last executing test programs: 8.894712265s ago: executing program 4 (id=13476): connect$unix(0xffffffffffffffff, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x2) write$tun(r0, 0x0, 0xfdef) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x0, 0x1, 0x0, 0x40, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) r1 = epoll_create1(0x0) ioctl$FS_IOC_SETFLAGS(r1, 0x40088a01, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000814000/0x4000)=nil) socket$inet_udp(0x2, 0x2, 0x0) fsopen(&(0x7f0000000000)='virtiofs\x00', 0x1) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) r2 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) mknod$loop(&(0x7f0000000140)='./file0\x00', 0x100, 0x1) socket$rxrpc(0x21, 0x2, 0x2) sendmsg$tipc(r2, 0x0, 0x20008000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_FLUSH(r3, 0x29, 0xd4, &(0x7f0000000100)=0x2, 0x4) 7.789464352s ago: executing program 0 (id=13486): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000010c30000000003002000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000116608000000000000180000000000000000000000000010009500000000000000360a"], 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, 0x94) recvmmsg(0xffffffffffffffff, &(0x7f0000000980)=[{{0x0, 0x0, 0x0}, 0x7fff}, {{0x0, 0x0, 0x0}, 0x9}], 0x2, 0x10000, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000001c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-512\x00'}, 0x58) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)}, {&(0x7f0000000100)="2e3b4d0793c0907a06a1c65afd96e5c997cc6fe980972c7c01fcfa7c85b0db039afd7c02884bfed5faf093fd548fca4f3a6e7391c8acfda620b96e71569873b28a43558b1c85f34b806418d36165411c9ebd66", 0x53}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c5b5ad28a834e43f387c8282e50e7d6b0cd91a93f87f645b32c1f200f7d9f101c7bcf701e4462f36e5f", 0xa4}, {0x0}], 0x4, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) bpf$MAP_CREATE(0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="1e00000007", @ANYRES64, @ANYRES32, @ANYRESHEX, @ANYRESHEX, @ANYRES32], 0x50) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)=""/83, 0x53}], 0x1}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 7.757960201s ago: executing program 4 (id=13487): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x11c0, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) close_range(r1, r1, 0x2) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000500)={0xa, 0x4e22, 0x8, @ipv4={'\x00', '\xff\xff', @loopback}, 0x5}, 0x1c) r3 = open(&(0x7f00000003c0)='./file0\x00', 0x7475c0, 0x0) r4 = epoll_create(0x9) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f00000001c0)={0xa0000000}) 7.629145197s ago: executing program 0 (id=13488): bind$alg(0xffffffffffffffff, &(0x7f00000001c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-512\x00'}, 0x58) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)}, {&(0x7f0000000100)="2e3b4d0793c0907a06a1c65afd96e5c997cc6fe980972c7c01fcfa7c85b0db039afd7c02884bfed5faf093fd548fca4f3a6e7391c8acfda620b96e71569873b28a43558b1c85f34b806418d36165411c9ebd66", 0x53}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c5b5ad28a834e43f387c8282e50e7d6b0cd91a93f87", 0x90}, {&(0x7f0000000440)}], 0x4, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) bpf$MAP_CREATE(0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="1e00000007", @ANYRES64, @ANYRES32, @ANYRESHEX, @ANYRESHEX, @ANYRES32], 0x50) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f40600", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 7.497520609s ago: executing program 4 (id=13489): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x2, 0x4e24, @private=0xa010102}, 0x10, &(0x7f0000000100)=[{&(0x7f00000000c0)="b7", 0x1}], 0x1}, 0x20008050) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000980)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{0x0, 0x1, 0xfffffffd}, {0x2, 0x0, 0xffffeffc, 0x8}]}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r3) recvmsg$unix(r2, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x84, 0x10, &(0x7f0000000000)=r4, 0xc) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), r0) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r5, 0x84, 0x20, &(0x7f0000000240)=0x401, 0x4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f00000004c0)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x1, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff000000009408000000001700638af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r8, @ANYBLOB="0000000000000000b70300000a000000850000006900000095"], &(0x7f0000005d80)='syzkaller\x00', 0xc}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000380)={r9, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000200)="d2ff0600600100004199dec6aa4a", 0x0, 0x440d5b1, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r10 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x1) r12 = eventfd(0x5f0) ioctl$KVM_IOEVENTFD(r11, 0x40a0ae49, &(0x7f0000000080)={0x7ff, 0x0, 0x0, r12}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), r1) r13 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r13, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r13, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r14}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r13, 0x3ba0, &(0x7f0000000580)={0x48, 0x2, r14}) openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x200, 0x0) 7.34977165s ago: executing program 0 (id=13490): openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0xffffffffffffff79, 0x0, 0x4a}, 0x8e98564dc29c29a5) 7.190571122s ago: executing program 3 (id=13491): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYRES32, @ANYBLOB="00000000000000116608000000000000180000000000000000000000000010009500000000000000360a02000000000118010000202078250000000000202020"], 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, 0x94) bind$alg(0xffffffffffffffff, &(0x7f00000001c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-512\x00'}, 0x58) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb0958730", 0x4c}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 7.158680508s ago: executing program 0 (id=13492): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x101041, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2800, 0x0) fcntl$setflags(r1, 0x2, 0x0) syz_open_pts(r0, 0xea283) r2 = dup3(r0, r0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff1000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ff3000/0x1000)=nil, &(0x7f0000ff1000/0x1000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000640)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-aesni\x00'}, 0x58) setsockopt$ALG_SET_AEAD_AUTHSIZE(r3, 0x117, 0x5, 0x0, 0x8) r4 = io_uring_setup(0x1c6c, &(0x7f0000000040)={0x0, 0xaebb, 0xd000, 0x20000a, 0x20002f7}) ioctl$BLKTRACESTART(r2, 0x1274, 0x0) r5 = syz_usb_connect(0x0, 0x202, &(0x7f0000000180)=ANY=[@ANYBLOB="1201100152018b401e040740185d000000010902f00101040000030904"], 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, &(0x7f0000004dc0)={0x44, &(0x7f0000004b00)={0x40}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@deltfilter={0x24, 0x2d, 0x800, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x9, 0xc}, {0xfff2, 0xd}, {0xb, 0xf}}}, 0x24}, 0x1, 0x0, 0x0, 0x40885}, 0x20000000) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3, &(0x7f0000000000)=0x6, 0x4) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0) 6.948912657s ago: executing program 3 (id=13494): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000010c30000000003002000851000000600000018000000", @ANYRES32], 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, 0x94) recvmmsg(0xffffffffffffffff, &(0x7f0000000980)=[{{0x0, 0x0, 0x0}, 0x7fff}, {{0x0, 0x0, 0x0}, 0x9}], 0x2, 0x10000, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000001c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-512\x00'}, 0x58) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000100)="2e3b4d0793c0907a06a1c65afd96e5c997cc6fe980972c7c01fcfa7c85b0db039afd7c02884bfed5faf093fd548fca4f3a6e7391c8acfda620b96e71569873b28a43558b1c85f34b806418d36165411c9ebd66", 0x53}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c5b5ad28a834e43f387c8282e50e7d6b0cd91a93f87f645b32c1f200f7d9f101c7bcf701e44", 0xa0}], 0x2, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 6.808533864s ago: executing program 3 (id=13496): r0 = syz_usb_connect$hid(0x1, 0x0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) r3 = openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000200)='/proc/sys/fs/binfmt_misc/syz0\x00', 0x2, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000240)=@o_path={&(0x7f0000000180)='./file1\x00', 0x0, 0x0, r3}, 0x18) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) unshare(0x400) r6 = socket$inet(0xa, 0x801, 0x84) connect$inet(r6, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r6, 0x8) r7 = accept4(r6, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r7, 0x84, 0x7d, &(0x7f0000000140)={0x0, 0x4}, 0x8) bind$alg(0xffffffffffffffff, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x7, 0x7f, 0xa9, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0x6, 0x0, 0x7, 0x3c5b, 0x1, 0x20, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x6, 0x7, 0x5, 0x8, 0x4c74, 0xffff7fff, 0x7, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0xffffffff, 0x7, 0x5, 0x80003e, 0x18e, 0x6, 0x6, 0x0, 0x8, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x7, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0x2009, 0xfffffffc, 0x573a, 0x0, 0x0, 0x5, 0x2f, 0x8, 0x312, 0x66abcbd2, 0xea4, 0x5, 0x4, 0x1007, 0x7, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x7, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4000004, 0x9, 0x8, 0x40, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x200009, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x6, 0x40a, 0x3ff, 0x5, 0xfffffffd, 0x100, 0x4, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x1000515, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6cff, 0x6, 0x38, 0x200, 0x1fd, 0x80, 0x7, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x8, 0xcc, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x7ef, 0x2006, 0x80a2cd, 0x4, 0x25], [0xc, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xfffc, 0xa620, 0x1, 0x5, 0x801, 0x2000002, 0x150, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0x10000, 0xf, 0x7e, 0x9, 0x9622, 0x7, 0xaf, 0x20000008, 0x5, 0x226, 0x2, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0xe1c4, 0x0, 0x4, 0x5, 0x7ff, 0xd7, 0x200, 0xb, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f00000000c0)=[{0x20, 0x0, 0x8, 0xfffff038}, {0x20, 0xf, 0x0, 0xffffefff}, {0x6}]}, 0x10) timer_create(0x1, 0x0, &(0x7f0000000000)) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) sendmmsg(r4, &(0x7f0000000180), 0x4000190, 0xc03e) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x1c0002, 0x0) connect$unix(r8, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x5) sendmmsg$unix(r9, &(0x7f00000bd000), 0x318, 0x0) 6.280862875s ago: executing program 2 (id=13497): connect$unix(0xffffffffffffffff, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) getrandom(0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x2) write$tun(r0, 0x0, 0xfdef) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x0, 0x1, 0x0, 0x40, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) r1 = epoll_create1(0x0) ioctl$FS_IOC_SETFLAGS(r1, 0x40088a01, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000814000/0x4000)=nil) socket$inet_udp(0x2, 0x2, 0x0) fsopen(&(0x7f0000000000)='virtiofs\x00', 0x1) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) r2 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) mknod$loop(&(0x7f0000000140)='./file0\x00', 0x100, 0x1) socket$rxrpc(0x21, 0x2, 0x2) sendmsg$tipc(r2, 0x0, 0x20008000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_FLUSH(r3, 0x29, 0xd4, &(0x7f0000000100)=0x2, 0x4) 6.054337654s ago: executing program 2 (id=13498): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000010c30000000003002000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000116608000000000000180000000000000000000000000010009500000000000000360a"], 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, 0x94) recvmmsg(0xffffffffffffffff, &(0x7f0000000980)=[{{0x0, 0x0, 0x0}, 0x7fff}, {{0x0, 0x0, 0x0}, 0x9}], 0x2, 0x10000, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000001c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-512\x00'}, 0x58) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)}, {&(0x7f0000000100)="2e3b4d0793c0907a06a1c65afd96e5c997cc6fe980972c7c01fcfa7c85b0db039afd7c02884bfed5faf093fd548fca4f3a6e7391c8acfda620b96e71569873b28a43558b1c85f34b806418d36165411c9ebd66", 0x53}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c5b5ad28a834e43f387c8282e50e7d6b0cd91a93f87f645b32c1f200f7d9f101c7bcf701e4462f36e5f", 0xa4}, {0x0}], 0x4, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) bpf$MAP_CREATE(0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="1e00000007", @ANYRES64, @ANYRES32, @ANYRESHEX, @ANYRESHEX, @ANYRES32], 0x50) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)=""/83, 0x53}], 0x1}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 5.901767818s ago: executing program 4 (id=13499): openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x42, 0x70) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000002100)={0x2020}, 0x2020) socket$nl_netfilter(0x10, 0x3, 0xc) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, 0x0) read$dsp(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x0, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) socket$kcm(0x10, 0x400000002, 0x0) r3 = syz_open_dev$vim2m(&(0x7f0000000080), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r3, 0xc0d05605, &(0x7f0000000cc0)={0x1, @pix_mp={0x0, 0x0, 0x32315241, 0x0, 0x0, [{}, {0x0, 0xfffffffe}, {}, {}, {0x0, 0x1000}, {0x7}, {0x0, 0x2}]}}) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f00000003c0)={0x0, 0x0, 0x0, 'queue0\x00'}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000001240), 0x80, 0x0) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_int(r6, 0x6, 0x3, 0x0, &(0x7f0000000000)) ioctl$TUNGETVNETLE(r5, 0x800454dd, 0x0) r7 = socket$netlink(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, r7) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r4, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0x2, 0x0, 0x0, 0x2, 0x2}}) 5.894271394s ago: executing program 2 (id=13500): bind$alg(0xffffffffffffffff, &(0x7f00000001c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-512\x00'}, 0x58) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)}, {&(0x7f0000000100)="2e3b4d0793c0907a06a1c65afd96e5c997cc6fe980972c7c01fcfa7c85b0db039afd7c02884bfed5faf093fd548fca4f3a6e7391c8acfda620b96e71569873b28a43558b1c85f34b806418d36165411c9ebd66", 0x53}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c5b5ad28a834e43f387c8282e50e7d6b0cd91a93f87", 0x90}, {&(0x7f0000000440)}], 0x4, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) bpf$MAP_CREATE(0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="1e00000007", @ANYRES64, @ANYRES32, @ANYRESHEX, @ANYRESHEX, @ANYRES32], 0x50) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f40600", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 5.672660057s ago: executing program 2 (id=13501): r0 = syz_usb_connect$hid(0x1, 0x0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) r3 = openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000200)='/proc/sys/fs/binfmt_misc/syz0\x00', 0x2, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000240)=@o_path={&(0x7f0000000180)='./file1\x00', 0x0, 0x0, r3}, 0x18) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) unshare(0x400) r6 = socket$inet(0xa, 0x801, 0x84) connect$inet(r6, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r6, 0x8) r7 = accept4(r6, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r7, 0x84, 0x7d, &(0x7f0000000140)={0x0, 0x4}, 0x8) bind$alg(0xffffffffffffffff, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x7, 0x7f, 0xa9, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0x6, 0x0, 0x7, 0x3c5b, 0x1, 0x20, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x6, 0x7, 0x5, 0x8, 0x4c74, 0xffff7fff, 0x7, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0xffffffff, 0x7, 0x5, 0x80003e, 0x18e, 0x6, 0x6, 0x0, 0x8, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x7, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0x2009, 0xfffffffc, 0x573a, 0x0, 0x0, 0x5, 0x2f, 0x8, 0x312, 0x66abcbd2, 0xea4, 0x5, 0x4, 0x1007, 0x7, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x7, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4000004, 0x9, 0x8, 0x40, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x200009, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x6, 0x40a, 0x3ff, 0x5, 0xfffffffd, 0x100, 0x4, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x1000515, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6cff, 0x6, 0x38, 0x200, 0x1fd, 0x80, 0x7, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x8, 0xcc, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x7ef, 0x2006, 0x80a2cd, 0x4, 0x25], [0xc, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xfffc, 0xa620, 0x1, 0x5, 0x801, 0x2000002, 0x150, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0x10000, 0xf, 0x7e, 0x9, 0x9622, 0x7, 0xaf, 0x20000008, 0x5, 0x226, 0x2, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0xe1c4, 0x0, 0x4, 0x5, 0x7ff, 0xd7, 0x200, 0xb, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f00000000c0)=[{0x20, 0x0, 0x8, 0xfffff038}, {0x20, 0xf, 0x0, 0xffffefff}, {0x6}]}, 0x10) timer_create(0x1, 0x0, &(0x7f0000000000)) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) sendmmsg(r4, &(0x7f0000000180), 0x4000190, 0xc03e) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r9 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x1c0002, 0x0) write$vga_arbiter(r9, &(0x7f0000000300)=ANY=[@ANYBLOB='decodes m'], 0xf) connect$unix(r8, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x5) 4.537113491s ago: executing program 1 (id=13503): mknodat$null(0xffffffffffffff9c, &(0x7f0000002440)='./file0\x00', 0x2, 0x103) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000180)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x2000}}) r1 = inotify_init1(0x800) inotify_add_watch(r1, &(0x7f0000000e00)='./file0\x00', 0x140) umount2(&(0x7f0000000000)='./file0\x00', 0x3) r2 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r2, 0x4010640d, &(0x7f0000002100)={0x1}) 4.501151554s ago: executing program 0 (id=13504): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="130100002add1e20ef050a023691010203010902240001000000000904000002ea1998000905a6a70000000000090507", @ANYRES32], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000280)=ANY=[@ANYBLOB="0005010000004f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_emit_ethernet(0xba, &(0x7f00000001c0)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x84, 0x2c, 0x0, @dev={0xfe, 0x80, '\x00', 0x8}, @local, {[@hopopts={0x3c, 0x7, '\x00', [@calipso={0x7, 0x38, {0x1, 0xc, 0x5, 0x40, [0x3, 0x2, 0x1, 0x8, 0x6, 0x6]}}]}, @routing={0x32, 0x4, 0x1, 0xa5, 0x0, [@private1={0xfc, 0x1, '\x00', 0x1}, @private2]}], {{0x2c00, 0x3, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x2, 0x200000000000001, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb48, 0x9, 0x8, 0x2, 0x21}, 0x0) ioctl$TUNSETOFFLOAD(0xffffffffffffffff, 0x400454d0, 0xb) r4 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r4, 0x83, 0x10, &(0x7f0000000500)=@ready={0x0, 0x0, 0x8, "72918f72", {0x1, 0x1, 0x1000, 0x2, 0x5}}) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@loopback, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x4e23, 0xfffc, 0x4e23, 0x3, 0xa, 0x80, 0x30}, {0x100000000, 0x2, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff, 0x6, 0x8, 0x800000000001}, {0x9, 0xfffffffffffffffe, 0x0, 0x9}, 0xd6, 0x0, 0x1, 0x0, 0x3, 0x1}, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x210000, 0x33}, 0x0, @in=@private=0xa010102, 0x0, 0x3, 0x0, 0x7, 0x0, 0x0, 0xfffffffb}}, 0xe8) syz_usb_ep_write$ath9k_ep1(r4, 0x82, 0x1f, &(0x7f0000000380)=ANY=[@ANYBLOB="0c00004e1560254722cb66187f3b68d00c08004e15"]) connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@loopback, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4f23, 0xfffc, 0x4e23, 0x6, 0xa, 0x2a11bad3d5f03f34, 0x30}, {0x100000000, 0x2, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff, 0x6, 0x8, 0x800000000001}, {0x9, 0xfffffffffffffffe, 0x4, 0x9}, 0x0, 0x0, 0x1, 0x0, 0x3, 0x3}, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x210000, 0x33}, 0x0, @in6=@empty, 0xffffffff, 0x0, 0x0, 0x7, 0x0, 0x0, 0x1}}, 0xe8) sendmmsg(0xffffffffffffffff, &(0x7f0000000480), 0x2e9, 0xffe0) r5 = syz_open_dev$dvb_demux(&(0x7f0000000000), 0x5, 0x2) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000004c0)={0x401, 0x7, 0x3, 0x0, 0x0, [{{r1}, 0x5}, {{r2}, 0x4}, {{r2}, 0x7}]}) r6 = io_uring_setup(0x3454, &(0x7f0000000080)) io_uring_register$IORING_REGISTER_BUFFERS(r6, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) mremap(&(0x7f00003eb000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000003000/0x1000)=nil) migrate_pages(0x0, 0x3, &(0x7f0000000040)=0x7f, &(0x7f0000000300)=0xa) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$SO_ATTACH_FILTER(r7, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6}]}, 0x10) getsockopt$sock_buf(r7, 0x1, 0x1a, 0x0, &(0x7f0000000340)) 4.068930189s ago: executing program 1 (id=13505): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d3750820c80a2103be6f000000010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000540)={0x1c, &(0x7f0000000200)=ANY=[], 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) close(0xffffffffffffffff) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="120100009e173610ef171e7206de0102030109021200010000000009040000000206"], 