last executing test programs: 2m40.856470643s ago: executing program 0 (id=389): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='yeah', 0x4) sendmmsg$inet(r0, &(0x7f0000001240)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000000140)="91f8a9849519def28691bbc4173c3d6f357d0272b7319130feaab952ac4703cad04be68907e50e997fc26e4c91ea4feb931647fc5393de25000000000000000000", 0x41}, {&(0x7f0000000e80)="44900000000056ee66c372f3105eb186dd8062fad2d5b5bfb0ba06f274a8d026bd209da8ffa6a26e3b3f8075704a9d0ef9aff7f1e7db24609f02d34e76992c9df9fe6888c6c9a4825c6223be6ac54536025af1dea54e527c68b0ff250261953f2da79a78104c2d9e", 0x68}, {&(0x7f00000003c0)="641a6a2b863c0dd898013a3f97a834ebb75a925ab48c", 0x16}, {&(0x7f00000001c0)="985e44efeabe", 0x6}], 0x4}}, {{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000b80)="f77d2b5dd5f7d74f0748cf3d2cf218d644566a14103b1c7dd35fd2951bd022f10f2dc7f4ce0d8ac5f4abaca4b97b706153756913b7dd48248b5bfb10460019248bf238743fa2aeb5bef21ce832db670920dc5e911ef2ad63e849901d1001129dbacbfd4924d7545517fd18b5d2", 0x6d}], 0x1}}], 0x2, 0x2090) 2m40.792615019s ago: executing program 0 (id=390): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000"], 0x7c}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010000000000000000004400000008000300", @ANYRES32=r2, @ANYBLOB="08002600851600000a00180000e70300000000001c005a8018000180140003"], 0x4c}}, 0x0) 2m40.709848s ago: executing program 0 (id=391): r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x40) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000040)=0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$setregs(0xd, r2, 0x0, &(0x7f00000003c0)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab675cb3976ee8100e2878c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b350a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44cc4c7b3664e29fb") ptrace$getregset(0x4205, r2, 0x2, &(0x7f0000000080)={0x0, 0x6c}) setpgid(r1, r2) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0)=0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r4) sendmsg$NFC_CMD_DEV_UP(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x1c, r5, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r3}]}, 0x1c}}, 0x0) write$nci(0xffffffffffffffff, &(0x7f0000000380)=ANY=[@ANYBLOB="610503000100200018027f103d0bf5ad5d08f832c1a504d10207030300ab2f082bce29a6a55e306aca507c54d8e52edcfcfb3df2bd2e80d0db7e6614c2faf186d8fafaf4971e6094c46f50be87fc3d86644a"], 0x19) 2m40.504056823s ago: executing program 0 (id=395): r0 = syz_open_dev$usbfs(&(0x7f0000000480), 0x5, 0x141341) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x8, 0x8031, 0xffffffffffffffff, 0xee04c000) mount$9p_fd(0x0, 0x0, &(0x7f0000000080), 0x80, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x9471) r1 = userfaultfd(0x1) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000080)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa07, &(0x7f0000000280)={{&(0x7f0000ffc000/0x2000)=nil, 0x2000}}) mprotect(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x300000a) ioctl$USBDEVFS_RELEASE_PORT(r0, 0x80045519, &(0x7f0000000180)=0x1) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f00000000c0)={0x0, 0x747, 0x3, 0x4, 0xfb, 0x8, 0x101}, 0xc) connect$bt_l2cap(r2, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) sendmmsg(r2, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000100)="34a9de6bd7bf6861118f95f1f8e5e8f18261e600e62712f1627bfff46fb8cff18515f5c6855b6de7e907186049b489cb4deb83ce69f22808fdab041f50311c50e1ee8ccede125d11e0682c", 0x4b}, {&(0x7f0000000180)="80526345ed25dcb502741b2277fe7b926fbb8e90d1eb2cc8734a6b456f03667269d32f9a3adf67022fadbf79ef333b3d705a9d6e0b9b863ab227e12b99e2558932ee7485f12048def3e745aa0d77336a6aaa4cfa352760a83694eecfa5fe1e33e92d9a33c7455b4019bbd312add6a8cf4d2f58e302bdc8f0956c5bca26b40e0000000000000000", 0x87}, {&(0x7f0000000780)="c037fbb324ac1cb0c52deeb75abc2304c2975e61d6ad33966a27618ef99f65b5607d3884168a33c3e7948985f354b612851e6d3e11fca8f7e5f98e3be9612bf228d401a4e955c3a23479eebf2c5a96c388b6aee7342cd74d940bb0fd7d04dfb1a3e09ba2e8f618320de3c868b081138e83ede914dd9e5c58bef2f8db0e4f6a6faf1209c2eaf0fd790e0dceb539fcb9f94ebc51ad9727c8754d4eb41182d63e76dda6a2578457ae5940752c254c1497ccf08dcbd2544268c081175cbe890480dda065b7cf1b559276832fbab4b28d8f1b4c50c1b49d4f6303f2aa3b5ad3c54c299790e1dd1c8a6756718cd1f631c733a39c5126fa879888508bd666686cd41060ffa21b89d5e4c086d8744289e99b3628b05267423de88026486cf678e73e96835ee1edd3757ed5c53818b520a5eec4e714e803d1d92376b6bbe1f9ec0bd40d5613eb5e0971104236b27627b9162a88996560beabf8ac148d625049267ddbb7c9bb00b51008887a29b150981d731da43f8fec201b1d33064ee499aae0b43587bbe56b4536471de991029c5ecf9a77b17cff450302a7d3e17fdaf50eb4dc4cee1c754eb1c06567194d8b42153a6defbd287ef506eb0b0e23fb44c4449618751c9477f4ac1c03709249af0ee53bd1e616", 0x1cf}], 0x3, &(0x7f0000000300)}}], 0x2, 0x20004840) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x64200, 0x0) 2m40.350589788s ago: executing program 0 (id=396): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000580)=ANY=[@ANYBLOB="4c0300002e000100000000000000000004001980380311803403cf802f0346"], 0x34c}], 0x1, 0x0, 0x0, 0x84}, 0x40000) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000080)={'\x00', 0x3, 0x9, 0x1, 0x9, 0x5, 0x0}) sendmsg$ETHTOOL_MSG_EEE_GET(0xffffffffffffffff, &(0x7f00000013c0)={0x0, 0x0, &(0x7f0000001380)={0x0}, 0x1, 0x0, 0x0, 0x4000}, 0x40448a0) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000002480)=[{{0x0, 0x0, &(0x7f0000001780)=[{&(0x7f0000000340)}, {0x0}, {&(0x7f00000005c0)}], 0x3}}], 0x1, 0x0) r2 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FILTER(r2, 0x65, 0x1, 0x0, 0x0) getsockopt$CAN_RAW_FILTER(r2, 0x65, 0x1, 0x0, &(0x7f0000000100)) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000f80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000b40)=ANY=[@ANYBLOB="14000000000000002900000034000000040000000000000014000000000000002900000034000000fdffffff0000000000010000000000002900000004000000041c000000000000fe72f4a4a3142ee1e12b9826287997a6b33d89f3d60da1641d9fe3896c3c1b6c130ef4f01be8f5836d417874540898619050b14420ab124b11de36afb16ef4fc00f3f4e4fa0e647cd1b07b068d3894180b6aa7527a4a8252f6836a0d67a7782c675a838ea989e567e4774de1f52d188e0b0888c5801409e12e5f0b6bdcf72f2ec7008a15fa88b025e0ad0738000000010c7a0180050000000000000009000000000000000400000000000000060000000000000000040000000000000b0000000000000005020a7e00010005020bf4c910fc0200000000000000000000780e000000000000000000140000000000000029000000340000000000000000000000700100000000000029000000360000005e2a000000000000ff4150d650847249ad288702ebd0d654b985e8908defb7ec6c5ff115c58e128b9e3a21c34b45ef9de99984e143ca7c3509a971b2ec429ee1edc0bb903fe94b32c28f70000100000100010800000000000000000708000000030000ff0f07100000000002070600ff7f00000000000008c6c8a110995d439fbfac9716a99c357bcb2d59a850490739734f6b321d19b3754df39cc2dc26cf263cbebbddb9a7f17b6771f74c46623f9e38bd23e6f0a2fd3a9a017f66738394aca44d1a9f0b35d9df0a964360ab0900a5e6fcac1cd41c91c97f6826ff706c41edc4e00205bbb53218ed58a1122d993b55a1b9a870a17e7869e3fc704b388202add651f628963a90fea5d8196d5e0373fd13584ae57b4f1c03d4f67005cdb5938591d5ea712014e358ea0808807873fd7290c6d4f033de64c7e86ab3030700008000000000000001082bdb86d1ce6a20c2000000000020000000000000002900000037000000730000000000000000010000000000001400000000000000290000000b0000000000000200000000180000000000000029000000390000000000000000000000380000000000000029000000390000003a04027000000000ff010000000000000000000000000001ff020000000000000000000000000001"], 0x340}}, {{&(0x7f0000000300)={0xa, 0x4e20, 0x80000000, @empty, 0x7}, 0x1c, &(0x7f0000000f00)=[{&(0x7f0000000500)='q', 0x1}, {&(0x7f0000000540)}, {&(0x7f0000000600)="58b327f21946add0e0c31b173119ac7b4ceda64bbfbc8159462a8686f4303aeee1d7c9b54c4bd660fe192582950eb09a8bae632fb4e7313e3828773c09fec9b010373ca7be0ccc91233fffcfe03f287a50f2b4a970278097aed06e61a0f2da47b0bd02fcb45bf3", 0x67}, {0x0}, {0x0}], 0x5}}], 0x2, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f00000001c0)={{0xeeee8000, 0x4, 0x3, 0xf1, 0x5, 0xfa, 0xd4, 0xd4, 0x0, 0x4, 0x7, 0x4f}, {0x5000, 0x2, 0xd, 0x9, 0x8, 0x3, 0x6, 0xb, 0x5, 0xf, 0x3, 0xc0}, {0xffff1000, 0xeeef0000, 0xb, 0x1, 0x2, 0x7, 0x4, 0x1, 0x81, 0x0, 0x6, 0x5}, {0xeeee8000, 0x2000, 0x8, 0xf8, 0x3, 0x46, 0x2, 0xd, 0x6, 0x0, 0x8, 0x1}, {0x100000, 0x4000, 0x9, 0x9, 0x3, 0x9, 0xd, 0x6, 0x5, 0x9, 0xc, 0x4b}, {0x6000, 0x0, 0x4, 0x6, 0x3, 0x7d, 0x1, 0xff, 0x4, 0x90, 0x1, 0xfc}, {0x8000000, 0x4000, 0x0, 0x9d, 0x3, 0x0, 0x0, 0xb, 0x5, 0x7, 0x9, 0xf8}, {0xf7f63004, 0x8000000, 0xf, 0x5, 0x28, 0x3, 0xa, 0x9, 0x54, 0x1, 0x2, 0x7}, {0xdddd1000, 0x5}, {0x4, 0x9}, 0x40030000, 0x0, 0x80a0000, 0x300, 0x1, 0xa901, 0xe6e70c00, [0x3, 0x401, 0x7, 0xc5]}) ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000740)={"373ab6e870bf64ef25ad87deef94c3b7350df627ea76a6efbd6c33a19e5dde0b3718dac0c2b8e833beb9e0347000fc7332c43a3128856f23df4628fb1e54b1745094c19bc88c190192f58dda884b3296f7cd6373842bff61047e0697c9af6e9f62b88fd21621b527902efdae6efd3516c7e5a36f4aaa12cd1b3ac0686db46783f45fe6aa2515ab6996b4807b0d9575a9061a775ef515a40b97c34035e8e412b9200000001000000062a07ab97f50ff5deb8a5978611317016887694245b363252230bbe17ed0f591f935d8e4ae7563eeff2fdfad8a775f0a4b15f63f5c4851df9aef747ace240cec55ce1659c08d38714245835e15291c4973ade3b2006d8870a1d739eb8e7a284e23f660b2061e31a70627be4acb16ecbe8a4edde1c5397c761a2fe0690f5d580ebf35b8640441ddf47d1f67a5e2d892f14a4f88412ce3cc8ec4d0580729c8638502410837253d6ac316ee9c6a24eb5d83463ff9bdf81f31c12b04adec97fe1377d2f29067e5f6f48cc123f2c4c02afe60d224c7d974a63c1aa9b110d2187f18de3753b57c630eab26238e8201501a007da99f1d07f76c4da113859ab55792049a15c5d83051f41ae951912eb81154f2398a729b6d6c51d6850bddcd4b35b24996e4ec707d1a744dff58ea5030fcd6b46a468ac029f86be30c7c3d5708e3871fed2e63b9c3ad265350e87e9fc44696eadeecc1ff67e30b64be27f480180d26218d031380149bcc31bd712063e9c09ed5329a530800000025d79eb9d4491d82d2b7a3d7d0cf9286396fcb8c2ccf1655b3ba420c36c3fb88d788308e947cc15e0957a98a843911c954c2a2feccd60d0000da8330cd1de951bcd767cf211a241c882b8d5e608fc0e796afead2a7b05018b4ae6c034c4c4997868343a5d064838dd0aca0d21b429665a0a1b4fd17cd34e711cee01d2348dc5871cca7ab4e4924f6f4bc29e7dbfae6788549e600000000271cd7ddfabd45803a6d1145734a82b2b9a6a87c8e118629840a027fd3f8e5a6a5dccee1a480d6cd0402a64db2263b1a9de61848b1eb31b51189f4caa2fdf0c3a38275386522137fe573ec27693a337c324952480c9ae476a694010aa22095c6d8bfceb5e024cbc21d6c1d1b17fae63dc627a948c4eca7dfa3f8a5e628531472e00ed28f2d2b7fcf03b5ba1975fcc010482a08c7800b3c87587a9fea37402ffafcc9cabc16a123164765d10dafe323ce33f197af8a3cf57332dbbee3f263a16cb565b61690b5804341630437ad2277be4ff82d1aa32c15b0cf99c88c7bca0ecf47a3be490bf6079f19acdf9a71f636fff612167c849b5c149cb32d8dd98d2aa8bb0606a1214fc1f0da04476cd8c3c056ec88eefca4d331ecbd5416c356466202cb97ddfc320b7594d5ab2e9102d549ffa72300"}) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r6 = accept4(r5, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r9 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r8, &(0x7f0000000240)=ANY=[@ANYBLOB="000086dd0000120000000000000063b9e7a900280008fc0200000000ff020000000000000000f6e8000000013303000000000000c905fe8800"], 0x5e) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) fcntl$setownex(r0, 0xf, &(0x7f0000000100)={0x1, r1}) 2m39.368053096s ago: executing program 0 (id=402): r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000380), 0x149842, 0x0) (async) r1 = syz_open_dev$cec(&(0x7f0000000940), 0x0, 0x0) ioctl$CEC_ADAP_G_CAPS(r1, 0xc04c6100, &(0x7f0000000980)) (async) write$dsp(r0, &(0x7f0000000040)="02", 0xfffffda3) (async) mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x8012, r0, 0x0) (async, rerun: 32) close(r0) (rerun: 32) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) r3 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_RECV_OWN_MSGS(r3, 0x65, 0x4, &(0x7f0000000040), &(0x7f0000000080)=0x4) (async) sendmsg$netlink(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)={0x10, 0x2e, 0x1, 0x0, 0x25dddbfb}, 0x10}], 0x1, 0x0, 0x0, 0x41}, 0x0) 2m34.581513491s ago: executing program 1 (id=422): r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x40) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000040)) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f00000000c0)=0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r4) sendmsg$NFC_CMD_DEV_UP(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x1c, r5, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r3}]}, 0x1c}}, 0x0) write$nci(r2, &(0x7f0000000380)=ANY=[@ANYBLOB="610503000100200018027f103d0bf5ad5d08f832c1a504d10207030300ab2f082bce29a6a55e306aca507c54d8e52edcfcfb3df2bd2e80d0db7e6614c2faf186d8fafaf4971e6094c46f50be87fc3d86644a"], 0x19) 2m34.362661774s ago: executing program 1 (id=423): modify_ldt$read_default(0x2, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)={0x90, 0x0, 0xe81, {0x6, 0x3, 0x3, 0x4, 0xc, 0x0, {0x1006, 0xfffffffffffffffd, 0x80000000000, 0x80000000004, 0x400000000000, 0x4, 0x5, 0x9, 0x1, 0x1000, 0x7, 0x0, 0x0, 0x0, 0x5}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$sock_SIOCGIFCONF(r1, 0x8912, &(0x7f0000001640)) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000dc0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GET(r2, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000540)=ANY=[], 0x50}, 0x1, 0x0, 0x0, 0x24040011}, 0x0) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x800000, 0x0) r3 = syz_clone(0x4111, 0x0, 0x88, 0x0, 0x0, 0x0) write$P9_RWSTAT(r0, &(0x7f0000000200)={0x7, 0x7f, 0x1}, 0x7) syz_open_procfs(r3, &(0x7f0000000040)='attr/keycreate\x00') syz_usb_connect$uac2(0x3, 0x9f, &(0x7f0000000100)=ANY=[@ANYBLOB="12011001000000201e04003040000102030109028d000301058009080b0002010b20000904000000010120000924010300011500040c2403060203030455ff000409040100000102200009040101010102200010240106100304000000fa070000000608240201e6040a060905010920000580d40825010130044e01090402000001022000090402010101022000090582090000091b3a082501050007fbfbe15642d47f02192a257fd5c77261b9fe826e5907b0601774a640056aa8890a425a015997c7097eb9d012b3cf652b7919e690c1e7eb7adc0b57add6"], 0x0) 2m33.659919712s ago: executing program 1 (id=424): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000013000a20000000000a01030000000000000000010000000900010073797a310000000054000000030a010200000000000000000100ffff0900030073797a320000000028000480080002400000000008000140000000051400030076657468315f746f5f687372000000000900010073797a31000000004c000000050a05000000000000000000010020000c00024000000000000000010900010073797a3100000000200004801400030076657468315f6d616376746107000000080001"], 0xe8}}, 0x0) 2m33.598807896s ago: executing program 1 (id=425): r0 = socket(0x1e, 0x5, 0x0) recvmsg$unix(r0, &(0x7f0000000300)={&(0x7f0000000100)=@abs, 0x6e, &(0x7f0000000640)=[{&(0x7f0000000240)=""/140, 0x8c}, {&(0x7f0000000180)=""/55, 0x37}, {&(0x7f0000000380)=""/247, 0xf7}, {&(0x7f0000000480)=""/196, 0xc4}, {&(0x7f0000000580)=""/141, 0x8d}], 0x5, &(0x7f00000001c0)=[@cred={{0x1c}}], 0x20}, 0x8001) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r3, 0x4068aea3, &(0x7f00000001c0)={0xbe, 0x0, 0x1}) ioctl$KVM_GET_MSRS_cpu(r3, 0xc008ae88, &(0x7f0000000100)={0x1, 0x0, [{0x4b564d02}]}) ioctl$SIOCGETVIFCNT(r0, 0x89e0, &(0x7f0000000080)) r4 = syz_open_dev$dri(&(0x7f0000000080), 0x1ff, 0x0) r5 = memfd_create(&(0x7f0000000000)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa', 0x2) fcntl$addseals(r5, 0x409, 0xc) write(r5, &(0x7f00000002c0)='[', 0x1) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000200)={0x28f, 0xfff, 0xa}) sendmsg$NL80211_CMD_SET_BEACON(0xffffffffffffffff, &(0x7f0000000c00)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000740)={0x448, 0x0, 0x300, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_IE={0x21a, 0x2a, [@supported_rates={0x1, 0x2, [{0x9}, {0x16, 0x1}]}, @perr={0x84, 0xc2, {0xe, 0xc, [{{}, @device_b, 0x1, @void, 0x26}, {{0x0, 0x1}, @broadcast, 0x6, @value, 0x3}, {{}, @broadcast, 0x0, @void, 0x10}, {{0x0, 0x1}, @device_b, 0x1, @value, 0xc}, {{}, @device_a, 0x1, @void, 0xc}, {{0x0, 0x1}, @broadcast, 0x8, @value, 0x15}, {{0x0, 0x1}, @device_a, 0x9, @value=@device_b, 0x10}, {{}, @device_a, 0x7d77, @void, 0xc}, {{0x0, 0x1}, @device_b, 0xc, @value, 0x1b}, {{}, @device_a, 0x283, @void, 0x26}, {{}, @broadcast, 0x7f, @void, 0xc}, {{0x0, 0x1}, @device_b, 0x8000000, @value=@device_b, 0x2b}]}}, @ext_channel_switch={0x3c, 0x4, {0x0, 0x3, 0x30, 0x5}}, @dsss={0x3, 0x1, 0xb4}, @ssid={0x0, 0x6, @default_ap_ssid}, @cf={0x4, 0x6, {0x7f, 0x9, 0x8, 0xb}}, @sec_chan_ofs={0x3e, 0x1, 0x1}, @mesh_id={0x72, 0x6}, @random_vendor={0xdd, 0xde, "867182f3f4b245da0dc8cee6206ac24f2c01f0170fcb3f3258925fcd0400b2c918cc8e4ec0f17fa43be8538d516ff7257d2a97e892f8c08d1745f6e3d2c12b4b4dce63ce99ff386d767fb265d0f0b5660e45c10da9470bb22ad09b25a54dc81162772ba44fa33c392e498b72476237b142d1a87b7e6ff93d5ac531b2127871e9b99430fe66cc64d4e753303566002ecccef240b5decc8b0aec5dbbade3097c72e6eeda04b134b994f7d1a459aba91147fefd521ad8c1fa9cc98018cf5bba7f03bf2ccd1f659235b4ad6af3ae90642c587f04e6c7b5f312bc71030c461e3e"}, @perr={0x84, 0x48, {0x9, 0x4, [{{0x0, 0x1}, @device_b, 0x8000, @value=@device_b, 0x31}, {{0x0, 0x1}, @device_a, 0x1, @value, 0x26}, {{0x0, 0x1}, @device_a, 0x1ff, @value, 0x21}, {{}, @broadcast, 0x19, @void, 0x19}]}}]}, @NL80211_ATTR_IE_PROBE_RESP={0x10b, 0x7f, [@fast_bss_trans={0x37, 0x7d, {0x7, 0x3, "ada174422f408038905c69ea8d1889e5", "0bb328626773d3869e13caa2ab20e621c26ca6a24a040b289b35fb285c8d9743", "45eff55630922be5ea025f885a8d2cb31454d2a865b2343dab36c135ba5b208c", [{0x2, 0x15, "bd2b7919f2e5d5440d57d3f78255d79d9b5130bc8f"}, {0x2, 0x3, "e16cec"}, {0x2, 0xd, "34652cc7c201f7769f9077d990"}]}}, @gcr_ga={0xbd, 0x6, @device_b}, @preq={0x82, 0x57, {{0x0, 0x0, 0x0, 0x0, 0x1}, 0x40, 0x8, 0x6af, @broadcast, 0x0, @value=@broadcast, 0x5, 0x1, 0x5, [{{}, @device_b, 0x6}, {{0x1, 0x0, 0x1}, @device_a, 0x4}, {{0x0, 0x0, 0x1}, @device_b, 0x6}, {{0x1, 0x0, 0x1}, @device_a, 0x40}, {{0x1, 0x0, 0x1}, @device_a, 0x6}]}}, @prep={0x83, 0x25, {{0x0, 0x1}, 0x9, 0x5, @device_a, 0x10, @value=@broadcast, 0xcca, 0x9}}]}, @NL80211_ATTR_FTM_RESPONDER={0x10c, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_ENABLED={0x4}, @NL80211_FTM_RESP_ATTR_ENABLED={0x4}, @NL80211_FTM_RESP_ATTR_LCI={0xfb, 0x2, "84909888f420c4e096c3909c1bf3c482cb02ed87c239f0876fdef2f89dd01ee900127dd40c339351fdda8376dd63c5e9dab31567c974abe6abf6ce585b4dfa6a26c8952a2d8f66cb5df3c1ac3f90ef9ee0d7576c27cb2d5f3b5e78658d462db14c38783490bd2d4cb585e2066cc1a566c9f9c7d2b89122c4bb16e37aee9031d6fd414d2dfdc36d88c8cbbc0e9200e906ac53f36c216bbd40a61d27508150bde74b4b2872e445f2150a3d54be112b2e31975449f2665a8519d755f5b64bc01593229922d8aabe2afeede56e592a2ba43461598d7deac3ad42961b9def26aa83aaeeac8ac3579b55328e1d3e6d4724486a41eaf4ab226d82"}, @NL80211_FTM_RESP_ATTR_ENABLED={0x4}]}]}, 0x448}, 0x1, 0x0, 0x0, 0x4000}, 0x24000000) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f0000000700)={0x0, &(0x7f0000000000)=[0x0], 0x0, 0x0, 0x0, 0x1}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000480), 0x0, &(0x7f0000000040)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x141091, 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) chdir(&(0x7f0000000100)='./file0\x00') mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000a00)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) ioctl$DRM_IOCTL_MODE_CURSOR(r4, 0xc01c64a3, &(0x7f0000000340)={0x3, r6, 0xfffffffa, 0x4, 0xb, 0x1fd, 0x1}) r7 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000101c1b021b00000000000109022400010000400009040000010300400009210000000122050009058103"], 0x0) syz_usb_control_io(r7, 0x0, 0x0) syz_usb_control_io$hid(r7, &(0x7f0000000980)={0x24, 0x0, 0x0, &(0x7f0000000ac0)=ANY=[@ANYBLOB="002210"], 0x0}, 0x0) syz_usb_control_io$hid(r7, 0x0, &(0x7f0000000400)={0x2c, &(0x7f0000000200)={0x0, 0x5, 0x6, "cb857874ddba"}, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CURSOR(r4, 0xc01c64a3, &(0x7f0000001880)={0x3, r6, 0xfff, 0x3ff, 0x2, 0x944}) socket$nl_xfrm(0x10, 0x3, 0x6) 2m31.680302608s ago: executing program 1 (id=432): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r1, &(0x7f0000003700)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000002840)={0x4c, r2, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6, 0x66, 0x88c7}, @NL80211_ATTR_FRAME={0x1c, 0x33, @data_frame={@msdu=@type10={{}, {}, @from_mac, @device_b, @broadcast}}}]}, 0x4c}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r0, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x50, r2, 0x4, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x8, 0x1b}}}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6, 0x66, 0x86dd}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}]}, 0x50}, 0x1, 0x0, 0x0, 0x4040}, 0x40000) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="05000000000000e2ffff0500000008000300", @ANYRES32=r6], 0x24}}, 0x0) 2m31.340243211s ago: executing program 1 (id=436): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0a00001bbbbbbbbbbbbbaa"], 0x9e) 2m31.129270041s ago: executing program 32 (id=436): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="0a00001bbbbbbbbbbbbbaa"], 0x9e) 2m24.327430416s ago: executing program 33 (id=402): r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000380), 0x149842, 0x0) (async) r1 = syz_open_dev$cec(&(0x7f0000000940), 0x0, 0x0) ioctl$CEC_ADAP_G_CAPS(r1, 0xc04c6100, &(0x7f0000000980)) (async) write$dsp(r0, &(0x7f0000000040)="02", 0xfffffda3) (async) mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x8012, r0, 0x0) (async, rerun: 32) close(r0) (rerun: 32) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) r3 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_RECV_OWN_MSGS(r3, 0x65, 0x4, &(0x7f0000000040), &(0x7f0000000080)=0x4) (async) sendmsg$netlink(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)={0x10, 0x2e, 0x1, 0x0, 0x25dddbfb}, 0x10}], 0x1, 0x0, 0x0, 0x41}, 0x0) 5.716937702s ago: executing program 3 (id=1272): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, 0x0, 0x0) bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x2}}, 0x10) bind$tipc(r0, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42, 0x20000003}}}, 0x10) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000040)={'lo\x00', 0x0}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r2, 0x201, 0x400000, 