last executing test programs: 47.499454674s ago: executing program 1 (id=310): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010029bd7000ffdbdf250100000006000600234e000014000200776730"], 0x30}}, 0x800) (fail_nth: 4) 47.465745361s ago: executing program 1 (id=311): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x803, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000001d80)="900736ffd7fb87465963b0d3522d82eab665c2832180d084a2b466cc4ea717ab45c96aea10a8c013fdd2a867d155cff2cc400602ee3af3f80c92a078afe315445c352d1695da6c390258ae2e7efc2c02fc161e1b5e271d98a04e5d977b6ca58c3c61f2e559489bcad21796d816c99b330ad4f7f0ff31a95635d4e18731539a4485d53546337f6453f17004a64899aa1c42bceea63fb4bb4a43deb4de7ddf18f773c836c304b2f2edf9c37e2859da3e0f28a1db43866032877a5b3218da48534a923d2b864964cf53bc0156359c23b20c4b5ed905fb9b6dd9178e6110aa63b24a24c71ff171dbf7bb65c26a4f3e3b960e1fe4e5c38c458170e7e5d38a2fa77262a334b70da13159214b59e99043f2d45738cfe619d4e54d9d9d52faad4185dc1461e3de1d4a8e2bac117f496b9198352ed12b367de480013f50733fcce28686f100f105d037fe1d3c387164fd3bb6d9f758e8c35de274cc824e0ef8a4ec4d740cb37a646300158bd9f137d0712242f3ff01641eedbf6207cc3e7b9314e8cd44581f210ae9980710a38a426305d71a732645e48a5faf121177bb16c0253dbba4b6495b2fdf147bf3557edbf1134ad8135eddb75535613f0c13e995f458d7117b7b4484be02dda974d1f894074f5258bc3416e61b41949c2bca7746dd9edc6fc1d0b9305c7ee799be795a7df68f76872046beb4e1ff6d5a62a7177902fdb74cb5d1e104b8852fd4db5ced74b73b68eb138695110452ddf5def0a6961d7010d1b170391e5897f32102ebade663ec2804708f63becf2b7595461d10062df096794e1cb4232cda841f3a86a6d5e50fe8db194bfb3721c9bc3e29b176f3554f1010776afe8fe89b5869bb25e5ffe24ad26f382b7176fd85e3d19a2d8e58031e1939ed39c96c4f2f967f75049ee7e36469b8c010992623f8248cff1c362bbb12e8ed5fd05b72fb1f391b4c13d06a453f2169bea0cc67768e06311494a3dc736c80ef644fc0d09dae7dfc09de2b7f6d0b21734486503b74bd3387ffa9a5da1b39a2ec9c410a4b2d4ec1f8ef1d3a7ced2637878b038da8d69b32a3e402580e5b746f8e7f930ff478e6b15f475b6b96a25cd8f55bdd73bc483ee5625b56b81f8d9183bc36a5c4c0974db6ad499bf1fcccb994c3defccf1324543260fb1a790ef60d50da4f955783af41066d51abdf7a566c2b2c876e0199e7b920068f226c7a5f14b65b3dbd7fb244c3fb1660740b5f849942e468af39e5a9bc80a6075878dfac23d0ae839a0e509448130e7dabadd7c494b64e67be6400ea34b097bfc578deb3c5ebefa9c1019ef65bf641c9388d9b29f6c9c2e5b8b81fcfdd94059d9a21c80f318d9675721a31ca77a4920b06cb744e96ae74ef66b4dfbe5d1085c9485abf9356d966cb63a75a250dc4432b89ec09dff3531613e12694abdd61d270ab34fba12ae1db3ed45fbc87eb1725f962de4922a64c82ed5d4b652ad926be7330f15fee7a6d53719f6231be26e7593454eabf6fdfe940f04c8cdf022ce9e278c0e2ce9aa9285594972d2b910cedf1d956976f9e6d9571210e4939821c9b68146925e2780db8e1fe6872ba1e178dfb627d9623b5c700cae1d3ce830422b9d906060b28d0956af355a2ce927c9cde8391b43fdbccd428403ee758de7c09de5a2c8eb2dac85a0e056b1ce291da6e54ea1e669b5eee9ca1043aa4f92368b39920f23f2ce3ea3906412de447a0ba28474f2b839a0413e1a0c5c1e7e818b6ae483fbf9a5fcf9367cf9badb8d2040e54dd868a672f3d24fc0e9a77648acb524999c46061b5a71cc8e0b3e66e5421b4e4f8ade64015793ac3949f7c0a3bd64b8e1d2bb99d3e51b5a295b1d2ae2de914a8d6309d9faf5f6b10edb2d9c1dad7eef2ade703d92f06f811cc8682fb98ba2ec324d9ffb23ccff4d231b459214004c7c3afd1f43265f3e40dfc15053103c220347ce2c480ffc73e500314bf7125baf8047ae9521a9c23b53983366fa69466d0bbd00374f703d8e1645849f024b5f2e6affcd99d0ac335e91daf78d5966b081f82762f050b090847f48696736db6ca4afa74e40c8be0fa72a4f8dfc1ba573ee763c9f995fe9fb17c2d1e6ef167c9f15d3bce4ea8a4634628e38f2460d0387c60cabdc6eb6c7223644ab5375a12b8bc39beec9d4c0346e3030fecb85b780380", 0x602}], 0x1}, 0x84) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000020c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000002100)={0xffffffffffffffff}, 0x13f, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f0000000180)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000000c0), r2, 0x0, 0x1, 0x4}}, 0x20) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x38a}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x282001, 0x0) syz_ublk_add_dev(r3, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, 0x0, 0x0, 0x1, &(0x7f0000000340)={0x2e, 0x6, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0xfff9, 0x42, 0x0, 0x0}}, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(0xffffffffffffffff, 0x1, &(0x7f0000000340)={0x2001}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000001c0)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000340)='1', 0x1}], 0x1, 0x0, 0x0, 0x48044}}], 0x1, 0x20000000) 47.26143985s ago: executing program 1 (id=312): r0 = syz_usb_connect(0x0, 0x202, &(0x7f0000000180)=ANY=[@ANYBLOB="1201100152018b401e040740185d000000010902f00101040000030904"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000040)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB="000d0200fcff5678"], 0x0, 0x0, 0x0, 0x0}) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000080)={0x6, 0x7, 0x2, 0x87, 0xffffffff, 0x1}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x1b, &(0x7f0000000100)={@private1={0xfc, 0x1, '\x00', 0x1}, 0x20002, 0x2, 0x1, 0x6, 0x0, 0xfff6}, 0x20) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000380)={0x14, &(0x7f0000000200)={0x40, 0xf, 0x9, {0x9, 0xe, "76c853d0e44bd6"}}, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="20103400000034316cb3f03806fe26f4d92313973545746cbf44ea4e9d5c81d8b570b578506154df3fd3e41d0dd2a526510773afe4f7b2000000"], 0x0, 0x0, 0x0}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_create_resource$binfmt(&(0x7f0000000000)='./file0\x00') r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80, 0x0) ioctl$KVM_CHECK_EXTENSION(r2, 0xae03, 0xa2) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x8400, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) ioctl$KVM_CAP_EXIT_HYPERCALL(r4, 0x4068aea3, &(0x7f00000003c0)={0xc9, 0x0, 0xc}) ioctl$KVM_SET_NR_MMU_PAGES(r4, 0xae44, 0xffffffff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000240)={0x14, &(0x7f0000000140)={0x20, 0x9, 0x11, {0x11, 0x23, "16191a63aa3cb4acb5992e822eb089"}}, &(0x7f00000001c0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000005c0)={0x44, &(0x7f00000002c0)={0x0, 0xb, 0x7, "a11104adf94723"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0xb}, &(0x7f0000000440)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000480)={0x20, 0x80, 0x1c, {0x2, 0x2, 0xf4d, 0x9, 0xff9a, 0x4, 0x8, 0x6, 0x7ff, 0x7ff, 0x4, 0x9}}, &(0x7f00000004c0)={0x20, 0x85, 0x4, 0x8}, &(0x7f0000000500)={0x20, 0x83, 0x2, 0x1}, &(0x7f0000000540)={0x20, 0x87, 0x2, 0x8}, &(0x7f0000000580)={0x20, 0x89, 0x2, 0x1}}) openat(0xffffffffffffff9c, &(0x7f00000000a0)='./proc/net/afs/cells\x00', 0x2, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000340)={0xffffffffffffffff}, 0x2, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r5, &(0x7f0000000b80)={0x13, 0x10, 0xfa00, {&(0x7f0000000980), r6, 0x2}}, 0x18) recvmmsg(0xffffffffffffffff, &(0x7f0000007280)=[{{0x0, 0x0, 0x0}, 0xe9}, {{0x0, 0x0, 0x0}, 0x20e8bd}], 0x2, 0x0, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8000, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r9, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f00000001c0)="c744240077dd0000c74424027fbe0000c7442406000000000f011c24b8010000000f01c1450f01ca470f01f866baf80cb8e4f61882ef66bafc0c66b8795966ef40250000000066b8de000f00d02e0f005ffa0f01c92e640fc71f", 0x5a}], 0x1, 0xe8, 0x0, 0x0) ioctl$KVM_RUN(r9, 0xae80, 0x0) 43.929108178s ago: executing program 1 (id=326): r0 = open$dir(&(0x7f0000000080)='./tracing/uprobe_events\x00', 0xa8180, 0x80) r1 = openat(r0, &(0x7f00000001c0)='./tracing/uprobe_events\x00', 0x42, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracing\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./tracing/uprobe_events\x00', 0x401, 0x0) socket(0x10, 0x3, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x7}, 0x4) r4 = openat$rtc(0xffffff9c, &(0x7f0000000140), 0xe380, 0x0) r5 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r5) ptrace(0x11, r5) tee(r2, r3, 0x10, 0x8) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="e82800cf", @ANYRES16=r7, @ANYBLOB="0be02dbd700000800000340000000800b800000a2dad1cf629af9d63690011000200303030303a30303a31302e30000000002032bcb65fb35b6e3b2ef2357f717cd34d6eb493520eb69b22623e800ddaaf3da7438ad8a82851d0563204a43384a7dead82d1b253cb1346bd42f92a42c4f55c66ce34cc53eea4afe184fd5e2417d6b67b00543648160e60b87c887ffee6f58453cc48114227505208a3151241ee2c17ec677d43b336f4881b83518948f2d28ec5044e0c197cb5cd4473932708ab51c0d3b87dc02f8ae18a6c73d93f37db8dc5a9252e78d38bf13749280b64b705f294f6cbccb2a4e5ba14ba7359b041"], 0x38}, 0x1, 0x0, 0x0, 0x6008010}, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuset.effective_cpus\x00', 0x275a, 0x0) fcntl$lock(r8, 0x6, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x3}) fcntl$lock(r8, 0x24, &(0x7f0000000040)={0x2, 0x0, 0x205, 0x5}) readv(r4, &(0x7f0000000000)=[{&(0x7f0000000200)=""/205, 0xcd}], 0x1) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) setsockopt$packet_int(r3, 0x107, 0x16, &(0x7f0000000000)=0x4, 0x4) write(r2, &(0x7f0000000300)='p:_est/event1 ./file0:0x0 _rg2=%bx', 0x22) ioctl$FS_IOC_GETFLAGS(r1, 0x80086601, &(0x7f0000000440)) 43.821400714s ago: executing program 1 (id=328): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) (async) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000100)="660f388173ab0fc76fb4360fc9bb25cc00007666ba6bb74189000003c70fae6e2fc0c00f0f2367260f01ca660f38817700c4c2459d78ad", 0x37}], 0x1, 0x55, 0x0, 0x0) (async, rerun: 32) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000001f80)=[{{&(0x7f00000000c0)={0x2, 0x4e22, @remote}, 0x10, 0x0}}], 0x1, 0x4) (async, rerun: 32) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fdd000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) (async) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000005700)=@vmx={0x105, 0x0, 0x2080, {0xf000}}) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x84, &(0x7f0000000100)={0x0, @in6={{0xa, 0x4e21, 0x101, @empty, 0x5ff}}, 0x7, 0x7ffd}, &(0x7f0000000000)=0x90) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) 43.580852449s ago: executing program 1 (id=329): r0 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/sys/kernel/sem\x00', 0x1, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000300)="ffffffff") mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) r3 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r3, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e20, @remote}}, 0x80, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x0) sendmsg$kcm(r3, &(0x7f0000000100)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0xffff, 0x2, 0x10, {0x2, 0x4e20, @loopback}}, 0x80, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x200008a0) sendmsg$kcm(r3, &(0x7f0000000180)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0xffff, 0x2, 0x10, {0x2, 0x4e22, @remote}}, 0x80, 0x0, 