last executing test programs: 10.756289237s ago: executing program 4 (id=677): syz_usb_connect$lan78xx(0x3, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x6, 0x100000b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80202, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x10) ioctl$F2FS_IOC_GARBAGE_COLLECT(r0, 0x4004f506, &(0x7f0000000080)) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)}, {0x0}], 0x2) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched_retired(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001400)=@newtaction={0x15c, 0x30, 0x1, 0x70bd29, 0x25dfdbfa, {}, [{0x148, 0x1, [@m_ipt={0x144, 0x1, 0x0, 0x0, {{0x8}, {0xcc, 0x2, 0x0, 0x1, [@TCA_IPT_TARG={0x91, 0x6, {0x9, 'mangle\x00', 0x4, 0x2, "f7c4bff37abfa63a3a3edf469d1925b8e2ab784e2c2becee1b6f4227dcdf72168f469984d47495bb9ed686a9d772222d5d47ddef541bb77a958d5e5ec0793163795735b05a96550578e77cc26c9c8c389f308782112130c0714002a493a6bd27546a20ea4d66ab"}}, @TCA_IPT_TABLE={0x24, 0x1, 'nat\x00'}, @TCA_IPT_HOOK={0x8, 0x2, 0x2}, @TCA_IPT_INDEX={0x8, 0x3, 0x4}]}, {0x53, 0x6, "c4c834e98c6449b68e05f93c4ae46d2b050a0d50c33fb1821fe82fd0b4cc9beef29c877c394fade8aa8dfa4b3fa7b600116572355c84a37e9c3bd5471be8f16c12977a3b1172884bc6f82e72da08da"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1}}}}]}]}, 0x15c}, 0x1, 0x0, 0x0, 0x8080}, 0x9080) r2 = socket$nl_generic(0x10, 0x3, 0x10) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000380)={'syz1\x00', {0x0, 0x7fff, 0x2, 0x2}, 0x51, [0x3ff, 0x2, 0x10000, 0x0, 0x7ca6, 0x9, 0xc2ad, 0x4, 0x9, 0x9, 0x5, 0x9, 0x8, 0x200, 0x5, 0x3, 0x7, 0x5, 0xfffffff9, 0x6, 0x3, 0xfff, 0x7f, 0x4152, 0x8b3, 0x9, 0x861, 0x7, 0x5, 0x0, 0x3c, 0x4, 0x1005, 0x4, 0x8, 0x1ff, 0x8, 0x8, 0xd5bb, 0x1000, 0x1, 0x9de9, 0x8, 0x3, 0x3, 0x7f, 0x5, 0x8, 0x0, 0x1, 0x3ff, 0x6, 0x2e, 0x800, 0x846c, 0x3, 0x6, 0x31b, 0x8, 0x8, 0x1, 0x7, 0xffffffff, 0x3], [0x4a, 0x19a78cbf, 0xe936, 0x8, 0xf6, 0xfffffff7, 0x2, 0x7d, 0x10001, 0x8, 0x3ff, 0x1, 0x7, 0x8f, 0x1, 0x2, 0x1ff, 0x200, 0x6f8, 0x7, 0xd, 0x7, 0x100788, 0x6, 0x0, 0x0, 0x8, 0x3, 0x5, 0x2, 0xa, 0x7, 0x80, 0x5aa, 0xfffff000, 0x400, 0x2, 0x7, 0x6, 0x6, 0x5, 0x3, 0x87, 0x22e2, 0x4, 0xffffffff, 0x40007, 0x1ff, 0x6, 0x10001, 0x9e, 0x1, 0x5, 0x101, 0xfffffffa, 0x0, 0x2, 0x2, 0x6, 0x1ff, 0x8, 0x3, 0x6], [0x2, 0x94da, 0xffffffff, 0x7, 0xc0000, 0x4, 0x4, 0xfffffffa, 0x6, 0x4, 0xea, 0x7, 0x6, 0x400, 0xfffeffff, 0xfc000000, 0x8, 0x8, 0xd1, 0x2, 0xb66, 0x3, 0x4, 0x52c, 0x4, 0x10001, 0xfffffff8, 0x2, 0x9, 0x1, 0x7, 0xe86, 0x8, 0x20000100, 0x7, 0x1, 0x746a6ffd, 0x3, 0x4, 0x0, 0x1, 0x45a6c325, 0x8, 0xffffff7f, 0x1000, 0x2, 0x5, 0x0, 0x2, 0x2, 0x1, 0x8, 0x2, 0x2, 0x81, 0x200, 0x3ff, 0xffffffcc, 0x6, 0xa000000, 0x8, 0xfff, 0x4000, 0x2], [0x8, 0x7, 0xffffffff, 0xfffffffc, 0x8000, 0x2, 0x8, 0x1ff, 0xfffffffc, 0x10, 0x5e, 0x4, 0x8, 0x8, 0x5, 0x8, 0xfb, 0xf25, 0xd, 0x1ff, 0x2, 0x95, 0x9, 0x9, 0x1, 0xc, 0xffff6f9e, 0x4, 0xfffffff7, 0x10000, 0x7, 0x52a, 0x5, 0xc1a4, 0x4, 0x8, 0x3, 0x9, 0x3, 0xb7af, 0x3, 0x4, 0x0, 0x1ff8, 0x2, 0x7, 0x6, 0x80000000, 0x8, 0x7, 0x7fffffff, 0xd, 0x40, 0x3ff, 0xc, 0x1ff, 0x9, 0x6, 0x0, 0x1000, 0x6, 0x2, 0x9, 0x4]}, 0x45c) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000140)={'gre0\x00'}) sendto(0xffffffffffffffff, 0x0, 0x0, 0x810, 0x0, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0x0, @none, 0x0, 0x2}, 0xe) listen(r2, 0x90007) syz_emit_vhci(&(0x7f0000001180)=ANY=[@ANYBLOB="043e130100c90001", @ANYRESHEX, @ANYBLOB="28cbc43f3f9e4a0769ec04073d62d51a0a9ffe243f458bb7dc848aaceb8f256ce2b527df3d43625c4ef8b15be1946bf4a508d0d908ba1df7496fe969c539c5c888ae168d511659d874a4e64ed181ac4f8da0b7675da9c17b8f6cdbd603374a68cc0cf5ea03f85b6784c65024615db48740a51ebd6a70dde488ff41852b64c96e60496fe858d0af72a248d1e55d983663b53f3eecf48fa06f62ed0d8997cf20482e661e801102d55d3a4ec2a49912daf708c23f7efb0a60"], 0x16) ppoll(&(0x7f00000000c0)=[{r3, 0x60}], 0x1, 0x0, 0x0, 0x0) socket$nl_audit(0x10, 0x3, 0x9) r4 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x38, 0x38, 0x3, [@var={0x1, 0x0, 0x0, 0xe, 0x3}, @int={0x7, 0x0, 0x0, 0x1, 0x5, 0x11, 0x0, 0x4}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x5, 0x2, 0xf4c9}}]}, {0x0, [0x61]}}, 0x0, 0x53}, 0x28) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000008000100400000000c000200700f0000000000000c00060003000000000000000a000a00272d5d29212b0000140007"], 0x6c}}, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000004}, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000018c0)={0x24, &(0x7f00000016c0)={0x40, 0x0, 0xca, {0xca, 0xd, "26fb23aa25a7a19a1979672b63493a5e68aca90d18a9c10d00fa25c6b12dfb45421e9b0f351d763809b3aa3de55d78fb28c1cd26f1bced8a4a6ee64812f0cb0196be5bca86d4b29d4494b9e62d9cf7c64948b5badbe91fc42167ca33034e3ffde8e6c11cc9054e394c697bc8eb66194a6bddc1d49cc11f34d66950c781fec67c722fd406369e0c1ccf31dd237929e69ebcd2108266cd381ab812eafef299ef90b195417d93a66812d7b3d779e205691b8a5d7a00407c3fef8669261d83d19a4708f651866ad44266"}}, &(0x7f00000017c0)=ANY=[@ANYBLOB="000367000000670307b4c76d8f4beee463bd7a5aef2042d64def9ebfe689e847f87ef58081e2929c6c5f1672039f0c02b95acbf14dee543ee266c1dcad93ab789130bf4436177f298ab804cc72a83b199117c6a7abda540431ec302fc43742c20da8388f9fd5315764754ae342"], &(0x7f0000001840)={0x0, 0x22, 0x9, {[@main=@item_4={0x3, 0x0, 0x8, "13594ab3"}, @main=@item_012={0x0, 0x0, 0xb}, @main=@item_012={0x1, 0x0, 0xc, '0'}, @global]}}, &(0x7f0000001880)={0x0, 0x21, 0x9, {0x9, 0x21, 0x4, 0x1, 0x1, {0x22, 0xc3e}}}}, &(0x7f0000001a80)={0x2c, &(0x7f0000001900)={0x0, 0x16, 0x70, "75a45c3b262040c8ac63047d87a0907efdea23c5d5593b4f5d2cce669001f098540d5054169989497293ebc389351b27010d7932cbab6860dd2c7e4b5f28a0ce2dfe32922ae75c882d66be0f3fa412d24ce9e17769b913954a76aaa335058f05204684bebcda31cab40cb9aea36a2e49"}, &(0x7f0000001980)={0x0, 0xa, 0x1, 0x88}, &(0x7f00000019c0)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000001a00)={0x20, 0x1, 0x10, "2b097626155b0dca398dc157293208ea"}, &(0x7f0000001a40)={0x20, 0x3, 0x1, 0xc1}}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) modify_ldt$write2(0x11, &(0x7f0000000100)={0x81, 0x0, 0x4000, 0x1}, 0x10) modify_ldt$read(0x0, &(0x7f0000000140)=""/4101, 0xffffffffffffffd6) 6.279142879s ago: executing program 4 (id=702): socket$nl_netfilter(0x10, 0x3, 0xc) openat$nvme_fabrics(0xffffff9c, &(0x7f0000000000), 0x800, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) openat$panthor(0xffffffffffffff9c, &(0x7f0000000c40), 0x2, 0x0) openat$userio(0xffffffffffffff9c, &(0x7f0000000000), 0x303882, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) syz_usb_connect(0x2, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000016038308c5109a8146e4010223010902"], 0x0) socket$netlink(0x10, 0x3, 0x0) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)) socket$inet_mptcp(0x2, 0x1, 0x106) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000080)=0x1000, 0x4) socketpair(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r0, &(0x7f0000002040)=[{{&(0x7f0000000700)=@xdp={0x2c, 0x0, r2}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x1}], 0x1}}], 0x1, 0x0) 5.284327141s ago: executing program 2 (id=708): r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) mprotect(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0xc9bf714d8475ecb7) syz_usb_connect$uac2(0x5, 0x9e, &(0x7f0000000080)=ANY=[@ANYBLOB="12010102000000208c0d0c0040000102030109028c000301008008080b0101010c20060904000000010120000924010300042c000408240a05004000030c24030207030503050300010f240603050600010002ed08000400090401"], &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0}) sendmmsg$inet(r0, &(0x7f0000000c40)=[{{&(0x7f0000000040)={0x2, 0x1, @multicast2}, 0x10, 0x0}}], 0x1, 0x8014) 5.095492265s ago: executing program 1 (id=710): socket$packet(0x11, 0x3, 0x300) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000fcffffff00000000000000008500000036000000180100006420002500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000001800000850000000600000095"], &(0x7f00000001c0)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x5, 0x14, 0x0, &(0x7f0000000b00)="259a00f271a76d1708fff74588a8010000002f47", 0x0, 0xd11, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='smaps\x00') copy_file_range(r1, 0x0, r1, 0x0, 0x0, 0xb8f) socket$packet(0x11, 0x3, 0x300) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000fcffffff00000000000000008500000036000000180100006420002500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000001800000850000000600000095"], &(0x7f00000001c0)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x5, 0x14, 0x0, &(0x7f0000000b00)="259a00f271a76d1708fff74588a8010000002f47", 0x0, 0xd11, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) (async) syz_open_procfs(0x0, &(0x7f0000000000)='smaps\x00') (async) copy_file_range(r1, 0x0, r1, 0x0, 0x0, 0xb8f) (async) 5.040379154s ago: executing program 1 (id=711): r0 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r2 = syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) close(0x3) syz_open_dev$midi(&(0x7f0000000000), 0x3, 0x88c02) syz_usb_disconnect(r2) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x4008132, 0xffffffffffffffff, 0x0) mq_unlink(&(0x7f0000000280)='fd/3\x00') madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) ioctl$VHOST_SET_VRING_BASE(r3, 0xaf01, 0x0) r4 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000240)=r4) ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000540)) socket(0x2, 0x80805, 0x0) close(0x3) 4.852882528s ago: executing program 4 (id=712): unshare(0x64010680) socket$xdp(0x2c, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000280)={@in={{0x2, 0x4e20, @loopback}}, 0x0, 0x0, 0x4, 0x0, "e83ae75240c2d6d8ec87bb53679fd0450078548ceb6c4414fab091000000000000000776aea5922406b64cddaeb9d339ba3c01c2c7d0df8e61740b9af2d4e499d58654a4cf0fa0ce1f830c3279cffcfd"}, 0xd8) r2 = syz_open_procfs(0x0, 0x0) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f0000000380)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010025bd7000fcdbdf250100000005000500810000002c000680140004002001000000000000000000000000000214000400fc0200000000000000000000000000010400018005000500060000050005000200000005000500860000000400018000e0bdeaac2df9a6ad5cd2b66009bad3f6da55dc3990e37e2b8d4c708f3e3648104c33adf414ba59"], 0x68}, 0x1, 0x0, 0x0, 0x1}, 0x4801) setsockopt$inet_tcp_int(r1, 0x6, 0x2, &(0x7f0000000040)=0xce, 0x4) connect$inet(r1, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$inet(r1, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0xd007) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000007c0)=ANY=[@ANYBLOB="fc000000196b8400002385afc75281ef8915942bc5da782a720000000000000020010000000000000000000000000000ac1414aa00000000000000000000000000000000000000000a00000000000000a6726b2cb47d8c99f7be51264defa3", @ANYRES32=0x0, @ANYRES32=r4, @ANYBLOB="0000000000000000a900000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000000000000080400000000000000000080000000000000000000000000000000044000500ac1414aa000000000000000000000000000080003c00000000000000ffffffff00000000000000000000000000000000000300"/180], 0xfc}}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000006c0)=ANY=[@ANYBLOB="ec00dd5e84f55945cc81e0ee3832f00000210001000000000004000000ff010000000000000000000000000001fc02000000000000000000000000000000000000000000000a32dc0000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000009c001100e0000001000000000000000000000000ac1414aa000000000000000000000000fc020000000000000000000000000000fe88000000000000000000000000000133040000ff34000002000200fc010000000000000000000000000001fe800000000000000000000000000035ac1414aa000000000000000000000000fc0200000000000000000000000000013c000000000000000a000800"], 0xec}}, 0x0) r6 = gettid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x3, &(0x7f0000000180)=0x200) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) lsm_get_self_attr(0x67, &(0x7f0000000600)={0x0, 0x0, 0xc2, 0xa2, ""/162}, &(0x7f0000000440)=0xc2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, r6, 0x2, 0x0) syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) 4.706267295s ago: executing program 3 (id=713): syz_emit_ethernet(0xf6, &(0x7f0000000400)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x22}, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xe8, 0x0, 0x0, 0x0, 0x11, 0x0, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x21}}, {0x0, 0x4e20, 0xd4, 0x0, @gue={{0x2, 0x1, 0x1, 0x9, 0x0, @val=0x80}, "9f507bb2c7b3eb890743515fcf10685bd90568c07f800f5879d375d5fcc29fd69082f5347d8395b2e8894477be097b0976e444cc08874d56acaf0eef3df266e7c27897bbe5543e0be6c0c69f40b365998c74ef243caac45bbb14866c2a26e30801f354080694038ff7f68de5ca73984a1ad607e453f3a54bab6a1924fe8226eea8c805cb33c90c78e557b6243bd04cc2a7d455c0e3b6aaf367a92730ab1409a285fed4b7bf3e3ef32c086ac4582df0545ece43b1cb4a49f967fea70f7d665fbdcec65494"}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7, 0x0, 0x0, 0x40f00, 0x5, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x200}, 0x94) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r1, 0x29, 0x31, &(0x7f0000000040)=0x7, 0x4) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r2 = syz_open_dev$media(&(0x7f0000000140), 0x200, 0x2) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000003c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080)={0xffffffffffffffff}, 0x13f, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r3, &(0x7f0000000000)={0x13, 0x10, 0xfa00, {0x0, r4, 0x1}}, 0x18) ioctl$MEDIA_IOC_REQUEST_ALLOC(r2, 0x80047c05, 0x0) syz_io_uring_setup(0xf00, &(0x7f0000000080)={0x0, 0x0, 0xc00, 0x0, 0x374}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r5, r6, r7, &(0x7f0000000000)=@IORING_OP_READ=@use_registered_buffer={0x16, 0x0, 0x4004, @fd_index=0x4, 0x718a, 0x0, 0x0, 0x12, 0x1, {0x2}}) 4.681204407s ago: executing program 0 (id=714): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1e000000000000000b00020009"], 0x50) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000001740)={r0, 0x0, &(0x7f0000001700)=""/53}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001100)={r0, 0x0, &(0x7f0000001700)=""/53}, 0x20) (fail_nth: 3) 4.544264517s ago: executing program 0 (id=715): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0x80000001) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) 4.529276327s ago: executing program 3 (id=716): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) r1 = fsopen(&(0x7f0000000240)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) fchdir(r2) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x442, 0x52) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) close_range(r3, 0xffffffffffffffff, 0x3f00000000000000) r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x0, 0x60) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x0, 0x4012011, r4, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) setsockopt$TIPC_SRC_DROPPABLE(r5, 0x10f, 0x80, &(0x7f0000001640)=0x4f1d, 0x4) sendmmsg$inet(r5, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0xf5) 4.171655607s ago: executing program 1 (id=717): r0 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r1 = syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) close(0x3) syz_open_dev$midi(&(0x7f0000000000), 0x3, 0x88c02) syz_usb_disconnect(r1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) r2 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(0xffffffffffffffff, 0x4004af07, &(0x7f0000000240)=r2) close(0x3) 4.058785641s ago: executing program 0 (id=718): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_DELETE(r0, 0x0, 0x0) 3.972724882s ago: executing program 0 (id=719): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mq_timedsend(0xffffffffffffffff, 0x0, 0x0, 0x7d8, 0xfffffffffffffffe) mount$fuse(0x0, 0x0, 0x0, 0x8, &(0x7f0000000040)=ANY=[@ANYBLOB='fd=', @ANYRESDEC=0x0]) mount(0x0, &(0x7f0000000440)='./file0\x00', &(0x7f0000000280)='autofs\x00', 0x201000c, &(0x7f0000000040)) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x0) r1 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r1, &(0x7f00000000c0)={&(0x7f0000000180)={0x2, 0x0, @empty}, 0x10, 0x0}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000240)={0xaa, 0x298}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x0, 0x0) r2 = getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000300)=0x6) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002700000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) ioctl$AUTOFS_IOC_ASKUMOUNT(r0, 0x80049370, &(0x7f00000001c0)) 3.868482716s ago: executing program 2 (id=720): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0x80000001) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) (fail_nth: 3) 3.629263122s ago: executing program 3 (id=721): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x24, 0x43, 0x107, 0xffffdffe, 0x25dfdbfc, {0x2, 0x7c}, [@nested={0x4, 0x148}, @nested={0xc, 0x1, 0x0, 0x1, [@nested={0x8, 0x14c, 0x0, 0x1, [@typed={0x4, 0xed, 0x0, 0x0, @binary}]}]}]}, 0x24}}, 0xc000) 3.468571884s ago: executing program 3 (id=722): r0 = socket$alg(0x26, 0x5, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x180) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x8001, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) mount$fuseblk(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x2424, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_hmac_sha512\x00'}, 0x58) r2 = accept4(r0, 0x0, 0x0, 0x0) mount(&(0x7f0000000140)=@nullb, &(0x7f0000000080)='./cgroup\x00', &(0x7f0000000040)='udf\x00', 0x208000, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, 0x0, {0xc, 0xc}, {0x0, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) recvmmsg(r2, &(0x7f0000002440), 0x3ffffffffffff67, 0x0, 0x0) r3 = syz_open_dev$dri(0x0, 0x1, 0x181000) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r3, 0xc01064bd, &(0x7f0000000140)={&(0x7f0000000100)="01dbe526c1dd8eb2f99a5c38aeef9bf8e02c5dbd4c4ae501012b84650bb8304d07a9a2dd2019000000000000", 0x2c, 0x0}) ioctl$DRM_IOCTL_MODE_GETPROPBLOB(r3, 0xc01064ac, &(0x7f00000007c0)={r4, 0x0, 0x0}) syz_usb_connect(0x2, 0x4f, &(0x7f0000000080)=ANY=[@ANYBLOB="1201510329fbf04038074045cec60102030109023d0002020610780904d40901786d3d400905010000020904020904e20002b22618bb0905010000027c9e09070585e371932d0905070b"], &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0}) 3.259243948s ago: executing program 1 (id=723): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) getsockname$packet(r2, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000005c0)=@newqdisc={0x24, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xa}, {0xfff1, 0xffff}}}, 0x24}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@gettclass={0x24, 0x2a, 0x64159223755480d7, 0x70bd2b, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0xe}, {0x1, 0xffff}, {0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x40448c0}, 0x0) 3.036230875s ago: executing program 4 (id=724): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x1fffffffffffffcd, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095", @ANYRESHEX, @ANYRES64], 0x0, 0x2010000, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000400)='.\x00', 0xa4000921) read(0xffffffffffffffff, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) r0 = socket(0x10, 0x2, 0x0) write(r0, &(0x7f0000000000)="1c0000001a009b8a140000003b9b301f00"/28, 0x1c) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x0) socket$igmp(0x2, 0x3, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x18, 0x8001, 0x0, 0xb, 0x2000000000000, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$video4linux(0x0, 0x9, 0x34f081) close(0xffffffffffffffff) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) setsockopt$IP_VS_SO_SET_STARTDAEMON(0xffffffffffffffff, 0x0, 0x48b, &(0x7f0000000000)={0x2, 'bond0\x00', 0x8}, 0x18) sched_setattr(0x0, &(0x7f0000000340)={0x38, 0x0, 0x1000000d, 0x8001, 0x299c0, 0x7, 0x800, 0xfc5, 0xfffffffe, 0x5}, 0x0) syz_80211_join_ibss(0x0, 0x0, 0x0, 0x1) sendmsg$rds(0xffffffffffffffff, 0x0, 0x0) socket(0x15, 0x5, 0x0) recvmmsg(r0, &(0x7f0000002ec0), 0x400000000000ec0, 0x2, &(0x7f00000001c0)={0x77359400}) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x2) r3 = syz_open_procfs(0x0, &(0x7f0000000480)='fdinfo/3\x00') read$eventfd(r3, &(0x7f00000001c0), 0x8) 3.035914575s ago: executing program 2 (id=725): r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x202, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x7, 0x13, &(0x7f0000000240)=ANY=[@ANYBLOB="180300000005000000000000000000001801000011af000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000020000838500000070000000180100002020752500000000806020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000400000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_open_dev$I2C(&(0x7f0000000300), 0x1ff, 0x1) ioctl$I2C_TENBIT(r1, 0x704, 0x0) write$sequencer(r0, &(0x7f0000000000)=[@t={0x81, 0x5, 0x0, 0x1, @generic=0xf}], 0x8) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f0000000040)=@t={0x81, 0x5, 0x3, 0x4, @generic=0xffffe861}) r2 = socket$kcm(0x29, 0x0, 0x0) sendmsg$kcm(r2, &(0x7f00000002c0)={&(0x7f00000000c0)=@nl=@proc={0x10, 0x0, 0x25dfdbfc, 0x80000000}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000140)="414c859f076635a62e5c1791a438d62754496bf43b04b61db81644c8d2a1df71b135876d512b5a0bb7c24e91b289df5d1bfbfa8c142a99bc8322633d5a68b52f8a247aa26463f954040bafc53756b9858d749dfbec7a9852d87005", 0x5b}], 0x1, &(0x7f0000000200)=[{0x20, 0x10d, 0x81, "e8a09d75abbeca8acbe4f761d530"}, {0x90, 0x103, 0x1, "fe626cd8092e6019205a20cfa2f5d51fbb0688b8e35a663fe545a3b471c25e3dfa3a29df83a2ef1bd691f669101ac14dfd9b7321ff302e47f2bd402b629c22f9182769e583cc1444900c00b6adaf7adedcca8dcfa6914922ddb73e88263027fe83ac853a67ee644ea981396a8806bbd037a0accd25ea39d864e4"}], 0xb0}, 0x0) r3 = accept$inet(0xffffffffffffffff, 0x0, &(0x7f0000000340)) sendmsg$inet_sctp(r3, &(0x7f0000001740)={&(0x7f0000000380)=@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x2b}}, 0x10, &(0x7f00000016c0)=[{&(0x7f0000000480)="fc3a93fffdf3e40c253c03a414484e092d0b424bd578dc84580b8bf051da", 0x1e}, {&(0x7f00000004c0)="e5e9adc285a0d66b9bdd3e203c953951e38b955b47a69c3e86777ea584ee16f63bc9e9e1b004c6fdc9340a986412325dbefadc704cb77d878b274d8d9c7074a022d189cc3c571f6aa9769ed956edc1194b430e35350cba130bfda7b76c6f687a", 0x60}, {&(0x7f0000000540)="6bad8e5ebe43fb629aa01301a38da11402df82b669263bbcd7e256495218b96a17f0efaee41ca9d29d910693981b8463f88027e0084616e8b48bed34310944c3f941aefa550bb3932fe795d6accbe060d84e2096598730faab8cdb0e7ab427", 