last executing test programs: 45.502375681s ago: executing program 0 (id=228): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000000080)=0x1, 0x4) setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x8}, 0x1c) r2 = syz_usb_connect$rtl8150(0x3, 0x3f, &(0x7f00000003c0)={{0x12, 0x1, 0x110, 0xff, 0xff, 0x0, 0x40, 0xbda, 0x8150, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x5, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x7f, 0x3, 0xff, 0x11, 0x1, 0x5, "", {{0x9, 0x5, 0x81, 0x2, 0x40, 0x6, 0x9, 0x4}, {0x9, 0x5, 0x2, 0x2, 0x20, 0x2, 0x57, 0x6e}, {0x9, 0x5, 0x83, 0x3, 0x240, 0x3, 0x82, 0x8}}}}}}]}}, 0x0) syz_usb_control_io$rtl8150(r2, &(0x7f0000000580)={0x14, 0x0, &(0x7f0000000180)=ANY=[]}, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000001c0)={'vcan0\x00'}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'xfrm0\x00', 0x0}) sendto$packet(r3, &(0x7f0000000180)='_', 0x1, 0x20008801, &(0x7f0000000200)={0x11, 0x2, r4, 0x1, 0x0, 0x6, @broadcast}, 0x14) setsockopt$packet_drop_memb(r0, 0x107, 0x2, &(0x7f0000000200)={r4, 0x1, 0x6}, 0x10) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'ip_vti0\x00'}) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) setns(0xc9, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xb, 0x9}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x200b03, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000080)={'bond_slave_0\x00'}) r7 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) r8 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r8, &(0x7f0000000100), 0x12) listen(r8, 0x1) write$tun(r6, &(0x7f0000000400)=ANY=[@ANYRESDEC=r1, @ANYBLOB="ceede5be516954c76f425d7dd73ac79156692b02306c848e39fe29bfba892b8ac9f3910a49e5c1dbc3bab62c9facb6c50e2d9f73585152e61c6463a17bec8bc59ffe411718a4c6e6436073fd84d727cfc04dbdde50ab9a771dcfdefdc0a779c9d4aa90337a29b07b6c80f2d14580dfb730a26feae6afa056791a1953e4537fadf90c4ce790078817ea69cddb19911c1b70436e5addca6ff9c344bb1734c63dce17447301156a201645c47768775aa8746bcb0a2d43a191c17c41abe3ff7fadff01bd413183d3b22336d7fe82ff33196eb038238b1060fe758922a3cdd6275047e885e3e410910939fad003932d16d8943111ecab", @ANYRESDEC=r6], 0x88) r9 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x40980, 0x0) ioctl$TIOCSETD(r9, 0x5423, &(0x7f00000000c0)=0x12) ioctl$TCFLSH(r9, 0x400455c8, 0x80000000001) ioctl$TIOCSTI(r9, 0x5412, &(0x7f0000000080)=0x33) syz_open_dev$usbfs(&(0x7f0000000000), 0x76, 0x103901) 45.153401251s ago: executing program 3 (id=229): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) recvmmsg(r0, &(0x7f0000002e80)=[{{0x0, 0x0, 0x0}, 0x3fffff}, {{0x0, 0x0, 0x0}, 0x4}, {{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000001bc0)=""/4097, 0x1001}, {&(0x7f0000000180)=""/22, 0x16}, {&(0x7f0000003840)=""/172, 0xac}, {&(0x7f00000007c0)=""/151, 0x97}, {&(0x7f0000000a40)=""/103, 0x67}, {&(0x7f0000003ac0)=""/4096, 0x1000}, {&(0x7f0000004ac0)=""/27, 0x1b}], 0x7}, 0x19}], 0x3, 0x0, 0x0) (fail_nth: 7) 40.862342222s ago: executing program 3 (id=231): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x4, &(0x7f0000000080)=[{&(0x7f0000000200)="2e0400001c008104e00f80ecdb4cb9f207c804a00d000000880802fb0a0002000a0ada1b40d80800c500c50083b8", 0xfec9}], 0x1, 0x0, 0x0, 0x5865}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0x3, 0x2) bind$packet(0xffffffffffffffff, &(0x7f0000000240)={0x11, 0xf6}, 0x14) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) write$tun(r1, &(0x7f0000000240)=ANY=[], 0xfdef) 38.582398946s ago: executing program 0 (id=236): syz_usb_connect$cdc_ncm(0x6, 0xd1, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x107) mount(&(0x7f0000000100), &(0x7f0000000280)='./bus\x00', &(0x7f00000002c0)='9p\x00', 0x44, &(0x7f0000000100)='trans=rdma,\xd6\xd2\x1e\x80\xc2W\xbe\xbf\x16.\x84j\xea1.\x8e\xe9\xc7.p*\xd9\x94Mk\xb9\xc6\x9e\xcf\xd7\x9eoc\xe2(\x03\xc3.{\x8aY\x17\xd0\xa3\xfe\xe3/\xc4\f\b2t\x1c4\x93/^\x91\xe8\xabK\x9e\x14j\xb3\x92\x13\x80\x96m\xc7\x96\"\xcb\xdc\xcc\xd8\x18\"\x9eT\x97Kh5i\x8f\xfc\xd8=\x8b\xe9\x1b\xce\xe4\xf5$\xf1sa,\x8f\xb6\x89\xd9Z\xa0\xae>Xs=\xadu\x9aQ\xe2z\xaf\x90\x90\x9b\x92\x9b\xeb\aQb#\xec}\xa79\xd7\xe6<6\xadL\xd8$\xd3\xa9\x1d\xd9W\x8a\xb9F\x982%g!\x8a\"@*\xb8\xc6\xddw\xefY\xefJ\x0e\xc5%S\xf09\xde\x95l\xd9\x1cPp\xb3\xfe+rY\xc24\x99\x88\xe7\njs\xb2\x8f') syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text16={0x10, 0x0}], 0x1, 0x6d, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000380)) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000007c0)={[0x7, 0xc, 0x6, 0xfffffffffffffffd, 0x8, 0x5, 0x4, 0x2, 0x8, 0x4, 0x3, 0xffffffffffffffff, 0x1932be21, 0x100000000, 0x4, 0x4], 0xffffffff, 0x40e00}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x40, 0x3, 0x10, 0x0, 0x8, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x1, 0x0, 0x0, 0xfffffff8, 0x0, 0xff, 0xff, 0x1, '\x00', 0x3}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 37.989488803s ago: executing program 1 (id=238): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast2}, 0x10) r1 = socket$igmp(0x2, 0x3, 0x2) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) setsockopt$MRT_ADD_VIF(r1, 0x0, 0xca, &(0x7f00000000c0)={0x18, 0x8, 0x0, 0x6, @vifc_lcl_ifindex=r2, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe0}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000100)=0x2, 0x4) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='highspeed', 0x9) sendmmsg$inet(r0, &(0x7f0000001240), 0x0, 0x1) syz_open_dev$tty1(0xc, 0x4, 0x1) 37.007995068s ago: executing program 1 (id=239): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) recvmmsg(r0, &(0x7f0000006dc0)=[{{0x0, 0x0, 0x0}, 0x3fffff}, {{0x0, 0x0, 0x0}, 0x7}, {{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000001bc0)=""/4097, 0x1001}, {&(0x7f00000002c0)=""/46, 0x2e}, {&(0x7f0000000dc0)=""/201, 0xc9}, {&(0x7f0000003840)=""/172, 0xac}, {&(0x7f00000003c0)=""/151, 0x97}, {&(0x7f0000000a40)=""/103, 0x67}, {&(0x7f0000004b00)=""/4080, 0xff0}, {&(0x7f0000004ac0)=""/41, 0x29}], 0x8}, 0x1c}], 0x3, 0x0, 0x0) syz_usb_connect(0x3, 0x86, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002ffffff40cd060f010001010203010902740001010080fa0904"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev/ttyUSB0\x00', 0x2, 0x0) 34.935695085s ago: executing program 3 (id=241): r0 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, 0x0) ioctl$DRM_IOCTL_MODE_GETCRTC(r0, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r0, 0xc06864ce, &(0x7f0000000780)={r1, 0xfffffffd, 0x4, 0x0, 0x1, [], [0x2, 0x0, 0x2, 0xa], [0x0, 0x0, 0xfffffffc], [0x1, 0x0, 0x7]}) r2 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x22241) ioctl$DRM_IOCTL_MODE_GETFB2(r2, 0xc06864ce, &(0x7f0000000200)={r1, 0x6, 0x7, 0x7cfb, 0x3, [], [0xfffffffe, 0x7fff, 0x80000000, 0x2], [0x7, 0x7c479eff, 0x2, 0xffff], [0x8e, 0x4, 0xb583, 0x6]}) 33.39221861s ago: executing program 1 (id=242): shmctl$SHM_LOCK(0x0, 0xb) 32.113359153s ago: executing program 0 (id=244): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = syz_usb_connect$uac3(0x3, 0x97, &(0x7f0000000440)=ANY=[@ANYBLOB="12010003000000103d100001400001020301090285000301d8100c080b0102010130020904000000010130000a2401100a00070000000904010000010230000904010101010230000905010920010000030a2525ffffff7f0c8001090402000001023000090402010101023000172401060080000007000200000000000000064a0900100905820920"], &(0x7f0000000540)={0x0, 0x0, 0x52, 0x0}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000d40)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a09000000000000000000020000020900020073797a310000000008000440000000000900010073797a3000000000080003400000000114000000110001"], 0x64}}, 0x0) sendmsg$NFT_MSG_GETOBJ(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000002240)={&(0x7f0000000040)={0x1c, 0x15, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x1}, [@NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20040011}, 0x4004880) syz_usb_control_io$uac3(r0, &(0x7f0000000000)={0x14, 0x0, &(0x7f0000000180)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x10, 0x5ac, 0x242, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x80, 0x3, "", [{{0x9, 0x4, 0x0, 0x9, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x81, 0x3, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x6, 0xc1}}}}}]}}]}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_usb_connect$uac1(0x4, 0x0, 0x0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0xc07}}]}) syz_usb_control_io$uac3(r0, &(0x7f0000000100)={0x14, &(0x7f0000000300)={0x0, 0xe, 0x6, {0x6, 0xa, "c39aed3c"}}, 0x0}, 0x0) syz_usb_control_io$uac3(r0, &(0x7f0000000140)={0x14, &(0x7f0000000240)=ANY=[], 0x0}, 0x0) 32.102131559s ago: executing program 3 (id=245): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket(0x2a, 0xa, 0xfffffffd) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x43, 0x0, 0x0) r3 = syz_open_dev$swradio(&(0x7f0000000040), 0x1, 0x2) ioctl$VIDIOC_S_FREQUENCY(r3, 0x402c5639, &(0x7f00000000c0)={0x0, 0x4}) r4 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870f500090582020002"], 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000440)={0x900, 0x0, &(0x7f0000000400)={&(0x7f0000000040)={0x2, 0xa, 0xfc, 0x0, 0x2, 0x0, 0x70bd28, 0x25dfdbfe}, 0x10}}, 0x40408c0) syz_usb_ep_write$ath9k_ep1(r4, 0x82, 0xa8, &(0x7f0000000040)=ANY=[@ANYBLOB="6b0ee0b3d41b1b"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000380)={0x2, 0x0, @ioapic={0x0, 0x9, 0x2, 0xfffffffe, 0x0, [{0x2, 0x4, 0x87}, {0x84, 0x8, 0x8, '\x00', 0xf}, {0xff, 0x7f, 0xc3, '\x00', 0x69}, {0x40, 0x5, 0xf5, '\x00', 0xf}, {0x7, 0x7, 0xf5, '\x00', 0xb4}, {0xf, 0x4, 0x54, '\x00', 0xff}, {0x75, 0xd5, 0xf1, '\x00', 0x7f}, {0x7, 0x5, 0xc}, {0x7f, 0x5, 0x4a, '\x00', 0x8}, {0x8, 0xd, 0x8, '\x00', 0x6}, {0x0, 0xf9, 0x80, '\x00', 0x10}, {0xfb, 0x58, 0xff, '\x00', 0x1}, {0xfe, 0x7, 0x26}, {0xcf, 0x3, 0x1, '\x00', 0x6}, {0xe, 0xee, 0x7, '\x00', 0x3}, {0x39, 0x2, 0x6, '\x00', 0xb}, {0xd, 0x4, 0x2, '\x00', 0x9}, {0x4, 0x4, 0x5, '\x00', 0xed}, {0x7, 0x2, 0x7, '\x00', 0xc2}, {0x0, 0x80, 0xe, '\x00', 0x7f}, {0x1, 0xc, 0x83, '\x00', 0x7c}, {0x10, 0x6, 0x0, '\x00', 0x10}, {0x1, 0x3, 0xf3, '\x00', 0x4}, {0x5, 0x6, 0x4}]}}) 31.233018662s ago: executing program 1 (id=246): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000040), r0) sendmsg$NET_DM_CMD_STOP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, r1, 0x1, 0x70bd2c, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x8054}, 0x400c080) syz_emit_vhci(&(0x7f00000000c0)=@HCI_EVENT_PKT={0x4, @hci_ev_le_meta={{0x3e, 0x2}}}, 0x5) 28.833468975s ago: executing program 1 (id=247): r0 = syz_open_dev$MSR(&(0x7f0000000140), 0x7, 0x0) ioctl$X86_IOC_RDMSR_REGS(r0, 0xc02063a0, &(0x7f0000000180)=[0xf, 0x480, 0xb8, 0xa8a, 0x4, 0xe061, 0x5, 0x7]) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x20080, 0x0) r2 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) r3 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000700)={0x0, &(0x7f00000002c0)=[@uexit={0x0, 0x18, 0x7}, @wr_drn={0x68, 0x20, {0x4, 0x5}}, @nested_amd_clgi={0x17f, 0x10}, @nested_amd_inject_event={0x180, 0x38, {0x2, 0xb9, 0x4, 0x6, 0x1}}, @wr_drn={0x68, 0x20, {0x5, 0x5}}, @nested_amd_stgi={0x17e, 0x10}, @enable_nested={0x12c, 0x18}, @code={0xa, 0x60, {"66460f3837d9440f20c0350d000000440f22c00f01ca66b846000f00d866450f29f3c4417ae6be18000000260fde659866420f671b66baf80cb83206bc8def66bafc0c66b8009066efc4217970d600"}}, @nested_amd_clgi={0x17f, 0x10}, @in_dx={0x69, 0x20, {0x7c3, 0x2}}, @nested_amd_vmload={0x182, 0x18, 0x1}, @out_dx={0x6a, 0x28, {0x1e1d, 0x4, 0x1}}, @nested_vmlaunch={0x12f, 0x18, 0x1}, @nested_amd_invlpga={0x17d, 0x20, {0x1000, 0xd970}}, @wrmsr={0x65, 0x20, {0x3a2, 0x7ff}}, @out_dx={0x6a, 0x28, {0xa279, 0x7, 0x4}}, @nested_vmlaunch={0x12f, 0x18}, @wr_drn={0x68, 0x20, {0x6, 0x6}}, @nested_amd_vmsave={0x183, 0x18, 0xb17}, @nested_amd_vmload={0x182, 0x18, 0x3}, @wr_crn={0x67, 0x20, {0x3, 0x175b}}, @wrmsr={0x65, 0x20, {0x258, 0xffffffffffffffff}}, @nested_vmresume={0x130, 0x18, 0x1}, @uexit={0x0, 0x18, 0x1dfc}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x3, @host16=0xc0a, 0x8, 0x6, 0x40}}, @in_dx={0x69, 0x20, {0x9, 0x2}}, @nested_amd_set_intercept={0x181, 0x20, {0x3, 0x9, 0x8, 0x1}}, @nested_amd_stgi={0x17e, 0x10}, @nested_load_code={0x12e, 0x7c, {0x3, "654d0fc7ae6cd10000f00fb13742d80f0f01c9c744240072cb0000c744240200500000c7442406000000000f0114240f20c035000000400f22c0470f0098783d0000c74424001a010000c744240200000000ff1c242e3ef30f0966ba400066b8070066ef"}}, @cpuid={0x64, 0x18, {0x80000001, 0x4f}}], 0x41c}) mmap$KVM_VCPU(&(0x7f0000ff9000/0x7000)=nil, r2, 0x2, 0x12, r3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000340)={'vlan0\x00', &(0x7f0000000700)=@ethtool_sfeatures={0x3b, 0x2, [{0x3b, 0x1}, {0x4, 0x3}]}}) r5 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r3, 0xc020f509, &(0x7f0000000040)={r3, 0xffffffffffffffcb, 0xffffffffffffffc4}) ioctl$KVM_GET_SREGS2(r7, 0x8140aecc, &(0x7f0000000740)) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x33, &(0x7f0000000100)=[{&(0x7f0000000000)=',', 0x5ac}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000200)={[0xc45, 0x9, 0xfffffffffffffffd, 0x10000000, 0x10000, 0x3, 0x4002004c2, 0x7ff, 0x9, 0x0, 0x400, 0x80, 0x89, 0x0, 0x8, 0x8d], 0x100000, 0x240046}) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 26.982926894s ago: executing program 0 (id=249): ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x20080, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x33, &(0x7f0000000100)=[{&(0x7f0000000000)=',', 0x5ac}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0xc45, 0x9, 0xfffffffffffffffd, 0x10000000, 0x10000, 0x3, 0x4002004c2, 0x7ff, 0x9, 0x0, 0x400, 0x80, 0x89, 0x0, 0x8, 0x8d], 0x100000, 0x240046}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x40000) 22.570239116s ago: executing program 0 (id=250): r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000000)={0x18, 0x0, {0x100, @empty, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000040)) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl(r1, 0x40047438, &(0x7f0000000040)) ioctl(r1, 0x4004743c, 0x0) 22.463992154s ago: executing program 3 (id=251): r0 = socket$kcm(0x2a, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={&(0x7f00000000c0)=@qipcrtr={0x2a, 0xffffffffffffffff, 0xfffffffe}, 0x80, 0x0}, 0x0) sendmsg$kcm(r0, &(0x7f0000001540)={&(0x7f0000000040)=@qipcrtr={0x2a, 0x1, 0x4000}, 0x80, 0x0}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) timer_create(0x9, &(0x7f0000000000)={0x0, 0x8, 0x1}, &(0x7f0000000040)=0x0) timer_settime(0x0, 0x0, &(0x7f0000000700)={{}, {0x77359400}}, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x206, 0x20182) ioctl$USBDEVFS_SETINTERFACE(r2, 0x80085504, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f00000000c0)={0x2, {0x2, 0x300, 0x400, 0x103}}) mkdir(&(0x7f0000000080)='./file1\x00', 0x8) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(&(0x7f00000000c0)='./file1\x00') r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='blkio.bfq.sectors\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r4, 0xffffffff80000800, 0x0, &(0x7f0000000340)={0x803, 0x5, 0x7fffffff, 0x3, 0x1, 0x6, 0x6, 0x2, 0x4}) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) r5 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r5, &(0x7f0000000140)={0x28, 0x0, 0x2710, @host}, 0x10) r6 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) r7 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010027bd7000fbd3df2502000000050004000100000005000400010000001400020076657468315f746f5f7465616d0000000900030073797a32000000000900010073"], 0x68}, 0x1, 0x0, 0x0, 0x4000145}, 0x0) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r5, 0x28, 0x6, &(0x7f0000000100)={0x0, 0xea60}, 0x10) connect$vsock_stream(r5, &(0x7f0000000300)={0x28, 0x0, 0xffffffff}, 0x10) connect$vsock_stream(r5, 0x0, 0x0) connect$vsock_stream(r5, &(0x7f0000000000)={0x28, 0x0, 0x2711, @hyper}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x140) getdents(r4, &(0x7f0000000180)=""/45, 0x2d) timer_delete(r1) mount$overlay(0x0, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000440), 0x8, &(0x7f0000000200)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@redirect_dir_nofollow}]}) 22.004000819s ago: executing program 2 (id=252): r0 = syz_usb_connect(0x2, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000406d0492080001000000010902220001010080320904"], &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000002c0)={0x14, &(0x7f0000000140)={0x0, 0x21, 0x101, {0x101, 0x23, "3b78db5656b70badccc1a10ab74f18d89f08a2e4fddd6c1dfac9ac2ba44352a8978a9105c2a0b2ec01ba40f1de439b582a877d7cd6a43159bf0a8ec66ecc71ace51d9d22367b45240c08cc3d6495fda10f64d3211f42f529a22e1672e05039bb6a02750defddb32a7467529f32edae860499fc9b8341043b30c6efa256b176f37f6062aea6dbeba35a3d68f051208315ef2bf5e46a05b1f590c6b65bc8ec4168f610dbafe228f89f6cec18675bb230ea1446c426faec925623176a89beeb80bc3754fe419a01c0d7d135eaa718928d222936563e2d1893c306b43d8f1383271c38d66e732d4be4f78b974a883b95efe983e408eb1b7134345bac09846e07fd"}}, &(0x7f0000000280)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000400)={0x1c, &(0x7f0000000300)={0x20, 0x7, 0x43, "2b476018f4c516ea39f4f4c911666206ca0cf7af4962eb898865db8d0f7c34c0cb6cdd43eef82105cc923bd2f848397e25175ee47f025b677056db1879a9d33c28aeeb"}, &(0x7f0000000380)={0x0, 0xa, 0x1, 0x6}, &(0x7f00000003c0)={0x0, 0x8, 0x1, 0x3}}) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)={0x84, &(0x7f0000000880)=ANY=[@ANYBLOB="0000010000003020e44a4f3be36773b38ffcd6ed90950d63950d6c28a83273cd7e5fcf36f7df99cdc406ce82ee6cb965df73f50437563fb57b052ab3655e3ab8b6877f52e78df4f47b6b9be4742d6f6a716dfc6e03d71fa9d3a184b026cc25e862f5fd9067a4ed1cf3e6d06a9bf339cee3682b8d214ab0195e741fc9475528b8beedbfdf2761eda999ce"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, &(0x7f0000000580)={0x14, &(0x7f0000000440)={0x20, 0x22, 0xcd, {0xcd, 0xc, "e92ac92ab6188ff28324d4b4330ad6ad4bf75c90d6b0a5c00dd09ebc0e6357bd23de07cb9898d471bd59b89bf0715431249c669bc1adfba2980c12064b7d089d45e1e98f33cfafb3fdfe4219ea9104d9860e2af0dddf6dfa86bdacdc47e83edc887221d33be2eb697f3fe5470c7c2b14c7c478e768887a60f44ee4efb37e4f858a913467fbfad018a9e604a2a9af1211f05392d6d5958371b89e7f1ca383fb23a143ba45cd297feb1a56a36d2078c9264cc9b87d73310d3190c2e5c21a76607fd2b0bb1f8896e1102003aa"}}, &(0x7f0000000080)={0x0, 0x3, 0x4a, @string={0x4a, 0x3, "73d0a0235b4f79cf42998861646defa9ea8a2d492a953ad4a92be485f7e2b5161fe53664d81d6620995b55152df18f8e071249a3b2b1915d149bca5323ade3a2f23bc942c3e8cc26"}}}, &(0x7f0000000840)={0x34, &(0x7f00000005c0)={0x0, 0x0, 0xf0, "025833bd25834fea636a8876c298a1c7658cf8c0387eebcfd58f873251271e4b4e800f8fb7739dc891986daba276c185d8aacc2a248583f3b134956597b47d94bec2d14479bda341ad73d2db3b53f4abc4daa0bc52218016306bb9f4b3b2835bca07e434825e57d19e37baea7f4b36866d9d1c3a8af367ed28306b33f5013a72e0da345b8bfd01aa50408d14d57160071ab0d890fc0b8711fe30c6566e3135760dc3d8f401082c6ff744385d89edee51dbcbe6ab38ba7c49aec021ca043b3d27b91438d0fc710fc92bd3d71e72797551518d2b13b62e65e47b2367ac04ad1aaa215e08dcaa73e6f054e1a53a7c75b971"}, &(0x7f00000006c0)={0x0, 