0x0, &(0x7f0000001a00)=ANY=[@ANYBLOB="1800000000000000100100000100000051d833483cc75d51900000000000000004000005040500002b24ec10064b6f2f0000f299a032ef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319e2e66d0998a61d7da0c86d70000001010"], 0x10b8}, 0x4000000) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x5000003, 0x14032, 0xffffffffffffffff, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_PUBL_GET(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)={0x20, r6, 0xd22800e99f4927f3, 0x0, 0x0, {}, [@TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0xfff}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x6}, 0x4020) ioctl$TUNSETIFF(r4, 0xc0c0583b, 0x0) ioctl$TUNSETCARRIER(r4, 0x400454e2, &(0x7f0000000180)=0x1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000080)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16, @ANYBLOB="010000140000000000000200000008000300", @ANYRES32=r7, @ANYBLOB="0c009985f2330fd547793c000800a0003a0900080500390104000000080026"], 0x40}, 0x1, 0x17, 0x0, 0x844}, 0x0) 43.43182623s ago: executing program 32 (id=329): r0 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/sys/kernel/sem\x00', 0x1, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl(r2, 0x40186f40, &(0x7f0000000300)="ffffffff") mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) r3 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r3, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e20, @remote}}, 0x80, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x0) sendmsg$kcm(r3, &(0x7f0000000100)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0xffff, 0x2, 0x10, {0x2, 0x4e20, @loopback}}, 0x80, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x200008a0) sendmsg$kcm(r3, &(0x7f0000000180)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0xffff, 0x2, 0x10, {0x2, 0x4e22, @remote}}, 0x80, 0x0, 0x0, &(0x7f0000001a00)=ANY=[@ANYBLOB="1800000000000000100100000100000051d833483cc75d51900000000000000004000005040500002b24ec10064b6f2f0000f299a032ef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319e2e66d0998a61d7da0c86d70000001010"], 0x10b8}, 0x4000000) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x5000003, 0x14032, 0xffffffffffffffff, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_PUBL_GET(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)={0x20, r6, 0xd22800e99f4927f3, 0x0, 0x0, {}, [@TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0xfff}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x6}, 0x4020) ioctl$TUNSETIFF(r4, 0xc0c0583b, 0x0) ioctl$TUNSETCARRIER(r4, 0x400454e2, &(0x7f0000000180)=0x1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000080)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16, @ANYBLOB="010000140000000000000200000008000300", @ANYRES32=r7, @ANYBLOB="0c009985f2330fd547793c000800a0003a0900080500390104000000080026"], 0x40}, 0x1, 0x17, 0x0, 0x844}, 0x0) 39.263247626s ago: executing program 4 (id=330): r0 = memfd_create(&(0x7f0000000080)=',\xea\x00', 0x4) r1 = dup(r0) r2 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x0, 0x1000}, &(0x7f0000000000)=0x0, &(0x7f0000000540)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r3, r4, r5, &(0x7f00000002c0)={0x2e, 0x2, 0x0, r1, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000100)=@new_dev={0x1, 0x67, 0x0, 0x0, 0x1000, 0xffffffff, 0xffffffffffffffff, 0x0, 0x40}}}, &(0x7f0000000340)=0x0) syz_ublk_setup_queues(r1, r6, &(0x7f0000000380)={0x0, 0xef64, 0x0, 0x1, 0x109, 0x0, r2}, &(0x7f0000000740)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ea6, 0x8, 0x1, 0x263, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2a1, 0x40, 0x1, 0x3d8, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c24, 0x0, 0x0, 0x39d}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x674d, 0x80, 0x3, 0x1e7}}], 0x4, &(0x7f00000019c0)={0x2e, 0x8, 0x0, r1, 0xc0107520, 0x0, 0x900, 0x0, 0x1, {0x7}, 0x0, 0x0, '\x00', {0x3, 0x2e5, 0x0, 0x0}}, &(0x7f0000001a40)) 38.054000266s ago: executing program 4 (id=341): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x42c01, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000000c0)={0x5c, 0x2, 0x6, 0x5, 0x0, 0x0, {0x2, 0x0, 0x4}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x0, 0x0, 0x89}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x5c}}, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) capset(&(0x7f0000000080)={0x20080522}, &(0x7f0000000040)={0x3, 0x10ffff, 0xfffffffd, 0x0, 0x100000, 0x17d3}) setsockopt$sock_int(r4, 0x1, 0x24, &(0x7f0000000200), 0x4) 37.755325581s ago: executing program 4 (id=344): mknodat$loop(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x6004, 0x1) r0 = open(&(0x7f0000000280)='.\x00', 0x80, 0x28) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000100)=0x10) link(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='./file1\x00') openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x143902, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x4) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(&(0x7f00000000c0)='./file1\x00') r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_QUOTAON(r1, 0xffffffff80000200, 0x0, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="580000000206030000000000000000000300000705000100070000000900020073797a31000000000c00078008001240000000050500050002000000050004000100000011000300686173683a69702c706f7274"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) sendmsg$IPSET_CMD_LIST(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x7, 0x6, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x20040010) mount(&(0x7f0000000000)=@nullb, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='nilfs2\x00', 0x8008, 0x0) 37.658991191s ago: executing program 4 (id=347): syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000040)="2e00000010008188040f80ec59acbc0413a1f848130000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000600)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="cdb6dc0b124010a709d18c2d88f5b526fade43a7233a41ed9112b6035ba93ebcec367d0326eb9d12dc63554e5e54a8202c383fed70731723499f8c1f46d9f6f285dc6d7673365cde98082bb97f553fa3549289d34b083d0c5766ec9c7d6eef2c17cf6db8f8438f94bbcfbe4d07ba86969d1a37247a5a8f6c8d6a74321c7061e2b844e7391be4179221058cd328e0e5b4e6fbe00fa99e57018211901026f9e53dd3d5afcb2811ebfacc0023771b40b56d70e5f46be0d49fabb83d90201cfd136b5f4de61123e22a705d4b2f91bcaf4f5dd364076dff9b0b81000a6b", @ANYBLOB="108aec5c9b9531916a446969a23701649b3a022b0554a1b57aa1dec757589e6367ea5b465488cadadc7fbe8a1f05794ce4f871d28bcbb6f735a68c9e0cf42df2bb6202bbdaa49bad4bc8a3ec8c2af66d06efe29269bdbf2fe617799e677af1bb49ad134e1979c21ad6866c52a83a3a198cc3b9a1e21baebaa9ad10b6838e5182c7fd5f3fee4d76b2bff5b4f0c6b6276df587cb9610d2f336266299a56284492cfd816f", @ANYRESDEC, @ANYRES64, @ANYBLOB="fa06308e28abb4a15d2ff7658f50d95ac2b1b1fe988bc9e175611eff43345b8172aadfee9d49d23c13061443d68d529737bf4020aac3ff2243ee382b2390be42a7b8e62936b22cc260e8112307f48d4bba8ad31faeec64", @ANYRESDEC=r0, @ANYRES8], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x2c, &(0x7f00000006c0)=ANY=[@ANYBLOB='\a'], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac3(0xffffffffffffffff, 0x0, 0x0) 22.597425234s ago: executing program 33 (id=347): syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000040)="2e00000010008188040f80ec59acbc0413a1f848130000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000600)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="cdb6dc0b124010a709d18c2d88f5b526fade43a7233a41ed9112b6035ba93ebcec367d0326eb9d12dc63554e5e54a8202c383fed70731723499f8c1f46d9f6f285dc6d7673365cde98082bb97f553fa3549289d34b083d0c5766ec9c7d6eef2c17cf6db8f8438f94bbcfbe4d07ba86969d1a37247a5a8f6c8d6a74321c7061e2b844e7391be4179221058cd328e0e5b4e6fbe00fa99e57018211901026f9e53dd3d5afcb2811ebfacc0023771b40b56d70e5f46be0d49fabb83d90201cfd136b5f4de61123e22a705d4b2f91bcaf4f5dd364076dff9b0b81000a6b", @ANYBLOB="108aec5c9b9531916a446969a23701649b3a022b0554a1b57aa1dec757589e6367ea5b465488cadadc7fbe8a1f05794ce4f871d28bcbb6f735a68c9e0cf42df2bb6202bbdaa49bad4bc8a3ec8c2af66d06efe29269bdbf2fe617799e677af1bb49ad134e1979c21ad6866c52a83a3a198cc3b9a1e21baebaa9ad10b6838e5182c7fd5f3fee4d76b2bff5b4f0c6b6276df587cb9610d2f336266299a56284492cfd816f", @ANYRESDEC, @ANYRES64, @ANYBLOB="fa06308e28abb4a15d2ff7658f50d95ac2b1b1fe988bc9e175611eff43345b8172aadfee9d49d23c13061443d68d529737bf4020aac3ff2243ee382b2390be42a7b8e62936b22cc260e8112307f48d4bba8ad31faeec64", @ANYRESDEC=r0, @ANYRES8], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x2c, &(0x7f00000006c0)=ANY=[@ANYBLOB='\a'], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac3(0xffffffffffffffff, 0x0, 0x0) 10.40517953s ago: executing program 0 (id=486): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NET_DM_CMD_STOP(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r1, 0x1, 0x70bd2b, 0x25dfdbfe, {}, ["", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x20000000) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000001c0)={'wpan3\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000200)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r2, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x1}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x1}]}, 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x5) (async) r5 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000640)={0x0, &(0x7f0000000340)=[@nested_vmresume={0x130, 0x18, 0x1}, @nested_amd_invlpga={0x17d, 0x20, {0xb000, 0xe46e}}, @out_dx={0x6a, 0x28, {0x807c, 0x4, 0x5}}, @enable_nested={0x12c, 0x18}, @set_irq_handler={0xc8, 0x20, {0xf5, 0x2}}, @uexit={0x0, 0x18, 0x7}, @nested_create_vm={0x12d, 0x18, 0x2}, @nested_amd_stgi={0x17e, 0x10}, @nested_amd_clgi={0x17f, 0x10}, @nested_vmlaunch={0x12f, 0x18}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @guest16=0x802, 0xc, 0x7ff, 0x9}}, @code={0xa, 0x4e, {"2e67640fc7ae00300000f30fc7700e66f20f78e800deb9000b00000f32f24289c966baa100b000ee66b8e5000f00d84220551246da392667f04783023e"}}, @nested_create_vm={0x12d, 0x18, 0xfffffffffffffffe}, @wr_drn={0x68, 0x20, {0x2, 0x5}}, @cpuid={0x64, 0x18, {0xff, 0x101}}, @nested_amd_stgi={0x17e, 0x10}, @rdmsr={0x66, 0x18, {0xb8f}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x1, @host64=0x2c04, 0x5, 0x80000000, 0x1000}}, @in_dx={0x69, 0x20, {0xe06b, 0x2}}, @nested_amd_stgi={0x17e, 0x10}, @in_dx={0x69, 0x20, {0x23fa, 0x4}}, @cpuid={0x64, 0x18, {0x429, 0x200}}, @wrmsr={0x65, 0x20, {0x638, 0x4}}, @wr_drn={0x68, 0x20, {0x0, 0xfffffffffffffffa}}, @nested_vmresume={0x130, 0x18, 0x2}], 0x2f6}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000680)={[0xffffffffffffffff, 0x4, 0xfffffffffffffffc, 0x401, 0x2, 0x44, 0x7, 0xffffffffffffffff, 0x0, 0x4, 0x0, 0x80000000, 0x3, 0x4, 0xf8, 0x10001], 0x1, 0xc0410}) (async) sendmsg$NL802154_CMD_GET_SEC_LEVEL(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x2c, r2, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0x0) (async) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_UNCONFIRMED(r6, &(0x7f0000000900)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x14, 