0x5f}, {&(0x7f00000005c0)="91aa0432879f7d5dd116efccdd4ff96b92ff2ad7d0b8a55a6bd093fcb8ff877727eeb2ac20ac16e78cb24c595125a436ca0b616ea8f8df19fe6bc1444f0a1e76574d368d92f8427c35df1922347b5f4c65fef266956a534bd552bd7447c9efc4fcd52762001ae3097e431a01ea8e213769895472662ff713fc640bcdc3ce8eb01f7c4b1230fdd6ab06b7f5af0b712741e816e9f4755b963b2c1ece36bc2619a3e30394481277a519d84872a9234880c5ce5e01b4181a1ea128cce5fdf4e0f9488236282b8478b7110c36cdf508d540a8e659bffeddf7cf38042793c949cb55b5c05243a4680f01dbf4d2b8fd1d8853064165a80586916ff974657d3d15023e8f8da8bd89af2f7d57121576691975d0744bfc320bee58d61e0a9e3bd906b5b4de5593ac9a3c02e8ae37e7eda5e161244670448145eb833be79e9239b8f7d187bf97c8e7d58b54fb6ac680af3a35f1f03316888270f35127bd8f5caa2b0362a316f06e657e3f93dd0a90045534ddbb5082355d7133718171ee277a7eae01e88205438ec658167b77451c2a6f4d1999466a357888d60381d7aa0e679cde5ccef7c71854b1c73396972b747e0159cc176dbf3f21890cc7b8fc942fcf843b9204f8858bcc2736bfb17f30d4858adfda642db1c609c14f7912142786ac599f7ed51198c85103359db64dbcfa1e73d6d87f016270d35e404c207c71446f95e75d8835e26500a8a367203183fb18f21e5218e2c045f6cef8468612d4a1642e2fd33066c0222f18dcdd8be9dcb2a2babf3dfe36dbbf5ed9c283f08dd6e368f03169daa2d340c65035d91a6bd0bd4a5e1918cf20a756f15018cf37e0d6784135d661280382dd1bba0a0f71aef8d47f28887bfccd36161b453637e5ed49da23000e3465337770e70992df8768fea074d4cfd3a51e4d11a5fc6f50f69476b0de6fbf57370f9db86b061bce45fe0c8a278ad05abc1a5cc60abb473186e26d7e32f24922bbdc6a9566848a26aac17ad849d16ecab43b610ee03e8d65b6c47c94df534eae68154c2d111bf24c50bd1bdf7b5b6411a517faaeb245799134f27adbc8552ffcf122e466041c71b8f23955bab618b830dd4d044167b4c1bd85c15a50e015e7ff4c6064f76d225371fd981e0a6f59370414d84c1ae12ef6d3adc4ee04456c048b92b3f62e020342d285cc82a89b660ebabce1e439e8cbd6c64913e0363b88731c575fad4f137a00484d8ff3eceeaa4e4c319c4f7e1026a962e68fb9970f592e3e2fdb23c9c2b581381f932430c8c8e16f59aba3bbf22cf4161b6e0691d92ccba15a65b616f97a88c34b605bf76019a5b1486a26253bdbfa6cf6038e6934538d33fed30bca2b89fada0f907271d367d004723e11c7079af60b9898e9f556f7d3564cb97ff0d5385508ddfbe1a6042c6ce7f5d34ac5b6e71e7324fbcc827c5ab832086d304e6079790f286067f8dc2221476ab16206ef10e429b58669243ef2aabd2862d9d0689d74733db696e0dbc0f04b2cfd266eb9bd9b6586251fcb640ed80d16aca19d1e17ccad2169be0c771c44838df524ca8d434f624ff610f13e82c396ef9f46e4e18c33f7f8cc0ff82859db8cfe17a4a41d0cc1875a2131571b1e7d7eb2f2be7e96ec04344cc3425b52cf962c740b9a81a3853972c6f6768d21fa31bc112cec690b27050f81eb2c51f0f3459bc101bba7661249bfa422d99c2c367acdb4ca4841e045eb6b1befd70d91bdce8a0034e9261061c1dfc7586b9571e19b3537eaaff8d19a7a7d7397395dc925cb79759acb25ed45884b9d53acc016c384a4f7938bb5cbd1b664723185f30c4db5744c64333a09a8aafff196de99ea2645dc23d547c98b7a368eea2f5fb3f6acbc5ef98a71b90ef6032a38b94a7533296e5861792b378aab0aec23a1059b26c81f7d24105b53e397a9009f9b458761a71936a6715b28e6fefc419ca4b0c709f7b3a1e4f4e0ae99a34ab9b9531def0e0f5827ec630f12c6717dbe20792ca0b153229157ff0ca0ad8dbfb1f83bc787c8565b29e06a399c85e658be3e489e12f42fb4ee9df665d535e2ee4f22612267da64109cfa6e51ce22675a974f970fc8477a83ac690349586889a8d1fbd486e766bffbfe6524feacdc929ae173ec89335e5350f5e1dba6a125c6b195eb7a28138a95c626de2cb0c59f7508d4abf94a0cd9bb74cc0e1db8c791c53dac67009aba479a80b348572e5ec40482ba906307b101ba2bb81b359d4f648185cf27d425b5abc9030918797a47f263ffe02519604fa1a011632bac3ee11fa91f2ee7ef2481f6dffb28ea545ebccc5da6d260069321a983ee84e809784b38ca28b1c806c9eeb9b4b4db04bdc5494b0d16876f4f33f8b0fe5b852512d1c8cf62d703e43f4490af8961393ef89c2ab8793ae01bb6473fa40ddae81e0434c7e0d449a7b44f3add95b7c6a48ee4da476168d9e71b325a4ac0b5f00eb49e136fdbe3eeb5b980ef2be6c5f9359f2882e0446dbef5953d30d9b6fcec700900a5a231150460d7ea7aab2e90106221cd44b1c92bd5328117cb1906cf3088289ad317d7e935adf78595774354882997575f990c7c31589b3e0d2b77152581e7327e3fc085e44a12fbf979939df062a2ca2e6eeadefef9666031efdb764379a3e49e678c7aaf9c34d1da7612264408f6b7620ab3d50d91606de331cfab53478c1e8f6864775c98683ea07e48ef5f125930d203c56f5913e127b9bf9b7513ae667677d4404e374f40bac467221e56bdfe504a5b73d94ffaa5e9db6b59cf0785499a4c80c2617ad97b603ea9e6be43805a7a2c1bc5dc15e64b651644d44859aa996f9274ebab21933b3922685a19dcdc72c3b1d9e058a20e2ee520a07f09565135abc9306d041eb6305cc5f82f1125ccda439d2b898ad343a976fc6edae37eae5886a27a94b87af894a37fa67d176c2af77969f67e32808444064dddf2c601f22de0b0c823b54e2c2c222674eb73138ba5e6de5ad15a6657369c2f57cce492d13e486c53349b73ea738f74bc84a29d21a553a93ddd954f5a967edeb43287f25326af7ef3d0f1817592fa272acc505e9c9fbb7d546ce631ecfc6ff0a13973a77a47f77f36854b3f80e707dc64899f7f2c27e1be69373f2f5d68a0096607338282693d326904920836eac96bd14a54f7f2daa85619dd6833dae00f82e82cd5422c89d2c665e6ee8edeec1454d0f889235d685eb9de82023291e26e31d266b69f01ef438c803cb75b874e7276cf2ae042954ad1d681a9a7e4396d789c690509fa44d10f0a7dffd2318892e4539126a0870d9333ce04e26ea0962aeeee3f5b6e2620c90ae844da6de73904333233a2ebfca01ab0c0f435e1aae36a5dfbdc70d8e31d8b4b88106fd5bb3e42b0475de7dd46b39f82fa367f09cef5023fa97b8bb52ac5bb796b8127134246e02bf62108bbb08aab85498b7001491db4a0269f3ff1d146ce1efa3dda513044e8f5e8833e2ad64945756569158444a5e119f6b7dbcc182211c6494ae4e7dc632f43171c8c4c3c793acb48e53e122469a3cdfb3b7d9e9c84106a11ba903a019b19808ecad78ce79c5c5cd68bd53f017005a5d4ef460c378ad4df32f92cb951734ba7d553f0bc739e52399f005a8bb2007129ddd09e32658b2f965298e22481609aac228327498a54befd2ad05a15b87ceda92827d97f4b207c26a7b9af0401dbcf4c574959384b98e47ae4c89c7d7b151f25d4b13df93d314ce4e02ef85398db402f552bee95a4be602876129a431965b43e1f2240668b9f3a41fc8eeff902629881e52692f8df213f256fe9b3a897864d2d08e8e80aadde6a5b4e6c41be2e7640da141212537c772dad78cc9741a967e1174db567d0fc1492b1c99a05896eb73555d57b5979eebd76ba0426e0344272e20df749a37f9f6228b9bf18d6c087b763cbf8c78bdb3a3c408dbf7ea0c227fd0a0a21c83d7e072f93dc935bd614c0e877e20a5d8fc5385f6b92496a385b17b913550ddd87733fdddb84a3a49263c29ccaddfb28249624403485af300116ff616f1c944f586a761426846311bee9f3a490427920b1fdddb37e35042abbe295e44a001ebdfff8393adc70fb2180f804ca8896f4ff917f8e870322658ad5dd8d0654dd995b35e8d975cd6ba576e4cbcbab4907d045c3c8741ed30846dffd8f902c5187c14094b818a92b27694a579be29cba7f61aad4e5aac88e2b50834eeca299d33bb784eaf67107c3b6bde8a1537feb1828753592ae849b978ce748a4d37e71f6ded16130843eaa37e13c2b39227a229ed82fff0554094ae871442f1a20de3b578a6a38b95d22095a3bcb99cfd1070ff2f38d60f213c84da5f946a8e01bbaa2016d99e62aa7e84925b4dd2d5115bf46fd2b729a2ac3ec79a9236ae1b6b7cc666ac51878c6c11a35ab453f406a02b118e1fee76bdc4006d271fd103850c059f94a6531bf2ce887b192b12e31e40c55e18b20540f7a73968c747b7056ad32f975f366679331f70bbe1e56bb48ae563d28b27660c1a4bf3c9873f83c008c9d48b954712faac40ee9f0447bc1f5e3fe6a5f78a8d01a78df51fd2410f005c7d2b001c18e319ea31117f7ad6e5949d7e7c7e2c92967a51a8fb5d12f3ac8572bbab8332a374bb69c1d4ebedd941bd742a63617f3dc05635910a57dcfa7cbefd3d1a9c84fa7c0170ab33274a636de86ee49971e156c9c7d8c36d44fb6d30763da7839e82740a8f530ee285afe6e934b324fd2eff8d7e8f35f18655e0429dbbd619387a154f4741619c9261432683c41a23d6e3032628da35400fd5ac36ac3e0039200bc2303c625eae4709aaf0459e74c10a8d0db54c2c1856547f344dc1b678dfbc6693798fddb82b9507211172003ba6fcfc352ee8e8c2a56373f43cd87bc5fadb7ad4446c6b92b1ad4631cd609fbe97f42d9fbce92e0a8a1c2682649a57cd879e2b5609666cf13b21a2d6e203170fdcb9d3998b58ec21e32981b1a12f92f2664ee1bbf62849c8ef405833dd5b0ad23f666023afa7c0e7e103c21c623731866d2d2889eb41d9a1c72bad1a538f1228ab56d6448b05194fcb47cc1a0f6ba2d7290e26b59ccf08774fd3d980574bba9b65a6351119c753aa4b589bfe7e6b7371eb1c0c9cec93919789dc29c3f405414e0dcb5257983f47a6a23140f86779856628079c6bb9c9b4601760a58958e0392b20ba1f2afb063b839b3311693f5ad390206b2aa3e753bed686daf6da7210a6c7c4c42c394a933279f6e33f9967cf9d6bb87d639896b66544d448ce285830ef2bf10c699ab2cb2a2fa32ed45612c0f5abb42798d3e2d8ebec830535519557a89892e5a6dd5b5a6e042aa3f8fa9df77dea3f741909fff49c0b929f0b671d55ba786648ca0922024295cca8c787b79d63c4a6bafbb7369a5411d6801819d88195717d1324b306fcf967a6d70dee1953eb9f53bb72ef3794ff5a614ac2930fa3f91153a73ab94c1720b1629cf6dd2cdcbe6636f8d8d895c521158f273675303bdfade55c8b3a6d32c92291d1b92440b3028e58aa504cc3a9afe2d9d98bb4665fd869ffa9e8e32581a277cd6c5c02b9cf2de0aebf3c83258a694a7610d30852641df88d4f6aa8227699a05cecbb39682df6bff04ed96b709bf4cf1c5826662d2bd9c142ab8089c170fbb554a9f504d48641284bfcde99c71519d866acc9d49ba135b6b641354e101ee13241023973134bc07844f979206d290289a931c50a6c9e2314e72ba947f2d8b7316f1693484f892ba553e11d1e758d95044302ea94f8574bfbc8d44aa8a054a4de3dfd027ca4205", 0x1000}, {&(0x7f00000015c0)="8693e2973ee349949bdeff13063c85927450e4813c6d283e2fc63b292a65f60356320e195e00ff1bac0c43827aefddca71c888066bd12195143a8ac61b24cdb0dd6768c36d4905e3efc0ca352dbbde53efedb51ecf97b3a95f39b1009370168265f85b23df8f24ba6ecb34e745a8386e3d0565a8924a493120f5173c5e6091499ec474bb40e138c86b0bf4eb97c048b52a6719ab832a7006d509defa28201c8df073a5385e10315fa335df51db161d25b27d9aff2a8a50b8805f93f7f416621d0e51c91dee5781d37dcbb93ba03954c7122c3b39fa3096ce8cb2cca0a09eb824ac44ffe681d9b8a3d4eeb893ea52cb1bd7bdfd9afbd3823176", 0xf9}], 0x5, 0x0, 0x0, 0x4000014}, 0x0) 3.031777598s ago: executing program 1 (id=726): syz_emit_ethernet(0xf6, &(0x7f0000000400)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x22}, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xe8, 0x0, 0x0, 0x0, 0x11, 0x0, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x21}}, {0x0, 0x4e20, 0xd4, 0x0, @gue={{0x2, 0x1, 0x1, 0x9, 0x0, @val=0x80}, "9f507bb2c7b3eb890743515fcf10685bd90568c07f800f5879d375d5fcc29fd69082f5347d8395b2e8894477be097b0976e444cc08874d56acaf0eef3df266e7c27897bbe5543e0be6c0c69f40b365998c74ef243caac45bbb14866c2a26e30801f354080694038ff7f68de5ca73984a1ad607e453f3a54bab6a1924fe8226eea8c805cb33c90c78e557b6243bd04cc2a7d455c0e3b6aaf367a92730ab1409a285fed4b7bf3e3ef32c086ac4582df0545ece43b1cb4a49f967fea70f7d665fbdcec65494"}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7, 0x0, 0x0, 0x40f00, 0x5, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x200}, 0x94) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r1, 0x29, 0x31, &(0x7f0000000040)=0x7, 0x4) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r2 = syz_open_dev$media(&(0x7f0000000140), 0x200, 0x2) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000003c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080)={0xffffffffffffffff}, 0x13f, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r3, &(0x7f0000000000)={0x13, 0x10, 0xfa00, {0x0, r4, 0x1}}, 0x18) ioctl$MEDIA_IOC_REQUEST_ALLOC(r2, 0x80047c05, 0x0) syz_io_uring_setup(0xf00, &(0x7f0000000080)={0x0, 0x0, 0xc00, 0x0, 0x374}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r5, r6, r7, &(0x7f0000000000)=@IORING_OP_READ=@use_registered_buffer={0x16, 0x0, 0x4004, @fd_index=0x4, 0x718a, 0x0, 0x0, 0x12, 0x1, {0x2}}) 2.946152687s ago: executing program 1 (id=727): syz_usb_connect$lan78xx(0x3, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x6, 0x100000b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80202, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x10) ioctl$F2FS_IOC_GARBAGE_COLLECT(r0, 0x4004f506, &(0x7f0000000080)) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)}, {0x0}], 0x2) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched_retired(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001400)=@newtaction={0x15c, 0x30, 0x1, 0x70bd29, 0x25dfdbfa, {}, [{0x148, 0x1, [@m_ipt={0x144, 0x1, 0x0, 0x0, {{0x8}, {0xcc, 0x2, 0x0, 0x1, [@TCA_IPT_TARG={0x91, 0x6, {0x9, 'mangle\x00', 0x4, 0x2, "f7c4bff37abfa63a3a3edf469d1925b8e2ab784e2c2becee1b6f4227dcdf72168f469984d47495bb9ed686a9d772222d5d47ddef541bb77a958d5e5ec0793163795735b05a96550578e77cc26c9c8c389f308782112130c0714002a493a6bd27546a20ea4d66ab"}}, @TCA_IPT_TABLE={0x24, 0x1, 'nat\x00'}, @TCA_IPT_HOOK={0x8, 0x2, 0x2}, @TCA_IPT_INDEX={0x8, 0x3, 0x4}]}, {0x53, 0x6, "c4c834e98c6449b68e05f93c4ae46d2b050a0d50c33fb1821fe82fd0b4cc9beef29c877c394fade8aa8dfa4b3fa7b600116572355c84a37e9c3bd5471be8f16c12977a3b1172884bc6f82e72da08da"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1}}}}]}]}, 0x15c}, 0x1, 0x0, 0x0, 0x8080}, 0x9080) r2 = socket$nl_generic(0x10, 0x3, 0x10) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000380)={'syz1\x00', {0x0, 0x7fff, 0x2, 0x2}, 0x51, [0x3ff, 0x2, 0x10000, 0x0, 0x7ca6, 0x9, 0xc2ad, 0x4, 0x9, 0x9, 0x5, 0x9, 0x8, 0x200, 0x5, 0x3, 0x7, 0x5, 0xfffffff9, 0x6, 0x3, 0xfff, 0x7f, 0x4152, 0x8b3, 0x9, 0x861, 0x7, 0x5, 0x0, 0x3c, 0x4, 0x1005, 0x4, 0x8, 0x1ff, 0x8, 0x8, 0xd5bb, 0x1000, 0x1, 0x9de9, 0x8, 0x3, 0x3, 0x7f, 0x5, 0x8, 0x0, 0x1, 0x3ff, 0x6, 0x2e, 0x800, 0x846c, 0x3, 0x6, 0x31b, 0x8, 0x8, 0x1, 0x7, 0xffffffff, 0x3], [0x4a, 0x19a78cbf, 0xe936, 0x8, 0xf6, 0xfffffff7, 0x2, 0x7d, 0x10001, 0x8, 0x3ff, 0x1, 0x7, 0x8f, 0x1, 0x2, 0x1ff, 0x200, 0x6f8, 0x7, 0xd, 0x7, 0x100788, 0x6, 0x0, 0x0, 0x8, 0x3, 0x5, 0x2, 0xa, 0x7, 0x80, 0x5aa, 0xfffff000, 0x400, 0x2, 0x7, 0x6, 0x6, 0x5, 0x3, 0x87, 0x22e2, 0x4, 0xffffffff, 0x40007, 0x1ff, 0x6, 0x10001, 0x9e, 0x1, 0x5, 0x101, 0xfffffffa, 0x0, 0x2, 0x2, 0x6, 0x1ff, 0x8, 0x3, 0x6], [0x2, 0x94da, 0xffffffff, 0x7, 0xc0000, 0x4, 0x4, 0xfffffffa, 0x6, 0x4, 0xea, 0x7, 0x6, 0x400, 0xfffeffff, 0xfc000000, 0x8, 0x8, 0xd1, 0x2, 0xb66, 0x3, 0x4, 0x52c, 0x4, 0x10001, 0xfffffff8, 0x2, 0x9, 0x1, 0x7, 0xe86, 0x8, 0x20000100, 0x7, 0x1, 0x746a6ffd, 0x3, 0x4, 0x0, 0x1, 0x45a6c325, 0x8, 0xffffff7f, 0x1000, 0x2, 0x5, 0x0, 0x2, 0x2, 0x1, 0x8, 0x2, 0x2, 0x81, 0x200, 0x3ff, 0xffffffcc, 0x6, 0xa000000, 0x8, 0xfff, 0x4000, 0x2], [0x8, 0x7, 0xffffffff, 0xfffffffc, 0x8000, 0x2, 0x8, 0x1ff, 0xfffffffc, 0x10, 0x5e, 0x4, 0x8, 0x8, 0x5, 0x8, 0xfb, 0xf25, 0xd, 0x1ff, 0x2, 0x95, 0x9, 0x9, 0x1, 0xc, 0xffff6f9e, 0x4, 0xfffffff7, 0x10000, 0x7, 0x52a, 0x5, 0xc1a4, 0x4, 0x8, 0x3, 0x9, 0x3, 0xb7af, 0x3, 0x4, 0x0, 0x1ff8, 0x2, 0x7, 0x6, 0x80000000, 0x8, 0x7, 0x7fffffff, 0xd, 0x40, 0x3ff, 0xc, 0x1ff, 0x9, 0x6, 0x0, 0x1000, 0x6, 0x2, 0x9, 0x4]}, 0x45c) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000140)={'gre0\x00'}) sendto(0xffffffffffffffff, 0x0, 0x0, 0x810, 0x0, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0x0, @none, 0x0, 0x2}, 0xe) listen(r2, 0x90007) syz_emit_vhci(&(0x7f0000001180)=ANY=[@ANYBLOB="043e130100c90001", @ANYRESHEX, @ANYBLOB="28cbc43f3f9e4a0769ec04073d62d51a0a9ffe243f458bb7dc848aaceb8f256ce2b527df3d43625c4ef8b15be1946bf4a508d0d908ba1df7496fe969c539c5c888ae168d511659d874a4e64ed181ac4f8da0b7675da9c17b8f6cdbd603374a68cc0cf5ea03f85b6784c65024615db48740a51ebd6a70dde488ff41852b64c96e60496fe858d0af72a248d1e55d983663b53f3eecf48fa06f62ed0d8997cf20482e661e801102d55d3a4ec2a49912daf708c23f7efb0a60"], 0x16) ppoll(&(0x7f00000000c0)=[{r3, 0x60}], 0x1, 0x0, 0x0, 0x0) socket$nl_audit(0x10, 0x3, 0x9) r4 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x38, 0x38, 0x3, [@var={0x1, 0x0, 0x0, 0xe, 0x3}, @int={0x7, 0x0, 0x0, 0x1, 0x5, 0x11, 0x0, 0x4}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x5, 0x2, 0xf4c9}}]}, {0x0, [0x61]}}, 0x0, 0x53}, 0x28) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000008000100400000000c000200700f0000000000000c00060003000000000000000a000a00272d5d29212b0000140007"], 0x6c}}, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000004}, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000018c0)={0x24, &(0x7f00000016c0)={0x40, 0x0, 0xca, {0xca, 0xd, "26fb23aa25a7a19a1979672b63493a5e68aca90d18a9c10d00fa25c6b12dfb45421e9b0f351d763809b3aa3de55d78fb28c1cd26f1bced8a4a6ee64812f0cb0196be5bca86d4b29d4494b9e62d9cf7c64948b5badbe91fc42167ca33034e3ffde8e6c11cc9054e394c697bc8eb66194a6bddc1d49cc11f34d66950c781fec67c722fd406369e0c1ccf31dd237929e69ebcd2108266cd381ab812eafef299ef90b195417d93a66812d7b3d779e205691b8a5d7a00407c3fef8669261d83d19a4708f651866ad44266"}}, &(0x7f00000017c0)=ANY=[@ANYBLOB="000367000000670307b4c76d8f4beee463bd7a5aef2042d64def9ebfe689e847f87ef58081e2929c6c5f1672039f0c02b95acbf14dee543ee266c1dcad93ab789130bf4436177f298ab804cc72a83b199117c6a7abda540431ec302fc43742c20da8388f9fd5315764754ae342"], &(0x7f0000001840)={0x0, 0x22, 0x9, {[@main=@item_4={0x3, 0x0, 0x8, "13594ab3"}, @main=@item_012={0x0, 0x0, 0xb}, @main=@item_012={0x1, 0x0, 0xc, '0'}, @global]}}, &(0x7f0000001880)={0x0, 0x21, 0x9, {0x9, 0x21, 0x4, 0x1, 0x1, {0x22, 0xc3e}}}}, &(0x7f0000001a80)={0x2c, &(0x7f0000001900)={0x0, 0x16, 0x70, "75a45c3b262040c8ac63047d87a0907efdea23c5d5593b4f5d2cce669001f098540d5054169989497293ebc389351b27010d7932cbab6860dd2c7e4b5f28a0ce2dfe32922ae75c882d66be0f3fa412d24ce9e17769b913954a76aaa335058f05204684bebcda31cab40cb9aea36a2e49"}, &(0x7f0000001980)={0x0, 0xa, 0x1, 0x88}, &(0x7f00000019c0)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000001a00)={0x20, 0x1, 0x10, "2b097626155b0dca398dc157293208ea"}, &(0x7f0000001a40)={0x20, 0x3, 0x1, 0xc1}}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) modify_ldt$write2(0x11, &(0x7f0000000100)={0x81, 0x0, 0x4000, 0x1}, 0x10) modify_ldt$read(0x0, &(0x7f0000000140)=""/4101, 0xffffffffffffffd6) 2.752278916s ago: executing program 2 (id=728): syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), 0xffffffffffffffff) open(&(0x7f0000000100)='./file0\x00', 0xa4c0, 0x10) r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) sched_setaffinity(0x0, 0xfffffffffffffdb1, &(0x7f0000000280)=0x6) socket$kcm(0x10, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000040), 0x2006, 0x0) read$msr(r1, &(0x7f0000001a40)=""/102392, 0x18ff8) shutdown(0xffffffffffffffff, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), r2) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r2, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x20, r3, 0x719, 0x70bd28, 0x25dfdbfc, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x8044}, 0x880) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r4) ptrace$peeksig(0x1a, r4, 0x0, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x104002c, &(0x7f0000000300)=ANY=[@ANYRES8, @ANYRESHEX=r0, @ANYRES64=r4, @ANYRES8=0x0]) read$FUSE(r0, 0x0, 0x0) r5 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r5, &(0x7f0000000200)={0xa, 0x4ea3, 0x0, @loopback, 0x3}, 0x1c) r6 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000019200)=@raw={'raw\x00', 0x8, 0x3, 0x4d8, 0x180, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x408, 0xffffffff, 0xffffffff, 0x408, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@loopback, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x158, 0x180, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@iprange={{0x68}, {@ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @ipv4=@multicast2, @ipv6=@loopback, @ipv6=@empty}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x538) sendmsg(r5, &(0x7f00000000c0)={0x0, 0x953a, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0xff8a}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) r7 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) setsockopt$ax25_int(r7, 0x101, 0x5, &(0x7f0000000400), 0x4) mkdirat(0xffffffffffffff9c, 0x0, 0x0) ioctl$TIOCL_UNBLANKSCREEN(0xffffffffffffffff, 0x541c, &(0x7f0000000140)) lseek(r6, 0x9, 0x2) socket$nl_generic(0x10, 0x3, 0x10) 2.371415453s ago: executing program 0 (id=729): r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000680), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket(0x11, 0x3, 0x0) bind$packet(r5, 0x0, 0x0) getpeername$packet(r5, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) futex(0x0, 0x5, 0x0, 0x0, &(0x7f0000000000), 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100), 0x8100, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newtaction={0xb4, 0x30, 0x1, 0x70bd2b, 0x25dfdbde, {}, [{0xa0, 0x1, [@m_bpf={0x58, 0x1, 0x0, 0x0, {{0x8}, {0x32, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x1}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x3, 0xef, 0x1, 0x8000, 0x2}}, @TCA_ACT_BPF_OPS={0xc, 0x4, [{0x16, 0xf2, 0x3, 0x7}]}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}, @m_bpf={0x44, 0x2, 0x0, 0x0, {{0x8}, {0x1c, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_PARMS={0x18, 0x2, {0x3, 0x2, 0x0, 0x6, 0x80}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0xc044}, 0x4000814) sendmsg$ETHTOOL_MSG_STRSET_GET(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="07052cbd6000fcdbdf2501000000010003000000"], 0x28}, 0x1, 0x0, 0x0, 0x8002}, 0x20000054) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000180)={'gretap0\x00', &(0x7f0000000080)={'syztnl2\x00', 0x0, 0x80, 0x20, 0x72a2, 0x10000, {{0x2b, 0x4, 0x3, 0x2, 0xac, 0x64, 0x0, 0x9, 0x4, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1, {[@ra={0x94, 0x4, 0x1}, @cipso={0x86, 0x10, 0x1, [{0x1, 0xa, "d67a6e211bbdf134"}]}, @lsrr={0x83, 0xf, 0xd2, [@rand_addr=0x64010100, @remote, @loopback]}, @timestamp_prespec={0x44, 0x14, 0x60, 0x3, 0x6, [{@rand_addr=0x64010101, 0x2}, {@local, 0x9}]}, @lsrr={0x83, 0x3, 0xf5}, @rr={0x7, 0xb, 0xa5, [@rand_addr=0x9e, @broadcast]}, @cipso={0x86, 0x51, 0x2, [{0x5, 0x2}, {0x0, 0x2}, {0x6, 0x12, "6103f31d465c49be754fd430c5e20bee"}, {0x0, 0x6, "6e3be44d"}, {0x2, 0xf, "c1511236737bbac4131c50dff6"}, {0x6, 0xd, "2fbffd50cabab1742e4342"}, {0x0, 0x3, "16"}, {0x6, 0xa, "83d9a2160db013b7"}, {0x6, 0x6, "8c0712ea"}]}]}}}}}) sendmsg$ETHTOOL_MSG_PRIVFLAGS_GET(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x70, r0, 0x100, 0x70bd27, 0x25dfdbfe, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip_vti0\x00'}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x4000000}, 0x400) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYRESOCT, @ANYRES8], 0xf) 1.630724086s ago: executing program 4 (id=730): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_DELETE(r0, 0x0, 0x0) 1.536253666s ago: executing program 2 (id=731): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket(0x11, 0x3, 0x0) bind$packet(r5, 0x0, 0x0) getpeername$packet(r5, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) futex(0x0, 0x5, 0x0, 0x0, &(0x7f0000000000), 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100), 0x8100, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newtaction={0xb4, 0x30, 0x1, 0x70bd2b, 0x25dfdbde, {}, [{0xa0, 0x1, [@m_bpf={0x58, 0x1, 0x0, 0x0, {{0x8}, {0x32, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x1}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x3, 0xef, 0x1, 0x8000, 0x2}}, @TCA_ACT_BPF_OPS={0xc, 0x4, [{0x16, 0xf2, 0x3, 0x7}]}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}, @m_bpf={0x44, 0x2, 0x0, 0x0, {{0x8}, {0x1c, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_PARMS={0x18, 0x2, {0x3, 0x2, 0x0, 0x6, 0x80}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0xc044}, 0x4000814) sendmsg$ETHTOOL_MSG_STRSET_GET(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16, @ANYBLOB="07052cbd6000fcdbdf2501000000010003000000"], 0x28}, 0x1, 0x0, 0x0, 0x8002}, 0x20000054) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000180)={'gretap0\x00', &(0x7f0000000080)={'syztnl2\x00', 0x0, 0x80, 0x20, 0x72a2, 0x10000, {{0x2b, 0x4, 0x3, 0x2, 