0xa, 0x1, 0x44}, &(0x7f0000000740)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000000780)={0xc0, 0xa1, 0x4, 0x5}, &(0x7f00000007c0)={0x40, 0xa0, 0x4, 0x6}, &(0x7f0000000800)={0xc0, 0xa2, 0x2f, "95114e0b93e37106e86de468de298173afb68d6bd8cbefff8a45759a18377a10bbb603ab5acab5cf5b2451e1b789ba"}}) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000100), 0x62600, 0x0) file_getattr(r1, 0x0, &(0x7f0000000040), 0x18, 0x1000) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)) syz_usb_control_io(r0, 0x0, 0x0) 21.010296549s ago: executing program 1 (id=253): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000002080)={0x1f, 0x21}, 0xe) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket(0x10, 0x3, 0x0) pipe2$9p(&(0x7f0000000000)={0x0, 0x0}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount$9p_fd(0x0, &(0x7f0000000200)='./mnt\x00', &(0x7f0000000240), 0x0, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r4}}) (async) nanosleep(&(0x7f0000000000)={0x0, 0x10000000}, 0x0) write$P9_RVERSION(r4, &(0x7f0000000040)={0x15, 0x65, 0xffff, 0x2000, 0x8, '9P2000.L'}, 0x15) nanosleep(&(0x7f0000000000)={0x0, 0x10000000}, 0x0) write$P9_RATTACH(r4, &(0x7f0000000080)={0x14, 0x69, 0x0, {0x80}}, 0x14) nanosleep(&(0x7f0000000000)={0x0, 0x10000000}, 0x0) write$P9_RGETATTR(r4, &(0x7f00000000c0)={0xa0, 0x19, 0x1, {0x3fff, {0x80}, 0x41ed, 0x0, 0x0, 0x1, 0x0, 0x1000, 0x1000, 0x8}}, 0x9f) nanosleep(&(0x7f0000000000)={0x0, 0x10000000}, 0x0) openat(0xffffffffffffff9c, &(0x7f00000002c0)='./mnt/file\x00', 0x42, 0x1ff) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setgroups(0x0, 0x0) setregid(0xffffffffffffffff, r5) socket$inet6_icmp(0xa, 0x2, 0x3a) r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_POOL_GET(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x44, r6, 0xa2276ad8371ec5c7, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x2}, {0x6, 0x11, 0xfffe}}]}, 0x44}, 0x1, 0x0, 0x0, 0x24000040}, 0x800) 20.145738655s ago: executing program 0 (id=254): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = msgget$private(0x0, 0x0) msgrcv(r2, &(0x7f0000000340)={0x0, ""/55}, 0x3f, 0x0, 0x0) close(r1) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r3, &(0x7f0000000040)={0x10, 0x0, 0x25dfdbfd, 0x2}, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c0001800600010000000000080003400000000114000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000810}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c000180060001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)={{0x14}, [@NFT_MSG_NEWSET={0x48, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7, 0x0, 0x3}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFTA_SET_TIMEOUT={0xc, 0xb, 0x1, 0x0, 0x9c}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x70}}, 0x20050800) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x9}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x6}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0xa}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}, @NFTA_BITWISE_XOR={0x4}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x10c}}, 0x0) 17.134291579s ago: executing program 2 (id=255): sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={0x0, 0x70}, 0x1, 0x7}, 0x0) r0 = semget$private(0x0, 0x7, 0x191) semtimedop(r0, &(0x7f0000000200)=[{0x0, 0xffff, 0x2000}, {0x4, 0x3, 0x1800}], 0x2, 0x0) semop(r0, &(0x7f0000000040)=[{0x1, 0xe8c7, 0x1000}], 0x1) semctl$SETVAL(r0, 0x0, 0x10, &(0x7f0000000080)=0x4) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220f000000040b2100000095f5758483"], 0x0}, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000740)={0x20, 0xc, 0x2, "3edf"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) ioctl$HIDIOCGUSAGES(r2, 0xd01c4813, 0x0) 15.302445331s ago: executing program 3 (id=256): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000140)={0xcf47, 0x19, 0x7, 0x9dff, 0x7, "8003e3ffff072000"}) write$binfmt_aout(r0, &(0x7f0000000140)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x3, 0x7fff, 0x16, "b0bfac0000000003000018bfff4000"}) r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="130100002add1e20ef050a023691010203010902240001000000000904000002ea1998000905a6a7f5ecf56c00090507", @ANYRES32=r0], 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000340)=ANY=[@ANYBLOB="00054fdff77a92017193394ec3780c9c41cdb0fe1e054be66f058a4ce0e4c3fdda5d2cd438e9648aa3578cbbf6c05a0d103bc6a850b679d34fb91c99eeb8ce92fc1c3250ef95fe7be67c596e5dd9bf621db952"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_open_pts(r0, 0x200) r3 = dup3(r2, r0, 0x0) ioctl$TIOCSTI(r3, 0x5412, &(0x7f00000000c0)=0xff) ioctl$VIDIOC_G_CROP(r3, 0xc014563b, &(0x7f00000002c0)={0xb, {0x2, 0x0, 0x1, 0x9}}) ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000080)=0xa) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r3, 0xc040564a, &(0x7f0000000000)={0x3329, 0x0, 0x200f, 0x2, 0x7, 0x2, 0x2, 0x1}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000840), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f00000008c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_FRAME_RETRIES(r5, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r6, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r7}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20080080}, 0x0) r8 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r9 = socket(0x10, 0x3, 0x0) setreuid(0xee01, 0xee01) setsockopt$sock_int(r9, 0x1, 0x21, &(0x7f0000b4bffc)=0x8, 0x4) ioctl$KVM_SET_IRQCHIP(r8, 0xc048aec8, &(0x7f0000000080)={0x1, 0x0, @ioapic={0x0, 0x0, 0x0, 0x0, 0x0, [{}, {}, {}, {}, {}, {0x0, 0x4, 0x0, '\x00', 0x1}, {0x0, 0xff}, {}, {0x0, 0x3}, {0x0, 0x0, 0x9}, {}, {}, {}, {0x20}, {}, {}, {0x3}, {}, {}, {}, {}, {0x6}, {}, {0x0, 0x0, 0x40}]}}) 10.471044847s ago: executing program 2 (id=257): r0 = syz_open_dev$sg(&(0x7f0000000000), 0xffffffffffffff0f, 0x321801) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000040)) (async) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000080)='syz0\x00', 0x1ff) r1 = socket$inet_sctp(0x2, 0x1, 0x84) (async) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x5}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r1, 0x84, 0x17, &(0x7f0000000140)={r2, 0x3, 0x37, "de45eddb7fdddac9432af75dfc57888c018b0d885d8e781c0b98230ee339e2b2027a8be6a71b54b6b8705de9e247bbd17eb26bf31ad902"}, 0x3f) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000180)={r2, @in6={{0xa, 0x4e22, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x4}}, 0xfffffff9, 0x8, 0x0, 0xfffffffc, 0x40, 0x7, 0x9}, &(0x7f0000000240)=0x9c) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000280)={0xc0, 0x6, 0x8000, 0x3, 0x10, 0x800, 0xe, 0x4b, r3}, 0x20) (async) ioctl$BTRFS_IOC_QUOTA_CTL(r1, 0xc0109428, &(0x7f00000002c0)={0x2, 0x9}) (async) ioctl$NILFS_IOCTL_SYNC(0xffffffffffffffff, 0x80086e8a, 0x0) (async) r4 = dup(0xffffffffffffffff) (async) r5 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) fcntl$getflags(r5, 0x401) (async) ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000340)={0x1, 0x101, 0x1, {0x50, 0x1, 0x8001, 0x2}}) (async) add_key$fscrypt_v1(&(0x7f0000000380), &(0x7f00000003c0)={'fscrypt:', @auto=[0x30, 0x34, 0x65, 0x31, 0x36, 0x37, 0x61, 0x64, 0x64, 0x31, 0x32, 0x33, 0x52, 0x34, 0x31, 0x34]}, &(0x7f0000000400)={0x0, "563f68bd19aa3fe60ed3f08e6bc0f189b20ad61a94c915f957e5736b3bd93f07086594a2b070d6ce037cbf530c74e524609888e66e160af6e8cd1d4b21e21dcb", 0x14}, 0x48, 0xffffffffffffffff) (async) ioctl$FAT_IOCTL_GET_ATTRIBUTES(r0, 0x80047210, &(0x7f0000000480)) (async) r6 = accept$inet6(r4, &(0x7f00000004c0)={0xa, 0x0, 0x0, @empty}, &(0x7f0000000500)=0x1c) getsockopt$inet6_mtu(r6, 0x29, 0x17, &(0x7f0000000540), &(0x7f0000000580)=0x4) (async) r7 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0), 0x2002, 0x0) ioctl$CEC_RECEIVE(0xffffffffffffffff, 0xc0386106, &(0x7f0000000600)={0xfffffffffffffff3, 0x5, 0x0, 0x1ff, 0x0, 0x4632, "52e2d5db0bee55dcd56ccf289d4c5a8f", 0x0, 0x81, 0x7f, 0x60, 0x4f, 0x43, 0x6}) (async) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, &(0x7f0000000d00)=@broute={'broute\x00', 0x20, 0x4, 0x668, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000680], 0x0, &(0x7f0000000640), &(0x7f0000000680)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{0x3, 0x18, 0x88b5, 'pimreg1\x00', 'gre0\x00', 'erspan0\x00', 'ip6tnl0\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x18}, [0x0, 0x0, 0xff, 0xff, 0xff], @multicast, [0x0, 0x0, 0xff, 0x390b45be2511648], 0x10e, 0x176, 0x1a6, [@connlabel={{'connlabel\x00', 0x0, 0x8}, {{0x5, 0x1}}}, @rateest={{'rateest\x00', 0x0, 0x48}, {{'macvlan1\x00', 'virt_wifi0\x00', 0x2b, 0x0, 0x5, 0x8d3e, 0x2, 0x400, {0xfffffffffffffffe}, {0x7ff}}}}], [@common=@dnat={'dnat\x00', 0x10, {{@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, 0xfffffffffffffffc}}}, @common=@CLASSIFY={'CLASSIFY\x00', 0x8, {{0x7}}}], @common=@redirect={'redirect\x00', 0x8, {{0xffffffffffffffff}}}}, {0x9, 0x3c, 0x5, 'netpci0\x00', 'veth1_macvtap\x00', 'dvmrp1\x00', 'ip_vti0\x00', @random="256e702e9484", [0xff, 0xff, 0x0, 0xff, 0x0, 0x868b2f2d60ee4ef5], @remote, [0x0, 0xff, 0x0, 0xff, 0xff, 0xff], 0xe6, 0xe6, 0x216, [@connlabel={{'connlabel\x00', 0x0, 0x8}, {{0x8000}}}, @ip={{'ip\x00', 0x0, 0x20}, {{@local, @broadcast, 0xffffffff, 0xffffffff, 0x80, 0x55, 0x8, 0x0, 0x4e21, 0x4e22, 0x4e22, 0x4e23}}}], [], @common=@SECMARK={'SECMARK\x00', 0x108, {{0x1, 0x80, 'system_u:object_r:etc_mail_t:s0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x2, [{0x5, 0x64, 0x8864, 'ipvlan1\x00', 'batadv0\x00', 'pimreg1\x00', 'batadv_slave_1\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1d}, [0xff, 0x0, 0xff], @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2d}, [0xff, 0xff, 0x0, 0xff, 0x0, 0xff], 0xde, 0x10e, 0x13e, [@rateest={{'rateest\x00', 0x0, 0x48}, {{'nr0\x00', 'nr0\x00', 0x35, 0x3, 0x8de, 0x5, 0x80000001, 0xefe5, {0x8}, {0x5}}}}], [@common=@CONNSECMARK={'CONNSECMARK\x00', 0x8, {{0x1}}}], @common=@CONNSECMARK={'CONNSECMARK\x00', 0x8, {{0x1}}}}, {0x3, 0x8, 0x8863, 'veth0_macvtap\x00', 'pim6reg0\x00', 'wg1\x00', 'vlan1\x00', @remote, [0xff, 0x7af0a6dab3ecc6eb, 0xff, 0xff, 0xff, 0xff], @multicast, [0xff, 0x0, 0xff, 0x0, 0xff], 0xae, 0xae, 0xde, [@quota={{'quota\x00', 0x0, 0x18}, {{0x0, 0x0, 0x6, {0x1ff}}}}], [], @common=@redirect={'redirect\x00', 0x8, {{0xfffffffffffffffe}}}}]}]}, 0x6e0) ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000d80)=0x2) (async) pipe2(&(0x7f0000000dc0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4800) inotify_add_watch(r8, &(0x7f0000000e00)='./file0\x00', 0x828) ioctl$VIDIOC_G_INPUT(r7, 0x80045626, &(0x7f0000000e40)) (async) ioctl$VHOST_NET_SET_BACKEND(r8, 0x4008af30, &(0x7f0000000e80)={0x2, r7}) (async) syz_open_dev$tty1(0xc, 0x4, 0x1) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000ec0), 0x402001, 0x0) (async) r9 = syz_genetlink_get_family_id$gtp(&(0x7f0000000f40), r4) sendmsg$GTP_CMD_GETPDP(r4, &(0x7f00000010c0)={&(0x7f0000000f00)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001080)={&(0x7f0000001000)={0x54, r9, 0x10, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_MS_ADDRESS={0x8, 0x5, @multicast1}, @GTPA_FAMILY={0x5, 0xd, 0x9}, @GTPA_MS_ADDR6={0x14, 0xc, @local}, @GTPA_TID={0xc, 0x3, 0x2}, @GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_LINK={0x8}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000060}, 0x24002004) 10.17803842s ago: executing program 2 (id=258): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="04230d00c9"], 0x10) read$char_usb(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$uac2(0x5, 0x98, &(0x7f0000000040)=ANY=[@ANYBLOB="1201100300000010351212824000010203010902860003010d5003080b00010108209809040000000101200009240106000626006e0c240303010105030251c70011240202"], &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0}) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000086021440f4151500bffd010203010902120001010000000904"], 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="e400000044000701fefffffffcdbdf25037c000004004580c900018004006480e7df25275c25d5d303873ef5ffc787"], 0xe4}, 0x1, 0x0, 0x0, 0x20000010}, 0xc000) 5.791609666s ago: executing program 32 (id=253): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000002080)={0x1f, 0x21}, 0xe) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket(0x10, 0x3, 0x0) pipe2$9p(&(0x7f0000000000)={0x0, 0x0}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount$9p_fd(0x0, &(0x7f0000000200)='./mnt\x00', &(0x7f0000000240), 0x0, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r4}}) (async) nanosleep(&(0x7f0000000000)={0x0, 0x10000000}, 0x0) write$P9_RVERSION(r4, &(0x7f0000000040)={0x15, 0x65, 0xffff, 0x2000, 0x8, '9P2000.L'}, 0x15) nanosleep(&(0x7f0000000000)={0x0, 0x10000000}, 0x0) write$P9_RATTACH(r4, &(0x7f0000000080)={0x14, 0x69, 0x0, {0x80}}, 0x14) nanosleep(&(0x7f0000000000)={0x0, 0x10000000}, 0x0) write$P9_RGETATTR(r4, &(0x7f00000000c0)={0xa0, 0x19, 0x1, {0x3fff, {0x80}, 0x41ed, 0x0, 0x0, 0x1, 0x0, 0x1000, 0x1000, 0x8}}, 0x9f) nanosleep(&(0x7f0000000000)={0x0, 0x10000000}, 0x0) openat(0xffffffffffffff9c, &(0x7f00000002c0)='./mnt/file\x00', 0x42, 0x1ff) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setgroups(0x0, 0x0) setregid(0xffffffffffffffff, r5) socket$inet6_icmp(0xa, 0x2, 0x3a) r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_POOL_GET(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x44, r6, 0xa2276ad8371ec5c7, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x2}, {0x6, 0x11, 0xfffe}}]}, 0x44}, 0x1, 0x0, 0x0, 0x24000040}, 0x800) 5.493249067s ago: executing program 2 (id=260): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = dup(r0) write$UHID_INPUT(r1, &(0x7f0000000000)={0xf, {"a2e3ad21ed0d09f91b5f090987f70906d038e7ff7fc6e5539b0d3d0e8b089b3f31006e090890e0878f0e1ac6e7049b334a959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070b074a0936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b6080000007a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb15da202d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) r2 = socket$kcm(0xa, 0x2, 0x3a) recvmsg(r2, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x2002) r3 = syz_open_dev$sndpcmc(&(0x7f0000001100), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r3, 0xc2604111, &(0x7f0000000400)={0x0, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0x8, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) ioctl$SNDRV_PCM_IOCTL_READI_FRAMES(r3, 0x80184151, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002040), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x0, &(0x7f0000002100)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x4000}}) openat$dir(0xffffffffffffff9c, &(0x7f0000002180)='./file0\x00', 0x0, 0x0) syz_fuse_handle_req(r4, &(0x7f00000021c0), 0x2000, &(0x7f00000041c0)={&(0x7f0000004280)={0x50}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r4, &(0x7f0000004300), 0x2000, &(0x7f0000006300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000063c0)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_connect(0x2, 0xb3, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ef0201406d0425080001000000010902a1000201008032080b00020e03000009040000000e0100000d240100012700006cdc020101112402010102000000000000000002000009240302010100010009040100000e0200000e240101470081000200000001001b2404"], &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0}) syz_usb_connect(0x0, 0x2d, &(0x7f0000001040)=ANY=[@ANYBLOB="1201000041436120410e5150e8d50000aaf5ca05185887b10401162896b8ed225dcf30c1a3a10e6d345325bf2c0e5fbeca81e7c32b0b7606cb2f122dcc25340abfaa7c98928eeb0c2b67e5921aeecde02f96157b41f181b21bc5916e99aa8ec02a8c3f72b3471dcb2f8184039a06c1b5a1fea58dec9d6d9593383de3bb02c70bb008b5f35a408e6f9c8dd0eb58ce8ab7a4f159f7797cbb703c67ceda9379a4404e76e7832f2f7f"], 0x0) 4.174395777s ago: executing program 33 (id=254): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = msgget$private(0x0, 0x0) msgrcv(r2, &(0x7f0000000340)={0x0, ""/55}, 0x3f, 0x0, 0x0) close(r1) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r3, &(0x7f0000000040)={0x10, 0x0, 0x25dfdbfd, 0x2}, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c0001800600010000000000080003400000000114000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000810}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c000180060001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)={{0x14}, [@NFT_MSG_NEWSET={0x48, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7, 0x0, 0x3}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFTA_SET_TIMEOUT={0xc, 0xb, 0x1, 0x0, 0x9c}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x70}}, 0x20050800) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x9}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x6}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0xa}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}, @NFTA_BITWISE_XOR={0x4}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x10c}}, 0x0) 452.11963ms ago: executing program 2 (id=262): r0 = socket$can_raw(0x1d, 0x3, 0x1) r1 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_LOOPBACK(r1, 0x65, 0x3, &(0x7f00000000c0), 0x4) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = socket$inet_sctp(0x2, 0x5, 0x84) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000011c0)=[{&(0x7f0000000500)="5c00000013006bcc9e3be35c6e17aa31076b", 0x12}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x4044) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r5, 0x10e, 0xc, &(0x7f0000000000)=0x4, 0x4) sendmsg$netlink(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000500)=ANY=[@ANYBLOB="30000000120001e7"], 0x30}], 0x1}, 0x0) r6 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r6, &(0x7f0000000040)={0xa, 0x4e22, 0x4ec, @private2={0xfc, 0x2, '\x00', 0x2}, 0x5}, 0x1c) setrlimit(0x40000000000008, &(0x7f0000000000)) capset(&(0x7f0000000040)={0x20071026}, &(0x7f00000000c0)={0x200000, 0x200000, 0x40000007, 0x0, 0x0, 0x2}) setsockopt$sock_linger(r6, 0x1, 0x3c, &(0x7f0000000100)={0x200000000000001}, 0x8) close(0xffffffffffffffff) sendto$inet6(r6, 0x0, 0x0, 0xb11476cb04580b09, 0x0, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000001a40)=[@in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}}], 0x10) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r4, 0x84, 0x6d, &(0x7f0000000580)={0x0, 0x10, "d5a2e4c6663c099aaba4e2695ec12c29"}, &(0x7f0000000040)=0x18) ioctl$IOCTL_VMCI_VERSION2(r3, 0x7a7, &(0x7f0000000080)=0xa0000) prctl$PR_SET_SECUREBITS(0x1c, 0x19) ioctl$IOCTL_VMCI_INIT_CONTEXT(r3, 0x7a0, &(0x7f0000000000)={@my=0x0, 0x1}) request_key(&(0x7f0000000540)='keyring\x00', &(0x7f0000001ffb)={'syz', 0x0}, 0x0, 0xfffffffffffffffa) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) r8 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_RTHDR(r8, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="290404000000000000000000000000000000000000000000ff010000140000000000000000000001"], 