0x7, 0x1, 0x5, 0x0, 0x0, {0x0, 0x0, 0x6}, ["", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x40) (async) listen(r6, 0x3) r7 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000940)='cpu.stat\x00', 0x0, 0x0) (async, rerun: 32) r8 = syz_genetlink_get_family_id$gtp(&(0x7f00000009c0), r5) (rerun: 32) sendmsg$GTP_CMD_GETPDP(r7, &(0x7f0000000a80)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000a40)={&(0x7f0000000a00)={0x40, r8, 0x100, 0x70bd26, 0x25dfdbfe, {}, [@GTPA_FLOW={0x6}, @GTPA_I_TEI={0x8}, @GTPA_FAMILY={0x5, 0xd, 0x1a}, @GTPA_PEER_ADDR6={0x14, 0xb, @dev={0xfe, 0x80, '\x00', 0x3c}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4001}, 0x24040815) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000ac0)={'wlan0\x00'}) (async) sendmsg$NFQNL_MSG_CONFIG(r7, &(0x7f0000000bc0)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000b80)={&(0x7f0000000b40)={0x34, 0x2, 0x3, 0x101, 0x0, 0x0, {0x2, 0x0, 0x8}, [@NFQA_CFG_PARAMS={0x9, 0x2, {0x3}}, @NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x1e}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x2}}]}, 0x34}, 0x1, 0x0, 0x0, 0x4040000}, 0x40000) write$bt_hci(r7, &(0x7f0000000c00)={0x1, @write_sc_support={{0xc7a, 0x1}, {0x43}}}, 0x5) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000c80), r7) sendmsg$NL80211_CMD_JOIN_OCB(r7, &(0x7f0000000d80)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000cc0)={0x54, r9, 0x4, 0x70bd29, 0x25dfdbfd, {{}, {@void, @void}}, [@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x162}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x1}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x64bf}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x16e9}, @NL80211_ATTR_CHANNEL_WIDTH={0x8}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x27}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x21}, @NL80211_ATTR_WIPHY_FREQ={0x8}]}, 0x54}, 0x1, 0x0, 0x0, 0x8004}, 0x4000000) r10 = syz_kvm_setup_syzos_vm$x86(r7, &(0x7f0000bfe000/0x400000)=nil) syz_kvm_add_vcpu$x86(r10, &(0x7f0000001240)={0x0, &(0x7f0000000dc0)=[@wrmsr={0x65, 0x20, {0x51c}}, @nested_amd_set_intercept={0x181, 0x30, {0x1, 0x0, 0x1}}, @wrmsr={0x65, 0x20, {0x65e, 0x5}}, @rdmsr={0x66, 0x18, {0x5f5}}, @nested_amd_vmsave={0x183, 0x18, 0x1}, @nested_load_code={0x12e, 0x89, {0x1, "0fc7730066ba210066b8001066ef2e66430f3881750066baa000edc744240009000000c744240221000000c7442406000000000f011424440f017ccd4366ba420066b8927b66efc744240004000000c744240200200000c7442406000000000f011c2436470f2287c4a17b108300800000"}}, @wr_drn={0x68, 0x20, {0x4, 0x7}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @host_nat=0x6c00, 0x2, 0x6, 0x1}}, @out_dx={0x6a, 0x28, {0xea2, 0x6, 0x1}}, @set_irq_handler={0xc8, 0x20, {0xca, 0x1}}, @nested_amd_vmsave={0x183, 0x18, 0x1}, @wr_crn={0x67, 0x20, {0x0, 0xa}}, @wr_drn={0x68, 0x20, {0x7, 0x87a}}, @in_dx={0x69, 0x20, {0xc90c, 0x7}}, @nested_amd_invlpga={0x17d, 0x20, {0x200000, 0x5e72}}, @in_dx={0x69, 0x20, {0xe218, 0x6}}, @enable_nested={0x12c, 0x18}, @nested_vmlaunch={0x12f, 0x18, 0x1}, @nested_amd_vmload={0x182, 0x18, 0x3}, @nested_amd_vmsave={0x183, 0x18, 0x3}, @nested_load_code={0x12e, 0x4f, {0x3, "f20f10eac4e170141f26400f09410f01c30f0766ba200066ed45decf64470f01c50f20d835080000000f22d86736f20f38f0bb64430000"}}, @nested_amd_stgi={0x17e, 0x10}, @nested_vmlaunch={0x12f, 0x18, 0x3}, @out_dx={0x6a, 0x28, {0x4e3d, 0x1, 0x3c}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x3, @ro64=0x2401, 0x4}}, @nested_amd_inject_event={0x180, 0x38, {0x2, 0xd4, 0x7, 0x4, 0x2}}, @nested_amd_stgi={0x17e, 0x10}, @nested_vmlaunch={0x12f, 0x18, 0x3}, @out_dx={0x6a, 0x28, {0xeb51, 0x4, 0xf89}}, @rdmsr={0x66, 0x18, {0xb4a}}, @nested_amd_clgi={0x17f, 0x10}], 0x468}) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000012c0)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_KEY(r0, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x2c, r2, 0x2e, 0x70bd2a, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r11}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x44000}, 0x8001) (async, rerun: 64) ioctl$UBLK_U_CMD_START_DEV(r7, 0xc0207506, &(0x7f00000013c0)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) (rerun: 64) prlimit64(r12, 0x7, 0x0, &(0x7f0000001440)) (async, rerun: 32) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r7, 0xc0189373, &(0x7f0000001480)={{0x1, 0x1, 0x18, r6, {0xffffffff}}, './file0\x00'}) (rerun: 32) ioctl$USBDEVFS_GET_CAPABILITIES(r13, 0x8004551a, &(0x7f00000014c0)) (async, rerun: 32) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000001500)=0x6, 0x4) (rerun: 32) 9.629573836s ago: executing program 0 (id=494): openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracing\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./tracing/uprobe_events\x00', 0x401, 0x0) write(r0, &(0x7f0000000300)='p:-est/event1 ./file0:0x0 _rg2=%bx', 0x22) 9.353647385s ago: executing program 0 (id=497): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000040)={'netpci0\x00', &(0x7f00000001c0)=@ethtool_per_queue_op={0x4b, 0x10, [0x5, 0x2, 0x9, 0xb588, 0x5, 0x7fffffff, 0x3, 0x7, 0x7, 0x80000000, 0x200, 0x9, 0x4, 0xd24, 0x7, 0x4002, 0x0, 0x99, 0x15b, 0x5, 0x0, 0x9, 0x9, 0x7, 0x9, 0x800, 0x6, 0xfa2, 0x0, 0x7, 0x40, 0x3fffffff, 0xd, 0x6, 0x2f0, 0x1, 0x7ff, 0x9, 0x7, 0xc6432d, 0x7, 0x4, 0x4, 0x3ff, 0xf, 0x17ff, 0x8, 0xfffff67e, 0x4, 0x6, 0xffffffff, 0x6, 0x6, 0x3bc9, 0x7ff, 0x7, 0x80000000, 0x0, 0x1fd, 0x1ff, 0x8, 0x7ff, 0x6, 0x7, 0x3ca6, 0x5, 0x40, 0x0, 0x0, 0x6, 0x9, 0x10000, 0x4, 0x7, 0xdba3, 0x5, 0x0, 0xf, 0x8, 0x1, 0x31c, 0xd, 0x9, 0x80000000, 0x6, 0x2, 0xffff4ff8, 0xa29, 0x2, 0xb0, 0x1, 0xecc4, 0x8, 0x2559, 0x8000, 0xb647, 0xffffff80, 0x0, 0x9, 0x2, 0x8, 0x3, 0x80000, 0x6, 0xd4, 0x80000000, 0x2, 0x800, 0x8000, 0x9, 0x87, 0x1, 0x400, 0x9, 0x7, 0x73e1, 0x0, 0x3, 0x6, 0x80000005, 0x7, 0x3, 0x401, 0x100, 0x0, 0xc, 0x0, 0x80000000]}}) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f00000001c0)={0x48, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r3 = socket$inet(0x2, 0x1, 0x6) bind$inet(r3, &(0x7f0000000000)={0x2, 0x801, @loopback}, 0x10) listen(r3, 0x5) setsockopt$inet_buf(r3, 0x0, 0x0, &(0x7f0000000300)="800001000000000000000001", 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':\x00'/18, &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000100), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="616464723d2c706f72743d323034392c6d6f756e74706f72743d32308c442ba1e855d544ec34392c70726b2a9040f5fcfc2b612445b0fed144706f746f3d7463702c6d6f756e7470726f746f3d7463702c6e6f6c6f636b2c74696d656f"]) r4 = accept$inet(r3, 0x0, 0x0) read(r4, &(0x7f0000000100), 0x4) read(r4, &(0x7f0000000304), 0x4) write(r4, &(0x7f0000000300), 0x100) r5 = socket$vsock_stream(0x28, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000400)={'wg2\x00', 0x100}) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r6, 0xffffffffffffffff, 0x0) bind$bt_l2cap(r2, &(0x7f0000002080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r2, 0x112, 0xf, &(0x7f0000000080)=0x4, 0x4) r7 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010029bd7000ffdbdf250100000006000600234e000014000200776730"], 0x30}}, 0x800) 8.396030361s ago: executing program 0 (id=505): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracing\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./tracing/uprobe_events\x00', 0x401, 0x0) write(r1, &(0x7f0000000300)='p:_est/event1 ./file0:0x0 _rg2=%bx', 0x22) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r3, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x4, r2, 0x0, 0x0, 0x400000fff, 0x0, 0x2}]) io_cancel(r3, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x7, 0x2, r0, &(0x7f00000001c0)="ef1c0a84afffcc12fb453bb35a33347e536782f7fab80ba6ef107481af7276a26a4f4272dcb6edd9ab86cbfe00f503a5f9ca53bfc54696b270b5c12caa155c287036b469aceeb39dad5ace5a20cad2f402cabd86602334dee783b02712ff26a54176b65a9dc40cae5dae678b36d787b6de42963e084bc34442c82042008061ac2bad30f53abcdb8a4821034dda5aa1219b75a76e83260e33c96aef2656d4849124933b48c06be703edd5fbb4e716abc84daa43afa2211bbb", 0xb8, 0x8}, &(0x7f00000002c0)) 8.16521139s ago: executing program 0 (id=506): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000000000000000000400000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x443b3af723a8488e) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a64000000060a0b0400000041000000000200000038000480340001800b0001007461726765740000240002800c0001004e465155455545000a000300000000100000000008000240000000030900010073797a30000000000900020073797a32"], 0x8c}}, 0x0) 7.886410687s ago: executing program 0 (id=507): madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x12) (async) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) (async, rerun: 64) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dir\x00', 0x1ff) (rerun: 64) mount(0x0, &(0x7f0000000040)='./dir\x00', &(0x7f0000000080)='cifs\x00', 0x0, &(0x7f00000000c0)='vers=2.0,sec=none,ip=127.0.0.1,port=20000,nodfs,username=root,password=root\x00') setsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000100)=0x63, 0x2) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010c001ddf8208c007121522300000000109021b0001000000010904010001faf48d00090582"], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x1000000) ioctl$XFS_IOC_ERROR_INJECTION(r1, 0x8028c003, 0x0) (async) syz_open_dev$sg(&(0x7f00000002c0), 0x0, 0x40) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async) rmdir(&(0x7f0000000140)='./sys\x00') (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000003b00010322bc7022fddbdf2508000000344c678dcf58a5139ce8bf41d31fc1669361d2fe6d3e59bddb44a0f672e7a25c7ef578f47f1f422717ea22a00aa66f9e62fbf88b7586627c34cbf861af1b7fe87812032784835acd8514f5488459bd18507013330a0543e6d1e53135201fa392257341eeef0336e8cd4d5590f3fb50319dad94213bfce3e4fc14b7aea7f3ce5fba6f87d9ba15eb154edc89aaf05c858859ecbb4947d1c8f307a2cb18f9e8f48588c0b5918efbe13bb178de0994c38eebb8961fb51c5a03c67f3a3031973b1ee9525912fe2b1b7e3bc9eff0bc62108d196eeb231e5494cdaae28eeee52df591074cf95fbdc315172478ce541f6a8f88986e7835118d9353b9393fb4e1ae3de73326c4500d1c1f41bef21b133a34f4b5a4b1"], 0x14}, 0x1, 0x0, 0x0, 0x4008}, 0x4000000) (async, rerun: 64) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) (async, rerun: 64) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) (async, rerun: 64) r4 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) sendmsg$nl_generic(r4, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001480)=ANY=[@ANYBLOB="200000001000010700000000000000000a0000000c0002006e6c3830323131"], 0x20}}, 0x0) (async) recvmmsg(r4, &(0x7f0000005ec0)=[{{0x0, 0x0, &(0x7f00000026c0)=[{&(0x7f0000000040)=""/4111, 0x100f}, {&(0x7f0000003a00)=""/4088, 0xff8}, {&(0x7f00000014c0)=""/4113, 