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000600)={0x44, &(0x7f0000000380)=ANY=[@ANYBLOB="000a04000000d5620963"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0x11a4, &(0x7f0000001740)=ANY=[@ANYBLOB="0010004e940984ae7cbfd7894d9a948e3b02a53dda6e013b2fa624fa25f5c2e769048e3e9e527308028b39d2a4a5b3602c20756c83b77cc6fcc827f0a8954c0520c3985a73577549f27590c67cbf14e31cc337392742b551dce08e1df5827244989ed4bd43c11aa5010f88436090fff7908733fcf04c2f9397c2cc7e908db914dbfb15b0d9e985c7f180e910ebd9181b3b40c3986f2fe2b0c0d4d6311504126ea7064f3bd045be1856a81aedcfd0ec99fd7c9c4ede81842083f7795f877212ffe58d965136310ed1e9b5b465ef5367f683993e19a89772e7d4a6ed7b406ec69ccc42c271ff38b09112a9aad166c2818a7fd103cabc45d266a2dc9010fe3396d294bd07ea0ba004d7afed749521f13072279eaaf17cf97514ee9cfe10e8140de147819dad67d9b29d712fb49e07b70fe4f13fb0ea7589d9287a63a1f56c3b89a158a5daf8f3815cadc11fa638293986c11e74139c17c3d42fb49a5657444b41f6416a6d2df83bb51c5d6b4cbef7e6ce62c8ba1c144e438cdf879e82736f7aa3c6dcaf857a49a5555bfcfe4eecbe43f0f96df207507e32b4ac4689006e7f9f1e73397e86ec4914a41ec9d771f15d93300560e4c99821db8cb4ecaf115de6db50dce214f3dc275e3541676fb5ef539e3381ebb2b9ce5f761daec8e7b925d2a5a685811edda4ba2cfe59b1c72e72038bf0ce804376070048f8d2db6503f2bdf3c736e52c6495416591fd5076846e169fd7ea733b188f9149939eb94f9430e138b4c463cda9a73950bf1cb62b4ac696ce9abb5e24724ab807cdcd1387fedf4c494eacd4cf464fbb20a1c8a470984c1a25ad5dc9c9a59bed24fd58125018fc64aef0f0c40394a8a59c7150ef8b24a3f1d9da7cf9e6a7489cf977e4c2816671b4b9ce386756f8ba67c24b8f6ac170261922dbd0e7511b0932c66b522423eff6820a4910bc054d7ba7f37ba622d7507d2d93833a3671b8ae2eff6681ff57f46673d0d8c9a434a20d5a3b818dc474f271ede5d2e1631510e32857f1cd0433ee467d0cb30e7d006292b7e43e0f2fb1f7a5ffeac1e1c545b74dd49cdcbf2e88f9437716fa97d5d07f474dbe614f7bf653d3c2a98dc5b3827a4216c68615f4cad60be0289fbd770a8c4fc19f1b7c536db48384482e385da2e6513fac3893c3a4a68b355c6a67fe219672826999e077bd5964a1cdd3ce7ed79a03948d8744a53580977fb0f7411bd0b4b03bf2fbad4686e53aed9521178f6ff511a21ab060eded9c0db7feba21fe96940f214e97e814761f6d28c39ebf7718416e4441eac6f30bb6dd62a2c33375c2490f8b8f732d71ca5c183009cb6884d0a1643e7b233040782e94c96e89c4a4a49fb0e9e31bc4ec4b16ec4c4232a083c149f150e71b092c46e762ec91acae90e9905a897eb3edcb5220ac896d0620008450e0c46c9185982f1f77441d5dfb604c32016278bba6969f7957d7a71c5a7c9e69a023da734dfe8c5339ae13866fdaa75ea2a14c07ed84aab929aa13aa8a6f30d9ecc6de4ee3630d9386292bcdb0573b47a17e3d06e95bf217aa17252bebab752896bb7a3c75457bb017586904b9fae26ddc68268bd8ba29a39637579a6b7d336045face90b5fddbb7c672a15985e438172e616137678b38b433db52ba184670e04c16ef1caa7013556cb77770728fbe67fc8fe50a8f368c57d1020f008dfd1a5d373389e8867d8ac6c1c720f9906c19794700b0cc12bc651c1f6da3eb82ab4cec3baa60c8dd4552bccaa61a7a9af77c7bb1b39b7685ca9c6c0084c76293ffacf2c321f4d0d711bb48a2b6d37dc3264d00f8d44012b35ce8ad4d0ac757946c18fa6000c9fabafd8b06ed27af71c18f1fabc4dca46737c1f0fe411e80f4e984eb8b87fa921a0c2172f037365d21278bd2c390d004ee7d945bb29270ea0d93f50e891c3e5bfc347154368ec011bd00bc2bbd76551cc9b76b994e72c1e52eb73c752583a2ef3b80a2903583bfd61412750a8221e5164be423b15f3b0fa0dab727cb8a56db99f5fb0c32c3e99046bab939dce363b6b0cf9468c977f73a8b45ee4a2ac1fc8a1629afc4b623d782f9511b5db1cb99292f372f0c63c4b456e8378900612a1b61b010ba005972d31e28c5e9193f5b0e8a4149dd5465c0e58e44daf2b238eac0f39e616a91817acfa348fbd85549bb7e52942242a26ed478ab823c0293c8b13e74f771532c8a7d76bb948cfc380bc8e4441b8de6051377522f5a50f482d910fbabf7ad947ea852ead3ca2f85d314451406ad80e65e411f7aa43c7d22acdbb388fc618986adb4d2f7b0cde66ddf280fec95f90193d3eaac0d36dd6c399e26cbe050c86ac843bed2fc864754095e9b18c7d0aaddc02a5cbadf97696184434ff6480034f9aff2b6378866dd5131f36f6d0893e18250ed24dcda0fbb31662e62729edef225150f18e0d0603e443fd1b7062a2216eee4d9684d5a2e1d65ce4ebef6c667bae4340ac32a3656b06e1cc117908b7d99179cf2b48c4d26d9400b59fa8c72fda6ecb9f1aad1785cffb76ab0193579a6fd2e97f7e9527cdfa3d5f8f3b281ef073a1aa0cd692f9c99a513a81b0d0fb2ee400a2db848aaeb1aa7173749244672440df9d339c2de1d6daaf44771fd8bc396227d7831eba9d7b2365e2f32c5d76609d78592a1a7e4d64d2200a470acd487c90f15e56f5b01ddbf07615286d98810b58fb4fe1edad8d3bda79efc5949eaa885b8002bb84200f17d7b31d9f4e922125aeab6fe331b93f03db991ec5706dfc64ceeb18e0ba449a8737370473f7c8bab639015f4a523b39decccbbee91ebd9c7baa7aa90ae5d8ba1b58ff680b5f73ba9195e9691750eeb0c31432fdbd8d1dfdcdcb39f08e569fe39d7306795e74b6d6b25739424ceb69e1d94e0927ae83d5d4223cc3b558368a10c03a1ed02957116bf90d0adf24e1ac0d47630be33a9bf4bab1e3e6a2703911e8584d02f130a46297162fffa0a862a1cc913e0903076a533d0b48eeb4d38f9a86d61489ca6805cbe7f61f88c0ef9abba4c20ad0eb378ed432afb2b192700752090588a25936c22eb487f3a624270ecd1bd714b049a5e4ebdcd2b4375ba12952d082e0d9c20d56945959f334c7ed40b2cd4bcac0004ed39fe28bfdad015405295382dbbdc3dc80a8edc28d6755f42de9cf97559e04f6f4f6820a46423e9df5130e97a58065a145dcc2a902470ee4f815911e90a98551bcdbe0c54f61ec1ed2fee837692c7722ace19df10d66391bf1df2641728615a055554004ca8c38148aa91add9c546c0dd5adb3b3548e14b6e6439024b48e1beba9b9b39d57fb4865a9b75eef1dcff0df1a086b365037274ea2ec87435f3ecf02a9ad1a60a7a9bedbe137843a253ebea2a03173077a148dcf80a72046c19b34cc0b5d6647d8f8f84f74c2899eff6a50266fadd4b6516cce6913012b9366c3341a17cd4d98989671b8b1bd7ec6488824dbfa5c102da2417ae7cf1b29bb222540e1e612cdbb71cab7d697de3df0a1adb32cac5a007ff446d71bc2528e35b2d5f4cea9c9157ec3ebce4ba44bb5b01d7ac6629f75f1eaf596341c3b725ed9119545fa4fe0551e3905028305073d68c1ae38c3f3edf18f60af551dc801f2c3d077f1e79099566cec2646e3608c565d88770a1d79000b790629c69a5fb487d7a95b4d8acb62295e3dfd990a8f906ef9141c996b6f545b4976c112a9546a7a73121b7d8ded17d6367040c57dee968a0a49d88d43c9805f71a9e9e69a35d310c2334ced32788463bfdb3f6cb45991675a5591b48bdd67466352a82dd9eb7209fcaae294fc1b2a5fc89cf3dd078afb5978a65803d87caed37d98394ee45a8e4eaccf5b9f9f2f2767691c6714fa8245e14e34fc9d56adde08ed3442aa52924c9038c19cd53200ef09c33196c6ee7dcb6816d80c1cc6ed5e511924e812dd08c022ca606710bb5e6c58b62251376d6f0bf53fb2e3a2ac9e993a484300f25345d242f838d1fd1c63d679ef3c62035a472b94de71945482808e6be3d4321a74cd2023abfb8d7dff140b1a51cb44b7bbbd5e5c3d581efc83579e1b2ba53ce2912020beff92997e563740199abb62efe5984ca1e3af994e1a7f8b18d39ca96cb74d04e7fc906f88d299098519fdd20e714340b0ad26af4ac2e02c37b84dffe642f7e9b62be8718d5e4590f4ae6eab1dd7914a5127bcabb1bf047660a00fb4428fe4124eb8a7656aad75971f7b274715302bdeb863eb8dfe4fc0a22ed17d9a2695a1b29ca2d979b898a40415d1e63c822f151beb9f9321b344dfe5956b2ff00fe9ef996eceda0c1624842af6e9bfa6a0c48a87867b5295330b077e99faf79d49067898b72764f3c588bf5c44bc130ae78a2173c2e495ec0e997674567e36038dc5bcc55147a476530e5ba60d2fdf927dbec072e03126c1f00d7515f61fe80f50f33e0c376dc2ae193c63acac4430a7cfe7985d9980addb6d723438df8a4a0080b7f79b00726b9170deb3c5f7f509e38ccd33936260639a7cf1e2a4829b43b47c5e25cb2859f8643a1635098a75b5d70a75e366d2da4871dcfcb290ea7b7f714472421bcd73332a29aec6daacd0f0c53221166e1c989124b9243dc508b9650dd15b034c90fba0d8c076c424520a10da5e7037190cf2449e05960ffa77788a14167d911f189672381dce6f3fae225efcf79ae549020516ddd492c357a88f22fe8afb42c93455c6e23462326ed7a6521c97db5c59e6fc13f24a6356c849890ecd5d79d6c1ac84717b2e0f78703788150cf20b9114dc2953b13d306caccf2217e26f868ee34d50a8477d4e79cdcc18711f6cc00f234bea41654aa7c5adf4ff4522fb05b9db45c2529ae7c148be280bfc4d6ac7d39c698206b024015d1fb9cc37246859fd674f6dfde189810d0cf65ddffb7029bc71f88078f4e781a440352fa298782a9692567573b6c8143cdc2b95ee5f66dcbee3ff6d0c71349939dfbe497a5d7c8f360e6aacf81a07523db2eef69b638f149bb3e9c7aafb9ba0930becaff9f72d5669fd34e563d1ec4b3704a8d613a7fbb7c7f236c53233e71234cfdfade6a17cdbad2401a97a718b5a29e2c2cfd6382eb6da0b2d2fd3c531f5045140453088b2498de90cc075cc8afe677caa3fc590ec6295b2614fa624c00df51deb577814e6d1a4ffd3a63579e5b16b53867ec8b8a6fa1e055eafe5db4284bd03b8b3b5ba25d558c65aa0ee06fe0a041a6a080a2cad2c897ccfebbe61346e45af2c5e1f8a03179d24d41df859ce7fb75a4f896ea4d328dcdda8762fedeefe96f31cde5d30feae35f3efbb2e82215b3e509465c76280007830230440d128fc5d0c5665967f075e77cf665b0e8d4ff86f31d4b82d072ab022987ece47651bfa06c05e22bb07c1a4efc41de22bd501c0ba1d71a286f46d00bd3cc78d6740ce9eec11701857681a3dc3856569ff6bd2adfce1a0d07318c29349b9bc92de33a5b92f229c37dda78331f37af6ddf8943bf629666b512f9f08e9629aeb515e7b629ae8def52443ec0e7d81ae48d377c3f33f3d93303a547fafcc1ab704fa841a0ca90903e2b97d53b3f9b3426b25921a3d84e394ba1ad05d85722f4fc26e93387a54d24da368c557a673fe26014166dc70acee7d27315b0185a43c695e37cf259a2b1c768c677bde3b621c2a2e40bdad3c58bc631b8dfdb9f0fdd171ee31207929f6f9235fd988c27839ebbe02759f28a271aa751852b30146eaeae1416d1b229ead0828fe0bdc8561181761f66cafc0f618f6fd1e3e2e3b318e26d84486d70366b610ef4d144aff1f03a303a23b342f650b7b17b767b00004ee34d921c2f271db34051c8dbb2b2b3defa7f8a1a466a4ace595e37c1e2927ab5ccc2ef5ed3291d99444cef2160655585ce562e6a7804f233ac6999f81b508cc3f93d67fb8738b175ee6380f1d3126dbd14b4ce01c607f7c0f64268bdbc3b8e1ac0a8df4e0623eeac41f41d633e9faa38297036b3c00383b2e26e1d00c700004ed78f9a1ca3c365f75a77626da65cac9d4af5641e33aa4101f93b1a4e6f58ea2f5452012c849777aca141c0021f96c7526d148138f59c42c12cc481e833e11532b5a0635fef1b6aba9b0e6c396e820d6c337dcb628d40fceff49c6d992460757b26cb0bfbe3df5cfe8265a9ecf8d0c13cb7b6f2cd9677206936309085e9506a5551486caff9743c607f31c6d2bb217c18d4ded7f1cbca8881df0ff2b2c744e6273582268afca911072ae19b8ef9cb3ca40d43f6cf1abf303cf5e66db54feec63b88d59c55d92afb004e00004e79ff1d9b2bb1faa1c60e67d575be52262e6fa0cd329afedb43fae749506acbf3ea321c893592813916074de0e08ebbe5ad316ca48a841850989ac7c099e468d5eb39db91fc0c690c155082f4bda70000a93adbe5df009615c7298d41c7b8bd2906c2e5985158e169ff72ecd95be9"]) 3.710853971s ago: executing program 4 (id=13506): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000010c30000000003002000851000000600000018000000", @ANYRES32], 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, 0x94) recvmmsg(0xffffffffffffffff, &(0x7f0000000980)=[{{0x0, 0x0, 0x0}, 0x7fff}, {{0x0, 0x0, 0x0}, 0x9}], 0x2, 0x10000, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000001c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-512\x00'}, 0x58) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000100)="2e3b4d0793c0907a06a1c65afd96e5c997cc6fe980972c7c01fcfa7c85b0db039afd7c02884bfed5faf093fd548fca4f3a6e7391c8acfda620b96e71569873b28a43558b1c85f34b806418d36165411c9ebd66", 0x53}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c5b5ad28a834e43f387c8282e50e7d6b0cd91a93f87f645b32c1f200f7d9f101c7bcf701e44", 0xa0}], 0x2, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 3.355515886s ago: executing program 4 (id=13507): r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x66, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000000340)) fsopen(&(0x7f00000005c0)='aufs\x00', 0x0) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x4, 0x0, 0x9, 0x2, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) memfd_create(&(0x7f0000000400)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Kp\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec2D\xf7\xb4\xa4\xb9\x06\xfc\xa7\x86\xb4Bxf\xd8\'\x17N\x1ar\xf9+%vm\t\x9f#yN\xb8k\xf6\xc0\xcbW8o\x92\xc7\xffo\xd3\xdc+\x84\x91\x13Ss\xb2h\x12C\xba\x02B\x92\xfeZ\b\xac\xb6[\x86\xbb\xdf\x8b\x7f\xfa\xc2\x8a\x13BW\'3\xa3m{\xd2\xc1p\xf9\xbf\xc5\xcb\xee', 0x6) pipe2$watch_queue(&(0x7f0000000300), 0x80) r3 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000280)="89000000120081ae08061cdc030ec080000000060003000000e2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec08120800030006010000bdad446b9bbc7a46e3988285dcdf12f2130809d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff000000000000000000", 0x89}], 0x1}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) socket(0x10, 0x3, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x40021, 0x0, @thr={&(0x7f0000000600)="25a8a4dc3f61b863ca3aa07f2cf2009cb882026e2de3f166906d2256612559e4df46e4c220ef2257fb6a0ef6fd86008e8b2ef7fdf1e85cd48704f9b34a0b440c00cddde511275e7012dd491d069e8f68dcfc54d4a222074c0fc0ee7b72f52513ae0b30e498cd53c743cfb22619c5eb629b7c30cef50d542c12652319ef112ca5d4a4e561f3d099eb25589ef098a7", &(0x7f00000006c0)="cff5df19531d1084e9849322f74c204d156668796959762fe695416f3c91b804ab97a022b744792e0fbe3b757c08f4b28aaf641fc8dde2e2ac32792712472c868564402474892c4268e5c7786d4a781ab3b4913f79d4740c98c4f7409651b4e2493f678fcfc3b747543140b789ce32eaf0bff3918ca39f19310d7ba65528ff7161f2865f26042f264f8072b5dff293d62d632c28177a4422d3f7ec34cb4b7df9e39f2bd8dcac07415915"}}, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r4 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000240), 0x128941, 0x0) preadv2(r4, &(0x7f0000000200)=[{&(0x7f0000000500)=""/61, 0x3d}], 0x20, 0x40, 0x4, 0x0) r5 = syz_open_dev$usbfs(&(0x7f0000000100), 0x75, 0x4cf40) ioctl$USBDEVFS_FORBID_SUSPEND(r5, 0x5521) 2.896493823s ago: executing program 3 (id=13508): connect$unix(0xffffffffffffffff, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) getrandom(0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x2) write$tun(r0, 0x0, 0xfdef) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x0, 0x1, 0x0, 0x40, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) r1 = epoll_create1(0x0) ioctl$FS_IOC_SETFLAGS(r1, 0x40088a01, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000814000/0x4000)=nil) socket$inet_udp(0x2, 0x2, 0x0) fsopen(&(0x7f0000000000)='virtiofs\x00', 0x1) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) r2 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) mknod$loop(&(0x7f0000000140)='./file0\x00', 0x100, 0x1) socket$rxrpc(0x21, 0x2, 0x2) sendmsg$tipc(r2, 0x0, 0x20008000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_FLUSH(r3, 0x29, 0xd4, &(0x7f0000000100)=0x2, 0x4) 2.555233021s ago: executing program 3 (id=13509): syz_usb_connect(0x114b62f068ee9eba, 0x0, 0x0, &(0x7f0000000b00)={0xa, &(0x7f0000000740)={0xa, 0x6, 0x0, 0x4, 0x6, 0x6, 0xff}, 0x21, &(0x7f0000000780)={0x5, 0xf, 0x21, 0x4, [@ptm_cap={0x3}, @wireless={0xb, 0x10, 0x1, 0x2, 0x6c, 0x7, 0x6, 0x0, 0x3}, @wireless={0xb, 0x10, 0x1, 0x8, 0x1, 0x9, 0x2, 0x7, 0xf0}, @ptm_cap={0x3}]}, 0x7, [{0x7f, &(0x7f00000007c0)=@string={0x7f, 0x3, "6feba05529951956ba39435e0d8d5e4da5fa4e13beeafeb27fc297414de40264a4e96654c5573c44efd4089a5c6c6c6f392d0eb337fe07e778b1e572a11710afaa46b176d7e0a75a4ed13a453dc25ff7f7b7e54fa65ff1c30387bc699a4df167b03d8e1474fe0cabc70a63ef02c71a0d813835b5023f36e84a06b9abf7"}}, {0x4, &(0x7f0000000840)=@lang_id={0x4, 0x3, 0x180a}}, {0x89, &(0x7f00000008c0)=ANY=[@ANYBLOB="8903ef134ff713f22776730470602bfc1633bcb8db1002dac1b5850acba2447509c7e7844f1052045807da175f5b87733e3a522163a327e5eeb81a842b72d75d555cf8f8e89ef05b926ed4fdca90bdad27ee04537af72805032a1254f41f64367fcbd666e80c71f09a285a8129cedbe687dfd1e3c55bea409cbf9342d02f1674c4ee6e3a5c0aaa3521"]}, {0x4, &(0x7f0000000980)=@lang_id={0x4, 0x3, 0x140a}}, {0xd, &(0x7f00000009c0)=@string={0xd, 0x3, "fd1088f5545478122116cd"}}, {0x4, &(0x7f0000000a00)=@lang_id={0x4, 0x3, 0x3009}}, {0xb5, &(0x7f0000000a40)=@string={0xb5, 0x3, "799460b93702442f66bbaadb2da126b11930191db8e6b971c448f3863f5b67e2302c73637d1010e2320019843c1b8b04186969f974a700a5089befeaa5565e882370c83eadd22a38ab6a582d6d7ede68b9e773bc1fe0a61e45adc950ba3ddce050a0a46b435879f0071857d21637d572a44076b8488f6d331e39b099871c8d97dd1115fde45305eae9111301c8dfac6e6045176269766ac2ba81f8ddab0540f1059a6e30ed0cc208582ef23bc77a8e341013b4"}}]}) add_key(&(0x7f0000000000)='dns_resolver\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000100)='[', 0xfeed, 0xffffffffffffffff) 1.849158612s ago: executing program 1 (id=13510): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000010c30000000003002000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000116608000000000000180000000000000000000000000010009500000000000000360a"], 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, 0x94) recvmmsg(0xffffffffffffffff, &(0x7f0000000980)=[{{0x0, 0x0, 0x0}, 0x7fff}, {{0x0, 0x0, 0x0}, 0x9}], 0x2, 0x10000, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000001c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-512\x00'}, 0x58) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)}, {&(0x7f0000000100)="2e3b4d0793c0907a06a1c65afd96e5c997cc6fe980972c7c01fcfa7c85b0db039afd7c02884bfed5faf093fd548fca4f3a6e7391c8acfda620b96e71569873b28a43558b1c85f34b806418d36165411c9ebd66", 0x53}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c5b5ad28a834e43f387c8282e50e7d6b0cd91a93f87f645b32c1f200f7d9f101c7bcf701e4462f36e5f", 0xa4}, {0x0}], 0x4, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) bpf$MAP_CREATE(0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="1e00000007", @ANYRES64, @ANYRES32, @ANYRESHEX, @ANYRESHEX, @ANYRES32], 0x50) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{0x0}, {&(0x7f0000000200)=""/83, 0x53}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 1.580381254s ago: executing program 3 (id=13511): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000180)={0x73622a85, 0x2301, 0x400000000000001}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000480)='./binderfs/binder0\x00', 0x0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) readahead(r0, 0xffffffff, 0x7f) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x25104000) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r3, 0xc0a85320, &(0x7f0000000440)={{0x80}, 'port1\x00', 0xe3, 0x1b1c07}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r3, 0x4058534c, &(0x7f0000000000)={0x80, 0x9, 0x2, 0xe05, 0x20000, 0x28e7}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x8417f, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000100)=[@increfs], 0x0, 0x0, 0x0}) r4 = dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000540)={0x10, 0x0, &(0x7f0000000440)=[@request_death={0x400c6313}], 0x0, 0x1000000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x7e, 0x0, &(0x7f0000000140)="d2ffb49ede31518d65a476a96e4a4e0b75db47ec5454c327bb5b7233ac3507e16db41d0000008000000000a8ca9d22a565ff96d46e88faa10ff4240c00"/70}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000640)={0x8, 0x0, &(0x7f0000000000)=[@decrefs={0x40086315}], 0x0, 0x0, 0x0}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="80000000", @ANYRES16=r6, @ANYBLOB="fc73609d3dc1d7e9050000000000000000008cad2f62e2b7fa1bc847fe8d9cc10b72b7a54b39b669b5dfedb400fd271d05cf239dacfd5aaaea0695581ca1488d5d4389fa55aede804a788366bfdf708d1305cb597ad04e5b67cf2c9f01eb15463891f85e9f36ecca9ca8ff8241a874d7173b7c1326d127d1554bdd6e095d770bd3a920bbbf", @ANYRES32=r7, @ANYBLOB="2b000e0080000000ffffffffffff08021100000008021100000000000000000000000000640001002a010500080026006c09000008000c006400000008000d000000000008003500000000001000a6800a000600ffffffffffff00000800a50001000000"], 0x80}}, 0x0) 1.452945447s ago: executing program 2 (id=13512): mknodat$null(0xffffffffffffff9c, &(0x7f0000002440)='./file0\x00', 0x2, 0x103) (async) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x40000, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000040)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) (async) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000000)={0x8, "b546baa5cc590d3033de259c2996817bb959ebab028deda501009bdeffafde25", 0xffffffffffffffff}) r4 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x5961, 0x10000, 0x0, 0x4e}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r5, r6, r7, &(0x7f0000000280)=@IORING_OP_FUTEX_WAIT={0x33, 0x0, 0x0, 0x8a, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x2}}) (async) io_uring_enter(r4, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) (async) ioctl$SYNC_IOC_MERGE(r2, 0xc0303e03, &(0x7f00000001c0)={"0080bced01eb0100000000000000000700000000000000c900", r3}) (async) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000002180)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r8, 0xffffffffffffffff, 0x0) (async) r9 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB, @ANYRESHEX=r9, @ANYBLOB=',rootmode=00000000000000000020000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) (async) utime(&(0x7f0000000040)='./file0\x00', 0x0) (async) umount2(&(0x7f0000000000)='./file0\x00', 0x3) 1.336086349s ago: executing program 1 (id=13513): sendmsg(0xffffffffffffffff, 0x0, 0x8e98564dc29c29a5) 1.096546774s ago: executing program 2 (id=13514): r0 = socket(0x2, 0x80805, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000180)={r2, 0x5}, &(0x7f0000000240)=0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000010c30000000003", @ANYRES32, @ANYBLOB="00000000000000116608000000000000180000000000000000000000000010009500000000000000360a020000000001180100002020782500000000002020207b1af8ff"], 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, 0x94) bind$alg(0xffffffffffffffff, &(0x7f00000001c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-512\x00'}, 0x58) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)}, {&(0x7f0000000100)="2e3b4d0793c0907a06a1c65afd96e5c997cc6fe980972c7c01fcfa7c85b0db039afd7c02884bfed5faf093fd548fca4f3a6e7391c8acfda620b96e71569873b28a43558b1c85f34b806418d36165411c9ebd66", 0x53}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c5b5ad28a834e43f387c8282e50e7d6b0cd91a93f87f645b32c1f200f7d9f101c7bcf701e4462f36e5fe550", 0xa6}, {&(0x7f0000000440)}], 0x4, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0) r4 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGUSAGE(r4, 0xc018480b, &(0x7f00000000c0)={0x3, 0x100, 0x0, 0x8, 0x7, 0x7}) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) bpf$MAP_CREATE(0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="1e00000007", @ANYRES64, @ANYRES32, @ANYRESHEX, @ANYRESHEX, @ANYRES32], 0x50) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r6 = accept4(r5, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r7, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r8, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r9, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 1.096359041s ago: executing program 1 (id=13515): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000140)={0x64, 0x2, 0x6, 0x5, 0xa00, 0x0, {0x7}, [@IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x11}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xffff}, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x10000}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}]}, 0x64}, 0x1, 0x0, 0x0, 0x810}, 0x4084) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000340)={{0x1, 0x1, 0x10000}}) readv(r0, &(0x7f0000000200)=[{&(0x7f0000004140)=""/4101, 0xb}], 0x2) 749.569844ms ago: executing program 0 (id=13516): r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x200000001003, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0x1, 0x3, 0x1}) pipe2(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$FUSE_INIT(r2, &(0x7f0000000400)={0x6f, 0x0, 0x0, {0x7, 0x28, 0x80000001, 0x0, 0x0, 0x0, 0x2, 0x1}}, 0xfffffede) fcntl$setpipe(r1, 