0x0, {{}, {}, {0x8, 0x11, 0x4}}}, 0x24}, 0x1, 0x2100000000000000}, 0x0) 5.530436701s ago: executing program 3 (id=1274): r0 = socket$inet(0xa, 0x801, 0x84) r1 = socket$inet(0xa, 0x801, 0x84) listen(r1, 0x8) setresuid(0xee01, 0xee00, 0x0) listen(r0, 0xfffffffd) r2 = socket$inet(0xa, 0x801, 0x84) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r3, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) r4 = socket$inet(0xa, 0x801, 0x84) listen(r4, 0x8) listen(r2, 0x1) r5 = socket$netlink(0x10, 0x3, 0x4) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r6, 0x3) syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r5) writev(r5, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000060000000", 0x40b}], 0x1) 5.499097654s ago: executing program 3 (id=1275): socket$kcm(0xa, 0x3, 0x87) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) pselect6(0x40, &(0x7f0000000040)={0x7, 0x100000000, 0x100000000000000, 0x1, 0xfdb1, 0xc, 0x288100000400000b, 0x7}, 0x0, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003088700fe88a43de1a400000000000000007d01ff020000000000030000000000000001"], 0xfdef) 4.487882198s ago: executing program 3 (id=1286): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0xfffd, &(0x7f0000000000)=[{&(0x7f0000000580)=ANY=[@ANYBLOB="4c0300002e0001000000000000000000040019803803118034"], 0x34c}], 0x1, 0x0, 0x0, 0x84}, 0x40000) 4.096026529s ago: executing program 5 (id=1291): r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x80001, 0x0) r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000100)={0x1, "5660359c3245d1c42317afad7d48ed51000000000000000100", 0xffffffffffffffff}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000000)={0x5, "340b7832ceefd131b8e6498c25f58fad9987ffe93bbabd18cf501922de974a27", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r2, 0xc0303e03, &(0x7f0000000180)={"2486910284ed923431d4c5d5fbf514fd00", r3, 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r3, 0xc0303e03, &(0x7f0000000340)={"bec10619269b544a68dee4635afa606c1224d8a541bb2128271af746bc72418f", r4}) (fail_nth: 7) 4.095810567s ago: executing program 3 (id=1292): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_QGROUP_ASSIGN(0xffffffffffffffff, 0x40189429, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000006000000000a20000000000a05000000000000000000010000000900010073797a300000000048000000030a05020000000000000000010000000900030073797a320000000014000480080002400000000008000140000000000900010073797a3000000000080007006e6174"], 0xcc}, 0x1, 0x0, 0x0, 0x880}, 0x0) 3.85600709s ago: executing program 5 (id=1293): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$RTC_WKALM_SET(0xffffffffffffffff, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x4, 0x3b, 0x11, 0xd, 0x0, 0xe80, 0x5, 0x40, 0xffffffffffffffff}}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r2, &(0x7f0000000300)={0x0, 0x18, 0x0}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 3.44789694s ago: executing program 5 (id=1294): syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000014da2108ab1204000000000000010902240001b30000040904410c17ff5d810009050f1f05e13f000009058303", @ANYRESDEC], 0x0) (async) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0) r0 = openat$6lowpan_enable(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) close(r0) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000040), &(0x7f0000048000), 0x0) (async) syz_open_dev$evdev(&(0x7f0000000240), 0x40, 0x84202) 2.771118453s ago: executing program 3 (id=1295): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000500)={0xa00, 0x18, 0xfa00, {0x100000000000000, 0x0}}, 0xfc36) ioctl$SNDCTL_DSP_SETTRIGGER(r1, 0x40045010, &(0x7f00000000c0)=0x1) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$RTC_WKALM_SET(0xffffffffffffffff, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x4, 0x3b, 0x11, 0xd, 0x0, 0xe80, 0x5, 0x40, 0xffffffffffffffff}}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) preadv(r3, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r3, &(0x7f0000000300)={0x0, 0x18, 0x0}, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 2.534389779s ago: executing program 2 (id=1298): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$RTC_WKALM_SET(0xffffffffffffffff, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x4, 0x3b, 0x11, 0xd, 0x0, 0xe80, 0x5, 0x40, 0xffffffffffffffff}}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r2, &(0x7f0000000300)={0x0, 0x18, 0x0}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x8601) 2.529866593s ago: executing program 4 (id=1299): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x181041, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000300)={0x28, 0x5, r1, 0x0, &(0x7f0000ff8000/0x4000)=nil, 0x4000, 0x57}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x5, r1, 0x0, &(0x7f0000000a40)="7f", 0x1, 0x4}) ioctl$IOMMU_IOAS_UNMAP(r0, 0x3b86, &(0x7f0000000240)={0x18, r1, 0x5, 0x100000001}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file3\x00', 0x105042, 0x0) mount(&(0x7f0000000280)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000300)='./file3\x00', &(0x7f0000000000)='erofs\x00', 0x0, &(0x7f0000000380)='acl') ioctl$sock_ifreq(r3, 0x8910, &(0x7f0000000000)={'veth0_vlan\x00', @ifru_ivalue=0x4}) ioctl$sock_netdev_private(r3, 0x89f1, &(0x7f0000000000)) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r5 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000240)=ANY=[@ANYBLOB="380000000314010000000120000000000900020073797a30000000000800410072786500140041"], 0x38}, 0x1, 0x0, 0x0, 0x808}, 0x4004000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) write$tun(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="000086dd0000120000000080000060fc030000382c01fe8000000000000000000000020000aaff0200000000000000000000000000013a"], 0x6e) 2.302292119s ago: executing program 2 (id=1300): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x5) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000780)={{{@in=@local, @in6=@private1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@empty}}, &(0x7f0000000340)=0xe8) sendmsg$netlink(r2, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000000)={0x24, 0x12, 0x1, 0x0, 0x0, "", [@nested={0xc, 0x0, 0x0, 0x0, [@typed={0x8, 0x0, 0x0, 0x0, @uid=r3}]}, @nested={0x8, 0x1d, 0x0, 0x1, [@generic="b112ed56"]}]}, 0x24}], 0x1}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000001880)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40ffffff07000000400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001", @ANYBLOB="11296d736e76291fcdaddbb6e3cb7c27977cd1e0d7c35bf53a84", @ANYBLOB="5f44f2e8529b210f236a43185043afaa839bf2e7b92b8ecb59362796a6994a4a6742d0f081dca9f58b54202f6f83c58c2b893b34e7ceafc9f4a5289faac45a08d1a82e0bbaf92cfa69f86ac9ace1fcbd34b48605db399e3228a89a01c9fe46351168ce475a8523247c62c4c1b160f807de2c13a4aadad5e4dd0040c43f7ebdecbd00d05744002f5fe2717d12a988b9e8556f74427ec85ba01a6fb8d43b423a7f378f52786c5c7f841d63fcfedd88df638335e9f7e71d7dfdb8984ae245be68a09976ca3051ae0edc761bc3d40abb6d1a433f968df634fbb0ba97b13062f3994568d124e279831b570b81ea7abc804054170f5c50993701cf6fec19607ea1381e05efd89d085fd99c72ad4ca14b9b5488ca062c93cdf05fd449a665657b20faf54915e79f2611383ecc9d252cba2de50443e02f4d77389d191a8a8cb04fe968fbbe27ba4b336f2cdee5589ab801208a29894877f4db1297f0ba9332a153e4e76205af535a131e99d854eb2252b425c639da65a61eb2c5cbf90c6055716cec93e435272cbea92bb2a86e4c017d56478efc403674c90f4531e90fff2f0a275e9e852cd1974e5f74f4c75d44a2899b649a301b27d65875702c588596d3050359fef76becdcd2b61909269b3c4584908797bf968d1a6757be4d1495f9091e3f84c768af3fbd1b5ae1b29f8a6ce72462691ee21d80c5968e8016c2227957a35cf56cbf2f5239a37df007a930c760cf4eaf5c84ab5c807138429ab1127fd69e0c77133080937983a4766cd0ccf052da1d582aa2e541d652f1346995dfa297db9740155e1b5df259bbeba7134239573a8b05cd3478e6bf371d1346f03adb921fb1be5fea6e7c31ca8ffc21ba5afdac83e5028f6afef7960d85a1e9f20e7b81c9ebff702d7caa5528fb5cba564e2d90c5f53278be6e705b148c59f4a74d96ebab41b0505fa56e412fc33b409ae279c8dbec241cd33ab2d67288fda61d6ff8466b88e19aac98e96e30de9895a8bb49578565fb61dd247e9186ad8cfee627dc0084024d7454c067e45e67871e3085120bb3a7f86c1cd723813ce4b582cd0e424123679de9567170f931f30d0533251e78342b3c58f0f5194920c1fbedbf427aaaa68eb650f6fa768dd220461e11ccd553e0597992567017206fb8a02626677e21b4ceb69e93730a2350d60d8c7516ca1d545bd7952c6d77ae8b90bcba17005c99d5dcc324d2235083c797f7b0b99e877cdeba054729f09a0ffebbeed16a60c06227a4dff8d980e597bc1fbddfb68f34a73cf7d104b30eacf7cd609876d4e0dadddfae5e2e37e629bc8f84b838daffe84fedccccdad9a81d631c415a2cfa2e141b1bc0d38721828e0cea9121d6fa08924afb914e1b74123f0821f5a992a20811bbc471f9e09604513d3ab25f346c33285957cc904ab48b3531f3a499712d2fb41d3211467e98ed6f72e0b0d87cdf11b1cbdc8802ce047d48c96ea21f668acaf9237b8e2a33c4dcd1ec003aca2189fb87fe3b2e2676e68314dde5906e5ab30ad5f4936520e241952d327b506a3fb0934fa3831ded99bc1339a0b1d1eccfaeef6e6d794ac896c57fa61a2b7b9766ebde612ce8853847d02fa3c2bc0932a8c23874258856ce36c7bd6a1eb37427be9d5bb29b807fcf82dd1a573889f18952bf59270f3e7c0c2f1f110005b2b908acb90d381568e57c92a61ea560daa3caa872b5920800ab2bb64955d9e7f219631487f7db98011d4f3e8519189b928c7b13e5758a5b36fa017c971f6767037dafffe0cf98d6b1f6eab74f076066ca93a70782031ed49b081cf0ef23cc64f42fe43453a6f7900a572d19b84bc4e2fade57f5ecd7581c54bd23af67eeeb78a70738c722d4227e8977ef0757426e58998c38b14865fb0b0188a27b364e6873456cae9ee0c616899b8cd13db96516691630d2374ef2d4730b2107430b2c0d6b94bfd620f4cd67a398b5a3b88bdec9c7db266956a8658907bb9ed52f4246bd76e303274374978b557e02e824a6dfddd9d6539a4e261c7c676a371e62f6e73da70f967dfe6989767c6b1511399d97bf8c956f741fad15a70ef12c094eb5f7a26cf8d1538347fa3270c306f255a7e465d7a2e1eace75485a023de11629be6bb0d5bb4f6b31a2191dc65307ffb58a431635c89cf483e0bbac77850f25229d78c4efea83cb81066b530ca067e2f6980c86e9a54f5cde6368c21250dede4f9b4757ae741bb552fe7e2253ada3d897c1a6f60d6e519adbd03390e6f08258860ba880a80bf9c1a5e471bf52d892d356066b7f5c17dedddccd94e3489ae10a6a2b29d8f71aefadb249ffbeb0fb0eef0bc053f57b0eb42661ebedf1e231c2e867955dcbc901a648f3523064c436e115bcb35723a207515ddb4e4a8b1fba9fe42abad411592941934ae176c0008457d0da763088ef79fb662cedd8f6f0c634acd7b943b2eb072dd55ffe0e428f932a74d97e59b95e752a7a16bcbb1fbac6913dba121102194bcaa0882928e3db820c64f34315a439c744a22b8bca295b425f371ec78b48c9efd148ad9118d1155d01a2cb4043d99e92b42c3e37997453b7cc1e2c4b71f479020963e3d63e00c430a01c6468b4e3e93aef2f9bc788da584eaf1f70b7290efa8b1d507baa680a41dddb3aa78d6c0f4a3cb20143a902455b5af483c37ad3cf748bfc123083c425eea0c8fbc3b5ef0bd2d672e5998aa21b136e1ebd56faaccc9d83477c49360d6c7a5a21ca40aa03b665563a5791594d3b664cd85c4b0b1bca680fb5f03ea164d327ab8bdd9e8fd13e2889fc79e23db5e9cb218c9bdc06839c1daf501c5bf9547b8fa569ec37b5820a8d1271847ec58716fd2d6959b61f3bcf9c619d6eeeae48109ebcafb6e499f0ead96de518c6a4a68f4d12a06e5bdb81bdb3d045420cb4014695715499d4b58617de3863f0f5c23826c241665057c3e2afd270e63873396909375aa922c610b148975aecd7d92b31403ea646c9dbd018899e39a621d2b4e54f2d604d64a9b3cd5ed7967fa1313757e08f5002fdd820525bf9cd083307affc0fe6c23deb1bd000bc75c3e8db769845d776cc7e17960a0d9e7fed8bc4e318acf5c9b647b67ffdf1ba3aee1d224c7dc6f35cfdb3a7d5e92aacc15f17df3b0318a014f9202f63b78a77e247ec92bdd385ad6e09b5f608c767c8591736aec3e1fc65e4d911985c2ffbffaad1d6b10749ea37ac518ed08295814c0c335b64d7ae2a4b4cdf42260c0d43ded6eebf78bc393967ca3ea1d970b9aa49141a0030fa3c64a713a5e27ae48b637136af367130e4aaf10cc91d2b521867721f0c0ec3ef0405c7baecb540ceb07d4125fceafcf42e5823d0c9976435d713ca9462fa7501010f0cc34a0a390df1745251e2dcd1ac9cde40928d976c2b35fb974da8de2c3249086d3d90f2ce3e1bf9f0eeaef9476aa12350c6b3e169378dc479bf7f27cbb2b4990a0716e9e3804aedf7d96f1c268c6cf2044479d5b76da80beb45573f98ccb58707d038385a3541f875e973605b883e4973fb097ce3a93687fe03de5a1d1582f8734d370479acf8d33a9ecbfccf3965fd0fd40397679208fb9982f14d1fe814b56592ce1cce7a864be6a2468aecbd24ea9198243c8e3128d8aced8cdefd1a210d6112561b3f6941f7d3d31094e36eaf2530c9a040be816827802086cc916b845f399776b655e1d423f58490918d89771a02f524466c5f0a801aa2c26bd9aa3c3ff7e07f807cfd25c2ed377a7ac119a8905c1e64b865148eae28239624e885aee273b2e6266c22b24cdad0b199d4ef6b6fcaafa4e04a9120cbcb60d4e66d80d4ab5baa70d5a77ae8d65cd4ac5600f7e3f5d7b04de0c5b399d48b308090eedb71bb206491de7f6a3b07e381c4f970cf24961758d235107b879df243f1a7680a854d2f3639f498b4aaf3fdc2ebb9d0b65a596e3fcc4f9b84ba9752282a8fe0e7e55bc7c51bba166483c33587a0139a9dae0812624575f1b8a5320c45b926c6f0d6c5fe8ab9549f45bc9fbaf3d91e9cd09fce7c6bc84d2406d10a50ea09bf57c46a150a0ada389cee7d67d252f738d3da55bb0c8b254638ea62202f29dff4683bb3c366e1384a537aa3e85608613b2712e4a40a368259f035a86fd60738ab74fd7e4fa40101df9df178ffe5d75a0754cc30a0ef3dcf1279858a246be6de7488d8f4332ab765e4affb0e62f0c84ad1db9bd9f87c2442d40a7f8eb26bbece21580106f0b922bb87eeb628eb266d0d523c8bb9b24daefcfd09b566d3558c60f12cb9d891d4a74ba0732c74788ca03d3911092ed513e318a32b267924b27ce9b66b845065608529afcfe671b170c245511b4cdae99f409bd227be706e088dc639e04f24b6d84a9aa0ab33b11a1c80a514af043949c108079dfed5cdbba2994df7331ec8121cb36f42fa1cda0ba91ce7d9f8bcc27ae90ea141caa5ea16e9c3a01720e890bb4edaa7f4c1bf3548c376b4ccb28c26455b8b1dc67c7b524fd5e3e75f55492046b66151c1c2322d7b43e79c1b192423af194441c0600619f9206ba3ec73d92c693765f324f44ea87fa9fb776bfdfff3f7284efed144b97b2804b333237c18dbd1d8fba5bfd130417beae539903b0091620f1ddb219b7d64500fbc92f5d8ea6e2d6434d5681fbc0140a3062535e09729a2407888953294f740d86186aabae5b4898084b8bf1d14fcd5f85fd3eaae4f792816ad66ee6368bbfde2f152342c8c07fb4e301e1b3d63c553efcd87360805e53b0fab80ab1b32d1a35d0e270d1f34516980fafc9f51a8c9ca7d8e521eae8e783752e9020bc6b4b42d33d3acc7c1de17894004c8b8a64d681f9d89d73ab4cff0a21e935099ad67f2428e7c9c7abc885225cf15e0bd0c391b0d43af018330f4189cb17fae75c8933c7d664da7f3e084392eb9f37cdeafdd6deb4b17a477c6c89538f55dac2c0f566ed8a988f0dfa7b1c359d96099524be7a1d23066ee5b3660bce5075b5595f479a018832390ae8dba50356411fc7913147c4a2869c4e7c2088b5d6b33464eeda9e16d27817bae0dd5ca535aa55d389140f6e8092332624693dd30aec358c23eabc76794c7802bebb440324ad13554a48b54e16bef438fbfe63f55aa4a2e28d0a3361bdf50beb3f0e196b9e35a4bf3d790aa5d439a4739164d0a654c989d28c5cacd7b466744bea2fef3d8bc7b99d2f1376525ef7824c7139cc8b6cadcd7ef7616bc70ad63c2b88ad886c9ecb933fbcd5e810ec333914b7ff6d1132dd6b2de93d9f4bea690a635a1f907344f21c1a892a29ee59a4d27a0afa2ff223c5b35468399f357afec2ec55f5783e3139c526deb449f324f5e55a26ccdf61ee5f72716cd9e3777b517c644a456a77346591c17c821f5e3ff1f3eaad2b1696a7aa6d15d7f2c0e9db6cb5537c0ef72c2c25e583b9c96298a699eed78ae01ccf3a25877a2f10c68fb9b3c47af7a2164b62c53822af38027b14dcd57bc2c7d17505026f3d1d109dc639efde51b7a2d14a3897fb34ee5d2e4d92105859f4b1983d7326cf07e88cfd183bfca44011fcbd78ae90557ba3cc2a0c6db1951f30e1c270a86226afc3aad35481641ad51541b9816e7e9f715533c6aac3e349acbbd6f1495746c644f2d9f02df1cea41b180d05f520d297604875ca3724cf9ae54c31a30591d522c875c47cfd2b94614e87ec72c3f270413dc94ebb991e18726e39450f9a276633600d4dd872eaeebd9122bbff2c634c5b4334fe9ab7a26b79bf639bcf258f3f5cee5aa059f5b30a7121e2f0bdf235ef684803aed1859b55a431c00562867206e8b67920b6f", @ANYRES32=r1, @ANYRES16=r0], 0xb4}, 0x1, 0x0, 0x0, 0x24004014}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a400000000c0a01010000000000f9ff000a0000090900020073797a31000000200900010073797a310000000014000380100000800c00018006000100582e000014000000110001"], 0x68}, 0x1, 0x0, 0x0, 0x4004850}, 0x40) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="2c0000000d0a010100000000000000000a0010010900020073797a31000000000900010073797a31000000000dab4eca3ea4ac924c3f793b1f2c4d639f43644e3a35547d69d0ec461cad808935a52c39a74222628fe12aca1fa7940c30d7c63fa0c6ded71a70c5662b4032311ad28d162fd41c54c9dc135387fbda976bcef9e935866bd6b92cfb84f4765517aa78be9fd89a310d7d8ae47760"], 0x2c}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x189642, 0x0) ioctl$TIOCMIWAIT(r5, 0x5453, 0x0) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000700), 0x22041, 0x0) r7 = accept$nfc_llcp(0xffffffffffffffff, &(0x7f00000005c0), &(0x7f0000000640)=0x60) ioctl$sock_SIOCOUTQ(r7, 0x5411, &(0x7f0000000740)) r8 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000040), 0x2000, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000000)={0x60, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x11}, @IPSET_ATTR_BUCKETSIZE={0x5}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}]}, 0x60}}, 0x0) ioctl$TCSETS2(r8, 0x402c542b, &(0x7f0000000080)={0x1, 0x9, 0x1e, 0x4, 0x8, "11ea1c6b59ed8afaab835d5059928c8b48d9f9", 0x5, 0x101}) ioctl$TIOCL_PASTESEL(r5, 0x541c, &(0x7f0000000200)) ioctl$TIOCMGET(r6, 0x5415, 0x0) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000540), r10) sendmsg$NLBL_CIPSOV4_C_REMOVE(r10, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000580)={0x1c, r11, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8001}, 0x24000800) sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x94, r11, 0x300, 0x70bd29, 0x25dfdbfb, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSCATLST={0x38, 0xc, 0x0, 0x1, [{0x34, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x6c79a17d}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5c71d1af}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x211cba76}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5b62}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4ec7ecd}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x562d}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x1}, @NLBL_CIPSOV4_A_DOI={0x8}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLST={0x20, 0x8, 0x0, 0x1, [{0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2168180}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdc}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x670705c6}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x3}]}, 0x94}, 0x1, 0x0, 0x0, 0x4000}, 0x8004) 2.169479218s ago: executing program 4 (id=1301): r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x80001, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000040)={0xfffffffffffffffc, 0x6000, 0x1000}, 0x20) r2 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, &(0x7f0000000100)={0x1, "5660359c3245d1c42317afad7d48ed51000000000000000100", 0xffffffffffffffff}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000000)={0x5, "340b7832ceefd131b8e6498c25f58fad9987ffe93bbabd18cf501922de974a27", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r3, 0xc0303e03, &(0x7f0000000180)={"2486910284ed923431d4c5d5fbf514fd00", r4, 0xffffffffffffffff}) r6 = openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$apparmor_exec(r6, &(0x7f0000000140)={'stack ', '/sys/kernel/debug/sync/sw_sync\x00'}, 0x25) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000340)={"bec10619269b544a68dee4635afa606c1224d8a541bb2128271af746bc72418f", r5}) 2.097103473s ago: executing program 4 (id=1302): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0xfffffffffffffe4a, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x90, 0x0, &(0x7f00000009c0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x4800, 0x0, 0x48, 0x0, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}, @fd={0x66642a85, 0x0, r0}}, 0x0}}, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 2.050875293s ago: executing program 2 (id=1303): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$RTC_WKALM_SET(0xffffffffffffffff, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x4, 0x3b, 0x11, 0xd, 0x0, 0xe80, 0x5, 0x40, 0xffffffffffffffff}}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r2, &(0x7f0000000300)={0x0, 0x18, 0x0}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 1.89043082s ago: executing program 4 (id=1304): r0 = syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000040)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x10, 0x103d, 0x100, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0xd8, 0x10, 0xc, {0x8, 0xb, 0x1, 0x2, 0x1, 0x1, 0x30, 0x2}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x7}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0xe, 0x0, 0x3, {0xa, 0x25, 0x25, 0x7fffffff, 0xc, 0x180}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x7f, 0x4, 0x0, {0xa, 0x25, 0x25, 0x400, 0x8f, 0x2}}}}}}}}]}}, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) timer_create(0x0, 0x0, &(0x7f0000000340)=0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_usb_control_io$uac3(r0, &(0x7f0000000100)={0x14, &(0x7f0000000300)={0x0, 0xe, 0x6, {0x6, 0xa, "c39aed3c"}}, 0x0}, 0x0) 1.822714415s ago: executing program 2 (id=1305): r0 = socket$nl_generic(0x10, 0x3, 0x10) fremovexattr(0xffffffffffffffff, &(0x7f0000000040)=ANY=[@ANYBLOB="abe1bbcc9a45a96f733201"]) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) r2 = socket(0x40000000015, 0x5, 0x0) getsockopt(r2, 0x200000000114, 0x5, 0x0, &(0x7f0000000040)) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = inotify_init1(0x800) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f0000000440)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_MESH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000080)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010029bd7000feffffff0f00000008000300", @ANYRES32=r7, @ANYBLOB="050035000400000008002cfe0600000005002d0001210000080034"], 0x3c}, 0x1, 0x0, 0x0, 0x40004}, 0x18) clock_gettime(0xfffffffffffffff1, &(0x7f0000000040)) inotify_add_watch(r4, &(0x7f0000000240)='.\x00', 0x848) r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') preadv(r8, &(0x7f00000005c0)=[{&(0x7f0000000040)=""/196, 0xc4}], 0x1, 0x80, 0x8) sendmsg$ETHTOOL_MSG_COALESCE_SET(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r1, @ANYRES64=r0], 0x4c}, 0x1, 0x0, 0x0, 0x40081}, 0x840) 1.719371957s ago: executing program 2 (id=1306): socket$kcm(0xa, 0x3, 0x87) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) pselect6(0x40, &(0x7f0000000040)={0x7, 0x100000000, 0x100000000000000, 0x1, 0xfdb1, 0xc, 0x288100000400000b, 0x5}, 0x0, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003088700fe88a43de1a400000000000000007d01ffffffff3f0000000000000000000001"], 0xfdef) 702.060072ms ago: executing program 2 (id=1307): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) prctl$PR_SET_NAME(0xf, &(0x7f0000000840)='\x00\xf4\xb5\x04#\xa3\xaa\x11e\x9f|\xd2\xc750\xffye\xcfH\x02n\\\xda\x18qf\vd\x04L\x82\xf2N\aUn\x85\xfd\xd8eS0\xcf\x00\xb1U\xd4\x9bKx\xa71\xeb\xf1o\x8aB\x8ar\xd8\xfbe\x93#K\xe2(\x18\xc7\xc8r\xdb\xbaF\x1a\xbfOZ\x01\x05\x99\x96\b\x94i\xb3T\xd2\xf4\x83\xd7\xf7\xf8\xa3\xcb?