0x1011}], 0x3}, 0x3}], 0x1, 0x40010100, 0x0) (async, rerun: 64) write$tun(r3, &(0x7f0000000340)=ANY=[], 0x141) (async, rerun: 64) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r3, 0x0) (async) r5 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) setsockopt$llc_int(r5, 0x10c, 0x4, &(0x7f0000000040)=0xffffffff, 0x4) r6 = openat(r3, &(0x7f0000000080)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0) write(r6, &(0x7f0000000400)='wusb3801 0x', 0xb) capset(&(0x7f0000000c00)={0x20080522}, &(0x7f0000000280)={0x0, 0x3, 0x7, 0x0, 0x10040, 0x8f}) openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x400000, 0x1ee) (async) r7 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x80, 0x2, 0x301}, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r8, r9, r10, &(0x7f0000000180)=@IORING_OP_FUTEX_WAIT={0x33, 0x0, 0x0, 0x86, 0x57, 0x0, 0x0, 0x0, 0x3}) (async) syz_ublk_add_dev(r7, r8, r9, r10, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x68ba, 0x0, 0x0, 0x10}}}, 0x0) 7.729974615s ago: executing program 34 (id=507): madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x12) (async) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) (async, rerun: 64) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dir\x00', 0x1ff) (rerun: 64) mount(0x0, &(0x7f0000000040)='./dir\x00', &(0x7f0000000080)='cifs\x00', 0x0, &(0x7f00000000c0)='vers=2.0,sec=none,ip=127.0.0.1,port=20000,nodfs,username=root,password=root\x00') setsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000100)=0x63, 0x2) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010c001ddf8208c007121522300000000109021b0001000000010904010001faf48d00090582"], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x1000000) ioctl$XFS_IOC_ERROR_INJECTION(r1, 0x8028c003, 0x0) (async) syz_open_dev$sg(&(0x7f00000002c0), 0x0, 0x40) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async) rmdir(&(0x7f0000000140)='./sys\x00') (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000003b00010322bc7022fddbdf2508000000344c678dcf58a5139ce8bf41d31fc1669361d2fe6d3e59bddb44a0f672e7a25c7ef578f47f1f422717ea22a00aa66f9e62fbf88b7586627c34cbf861af1b7fe87812032784835acd8514f5488459bd18507013330a0543e6d1e53135201fa392257341eeef0336e8cd4d5590f3fb50319dad94213bfce3e4fc14b7aea7f3ce5fba6f87d9ba15eb154edc89aaf05c858859ecbb4947d1c8f307a2cb18f9e8f48588c0b5918efbe13bb178de0994c38eebb8961fb51c5a03c67f3a3031973b1ee9525912fe2b1b7e3bc9eff0bc62108d196eeb231e5494cdaae28eeee52df591074cf95fbdc315172478ce541f6a8f88986e7835118d9353b9393fb4e1ae3de73326c4500d1c1f41bef21b133a34f4b5a4b1"], 0x14}, 0x1, 0x0, 0x0, 0x4008}, 0x4000000) (async, rerun: 64) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) (async, rerun: 64) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) (async, rerun: 64) r4 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) sendmsg$nl_generic(r4, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001480)=ANY=[@ANYBLOB="200000001000010700000000000000000a0000000c0002006e6c3830323131"], 0x20}}, 0x0) (async) recvmmsg(r4, &(0x7f0000005ec0)=[{{0x0, 0x0, &(0x7f00000026c0)=[{&(0x7f0000000040)=""/4111, 0x100f}, {&(0x7f0000003a00)=""/4088, 0xff8}, {&(0x7f00000014c0)=""/4113, 0x1011}], 0x3}, 0x3}], 0x1, 0x40010100, 0x0) (async, rerun: 64) write$tun(r3, &(0x7f0000000340)=ANY=[], 0x141) (async, rerun: 64) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r3, 0x0) (async) r5 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) setsockopt$llc_int(r5, 0x10c, 0x4, &(0x7f0000000040)=0xffffffff, 0x4) r6 = openat(r3, &(0x7f0000000080)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0) write(r6, &(0x7f0000000400)='wusb3801 0x', 0xb) capset(&(0x7f0000000c00)={0x20080522}, &(0x7f0000000280)={0x0, 0x3, 0x7, 0x0, 0x10040, 0x8f}) openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x400000, 0x1ee) (async) r7 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x80, 0x2, 0x301}, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r8, r9, r10, &(0x7f0000000180)=@IORING_OP_FUTEX_WAIT={0x33, 0x0, 0x0, 0x86, 0x57, 0x0, 0x0, 0x0, 0x3}) (async) syz_ublk_add_dev(r7, r8, r9, r10, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x68ba, 0x0, 0x0, 0x10}}}, 0x0) 3.974575451s ago: executing program 2 (id=526): r0 = socket$netlink(0x10, 0x3, 0x0) sendto(r0, &(0x7f00000000c0)="68000000300005050100000000000000000000005400018050003f80090001006761746500000000400002801800020000000000000000000000000000000000000000001800058014000180080003000000000008000500640000000c000700e803ffe40000eeff", 0x68, 0x0, 0x0, 0x0) 3.865021509s ago: executing program 2 (id=527): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a50000000060a0b0400000000000000000100000124000680200001800700010063740000140002800800024000000025080001400000e90d0900010073797a30000000000900020073797a32"], 0x78}, 0x1, 0x0, 0x20}, 0x0) 3.731250029s ago: executing program 2 (id=528): socketpair$unix(0x1, 0x1, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) io_setup(0x1, &(0x7f0000000200)=0x0) io_submit(r1, 0x1, &(0x7f0000000400)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x2, 0xfd0, r0, 0x0, 0x0, 0x80000001, 0x0, 0x1}]) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="7000000002060500000000000000000000000000120003006269746d61703a69702c6d6163000000050004000000000009000200f3797a3000000000240007800c0002800800014000008e020c0001800800014000000000080008400000001005000500020000000500010006"], 0x70}}, 0x0) syz_usb_connect$hid(0x2, 0x0, 0x0, 0x0) timer_create(0x2, &(0x7f0000533fa0)={0x0, 0x21}, &(0x7f00000001c0)) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) r6 = socket$inet(0x2, 0x3, 0x33) ioctl$PTP_EXTTS_REQUEST2(0xffffffffffffffff, 0xc0603d06, &(0x7f0000000000)={0x6, 0xb}) getsockopt$inet_mreqsrc(r6, 0x0, 0x53, &(0x7f0000000000)={@dev, @local, @broadcast}, &(0x7f00000002c0)=0xc) shutdown(r5, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) r8 = socket$inet_sctp(0x2, 0x5, 0x84) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r9, 0x84, 0x6f, &(0x7f0000000300)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e20, @private=0xa010103}]}, &(0x7f0000000380)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r9, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp_SCTP_RTOINFO(r8, 0x84, 0x0, &(0x7f0000000000)={r10, 0x40, 0x8, 0x1}, &(0x7f0000000100)=0x10) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r5, 0x84, 0x7b, &(0x7f0000000180)={r10, 0x6}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r5, 0x84, 0x7a, &(0x7f0000000340)={r7, @in={{0x2, 0x4e24, @remote}}}, &(0x7f0000000040)=0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000002180)={0x0, @in={{0x2, 0x4e23, @empty}}, 0x0, 0x2002, 0x40000002, 0x4, 0xa17433da3c5d6980, 0x2, 0x81}, 0x9c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000004c0)={0x0, @in={{0x2, 0x4e22, @empty}}, 0xfffffff8, 0x40, 0xc, 0xffffffbb, 0x40, 0x1, 0x1}, &(0x7f00000003c0)=0x9c) r11 = signalfd4(0xffffffffffffffff, &(0x7f0000000300)={[0xfffffffffffffff2]}, 0x8, 0x80800) ppoll(&(0x7f0000000000)=[{r11, 0xa419}], 0x1, 0x0, 0x0, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[], 0x70}}, 0x0) 2.6746011s ago: executing program 5 (id=533): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=ANY=[@ANYBLOB="fc0000001900010000000000000000007f0000010000000000000000000000000000000000000000000000000000000100000008000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000fcffffffffffffff00000000000000000000000000000000ffffffffffffffff08000000000000000000000000000000000000da84669c00000a000000000000000000000080400002000000000000080000000000000000000000000000000044000500ac1414aa000000000000000000000000000000003c"], 0xfc}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000140)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f00000016c0)=ANY=[@ANYBLOB="110086dd0000110000000000000060ec970000382c00fe8000000000080000000000000000aaff02000000000000000000000000000104"], 0xfdef) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) 2.453949556s ago: executing program 5 (id=534): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc_mnt\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc_mnt/config.gz\x00', 0x0, 0x0) r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000356ffc)=0xffffffffffffff40, 0x4) setuid(0xee01) bind$inet(r0, &(0x7f0000e15000)={0x2, 0x4e20, @empty}, 0x10) r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000356ffc)=0xffffffffffffff40, 0x4) bind$inet(r1, &(0x7f0000e15000)={0x2, 0x4e20, @empty}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r3, 0x84009422, &(0x7f0000000080)={0x0, 0x0, {0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct}}) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SCAUSEDIAG(r4, 0x89ec, 0x0) ioctl$KDSKBENT(r2, 0x80045440, &(0x7f0000000000)={0x79, 0x0, 0x27f}) 2.350911571s ago: executing program 5 (id=535): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="5c00000013006bcd9e3fe3dc6e48aa310b6b8703110000fd1f03000000000000040014000d000a000d0000009ee517d34460bc24eab556a705251e6182949a3651f60a84d0f5d1938037e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x4014) 2.325642269s ago: executing program 5 (id=536): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$BTRFS_IOC_BALANCE_V2(r0, 0xc4009420, &(0x7f0000000140)={0xa2d38e8a5578eac5, 0x0, {0x6, @usage=0x6, 0x0, 0xfffffffffffffffd, 0x8000000000000001, 0x6, 0x8, 0x3, 0x51, @struct={0x3, 0x9}, 0x2, 0x3, [0x9, 0x80000000, 0x3, 0xffff, 0x9953, 0x3]}, {0x2, @usage=0x5, 0x0, 0x7, 0x80, 0xa, 0xffffffffffffff71, 0x0, 0x433, @struct={0x4, 0x3ff}, 0xdf, 0xd16, [0x3, 0x0, 0x3, 0x5, 0x8, 0x8]}, {0x96, @struct={0x6, 0x4}, 0x0, 0x3, 0x8, 0x1, 0x5, 0x6, 0x51, @usage=0x1, 0x5, 0x3, [0x9, 0xcfe, 0x9, 0x2, 0x100000000]}, {0x4, 0x0, 0x7fffffffffffffff}}) r2 = socket$inet(0x2, 0x2, 0x0) shutdown(r2, 0x0) recvmmsg(r2, &(0x7f00000066c0), 0xa0d, 0x0, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000540)={r1, 0x1f800000000, 0x1ff, 0x1}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b1a, &(0x7f0000000100)={'wlan0\x00'}) 2.219949583s ago: executing program 6 (id=508): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x8, &(0x7f0000000080)=0x7) prctl$PR_SET_SECUREBITS(0x1c, 0x4) pipe(0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c000280050001000000000008000740000000"], 0x64}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="5c00000000010104000000000000000002001000240002801400018008000100e000000108000200e00000010c00028005000100000000001c001080", @ANYRES64=r4], 0x5c}, 0x1, 0x0, 0x2f, 0x4000}, 0x4000) 2.151291284s ago: executing program 5 (id=537): setresuid(0xee01, 0x0, 0x0) (async) setresuid(0xee01, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc_dir\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc_dir\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc_dir/acpi/wakeup\x00', 0x2, 0x0) (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc_dir/acpi/wakeup\x00', 