0x407, 0xc000) ioctl$vim2m_VIDIOC_STREAMON(r0, 0x40045612, &(0x7f0000000080)=0x2) ioctl$KVM_CAP_EXIT_HYPERCALL(r2, 0x4068aea3, &(0x7f0000000180)={0xc9, 0x0, 0xc}) ioctl$VIDIOC_DECODER_CMD(r0, 0xc0485660, &(0x7f0000000000)={0x1, 0x1, @stop_pts=0x5}) ioctl$VIDIOC_DECODER_CMD(r0, 0xc0485660, &(0x7f0000000380)={0x1, 0x2, @start={0x1}}) 0s ago: executing program 1 (id=13517): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000010c30000000003002000851000000600000018000000", @ANYRES32], 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, 0x94) recvmmsg(0xffffffffffffffff, &(0x7f0000000980)=[{{0x0, 0x0, 0x0}, 0x7fff}, {{0x0, 0x0, 0x0}, 0x9}], 0x2, 0x10000, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000001c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-512\x00'}, 0x58) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000100)="2e3b4d0793c0907a06a1c65afd96e5c997cc6fe980972c7c01fcfa7c85b0db039afd7c02884bfed5faf093fd548fca4f3a6e7391c8acfda620b96e71569873b28a43558b1c85f34b806418d36165411c9ebd66", 0x53}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c5b5ad28a834e43f387c8282e50e7d6b0cd91a93f87f645b32c1f200f7d9f101c7bcf701e44", 0xa0}], 0x2, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) kernel console output (not intermixed with test programs): tv0680-2.14.0 probing 041e:4007 [ 1655.464293][ T7175] FAULT_INJECTION: forcing a failure. [ 1655.464293][ T7175] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1655.528513][ T7175] CPU: 1 UID: 0 PID: 7175 Comm: syz.4.12913 Tainted: G L syzkaller #0 PREEMPT(full) [ 1655.528540][ T7175] Tainted: [L]=SOFTLOCKUP [ 1655.528546][ T7175] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1655.528556][ T7175] Call Trace: [ 1655.528562][ T7175] [ 1655.528569][ T7175] dump_stack_lvl+0xe8/0x150 [ 1655.528598][ T7175] should_fail_ex+0x40c/0x560 [ 1655.528622][ T7175] _copy_from_user+0x2d/0xb0 [ 1655.528638][ T7175] __sys_bpf+0x2e7/0xd90 [ 1655.528665][ T7175] ? __pfx___sys_bpf+0x10/0x10 [ 1655.528694][ T7175] ? __fget_files+0x2a/0x420 [ 1655.528730][ T7175] ? ksys_write+0x242/0x270 [ 1655.528747][ T7175] ? __pfx_ksys_write+0x10/0x10 [ 1655.528765][ T7175] __x64_sys_bpf+0xba/0xd0 [ 1655.528784][ T7175] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1655.528801][ T7175] do_syscall_64+0x174/0x580 [ 1655.528821][ T7175] ? trace_irq_disable+0x3b/0x140 [ 1655.528840][ T7175] ? clear_bhb_loop+0x40/0x90 [ 1655.528859][ T7175] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1655.528874][ T7175] RIP: 0033:0x7f92f379e019 [ 1655.528889][ T7175] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1655.528903][ T7175] RSP: 002b:00007f92f4612028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1655.528919][ T7175] RAX: ffffffffffffffda RBX: 00007f92f3a25fa0 RCX: 00007f92f379e019 [ 1655.528931][ T7175] RDX: 0000000000000094 RSI: 0000200000000540 RDI: 0000000000000005 [ 1655.528967][ T7175] RBP: 00007f92f4612090 R08: 0000000000000000 R09: 0000000000000000 [ 1655.528980][ T7175] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1655.528994][ T7175] R13: 00007f92f3a26038 R14: 00007f92f3a25fa0 R15: 00007f92f3b4fa48 [ 1655.529029][ T7175] [ 1656.152804][ T7183] netlink: 1752 bytes leftover after parsing attributes in process `syz.4.12917'. [ 1656.519299][ T9413] gspca_stv0680: usb_control_msg error 0, request = 0x88, error = -32 [ 1656.626287][ T9413] stv0680 4-1:4.0: STV(e): camera ping failed!! [ 1656.644279][ T7189] netlink: 1752 bytes leftover after parsing attributes in process `syz.4.12918'. [ 1656.709120][ T9413] stv0680 4-1:4.0: last error: 0, command = 0x0 [ 1656.918676][ T9413] usb 4-1: USB disconnect, device number 15 [ 1657.167073][ T7199] FAULT_INJECTION: forcing a failure. [ 1657.167073][ T7199] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1657.188505][ T7199] CPU: 1 UID: 0 PID: 7199 Comm: syz.1.12923 Tainted: G L syzkaller #0 PREEMPT(full) [ 1657.188539][ T7199] Tainted: [L]=SOFTLOCKUP [ 1657.188548][ T7199] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1657.188561][ T7199] Call Trace: [ 1657.188570][ T7199] [ 1657.188580][ T7199] dump_stack_lvl+0xe8/0x150 [ 1657.188620][ T7199] should_fail_ex+0x40c/0x560 [ 1657.188664][ T7199] _copy_from_user+0x2d/0xb0 [ 1657.188688][ T7199] do_ipv6_setsockopt+0x249/0x3180 [ 1657.188719][ T7199] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 1657.188744][ T7199] ? __pfx_do_ipv6_setsockopt+0x10/0x10 [ 1657.188767][ T7199] ? get_pid_task+0x20/0x1f0 [ 1657.188809][ T7199] ? __lock_acquire+0x683/0x2cf0 [ 1657.188860][ T7199] ? aa_sk_perm+0x6d5/0x900 [ 1657.188883][ T7199] ? __fget_files+0x2a/0x420 [ 1657.188918][ T7199] ? __pfx_aa_sk_perm+0x10/0x10 [ 1657.188942][ T7199] ? __fget_files+0x2a/0x420 [ 1657.188969][ T7199] ? aa_sock_opt_perm+0xff/0x1a0 [ 1657.188996][ T7199] ipv6_setsockopt+0x59/0x170 [ 1657.189018][ T7199] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 1657.189055][ T7199] do_sock_setsockopt+0x17c/0x1b0 [ 1657.189084][ T7199] __x64_sys_setsockopt+0x13d/0x1b0 [ 1657.189112][ T7199] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1657.189136][ T7199] do_syscall_64+0x174/0x580 [ 1657.189163][ T7199] ? trace_irq_disable+0x3b/0x140 [ 1657.189191][ T7199] ? clear_bhb_loop+0x40/0x90 [ 1657.189218][ T7199] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1657.189239][ T7199] RIP: 0033:0x7fe64d39e019 [ 1657.189260][ T7199] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1657.189278][ T7199] RSP: 002b:00007fe64e340028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1657.189301][ T7199] RAX: ffffffffffffffda RBX: 00007fe64d625fa0 RCX: 00007fe64d39e019 [ 1657.189317][ T7199] RDX: 0000000000000030 RSI: 0000000000000029 RDI: 0000000000000003 [ 1657.189330][ T7199] RBP: 00007fe64e340090 R08: 0000000000000090 R09: 0000000000000000 [ 1657.189345][ T7199] R10: 00002000000000c0 R11: 0000000000000246 R12: 0000000000000001 [ 1657.189359][ T7199] R13: 00007fe64d626038 R14: 00007fe64d625fa0 R15: 00007fe64d74fa48 [ 1657.189392][ T7199] [ 1657.950750][ T7215] netlink: 1752 bytes leftover after parsing attributes in process `syz.3.12930'. [ 1658.493729][ T7237] netlink: 'syz.3.12940': attribute type 10 has an invalid length. [ 1658.518162][ T7237] netlink: 40 bytes leftover after parsing attributes in process `syz.3.12940'. [ 1658.559337][ T7237] batadv0: entered promiscuous mode [ 1658.567527][ T7237] batadv0: entered allmulticast mode [ 1658.597338][ T7237] bridge0: port 3(batadv0) entered blocking state [ 1658.626473][ T7237] bridge0: port 3(batadv0) entered disabled state [ 1658.670461][ T7237] bridge0: port 3(batadv0) entered blocking state [ 1658.677066][ T7237] bridge0: port 3(batadv0) entered forwarding state [ 1659.014017][ T9512] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 1659.101515][ T5464] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 1659.111402][ T5464] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 1659.260168][ T9512] usb 5-1: Using ep0 maxpacket: 16 [ 1659.298677][ T9512] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 1659.338245][ T9512] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1659.372705][ T9512] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1659.405462][ T9512] usb 5-1: Product: syz [ 1659.446354][ T9512] usb 5-1: Manufacturer: syz [ 1659.483025][ T9512] usb 5-1: SerialNumber: syz [ 1659.547418][ T9512] usb 5-1: config 0 descriptor?? [ 1659.587151][ T9512] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1659.619333][ T9512] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 1660.205675][ T9512] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 1660.290910][ T7286] netlink: 'syz.0.12957': attribute type 1 has an invalid length. [ 1660.580414][ T7286] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1660.687608][ T9512] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 1660.720440][ T4900] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 1660.728927][ T9512] em28xx 5-1:0.0: board has no eeprom [ 1660.784845][ T7288] bond1: (slave gretap1): making interface the new active one [ 1660.862016][ T7288] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 1660.919945][ T4900] usb 1-1: Using ep0 maxpacket: 8 [ 1660.947826][ T4900] usb 1-1: New USB device found, idVendor=09e8, idProduct=0062, bcdDevice= 0.40 [ 1661.003974][ T4900] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1661.030595][ T4900] usb 1-1: Product: syz [ 1661.045374][ T4900] usb 1-1: Manufacturer: syz [ 1661.070519][ T4900] usb 1-1: SerialNumber: syz [ 1661.116543][ T4900] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 1661.139673][ T9512] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 1661.193443][ T9512] em28xx 5-1:0.0: dvb set to bulk mode. [ 1661.230977][ T1459] em28xx 5-1:0.0: Binding DVB extension [ 1661.474289][ T4900] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 1661.516552][ T4900] usb 1-1: USB disconnect, device number 26 [ 1661.565009][T16969] udevd[16969]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1661.646081][ T7298] FAULT_INJECTION: forcing a failure. [ 1661.646081][ T7298] name failslab, interval 1, probability 0, space 0, times 0 [ 1661.691148][ T7298] CPU: 0 UID: 0 PID: 7298 Comm: syz.2.12959 Tainted: G L syzkaller #0 PREEMPT(full) [ 1661.691186][ T7298] Tainted: [L]=SOFTLOCKUP [ 1661.691196][ T7298] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1661.691209][ T7298] Call Trace: [ 1661.691218][ T7298] [ 1661.691228][ T7298] dump_stack_lvl+0xe8/0x150 [ 1661.691271][ T7298] should_fail_ex+0x40c/0x560 [ 1661.691313][ T7298] should_failslab+0xa8/0x100 [ 1661.691349][ T7298] __kmalloc_noprof+0xfe/0x720 [ 1661.691377][ T7298] ? rcu_is_watching+0x15/0xb0 [ 1661.691398][ T7298] ? tomoyo_realpath_from_path+0xef/0x640 [ 1661.691425][ T7298] ? tomoyo_realpath_from_path+0xef/0x640 [ 1661.691458][ T7298] tomoyo_realpath_from_path+0xef/0x640 [ 1661.691496][ T7298] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1661.691531][ T7298] tomoyo_path_number_perm+0x246/0x5f0 [ 1661.691568][ T7298] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1661.691603][ T7298] ? __lock_acquire+0x683/0x2cf0 [ 1661.691649][ T7298] ? hook_file_ioctl+0x1f0/0x5f0 [ 1661.691693][ T7298] ? __fget_files+0x2a/0x420 [ 1661.691725][ T7298] ? __fget_files+0x2a/0x420 [ 1661.691754][ T7298] ? __fget_files+0x3a2/0x420 [ 1661.691783][ T7298] ? __fget_files+0x2a/0x420 [ 1661.691816][ T7298] security_file_ioctl+0xc3/0x2a0 [ 1661.691852][ T7298] __se_sys_ioctl+0x47/0x170 [ 1661.691876][ T7298] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1661.691901][ T7298] do_syscall_64+0x174/0x580 [ 1661.691927][ T7298] ? trace_irq_disable+0x3b/0x140 [ 1661.691954][ T7298] ? clear_bhb_loop+0x40/0x90 [ 1661.691981][ T7298] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1661.692005][ T7298] RIP: 0033:0x7fd36af9e019 [ 1661.692025][ T7298] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1661.692044][ T7298] RSP: 002b:00007fd36bde2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1661.692068][ T7298] RAX: ffffffffffffffda RBX: 00007fd36b226090 RCX: 00007fd36af9e019 [ 1661.692085][ T7298] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000008 [ 1661.692099][ T7298] RBP: 00007fd36bde2090 R08: 0000000000000000 R09: 0000000000000000 [ 1661.692113][ T7298] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1661.692126][ T7298] R13: 00007fd36b226128 R14: 00007fd36b226090 R15: 00007fd36b34fa48 [ 1661.692161][ T7298] [ 1661.692348][ T7298] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1662.145692][ T7301] netlink: 1752 bytes leftover after parsing attributes in process `syz.1.12960'. [ 1662.467152][ T7259] em28xx 5-1:0.0: reading from i2c device at 0xe failed (error=-5) [ 1662.706655][ T1459] em28xx 5-1:0.0: Registering input extension [ 1663.097257][ T9413] usb 5-1: USB disconnect, device number 43 [ 1663.126943][ T9413] em28xx 5-1:0.0: Disconnecting em28xx [ 1663.155850][ T9413] em28xx 5-1:0.0: Closing input extension [ 1663.244850][ T7336] FAULT_INJECTION: forcing a failure. [ 1663.244850][ T7336] name failslab, interval 1, probability 0, space 0, times 0 [ 1663.339693][ T7336] CPU: 1 UID: 0 PID: 7336 Comm: syz.4.12971 Tainted: G L syzkaller #0 PREEMPT(full) [ 1663.339729][ T7336] Tainted: [L]=SOFTLOCKUP [ 1663.339738][ T7336] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1663.339752][ T7336] Call Trace: [ 1663.339762][ T7336] [ 1663.339772][ T7336] dump_stack_lvl+0xe8/0x150 [ 1663.339811][ T7336] should_fail_ex+0x40c/0x560 [ 1663.339842][ T7336] ? traverse+0xf1/0x620 [ 1663.339868][ T7336] should_failslab+0xa8/0x100 [ 1663.339921][ T7336] __kvmalloc_node_noprof+0x176/0x860 [ 1663.339957][ T7336] ? aa_file_perm+0x18b/0x15f0 [ 1663.339984][ T7336] ? traverse+0xf1/0x620 [ 1663.340025][ T7336] traverse+0xf1/0x620 [ 1663.340047][ T7336] ? aa_file_perm+0x18b/0x15f0 [ 1663.340078][ T7336] ? aa_file_perm+0x4ed/0x15f0 [ 1663.340106][ T7336] seq_read_iter+0xb6a/0xca0 [ 1663.340146][ T7336] seq_read+0x367/0x480 [ 1663.340168][ T7336] ? get_pid_task+0x20/0x1f0 [ 1663.340205][ T7336] ? __pfx_seq_read+0x10/0x10 [ 1663.340236][ T7336] ? apparmor_file_permission+0x1f4/0x300 [ 1663.340342][ T7336] ? __pfx_seq_read+0x10/0x10 [ 1663.340363][ T7336] proc_reg_read+0x1e9/0x2e0 [ 1663.340400][ T7336] ? __pfx_proc_reg_read+0x10/0x10 [ 1663.340418][ T7336] vfs_read+0x213/0xa80 [ 1663.340443][ T7336] ? __pfx_vfs_read+0x10/0x10 [ 1663.340465][ T7336] ? __fget_files+0x2a/0x420 [ 1663.340498][ T7336] ? __fget_files+0x2a/0x420 [ 1663.340524][ T7336] ? __fget_files+0x3a2/0x420 [ 1663.340550][ T7336] ? __fget_files+0x2a/0x420 [ 1663.340583][ T7336] __x64_sys_pread64+0x196/0x220 [ 1663.340603][ T7336] ? __pfx___x64_sys_pread64+0x10/0x10 [ 1663.340627][ T7336] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1663.340647][ T7336] do_syscall_64+0x174/0x580 [ 1663.340669][ T7336] ? trace_irq_disable+0x3b/0x140 [ 1663.340692][ T7336] ? clear_bhb_loop+0x40/0x90 [ 1663.340713][ T7336] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1663.340731][ T7336] RIP: 0033:0x7f92f379e019 [ 1663.340749][ T7336] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1663.340764][ T7336] RSP: 002b:00007f92f4612028 EFLAGS: 00000246 ORIG_RAX: 0000000000000011 [ 1663.340783][ T7336] RAX: ffffffffffffffda RBX: 00007f92f3a25fa0 RCX: 00007f92f379e019 [ 1663.340795][ T7336] RDX: 0000000000000131 RSI: 0000200000000240 RDI: 0000000000000003 [ 1663.340805][ T7336] RBP: 00007f92f4612090 R08: 0000000000000000 R09: 0000000000000000 [ 1663.340816][ T7336] R10: 0000000000000131 R11: 0000000000000246 R12: 0000000000000001 [ 1663.340827][ T7336] R13: 00007f92f3a26038 R14: 00007f92f3a25fa0 R15: 00007f92f3b4fa48 [ 1663.340854][ T7336] [ 1664.116725][ T9413] em28xx 5-1:0.0: Freeing device [ 1664.395310][ T7347] netlink: 1752 bytes leftover after parsing attributes in process `syz.0.12973'. [ 1665.348656][ T7361] bridge0: port 3(batadv0) entered disabled state [ 1665.355485][ T7361] bridge0: port 2(bridge_slave_1) entered disabled state [ 1665.363148][ T7361] bridge0: port 1(bridge_slave_0) entered disabled state [ 1665.641699][ T7361] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1665.685456][ T7361] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1666.506412][ T7361] vlan2: left allmulticast mode [ 1666.522853][ T7361] virt_wifi0: left allmulticast mode [ 1666.620120][T14912] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1666.657798][T14912] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1666.706814][T14912] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1666.752264][T14912] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1667.910233][ T7372] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 1668.096401][ T7372] usb 1-1: New USB device found, idVendor=0c45, idProduct=6005, bcdDevice=b5.55 [ 1668.136470][ T7372] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1668.173358][ T7372] usb 1-1: Product: syz [ 1668.198856][ T7372] usb 1-1: Manufacturer: syz [ 1668.226076][ T7372] usb 1-1: SerialNumber: syz [ 1668.241685][ T7372] usb 1-1: config 0 descriptor?? [ 1668.285138][ T7372] gspca_main: sonixb-2.14.0 probing 0c45:6005 [ 1668.923834][ T7443] could not allocate digest TFM handle sha3-224-ce [ 1669.007159][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 1669.014355][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 1669.524330][ T7461] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1669.603433][ T7372] usb 1-1: USB disconnect, device number 27 [ 1669.916152][ T7473] netlink: 24 bytes leftover after parsing attributes in process `syz.3.13011'. [ 1669.930382][ T7473] netlink: 24 bytes leftover after parsing attributes in process `syz.3.13011'. [ 1670.861519][ T7500] netlink: 72 bytes leftover after parsing attributes in process `syz.0.13021'. [ 1670.885480][ T7500] netlink: 64 bytes leftover after parsing attributes in process `syz.0.13021'. [ 1671.135687][ T7508] netlink: 36 bytes leftover after parsing attributes in process `syz.3.13025'. [ 1671.189506][ T7508] FAULT_INJECTION: forcing a failure. [ 1671.189506][ T7508] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1671.222930][ T7508] CPU: 1 UID: 0 PID: 7508 Comm: syz.3.13025 Tainted: G L syzkaller #0 PREEMPT(full) [ 1671.222966][ T7508] Tainted: [L]=SOFTLOCKUP [ 1671.222975][ T7508] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1671.222988][ T7508] Call Trace: [ 1671.222997][ T7508] [ 1671.223007][ T7508] dump_stack_lvl+0xe8/0x150 [ 1671.223047][ T7508] should_fail_ex+0x40c/0x560 [ 1671.223081][ T7508] _copy_from_user+0x2d/0xb0 [ 1671.223105][ T7508] ___sys_sendmsg+0x1c6/0x360 [ 1671.223132][ T7508] ? __lock_acquire+0x683/0x2cf0 [ 1671.223167][ T7508] ? __pfx____sys_sendmsg+0x10/0x10 [ 1671.223230][ T7508] ? __fget_files+0x2a/0x420 [ 1671.223260][ T7508] ? __fget_files+0x3a2/0x420 [ 1671.223300][ T7508] __x64_sys_sendmsg+0x1b1/0x290 [ 1671.223339][ T7508] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1671.223385][ T7508] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1671.223408][ T7508] do_syscall_64+0x174/0x580 [ 1671.223436][ T7508] ? trace_irq_disable+0x3b/0x140 [ 1671.223464][ T7508] ? clear_bhb_loop+0x40/0x90 [ 1671.223491][ T7508] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1671.223513][ T7508] RIP: 0033:0x7f55da99e019 [ 1671.223533][ T7508] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1671.223553][ T7508] RSP: 002b:00007f55db7b7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1671.223578][ T7508] RAX: ffffffffffffffda RBX: 00007f55dac25fa0 RCX: 00007f55da99e019 [ 1671.223595][ T7508] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1671.223610][ T7508] RBP: 00007f55db7b7090 R08: 0000000000000000 R09: 0000000000000000 [ 1671.223624][ T7508] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1671.223637][ T7508] R13: 00007f55dac26038 R14: 00007f55dac25fa0 R15: 00007f55dad4fa48 [ 1671.223671][ T7508] [ 1671.870749][ T7522] netlink: 40 bytes leftover after parsing attributes in process `syz.3.13032'. [ 1671.903047][ T7522] netlink: 40 bytes leftover after parsing attributes in process `syz.3.13032'. [ 1671.932803][ T7525] FAULT_INJECTION: forcing a failure. [ 1671.932803][ T7525] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1671.977850][ T7525] CPU: 1 UID: 0 PID: 7525 Comm: syz.3.13032 Tainted: G L syzkaller #0 PREEMPT(full) [ 1671.977886][ T7525] Tainted: [L]=SOFTLOCKUP [ 1671.977895][ T7525] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1671.977908][ T7525] Call Trace: [ 1671.977917][ T7525] [ 1671.977926][ T7525] dump_stack_lvl+0xe8/0x150 [ 1671.977963][ T7525] should_fail_ex+0x40c/0x560 [ 1671.977997][ T7525] _copy_from_user+0x2d/0xb0 [ 1671.978020][ T7525] ___sys_sendmsg+0x1c6/0x360 [ 1671.978047][ T7525] ? __lock_acquire+0x683/0x2cf0 [ 1671.978082][ T7525] ? __pfx____sys_sendmsg+0x10/0x10 [ 1671.978145][ T7525] ? __fget_files+0x2a/0x420 [ 1671.978181][ T7525] ? __fget_files+0x3a2/0x420 [ 1671.978221][ T7525] __x64_sys_sendmsg+0x1b1/0x290 [ 1671.978251][ T7525] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1671.978294][ T7525] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1671.978317][ T7525] do_syscall_64+0x174/0x580 [ 1671.978351][ T7525] ? trace_irq_disable+0x3b/0x140 [ 1671.978378][ T7525] ? clear_bhb_loop+0x40/0x90 [ 1671.978405][ T7525] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1671.978428][ T7525] RIP: 0033:0x7f55da99e019 [ 1671.978464][ T7525] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1671.978484][ T7525] RSP: 002b:00007f55db796028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1671.978508][ T7525] RAX: ffffffffffffffda RBX: 00007f55dac26090 RCX: 00007f55da99e019 [ 1671.978525][ T7525] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1671.978539][ T7525] RBP: 00007f55db796090 R08: 0000000000000000 R09: 0000000000000000 [ 1671.978552][ T7525] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1671.978566][ T7525] R13: 00007f55dac26128 R14: 00007f55dac26090 R15: 00007f55dad4fa48 [ 1671.978600][ T7525] [ 1672.354791][ T7522] netlink: 40 bytes leftover after parsing attributes in process `syz.3.13032'. [ 1672.371235][ T7522] netlink: 40 bytes leftover after parsing attributes in process `syz.3.13032'. [ 1672.401899][ T1459] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 1672.426664][ T7531] netlink: 'syz.0.13035': attribute type 28 has an invalid length. [ 1672.435044][ T7531] netlink: 28 bytes leftover after parsing attributes in process `syz.0.13035'. [ 1672.543962][ T7536] FAULT_INJECTION: forcing a failure. [ 1672.543962][ T7536] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1672.560832][ T1459] usb 5-1: Using ep0 maxpacket: 32 [ 1672.582408][ T1459] usb 5-1: config 2 has an invalid interface number: 88 but max is 0 [ 1672.593634][ T1459] usb 5-1: config 2 has no interface number 0 [ 1672.614022][ T7536] CPU: 0 UID: 0 PID: 7536 Comm: syz.1.13034 Tainted: G L syzkaller #0 PREEMPT(full) [ 1672.614062][ T7536] Tainted: [L]=SOFTLOCKUP [ 1672.614071][ T7536] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1672.614085][ T7536] Call Trace: [ 1672.614094][ T7536] [ 1672.614104][ T7536] dump_stack_lvl+0xe8/0x150 [ 1672.614142][ T7536] should_fail_ex+0x40c/0x560 [ 