\x19\x94O\xb6\xa9:\xf0\xfbR\xac\x12\x8f\x12i\bK\x9f\xc2\xfa\"\xe7\x87,\x86\xf9\xbc\xaeW\f\x18\x12\xd1=!%e\xd4\xcb\x901\x9e\x8f\x81\a\xa2\thG/\x8f\xf4\xcet.\xc6\xee,\x067\xd0I\xc5t\x83a\x9e\xeb\'3\x92Z\x01\xdb}\x8f\xa6\x96T%\xc8\xa1hqN}\x03*\xb8\xa5\x19$\x01\xd9\x83/s\x8c\xccur|?\x1a\x99\xc8^\xb0\v\x9a\x9d\"\x00\x00\x00\x00\t\aMab\x8d\xe0\xfdBO\x9c\xaeSD5a<\xbe\xe5\xf6A\x19\xc9\x8d\xe7;\x8b\x8c\xe5\x04B{\xb2\xec\xdc\x8e\a,}\x9bE\xfat@q\xc2\xbe\xdb\xfe') prctl$PR_SET_SECCOMP(0x4, 0x0, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000240)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) setsockopt$CAN_RAW_ERR_FILTER(r2, 0x65, 0x7, 0x0, 0x0) r4 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)={0x14, r4, 0x9c3fa077fa966179, 0x0, 0x0, {{0x7e}, {@void, @void}}}, 0x14}}, 0x4000054) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000340), 0x400, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)={'vxcan0\x00'}) socketpair$unix(0x1, 0x2, 0x0, 0x0) r5 = fsopen(&(0x7f0000000040)='debugfs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000700)='source', &(0x7f0000000580)='c:::/\x83\xc1\xcfD\xc4AO\x06)\xb03\xfcI\x95w\x96\x9b\xe9\xa6\x1a\x96\xael\x11\xa6\x06\xe3G\xb1\x1d$\xc2;\x8f\xf3\x13\xebB\x93\x94\x01\x8b\x88\xeb\xa3\x01\rx\x86bK&\x13a~\x04/\x18\x14ZM\xcb\xad\x92>\xe5\x01V\xdc\x05#\x13\xe9F\xa0\x1b\xf8\xe12\xe9\x80\x988\xd8?\x86\xe9i\x7f\xa8\xe0c\x94\xc1\xae\x9c\xba\x1c\xfa\xbc\xa8\xbf\xff\xfe\xfe!\x7f2\xf1\xc7P\x80A\x1c2k\xf6}P\x19\xee:i|0\x1c\x13u\xb0I\xaa\xe3\x14\x9a\x1f\x9f(\xd1$\x06\xa8&t&A0\xa7\xef\x9cL\x8e1K', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000700)='source', &(0x7f00000004c0)='c:::/\x83\xc1\xcfD\xc4AO\x06)\xb03\xfcI\x95w\x96\x9b\xe9\xa6\x1a\x96\xael,\xc4\x00\x00\x00\x00\x00\x00\xc2;\x8f\xf3\x13\xebB\x93\x94\x01\x8b\x88\xeb\xa3\x01\rx\x86bK&\x13a~\x04/\x18\x14ZM\xcb\xad\x92>\xe5\x01V\xdc\x05#\x00\x00\x00\x00\x1b\xf8\xe12\xe9\x80\x988\xd8?\x86\xe9i\x7f\xa8\xe0c\x94\xc1\xae\xf9\xff\x1b\xfa\xbc\xa8\xbf\xff\xfe\xfe!\x7f2\xf1\xc7P\x80A\x1c2k\xf6}P\x19\xee:i|0\x1c\x13u\xb0I\xaa\xe3\x14\x9a\x1f\x9f(\xd1$\x06\xa8&\xc1&A0\xa7\xef\x9cL\x8e1K', 0x0) r6 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r6}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r7 = socket$inet(0x2, 0x2, 0x0) setsockopt$sock_int(r7, 0x1, 0x2e, &(0x7f0000000180)=0x7b, 0x4) recvmmsg(r7, &(0x7f0000000300)=[{{0x0, 0x1c, 0x0}, 0x101}], 0x1, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(0xffffffffffffffff, 0x84, 0x15, &(0x7f0000000140)={0xa}, 0x1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/custom0\x00', 0x802, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000280)={@flat=@weak_binder={0x70742a85, 0x1000, 0xffffffffffffffff}, @flat=@handle={0x73682a85, 0x0, 0x1}, @flat=@binder={0x70742a85, 0x1, 0x2}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 386.561293ms ago: executing program 4 (id=1308): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$ttys(0xc, 0x2, 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x3) 339.949397ms ago: executing program 5 (id=1309): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x2, @multicast2}, 0x2, 0x0, 0x4}}, 0x2e) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000007fffffff06000000140008"], 0x28}}, 0x8000) 205.62669ms ago: executing program 5 (id=1310): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x40000, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCGPKT(r2, 0x40045431, &(0x7f0000000000)) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000f00)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a300000000078000000090a010400000000000000000700000008000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d34001280200001800a00010071756f7461000000100002800c0001400000000300000000000000800a00010071756f746100000008000340000001"], 0xc0}}, 0x20050800) r3 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) r4 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_CREATE_BUFS(r4, 0xc100565c, &(0x7f00000013c0)={0x8, 0x8, 0x2, {0x5, @vbi={0x0, 0x0, 0x4, 0x3136564e, [], [0x8200], 0x1}}}) ioctl$VIDIOC_QBUF(r3, 0xc058565d, &(0x7f0000000200)=@fd={0x0, 0x5, 0x4, 0x0, 0x9, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, "8000"}, 0x0, 0x2, {}, 0x20800}) r5 = socket$kcm(0x2, 0xa, 0x2) r6 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r6, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf83, 0x3}, 0x1c) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYRESOCT], 0x9e) 89.79469ms ago: executing program 5 (id=1311): r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$qrtr(0x2a, 0x2, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a78000000000a01080000000000000000070000000900010073797a30000000000c00044000000000000000044c00060098d560227defe8a9e949f23891071949edba7a5b59dc884427bff96fac71f2db1e12bcef82bf040f716d96376fac5d28236b656fa5044c44e4dd9a2b37a2fe55337e1029dd978eb454000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000000c080003400000000808000440ffffff"], 0x17c}}, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000680), r0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x21, &(0x7f00000007c0), &(0x7f0000000800)=0x4) bind$inet(r3, &(0x7f0000000200)={0x2, 0x4e20, @multicast1}, 0x10) fcntl$setstatus(r3, 0x4, 0x40800) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) ftruncate(r4, 0x2000009) sendfile(r3, r4, 0x0, 0x7ffff004) ioctl$SNDRV_PCM_IOCTL_RESUME(r4, 0x4147, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) socket(0x2b, 0x1, 0x0) r5 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001480)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001400010601800000edffffff2aa16900"], 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r6 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000006c0)=0x0) sched_setattr(r7, &(0x7f0000000700)={0x38, 0x0, 0x10000000, 0x7fffffff, 0x9, 0x6, 0x3ff, 0x2, 0x7f, 0x9}, 0x0) ioctl$IOCTL_VMCI_DATAGRAM_SEND(0xffffffffffffffff, 0x7ab, &(0x7f0000000040)={&(0x7f0000000280)={{@local}, {@local, 0x6}, 0x400, "787c2ce2fba15d4e9f8e96bc11e2ca247a20c3e26661b174fe1825253be9e8480cb4f3524914f59ba189c1429727ef39b4164f93bb821987b3b7f73495bc8e745304668e0e46798c7f5917ea8428d41cab5612336f04000300000000008e9c1c86a394feb64fb06f77dadbcb20fc62741432b7dca37007d68e98fe46135d6a1c5ed42102f58daa5211319db84aa9abac734be47c908dc3ffa3aa7b61ec16d3d1209fc618f6c4532ea582628502ac46d167db6d53d8f3184df68414e6b6ec0109664c570e155654e03d58dadd0e5a7bab42bbb4a9afdefc115eb1609e7b50dbd94b94ba09000000000000001c9e4a41d3e16af21d6c897a1121bc14de16e78d6d7f2ae79db44e302539fd926e0b91e0fc589e2fa19b218d0508b5ce3ad40d03936693ca5aa41ddc07cf492874569ab037e0530e38245b98131ae0c9afd871df5f51331938764f5a7dd96890edd467b2fbc335ed081729b5ea722a98b34d0dac6de995de4ee263c81b2567b3f87e0897857edd5d7e97d61fc67076eab4846010d4828cc879f95cddb69ff6438f2a109285c46d8224c36069d30c3c9cf4a6800ae224111136bd9c1e06c4bfc4685d7bb6a72345772b3ce9bf105490743dc4b700f24ce6b250b95e6c383fe44967a55d140baf0ec339e3815b29a2246cb5c953048c43266485bbd9d0caecf00e9501a4433b54930cba54e06607ada2f5d818e4804294fcf53058e58e0d33d4aa6dc943811056908fe9116e65cdddac1d2fb24d1eacee389af38b7e5a7056d0de50c6b49fb38388cf28c2d6dd3dbbab84ffbef4b0c02a77f018e8a9749a557909e6aa96185d268dad7744b094d8c6134b89efe26674d65f908f9c3a8c201f661fc26efe0eff248d3a473fe32a5b3643bfad8f186c2af3fbaa1d38560c1244c79a0e48893eefb792af281650f34f6c2d9a6c622aba234b63586713cb66179a0897d98ee5228569c32c1a682807c8db7eb197ccbbd6549db86a6a9aebbf5dc14060f22e2b07d6166f43c25ae0c88be7a4dc38e7ed08972a355b0e5d6fc43b8e5594fa6b36a36a44bb94b75eaff11dc17105f54beda54da2a1ea1acfab354745057dd2e7725f2c8450b19fdf37e19f6ce43449e9191f5a5beb4a1bc176f6130052e83acefd8ff18d592bb75f15f86c9113e4bd67ad420c33ae706cdc10060277b83ef30a50d4ac19c9a791b309377aa20a4743bbb799abc3ba58071b628c9ba8103bbfe389939e55296ec9b4f8d3a03aff30ce9aa0dd6e5158a672be8f3da8349ed4ad82f6ca67ee29e8b234840cf7846e604e5b8135abd94d71fe0a79180e75d4e193ea8df466c087b660fe984943751a9f6df8545699701d478c2b3daa949155770e74835bcd972de27afd20b02ce0e504c15b0237437200"}, 0x418, 0x7fffffff}) capset(0x0, 0x0) write$apparmor_exec(r6, &(0x7f0000000080)=ANY=[@ANYBLOB="737461636b203aae86ad47aa0d9495e6d80f7bde2d18ffb36cf152aed2d408fb58e305fc8e2f2f7d91f81b621cc4214d4a27e1614fbee0beac8f4a045070b770212d46d4a2df096b791f2a4ba218e12cb76aa24945b70a7c9dd5edeac52b5a876f73cfbe66371a72f11f3d9544d6b59b4a5541dcef5cbf11ffff37dfd147c8a3e5098a207be806ea7167101f8c1b5c8fe41e170fd0c775dbc5be0b6d3ab625ab702e5b1dc15f9c4b3d09be812f340e681e0694f5badf640da3fdfc2f929b4c2beb9a592c577287b6021bfeec24146c7f95608bb60a736207a09d9f47e89c4044eadde57cdefd15f25b822d2eaf2205df0d6b71b63ee0b63cb598f26509af36983578f6f4198a0843cc1b1bd780015007ab9709cc6211e3b5c685b972b5c5e95f054a7a9fe149282f679c8466b9734e3850ec98419dd0c887715902f9e7802842085bc606f30c2654869e9e3701fd0fc69137fe165592689465eebd5cafad7c29de2adadec42a818d8ee389ca1fe33a1ef23617c89116a3a458b56612e4c36c43a9150d5331adbb0beb01a062b1f1349fc2ecea76cb7c40cdfe378185f3099b1d71414d0fda5a47f8593260cc0bd723a4cca81435f041321635f91bcb15aac48883a9617fb4e58c19b18cf3a7e1299a07f45325fcd05a7c30f47e77073dcc584f7e0516cb74c55a0a2a30dc9f3163868f7c233ad1fff87a3c2a30f1312c3ad0fb71cc6433e9bd7c3209de0cba9552f5c7c04f24eccf206bdb745564539dd62d655a33d40a507660668c30f7720280c86c104e58d30d6cb65814e00b55ff9a33f3ed375dfb4b47d89a599f31a0d612827a8f6e2a73eb376e11160ddbc0d79e3a11d5a99fa9c98f559efeb1e0a196d6da225f8c145334989fae4eafc05bbad0dc880e923d6b2ed2890eed8255bd2f8296b8d689762aa02e1399045bc0cbec07ec937f2e6dfac960460574e2e00dc39221a4a0c31dbbfa4973e8b056afe87bdfe6bc1405d9ae867d05316247465aceddf5c95825d73a9b119dab89ac982fff04e5d140a8391bd6f1831a9b7519ba86abc94993fe918a1b640d57e276027d9ef49006523593"], 0x564) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000340)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r2, @ANYBLOB="150327bd7000fdeddf25040000000c0001800800030003"], 0x20}, 0x1, 0x0, 0x0, 0x40010}, 0x4800) 0s ago: executing program 4 (id=1312): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000002c0), r0) sendmsg$NLBL_UNLABEL_C_STATICADD(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=ANY=[@ANYBLOB="b0000000", @ANYRES16=r1, @ANYBLOB="010027bd7000ffdbdf250300000014000300fe8000000000000000000000000000bb2900070073797374656d5f753a6f626a6563745f723a617564697463746c5f657865635f743a7330000000211400060076657468310000000000000000000000080004007f00010114000200"], 0xb0}, 0x1, 0x0, 0x0, 0x24004884}, 0x0) kernel console output (not intermixed with test programs): red promiscuous mode [ 212.758380][ T9314] syzkaller0: entered allmulticast mode [ 214.049865][ T5975] hid-generic 00A0:0006:0003.0013: unknown main item tag 0x0 [ 214.058796][ T5975] hid-generic 00A0:0006:0003.0013: unknown main item tag 0x0 [ 214.066449][ T5975] hid-generic 00A0:0006:0003.0013: unknown main item tag 0x0 [ 214.075701][ T5975] hid-generic 00A0:0006:0003.0013: unknown main item tag 0x0 [ 214.084847][ T5975] hid-generic 00A0:0006:0003.0013: unknown main item tag 0x0 [ 214.107888][ T5975] hid-generic 00A0:0006:0003.0013: unknown main item tag 0x0 [ 214.118814][ T5975] hid-generic 00A0:0006:0003.0013: unknown main item tag 0x0 [ 214.135527][ T29] usb 6-1: USB disconnect, device number 19 [ 214.136945][ T5975] hid-generic 00A0:0006:0003.0013: unknown main item tag 0x0 [ 214.168695][ T5975] hid-generic 00A0:0006:0003.0013: unknown main item tag 0x0 [ 214.187300][ T5975] hid-generic 00A0:0006:0003.0013: unknown main item tag 0x0 [ 214.240451][ T5975] hid-generic 00A0:0006:0003.0013: hidraw0: HID v0.05 Device [syz0] on syz0 [ 214.954874][ T9306] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 215.399756][ T5975] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 215.565576][ T5975] usb 6-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 215.600168][ T5975] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 215.612368][ T5975] usb 6-1: Product: syz [ 215.616721][ T5975] usb 6-1: Manufacturer: syz [ 215.621380][ T5975] usb 6-1: SerialNumber: syz [ 215.647151][ T5975] usb 6-1: config 0 descriptor?? [ 215.659714][ T9341] netlink: 'syz.4.817': attribute type 10 has an invalid length. [ 215.671313][ T5975] gspca_main: sunplus-2.14.0 probing 04fc:504a [ 215.865059][ T24] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 215.945059][ T5904] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 216.015027][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 216.021855][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 216.033142][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 216.043115][ T24] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 216.055995][ T24] usb 3-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 216.065185][ T5975] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 216.072959][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 216.084696][ T24] usb 3-1: config 0 descriptor?? [ 216.095014][ T5904] usb 4-1: Using ep0 maxpacket: 16 [ 216.102182][ T5904] usb 4-1: unable to get BOS descriptor or descriptor too short [ 216.110991][ T5904] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 216.124339][ T5904] usb 4-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 216.133673][ T5904] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 216.141909][ T5904] usb 4-1: Product: syz [ 216.146409][ T5904] usb 4-1: Manufacturer: syz [ 216.152088][ T5904] usb 4-1: SerialNumber: syz [ 216.205560][ T5975] usb 5-1: device descriptor read/64, error -71 [ 216.369258][ T5904] usb 4-1: Audio class v2/v3 interfaces need an interface association [ 216.381175][ T5904] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 216.455097][ T5975] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 216.510153][ T24] input: HID 0458:5011 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0458:5011.0014/input/input15 [ 216.605066][ T5975] usb 5-1: device descriptor read/64, error -71 [ 216.625155][ T24] input: HID 0458:5011 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0458:5011.0014/input/input16 [ 216.664021][ T5904] usb 4-1: USB disconnect, device number 50 [ 216.699619][ T9339] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 216.735881][ T5975] usb usb5-port1: attempt power cycle [ 216.741869][ T9339] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 216.809656][ T24] kye 0003:0458:5011.0014: input,hiddev0,hidraw0: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.2-1/input0 [ 216.902525][ T24] usb 3-1: USB disconnect, device number 40 [ 217.097028][ T5975] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 217.125691][ T5975] usb 5-1: device descriptor read/8, error -71 [ 217.141046][ T9358] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 217.149854][ T9358] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 217.325164][ T5904] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 217.375073][ T5975] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 217.395592][ T5975] usb 5-1: device descriptor read/8, error -71 [ 217.477071][ T5904] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 217.488592][ T5904] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 217.499321][ T5904] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 217.512682][ T5904] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 217.522966][ T5904] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 217.532994][ T5975] usb usb5-port1: unable to enumerate USB device [ 217.538479][ T5904] usb 4-1: config 0 descriptor?? [ 217.955188][ T5904] plantronics 0003:047F:FFFF.0015: item fetching failed at offset 10/15 [ 217.965380][ T5904] plantronics 0003:047F:FFFF.0015: parse failed [ 217.971904][ T5904] plantronics 0003:047F:FFFF.0015: probe with driver plantronics failed with error -22 [ 219.047782][ T9375] overlayfs: option "volatile" is meaningless in a non-upper mount, ignoring it. [ 219.057196][ T9375] overlayfs: missing 'lowerdir' [ 219.119874][ T9376] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3089888063 (3089888063 ns) > initial count (2126324423 ns). Using initial count to start timer. [ 219.986268][ T5975] usb 4-1: USB disconnect, device number 51 [ 220.030196][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.047164][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.052642][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.058710][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.064160][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.070129][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.075604][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.080977][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.087236][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.092646][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.098401][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.103787][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.110013][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.115366][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.121113][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.126727][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.132097][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.137652][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.142940][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.149318][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.154630][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.160856][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.166309][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.171648][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.177667][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.182984][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.188406][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.193753][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.199151][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.204435][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.209825][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.215292][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.220728][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.226307][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.231653][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.237215][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.242532][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.247919][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.253233][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.258666][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.264114][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.269573][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.274890][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.280273][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.285693][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.290965][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.296376][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.301707][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.307209][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.312512][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.317968][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.323282][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.328709][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.334002][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.339487][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.344879][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.350549][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.355993][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.361819][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.367359][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.372700][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.378160][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.383470][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.390567][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.396079][ T9380] tmpfs: Bad value for 'nr_blocks' [ 220.452668][ T9360] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 220.553135][ T29] usb 6-1: USB disconnect, device number 20 [ 220.886106][ T9399] netlink: 188 bytes leftover after parsing attributes in process `syz.2.834'. [ 220.905046][ T9] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 220.925052][ T5975] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 221.055177][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 221.062620][ T9] usb 5-1: unable to get BOS descriptor or descriptor too short [ 221.072666][ T5975] usb 4-1: device descriptor read/64, error -71 [ 221.081470][ T9] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 221.095997][ T9] usb 5-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 221.106126][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 221.114772][ T9] usb 5-1: Product: syz [ 221.120148][ T9] usb 5-1: Manufacturer: syz [ 221.125041][ T9] usb 5-1: SerialNumber: syz [ 221.315058][ T5975] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 221.342549][ T9] usb 5-1: Audio class v2/v3 interfaces need an interface association [ 221.351332][ T9] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 221.455041][ T5975] usb 4-1: device descriptor read/64, error -71 [ 221.586272][ T5975] usb usb4-port1: attempt power cycle [ 221.775057][ T5904] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 221.791807][ T9] usb 5-1: USB disconnect, device number 25 [ 221.848156][ T6016] udevd[6016]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 221.929010][ T5975] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 221.955648][ T5975] usb 4-1: device descriptor read/8, error -71 [ 221.966382][ T5904] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 221.981984][ T5904] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 221.992932][ T5904] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 222.006284][ T5904] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 222.015518][ T5904] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 222.036566][ T5904] usb 3-1: config 0 descriptor?? [ 