0x2, 0x0) write$binfmt_script(r0, 0x0, 0xfffffe9c) (async) write$binfmt_script(r0, 0x0, 0xfffffe9c) syz_clone3(&(0x7f00000002c0)={0x180002b00, &(0x7f0000000000), &(0x7f0000000080)=0x0, &(0x7f00000000c0), {0x15}, &(0x7f0000000100)=""/245, 0xf5, &(0x7f0000000200)=""/119, &(0x7f0000000280)=[0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0], 0x9}, 0x58) prlimit64(r1, 0x6, &(0x7f0000000040)={0x6, 0x6}, 0x0) setrlimit(0x7, &(0x7f00000003c0)={0x8000000000000001, 0x40}) syz_clone3(&(0x7f0000000340)={0x801400, &(0x7f0000000040), 0x0, 0x0, {0x19}, 0x0, 0x0, 0x0, 0x0}, 0x40) 1.167422274s ago: executing program 6 (id=538): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000080)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000140000000000000200000008000300", @ANYRES32=r3, @ANYBLOB="0c009985f2330fd547793c000800a0003a0900080500390104000000080026"], 0x40}, 0x1, 0x17, 0x0, 0x844}, 0x0) 1.040917321s ago: executing program 3 (id=539): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000003f0007012bbd700000000000027c0088dd76e2800c00018006", @ANYRES32, @ANYRES16], 0x30}, 0x1, 0x900, 0x0, 0x48895}, 0xc020) 919.386792ms ago: executing program 5 (id=540): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) writev(r0, &(0x7f0000000200)=[{&(0x7f0000000080)="503bfde51b257f40", 0x8}], 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_VM_DISABLE_NX_HUGE_PAGES(r2, 0x4068aea3, &(0x7f0000000040)={0xc4}) syz_usb_connect(0x1, 0x32, &(0x7f0000000000)=ANY=[], 0x0) 919.129633ms ago: executing program 3 (id=541): socket$nl_route(0x10, 0x3, 0x0) socket$rds(0x15, 0x5, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="c40000001900674c2cbd70000000000000000000000000000000000000000000ac1eff0100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0100000000000000000000000000000000000020000000000000000000000000000000000000000000008000000000000000000000000000fcffffffffffffff0000000000000000b0ac00000000000000000000000000000000000000000000000400000000000000000002000000000a00100001"], 0xc4}}, 0x4c050) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000280)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="034886dd010000008100140000006000000003082f00fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) 683.208666ms ago: executing program 3 (id=542): r0 = fsopen(&(0x7f00000002c0)='ntfs3\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000140)='source\x00', &(0x7f0000000180)='127.0.0.1:/export\x00', 0x0) 607.437098ms ago: executing program 3 (id=543): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) openat2$dir(0xffffffffffffff9c, 0x0, &(0x7f0000000080)={0x2240, 0x20, 0x3a}, 0x18) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000001980)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="090b000000000000000005"], 0x1c}, 0x1, 0x0, 0x0, 0x4080}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) getpid() (async) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) (async) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCSETAW(r2, 0x5407, &(0x7f0000000040)={0x80, 0x2, 0x5, 0x828e, 0x3}) (async) ioctl$TIOCMSET(r2, 0x5418, &(0x7f0000000000)=0x8001) (async) openat$ttyS3(0xffffff9c, &(0x7f0000000280), 0x1a9140, 0x0) 523.265858ms ago: executing program 2 (id=544): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010029bd7000ffdbdf250100000006000600234e000014000200776730"], 0x30}}, 0x800) 469.184349ms ago: executing program 2 (id=545): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000100)=ANY=[@ANYBLOB="14000000100001f5ffffffffffffff000000000a20001b00000a01010000000000000000050000080900010073797a30000000005c000000030a03000000000000000000050000000900010073797a30000000000900030073797a300000000008000a4000000003280004800800024000000012080001"], 0xa4}}, 0x0) 333.819266ms ago: executing program 2 (id=546): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x200a}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) syz_usb_connect(0x3, 0x36, &(0x7f0000000880)=ANY=[@ANYBLOB="120110010c793020570bd7e67832010203010902240001040510f20904a90602030102050905ee0f"], 0x0) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0x4c, 0x0, &(0x7f0000000540)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000680)={@flat=@weak_binder={0x77622a85, 0xb, 0x3}, @flat, @fda={0x66646185, 0x4, 0x1, 0x12}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000880)="4a8e464b3d4657499ea54e5c7d563ff8776074ae642a55558dbfd1df9462b1259816b613ea02f9c5a2a4cc3bf701b7f4fa887e4ce6d2045a432a7b060f115097ae0e0e07f3f3704a688c03fccef3e273"}) 114.845415ms ago: executing program 3 (id=547): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan1\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r0, &(0x7f0000003700)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)={0x4c, r2, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6, 0x66, 0x88c7}, @NL80211_ATTR_FRAME={0x1c, 0x33, @data_frame={@msdu=@type10={{}, {}, @from_mac=@broadcast, @device_b}}}]}, 0x4c}, 0x1, 0x0, 0x300000000000000}, 0x800) 0s ago: executing program 3 (id=548): openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracing\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./tracing/uprobe_events\x00', 0x401, 0x0) write(r0, &(0x7f0000000300)='p:_est/event1 ./file0:0x0 _rg2=%bx', 0x22) (fail_nth: 8) kernel console output (not intermixed with test programs): __pfx_____sys_sendmsg+0x10/0x10 [ 94.935721][ T6325] ? import_iovec+0x73/0xa0 [ 94.935736][ T6325] ___sys_sendmsg+0x2a5/0x360 [ 94.935746][ T6325] ? __lock_acquire+0x747/0x2de0 [ 94.935764][ T6325] ? __pfx____sys_sendmsg+0x10/0x10 [ 94.935791][ T6325] ? __fget_files+0x2a/0x420 [ 94.935804][ T6325] ? __fget_files+0x3a2/0x420 [ 94.935821][ T6325] __x64_sys_sendmsg+0x1b1/0x290 [ 94.935834][ T6325] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 94.935858][ T6325] do_syscall_64+0x166/0x520 [ 94.935869][ T6325] ? trace_irq_disable+0x3b/0x140 [ 94.935884][ T6325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.935894][ T6325] ? clear_bhb_loop+0x70/0xc0 [ 94.935907][ T6325] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.935917][ T6325] RIP: 0033:0x7f306079e159 [ 94.935928][ T6325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.935936][ T6325] RSP: 002b:00007f306164d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 94.935948][ T6325] RAX: ffffffffffffffda RBX: 00007f3060a25fa0 RCX: 00007f306079e159 [ 94.935955][ T6325] RDX: 0000000000000800 RSI: 00002000000000c0 RDI: 0000000000000003 [ 94.935962][ T6325] RBP: 00007f306164d090 R08: 0000000000000000 R09: 0000000000000000 [ 94.935968][ T6325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 94.935974][ T6325] R13: 00007f3060a26038 R14: 00007f3060a25fa0 R15: 00007ffd47c3e678 [ 94.935990][ T6325] [ 94.950789][ T25] usb usb1-port1: attempt power cycle [ 94.981451][ T5760] usb 2-1: device descriptor read/64, error -71 [ 95.258550][ T5760] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 95.290518][ T25] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 95.310128][ T25] usb 1-1: device descriptor read/8, error -71 [ 95.373474][ T13] Bluetooth: hci4: Frame reassembly failed (-84) [ 95.398352][ T5760] usb 2-1: device descriptor read/64, error -71 [ 95.508632][ T5760] usb usb2-port1: attempt power cycle [ 95.548425][ T25] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 95.568690][ T25] usb 1-1: device descriptor read/8, error -71 [ 95.679677][ T25] usb usb1-port1: unable to enumerate USB device [ 95.878280][ T5760] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 95.898779][ T5760] usb 2-1: device descriptor read/8, error -71 [ 95.988269][ T25] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 96.138877][ T25] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 96.142162][ T25] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 96.142188][ T25] usb 4-1: Product: syz [ 96.142201][ T25] usb 4-1: Manufacturer: syz [ 96.142214][ T25] usb 4-1: SerialNumber: syz [ 96.144004][ T25] usb 4-1: config 0 descriptor?? [ 96.148503][ T5760] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 96.180445][ T5760] usb 2-1: device descriptor read/8, error -71 [ 96.288670][ T5760] usb usb2-port1: unable to enumerate USB device [ 96.346278][ T25] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 97.450072][ T5614] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 97.583378][ T6363] validate_nla: 1 callbacks suppressed [ 97.583398][ T6363] netlink: 'syz.2.184': attribute type 10 has an invalid length. [ 97.635735][ T6365] FAULT_INJECTION: forcing a failure. [ 97.635735][ T6365] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 97.635770][ T6365] CPU: 1 UID: 0 PID: 6365 Comm: syz.0.185 Tainted: G L syzkaller #0 PREEMPT(full) [ 97.635796][ T6365] Tainted: [L]=SOFTLOCKUP [ 97.635804][ T6365] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 97.635815][ T6365] Call Trace: [ 97.635823][ T6365] [ 97.635832][ T6365] dump_stack_lvl+0xe8/0x150 [ 97.635863][ T6365] should_fail_ex+0x3eb/0x540 [ 97.635890][ T6365] _copy_from_user+0x2d/0xb0 [ 97.635916][ T6365] trace_parse_run_command+0xb8/0x380 [ 97.635945][ T6365] ? __pfx_create_or_delete_trace_uprobe+0x10/0x10 [ 97.635977][ T6365] ? __pfx_probes_write+0x10/0x10 [ 97.636004][ T6365] vfs_write+0x296/0xba0 [ 97.636040][ T6365] ? __pfx_vfs_write+0x10/0x10 [ 97.636067][ T6365] ? __fget_files+0x2a/0x420 [ 97.636096][ T6365] ? __fget_files+0x3a2/0x420 [ 97.636119][ T6365] ? __fget_files+0x2a/0x420 [ 97.636152][ T6365] ksys_write+0x150/0x270 [ 97.636181][ T6365] ? __pfx_ksys_write+0x10/0x10 [ 97.636219][ T6365] do_syscall_64+0x166/0x520 [ 97.636237][ T6365] ? trace_irq_disable+0x3b/0x140 [ 97.636264][ T6365] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.636284][ T6365] ? clear_bhb_loop+0x70/0xc0 [ 97.636309][ T6365] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.636328][ T6365] RIP: 0033:0x7fbbae99e159 [ 97.636346][ T6365] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 97.636362][ T6365] RSP: 002b:00007fbbaf8ae028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 97.636384][ T6365] RAX: ffffffffffffffda RBX: 00007fbbaec25fa0 RCX: 00007fbbae99e159 [ 97.636398][ T6365] RDX: 0000000000000022 RSI: 0000200000000300 RDI: 0000000000000004 [ 97.636411][ T6365] RBP: 00007fbbaf8ae090 R08: 0000000000000000 R09: 0000000000000000 [ 97.636423][ T6365] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 97.636435][ T6365] R13: 00007fbbaec26038 R14: 00007fbbaec25fa0 R15: 00007ffeee2537c8 [ 97.636467][ T6365] [ 97.777113][ T6351] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 97.777576][ T6351] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 97.883851][ T6370] FAULT_INJECTION: forcing a failure. [ 97.883851][ T6370] name failslab, interval 1, probability 0, space 0, times 0 [ 97.883883][ T6370] CPU: 0 UID: 0 PID: 6370 Comm: syz.0.186 Tainted: G L