1672.614184][ T7536] _copy_from_user+0x2d/0xb0 [ 1672.614208][ T7536] __sys_bpf+0x2e7/0xd90 [ 1672.614245][ T7536] ? __pfx___sys_bpf+0x10/0x10 [ 1672.614277][ T7536] ? __fget_files+0x2a/0x420 [ 1672.614316][ T7536] ? ksys_write+0x242/0x270 [ 1672.614335][ T7536] ? __pfx_ksys_write+0x10/0x10 [ 1672.614356][ T7536] __x64_sys_bpf+0xba/0xd0 [ 1672.614377][ T7536] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1672.614396][ T7536] do_syscall_64+0x174/0x580 [ 1672.614418][ T7536] ? trace_irq_disable+0x3b/0x140 [ 1672.614444][ T7536] ? clear_bhb_loop+0x40/0x90 [ 1672.614469][ T7536] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1672.614486][ T7536] RIP: 0033:0x7fe64d39e019 [ 1672.614502][ T7536] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1672.614517][ T7536] RSP: 002b:00007fe64e2fe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1672.614536][ T7536] RAX: ffffffffffffffda RBX: 00007fe64d626180 RCX: 00007fe64d39e019 [ 1672.614549][ T7536] RDX: 0000000000000038 RSI: 0000200000000300 RDI: 000000000000001a [ 1672.614560][ T7536] RBP: 00007fe64e2fe090 R08: 0000000000000000 R09: 0000000000000000 [ 1672.614571][ T7536] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1672.614581][ T7536] R13: 00007fe64d626218 R14: 00007fe64d626180 R15: 00007fe64d74fa48 [ 1672.614606][ T7536] [ 1672.615424][ T1459] usb 5-1: config 2 interface 88 altsetting 25 bulk endpoint 0x6 has invalid maxpacket 256 [ 1672.854834][ T1459] usb 5-1: config 2 interface 88 has no altsetting 0 [ 1672.875110][ T1459] usb 5-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.06 [ 1672.891061][ T1459] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 1672.909486][ T1459] usb 5-1: Product: syz [ 1672.924453][ T1459] usb 5-1: Manufacturer: syz [ 1672.942373][ T1459] usb 5-1: SerialNumber: syz [ 1672.997317][ T7520] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1673.212584][ T7520] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1673.231000][ T7546] netlink: 'syz.3.13041': attribute type 1 has an invalid length. [ 1673.268422][ T5178] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 1673.431701][ T5178] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 1673.458115][ T5178] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1673.475947][ T5178] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1673.492912][ T5178] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 1673.509380][ T5178] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 1673.520388][ T5178] usb 3-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 1673.531521][ T5178] usb 3-1: Manufacturer: syz [ 1673.554613][ T5178] usb 3-1: config 0 descriptor?? [ 1673.828381][ T7375] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 1673.847077][ T7520] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1673.878144][ T7520] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1674.008380][ T7375] usb 1-1: Using ep0 maxpacket: 32 [ 1674.016543][ T7375] usb 1-1: config 0 has an invalid interface number: 12 but max is 0 [ 1674.025793][ T7375] usb 1-1: config 0 has no interface number 0 [ 1674.043138][ T7375] usb 1-1: config 0 interface 12 has no altsetting 0 [ 1674.058881][ T7375] usb 1-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 1674.072421][ T7375] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1674.088628][ T7375] usb 1-1: Product: syz [ 1674.098537][ T1459] asix 5-1:2.88 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 1674.110123][ T5178] appleir 0003:05AC:8243.0029: unknown main item tag 0x0 [ 1674.136803][ T1459] asix 5-1:2.88 (unnamed net_device) (uninitialized): Failed to write RX_CTL mode to 0x0080: ffffffb9 [ 1674.166672][ T7375] usb 1-1: Manufacturer: syz [ 1674.173319][ T7375] usb 1-1: SerialNumber: syz [ 1674.183527][ T1459] asix 5-1:2.88: probe with driver asix failed with error -71 [ 1674.220057][ T7375] usb 1-1: config 0 descriptor?? [ 1674.241461][ T5178] appleir 0003:05AC:8243.0029: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.2-1/input0 [ 1674.255483][ T1459] usb 5-1: USB disconnect, device number 44 [ 1674.505140][ T7542] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1674.525621][ T7542] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1674.562151][ T7372] usb 3-1: USB disconnect, device number 34 [ 1674.905598][ T7553] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1674.928916][ T7553] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1675.389650][ T7573] __nla_validate_parse: 1 callbacks suppressed [ 1675.389665][ T7573] netlink: 8 bytes leftover after parsing attributes in process `syz.4.13051'. [ 1676.087493][ T7595] netlink: 16 bytes leftover after parsing attributes in process `syz.1.13057'. [ 1676.194143][ T7599] netlink: 8 bytes leftover after parsing attributes in process `syz.3.13060'. [ 1676.223137][ T7599] netlink: 4 bytes leftover after parsing attributes in process `syz.3.13060'. [ 1676.261601][ T7599] netlink: 8 bytes leftover after parsing attributes in process `syz.3.13060'. [ 1676.462308][ T7607] netlink: 4 bytes leftover after parsing attributes in process `syz.1.13064'. [ 1676.471461][ T7599] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1676.485342][ T7599] 8021q: adding VLAN 0 to HW filter on device team0 [ 1676.519531][ T7599] bridge0: port 3(batadv0) entered blocking state [ 1676.528428][ T7599] bridge0: port 3(batadv0) entered forwarding state [ 1676.558903][ T7599] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1676.620409][ T7599] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1676.632903][ T7599] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1676.673105][ T7599] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1676.689960][ T7599] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1676.716291][ T7599] veth1_vlan: left promiscuous mode [ 1676.739370][ T7599] veth0_vlan: left promiscuous mode [ 1676.747624][ T7599] veth0_vlan: entered promiscuous mode [ 1676.770090][ T7599] veth1_vlan: entered promiscuous mode [ 1676.783284][ T7599] veth1_macvtap: left promiscuous mode [ 1676.795820][ T7599] veth0_macvtap: left promiscuous mode [ 1676.804811][ T7599] veth0_macvtap: entered promiscuous mode [ 1676.823819][ T7599] veth1_macvtap: entered promiscuous mode [ 1676.854876][ T7599] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1676.869038][ T7617] netlink: 164 bytes leftover after parsing attributes in process `syz.1.13066'. [ 1676.880191][ T7599] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1676.888935][ T7599] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1676.901839][ T7599] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1676.945476][ T3310] bridge0: port 1(bridge_slave_0) entered blocking state [ 1676.952807][ T3310] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1676.975840][ T3310] bridge0: port 2(bridge_slave_1) entered blocking state [ 1676.983180][ T3310] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1677.141532][ T7375] f81534 1-1:0.12: f81534_set_register: reg: 1001 data: f1 failed: -71 [ 1677.152819][ T3310] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1677.163669][ T7375] f81534 1-1:0.12: f81534_find_config_idx: read failed: -71 [ 1677.182518][ T3310] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1677.193841][ T7375] f81534 1-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 1677.202574][ T7375] f81534 1-1:0.12: probe with driver f81534 failed with error -71 [ 1677.222710][ T7375] usb 1-1: USB disconnect, device number 28 [ 1677.281354][ T787] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1677.307301][ T787] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1677.326428][ T787] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1677.336870][ T787] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1677.372383][ T3310] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1677.385620][ T3310] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1677.611248][ T7393] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 1677.789232][ T7393] usb 3-1: Using ep0 maxpacket: 16 [ 1677.821664][ T7393] usb 3-1: config 0 has no interfaces? [ 1677.841945][ T7393] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1677.870128][ T7393] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1677.908155][ T7393] usb 3-1: config 0 descriptor?? [ 1678.128967][ T7375] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 1678.139059][ T7620] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1678.155493][ T7620] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1678.164521][T16929] Bluetooth: hci4: adv larger than maximum supported [ 1678.164582][T16929] Bluetooth: hci4: Malformed LE Event: 0x0d [ 1678.217456][ T7620] 0: reclassify loop, rule prio 0, protocol 03 [ 1678.227981][ T7620] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1678.242083][ T7620] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1678.298401][ T7375] usb 4-1: Using ep0 maxpacket: 16 [ 1678.307882][ T7375] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1678.322828][ T7375] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1678.332755][ T7375] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1678.345859][ T7375] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1678.355413][ T7375] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1678.367177][ T7393] usb 3-1: USB disconnect, device number 35 [ 1678.372368][ T7375] usb 4-1: config 0 descriptor?? [ 1678.830528][ T7375] input: HID 045e:07da as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:045E:07DA.002A/input/input64 [ 1678.953593][ T7375] microsoft 0003:045E:07DA.002A: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.3-1/input0 [ 1679.085873][ T9514] usb 4-1: USB disconnect, device number 16 [ 1679.169930][ T7650] fido_id[7650]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 1680.115726][ T7375] usb 3-1: new low-speed USB device number 36 using dummy_hcd [ 1680.298750][ T7375] usb 3-1: Invalid ep0 maxpacket: 32 [ 1680.444069][ T7375] usb 3-1: new low-speed USB device number 37 using dummy_hcd [ 1680.466473][ T7688] mmap: syz.0.13096 (7688): VmData 25702400 exceed data ulimit 9. Update limits or use boot option ignore_rlimit_data. [ 1680.484557][ T7688] netlink: 8 bytes leftover after parsing attributes in process `syz.0.13096'. [ 1680.628653][ T7375] usb 3-1: Invalid ep0 maxpacket: 32 [ 1680.642820][ T7375] usb usb3-port1: attempt power cycle [ 1680.988621][ T7375] usb 3-1: new low-speed USB device number 38 using dummy_hcd [ 1681.039227][ T7375] usb 3-1: Invalid ep0 maxpacket: 32 [ 1681.059525][ T7393] usb 4-1: new full-speed USB device number 17 using dummy_hcd [ 1681.075633][ T7705] netlink: 24 bytes leftover after parsing attributes in process `syz.1.13100'. [ 1681.118568][ T7704] netlink: 64 bytes leftover after parsing attributes in process `syz.4.13101'. [ 1681.190925][ T7375] usb 3-1: new low-speed USB device number 39 using dummy_hcd [ 1681.230154][ T7375] usb 3-1: Invalid ep0 maxpacket: 32 [ 1681.243825][ T7393] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1681.261382][ T7375] usb usb3-port1: unable to enumerate USB device [ 1681.288371][ T7393] usb 4-1: New USB device found, idVendor=06f8, idProduct=301b, bcdDevice=bb.39 [ 1681.308719][ T7705] kAFS: unable to lookup cell 'ÿ' [ 1681.318392][T26973] Bluetooth: hci2: command 0x0406 tx timeout [ 1681.321815][ T7393] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1681.380165][ T7393] usb 4-1: Product: syz [ 1681.404982][ T7393] usb 4-1: Manufacturer: syz [ 1681.424040][ T7393] usb 4-1: SerialNumber: syz [ 1681.452043][ T7393] usb 4-1: config 0 descriptor?? [ 1681.484616][ T7393] gspca_main: gspca_pac7302-2.14.0 probing 06f8:301b [ 1682.008649][ T7393] gspca_pac7302: reg_w() failed i: ff v: 01 error -110 [ 1682.025581][ T7393] gspca_pac7302 4-1:0.0: probe with driver gspca_pac7302 failed with error -110 [ 1682.865436][ T7718] netlink: 16 bytes leftover after parsing attributes in process `syz.1.13105'. [ 1683.348757][ T7375] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 1683.530860][ T7375] usb 1-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1683.555598][ T7375] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1683.589837][ T7375] usb 1-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1683.621083][ T7375] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1683.641768][ T7375] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1683.680385][ T7375] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 1683.707225][ T7375] usb 1-1: invalid MIDI out EP 0 [ 1683.945158][ T7374] usb 4-1: USB disconnect, device number 17 [ 1684.008207][ T7375] snd-usb-audio 1-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 1684.083380][ T7375] usb 1-1: USB disconnect, device number 29 [ 1684.276996][ T7742] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.13116'. [ 1685.065237][ T7767] FAULT_INJECTION: forcing a failure. [ 1685.065237][ T7767] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1685.081455][ T7767] CPU: 1 UID: 0 PID: 7767 Comm: syz.0.13128 Tainted: G L syzkaller #0 PREEMPT(full) [ 1685.081491][ T7767] Tainted: [L]=SOFTLOCKUP [ 1685.081499][ T7767] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1685.081512][ T7767] Call Trace: [ 1685.081521][ T7767] [ 1685.081531][ T7767] dump_stack_lvl+0xe8/0x150 [ 1685.081570][ T7767] should_fail_ex+0x40c/0x560 [ 1685.081604][ T7767] _copy_from_user+0x2d/0xb0 [ 1685.081627][ T7767] copy_from_sockptr+0x5e/0x90 [ 1685.081653][ T7767] do_ipv6_setsockopt+0x18d7/0x3180 [ 1685.081695][ T7767] ? __pfx_do_ipv6_setsockopt+0x10/0x10 [ 1685.081718][ T7767] ? get_pid_task+0x20/0x1f0 [ 1685.081760][ T7767] ? __lock_acquire+0x683/0x2cf0 [ 1685.081812][ T7767] ? aa_sk_perm+0x6d5/0x900 [ 1685.081837][ T7767] ? __fget_files+0x2a/0x420 [ 1685.081881][ T7767] ? __fget_files+0x2a/0x420 [ 1685.081908][ T7767] ? aa_sock_opt_perm+0xff/0x1a0 [ 1685.081935][ T7767] ipv6_setsockopt+0x59/0x170 [ 1685.081956][ T7767] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 1685.081994][ T7767] do_sock_setsockopt+0x17c/0x1b0 [ 1685.082025][ T7767] __x64_sys_setsockopt+0x13d/0x1b0 [ 1685.082053][ T7767] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1685.082078][ T7767] do_syscall_64+0x174/0x580 [ 1685.082105][ T7767] ? trace_irq_disable+0x3b/0x140 [ 1685.082133][ T7767] ? clear_bhb_loop+0x40/0x90 [ 1685.082160][ T7767] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1685.082181][ T7767] RIP: 0033:0x7f526339e019 [ 1685.082202][ T7767] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1685.082221][ T7767] RSP: 002b:00007f526423a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1685.082244][ T7767] RAX: ffffffffffffffda RBX: 00007f5263625fa0 RCX: 00007f526339e019 [ 1685.082260][ T7767] RDX: 000000000000001b RSI: 0000000000000029 RDI: 0000000000000003 [ 1685.082273][ T7767] RBP: 00007f526423a090 R08: 0000000000000014 R09: 0000000000000000 [ 1685.082287][ T7767] R10: 0000200000000200 R11: 0000000000000246 R12: 0000000000000001 [ 1685.082301][ T7767] R13: 00007f5263626038 R14: 00007f5263625fa0 R15: 00007f526374fa48 [ 1685.082335][ T7767] [ 1685.418110][ T7375] IPVS: starting estimator thread 0... [ 1685.530265][ T7772] IPVS: using max 30 ests per chain, 72000 per kthread [ 1685.551560][ T7780] FAULT_INJECTION: forcing a failure. [ 1685.551560][ T7780] name failslab, interval 1, probability 0, space 0, times 0 [ 1685.569808][ T7780] CPU: 1 UID: 0 PID: 7780 Comm: syz.2.13134 Tainted: G L syzkaller #0 PREEMPT(full) [ 1685.569841][ T7780] Tainted: [L]=SOFTLOCKUP [ 1685.569850][ T7780] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1685.569862][ T7780] Call Trace: [ 1685.569872][ T7780] [ 1685.569881][ T7780] dump_stack_lvl+0xe8/0x150 [ 1685.569920][ T7780] should_fail_ex+0x40c/0x560 [ 1685.569954][ T7780] should_failslab+0xa8/0x100 [ 1685.569996][ T7780] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 1685.570024][ T7780] ? local_lock_release+0x9c/0x160 [ 1685.570048][ T7780] ? __alloc_skb+0x1d7/0x7a0 [ 1685.570077][ T7780] ? __alloc_skb+0x1d7/0x7a0 [ 1685.570106][ T7780] __alloc_skb+0x1d7/0x7a0 [ 1685.570133][ T7780] netlink_sendmsg+0x5d4/0xb40 [ 1685.570247][ T7780] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1685.570279][ T7780] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1685.570309][ T7780] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1685.570335][ T7780] sock_sendmsg_nosec+0x13a/0x180 [ 1685.570371][ T7780] ____sys_sendmsg+0x54e/0x850 [ 1685.570402][ T7780] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1685.570438][ T7780] ? import_iovec+0x73/0xa0 [ 1685.570464][ T7780] ___sys_sendmsg+0x2a5/0x360 [ 1685.570488][ T7780] ? __lock_acquire+0x683/0x2cf0 [ 1685.570523][ T7780] ? __pfx____sys_sendmsg+0x10/0x10 [ 1685.570584][ T7780] ? __fget_files+0x2a/0x420 [ 1685.570613][ T7780] ? __fget_files+0x3a2/0x420 [ 1685.570652][ T7780] __x64_sys_sendmsg+0x1b1/0x290 [ 1685.570681][ T7780] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1685.570726][ T7780] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1685.570750][ T7780] do_syscall_64+0x174/0x580 [ 1685.570776][ T7780] ? trace_irq_disable+0x3b/0x140 [ 1685.570804][ T7780] ? clear_bhb_loop+0x40/0x90 [ 1685.570830][ T7780] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1685.570851][ T7780] RIP: 0033:0x7fd36af9e019 [ 1685.570871][ T7780] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1685.570890][ T7780] RSP: 002b:00007fd36be03028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1685.570914][ T7780] RAX: ffffffffffffffda RBX: 00007fd36b225fa0 RCX: 00007fd36af9e019 [ 1685.570931][ T7780] RDX: 0000000000000000 RSI: 0000200000000340 RDI: 0000000000000003 [ 1685.570944][ T7780] RBP: 00007fd36be03090 R08: 0000000000000000 R09: 0000000000000000 [ 1685.570958][ T7780] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1685.570971][ T7780] R13: 00007fd36b226038 R14: 00007fd36b225fa0 R15: 00007fd36b34fa48 [ 1685.571004][ T7780] [ 1685.605291][ T7775] netlink: 1752 bytes leftover after parsing attributes in process `syz.0.13130'. [ 1685.799020][ T5178] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 1686.020436][ T5178] usb 2-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 1686.030748][ T5178] usb 2-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 1686.062657][ T5178] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1686.107012][ T5178] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 1686.147440][ T7797] netlink: 1624 bytes leftover after parsing attributes in process `syz.0.13140'. [ 1686.289802][ T7805] nicvf0: entered promiscuous mode [ 1686.403417][ T7812] netlink: 1752 bytes leftover after parsing attributes in process `syz.0.13147'. [ 1686.925215][ T30] kauditd_printk_skb: 28 callbacks suppressed [ 1686.925236][ T30] audit: type=1400 audit(1785577008.899:3333): apparmor="DENIED" operation="setprocattr" info="exec" error=-22 profile="unconfined" pid=7830 comm="syz.4.13153" [ 1687.010687][ T7834] FAULT_INJECTION: forcing a failure. [ 1687.010687][ T7834] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1687.038595][ T7834] CPU: 0 UID: 0 PID: 7834 Comm: syz.0.13154 Tainted: G L syzkaller #0 PREEMPT(full) [ 1687.038633][ T7834] Tainted: [L]=SOFTLOCKUP [ 1687.038641][ T7834] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1687.038653][ T7834] Call Trace: [ 1687.038668][ T7834] [ 1687.038676][ T7834] dump_stack_lvl+0xe8/0x150 [ 1687.038705][ T7834] should_fail_ex+0x40c/0x560 [ 1687.038729][ T7834] _copy_from_user+0x2d/0xb0 [ 1687.038744][ T7834] sctp_getsockopt_pr_supported+0xbb/0x510 [ 1687.038860][ T7834] ? __pfx_sctp_getsockopt_pr_supported+0x10/0x10 [ 1687.038878][ T7834] ? sctp_getsockopt+0x12f/0xb90 [ 1687.038916][ T7834] ? __local_bh_enable_ip+0xd0/0x130 [ 1687.038939][ T7834] sctp_getsockopt+0x9f8/0xb90 [ 1687.038959][ T7834] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 1687.038984][ T7834] do_sock_getsockopt+0x51d/0x7e0 [ 1687.039007][ T7834] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 1687.039036][ T7834] ? __fget_files+0x3a2/0x420 [ 1687.039058][ T7834] ? __fget_files+0x2a/0x420 [ 1687.039084][ T7834] __x64_sys_getsockopt+0x1a4/0x240 [ 1687.039106][ T7834] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1687.039123][ T7834] do_syscall_64+0x174/0x580 [ 1687.039142][ T7834] ? trace_irq_disable+0x3b/0x140 [ 1687.039162][ T7834] ? clear_bhb_loop+0x40/0x90 [ 1687.039181][ T7834] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1687.039196][ T7834] RIP: 0033:0x7f526339e019 [ 1687.039211][ T7834] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1687.039223][ T7834] RSP: 002b:00007f526423a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 1687.039240][ T7834] RAX: ffffffffffffffda RBX: 00007f5263625fa0 RCX: 00007f526339e019 [ 1687.039252][ T7834] RDX: 0000000000000071 RSI: 0000000000000084 RDI: 0000000000000003 [ 1687.039261][ T7834] RBP: 00007f526423a090 R08: 00002000000002c0 R09: 0000000000000000 [ 1687.039272][ T7834] R10: 0000200000000280 R11: 0000000000000246 R12: 0000000000000001 [ 1687.039282][ T7834] R13: 00007f5263626038 R14: 00007f5263625fa0 R15: 00007f526374fa48 [ 1687.039305][ T7834] [ 1687.161408][ T5178] gspca_stv0680: usb_control_msg error 0, request = 0x88, error = -32 [ 1687.382691][ T7838] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.13156'. [ 1687.444533][ T5178] stv0680 2-1:4.0: STV(e): camera ping failed!! [ 1687.461403][ T5178] stv0680 2-1:4.0: last error: 0, command = 0x0 [ 1687.474402][ T7843] netlink: 1624 bytes leftover after parsing attributes in process `syz.0.13155'. [ 1687.666617][ T5178] usb 2-1: USB disconnect, device number 37 [ 1687.679611][ T7848] netlink: 16 bytes leftover after parsing attributes in process `syz.2.13157'. [ 1687.866396][ T7851] netlink: 1752 bytes leftover after parsing attributes in process `syz.0.13159'. [ 1688.034097][ T7855] netlink: 1752 bytes leftover after parsing attributes in process `syz.4.13160'. [ 1688.062374][ T7853] netlink: 1752 bytes leftover after parsing attributes in process `syz.0.13161'. [ 1688.442566][ T7866] netlink: 64 bytes leftover after parsing attributes in process `syz.1.13165'. [ 1688.554904][ T7864] FAULT_INJECTION: forcing a failure. [ 1688.554904][ T7864] name failslab, interval 1, probability 0, space 0, times 0 [ 1688.686150][ T7864] CPU: 0 UID: 0 PID: 7864 Comm: syz.1.13165 Tainted: G L syzkaller #0 PREEMPT(full) [ 1688.686187][ T7864] Tainted: [L]=SOFTLOCKUP [ 1688.686196][ T7864] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1688.686209][ T7864] Call Trace: [ 1688.686218][ T7864] [ 1688.686228][ T7864] dump_stack_lvl+0xe8/0x150 [ 1688.686267][ T7864] should_fail_ex+0x40c/0x560 [ 1688.686301][ T7864] should_failslab+0xa8/0x100 [ 1688.686337][ T7864] __kmalloc_noprof+0xfe/0x720 [ 1688.686367][ T7864] ? tomoyo_encode+0x2ad/0x570 [ 1688.686392][ T7864] ? tomoyo_encode+0x2ad/0x570 [ 1688.686425][ T7864] tomoyo_encode+0x2ad/0x570 [ 1688.686457][ T7864] tomoyo_realpath_from_path+0x5fa/0x640 [ 1688.686495][ T7864] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1688.686530][ T7864] tomoyo_path_number_perm+0x246/0x5f0 [ 1688.686568][ T7864] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1688.686601][ T7864] ? __lock_acquire+0x683/0x2cf0 [ 1688.686653][ T7864] ? hook_file_ioctl+0x1f0/0x5f0 [ 1688.686697][ T7864] ? __fget_files+0x2a/0x420 [ 1688.686729][ T7864] ? __fget_files+0x2a/0x420 [ 1688.686757][ T7864] ? __fget_files+0x3a2/0x420 [ 1688.686785][ T7864] ? __fget_files+0x2a/0x420 [ 1688.686819][ T7864] security_file_ioctl+0xc3/0x2a0 [ 1688.686862][ T7864] __se_sys_ioctl+0x47/0x170 [ 1688.686885][ T7864] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1688.686909][ T7864] do_syscall_64+0x174/0x580 [ 1688.686936][ T7864] ? trace_irq_disable+0x3b/0x140 [ 1688.686964][ T7864] ? clear_bhb_loop+0x40/0x90 [ 1688.686990][ T7864] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1688.687011][ T7864] RIP: 0033:0x7fe64d39e019 [ 1688.687031][ T7864] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1688.687049][ T7864] RSP: 002b:00007fe64e340028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1688.687073][ T7864] RAX: ffffffffffffffda RBX: 00007fe64d625fa0 RCX: 00007fe64d39e019 [ 1688.687089][ T7864] RDX: 0000200000000040 RSI: 0000000000008914 RDI: 0000000000000006 [ 1688.687104][ T7864] RBP: 00007fe64e340090 R08: 0000000000000000 R09: 0000000000000000 [ 1688.687117][ T7864] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1688.687130][ T7864] R13: 00007fe64d626038 R14: 00007fe64d625fa0 R15: 00007fe64d74fa48 [ 1688.687164][ T7864] [ 1688.741223][ T7864] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1689.129418][ T7864] syzkaller1: entered promiscuous mode [ 1689.171416][ T7864] syzkaller1: entered allmulticast mode [ 1690.209538][ T1459] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 1690.348938][ T7375] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 1690.378397][ T1459] usb 3-1: Using ep0 maxpacket: 8 [ 1690.408922][ T1459] usb 3-1: config 179 has an invalid interface number: 65 but max is 0 [ 1690.426741][ T1459] usb 3-1: config 179 has no interface number 0 [ 1690.436220][ T1459] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1690.475100][ T1459] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1690.507970][ T1459] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1690.541402][ T1459] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1690.561744][ T7375] usb 4-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 1690.583433][ T7375] usb 4-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 1690.596831][ T1459] usb 3-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1690.631214][ T1459] usb 3-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1690.639036][ T7375] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1690.647903][ T1459] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1690.676063][ T7892] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1690.710371][ T7375] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 1690.872861][ T7907] __nla_validate_parse: 3 callbacks suppressed [ 1690.872941][ T7907] netlink: 1752 bytes leftover after parsing attributes in process `syz.4.13179'. [ 1691.171120][ T7892] input: syz1 as /devices/virtual/input/input65 [ 1691.449022][ T1459] usb 2-1: new full-speed USB device number 38 using dummy_hcd [ 1691.565618][T16929] Bluetooth: hci5: command 0x0406 tx timeout [ 1691.618442][ T1459] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1691.636065][ T1459] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1691.651625][ T1459] usb 2-1: Product: syz [ 1691.656762][ T1459] usb 2-1: Manufacturer: syz [ 1691.661792][ T1459] usb 2-1: SerialNumber: syz [ 1691.674875][ T1459] usb 2-1: config 0 descriptor?? [ 1691.741069][ T10] usb 3-1: USB disconnect, device number 40 [ 1691.741284][ C1] xpad 3-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1691.755412][ C1] xpad 3-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1691.799777][ T7375] gspca_stv0680: usb_control_msg error 0, request = 0x88, error = -32 [ 1691.827829][ T7375] stv0680 4-1:4.0: STV(e): camera ping failed!! [ 1691.843647][ T7375] stv0680 4-1:4.0: last error: 0, command = 0x0 [ 1691.901681][ T7915] Invalid argument reading file caps for ./file0 [ 1691.913759][ T1459] dvb_usb_rtl28xxu 2-1:0.0: chip type detection failed -71 [ 1691.927708][ T1459] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 1691.946669][ T1459] usb 2-1: USB disconnect, device number 38 [ 1692.047598][ T5178] usb 4-1: USB disconnect, device number 18 [ 1692.468457][ T10] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 1692.476630][ T7934] netlink: 'syz.2.13187': attribute type 9 has an invalid length. [ 1692.503836][ T7934] netlink: 'syz.2.13187': attribute type 7 has an invalid length. [ 1692.521709][ T7934] netlink: 'syz.2.13187': attribute type 8 has an invalid length. [ 1692.587071][ T7937] netlink: 1752 bytes leftover after parsing attributes in process `syz.1.13191'. [ 1692.629582][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 1692.653991][ T10] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC4, changing to 0x84 [ 1692.709675][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 52, changing to 7 [ 1692.727476][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 9272, setting to 1024 [ 1692.768073][ T10] usb 1-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=51.16 [ 1692.794488][ T10] usb 1-1: New USB device strings: Mfr=154, Product=2, SerialNumber=3 [ 1692.819614][ T10] usb 1-1: Product: syz [ 1692.837104][ T10] usb 1-1: Manufacturer: syz [ 1692.857561][ T10] usb 1-1: SerialNumber: syz [ 1692.882735][ T10] usb 1-1: config 0 descriptor?? [ 1692.911927][ T10] usb 1-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 1693.099676][ T7954] netlink: 'syz.3.13197': attribute type 1 has an invalid length. [ 1693.113881][ T3310] usb 1-1: Failed to submit usb control message: -71 [ 1693.114663][ T10] usb 1-1: USB disconnect, device number 30 [ 1693.153027][ T3310] usb 1-1: unable to send the bmi data to the device: -71 [ 1693.185130][ T3310] usb 1-1: unable to get target info from device [ 1693.196738][ T7957] netlink: 28 bytes leftover after parsing attributes in process `syz.3.13197'. [ 1693.224140][ T3310] usb 1-1: could not get target info (-71) [ 1693.245544][ T3310] usb 1-1: could not probe fw (-71) [ 1693.393276][ T7954] tipc: Enabled bearer , priority 0 [ 1693.451400][ T7954] syzkaller0: entered promiscuous mode [ 1693.493936][ T7954] syzkaller0: entered allmulticast mode [ 1693.590532][ T7952] tipc: Resetting bearer [ 1693.685792][ T7952] tipc: Disabling bearer [ 1694.138804][ T5178] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 1694.314744][ T5178] usb 2-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 1694.348626][ T5178] usb 2-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 1694.379361][ T5178] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1694.429913][ T5178] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 1694.888397][ T7375] usb 3-1: new full-speed USB device number 41 using dummy_hcd [ 1694.918919][ T9514] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 1695.051458][ T7375] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1695.071142][ T7375] usb 3-1: New USB device found, idVendor=06f8, idProduct=301b, bcdDevice=bb.39 [ 1695.078942][ T9514] usb 5-1: Using ep0 maxpacket: 32 [ 1695.081867][ T7375] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1695.099834][ T9514] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC4, changing to 0x84 [ 1695.118455][ T7375] usb 3-1: Product: syz [ 1695.127551][ T7375] usb 3-1: Manufacturer: syz [ 1695.129349][ T9514] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 52, changing to 7 [ 1695.134405][ T7375] usb 3-1: SerialNumber: syz [ 1695.157692][ T7375] usb 3-1: config 0 descriptor?? [ 1695.167038][ T9514] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 9272, setting to 1024 [ 1695.184008][ T9514] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=51.16 [ 1695.207460][ T9514] usb 5-1: New USB device strings: Mfr=154, Product=2, SerialNumber=3 [ 1695.213420][ T7375] gspca_main: gspca_pac7302-2.14.0 probing 06f8:301b [ 1695.217435][ T9514] usb 5-1: Product: syz [ 1695.230809][ T9514] usb 5-1: Manufacturer: syz [ 1695.235504][ T9514] usb 5-1: SerialNumber: syz [ 1695.245077][ T9514] usb 5-1: config 0 descriptor?? [ 1695.269556][ T9514] usb 5-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 1695.417866][ T7989] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1695.430237][ T7989] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1695.455432][ T7989] netlink: 'syz.2.13211': attribute type 1 has an invalid length. [ 1695.465564][ T3310] usb 5-1: Failed to submit usb control message: -71 [ 1695.473873][ T9514] usb 5-1: USB disconnect, device number 45 [ 1695.483527][ T3310] usb 5-1: unable to send the bmi data to the device: -71 [ 1695.491653][ T5178] gspca_stv0680: usb_control_msg error 0, request = 0x88, error = -32 [ 1695.521513][ T5178] stv0680 2-1:4.0: STV(e): camera ping failed!! [ 1695.535509][ T8020] netlink: 76 bytes leftover after parsing attributes in process `syz.2.13211'. [ 1695.546584][ T3310] usb 5-1: unable to get target info from device [ 1695.566550][ T5178] stv0680 2-1:4.0: last error: 0, command = 0x0 [ 1695.586197][ T3310] usb 5-1: could not get target info (-71) [ 1695.620284][ T3310] usb 5-1: could not probe fw (-71) [ 1695.651324][ T8023] netlink: 28 bytes leftover after parsing attributes in process `syz.2.13211'. [ 1695.728825][ T7375] gspca_pac7302: reg_w() failed i: ff v: 01 error -110 [ 1695.757954][ T7375] gspca_pac7302 3-1:0.0: probe with driver gspca_pac7302 failed with error -110 [ 1695.784321][ T8023] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1695.795639][ T1459] usb 2-1: USB disconnect, device number 39 [ 1695.809606][ T7374] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 1695.894845][ T7989] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1695.910512][ T7989] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1695.927624][ T10] usb 3-1: USB disconnect, device number 41 [ 1695.998406][ T7374] usb 4-1: Using ep0 maxpacket: 16 [ 1696.009544][ T7374] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1696.021789][ T7374] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1696.056923][ T7374] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1696.066996][ T7374] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1696.088389][ T7374] usb 4-1: Product: syz [ 1696.104081][ T7374] usb 4-1: Manufacturer: syz [ 1696.118708][ T7374] usb 4-1: SerialNumber: syz [ 1696.140681][ T7374] usb 4-1: config 0 descriptor?? [ 1696.157245][ T7374] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1696.167266][ T7374] em28xx 4-1:0.0: Audio interface 0 found (Vendor Class) [ 1696.762646][ T7374] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 1696.965121][ T7374] em28xx 4-1:0.0: Config register raw data: 0xfffffffb [ 1697.385477][ T8052] netlink: 'syz.1.13233': attribute type 10 has an invalid length. [ 1697.393938][ T8052] netlink: 40 bytes leftover after parsing attributes in process `syz.1.13233'. [ 1697.540566][ T8052] batadv0: entered promiscuous mode [ 1697.577209][ T8052] batadv0: entered allmulticast mode [ 1697.621536][ T8052] bridge0: port 3(batadv0) entered blocking state [ 1697.656183][ T8052] bridge0: port 3(batadv0) entered disabled state [ 1697.709378][ T8052] bridge0: port 3(batadv0) entered blocking state [ 1697.715966][ T8052] bridge0: port 3(batadv0) entered forwarding state [ 1697.832630][ T7374] em28xx 4-1:0.0: Unknown AC97 audio processor detected! [ 1697.873439][ T7374] em28xx 4-1:0.0: couldn't setup AC97 register 2 [ 1697.905260][ T7374] em28xx 4-1:0.0: couldn't setup AC97 register 4 [ 1697.940004][ T7374] em28xx 4-1:0.0: couldn't setup AC97 register 6 [ 1697.971260][ T7374] em28xx 4-1:0.0: couldn't setup AC97 register 54 [ 1697.999337][ T7374] em28xx 4-1:0.0: couldn't setup AC97 register 56 [ 1698.011098][ T49] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 1698.020509][ T49] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 1698.093909][ T7374] usb 4-1: USB disconnect, device number 19 [ 1698.468136][ T8065] tipc: Started in network mode [ 1698.497698][ T8065] tipc: Node identity aaaaaaaaaa33, cluster identity 4711 [ 1698.541223][ T8065] tipc: Enabled bearer , priority 10 [ 1698.591054][ T8065] netlink: 64 bytes leftover after parsing attributes in process `syz.1.13237'. [ 1698.604579][ T8067] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.13238'. [ 1698.701191][ T8068] syzkaller1: entered promiscuous mode [ 1698.795541][ T8068] syzkaller1: entered allmulticast mode [ 1699.452569][ T8089] netlink: 1624 bytes leftover after parsing attributes in process `syz.2.13246'. [ 1699.558668][ T7374] tipc: Node number set to 10070698 [ 1699.677779][ T8095] FAULT_INJECTION: forcing a failure. [ 1699.677779][ T8095] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1699.764487][ T8095] CPU: 0 UID: 0 PID: 8095 Comm: syz.1.13249 Tainted: G L syzkaller #0 PREEMPT(full) [ 1699.764526][ T8095] Tainted: [L]=SOFTLOCKUP [ 1699.764536][ T8095] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1699.764550][ T8095] Call Trace: [ 1699.764560][ T8095] [ 1699.764571][ T8095] dump_stack_lvl+0xe8/0x150 [ 1699.764606][ T8095] should_fail_ex+0x40c/0x560 [ 1699.764646][ T8095] _copy_to_user+0x31/0xb0 [ 1699.764668][ T8095] simple_read_from_buffer+0xe1/0x170 [ 1699.764710][ T8095] proc_fail_nth_read+0x1bb/0x230 [ 1699.764742][ T8095] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1699.764776][ T8095] ? rw_verify_area+0x24a/0x4c0 [ 1699.764796][ T8095] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1699.764823][ T8095] vfs_read+0x213/0xa80 [ 1699.764846][ T8095] ? __pfx___mutex_lock+0x10/0x10 [ 1699.764874][ T8095] ? __pfx_vfs_read+0x10/0x10 [ 1699.764896][ T8095] ? __fget_files+0x2a/0x420 [ 1699.764930][ T8095] ? __fget_files+0x3a2/0x420 [ 1699.764959][ T8095] ? __fget_files+0x2a/0x420 [ 1699.764998][ T8095] ksys_read+0x150/0x270 [ 1699.765021][ T8095] ? __pfx_ksys_read+0x10/0x10 [ 1699.765049][ T8095] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1699.765071][ T8095] do_syscall_64+0x174/0x580 [ 1699.765097][ T8095] ? trace_irq_disable+0x3b/0x140 [ 1699.765126][ T8095] ? clear_bhb_loop+0x40/0x90 [ 1699.765153][ T8095] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1699.765176][ T8095] RIP: 0033:0x7fe64d35e84e [ 1699.765197][ T8095] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1699.765213][ T8095] RSP: 002b:00007fe64e33ffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1699.765234][ T8095] RAX: ffffffffffffffda RBX: 00007fe64e3406c0 RCX: 00007fe64d35e84e [ 1699.765258][ T8095] RDX: 000000000000000f RSI: 00007fe64e3400a0 RDI: 0000000000000003 [ 1699.765270][ T8095] RBP: 00007fe64e340090 R08: 0000000000000000 R09: 0000000000000000 [ 1699.765283][ T8095] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1699.765294][ T8095] R13: 00007fe64d626038 R14: 00007fe64d625fa0 R15: 00007fe64d74fa48 [ 1699.765327][ T8095] [ 1700.166336][ T8097] netlink: 1752 bytes leftover after parsing attributes in process `syz.4.13251'. [ 1700.596398][ T8121] syz_tun: entered allmulticast mode [ 1700.632039][ T8121] syz_tun: left allmulticast mode [ 1700.675471][ T8123] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1700.865076][ T8129] netlink: 1752 bytes leftover after parsing attributes in process `syz.3.13263'. [ 1702.304141][ T1459] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 1702.472575][ T8155] netlink: 1752 bytes leftover after parsing attributes in process `syz.4.13273'. [ 1702.482431][ T1459] usb 3-1: Using ep0 maxpacket: 16 [ 1702.505802][ T1459] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 1702.530838][ T1459] usb 3-1: config 0 has no interface number 0 [ 1702.547709][ T1459] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1702.599852][ T1459] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1702.630021][ T1459] usb 3-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 1702.647401][ T1459] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1702.693829][ T1459] usb 3-1: config 0 descriptor?? [ 1702.860466][ T8163] netlink: 16 bytes leftover after parsing attributes in process `syz.3.13274'. [ 1702.917608][ T8149] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1702.943675][ T8149] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1703.194669][ T8169] netlink: 1752 bytes leftover after parsing attributes in process `syz.1.13276'. [ 1703.433775][ T8170] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1703.481533][ T8170] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1703.976828][ T8182] xt_hashlimit: size too large, truncated to 1048576 [ 1704.053605][ T8184] netlink: 4 bytes leftover after parsing attributes in process `syz.4.13280'. [ 1704.094556][ T8184] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 1704.178125][ T8186] bridge0: port 1(bridge_slave_0) entered disabled state [ 1704.400466][ T8186] bridge_slave_0 (unregistering): left allmulticast mode [ 1704.491235][ T8186] bridge_slave_0 (unregistering): left promiscuous mode [ 1704.665878][ T8186] bridge0: port 1(bridge_slave_0) entered disabled state [ 1705.060604][ T9512] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 1705.239329][ T9512] usb 5-1: Using ep0 maxpacket: 8 [ 1705.293128][ T9512] usb 5-1: config index 0 descriptor too short (expected 6427, got 27) [ 1705.348568][ T9512] usb 5-1: config 0 has an invalid interface number: 21 but max is 0 [ 1705.376297][ T1459] usbhid 3-1:0.1: can't add hid device: -71 [ 1705.389576][ T9512] usb 5-1: config 0 has no interface number 0 [ 1705.420488][ T1459] usbhid 3-1:0.1: probe with driver usbhid failed with error -71 [ 1705.446825][ T9512] usb 5-1: config 0 interface 21 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1705.515589][ T1459] usb 3-1: USB disconnect, device number 42 [ 1705.552604][ T9512] usb 5-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 1705.601558][ T9512] usb 5-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0 [ 1705.639131][ T9512] usb 5-1: Product: syz [ 1705.683007][ T9512] usb 5-1: config 0 descriptor?? [ 1706.027420][ T8212] netlink: 1752 bytes leftover after parsing attributes in process `syz.1.13285'. [ 1706.209121][ T8215] netlink: 'syz.2.13286': attribute type 10 has an invalid length. [ 1706.242727][ T8215] netlink: 40 bytes leftover after parsing attributes in process `syz.2.13286'. [ 1706.292045][ T8215] batadv0: entered promiscuous mode [ 1706.325142][ T8215] batadv0: entered allmulticast mode [ 1706.345938][ T8215] bridge0: port 3(batadv0) entered blocking state [ 1706.374951][ T8215] bridge0: port 3(batadv0) entered disabled state [ 1706.409571][ T8215] bridge0: port 3(batadv0) entered blocking state [ 1706.416228][ T8215] bridge0: port 3(batadv0) entered forwarding state [ 1706.794187][ T8238] netlink: 'syz.2.13289': attribute type 10 has an invalid length. [ 1706.818082][ T787] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 1706.827507][ T787] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 1706.841495][ T8238] netlink: 24 bytes leftover after parsing attributes in process `syz.2.13289'. [ 1707.686443][ T7393] usb 5-1: USB disconnect, device number 46 [ 1708.139884][ T8268] netlink: 'syz.4.13298': attribute type 10 has an invalid length. [ 1708.166909][ T8268] netlink: 40 bytes leftover after parsing attributes in process `syz.4.13298'. [ 1708.191207][ T8270] netlink: 'syz.2.13299': attribute type 10 has an invalid length. [ 1708.207752][ T8268] batadv0: entered promiscuous mode [ 1708.222611][ T8270] netlink: 40 bytes leftover after parsing attributes in process `syz.2.13299'. [ 1708.237717][ T8268] batadv0: entered allmulticast mode [ 1708.259511][ T8268] bridge0: port 1(batadv0) entered blocking state [ 1708.278777][ T8268] bridge0: port 1(batadv0) entered disabled state [ 1708.351484][ T8268] bridge0: port 1(batadv0) entered blocking state [ 1708.358379][ T8268] bridge0: port 1(batadv0) entered forwarding state [ 1708.450633][ T49] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 1708.462050][ T49] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 1708.826602][ T8292] netlink: 1752 bytes leftover after parsing attributes in process `syz.3.13306'. [ 1708.894656][ T8295] netlink: 1752 bytes leftover after parsing attributes in process `syz.1.13307'. [ 1709.020719][ T7374] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 1709.160968][ T7374] usb 1-1: device descriptor read/64, error -71 [ 1709.218558][ T1459] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 1709.378357][ T1459] usb 2-1: Using ep0 maxpacket: 16 [ 1709.393365][ T1459] usb 2-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 1709.409784][ T7374] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 1709.425411][ T1459] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1709.443787][ T1459] usb 2-1: Product: syz [ 1709.457403][ T1459] usb 2-1: Manufacturer: syz [ 1709.470350][ T1459] usb 2-1: SerialNumber: syz [ 1709.479838][ T1459] usb 2-1: config 0 descriptor?? [ 1709.497357][ T1459] asix 2-1:0.0: probe with driver asix failed with error -22 [ 1709.548565][ T7374] usb 