0xac, 0x64, 0x0, 0x9, 0x4, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1, {[@ra={0x94, 0x4, 0x1}, @cipso={0x86, 0x10, 0x1, [{0x1, 0xa, "d67a6e211bbdf134"}]}, @lsrr={0x83, 0xf, 0xd2, [@rand_addr=0x64010100, @remote, @loopback]}, @timestamp_prespec={0x44, 0x14, 0x60, 0x3, 0x6, [{@rand_addr=0x64010101, 0x2}, {@local, 0x9}]}, @lsrr={0x83, 0x3, 0xf5}, @rr={0x7, 0xb, 0xa5, [@rand_addr=0x9e, @broadcast]}, @cipso={0x86, 0x51, 0x2, [{0x5, 0x2}, {0x0, 0x2}, {0x6, 0x12, "6103f31d465c49be754fd430c5e20bee"}, {0x0, 0x6, "6e3be44d"}, {0x2, 0xf, "c1511236737bbac4131c50dff6"}, {0x6, 0xd, "2fbffd50cabab1742e4342"}, {0x0, 0x3, "16"}, {0x6, 0xa, "83d9a2160db013b7"}, {0x6, 0x6, "8c0712ea"}]}]}}}}}) sendmsg$ETHTOOL_MSG_PRIVFLAGS_GET(r0, &(0x7f0000000580)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x70, 0x0, 0x100, 0x70bd27, 0x25dfdbfe, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip_vti0\x00'}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x4000000}, 0x400) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYRESOCT, @ANYRES8], 0xf) 1.535324795s ago: executing program 4 (id=732): r0 = socket$kcm(0x11, 0x200000000000002, 0x300) r1 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x1) r2 = fsmount(r1, 0x0, 0x0) sendmsg$tipc(r2, &(0x7f0000000340)={&(0x7f0000000080)=@id={0x1e, 0x3, 0x3, {0x4e20}}, 0x10, &(0x7f00000002c0)=[{&(0x7f00000000c0)="1f8eb3fe797ebf3986b2a2a23362391d9e41fb7c5be1305b61add3fa63f0e1a3552bc88bce676dc294335012e3fb1a117a145fd20d89311bbfd26db1135c9c9511d813638cd4b6b3c4178eccfdce3c7b99a230cd25c323f4d98add08e52f57425bae738fef", 0x65}, {&(0x7f0000000200)="2aa59e8b81c9549ad305f9795aa58cfc16ca53e7cb15dfcc2d4070bdebe620aa7b2e7667e8eb08b30a65e831d429ee257f489088468318a2981cd756dcc2f9be4829e6a769a7a0263a9a67a599b0d945fd18fd9749735b3247e2eb0b1fbafc4c1a0805e320b00462bef4c38dd3b34a96a6cf7cd2dd6e4e35acd8471686532bd4baf24c41211a7e20299a7232fe9b13a572796598fc43705994a3eb9adda477dccd70366414a1c637c480653e0ca93737d44aad64", 0xb4}], 0x2, &(0x7f0000000300)="f2f6d50b773dc2", 0x7}, 0x4000010) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = fsopen(&(0x7f0000000500)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) r7 = io_uring_setup(0x5415, &(0x7f00000000c0)={0x0, 0xef9c, 0x1, 0x0, 0xe9}) io_uring_register$IORING_REGISTER_EVENTFD(r7, 0x4, &(0x7f0000000140), 0x1) r8 = fsmount(r6, 0x0, 0x0) fchdir(r8) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./file1\x00', 0x10) mount$overlay(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000140), 0x200800, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@volatile}]}) r9 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000000)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0}, 0x50) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r9, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000140)=r10, 0x4) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000440)={'gre0\x00', &(0x7f0000000380)={'ip_vti0\x00', 0x0, 0x0, 0x10, 0x40, 0xfffffffd, {{0x5, 0x4, 0x1, 0x5, 0x14, 0x67, 0x0, 0x9, 0x2f, 0x0, @dev={0xac, 0x14, 0x14, 0x44}, @loopback}}}}) openat$vmci(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) 798.326233ms ago: executing program 0 (id=733): r0 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r1 = syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) close(0x3) syz_open_dev$midi(&(0x7f0000000000), 0x3, 0x88c02) syz_usb_disconnect(r1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) r2 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(0xffffffffffffffff, 0x4004af07, &(0x7f0000000240)=r2) close(0x3) 207.550765ms ago: executing program 2 (id=734): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x1ff) bpf$PROG_LOAD(0x5, &(0x7f00000009c0)={0x1f, 0x4, &(0x7f0000000580)=@framed={{0x18, 0x0, 0x0, 0x0, 0x5}, [@call={0x85, 0x0, 0x0, 0xc2}]}, &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x32, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000140)=@raw={'raw\x00', 0x9, 0x3, 0x288, 0xd0, 0xffffffff, 0xffffffff, 0xd0, 0xffffffff, 0x1f0, 0xffffffff, 0xffffffff, 0x1f0, 0xffffffff, 0x3, &(0x7f0000000040), {[{{@ip={@multicast1, @rand_addr=0x64010102, 0xffffff, 0xffffffff, 'erspan0\x00', 'wg1\x00', {}, {0xff}, 0x29, 0x1, 0xe}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast, 0x7, 0x7, [0x40, 0x3c, 0x1b, 0x13, 0xb, 0x20, 0x14, 0xd, 0x7, 0x3c, 0x2e, 0xa, 0x37, 0x29, 0x38, 0x37], 0x0, 0x4, 0x2}}}, {{@uncond, 0x0, 0xb8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x9}}, @common=@socket0={{0x20}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x8, 0x2, 0x400, 0x400, 'netbios-ns\x00', 'syz1\x00', {0x9}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2e8) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000480)='./cgroup.net/syz0\x00', 0x200002, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x40801, 0x0) ppoll(&(0x7f0000000000)=[{r1, 0x2}], 0x1, 0x0, 0x0, 0x0) ioctl$FS_IOC_GETFLAGS(r1, 0x5437, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x8) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x14) 93.756576ms ago: executing program 3 (id=735): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r1, &(0x7f0000000340)={0x6, 0x2, 0x3, 0x0, 0x1}, 0x8) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) ioctl$IOMMU_VFIO_IOAS$SET(r2, 0x3b88, &(0x7f00000000c0)={0xc, r3}) ioctl$IOMMU_VFIO_IOAS$GET(r2, 0x3b88, &(0x7f0000000100)={0xc}) ioctl$IOMMU_VFIO_IOAS$CLEAR(r2, 0x3b88, &(0x7f0000000140)={0xc}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r2, 0x3b82, &(0x7f0000000180)={0x20, r3, 0x0, 0x0, &(0x7f00000001c0)}) ioctl$IOMMU_VFIO_IOAS$SET(r2, 0x3b88, &(0x7f0000000200)={0xc, r3}) ioctl$IOMMU_VFIO_GET_API_VERSION(r2, 0x3b64) ioctl$IOMMU_VFIO_SET_IOMMU(r2, 0x3b66, 0x3) ioctl$IOMMU_VFIO_CHECK_EXTENSION(r2, 0x3b65, 0x9) ioctl$IOMMU_VFIO_IOMMU_GET_INFO(r2, 0x3b70, &(0x7f0000000240)={0x70, 0x0, 0x0, 0x0, {}, {{}, 0x0, 0x0, [{}]}}) ioctl$IOMMU_VFIO_IOMMU_MAP_DMA(r2, 0x3b71, &(0x7f0000000280)={0x20, 0x0, &(0x7f00000002c0)='LLLLLLLLLLLLLLLLLLLLLLLLLLLL', 0x1c, 0x1c}) ioctl$IOMMU_VFIO_IOMMU_UNMAP_DMA(r2, 0x3b72, &(0x7f00000003c0)=ANY=[@ANYBLOB="182f82352a1cec9544b94f00000000002f1528c6a7d2ecfe26e33236952dd9352ceffc53a0a923a19c63051f625465205756437aa3c09def9b0440285a5c056f8498f48b0d2933c3b71cf208acbec152e9682da5252c258f197c4bbfd293a39c3ee46a205a19f86674550a64fc379d890247ce1b6a0589be1a7f231481e4c7ce5d46f60913ee38545f0a1a7f1e55"]) ioctl$IOMMU_IOAS_UNMAP$ALL(r2, 0x3b86, &(0x7f0000000340)={0x18, r3}) ioctl$IOMMU_DESTROY$ioas(r2, 0x3b80, &(0x7f0000000380)={0x8, r3}) close(r2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x208000, 0x0) 0s ago: executing program 3 (id=736): mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x40) mount$afs(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f00000002c0), 0x5, &(0x7f0000000640)=ANY=[@ANYBLOB='dyn']) chdir(&(0x7f0000000340)='./file0\x00') prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000389000/0x1000)=nil, 0x1000, 0xb635773f06ebbee7, 0x100010, 0xffffffffffffffff, 0x3000) (async) mmap(&(0x7f0000389000/0x1000)=nil, 0x1000, 0xb635773f06ebbee7, 0x100010, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) (async) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x0, 0x2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, 0x0, 0x40000010) sendmsg$IPSET_CMD_FLUSH(r3, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000011}, 0x20000084) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r4, 0x400448e3, &(0x7f0000000400)="62c425770c1930feabd8ef15e2ac658246035657efba20b9b696232e0d0000000000000000b9e39e27933f4aea61cd55fbc94836c0a9c39fba097426b03ee9d7bf1584c015952422dfe0c02976d003b46f20d33b2687c95d66caff25ae587b0aa4039143121354184c42f7c2ca49e780068800ea181430d62977b3e11f42e1cb15cb6c9843fb61fa114241719a5c170e6acd4da261cc05a558e7acd6b2e603e371aa418f69c8511aa6f38f744916961b27271b0a681fa2b662be934f3c1b3e03b986466a62d456f97a8fac19beb147cd81b37f9a6fccdd4f2a2eef3333006f5a019723164ffdedad90c8c39b9bc770c54e56b1742d77a5a03e7ba6b1e0c9196635aedf00000000400000002f61") setxattr$trusted_overlay_redirect(&(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000100), 0x0, 0x0, 0x2) mount$cgroup2(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x4000, 0x0) (async) mount$cgroup2(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x4000, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) (async) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) (async) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0xa, 0x4}}]}}]}, 0x48}}, 0x20040084) (async) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0xa, 0x4}}]}}]}, 0x48}}, 0x20040084) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r9, {0xffff}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x5, 0xd, 0x8b, 0xd, 0x2, 0x4, 0x2, 0xf, 0x6, 0x3, 0x7, 0x8, 0x4, 0x10, 0x4], 0x3, [0xb, 0x3, 0xad1e, 0x2002, 0x1, 0x4, 0x2, 0xd06, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xe, 0x100], [0xfff1, 0x5, 0xffff, 0xfff5, 0x4, 0x8, 0x1, 0x9, 0x5, 0x2, 0xc, 0x4, 0xfffc, 0x3, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) (async) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r9, {0xffff}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x5, 0xd, 0x8b, 0xd, 0x2, 0x4, 0x2, 0xf, 0x6, 0x3, 0x7, 0x8, 0x4, 0x10, 0x4], 0x3, [0xb, 0x3, 0xad1e, 0x2002, 0x1, 0x4, 0x2, 0xd06, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xe, 0x100], [0xfff1, 0x5, 0xffff, 0xfff5, 0x4, 0x8, 0x1, 0x9, 0x5, 0x2, 0xc, 0x4, 0xfffc, 0x3, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) (async) socket$unix(0x1, 0x1, 0x0) kernel console output (not intermixed with test programs): 54][ T30] audit: type=1326 audit(1776287366.938:543): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7250 comm="syz.3.329" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f84cc75d04e code=0x7ffc0000 [ 200.034414][ T30] audit: type=1326 audit(1776287366.938:544): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7250 comm="syz.3.329" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f84cc75d04e code=0x7ffc0000 [ 200.088722][ T30] audit: type=1326 audit(1776287366.938:545): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7250 comm="syz.3.329" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f84cc75d04e code=0x7ffc0000 [ 200.165679][ T30] audit: type=1326 audit(1776287366.938:546): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7250 comm="syz.3.329" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f84cc75d04e code=0x7ffc0000 [ 200.391057][ T30] audit: type=1326 audit(1776287366.938:547): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7250 comm="syz.3.329" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f84cc75d04e code=0x7ffc0000 [ 200.535078][ T30] audit: type=1326 audit(1776287366.938:548): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7250 comm="syz.3.329" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f84cc75d04e code=0x7ffc0000 [ 200.701476][ T7280] netlink: 76 bytes leftover after parsing attributes in process `syz.2.334'. [ 200.710410][ T30] audit: type=1326 audit(1776287366.938:549): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7250 comm="syz.3.329" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f84cc75d04e code=0x7ffc0000 [ 200.745133][ T7283] netlink: 12 bytes leftover after parsing attributes in process `syz.0.336'. [ 200.816478][ T30] audit: type=1326 audit(1776287366.948:550): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7250 comm="syz.3.329" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f84cc75d04e code=0x7ffc0000 [ 200.870353][ T30] audit: type=1326 audit(1776287366.948:551): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7250 comm="syz.3.329" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f84cc75d04e code=0x7ffc0000 [ 200.975120][ T7287] netlink: 'syz.2.337': attribute type 30 has an invalid length. [ 201.082648][ T29] usb 4-1: USB disconnect, device number 14 [ 201.093676][ T7290] netlink: 'syz.2.337': attribute type 30 has an invalid length. [ 201.421573][ T7297] overlayfs: failed to resolve './bus': -2 [ 201.872667][ T7304] netlink: 'syz.1.341': attribute type 4 has an invalid length. [ 201.911085][ T7304] netlink: 17 bytes leftover after parsing attributes in process `syz.1.341'. [ 201.921771][ T7305] netlink: 14601 bytes leftover after parsing attributes in process `syz.1.341'. [ 202.792300][ T5922] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 203.013576][ T5922] usb 1-1: Using ep0 maxpacket: 16 [ 203.081579][ T5922] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 203.116483][ T5922] usb 1-1: config 1 has no interface number 1 [ 203.124207][ T5922] usb 1-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 203.136598][ T5922] usb 1-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 0 [ 203.151952][ T5922] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 203.206496][ T5922] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 203.227300][ T5922] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 203.314805][ T5922] usb 1-1: Product: syz [ 203.390765][ T5922] usb 1-1: Manufacturer: syz [ 203.492334][ T5922] usb 1-1: SerialNumber: syz [ 203.829259][ T5922] usb 1-1: failed to enable PITCH for EP 0x82 [ 203.883914][ T5922] usb 1-1: 2:1: cannot set freq 11994917 to ep 0x82 [ 204.165681][ T5922] usb 1-1: USB disconnect, device number 12 [ 204.329992][ T5798] udevd[5798]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 204.585696][ T7328] netlink: 12 bytes leftover after parsing attributes in process `syz.2.348'. [ 204.632509][ T7330] netlink: 8 bytes leftover after parsing attributes in process `syz.0.349'. [ 204.714508][ T7331] FAULT_INJECTION: forcing a failure. [ 204.714508][ T7331] name failslab, interval 1, probability 0, space 0, times 0 [ 204.761451][ T7331] CPU: 1 UID: 0 PID: 7331 Comm: syz.0.349 Not tainted syzkaller #0 PREEMPT(full) [ 204.761477][ T7331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 204.761486][ T7331] Call Trace: [ 204.761492][ T7331] [ 204.761498][ T7331] dump_stack_lvl+0x100/0x190 [ 204.761521][ T7331] should_fail_ex.cold+0x5/0xa [ 204.761544][ T7331] should_failslab+0xc2/0x120 [ 204.761569][ T7331] __kmalloc_cache_node_noprof+0x7d/0x770 [ 204.761593][ T7331] ? __get_vm_area_node+0x101/0x330 [ 204.761615][ T7331] ? __pfx_css_rstat_updated+0x10/0x10 [ 204.761636][ T7331] __get_vm_area_node+0x101/0x330 [ 204.761657][ T7331] __vmalloc_node_range_noprof+0x213/0x1530 [ 204.761668][ T7331] ? kernel_clone+0x12e/0x9c0 [ 204.761685][ T7331] ? find_held_lock+0x2b/0x80 [ 204.761703][ T7331] ? local_lock_release+0x99/0x130 [ 204.761729][ T7331] ? local_lock_release+0x99/0x130 [ 204.761755][ T7331] ? kernel_clone+0x12e/0x9c0 [ 204.761778][ T7331] ? find_held_lock+0x2b/0x80 [ 204.761794][ T7331] ? rcu_read_unlock+0x17/0x60 [ 204.761810][ T7331] ? rcu_read_unlock+0x17/0x60 [ 204.761826][ T7331] ? obj_cgroup_charge_account+0x46d/0x640 [ 204.761846][ T7331] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 204.761864][ T7331] ? __memcg_slab_post_alloc_hook+0x51b/0x990 [ 204.761891][ T7331] ? rcu_is_watching+0x12/0xc0 [ 204.761912][ T7331] ? trace_kmem_cache_alloc+0xd5/0x100 [ 204.761933][ T7331] ? kernel_clone+0x12e/0x9c0 [ 204.761949][ T7331] __vmalloc_node_noprof+0xad/0xf0 [ 204.761960][ T7331] ? kernel_clone+0x12e/0x9c0 [ 204.761977][ T7331] copy_process+0x7fb/0x7e30 [ 204.761996][ T7331] ? _kstrtoull+0x13c/0x1f0 [ 204.762018][ T7331] ? __pfx__kstrtoull+0x10/0x10 [ 204.762049][ T7331] ? __pfx_copy_process+0x10/0x10 [ 204.762074][ T7331] ? _copy_from_user+0x59/0xd0 [ 204.762088][ T7331] kernel_clone+0x12e/0x9c0 [ 204.762104][ T7331] ? get_pid_task+0xfc/0x250 [ 204.762116][ T7331] ? __pfx_kernel_clone+0x10/0x10 [ 204.762138][ T7331] ? find_held_lock+0x2b/0x80 [ 204.762167][ T7331] __do_sys_clone3+0x214/0x290 [ 204.762190][ T7331] ? __pfx___do_sys_clone3+0x10/0x10 [ 204.762227][ T7331] ? __fget_files+0x21f/0x3d0 [ 204.762262][ T7331] ? rcu_is_watching+0x12/0xc0 [ 204.762285][ T7331] do_syscall_64+0x10b/0xf80 [ 204.762305][ T7331] ? clear_bhb_loop+0x40/0x90 [ 204.762324][ T7331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 204.762339][ T7331] RIP: 0033:0x7f576239c819 [ 204.762354][ T7331] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 204.762365][ T7331] RSP: 002b:00007f57632f2ef8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 204.762376][ T7331] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007f576239c819 [ 204.762383][ T7331] RDX: 00007f57632f2f10 RSI: 0000000000000058 RDI: 00007f57632f2f10 [ 204.762389][ T7331] RBP: 00007f57632f3090 R08: 0000000000000000 R09: 0000000000000058 [ 204.762395][ T7331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 204.762406][ T7331] R13: 00007f5762616128 R14: 00007f5762616090 R15: 00007ffe69dbba58 [ 204.762423][ T7331] [ 205.145277][ T7331] syz.0.349: vmalloc error: size 32768, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 205.168451][ T30] kauditd_printk_skb: 65 callbacks suppressed [ 205.168463][ T30] audit: type=1400 audit(1776287372.258:617): avc: denied { remount } for pid=7337 comm="syz.2.351" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 205.235883][ T7331] CPU: 0 UID: 0 PID: 7331 Comm: syz.0.349 Not tainted syzkaller #0 PREEMPT(full) [ 205.235900][ T7331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 205.235906][ T7331] Call Trace: [ 205.235910][ T7331] [ 205.235914][ T7331] dump_stack_lvl+0x100/0x190 [ 205.235934][ T7331] warn_alloc.cold+0x95/0x1c1 [ 205.235946][ T7331] ? __pfx_warn_alloc+0x10/0x10 [ 205.235959][ T7331] ? trace_kmalloc+0xe3/0x110 [ 205.235977][ T7331] ? __kmalloc_cache_node_noprof+0x2d9/0x770 [ 205.235993][ T7331] ? __kasan_kmalloc+0x8a/0xb0 [ 205.236008][ T7331] ? __get_vm_area_node+0x208/0x330 [ 205.236027][ T7331] __vmalloc_node_range_noprof+0xbf4/0x1530 [ 205.236039][ T7331] ? find_held_lock+0x2b/0x80 [ 205.236054][ T7331] ? local_lock_release+0x99/0x130 [ 205.236071][ T7331] ? local_lock_release+0x99/0x130 [ 205.236090][ T7331] ? kernel_clone+0x12e/0x9c0 [ 205.236108][ T7331] ? find_held_lock+0x2b/0x80 [ 205.236123][ T7331] ? rcu_read_unlock+0x17/0x60 [ 205.236139][ T7331] ? rcu_read_unlock+0x17/0x60 [ 205.236155][ T7331] ? obj_cgroup_charge_account+0x46d/0x640 [ 205.236173][ T7331] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 205.236184][ T7331] ? __memcg_slab_post_alloc_hook+0x51b/0x990 [ 205.236203][ T7331] ? rcu_is_watching+0x12/0xc0 [ 205.236219][ T7331] ? trace_kmem_cache_alloc+0xd5/0x100 [ 205.236236][ T7331] ? kernel_clone+0x12e/0x9c0 [ 205.236252][ T7331] __vmalloc_node_noprof+0xad/0xf0 [ 205.236262][ T7331] ? kernel_clone+0x12e/0x9c0 [ 205.236280][ T7331] copy_process+0x7fb/0x7e30 [ 205.236296][ T7331] ? _kstrtoull+0x13c/0x1f0 [ 205.236311][ T7331] ? __pfx__kstrtoull+0x10/0x10 [ 205.236333][ T7331] ? __pfx_copy_process+0x10/0x10 [ 205.236352][ T7331] ? _copy_from_user+0x59/0xd0 [ 205.236366][ T7331] kernel_clone+0x12e/0x9c0 [ 205.236382][ T7331] ? get_pid_task+0xfc/0x250 [ 205.236394][ T7331] ? __pfx_kernel_clone+0x10/0x10 [ 205.236413][ T7331] ? find_held_lock+0x2b/0x80 [ 205.236432][ T7331] __do_sys_clone3+0x214/0x290 [ 205.236449][ T7331] ? __pfx___do_sys_clone3+0x10/0x10 [ 205.236473][ T7331] ? __fget_files+0x21f/0x3d0 [ 205.236496][ T7331] ? rcu_is_watching+0x12/0xc0 [ 205.236512][ T7331] do_syscall_64+0x10b/0xf80 [ 205.236525][ T7331] ? clear_bhb_loop+0x40/0x90 [ 205.236538][ T7331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 205.236550][ T7331] RIP: 0033:0x7f576239c819 [ 205.236559][ T7331] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 205.236569][ T7331] RSP: 002b:00007f57632f2ef8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 205.236581][ T7331] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007f576239c819 [ 205.236587][ T7331] RDX: 00007f57632f2f10 RSI: 0000000000000058 RDI: 00007f57632f2f10 [ 205.236594][ T7331] RBP: 00007f57632f3090 R08: 0000000000000000 R09: 0000000000000058 [ 205.236600][ T7331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 205.236606][ T7331] R13: 00007f5762616128 R14: 00007f5762616090 R15: 00007ffe69dbba58 [ 205.236620][ T7331] [ 205.236641][ T7331] Mem-Info: [ 205.544995][ T7331] active_anon:16121 inactive_anon:0 isolated_anon:0 [ 205.544995][ T7331] active_file:21072 inactive_file:40877 isolated_file:0 [ 205.544995][ T7331] unevictable:768 dirty:506 writeback:0 [ 205.544995][ T7331] slab_reclaimable:11517 slab_unreclaimable:101211 [ 205.544995][ T7331] mapped:33527 shmem:7095 pagetables:1307 [ 205.544995][ T7331] sec_pagetables:0 bounce:0 [ 205.544995][ T7331] kernel_misc_reclaimable:0 [ 205.544995][ T7331] free:1287373 free_pcp:10626 free_cma:0 [ 205.598828][ T7331] Node 0 active_anon:64488kB inactive_anon:0kB active_file:84288kB inactive_file:163316kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:134052kB dirty:2028kB writeback:0kB shmem:26864kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12736kB pagetables:5156kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 205.652566][ T7331] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:192kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:112kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 205.704384][ T5964] usb 3-1: new full-speed USB device number 21 using dummy_hcd [ 205.736428][ T7331] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 205.772445][ T7331] lowmem_reserve[]: 0 2476 2477 2477 2477 [ 205.778907][ T7331] Node 0 DMA32 free:1197996kB boost:0kB min:34052kB low:42564kB high:51076kB reserved_highatomic:0KB free_highatomic:0KB active_anon:61488kB inactive_anon:0kB active_file:84288kB inactive_file:163316kB unevictable:1536kB writepending:2028kB zspages:0kB present:3129332kB managed:2535812kB mlocked:0kB bounce:0kB free_pcp:46500kB local_pcp:21072kB free_cma:0kB [ 205.862320][ T7331] lowmem_reserve[]: 0 0 0 0 0 [ 205.882476][ T7331] Node 0 Normal free:12kB boost:0kB min:12kB low:12kB high:12kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1020kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:4kB free_cma:0kB [ 205.942372][ T7331] lowmem_reserve[]: 0 0 0 0 0 [ 205.947209][ T7331] Node 1 Normal free:3939680kB boost:0kB min:55832kB low:69788kB high:83744kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:192kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 205.953479][ T5964] usb 3-1: unable to get BOS descriptor or descriptor too short [ 205.990167][ T7331] lowmem_reserve[]: 0 0 0 0 0 [ 205.995316][ T5964] usb 3-1: not running at top speed; connect to a high