222.195042][ T5975] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 222.215879][ T5975] usb 4-1: device descriptor read/8, error -71 [ 222.326471][ T5975] usb usb4-port1: unable to enumerate USB device [ 222.458180][ T5904] plantronics 0003:047F:FFFF.0016: item fetching failed at offset 10/15 [ 222.473340][ T5904] plantronics 0003:047F:FFFF.0016: parse failed [ 222.480886][ T5904] plantronics 0003:047F:FFFF.0016: probe with driver plantronics failed with error -22 [ 222.816891][ T9427] netlink: 40 bytes leftover after parsing attributes in process `syz.4.844'. [ 222.829152][ T9427] netlink: 40 bytes leftover after parsing attributes in process `syz.4.844'. [ 223.315026][ T5975] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 223.465023][ T5975] usb 5-1: Using ep0 maxpacket: 16 [ 223.472301][ T5975] usb 5-1: unable to get BOS descriptor or descriptor too short [ 223.481155][ T5975] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 223.494087][ T5975] usb 5-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 223.503440][ T5975] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 223.511963][ T5975] usb 5-1: Product: syz [ 223.516242][ T5975] usb 5-1: Manufacturer: syz [ 223.520856][ T5975] usb 5-1: SerialNumber: syz [ 223.719747][ T9441] netlink: 88 bytes leftover after parsing attributes in process `syz.3.849'. [ 223.738691][ T5975] usb 5-1: Audio class v2/v3 interfaces need an interface association [ 223.748873][ T5975] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 224.189333][ T5975] usb 5-1: USB disconnect, device number 26 [ 224.564652][ T9] usb 3-1: USB disconnect, device number 41 [ 224.637419][ T9456] kvm: user requested TSC rate below hardware speed [ 224.646218][ T9456] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=64875003 (129750006 ns) > initial count (53591314 ns). Using initial count to start timer. [ 225.045044][ T9] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 225.081860][ T9411] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 225.175999][ T9] usb 3-1: device descriptor read/64, error -71 [ 225.435048][ T9] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 225.565529][ T29] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 225.572733][ T9] usb 3-1: device descriptor read/64, error -71 [ 225.685309][ T9] usb usb3-port1: attempt power cycle [ 225.726955][ T29] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 225.735122][ T29] usb 6-1: config 0 has no interface number 0 [ 225.743461][ T29] usb 6-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 225.752875][ T29] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 225.755734][ T5846] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 225.761116][ T29] usb 6-1: Product: syz [ 225.772662][ T29] usb 6-1: Manufacturer: syz [ 225.778234][ T29] usb 6-1: SerialNumber: syz [ 225.785417][ T29] usb 6-1: config 0 descriptor?? [ 225.875039][ T5897] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 225.916731][ T5846] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 225.927757][ T5846] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 225.937809][ T5846] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 225.953531][ T5846] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 225.963302][ T5846] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 225.974453][ T5846] usb 4-1: config 0 descriptor?? [ 226.000733][ T29] dvb_usb_ec168 6-1:0.1: probe with driver dvb_usb_ec168 failed with error -71 [ 226.024447][ T29] usb 6-1: USB disconnect, device number 21 [ 226.035363][ T9] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 226.043621][ T5897] usb 5-1: Using ep0 maxpacket: 16 [ 226.058217][ T6016] udevd[6016]: setting mode of /dev/bus/usb/006/021 to 020664 failed: No such file or directory [ 226.073353][ T5897] usb 5-1: unable to get BOS descriptor or descriptor too short [ 226.083120][ T9] usb 3-1: device descriptor read/8, error -71 [ 226.095716][ T6016] udevd[6016]: setting owner of /dev/bus/usb/006/021 to uid=0, gid=0 failed: No such file or directory [ 226.113078][ T5897] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 226.133286][ T5897] usb 5-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 226.143730][ T5897] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 226.155321][ T5897] usb 5-1: Product: syz [ 226.159594][ T5897] usb 5-1: Manufacturer: syz [ 226.164412][ T5897] usb 5-1: SerialNumber: syz [ 226.345100][ T9] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 226.365452][ T9] usb 3-1: device descriptor read/8, error -71 [ 226.380149][ T5897] usb 5-1: Audio class v2/v3 interfaces need an interface association [ 226.391294][ T5846] plantronics 0003:047F:FFFF.0017: item fetching failed at offset 10/15 [ 226.400099][ T5897] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 226.411434][ T5846] plantronics 0003:047F:FFFF.0017: parse failed [ 226.421533][ T5846] plantronics 0003:047F:FFFF.0017: probe with driver plantronics failed with error -22 [ 226.475356][ T9] usb usb3-port1: unable to enumerate USB device [ 226.815433][ T5897] usb 5-1: USB disconnect, device number 27 [ 226.846924][ T6016] udevd[6016]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 228.536578][ T24] usb 4-1: USB disconnect, device number 56 [ 228.576558][ T9503] netlink: 'syz.3.871': attribute type 4 has an invalid length. [ 229.325154][ T5846] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 229.475160][ T5846] usb 4-1: Using ep0 maxpacket: 16 [ 229.483868][ T5846] usb 4-1: unable to get BOS descriptor or descriptor too short [ 229.497652][ T5846] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 229.512175][ T5846] usb 4-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 229.525490][ T5846] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 229.533872][ T5846] usb 4-1: Product: syz [ 229.538391][ T5846] usb 4-1: Manufacturer: syz [ 229.544353][ T5846] usb 4-1: SerialNumber: syz [ 229.705464][ T9484] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 229.813869][ T5846] usb 4-1: Audio class v2/v3 interfaces need an interface association [ 229.850983][ T5846] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 230.105078][ T5928] usb 6-1: new full-speed USB device number 22 using dummy_hcd [ 230.146564][ T5904] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 230.246027][ T5897] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 230.254991][ T5928] usb 6-1: device descriptor read/64, error -71 [ 230.273943][ T5846] usb 4-1: USB disconnect, device number 57 [ 230.319067][ T6016] udevd[6016]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 230.348515][ T5904] usb 5-1: Using ep0 maxpacket: 32 [ 230.369207][ T5904] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 230.393464][ T5904] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 230.405737][ T5904] usb 5-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 230.412661][ T5897] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 230.415479][ T5904] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 230.434406][ T5897] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 230.446950][ T5897] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 230.447412][ T5904] usb 5-1: Product: syz [ 230.461214][ T5897] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 230.473828][ T5897] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 230.482967][ T5904] usb 5-1: Manufacturer: syz [ 230.490075][ T5897] usb 3-1: config 0 descriptor?? [ 230.492327][ T5904] usb 5-1: SerialNumber: syz [ 230.507494][ T5928] usb 6-1: new full-speed USB device number 23 using dummy_hcd [ 230.522189][ T5904] usb 5-1: config 0 descriptor?? [ 230.665082][ T5928] usb 6-1: device descriptor read/64, error -71 [ 230.761833][ T5904] usb 5-1: USB disconnect, device number 28 [ 230.776733][ T5928] usb usb6-port1: attempt power cycle [ 230.937911][ T5897] plantronics 0003:047F:FFFF.0018: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 231.125317][ T5928] usb 6-1: new full-speed USB device number 24 using dummy_hcd [ 231.167192][ T5928] usb 6-1: device descriptor read/8, error -71 [ 231.425038][ T5928] usb 6-1: new full-speed USB device number 25 using dummy_hcd [ 231.467166][ T5928] usb 6-1: device descriptor read/8, error -71 [ 231.536029][ T5904] usb 3-1: USB disconnect, device number 46 [ 231.595244][ T5928] usb usb6-port1: unable to enumerate USB device [ 231.955114][ T9] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 232.105366][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 232.113651][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 232.122996][ T9] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 232.137269][ T9] usb 4-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 232.146798][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 232.155070][ T9] usb 4-1: Product: syz [ 232.159456][ T9] usb 4-1: Manufacturer: syz [ 232.164174][ T9] usb 4-1: SerialNumber: syz [ 232.391154][ T9] usb 4-1: Audio class v2/v3 interfaces need an interface association [ 232.402015][ T9] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 232.864764][ T9] usb 4-1: USB disconnect, device number 58 [ 232.924719][ T6016] udevd[6016]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 233.105226][ T5904] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 233.295912][ T5904] usb 3-1: Using ep0 maxpacket: 32 [ 233.302477][ T5904] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 233.312658][ T5904] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 233.324264][ T5904] usb 3-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 233.344994][ T5904] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 233.354412][ T5904] usb 3-1: Product: syz [ 233.359027][ T5904] usb 3-1: Manufacturer: syz [ 233.363701][ T5904] usb 3-1: SerialNumber: syz [ 233.373890][ T5904] usb 3-1: config 0 descriptor?? [ 233.591585][ T5904] usb 3-1: USB disconnect, device number 47 [ 234.206451][ T9621] netlink: 39 bytes leftover after parsing attributes in process `syz.2.898'. [ 234.488367][ T9571] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 234.615344][ T5904] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 234.751745][ T9629] netlink: 8 bytes leftover after parsing attributes in process `syz.4.901'. [ 234.816426][ T5904] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 234.843615][ T5904] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 234.870407][ T5904] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 234.893321][ T5904] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 234.923293][ T5904] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 234.934946][ T9618] comedi comedi3: reset error (fatal) [ 234.955390][ T5904] usb 3-1: config 0 descriptor?? [ 235.275263][ T24] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 235.394439][ T5904] plantronics 0003:047F:FFFF.0019: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 235.427035][ T24] usb 6-1: Using ep0 maxpacket: 16 [ 235.434821][ T24] usb 6-1: unable to get BOS descriptor or descriptor too short [ 235.444520][ T24] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 235.461702][ T24] usb 6-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 235.471199][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 235.480373][ T24] usb 6-1: Product: syz [ 235.484837][ T24] usb 6-1: Manufacturer: syz [ 235.489946][ T24] usb 6-1: SerialNumber: syz [ 235.717069][ T24] usb 6-1: Audio class v2/v3 interfaces need an interface association [ 235.726623][ T24] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 235.817277][ T5904] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 235.841313][ T9652] binder: 9651:9652 ioctl c0306201 2000000004c0 returned -14 [ 235.953443][ T62] nci: nci_rf_intf_activated_ntf_packet: unsupported activation_rf_tech_and_mode 0x20 [ 235.975217][ T5904] usb 4-1: Using ep0 maxpacket: 32 [ 235.995112][ T5904] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 236.008610][ T5904] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 236.030077][ T5904] usb 4-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 236.043207][ T5904] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 236.043223][ T5846] usb 3-1: USB disconnect, device number 48 [ 236.085128][ T5904] usb 4-1: Product: syz [ 236.096777][ T5904] usb 4-1: Manufacturer: syz [ 236.111831][ T5904] usb 4-1: SerialNumber: syz [ 236.136571][ T5904] usb 4-1: config 0 descriptor?? [ 236.202237][ T24] usb 6-1: USB disconnect, device number 26 [ 236.348712][ T9] usb 4-1: USB disconnect, device number 59 [ 236.525120][ T5904] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 236.695723][ T5904] usb 5-1: Using ep0 maxpacket: 8 [ 236.697350][ T5904] usb 5-1: config 6 has an invalid interface number: 220 but max is 0 [ 236.697376][ T5904] usb 5-1: config 6 has no interface number 0 [ 236.697403][ T5904] usb 5-1: config 6 interface 220 has no altsetting 0 [ 236.701956][ T5904] usb 5-1: New USB device found, idVendor=174f, idProduct=5212, bcdDevice=40.10 [ 236.701982][ T5904] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 236.702007][ T5904] usb 5-1: Product: syz [ 236.702018][ T5904] usb 5-1: Manufacturer: syz [ 236.702028][ T5904] usb 5-1: SerialNumber: syz [ 236.737257][ T9672] binder: 9668:9672 ioctl c0306201 200000000400 returned -11 [ 236.925562][ T9661] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 236.947452][ T9661] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 237.001259][ T5904] uvcvideo 5-1:6.220: Found multiple Units with ID 4 [ 237.022636][ T5904] uvcvideo 5-1:6.220: Found Unit with invalid ID 0 [ 237.051483][ T5904] uvcvideo 5-1:6.220: Found UVC 7.ff device syz (174f:5212) [ 237.077674][ T5904] uvcvideo 5-1:6.220: Entity type for entity Output 4 was not initialized! [ 237.101665][ T5904] uvcvideo 5-1:6.220: Failed to create links for entity 4 [ 237.117526][ T5904] uvcvideo 5-1:6.220: Failed to register entities (-22). [ 237.140951][ T5904] usb 5-1: USB disconnect, device number 29 [ 237.280203][ T9689] netlink: 44 bytes leftover after parsing attributes in process `syz.5.917'. [ 237.363476][ T36] nci: nci_rf_intf_activated_ntf_packet: unsupported activation_rf_tech_and_mode 0x20 [ 237.615041][ T5904] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 237.635624][ T5846] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 237.789292][ T5904] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 237.805030][ T5846] usb 4-1: Using ep0 maxpacket: 16 [ 237.805466][ T946] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 237.823408][ T5904] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 237.837819][ T5904] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 237.839842][ T5846] usb 4-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=9c.15 [ 237.852337][ T5904] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 237.852367][ T5904] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 237.882415][ T5846] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 237.893337][ T5846] usb 4-1: Product: syz [ 237.898099][ T5846] usb 4-1: Manufacturer: syz [ 237.903397][ T5846] usb 4-1: SerialNumber: syz [ 237.910221][ T5904] usb 6-1: config 0 descriptor?? [ 237.925158][ T5846] usb 4-1: config 0 descriptor?? [ 237.939146][ T5846] ssu100 4-1:0.0: Quatech SSU-100 USB to Serial Driver converter detected [ 238.004987][ T946] usb 5-1: Using ep0 maxpacket: 16 [ 238.013287][ T946] usb 5-1: unable to get BOS descriptor or descriptor too short [ 238.022541][ T946] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 238.033848][ T24] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 238.044675][ T946] usb 5-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 238.053817][ T946] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 238.061908][ T946] usb 5-1: Product: syz [ 238.066371][ T946] usb 5-1: Manufacturer: syz [ 238.071017][ T946] usb 5-1: SerialNumber: syz [ 238.194984][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 238.201860][ T24] usb 3-1: config 0 has an invalid interface number: 196 but max is 0 [ 238.210315][ T24] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 238.220950][ T24] usb 3-1: config 0 has no interface number 0 [ 238.227246][ T24] usb 3-1: config 0 interface 196 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 238.238266][ T24] usb 3-1: config 0 interface 196 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 238.251366][ T24] usb 3-1: config 0 interface 196 has no altsetting 0 [ 238.261445][ T24] usb 3-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 238.270575][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 238.278649][ T24] usb 3-1: Product: syz [ 238.282850][ T24] usb 3-1: Manufacturer: syz [ 238.287825][ T24] usb 3-1: SerialNumber: syz [ 238.297169][ T24] usb 3-1: config 0 descriptor?? [ 238.304786][ T946] usb 5-1: Audio class v2/v3 interfaces need an interface association [ 238.314373][ T946] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 238.338343][ T5846] ssu100 4-1:0.0: probe with driver ssu100 failed with error -71 [ 238.353930][ T5904] plantronics 0003:047F:FFFF.001A: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 238.374863][ T5846] usb 4-1: USB disconnect, device number 60 [ 238.530191][ T24] ipheth 3-1:0.196: Unable to find endpoints [ 238.542009][ T24] usb 3-1: USB disconnect, device number 49 [ 238.728344][ T946] usb 5-1: USB disconnect, device number 30 [ 238.758750][ T6016] udevd[6016]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 238.891915][ T9710] netlink: 20 bytes leftover after parsing attributes in process `syz.3.925'. [ 238.944772][ T9713] netlink: 8 bytes leftover after parsing attributes in process `syz.3.926'. [ 238.961283][ T9] usb 6-1: USB disconnect, device number 27 [ 239.231908][ T3532] nci: nci_rf_intf_activated_ntf_packet: unsupported activation_rf_tech_and_mode 0x20 [ 239.252817][ T5846] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 239.425845][ T5846] usb 4-1: Using ep0 maxpacket: 16 [ 239.446805][ T5846] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 239.496797][ T5846] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 239.556027][ T5846] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 239.592444][ T5846] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 239.613802][ T5846] usb 4-1: Product: syz [ 239.622145][ T5846] usb 4-1: Manufacturer: syz [ 239.630762][ T5846] usb 4-1: SerialNumber: syz [ 239.660953][ T5846] usb 4-1: config 0 descriptor?? [ 239.683311][ T5846] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 239.717765][ T5846] em28xx 4-1:0.0: Audio interface 0 found (Vendor Class) [ 239.984152][ T9755] netlink: 288 bytes leftover after parsing attributes in process `syz.4.936'. [ 240.019959][ T9755] sctp: [Deprecated]: syz.4.936 (pid 9755) Use of int in max_burst socket option. [ 240.019959][ T9755] Use struct sctp_assoc_value instead [ 240.195052][ T9] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 240.235134][ T5897] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 240.288228][ T5846] em28xx 4-1:0.0: unknown em28xx chip ID (172) [ 240.355089][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 240.362891][ T9] usb 3-1: config 0 has an invalid interface number: 196 but max is 0 [ 240.371666][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 240.383561][ T9] usb 3-1: config 0 has no interface number 0 [ 240.391055][ T9] usb 3-1: config 0 interface 196 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 240.402310][ T5897] usb 6-1: Using ep0 maxpacket: 16 [ 240.409470][ T9] usb 3-1: config 0 interface 196 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 240.424668][ T9] usb 3-1: config 0 interface 196 has no altsetting 0 [ 240.434173][ T5897] usb 6-1: unable to get BOS descriptor or descriptor too short [ 240.445965][ T5897] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 240.458025][ T9] usb 3-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 240.467450][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 240.476500][ T9] usb 3-1: Product: syz [ 240.481024][ T9] usb 3-1: Manufacturer: syz [ 240.488619][ T5897] usb 6-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 240.498874][ T5846] em28xx 4-1:0.0: Config register raw data: 0x72 [ 240.505493][ T5846] em28xx 4-1:0.0: I2S Audio (5 sample rate(s)) [ 240.511822][ T5897] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 240.520337][ T5846] em28xx 4-1:0.0: No AC97 audio processor [ 240.526518][ T9] usb 3-1: SerialNumber: syz [ 240.531258][ T5897] usb 6-1: Product: syz [ 240.538427][ T5897] usb 6-1: Manufacturer: syz [ 240.544508][ T9] usb 3-1: config 0 descriptor?? [ 240.551474][ T5897] usb 6-1: SerialNumber: syz [ 240.715291][ T5846] usb 4-1: USB disconnect, device number 61 [ 240.771005][ T9] ipheth 3-1:0.196: Unable to find endpoints [ 240.792675][ T9] usb 3-1: USB disconnect, device number 50 [ 240.810251][ T5897] usb 6-1: Audio class v2/v3 interfaces need an interface association [ 240.836792][ T5897] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 241.266583][ T5897] usb 6-1: USB disconnect, device number 28 [ 241.695018][ T5904] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 241.846324][ T5904] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 241.860152][ T5904] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 241.871256][ T5904] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 241.884676][ T5904] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 241.894062][ T5904] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 241.908127][ T5904] usb 4-1: config 0 descriptor?? [ 242.340488][ T5904] plantronics 0003:047F:FFFF.001B: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 242.938845][ T5897] usb 4-1: USB disconnect, device number 62 [ 243.124502][ T9761] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 243.318876][ T9811] netlink: 'syz.2.948': attribute type 10 has an invalid length. [ 243.337363][ T9815] netlink: 'syz.5.949': attribute type 10 has an invalid length. [ 243.349983][ T9811] team0: Device vxcan1 is of different type [ 243.380735][ T9815] netlink: 12 