0x28) close_range(r7, 0xffffffffffffffff, 0x200000000000000) bind$can_raw(r0, &(0x7f00000001c0)={0x1d, r2}, 0x10) setsockopt$CAN_RAW_RECV_OWN_MSGS(r0, 0x65, 0x4, &(0x7f0000000040)=0x1, 0x4) sendmsg$can_raw(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000580)=@can={{0x4, 0x0, 0x0, 0x1}, 0x5, 0x1, 0x0, 0x0, "71949a1857e8bcf3"}, 0x10}, 0x1, 0x0, 0x0, 0x40}, 0xd209f6d81082d3d6) 0s ago: executing program 34 (id=256): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000140)={0xcf47, 0x19, 0x7, 0x9dff, 0x7, "8003e3ffff072000"}) write$binfmt_aout(r0, &(0x7f0000000140)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x3, 0x7fff, 0x16, "b0bfac0000000003000018bfff4000"}) r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="130100002add1e20ef050a023691010203010902240001000000000904000002ea1998000905a6a7f5ecf56c00090507", @ANYRES32=r0], 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000340)=ANY=[@ANYBLOB="00054fdff77a92017193394ec3780c9c41cdb0fe1e054be66f058a4ce0e4c3fdda5d2cd438e9648aa3578cbbf6c05a0d103bc6a850b679d34fb91c99eeb8ce92fc1c3250ef95fe7be67c596e5dd9bf621db952"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_open_pts(r0, 0x200) r3 = dup3(r2, r0, 0x0) ioctl$TIOCSTI(r3, 0x5412, &(0x7f00000000c0)=0xff) ioctl$VIDIOC_G_CROP(r3, 0xc014563b, &(0x7f00000002c0)={0xb, {0x2, 0x0, 0x1, 0x9}}) ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000080)=0xa) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r3, 0xc040564a, &(0x7f0000000000)={0x3329, 0x0, 0x200f, 0x2, 0x7, 0x2, 0x2, 0x1}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000840), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f00000008c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_FRAME_RETRIES(r5, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r6, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r7}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20080080}, 0x0) r8 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r9 = socket(0x10, 0x3, 0x0) setreuid(0xee01, 0xee01) setsockopt$sock_int(r9, 0x1, 0x21, &(0x7f0000b4bffc)=0x8, 0x4) ioctl$KVM_SET_IRQCHIP(r8, 0xc048aec8, &(0x7f0000000080)={0x1, 0x0, @ioapic={0x0, 0x0, 0x0, 0x0, 0x0, [{}, {}, {}, {}, {}, {0x0, 0x4, 0x0, '\x00', 0x1}, {0x0, 0xff}, {}, {0x0, 0x3}, {0x0, 0x0, 0x9}, {}, {}, {}, {0x20}, {}, {}, {0x3}, {}, {}, {}, {}, {0x6}, {}, {0x0, 0x0, 0x40}]}}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.71' (ED25519) to the list of known hosts. [ 91.900039][ T10] cfg80211: failed to load regulatory.db [ 92.770872][ T5576] cgroup: Unknown subsys name 'net' [ 92.998472][ T5576] cgroup: Unknown subsys name 'cpuset' [ 93.077055][ T5576] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 95.061615][ T5576] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 99.153578][ T5601] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 99.154843][ T5601] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 99.179511][ T5601] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 99.184656][ T5601] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 99.185393][ T5601] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 99.186115][ T5601] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 99.190166][ T5601] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 99.194334][ T5601] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 99.204178][ T5601] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 99.204661][ T5601] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 99.219331][ T5601] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 99.220239][ T5601] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 99.229108][ T60] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 99.229530][ T5601] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 99.252888][ T5608] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 99.326148][ T5610] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 99.331017][ T5610] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 99.358104][ T5608] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 99.358358][ T5608] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 99.425107][ T5608] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 101.470760][ T5600] Bluetooth: hci2: command tx timeout [ 101.470889][ T5600] Bluetooth: hci1: command tx timeout [ 101.626561][ T4904] Bluetooth: hci0: command tx timeout [ 101.626792][ T5600] Bluetooth: hci3: command tx timeout [ 101.718916][ T5595] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.719908][ T5595] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.720126][ T5595] bridge_slave_0: entered allmulticast mode [ 101.723261][ T5595] bridge_slave_0: entered promiscuous mode [ 101.771698][ T5594] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.771960][ T5594] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.772178][ T5594] bridge_slave_0: entered allmulticast mode [ 101.774782][ T5594] bridge_slave_0: entered promiscuous mode [ 101.822065][ T5595] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.822336][ T5595] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.822816][ T5595] bridge_slave_1: entered allmulticast mode [ 101.825365][ T5595] bridge_slave_1: entered promiscuous mode [ 101.863552][ T5594] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.863805][ T5594] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.864014][ T5594] bridge_slave_1: entered allmulticast mode [ 101.866836][ T5594] bridge_slave_1: entered promiscuous mode [ 101.957282][ T5593] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.957607][ T5593] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.957867][ T5593] bridge_slave_0: entered allmulticast mode [ 101.961023][ T5593] bridge_slave_0: entered promiscuous mode [ 102.033985][ T5593] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.034439][ T5593] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.035043][ T5593] bridge_slave_1: entered allmulticast mode [ 102.058265][ T5593] bridge_slave_1: entered promiscuous mode [ 102.075574][ T5595] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.144232][ T5594] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.174297][ T5595] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.174748][ T5596] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.175026][ T5596] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.175233][ T5596] bridge_slave_0: entered allmulticast mode [ 102.200800][ T5596] bridge_slave_0: entered promiscuous mode [ 102.220053][ T5594] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.262304][ T5596] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.262569][ T5596] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.262787][ T5596] bridge_slave_1: entered allmulticast mode [ 102.265357][ T5596] bridge_slave_1: entered promiscuous mode [ 102.315610][ T5593] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.382138][ T5593] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.387399][ T5595] team0: Port device team_slave_0 added [ 102.423238][ T5594] team0: Port device team_slave_0 added [ 102.450790][ T5595] team0: Port device team_slave_1 added [ 102.463050][ T5596] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.470807][ T5594] team0: Port device team_slave_1 added [ 102.529133][ T5596] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.562998][ T5593] team0: Port device team_slave_0 added [ 102.627726][ T5593] team0: Port device team_slave_1 added [ 102.630710][ T5595] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 102.630730][ T5595] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.630749][ T5595] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 102.692266][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 102.692278][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.692298][ T5594] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 102.748336][ T5595] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 102.748348][ T5595] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.748367][ T5595] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 102.752319][ T5596] team0: Port device team_slave_0 added [ 102.754426][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 102.754436][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.754455][ T5594] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 102.865482][ T5596] team0: Port device team_slave_1 added [ 102.881412][ T5593] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 102.881424][ T5593] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.881443][ T5593] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 102.942468][ T5593] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 102.942481][ T5593] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.942500][ T5593] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 103.033566][ T5596] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 103.033580][ T5596] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.033600][ T5596] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 103.107215][ T5596] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 103.107228][ T5596] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.107248][ T5596] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 103.177685][ T5595] hsr_slave_0: entered promiscuous mode [ 103.179771][ T5595] hsr_slave_1: entered promiscuous mode [ 103.457524][ T5594] hsr_slave_0: entered promiscuous mode [ 103.459446][ T5594] hsr_slave_1: entered promiscuous mode [ 103.461041][ T5594] debugfs: 'hsr0' already exists in 'hsr' [ 103.461137][ T5594] Cannot create hsr debugfs directory [ 103.539671][ T5593] hsr_slave_0: entered promiscuous mode [ 103.541388][ T5593] hsr_slave_1: entered promiscuous mode [ 103.542825][ T5593] debugfs: 'hsr0' already exists in 'hsr' [ 103.542848][ T5593] Cannot create hsr debugfs directory [ 103.546635][ T4904] Bluetooth: hci1: command tx timeout [ 103.546731][ T5600] Bluetooth: hci2: command tx timeout [ 103.701126][ T5596] hsr_slave_0: entered promiscuous mode [ 103.702864][ T5596] hsr_slave_1: entered promiscuous mode [ 103.704293][ T5596] debugfs: 'hsr0' already exists in 'hsr' [ 103.704317][ T5596] Cannot create hsr debugfs directory [ 103.708176][ T4904] Bluetooth: hci0: command tx timeout [ 103.708270][ T5600] Bluetooth: hci3: command tx timeout [ 104.554006][ T5595] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 104.607060][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 104.618410][ T5595] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 104.662918][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 104.675817][ T5595] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 104.711929][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 104.736308][ T5595] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 104.763018][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 104.883318][ T5593] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 104.925799][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 104.942947][ T5593] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 104.984046][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 104.990708][ T5593] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 105.032377][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 105.061681][ T5593] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 105.096075][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 105.244018][ T5596] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 105.273320][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 105.284958][ T5596] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 105.322635][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 105.353172][ T5596] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 105.382803][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 105.415570][ T5596] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 105.451171][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 105.627581][ T5600] Bluetooth: hci2: command tx timeout [ 105.627617][ T5600] Bluetooth: hci1: command tx timeout [ 105.633366][ T5594] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 105.662001][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 105.679918][ T5594] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 105.701844][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 105.715431][ T5594] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 105.744269][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 105.760922][ T5594] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 105.789226][ T5600] Bluetooth: hci3: command tx timeout [ 105.789254][ T4904] Bluetooth: hci0: command tx timeout [ 105.814502][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 105.978540][ T5595] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.120441][ T5595] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.165534][ T5593] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.200014][ T1010] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.200204][ T1010] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.260471][ T1010] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.260620][ T1010] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.331808][ T5593] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.392141][ T5596] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.422967][ T446] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.423138][ T446] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.476132][ T2936] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.476277][ T2936] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.577376][ T5596] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.653112][ T5594] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.655183][ T2936] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.655399][ T2936] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.733867][ T2936] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.733995][ T2936] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.842988][ T5594] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.945438][ T2936] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.954769][ T2936] bridge0: port 1(bridge_slave_0) entered forwarding state [ 107.032353][ T446] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.032521][ T446] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.706616][ T4904] Bluetooth: hci1: command tx timeout [ 107.706652][ T4904] Bluetooth: hci2: command tx timeout [ 107.867730][ T5600] Bluetooth: hci3: command tx timeout [ 107.870058][ T5600] Bluetooth: hci0: command tx timeout [ 108.048842][ T5595] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 108.243521][ T5593] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 108.539107][ T5595] veth0_vlan: entered promiscuous mode [ 108.610500][ T5596] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 108.660943][ T5595] veth1_vlan: entered promiscuous mode [ 108.751633][ T5594] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 108.783232][ T5593] veth0_vlan: entered promiscuous mode [ 108.857721][ T5593] veth1_vlan: entered promiscuous mode [ 108.924039][ T5595] veth0_macvtap: entered promiscuous mode [ 108.951340][ T5596] veth0_vlan: entered promiscuous mode [ 108.962850][ T5595] veth1_macvtap: entered promiscuous mode [ 109.048179][ T5596] veth1_vlan: entered promiscuous mode [ 109.080305][ T5594] veth0_vlan: entered promiscuous mode [ 109.102352][ T5595] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 109.131546][ T5593] veth0_macvtap: entered promiscuous mode [ 109.145586][ T5595] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 109.172952][ T5594] veth1_vlan: entered promiscuous mode [ 109.191891][ T5593] veth1_macvtap: entered promiscuous mode [ 109.224745][ T67] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.251680][ T67] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.272305][ T67] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.291897][ T67] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.410268][ T5596] veth0_macvtap: entered promiscuous mode [ 109.460591][ T5593] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 109.504523][ T5596] veth1_macvtap: entered promiscuous mode [ 109.602690][ T5593] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 109.763128][ T69] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.792172][ T69] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.805814][ T5594] veth0_macvtap: entered promiscuous mode [ 109.816119][ T69] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.837593][ T5596] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 109.837752][ T69] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.901096][ T5594] veth1_macvtap: entered promiscuous mode [ 109.963147][ T5596] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 109.992798][ T2936] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.992819][ T2936] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.145351][ T67] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.166597][ T67] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.171869][ T67] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.171912][ T67] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.488941][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 110.511294][ T67] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.511313][ T67] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.774432][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.869068][ T1010] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.870306][ T1010] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.870847][ T1010] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.874140][ T67] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.874156][ T67] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.875890][ T1010] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.215471][ T1425] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.215493][ T1425] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.491446][ T67] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.491467][ T67] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.969674][ T69] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.969695][ T69] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.270381][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.270403][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.629617][ T1010] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.629639][ T1010] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.969454][ T5600] Bluetooth: hci2: unexpected subevent 0x10 length: 30 > 2 [ 113.253742][ T5749] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3'. [ 113.639357][ T822] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 113.809552][ T5605] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 114.169310][ T5605] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 114.169338][ T5605] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 114.178322][ T822] usb 4-1: Using ep0 maxpacket: 16 [ 114.220215][ T5605] usb 1-1: New USB device found, idVendor=249c, idProduct=9001, bcdDevice= 0.40 [ 114.220244][ T5605] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 114.220262][ T5605] usb 1-1: Product: syz [ 114.220277][ T5605] usb 1-1: Manufacturer: syz [ 114.220291][ T5605] usb 1-1: SerialNumber: syz [ 114.311519][ T5759] nvme_fc: nvme_fc_parse_traddr: bad traddr string [ 114.351456][ T822] usb 4-1: unable to get BOS descriptor or descriptor too short [ 114.355894][ T822] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 114.355980][ T822] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 114.356029][ T822] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 114.497661][ T822] usb 4-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 114.497698][ T822] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 114.497720][ T822] usb 4-1: Product: syz [ 114.497735][ T822] usb 4-1: Manufacturer: syz [ 114.497748][ T822] usb 4-1: SerialNumber: syz [ 114.836305][ T5758] can: request_module (can-proto-4) failed. [ 115.125767][ T5752] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 115.135841][ T5752] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 115.441651][ T5765] netlink: 56 bytes leftover after parsing attributes in process `syz.0.7'. [ 115.446991][ T5766] warning: `syz.0.7' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 115.517674][ T5763] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6'. [ 115.671663][ T5745] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 115.717744][ T5745] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 115.793959][ T822] usb 4-1: Audio class v2/v3 interfaces need an interface association [ 115.796105][ T822] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 116.098106][ T822] usb 4-1: 2:1 : bogus bTerminalLink 6 [ 116.167816][ T5756] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 116.861851][ T5605] usb 1-1: USB disconnect, device number 2 [ 117.039764][ T5773] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 117.519297][ T37] audit: type=1326 audit(1785953254.929:2): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=5777 comm="syz.0.10" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f08a0b8e0d9 code=0x0 [ 117.558506][ T5698] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 117.736795][ T5698] usb 3-1: Using ep0 maxpacket: 32 [ 117.770369][ T822] usb 4-1: USB disconnect, device number 2 [ 117.772670][ T5698] usb 3-1: config 0 has an invalid interface number: 51 but max is 0 [ 117.772698][ T5698] usb 3-1: config 0 has no interface number 0 [ 117.807571][ T5698] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 117.807604][ T5698] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.807625][ T5698] usb 3-1: Product: syz [ 117.807640][ T5698] usb 3-1: Manufacturer: syz [ 117.807655][ T5698] usb 3-1: SerialNumber: syz [ 117.953572][ T5698] usb 3-1: config 0 descriptor?? [ 118.035427][ T5698] quatech2 3-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 118.922326][ T47] wlan0: Trigger new scan to find an IBSS to join [ 118.931529][ C1] usb 3-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 119.100430][ T5787] netlink: 16186 bytes leftover after parsing attributes in process `syz.0.13'. [ 119.313308][ T5698] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 119.338516][ T5793] ======================================================= [ 119.338516][ T5793] WARNING: The mand mount option has been deprecated and [ 119.338516][ T5793] and is ignored by this kernel. Remove the mand [ 119.338516][ T5793] option from the mount to silence this warning. [ 119.338516][ T5793] ======================================================= [ 119.449955][ T5607] udevd[5607]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 119.515716][ T5698] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 119.668898][ T5698] usb 3-1: USB disconnect, device number 2 [ 119.825101][ T5600] Bluetooth: hci0: unexpected subevent 0x10 length: 30 > 2 [ 120.096755][ T5798] netlink: 32 bytes leftover after parsing attributes in process `syz.3.17'. [ 120.175894][ T5698] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 120.229551][ T5698] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 120.383651][ T5698] quatech2 3-1:0.51: device disconnected [ 120.396528][ T5321] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 120.550200][ T5321] usb 2-1: Using ep0 maxpacket: 16 [ 120.556503][ T5321] usb 2-1: config 0 has an invalid interface number: 34 but max is 0 [ 120.556531][ T5321] usb 2-1: config 0 has no interface number 0 [ 120.556574][ T5321] usb 2-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 120.556598][ T5321] usb 2-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 120.610362][ T5321] usb 2-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 120.610394][ T5321] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 120.610415][ T5321] usb 2-1: Product: syz [ 120.610430][ T5321] usb 2-1: Manufacturer: syz [ 120.610446][ T5321] usb 2-1: SerialNumber: syz [ 120.701756][ T5321] usb 2-1: config 0 descriptor?? [ 120.702713][ T5799] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 120.702861][ T5799] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 120.815114][ T5698] usb 3-1: new full-speed USB device number 3 using dummy_hcd [ 120.943671][ T5799] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 120.943811][ T5799] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 120.995750][ T5698] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 120.995780][ T5698] usb 3-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 121.024556][ T5698] usb 3-1: New USB device found, idVendor=249c, idProduct=9001, bcdDevice= 0.40 [ 121.024586][ T5698] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 121.024606][ T5698] usb 3-1: Product: syz [ 121.024620][ T5698] usb 3-1: Manufacturer: syz [ 121.024635][ T5698] usb 3-1: SerialNumber: syz [ 121.066542][ T5789] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 121.253848][ T5321] asix 2-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 121.304962][ T5803] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 121.321188][ T5803] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 121.415306][ T5805] netlink: 56 bytes leftover after parsing attributes in process `syz.2.18'. [ 121.665750][ T5698] usb 3-1: USB disconnect, device number 3 [ 122.267960][ T5321] asix 2-1:0.34 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 122.267999][ T5321] asix 2-1:0.34 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 122.268781][ T5321] asix 2-1:0.34: probe with driver asix failed with error -71 [ 122.404549][ T5321] usb 2-1: USB disconnect, device number 2 [ 122.521058][ T37] audit: type=1326 audit(1785953259.959:3): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=5814 comm="syz.2.21" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f5319b8e0d9 code=0x0 [ 122.837922][ T1425] wlan0: Trigger new scan to find an IBSS to join [ 123.020384][ T5800] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 123.056572][ T5321] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 123.130771][ T5823] syz.1.31 (5823) used obsolete PPPIOCDETACH ioctl [ 123.186585][ T5321] usb 1-1: device descriptor read/64, error -71 [ 123.231033][ T5822] nvme_fc: nvme_fc_parse_traddr: bad traddr string [ 123.341165][ T5824] can: request_module (can-proto-4) failed. [ 123.467959][ T5321] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 123.488406][ T37] audit: type=1326 audit(1785953260.929:4): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=5829 comm="syz.1.33" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7ff9120fe0d9 code=0x0 [ 123.606578][ T5321] usb 1-1: device descriptor read/64, error -71 [ 123.723480][ T5321] usb usb1-port1: attempt power cycle [ 123.759586][ T2936] wlan0: Creating new IBSS network, BSSID 2a:c8:16:a0:05:98 [ 123.867392][ T1468] wlan0: Trigger new scan to find an IBSS to join [ 124.116562][ T5321] usb 1-1: new full-speed USB device number 5 using dummy_hcd [ 124.137558][ T5321] usb 1-1: device descriptor read/8, error -71 [ 124.388733][ T5321] usb 1-1: new full-speed USB device number 6 using dummy_hcd [ 124.417430][ T5321] usb 1-1: device descriptor read/8, error -71 [ 124.510735][ T5600] Bluetooth: hci1: unexpected subevent 0x10 length: 30 > 2 [ 124.528119][ T5321] usb usb1-port1: unable to enumerate USB device [ 124.638551][ T5844] netlink: 16186 bytes leftover after parsing attributes in process `syz.2.27'. [ 124.867161][ T5698] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 124.867303][ T49] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 125.016734][ T5698] usb 4-1: Using ep0 maxpacket: 32 [ 125.036849][ T5698] usb 4-1: config 0 has an invalid interface number: 51 but max is 0 [ 125.036877][ T5698] usb 4-1: config 0 has no interface number 0 [ 125.064880][ T49] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 125.064909][ T49] usb 2-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 125.065593][ T5698] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 125.065613][ T5698] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 125.065627][ T5698] usb 4-1: Product: syz [ 125.065637][ T5698] usb 4-1: Manufacturer: syz [ 125.065690][ T5698] usb 4-1: SerialNumber: syz [ 125.108095][ T49] usb 2-1: New USB device found, idVendor=249c, idProduct=9001, bcdDevice= 0.40 [ 125.108186][ T49] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 125.108240][ T49] usb 2-1: Product: syz [ 125.108281][ T49] usb 2-1: Manufacturer: syz [ 125.108317][ T49] usb 2-1: SerialNumber: syz [ 125.186229][ T5698] usb 4-1: config 0 descriptor?? [ 125.202355][ T5698] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 125.448855][ T5846] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 125.472227][ T5846] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 125.489310][ T5698] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 125.490562][ T5846] netlink: 56 bytes leftover after parsing attributes in process `syz.1.28'. [ 125.521858][ T5698] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 125.642751][ T49] usb 2-1: USB disconnect, device number 3 [ 126.070629][ C1] usb 4-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 126.096589][ T5605] usb 4-1: USB disconnect, device number 3 [ 126.165012][ T5605] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 126.219039][ T5605] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 126.223593][ T5605] quatech2 4-1:0.51: device disconnected [ 126.486666][ T5856] netlink: 32 bytes leftover after parsing attributes in process `syz.0.32'. [ 126.587155][ T5842] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 126.696547][ T49] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 126.834645][ T1425] wlan0: Trigger new scan to find an IBSS to join [ 126.846470][ T49] usb 2-1: Using ep0 maxpacket: 8 [ 126.854739][ T49] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 126.854799][ T49] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 126.854823][ T49] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 126.854848][ T49] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 126.854873][ T49] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 126.854915][ T49] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 126.854939][ T49] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 127.152760][ T49] usb 2-1: usb_control_msg returned -32 [ 127.152874][ T49] usbtmc 2-1:16.0: can't read capabilities [ 127.423035][ T5854] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 127.425180][ T5854] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 127.452955][ T5698] usb 2-1: USB disconnect, device number 4 [ 127.626612][ T5751] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 127.671580][ T37] audit: type=1326 audit(1785953265.109:5): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=5853 comm="syz.1.30" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7ff9120fe0d9 code=0x80000000 [ 127.776788][ T5751] usb 3-1: Using ep0 maxpacket: 16 [ 127.793676][ T5751] usb 3-1: unable to get BOS descriptor or descriptor too short [ 127.805562][ T5751] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 127.805622][ T5751] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 127.805650][ T5751] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 127.848079][ T5751] usb 3-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 127.848101][ T5751] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 127.848115][ T5751] usb 3-1: Product: syz [ 127.848125][ T5751] usb 3-1: Manufacturer: syz [ 127.848136][ T5751] usb 3-1: SerialNumber: syz [ 127.870097][ T446] wlan0: Trigger new scan to find an IBSS to join [ 128.193436][ T5863] netlink: 4 bytes leftover after parsing attributes in process `syz.2.35'. [ 128.239064][ T5751] usb 3-1: Audio class v2/v3 interfaces need an interface association [ 128.239433][ T5751] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 128.447718][ T5863] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 128.451241][ T5863] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 128.666606][ T5857] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 128.693284][ T5751] usb 3-1: 2:1 : bogus bTerminalLink 6 [ 129.178789][ T5751] usb 3-1: USB disconnect, device number 4 [ 129.525640][ T5607] udevd[5607]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 129.727429][ T5605] usb 1-1: new full-speed USB device number 7 using dummy_hcd [ 129.867662][ T1431] wlan0: Creating new IBSS network, BSSID f2:5e:68:01:2e:57 [ 129.926939][ T5605] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 129.926973][ T5605] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 129.927020][ T5605] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 129.927044][ T5605] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 130.243382][ T5605] usb 1-1: usb_control_msg returned -32 [ 130.243431][ T5605] usbtmc 1-1:16.0: can't read capabilities [ 130.556559][ T5751] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 130.706497][ T5751] usb 2-1: Using ep0 maxpacket: 8 [ 130.708725][ T5751] usb 2-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 130.708747][ T5751] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 130.708763][ T5751] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 130.711313][ T5751] usb 2-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 130.711344][ T5751] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 130.711365][ T5751] usb 2-1: Product: syz [ 130.711375][ T5751] usb 2-1: Manufacturer: syz [ 130.711386][ T5751] usb 2-1: SerialNumber: syz [ 130.715854][ T5751] usb 2-1: config 0 descriptor?? [ 131.770142][ T5897] netlink: 16186 bytes leftover after parsing attributes in process `syz.2.44'. [ 131.903169][ T5894] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 131.903824][ T5894] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 132.044723][ T5904] netlink: 16 bytes leftover after parsing attributes in process `syz.3.46'. [ 132.443201][ T5321] usb 1-1: USB disconnect, device number 7 [ 132.456617][ T32] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 132.616776][ T32] usb 4-1: Using ep0 maxpacket: 8 [ 132.621027][ T32] usb 4-1: config 16 has an invalid descriptor of length 197, skipping remainder of the config [ 132.621086][ T32] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 3201, setting to 1024 [ 132.621113][ T32] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 132.621130][ T32] usb 4-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 132.621161][ T32] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 132.621178][ T32] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 132.708247][ T32] usbtmc 4-1:16.0: bulk endpoints not found [ 132.841136][ T2936] wlan0: Trigger new scan to find an IBSS to join [ 132.861555][ T1337] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.861692][ T1337] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.367534][ T32] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 133.526768][ T32] usb 1-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 133.526800][ T32] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 133.526896][ T32] usb 1-1: Product: syz [ 133.526913][ T32] usb 1-1: Manufacturer: syz [ 133.526928][ T32] usb 1-1: SerialNumber: syz [ 133.532608][ T32] usb 1-1: config 0 descriptor?? [ 133.800838][ T5891] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 133.814845][ T32] usb 1-1: USB disconnect, device number 8 [ 133.822433][ T12] wlan0: Creating new IBSS network, BSSID 5e:f0:63:72:95:01 [ 134.025319][ T5922] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 134.025950][ T5922] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 134.052091][ T5922] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 134.052968][ T5922] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 134.959231][ T5941] syz.1.58 uses obsolete (PF_INET,SOCK_PACKET) [ 135.158988][ T32] usb 4-1: USB disconnect, device number 4 [ 135.216559][ T5698] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 135.358216][ T5947] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.62'. [ 135.380337][ T5698] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 135.380402][ T5698] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 135.380429][ T5698] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 135.380456][ T5698] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 64 [ 135.380481][ T5698] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 64 [ 135.380505][ T5698] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 64 [ 135.380532][ T5698] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 64 [ 135.380549][ T5698] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x87 has invalid maxpacket 64 [ 135.380566][ T5698] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 135.380582][ T5698] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 135.380599][ T5698] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [ 135.380618][ T5698] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 64 [ 135.380636][ T5698] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x5 has an invalid bInterval 0, changing to 7 [ 135.380654][ T5698] usb 1-1: config 1 interface 0 altsetting 0 has 12 endpoint descriptors, different from the interface descriptor's value: 14 [ 135.383261][ T5698] usb 1-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 135.383290][ T5698] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 135.383311][ T5698] usb 1-1: Product: syz [ 135.383328][ T5698] usb 1-1: Manufacturer: syz [ 135.383339][ T5698] usb 1-1: SerialNumber: syz [ 135.501989][ T5942] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 135.503600][ T5942] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 135.608619][ T5942] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 135.608820][ T5942] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 135.608998][ T5942] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 135.609261][ T5942] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 135.609453][ T5942] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 135.609747][ T5942] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 135.609930][ T5942] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 135.610114][ T5942] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 135.654396][ T5942] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 135.693814][ T5698] keyspan 1-1:1.0: Keyspan 2 port adapter converter detected [ 135.713980][ T5698] keyspan 1-1:1.0: found no endpoint descriptor for endpoint 7 [ 135.727940][ T5698] usb 1-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 135.730696][ T5698] keyspan 1-1:1.0: found no endpoint descriptor for endpoint 6 [ 135.734264][ T5698] usb 1-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 135.898916][ T198] usb 1-1: USB disconnect, device number 9 [ 135.936002][ T198] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 135.955989][ T198] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 135.970272][ T198] keyspan 1-1:1.0: device disconnected [ 136.827354][ T198] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 136.946576][ T5751] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 136.996708][ T198] usb 3-1: Using ep0 maxpacket: 8 [ 136.999369][ T198] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 136.999398][ T198] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 136.999426][ T198] usb 3-1: config 16 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 136.999441][ T198] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 136.999472][ T198] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 136.999489][ T198] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 137.084843][ T198] usbtmc 3-1:16.0: bulk endpoints not found [ 137.096490][ T5751] usb 1-1: Using ep0 maxpacket: 32 [ 137.098814][ T5751] usb 1-1: config 0 has an invalid interface number: 51 but max is 0 [ 137.098840][ T5751] usb 1-1: config 0 has no interface number 0 [ 137.101388][ T5751] usb 1-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 137.101416][ T5751] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 137.101435][ T5751] usb 1-1: Product: syz [ 137.101454][ T5751] usb 1-1: Manufacturer: syz [ 137.101464][ T5751] usb 1-1: SerialNumber: syz [ 137.136464][ T5321] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 137.185896][ T5751] usb 1-1: config 0 descriptor?? [ 137.207804][ T5751] quatech2 1-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 137.309211][ T5946] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 137.368892][ T5321] usb 4-1: New USB device found, idVendor=2c42, idProduct=1709, bcdDevice=ca.b7 [ 137.368925][ T5321] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 137.368947][ T5321] usb 4-1: Product: syz [ 137.368963][ T5321] usb 4-1: Manufacturer: syz [ 137.368978][ T5321] usb 4-1: SerialNumber: syz [ 137.410434][ T5321] usb 4-1: config 0 descriptor?? [ 137.467638][ T5751] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 137.515395][ T5751] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 138.287653][ C1] usb 1-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 138.288718][ T5751] usb 1-1: USB disconnect, device number 10 [ 138.355493][ T5751] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 138.422939][ T5751] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 138.445586][ T5751] quatech2 1-1:0.51: device disconnected [ 138.486492][ T5321] usb 4-1: f81604_read: reg: 100f failed: -EPROTO [ 138.528218][ T5321] usb 4-1: f81604_read: reg: 200f failed: -EPROTO [ 138.539560][ T5321] usb 4-1: USB disconnect, device number 5 [ 138.615780][ T5321] usb 4-1: f81604_read: reg: 100f failed: -ENODEV [ 138.763616][ T5250] usb 4-1: f81604_read: reg: 200f failed: -ENODEV [ 138.794615][ T5250] usb 4-1: f81604_read: reg: 200f failed: -ENODEV [ 138.867747][ T5321] usb 4-1: f81604_read: reg: 200f failed: -ENODEV [ 138.895854][ T5967] FAULT_INJECTION: forcing a failure. [ 138.895854][ T5967] name failslab, interval 1, probability 0, space 0, times 1 [ 138.895907][ T5967] CPU: 0 UID: 0 PID: 5967 Comm: syz.1.69 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 138.895926][ T5967] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 138.895941][ T5967] Call Trace: [ 138.895947][ T5967] [ 138.895954][ T5967] dump_stack_lvl+0xe8/0x150 [ 138.895979][ T5967] should_fail_ex+0x467/0x600 [ 138.896004][ T5967] should_failslab+0xa8/0x100 [ 138.896022][ T5967] __kmalloc_node_track_caller_noprof+0xfb/0x7b0 [ 138.896047][ T5967] ? nvmf_dev_write+0xef8/0x2d90 [ 138.896064][ T5967] ? nvmf_dev_write+0xef8/0x2d90 [ 138.896088][ T5967] kmemdup_nul+0x36/0xf0 [ 138.896106][ T5967] nvmf_dev_write+0xef8/0x2d90 [ 138.896148][ T5967] ? __pfx_nvmf_dev_write+0x10/0x10 [ 138.896171][ T5967] ? kstrtouint+0x6e/0xe0 [ 138.896213][ T5967] ? bpf_lsm_file_permission+0x9/0x20 [ 138.896237][ T5967] ? security_file_permission+0x68/0x220 [ 138.896256][ T5967] ? rw_verify_area+0x209/0x4d0 [ 138.896276][ T5967] ? __pfx_nvmf_dev_write+0x10/0x10 [ 138.896292][ T5967] vfs_write+0x29f/0xbb0 [ 138.896317][ T5967] ? __pfx_vfs_write+0x10/0x10 [ 138.896374][ T5967] ? __fget_files+0x2a/0x420 [ 138.896398][ T5967] ? __fget_files+0x2a/0x420 [ 138.896418][ T5967] ? __fget_files+0x3a8/0x420 [ 138.896439][ T5967] ? __fget_files+0x2a/0x420 [ 138.896470][ T5967] ksys_write+0x156/0x270 [ 138.896498][ T5967] ? __pfx_ksys_write+0x10/0x10 [ 138.896534][ T5967] do_syscall_64+0x17b/0x530 [ 138.896556][ T5967] ? irqentry_exit+0x10f/0x8f0 [ 138.896584][ T5967] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 138.896607][ T5967] ? clear_bhb_loop+0x40/0x90 [ 138.896636][ T5967] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 138.896655][ T5967] RIP: 0033:0x7ff9120fe0d9 [ 138.896674][ T5967] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 138.896687][ T5967] RSP: 002b:00007ff910356028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 138.896706][ T5967] RAX: ffffffffffffffda RBX: 00007ff912385fa0 RCX: 00007ff9120fe0d9 [ 138.896718][ T5967] RDX: 00000000000000af RSI: 0000200000000a00 RDI: 0000000000000003 [ 138.896727][ T5967] RBP: 00007ff910356090 R08: 0000000000000000 R09: 0000000000000000 [ 138.896737][ T5967] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 138.896746][ T5967] R13: 00007ff912386038 R14: 00007ff912385fa0 R15: 00007ffe2d8d87c8 [ 138.896770][ T5967] [ 139.519774][ T5975] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 139.624458][ T5672] usb 3-1: USB disconnect, device number 5 [ 139.866100][ T5986] 9p: Bad value for 'wfdno' [ 140.841448][ T6015] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 140.842910][ T6015] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 140.865543][ T6015] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 140.866173][ T6015] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 141.340635][ T6024] nvme_fabrics: missing parameter 'transport=%s' [ 141.340655][ T6024] nvme_fabrics: missing parameter 'nqn=%s' [ 142.187218][ T5998] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 142.731654][ T5672] IPVS: starting estimator thread 0... [ 142.826622][ T6042] IPVS: using max 9 ests per chain, 21600 per kthread [ 143.094880][ T6045] tmpfs: Bad value for 'grpquota_block_hardlimit' [ 143.139968][ T5672] IPVS: starting estimator thread 0... [ 143.163319][ T6050] IPVS: set_ctl: invalid protocol: 0 100.1.1.0:20004 [ 143.227632][ T6051] IPVS: using max 7 ests per chain, 16800 per kthread [ 143.231625][ T6053] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 143.232344][ T6053] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 143.677294][ T6066] Zero length message leads to an empty skb [ 144.474308][ T6082] netlink: 8 bytes leftover after parsing attributes in process `syz.0.97'. [ 144.496590][ T5672] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 144.656178][ T6084] FAULT_INJECTION: forcing a failure. [ 144.656178][ T6084] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 144.656215][ T6084] CPU: 0 UID: 0 PID: 6084 Comm: syz.3.99 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 144.656238][ T6084] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 144.656251][ T6084] Call Trace: [ 144.656259][ T6084] [ 144.656268][ T6084] dump_stack_lvl+0xe8/0x150 [ 144.656300][ T6084] should_fail_ex+0x467/0x600 [ 144.656337][ T6084] _copy_from_user+0x2d/0xb0 [ 144.656357][ T6084] get_user_ifreq+0x6b/0x180 [ 144.656381][ T6084] sock_ioctl+0x6fb/0x7f0 [ 144.656407][ T6084] ? __pfx_sock_ioctl+0x10/0x10 [ 144.656433][ T6084] ? __fget_files+0x3a8/0x420 [ 144.656455][ T6084] ? __fget_files+0x2a/0x420 [ 144.656480][ T6084] ? bpf_lsm_file_ioctl+0x9/0x20 [ 144.656512][ T6084] ? __pfx_sock_ioctl+0x10/0x10 [ 144.656534][ T6084] __se_sys_ioctl+0xff/0x170 [ 144.656566][ T6084] do_syscall_64+0x17b/0x530 [ 144.656588][ T6084] ? irqentry_exit+0x10f/0x8f0 [ 144.656609][ T6084] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 144.656632][ T6084] ? clear_bhb_loop+0x40/0x90 [ 144.656660][ T6084] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 144.656683][ T6084] RIP: 0033:0x7f8f4f9be0d9 [ 144.656711][ T6084] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 144.656728][ T6084] RSP: 002b:00007f8f4dc16028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 144.656750][ T6084] RAX: ffffffffffffffda RBX: 00007f8f4fc45fa0 RCX: 00007f8f4f9be0d9 [ 144.656766][ T6084] RDX: 0000200000000140 RSI: 00000000000089f0 RDI: 0000000000000003 [ 144.656780][ T6084] RBP: 00007f8f4dc16090 R08: 0000000000000000 R09: 0000000000000000 [ 144.656793][ T6084] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 144.656805][ T6084] R13: 00007f8f4fc46038 R14: 00007f8f4fc45fa0 R15: 00007ffffdead5e8 [ 144.656839][ T6084] [ 144.718336][ T5672] usb 3-1: Using ep0 maxpacket: 16 [ 144.867831][ T5672] usb 3-1: unable to get BOS descriptor or descriptor too short [ 144.872085][ T5672] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 144.872165][ T5672] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 144.872207][ T5672] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 144.921082][ T5672] usb 3-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 144.921114][ T5672] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 144.921236][ T5672] usb 3-1: Product: syz [ 144.921253][ T5672] usb 3-1: Manufacturer: syz [ 144.921268][ T5672] usb 3-1: SerialNumber: syz [ 145.256668][ T6077] netlink: 4 bytes leftover after parsing attributes in process `syz.2.95'. [ 145.314606][ T6086] fuse: Bad value for 'fd' [ 145.348272][ T5672] usb 3-1: Audio class v2/v3 interfaces need an interface association [ 145.348604][ T5672] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 145.539754][ T6077] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 145.551571][ T6077] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 145.623802][ T6092] capability: warning: `syz.3.102' uses deprecated v2 capabilities in a way that may be insecure [ 145.806032][ T6093] /dev/nullb0: Can't open blockdev [ 146.084598][ T5672] usb 3-1: USB disconnect, device number 6 [ 146.097696][ T5751] usb 1-1: new low-speed USB device number 11 using dummy_hcd [ 146.263384][ T5751] usb 1-1: config 0 interface 0 altsetting 31 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 146.263423][ T5751] usb 1-1: config 0 interface 0 altsetting 31 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 146.263458][ T5751] usb 1-1: config 0 interface 0 has no altsetting 0 [ 146.263493][ T5751] usb 1-1: New USB device found, idVendor=04d9, idProduct=a070, bcdDevice= 0.00 [ 146.263518][ T5751] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 146.345796][ T5751] usb 1-1: config 0 descriptor?? [ 146.352868][ T6095] raw-gadget.4 gadget.0: fail, usb_ep_enable returned -22 [ 146.385416][ T5607] udevd[5607]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 146.629004][ T6105] netlink: 12 bytes leftover after parsing attributes in process `syz.3.106'. [ 146.693713][ T6102] nfs: Unknown parameter 'smackfsflź®§— ¨' [ 146.814203][ T5751] holtek_mouse 0003:04D9:A070.0001: unknown main item tag 0x2 [ 146.814251][ T5751] holtek_mouse 0003:04D9:A070.0001: global environment stack underflow [ 146.814271][ T5751] holtek_mouse 0003:04D9:A070.0001: item 0 4 1 11 parsing failed [ 146.815340][ T5751] holtek_mouse 0003:04D9:A070.0001: hid parse failed: -22 [ 146.815425][ T5751] holtek_mouse 0003:04D9:A070.0001: probe with driver holtek_mouse failed with error -22 [ 147.027821][ T5751] usb 1-1: USB disconnect, device number 11 [ 147.070622][ T6113] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 147.099971][ T6110] netlink: 132 bytes leftover after parsing attributes in process `syz.2.107'. [ 147.488358][ T5321] usb 3-1: new low-speed USB device number 7 using dummy_hcd [ 147.492814][ T5605] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 147.499286][ T6121] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 147.524244][ T6121] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 147.616551][ T5321] usb 3-1: device descriptor read/64, error -71 [ 147.616659][ T5605] usb 4-1: device descriptor read/64, error -71 [ 147.828986][ T6124] openvswitch: netlink: Unexpected mask (mask=440, allowed=10048) [ 147.857968][ T5321] usb 3-1: new low-speed USB device number 8 using dummy_hcd [ 147.858174][ T5605] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 148.026731][ T5605] usb 4-1: device descriptor read/64, error -71 [ 148.026804][ T5321] usb 3-1: device descriptor read/64, error -71 [ 148.137062][ T5321] usb usb3-port1: attempt power cycle [ 148.139932][ T5605] usb usb4-port1: attempt power cycle [ 148.360956][ T6131] overlay: Unknown parameter '/' [ 148.536573][ T5605] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 148.536734][ T5321] usb 3-1: new low-speed USB device number 9 using dummy_hcd [ 148.561498][ T5605] usb 4-1: device descriptor read/8, error -71 [ 148.561604][ T5321] usb 3-1: device descriptor read/8, error -71 [ 148.808037][ T5321] usb 3-1: new low-speed USB device number 10 using dummy_hcd [ 148.809584][ T5605] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 148.837100][ T5321] usb 3-1: device descriptor read/8, error -71 [ 148.838785][ T5605] usb 4-1: device descriptor read/8, error -71 [ 148.859498][ T5751] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 148.946847][ T5321] usb usb3-port1: unable to enumerate USB device [ 148.948121][ T5605] usb usb4-port1: unable to enumerate USB device [ 149.006533][ T5751] usb 1-1: Using ep0 maxpacket: 16 [ 149.009837][ T5751] usb 1-1: unable to get BOS descriptor or descriptor too short [ 149.012345][ T5751] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 149.012433][ T5751] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 149.012477][ T5751] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 149.046531][ T5751] usb 1-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 149.046564][ T5751] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 149.046585][ T5751] usb 1-1: Product: syz [ 149.046600][ T5751] usb 1-1: Manufacturer: syz [ 149.046615][ T5751] usb 1-1: SerialNumber: syz [ 149.309948][ T6136] netlink: 4 bytes leftover after parsing attributes in process `syz.0.115'. [ 149.331190][ T5751] usb 1-1: Audio class v2/v3 interfaces need an interface association [ 149.331694][ T5751] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 149.515651][ T6136] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 149.530888][ T6136] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 149.691744][ T6142] FAULT_INJECTION: forcing a failure. [ 149.691744][ T6142] name failslab, interval 1, probability 0, space 0, times 0 [ 149.691794][ T6142] CPU: 0 UID: 0 PID: 6142 Comm: syz.1.117 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 149.691819][ T6142] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 149.691832][ T6142] Call Trace: [ 149.691841][ T6142] [ 149.691849][ T6142] dump_stack_lvl+0xe8/0x150 [ 149.691881][ T6142] should_fail_ex+0x467/0x600 [ 149.691916][ T6142] should_failslab+0xa8/0x100 [ 149.691932][ T6142] __kmalloc_noprof+0xfb/0x790 [ 149.691981][ T6142] ? tomoyo_encode+0x2ad/0x570 [ 149.692012][ T6142] ? tomoyo_encode+0x2ad/0x570 [ 149.692049][ T6142] tomoyo_encode+0x2ad/0x570 [ 149.692090][ T6142] tomoyo_realpath_from_path+0x5fa/0x640 [ 149.692149][ T6142] ? tomoyo_path_number_perm+0x219/0x5f0 [ 149.692179][ T6142] tomoyo_path_number_perm+0x246/0x5f0 [ 149.692210][ T6142] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 149.692238][ T6142] ? do_raw_spin_lock+0x12b/0x2f0 [ 149.692279][ T6142] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 149.692311][ T6142] ? lockdep_hardirqs_on+0x7a/0x110 [ 149.692350][ T6142] ? __fget_files+0x2a/0x420 [ 149.692379][ T6142] ? __fget_files+0x3a8/0x420 [ 149.692400][ T6142] ? __fget_files+0x2a/0x420 [ 149.692426][ T6142] security_file_ioctl+0xb9/0x260 [ 149.692452][ T6142] __se_sys_ioctl+0x47/0x170 [ 149.692490][ T6142] do_syscall_64+0x17b/0x530 [ 149.692513][ T6142] ? irqentry_exit+0x10f/0x8f0 [ 149.692535][ T6142] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 149.692558][ T6142] ? clear_bhb_loop+0x40/0x90 [ 149.692583][ T6142] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 149.692603][ T6142] RIP: 0033:0x7ff9120fe0d9 [ 149.692626][ T6142] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 149.692639][ T6142] RSP: 002b:00007ff910335028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 149.692673][ T6142] RAX: ffffffffffffffda RBX: 00007ff912386090 RCX: 00007ff9120fe0d9 [ 149.692689][ T6142] RDX: 0000200000000080 RSI: 00000000c0884113 RDI: 0000000000000005 [ 149.692703][ T6142] RBP: 00007ff910335090 R08: 0000000000000000 R09: 0000000000000000 [ 149.692717][ T6142] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 149.692731][ T6142] R13: 00007ff912386128 R14: 00007ff912386090 R15: 00007ffe2d8d87c8 [ 149.692764][ T6142] [ 149.692789][ T6142] ERROR: Out of memory at tomoyo_realpath_from_path. [ 150.011328][ T5751] usb 1-1: USB disconnect, device number 12 [ 150.111830][ T5848] udevd[5848]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 150.437849][ T6150] FAULT_INJECTION: forcing a failure. [ 150.437849][ T6150] name failslab, interval 1, probability 0, space 0, times 0 [ 150.437889][ T6150] CPU: 0 UID: 0 PID: 6150 Comm: syz.2.119 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 