speed hub [ 206.003742][ T7331] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 206.017831][ T5964] usb 3-1: config 2 has an invalid interface number: 212 but max is 1 [ 206.026277][ T5964] usb 3-1: config 2 has an invalid interface number: 226 but max is 1 [ 206.033510][ T7331] Node 0 [ 206.034952][ T5964] usb 3-1: config 2 has no interface number 0 [ 206.036733][ T7331] DMA32: [ 206.037943][ T5964] usb 3-1: config 2 has no interface number 1 [ 206.054760][ T7345] CIFS: VFS: UNC: path must begin with // or \\ [ 206.056989][ T5964] usb 3-1: config 2 interface 212 altsetting 9 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 206.061732][ T7345] Malformed UNC in devname [ 206.061732][ T7345] [ 206.072077][ T5964] usb 3-1: config 2 interface 226 altsetting 0 has a duplicate endpoint with address 0x1, skipping [ 206.088851][ T7331] 263*4kB (UME) 1977*8kB (UME) 1480*16kB (UME) 900*32kB (UME) 557*64kB (UME) 398*128kB (UME) 283*256kB (UME) 161*512kB (UM) 91*1024kB (UME) 13*2048kB (UME) 190*4096kB [ 206.089407][ T5964] usb 3-1: config 2 interface 226 altsetting 0 endpoint 0x85 has invalid maxpacket 37745, setting to 64 [ 206.124732][ T7345] CIFS: VFS: Malformed UNC in devname [ 206.125635][ T7331] (UM) [ 206.130295][ T5964] usb 3-1: config 2 interface 226 altsetting 0 endpoint 0x7 has an invalid bInterval 0, changing to 10 [ 206.137248][ T7331] = 1208868kB [ 206.147654][ T5964] usb 3-1: config 2 interface 226 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 206.155606][ T7331] Node 0 [ 206.158095][ T5964] usb 3-1: config 2 interface 226 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 206.158791][ T7331] Normal: [ 206.161071][ T5964] usb 3-1: config 2 interface 212 has no altsetting 0 [ 206.188233][ T7331] 1*4kB (U) 1*8kB (U) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 12kB [ 206.200199][ T7331] Node 1 Normal: 2*4kB (UM) 3*8kB (UM) 4*16kB (UM) 8*32kB (UM) 4*64kB (UM) 2*128kB (UM) 2*256kB (M) 2*512kB (M) 1*1024kB (M) 2*2048kB (U) 960*4096kB (UM) = 3939680kB [ 206.218827][ T29] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 206.220526][ T7331] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 206.245421][ T7331] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 206.256340][ T5964] usb 3-1: New USB device found, idVendor=0738, idProduct=4540, bcdDevice=c6.ce [ 206.267250][ T7331] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 206.267897][ T5964] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 206.277710][ T7331] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 206.294408][ T5964] usb 3-1: Product: syz [ 206.298689][ T5964] usb 3-1: Manufacturer: syz [ 206.298702][ T7331] 63320 total pagecache pages [ 206.298712][ T7331] 0 pages in swap cache [ 206.298718][ T7331] Free swap = 124996kB [ 206.298726][ T7331] Total swap = 124996kB [ 206.298734][ T7331] 2097051 pages RAM [ 206.303713][ T5964] usb 3-1: SerialNumber: syz [ 206.312803][ T7331] 0 pages HighMem/MovableOnly [ 206.335499][ T7331] 431228 pages reserved [ 206.339667][ T7331] 0 pages cma reserved [ 206.382395][ T29] usb 4-1: Using ep0 maxpacket: 32 [ 206.397382][ T29] usb 4-1: config 0 has no interfaces? [ 206.403867][ T29] usb 4-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 206.415643][ T29] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 206.497813][ T29] usb 4-1: config 0 descriptor?? [ 206.524052][ T5881] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 206.736200][ T5881] usb 5-1: config 0 has no interfaces? [ 206.747575][ T5881] usb 5-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 206.758677][ T5881] usb 5-1: New USB device strings: Mfr=0, Product=10, SerialNumber=0 [ 206.774696][ T5881] usb 5-1: Product: syz [ 206.802004][ T5964] input: Mad Catz Beat Pad as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:2.226/input/input12 [ 206.813378][ T5881] usb 5-1: config 0 descriptor?? [ 206.969525][ T30] audit: type=1400 audit(1776287374.058:618): avc: denied { read } for pid=5165 comm="acpid" name="js0" dev="devtmpfs" ino=3012 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 207.104098][ T30] audit: type=1400 audit(1776287374.058:619): avc: denied { open } for pid=5165 comm="acpid" path="/dev/input/js0" dev="devtmpfs" ino=3012 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 207.429696][ T30] audit: type=1400 audit(1776287374.058:620): avc: denied { ioctl } for pid=5165 comm="acpid" path="/dev/input/js0" dev="devtmpfs" ino=3012 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 207.431088][ T29] usb 4-1: USB disconnect, device number 15 [ 207.474756][ T30] audit: type=1400 audit(1776287374.238:621): avc: denied { getopt } for pid=7342 comm="syz.3.353" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 207.475143][ T5860] usb 5-1: USB disconnect, device number 14 [ 207.555649][ T5964] usb 3-1: USB disconnect, device number 21 [ 207.686945][ T30] audit: type=1400 audit(1776287374.778:622): avc: denied { shutdown } for pid=7362 comm="syz.1.359" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 207.796803][ T7366] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 207.807747][ T7366] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 210.042483][ T5860] usb 4-1: new full-speed USB device number 16 using dummy_hcd [ 210.471865][ T5860] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 210.648790][ T5860] usb 4-1: config 0 has no interface number 0 [ 210.662927][ T5860] usb 4-1: config 0 interface 1 altsetting 128 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 210.708295][ T5860] usb 4-1: config 0 interface 1 altsetting 128 endpoint 0x81 has invalid wMaxPacketSize 0 [ 210.751709][ T5860] usb 4-1: config 0 interface 1 altsetting 128 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 210.804450][ T5860] usb 4-1: config 0 interface 1 has no altsetting 0 [ 210.846247][ T5860] usb 4-1: New USB device found, idVendor=145f, idProduct=0212, bcdDevice= 0.00 [ 210.876740][ T5860] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 210.906943][ T5860] usb 4-1: config 0 descriptor?? [ 210.996635][ T7396] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 211.017547][ T7396] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 211.524742][ T24] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 211.816789][ T7405] netlink: 44 bytes leftover after parsing attributes in process `syz.3.365'. [ 211.837977][ T24] usb 1-1: config 0 has no interfaces? [ 211.967214][ T24] usb 1-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 211.976960][ T24] usb 1-1: New USB device strings: Mfr=0, Product=10, SerialNumber=0 [ 211.985452][ T24] usb 1-1: Product: syz [ 211.992579][ T24] usb 1-1: config 0 descriptor?? [ 212.756078][ T7413] Mount JFS Failure: -22 [ 212.760410][ T7413] jfs_mount failed w/return code = -22 [ 213.088194][ T5964] usb 1-1: USB disconnect, device number 13 [ 213.128048][ T5860] uclogic 0003:145F:0212.0002: failed retrieving string descriptor #100: -71 [ 213.137707][ T5860] uclogic 0003:145F:0212.0002: failed retrieving pen parameters: -71 [ 213.146227][ T5860] uclogic 0003:145F:0212.0002: pen probing failed: -71 [ 213.153481][ T5860] uclogic 0003:145F:0212.0002: failed probing parameters: -71 [ 213.162066][ T5860] uclogic 0003:145F:0212.0002: probe with driver uclogic failed with error -71 [ 213.173989][ T5860] usb 4-1: USB disconnect, device number 16 [ 214.262343][ T5860] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 214.370906][ T30] audit: type=1804 audit(1776287381.458:623): pid=7430 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.1.377" name="file1" dev="ramfs" ino=15572 res=1 errno=0 [ 214.444172][ T5860] usb 3-1: unable to get BOS descriptor or descriptor too short [ 214.464170][ T5860] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 214.480323][ T5860] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 214.499042][ T5860] usb 3-1: config 1 interface 1 has no altsetting 0 [ 214.521733][ T5860] usb 3-1: string descriptor 0 read error: -22 [ 214.535927][ T5860] usb 3-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 214.554372][ T5860] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 214.762421][ T5860] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 215.270759][ T30] audit: type=1400 audit(1776287382.358:624): avc: denied { read } for pid=5476 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 215.272577][ T7445] sp0: Synchronizing with TNC [ 215.526517][ T7444] [U] [ 215.820481][ T7455] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 215.848189][ T7455] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 216.826662][ T30] audit: type=1400 audit(1776287383.918:625): avc: denied { block_suspend } for pid=7460 comm="syz.1.387" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 217.036662][ T5963] usb 3-1: USB disconnect, device number 22 [ 217.965027][ T7474] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 217.975579][ T7474] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 218.204253][ T5964] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 218.396624][ T5964] usb 5-1: config 0 has no interfaces? [ 218.405261][ T5964] usb 5-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 218.418663][ T5964] usb 5-1: New USB device strings: Mfr=0, Product=10, SerialNumber=0 [ 218.418686][ T5860] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 218.456678][ T5964] usb 5-1: Product: syz [ 218.468449][ T5964] usb 5-1: config 0 descriptor?? [ 218.604176][ T5860] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 218.616904][ T5860] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 218.627108][ T5860] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 218.638340][ T5860] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 218.935852][ T5922] usb 5-1: USB disconnect, device number 15 [ 218.947504][ T7476] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 218.988941][ T5860] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 219.478345][ T7489] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 219.506937][ T7489] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 219.696765][ T5860] usb 3-1: USB disconnect, device number 23 [ 219.923057][ T7496] syzkaller0: entered promiscuous mode [ 219.928762][ T7496] syzkaller0: entered allmulticast mode [ 222.098813][ T7519] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 222.118435][ T7519] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 222.162497][ T5860] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 222.323969][ T5860] usb 4-1: unable to get BOS descriptor or descriptor too short [ 222.334014][ T5860] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 222.352609][ T5860] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 222.402464][ T5963] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 222.410309][ T5860] usb 4-1: too many endpoints for config 1 interface 1 altsetting 76: 188, using maximum allowed: 30 [ 222.456515][ T5860] usb 4-1: config 1 interface 1 altsetting 76 has 0 endpoint descriptors, different from the interface descriptor's value: 188 [ 222.473488][ T5860] usb 4-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 222.488011][ T5860] usb 4-1: config 1 interface 1 has no altsetting 0 [ 222.522251][ T5860] usb 4-1: string descriptor 0 read error: -22 [ 222.531545][ T5860] usb 4-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 222.562514][ T5860] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 222.594221][ T5963] usb 1-1: Using ep0 maxpacket: 8 [ 222.713546][ T5963] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 223.198538][ T5963] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 223.208402][ T5963] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 223.222286][ T5963] usb 1-1: New USB device found, idVendor=054c, idProduct=0268, bcdDevice= 0.00 [ 223.254049][ T5963] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 223.303986][ T5963] usb 1-1: config 0 descriptor?? [ 223.954260][ T5860] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 223.984617][ T5963] usbhid 1-1:0.0: can't add hid device: -71 [ 223.996790][ T5963] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 224.020546][ T5963] usb 1-1: USB disconnect, device number 14 [ 225.375113][ T6042] usb 4-1: USB disconnect, device number 17 [ 225.663588][ T5963] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 225.824642][ T6042] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 225.842712][ T5963] usb 3-1: Using ep0 maxpacket: 32 [ 225.860894][ T5963] usb 3-1: config 0 has an invalid interface number: 132 but max is 0 [ 225.890349][ T5963] usb 3-1: config 0 has no interface number 0 [ 225.908600][ T5963] usb 3-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 225.945276][ T5963] usb 3-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 225.970249][ T5963] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 225.985484][ T5963] usb 3-1: Product: syz [ 225.993084][ T5963] usb 3-1: Manufacturer: syz [ 225.998355][ T5963] usb 3-1: SerialNumber: syz [ 226.012358][ T5963] usb 3-1: config 0 descriptor?? [ 226.015371][ T6042] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 226.025659][ T5963] em28xx 3-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 226.069387][ T6042] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 226.104065][ T6042] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 226.140559][ T6042] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 226.165179][ T7547] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 226.198115][ T5963] em28xx 3-1:0.132: Video interface 132 found: [ 226.203278][ T6042] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 226.409430][ T6042] usb 4-1: USB disconnect, device number 18 [ 226.505851][ T5963] em28xx 3-1:0.132: unknown em28xx chip ID (0) [ 226.555065][ T5799] udevd[5799]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 226.929811][ T5963] em28xx 3-1:0.132: reading from i2c device at 0xa0 failed: couldn't get the received message from the bridge (error=0) [ 226.966753][ T5963] em28xx 3-1:0.132: board has no eeprom [ 227.225880][ T5963] em28xx 3-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 227.250714][ T5963] em28xx 3-1:0.132: analog set to bulk mode. [ 227.273045][ T5891] em28xx 3-1:0.132: Registering V4L2 extension [ 227.860052][ T6042] usb 3-1: USB disconnect, device number 24 [ 227.883599][ T6042] em28xx 3-1:0.132: Disconnecting em28xx [ 228.129424][ T5891] em28xx 3-1:0.132: Config register raw data: 0xffffffed [ 228.138298][ T5891] em28xx 3-1:0.132: AC97 chip type couldn't be determined [ 228.219597][ T5891] em28xx 3-1:0.132: No AC97 audio processor [ 228.236287][ T5891] usb 3-1: Decoder not found [ 228.242344][ T5891] em28xx 3-1:0.132: failed to create media graph [ 228.249262][ T5891] em28xx 3-1:0.132: V4L2 device video103 deregistered [ 228.319997][ T5891] em28xx 3-1:0.132: Remote control support is not available for this card. [ 228.472162][ T6042] em28xx 3-1:0.132: Closing input extension [ 228.486402][ T6042] em28xx 3-1:0.132: Freeing device [ 231.813478][ T7589] netlink: 'syz.3.419': attribute type 3 has an invalid length. [ 231.835989][ T30] audit: type=1400 audit(1776287398.898:626): avc: denied { create } for pid=7583 comm="syz.3.419" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 232.646272][ T30] audit: type=1400 audit(1776287398.898:627): avc: denied { write } for pid=7583 comm="syz.3.419" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 232.774922][ T30] audit: type=1400 audit(1776287398.918:628): avc: denied { ioctl } for pid=7583 comm="syz.3.419" path="socket:[15800]" dev="sockfs" ino=15800 ioctlcmd=0x941a scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 232.821471][ T30] audit: type=1400 audit(1776287398.918:629): avc: denied { name_bind } for pid=7583 comm="syz.3.419" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=icmp_socket permissive=1 [ 232.855960][ T30] audit: type=1400 audit(1776287398.918:630): avc: denied { node_bind } for pid=7583 comm="syz.3.419" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 233.122386][ T5860] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 233.137838][ T5809] Bluetooth: hci4: Ignoring HCI_Connection_Complete for existing connection [ 233.202391][ T7599] netlink: 4 bytes leftover after parsing attributes in process `syz.2.423'. [ 233.299636][ T5860] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 233.311163][ T7599] nbd: socks must be embedded in a SOCK_ITEM attr [ 233.337791][ T5860] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 233.418141][ T5860] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 233.488581][ T5860] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 233.646244][ T7592] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 233.836663][ T5860] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 234.126947][ T6644] udevd[6644]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 234.320103][ T6644] udevd[6644]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 234.693640][ T5860] usb 4-1: USB disconnect, device number 19 [ 237.706979][ T5963] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 237.874271][ T5963] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 237.901344][ T5963] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 237.938083][ T5963] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 238.015113][ T5963] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 238.030852][ T7612] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 238.050351][ T5963] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 238.074022][ T5891] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 238.259897][ T5963] usb 5-1: USB disconnect, device number 16 [ 238.273302][ T5891] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 238.291016][ T5891] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 238.324812][ T5891] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 238.347522][ T5891] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 238.388940][ T7620] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 238.428451][ T5891] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 238.738790][ T5891] usb 4-1: USB disconnect, device number 20 [ 238.964542][ T30] audit: type=1400 audit(1776287405.948:631): avc: denied { write } for pid=7631 comm="syz.2.432" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 239.714977][ T7642] loop4: detected capacity change from 0 to 7 [ 239.741585][ T7642] buffer_io_error: 28 callbacks suppressed [ 239.741603][ T7642] Buffer I/O error on dev loop4, logical block 0, async page read [ 239.756923][ T7642] Buffer I/O error on dev loop4, logical block 0, async page read [ 239.769360][ T7642] Buffer I/O error on dev loop4, logical block 0, async page read [ 239.794794][ T7642] Buffer I/O error on dev loop4, logical block 0, async page read [ 239.808478][ T7642] Buffer I/O error on dev loop4, logical block 0, async page read [ 239.826488][ T7642] Buffer I/O error on dev loop4, logical block 0, async page read [ 239.830914][ T7628] tipc: Enabling of bearer rejected, already enabled [ 239.835985][ T7642] Buffer I/O error on dev loop4, logical block 0, async page read [ 239.892009][ T7642] ldm_validate_partition_table(): Disk read failed. [ 239.922072][ T7642] Buffer I/O error on dev loop4, logical block 0, async page read [ 239.932767][ T7642] Buffer I/O error on dev loop4, logical block 0, async page read [ 239.941596][ T7642] Buffer I/O error on dev loop4, logical block 0, async page read [ 239.955872][ T7642] Dev loop4: unable to read RDB block 0 [ 239.966045][ T7642] loop4: unable to read partition table [ 240.002755][ T7642] loop4: partition table beyond EOD, truncated [ 240.009844][ T7642] loop_reread_partitions: partition scan of loop4 (Sj %`ր5) failed (rc=-5) [ 240.128103][ T7646] ldm_validate_partition_table(): Disk read failed. [ 240.137875][ T7646] Dev loop4: unable to read RDB block 0 [ 240.150489][ T7646] loop4: unable to read partition table [ 240.157222][ T7646] loop4: partition table beyond EOD, truncated [ 241.084770][ T7654] tipc: Enabling of bearer rejected, already enabled [ 241.883931][ T5891] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 242.064465][ T5891] usb 4-1: config 0 has no interfaces? [ 242.085215][ T5891] usb 4-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 242.123246][ T5891] usb 4-1: New USB device strings: Mfr=0, Product=10, SerialNumber=0 [ 242.150500][ T5891] usb 4-1: Product: syz [ 242.176328][ T5891] usb 4-1: config 0 descriptor?? [ 242.402520][ T5891] usb 4-1: USB disconnect, device number 21 [ 243.160954][ T7676] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 243.169798][ T7676] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 243.267101][ T30] audit: type=1400 audit(1776287410.358:632): avc: denied { mount } for pid=7677 comm="syz.3.443" name="/" dev="autofs" ino=16494 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 243.372336][ T5922] usb 3-1: new full-speed USB device number 25 using dummy_hcd [ 243.536034][ T5922] usb 3-1: config 0 has no interfaces? [ 243.547926][ T5922] usb 3-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 243.558807][ T5922] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 243.568879][ T5922] usb 3-1: Product: syz [ 243.597454][ T5922] usb 3-1: Manufacturer: syz [ 243.608557][ T5922] usb 3-1: SerialNumber: syz [ 243.634575][ T5922] usb 3-1: config 0 descriptor?? [ 243.862001][ T5922] usb 3-1: USB disconnect, device number 25 [ 244.054528][ T7693] loop4: detected capacity change from 0 to 7 [ 244.065171][ T7695] netlink: 28 bytes leftover after parsing attributes in process `syz.4.447'. [ 244.076258][ T7693] ldm_validate_partition_table(): Disk read failed. [ 244.092904][ T7693] Dev loop4: unable to read RDB block 0 [ 244.099806][ T7693] loop4: unable to read partition table [ 244.108391][ T7693] loop4: partition table beyond EOD, truncated [ 244.133064][ T7693] loop_reread_partitions: partition scan of loop4 (Sj %`ր5) failed (rc=-5) [ 244.171807][ T7697] ldm_validate_partition_table(): Disk read failed. [ 244.199684][ T7697] Dev loop4: unable to read RDB block 0 [ 244.238601][ T7697] loop4: unable to read partition table [ 244.252550][ T7697] loop4: partition table beyond EOD, truncated [ 245.012320][ T24] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 245.019973][ T29] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 245.162345][ T5964] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 245.196477][ T29] usb 1-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 245.213048][ T24] usb 3-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 245.237783][ T29] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 245.247528][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 245.261087][ T29] usb 1-1: Product: syz [ 245.268759][ T24] usb 3-1: Product: syz [ 245.274451][ T29] usb 1-1: Manufacturer: syz [ 245.285636][ T24] usb 3-1: Manufacturer: syz [ 245.295882][ T29] usb 1-1: SerialNumber: syz [ 245.304540][ T24] usb 3-1: SerialNumber: syz [ 245.337289][ T29] usb 1-1: config 0 descriptor?? [ 245.349200][ T5964] usb 5-1: Using ep0 maxpacket: 32 [ 245.362732][ T24] usb 3-1: config 0 descriptor?? [ 245.374524][ T30] audit: type=1400 audit(1776287412.458:633): avc: denied { unmount } for pid=5807 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 245.409422][ T29] i2c-tiny-usb 1-1:0.0: version 6d.cc found at bus 001 address 015 [ 245.419014][ T24] i2c-tiny-usb 3-1:0.0: version 6d.cc found at bus 003 address 026 [ 245.463606][ T5964] usb 5-1: config 0 has an invalid interface number: 132 but max is 0 [ 245.463860][ T7708] netlink: 232 bytes leftover after parsing attributes in process `syz.3.452'. [ 245.512349][ T5964] usb 5-1: config 0 has no interface number 0 [ 245.532414][ T5964] usb 5-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 245.575535][ T5964] usb 5-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 245.621838][ T5964] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 245.646926][ T5964] usb 5-1: Product: syz [ 245.684565][ T5964] usb 5-1: Manufacturer: syz [ 245.695083][ T5964] usb 5-1: SerialNumber: syz [ 245.698693][ T7710] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 245.714856][ T7710] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 245.727556][ T5964] usb 5-1: config 0 descriptor?? [ 245.744846][ T5964] em28xx 5-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 245.771158][ T5964] em28xx 5-1:0.132: Video interface 132 found: [ 245.912334][ T5860] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 246.013730][ T24] i2c i2c-1: failure reading functionality [ 246.034149][ T29] i2c i2c-2: failure reading functionality [ 246.042578][ T24] i2c i2c-1: connected i2c-tiny-usb device [ 246.062922][ T29] i2c i2c-2: connected i2c-tiny-usb device [ 246.070500][ T24] usb 3-1: USB disconnect, device number 26 [ 246.084806][ T29] usb 1-1: USB disconnect, device number 15 [ 246.097562][ T5860] usb 4-1: unable to get BOS descriptor or descriptor too short [ 246.107966][ T5860] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 246.136965][ T5860] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 246.156343][ T5964] em28xx 5-1:0.132: unknown em28xx chip ID (0) [ 246.160793][ T5860] usb 4-1: too many endpoints for config 1 interface 1 altsetting 76: 188, using maximum allowed: 30 [ 246.180080][ T5860] usb 4-1: config 1 interface 1 altsetting 76 has 0 endpoint descriptors, different from the interface descriptor's value: 188 [ 246.197262][ T5860] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 246.214311][ T5860] usb 4-1: config 1 interface 1 has no altsetting 0 [ 246.225826][ T5860] usb 4-1: string descriptor 0 read error: -22 [ 246.237769][ T5860] usb 4-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 246.261423][ T5860] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 246.291519][ T5860] usb 4-1: incorrect wMaxPacketSize 0x0 for BADD profile [ 246.443144][ T5860] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 246.649180][ T5964] em28xx 5-1:0.132: reading from i2c device at 0xa0 failed: couldn't get the received message from the bridge (error=0) [ 246.675749][ T5964] em28xx 5-1:0.132: board has no eeprom [ 248.157429][ T5964] em28xx 5-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 248.168959][ T7719] fuse: Invalid rootmode [ 248.178533][ T5964] em28xx 5-1:0.132: analog set to bulk mode. [ 248.185821][ T5922] em28xx 5-1:0.132: Registering V4L2 extension [ 248.282590][ T29] usb 5-1: USB disconnect, device number 17 [ 248.325388][ T29] em28xx 5-1:0.132: Disconnecting em28xx [ 248.569878][ T5922] em28xx 5-1:0.132: Config register raw data: 0xffffffed [ 248.579145][ T5922] em28xx 5-1:0.132: AC97 chip type couldn't be determined [ 248.588245][ T5922] em28xx 5-1:0.132: No AC97 audio processor [ 248.622711][ T5922] usb 5-1: Decoder not found [ 248.634802][ T5922] em28xx 5-1:0.132: failed to create media graph [ 248.649991][ T5922] em28xx 5-1:0.132: V4L2 device video103 deregistered [ 248.670736][ T5922] em28xx 5-1:0.132: Remote control support is not available for this card. [ 248.686549][ T5881] usb 3-1: new full-speed USB device number 27 using dummy_hcd [ 248.699892][ T29] em28xx 5-1:0.132: Closing input extension [ 248.767992][ T5860] usb 4-1: USB disconnect, device number 22 [ 248.781199][ T29] em28xx 5-1:0.132: Freeing device [ 248.848563][ T7735] loop4: detected capacity change from 0 to 7 [ 248.891016][ T5881] usb 3-1: config 0 has no interfaces? [ 248.900254][ T5881] usb 3-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 248.917678][ T5881] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 248.988995][ T7735] buffer_io_error: 66 callbacks suppressed [ 248.989056][ T7735] Buffer I/O error on dev loop4, logical block 0, async page read [ 249.022247][ T7735] Buffer I/O error on dev loop4, logical block 0, async page read [ 249.044729][ T7735] Buffer I/O error on dev loop4, logical block 0, async page read [ 249.067640][ T7735] Buffer I/O error on dev loop4, logical block 0, async page read [ 249.090865][ T7735] Buffer I/O error on dev loop4, logical block 0, async page read [ 249.110564][ T7735] Buffer I/O error on dev loop4, logical block 0, async page read [ 249.138971][ T7735] Buffer I/O error on dev loop4, logical block 0, async page read [ 249.151554][ T7735] ldm_validate_partition_table(): Disk read failed. [ 249.162462][ T7735] Buffer I/O error on dev loop4, logical block 0, async page read [ 249.181930][ T7735] Buffer I/O error on dev loop4, logical block 0, async page read [ 249.208921][ T7735] Buffer I/O error on dev loop4, logical block 0, async page read [ 249.220175][ T7735] Dev loop4: unable to read RDB block 0 [ 249.250616][ T7735] loop4: unable to read partition table [ 249.274867][ T7735] loop4: partition table beyond EOD, truncated [ 249.283089][ T7735] loop_reread_partitions: partition scan of loop4 (Sj %`ր5) failed (rc=-5) [ 249.440067][ T5881] usb 3-1: Product: syz [ 249.458667][ T5881] usb 3-1: Manufacturer: syz [ 249.475256][ T5881] usb 3-1: SerialNumber: syz [ 249.555004][ T5881] usb 3-1: config 0 descriptor?? [ 249.803014][ T5881] usb 3-1: USB disconnect, device number 27 [ 249.824627][ T5809] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 249.900830][ T7745] netlink: 4 bytes leftover after parsing attributes in process `syz.4.463'. [ 250.110364][ T7745] nbd: socks must be embedded in a SOCK_ITEM attr [ 251.447319][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 251.456317][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 251.956567][ T6139] udevd[6139]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 252.643531][ T7755] netlink: 'syz.3.465': attribute type 1 has an invalid length. [ 252.720137][ T30] audit: type=1400 audit(1776287419.808:634): avc: denied { create } for pid=7757 comm="syz.0.464" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 252.740944][ T30] audit: type=1400 audit(1776287419.808:635): avc: denied { write } for pid=7757 comm="syz.0.464" path="socket:[16709]" dev="sockfs" ino=16709 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 252.887921][ T30] audit: type=1400 audit(1776287419.978:636): avc: denied { create } for pid=7757 comm="syz.0.464" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 252.933986][ T5881] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 253.105931][ T5881] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 252, changing to 11 [ 253.128482][ T5881] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 253.145495][ T5881] usb 4-1: New USB device found, idVendor=04d9, idProduct=a04a, bcdDevice= 0.00 [ 253.164076][ T5881] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 253.198382][ T5881] usb 4-1: config 0 descriptor?? [ 253.636595][ T5881] holtek_mouse 0003:04D9:A04A.0003: unknown main item tag 0x0 [ 253.657189][ T5881] holtek_mouse 0003:04D9:A04A.0003: unknown main item tag 0x0 [ 253.680761][ T5881] holtek_mouse 0003:04D9:A04A.0003: unknown main item tag 0x0 [ 253.688654][ T5881] holtek_mouse 0003:04D9:A04A.0003: unknown main item tag 0x0 [ 253.707672][ T5881] holtek_mouse 0003:04D9:A04A.0003: unknown main item tag 0x0 [ 253.727217][ T5881] holtek_mouse 0003:04D9:A04A.0003: unknown main item tag 0x0 [ 253.735160][ T5881] holtek_mouse 0003:04D9:A04A.0003: unknown main item tag 0x0 [ 253.759075][ T5881] holtek_mouse 0003:04D9:A04A.0003: unknown main item tag 0x0 [ 253.777836][ T5881] holtek_mouse 0003:04D9:A04A.0003: unknown main item tag 0x0 [ 253.786154][ T5881] holtek_mouse 0003:04D9:A04A.0003: unknown main item tag 0x0 [ 253.821326][ T5881] holtek_mouse 0003:04D9:A04A.0003: unexpected long global item [ 253.833801][ T5881] holtek_mouse 0003:04D9:A04A.0003: hid parse failed: -22 [ 253.876159][ T5881] holtek_mouse 0003:04D9:A04A.0003: probe with driver holtek_mouse failed with error -22 [ 254.000824][ T30] audit: type=1400 audit(1776287421.088:637): avc: denied { lock } for pid=7754 comm="syz.3.465" path="socket:[16730]" dev="sockfs" ino=16730 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_stream_socket permissive=1 [ 256.052737][ T5881] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 256.070319][ T7755] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 256.245597][ T30] audit: type=1400 audit(1776287423.338:638): avc: denied { connect } for pid=7790 comm="syz.1.474" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 256.290533][ T5881] usb 5-1: unable to get BOS descriptor or descriptor too short [ 256.302373][ T5860] usb 4-1: USB disconnect, device number 23 [ 256.308722][ T5881] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 256.332530][ T5881] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 256.393304][ T5881] usb 5-1: too many endpoints for config 1 interface 1 altsetting 76: 188, using maximum allowed: 30 [ 256.422330][ T5881] usb 5-1: config 1 interface 1 altsetting 76 has 0 endpoint descriptors, different from the interface descriptor's value: 188 [ 256.440725][ T5881] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 256.497909][ T5881] usb 5-1: config 1 interface 1 has no altsetting 0 [ 256.564390][ T5881] usb 5-1: string descriptor 0 read error: -22 [ 256.576251][ T5881] usb 5-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 256.628497][ T7791] sctp: [Deprecated]: syz.2.473 (pid 7791) Use of struct sctp_assoc_value in delayed_ack socket option. [ 256.628497][ T7791] Use struct sctp_sack_info instead [ 256.645192][ T5881] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 256.681118][ T5881] usb 5-1: incorrect wMaxPacketSize 0x0 for BADD profile [ 256.747857][ T7791] sctp: [Deprecated]: syz.2.473 (pid 7791) Use of struct sctp_assoc_value in delayed_ack socket option. [ 256.747857][ T7791] Use struct sctp_sack_info instead [ 256.877256][ T7800] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 256.922076][ T5881] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 256.987200][ T7791] openvswitch: netlink: Tunnel attr 67 out of range max 16 [ 257.117531][ T7789] overlayfs: failed to create directory ./bus/work (errno: 22); mounting read-only [ 257.335847][ T7807] netlink: 'syz.2.478': attribute type 21 has an invalid length. [ 257.360013][ T7807] netlink: 128 bytes leftover after parsing attributes in process `syz.2.478'. [ 257.374624][ T7807] netlink: 'syz.2.478': attribute type 4 has an invalid length. [ 257.386178][ T7807] netlink: 3 bytes leftover after parsing attributes in process `syz.2.478'. [ 257.400814][ T7807] capability: warning: `syz.2.478' uses deprecated v2 capabilities in a way that may be insecure [ 257.412901][ T5881] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 257.572373][ T5881] usb 4-1: Using ep0 maxpacket: 32 [ 257.580109][ T5881] usb 4-1: config 0 has an invalid interface number: 188 but max is 0 [ 257.597488][ T5881] usb 4-1: config 0 has no interface number 0 [ 257.610639][ T5881] usb 4-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 257.640697][ T5881] usb 4-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 257.642906][ T5891] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 257.669052][ T7817] FAULT_INJECTION: forcing a failure. [ 257.669052][ T7817] name failslab, interval 1, probability 0, space 0, times 0 [ 257.685108][ T5881] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 257.685217][ T7817] CPU: 0 UID: 0 PID: 7817 Comm: syz.1.482 Not tainted syzkaller #0 PREEMPT(full) [ 257.685237][ T7817] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 257.685246][ T7817] Call Trace: [ 257.685252][ T7817] [ 257.685261][ T7817] dump_stack_lvl+0x100/0x190 [ 257.685283][ T7817] should_fail_ex.cold+0x5/0xa [ 257.685306][ T7817] should_failslab+0xc2/0x120 [ 257.685329][ T7817] kmem_cache_alloc_node_noprof+0x81/0x6f0 [ 257.685349][ T7817] ? __alloc_skb+0x140/0x710 [ 257.685366][ T7817] ? __alloc_skb+0x5b7/0x710 [ 257.685386][ T7817] __alloc_skb+0x140/0x710 [ 257.685402][ T7817] ? __alloc_skb+0x5b7/0x710 [ 257.685417][ T7817] ? __pfx___alloc_skb+0x10/0x10 [ 257.685441][ T7817] netlink_alloc_large_skb+0x69/0x150 [ 257.685465][ T7817] netlink_sendmsg+0x680/0xda0 [ 257.685491][ T7817] ? __pfx_netlink_sendmsg+0x10/0x10 [ 257.685513][ T7817] ? __might_fault+0xa0/0x140 [ 257.685538][ T7817] ____sys_sendmsg+0x9e1/0xb70 [ 257.685559][ T7817] ? __pfx_netlink_sendmsg+0x10/0x10 [ 257.685583][ T7817] ? __pfx_____sys_sendmsg+0x10/0x10 [ 257.685621][ T7817] ___sys_sendmsg+0x190/0x1e0 [ 257.685650][ T7817] ? __pfx____sys_sendmsg+0x10/0x10 [ 257.685698][ T7817] __sys_sendmsg+0x170/0x220 [ 257.685718][ T7817] ? __pfx___sys_sendmsg+0x10/0x10 [ 257.685745][ T7817] ? rcu_is_watching+0x12/0xc0 [ 257.685768][ T7817] do_syscall_64+0x10b/0xf80 [ 257.685786][ T7817] ? clear_bhb_loop+0x40/0x90 [ 257.685804][ T7817] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 257.685820][ T7817] RIP: 0033:0x7f5a9819c819 [ 257.685833][ T7817] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 257.685847][ T7817] RSP: 002b:00007f5a9901d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 257.685863][ T7817] RAX: ffffffffffffffda RBX: 00007f5a98415fa0 RCX: 00007f5a9819c819 [ 257.685873][ T7817] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 257.685881][ T7817] RBP: 00007f5a9901d090 R08: 0000000000000000 R09: 0000000000000000 [ 257.685890][ T7817] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 257.685899][ T7817] R13: 00007f5a98416038 R14: 00007f5a98415fa0 R15: 00007ffd7b49f138 [ 257.685919][ T7817] [ 257.991581][ T7819] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 258.002670][ T7819] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 258.084061][ T5891] usb 1-1: config 0 has no interfaces? [ 258.104684][ T5891] usb 1-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 258.114073][ T5891] usb 1-1: New USB device strings: Mfr=0, Product=10, SerialNumber=0 [ 258.122284][ T5891] usb 1-1: Product: syz [ 258.130552][ T5881] usb 4-1: Product: syz [ 258.139937][ T5891] usb 1-1: config 0 descriptor?? [ 258.159255][ T5881] usb 4-1: Manufacturer: syz [ 258.171512][ T5881] usb 4-1: SerialNumber: syz [ 258.188739][ T5881] usb 4-1: config 0 descriptor?? [ 258.201390][ T7804] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 258.354601][ T5860] usb 1-1: USB disconnect, device number 16 [ 258.418548][ T7804] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 258.437977][ T7804] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 258.474746][ T30] audit: type=1400 audit(1776287425.568:639): avc: denied { bind } for pid=7803 comm="syz.3.477" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 258.516249][ T7804] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 258.691293][ T7823] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 258.728269][ T7823] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 258.845936][ T5891] usb 5-1: USB disconnect, device number 18 [ 259.535448][ T7829] tipc: Enabling of bearer rejected, already enabled [ 260.457482][ T5881] asix 4-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 260.516170][ T5881] asix 4-1:0.188: probe with driver asix failed with error -71 [ 260.574373][ T5881] usb 4-1: USB disconnect, device number 24 [ 260.624812][ T7832] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(5) [ 260.631677][ T7832] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 260.669171][ T7832] vhci_hcd vhci_hcd.0: Device attached [ 260.690769][ T7833] vhci_hcd: cannot find a urb of seqnum 1 max seqnum 0 [ 260.699463][ T30] audit: type=1400 audit(1776287427.788:640): avc: denied { setopt } for pid=7831 comm="syz.3.488" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 260.738080][ T3555] vhci_hcd vhci_hcd.3: stop threads [ 260.778032][ T3555] vhci_hcd vhci_hcd.3: release socket [ 260.880000][ T30] audit: type=1400 audit(1776287427.938:641): avc: denied { create } for pid=7839 comm="syz.2.489" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 260.902318][ T29] usb 39-1: new low-speed USB device number 2 using vhci_hcd [ 261.615999][ T3555] vhci_hcd vhci_hcd.3: disconnect device [ 261.788236][ T7849] loop4: detected capacity change from 0 to 7 [ 261.823620][ T7849] buffer_io_error: 14 callbacks suppressed [ 261.823639][ T7849] Buffer I/O error on dev loop4, logical block 0, async page read [ 261.888281][ T7849] Buffer I/O error on dev loop4, logical block 0, async page read [ 261.894356][ T7854] netlink: 12 bytes leftover after parsing attributes in process `syz.2.493'. [ 261.946158][ T7856] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 261.957085][ T7849] Buffer I/O error on dev loop4, logical block 0, async page read [ 261.967408][ T7849] Buffer I/O error on dev loop4, logical block 0, async page read [ 261.972703][ T7856] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 261.987963][ T7849] Buffer I/O error on dev loop4, logical block 0, async page read [ 261.996880][ T7849] Buffer I/O error on dev loop4, logical block 0, async page read [ 262.006176][ T7849] Buffer I/O error on dev loop4, logical block 0, async page read [ 262.015718][ T7849] ldm_validate_partition_table(): Disk read failed. [ 262.024601][ T7849] Buffer I/O error on dev loop4, logical block 0, async page read [ 262.034185][ T7849] Buffer I/O error on dev loop4, logical block 0, async page read [ 262.042940][ T7849] Buffer I/O error on dev loop4, logical block 0, async page read [ 262.051942][ T7849] Dev loop4: unable to read RDB block 0 [ 262.059461][ T7849] loop4: unable to read partition table [ 262.066369][ T7849] loop4: partition table beyond EOD, truncated [ 262.072903][ T7849] loop_reread_partitions: partition scan of loop4 (Sj %`ր5) failed (rc=-5) [ 262.289041][ T7853] ldm_validate_partition_table(): Disk read failed. [ 262.297764][ T7853] Dev loop4: unable to read RDB block 0 [ 262.305035][ T7853] loop4: unable to read partition table [ 262.311773][ T7853] loop4: partition table beyond EOD, truncated [ 262.663141][ T5180] ldm_validate_partition_table(): Disk read failed. [ 262.670023][ T5180] Dev loop4: unable to read RDB block 0 [ 262.679605][ T5180] loop4: unable to read partition table [ 262.685586][ T5180] loop4: partition table beyond EOD, truncated [ 262.692781][ T5860] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 262.936639][ T7862] FAULT_INJECTION: forcing a failure. [ 262.936639][ T7862] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 262.951101][ T7862] CPU: 0 UID: 0 PID: 7862 Comm: syz.4.487 Not tainted syzkaller #0 PREEMPT(full) [ 262.951126][ T7862] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 262.951135][ T7862] Call Trace: [ 262.951144][ T7862] [ 262.951150][ T7862] dump_stack_lvl+0x100/0x190 [ 262.951173][ T7862] should_fail_ex.cold+0x5/0xa [ 262.951197][ T7862] strncpy_from_user+0x3b/0x2d0 [ 262.951219][ T7862] do_getname+0x78/0x390 [ 262.951240][ T7862] do_sys_openat2+0xc5/0x1e0 [ 262.951257][ T7862] ? __pfx_do_sys_openat2+0x10/0x10 [ 262.951283][ T7862] __x64_sys_openat+0x12d/0x210 [ 262.951301][ T7862] ? __pfx___x64_sys_openat+0x10/0x10 [ 262.951323][ T7862] ? rcu_is_watching+0x12/0xc0 [ 262.951348][ T7862] do_syscall_64+0x10b/0xf80 [ 262.951369][ T7862] ? clear_bhb_loop+0x40/0x90 [ 262.951389][ T7862] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 262.951405][ T7862] RIP: 0033:0x7f110e39c819 [ 262.951419][ T7862] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 262.951434][ T7862] RSP: 002b:00007f110f279028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 262.951451][ T7862] RAX: ffffffffffffffda RBX: 00007f110e616090 RCX: 00007f110e39c819 [ 262.951462][ T7862] RDX: 0000000000000000 RSI: 0000200000000340 RDI: ffffffffffffff9c [ 262.951472][ T7862] RBP: 00007f110f279090 R08: 0000000000000000 R09: 0000000000000000 [ 262.951481][ T7862] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 262.951491][ T7862] R13: 00007f110e616128 R14: 00007f110e616090 R15: 00007ffd58337c08 [ 262.951515][ T7862] [ 263.244458][ T5860] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 263.273057][ T5860] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 263.297918][ T5860] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 263.308038][ T5860] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 263.336774][ T7859] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 263.377398][ T5860] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 263.482883][ T30] audit: type=1400 audit(1776287430.578:642): avc: denied { read } for pid=7871 comm="syz.4.499" path="socket:[16983]" dev="sockfs" ino=16983 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 263.523595][ T6042] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 263.569615][ T7869] could not allocate digest TFM handle rmd256-generic [ 263.621314][ T5860] usb 3-1: USB disconnect, device number 28 [ 263.684662][ T6042] usb 1-1: unable to get BOS descriptor or descriptor too short [ 263.707096][ T6042] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 