1-1: device descriptor read/64, error -71 [ 1709.668928][ T7374] usb usb1-port1: attempt power cycle [ 1709.713859][ T8300] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1709.744148][ T8300] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1709.765974][ T1459] usb 2-1: USB disconnect, device number 40 [ 1710.008556][ T7374] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 1710.041114][ T7374] usb 1-1: device descriptor read/8, error -71 [ 1710.130080][ T8316] netlink: 56 bytes leftover after parsing attributes in process `syz.4.13315'. [ 1710.166572][ T8316] netlink: 56 bytes leftover after parsing attributes in process `syz.4.13315'. [ 1710.183619][ T8300] Invalid option length (954) for dns_resolver key [ 1710.291162][ T7374] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 1710.319196][ T7374] usb 1-1: device descriptor read/8, error -71 [ 1710.439183][ T7374] usb usb1-port1: unable to enumerate USB device [ 1711.138500][ T1459] usb 5-1: new low-speed USB device number 47 using dummy_hcd [ 1711.311006][ T1459] usb 5-1: config 1 interface 0 altsetting 64 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 1711.347919][ T1459] usb 5-1: config 1 interface 0 altsetting 64 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1711.371020][ T1459] usb 5-1: config 1 interface 0 has no altsetting 0 [ 1711.991537][ T8359] netlink: 'syz.1.13332': attribute type 10 has an invalid length. [ 1712.020624][ T8359] ipvlan0: entered allmulticast mode [ 1712.026384][ T8359] veth0_vlan: entered allmulticast mode [ 1712.098553][ T7375] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 1712.132372][ T8359] team0: Device ipvlan0 failed to register rx_handler [ 1712.271164][ T7375] usb 1-1: Using ep0 maxpacket: 16 [ 1712.298395][ T7375] usb 1-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 1712.311092][ T7375] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1712.327315][ T7375] usb 1-1: Product: syz [ 1712.338926][ T7375] usb 1-1: Manufacturer: syz [ 1712.349252][ T7375] usb 1-1: SerialNumber: syz [ 1712.370869][ T7375] usb 1-1: config 0 descriptor?? [ 1712.389020][ T7375] asix 1-1:0.0: probe with driver asix failed with error -22 [ 1712.443454][ T30] audit: type=1326 audit(1785577034.419:3334): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8364 comm="syz.2.13335" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd36af9e019 code=0x7ffc0000 [ 1712.476736][ T30] audit: type=1326 audit(1785577034.419:3335): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8364 comm="syz.2.13335" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd36af9e019 code=0x7ffc0000 [ 1712.526804][ T30] audit: type=1326 audit(1785577034.459:3336): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8364 comm="syz.2.13335" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=28 compat=0 ip=0x7fd36af9e019 code=0x7ffc0000 [ 1712.583461][ T8369] netlink: 172 bytes leftover after parsing attributes in process `syz.2.13335'. [ 1712.590559][ T30] audit: type=1326 audit(1785577034.479:3337): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8364 comm="syz.2.13335" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd36af9e019 code=0x7ffc0000 [ 1712.654606][ T8357] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1712.674108][ T8357] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1712.702694][ T7374] usb 1-1: USB disconnect, device number 35 [ 1712.725046][ T30] audit: type=1326 audit(1785577034.479:3338): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8364 comm="syz.2.13335" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd36af9e019 code=0x7ffc0000 [ 1712.791750][ T8374] FAULT_INJECTION: forcing a failure. [ 1712.791750][ T8374] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1712.811708][ T30] audit: type=1326 audit(1785577034.489:3339): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8364 comm="syz.2.13335" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=70 compat=0 ip=0x7fd36af9e019 code=0x7ffc0000 [ 1712.837760][ T8374] CPU: 1 UID: 0 PID: 8374 Comm: syz.1.13338 Tainted: G L syzkaller #0 PREEMPT(full) [ 1712.837797][ T8374] Tainted: [L]=SOFTLOCKUP [ 1712.837811][ T8374] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1712.837825][ T8374] Call Trace: [ 1712.837834][ T8374] [ 1712.837844][ T8374] dump_stack_lvl+0xe8/0x150 [ 1712.837886][ T8374] should_fail_ex+0x40c/0x560 [ 1712.837922][ T8374] _copy_from_user+0x2d/0xb0 [ 1712.837946][ T8374] ___sys_sendmsg+0x1c6/0x360 [ 1712.837975][ T8374] ? __lock_acquire+0x683/0x2cf0 [ 1712.838020][ T8374] ? __pfx____sys_sendmsg+0x10/0x10 [ 1712.838083][ T8374] ? __fget_files+0x2a/0x420 [ 1712.838115][ T8374] ? __fget_files+0x3a2/0x420 [ 1712.838155][ T8374] __x64_sys_sendmsg+0x1b1/0x290 [ 1712.838185][ T8374] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1712.838232][ T8374] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1712.838255][ T8374] do_syscall_64+0x174/0x580 [ 1712.838284][ T8374] ? trace_irq_disable+0x3b/0x140 [ 1712.838312][ T8374] ? clear_bhb_loop+0x40/0x90 [ 1712.838338][ T8374] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1712.838358][ T8374] RIP: 0033:0x7fe64d39e019 [ 1712.838379][ T8374] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1712.838397][ T8374] RSP: 002b:00007fe64e340028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1712.838418][ T8374] RAX: ffffffffffffffda RBX: 00007fe64d625fa0 RCX: 00007fe64d39e019 [ 1712.838434][ T8374] RDX: 0000000000000000 RSI: 000020000000c2c0 RDI: 0000000000000003 [ 1712.838448][ T8374] RBP: 00007fe64e340090 R08: 0000000000000000 R09: 0000000000000000 [ 1712.838461][ T8374] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1712.838474][ T8374] R13: 00007fe64d626038 R14: 00007fe64d625fa0 R15: 00007fe64d74fa48 [ 1712.838507][ T8374] [ 1713.032050][ T30] audit: type=1326 audit(1785577034.489:3340): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8364 comm="syz.2.13335" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd36af9e019 code=0x7ffc0000 [ 1713.058019][ T30] audit: type=1326 audit(1785577034.499:3341): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8364 comm="syz.2.13335" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd36af9e019 code=0x7ffc0000 [ 1713.082664][ T30] audit: type=1326 audit(1785577034.499:3342): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8364 comm="syz.2.13335" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fd36af9e019 code=0x7ffc0000 [ 1713.106988][ T30] audit: type=1326 audit(1785577034.499:3343): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8364 comm="syz.2.13335" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd36af9e019 code=0x7ffc0000 [ 1713.152650][ T8357] Invalid option length (954) for dns_resolver key [ 1713.427909][ T8381] FAULT_INJECTION: forcing a failure. [ 1713.427909][ T8381] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1713.465769][ T8381] CPU: 1 UID: 0 PID: 8381 Comm: syz.1.13341 Tainted: G L syzkaller #0 PREEMPT(full) [ 1713.465805][ T8381] Tainted: [L]=SOFTLOCKUP [ 1713.465814][ T8381] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1713.465827][ T8381] Call Trace: [ 1713.465836][ T8381] [ 1713.465847][ T8381] dump_stack_lvl+0xe8/0x150 [ 1713.465891][ T8381] should_fail_ex+0x40c/0x560 [ 1713.465927][ T8381] _copy_from_user+0x2d/0xb0 [ 1713.465951][ T8381] kstrtouint_from_user+0xd6/0x180 [ 1713.465984][ T8381] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1713.466032][ T8381] proc_fail_nth_write+0x8e/0x210 [ 1713.466066][ T8381] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1713.466106][ T8381] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1713.466137][ T8381] vfs_write+0x296/0xba0 [ 1713.466169][ T8381] ? __pfx_vfs_write+0x10/0x10 [ 1713.466193][ T8381] ? __fget_files+0x2a/0x420 [ 1713.466229][ T8381] ? __fget_files+0x3a2/0x420 [ 1713.466258][ T8381] ? __fget_files+0x2a/0x420 [ 1713.466297][ T8381] ksys_write+0x150/0x270 [ 1713.466323][ T8381] ? __pfx_ksys_write+0x10/0x10 [ 1713.466354][ T8381] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1713.466379][ T8381] do_syscall_64+0x174/0x580 [ 1713.466406][ T8381] ? trace_irq_disable+0x3b/0x140 [ 1713.466435][ T8381] ? clear_bhb_loop+0x40/0x90 [ 1713.466471][ T8381] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1713.466494][ T8381] RIP: 0033:0x7fe64d35e84e [ 1713.466515][ T8381] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1713.466534][ T8381] RSP: 002b:00007fe64e33ffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1713.466557][ T8381] RAX: ffffffffffffffda RBX: 00007fe64e3406c0 RCX: 00007fe64d35e84e [ 1713.466574][ T8381] RDX: 0000000000000001 RSI: 00007fe64e3400a0 RDI: 0000000000000004 [ 1713.466587][ T8381] RBP: 00007fe64e340090 R08: 0000000000000000 R09: 0000000000000000 [ 1713.466601][ T8381] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1713.466614][ T8381] R13: 00007fe64d626038 R14: 00007fe64d625fa0 R15: 00007fe64d74fa48 [ 1713.466648][ T8381] [ 1713.864054][ T1459] usb 5-1: New USB device found, idVendor=04d9, idProduct=a067, bcdDevice= 0.40 [ 1713.873354][ T1459] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1713.887531][ T1459] usb 5-1: can't set config #1, error -71 [ 1713.895227][ T1459] usb 5-1: USB disconnect, device number 47 [ 1714.021256][ T8389] netlink: 32 bytes leftover after parsing attributes in process `syz.3.13347'. [ 1714.060952][ T8391] FAULT_INJECTION: forcing a failure. [ 1714.060952][ T8391] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1714.102414][ T8395] netlink: 1688 bytes leftover after parsing attributes in process `syz.4.13345'. [ 1714.114644][ T8391] CPU: 1 UID: 0 PID: 8391 Comm: syz.2.13348 Tainted: G L syzkaller #0 PREEMPT(full) [ 1714.114681][ T8391] Tainted: [L]=SOFTLOCKUP [ 1714.114690][ T8391] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1714.114703][ T8391] Call Trace: [ 1714.114713][ T8391] [ 1714.114722][ T8391] dump_stack_lvl+0xe8/0x150 [ 1714.114762][ T8391] should_fail_ex+0x40c/0x560 [ 1714.114796][ T8391] _copy_from_user+0x2d/0xb0 [ 1714.114819][ T8391] ___sys_sendmsg+0x1c6/0x360 [ 1714.114845][ T8391] ? __lock_acquire+0x683/0x2cf0 [ 1714.114886][ T8391] ? __pfx____sys_sendmsg+0x10/0x10 [ 1714.114918][ T8391] ? kstrtouint+0x6e/0xe0 [ 1714.114966][ T8391] ? __fget_files+0x2a/0x420 [ 1714.114996][ T8391] ? __fget_files+0x3a2/0x420 [ 1714.115036][ T8391] __sys_sendmmsg+0x273/0x4d0 [ 1714.115067][ T8391] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1714.115102][ T8391] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1714.115144][ T8391] ? ksys_write+0x242/0x270 [ 1714.115168][ T8391] ? __pfx_ksys_write+0x10/0x10 [ 1714.115197][ T8391] __x64_sys_sendmmsg+0xa0/0xc0 [ 1714.115224][ T8391] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1714.115247][ T8391] do_syscall_64+0x174/0x580 [ 1714.115274][ T8391] ? trace_irq_disable+0x3b/0x140 [ 1714.115302][ T8391] ? clear_bhb_loop+0x40/0x90 [ 1714.115327][ T8391] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1714.115350][ T8391] RIP: 0033:0x7fd36af9e019 [ 1714.115370][ T8391] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1714.115388][ T8391] RSP: 002b:00007fd36be03028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1714.115420][ T8391] RAX: ffffffffffffffda RBX: 00007fd36b225fa0 RCX: 00007fd36af9e019 [ 1714.115436][ T8391] RDX: 04000000000001f2 RSI: 0000200000000000 RDI: 0000000000000003 [ 1714.115452][ T8391] RBP: 00007fd36be03090 R08: 0000000000000000 R09: 0000000000000000 [ 1714.115466][ T8391] R10: 00000000000000fc R11: 0000000000000246 R12: 0000000000000001 [ 1714.115480][ T8391] R13: 00007fd36b226038 R14: 00007fd36b225fa0 R15: 00007fd36b34fa48 [ 1714.115513][ T8391] [ 1714.670301][T26973] Bluetooth: hci2: unexpected event for opcode 0x0c7b [ 1714.689071][ T8415] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.13357'. [ 1714.824632][ T8421] netlink: 1688 bytes leftover after parsing attributes in process `syz.2.13359'. [ 1714.858664][ T10] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 1715.018395][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 1715.034032][ T10] usb 1-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 1715.051044][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1715.077955][ T10] usb 1-1: Product: syz [ 1715.089821][ T7374] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 1715.104072][ T10] usb 1-1: Manufacturer: syz [ 1715.109304][ T8430] netlink: 1752 bytes leftover after parsing attributes in process `syz.3.13363'. [ 1715.122682][ T10] usb 1-1: SerialNumber: syz [ 1715.137068][ T10] usb 1-1: config 0 descriptor?? [ 1715.163827][ T10] asix 1-1:0.0: probe with driver asix failed with error -22 [ 1715.273087][ T7374] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1715.286645][ T7374] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1715.300335][ T7374] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 1715.311517][ T7374] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1715.321297][ T7374] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1715.360575][ T7374] usb 5-1: config 0 descriptor?? [ 1715.374066][ T8411] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1715.414468][ T8411] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1715.439630][ T8411] Invalid option length (954) for dns_resolver key [ 1715.473036][ T10] usb 1-1: USB disconnect, device number 36 [ 1715.816051][ T7374] plantronics 0003:047F:FFFF.002B: item fetching failed at offset 23/24 [ 1715.850903][ T7374] plantronics 0003:047F:FFFF.002B: parse failed [ 1715.870755][ T7374] plantronics 0003:047F:FFFF.002B: probe with driver plantronics failed with error -22 [ 1716.027363][ T7374] usb 5-1: USB disconnect, device number 48 [ 1716.196788][ T8445] netlink: 24 bytes leftover after parsing attributes in process `syz.0.13370'. [ 1716.389398][ T8449] netlink: 24 bytes leftover after parsing attributes in process `syz.3.13371'. [ 1716.807795][ T8454] netlink: 1752 bytes leftover after parsing attributes in process `syz.1.13373'. [ 1716.982892][ T8457] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.13374'. [ 1717.039107][ T8462] netlink: 1752 bytes leftover after parsing attributes in process `syz.4.13376'. [ 1717.568460][ T1459] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 1717.758099][ T1459] usb 3-1: Using ep0 maxpacket: 16 [ 1717.780506][ T1459] usb 3-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 1717.796969][ T1459] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1717.828407][ T1459] usb 3-1: Product: syz [ 1717.843704][ T1459] usb 3-1: Manufacturer: syz [ 1717.853253][ T1459] usb 3-1: SerialNumber: syz [ 1717.880293][ T1459] usb 3-1: config 0 descriptor?? [ 1717.915902][ T1459] asix 3-1:0.0: probe with driver asix failed with error -22 [ 1718.135974][ T8472] Invalid option length (954) for dns_resolver key [ 1718.178750][ T1459] usb 3-1: USB disconnect, device number 43 [ 1718.723510][ T8490] FAULT_INJECTION: forcing a failure. [ 1718.723510][ T8490] name failslab, interval 1, probability 0, space 0, times 0 [ 1718.777375][ T8490] CPU: 1 UID: 0 PID: 8490 Comm: syz.4.13384 Tainted: G L syzkaller #0 PREEMPT(full) [ 1718.777401][ T8490] Tainted: [L]=SOFTLOCKUP [ 1718.777407][ T8490] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1718.777417][ T8490] Call Trace: [ 1718.777423][ T8490] [ 1718.777431][ T8490] dump_stack_lvl+0xe8/0x150 [ 1718.777460][ T8490] should_fail_ex+0x40c/0x560 [ 1718.777485][ T8490] should_failslab+0xa8/0x100 [ 1718.777511][ T8490] __kmalloc_cache_noprof+0xa8/0x660 [ 1718.777534][ T8490] ? alloc_pipe_info+0xe8/0x4c0 [ 1718.777550][ T8490] ? alloc_pipe_info+0xe8/0x4c0 [ 1718.777570][ T8490] alloc_pipe_info+0xe8/0x4c0 [ 1718.777588][ T8490] splice_direct_to_actor+0xa41/0xcb0 [ 1718.777647][ T8490] ? __pfx_aa_file_perm+0x10/0x10 [ 1718.777673][ T8490] ? __pfx_direct_splice_actor+0x10/0x10 [ 1718.777696][ T8490] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 1718.777726][ T8490] do_splice_direct+0x195/0x290 [ 1718.777751][ T8490] ? __pfx_do_splice_direct+0x10/0x10 [ 1718.777774][ T8490] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 1718.777791][ T8490] ? bpf_lsm_file_permission+0x9/0x20 [ 1718.777810][ T8490] ? security_file_permission+0x75/0x260 [ 1718.777835][ T8490] ? rw_verify_area+0x203/0x4c0 [ 1718.777852][ T8490] do_sendfile+0x52e/0x7c0 [ 1718.777878][ T8490] ? __pfx_do_sendfile+0x10/0x10 [ 1718.777897][ T8490] ? __fget_files+0x3a2/0x420 [ 1718.777926][ T8490] __se_sys_sendfile64+0x144/0x1a0 [ 1718.777946][ T8490] ? __pfx___se_sys_sendfile64+0x10/0x10 [ 1718.777971][ T8490] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1718.777987][ T8490] do_syscall_64+0x174/0x580 [ 1718.778007][ T8490] ? trace_irq_disable+0x3b/0x140 [ 1718.778027][ T8490] ? clear_bhb_loop+0x40/0x90 [ 1718.778046][ T8490] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1718.778062][ T8490] RIP: 0033:0x7f92f379e019 [ 1718.778076][ T8490] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1718.778089][ T8490] RSP: 002b:00007f92f4612028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 1718.778106][ T8490] RAX: ffffffffffffffda RBX: 00007f92f3a25fa0 RCX: 00007f92f379e019 [ 1718.778120][ T8490] RDX: 0000000000000000 RSI: 000000000000000c RDI: 000000000000000d [ 1718.778129][ T8490] RBP: 00007f92f4612090 R08: 0000000000000000 R09: 0000000000000000 [ 1718.778139][ T8490] R10: 0000000100000002 R11: 0000000000000246 R12: 0000000000000001 [ 1718.778149][ T8490] R13: 00007f92f3a26038 R14: 00007f92f3a25fa0 R15: 00007f92f3b4fa48 [ 1718.778172][ T8490] [ 1719.278125][ T8497] __nla_validate_parse: 2 callbacks suppressed [ 1719.278145][ T8497] netlink: 1752 bytes leftover after parsing attributes in process `syz.3.13387'. [ 1719.340343][ T8499] netlink: 1752 bytes leftover after parsing attributes in process `syz.4.13388'. [ 1719.468465][ T10] usb 3-1: new full-speed USB device number 44 using dummy_hcd [ 1719.522702][ T8501] xt_hashlimit: size too large, truncated to 1048576 [ 1719.592245][ T8504] netlink: 4 bytes leftover after parsing attributes in process `syz.3.13389'. [ 1719.641678][ T8504] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 1719.655351][ T10] usb 3-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 1719.685943][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1719.687197][ T8505] bridge0: port 1(bridge_slave_0) entered disabled state [ 1719.703757][ T10] usb 3-1: Product: syz [ 1719.714186][ T10] usb 3-1: Manufacturer: syz [ 1719.726887][ T10] usb 3-1: SerialNumber: syz [ 1719.739705][ T8507] netlink: 1624 bytes leftover after parsing attributes in process `syz.0.13391'. [ 1719.767555][ T10] usb 3-1: config 0 descriptor?? [ 1719.794901][ T8505] bridge_slave_0 (unregistering): left allmulticast mode [ 1719.809608][ T10] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 1719.826265][ T8505] bridge_slave_0 (unregistering): left promiscuous mode [ 1719.874885][ T8505] bridge0: port 1(bridge_slave_0) entered disabled state [ 1720.408871][ T5178] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 1720.522939][ T8533] FAULT_INJECTION: forcing a failure. [ 1720.522939][ T8533] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1720.564001][ T8533] CPU: 0 UID: 0 PID: 8533 Comm: syz.0.13397 Tainted: G L syzkaller #0 PREEMPT(full) [ 1720.564038][ T8533] Tainted: [L]=SOFTLOCKUP [ 1720.564046][ T8533] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1720.564059][ T8533] Call Trace: [ 1720.564069][ T8533] [ 1720.564078][ T8533] dump_stack_lvl+0xe8/0x150 [ 1720.564123][ T8533] should_fail_ex+0x40c/0x560 [ 1720.564157][ T8533] _copy_from_user+0x2d/0xb0 [ 1720.564181][ T8533] ucma_write+0x15d/0x2f0 [ 1720.564306][ T8533] ? __pfx_ucma_write+0x10/0x10 [ 1720.564329][ T8533] ? security_file_permission+0x75/0x260 [ 1720.564362][ T8533] ? rw_verify_area+0x203/0x4c0 [ 1720.564388][ T8533] vfs_writev+0x4bb/0x990 [ 1720.564416][ T8533] ? __pfx_ucma_write+0x10/0x10 [ 1720.564443][ T8533] ? __pfx_vfs_writev+0x10/0x10 [ 1720.564494][ T8533] ? __fget_files+0x2a/0x420 [ 1720.564529][ T8533] ? __fget_files+0x3a2/0x420 [ 1720.564557][ T8533] ? __fget_files+0x2a/0x420 [ 1720.564594][ T8533] do_writev+0x154/0x2e0 [ 1720.564624][ T8533] ? __pfx_do_writev+0x10/0x10 [ 1720.564658][ T8533] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1720.564682][ T8533] do_syscall_64+0x174/0x580 [ 1720.564710][ T8533] ? trace_irq_disable+0x3b/0x140 [ 1720.564738][ T8533] ? clear_bhb_loop+0x40/0x90 [ 1720.564765][ T8533] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1720.564787][ T8533] RIP: 0033:0x7f526339e019 [ 1720.564807][ T8533] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1720.564826][ T8533] RSP: 002b:00007f5264219028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 1720.564849][ T8533] RAX: ffffffffffffffda RBX: 00007f5263626090 RCX: 00007f526339e019 [ 1720.564865][ T8533] RDX: 0000000000000002 RSI: 0000200000000040 RDI: 000000000000000e [ 1720.564880][ T8533] RBP: 00007f5264219090 R08: 0000000000000000 R09: 0000000000000000 [ 1720.564893][ T8533] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1720.564907][ T8533] R13: 00007f5263626128 R14: 00007f5263626090 R15: 00007f526374fa48 [ 1720.564940][ T8533] [ 1720.902367][ T5178] usb 2-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 1720.916514][ T5178] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1720.954406][ T5178] usb 2-1: Product: syz [ 1720.961424][ T5178] usb 2-1: Manufacturer: syz [ 1720.972187][ T5178] usb 2-1: SerialNumber: syz [ 1721.007475][ T5178] usb 2-1: config 0 descriptor?? [ 1721.163992][ T10] gspca_stk1135: reg_w 0xd err -71 [ 1721.170321][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 1721.176995][ T10] gspca_stk1135: Sensor write failed [ 1721.194578][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 1721.218750][ T10] gspca_stk1135: Sensor write failed [ 1721.232607][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 1721.251823][ T10] gspca_stk1135: Sensor read failed [ 1721.266876][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 1721.301393][ T10] gspca_stk1135: Sensor read failed [ 1721.330335][ T10] gspca_stk1135: Detected sensor type unknown (0x0) [ 