syzkaller #0 PREEMPT(full) [ 97.883909][ T6370] Tainted: [L]=SOFTLOCKUP [ 97.883915][ T6370] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 97.883926][ T6370] Call Trace: [ 97.883933][ T6370] [ 97.883941][ T6370] dump_stack_lvl+0xe8/0x150 [ 97.883971][ T6370] should_fail_ex+0x3eb/0x540 [ 97.883998][ T6370] should_failslab+0xa8/0x100 [ 97.884023][ T6370] __kmalloc_cache_noprof+0x9e/0x600 [ 97.884061][ T6370] ? fast_dput+0x481/0x690 [ 97.884084][ T6370] ? relay_open+0x12b/0x900 [ 97.884104][ T6370] ? relay_open+0x12b/0x900 [ 97.884131][ T6370] relay_open+0x12b/0x900 [ 97.884152][ T6370] ? debugfs_create_file_full+0x3f/0x60 [ 97.884184][ T6370] blk_trace_setup_prepare+0x425/0x5a0 [ 97.884220][ T6370] blk_trace_setup+0x2f5/0x520 [ 97.884253][ T6370] ? __pfx_blk_trace_setup+0x10/0x10 [ 97.884302][ T6370] ? snprintf+0xe8/0x140 [ 97.884344][ T6370] blk_trace_ioctl+0x37f/0x910 [ 97.884366][ T6370] ? __pfx_blk_trace_ioctl+0x10/0x10 [ 97.884397][ T6370] ? kasan_quarantine_put+0xbb/0x1f0 [ 97.884433][ T6370] ? tomoyo_path_number_perm+0x219/0x5f0 [ 97.884455][ T6370] ? tomoyo_path_number_perm+0x219/0x5f0 [ 97.884477][ T6370] ? do_vfs_ioctl+0x116f/0x1530 [ 97.884498][ T6370] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 97.884527][ T6370] ? hook_file_ioctl+0x1f2/0x600 [ 97.884545][ T6370] ? call_rcu+0x64d/0x8b0 [ 97.884586][ T6370] blkdev_ioctl+0x4c1/0x740 [ 97.884613][ T6370] ? __pfx_blkdev_ioctl+0x10/0x10 [ 97.884634][ T6370] ? __fget_files+0x2a/0x420 [ 97.884662][ T6370] ? bpf_lsm_file_ioctl+0x9/0x20 [ 97.884687][ T6370] ? __pfx_blkdev_ioctl+0x10/0x10 [ 97.884708][ T6370] __se_sys_ioctl+0xfc/0x170 [ 97.884740][ T6370] do_syscall_64+0x166/0x520 [ 97.884757][ T6370] ? trace_irq_disable+0x3b/0x140 [ 97.884784][ T6370] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.884804][ T6370] ? clear_bhb_loop+0x70/0xc0 [ 97.884826][ T6370] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.884849][ T6370] RIP: 0033:0x7fbbae99e159 [ 97.884867][ T6370] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 97.884884][ T6370] RSP: 002b:00007fbbaf8ae028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 97.884905][ T6370] RAX: ffffffffffffffda RBX: 00007fbbaec25fa0 RCX: 00007fbbae99e159 [ 97.884918][ T6370] RDX: 0000200000000440 RSI: 00000000c0481273 RDI: 0000000000000003 [ 97.884930][ T6370] RBP: 00007fbbaea3503b R08: 0000000000000000 R09: 0000000000000000 [ 97.884942][ T6370] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 97.884954][ T6370] R13: 00007fbbaec26038 R14: 00007fbbaec25fa0 R15: 00007ffeee2537c8 [ 97.884985][ T6370] [ 98.043781][ T25] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 98.068366][ T25] usb 4-1: USB disconnect, device number 4 [ 98.237887][ T6378] comedi comedi1: rti802: I/O base address not correctly aligned [ 98.490540][ T6396] loop0: detected capacity change from 0 to 3904 [ 98.560678][ T6401] netlink: 'syz.2.198': attribute type 10 has an invalid length. [ 98.565416][ T6396] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 98.565446][ T6396] ldm_validate_privheads(): Disk read failed. [ 98.571726][ T6396] ldm_parse_tocblock(): TOCBLOCK's second bitmap is 'log', should be ''. [ 98.571749][ T6396] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 98.571761][ T6396] ldm_validate_tocblocks(): Disk read failed for TOCBLOCK 2. [ 98.571774][ T6396] ldm_validate_tocblocks(): Disk read failed for TOCBLOCK 3. [ 98.571797][ T6396] ldm_validate_tocblocks(): Failed to find a valid TOCBLOCK. [ 98.574281][ T6396] loop0: [ 98.574301][ T6396] loop0: partition table partially beyond EOD, truncated [ 98.608281][ T25] usb 2-1: new full-speed USB device number 17 using dummy_hcd [ 98.749735][ T25] usb 2-1: not running at top speed; connect to a high speed hub [ 98.749757][ T25] usb 2-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 98.751055][ T25] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 98.751089][ T25] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 98.762361][ T25] uvcvideo 2-1:1.0: Found UVC 1.00 device (046d:0825) [ 98.769913][ T6404] netlink: 'syz.3.199': attribute type 29 has an invalid length. [ 98.770213][ T6403] netlink: 'syz.3.199': attribute type 29 has an invalid length. [ 98.770412][ T6403] netlink: 'syz.3.199': attribute type 29 has an invalid length. [ 98.770618][ T6403] netlink: 'syz.3.199': attribute type 29 has an invalid length. [ 98.770911][ T6403] netlink: 'syz.3.199': attribute type 29 has an invalid length. [ 98.771262][ T6403] netlink: 'syz.3.199': attribute type 29 has an invalid length. [ 98.771609][ T6403] netlink: 'syz.3.199': attribute type 29 has an invalid length. [ 98.772779][ T6403] netlink: 'syz.3.199': attribute type 29 has an invalid length. [ 98.828291][ T5697] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 98.948836][ T5697] usb 1-1: device descriptor read/64, error -71 [ 99.162307][ T25] uvcvideo 2-1:1.0: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 99.163131][ T25] uvcvideo 2-1:1.1: No frame descriptor found for the default format. [ 99.163149][ T25] uvcvideo 2-1:1.1: Failed to initialize the device (-22). [ 99.164155][ T25] uvcvideo 2-1:1.0: probe with driver uvcvideo failed with error -22 [ 99.204718][ T5697] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 99.329967][ T5697] usb 1-1: device descriptor read/64, error -71 [ 99.942666][ T6420] netlink: 8 bytes leftover after parsing attributes in process `syz.2.206'. [ 100.288188][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 100.392554][ T5697] usb usb1-port1: attempt power cycle [ 100.432961][ T1221] usb 2-1: USB disconnect, device number 17 [ 100.728848][ T5697] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 100.764045][ T5697] usb 1-1: device descriptor read/8, error -71 [ 100.818549][ T942] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 100.826960][ T6426] CacheFiles: Failed to register: -95 [ 100.916557][ T6428] rust_binder: 6427:6428 error while translating object: EINVAL [ 100.916611][ T6428] rust_binder: Failure in copy_transaction_data: EINVAL [ 100.916626][ T6428] rust_binder: 6427:6428 transaction call to 6427:0 failed EINVAL, code 0 size 72-24 [ 100.916969][ T1221] rust_binder: 6427: undelivered TRANSACTION_ERROR: 29201 [ 100.979187][ T942] usb 4-1: Using ep0 maxpacket: 16 [ 100.979953][ T942] usb 4-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 100.980915][ T942] usb 4-1: config 0 has an invalid interface number: 34 but max is 0 [ 100.980937][ T942] usb 4-1: config 0 has no interface number 0 [ 100.980974][ T942] usb 4-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 100.980998][ T942] usb 4-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 100.982911][ T942] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 100.982934][ T942] usb 4-1: Product: syz [ 100.982948][ T942] usb 4-1: Manufacturer: syz [ 100.982961][ T942] usb 4-1: SerialNumber: syz [ 100.987366][ T942] usb 4-1: config 0 descriptor?? [ 100.988070][ T6424] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 100.989077][ T6424] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 100.998271][ T5697] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 101.020033][ T5697] usb 1-1: device descriptor read/8, error -71 [ 101.128641][ T5697] usb usb1-port1: unable to enumerate USB device [ 101.187498][ T6438] netlink: 40 bytes leftover after parsing attributes in process `syz.1.214'. [ 101.222878][ T6424] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 101.223010][ T6424] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 101.473298][ T4984] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 101.473326][ T4984] ldm_validate_privheads(): Disk read failed. [ 101.474939][ T4984] ldm_parse_tocblock(): TOCBLOCK's second bitmap is 'log', should be ''. [ 101.474962][ T4984] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 101.474972][ T4984] ldm_validate_tocblocks(): Disk read failed for TOCBLOCK 2. [ 101.474985][ T4984] ldm_validate_tocblocks(): Disk read failed for TOCBLOCK 3. [ 101.474997][ T4984] ldm_validate_tocblocks(): Failed to find a valid TOCBLOCK. [ 101.475062][ T4984] loop0: [ 101.475079][ T4984] loop0: partition table partially beyond EOD, truncated [ 101.639869][ T6451] netlink: 84 bytes leftover after parsing attributes in process `syz.2.220'. [ 101.650277][ T942] asix 4-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 101.650304][ T942] asix 4-1:0.34 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffb9 [ 101.650747][ T942] asix 4-1:0.34: probe with driver asix failed with error -71 [ 101.677546][ T942] usb 4-1: USB disconnect, device number 5 [ 101.687701][ T5697] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 101.787313][ T6453] syz.0.221: vmalloc error: size 18446744073699066186, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 101.787985][ T6453] CPU: 0 UID: 0 PID: 6453 Comm: syz.0.221 Tainted: G L syzkaller #0 PREEMPT(full) [ 101.788014][ T6453] Tainted: [L]=SOFTLOCKUP [ 101.788022][ T6453] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 101.788035][ T6453] Call Trace: [ 101.788043][ T6453] [ 101.788052][ T6453] dump_stack_lvl+0xe8/0x150 [ 101.788084][ T6453] warn_alloc+0x24d/0x270 [ 101.788113][ T6453] ? tomoyo_path_number_perm+0x4ba/0x5f0 [ 101.788135][ T6453] ? security_file_ioctl+0xc3/0x2a0 [ 101.788166][ T6453] ? __UNIQUE_ID_modinfo_13796+0x64302e6c/0xffffffffffec8d22 [ 101.788194][ T6453] ? __pfx_warn_alloc+0x10/0x10 [ 101.788250][ T6453] __vmalloc_node_range_noprof+0x12c/0x1690 [ 101.788285][ T6453] ? __mutex_trylock_common+0x15f/0x270 [ 101.788311][ T6453] ? __pfx___mutex_trylock_common+0x10/0x10 [ 101.788334][ T6453] ? __UNIQUE_ID_modinfo_13796+0x64302e6c/0xffffffffffec8d22 [ 101.788362][ T6453] ? rcu_is_watching+0x16/0xb0 [ 101.788388][ T6453] ? __mutex_lock+0x305/0x15a0 [ 101.788412][ T6453] ? tomoyo_path_number_perm+0x219/0x5f0 [ 101.788437][ T6453] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 101.788463][ T6453] ? dvb_demux_do_ioctl+0x320/0x540 [ 101.788489][ T6453] ? __pfx___mutex_lock+0x10/0x10 [ 101.788510][ T6453] ? __UNIQUE_ID_modinfo_13796+0x64302e6c/0xffffffffffec8d22 [ 101.788536][ T6453] ? dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 101.788562][ T6453] vmalloc_noprof+0xb2/0xe0 [ 101.788589][ T6453] ? dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 101.788615][ T6453] ? __UNIQUE_ID_modinfo_13796+0x64302e6c/0xffffffffffec8d22 [ 101.788641][ T6453] dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 101.788673][ T6453] dvb_demux_do_ioctl+0x45d/0x540 [ 101.788696][ T6453] ? __UNIQUE_ID_modinfo_13796+0x64302e6c/0xffffffffffec8d22 [ 101.788724][ T6453] ? __UNIQUE_ID_modinfo_13796+0x64302e6c/0xffffffffffec8d22 [ 101.788751][ T6453] dvb_usercopy+0x199/0x2e0 [ 101.788772][ T6453] ? __UNIQUE_ID_modinfo_13796+0x64302e6c/0xffffffffffec8d22 [ 101.788799][ T6453] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 101.788824][ T6453] ? __pfx_dvb_usercopy+0x10/0x10 [ 101.788857][ T6453] ? __fget_files+0x3a2/0x420 [ 101.788882][ T6453] ? __fget_files+0x2a/0x420 [ 101.788907][ T6453] ? __UNIQUE_ID_modinfo_13796+0x64302e6c/0xffffffffffec8d22 [ 101.788933][ T6453] ? __UNIQUE_ID_modinfo_13796+0x64302e6c/0xffffffffffec8d22 [ 101.788960][ T6453] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 101.788983][ T6453] ? __UNIQUE_ID_modinfo_13796+0x64302e6c/0xffffffffffec8d22 [ 101.789009][ T6453] dvb_demux_ioctl+0x29/0x40 [ 101.789034][ T6453] __se_sys_ioctl+0xfc/0x170 [ 101.789068][ T6453] do_syscall_64+0x166/0x520 [ 101.789087][ T6453] ? trace_irq_disable+0x3b/0x140 [ 101.789115][ T6453] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.789136][ T6453] ? clear_bhb_loop+0x70/0xc0 [ 101.789160][ T6453] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.789180][ T6453] RIP: 0033:0x7fbbae99e159 [ 101.789199][ T6453] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 101.789223][ T6453] RSP: 002b:00007fbbaf8ae028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 101.789245][ T6453] RAX: ffffffffffffffda RBX: 00007fbbaec25fa0 RCX: 00007fbbae99e159 [ 101.789260][ T6453] RDX: ffffffffff60014a RSI: 0000000000006f2d RDI: 0000000000000007 [ 101.789274][ T6453] RBP: 00007fbbaea3503b R08: 0000000000000000 R09: 0000000000000000 [ 101.789287][ T6453] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 101.789299][ T6453] R13: 00007fbbaec26038 R14: 00007fbbaec25fa0 R15: 00007ffeee2537c8 [ 101.789323][ T6453] ? __UNIQUE_ID_modinfo_13796+0x64302e6c/0xffffffffffec8d22 [ 101.789353][ T6453] [ 101.818475][ T6453] Mem-Info: [ 101.818491][ T6453] active_anon:5518 inactive_anon:13 isolated_anon:0 [ 101.818491][ T6453] active_file:117 inactive_file:54927 isolated_file:0 [ 101.818491][ T6453] unevictable:0 dirty:3 writeback:0 [ 101.818491][ T6453] slab_reclaimable:7694 slab_unreclaimable:88825 [ 101.818491][ T6453] mapped:24677 shmem:563 pagetables:1096 [ 101.818491][ T6453] sec_pagetables:0 bounce:0 [ 101.818491][ T6453] kernel_misc_reclaimable:0 [ 101.818491][ T6453] free:1328092 free_pcp:23736 free_cma:0 [ 101.818549][ T6453] Node 0 active_anon:22072kB inactive_anon:52kB active_file:468kB inactive_file:219508kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:98708kB dirty:12kB writeback:0kB shmem:2252kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:11552kB pagetables:4264kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 101.818616][ T6453] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:120kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 101.818667][ T6453] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 101.818725][ T6453] lowmem_reserve[]: 0 2482 2483 2483 2483 [ 101.818761][ T6453] Node 0 DMA32 free:1352428kB boost:0kB min:34092kB low:42612kB high:51132kB reserved_highatomic:0kB free_highatomic:0kB active_anon:22072kB inactive_anon:52kB active_file:468kB inactive_file:219508kB unevictable:0kB writepending:12kB zspages:592kB present:3129332kB managed:2541832kB mlocked:0kB bounce:0kB free_pcp:94944kB local_pcp:38368kB free_cma:0kB [ 101.818820][ T6453] lowmem_reserve[]: 0 0 1 1 1 [ 101.818854][ T6453] Node 0 Normal free:0kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1692kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 101.818907][ T6453] lowmem_reserve[]: 0 0 0 0 0 [ 101.818940][ T6453] Node 1 Normal free:3944580kB boost:0kB min:55784kB low:69728kB high:83672kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 101.818996][ T6453] lowmem_reserve[]: 0 0 0 0 0 [ 101.819029][ T6453] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 101.819177][ T6453] Node 0 DMA32: 1031*4kB (UM) 894*8kB (UME) 417*16kB (UME) 186*32kB (UME) 162*64kB (UME) 110*128kB (UME) 30*256kB (ME) 8*512kB (M) 0*1024kB 3*2048kB (ME) 314*4096kB (M) = 1352412kB [ 101.819329][ T6453] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 101.819419][ T6453] Node 1 Normal: 3*4kB (UM) 5*8kB (UM) 7*16kB (UM) 5*32kB (UM) 5*64kB (UM) 2*128kB (UM) 5*256kB (UM) 2*512kB (M) 1*1024kB (M) 2*2048kB (U) 961*4096kB (M) = 3944580kB [ 101.819571][ T6453] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 101.819587][ T6453] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 101.819603][ T6453] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 101.819618][ T6453] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 101.819633][ T6453] 55578 total pagecache pages [ 101.819662][ T6453] 0 pages in swap cache [ 101.819669][ T6453] Free swap = 124752kB [ 101.819677][ T6453] Total swap = 124996kB [ 101.819685][ T6453] 2097051 pages RAM [ 101.819692][ T6453] 0 pages HighMem/MovableOnly [ 101.819699][ T6453] 429554 pages reserved [ 101.819706][ T6453] 0 pages cma reserved [ 101.911342][ T5697] usb 2-1: New USB device found, idVendor=044f, idProduct=b324, bcdDevice= 0.00 [ 101.962150][ T5697] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 101.962179][ T5697] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 101.962200][ T5697] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 101.962239][ T5697] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.287464][ T5697] usb 2-1: config 0 descriptor?? [ 102.687129][ T6471] validate_nla: 4 callbacks suppressed [ 102.687149][ T6471] netlink: 'syz.2.228': attribute type 10 has an invalid length. [ 102.735321][ T6473] netlink: 'syz.0.229': attribute type 4 has an invalid length. [ 102.752389][ T6473] netlink: 'syz.0.229': attribute type 4 has an invalid length. [ 103.091201][ T5697] thrustmaster 0003:044F:B324.0002: hidraw0: USB HID v0.00 Device [HID 044f:b324] on usb-dummy_hcd.1-1/input0 [ 103.128307][ T5760] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 103.258611][ T5760] usb 1-1: device descriptor read/64, error -71 [ 103.337924][ T6498] netlink: 'syz.3.233': attribute type 10 has an invalid length. [ 103.337948][ T6498] netlink: 40 bytes leftover after parsing attributes in process `syz.3.233'. [ 103.387651][ T6446] kvm [6445]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x9d00 [ 103.387827][ T6446] kvm [6445]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0x9d00 [ 103.435541][ T5697] usb 2-1: USB disconnect, device number 18 [ 103.508367][ T5760] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 103.638592][ T5760] usb 1-1: device descriptor read/64, error -71 [ 103.749132][ T5760] usb usb1-port1: attempt power cycle [ 103.786630][ T6522] netlink: 12 bytes leftover after parsing attributes in process `syz.3.236'. [ 103.900101][ T1221] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 103.921943][ T6526] netlink: 12 bytes leftover after parsing attributes in process `syz.3.237'. [ 103.923742][ T6526] openvswitch: netlink: Message has 4 unknown bytes. [ 104.048606][ T1221] usb 3-1: Using ep0 maxpacket: 8 [ 104.050650][ T1221] usb 3-1: unable to get BOS descriptor or descriptor too short [ 104.050695][ T1221] usb 3-1: New USB device found, idVendor=17cc, idProduct=1000, bcdDevice= 0.40 [ 104.052197][ T1221] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 128, changing to 7 [ 104.055738][ T1221] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 104.055761][ T1221] usb 3-1: Product: syz [ 104.055774][ T1221] usb 3-1: Manufacturer: syz [ 104.055787][ T1221] usb 3-1: SerialNumber: syz [ 104.110978][ T5760] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 104.138924][ T5760] usb 1-1: device descriptor read/8, error -71 [ 104.218545][ T942] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 104.327213][ T1221] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 104.333267][ T1221] snd-usb-audio 3-1:1.1: probe with driver snd-usb-audio failed with error -71 [ 104.345105][ T1221] snd-usb-audio 3-1:1.2: probe with driver snd-usb-audio failed with error -71 [ 104.360561][ T6539] wireguard: wg0: Could not create IPv4 socket [ 104.362164][ T1221] usb 3-1: USB disconnect, device number 5 [ 104.382458][ T942] usb 4-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 1.00 [ 104.385272][ T942] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 104.385973][ T5760] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 104.387211][ T942] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 104.387235][ T942] usb 4-1: Product: syz [ 104.387249][ T942] usb 4-1: Manufacturer: syz [ 104.439406][ T5760] usb 1-1: device descriptor read/8, error -71 [ 104.474855][ T6541] overlayfs: upper fs does not support file handles, falling back to index=off. [ 104.528790][ T6543] FAULT_INJECTION: forcing a failure. [ 104.528790][ T6543] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 104.528818][ T6543] CPU: 0 UID: 0 PID: 6543 Comm: syz.1.241 Tainted: G L syzkaller #0 PREEMPT(full) [ 104.528843][ T6543] Tainted: [L]=SOFTLOCKUP [ 104.528850][ T6543] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 104.528860][ T6543] Call Trace: [ 104.528867][ T6543] [ 104.528874][ T6543] dump_stack_lvl+0xe8/0x150 [ 104.528907][ T6543] should_fail_ex+0x3eb/0x540 [ 104.528923][ T6543] _copy_from_iter+0x1d3/0x1660 [ 104.528936][ T6543] ? __alloc_skb+0x27a/0x7a0 [ 104.528947][ T6543] ? __alloc_skb+0x27a/0x7a0 [ 104.528958][ T6543] ? __alloc_skb+0x27a/0x7a0 [ 104.528967][ T6543] ? __pfx__copy_from_iter+0x10/0x10 [ 104.528978][ T6543] ? kmem_cache_alloc_node_noprof+0x1f4/0x600 [ 104.528999][ T6543] ? __alloc_skb+0x27a/0x7a0 [ 104.529007][ T6543] ? __alloc_skb+0x27a/0x7a0 [ 104.529019][ T6543] ? netlink_sendmsg+0x5fa/0xae0 [ 104.529032][ T6543] ? skb_put+0x112/0x210 [ 104.529044][ T6543] netlink_sendmsg+0x667/0xae0 [ 104.529059][ T6543] ? __pfx_netlink_sendmsg+0x10/0x10 [ 104.529076][ T6543] ? apparmor_socket_sendmsg+0x98/0x360 [ 104.529088][ T6543] ? __pfx_netlink_sendmsg+0x10/0x10 [ 104.529101][ T6543] sock_sendmsg_nosec+0x13a/0x180 [ 104.529117][ T6543] ____sys_sendmsg+0x54e/0x850 [ 104.529130][ T6543] ? __pfx_____sys_sendmsg+0x10/0x10 [ 104.529146][ T6543] ? import_iovec+0x73/0xa0 [ 104.529163][ T6543] ___sys_sendmsg+0x2a5/0x360 [ 104.529173][ T6543] ? __lock_acquire+0x747/0x2de0 [ 104.529191][ T6543] ? __pfx____sys_sendmsg+0x10/0x10 [ 104.529218][ T6543] ? __fget_files+0x2a/0x420 [ 104.529231][ T6543] ? __fget_files+0x3a2/0x420 [ 104.529248][ T6543] __x64_sys_sendmsg+0x1b1/0x290 [ 104.529261][ T6543] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 104.529282][ T6543] do_syscall_64+0x166/0x520 [ 104.529292][ T6543] ? trace_irq_disable+0x3b/0x140 [ 104.529307][ T6543] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.529318][ T6543] ? clear_bhb_loop+0x70/0xc0 [ 104.529330][ T6543] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.529341][ T6543] RIP: 0033:0x7f2748b9e159 [ 104.529351][ T6543] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 104.529360][ T6543] RSP: 002b:00007f2749a46028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 