263.729937][ T6042] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 263.737851][ T7877] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 263.744061][ T6042] usb 1-1: too many endpoints for config 1 interface 1 altsetting 76: 188, using maximum allowed: 30 [ 263.749498][ T7877] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 263.761678][ T6042] usb 1-1: config 1 interface 1 altsetting 76 has 0 endpoint descriptors, different from the interface descriptor's value: 188 [ 263.782577][ T6042] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 263.793138][ T6042] usb 1-1: config 1 interface 1 has no altsetting 0 [ 263.803535][ T6042] usb 1-1: string descriptor 0 read error: -22 [ 263.809866][ T6042] usb 1-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 263.819149][ T6042] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 263.836666][ T6042] usb 1-1: incorrect wMaxPacketSize 0x0 for BADD profile [ 263.898230][ T30] audit: type=1400 audit(1776287430.988:643): avc: denied { create } for pid=7881 comm="syz.3.502" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 263.941059][ T30] audit: type=1400 audit(1776287431.008:644): avc: denied { setopt } for pid=7881 comm="syz.3.502" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 263.943974][ T6042] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 263.992750][ T7882] netlink: 188 bytes leftover after parsing attributes in process `syz.3.502'. [ 264.070936][ T7882] netlink: 12 bytes leftover after parsing attributes in process `syz.3.502'. [ 264.080176][ T7882] netlink: 32 bytes leftover after parsing attributes in process `syz.3.502'. [ 264.262635][ T30] audit: type=1400 audit(1776287431.358:645): avc: denied { listen } for pid=7885 comm="syz.3.503" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 265.817134][ T7899] loop4: detected capacity change from 0 to 7 [ 265.839022][ T7899] ldm_validate_partition_table(): Disk read failed. [ 265.848216][ T7899] Dev loop4: unable to read RDB block 0 [ 266.002605][ T7899] loop4: unable to read partition table [ 266.009163][ T7899] loop4: partition table beyond EOD, truncated [ 266.017067][ T7899] loop_reread_partitions: partition scan of loop4 (Sj %`ր5) failed (rc=-5) [ 266.037861][ T7902] ldm_validate_partition_table(): Disk read failed. [ 266.046683][ T7902] Dev loop4: unable to read RDB block 0 [ 266.054834][ T7902] loop4: unable to read partition table [ 266.062180][ T7902] loop4: partition table beyond EOD, truncated [ 266.172570][ T6042] usb 5-1: new full-speed USB device number 19 using dummy_hcd [ 266.381831][ T5971] usb 1-1: USB disconnect, device number 18 [ 266.484464][ T6042] usb 5-1: config 0 has no interfaces? [ 266.496382][ T6042] usb 5-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 266.515027][ T6042] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 266.532358][ T6042] usb 5-1: Product: syz [ 266.536652][ T6042] usb 5-1: Manufacturer: syz [ 266.546059][ T6042] usb 5-1: SerialNumber: syz [ 266.560309][ T6042] usb 5-1: config 0 descriptor?? [ 266.633223][ T5860] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 266.779716][ T5891] usb 5-1: USB disconnect, device number 19 [ 266.785886][ T29] vhci_hcd vhci_hcd.3: vhci_device speed not set [ 266.813809][ T5860] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 266.836959][ T5860] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 266.840966][ T5971] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 266.852277][ T5860] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 266.888379][ T5860] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 267.039937][ T7907] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 267.178665][ T5971] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 267.202386][ T5971] usb 1-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 267.204635][ T5860] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 267.241255][ T5971] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 267.291476][ T5971] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 267.339858][ T7909] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 267.420092][ T5971] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 267.433776][ T5860] usb 3-1: USB disconnect, device number 29 [ 267.654823][ T5130] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 268.190109][ T7925] netlink: 4 bytes leftover after parsing attributes in process `syz.4.515'. [ 268.279250][ T5971] usb 1-1: USB disconnect, device number 19 [ 268.424206][ T7925] nbd: socks must be embedded in a SOCK_ITEM attr [ 268.748223][ T6139] udevd[6139]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 270.336162][ T7945] netlink: 48 bytes leftover after parsing attributes in process `syz.2.519'. [ 270.599455][ T30] audit: type=1400 audit(1776287437.668:646): avc: denied { connect } for pid=7946 comm="syz.3.520" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 271.382307][ T29] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 271.544665][ T29] usb 3-1: no configurations [ 271.558928][ T29] usb 3-1: can't read configurations, error -22 [ 271.696967][ T5971] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 271.702324][ T29] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 271.810244][ T7963] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 271.821041][ T7963] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 271.863038][ T29] usb 3-1: no configurations [ 271.867766][ T29] usb 3-1: can't read configurations, error -22 [ 271.875994][ T29] usb usb3-port1: attempt power cycle [ 271.892811][ T5971] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 271.905328][ T5971] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 271.942156][ T5971] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 271.968331][ T5971] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 271.997815][ T7960] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 272.047174][ T5971] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 272.222323][ T29] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 272.242743][ T5971] usb 4-1: USB disconnect, device number 25 [ 272.251432][ T29] usb 3-1: no configurations [ 272.257830][ T29] usb 3-1: can't read configurations, error -22 [ 272.409530][ T29] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 272.448591][ T29] usb 3-1: no configurations [ 272.463208][ T29] usb 3-1: can't read configurations, error -22 [ 272.471959][ T29] usb usb3-port1: unable to enumerate USB device [ 273.305994][ T7968] netlink: 268 bytes leftover after parsing attributes in process `syz.3.526'. [ 274.096368][ T7966] netlink: 4 bytes leftover after parsing attributes in process `syz.3.526'. [ 274.227313][ T7972] netlink: 'syz.4.527': attribute type 4 has an invalid length. [ 274.285218][ T5130] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 274.308353][ T7978] loop4: detected capacity change from 0 to 7 [ 274.317475][ T7978] buffer_io_error: 90 callbacks suppressed [ 274.317491][ T7978] Buffer I/O error on dev loop4, logical block 0, async page read [ 274.331510][ T7978] Buffer I/O error on dev loop4, logical block 0, async page read [ 274.343540][ T7978] Buffer I/O error on dev loop4, logical block 0, async page read [ 274.344358][ T7981] FAULT_INJECTION: forcing a failure. [ 274.344358][ T7981] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 274.351484][ T7978] Buffer I/O error on dev loop4, logical block 0, async page read [ 274.378004][ T7983] netlink: 4 bytes leftover after parsing attributes in process `syz.3.528'. [ 274.389718][ T7981] CPU: 0 UID: 0 PID: 7981 Comm: syz.4.531 Not tainted syzkaller #0 PREEMPT(full) [ 274.389743][ T7981] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 274.389755][ T7981] Call Trace: [ 274.389761][ T7981] [ 274.389768][ T7981] dump_stack_lvl+0x100/0x190 [ 274.389793][ T7981] should_fail_ex.cold+0x5/0xa [ 274.389816][ T7981] _copy_from_iter+0x1f4/0x1690 [ 274.389838][ T7981] ? __asan_memset+0x23/0x50 [ 274.389858][ T7981] ? __pfx__copy_from_iter+0x10/0x10 [ 274.389877][ T7981] ? __pfx___alloc_skb+0x10/0x10 [ 274.389904][ T7981] netlink_sendmsg+0x808/0xda0 [ 274.389931][ T7981] ? __pfx_netlink_sendmsg+0x10/0x10 [ 274.389954][ T7981] ? __might_fault+0xa0/0x140 [ 274.389980][ T7981] ____sys_sendmsg+0x9e1/0xb70 [ 274.390003][ T7981] ? __pfx_netlink_sendmsg+0x10/0x10 [ 274.390030][ T7981] ? __pfx_____sys_sendmsg+0x10/0x10 [ 274.390057][ T7981] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 274.390075][ T7981] ? dummy_timer+0x1dba/0x36c0 [ 274.390104][ T7981] ___sys_sendmsg+0x190/0x1e0 [ 274.390135][ T7981] ? __pfx____sys_sendmsg+0x10/0x10 [ 274.390186][ T7981] __sys_sendmsg+0x170/0x220 [ 274.390207][ T7981] ? __pfx___sys_sendmsg+0x10/0x10 [ 274.390235][ T7981] ? rcu_is_watching+0x12/0xc0 [ 274.390261][ T7981] do_syscall_64+0x10b/0xf80 [ 274.390281][ T7981] ? clear_bhb_loop+0x40/0x90 [ 274.390303][ T7981] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 274.390319][ T7981] RIP: 0033:0x7f110e39c819 [ 274.390335][ T7981] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 274.390351][ T7981] RSP: 002b:00007f110f29a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 274.390366][ T7981] RAX: ffffffffffffffda RBX: 00007f110e615fa0 RCX: 00007f110e39c819 [ 274.390376][ T7981] RDX: 0000000000008010 RSI: 0000200000000000 RDI: 0000000000000003 [ 274.390385][ T7981] RBP: 00007f110f29a090 R08: 0000000000000000 R09: 0000000000000000 [ 274.390395][ T7981] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 274.390405][ T7981] R13: 00007f110e616038 R14: 00007f110e615fa0 R15: 00007ffd58337c08 [ 274.390426][ T7981] [ 274.390836][ T6139] Buffer I/O error on dev loop4, logical block 0, async page read [ 274.623454][ T7978] Buffer I/O error on dev loop4, logical block 0, async page read [ 274.654837][ T7978] Buffer I/O error on dev loop4, logical block 0, async page read [ 274.665647][ T6139] Buffer I/O error on dev loop4, logical block 0, async page read [ 274.726693][ T7978] Buffer I/O error on dev loop4, logical block 0, async page read [ 274.735136][ T7978] ldm_validate_partition_table(): Disk read failed. [ 274.742014][ T7978] Buffer I/O error on dev loop4, logical block 0, async page read [ 274.752712][ T7978] Dev loop4: unable to read RDB block 0 [ 274.768620][ T7978] loop4: unable to read partition table [ 274.775099][ T7978] loop4: partition table beyond EOD, truncated [ 274.781577][ T7978] loop_reread_partitions: partition scan of loop4 (Sj %`ր5) failed (rc=-5) [ 275.022501][ T7983] nbd: socks must be embedded in a SOCK_ITEM attr [ 275.054374][ T7985] ldm_validate_partition_table(): Disk read failed. [ 275.076527][ T7985] Dev loop4: unable to read RDB block 0 [ 275.113639][ T7985] loop4: unable to read partition table [ 275.159931][ T7985] loop4: partition table beyond EOD, truncated [ 275.181700][ T30] audit: type=1400 audit(1776287442.268:647): avc: denied { listen } for pid=7989 comm="syz.4.532" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 275.190345][ T7993] bridge_slave_0: left allmulticast mode [ 275.216872][ T7993] bridge_slave_0: left promiscuous mode [ 275.258977][ T7993] bridge0: port 1(bridge_slave_0) entered disabled state [ 275.301173][ T6644] udevd[6644]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 275.323280][ T30] audit: type=1400 audit(1776287442.268:648): avc: denied { accept } for pid=7989 comm="syz.4.532" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 275.332928][ T7997] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 275.388225][ T7993] bridge_slave_1: left allmulticast mode [ 275.425578][ T7993] bridge_slave_1: left promiscuous mode [ 275.441982][ T7993] bridge0: port 2(bridge_slave_1) entered disabled state [ 275.480355][ T7997] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 275.585724][ T7993] bond0: (slave bond_slave_0): Releasing backup interface [ 275.620382][ T30] audit: type=1400 audit(1776287442.708:649): avc: denied { name_connect } for pid=8003 comm="syz.0.535" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 275.683112][ T7993] bond0: (slave bond_slave_1): Releasing backup interface [ 275.711871][ T30] audit: type=1400 audit(1776287442.738:650): avc: denied { getopt } for pid=8003 comm="syz.0.535" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 275.811955][ T7993] team0: Port device team_slave_0 removed [ 275.828288][ T7993] team0: Port device team_slave_1 removed [ 275.840215][ T7993] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 275.850243][ T7993] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 275.871533][ T7993] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 275.881221][ T7993] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 275.891622][ T7993] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 276.760563][ T30] audit: type=1400 audit(1776287443.848:651): avc: denied { setopt } for pid=8021 comm="syz.2.540" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 276.788125][ T8023] loop4: detected capacity change from 0 to 7 [ 276.817618][ T8023] ldm_validate_partition_table(): Disk read failed. [ 276.836091][ T8023] Dev loop4: unable to read RDB block 0 [ 276.837895][ T8022] x_tables: duplicate underflow at hook 3 [ 276.851426][ T8023] loop4: unable to read partition table [ 276.865817][ T8023] loop4: partition table beyond EOD, truncated [ 276.894694][ T8023] loop_reread_partitions: partition scan of loop4 (Sj %`ր5) failed (rc=-5) [ 276.972101][ T8026] ldm_validate_partition_table(): Disk read failed. [ 276.980307][ T8026] Dev loop4: unable to read RDB block 0 [ 276.987866][ T8026] loop4: unable to read partition table [ 276.995099][ T8026] loop4: partition table beyond EOD, truncated [ 277.413963][ T5180] ldm_validate_partition_table(): Disk read failed. [ 277.441202][ T5180] Dev loop4: unable to read RDB block 0 [ 277.463550][ T5180] loop4: unable to read partition table [ 277.484755][ T5180] loop4: partition table beyond EOD, truncated [ 278.659477][ T5860] usb 5-1: new full-speed USB device number 20 using dummy_hcd [ 278.759217][ T8047] FAULT_INJECTION: forcing a failure. [ 278.759217][ T8047] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 278.800204][ T8047] CPU: 1 UID: 0 PID: 8047 Comm: syz.1.546 Not tainted syzkaller #0 PREEMPT(full) [ 278.800231][ T8047] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 278.800241][ T8047] Call Trace: [ 278.800247][ T8047] [ 278.800255][ T8047] dump_stack_lvl+0x100/0x190 [ 278.800280][ T8047] should_fail_ex.cold+0x5/0xa [ 278.800305][ T8047] _copy_from_user+0x2e/0xd0 [ 278.800327][ T8047] bpf_test_init.isra.0+0xaf/0x100 [ 278.800353][ T8047] bpf_prog_test_run_skb+0x490/0x3590 [ 278.800386][ T8047] ? find_held_lock+0x2b/0x80 [ 278.800418][ T8047] ? __fget_files+0x161/0x3d0 [ 278.800449][ T8047] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 278.800477][ T8047] ? fput+0x79/0x100 [ 278.800496][ T8047] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 278.800522][ T8047] __sys_bpf+0x1725/0x4b90 [ 278.800549][ T8047] ? __pfx___sys_bpf+0x10/0x10 [ 278.800570][ T8047] ? proc_fail_nth_write+0x9f/0x220 [ 278.800592][ T8047] ? find_held_lock+0x2b/0x80 [ 278.800620][ T8047] ? find_held_lock+0x2b/0x80 [ 278.800642][ T8047] ? ksys_write+0x190/0x250 [ 278.800664][ T8047] ? ksys_write+0x190/0x250 [ 278.800691][ T8047] ? __mutex_unlock_slowpath+0x15d/0x8a0 [ 278.800712][ T8047] ? vfs_write+0x3/0x1070 [ 278.800732][ T8047] ? __fget_files+0x215/0x3d0 [ 278.800769][ T8047] ? fput+0x79/0x100 [ 278.800785][ T8047] ? ksys_write+0x1ac/0x250 [ 278.800807][ T8047] ? __pfx_ksys_write+0x10/0x10 [ 278.800835][ T8047] __x64_sys_bpf+0x7b/0xc0 [ 278.800857][ T8047] ? lockdep_hardirqs_on+0x78/0x100 [ 278.800876][ T8047] do_syscall_64+0x10b/0xf80 [ 278.800896][ T8047] ? clear_bhb_loop+0x40/0x90 [ 278.800918][ T8047] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 278.800938][ T8047] RIP: 0033:0x7f5a9819c819 [ 278.800953][ T8047] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 278.800969][ T8047] RSP: 002b:00007f5a9901d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 278.800987][ T8047] RAX: ffffffffffffffda RBX: 00007f5a98415fa0 RCX: 00007f5a9819c819 [ 278.800998][ T8047] RDX: 0000000000000050 RSI: 00002000000002c0 RDI: 000000000000000a [ 278.801008][ T8047] RBP: 00007f5a9901d090 R08: 0000000000000000 R09: 0000000000000000 [ 278.801017][ T8047] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 278.801027][ T8047] R13: 00007f5a98416038 R14: 00007f5a98415fa0 R15: 00007ffd7b49f138 [ 278.801051][ T8047] [ 279.220844][ T8051] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 279.231601][ T8051] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 279.316315][ T5860] usb 5-1: config 0 has no interfaces? [ 279.329074][ T5860] usb 5-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 279.338415][ T5860] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 279.347757][ T5860] usb 5-1: Product: syz [ 279.352025][ T5860] usb 5-1: Manufacturer: syz [ 279.357046][ T5860] usb 5-1: SerialNumber: syz [ 279.368369][ T5860] usb 5-1: config 0 descriptor?? [ 279.464294][ T8052] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 279.475552][ T8052] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 279.562925][ T5971] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 279.584814][ T5891] usb 5-1: USB disconnect, device number 20 [ 279.614673][ T8052] gtp0: left promiscuous mode [ 279.619409][ T8052] gtp0: left allmulticast mode [ 279.686074][ T3502] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 279.701940][ T3502] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 279.730897][ T3502] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 279.751465][ T5971] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 279.763858][ T3502] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 279.775638][ T5971] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 279.786145][ T5971] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 279.798092][ T5971] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 279.831108][ T8054] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 279.851611][ T5971] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 280.154316][ T5971] usb 3-1: USB disconnect, device number 34 [ 280.665860][ T30] audit: type=1400 audit(1776287447.328:652): avc: denied { setopt } for pid=8061 comm="syz.3.551" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 280.823296][ T5130] Bluetooth: hci2: Ignoring HCI_Connection_Complete for existing connection [ 280.846191][ T5130] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 280.931305][ T8073] netlink: 4 bytes leftover after parsing attributes in process `syz.1.553'. [ 281.139179][ T8073] nbd: socks must be embedded in a SOCK_ITEM attr [ 281.437077][ T8084] loop4: detected capacity change from 0 to 7 [ 281.459291][ T8084] buffer_io_error: 90 callbacks suppressed [ 281.459310][ T8084] Buffer I/O error on dev loop4, logical block 0, async page read [ 281.487048][ T6139] Buffer I/O error on dev loop4, logical block 0, async page read [ 281.500661][ T8084] Buffer I/O error on dev loop4, logical block 0, async page read [ 281.516562][ T6139] Buffer I/O error on dev loop4, logical block 0, async page read [ 281.528528][ T8084] Buffer I/O error on dev loop4, logical block 0, async page read [ 281.553932][ T6139] Buffer I/O error on dev loop4, logical block 0, async page read [ 281.629785][ T8084] Buffer I/O error on dev loop4, logical block 0, async page read [ 281.648869][ T6139] Buffer I/O error on dev loop4, logical block 0, async page read [ 281.663832][ T6139] Buffer I/O error on dev loop4, logical block 0, async page read [ 281.678345][ T8084] Buffer I/O error on dev loop4, logical block 0, async page read [ 281.908879][ T8084] ldm_validate_partition_table(): Disk read failed. [ 281.923141][ T8084] Dev loop4: unable to read RDB block 0 [ 281.932376][ T8084] loop4: unable to read partition table [ 281.947330][ T8084] loop4: partition table beyond EOD, truncated [ 281.955488][ T8084] loop_reread_partitions: partition scan of loop4 (Sj %`ր5) failed (rc=-5) [ 281.973641][ T8087] ldm_validate_partition_table(): Disk read failed. [ 281.981817][ T8087] Dev loop4: unable to read RDB block 0 [ 281.989028][ T8087] loop4: unable to read partition table [ 282.002915][ T8087] loop4: partition table beyond EOD, truncated [ 282.013719][ T30] audit: type=1400 audit(1776287449.108:653): avc: denied { write } for pid=8085 comm="syz.2.557" name="file0" dev="fuse" ino=64 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 282.018136][ T8086] netlink: 188 bytes leftover after parsing attributes in process `syz.2.557'. [ 282.059044][ T30] audit: type=1400 audit(1776287449.108:654): avc: denied { open } for pid=8085 comm="syz.2.557" path="/104/file0/file0" dev="fuse" ino=64 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 282.105354][ T30] audit: type=1400 audit(1776287449.108:655): avc: denied { ioctl } for pid=8085 comm="syz.2.557" path="/104/file0/file0" dev="fuse" ino=64 ioctlcmd=0x4d01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 282.699228][ T8100] Mount JFS Failure: -22 [ 282.703569][ T8100] jfs_mount failed w/return code = -22 [ 283.852321][ T5971] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 283.929169][ T8113] netlink: 'syz.1.565': attribute type 1 has an invalid length. [ 284.038204][ T8118] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 284.047188][ T8118] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 284.053689][ T5971] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 284.068502][ T5971] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 284.078769][ T5971] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 284.088882][ T5971] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 284.103141][ T8104] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 284.117636][ T5971] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 284.372358][ T5891] usb 5-1: new full-speed USB device number 21 using dummy_hcd [ 284.407093][ T6042] usb 4-1: USB disconnect, device number 26 [ 284.553778][ T5891] usb 5-1: config 0 has no interfaces? [ 284.561205][ T5891] usb 5-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 284.571541][ T5891] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 284.590494][ T5891] usb 5-1: Product: syz [ 284.595738][ T5891] usb 5-1: Manufacturer: syz [ 284.600422][ T5891] usb 5-1: SerialNumber: syz [ 284.607994][ T5891] usb 5-1: config 0 descriptor?? [ 284.792533][ T8131] loop4: detected capacity change from 0 to 7 [ 284.799525][ T8131] ldm_validate_partition_table(): Disk read failed. [ 284.806822][ T8131] Dev loop4: unable to read RDB block 0 [ 284.812807][ T8131] loop4: unable to read partition table [ 284.818671][ T8131] loop4: partition table beyond EOD, truncated [ 284.824902][ T8131] loop_reread_partitions: partition scan of loop4 (Sj %`ր5) failed (rc=-5) [ 284.845002][ T6042] usb 5-1: USB disconnect, device number 21 [ 284.865031][ T8131] ldm_validate_partition_table(): Disk read failed. [ 284.880746][ T8131] Dev loop4: unable to read RDB block 0 [ 284.891595][ T8131] loop4: unable to read partition table [ 284.913770][ T8131] loop4: partition table beyond EOD, truncated [ 284.955266][ T8134] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=2 sclass=netlink_tcpdiag_socket pid=8134 comm=syz.1.570 [ 285.416258][ T5180] ldm_validate_partition_table(): Disk read failed. [ 285.429587][ T5180] Dev loop4: unable to read RDB block 0 [ 285.438911][ T5180] loop4: unable to read partition table [ 285.450768][ T5180] loop4: partition table beyond EOD, truncated [ 285.609589][ T5180] ldm_validate_partition_table(): Disk read failed. [ 285.629678][ T8148] Mount JFS Failure: -22 [ 285.634904][ T5180] Dev loop4: unable to read RDB block 0 [ 285.649611][ T5180] loop4: unable to read partition table [ 285.661979][ T5180] loop4: partition table beyond EOD, truncated [ 285.672105][ T8148] jfs_mount failed w/return code = -22 [ 286.184270][ T8158] Bluetooth: MGMT ver 1.23 [ 286.298809][ T30] audit: type=1400 audit(1776287453.388:656): avc: denied { write } for pid=8157 comm="syz.3.578" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 286.742683][ T5860] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 287.203531][ T5860] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 287.222871][ T5860] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 287.252299][ T5860] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 287.275616][ T5860] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 287.291320][ T8167] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 287.299815][ T8176] netlink: 16 bytes leftover after parsing attributes in process `syz.3.583'. [ 287.315145][ T5860] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 287.348415][ T8176] netlink: 12 bytes leftover after parsing attributes in process `syz.3.583'. [ 287.493017][ T8176] ipvlan2: entered allmulticast mode [ 287.516614][ T8176] syz_tun: entered allmulticast mode [ 287.547445][ T5971] usb 5-1: USB disconnect, device number 22 [ 287.852355][ T5860] usb 1-1: new full-speed USB device number 20 using dummy_hcd [ 287.918453][ T8185] loop4: detected capacity change from 0 to 7 [ 287.928528][ T8185] buffer_io_error: 104 callbacks suppressed [ 287.928545][ T8185] Buffer I/O error on dev loop4, logical block 0, async page read [ 287.945864][ T8185] Buffer I/O error on dev loop4, logical block 0, async page read [ 287.954118][ T8185] Buffer I/O error on dev loop4, logical block 0, async page read [ 287.962113][ T8185] Buffer I/O error on dev loop4, logical block 0, async page read [ 287.971353][ T8185] Buffer I/O error on dev loop4, logical block 0, async page read [ 287.980811][ T8185] Buffer I/O error on dev loop4, logical block 0, async page read [ 287.990608][ T8185] Buffer I/O error on dev loop4, logical block 0, async page read [ 288.000130][ T8185] ldm_validate_partition_table(): Disk read failed. [ 288.008195][ T8185] Buffer I/O error on dev loop4, logical block 0, async page read [ 288.016941][ T8185] Buffer I/O error on dev loop4, logical block 0, async page read [ 288.026429][ T8185] Buffer I/O error on dev loop4, logical block 0, async page read [ 288.026532][ T5860] usb 1-1: config 0 has no interfaces? [ 288.045017][ T5860] usb 1-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 288.055066][ T8185] Dev loop4: unable to read RDB block 0 [ 288.060714][ T5860] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 288.063298][ T8185] loop4: unable to read partition table [ 288.069324][ T5860] usb 1-1: Product: syz [ 288.079128][ T5860] usb 1-1: Manufacturer: syz [ 288.084047][ T5860] usb 1-1: SerialNumber: syz [ 288.096190][ T8185] loop4: partition table beyond EOD, truncated [ 288.114927][ T5860] usb 1-1: config 0 descriptor?? [ 288.129371][ T8185] loop_reread_partitions: partition scan of loop4 (Sj %`ր5) failed (rc=-5) [ 288.158198][ T8186] ldm_validate_partition_table(): Disk read failed. [ 288.169221][ T8186] Dev loop4: unable to read RDB block 0 [ 288.181214][ T8186] loop4: unable to read partition table [ 288.191506][ T8186] loop4: partition table beyond EOD, truncated [ 288.272275][ T5130] Bluetooth: hci2: command 0x0406 tx timeout [ 288.272312][ T5809] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 288.313246][ T5180] ldm_validate_partition_table(): Disk read failed. [ 288.343821][ T5860] usb 1-1: USB disconnect, device number 20 [ 288.363495][ T5180] Dev loop4: unable to read RDB block 0 [ 288.475077][ T5180] loop4: unable to read partition table [ 288.481312][ T5180] loop4: partition table beyond EOD, truncated [ 289.578463][ T8201] block nbd0: not configured, cannot reconfigure [ 289.751420][ T8205] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 289.760597][ T8205] overlayfs: failed to set xattr on upper [ 289.766416][ T8205] overlayfs: ...falling back to redirect_dir=nofollow. [ 289.774391][ T8205] overlayfs: ...falling back to index=off. [ 289.780214][ T8205] overlayfs: ...falling back to uuid=null. [ 290.613269][ T8208] overlayfs: overlay with incompat feature 'volatile' cannot be mounted [ 290.967036][ T8210] A link change request failed with some changes committed already. Interface sit1 may have been left with an inconsistent configuration, please check. [ 291.056477][ T8217] ======================================================= [ 291.056477][ T8217] WARNING: The mand mount option has been deprecated and [ 291.056477][ T8217] and is ignored by this kernel. Remove the mand [ 291.056477][ T8217] option from the mount to silence this warning. [ 291.056477][ T8217] ======================================================= [ 291.102522][ T8217] 9p: Bad value for 'wfdno' [ 291.235779][ T30] audit: type=1400 audit(1776287458.328:657): avc: denied { open } for pid=8215 comm="syz.3.597" path="/dev/ptyqb" dev="devtmpfs" ino=130 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 291.336093][ T8225] netlink: 2 bytes leftover after parsing attributes in process `syz.4.596'. [ 291.347127][ T8225] netlink: 2 bytes leftover after parsing attributes in process `syz.4.596'. [ 291.358084][ T8225] netlink: 2 bytes leftover after parsing attributes in process `syz.4.596'. [ 291.368863][ T8225] netlink: 2 bytes leftover after parsing attributes in process `syz.4.596'. [ 291.379809][ T8225] netlink: 2 bytes leftover after parsing attributes in process `syz.4.596'. [ 291.390765][ T8225] netlink: 2 bytes leftover after parsing attributes in process `syz.4.596'. [ 291.401732][ T8225] netlink: 2 bytes leftover after parsing attributes in process `syz.4.596'. [ 291.413943][ T8225] netlink: 2 bytes leftover after parsing attributes in process `syz.4.596'. [ 291.691215][ T30] audit: type=1400 audit(1776287458.778:658): avc: denied { setopt } for pid=8215 comm="syz.3.597" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 292.020200][ T30] audit: type=1400 audit(1776287459.108:659): avc: denied { ioctl } for pid=8231 comm="syz.4.600" path="socket:[19616]" dev="sockfs" ino=19616 ioctlcmd=0x890b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 292.160993][ T30] audit: type=1400 audit(1776287459.248:660): avc: denied { listen } for pid=8237 comm="syz.2.601" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 292.274961][ T30] audit: type=1400 audit(1776287459.278:661): avc: denied { accept } for pid=8237 comm="syz.2.601" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 292.302946][ T30] audit: type=1400 audit(1776287459.288:662): avc: denied { create } for pid=8237 comm="syz.2.601" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 292.452440][ T30] audit: type=1400 audit(1776287459.288:663): avc: denied { ioctl } for pid=8237 comm="syz.2.601" path="socket:[19245]" dev="sockfs" ino=19245 ioctlcmd=0x89e2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 293.304959][ T8262] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 293.310958][ T8262] syzkaller1: Linktype set failed because interface is up [ 293.798822][ T8274] __nla_validate_parse: 3 callbacks suppressed [ 293.798854][ T8274] netlink: 2 bytes leftover after parsing attributes in process `syz.0.610'. [ 293.815984][ T8274] netlink: 2 bytes leftover after parsing attributes in process `syz.0.610'. [ 293.826732][ T8274] netlink: 2 bytes leftover after parsing attributes in process `syz.0.610'. [ 293.837748][ T8274] netlink: 2 bytes leftover after parsing attributes in process `syz.0.610'. [ 293.848434][ T8274] netlink: 2 bytes leftover after parsing attributes in process `syz.0.610'. [ 293.859168][ T8274] netlink: 2 bytes leftover after parsing attributes in process `syz.0.610'. [ 293.871033][ T8274] netlink: 2 bytes leftover after parsing attributes in process `syz.0.610'. [ 293.882101][ T8274] netlink: 2 bytes leftover after parsing attributes in process `syz.0.610'. [ 293.893024][ T8274] netlink: 2 bytes leftover after parsing attributes in process `syz.0.610'. [ 293.903815][ T8274] netlink: 2 bytes leftover after parsing attributes in process `syz.0.610'. [ 294.751678][ T8283] FAULT_INJECTION: forcing a failure. [ 294.751678][ T8283] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 294.782294][ T8283] CPU: 0 UID: 0 PID: 8283 Comm: syz.1.613 Not tainted syzkaller #0 PREEMPT(full) [ 294.782321][ T8283] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 294.782331][ T8283] Call Trace: [ 294.782337][ T8283] [ 294.782344][ T8283] dump_stack_lvl+0x100/0x190 [ 294.782372][ T8283] should_fail_ex.cold+0x5/0xa [ 294.782397][ T8283] _copy_from_user+0x2e/0xd0 [ 294.782417][ T8283] move_addr_to_kernel+0x65/0x170 [ 294.782444][ T8283] __sys_connect+0xb5/0x170 [ 294.782462][ T8283] ? __pfx___sys_connect+0x10/0x10 [ 294.782479][ T8283] ? __fget_files+0x21f/0x3d0 [ 294.782514][ T8283] ? __pfx_ksys_write+0x10/0x10 [ 294.782541][ T8283] __x64_sys_connect+0x72/0xb0 [ 294.782558][ T8283] ? lockdep_hardirqs_on+0x78/0x100 [ 294.782579][ T8283] do_syscall_64+0x10b/0xf80 [ 294.782599][ T8283] ? clear_bhb_loop+0x40/0x90 [ 294.782620][ T8283] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 294.782638][ T8283] RIP: 0033:0x7f5a9819c819 [ 294.782652][ T8283] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 294.782673][ T8283] RSP: 002b:00007f5a9901d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 294.782690][ T8283] RAX: ffffffffffffffda RBX: 00007f5a98415fa0 RCX: 00007f5a9819c819 [ 294.782701][ T8283] RDX: 000000000000002e RSI: 0000200000000000 RDI: 0000000000000007 [ 294.782710][ T8283] RBP: 00007f5a9901d090 R08: 0000000000000000 R09: 0000000000000000 [ 294.782719][ T8283] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 294.782729][ T8283] R13: 00007f5a98416038 R14: 00007f5a98415fa0 R15: 00007ffd7b49f138 [ 294.782751][ T8283] [ 295.110029][ T8253] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 295.138416][ T8289] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 295.251681][ T8289] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 295.365831][ T5809] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 295.526569][ T8297] nbd: socks must be embedded in a SOCK_ITEM attr [ 295.922258][ T5971] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 296.073396][ T8311] FAULT_INJECTION: forcing a failure. [ 296.073396][ T8311] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 296.094638][ T8311] CPU: 0 UID: 0 PID: 8311 Comm: syz.0.622 Not tainted syzkaller #0 PREEMPT(full) [ 296.094675][ T8311] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 296.094685][ T8311] Call Trace: [ 296.094690][ T8311] [ 296.094696][ T8311] dump_stack_lvl+0x100/0x190 [ 296.094725][ T8311] should_fail_ex.cold+0x5/0xa [ 296.094748][ T8311] _copy_from_user+0x2e/0xd0 [ 296.094767][ T8311] bpf_test_init.isra.0+0xaf/0x100 [ 296.094794][ T8311] bpf_prog_test_run_skb+0x490/0x3590 [ 296.094824][ T8311] ? find_held_lock+0x2b/0x80 [ 296.094850][ T8311] ? __fget_files+0x161/0x3d0 [ 296.094880][ T8311] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 296.094908][ T8311] ? fput+0x79/0x100 [ 296.094927][ T8311] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 296.094951][ T8311] __sys_bpf+0x1725/0x4b90 [ 296.094974][ T8311] ? __pfx___sys_bpf+0x10/0x10 [ 296.094993][ T8311] ? proc_fail_nth_write+0x9f/0x220 [ 296.095014][ T8311] ? find_held_lock+0x2b/0x80 [ 296.095040][ T8311] ? find_held_lock+0x2b/0x80 [ 296.095062][ T8311] ? ksys_write+0x190/0x250 [ 296.095083][ T8311] ? ksys_write+0x190/0x250 [ 296.095108][ T8311] ? __mutex_unlock_slowpath+0x15d/0x8a0 [ 296.095129][ T8311] ? vfs_write+0x3/0x1070 [ 296.095150][ T8311] ? __fget_files+0x215/0x3d0 [ 296.095186][ T8311] ? fput+0x79/0x100 [ 296.095203][ T8311] ? ksys_write+0x1ac/0x250 [ 296.095225][ T8311] ? __pfx_ksys_write+0x10/0x10 [ 296.095252][ T8311] __x64_sys_bpf+0x7b/0xc0 [ 296.095273][ T8311] ? lockdep_hardirqs_on+0x78/0x100 [ 296.095294][ T8311] do_syscall_64+0x10b/0xf80 [ 296.095313][ T8311] ? clear_bhb_loop+0x40/0x90 [ 296.095335][ T8311] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 296.095352][ T8311] RIP: 0033:0x7f576239c819 [ 296.095368][ T8311] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 296.095383][ T8311] RSP: 002b:00007f5763314028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 296.095399][ T8311] RAX: ffffffffffffffda RBX: 00007f5762615fa0 RCX: 00007f576239c819 [ 296.095408][ T8311] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 296.095417][ T8311] RBP: 00007f5763314090 R08: 0000000000000000 R09: 0000000000000000 [ 296.095428][ T8311] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 296.095437][ T8311] R13: 00007f5762616038 R14: 00007f5762615fa0 R15: 00007ffe69dbba58 [ 296.095459][ T8311] [ 296.096755][ T5971] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 296.097128][ T6139] udevd[6139]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 296.109480][ T5971] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 296.524587][ T5971] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 296.552534][ T5860] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 296.553268][ T5971] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 296.591902][ T30] audit: type=1400 audit(1776287463.678:664): avc: denied { getopt } for pid=8318 comm="syz.1.624" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 296.626013][ T8301] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 296.636085][ T5971] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 296.662622][ T8320] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 296.726002][ T8320] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 296.765551][ T5860] usb 1-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 296.776984][ T5860] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 296.797267][ T5860] usb 1-1: Product: syz [ 296.804830][ T5860] usb 1-1: Manufacturer: syz [ 296.812911][ T5860] usb 1-1: SerialNumber: syz [ 296.839896][ T5860] usb 1-1: config 0 descriptor?? [ 296.859174][ T5971] usb 5-1: USB disconnect, device number 23 [ 296.862892][ T5860] i2c-tiny-usb 1-1:0.0: version 6d.cc found at bus 001 address 021 [ 297.132814][ T30] audit: type=1400 audit(1776287464.218:665): avc: denied { getopt } for pid=8318 comm="syz.1.624" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 297.402286][ T6042] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 297.467773][ T5860] i2c i2c-1: failure reading functionality [ 297.480371][ T5860] i2c i2c-1: connected i2c-tiny-usb device [ 297.491986][ T5860] usb 1-1: USB disconnect, device number 21 [ 297.564538][ T6042] usb 3-1: config 1 has an invalid interface number: 7 but max is 0 [ 297.572695][ T6042] usb 3-1: config 1 has no interface number 0 [ 297.578860][ T6042] usb 3-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 297.590586][ T6042] usb 3-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 297.601928][ T6042] usb 3-1: config 1 interface 7 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 297.615141][ T6042] usb 3-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 297.624778][ T6042] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 297.633015][ T6042] usb 3-1: Product: syz [ 297.637432][ T6042] usb 3-1: Manufacturer: syz [ 297.642057][ T6042] usb 3-1: SerialNumber: syz [ 297.653067][ T8324] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 297.877499][ T8324] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 298.600497][ T6042] usb 3-1: Incompatible driver and firmware versions [ 298.703185][ T5971] usb 3-1: USB disconnect, device number 35 [ 299.016632][ T8354] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 299.038707][ T8354] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 299.063466][ T8352] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 299.073094][ T30] audit: type=1400 audit(1776287466.148:666): avc: denied { ioctl } for pid=8351 comm="syz.4.634" path="socket:[20618]" dev="sockfs" ino=20618 ioctlcmd=0x940a scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 299.104420][ T8352] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 299.242305][ T5971] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 299.543511][ T8361] Invalid argument reading file caps for ./file0 [ 299.849822][ T5971] usb 5-1: config 1 has an invalid descriptor of length 220, skipping remainder of the config [ 299.873501][ T5971] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 299.889294][ T5971] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 117, setting to 64 [ 299.916410][ T5971] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 299.930343][ T5971] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 299.944735][ T5971] usb 5-1: Product: syz [ 299.949025][ T5971] usb 5-1: Manufacturer: syz [ 299.954186][ T5971] usb 5-1: SerialNumber: syz [ 299.967430][ T5971] cdc_ncm 5-1:1.0: skipping garbage [ 299.976070][ T5971] cdc_ncm 5-1:1.0: CDC Union missing and no IAD found [ 299.985047][ T5971] cdc_ncm 5-1:1.0: bind() failure [ 300.070450][ T8363] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 300.084460][ T8363] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 300.221655][ T5860] usb 5-1: USB disconnect, device number 24 [ 300.605334][ T8379] overlayfs: failed to resolve './bus': -2 [ 300.989940][ T5891] usb 4-1: new full-speed USB device number 27 using dummy_hcd [ 301.306237][ T8383] __nla_validate_parse: 11 callbacks suppressed [ 301.306269][ T8383] netlink: 2 bytes leftover after parsing attributes in process `syz.4.643'. [ 301.323627][ T8383] netlink: 2 bytes leftover after parsing attributes in process `syz.4.643'. [ 301.334431][ T8383] netlink: 2 bytes leftover after parsing attributes in process `syz.4.643'. [ 301.346374][ T8383] netlink: 2 bytes leftover after parsing attributes in process `syz.4.643'. [ 301.357450][ T8383] netlink: 2 bytes leftover after parsing attributes in process `syz.4.643'. [ 301.368312][ T8383] netlink: 2 bytes leftover after parsing attributes in process `syz.4.643'. [ 301.379168][ T8383] netlink: 2 bytes leftover after parsing attributes in process `syz.4.643'. [ 301.390028][ T8383] netlink: 2 bytes leftover after parsing attributes in process `syz.4.643'. [ 301.417818][ T8383] netlink: 2 bytes leftover after parsing attributes in process `syz.4.643'. [ 301.428747][ T8383] netlink: 2 bytes leftover after parsing attributes in process `syz.4.643'. [ 301.616807][ T5891] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 301.626248][ T5891] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 301.637400][ T5891] usb 4-1: Product: syz [ 301.641724][ T5891] usb 4-1: Manufacturer: syz [ 301.646722][ T5891] usb 4-1: SerialNumber: syz [ 301.654663][ T5891] usb 4-1: config 0 descriptor?? [ 301.870823][ T5891] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 301.934334][ T30] audit: type=1400 audit(1776287468.978:667): avc: denied { connect } for pid=8387 comm="syz.0.646" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 302.087824][ T30] audit: type=1400 audit(1776287469.148:668): avc: denied { create } for pid=8392 comm="syz.1.647" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 302.141783][ T30] audit: type=1400 audit(1776287469.228:669): avc: denied { ioctl } for pid=8392 comm="syz.1.647" path="socket:[20697]" dev="sockfs" ino=20697 ioctlcmd=0x61f2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 302.303822][ T5881] usb 1-1: new low-speed USB device number 22 using dummy_hcd [ 302.485267][ T5881] usb 1-1: unable to get BOS descriptor or descriptor too short [ 302.529268][ T5881] usb 1-1: config 194 has an invalid interface number: 4 but max is 0 [ 302.566829][ T5881] usb 1-1: config 194 has no interface number 0 [ 302.606697][ T5881] usb 1-1: config 194 interface 4 has no altsetting 0 [ 302.690391][ T5881] usb 1-1: string descriptor 0 read error: -22 [ 302.705000][ T5881] usb 1-1: New USB device found, idVendor=16c0, idProduct=05df, bcdDevice=b0.85 [ 302.743830][ T5881] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 302.814624][ T30] audit: type=1400 audit(1776287469.908:670): avc: denied { create } for pid=8410 comm="syz.1.650" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_nflog_socket permissive=1 [ 303.131254][ T8420] x_tables: duplicate underflow at hook 3 [ 303.761733][ T5891] usb 4-1: dvb_usb_v2: will use the device's hardware PID filter (table count: 32) [ 303.777633][ T5971] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 303.810300][ T5891] dvbdev: DVB: registering new adapter (TerraTec NOXON DAB Stick) [ 303.836989][ T5891] usb 4-1: media controller created [ 303.870483][ T5891] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 303.967927][ T5891] i2c i2c-1: Added multiplexed i2c bus 2 [ 303.975381][ T5891] rtl2832 1-0010: Realtek RTL2832 successfully attached [ 303.987202][ T5971] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 304.007781][ T5891] usb 4-1: DVB: registering adapter 1 frontend 0 (Realtek