bytes leftover after parsing attributes in process `syz.5.949'. [ 243.575853][ T5897] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 243.649457][ T9831] netlink: 20 bytes leftover after parsing attributes in process `syz.2.952'. [ 243.735051][ T5897] usb 5-1: Using ep0 maxpacket: 32 [ 243.744119][ T5897] usb 5-1: config 0 has an invalid interface number: 196 but max is 0 [ 243.752809][ T5897] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 243.766607][ T5897] usb 5-1: config 0 has no interface number 0 [ 243.772805][ T5897] usb 5-1: config 0 interface 196 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 243.784168][ T5897] usb 5-1: config 0 interface 196 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 243.797515][ T5897] usb 5-1: config 0 interface 196 has no altsetting 0 [ 243.805387][ T24] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 243.809374][ T5897] usb 5-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 243.825010][ T5897] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 243.840765][ T5897] usb 5-1: Product: syz [ 243.847338][ T5897] usb 5-1: Manufacturer: syz [ 243.855060][ T5897] usb 5-1: SerialNumber: syz [ 243.867546][ T5897] usb 5-1: config 0 descriptor?? [ 243.985554][ T24] usb 4-1: Using ep0 maxpacket: 32 [ 243.993020][ T24] usb 4-1: config 0 has an invalid interface number: 67 but max is 0 [ 244.001641][ T24] usb 4-1: config 0 has no interface number 0 [ 244.012027][ T24] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 244.022941][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 244.031275][ T24] usb 4-1: Product: syz [ 244.036223][ T24] usb 4-1: Manufacturer: syz [ 244.040868][ T24] usb 4-1: SerialNumber: syz [ 244.051695][ T24] usb 4-1: config 0 descriptor?? [ 244.081458][ T5897] ipheth 5-1:0.196: Unable to find endpoints [ 244.098974][ T5897] usb 5-1: USB disconnect, device number 31 [ 244.136287][ T5846] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 244.285072][ T5846] usb 3-1: Using ep0 maxpacket: 16 [ 244.292465][ T5846] usb 3-1: unable to get BOS descriptor or descriptor too short [ 244.303370][ T5846] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 244.322084][ T5846] usb 3-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 244.332458][ T5846] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 244.342907][ T5846] usb 3-1: Product: syz [ 244.352066][ T5846] usb 3-1: Manufacturer: syz [ 244.358203][ T5846] usb 3-1: SerialNumber: syz [ 244.464211][ T24] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 244.483113][ T24] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 244.578302][ T5846] usb 3-1: Audio class v2/v3 interfaces need an interface association [ 244.587512][ T5846] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 244.867923][ T9863] capability: warning: `syz.4.959' uses 32-bit capabilities (legacy support in use) [ 245.029935][ T5846] usb 3-1: USB disconnect, device number 51 [ 245.087330][ T6016] udevd[6016]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 245.816096][ T946] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 246.007844][ T946] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 246.019655][ T946] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 246.031586][ T946] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 246.049134][ T946] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 246.060383][ T946] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 246.075888][ T946] usb 3-1: config 0 descriptor?? [ 246.085293][ T5846] usb 5-1: new low-speed USB device number 32 using dummy_hcd [ 246.247068][ T5846] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 246.255277][ T5846] usb 5-1: config 0 has no interface number 0 [ 246.261420][ T5846] usb 5-1: config 0 interface 1 altsetting 19 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 246.272709][ T5846] usb 5-1: config 0 interface 1 altsetting 19 endpoint 0x81 has invalid wMaxPacketSize 0 [ 246.282638][ T5846] usb 5-1: config 0 interface 1 has no altsetting 0 [ 246.291605][ T5846] usb 5-1: New USB device found, idVendor=2179, idProduct=0053, bcdDevice= 0.00 [ 246.300816][ T5846] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 246.311303][ T5846] usb 5-1: config 0 descriptor?? [ 246.508834][ T946] plantronics 0003:047F:FFFF.001C: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 246.932632][ T5846] uclogic 0003:2179:0053.001D: failed retrieving string descriptor #100: -71 [ 246.947308][ T5846] uclogic 0003:2179:0053.001D: failed retrieving pen parameters: -71 [ 246.956770][ T5846] uclogic 0003:2179:0053.001D: pen probing failed: -71 [ 246.963701][ T5846] uclogic 0003:2179:0053.001D: failed probing parameters: -71 [ 246.971551][ T5846] uclogic 0003:2179:0053.001D: probe with driver uclogic failed with error -71 [ 246.985670][ T5846] usb 5-1: USB disconnect, device number 32 [ 247.107783][ T5931] usb 3-1: USB disconnect, device number 52 [ 247.749435][ T9855] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 247.762042][ T9878] FAULT_INJECTION: forcing a failure. [ 247.762042][ T9878] name failslab, interval 1, probability 0, space 0, times 0 [ 247.819491][ T9878] CPU: 1 UID: 0 PID: 9878 Comm: syz.4.963 Tainted: G L syzkaller #0 PREEMPT(full) [ 247.819525][ T9878] Tainted: [L]=SOFTLOCKUP [ 247.819532][ T9878] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 247.819549][ T9878] Call Trace: [ 247.819558][ T9878] [ 247.819567][ T9878] dump_stack_lvl+0xe8/0x150 [ 247.819602][ T9878] should_fail_ex+0x412/0x560 [ 247.819629][ T9878] should_failslab+0xa8/0x100 [ 247.819653][ T9878] __kmalloc_node_track_caller_noprof+0xeb/0x7b0 [ 247.819686][ T9878] ? kobject_set_name_vargs+0x61/0x110 [ 247.819716][ T9878] kvasprintf+0xeb/0x1a0 [ 247.819746][ T9878] ? __pfx_kvasprintf+0x10/0x10 [ 247.819774][ T9878] ? __mutex_lock+0x320/0x1420 [ 247.819793][ T9878] ? lruvec_stat_mod_folio+0x6e/0x3e0 [ 247.819823][ T9878] ? kvasprintf_const+0xe1/0x240 [ 247.819851][ T9878] kobject_set_name_vargs+0x61/0x110 [ 247.819875][ T9878] dev_set_name+0xe2/0x140 [ 247.819899][ T9878] ? __pfx_netdev_run_todo+0x10/0x10 [ 247.819928][ T9878] ? __pfx_dev_set_name+0x10/0x10 [ 247.819952][ T9878] ? kstrndup+0x80/0x160 [ 247.819974][ T9878] ? genl_family_rcv_msg_doit+0x22a/0x330 [ 247.820005][ T9878] ? wiphy_new_nm+0x625/0x19e0 [ 247.820034][ T9878] ? netlink_rcv_skb+0x232/0x4b0 [ 247.820068][ T9878] ? genl_rcv+0x28/0x40 [ 247.820264][ T9878] wiphy_new_nm+0x7a1/0x19e0 [ 247.820282][ T9878] ? ieee80211_alloc_hw_nm+0x935/0x1fa0 [ 247.820301][ T9878] ? __pfx_ieee80211_emulate_remove_chanctx+0x10/0x10 [ 247.820320][ T9878] ieee80211_alloc_hw_nm+0x3f3/0x1fa0 [ 247.820337][ T9878] ? __pfx_ieee80211_emulate_add_chanctx+0x10/0x10 [ 247.820358][ T9878] mac80211_hwsim_new_radio+0x1e8/0x5ba0 [ 247.820394][ T9878] ? rcu_is_watching+0x15/0xb0 [ 247.820415][ T9878] ? trace_kmalloc+0x2a/0x110 [ 247.820452][ T9878] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 247.820469][ T9878] ? kstrndup+0xbf/0x160 [ 247.820492][ T9878] hwsim_new_radio_nl+0xf6a/0x1c00 [ 247.820525][ T9878] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 247.820549][ T9878] ? rcu_is_watching+0x15/0xb0 [ 247.820563][ T9878] ? trace_kmalloc+0x2a/0x110 [ 247.820589][ T9878] ? __nla_parse+0x40/0x60 [ 247.820611][ T9878] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 247.820630][ T9878] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 247.820654][ T9878] genl_family_rcv_msg_doit+0x22a/0x330 [ 247.820678][ T9878] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 247.820705][ T9878] ? bpf_lsm_capable+0x9/0x20 [ 247.820722][ T9878] ? security_capable+0x7e/0x2c0 [ 247.820749][ T9878] genl_rcv_msg+0x61c/0x7a0 [ 247.820771][ T9878] ? __pfx_genl_rcv_msg+0x10/0x10 [ 247.820788][ T9878] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 247.820804][ T9878] ? __lock_acquire+0x6b5/0x2cf0 [ 247.821010][ T9878] netlink_rcv_skb+0x232/0x4b0 [ 247.821034][ T9878] ? __pfx_genl_rcv_msg+0x10/0x10 [ 247.821052][ T9878] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 247.821087][ T9878] ? down_read+0x270/0x2e0 [ 247.821102][ T9878] ? genl_rcv+0xd/0x40 [ 247.821119][ T9878] genl_rcv+0x28/0x40 [ 247.821135][ T9878] netlink_unicast+0x80f/0x9b0 [ 247.821163][ T9878] ? __pfx_netlink_unicast+0x10/0x10 [ 247.821185][ T9878] ? netlink_sendmsg+0x650/0xb40 [ 247.821197][ T9878] ? skb_put+0x11b/0x210 [ 247.821216][ T9878] netlink_sendmsg+0x813/0xb40 [ 247.821237][ T9878] ? __pfx_netlink_sendmsg+0x10/0x10 [ 247.821252][ T9878] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 247.821283][ T9878] ? __pfx_netlink_sendmsg+0x10/0x10 [ 247.821295][ T9878] sock_sendmsg_nosec+0x112/0x150 [ 247.821324][ T9878] ____sys_sendmsg+0x589/0x8c0 [ 247.821347][ T9878] ? __pfx_____sys_sendmsg+0x10/0x10 [ 247.821370][ T9878] ? import_iovec+0x73/0xa0 [ 247.821391][ T9878] ___sys_sendmsg+0x2a5/0x360 [ 247.821412][ T9878] ? __pfx____sys_sendmsg+0x10/0x10 [ 247.821454][ T9878] ? __fget_files+0x2a/0x420 [ 247.821473][ T9878] ? __fget_files+0x3a0/0x420 [ 247.821499][ T9878] __x64_sys_sendmsg+0x1bd/0x2a0 [ 247.821517][ T9878] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 247.821540][ T9878] ? __pfx_ksys_write+0x10/0x10 [ 247.821563][ T9878] do_syscall_64+0x14d/0xf80 [ 247.821576][ T9878] ? trace_irq_disable+0x3b/0x150 [ 247.821593][ T9878] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 247.821608][ T9878] ? clear_bhb_loop+0x40/0x90 [ 247.821625][ T9878] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 247.821640][ T9878] RIP: 0033:0x7f595a59c799 [ 247.821655][ T9878] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 247.821667][ T9878] RSP: 002b:00007f59587f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 247.821683][ T9878] RAX: ffffffffffffffda RBX: 00007f595a815fa0 RCX: 00007f595a59c799 [ 247.821693][ T9878] RDX: 0000000000040000 RSI: 0000200000000040 RDI: 0000000000000004 [ 247.821703][ T9878] RBP: 00007f59587f6090 R08: 0000000000000000 R09: 0000000000000000 [ 247.821711][ T9878] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 247.821719][ T9878] R13: 00007f595a816038 R14: 00007f595a815fa0 R15: 00007ffe0a627ed8 [ 247.821748][ T9878] [ 248.549062][ T9896] netlink: 'syz.4.967': attribute type 1 has an invalid length. [ 248.585232][ T24] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000011c: -71 [ 248.596985][ T24] smsc95xx 4-1:0.67: probe with driver smsc95xx failed with error -71 [ 248.612405][ T24] usb 4-1: USB disconnect, device number 63 [ 248.617360][ T10] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 248.785842][ T10] usb 6-1: Using ep0 maxpacket: 32 [ 248.797709][ T10] usb 6-1: config 0 has an invalid interface number: 196 but max is 0 [ 248.807430][ T10] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 248.831718][ T10] usb 6-1: config 0 has no interface number 0 [ 248.853406][ T10] usb 6-1: config 0 interface 196 altsetting 1 endpoint 0x2 has invalid maxpacket 33285, setting to 1024 [ 248.886687][ T10] usb 6-1: config 0 interface 196 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 248.926699][ T10] usb 6-1: config 0 interface 196 has no altsetting 0 [ 248.962839][ T10] usb 6-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 248.981505][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 248.997469][ T10] usb 6-1: Product: syz [ 249.012017][ T10] usb 6-1: Manufacturer: syz [ 249.018986][ T10] usb 6-1: SerialNumber: syz [ 249.032545][ T10] usb 6-1: config 0 descriptor?? [ 249.041532][ T24] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 249.208439][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 249.230962][ T24] usb 4-1: unable to get BOS descriptor or descriptor too short [ 249.241318][ T24] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 249.263930][ T10] ipheth 6-1:0.196: Unable to find endpoints [ 249.264639][ T24] usb 4-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 249.280680][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 249.326384][ T24] usb 4-1: Product: syz [ 249.336931][ T10] usb 6-1: USB disconnect, device number 29 [ 249.353718][ T24] usb 4-1: Manufacturer: syz [ 249.366625][ T9] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 249.380381][ T24] usb 4-1: SerialNumber: syz [ 249.526877][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 249.538831][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 249.549181][ T9] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 249.562363][ T9] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 249.571534][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 249.582181][ T9] usb 5-1: config 0 descriptor?? [ 249.620512][ T24] usb 4-1: Audio class v2/v3 interfaces need an interface association [ 249.629672][ T24] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 250.014582][ T9] plantronics 0003:047F:FFFF.001E: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 250.084146][ T24] usb 4-1: USB disconnect, device number 64 [ 250.608870][ T24] usb 5-1: USB disconnect, device number 33 [ 252.180395][ T9920] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 252.776530][ T9] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 252.965464][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 252.983432][ T9] usb 4-1: config 0 has an invalid interface number: 196 but max is 0 [ 252.996922][ T9] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 253.007418][ T9] usb 4-1: config 0 has no interface number 0 [ 253.013591][ T9] usb 4-1: config 0 interface 196 altsetting 1 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 253.028454][ T9] usb 4-1: config 0 interface 196 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 253.050464][ T5904] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 253.056565][ T9] usb 4-1: config 0 interface 196 has no altsetting 0 [ 253.078509][ T9] usb 4-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 253.094978][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 253.118940][ T9] usb 4-1: Product: syz [ 253.135001][ T9] usb 4-1: Manufacturer: syz [ 253.139793][ T9] usb 4-1: SerialNumber: syz [ 253.152105][ T9] usb 4-1: config 0 descriptor?? [ 253.214988][ T5904] usb 6-1: Using ep0 maxpacket: 16 [ 253.228805][ T5904] usb 6-1: unable to get BOS descriptor or descriptor too short [ 253.248562][ T5904] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 253.276345][ T5904] usb 6-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 253.291674][ T5904] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 253.306434][ T5904] usb 6-1: Product: syz [ 253.315946][ T5904] usb 6-1: Manufacturer: syz [ 253.327288][ T5904] usb 6-1: SerialNumber: syz [ 253.365849][ T9] ipheth 4-1:0.196: Unable to find endpoints [ 253.385520][ T9] usb 4-1: USB disconnect, device number 65 [ 253.464987][ T24] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 253.551707][ T5904] usb 6-1: Audio class v2/v3 interfaces need an interface association [ 253.560501][ T5904] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 253.626563][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 253.637863][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 253.648811][ T24] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 253.662192][ T24] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 253.672912][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 253.684109][ T24] usb 3-1: config 0 descriptor?? [ 254.016863][ T5904] usb 6-1: USB disconnect, device number 30 [ 254.064287][ T6016] udevd[6016]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 254.120332][ T24] plantronics 0003:047F:FFFF.001F: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 254.585002][ T5904] usb 4-1: new full-speed USB device number 66 using dummy_hcd [ 254.747676][ T5904] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 254.756226][ T5904] usb 4-1: config 179 has no interface number 0 [ 254.762553][ T5904] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 64 [ 254.774244][ T5904] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 254.785955][ T5904] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid wMaxPacketSize 0 [ 254.801438][ T5904] usb 4-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 254.814851][ T5904] usb 4-1: config 179 interface 65 has no altsetting 0 [ 254.821771][ T5904] usb 4-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 254.830850][ T5904] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 254.842575][T10005] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 254.868853][ T5904] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:179.65/input/input18 [ 254.918177][ T5904] usb 3-1: USB disconnect, device number 53 [ 255.162221][T10012] netlink: 128 bytes leftover after parsing attributes in process `syz.3.992'. [ 255.541953][T10017] netlink: 4 bytes leftover after parsing attributes in process `syz.2.996'. [ 255.555808][T10017] openvswitch: netlink: nsh attr 1 has unexpected len 0 expected 8 [ 255.569538][T10017] netlink: 4 bytes leftover after parsing attributes in process `syz.2.996'. [ 255.579801][T10017] openvswitch: netlink: nsh attr 1 has unexpected len 0 expected 8 [ 255.590206][T10017] netlink: 4 bytes leftover after parsing attributes in process `syz.2.996'. [ 255.599616][T10017] openvswitch: netlink: nsh attr 1 has unexpected len 0 expected 8 [ 255.615380][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.621851][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.320559][ T9988] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 256.400176][ T9] usb 4-1: USB disconnect, device number 66 [ 256.400191][ C1] xpad 4-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 256.755011][ T24] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 256.915521][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 256.922612][ T24] usb 3-1: config 0 has an invalid interface number: 196 but max is 0 [ 256.931107][ T24] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 256.942597][ T24] usb 3-1: config 0 has no interface number 0 [ 256.946045][ T9] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 256.951428][ T24] usb 3-1: config 0 interface 196 altsetting 1 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 256.970677][ T24] usb 3-1: config 0 interface 196 altsetting 1 endpoint 0x2 has invalid wMaxPacketSize 0 [ 256.991519][ T24] usb 3-1: config 0 interface 196 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 257.024104][ T24] usb 3-1: config 0 interface 196 has no altsetting 0 [ 257.050862][ T24] usb 3-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 257.079353][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 257.106892][ T24] usb 3-1: Product: syz [ 257.112744][ T24] usb 3-1: Manufacturer: syz [ 257.118583][ T24] usb 3-1: SerialNumber: syz [ 257.131795][ T24] usb 3-1: config 0 descriptor?? [ 257.146035][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 257.176427][ T9] usb 5-1: unable to get BOS descriptor or descriptor too short [ 257.209877][ T9] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 257.249930][ T9] usb 5-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 257.272647][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 257.284995][ T9] usb 5-1: Product: syz [ 257.292859][ T9] usb 5-1: Manufacturer: syz [ 257.302970][ T9] usb 5-1: SerialNumber: syz [ 257.359571][ T24] ipheth 3-1:0.196: Unable to find endpoints [ 257.389064][ T24] usb 3-1: USB disconnect, device number 54 [ 257.466996][ T946] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 257.557512][ T9] usb 5-1: Audio class v2/v3 interfaces need an interface association [ 257.574466][ T9] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 257.631588][ T946] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 257.648947][ T946] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 257.659941][ T946] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 257.677654][ T946] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 257.688798][ T946] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 257.704234][ T946] usb 4-1: config 0 descriptor?? [ 258.012690][ T9] usb 5-1: USB disconnect, device number 34 [ 258.151331][T10079] netlink: 14 bytes leftover after parsing attributes in process `syz.2.1008'. [ 258.169399][ T946] plantronics 0003:047F:FFFF.0020: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 258.527354][ T946] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 258.687836][ T946] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 258.699625][ T946] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 258.711487][ T946] usb 3-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 258.727001][ T946] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 258.745059][ T946] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 258.763511][ T946] usb 3-1: Product: syz [ 258.768977][ T946] usb 3-1: Manufacturer: syz [ 258.773684][ T946] usb 3-1: SerialNumber: syz [ 258.790198][ T946] cdc_mbim 3-1:1.0: skipping garbage [ 258.943836][ T24] usb 4-1: USB disconnect, device number 67 [ 259.593343][T10101] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1014'. [ 259.734214][T10110] netlink: 'syz.4.1015': attribute type 10 has an invalid length. [ 259.742284][T10110] team0: Device vxcan1 is up. Set it down before adding it as a team port [ 259.756825][T10109] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 260.377199][T10129] FAULT_INJECTION: forcing a failure. [ 260.377199][T10129] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 260.394403][T10129] CPU: 1 UID: 0 PID: 10129 Comm: syz.3.1019 Tainted: G L syzkaller #0 PREEMPT(full) [ 260.394427][T10129] Tainted: [L]=SOFTLOCKUP [ 260.394432][T10129] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 260.394441][T10129] Call Trace: [ 260.394446][T10129] [ 260.394452][T10129] dump_stack_lvl+0xe8/0x150 [ 260.394478][T10129] should_fail_ex+0x412/0x560 [ 260.394502][T10129] _copy_to_user+0x31/0xb0 [ 260.394523][T10129] simple_read_from_buffer+0xe1/0x170 [ 260.394547][T10129] proc_fail_nth_read+0x1bb/0x230 [ 260.394588][T10129] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 260.394619][T10129] ? rw_verify_area+0x2a6/0x4d0 [ 260.394652][T10129] ? tun_chr_write_iter+0x197/0x210 [ 260.394675][T10129] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 260.394696][T10129] vfs_read+0x20c/0xa70 [ 260.394717][T10129] ? fdget_pos+0x246/0x320 [ 260.394752][T10129] ? __pfx___mutex_lock+0x10/0x10 [ 260.394766][T10129] ? __pfx_vfs_read+0x10/0x10 [ 260.394787][T10129] ? __fget_files+0x2a/0x420 [ 260.394807][T10129] ? __fget_files+0x3a0/0x420 [ 260.394824][T10129] ? __fget_files+0x2a/0x420 [ 260.394846][T10129] ksys_read+0x150/0x270 [ 260.394859][T10129] ? __pfx_ksys_read+0x10/0x10 [ 260.394879][T10129] do_syscall_64+0x14d/0xf80 [ 260.394902][T10129] ? trace_irq_disable+0x3b/0x150 [ 260.394923][T10129] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 260.394941][T10129] ? clear_bhb_loop+0x40/0x90 [ 260.394962][T10129] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 260.394979][T10129] RIP: 0033:0x7fddfc55cfce [ 260.395008][T10129] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 260.395022][T10129] RSP: 002b:00007fddfd399fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 260.395041][T10129] RAX: ffffffffffffffda RBX: 00007fddfd39a6c0 RCX: 00007fddfc55cfce [ 260.395052][T10129] RDX: 000000000000000f RSI: 00007fddfd39a0a0 RDI: 0000000000000005 [ 260.395061][T10129] RBP: 00007fddfd39a090 R08: 0000000000000000 R09: 0000000000000000 [ 260.395078][T10129] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 260.395088][T10129] R13: 00007fddfc816038 R14: 00007fddfc815fa0 R15: 00007ffe1d023e68 [ 260.395113][T10129] [ 260.616026][T10063] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 260.685353][ T5846] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 260.845271][ T5846] usb 5-1: Using ep0 maxpacket: 16 [ 260.878875][ T5846] usb 5-1: unable to get BOS descriptor or descriptor too short [ 260.918752][ T5846] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 260.950958][ T5846] usb 5-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 260.961768][ T5846] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 260.979383][ T5846] usb 5-1: Product: syz [ 260.985457][ T5846] usb 5-1: Manufacturer: syz [ 260.990881][ T5846] usb 5-1: SerialNumber: syz [ 261.228347][ T5846] usb 5-1: Audio class v2/v3 interfaces need an interface association [ 261.255343][ T5846] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 261.328841][ T946] cdc_mbim 3-1:1.0: failed GET_NTB_PARAMETERS [ 261.355030][ T946] cdc_mbim 3-1:1.0: bind() failure [ 261.374471][ T946] cdc_ncm 3-1:1.1: CDC Union missing and no IAD found [ 261.389191][ T946] cdc_ncm 3-1:1.1: bind() failure [ 261.402175][ T946] usb 3-1: USB disconnect, device number 55 [ 261.454996][ T5904] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 261.466370][T10155] netlink: 'syz.2.1024': attribute type 3 has an invalid length. [ 261.495001][T10155] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1024'. [ 261.602706][T10158] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1026'. [ 261.607058][ T5846] usb 5-1: USB disconnect, device number 35 [ 261.649130][ T5904] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 261.675700][ T5904] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 261.692417][ T5904] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 261.719831][ T5904] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 261.729993][ T5904] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 261.753432][T10161] kvm: user requested TSC rate below hardware speed [ 261.762815][ T5904] usb 6-1: config 0 descriptor?? [ 261.779317][T10161] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer. [ 261.905055][ T946] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 262.071500][ T946] usb 3-1: device descriptor read/64, error -71 [ 262.207188][ T5904] plantronics 0003:047F:FFFF.0021: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 262.346847][ T946] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 262.495325][ T946] usb 3-1: device descriptor read/64, error -71 [ 262.618858][ T946] usb usb3-port1: attempt power cycle [ 262.789010][T10187] netlink: 104 bytes leftover after parsing attributes in process `syz.3.1032'. [ 262.975223][ T946] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 263.007483][ T5904] usb 6-1: USB disconnect, device number 31 [ 263.020815][ T946] usb 3-1: device descriptor read/8, error -71 [ 263.105092][ T5897] usb 4-1: new high-speed USB device number 68 using dummy_hcd [ 263.265193][ T946] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 263.266918][ T5897] usb 4-1: Using ep0 maxpacket: 16 [ 263.281379][ T5897] usb 4-1: unable to get BOS descriptor or descriptor too short [ 263.290566][ T5897] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 263.304272][ T5897] usb 4-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 263.313683][ T5897] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 263.321908][ T5897] usb 4-1: Product: syz [ 263.322356][ T946] usb 3-1: device descriptor read/8, error -71 [ 263.326168][ T5897] usb 4-1: Manufacturer: syz [ 263.326185][ T5897] usb 4-1: SerialNumber: syz [ 263.445402][ T946] usb usb3-port1: unable to enumerate USB device [ 263.568329][ T5897] usb 4-1: Audio class v2/v3 interfaces need an interface association [ 263.577318][ T5897] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 263.817982][ T5897] usb 4-1: USB disconnect, device number 68 [ 263.863829][ T6016] udevd[6016]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 264.871987][T10224] FAULT_INJECTION: forcing a failure. [ 264.871987][T10224] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 264.885296][T10224] CPU: 0 UID: 0 PID: 10224 Comm: syz.3.1045 Tainted: G L syzkaller #0 PREEMPT(full) [ 264.885317][T10224] Tainted: [L]=SOFTLOCKUP [ 264.885322][T10224] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 264.885330][T10224] Call Trace: [ 264.885336][T10224] [ 264.885341][T10224] dump_stack_lvl+0xe8/0x150 [ 264.885363][T10224] should_fail_ex+0x412/0x560 [ 264.885381][T10224] _copy_from_iter+0x1d3/0x1670 [ 264.885398][T10224] ? sock_alloc_send_pskb+0x896/0x990 [ 264.885418][T10224] ? __pfx__copy_from_iter+0x10/0x10 [ 264.885438][T10224] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 264.885456][T10224] skb_copy_datagram_from_iter+0xf5/0x710 [ 264.885476][T10224] ? skb_put+0x11b/0x210 [ 264.885490][T10224] tun_get_user+0xc5c/0x4300 [ 264.885525][T10224] ? __pfx_tun_get_user+0x10/0x10 [ 264.885545][T10224] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 264.885565][T10224] ? lockdep_hardirqs_on+0x7a/0x110 [ 264.885600][T10224] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 264.885619][T10224] ? save_netdev_trace_buffer+0x4e2/0x610 [ 264.885644][T10224] ? ref_tracker_alloc+0x35c/0x4c0 [ 264.885659][T10224] ? tun_chr_write_iter+0x60/0x210 [ 264.885677][T10224] ? vfs_write+0x61d/0xb90 [ 264.885688][T10224] ? ksys_write+0x150/0x270 [ 264.885699][T10224] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 264.885719][T10224] ? tun_get+0x1c/0x2f0 [ 264.885752][T10224] ? tun_get+0x1c/0x2f0 [ 264.885770][T10224] ? tun_get+0x1c/0x2f0 [ 264.885790][T10224] tun_chr_write_iter+0x113/0x210 [ 264.885810][T10224] vfs_write+0x61d/0xb90 [ 264.885826][T10224] ? __pfx_vfs_write+0x10/0x10 [ 264.885843][T10224] ? __fget_files+0x2a/0x420 [ 264.885882][T10224] ksys_write+0x150/0x270 [ 264.885896][T10224] ? __pfx_ksys_write+0x10/0x10 [ 264.885915][T10224] do_syscall_64+0x14d/0xf80 [ 264.885927][T10224] ? trace_irq_disable+0x3b/0x150 [ 264.885942][T10224] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 264.885955][T10224] ? clear_bhb_loop+0x40/0x90 [ 264.885971][T10224] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 264.885984][T10224] RIP: 0033:0x7fddfc59c799 [ 264.885997][T10224] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 264.886008][T10224] RSP: 002b:00007fddfd39a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 264.886021][T10224] RAX: ffffffffffffffda RBX: 00007fddfc815fa0 RCX: 00007fddfc59c799 [ 264.886031][T10224] RDX: 000000000000006e RSI: 0000200000000280 RDI: 0000000000000003 [ 264.886039][T10224] RBP: 00007fddfd39a090 R08: 0000000000000000 R09: 0000000000000000 [ 264.886048][T10224] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 264.886055][T10224] R13: 00007fddfc816038 R14: 00007fddfc815fa0 R15: 00007ffe1d023e68 [ 264.886075][T10224] [ 265.166083][T10171] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 265.255019][ T10] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 265.459229][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 265.471595][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 265.484014][ T10] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 265.497235][ T10] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 265.509156][ T5846] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 265.518023][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 265.529729][ T10] usb 3-1: config 0 descriptor?? [ 265.685415][ T5846] usb 5-1: Using ep0 maxpacket: 16 [ 265.702363][ T5846] usb 5-1: unable to get BOS descriptor or descriptor too short [ 265.728675][ T5846] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 265.740772][T10240] kvm: user requested TSC rate below hardware speed [ 265.752303][ T5846] usb 5-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 265.764066][T10240] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=64875003 (129750006 ns) > initial count (53591314 ns). Using initial count to start timer. [ 265.781486][ T5846] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 265.789850][ T5846] usb 5-1: Product: syz [ 265.795206][ T5846] usb 5-1: Manufacturer: syz [ 265.808815][ T5846] usb 5-1: SerialNumber: syz [ 265.935950][ T62] nci: nci_rf_intf_activated_ntf_packet: unsupported activation_rf_tech_and_mode 0x20 [ 266.008965][ T10] plantronics 0003:047F:FFFF.0022: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 266.071168][ T5846] usb 5-1: Audio class v2/v3 interfaces need an interface association [ 266.099008][ T5846] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 266.379811][T10259] netlink: 'syz.3.1058': attribute type 10 has an invalid length. [ 266.390307][T10259] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1058'. [ 266.515554][ T5846] usb 5-1: USB disconnect, device number 36 [ 266.771462][ T5846] usb 3-1: USB disconnect, device number 60 [ 267.232585][T10284] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3089888063 (3089888063 ns) > initial count (2126324423 ns). Using initial count to start timer. [ 267.695594][ T5904] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 267.885049][ T5904] usb 6-1: Using ep0 maxpacket: 16 [ 267.897337][ T5904] usb 6-1: unable to get BOS descriptor or descriptor too short [ 267.924528][ T5904] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 267.950654][ T5904] usb 6-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 267.963372][ T5904] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 267.972758][ T5904] usb 6-1: Product: syz [ 267.978732][ T5904] usb 6-1: Manufacturer: syz [ 267.988941][ T5904] usb 6-1: SerialNumber: syz [ 268.035132][ T5846] usb 3-1: new full-speed USB device number 61 using dummy_hcd [ 268.202213][ T5846] usb 3-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 268.217544][ T5904] usb 6-1: Audio class v2/v3 interfaces need an interface association [ 268.226102][ T5846] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 268.226535][ T5904] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 268.242768][ T5846] usb 3-1: Product: syz [ 268.250950][ T5846] usb 3-1: Manufacturer: syz [ 268.255619][ T5846] usb 3-1: SerialNumber: syz [ 268.425102][ T946] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 268.586708][ T946] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 268.598112][ T946] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 268.608020][ T946] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 268.621090][ T946] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 268.631263][ T946] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 268.640963][ T5846] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 268.651000][ T5846] usb 3-1: MIDIStreaming interface descriptor not found [ 268.662657][ T946] usb 5-1: config 0 descriptor?? [ 268.713303][ T5846] usb 3-1: USB disconnect, device number 61 [ 268.757626][ T5904] usb 6-1: USB disconnect, device number 32 [ 268.804454][ T6517] udevd[6517]: setting owner of /dev/bus/usb/003/061 to uid=0, gid=0 failed: No such file or directory [ 268.859406][ T5856] udevd[5856]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 269.097538][ T946] plantronics 0003:047F:FFFF.0023: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 269.271408][T10329] netlink: 88 bytes leftover after parsing attributes in process `syz.5.1082'. [ 269.409318][T10335] kvm: user requested TSC rate below hardware speed [ 269.421138][T10335] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=64875003 (129750006 ns) > initial count (53591314 ns). Using initial count to start timer. [ 269.903651][ T10] usb 5-1: USB disconnect, device number 37 [ 269.995638][ T946] usb 4-1: new high-speed USB device number 69 using dummy_hcd [ 270.145132][ T946] usb 4-1: Using ep0 maxpacket: 16 [ 270.152524][ T946] usb 4-1: unable to get BOS descriptor or descriptor too short [ 270.161613][ T946] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 270.176287][ T946] usb 4-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 270.185470][ T946] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 270.193513][ T946] usb 4-1: Product: syz [ 270.197795][ T946] usb 4-1: Manufacturer: syz [ 270.202435][ T946] usb 4-1: SerialNumber: syz [ 270.418542][ T946] usb 4-1: Audio class v2/v3 interfaces need an interface association [ 270.427318][ T946] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 270.752939][T10366] ======================================================= [ 270.752939][T10366] WARNING: The mand mount option has been deprecated and [ 270.752939][T10366] and is ignored by this kernel. Remove the mand [ 270.752939][T10366] option from the mount to silence this warning. [ 270.752939][T10366] ======================================================= [ 270.811908][T10366] evm: overlay not supported [ 270.911249][ T946] usb 4-1: USB disconnect, device number 69 [ 271.008184][ T6016] udevd[6016]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 271.415958][ T946] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 271.598090][ T946] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 271.637348][ T946] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 271.678091][ T946] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 271.738502][ T946] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 271.760452][ T946] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 271.785757][ T946] usb 3-1: config 0 descriptor?? [ 271.937312][ T5846] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 272.061510][T10409] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 272.112985][ T5846] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 272.157204][ T5846] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 272.167942][ T5846] usb 6-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 272.179644][ T5846] usb 6-1: Product: syz [ 272.187240][T10413] FAULT_INJECTION: forcing a failure. [ 272.187240][T10413] name failslab, interval 1, probability 0, space 0, times 0 [ 272.189795][ T5846] usb 6-1: SerialNumber: syz [ 272.202797][T10413] CPU: 1 UID: 0 PID: 10413 Comm: syz.4.1113 Tainted: G L syzkaller #0 PREEMPT(full) [ 272.202867][T10413] Tainted: [L]=SOFTLOCKUP [ 272.202879][T10413] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 272.202912][T10413] Call Trace: [ 272.202929][T10413] [ 272.202947][T10413] dump_stack_lvl+0xe8/0x150 [ 272.203051][T10413] should_fail_ex+0x412/0x560 [ 272.203126][T10413] should_failslab+0xa8/0x100 [ 272.203172][T10413] ? alloc_empty_file+0x55/0x1d0 [ 272.203226][T10413] kmem_cache_alloc_noprof+0x87/0x650 [ 272.203314][T10413] alloc_empty_file+0x55/0x1d0 [ 272.203369][T10413] alloc_file_pseudo+0x155/0x240 [ 272.203431][T10413] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 272.203516][T10413] anon_inode_getfile+0xc5/0x1a0 [ 272.203621][T10413] sync_file_ioctl+0xc69/0x1170 [ 272.203724][T10413] ? __pfx_sync_file_ioctl+0x10/0x10 [ 272.203793][T10413] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 272.203901][T10413] ? __fget_files+0x2a/0x420 [ 272.204004][T10413] ? bpf_lsm_file_ioctl+0x9/0x20 [ 272.204057][T10413] ? __pfx_sync_file_ioctl+0x10/0x10 [ 272.204142][T10413] __se_sys_ioctl+0xfc/0x170 [ 272.204204][T10413] do_syscall_64+0x14d/0xf80 [ 272.204274][T10413] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 272.204326][T10413] ? clear_bhb_loop+0x40/0x90 [ 272.204396][T10413] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 272.204449][T10413] RIP: 0033:0x7f595a59c799 [ 272.204501][T10413] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 272.204546][T10413] RSP: 002b:00007f59587f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 272.204606][T10413] RAX: ffffffffffffffda RBX: 00007f595a815fa0 RCX: 00007f595a59c799 [ 272.204647][T10413] RDX: 0000200000000340 RSI: 00000000c0303e03 RDI: 0000000000000006 [ 272.204682][T10413] RBP: 00007f59587f6090 R08: 0000000000000000 R09: 0000000000000000 [ 272.204752][T10413] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 272.204764][T10413] R13: 00007f595a816038 R14: 00007f595a815fa0 R15: 00007ffe0a627ed8 [ 272.204803][T10413] [ 272.365430][ T5931] usb 4-1: new full-speed USB device number 70 using dummy_hcd [ 272.426232][ T946] plantronics 0003:047F:FFFF.0024: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 272.693022][ T5931] usb 4-1: unable to get BOS descriptor or descriptor too short [ 272.703575][ T5931] usb 4-1: not running at top speed; connect to a high speed hub [ 272.713578][ T5928] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 272.728493][ T5931] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 272.737969][ T5931] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 272.746395][ T5931] usb 4-1: Product: syz [ 272.750618][ T5931] usb 4-1: Manufacturer: syz [ 272.755723][ T5931] usb 4-1: SerialNumber: syz [ 272.865571][ T5928] usb 5-1: Using ep0 maxpacket: 16 [ 272.873632][ T5928] usb 5-1: unable to get BOS descriptor or descriptor too short [ 272.887765][ T5928] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 272.905207][ T5928] usb 5-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 272.915360][ T5928] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 272.924527][ T5928] usb 5-1: Product: syz [ 272.930145][ T5928] usb 5-1: Manufacturer: syz [ 272.934829][ T5928] usb 5-1: SerialNumber: syz [ 272.985754][ T5931] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 273.001053][ T5931] usb 4-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 273.032297][ T5853] Bluetooth: hci3: command 0x0406 tx timeout [ 273.104079][T10392] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 273.113535][ T5931] usb 4-1: USB disconnect, device number 70 [ 273.138463][T10392] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 273.188034][ T5928] usb 5-1: Audio class v2/v3 interfaces need an interface association [ 273.201121][ T5928] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 273.219185][ T6517] udevd[6517]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 273.482919][ T5928] usb 5-1: USB disconnect, device number 38 [ 273.577829][T10392] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1107'. [ 273.588059][ T6016] udevd[6016]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 273.621476][ T5846] cdc_ncm 6-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 273.633628][ T5846] cdc_ncm 6-1:1.0: dwNtbInMaxSize=0 is too small. Using 2048 [ 273.650624][ T5846] cdc_ncm 6-1:1.0: setting rx_max = 2048 [ 273.891404][ T5846] cdc_ncm 6-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.5-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 273.951811][ T5846] usb 6-1: USB disconnect, device number 33 [ 274.002350][ T5846] cdc_ncm 6-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.5-1, CDC NCM (NO ZLP) [ 274.231721][ T946] usb 3-1: USB disconnect, device number 62 [ 274.243110][ T5928] usb 4-1: new high-speed USB device number 71 using dummy_hcd [ 274.427086][ T5928] usb 4-1: Using ep0 maxpacket: 8 [ 274.461296][ T5928] usb 4-1: config index 0 descriptor too short (expected 6427, got 27) [ 274.492814][ T5928] usb 4-1: config 0 has an invalid interface number: 21 but max is 0 [ 274.548327][ T5928] usb 4-1: config 0 has no interface number 0 [ 274.575046][ T5928] usb 4-1: config 0 interface 21 altsetting 0 has an endpoint descriptor with address 0x17, changing to 0x7 [ 274.622896][ T5928] usb 4-1: config 0 interface 21 altsetting 0 endpoint 0x7 has an invalid bInterval 0, changing to 7 [ 274.650746][ T5928] usb 4-1: config 0 interface 21 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 274.663603][ T5928] usb 4-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 274.678283][ T5928] usb 4-1: New USB device strings: Mfr=31, Product=1, SerialNumber=0 [ 274.687009][ T5928] usb 4-1: Product: syz [ 274.691308][ T5928] usb 4-1: Manufacturer: syz [ 274.738303][ T5928] usb 4-1: config 0 descriptor?? [ 274.919109][T10478] x_tables: unsorted entry at hook 1 [ 274.964134][ T5928] usb 4-1: USB disconnect, device number 71 [ 275.034993][ T9] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 275.090841][T10484] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1125'. [ 275.204989][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 275.230551][ T9] usb 3-1: unable to get BOS descriptor or descriptor too short [ 275.251567][ T9] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 275.267015][ T9] usb 3-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 275.276820][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 275.284994][ T9] usb 3-1: Product: syz [ 275.289569][ T9] usb 3-1: Manufacturer: syz [ 275.294273][ T9] usb 3-1: SerialNumber: syz [ 275.537665][ T9] usb 3-1: Audio class v2/v3 interfaces need an interface association [ 275.557486][ T9] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 275.688966][ T9] usb 3-1: USB disconnect, device number 63 [ 275.725082][ T10] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 275.887289][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 275.903836][T10512] binder: 10510:10512 ioctl c0306201 2000000004c0 returned -14 [ 275.905960][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 275.939843][ T10] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 275.961715][ T10] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 275.972888][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 275.999582][ T10] usb 5-1: config 0 descriptor?? [ 276.293693][T10521] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1133'. [ 276.448430][ T10] plantronics 0003:047F:FFFF.0025: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 276.479062][T10521] NFSD: Failed to start, no listeners configured. [ 277.026922][T10538] netlink: 'syz.5.1138': attribute type 3 has an invalid length. [ 277.040240][T10538] xt_l2tp: missing protocol rule (udp|l2tpip) [ 277.073803][T10540] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1139'. [ 277.165724][T10545] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1140'. [ 277.278887][T10549] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1143'. [ 278.147637][T10577] raw_sendmsg: syz.3.1150 forgot to set AF_INET. Fix it! [ 278.155965][ T5163] Bluetooth: hci4: command 0x0406 tx timeout [ 278.529336][T10594] trusted_key: encrypted_key: master key parameter 'user:' is invalid [ 278.537678][ T10] usb 5-1: USB disconnect, device number 39 [ 278.590470][T10598] overlayfs: failed to resolve './file0': -2 [ 278.779827][T10604] netlink: 'syz.3.1159': attribute type 10 has an invalid length. [ 278.800446][T10607] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1160'. [ 279.085404][T10615] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 279.369331][T10635] FAULT_INJECTION: forcing a failure. [ 279.369331][T10635] name failslab, interval 1, probability 0, space 0, times 0 [ 279.385621][T10635] CPU: 1 UID: 0 PID: 10635 Comm: syz.5.1170 Tainted: G L syzkaller #0 PREEMPT(full) [ 279.385650][T10635] Tainted: [L]=SOFTLOCKUP [ 279.385656][T10635] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 279.385666][T10635] Call Trace: [ 279.385673][T10635] [ 279.385680][T10635] dump_stack_lvl+0xe8/0x150 [ 279.385710][T10635] should_fail_ex+0x412/0x560 [ 279.385735][T10635] should_failslab+0xa8/0x100 [ 279.385756][T10635] __kvmalloc_node_noprof+0x178/0x8a0 [ 279.385774][T10635] ? rhashtable_init_noprof+0x52e/0xa70 [ 279.385795][T10635] ? rhashtable_init_noprof+0x12d/0xa70 [ 279.385819][T10635] rhashtable_init_noprof+0x52e/0xa70 [ 279.385840][T10635] ? __init_waitqueue_head+0xa9/0x150 [ 279.385865][T10635] rhltable_init_noprof+0x1e/0x60 [ 279.385886][T10635] sta_info_init+0x28/0x130 [ 279.385913][T10635] ieee80211_alloc_hw_nm+0x83b/0x1fa0 [ 279.385932][T10635] ? __pfx_ieee80211_emulate_add_chanctx+0x10/0x10 [ 279.385958][T10635] mac80211_hwsim_new_radio+0x1e8/0x5ba0 [ 279.385994][T10635] ? rcu_is_watching+0x15/0xb0 [ 279.386012][T10635] ? trace_kmalloc+0x2a/0x110 [ 279.386043][T10635] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 279.386060][T10635] ? kstrndup+0xbf/0x160 [ 279.386086][T10635] hwsim_new_radio_nl+0xf6a/0x1c00 [ 279.386125][T10635] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 279.386153][T10635] ? rcu_is_watching+0x15/0xb0 [ 279.386170][T10635] ? trace_kmalloc+0x2a/0x110 [ 279.386200][T10635] ? __nla_parse+0x40/0x60 [ 279.386226][T10635] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 279.386247][T10635] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 279.386275][T10635] genl_family_rcv_msg_doit+0x22a/0x330 [ 279.386301][T10635] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 279.386332][T10635] ? bpf_lsm_capable+0x9/0x20 [ 279.386350][T10635] ? security_capable+0x7e/0x2c0 [ 279.386387][T10635] genl_rcv_msg+0x61c/0x7a0 [ 279.386413][T10635] ? __pfx_genl_rcv_msg+0x10/0x10 [ 279.386432][T10635] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 279.386452][T10635] ? __lock_acquire+0x6b5/0x2cf0 [ 279.386487][T10635] netlink_rcv_skb+0x232/0x4b0 [ 279.386514][T10635] ? __pfx_genl_rcv_msg+0x10/0x10 [ 279.386536][T10635] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 279.386574][T10635] ? down_read+0x270/0x2e0 [ 279.386591][T10635] ? genl_rcv+0xd/0x40 [ 279.386611][T10635] genl_rcv+0x28/0x40 [ 279.386629][T10635] netlink_unicast+0x80f/0x9b0 [ 279.386660][T10635] ? __pfx_netlink_unicast+0x10/0x10 [ 279.386686][T10635] ? netlink_sendmsg+0x650/0xb40 [ 279.386701][T10635] ? skb_put+0x11b/0x210 [ 279.386722][T10635] netlink_sendmsg+0x813/0xb40 [ 279.386746][T10635] ? __pfx_netlink_sendmsg+0x10/0x10 [ 279.386764][T10635] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 279.386803][T10635] ? __pfx_netlink_sendmsg+0x10/0x10 [ 279.386818][T10635] sock_sendmsg_nosec+0x112/0x150 [ 279.386845][T10635] ____sys_sendmsg+0x589/0x8c0 [ 279.386872][T10635] ? __pfx_____sys_sendmsg+0x10/0x10 [ 279.386899][T10635] ? import_iovec+0x73/0xa0 [ 279.386923][T10635] ___sys_sendmsg+0x2a5/0x360 [ 279.386947][T10635] ? __pfx____sys_sendmsg+0x10/0x10 [ 279.386999][T10635] ? __fget_files+0x2a/0x420 [ 279.387022][T10635] ? __fget_files+0x3a0/0x420 [ 279.387054][T10635] __x64_sys_sendmsg+0x1bd/0x2a0 [ 279.387076][T10635] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 279.387105][T10635] ? __pfx_ksys_write+0x10/0x10 [ 279.387133][T10635] do_syscall_64+0x14d/0xf80 [ 279.387149][T10635] ? trace_irq_disable+0x3b/0x150 [ 279.387169][T10635] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 279.387187][T10635] ? clear_bhb_loop+0x40/0x90 [ 279.387208][T10635] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 279.387225][T10635] RIP: 0033:0x7f0fe9d9c799 [ 279.387242][T10635] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 279.387256][T10635] RSP: 002b:00007f0feac6c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 279.387274][T10635] RAX: ffffffffffffffda RBX: 00007f0fea015fa0 RCX: 00007f0fe9d9c799 [ 279.387286][T10635] RDX: 0000000000040000 RSI: 0000200000000040 RDI: 0000000000000004 [ 279.387297][T10635] RBP: 00007f0feac6c090 R08: 0000000000000000 R09: 0000000000000000 [ 279.387307][T10635] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 279.387317][T10635] R13: 00007f0fea016038 R14: 00007f0fea015fa0 R15: 00007ffd68dc4f98 [ 279.387345][T10635] [ 279.466956][ T10] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 279.822140][ T5846] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 279.907590][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 279.920605][ T10] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 279.935142][ T10] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 279.946817][ T10] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 279.964771][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 279.981125][T10638] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 279.992035][ T5846] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 280.018888][ T10] usb 3-1: Product: syz [ 280.023218][ T5846] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 280.038113][ T10] usb 3-1: Manufacturer: syz [ 280.048409][ T10] usb 3-1: SerialNumber: syz [ 280.054670][ T5846] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 280.083430][ T10] usb 3-1: 0:2 : does not exist [ 280.093462][ T5846] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 280.116338][ T5846] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 280.157868][ T5846] usb 5-1: config 0 descriptor?? [ 280.285286][T10627] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 280.294387][T10627] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 280.356113][ T5897] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 280.374872][ T10] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 280.436649][ T10] usb 3-1: USB disconnect, device number 64 [ 280.480413][ T6016] udevd[6016]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 280.536373][ T5897] usb 6-1: Using ep0 maxpacket: 32 [ 280.543579][ T5897] usb 6-1: config 0 has an invalid interface number: 67 but max is 0 [ 280.553276][ T5897] usb 6-1: config 0 has no interface number 0 [ 280.563408][ T5897] usb 6-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 280.599472][ T5846] plantronics 0003:047F:FFFF.0026: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 280.613456][ T5897] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 280.632555][ T5897] usb 6-1: Product: syz [ 280.646590][ T5897] usb 6-1: Manufacturer: syz [ 280.657423][ T5897] usb 6-1: SerialNumber: syz [ 280.675650][ T5897] usb 6-1: config 0 descriptor?? [ 280.812143][T10665] netlink: 'syz.3.1173': attribute type 1 has an invalid length. [ 281.108693][ T5897] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 281.141070][ T5897] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 282.036982][ T5897] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 282.048854][ T5897] smsc95xx 6-1:0.67: probe with driver smsc95xx failed with error -61 [ 282.225871][ T5897] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 282.269770][ T24] usb 5-1: USB disconnect, device number 40 [ 282.385357][ T5897] usb 3-1: Using ep0 maxpacket: 16 [ 282.411053][ T5897] usb 3-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 2.00 [ 282.444527][ T5897] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 282.471808][ T5897] usb 3-1: config 0 descriptor?? [ 282.496462][ T5897] ftdi_sio 3-1:0.0: FTDI USB Serial Device converter detected [ 282.717407][ T5897] usb 3-1: Detected FT232B [ 282.776387][ T24] usb 5-1: new full-speed USB device number 41 using dummy_hcd [ 282.952231][ T24] usb 5-1: not running at top speed; connect to a high speed hub [ 282.983283][ T24] usb 5-1: config 0 has an invalid interface number: 31 but max is 1 [ 283.003067][ T24] usb 5-1: config 0 has no interface number 1 [ 283.014186][ T24] usb 5-1: config 0 interface 0 has no altsetting 0 [ 283.037651][ T24] usb 5-1: config 0 interface 31 has no altsetting 0 [ 283.069111][ T24] usb 5-1: New USB device found, idVendor=05c6, idProduct=9245, bcdDevice=cd.be [ 283.097632][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 283.118641][ T24] usb 5-1: Product: syz [ 283.124130][ T24] usb 5-1: Manufacturer: syz [ 283.129435][ T24] usb 5-1: SerialNumber: syz [ 283.144466][ T5897] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 283.159310][ T24] usb 5-1: config 0 descriptor?? [ 283.173538][ T5897] usb 3-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 283.201586][ T5897] usb 3-1: USB disconnect, device number 65 [ 283.229359][ T5897] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 283.241165][ T5897] ftdi_sio 3-1:0.0: device disconnected [ 283.385779][ T24] usb 5-1: unknown number of interfaces: 2 [ 283.396285][ T24] usb 5-1: USB disconnect, device number 41 [ 284.117180][ T24] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 284.277238][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 284.296900][ T24] usb 4-1: unable to get BOS descriptor or descriptor too short [ 284.316089][ T24] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 284.342775][ T24] usb 4-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 284.362341][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 284.392999][ T24] usb 4-1: Product: syz [ 284.406673][ T24] usb 4-1: Manufacturer: syz [ 284.414453][ T24] usb 4-1: SerialNumber: syz [ 284.446421][ T5931] usb 6-1: USB disconnect, device number 34 [ 284.678196][T10811] ieee802154 phy0 wpan0: encryption failed: -90 [ 284.716500][ T24] usb 4-1: Audio class v2/v3 interfaces need an interface association [ 284.760734][ T24] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 284.817415][ T24] usb 4-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 284.920457][T10820] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1205'. [ 284.931947][ T24] usb 4-1: USB disconnect, device number 72 [ 285.041790][T10820] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1205'. [ 285.092230][ T10] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 285.255591][ T10] usb 6-1: Using ep0 maxpacket: 32 [ 285.276752][ T10] usb 6-1: config 0 has an invalid interface number: 196 but max is 0 [ 285.292599][ T10] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 285.311494][T10838] faux_driver vgem: [drm] Unknown color mode 127; guessing buffer size. [ 285.334063][ T10] usb 6-1: config 0 has no interface number 0 [ 285.344703][ T10] usb 6-1: config 0 interface 196 altsetting 1 endpoint 0x2 has an invalid bInterval 128, changing to 7 [ 285.394370][ T10] usb 6-1: config 0 interface 196 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 285.412843][ T10] usb 6-1: config 0 interface 196 has no altsetting 0 [ 285.424674][ T10] usb 6-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 285.438884][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 285.460572][ T10] usb 6-1: Product: syz [ 285.470371][ T10] usb 6-1: Manufacturer: syz [ 285.478955][ T10] usb 6-1: SerialNumber: syz [ 285.503043][ T10] usb 6-1: config 0 descriptor?? [ 285.615012][T10841] sp0: Synchronizing with TNC [ 285.683187][T10851] netlink: 'syz.2.1212': attribute type 10 has an invalid length. [ 285.698793][T10847] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.1210'. [ 285.715913][T10851] team0: Device vxcan1 is of different type [ 285.730631][ T10] ipheth 6-1:0.196: Unable to find endpoints [ 285.793314][ T10] usb 6-1: USB disconnect, device number 35 [ 286.148348][ T10] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 286.259527][T10868] netlink: 'syz.3.1216': attribute type 3 has an invalid length. [ 286.277731][T10868] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1216'. [ 286.356341][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 286.410858][ T10] usb 3-1: unable to get BOS descriptor or descriptor too short [ 286.456704][ T10] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 286.480504][ T10] usb 3-1: can't read configurations, error -71 [ 286.556252][T10873] kvm: user requested TSC rate below hardware speed [ 286.575420][T10873] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 286.725236][ T5897] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 286.777646][T10888] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1223'. [ 286.899148][ T5897] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 286.932157][ T5897] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 286.969868][ T5897] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 286.995825][ T5897] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 287.041256][T10871] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 287.067731][ T5897] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 287.313326][ T5897] usb 5-1: USB disconnect, device number 42 [ 287.335304][ T10] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 287.487975][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 287.526556][ T10] usb 3-1: unable to get BOS descriptor or descriptor too short [ 287.554171][ T10] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 287.572023][ T10] usb 3-1: can't read configurations, error -71 [ 287.587363][ T10] usb usb3-port1: attempt power cycle [ 288.117213][T10922] netlink: 264 bytes leftover after parsing attributes in process `syz.4.1235'. [ 288.130950][T10921] FAULT_INJECTION: forcing a failure. [ 288.130950][T10921] name failslab, interval 1, probability 0, space 0, times 0 [ 288.145075][T10921] CPU: 0 UID: 0 PID: 10921 Comm: syz.3.1234 Tainted: G L syzkaller #0 PREEMPT(full) [ 288.145106][T10921] Tainted: [L]=SOFTLOCKUP [ 288.145113][T10921] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 288.145125][T10921] Call Trace: [ 288.145134][T10921] [ 288.145143][T10921] dump_stack_lvl+0xe8/0x150 [ 288.145177][T10921] should_fail_ex+0x412/0x560 [ 288.145206][T10921] should_failslab+0xa8/0x100 [ 288.145227][T10921] ? dst_alloc+0x105/0x170 [ 288.145250][T10921] kmem_cache_alloc_noprof+0x87/0x650 [ 288.145285][T10921] ? __pfx_ip6_dst_gc+0x10/0x10 [ 288.145309][T10921] dst_alloc+0x105/0x170 [ 288.145338][T10921] ip6_pol_route+0xb08/0x13e0 [ 288.145362][T10921] ? ip6_pol_route+0x160/0x13e0 [ 288.145391][T10921] ? __pfx_ip6_pol_route+0x10/0x10 [ 288.145414][T10921] ? __lock_acquire+0x6b5/0x2cf0 [ 288.145447][T10921] ? __lock_acquire+0x6b5/0x2cf0 [ 288.145479][T10921] ? __lock_acquire+0x6b5/0x2cf0 [ 288.145514][T10921] fib6_rule_action+0xa02/0xc20 [ 288.145546][T10921] ? __pfx_fib6_rule_action+0x10/0x10 [ 288.145564][T10921] ? lock_acquire+0xf0/0x2e0 [ 288.145590][T10921] ? __lock_acquire+0x6b5/0x2cf0 [ 288.145614][T10921] ? fib6_rule_match+0x79a/0xa80 [ 288.145633][T10921] ? __pfx_fib6_rule_action+0x10/0x10 [ 288.145653][T10921] fib_rules_lookup+0x768/0xea0 [ 288.145673][T10921] ? fib_rules_lookup+0x9b/0xea0 [ 288.145694][T10921] ? __pfx_fib_rules_lookup+0x10/0x10 [ 288.145710][T10921] ? l3mdev_update_flow+0x29/0x640 [ 288.145728][T10921] ? l3mdev_update_flow+0x4d1/0x640 [ 288.145750][T10921] fib6_rule_lookup+0x1a0/0x740 [ 288.145770][T10921] ? __pfx_ip6_pol_route_input+0x10/0x10 [ 288.145791][T10921] ? __pfx_fib6_rule_lookup+0x10/0x10 [ 288.145815][T10921] ? __pfx_ip6_pol_route_input+0x10/0x10 [ 288.145837][T10921] ? ip6t_do_table+0x1df/0x1560 [ 288.145868][T10921] ip6_route_input+0x730/0xad0 [ 288.145893][T10921] ? __pfx_ip6_route_input+0x10/0x10 [ 288.145923][T10921] ? nf_nat_ipv6_in+0x203/0x2c0 [ 288.145959][T10921] ? ip6_rcv_finish_core+0x222/0x420 [ 288.145984][T10921] ip6_rcv_finish+0x141/0x280 [ 288.146013][T10921] NF_HOOK+0x336/0x3c0 [ 288.146026][T10921] ? skb_orphan+0x4f/0xd0 [ 288.146042][T10921] ? __pfx_ip6_rcv_finish+0x10/0x10 [ 288.146066][T10921] ? NF_HOOK+0x9e/0x3c0 [ 288.146080][T10921] ? __pfx_NF_HOOK+0x10/0x10 [ 288.146097][T10921] ? __pfx_ip6_rcv_finish+0x10/0x10 [ 288.146127][T10921] ? netif_receive_skb+0x102/0xc50 [ 288.146151][T10921] netif_receive_skb+0x278/0xc50 [ 288.146178][T10921] ? __pfx_netif_receive_skb+0x10/0x10 [ 288.146198][T10921] ? __lock_acquire+0x6b5/0x2cf0 [ 288.146227][T10921] ? tun_rx_batched+0x185/0x790 [ 288.146244][T10921] tun_rx_batched+0x1de/0x790 [ 288.146264][T10921] ? __pfx_tun_rx_batched+0x10/0x10 [ 288.146288][T10921] ? tun_get_user+0x2364/0x4300 [ 288.146312][T10921] ? __local_bh_enable_ip+0xd0/0x130 [ 288.146342][T10921] tun_get_user+0x2b8c/0x4300 [ 288.146374][T10921] ? tun_get_user+0x2757/0x4300 [ 288.146414][T10921] ? __pfx_tun_get_user+0x10/0x10 [ 288.146439][T10921] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 288.146464][T10921] ? lockdep_hardirqs_on+0x7a/0x110 [ 288.146481][T10921] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 288.146505][T10921] ? save_netdev_trace_buffer+0x4e2/0x610 [ 288.146536][T10921] ? ref_tracker_alloc+0x35c/0x4c0 [ 288.146556][T10921] ? tun_chr_write_iter+0x60/0x210 [ 288.146578][T10921] ? vfs_write+0x61d/0xb90 [ 288.146591][T10921] ? ksys_write+0x150/0x270 [ 288.146606][T10921] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 288.146630][T10921] ? tun_get+0x1c/0x2f0 [ 288.146659][T10921] ? tun_get+0x1c/0x2f0 [ 288.146683][T10921] ? tun_get+0x1c/0x2f0 [ 288.146711][T10921] tun_chr_write_iter+0x113/0x210 [ 288.146738][T10921] vfs_write+0x61d/0xb90 [ 288.146759][T10921] ? __pfx_vfs_write+0x10/0x10 [ 288.146783][T10921] ? __fget_files+0x2a/0x420 [ 288.146813][T10921] ksys_write+0x150/0x270 [ 288.146830][T10921] ? __pfx_ksys_write+0x10/0x10 [ 288.146855][T10921] do_syscall_64+0x14d/0xf80 [ 288.146870][T10921] ? trace_irq_disable+0x3b/0x150 [ 288.146889][T10921] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 288.146905][T10921] ? clear_bhb_loop+0x40/0x90 [ 288.146925][T10921] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 288.146941][T10921] RIP: 0033:0x7fddfc59c799 [ 288.146958][T10921] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 288.146984][T10921] RSP: 002b:00007fddfd39a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 288.147001][T10921] RAX: ffffffffffffffda RBX: 00007fddfc815fa0 RCX: 00007fddfc59c799 [ 288.147013][T10921] RDX: 000000000000006e RSI: 0000200000000280 RDI: 0000000000000003 [ 288.147024][T10921] RBP: 00007fddfd39a090 R08: 0000000000000000 R09: 0000000000000000 [ 288.147033][T10921] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 288.147042][T10921] R13: 00007fddfc816038 R14: 00007fddfc815fa0 R15: 00007ffe1d023e68 [ 288.147091][T10921] [ 289.088767][T10949] kvm: user requested TSC rate below hardware speed [ 289.097122][T10949] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=64875003 (129750006 ns) > initial count (53591314 ns). Using initial count to start timer. [ 289.195456][ T24] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 289.376741][ T24] usb 6-1: Using ep0 maxpacket: 16 [ 289.426723][ T24] usb 6-1: unable to get BOS descriptor or descriptor too short [ 289.445340][ T5931] usb 3-1: new high-speed USB device number 69 using dummy_hcd [ 289.466854][ T24] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 289.489086][ T24] usb 6-1: can't read configurations, error -71 [ 289.506884][T10972] nbd: must specify an index to disconnect [ 289.639579][ T5931] usb 3-1: unable to get BOS descriptor or descriptor too short [ 289.661488][ T5931] usb 3-1: config index 0 descriptor too short (expected 198, got 134) [ 289.683461][ T5931] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 289.708458][T10976] netlink: 'syz.3.1247': attribute type 10 has an invalid length. [ 289.719657][ T5931] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 289.740084][T10976] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1247'. [ 289.763884][ T5931] usb 3-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 289.774671][ T5931] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 289.792645][ T5931] usb 3-1: Product: syz [ 289.806724][ T5931] usb 3-1: Manufacturer: syz [ 289.811441][ T5931] usb 3-1: SerialNumber: syz [ 289.839646][ T5931] usb 3-1: 0:1 : does not exist [ 289.861655][ T5931] usb 3-1: unit 0 not found! [ 290.034803][ T5931] usb 3-1: USB disconnect, device number 69 [ 290.156191][ T946] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 290.325074][ T946] usb 5-1: Using ep0 maxpacket: 8 [ 290.331560][ T946] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 290.339766][ T946] usb 5-1: config 0 has no interface number 0 [ 290.347344][ T946] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 290.358259][ T946] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 290.370111][ T946] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 290.381218][ T946] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 290.399842][ T946] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 290.409248][ T946] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 290.419287][ T946] usb 5-1: config 0 descriptor?? [ 290.434142][ T946] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 290.572063][T10996] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3089888063 (3089888063 ns) > initial count (2126324423 ns). Using initial count to start timer. [ 290.635750][ T946] usb 5-1: USB disconnect, device number 43 [ 290.641758][ C1] ldusb 5-1:0.55: usb_submit_urb failed (-19) [ 290.651459][T10985] ldusb 5-1:0.55: Couldn't submit interrupt_out_urb -19 [ 290.681227][ T946] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 290.975007][ T9] usb 3-1: new high-speed USB device number 70 using dummy_hcd [ 291.063073][T11010] syzkaller1: entered allmulticast mode [ 291.135008][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 291.175802][ T9] usb 3-1: unable to get BOS descriptor or descriptor too short [ 291.222876][ T9] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 291.271495][ T9] usb 3-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 291.292830][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 291.310979][ T9] usb 3-1: Product: syz [ 291.325062][ T9] usb 3-1: Manufacturer: syz [ 291.331085][ T9] usb 3-1: SerialNumber: syz [ 291.534452][T11029] netlink: 88 bytes leftover after parsing attributes in process `syz.3.1265'. [ 291.703165][T11036] kvm: user requested TSC rate below hardware speed [ 291.714232][T11036] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=64875003 (129750006 ns) > initial count (53591314 ns). Using initial count to start timer. [ 291.767354][ T9] usb 3-1: Audio class v2/v3 interfaces need an interface association [ 291.785863][ T9] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 291.831198][ T9] usb 3-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 291.875465][ T946] usb 5-1: new full-speed USB device number 44 using dummy_hcd [ 291.908459][ T9] usb 3-1: USB disconnect, device number 70 [ 291.979771][ T6016] udevd[6016]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 292.057623][ T946] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 292.068788][ T946] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 137, setting to 64 [ 292.080348][ T946] usb 5-1: New USB device found, idVendor=056a, idProduct=4f00, bcdDevice= 0.ea [ 292.089678][ T946] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 292.110857][ T946] usb 5-1: config 0 descriptor?? [ 292.120070][T11032] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 292.160464][T11049] tipc: Started in network mode [ 292.166549][T11049] tipc: Node identity 4, cluster identity 4711 [ 292.172768][T11049] tipc: Node number set to 4 [ 292.243405][T11053] netlink: 'syz.5.1273': attribute type 11 has an invalid length. [ 292.260455][T11053] netlink: 'syz.5.1273': attribute type 58 has an invalid length. [ 292.462898][T11066] qnx4: no qnx4 filesystem (no root dir). [ 292.549122][T11032] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 292.568685][T11032] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 292.593609][ T946] hid (null): unknown global tag 0xc [ 292.615939][ T946] hid_parser_main: 5 callbacks suppressed [ 292.615973][ T946] wacom 0003:056A:4F00.0027: unknown main item tag 0x0 [ 292.632398][ T946] wacom 0003:056A:4F00.0027: unknown main item tag 0x0 [ 292.661938][ T946] wacom 0003:056A:4F00.0027: unknown main item tag 0x0 [ 292.670331][ T946] wacom 0003:056A:4F00.0027: unknown main item tag 0x0 [ 292.679988][ T946] wacom 0003:056A:4F00.0027: unknown main item tag 0x0 [ 292.709356][ T946] wacom 0003:056A:4F00.0027: unknown main item tag 0x0 [ 292.740163][ T946] wacom 0003:056A:4F00.0027: unknown main item tag 0x0 [ 292.757179][ T946] wacom 0003:056A:4F00.0027: unknown main item tag 0x0 [ 292.788879][ T946] wacom 0003:056A:4F00.0027: unknown main item tag 0x0 [ 292.837424][ T946] wacom 0003:056A:4F00.0027: unknown main item tag 0x0 [ 292.858743][ T946] wacom 0003:056A:4F00.0027: unknown global tag 0xc [ 292.874326][ T946] wacom 0003:056A:4F00.0027: item 0 1 1 12 parsing failed [ 292.892934][ T946] wacom 0003:056A:4F00.0027: parse failed [ 292.904766][ T946] wacom 0003:056A:4F00.0027: probe with driver wacom failed with error -22 [ 292.955680][ T946] usb 5-1: USB disconnect, device number 44 [ 293.065035][T11086] kAFS: unable to lookup cell '.,c¾ûL' [ 293.113863][T11086] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2307790675 (73849301600 ns) > initial count (32142752608 ns). Using initial count to start timer. [ 293.495391][ T946] usb 3-1: new high-speed USB device number 71 using dummy_hcd [ 293.662395][T11113] FAULT_INJECTION: forcing a failure. [ 293.662395][T11113] name failslab, interval 1, probability 0, space 0, times 0 [ 293.678110][ T946] usb 3-1: Using ep0 maxpacket: 16 [ 293.695099][T11113] CPU: 1 UID: 0 PID: 11113 Comm: syz.5.1291 Tainted: G L syzkaller #0 PREEMPT(full) [ 293.695131][T11113] Tainted: [L]=SOFTLOCKUP [ 293.695139][T11113] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 293.695151][T11113] Call Trace: [ 293.695159][T11113] [ 293.695167][T11113] dump_stack_lvl+0xe8/0x150 [ 293.695201][T11113] should_fail_ex+0x412/0x560 [ 293.695229][T11113] should_failslab+0xa8/0x100 [ 293.695258][T11113] ? security_file_alloc+0x34/0x310 [ 293.695283][T11113] kmem_cache_alloc_noprof+0x87/0x650 [ 293.695312][T11113] ? rcu_is_watching+0x15/0xb0 [ 293.695332][T11113] ? trace_kmem_cache_alloc+0x29/0xf0 [ 293.695362][T11113] security_file_alloc+0x34/0x310 [ 293.695386][T11113] init_file+0x90/0x2b0 [ 293.695413][T11113] alloc_empty_file+0x6e/0x1d0 [ 293.695440][T11113] alloc_file_pseudo+0x155/0x240 [ 293.695468][T11113] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 293.695506][T11113] anon_inode_getfile+0xc5/0x1a0 [ 293.695530][T11113] sync_file_ioctl+0xc69/0x1170 [ 293.695569][T11113] ? __pfx_sync_file_ioctl+0x10/0x10 [ 293.695599][T11113] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 293.695639][T11113] ? __fget_files+0x2a/0x420 [ 293.695686][T11113] ? bpf_lsm_file_ioctl+0x9/0x20 [ 293.695705][T11113] ? __pfx_sync_file_ioctl+0x10/0x10 [ 293.695730][T11113] __se_sys_ioctl+0xfc/0x170 [ 293.695750][T11113] do_syscall_64+0x14d/0xf80 [ 293.695766][T11113] ? trace_irq_disable+0x3b/0x150 [ 293.695786][T11113] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 293.695805][T11113] ? clear_bhb_loop+0x40/0x90 [ 293.695826][T11113] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 293.695843][T11113] RIP: 0033:0x7f0fe9d9c799 [ 293.695860][T11113] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 293.695876][T11113] RSP: 002b:00007f0feac6c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 293.695895][T11113] RAX: ffffffffffffffda RBX: 00007f0fea015fa0 RCX: 00007f0fe9d9c799 [ 293.695908][T11113] RDX: 0000200000000340 RSI: 00000000c0303e03 RDI: 0000000000000006 [ 293.695919][T11113] RBP: 00007f0feac6c090 R08: 0000000000000000 R09: 0000000000000000 [ 293.695930][T11113] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 293.695940][T11113] R13: 00007f0fea016038 R14: 00007f0fea015fa0 R15: 00007ffd68dc4f98 [ 293.695969][T11113] [ 293.698696][ T946] usb 3-1: unable to get BOS descriptor or descriptor too short [ 293.833209][ T5846] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 293.880148][ T946] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 293.992405][ T946] usb 3-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 294.004019][ T946] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 294.012098][ T946] usb 3-1: Product: syz [ 294.016387][ T946] usb 3-1: Manufacturer: syz [ 294.021017][ T946] usb 3-1: SerialNumber: syz [ 294.045565][ T5846] usb 5-1: Using ep0 maxpacket: 32 [ 294.059412][ T5846] usb 5-1: unable to get BOS descriptor or descriptor too short [ 294.069464][ T5846] usb 5-1: config 78 has an invalid interface number: 117 but max is 0 [ 294.082200][ T5846] usb 5-1: config 78 has no interface number 0 [ 294.100607][ T5846] usb 5-1: config 78 interface 117 has no altsetting 0 [ 294.121094][ T5846] usb 5-1: New USB device found, idVendor=1385, idProduct=4251, bcdDevice=ca.f8 [ 294.146565][ T5846] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 294.170843][ T5846] usb 5-1: Product: syz [ 294.185812][ T5846] usb 5-1: Manufacturer: syz [ 294.195538][ T5846] usb 5-1: SerialNumber: syz [ 294.463378][ T946] usb 3-1: Audio class v2/v3 interfaces need an interface association [ 294.479492][ T946] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 294.516187][ T5846] usb 5-1: Could not find all expected endpoints [ 294.530886][ T946] usb 3-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 294.551856][ T5846] usb 5-1: USB disconnect, device number 45 [ 294.625203][ T9] usb 6-1: new high-speed USB device number 38 using dummy_hcd [ 294.732821][ T946] usb 3-1: USB disconnect, device number 71 [ 294.775426][ T9] usb 6-1: device descriptor read/64, error -71 [ 295.046916][ T9] usb 6-1: new high-speed USB device number 39 using dummy_hcd [ 295.207309][ T9] usb 6-1: device descriptor read/64, error -71 [ 295.325999][ T9] usb usb6-port1: attempt power cycle [ 295.361794][T11156] erofs (device nbd4): cannot find valid erofs superblock [ 295.568165][T11166] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1300'. [ 295.685012][ T9] usb 6-1: new high-speed USB device number 40 using dummy_hcd [ 295.728722][ T9] usb 6-1: device descriptor read/8, error -71 [ 295.770219][T11173] binder: 11171:11173 ioctl c0306201 2000000004c0 returned -14 [ 295.987764][ T9] usb 6-1: new high-speed USB device number 41 using dummy_hcd [ 296.015665][ T9] usb 6-1: device descriptor read/8, error -71 [ 296.137874][ T9] usb usb6-port1: unable to enumerate USB device [ 296.158824][ T5846] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 296.315432][ T5846] usb 5-1: Using ep0 maxpacket: 16 [ 296.324627][ T5846] usb 5-1: unable to get BOS descriptor or descriptor too short [ 296.334710][ T5846] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 296.352872][ T5846] usb 5-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 296.368270][ T5846] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 296.380773][ T5846] usb 5-1: Product: syz [ 296.386436][ T5846] usb 5-1: Manufacturer: syz [ 296.391847][ T5846] usb 5-1: SerialNumber: syz [ 296.817124][ T5846] usb 5-1: Audio class v2/v3 interfaces need an interface association [ 296.825775][ T5846] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 296.838118][ T5846] usb 5-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 296.871762][ T5846] usb 5-1: USB disconnect, device number 46 [ 296.897630][ T6016] udevd[6016]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 297.040583][ T30] audit: type=1326 audit(1773812978.346:376): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11196 comm="syz.2.1307" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1b11b9c799 code=0x7ffc0000 [ 297.063498][ T30] audit: type=1326 audit(1773812978.346:377): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11196 comm="syz.2.1307" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1b11b9c799 code=0x7ffc0000 [ 297.089043][ T30] audit: type=1326 audit(1773812978.346:378): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11196 comm="syz.2.1307" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f1b11b9c799 code=0x7ffc0000 [ 297.112330][ T30] audit: type=1326 audit(1773812978.346:379): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11196 comm="" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1b11b9c799 code=0x7ffc0000 [ 297.133967][ T30] audit: type=1326 audit(1773812978.346:380): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11196 comm="" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1b11b9c799 code=0x7ffc0000 [ 297.156433][ T30] audit: type=1326 audit(1773812978.346:381): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11196 comm="" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f1b11b9c799 code=0x7ffc0000 [ 297.180824][ T30] audit: type=1326 audit(1773812978.346:382): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11196 comm="" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1b11b9c799 code=0x7ffc0000 [ 297.206068][ T30] audit: type=1326 audit(1773812978.346:383): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11196 comm="" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f1b11b9c799 code=0x7ffc0000 [ 297.227890][ T30] audit: type=1326 audit(1773812978.346:384): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11196 comm="" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1b11b9c799 code=0x7ffc0000 [ 297.249587][ T30] audit: type=1326 audit(1773812978.346:385): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11196 comm="" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1b11b9c799 code=0x7ffc0000 [ 297.746820][T11207] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1311'. [ 297.825899][ T31] INFO: task syz.0.402:7498 blocked for more than 143 seconds. [ 297.835390][ T31] Tainted: G L syzkaller #0 [ 297.843647][ T31] Blocked by coredump. [ 297.857840][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 297.868094][T11211] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1312'. [ 297.884062][ T31] task:syz.0.402 state:D stack:25760 pid:7498 tgid:7498 ppid:5843 task_flags:0x40004c flags:0x00080000 [ 297.907990][ T31] Call Trace: [ 297.930099][ T31] [ 297.948463][ T31] __schedule+0x1665/0x5590 [ 297.958412][ T31] ? __pfx___schedule+0x10/0x10 [ 297.971388][ T31] ? schedule+0x90/0x360 [ 297.989101][ T31] schedule+0x164/0x360 [ 297.999258][ T31] schedule_preempt_disabled+0x13/0x30 [ 298.008456][ T31] rwsem_down_read_slowpath+0x6d9/0x940 [ 298.014601][ T31] ? rwsem_down_read_slowpath+0x596/0x940 [ 298.021784][ T31] ? __pfx_rwsem_down_read_slowpath+0x10/0x10 [ 298.029827][ T31] ? do_futex+0x395/0x420 [ 298.034332][ T31] down_read+0x99/0x2e0 [ 298.038663][ T31] ? exit_mm+0x64/0x250 [ 298.055055][ T31] exit_mm+0x73/0x250 [ 298.061579][ T31] ? unwind_deferred_task_exit+0x67/0xa0 [ 298.070751][ T31] do_exit+0x8b9/0x2490 [ 298.075978][ T31] ? try_to_wake_up+0x7fc/0x1390 [ 298.081692][ T31] ? __pfx_do_exit+0x10/0x10 [ 298.090120][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 298.096396][ T31] do_group_exit+0x21b/0x2d0 [ 298.103085][ T31] __x64_sys_exit_group+0x3f/0x40 [ 298.109819][ T31] x64_sys_call+0x221a/0x2240 [ 298.114837][ T31] do_syscall_64+0x14d/0xf80 [ 298.120287][ T31] ? trace_irq_disable+0x3b/0x150 [ 298.125833][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 298.132571][ T31] ? clear_bhb_loop+0x40/0x90 [ 298.138226][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 298.145658][ T31] RIP: 0033:0x7fb50fd9c799 [ 298.150740][ T31] RSP: 002b:00007ffede6d82f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 298.167275][ T31] RAX: ffffffffffffffda RBX: 000000000000000b RCX: 00007fb50fd9c799 [ 298.177155][ T31] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 000000000000000b [ 298.186839][ T31] RBP: 00000000000000f7 R08: 00007ffede6d87a7 R09: 000000000000000b [ 298.198173][ T31] R10: 00007fb510015fa0 R11: 0000000000000246 R12: 0000000000000003 [ 298.210249][ T31] R13: 00007fb51001627c R14: 00007fb510016278 R15: 00007fb510016270 [ 298.219148][ T31] [ 298.222333][ T31] [ 298.222333][ T31] Showing all locks held in the system: [ 298.231976][ T31] 1 lock held by khungtaskd/31: [ 298.237247][ T31] #0: ffffffff8eb5d6a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 298.254993][ T31] 2 locks held by getty/5606: [ 298.260234][ T31] #0: ffff8880329fc0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 298.271456][ T31] #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 [ 298.284556][ T31] 1 lock held by syz.0.402/7498: [ 298.290065][ T31] #0: ffff88807d27dab8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0x73/0x250 [ 298.299039][ T31] [ 298.301398][ T31] ============================================= [ 298.301398][ T31] [ 298.314692][ T31] NMI backtrace for cpu 1 [ 298.314705][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 298.314722][ T31] Tainted: [L]=SOFTLOCKUP [ 298.314726][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 298.314734][ T31] Call Trace: [ 298.314739][ T31] [ 298.314745][ T31] dump_stack_lvl+0xe8/0x150 [ 298.314767][ T31] nmi_cpu_backtrace+0x274/0x2d0 [ 298.314785][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 298.314804][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 298.314822][ T31] sys_info+0x135/0x170 [ 298.314837][ T31] watchdog+0x1002/0x1060 [ 298.314856][ T31] ? watchdog+0x1da/0x1060 [ 298.314874][ T31] kthread+0x388/0x470 [ 298.314912][ T31] ? __pfx_watchdog+0x10/0x10 [ 298.314930][ T31] ? __pfx_kthread+0x10/0x10 [ 298.314951][ T31] ret_from_fork+0x51e/0xb90 [ 298.314977][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 298.314999][ T31] ? __switch_to+0xc7d/0x1450 [ 298.315023][ T31] ? __pfx_kthread+0x10/0x10 [ 298.315043][ T31] ret_from_fork_asm+0x1a/0x30 [ 298.315072][ T31] [ 298.425379][ T31] Sending NMI from CPU 1 to CPUs 0: [ 298.430641][ C0] NMI backtrace for cpu 0 [ 298.430656][ C0] CPU: 0 UID: 0 PID: 5831 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT(full) [ 298.430677][ C0] Tainted: [L]=SOFTLOCKUP [ 298.430682][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 298.430691][ C0] RIP: 0010:dequeue_entities+0x8a3/0x3820 [ 298.430712][ C0] Code: 20 84 c0 0f 85 52 08 00 00 41 8b 3e e8 b6 02 e2 ff 45 31 f6 39 c5 40 0f 94 c5 48 83 c3 08 48 89 d8 48 c1 e8 03 42 0f b6 04 20 <84> c0 0f 85 47 08 00 00 41 88 ee 41 f7 de 44 01 33 49 8d 5f 48 48 [ 298.430725][ C0] RSP: 0018:ffffc900038e7838 EFLAGS: 00000806 [ 298.430738][ C0] RAX: 0000000000000000 RBX: ffff8880b843ad88 RCX: ffff88807d165b80 [ 298.430749][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008 [ 298.430757][ C0] RBP: 0000000000000001 R08: ffffffff905444f7 R09: 1ffffffff20a889e [ 298.430767][ C0] R10: dffffc0000000000 R11: fffffbfff20a889f R12: dffffc0000000000 [ 298.430778][ C0] R13: ffff8880b843ae40 R14: 0000000000000000 R15: ffff88807d165c00 [ 298.430788][ C0] FS: 0000555566101540(0000) GS:ffff888124de1000(0000) knlGS:0000000000000000 [ 298.430801][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 298.430810][ C0] CR2: 00007fddfc7e92f8 CR3: 0000000075334000 CR4: 00000000003526f0 [ 298.430829][ C0] Call Trace: [ 298.430834][ C0] [ 298.430849][ C0] ? rcu_is_watching+0x15/0xb0 [ 298.430867][ C0] dequeue_task_fair+0x200/0x670 [ 298.430888][ C0] __schedule+0x6da/0x5590 [ 298.430924][ C0] ? __pfx___schedule+0x10/0x10 [ 298.430949][ C0] ? schedule+0x90/0x360 [ 298.430971][ C0] schedule+0x164/0x360 [ 298.430991][ C0] do_nanosleep+0x1c2/0x620 [ 298.431012][ C0] ? do_nanosleep+0x80/0x620 [ 298.431030][ C0] ? __pfx_do_nanosleep+0x10/0x10 [ 298.431048][ C0] ? __asan_memset+0x22/0x50 [ 298.431068][ C0] ? __hrtimer_setup+0x1b7/0x260 [ 298.431082][ C0] ? __pfx_hrtimer_wakeup+0x10/0x10 [ 298.431099][ C0] hrtimer_nanosleep+0x18f/0x3a0 [ 298.431116][ C0] ? __pfx_hrtimer_nanosleep+0x10/0x10 [ 298.431134][ C0] ? __pfx_hrtimer_wakeup+0x10/0x10 [ 298.431155][ C0] __se_sys_clock_nanosleep+0x35b/0x3b0 [ 298.431173][ C0] ? __pfx___se_sys_clock_nanosleep+0x10/0x10 [ 298.431194][ C0] do_syscall_64+0x14d/0xf80 [ 298.431208][ C0] ? trace_irq_disable+0x3b/0x150 [ 298.431225][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 298.431240][ C0] ? clear_bhb_loop+0x40/0x90 [ 298.431257][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 298.431271][ C0] RIP: 0033:0x7f71f1d57917 [ 298.431284][ C0] Code: 48 89 fa 4c 89 df e8 a8 56 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 298.431296][ C0] RSP: 002b:00007ffd9e495020 EFLAGS: 00000202 ORIG_RAX: 00000000000000e6 [ 298.431310][ C0] RAX: ffffffffffffffda RBX: 0000555566101540 RCX: 00007f71f1d57917 [ 298.431321][ C0] RDX: 00007ffd9e495060 RSI: 0000000000000000 RDI: 0000000000000000 [ 298.431330][ C0] RBP: 00007ffd9e495540 R08: 0000000000000000 R09: 0000000000000000 [ 298.431339][ C0] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000004 [ 298.431348][ C0] R13: 00007ffd9e49509c R14: 00007ffd9e495130 R15: 0000000000000000 [ 298.431366][ C0] [ 298.755023][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 298.761907][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 298.772595][ T31] Tainted: [L]=SOFTLOCKUP [ 298.776934][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 298.787103][ T31] Call Trace: [ 298.790399][ T31] [ 298.793347][ T31] vpanic+0x56c/0xa60 [ 298.797356][ T31] ? __pfx___schedule+0x10/0x10 [ 298.802247][ T31] ? __pfx_vpanic+0x10/0x10 [ 298.806783][ T31] ? nmi_trigger_cpumask_backtrace+0x1f4/0x300 [ 298.812974][ T31] panic+0xc5/0xd0 [ 298.816715][ T31] ? __pfx_panic+0x10/0x10 [ 298.821158][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 298.826561][ T31] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 298.832745][ T31] watchdog+0x105b/0x1060 [ 298.837102][ T31] ? watchdog+0x1da/0x1060 [ 298.841533][ T31] kthread+0x388/0x470 [ 298.845611][ T31] ? __pfx_watchdog+0x10/0x10 [ 298.850299][ T31] ? __pfx_kthread+0x10/0x10 [ 298.854904][ T31] ret_from_fork+0x51e/0xb90 [ 298.859517][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 298.864648][ T31] ? __switch_to+0xc7d/0x1450 [ 298.869382][ T31] ? __pfx_kthread+0x10/0x10 [ 298.873984][ T31] ret_from_fork_asm+0x1a/0x30 [ 298.878775][ T31] [ 298.882602][ T31] Kernel Offset: disabled [ 298.886938][ T31] Rebooting in 86400 seconds..