150.437913][ T6150] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 150.437927][ T6150] Call Trace: [ 150.437935][ T6150] [ 150.437944][ T6150] dump_stack_lvl+0xe8/0x150 [ 150.437977][ T6150] should_fail_ex+0x467/0x600 [ 150.438013][ T6150] should_failslab+0xa8/0x100 [ 150.438036][ T6150] __kmalloc_noprof+0xfb/0x790 [ 150.438068][ T6150] ? ___neigh_create+0x719/0x23a0 [ 150.438094][ T6150] ? ___neigh_create+0x719/0x23a0 [ 150.438129][ T6150] ___neigh_create+0x719/0x23a0 [ 150.438190][ T6150] ip6_finish_output2+0x6d6/0x1410 [ 150.438215][ T6150] ? ip6_mtu+0x7d/0x490 [ 150.438254][ T6150] ? ip6_output+0x11e/0x540 [ 150.438285][ T6150] ip6_output+0x337/0x540 [ 150.438318][ T6150] ? ip6_send_skb+0x10a/0x380 [ 150.438355][ T6150] ip6_send_skb+0x1cd/0x380 [ 150.438398][ T6150] udp_v6_send_skb+0xaa8/0x1380 [ 150.438447][ T6150] udpv6_sendmsg+0x1e44/0x2610 [ 150.438498][ T6150] ? __pfx_udpv6_sendmsg+0x10/0x10 [ 150.438530][ T6150] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 150.438588][ T6150] ? __local_bh_enable_ip+0x1ae/0x2b0 [ 150.438621][ T6150] ? inet_send_prepare+0x1b4/0x260 [ 150.438653][ T6150] ? inet6_sendmsg+0xe4/0x120 [ 150.438682][ T6150] ? __pfx_inet6_sendmsg+0x10/0x10 [ 150.438710][ T6150] sock_sendmsg_nosec+0x90/0x180 [ 150.438737][ T6150] __sys_sendto+0x41e/0x5d0 [ 150.438776][ T6150] ? __pfx___sys_sendto+0x10/0x10 [ 150.438837][ T6150] ? __pfx_ksys_write+0x10/0x10 [ 150.438868][ T6150] __x64_sys_sendto+0xde/0x100 [ 150.438903][ T6150] do_syscall_64+0x17b/0x530 [ 150.438925][ T6150] ? irqentry_exit+0x10f/0x8f0 [ 150.438946][ T6150] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 150.438968][ T6150] ? clear_bhb_loop+0x40/0x90 [ 150.438996][ T6150] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 150.439019][ T6150] RIP: 0033:0x7f5319b8e0d9 [ 150.439040][ T6150] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 150.439058][ T6150] RSP: 002b:00007f5317de6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 150.439082][ T6150] RAX: ffffffffffffffda RBX: 00007f5319e15fa0 RCX: 00007f5319b8e0d9 [ 150.439098][ T6150] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 150.439111][ T6150] RBP: 00007f5317de6090 R08: 0000200000000400 R09: 000000000000001c [ 150.439125][ T6150] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 150.439138][ T6150] R13: 00007f5319e16038 R14: 00007f5319e15fa0 R15: 00007ffc31db5b98 [ 150.439180][ T6150] [ 150.803134][ T6153] tmpfs: Bad value for 'mpol' [ 151.003912][ T6157] netlink: 'syz.0.121': attribute type 83 has an invalid length. [ 151.379384][ T6163] syzkaller1: entered promiscuous mode [ 151.379412][ T6163] syzkaller1: entered allmulticast mode [ 151.652140][ T6177] FAULT_INJECTION: forcing a failure. [ 151.652140][ T6177] name failslab, interval 1, probability 0, space 0, times 0 [ 151.652169][ T6177] CPU: 1 UID: 0 PID: 6177 Comm: syz.3.125 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 151.652189][ T6177] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 151.652200][ T6177] Call Trace: [ 151.652206][ T6177] [ 151.652213][ T6177] dump_stack_lvl+0xe8/0x150 [ 151.652241][ T6177] should_fail_ex+0x467/0x600 [ 151.652268][ T6177] should_failslab+0xa8/0x100 [ 151.652287][ T6177] __kmalloc_cache_noprof+0xa1/0x670 [ 151.652314][ T6177] ? kvm_dev_ioctl+0x8ee/0x1620 [ 151.652340][ T6177] ? kvm_dev_ioctl+0x8ee/0x1620 [ 151.652371][ T6177] kvm_dev_ioctl+0x8ee/0x1620 [ 151.652404][ T6177] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 151.652428][ T6177] ? __fget_files+0x3a8/0x420 [ 151.652450][ T6177] ? bpf_lsm_file_ioctl+0x9/0x20 [ 151.652490][ T6177] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 151.652516][ T6177] __se_sys_ioctl+0xff/0x170 [ 151.652542][ T6177] do_syscall_64+0x17b/0x530 [ 151.652560][ T6177] ? irqentry_exit+0x10f/0x8f0 [ 151.652603][ T6177] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 151.652634][ T6177] ? clear_bhb_loop+0x40/0x90 [ 151.652656][ T6177] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 151.652674][ T6177] RIP: 0033:0x7f8f4f9be0d9 [ 151.652696][ T6177] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 151.652711][ T6177] RSP: 002b:00007f8f4dc16028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 151.652729][ T6177] RAX: ffffffffffffffda RBX: 00007f8f4fc45fa0 RCX: 00007f8f4f9be0d9 [ 151.652742][ T6177] RDX: 0000000000000000 RSI: 000000000000ae01 RDI: 0000000000000003 [ 151.652752][ T6177] RBP: 00007f8f4dc16090 R08: 0000000000000000 R09: 0000000000000000 [ 151.652763][ T6177] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 151.652773][ T6177] R13: 00007f8f4fc46038 R14: 00007f8f4fc45fa0 R15: 00007ffffdead5e8 [ 151.652799][ T6177] [ 152.090715][ T6182] process 'syz.3.126' launched '/dev/fd/6' with NULL argv: empty string added [ 152.205463][ T6186] FAULT_INJECTION: forcing a failure. [ 152.205463][ T6186] name failslab, interval 1, probability 0, space 0, times 0 [ 152.205500][ T6186] CPU: 0 UID: 0 PID: 6186 Comm: syz.1.127 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 152.205524][ T6186] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 152.205537][ T6186] Call Trace: [ 152.205544][ T6186] [ 152.205553][ T6186] dump_stack_lvl+0xe8/0x150 [ 152.205588][ T6186] should_fail_ex+0x467/0x600 [ 152.205621][ T6186] should_failslab+0xa8/0x100 [ 152.205644][ T6186] __kmalloc_noprof+0xfb/0x790 [ 152.205675][ T6186] ? tomoyo_realpath_from_path+0xef/0x640 [ 152.205708][ T6186] ? tomoyo_realpath_from_path+0xef/0x640 [ 152.205749][ T6186] tomoyo_realpath_from_path+0xef/0x640 [ 152.205794][ T6186] tomoyo_check_open_permission+0x229/0x470 [ 152.205825][ T6186] ? tomoyo_check_open_permission+0x1d3/0x470 [ 152.205854][ T6186] ? __pfx_tomoyo_check_open_permission+0x10/0x10 [ 152.205880][ T6186] ? do_raw_spin_lock+0x12b/0x2f0 [ 152.205948][ T6186] ? rt_spin_unlock+0x157/0x200 [ 152.205976][ T6186] ? tomoyo_file_open+0x166/0x220 [ 152.206015][ T6186] security_file_open+0x9c/0x200 [ 152.206042][ T6186] do_dentry_open+0x4be/0x1420 [ 152.206096][ T6186] vfs_open+0x3b/0x350 [ 152.206128][ T6186] ? path_openat+0x2e4d/0x3850 [ 152.206157][ T6186] path_openat+0x2e64/0x3850 [ 152.206196][ T6186] ? __kasan_slab_alloc+0x6c/0x80 [ 152.206230][ T6186] ? do_sys_openat2+0xcc/0x200 [ 152.206262][ T6186] ? __x64_sys_openat+0x138/0x170 [ 152.206294][ T6186] ? do_syscall_64+0x17b/0x530 [ 152.206338][ T6186] do_file_open+0x23e/0x4a0 [ 152.206363][ T6186] ? lockdep_hardirqs_on+0x7a/0x110 [ 152.206388][ T6186] ? __pfx_do_file_open+0x10/0x10 [ 152.206440][ T6186] ? alloc_fd+0x654/0x6d0 [ 152.206473][ T6186] do_sys_openat2+0x115/0x200 [ 152.206510][ T6186] ? __pfx_do_sys_openat2+0x10/0x10 [ 152.206553][ T6186] ? rcu_is_watching+0x15/0xb0 [ 152.206583][ T6186] __x64_sys_openat+0x138/0x170 [ 152.206625][ T6186] do_syscall_64+0x17b/0x530 [ 152.206647][ T6186] ? irqentry_exit+0x10f/0x8f0 [ 152.206667][ T6186] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 152.206689][ T6186] ? clear_bhb_loop+0x40/0x90 [ 152.206717][ T6186] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 152.206739][ T6186] RIP: 0033:0x7ff9120fe0d9 [ 152.206759][ T6186] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 152.206777][ T6186] RSP: 002b:00007ff910356028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 152.206799][ T6186] RAX: ffffffffffffffda RBX: 00007ff912385fa0 RCX: 00007ff9120fe0d9 [ 152.206815][ T6186] RDX: 0000000000000001 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 152.206830][ T6186] RBP: 00007ff910356090 R08: 0000000000000000 R09: 0000000000000000 [ 152.206844][ T6186] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 152.206856][ T6186] R13: 00007ff912386038 R14: 00007ff912385fa0 R15: 00007ffe2d8d87c8 [ 152.206892][ T6186] [ 152.221311][ T6186] ERROR: Out of memory at tomoyo_realpath_from_path. [ 152.656552][ T6190] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 152.657079][ T6190] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 152.683627][ T6190] netlink: 4 bytes leftover after parsing attributes in process `syz.1.130'. [ 152.724443][ T6190] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 152.725115][ T6190] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 152.840670][ T6195] FAULT_INJECTION: forcing a failure. [ 152.840670][ T6195] name failslab, interval 1, probability 0, space 0, times 0 [ 152.840706][ T6195] CPU: 0 UID: 0 PID: 6195 Comm: syz.0.131 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 152.840730][ T6195] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 152.840743][ T6195] Call Trace: [ 152.840751][ T6195] [ 152.840760][ T6195] dump_stack_lvl+0xe8/0x150 [ 152.840793][ T6195] should_fail_ex+0x467/0x600 [ 152.840828][ T6195] should_failslab+0xa8/0x100 [ 152.840852][ T6195] __kmalloc_noprof+0xfb/0x790 [ 152.840883][ T6195] ? tomoyo_encode+0x2ad/0x570 [ 152.840923][ T6195] ? tomoyo_encode+0x2ad/0x570 [ 152.840960][ T6195] tomoyo_encode+0x2ad/0x570 [ 152.840998][ T6195] tomoyo_realpath_from_path+0x5fa/0x640 [ 152.841043][ T6195] ? tomoyo_path_number_perm+0x219/0x5f0 [ 152.841072][ T6195] tomoyo_path_number_perm+0x246/0x5f0 [ 152.841103][ T6195] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 152.841131][ T6195] ? do_raw_spin_lock+0x12b/0x2f0 [ 152.841176][ T6195] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 152.841199][ T6195] ? lockdep_hardirqs_on+0x7a/0x110 [ 152.841239][ T6195] ? __fget_files+0x2a/0x420 [ 152.841266][ T6195] ? __fget_files+0x3a8/0x420 [ 152.841288][ T6195] ? __fget_files+0x2a/0x420 [ 152.841316][ T6195] security_file_ioctl+0xb9/0x260 [ 152.841344][ T6195] __se_sys_ioctl+0x47/0x170 [ 152.841377][ T6195] do_syscall_64+0x17b/0x530 [ 152.841399][ T6195] ? irqentry_exit+0x10f/0x8f0 [ 152.841420][ T6195] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 152.841447][ T6195] ? clear_bhb_loop+0x40/0x90 [ 152.841474][ T6195] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 152.841496][ T6195] RIP: 0033:0x7f08a0b8e0d9 [ 152.841516][ T6195] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 152.841533][ T6195] RSP: 002b:00007f089ede6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 152.841556][ T6195] RAX: ffffffffffffffda RBX: 00007f08a0e15fa0 RCX: 00007f08a0b8e0d9 [ 152.841572][ T6195] RDX: 0000200000000040 RSI: 0000000000008b2a RDI: 0000000000000003 [ 152.841586][ T6195] RBP: 00007f089ede6090 R08: 0000000000000000 R09: 0000000000000000 [ 152.841599][ T6195] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 152.841611][ T6195] R13: 00007f08a0e16038 R14: 00007f08a0e15fa0 R15: 00007ffe3b87cca8 [ 152.841646][ T6195] [ 152.871853][ T6195] ERROR: Out of memory at tomoyo_realpath_from_path. [ 153.267362][ T6201] netlink: 44 bytes leftover after parsing attributes in process `syz.2.134'. [ 153.267388][ T6201] netlink: 59 bytes leftover after parsing attributes in process `syz.2.134'. [ 153.268193][ T6201] netlink: 59 bytes leftover after parsing attributes in process `syz.2.134'. [ 153.840924][ T1010] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 154.198780][ T6208] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 154.355204][ T6227] netlink: 12 bytes leftover after parsing attributes in process `syz.1.142'. [ 154.374250][ T6227] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 154.374897][ T6227] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 154.666653][ T5599] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 154.821113][ T5599] usb 4-1: device descriptor read/64, error -71 [ 155.006557][ T10] usb 3-1: new full-speed USB device number 11 using dummy_hcd [ 155.068660][ T5599] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 155.096544][ T5751] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 155.181707][ T10] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 155.181736][ T10] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 155.184152][ T10] usb 3-1: New USB device found, idVendor=0c72, idProduct=0013, bcdDevice=ba.be [ 155.184182][ T10] usb 3-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 155.184197][ T10] usb 3-1: Product: syz [ 155.184208][ T10] usb 3-1: Manufacturer: syz [ 155.184218][ T10] usb 3-1: SerialNumber: syz [ 155.196563][ T5599] usb 4-1: device descriptor read/64, error -71 [ 155.199063][ T10] usb 3-1: config 0 descriptor?? [ 155.276517][ T5751] usb 1-1: Using ep0 maxpacket: 16 [ 155.279866][ T5751] usb 1-1: unable to get BOS descriptor or descriptor too short [ 155.281197][ T5751] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 155.281277][ T5751] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 155.281320][ T5751] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 155.284712][ T5751] usb 1-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 155.284740][ T5751] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 155.284760][ T5751] usb 1-1: Product: syz [ 155.284775][ T5751] usb 1-1: Manufacturer: syz [ 155.284791][ T5751] usb 1-1: SerialNumber: syz [ 155.350604][ T5599] usb usb4-port1: attempt power cycle [ 155.619249][ T6243] netlink: 4 bytes leftover after parsing attributes in process `syz.0.147'. [ 155.660125][ T5751] usb 1-1: Audio class v2/v3 interfaces need an interface association [ 155.660614][ T5751] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 155.756722][ T5599] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 155.780277][ T5599] usb 4-1: device descriptor read/8, error -71 [ 155.865081][ T6243] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 155.866226][ T6243] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 156.016532][ T5599] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 156.038685][ T5599] usb 4-1: device descriptor read/8, error -71 [ 156.159210][ T5599] usb usb4-port1: unable to enumerate USB device [ 156.343092][ T5751] usb 1-1: USB disconnect, device number 13 [ 156.480557][ T5848] udevd[5848]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 157.378834][ T49] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 157.547728][ T49] usb 1-1: Using ep0 maxpacket: 32 [ 157.551270][ T49] usb 1-1: unable to get BOS descriptor or descriptor too short [ 157.585288][ T49] usb 1-1: New USB device found, idVendor=0763, idProduct=0150, bcdDevice= 0.40 [ 157.585316][ T49] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 157.585336][ T49] usb 1-1: Product: syz [ 157.585350][ T49] usb 1-1: SerialNumber: syz [ 157.923910][ T446] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 157.943686][ T49] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 157.943755][ T49] usb 1-1: MIDIStreaming interface descriptor not found [ 158.016514][ T5751] usb 4-1: new low-speed USB device number 14 using dummy_hcd [ 158.147241][ T5751] usb 4-1: device descriptor read/64, error -71 [ 158.322704][ T10] usb 3-1: USB disconnect, device number 11 [ 158.388394][ T5751] usb 4-1: new low-speed USB device number 15 using dummy_hcd [ 158.413164][ T49] usb 1-1: USB disconnect, device number 14 [ 158.585359][ T5751] usb 4-1: device descriptor read/64, error -71 [ 158.666137][ T5588] udevd[5588]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 158.689117][ T5751] usb usb4-port1: attempt power cycle [ 158.803524][ T6277] FAULT_INJECTION: forcing a failure. [ 158.803524][ T6277] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 158.803561][ T6277] CPU: 1 UID: 0 PID: 6277 Comm: syz.0.156 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 158.803585][ T6277] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 158.803598][ T6277] Call Trace: [ 158.803606][ T6277] [ 158.803616][ T6277] dump_stack_lvl+0xe8/0x150 [ 158.803650][ T6277] should_fail_ex+0x467/0x600 [ 158.803684][ T6277] _copy_to_user+0x31/0xb0 [ 158.803708][ T6277] simple_read_from_buffer+0xe1/0x170 [ 158.803737][ T6277] proc_fail_nth_read+0x1be/0x230 [ 158.803765][ T6277] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 158.803792][ T6277] ? rw_verify_area+0x250/0x4d0 [ 158.803820][ T6277] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 158.803842][ T6277] vfs_read+0x219/0xa90 [ 158.803877][ T6277] ? __pfx_vfs_read+0x10/0x10 [ 158.803904][ T6277] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 158.803927][ T6277] ? lockdep_hardirqs_on+0x7a/0x110 [ 158.803949][ T6277] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 158.803971][ T6277] ? mutex_lock_nested+0x152/0x1d0 [ 158.803998][ T6277] ? fdget_pos+0x252/0x320 [ 158.804030][ T6277] ksys_read+0x156/0x270 [ 158.804059][ T6277] ? __pfx_ksys_read+0x10/0x10 [ 158.804095][ T6277] do_syscall_64+0x17b/0x530 [ 158.804121][ T6277] ? irqentry_exit+0x10f/0x8f0 [ 158.804141][ T6277] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.804164][ T6277] ? clear_bhb_loop+0x40/0x90 [ 158.804191][ T6277] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.804213][ T6277] RIP: 0033:0x7f08a0b4e90e [ 158.804232][ T6277] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 158.804251][ T6277] RSP: 002b:00007f089ede5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 158.804273][ T6277] RAX: ffffffffffffffda RBX: 00007f089ede66c0 RCX: 00007f08a0b4e90e [ 158.804289][ T6277] RDX: 000000000000000f RSI: 00007f089ede60a0 RDI: 0000000000000004 [ 158.804302][ T6277] RBP: 00007f089ede6090 R08: 0000000000000000 R09: 0000000000000000 [ 158.804314][ T6277] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 158.804327][ T6277] R13: 00007f08a0e16038 R14: 00007f08a0e15fa0 R15: 00007ffe3b87cca8 [ 158.804360][ T6277] [ 159.066734][ T5751] usb 4-1: new low-speed USB device number 16 using dummy_hcd [ 159.093495][ T5751] usb 4-1: device descriptor read/8, error -71 [ 159.094350][ T6281] FAULT_INJECTION: forcing a failure. [ 159.094350][ T6281] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 159.094374][ T6281] CPU: 1 UID: 0 PID: 6281 Comm: syz.1.157 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 159.094392][ T6281] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 159.094401][ T6281] Call Trace: [ 159.094407][ T6281] [ 159.094413][ T6281] dump_stack_lvl+0xe8/0x150 [ 159.094439][ T6281] should_fail_ex+0x467/0x600 [ 159.094464][ T6281] _copy_to_user+0x31/0xb0 [ 159.094487][ T6281] simple_read_from_buffer+0xe1/0x170 [ 159.094508][ T6281] proc_fail_nth_read+0x1be/0x230 [ 159.094528][ T6281] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 159.094547][ T6281] ? rw_verify_area+0x250/0x4d0 [ 159.094566][ T6281] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 159.094583][ T6281] vfs_read+0x219/0xa90 [ 159.094607][ T6281] ? __pfx_vfs_read+0x10/0x10 [ 159.094626][ T6281] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 159.094642][ T6281] ? lockdep_hardirqs_on+0x7a/0x110 [ 159.094657][ T6281] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 159.094671][ T6281] ? mutex_lock_nested+0x152/0x1d0 [ 159.094690][ T6281] ? fdget_pos+0x252/0x320 [ 159.094712][ T6281] ksys_read+0x156/0x270 [ 159.094731][ T6281] ? __pfx_ksys_read+0x10/0x10 [ 159.094756][ T6281] do_syscall_64+0x17b/0x530 [ 159.094795][ T6281] ? irqentry_exit+0x10f/0x8f0 [ 159.094816][ T6281] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 159.094839][ T6281] ? clear_bhb_loop+0x40/0x90 [ 159.094868][ T6281] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 159.094893][ T6281] RIP: 0033:0x7ff9120be90e [ 159.094907][ T6281] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 159.094919][ T6281] RSP: 002b:00007ff910355fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 159.094936][ T6281] RAX: ffffffffffffffda RBX: 00007ff9103566c0 RCX: 00007ff9120be90e [ 159.094947][ T6281] RDX: 000000000000000f RSI: 00007ff9103560a0 RDI: 0000000000000003 [ 159.094957][ T6281] RBP: 00007ff910356090 R08: 0000000000000000 R09: 0000000000000000 [ 159.094966][ T6281] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 159.094976][ T6281] R13: 00007ff912386038 R14: 00007ff912385fa0 R15: 00007ffe2d8d87c8 [ 159.095001][ T6281] [ 159.346540][ T5751] usb 4-1: new low-speed USB device number 17 using dummy_hcd [ 159.372594][ T5751] usb 4-1: device descriptor read/8, error -71 [ 159.477124][ T5751] usb usb4-port1: unable to enumerate USB device [ 159.479587][ T6286] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 159.480315][ T6286] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 159.484657][ T6286] netlink: 4 bytes leftover after parsing attributes in process `syz.1.159'. [ 159.552498][ T6286] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 159.553108][ T6286] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 160.957558][ T6305] netlink: 'syz.3.165': attribute type 1 has an invalid length. [ 160.978476][ T6306] netlink: 'syz.3.165': attribute type 1 has an invalid length. [ 161.030911][ T6303] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 161.042480][ T6303] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 161.246910][ T6309] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 161.266572][ T5751] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 161.396515][ T5751] usb 4-1: device descriptor read/64, error -71 [ 161.647992][ T6321] netlink: 'syz.0.170': attribute type 10 has an invalid length. [ 161.657128][ T5751] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 161.726591][ T198] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 161.765678][ T6321] team0: Device wg2 is of different type [ 161.796503][ T5751] usb 4-1: device descriptor read/64, error -71 [ 161.876522][ T198] usb 3-1: Using ep0 maxpacket: 16 [ 161.879270][ T198] usb 3-1: unable to get BOS descriptor or descriptor too short [ 161.881734][ T198] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 161.881855][ T198] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 161.881897][ T198] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 161.945861][ T5751] usb usb4-port1: attempt power cycle [ 161.960393][ T198] usb 3-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 161.960424][ T198] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 161.960445][ T198] usb 3-1: Product: syz [ 161.960460][ T198] usb 3-1: Manufacturer: syz [ 161.960474][ T198] usb 3-1: SerialNumber: syz [ 162.074815][ T6323] netlink: 196 bytes leftover after parsing attributes in process `syz.0.171'. [ 162.074966][ T6323] netlink: 'syz.0.171': attribute type 5 has an invalid length. [ 162.206198][ T6317] netlink: 4 bytes leftover after parsing attributes in process `syz.2.169'. [ 162.231757][ T198] usb 3-1: Audio class v2/v3 interfaces need an interface association [ 162.232089][ T198] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 162.286570][ T5751] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 162.307750][ T5751] usb 4-1: device descriptor read/8, error -71 [ 162.346556][ T10] usb 1-1: new low-speed USB device number 15 using dummy_hcd [ 162.441483][ T6317] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 162.443073][ T6317] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 162.546571][ T5751] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 162.567618][ T5751] usb 4-1: device descriptor read/8, error -71 [ 162.568900][ T10] usb 1-1: unable to get BOS descriptor or descriptor too short [ 162.572877][ T10] usb 1-1: config 255 has an invalid interface number: 80 but max is 0 [ 162.572909][ T10] usb 1-1: config 255 has no interface number 0 [ 162.572933][ T10] usb 1-1: config 255 interface 80 has no altsetting 0 [ 162.611907][ T10] usb 1-1: string descriptor 0 read error: -22 [ 162.624678][ T10] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice=53.b2 [ 162.624742][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 162.681490][ T5751] usb usb4-port1: unable to enumerate USB device [ 162.703928][ T198] usb 3-1: 2:1 : can't get Cluster Descriptor [ 162.739774][ T10] usbtest 1-1:255.80: Linux user mode ISO test driver [ 162.739805][ T10] usbtest 1-1:255.80: low-speed {control} tests [ 162.919580][ T6323] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 162.922181][ T6323] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 162.998705][ T10] usb 3-1: USB disconnect, device number 12 [ 163.132653][ T6323] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 163.133304][ T6323] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 163.179831][ T198] usb 1-1: USB disconnect, device number 15 [ 163.695009][ T6328] syzkaller1: entered promiscuous mode [ 163.695037][ T6328] syzkaller1: entered allmulticast mode [ 163.752042][ T6330] syz.0.174 (6330): attempted to duplicate a private mapping with mremap. This is not supported. [ 163.861027][ T69] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 163.885161][ T6332] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 164.029945][ T6335] block nbd0: not configured, cannot reconfigure [ 164.030074][ T6335] FAULT_INJECTION: forcing a failure. [ 164.030074][ T6335] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 164.030224][ T6335] CPU: 1 UID: 0 PID: 6335 Comm: syz.0.176 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 164.030249][ T6335] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 164.030272][ T6335] Call Trace: [ 164.030280][ T6335] [ 164.030289][ T6335] dump_stack_lvl+0xe8/0x150 [ 164.030324][ T6335] should_fail_ex+0x467/0x600 [ 164.030360][ T6335] _copy_from_user+0x2d/0xb0 [ 164.030383][ T6335] kstrtouint_from_user+0xd6/0x180 [ 164.030417][ T6335] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 164.030448][ T6335] ? __lock_acquire+0x6df/0x2e40 [ 164.030470][ T6335] ? trace_raw_output_btrfs_log_inode_enter+0x500/0x500 [ 164.030511][ T6335] ? lock_acquire+0x115/0x350 [ 164.030551][ T6335] proc_fail_nth_write+0x8e/0x210 [ 164.030576][ T6335] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 164.030609][ T6335] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 164.030632][ T6335] vfs_write+0x29f/0xbb0 [ 164.030669][ T6335] ? __pfx_vfs_write+0x10/0x10 [ 164.030699][ T6335] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 164.030723][ T6335] ? lockdep_hardirqs_on+0x7a/0x110 [ 164.030745][ T6335] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 164.030768][ T6335] ? mutex_lock_nested+0x152/0x1d0 [ 164.030794][ T6335] ? fdget_pos+0x252/0x320 [ 164.030827][ T6335] ksys_write+0x156/0x270 [ 164.030855][ T6335] ? __pfx_ksys_write+0x10/0x10 [ 164.030893][ T6335] do_syscall_64+0x17b/0x530 [ 164.030916][ T6335] ? irqentry_exit+0x10f/0x8f0 [ 164.030934][ T6335] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 164.030964][ T6335] ? clear_bhb_loop+0x40/0x90 [ 164.030986][ T6335] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 164.031004][ T6335] RIP: 0033:0x7f08a0b4e90e [ 164.031022][ T6335] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 164.031036][ T6335] RSP: 002b:00007f089ede5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 164.031055][ T6335] RAX: ffffffffffffffda RBX: 00007f089ede66c0 RCX: 00007f08a0b4e90e [ 164.031068][ T6335] RDX: 0000000000000001 RSI: 00007f089ede60a0 RDI: 0000000000000003 [ 164.031079][ T6335] RBP: 00007f089ede6090 R08: 0000000000000000 R09: 0000000000000000 [ 164.031089][ T6335] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 164.031099][ T6335] R13: 00007f08a0e16038 R14: 00007f08a0e15fa0 R15: 00007ffe3b87cca8 [ 164.031125][ T6335] [ 164.767604][ T6352] FAULT_INJECTION: forcing a failure. [ 164.767604][ T6352] name failslab, interval 1, probability 0, space 0, times 0 [ 164.767642][ T6352] CPU: 0 UID: 0 PID: 6352 Comm: syz.0.183 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 164.767666][ T6352] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 164.767678][ T6352] Call Trace: [ 164.767686][ T6352] [ 164.767695][ T6352] dump_stack_lvl+0xe8/0x150 [ 164.767728][ T6352] should_fail_ex+0x467/0x600 [ 164.767763][ T6352] should_failslab+0xa8/0x100 [ 164.767785][ T6352] kmem_cache_alloc_node_noprof+0xac/0x660 [ 164.767815][ T6352] ? __alloc_skb+0x1d7/0x7a0 [ 164.767842][ T6352] ? __alloc_skb+0x1d7/0x7a0 [ 164.767876][ T6352] __alloc_skb+0x1d7/0x7a0 [ 164.767907][ T6352] netlink_ack+0x136/0xb30 [ 164.767945][ T6352] ? __kmalloc_cache_noprof+0x3cd/0x670 [ 164.767976][ T6352] ? nfnetlink_rcv+0x102a/0x28d0 [ 164.768014][ T6352] nfnetlink_rcv+0x2613/0x28d0 [ 164.768079][ T6352] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 164.768123][ T6352] ? __pfx_save_netdev_trace_buffer+0x10/0x10 [ 164.768144][ T6352] ? ref_tracker_free+0x668/0x820 [ 164.768197][ T6352] ? skb_clone+0x246/0x3a0 [ 164.768233][ T6352] ? __netlink_deliver_tap+0x838/0x880 [ 164.768275][ T6352] ? netlink_deliver_tap+0x2e/0x1b0 [ 164.768307][ T6352] ? netlink_deliver_tap+0x2e/0x1b0 [ 164.768345][ T6352] netlink_unicast+0x7f5/0x990 [ 164.768386][ T6352] netlink_sendmsg+0x813/0xb40 [ 164.768430][ T6352] ? __pfx_netlink_sendmsg+0x10/0x10 [ 164.768466][ T6352] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 164.768503][ T6352] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 164.768536][ T6352] ? arch_stack_walk+0xfb/0x150 [ 164.768570][ T6352] ? __pfx_netlink_sendmsg+0x10/0x10 [ 164.768618][ T6352] sock_sendmsg_nosec+0x13a/0x180 [ 164.768646][ T6352] ____sys_sendmsg+0x565/0x870 [ 164.768688][ T6352] ? __pfx_____sys_sendmsg+0x10/0x10 [ 164.768729][ T6352] ? import_iovec+0x73/0xa0 [ 164.768766][ T6352] ___sys_sendmsg+0x2a5/0x360 [ 164.768796][ T6352] ? __lock_acquire+0x6df/0x2e40 [ 164.768819][ T6352] ? __pfx____sys_sendmsg+0x10/0x10 [ 164.768889][ T6352] ? __fget_files+0x2a/0x420 [ 164.768910][ T6352] ? __fget_files+0x3a8/0x420 [ 164.768941][ T6352] __x64_sys_sendmsg+0x1b7/0x290 [ 164.768976][ T6352] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 164.769027][ T6352] do_syscall_64+0x17b/0x530 [ 164.769048][ T6352] ? irqentry_exit+0x10f/0x8f0 [ 164.769067][ T6352] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 164.769088][ T6352] ? clear_bhb_loop+0x40/0x90 [ 164.769116][ T6352] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 164.769137][ T6352] RIP: 0033:0x7f08a0b8e0d9 [ 164.769156][ T6352] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 164.769173][ T6352] RSP: 002b:00007f089ede6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 164.769195][ T6352] RAX: ffffffffffffffda RBX: 00007f08a0e15fa0 RCX: 00007f08a0b8e0d9 [ 164.769211][ T6352] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 164.769225][ T6352] RBP: 00007f089ede6090 R08: 0000000000000000 R09: 0000000000000000 [ 164.769237][ T6352] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 164.769249][ T6352] R13: 00007f08a0e16038 R14: 00007f08a0e15fa0 R15: 00007ffe3b87cca8 [ 164.769282][ T6352] [ 165.086522][ T5751] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 165.236516][ T5751] usb 4-1: Using ep0 maxpacket: 16 [ 165.252003][ T5751] usb 4-1: unable to get BOS descriptor or descriptor too short [ 165.260387][ T5751] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 165.260469][ T5751] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 165.260512][ T5751] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 165.286667][ T5751] usb 4-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 165.286698][ T5751] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 165.286718][ T5751] usb 4-1: Product: syz [ 165.286734][ T5751] usb 4-1: Manufacturer: syz [ 165.286749][ T5751] usb 4-1: SerialNumber: syz [ 165.471506][ T6360] dvmrp8: entered allmulticast mode [ 165.567074][ T6347] netlink: 4 bytes leftover after parsing attributes in process `syz.3.181'. [ 165.612212][ T5751] usb 4-1: Audio class v2/v3 interfaces need an interface association [ 165.615992][ T5751] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 165.666522][ T5753] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 165.701796][ T5600] Bluetooth: hci0: Zero size dump init pkt [ 165.743058][ T5600] Bluetooth: hci0: Zero size dump init pkt [ 165.811615][ T6347] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 165.814932][ T6347] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 165.892341][ T5753] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 165.892436][ T5753] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 165.892454][ T5753] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 165.944183][ T5753] usb 1-1: config 0 descriptor?? [ 166.054329][ T5751] usb 4-1: 2:1 : can't get Cluster Descriptor [ 166.392831][ T10] usb 4-1: USB disconnect, device number 22 [ 166.469904][ T5753] usbhid 1-1:0.0: can't add hid device: -71 [ 166.469998][ T5753] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 166.516890][ T5753] usb 1-1: USB disconnect, device number 16 [ 166.781043][ T6382] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 166.781907][ T6382] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 166.933868][ T6387] FAULT_INJECTION: forcing a failure. [ 166.933868][ T6387] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 166.933905][ T6387] CPU: 1 UID: 0 PID: 6387 Comm: syz.2.194 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 166.933929][ T6387] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 166.933943][ T6387] Call Trace: [ 166.933951][ T6387] [ 166.933966][ T6387] dump_stack_lvl+0xe8/0x150 [ 166.933992][ T6387] should_fail_ex+0x467/0x600 [ 166.934017][ T6387] _copy_from_user+0x2d/0xb0 [ 166.934032][ T6387] kstrtouint_from_user+0xd6/0x180 [ 166.934056][ T6387] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 166.934076][ T6387] ? __lock_acquire+0x6df/0x2e40 [ 166.934113][ T6387] ? trace_raw_output_btrfs_log_inode_enter+0x500/0x500 [ 166.934154][ T6387] ? lock_acquire+0x115/0x350 [ 166.934191][ T6387] proc_fail_nth_write+0x8e/0x210 [ 166.934216][ T6387] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 166.934253][ T6387] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 166.934270][ T6387] vfs_write+0x29f/0xbb0 [ 166.934296][ T6387] ? __pfx_vfs_write+0x10/0x10 [ 166.934316][ T6387] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 166.934333][ T6387] ? lockdep_hardirqs_on+0x7a/0x110 [ 166.934348][ T6387] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 166.934366][ T6387] ? mutex_lock_nested+0x152/0x1d0 [ 166.934386][ T6387] ? fdget_pos+0x252/0x320 [ 166.934409][ T6387] ksys_write+0x156/0x270 [ 166.934429][ T6387] ? __pfx_ksys_write+0x10/0x10 [ 166.934455][ T6387] do_syscall_64+0x17b/0x530 [ 166.934471][ T6387] ? irqentry_exit+0x10f/0x8f0 [ 166.934485][ T6387] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 166.934501][ T6387] ? clear_bhb_loop+0x40/0x90 [ 166.934521][ T6387] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 166.934537][ T6387] RIP: 0033:0x7f5319b4e90e [ 166.934551][ T6387] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 166.934563][ T6387] RSP: 002b:00007f5317de5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 166.934579][ T6387] RAX: ffffffffffffffda RBX: 00007f5317de66c0 RCX: 00007f5319b4e90e [ 166.934597][ T6387] RDX: 0000000000000001 RSI: 00007f5317de60a0 RDI: 0000000000000003 [ 166.934606][ T6387] RBP: 00007f5317de6090 R08: 0000000000000000 R09: 0000000000000000 [ 166.934616][ T6387] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 166.934625][ T6387] R13: 00007f5319e16038 R14: 00007f5319e15fa0 R15: 00007ffc31db5b98 [ 166.934649][ T6387] [ 167.096644][ T5753] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 167.308857][ T5753] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 167.308910][ T5753] usb 1-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 167.308935][ T5753] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 167.395756][ T5753] usb 1-1: config 0 descriptor?? [ 167.577116][ T6398] netlink: 16 bytes leftover after parsing attributes in process `syz.3.195'. [ 167.658907][ T6399] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 167.964934][ T6404] syz.2.198 (6404) used greatest stack depth: 18688 bytes left [ 168.238162][ T5753] aiptek 1-1:0.0: Aiptek using 400 ms programming speed [ 168.272718][ T6359] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 168.290321][ T6359] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 168.319123][ T5753] input: Aiptek as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input5 [ 168.488144][ T10] usb 4-1: new full-speed USB device number 23 using dummy_hcd [ 168.690192][ T10] usb 4-1: unable to get BOS descriptor or descriptor too short [ 168.716203][ T10] usb 4-1: not running at top speed; connect to a high speed hub [ 168.735353][ T10] usb 4-1: config 1 has an invalid interface number: 93 but max is 0 [ 168.735384][ T10] usb 4-1: config 1 has no interface number 0 [ 168.735431][ T10] usb 4-1: config 1 interface 93 has no altsetting 0 [ 168.764856][ T10] usb 4-1: New USB device found, idVendor=0c72, idProduct=000c, bcdDevice= e.3d [ 168.764890][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 168.764912][ T10] usb 4-1: Product: syz [ 168.764927][ T10] usb 4-1: Manufacturer: syz [ 168.764942][ T10] usb 4-1: SerialNumber: syz [ 168.776464][ T198] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 168.951777][ T198] usb 3-1: device descriptor read/64, error -71 [ 169.021285][ T5600] Bluetooth: hci2: unknown advertising packet type: 0x63 [ 169.021324][ T5600] Bluetooth: hci2: unknown advertising packet type: 0x1c [ 169.021339][ T5600] Bluetooth: hci2: unknown advertising packet type: 0xe2 [ 169.230019][ T198] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 169.354293][ T6374] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 169.373406][ T6374] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 169.426508][ T198] usb 3-1: device descriptor read/64, error -71 [ 169.537542][ T198] usb usb3-port1: attempt power cycle [ 169.633069][ T6420] netlink: 'syz.3.201': attribute type 27 has an invalid length. [ 169.998686][ T198] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 170.041226][ T198] usb 3-1: device descriptor read/8, error -71 [ 170.599034][ T198] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 170.655494][ T198] usb 3-1: device descriptor read/8, error -71 [ 170.665866][ T6374] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 