1721.356436][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 1721.393337][ T10] gspca_stk1135: Sensor read failed [ 1721.425338][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 1721.451097][ T10] gspca_stk1135: Sensor read failed [ 1721.471973][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 1721.497019][ T10] gspca_stk1135: Sensor write failed [ 1721.518222][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 1721.541161][ T10] gspca_stk1135: Sensor write failed [ 1721.565014][ T10] stk1135 3-1:0.0: probe with driver stk1135 failed with error -71 [ 1721.630994][ T10] usb 3-1: USB disconnect, device number 44 [ 1721.800697][ T7375] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 1721.968734][ T7375] usb 1-1: Using ep0 maxpacket: 16 [ 1721.984013][ T7375] usb 1-1: config index 0 descriptor too short (expected 46642, got 72) [ 1722.026360][ T7375] usb 1-1: config 173 has too many interfaces: 131, using maximum allowed: 32 [ 1722.052269][ T7375] usb 1-1: config 173 contains an unexpected descriptor of type 0x1, skipping [ 1722.073273][ T7375] usb 1-1: config 173 has an invalid descriptor of length 0, skipping remainder of the config [ 1722.117851][ T7375] usb 1-1: config 173 has 0 interfaces, different from the descriptor's value: 131 [ 1722.166334][ T7375] usb 1-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 1722.189762][ T7375] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1722.212227][ T7375] usb 1-1: Product: syz [ 1722.225480][ T7375] usb 1-1: Manufacturer: syz [ 1722.251487][ T5178] usb 2-1: Firmware version (0.0) predates our first public release. [ 1722.268129][ T7375] usb 1-1: SerialNumber: syz [ 1722.284732][ T5178] usb 2-1: Please update to version 0.2 or newer [ 1722.356169][ T8550] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.13399'. [ 1722.403872][ T5178] usb 2-1: USB disconnect, device number 41 [ 1723.155482][ T8572] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.13400'. [ 1723.323322][ T7375] usb 1-1: USB disconnect, device number 37 [ 1723.489608][ T5178] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 1723.648385][ T5178] usb 2-1: Using ep0 maxpacket: 8 [ 1723.676925][ T5178] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 1723.710717][ T5178] usb 2-1: config 179 has no interface number 0 [ 1723.732468][ T8589] netlink: 1624 bytes leftover after parsing attributes in process `syz.0.13405'. [ 1723.780017][ T5178] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1723.796665][ T5178] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1723.810678][ T5178] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1723.824604][ T5178] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1723.837119][ T5178] usb 2-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1723.857502][ T5178] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1723.874430][ T5178] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1723.909027][ T8576] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 1724.450642][ T8576] input: syz1 as /devices/virtual/input/input68 [ 1724.470369][ T8605] FAULT_INJECTION: forcing a failure. [ 1724.470369][ T8605] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1724.529738][ T8605] CPU: 0 UID: 0 PID: 8605 Comm: syz.0.13410 Tainted: G L syzkaller #0 PREEMPT(full) [ 1724.529774][ T8605] Tainted: [L]=SOFTLOCKUP [ 1724.529782][ T8605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1724.529795][ T8605] Call Trace: [ 1724.529804][ T8605] [ 1724.529813][ T8605] dump_stack_lvl+0xe8/0x150 [ 1724.529853][ T8605] should_fail_ex+0x40c/0x560 [ 1724.529890][ T8605] _copy_to_user+0x31/0xb0 [ 1724.529916][ T8605] simple_read_from_buffer+0xe1/0x170 [ 1724.529951][ T8605] proc_fail_nth_read+0x1bb/0x230 [ 1724.529984][ T8605] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1724.530017][ T8605] ? rw_verify_area+0x24a/0x4c0 [ 1724.530040][ T8605] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1724.530070][ T8605] vfs_read+0x213/0xa80 [ 1724.530096][ T8605] ? __pfx___mutex_lock+0x10/0x10 [ 1724.530125][ T8605] ? __pfx_vfs_read+0x10/0x10 [ 1724.530147][ T8605] ? __fget_files+0x2a/0x420 [ 1724.530181][ T8605] ? __fget_files+0x3a2/0x420 [ 1724.530209][ T8605] ? __fget_files+0x2a/0x420 [ 1724.530247][ T8605] ksys_read+0x150/0x270 [ 1724.530272][ T8605] ? __pfx_ksys_read+0x10/0x10 [ 1724.530301][ T8605] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1724.530326][ T8605] do_syscall_64+0x174/0x580 [ 1724.530352][ T8605] ? trace_irq_disable+0x3b/0x140 [ 1724.530380][ T8605] ? clear_bhb_loop+0x40/0x90 [ 1724.530408][ T8605] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1724.530430][ T8605] RIP: 0033:0x7f526335e84e [ 1724.530458][ T8605] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1724.530477][ T8605] RSP: 002b:00007f5264239fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1724.530499][ T8605] RAX: ffffffffffffffda RBX: 00007f526423a6c0 RCX: 00007f526335e84e [ 1724.530520][ T8605] RDX: 000000000000000f RSI: 00007f526423a0a0 RDI: 0000000000000003 [ 1724.530534][ T8605] RBP: 00007f526423a090 R08: 0000000000000000 R09: 0000000000000000 [ 1724.530547][ T8605] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1724.530559][ T8605] R13: 00007f5263626038 R14: 00007f5263625fa0 R15: 00007f526374fa48 [ 1724.530598][ T8605] [ 1725.078183][ T7374] usb 2-1: USB disconnect, device number 42 [ 1725.078552][ C1] xpad 2-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1725.092732][ C1] xpad 2-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1725.248691][ T9514] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 1725.303830][ T8617] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.13414'. [ 1725.418403][ T9514] usb 4-1: Using ep0 maxpacket: 32 [ 1725.425666][ T9514] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1725.438762][ T9514] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1725.449789][ T9514] usb 4-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1725.459325][ T9514] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1725.471560][ T9514] usb 4-1: config 0 descriptor?? [ 1725.501416][ T7375] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 1725.518704][ T7393] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 1725.658542][ T7375] usb 1-1: Using ep0 maxpacket: 32 [ 1725.683187][ T7393] usb 5-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 1725.693557][ T7375] usb 1-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 1725.693592][ T7375] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1725.693614][ T7375] usb 1-1: Product: syz [ 1725.693631][ T7375] usb 1-1: Manufacturer: syz [ 1725.693649][ T7375] usb 1-1: SerialNumber: syz [ 1725.745746][ T7375] usb 1-1: config 0 descriptor?? [ 1725.756032][ T7393] usb 5-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 1725.774981][ T7375] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 1725.786146][ T7393] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1725.794809][ T1459] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 1725.822546][ T7393] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 1725.958442][ T1459] usb 3-1: Using ep0 maxpacket: 32 [ 1725.974000][ T1459] usb 3-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 1725.984844][ T1459] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1726.000628][ T1459] usb 3-1: config 0 descriptor?? [ 1726.030509][ T9514] ft260 0003:0403:6030.002C: unknown main item tag 0x0 [ 1726.039164][ T9514] ft260 0003:0403:6030.002C: unknown main item tag 0x0 [ 1726.054308][ T1459] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 1726.208587][ T9514] ft260 0003:0403:6030.002C: chip code: 0000 0000 [ 1726.348403][ T5178] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 1726.415830][ T9514] ft260 0003:0403:6030.002C: failed to retrieve system status [ 1726.426922][ T9514] ft260 0003:0403:6030.002C: probe with driver ft260 failed with error -5 [ 1726.500738][ T5178] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 1726.512504][ T5178] usb 2-1: New USB device found, idVendor=056e, idProduct=00e6, bcdDevice= 0.00 [ 1726.521984][ T5178] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1726.536349][ T5178] usb 2-1: config 0 descriptor?? [ 1726.542542][ T8633] raw-gadget.4 gadget.1: fail, usb_ep_enable returned -22 [ 1726.839765][ T7393] gspca_stv0680: usb_control_msg error 0, request = 0x88, error = -32 [ 1726.848208][ T7393] stv0680 5-1:4.0: STV(e): camera ping failed!! [ 1726.856345][ T7393] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -71 [ 1726.865091][ T7393] stv0680 5-1:4.0: last error: 0, command = 0x0 [ 1726.876014][ T7393] usb 5-1: USB disconnect, device number 49 [ 1726.981068][ T8615] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1726.990070][ T5178] elecom 0003:056E:00E6.002D: unknown main item tag 0x0 [ 1726.998000][ T8615] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1727.007002][ T5178] elecom 0003:056E:00E6.002D: unknown main item tag 0x0 [ 1727.014816][ T5178] elecom 0003:056E:00E6.002D: unknown main item tag 0x0 [ 1727.024027][ T5178] elecom 0003:056E:00E6.002D: unknown main item tag 0x0 [ 1727.032074][ T5178] elecom 0003:056E:00E6.002D: unknown main item tag 0x0 [ 1727.043178][ T5178] elecom 0003:056E:00E6.002D: unknown main item tag 0x0 [ 1727.053330][ T5178] elecom 0003:056E:00E6.002D: unknown main item tag 0x0 [ 1727.061457][ T5178] elecom 0003:056E:00E6.002D: unknown main item tag 0x0 [ 1727.088731][ T5178] elecom 0003:056E:00E6.002D: hidraw0: USB HID v7f.fd Device [HID 056e:00e6] on usb-dummy_hcd.1-1/input0 [ 1727.192454][ T8633] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1727.202789][ T8633] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1727.216221][ T5178] usb 2-1: USB disconnect, device number 43 [ 1727.279110][ T7375] gspca_ov534_9: reg_w failed -110 [ 1727.404504][T26973] Bluetooth: hci1: command 0x0406 tx timeout [ 1727.618445][ T7375] gspca_ov534_9: Unknown sensor 0000 [ 1727.618557][ T7375] ov534_9 1-1:0.0: probe with driver ov534_9 failed with error -22 [ 1727.688664][ T5178] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 1727.848372][ T5178] usb 5-1: Using ep0 maxpacket: 8 [ 1727.863812][ T5178] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1727.888441][ T5178] usb 5-1: New USB device found, idVendor=05e1, idProduct=0893, bcdDevice=fd.5b [ 1727.901728][ T5178] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1727.910193][ T5178] usb 5-1: Product: syz [ 1727.914488][ T5178] usb 5-1: Manufacturer: syz [ 1727.921210][ T5178] usb 5-1: SerialNumber: syz [ 1727.930833][ T5178] usb 5-1: config 0 descriptor?? [ 1727.943245][ T5178] gspca_main: stk014-2.14.0 probing 05e1:0893 [ 1727.951069][ T5178] usb 5-1: selecting invalid altsetting 1 [ 1728.283510][ T5178] usb 1-1: USB disconnect, device number 38 [ 1728.393239][ T7375] usb 5-1: USB disconnect, device number 50 [ 1728.493372][ T9512] usb 4-1: USB disconnect, device number 20 [ 1728.859681][ T8653] netlink: 1752 bytes leftover after parsing attributes in process `syz.3.13425'. [ 1729.084708][ T8660] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1729.085172][ T8660] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1729.117098][ T1459] gspca_vc032x: reg_r err -71 [ 1729.117132][ T1459] gspca_vc032x: I2c Bus Busy Wait 00 [ 1729.117145][ T1459] gspca_vc032x: I2c Bus Busy Wait 00 [ 1729.117156][ T1459] gspca_vc032x: I2c Bus Busy Wait 00 [ 1729.117166][ T1459] gspca_vc032x: I2c Bus Busy Wait 00 [ 1729.117176][ T1459] gspca_vc032x: I2c Bus Busy Wait 00 [ 1729.117186][ T1459] gspca_vc032x: I2c Bus Busy Wait 00 [ 1729.117197][ T1459] gspca_vc032x: I2c Bus Busy Wait 00 [ 1729.117208][ T1459] gspca_vc032x: I2c Bus Busy Wait 00 [ 1729.117225][ T1459] gspca_vc032x: I2c Bus Busy Wait 00 [ 1729.117238][ T1459] gspca_vc032x: I2c Bus Busy Wait 00 [ 1729.117250][ T1459] gspca_vc032x: I2c Bus Busy Wait 00 [ 1729.117263][ T1459] gspca_vc032x: I2c Bus Busy Wait 00 [ 1729.117274][ T1459] gspca_vc032x: I2c Bus Busy Wait 00 [ 1729.117287][ T1459] gspca_vc032x: I2c Bus Busy Wait 00 [ 1729.117299][ T1459] gspca_vc032x: I2c Bus Busy Wait 00 [ 1729.117310][ T1459] gspca_vc032x: I2c Bus Busy Wait 00 [ 1729.117322][ T1459] gspca_vc032x: I2c Bus Busy Wait 00 [ 1729.117334][ T1459] gspca_vc032x: Unknown sensor... [ 1729.117412][ T1459] vc032x 3-1:0.0: probe with driver vc032x failed with error -22 [ 1729.138012][ T1459] usb 3-1: USB disconnect, device number 45 [ 1729.300061][ T7375] usb 5-1: new low-speed USB device number 51 using dummy_hcd [ 1729.441406][ T7375] usb 5-1: device descriptor read/64, error -71 [ 1729.678386][ T7375] usb 5-1: new low-speed USB device number 52 using dummy_hcd [ 1729.811925][ T7375] usb 5-1: device descriptor read/64, error -71 [ 1729.918789][ T7375] usb usb5-port1: attempt power cycle [ 1730.258371][ T7375] usb 5-1: new low-speed USB device number 53 using dummy_hcd [ 1730.309176][ T7375] usb 5-1: device descriptor read/8, error -71 [ 1730.441811][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 1730.450284][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 1730.579371][ T7375] usb 5-1: new low-speed USB device number 54 using dummy_hcd [ 1730.632377][ T7375] usb 5-1: device descriptor read/8, error -71 [ 1730.770501][ T7375] usb usb5-port1: unable to enumerate USB device [ 1731.088336][T16929] Bluetooth: hci2: unexpected event for opcode 0x0c5a [ 1731.670832][ T8700] netlink: 20 bytes leftover after parsing attributes in process `syz.0.13441'. [ 1731.758397][ T10] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 1731.928467][ T10] usb 2-1: Using ep0 maxpacket: 8 [ 1731.944125][ T10] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 1731.969432][ T10] usb 2-1: config 179 has no interface number 0 [ 1731.982117][ T10] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1732.004225][ T10] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1732.018934][ T10] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1732.043082][ T10] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1732.081572][ T10] usb 2-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1732.164193][ T10] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1732.197536][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1732.244600][ T8698] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 1732.862177][ T8698] input: syz1 as /devices/virtual/input/input69 [ 1733.272969][ T7374] usb 2-1: USB disconnect, device number 44 [ 1733.279140][ C0] xpad 2-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1733.279180][ C0] xpad 2-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1733.380935][ T8730] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.13449'. [ 1734.183387][ T8737] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1734.314636][ T8743] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1734.380575][ T8743] Set syz0 is full, maxelem 0 reached [ 1734.888434][ T7374] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 1734.933050][ T8753] netlink: 1752 bytes leftover after parsing attributes in process `syz.0.13459'. [ 1735.060434][ T7374] usb 5-1: Using ep0 maxpacket: 32 [ 1735.090763][ T7374] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1735.108182][ T7374] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1735.119274][ T7374] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1735.148669][ T7374] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1735.177783][ T7374] usb 5-1: config 0 descriptor?? [ 1735.204671][ T7374] hub 5-1:0.0: USB hub found [ 1735.410288][ T7374] hub 5-1:0.0: 1 port detected [ 1735.518381][ T7375] usb 2-1: new full-speed USB device number 45 using dummy_hcd [ 1735.570840][ T1459] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 1735.716012][ T7375] usb 2-1: config index 0 descriptor too short (expected 30, got 18) [ 1735.730288][ T1459] usb 1-1: Using ep0 maxpacket: 8 [ 1735.748770][ T1459] usb 1-1: config 252 has an invalid interface number: 255 but max is 0 [ 1735.762485][ T1459] usb 1-1: config 252 has no interface number 0 [ 1735.771564][ T1459] usb 1-1: too many endpoints for config 252 interface 255 altsetting 255: 255, using maximum allowed: 30 [ 1735.785670][ T1459] usb 1-1: config 252 interface 255 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 1735.805580][ T7375] usb 2-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 1735.824764][ T1459] usb 1-1: config 252 interface 255 has no altsetting 0 [ 1735.835993][ T1459] usb 1-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1735.847881][ T1459] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1735.862920][ T7375] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1735.888285][ T7375] usb 2-1: Product: syz [ 1735.899351][ T7375] usb 2-1: Manufacturer: syz [ 1735.939537][ T7375] usb 2-1: SerialNumber: syz [ 1735.950488][ T1459] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1735.967980][ T1459] pvrusb2: ********** [ 1735.975763][ T7375] usb 2-1: config 0 descriptor?? [ 1735.992196][ T1459] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1736.017475][ T7375] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 1736.037859][ T1459] pvrusb2: Important functionality might not be entirely working. [ 1736.062919][ T7374] hub 5-1:0.0: activate --> -90 [ 1736.074877][ T7375] usb 2-1: setting power ON [ 1736.088883][ T7375] dvb-usb: bulk message failed: -22 (2/0) [ 1736.101485][ T1459] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1736.121539][ T7375] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 1736.158930][ T7375] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) error while loading driver (-19) [ 1736.170836][ T1459] pvrusb2: ********** [ 1736.183729][ T1459] usb 1-1: selecting invalid altsetting 0 [ 1736.195577][ T7375] dvb_usb_cxusb 2-1:0.0: probe with driver dvb_usb_cxusb failed with error -22 [ 1736.263465][ T2369] pvrusb2: Invalid write control endpoint [ 1736.533600][ T8772] pvrusb2: Invalid write control endpoint [ 1736.615707][ T8772] loop3: detected capacity change from 0 to 1 [ 1736.635094][ T8772] Dev loop3: unable to read RDB block 1 [ 1736.635131][ T8772] loop3: unable to read partition table [ 1736.635293][ T8772] loop3: partition table beyond EOD, truncated [ 1736.635346][ T8772] loop_reread_partitions: partition scan of loop3 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1736.836220][ T9496] usb 5-1: USB disconnect, device number 55 [ 1736.951906][ T2369] pvrusb2: Invalid write control endpoint [ 1736.964457][ T4994] Dev loop3: unable to read RDB block 1 [ 1736.987509][ T4994] loop3: unable to read partition table [ 1736.997656][ T2369] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1737.001369][ T4994] loop3: partition table beyond EOD, [ 1737.019844][ T2369] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1737.040088][ T2369] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1737.048905][ T4994] truncated [ 1737.052108][ T2369] pvrusb2: Device being rendered inoperable [ 1737.066988][ T2369] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1737.079570][ T2369] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 1737.110561][ T2369] pvrusb2: Attached sub-driver cx25840 [ 1737.118744][ T2369] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1737.134034][ T2369] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1737.159146][ T7374] usb 5-1-port1: config error [ 1737.328520][ T7379] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 1737.341127][ T8780] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.13468'. [ 1737.484491][ T7379] usb 4-1: Using ep0 maxpacket: 16 [ 1737.491515][ T7379] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 8 [ 1737.505530][ T7379] usb 4-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 6.00 [ 1737.514995][ T7379] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1737.523415][ T7379] usb 4-1: Product: syz [ 1737.527721][ T7379] usb 4-1: Manufacturer: syz [ 1737.533039][ T7379] usb 4-1: SerialNumber: syz [ 1737.543096][ T7379] usb 4-1: config 0 descriptor?? [ 1737.559305][ T7379] ftdi_sio 4-1:0.0: FTDI USB Serial Device converter detected [ 1737.570143][ T7379] usb 4-1: Detected FT232R [ 1737.698486][ T1459] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 1737.758077][ T8776] FAULT_INJECTION: forcing a failure. [ 1737.758077][ T8776] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1737.773608][ T8776] CPU: 1 UID: 0 PID: 8776 Comm: syz.3.13466 Tainted: G L syzkaller #0 PREEMPT(full) [ 1737.773642][ T8776] Tainted: [L]=SOFTLOCKUP [ 1737.773650][ T8776] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1737.773662][ T8776] Call Trace: [ 1737.773671][ T8776] [ 1737.773681][ T8776] dump_stack_lvl+0xe8/0x150 [ 1737.773719][ T8776] should_fail_ex+0x40c/0x560 [ 1737.773751][ T8776] _copy_from_user+0x2d/0xb0 [ 1737.773772][ T8776] __sys_bpf+0x2e7/0xd90 [ 1737.773809][ T8776] ? __pfx___sys_bpf+0x10/0x10 [ 1737.773846][ T8776] ? __fget_files+0x2a/0x420 [ 1737.773894][ T8776] ? ksys_write+0x242/0x270 [ 1737.773918][ T8776] ? __pfx_ksys_write+0x10/0x10 [ 1737.773945][ T8776] __x64_sys_bpf+0xba/0xd0 [ 1737.773972][ T8776] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1737.773996][ T8776] do_syscall_64+0x174/0x580 [ 1737.774021][ T8776] ? trace_irq_disable+0x3b/0x140 [ 1737.774048][ T8776] ? clear_bhb_loop+0x40/0x90 [ 1737.774073][ T8776] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1737.774095][ T8776] RIP: 0033:0x7f55da99e019 [ 1737.774115][ T8776] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1737.774132][ T8776] RSP: 002b:00007f55db7b7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1737.774154][ T8776] RAX: ffffffffffffffda RBX: 00007f55dac25fa0 RCX: 00007f55da99e019 [ 1737.774169][ T8776] RDX: 0000000000000094 RSI: 0000200000002c40 RDI: 0000000000000005 [ 1737.774182][ T8776] RBP: 00007f55db7b7090 R08: 0000000000000000 R09: 0000000000000000 [ 1737.774195][ T8776] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1737.774207][ T8776] R13: 00007f55dac26038 R14: 00007f55dac25fa0 R15: 00007f55dad4fa48 [ 1737.774247][ T8776] [ 1737.775354][ T7379] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 1737.982725][ T7379] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 1737.993786][ T7379] ftdi_sio 4-1:0.0: GPIO initialisation failed: -71 [ 1738.000701][ T1459] usb 3-1: Using ep0 maxpacket: 16 [ 1738.009820][ T1459] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1738.020363][ T7379] usb 4-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 1738.030066][ T1459] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1738.044158][ T1459] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1738.056915][ T7379] usb 4-1: USB disconnect, device number 21 [ 1738.080790][ T1459] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1738.090326][ T1459] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1738.103512][ T7379] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 1738.113193][ T1459] usb 3-1: Product: syz [ 1738.117571][ T1459] usb 3-1: Manufacturer: syz [ 1738.140242][ T7379] ftdi_sio 4-1:0.0: device disconnected [ 1738.146588][ T1459] usb 3-1: SerialNumber: syz [ 1738.224890][ T9512] usb 2-1: USB disconnect, device number 45 [ 1738.362139][ T9496] usb 1-1: USB disconnect, device number 39 [ 1738.556528][ T8800] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1738.626863][ T8800] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1738.683793][ T8805] netlink: 1752 bytes leftover after parsing attributes in process `syz.1.13479'. [ 1739.450478][ T8821] syzkaller0: entered promiscuous mode [ 1739.471339][ T8821] syzkaller0: entered allmulticast mode [ 1740.019871][ T8843] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1740.173694][ T8850] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 1740.308387][ T9496] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 1740.496588][ T9496] usb 1-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 1740.514090][ T9496] usb 1-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 1740.535219][ T10] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 1740.545217][ T9496] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1740.632963][ T9496] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 1740.709682][ T1459] cdc_ncm 3-1:1.0: CDC Union missing and no IAD found [ 1740.726962][ T1459] cdc_ncm 3-1:1.0: bind() failure [ 1740.745243][ T10] usb 2-1: Using ep0 maxpacket: 8 [ 1740.783421][ T10] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 1740.797265][ T1459] usb 3-1: USB disconnect, device number 46 [ 1740.821034][ T10] usb 2-1: config 179 has no interface number 0 [ 1740.857926][ T10] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1740.912480][ T10] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1740.954217][ T10] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1741.023924][ T10] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1741.060606][ T10] usb 2-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1741.129591][ T10] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1741.145359][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1741.174940][ T8854] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 1741.660596][ T10] usb 2-1: USB disconnect, device number 46 [ 1741.666585][ C0] xpad 2-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1741.666627][ C0] xpad 2-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1741.719235][ T9496] stv0680 1-1:4.0: STV(e): camera ping failed!! [ 1741.943339][ T9496] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -71 [ 1741.965475][ T9496] stv0680 1-1:4.0: last error: 0, command = 0x0 [ 1742.009884][ T9496] usb 1-1: USB disconnect, device number 40 [ 1742.770571][T26973] Bluetooth: hci3: command 0x0406 tx timeout [ 1742.888566][ T9496] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 1743.068676][ T9496] usb 1-1: Using ep0 maxpacket: 32 [ 1743.099295][ T9496] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 1743.138334][ T9496] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 1743.186452][ T9496] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 1743.226497][ T9496] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 1743.259243][ T9512] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 1743.277133][ T9496] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 1743.320473][ T9496] usb 1-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 1743.332058][ T9496] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1743.363555][ T9496] usb 1-1: Product: syz [ 1743.381810][ T9496] usb 1-1: Manufacturer: syz [ 1743.394074][ T9496] usb 1-1: SerialNumber: syz [ 1743.439676][ T9512] usb 2-1: Using ep0 maxpacket: 32 [ 1743.447189][ T9496] usb 1-1: config 0 descriptor?? [ 1743.481228][ T9512] usb 2-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 1743.507026][ T9512] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1743.559311][ T9512] usb 2-1: config 0 descriptor?? [ 1743.589952][ T9512] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 1743.896344][ T9496] iforce 1-1:0.0: usb_submit_urb failed: -32 [ 1743.911048][ T9496] input input70: Device does not respond to id packet M [ 1743.929758][ T9496] iforce 1-1:0.0: usb_submit_urb failed: -32 [ 1743.947063][ T9496] input input70: Device does not respond to id packet P [ 1744.038501][ T1459] usb 5-1: new high-speed USB device number 56 using dummy_hcd [ 1744.054429][ T8892] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1744.095409][ T8892] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1744.230892][ T1459] usb 5-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 1744.257512][ T1459] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1744.400349][ T8887] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1744.435769][ T8887] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1744.466666][ T9512] gspca_vc032x: reg_w err -71 [ 1744.488322][ T9512] gspca_vc032x: I2c Bus Busy Wait 00 [ 1744.516542][ T9512] gspca_vc032x: I2c Bus Busy Wait 00 [ 1744.548911][ T9512] gspca_vc032x: I2c Bus Busy Wait 00 [ 1744.574702][ T9512] gspca_vc032x: I2c Bus Busy Wait 00 [ 1744.593823][ T9512] gspca_vc032x: I2c Bus Busy Wait 00 [ 1744.610425][ T9512] gspca_vc032x: I2c Bus Busy Wait 00 [ 1744.632901][ T9512] gspca_vc032x: I2c Bus Busy Wait 00 [ 1744.646586][ T9512] gspca_vc032x: I2c Bus Busy Wait 00 [ 1744.693413][ T9512] gspca_vc032x: I2c Bus Busy Wait 00 [ 1744.715855][ T9512] gspca_vc032x: I2c Bus Busy Wait 00 [ 1744.724366][ T9512] gspca_vc032x: I2c Bus Busy Wait 00 [ 1744.731864][ T9512] gspca_vc032x: I2c Bus Busy Wait 00 [ 1744.737508][ T9512] gspca_vc032x: I2c Bus Busy Wait 00 [ 1744.742972][ T9512] gspca_vc032x: I2c Bus Busy Wait 00 [ 1744.749233][ T8897] Invalid option length (62825) for dns_resolver key [ 1744.768483][ T9512] gspca_vc032x: I2c Bus Busy Wait 00 [ 1744.784343][ T9512] gspca_vc032x: I2c Bus Busy Wait 00 [ 1744.795666][ T9512] gspca_vc032x: I2c Bus Busy Wait 00 [ 1744.804572][ T9512] gspca_vc032x: I2c Bus Busy Wait 00 [ 1744.813743][ T9512] gspca_vc032x: Unknown sensor... [ 1744.821872][ T9512] vc032x 2-1:0.0: probe with driver vc032x failed with error -22 [ 1744.857939][ T9512] usb 2-1: USB disconnect, device number 47 [ 1745.001902][ T9496] iforce 1-1:0.0: usb_submit_urb failed: -110 [ 1745.021107][ T9496] input input70: Device does not respond to id packet B [ 1745.040922][ T9496] iforce 1-1:0.0: usb_submit_urb failed: -32 [ 1745.067386][ T9496] input input70: Device does not respond to id packet N [ 1745.096375][ T9496] iforce 1-1:0.0: usb_submit_urb failed: -32 [ 1745.120794][ T9496] iforce 1-1:0.0: usb_submit_urb failed: -32 [ 1745.143336][ T9496] iforce 1-1:0.0: usb_submit_urb failed: -32 [ 1745.175666][ T9496] iforce 1-1:0.0: usb_submit_urb failed: -32 [ 1745.213118][ T9496] input: Unknown I-Force Device [%04x:%04x] as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input70 [ 1746.256182][ T9496] usb 1-1: USB disconnect, device number 41 [ 1746.399725][ T7398] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 1746.580802][ T7398] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1746.604238][ T7398] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1746.628110][ T7398] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1746.673411][ T7398] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1746.703368][ T7398] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1746.750425][ T7398] usb 3-1: config 0 descriptor?? [ 1746.862396][ T8905] binder: 8904:8905 ioctl c0306201 200000000640 returned -22 [ 1746.998687][ T1459] cxacru_cm: 39 callbacks suppressed [ 1746.998708][ T1459] cxacru 5-1:1.0: send of cm 0x84 failed (-104) [ 1747.034421][ T1459] ATM dev 0: cxacru_atm_start: CHIP_ADSL_LINE_START returned -104 [ 1747.065945][ T1459] ------------[ cut here ]------------ [ 1747.072169][ T1459] URB ffff888046d59100 submitted while active [ 1747.079196][ T1459] WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x79/0x18b0, CPU#1: kworker/1:0/1459 [ 1747.090074][ T1459] Modules linked in: [ 1747.094290][ T1459] CPU: 1 UID: 0 PID: 1459 Comm: kworker/1:0 Tainted: G L syzkaller #0 PREEMPT(full) [ 1747.106966][ T1459] Tainted: [L]=SOFTLOCKUP [ 1747.112101][ T1459] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1747.122390][ T1459] Workqueue: usb_hub_wq hub_event [ 1747.127609][ T1459] RIP: 0010:usb_submit_urb+0x7c/0x18b0 [ 1747.133216][ T1459] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 d9 cb d2 fa 49 83 3e 00 74 40 e8 5e 33 65 fa 48 8d 3d 07 ac 03 09 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 43 33 65 fa eb 05 e8 3c 33 [ 1747.153000][ T1459] RSP: 0018:ffffc900042ee858 EFLAGS: 00010283 [ 1747.159307][ T1459] RAX: ffffffff8761e172 RBX: ffff888046d59100 RCX: 0000000000100000 [ 1747.167345][ T1459] RDX: ffffc9001aab7000 RSI: ffff888046d59100 RDI: ffffffff90658d80 [ 1747.175417][ T1459] RBP: dffffc0000000000 R08: 0000000000000002 R09: 0000000000000000 [ 1747.183566][ T1459] R10: dffffc0000000000 R11: fffffbfff20af3a7 R12: 0000000000000040 [ 1747.191845][ T1459] R13: 0000000000000000 R14: ffff888046d59108 R15: 0000000000000cc0 [ 1747.199952][ T1459] FS: 0000000000000000(0000) GS:ffff88812504c000(0000) knlGS:0000000000000000 [ 1747.210484][ T1459] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1747.217121][ T1459] CR2: 00007fe64e1556c8 CR3: 0000000048e9a000 CR4: 00000000003526f0 [ 1747.226092][ T1459] Call Trace: [ 1747.229512][ T1459] [ 1747.232485][ T1459] ? __raw_spin_lock_init+0x45/0x100 [ 1747.237835][ T1459] ? __init_swait_queue_head+0xa8/0x150 [ 1747.244623][ T1459] cxacru_cm+0x21a/0xf10 [ 1747.249518][ T1459] ? usb_new_device+0x99d/0x1620 [ 1747.254661][ T1459] ? hub_event+0x28e8/0x4d30 [ 1747.259386][ T1459] ? process_scheduled_works+0xa8e/0x14e0 [ 1747.265204][ T1459] ? kthread+0x388/0x470 [ 1747.269692][ T1459] ? __pfx_cxacru_cm+0x10/0x10 [ 1747.274695][ T1459] ? __kasan_kmalloc+0x93/0xb0 [ 1747.279554][ T1459] ? __kmalloc_cache_noprof+0x32d/0x660 [ 1747.285184][ T1459] ? __kmalloc_cache_noprof+0x150/0x660 [ 1747.290816][ T1459] ? cxacru_poll_status+0x14b/0x1110 [ 1747.296142][ T1459] ? cxacru_poll_status+0x14b/0x1110 [ 1747.301562][ T1459] cxacru_poll_status+0x178/0x1110 [ 1747.306732][ T1459] ? cxacru_atm_start+0x176/0x360 [ 1747.313213][ T1459] ? __pfx_cxacru_poll_status+0x10/0x10 [ 1747.319750][ T1459] ? __mutex_unlock_slowpath+0x731/0x900 [ 1747.325457][ T1459] ? atm_register_sysfs+0x18e/0x360 [ 1747.330906][ T1459] cxacru_atm_start+0x185/0x360 [ 1747.335856][ T1459] usbatm_atm_init+0x144/0x3a0 [ 1747.340771][ T1459] usbatm_usb_probe+0x15cb/0x1db0 [ 1747.345868][ T1459] cxacru_usb_probe+0x17f/0x220 [ 1747.350819][ T1459] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1747.356866][ T1459] ? __pfx_cxacru_usb_probe+0x10/0x10 [ 1747.362443][ T1459] usb_probe_interface+0x653/0xc60 [ 1747.367693][ T1459] ? __pfx_usb_probe_interface+0x10/0x10 [ 1747.373425][ T1459] really_probe+0x254/0xae0 [ 1747.378347][ T1459] __driver_probe_device+0x1e8/0x360 [ 1747.383703][ T1459] driver_probe_device+0x4f/0x240 [ 1747.388824][ T1459] __device_attach_driver+0x270/0x410 [ 1747.394261][ T1459] bus_for_each_drv+0x258/0x2f0 [ 1747.399646][ T1459] ? __pfx___device_attach_driver+0x10/0x10 [ 1747.405960][ T1459] ? __pfx_bus_for_each_drv+0x10/0x10 [ 1747.411474][ T1459] ? lockdep_hardirqs_on+0x7a/0x110 [ 1747.417870][ T1459] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1747.424437][ T1459] __device_attach+0x2c4/0x450 [ 1747.429313][ T1459] ? __pfx___device_attach+0x10/0x10 [ 1747.434661][ T1459] ? do_raw_spin_unlock+0xf5/0x210 [ 1747.439847][ T1459] ? _raw_spin_unlock+0x28/0x50 [ 1747.444736][ T1459] device_initial_probe+0xa1/0xd0 [ 1747.449851][ T1459] bus_probe_device+0x12a/0x220 [ 1747.454744][ T1459] device_add+0x7d7/0xb80 [ 1747.459176][ T1459] usb_set_configuration+0x1ad8/0x2180 [ 1747.464704][ T1459] usb_generic_driver_probe+0x8d/0x150 [ 1747.470290][ T1459] usb_probe_device+0x1c3/0x3b0 [ 1747.475205][ T1459] ? __pfx_usb_probe_device+0x10/0x10 [ 1747.480702][ T1459] really_probe+0x254/0xae0 [ 1747.485263][ T1459] __driver_probe_device+0x1e8/0x360 [ 1747.490646][ T1459] driver_probe_device+0x4f/0x240 [ 1747.495734][ T1459] __device_attach_driver+0x270/0x410 [ 1747.501222][ T1459] bus_for_each_drv+0x258/0x2f0 [ 1747.506143][ T1459] ? __pfx___device_attach_driver+0x10/0x10 [ 1747.512146][ T1459] ? __pfx_bus_for_each_drv+0x10/0x10 [ 1747.518958][ T1459] ? lockdep_hardirqs_on+0x7a/0x110 [ 1747.525759][ T1459] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1747.533520][ T1459] __device_attach+0x2c4/0x450 [ 1747.538461][ T1459] ? __pfx___device_attach+0x10/0x10 [ 1747.543861][ T1459] ? do_raw_spin_unlock+0xf5/0x210 [ 1747.549118][ T1459] ? _raw_spin_unlock+0x28/0x50 [ 1747.554038][ T1459] device_initial_probe+0xa1/0xd0 [ 1747.559168][ T1459] bus_probe_device+0x12a/0x220 [ 1747.564120][ T1459] device_add+0x7d7/0xb80 [ 1747.568593][ T1459] usb_new_device+0x99d/0x1620 [ 1747.573470][ T1459] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1747.579565][ T1459] ? __pfx_usb_new_device+0x10/0x10 [ 1747.584853][ T1459] ? _raw_spin_unlock_irq+0x23/0x50 [ 1747.590167][ T1459] hub_event+0x28e8/0x4d30 [ 1747.594640][ T1459] ? do_raw_spin_unlock+0xf5/0x210 [ 1747.599894][ T1459] ? __pfx_hub_event+0x10/0x10 [ 1747.604712][ T1459] ? process_scheduled_works+0xa20/0x14e0 [ 1747.610555][ T1459] ? rcu_is_watching+0x15/0xb0 [ 1747.615390][ T1459] ? process_scheduled_works+0xa20/0x14e0 [ 1747.622551][ T1459] process_scheduled_works+0xa8e/0x14e0 [ 1747.628176][ T1459] ? __pfx_process_scheduled_works+0x10/0x10 [ 1747.635007][ T1459] ? assign_work+0x3cf/0x5d0 [ 1747.639684][ T1459] worker_thread+0xa47/0xfb0 [ 1747.644342][ T1459] kthread+0x388/0x470 [ 1747.648514][ T1459] ? __pfx_worker_thread+0x10/0x10 [ 1747.653698][ T1459] ? __pfx_kthread+0x10/0x10 [ 1747.658978][ T1459] ret_from_fork+0x514/0xb70 [ 1747.663661][ T1459] ? __pfx_ret_from_fork+0x10/0x10 [ 1747.668867][ T1459] ? __switch_to+0xc89/0x1420 [ 1747.673665][ T1459] ? __pfx_kthread+0x10/0x10 [ 1747.678416][ T1459] ret_from_fork_asm+0x1a/0x30 [ 1747.683262][ T1459] [ 1747.686322][ T1459] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1747.693619][ T1459] CPU: 1 UID: 0 PID: 1459 Comm: kworker/1:0 Tainted: G L syzkaller #0 PREEMPT(full) [ 1747.704575][ T1459] Tainted: [L]=SOFTLOCKUP [ 1747.708911][ T1459] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1747.718985][ T1459] Workqueue: usb_hub_wq hub_event [ 1747.724057][ T1459] Call Trace: [ 1747.727349][ T1459] [ 1747.730292][ T1459] vpanic+0x56c/0xa60 [ 1747.734355][ T1459] ? __pfx__printk+0x10/0x10 [ 1747.738977][ T1459] ? __pfx_vpanic+0x10/0x10 [ 1747.743526][ T1459] ? is_bpf_text_address+0x292/0x2b0 [ 1747.748835][ T1459] ? is_bpf_text_address+0x26/0x2b0 [ 1747.754064][ T1459] panic+0xc5/0xd0 [ 1747.757822][ T1459] ? __pfx_panic+0x10/0x10 [ 1747.762296][ T1459] ? ret_from_fork_asm+0x1a/0x30 [ 1747.767275][ T1459] __warn+0x315/0x4c0 [ 1747.771286][ T1459] ? usb_submit_urb+0x79/0x18b0 [ 1747.776167][ T1459] ? usb_submit_urb+0x79/0x18b0 [ 1747.781039][ T1459] __report_bug+0x276/0x570 [ 1747.785660][ T1459] ? unwind_next_frame+0x8f/0x2550 [ 1747.790794][ T1459] ? usb_submit_urb+0x79/0x18b0 [ 1747.795668][ T1459] ? __pfx___report_bug+0x10/0x10 [ 1747.800718][ T1459] ? __pfx___mutex_trylock_common+0x10/0x10 [ 1747.806630][ T1459] ? rcu_is_watching+0x15/0xb0 [ 1747.811498][ T1459] report_bug_entry+0x19a/0x290 [ 1747.816383][ T1459] ? usb_submit_urb+0x7c/0x18b0 [ 1747.821251][ T1459] ? usb_submit_urb+0x81/0x18b0 [ 1747.826120][ T1459] handle_bug+0xce/0x200 [ 1747.830500][ T1459] exc_invalid_op+0x1a/0x50 [ 1747.835037][ T1459] asm_exc_invalid_op+0x1a/0x20 [ 1747.839928][ T1459] RIP: 0010:usb_submit_urb+0x7c/0x18b0 [ 1747.845412][ T1459] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 d9 cb d2 fa 49 83 3e 00 74 40 e8 5e 33 65 fa 48 8d 3d 07 ac 03 09 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 43 33 65 fa eb 05 e8 3c 33 [ 1747.865845][ T1459] RSP: 0018:ffffc900042ee858 EFLAGS: 00010283 [ 1747.871934][ T1459] RAX: ffffffff8761e172 RBX: ffff888046d59100 RCX: 0000000000100000 [ 1747.879923][ T1459] RDX: ffffc9001aab7000 RSI: ffff888046d59100 RDI: ffffffff90658d80 [ 1747.887922][ T1459] RBP: dffffc0000000000 R08: 0000000000000002 R09: 0000000000000000 [ 1747.895906][ T1459] R10: dffffc0000000000 R11: fffffbfff20af3a7 R12: 0000000000000040 [ 1747.903979][ T1459] R13: 0000000000000000 R14: ffff888046d59108 R15: 0000000000000cc0 [ 1747.911989][ T1459] ? usb_submit_urb+0x72/0x18b0 [ 1747.916877][ T1459] ? usb_submit_urb+0x72/0x18b0 [ 1747.921748][ T1459] ? __raw_spin_lock_init+0x45/0x100 [ 1747.927080][ T1459] ? __init_swait_queue_head+0xa8/0x150 [ 1747.932709][ T1459] cxacru_cm+0x21a/0xf10 [ 1747.937048][ T1459] ? usb_new_device+0x99d/0x1620 [ 1747.942039][ T1459] ? hub_event+0x28e8/0x4d30 [ 1747.946665][ T1459] ? process_scheduled_works+0xa8e/0x14e0 [ 1747.952447][ T1459] ? kthread+0x388/0x470 [ 1747.956750][ T1459] ? __pfx_cxacru_cm+0x10/0x10 [ 1747.961552][ T1459] ? __kasan_kmalloc+0x93/0xb0 [ 1747.966342][ T1459] ? __kmalloc_cache_noprof+0x32d/0x660 [ 1747.971908][ T1459] ? __kmalloc_cache_noprof+0x150/0x660 [ 1747.977481][ T1459] ? cxacru_poll_status+0x14b/0x1110 [ 1747.982786][ T1459] ? cxacru_poll_status+0x14b/0x1110 [ 1747.988106][ T1459] cxacru_poll_status+0x178/0x1110 [ 1747.993266][ T1459] ? cxacru_atm_start+0x176/0x360 [ 1747.998345][ T1459] ? __pfx_cxacru_poll_status+0x10/0x10 [ 1748.003941][ T1459] ? __mutex_unlock_slowpath+0x731/0x900 [ 1748.009961][ T1459] ? atm_register_sysfs+0x18e/0x360 [ 1748.015201][ T1459] cxacru_atm_start+0x185/0x360 [ 1748.020087][ T1459] usbatm_atm_init+0x144/0x3a0 [ 1748.024888][ T1459] usbatm_usb_probe+0x15cb/0x1db0 [ 1748.029983][ T1459] cxacru_usb_probe+0x17f/0x220 [ 1748.034902][ T1459] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1748.040751][ T1459] ? __pfx_cxacru_usb_probe+0x10/0x10 [ 1748.046170][ T1459] usb_probe_interface+0x653/0xc60 [ 1748.051319][ T1459] ? __pfx_usb_probe_interface+0x10/0x10 [ 1748.056979][ T1459] really_probe+0x254/0xae0 [ 1748.061509][ T1459] __driver_probe_device+0x1e8/0x360 [ 1748.066841][ T1459] driver_probe_device+0x4f/0x240 [ 1748.071887][ T1459] __device_attach_driver+0x270/0x410 [ 1748.077306][ T1459] bus_for_each_drv+0x258/0x2f0 [ 1748.082201][ T1459] ? __pfx___device_attach_driver+0x10/0x10 [ 1748.088110][ T1459] ? __pfx_bus_for_each_drv+0x10/0x10 [ 1748.093516][ T1459] ? lockdep_hardirqs_on+0x7a/0x110 [ 1748.098737][ T1459] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1748.104555][ T1459] __device_attach+0x2c4/0x450 [ 1748.109515][ T1459] ? __pfx___device_attach+0x10/0x10 [ 1748.114820][ T1459] ? do_raw_spin_unlock+0xf5/0x210 [ 1748.119948][ T1459] ? _raw_spin_unlock+0x28/0x50 [ 1748.124832][ T1459] device_initial_probe+0xa1/0xd0 [ 1748.129977][ T1459] bus_probe_device+0x12a/0x220 [ 1748.134864][ T1459] device_add+0x7d7/0xb80 [ 1748.139323][ T1459] usb_set_configuration+0x1ad8/0x2180 [ 1748.144817][ T1459] usb_generic_driver_probe+0x8d/0x150 [ 1748.150294][ T1459] usb_probe_device+0x1c3/0x3b0 [ 1748.155187][ T1459] ? __pfx_usb_probe_device+0x10/0x10 [ 1748.160570][ T1459] really_probe+0x254/0xae0 [ 1748.165091][ T1459] __driver_probe_device+0x1e8/0x360 [ 1748.170479][ T1459] driver_probe_device+0x4f/0x240 [ 1748.175522][ T1459] __device_attach_driver+0x270/0x410 [ 1748.180915][ T1459] bus_for_each_drv+0x258/0x2f0 [ 1748.185806][ T1459] ? __pfx___device_attach_driver+0x10/0x10 [ 1748.191714][ T1459] ? __pfx_bus_for_each_drv+0x10/0x10 [ 1748.197110][ T1459] ? lockdep_hardirqs_on+0x7a/0x110 [ 1748.202328][ T1459] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1748.208147][ T1459] __device_attach+0x2c4/0x450 [ 1748.213459][ T1459] ? __pfx___device_attach+0x10/0x10 [ 1748.218780][ T1459] ? do_raw_spin_unlock+0xf5/0x210 [ 1748.223908][ T1459] ? _raw_spin_unlock+0x28/0x50 [ 1748.228777][ T1459] device_initial_probe+0xa1/0xd0 [ 1748.233856][ T1459] bus_probe_device+0x12a/0x220 [ 1748.238763][ T1459] device_add+0x7d7/0xb80 [ 1748.243142][ T1459] usb_new_device+0x99d/0x1620 [ 1748.247936][ T1459] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1748.253938][ T1459] ? __pfx_usb_new_device+0x10/0x10 [ 1748.259179][ T1459] ? _raw_spin_unlock_irq+0x23/0x50 [ 1748.264499][ T1459] hub_event+0x28e8/0x4d30 [ 1748.269044][ T1459] ? do_raw_spin_unlock+0xf5/0x210 [ 1748.274222][ T1459] ? __pfx_hub_event+0x10/0x10 [ 1748.279003][ T1459] ? process_scheduled_works+0xa20/0x14e0 [ 1748.284745][ T1459] ? rcu_is_watching+0x15/0xb0 [ 1748.289530][ T1459] ? process_scheduled_works+0xa20/0x14e0 [ 1748.295339][ T1459] process_scheduled_works+0xa8e/0x14e0 [ 1748.300967][ T1459] ? __pfx_process_scheduled_works+0x10/0x10 [ 1748.307065][ T1459] ? assign_work+0x3cf/0x5d0 [ 1748.311954][ T1459] worker_thread+0xa47/0xfb0 [ 1748.316602][ T1459] kthread+0x388/0x470 [ 1748.320780][ T1459] ? __pfx_worker_thread+0x10/0x10 [ 1748.325967][ T1459] ? __pfx_kthread+0x10/0x10 [ 1748.330586][ T1459] ret_from_fork+0x514/0xb70 [ 1748.335213][ T1459] ? __pfx_ret_from_fork+0x10/0x10 [ 1748.340414][ T1459] ? __switch_to+0xc89/0x1420 [ 1748.345138][ T1459] ? __pfx_kthread+0x10/0x10 [ 1748.349753][ T1459] ret_from_fork_asm+0x1a/0x30 [ 1748.354543][ T1459] [ 1748.357773][ T1459] Kernel Offset: disabled [ 1748.362138][ T1459] Rebooting in 86400 seconds..