RTL2832 (DVB-T))... [ 304.018074][ T5971] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 304.032435][ T5971] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 304.048032][ T5891] dvbdev: dvb_create_media_entity: media entity 'Realtek RTL2832 (DVB-T)' registered. [ 304.058357][ T5971] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 304.096209][ T8428] raw-gadget.3 gadget.4: fail, usb_ep_enable returned -22 [ 304.120453][ T5971] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 304.358614][ T5891] DVB: Unable to find symbol r820t_attach() [ 304.375162][ T5971] usb 5-1: USB disconnect, device number 25 [ 304.784712][ T5891] usb 4-1: USB disconnect, device number 27 [ 305.152327][ T5891] usb 4-1: new full-speed USB device number 28 using dummy_hcd [ 305.353874][ T5891] usb 4-1: config 0 has an invalid interface number: 12 but max is 0 [ 305.396883][ T5891] usb 4-1: config 0 has no interface number 0 [ 305.404417][ T5891] usb 4-1: config 0 interface 12 altsetting 2 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 305.415705][ T5891] usb 4-1: config 0 interface 12 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 305.426151][ T5891] usb 4-1: config 0 interface 12 has no altsetting 0 [ 305.435467][ T5891] usb 4-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 305.445676][ T5891] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 305.458012][ T5891] usb 4-1: Product: syz [ 305.462504][ T5891] usb 4-1: Manufacturer: syz [ 305.467326][ T5891] usb 4-1: SerialNumber: syz [ 305.476777][ T5891] usb 4-1: config 0 descriptor?? [ 305.482690][ T8439] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 305.498153][ T5891] f81534 4-1:0.12: unsupported endpoint max packet size [ 306.011835][ T5881] usb 1-1: USB disconnect, device number 22 [ 306.637395][ T8455] __nla_validate_parse: 1 callbacks suppressed [ 306.637426][ T8455] netlink: 5992 bytes leftover after parsing attributes in process `syz.0.662'. [ 308.704244][ T8443] netlink: 2 bytes leftover after parsing attributes in process `syz.4.658'. [ 308.714815][ T8443] netlink: 2 bytes leftover after parsing attributes in process `syz.4.658'. [ 308.725057][ T8443] netlink: 2 bytes leftover after parsing attributes in process `syz.4.658'. [ 308.734359][ T8443] netlink: 2 bytes leftover after parsing attributes in process `syz.4.658'. [ 308.743701][ T8443] netlink: 2 bytes leftover after parsing attributes in process `syz.4.658'. [ 308.752941][ T8443] netlink: 2 bytes leftover after parsing attributes in process `syz.4.658'. [ 308.762087][ T8443] netlink: 2 bytes leftover after parsing attributes in process `syz.4.658'. [ 308.771305][ T8443] netlink: 2 bytes leftover after parsing attributes in process `syz.4.658'. [ 308.780577][ T8443] netlink: 2 bytes leftover after parsing attributes in process `syz.4.658'. [ 308.915687][ T5891] usb 4-1: USB disconnect, device number 28 [ 309.370357][ T8462] fuse: Invalid rootmode [ 309.409435][ T8470] x_tables: duplicate underflow at hook 3 [ 310.092993][ T5860] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 310.266029][ T5860] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 310.313189][ T8499] IPv6: NLM_F_CREATE should be specified when creating new route [ 310.321035][ T5860] usb 1-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 310.337571][ T5860] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 310.346950][ T5860] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 310.375181][ T8483] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 310.439870][ T5860] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 310.705088][ T5860] usb 1-1: USB disconnect, device number 23 [ 310.894527][ T5809] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 311.073875][ T8513] nbd: socks must be embedded in a SOCK_ITEM attr [ 311.102953][ T5799] block nbd64: NBD_DISCONNECT [ 311.280377][ T6139] udevd[6139]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 311.698545][ T8541] fuse: Invalid rootmode [ 311.723995][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 311.739361][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 311.952965][ T30] audit: type=1400 audit(1776287479.048:671): avc: denied { write } for pid=8542 comm="syz.1.686" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 312.252070][ T30] audit: type=1400 audit(1776287479.338:672): avc: denied { write } for pid=8550 comm="syz.3.689" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 312.275526][ T8551] random: crng reseeded on system resumption [ 312.305756][ T30] audit: type=1400 audit(1776287479.368:673): avc: denied { open } for pid=8550 comm="syz.3.689" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 312.368697][ T30] audit: type=1400 audit(1776287479.388:674): avc: denied { map } for pid=8550 comm="syz.3.689" path="socket:[21004]" dev="sockfs" ino=21004 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 312.443974][ T30] audit: type=1400 audit(1776287479.388:675): avc: denied { ioctl } for pid=8550 comm="syz.3.689" path="/dev/snapshot" dev="devtmpfs" ino=92 ioctlcmd=0x330d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 313.794792][ T5809] Bluetooth: hci4: command 0x0406 tx timeout [ 314.372900][ T5891] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 314.604239][ T5891] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 314.615796][ T5891] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 314.632996][ T5891] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 314.659693][ T5891] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 314.774660][ T8582] overlayfs: failed to resolve './bus': -2 [ 315.090748][ T8569] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 315.115386][ T5891] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 315.419947][ T6042] usb 3-1: USB disconnect, device number 36 [ 315.445405][ T30] audit: type=1400 audit(1776287482.538:676): avc: denied { setopt } for pid=8595 comm="syz.0.704" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 315.465981][ T5963] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 315.572305][ T5881] usb 5-1: new full-speed USB device number 26 using dummy_hcd [ 315.588708][ T30] audit: type=1400 audit(1776287482.678:677): avc: denied { setopt } for pid=8602 comm="syz.0.705" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 315.645061][ T5963] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 315.680076][ T5963] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 315.702279][ T5963] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 315.711561][ T5963] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 315.732387][ T8588] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 315.751987][ T5963] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 315.785459][ T5881] usb 5-1: config 0 has no interfaces? [ 315.798623][ T5881] usb 5-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 315.835799][ T5881] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 315.861415][ T5881] usb 5-1: Product: syz [ 315.873657][ T5881] usb 5-1: Manufacturer: syz [ 315.886301][ T5881] usb 5-1: SerialNumber: syz [ 315.911451][ T5881] usb 5-1: config 0 descriptor?? [ 316.005580][ T5963] usb 4-1: USB disconnect, device number 29 [ 316.164527][ T5881] usb 5-1: USB disconnect, device number 26 [ 316.540883][ T8622] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 316.550043][ T8622] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 316.558111][ T5963] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 316.713425][ T5963] usb 3-1: Using ep0 maxpacket: 32 [ 316.727663][ T5963] usb 3-1: unable to get BOS descriptor or descriptor too short [ 316.737699][ T5963] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 316.750046][ T5963] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 316.762690][ T5963] usb 3-1: New USB device found, idVendor=0d8c, idProduct=000c, bcdDevice= 0.40 [ 316.772422][ T5963] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 316.781655][ T5963] usb 3-1: Product: syz [ 316.786089][ T5963] usb 3-1: Manufacturer: syz [ 316.792151][ T5963] usb 3-1: SerialNumber: syz [ 317.009965][ T8628] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=27417 sclass=netlink_xfrm_socket pid=8628 comm=syz.4.712 [ 317.064963][ T5963] usb 3-1: 3:0: cannot get min/max values for control 2 (id 3) [ 317.088854][ T5963] usb 3-1: applying playback min mute quirk [ 317.104169][ T5963] usb 3-1: 3:0: cannot get min/max values for control 5 (id 3) [ 317.126786][ T5963] usb 3-1: 3:0: cannot get min/max values for control 8 (id 3) [ 317.165506][ T5963] usb 3-1: 3:0: failed to get current value for ch 0 (-71) [ 317.214482][ T5963] usb 3-1: 3:0: cannot get min/max values for control 5 (id 3) [ 317.293067][ T5963] usb 3-1: USB disconnect, device number 37 [ 317.467937][ T8638] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 317.495824][ T8638] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 317.518971][ T6139] udevd[6139]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 317.736420][ T8645] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 318.000290][ T8648] netlink: del zone limit has 8 unknown bytes [ 318.388507][ T8652] __nla_validate_parse: 3 callbacks suppressed [ 318.388527][ T8652] netlink: 40 bytes leftover after parsing attributes in process `syz.1.723'. [ 318.492263][ T6042] usb 4-1: new full-speed USB device number 30 using dummy_hcd [ 318.664061][ T6042] usb 4-1: unable to get BOS descriptor or descriptor too short [ 318.677911][ T6042] usb 4-1: not running at top speed; connect to a high speed hub [ 318.697964][ T6042] usb 4-1: config 2 has an invalid interface number: 212 but max is 1 [ 318.707900][ T5130] Bluetooth: hci2: Ignoring HCI_Connection_Complete for existing connection [ 318.719435][ T6042] usb 4-1: config 2 has an invalid interface number: 226 but max is 1 [ 318.728406][ T6042] usb 4-1: config 2 has no interface number 0 [ 318.734815][ T6042] usb 4-1: config 2 has no interface number 1 [ 318.741411][ T6042] usb 4-1: config 2 interface 212 altsetting 9 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 318.765115][ T6042] usb 4-1: config 2 interface 226 altsetting 0 has a duplicate endpoint with address 0x1, skipping [ 318.782863][ T6042] usb 4-1: config 2 interface 226 altsetting 0 endpoint 0x85 has invalid maxpacket 37745, setting to 64 [ 318.799310][ T6042] usb 4-1: config 2 interface 226 altsetting 0 endpoint 0x7 has an invalid bInterval 0, changing to 10 [ 318.813390][ T6042] usb 4-1: config 2 interface 226 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 318.826795][ T8663] netlink: 4 bytes leftover after parsing attributes in process `syz.1.727'. [ 318.835782][ T6042] usb 4-1: config 2 interface 226 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 318.854203][ T6042] usb 4-1: config 2 interface 212 has no altsetting 0 [ 318.866286][ T6042] usb 4-1: New USB device found, idVendor=0738, idProduct=4540, bcdDevice=c6.ce [ 318.875790][ T6042] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 318.885407][ T6042] usb 4-1: Product: syz [ 318.889759][ T6042] usb 4-1: Manufacturer: syz [ 318.896012][ T6042] usb 4-1: SerialNumber: syz [ 318.964058][ T8663] nbd: socks must be embedded in a SOCK_ITEM attr [ 319.005038][ T8668] xt_hashlimit: size too large, truncated to 1048576 [ 319.104921][ T30] audit: type=1400 audit(1776287486.198:678): avc: denied { setopt } for pid=8664 comm="syz.2.728" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 319.154951][ T6042] input: Mad Catz Beat Pad as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:2.226/input/input13 [ 319.202705][ T6042] usb 4-1: USB disconnect, device number 30 [ 319.208735][ C1] xpad 4-1:2.226: xpad_irq_in - usb_submit_urb failed with result -19 [ 319.249880][ T6644] udevd[6644]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 319.529158][ T8677] netlink: 2 bytes leftover after parsing attributes in process `syz.0.729'. [ 319.540306][ T8677] netlink: 2 bytes leftover after parsing attributes in process `syz.0.729'. [ 319.551107][ T8677] netlink: 2 bytes leftover after parsing attributes in process `syz.0.729'. [ 319.562017][ T8677] netlink: 2 bytes leftover after parsing attributes in process `syz.0.729'. [ 319.574033][ T8677] netlink: 2 bytes leftover after parsing attributes in process `syz.0.729'. [ 319.585153][ T8677] netlink: 2 bytes leftover after parsing attributes in process `syz.0.729'. [ 319.596151][ T8677] netlink: 2 bytes leftover after parsing attributes in process `syz.0.729'. [ 319.607044][ T8677] netlink: 2 bytes leftover after parsing attributes in process `syz.0.729'. [ 321.051060][ T8687] overlayfs: failed to resolve './bus': -2 [ 321.479452][ T8692] x_tables: duplicate underflow at hook 3 [ 321.622255][ C0] ------------[ cut here ]------------ [ 321.628932][ C0] ODEBUG: activate active (active state 0) object: ffff888055b82c18 object type: rcu_head hint: 0x0 [ 321.639777][ C0] WARNING: lib/debugobjects.c:629 at debug_print_object+0x18e/0x2a0, CPU#0: swapper/0/0 [ 321.649555][ C0] Modules linked in: [ 321.654775][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G L syzkaller #0 PREEMPT(full) [ 321.665289][ C0] Tainted: [L]=SOFTLOCKUP [ 321.669611][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 321.679698][ C0] RIP: 0010:debug_print_object+0x19b/0x2a0 [ 321.685517][ C0] Code: b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 4f 48 8d 3d 52 bc e4 0b 41 56 48 8b 14 dd a0 60 1b 8c 4c 89 e6 <67> 48 0f b9 3a 58 83 05 8c 7a da 0b 01 48 83 c4 18 5b 5d 41 5c 41 [ 321.705126][ C0] RSP: 0018:ffffc90000007ad8 EFLAGS: 00010246 [ 321.711174][ C0] RAX: dffffc0000000000 RBX: 0000000000000003 RCX: 0000000000000000 [ 321.719165][ C0] RDX: ffffffff8c1b5fe0 RSI: ffffffff8c1b5b40 RDI: ffffffff90e51080 [ 321.727135][ C0] RBP: 0000000000000001 R08: ffff888055b82c18 R09: ffffffff8bb14b80 [ 321.732305][ T6042] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 321.735124][ C0] R10: 0000000000000001 R11: 0000000000000000 R12: ffffffff8c1b5b40 [ 321.750636][ C0] R13: ffffffff8bb14bc0 R14: 0000000000000000 R15: ffffc90000007b98 [ 321.758614][ C0] FS: 0000000000000000(0000) GS:ffff88812430d000(0000) knlGS:0000000000000000 [ 321.767536][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 321.774115][ C0] CR2: 000020000057f000 CR3: 000000005428b000 CR4: 00000000003526f0 [ 321.782066][ C0] DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000083 [ 321.790031][ C0] DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 321.797997][ C0] Call Trace: [ 321.801254][ C0] [ 321.804092][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 321.809896][ C0] debug_object_activate+0x2ad/0x490 [ 321.815177][ C0] ? __pfx_debug_object_activate+0x10/0x10 [ 321.820967][ C0] ? __lock_acquire+0x4a5/0x2630 [ 321.825926][ C0] ? __pfx_radix_tree_node_rcu_free+0x10/0x10 [ 321.831995][ C0] __call_rcu_common.constprop.0+0x35/0x9b0 [ 321.837890][ C0] delete_node+0x200/0x8f0 [ 321.842308][ C0] ? __kfree_rcu_sheaf+0x195/0x720 [ 321.847401][ C0] ? __kfree_rcu_sheaf+0x195/0x720 [ 321.852514][ C0] __radix_tree_delete+0x193/0x3d0 [ 321.857605][ C0] radix_tree_delete_item+0xea/0x230 [ 321.862888][ C0] ? kvfree_call_rcu+0x1b6/0x4f0 [ 321.867802][ C0] ? __pfx_radix_tree_delete_item+0x10/0x10 [ 321.873716][ C0] ? rcu_core+0x59d/0x10d0 [ 321.878116][ C0] ? afs_put_vlserverlist+0x6b/0x230 [ 321.883400][ C0] ? afs_unuse_cell+0x1aa/0x2e0 [ 321.888230][ C0] ? rcu_core+0x59d/0x10d0 [ 321.892636][ C0] afs_cell_destroy+0x1db/0x2d0 [ 321.897465][ C0] rcu_core+0x5a2/0x10d0 [ 321.901687][ C0] ? __pfx_rcu_core+0x10/0x10 [ 321.906354][ C0] ? rcu_is_watching+0x12/0xc0 [ 321.911097][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 321.916895][ C0] handle_softirqs+0x1ea/0xa00 [ 321.921640][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 321.926923][ C0] ? _raw_spin_unlock+0x28/0x50 [ 321.931766][ C0] ? __hrtimer_rearm_deferred+0x9b/0x740 [ 321.937396][ C0] __irq_exit_rcu+0x162/0x210 [ 321.942057][ C0] irq_exit_rcu+0x9/0x30 [ 321.946315][ C0] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 321.951931][ C0] [ 321.954850][ C0] [ 321.957758][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 321.963798][ C0] RIP: 0010:tick_nohz_idle_enter+0x1a1/0x270 [ 321.969776][ C0] Code: b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 cd 00 00 00 48 83 0b 01 48 89 df e8 c6 e3 ff ff e8 e1 4d 17 00 fb 5b <5d> 41 5c e9 07 ab 9f 09 e8 a2 58 0f 00 65 8b 2d 27 d3 17 12 31 ff [ 321.989394][ C0] RSP: 0018:ffffffff8e407e00 EFLAGS: 00000206 [ 321.995458][ C0] RAX: 00000000016af4a3 RBX: ffffffff8e4955c0 RCX: 0000000000000000 [ 322.003422][ C0] RDX: 0000000000000000 RSI: ffffffff8df37a35 RDI: ffffffff8c1b4ee0 [ 322.011381][ C0] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 [ 322.019351][ C0] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 [ 322.027325][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 000000000008b000 [ 322.035299][ C0] do_idle+0x80/0x590 [ 322.039271][ C0] ? __pfx_do_idle+0x10/0x10 [ 322.043854][ C0] ? finish_task_switch.isra.0+0x152/0x1010 [ 322.049753][ C0] cpu_startup_entry+0x4f/0x60 [ 322.054513][ C0] rest_init+0x251/0x260 [ 322.058751][ C0] ? __pfx_x86_late_time_init+0x10/0x10 [ 322.064292][ C0] start_kernel+0x484/0x490 [ 322.068779][ C0] x86_64_start_reservations+0x24/0x30 [ 322.074236][ C0] x86_64_start_kernel+0x12b/0x130 [ 322.079330][ C0] common_startup_64+0x13e/0x148 [ 322.084266][ C0] [ 322.087261][ C0] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 322.094516][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G L syzkaller #0 PREEMPT(full) [ 322.104998][ C0] Tainted: [L]=SOFTLOCKUP [ 322.109293][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 322.119321][ C0] Call Trace: [ 322.122581][ C0] [ 322.125405][ C0] dump_stack_lvl+0x100/0x190 [ 322.130063][ C0] vpanic+0x552/0x970 [ 322.134023][ C0] ? __pfx_vpanic+0x10/0x10 [ 322.138515][ C0] panic+0xd1/0xe0 [ 322.142215][ C0] ? __pfx_panic+0x10/0x10 [ 322.146627][ C0] ? check_panic_on_warn+0x1f/0x90 [ 322.151729][ C0] check_panic_on_warn.cold+0x19/0x34 [ 322.157077][ C0] ? debug_print_object+0x18e/0x2a0 [ 322.162265][ C0] __warn.cold+0x191/0x328 [ 322.166670][ C0] __report_bug+0x296/0x3d0 [ 322.171156][ C0] ? debug_print_object+0x18e/0x2a0 [ 322.176344][ C0] ? __pfx___report_bug+0x10/0x10 [ 322.181342][ C0] ? do_raw_spin_lock+0x128/0x260 [ 322.186346][ C0] ? trace_contention_end.constprop.0+0x141/0x1a0 [ 322.192741][ C0] ? __pv_queued_spin_lock_slowpath+0x284/0xc00 [ 322.198972][ C0] report_bug_entry+0xe1/0x290 [ 322.203715][ C0] ? debug_print_object+0x19b/0x2a0 [ 322.208895][ C0] handle_bug+0x1cd/0x2a0 [ 322.213206][ C0] exc_invalid_op+0x17/0x50 [ 322.217688][ C0] asm_exc_invalid_op+0x1a/0x20 [ 322.222512][ C0] RIP: 0010:debug_print_object+0x19b/0x2a0 [ 322.228303][ C0] Code: b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 4f 48 8d 3d 52 bc e4 0b 41 56 48 8b 14 dd a0 60 1b 8c 4c 89 e6 <67> 48 0f b9 3a 58 83 05 8c 7a da 0b 01 48 83 c4 18 5b 5d 41 5c 41 [ 322.247900][ C0] RSP: 0018:ffffc90000007ad8 EFLAGS: 00010246 [ 322.253948][ C0] RAX: dffffc0000000000 RBX: 0000000000000003 RCX: 0000000000000000 [ 322.261905][ C0] RDX: ffffffff8c1b5fe0 RSI: ffffffff8c1b5b40 RDI: ffffffff90e51080 [ 322.269864][ C0] RBP: 0000000000000001 R08: ffff888055b82c18 R09: ffffffff8bb14b80 [ 322.277829][ C0] R10: 0000000000000001 R11: 0000000000000000 R12: ffffffff8c1b5b40 [ 322.285774][ C0] R13: ffffffff8bb14bc0 R14: 0000000000000000 R15: ffffc90000007b98 [ 322.293743][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 322.299533][ C0] debug_object_activate+0x2ad/0x490 [ 322.304803][ C0] ? __pfx_debug_object_activate+0x10/0x10 [ 322.310589][ C0] ? __lock_acquire+0x4a5/0x2630 [ 322.315564][ C0] ? __pfx_radix_tree_node_rcu_free+0x10/0x10 [ 322.321618][ C0] __call_rcu_common.constprop.0+0x35/0x9b0 [ 322.327500][ C0] delete_node+0x200/0x8f0 [ 322.331902][ C0] ? __kfree_rcu_sheaf+0x195/0x720 [ 322.336996][ C0] ? __kfree_rcu_sheaf+0x195/0x720 [ 322.342099][ C0] __radix_tree_delete+0x193/0x3d0 [ 322.347190][ C0] radix_tree_delete_item+0xea/0x230 [ 322.352456][ C0] ? kvfree_call_rcu+0x1b6/0x4f0 [ 322.357381][ C0] ? __pfx_radix_tree_delete_item+0x10/0x10 [ 322.363293][ C0] ? rcu_core+0x59d/0x10d0 [ 322.367701][ C0] ? afs_put_vlserverlist+0x6b/0x230 [ 322.372987][ C0] ? afs_unuse_cell+0x1aa/0x2e0 [ 322.377832][ C0] ? rcu_core+0x59d/0x10d0 [ 322.382242][ C0] afs_cell_destroy+0x1db/0x2d0 [ 322.387091][ C0] rcu_core+0x5a2/0x10d0 [ 322.391320][ C0] ? __pfx_rcu_core+0x10/0x10 [ 322.395988][ C0] ? rcu_is_watching+0x12/0xc0 [ 322.400733][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 322.406534][ C0] handle_softirqs+0x1ea/0xa00 [ 322.411283][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 322.416549][ C0] ? _raw_spin_unlock+0x28/0x50 [ 322.421375][ C0] ? __hrtimer_rearm_deferred+0x9b/0x740 [ 322.426990][ C0] __irq_exit_rcu+0x162/0x210 [ 322.431657][ C0] irq_exit_rcu+0x9/0x30 [ 322.435894][ C0] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 322.441509][ C0] [ 322.444425][ C0] [ 322.447358][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 322.453364][ C0] RIP: 0010:tick_nohz_idle_enter+0x1a1/0x270 [ 322.459336][ C0] Code: b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 cd 00 00 00 48 83 0b 01 48 89 df e8 c6 e3 ff ff e8 e1 4d 17 00 fb 5b <5d> 41 5c e9 07 ab 9f 09 e8 a2 58 0f 00 65 8b 2d 27 d3 17 12 31 ff [ 322.478943][ C0] RSP: 0018:ffffffff8e407e00 EFLAGS: 00000206 [ 322.484994][ C0] RAX: 00000000016af4a3 RBX: ffffffff8e4955c0 RCX: 0000000000000000 [ 322.492945][ C0] RDX: 0000000000000000 RSI: ffffffff8df37a35 RDI: ffffffff8c1b4ee0 [ 322.500894][ C0] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 [ 322.508840][ C0] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 [ 322.516794][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 000000000008b000 [ 322.524754][ C0] do_idle+0x80/0x590 [ 322.528722][ C0] ? __pfx_do_idle+0x10/0x10 [ 322.533291][ C0] ? finish_task_switch.isra.0+0x152/0x1010 [ 322.539258][ C0] cpu_startup_entry+0x4f/0x60 [ 322.544030][ C0] rest_init+0x251/0x260 [ 322.548267][ C0] ? __pfx_x86_late_time_init+0x10/0x10 [ 322.553808][ C0] start_kernel+0x484/0x490 [ 322.558311][ C0] x86_64_start_reservations+0x24/0x30 [ 322.563754][ C0] x86_64_start_kernel+0x12b/0x130 [ 322.568849][ C0] common_startup_64+0x13e/0x148 [ 322.573777][ C0] [ 322.577090][ C0] Kernel Offset: disabled [ 322.581413][ C0] Rebooting in 86400 seconds..