170.765984][ T198] usb usb3-port1: unable to enumerate USB device [ 171.066069][ T6424] netlink: 'syz.1.203': attribute type 21 has an invalid length. [ 171.091560][ T6374] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 171.092456][ T6374] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 171.186620][ T6374] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 171.300098][ T6374] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 171.300397][ T6374] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 171.388762][ T5600] Bluetooth: hci1: command 0x0c1a tx timeout [ 171.569952][ T6374] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 172.103390][ T6424] netlink: 'syz.1.203': attribute type 1 has an invalid length. [ 172.307159][ T10] usb 4-1: USB disconnect, device number 23 [ 172.324962][ T5751] usb 1-1: USB disconnect, device number 17 [ 172.325051][ C1] aiptek 1-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 173.050012][ T6447] netlink: 666 bytes leftover after parsing attributes in process `syz.1.207'. [ 173.150556][ T5600] Bluetooth: hci3: command 0x0c1a tx timeout [ 173.316530][ T5600] Bluetooth: hci2: command 0x0c1a tx timeout [ 173.466679][ T5600] Bluetooth: hci1: command 0x0c1a tx timeout [ 173.916410][ T6451] sg_write: data in/out 307589/136 bytes for SCSI command 0x0-- guessing data in; [ 173.916410][ T6451] program syz.2.210 not setting count and/or reply_len properly [ 174.267162][ T6451] netlink: 8 bytes leftover after parsing attributes in process `syz.2.210'. [ 175.386605][ T5600] Bluetooth: hci2: command 0x0c1a tx timeout [ 175.546542][ T5600] Bluetooth: hci1: command 0x0c1a tx timeout [ 175.890990][ T5600] Bluetooth: hci3: command 0x0c1a tx timeout [ 176.383573][ T6466] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 176.383628][ T6466] overlayfs: option "index=on" is useless in a non-upper mount, ignore [ 176.383676][ T6466] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 176.661338][ T6484] syzkaller1: entered promiscuous mode [ 176.661367][ T6484] syzkaller1: entered allmulticast mode [ 177.467137][ T5600] Bluetooth: hci2: command 0x0c1a tx timeout [ 177.946620][ T5600] Bluetooth: hci3: command 0x0c1a tx timeout [ 177.978163][ T49] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 178.152602][ T49] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 246, changing to 11 [ 178.152639][ T49] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 178.152683][ T49] usb 4-1: New USB device found, idVendor=20a0, idProduct=4287, bcdDevice= 0.00 [ 178.152708][ T49] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 178.223472][ T6497] 9p: Bad value for 'rfdno' [ 178.223883][ T49] usb 4-1: config 0 descriptor?? [ 178.374647][ T6498] tmpfs: Unknown parameter 'mpolUd—«¬2lc' [ 178.755843][ T49] hid-u2fzero 0003:20A0:4287.0002: unknown main item tag 0x0 [ 178.755882][ T49] hid-u2fzero 0003:20A0:4287.0002: unknown main item tag 0x0 [ 178.755910][ T49] hid-u2fzero 0003:20A0:4287.0002: unknown main item tag 0x0 [ 178.755937][ T49] hid-u2fzero 0003:20A0:4287.0002: unknown main item tag 0x0 [ 178.755964][ T49] hid-u2fzero 0003:20A0:4287.0002: unknown main item tag 0x0 [ 178.755991][ T49] hid-u2fzero 0003:20A0:4287.0002: unknown main item tag 0x0 [ 178.756017][ T49] hid-u2fzero 0003:20A0:4287.0002: unknown main item tag 0x0 [ 178.756044][ T49] hid-u2fzero 0003:20A0:4287.0002: unknown main item tag 0x0 [ 178.756071][ T49] hid-u2fzero 0003:20A0:4287.0002: unknown main item tag 0x0 [ 178.756098][ T49] hid-u2fzero 0003:20A0:4287.0002: unknown main item tag 0x0 [ 178.839445][ T49] hid-u2fzero 0003:20A0:4287.0002: collection stack underflow [ 178.839479][ T49] hid-u2fzero 0003:20A0:4287.0002: item 0 0 0 12 parsing failed [ 178.840420][ T49] hid-u2fzero 0003:20A0:4287.0002: probe with driver hid-u2fzero failed with error -22 [ 179.423628][ T49] usb 4-1: USB disconnect, device number 24 [ 179.554499][ T32] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 179.741034][ T32] usb 1-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 179.741308][ T32] usb 1-1: config 1 interface 0 altsetting 127 bulk endpoint 0x2 has invalid maxpacket 32 [ 179.741339][ T32] usb 1-1: config 1 interface 0 has no altsetting 0 [ 179.744993][ T32] usb 1-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 179.745021][ T32] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 179.745042][ T32] usb 1-1: Product: syz [ 179.745057][ T32] usb 1-1: Manufacturer: syz [ 179.745071][ T32] usb 1-1: SerialNumber: syz [ 179.825695][ T6506] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 179.825914][ T6506] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 181.181736][ T6520] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 181.198941][ T6520] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 184.861614][ T446] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 185.761533][ C1] raw-gadget.2 gadget.0: ignoring, device is not running [ 185.906197][ T32] rtl8150 1-1:1.0: couldn't reset the device [ 185.913935][ T32] rtl8150 1-1:1.0: probe with driver rtl8150 failed with error -5 [ 185.957010][ T32] usb 1-1: USB disconnect, device number 18 [ 186.146904][ T49] usb 3-1: new full-speed USB device number 17 using dummy_hcd [ 186.306528][ T49] usb 3-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice= 0.40 [ 186.306561][ T49] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 186.306582][ T49] usb 3-1: Product: syz [ 186.306597][ T49] usb 3-1: Manufacturer: syz [ 186.306612][ T49] usb 3-1: SerialNumber: syz [ 187.039682][ T6541] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 187.063869][ T6541] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 187.211575][ T6543] batadv0: entered allmulticast mode [ 187.305700][ T49] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 189.051993][ T12] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 189.655562][ T6547] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 189.698049][ T6547] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 190.781093][ T49] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 190.817618][ T49] usb 3-1: USB disconnect, device number 17 [ 190.953699][ T5848] udevd[5848]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 192.255495][ T5600] Bluetooth: hci3: unexpected subevent 0x10 length: 30 > 2 [ 192.858852][ T6557] overlayfs: conflicting options: userxattr,metacopy=on [ 192.966670][ T6559] netlink: 8 bytes leftover after parsing attributes in process `syz.2.243'. [ 193.436714][ T10] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 197.010851][ T1337] ieee802154 phy0 wpan0: encryption failed: -22 [ 197.010967][ T1337] ieee802154 phy1 wpan1: encryption failed: -22 [ 197.068378][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 197.240941][ T1425] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 197.559042][ T10] usb 1-1: device descriptor read/all, error -71 [ 198.326504][ T6422] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 203.966523][ T6422] usb 3-1: new full-speed USB device number 18 using dummy_hcd [ 204.561973][ T6422] usb 3-1: not running at top speed; connect to a high speed hub [ 204.564001][ T6422] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 204.564061][ T6422] usb 3-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice= 1.00 [ 204.564086][ T6422] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 204.902025][ T6600] netlink: 8 bytes leftover after parsing attributes in process `syz.0.254'. [ 204.902051][ T6600] netlink: 8 bytes leftover after parsing attributes in process `syz.0.254'. [ 204.904807][ T6422] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 207.323352][ T6422] gspca_vc032x: reg_r err -110 [ 207.323472][ T6422] vc032x 3-1:1.0: probe with driver vc032x failed with error -110 [ 207.561367][ T6422] usb 3-1: USB disconnect, device number 18 [ 209.076445][ T6422] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 209.252516][ T6422] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 209.252553][ T6422] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 209.252577][ T6422] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 209.252621][ T6422] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 209.252647][ T6422] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 209.318794][ T6422] usb 3-1: config 0 descriptor?? [ 213.712137][ T6422] plantronics 0003:047F:FFFF.0003: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 215.110785][ T10] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 216.166479][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 216.437774][ T10] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 216.437810][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 245, changing to 11 [ 216.437839][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid maxpacket 58613, setting to 1024 [ 216.437868][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 216.437895][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 216.446171][ T10] usb 4-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 216.446204][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 216.446225][ T10] usb 4-1: Product: syz [ 216.446240][ T10] usb 4-1: Manufacturer: syz [ 216.446256][ T10] usb 4-1: SerialNumber: syz [ 216.549812][ T10] usb 4-1: config 0 descriptor?? [ 217.860370][ T995] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 219.246734][ T10] iforce 4-1:0.0: usb_submit_urb failed: -110 [ 219.345497][ T32] usb 2-1: USB disconnect, device number 5 [ 220.729750][ T6422] usb 3-1: USB disconnect, device number 19 [ 220.746510][ T10] iforce 4-1:0.0: usb_submit_urb failed: -32 [ 220.747059][ T10] iforce 4-1:0.0: usb_submit_urb failed: -32 [ 220.747550][ T10] iforce 4-1:0.0: usb_submit_urb failed: -32 [ 220.748052][ T10] iforce 4-1:0.0: usb_submit_urb failed: -32 [ 220.748538][ T10] iforce 4-1:0.0: usb_submit_urb failed: -32 [ 220.752615][ T10] iforce 4-1:0.0: usb_submit_urb failed: -32 [ 220.762420][ T10] iforce 4-1:0.0: usb_submit_urb failed: -32 [ 220.762944][ T10] iforce 4-1:0.0: usb_submit_urb failed: -32 [ 220.763438][ T10] iforce 4-1:0.0: usb_submit_urb failed: -32 [ 220.763916][ T10] iforce 4-1:0.0: usb_submit_urb failed: -32 [ 220.764397][ T10] iforce 4-1:0.0: usb_submit_urb failed: -32 [ 220.764871][ T10] iforce 4-1:0.0: usb_submit_urb failed: -32 [ 220.766444][ T10] iforce 4-1:0.0: usb_submit_urb failed: -32 [ 220.766927][ T10] iforce 4-1:0.0: usb_submit_urb failed: -32 [ 220.769782][ T10] iforce 4-1:0.0: usb_submit_urb failed: -32 [ 220.777408][ T10] iforce 4-1:0.0: usb_submit_urb failed: -32 [ 220.780202][ T10] iforce 4-1:0.0: usb_submit_urb failed: -32 [ 220.780696][ T10] iforce 4-1:0.0: usb_submit_urb failed: -32 [ 220.780757][ T10] input input8: Timeout waiting for response from device. [ 221.260370][ T4904] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 221.350698][ T4904] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 221.366099][ T4904] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 221.382801][ T4904] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 221.383926][ T4904] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 221.995188][ T47] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 223.443885][ T4904] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 223.531630][ T4904] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 223.533195][ T4904] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 223.537974][ T4904] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 223.538835][ T4904] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 223.566572][ T4904] Bluetooth: hci4: command tx timeout [ 225.638032][ T5600] Bluetooth: hci4: command tx timeout [ 225.718758][ T5600] Bluetooth: hci5: command tx timeout [ 225.816285][ T4904] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 225.900737][ T4904] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 225.904315][ T4904] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 226.035809][ T4904] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 226.040498][ T4904] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 226.062987][ T9] usb 4-1: USB disconnect, device number 26 [ 227.921859][ T4904] Bluetooth: hci5: command tx timeout [ 227.924238][ T5600] Bluetooth: hci4: command tx timeout [ 228.426543][ T5600] Bluetooth: hci6: command tx timeout [ 229.306657][ T10] ------------[ cut here ]------------ [ 229.306674][ T10] faux_driver vkms: [drm] vblank wait timed out on crtc 0 [ 229.306709][ T10] WARNING: drivers/gpu/drm/drm_vblank.c:1329 at drm_crtc_wait_one_vblank+0x3bc/0x560, CPU#0: kworker/0:1/10 [ 229.306760][ T10] Modules linked in: [ 229.306785][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 229.306807][ T10] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 229.306821][ T10] Workqueue: events drm_fb_helper_damage_work [ 229.306845][ T10] RIP: 0010:drm_crtc_wait_one_vblank+0x51a/0x560 [ 229.306882][ T10] Code: c1 e8 03 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 4c 89 ef e8 f5 b6 aa fc 4d 8b 7d 00 4c 89 f7 4c 89 e6 4c 89 fa 89 d9 <67> 48 0f b9 3a 48 8b 3c 24 89 de e8 36 f4 ff ff b8 92 ff ff ff 49 [ 229.306899][ T10] RSP: 0018:ffffc900000f7840 EFLAGS: 00010246 [ 229.306918][ T10] RAX: 1ffff11004c52000 RBX: 0000000000000000 RCX: 0000000000000000 [ 229.306932][ T10] RDX: ffffffff8be3c600 RSI: ffffffff8be5a3a0 RDI: ffffffff8fdc0f10 [ 229.306949][ T10] RBP: ffffc900000f7928 R08: 0000000000000000 R09: 0000000000000000 [ 229.306963][ T10] R10: dffffc0000000000 R11: fffffbfff1fa1890 R12: ffffffff8be5a3a0 [ 229.306978][ T10] R13: ffff888026290000 R14: ffffffff8fdc0f10 R15: ffffffff8be3c600 [ 229.306994][ T10] FS: 0000000000000000(0000) GS:ffff8881259f2000(0000) knlGS:0000000000000000 [ 229.307012][ T10] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 229.307034][ T10] CR2: 000000110c4a0ea7 CR3: 00000000419c2000 CR4: 00000000003526f0 [ 229.307052][ T10] Call Trace: [ 229.307060][ T10] [ 229.307075][ T10] ? __pfx_drm_crtc_wait_one_vblank+0x10/0x10 [ 229.307109][ T10] ? rt_spin_unlock+0x157/0x200 [ 229.307138][ T10] ? __pfx_autoremove_wake_function+0x10/0x10 [ 229.307172][ T10] ? rt_spin_unlock+0x163/0x200 [ 229.307204][ T10] ? drm_vblank_get+0x147/0x280 [ 229.307240][ T10] drm_client_modeset_wait_for_vblank+0xc5/0xf0 [ 229.307276][ T10] drm_fb_helper_damage_work+0x6cf/0xf00 [ 229.307310][ T10] ? __pfx_drm_fb_helper_damage_work+0x10/0x10 [ 229.307352][ T10] ? lock_acquire+0x115/0x350 [ 229.307396][ T10] ? rcu_is_watching+0x15/0xb0 [ 229.307423][ T10] ? process_one_work+0x7fd/0x1480 [ 229.307448][ T10] process_one_work+0xaaf/0x1480 [ 229.307493][ T10] ? __pfx_process_one_work+0x10/0x10 [ 229.307513][ T10] ? do_raw_spin_lock+0x12b/0x2f0 [ 229.307553][ T10] ? assign_work+0x3cf/0x5d0 [ 229.307580][ T10] worker_thread+0xb05/0x10d0 [ 229.307616][ T10] ? __kthread_parkme+0x71/0x1f0 [ 229.307654][ T10] kthread+0x388/0x470 [ 229.307684][ T10] ? __pfx_worker_thread+0x10/0x10 [ 229.307705][ T10] ? __pfx_kthread+0x10/0x10 [ 229.307736][ T10] ret_from_fork+0x514/0xb70 [ 229.307770][ T10] ? __pfx_ret_from_fork+0x10/0x10 [ 229.307800][ T10] ? __switch_to+0xc89/0x1420 [ 229.307829][ T10] ? __pfx_kthread+0x10/0x10 [ 229.307861][ T10] ret_from_fork_asm+0x1a/0x30 [ 229.307911][ T10] [ 229.307922][ T10] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 229.307937][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 229.307961][ T10] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 229.307974][ T10] Workqueue: events drm_fb_helper_damage_work [ 229.307997][ T10] Call Trace: [ 229.308005][ T10] [ 229.308014][ T10] vpanic+0x56c/0xa60 [ 229.308044][ T10] ? __pfx__printk+0x10/0x10 [ 229.308071][ T10] ? __pfx_vpanic+0x10/0x10 [ 229.308090][ T10] ? is_bpf_text_address+0x292/0x2b0 [ 229.308115][ T10] ? is_bpf_text_address+0x26/0x2b0 [ 229.308149][ T10] panic+0xc5/0xd0 [ 229.308171][ T10] ? __pfx_panic+0x10/0x10 [ 229.308203][ T10] ? ret_from_fork_asm+0x1a/0x30 [ 229.308239][ T10] __warn+0x315/0x4c0 [ 229.308260][ T10] ? drm_crtc_wait_one_vblank+0x3bc/0x560 [ 229.308300][ T10] ? drm_crtc_wait_one_vblank+0x3bc/0x560 [ 229.308336][ T10] __report_bug+0x276/0x570 [ 229.308363][ T10] ? drm_crtc_wait_one_vblank+0x3bc/0x560 [ 229.308401][ T10] ? __pfx___report_bug+0x10/0x10 [ 229.308434][ T10] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 229.308457][ T10] ? lockdep_hardirqs_on+0x7a/0x110 [ 229.308478][ T10] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 229.308505][ T10] report_bug_entry+0x19a/0x290 [ 229.308529][ T10] ? drm_crtc_wait_one_vblank+0x51a/0x560 [ 229.308562][ T10] ? drm_crtc_wait_one_vblank+0x51f/0x560 [ 229.308596][ T10] handle_bug+0xce/0x200 [ 229.308623][ T10] exc_invalid_op+0x1a/0x50 [ 229.308649][ T10] asm_exc_invalid_op+0x1a/0x20 [ 229.308671][ T10] RIP: 0010:drm_crtc_wait_one_vblank+0x51a/0x560 [ 229.308708][ T10] Code: c1 e8 03 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 4c 89 ef e8 f5 b6 aa fc 4d 8b 7d 00 4c 89 f7 4c 89 e6 4c 89 fa 89 d9 <67> 48 0f b9 3a 48 8b 3c 24 89 de e8 36 f4 ff ff b8 92 ff ff ff 49 [ 229.308726][ T10] RSP: 0018:ffffc900000f7840 EFLAGS: 00010246 [ 229.308744][ T10] RAX: 1ffff11004c52000 RBX: 0000000000000000 RCX: 0000000000000000 [ 229.308758][ T10] RDX: ffffffff8be3c600 RSI: ffffffff8be5a3a0 RDI: ffffffff8fdc0f10 [ 229.308774][ T10] RBP: ffffc900000f7928 R08: 0000000000000000 R09: 0000000000000000 [ 229.308788][ T10] R10: dffffc0000000000 R11: fffffbfff1fa1890 R12: ffffffff8be5a3a0 [ 229.308804][ T10] R13: ffff888026290000 R14: ffffffff8fdc0f10 R15: ffffffff8be3c600 [ 229.308844][ T10] ? __pfx_drm_crtc_wait_one_vblank+0x10/0x10 [ 229.308877][ T10] ? rt_spin_unlock+0x157/0x200 [ 229.308906][ T10] ? __pfx_autoremove_wake_function+0x10/0x10 [ 229.308938][ T10] ? rt_spin_unlock+0x163/0x200 [ 229.308971][ T10] ? drm_vblank_get+0x147/0x280 [ 229.309008][ T10] drm_client_modeset_wait_for_vblank+0xc5/0xf0 [ 229.309049][ T10] drm_fb_helper_damage_work+0x6cf/0xf00 [ 229.309084][ T10] ? __pfx_drm_fb_helper_damage_work+0x10/0x10 [ 229.309125][ T10] ? lock_acquire+0x115/0x350 [ 229.309170][ T10] ? rcu_is_watching+0x15/0xb0 [ 229.309197][ T10] ? process_one_work+0x7fd/0x1480 [ 229.309221][ T10] process_one_work+0xaaf/0x1480 [ 229.309268][ T10] ? __pfx_process_one_work+0x10/0x10 [ 229.309288][ T10] ? do_raw_spin_lock+0x12b/0x2f0 [ 229.309327][ T10] ? assign_work+0x3cf/0x5d0 [ 229.309356][ T10] worker_thread+0xb05/0x10d0 [ 229.309391][ T10] ? __kthread_parkme+0x71/0x1f0 [ 229.309429][ T10] kthread+0x388/0x470 [ 229.309459][ T10] ? __pfx_worker_thread+0x10/0x10 [ 229.309481][ T10] ? __pfx_kthread+0x10/0x10 [ 229.309513][ T10] ret_from_fork+0x514/0xb70 [ 229.309547][ T10] ? __pfx_ret_from_fork+0x10/0x10 [ 229.309577][ T10] ? __switch_to+0xc89/0x1420 [ 229.309606][ T10] ? __pfx_kthread+0x10/0x10 [ 229.309638][ T10] ret_from_fork_asm+0x1a/0x30 [ 229.309686][ T10] [ 229.310294][ T10] Kernel Offset: disabled