104.529372][ T6543] RAX: ffffffffffffffda RBX: 00007f2748e25fa0 RCX: 00007f2748b9e159 [ 104.529380][ T6543] RDX: 0000000000000800 RSI: 00002000000000c0 RDI: 0000000000000003 [ 104.529387][ T6543] RBP: 00007f2749a46090 R08: 0000000000000000 R09: 0000000000000000 [ 104.529393][ T6543] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 104.529399][ T6543] R13: 00007f2748e26038 R14: 00007f2748e25fa0 R15: 00007ffdd6109448 [ 104.529414][ T6543] [ 104.566079][ T5760] usb usb1-port1: unable to enumerate USB device [ 104.593913][ T6545] netlink: 'syz.1.242': attribute type 10 has an invalid length. [ 104.662882][ T942] usb 4-1: selecting invalid altsetting 1 [ 104.662904][ T942] speedtch 4-1:1.0: speedtch_bind: setting interface to 1 failed (-22)! [ 104.662964][ T942] speedtch 4-1:1.0: usbatm_usb_probe: bind failed: -22! [ 104.663018][ T942] speedtch 4-1:1.0: probe with driver speedtch failed with error -22 [ 104.670366][ T942] usb 4-1: selecting invalid altsetting 1 [ 104.670386][ T942] speedtch 4-1:1.1: speedtch_bind: setting interface to 1 failed (-22)! [ 104.671414][ T942] speedtch 4-1:1.1: usbatm_usb_probe: bind failed: -22! [ 104.671462][ T942] speedtch 4-1:1.1: probe with driver speedtch failed with error -22 [ 104.675320][ T942] usb 4-1: USB disconnect, device number 6 [ 105.651546][ T5760] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 105.776732][ T270] Bluetooth: hci4: Frame reassembly failed (-84) [ 105.777497][ T270] Bluetooth: hci4: Frame reassembly failed (-84) [ 105.777572][ T270] Bluetooth: hci4: Frame reassembly failed (-84) [ 105.777637][ T270] Bluetooth: hci4: Frame reassembly failed (-84) [ 105.777730][ T3800] Bluetooth: hci4: Frame reassembly failed (-84) [ 105.777914][ T6580] netlink: 'syz.3.252': attribute type 27 has an invalid length. [ 105.798694][ T5760] usb 2-1: Using ep0 maxpacket: 16 [ 105.803615][ T5760] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 105.804895][ T5760] usb 2-1: config 1 interface 0 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 64 [ 105.804921][ T5760] usb 2-1: config 1 interface 0 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 32 [ 105.804942][ T5760] usb 2-1: config 1 interface 0 has no altsetting 0 [ 105.809783][ T5760] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 105.809805][ T5760] usb 2-1: Product: syz [ 105.809818][ T5760] usb 2-1: Manufacturer: 忤ä㑋ꦮ奻ыížë› è†®èºéˆªà®¾ë¡¢ã‡—襦ॳከ孽㜽啀ì‚Ϛ嘳璚츓ﰄြ嗋猷⢥抎孺ä…烆㦆賓럢涢䪦â®å‡¹ê‚ ä¹ä¤‚㲥んᰬ헙鋦å•ì†Šë˜ä’‹ê´®îŠ‰çž´ [ 105.809839][ T5760] usb 2-1: SerialNumber: syz [ 105.825391][ T5760] usb 2-1: rejected 1 configuration due to insufficient available bus power [ 105.825440][ T5760] usb 2-1: no configuration chosen from 1 choice [ 105.992144][ T6583] netlink: 'syz.2.253': attribute type 10 has an invalid length. [ 106.100234][ T6589] FAULT_INJECTION: forcing a failure. [ 106.100234][ T6589] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 106.100255][ T6589] CPU: 0 UID: 0 PID: 6589 Comm: syz.0.256 Tainted: G L syzkaller #0 PREEMPT(full) [ 106.100270][ T6589] Tainted: [L]=SOFTLOCKUP [ 106.100274][ T6589] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 106.100280][ T6589] Call Trace: [ 106.100285][ T6589] [ 106.100289][ T6589] dump_stack_lvl+0xe8/0x150 [ 106.100310][ T6589] should_fail_ex+0x3eb/0x540 [ 106.100327][ T6589] _copy_from_user+0x2d/0xb0 [ 106.100341][ T6589] trace_parse_run_command+0xb8/0x380 [ 106.100357][ T6589] ? __pfx_create_or_delete_trace_uprobe+0x10/0x10 [ 106.100375][ T6589] ? __pfx_probes_write+0x10/0x10 [ 106.100389][ T6589] vfs_write+0x296/0xba0 [ 106.100409][ T6589] ? __pfx_vfs_write+0x10/0x10 [ 106.100423][ T6589] ? __fget_files+0x2a/0x420 [ 106.100439][ T6589] ? __fget_files+0x3a2/0x420 [ 106.100451][ T6589] ? __fget_files+0x2a/0x420 [ 106.100467][ T6589] ksys_write+0x150/0x270 [ 106.100482][ T6589] ? __pfx_ksys_write+0x10/0x10 [ 106.100501][ T6589] do_syscall_64+0x166/0x520 [ 106.100512][ T6589] ? trace_irq_disable+0x3b/0x140 [ 106.100526][ T6589] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.100537][ T6589] ? clear_bhb_loop+0x70/0xc0 [ 106.100550][ T6589] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.100567][ T6589] RIP: 0033:0x7fbbae99e159 [ 106.100577][ T6589] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 106.100586][ T6589] RSP: 002b:00007fbbaf8ae028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 106.100598][ T6589] RAX: ffffffffffffffda RBX: 00007fbbaec25fa0 RCX: 00007fbbae99e159 [ 106.100606][ T6589] RDX: 0000000000000022 RSI: 0000200000000300 RDI: 0000000000000004 [ 106.100612][ T6589] RBP: 00007fbbaf8ae090 R08: 0000000000000000 R09: 0000000000000000 [ 106.100619][ T6589] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 106.100625][ T6589] R13: 00007fbbaec26038 R14: 00007fbbaec25fa0 R15: 00007ffeee2537c8 [ 106.100641][ T6589] [ 106.312447][ T6591] Invalid source name [ 106.602083][ T6600] loop8: detected capacity change from 0 to 8 [ 106.607437][ T6600] Dev loop8: unable to read RDB block 8 [ 106.607480][ T6600] loop8: unable to read partition table [ 106.607683][ T6600] loop8: partition table beyond EOD, truncated [ 106.611157][ T6600] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 107.761991][ T6623] netlink: 'syz.0.268': attribute type 10 has an invalid length. [ 107.839495][ T5625] Bluetooth: hci4: command 0x1003 tx timeout [ 107.840352][ T5614] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 108.542881][ T6640] netlink: 8 bytes leftover after parsing attributes in process `syz.3.274'. [ 109.164171][ T5697] usb 2-1: USB disconnect, device number 19 [ 109.352212][ T6650] EXT4-fs warning (device sda1): verify_group_input:137: Cannot add at group 0 (only 8 groups) [ 109.463625][ T6655] rust_binder: 6652:6655 error while translating object: EINVAL [ 109.463712][ T6655] rust_binder: Failure in copy_transaction_data: EINVAL [ 109.463739][ T6655] rust_binder: 6652:6655 transaction call to 6652:0 failed EINVAL, code 0 size 72-24 [ 109.464132][ T1221] rust_binder: 6652: undelivered TRANSACTION_ERROR: 29201 [ 109.810613][ T6669] process 'syz.1.282' launched './file0' with NULL argv: empty string added [ 109.933203][ T6674] netlink: 'syz.0.283': attribute type 10 has an invalid length. [ 109.933225][ T6674] netlink: 40 bytes leftover after parsing attributes in process `syz.0.283'. [ 109.933302][ T6674] team0: entered promiscuous mode [ 109.933318][ T6674] team_slave_0: entered promiscuous mode [ 109.933515][ T6674] team_slave_1: entered promiscuous mode [ 109.933680][ T6674] team0: entered allmulticast mode [ 109.933693][ T6674] team_slave_0: entered allmulticast mode [ 109.933707][ T6674] team_slave_1: entered allmulticast mode [ 109.934475][ T6674] bridge0: port 3(team0) entered blocking state [ 109.939908][ T6678] netlink: NAT attribute has 4 unknown bytes [ 109.939937][ T6678] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 109.940220][ T6674] bridge0: port 3(team0) entered disabled state [ 109.943376][ T6674] bridge0: port 3(team0) entered blocking state [ 109.943513][ T6674] bridge0: port 3(team0) entered forwarding state [ 110.035396][ T6679] capability: warning: `syz.1.285' uses 32-bit capabilities (legacy support in use) [ 110.057637][ T6681] netlink: 'syz.0.286': attribute type 10 has an invalid length. [ 110.182920][ T5760] logitech-hidpp-device 0003:046D:C082.0003: hidraw0: USB HID v0.00 Device [syz0] on syz0 [ 110.256605][ T6690] device-mapper: ioctl: device name cannot be "control", ".", or ".." [ 110.289425][ T6687] fido_id[6687]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 110.416289][ T6696] netlink: 'syz.1.293': attribute type 6 has an invalid length. [ 110.581272][ T6708] netlink: 'syz.1.297': attribute type 4 has an invalid length. [ 110.588040][ T6708] netlink: 'syz.1.297': attribute type 4 has an invalid length. [ 110.698262][ T5350] usb 4-1: new full-speed USB device number 7 using dummy_hcd [ 110.854203][ T5350] usb 4-1: New USB device found, idVendor=0df6, idProduct=0056, bcdDevice=d2.4b [ 110.855189][ T6720] netlink: 'syz.1.302': attribute type 10 has an invalid length. [ 110.855207][ T6720] netlink: 40 bytes leftover after parsing attributes in process `syz.1.302'. [ 110.861000][ T5350] usb 4-1: config 127 has an invalid descriptor of length 0, skipping remainder of the config [ 110.861022][ T5350] usb 4-1: config 127 has 0 interfaces, different from the descriptor's value: 1 [ 110.867423][ T5350] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 110.867454][ T5350] usb 4-1: Product: syz [ 110.867468][ T5350] usb 4-1: Manufacturer: syz [ 110.867481][ T5350] usb 4-1: SerialNumber: syz [ 110.982315][ T6724] netlink: 20 bytes leftover after parsing attributes in process `syz.2.304'. [ 110.982616][ T6725] netlink: 20 bytes leftover after parsing attributes in process `syz.2.304'. [ 110.995002][ T6727] netlink: 12 bytes leftover after parsing attributes in process `syz.1.305'. [ 111.074453][ T6732] netlink: 'syz.1.307': attribute type 10 has an invalid length. [ 111.107513][ T31] audit: type=1326 audit(1789186059.357:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6723 comm="syz.2.304" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f306079e159 code=0x0 [ 111.218556][ T6737] No control pipe specified [ 111.508297][ T942] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 111.605049][ T6741] wireguard: wg0: Could not create IPv4 socket [ 111.636358][ T6743] FAULT_INJECTION: forcing a failure. [ 111.636358][ T6743] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 111.636382][ T6743] CPU: 1 UID: 0 PID: 6743 Comm: syz.1.310 Tainted: G L syzkaller #0 PREEMPT(full) [ 111.636415][ T6743] Tainted: [L]=SOFTLOCKUP [ 111.636422][ T6743] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 111.636432][ T6743] Call Trace: [ 111.636440][ T6743] [ 111.636447][ T6743] dump_stack_lvl+0xe8/0x150 [ 111.636470][ T6743] should_fail_ex+0x3eb/0x540 [ 111.636486][ T6743] _copy_from_iter+0x1d3/0x1660 [ 111.636498][ T6743] ? __alloc_skb+0x27a/0x7a0 [ 111.636509][ T6743] ? __alloc_skb+0x27a/0x7a0 [ 111.636520][ T6743] ? __alloc_skb+0x27a/0x7a0 [ 111.636529][ T6743] ? __pfx__copy_from_iter+0x10/0x10 [ 111.636540][ T6743] ? kmem_cache_alloc_node_noprof+0x1f4/0x600 [ 111.636555][ T6743] ? __alloc_skb+0x27a/0x7a0 [ 111.636563][ T6743] ? __alloc_skb+0x27a/0x7a0 [ 111.636575][ T6743] ? netlink_sendmsg+0x5fa/0xae0 [ 111.636589][ T6743] ? skb_put+0x112/0x210 [ 111.636600][ T6743] netlink_sendmsg+0x667/0xae0 [ 111.636616][ T6743] ? __pfx_netlink_sendmsg+0x10/0x10 [ 111.636634][ T6743] ? apparmor_socket_sendmsg+0x98/0x360 [ 111.636654][ T6743] ? __pfx_netlink_sendmsg+0x10/0x10 [ 111.636679][ T6743] sock_sendmsg_nosec+0x13a/0x180 [ 111.636706][ T6743] ____sys_sendmsg+0x54e/0x850 [ 111.636729][ T6743] ? __pfx_____sys_sendmsg+0x10/0x10 [ 111.636745][ T6743] ? import_iovec+0x73/0xa0 [ 111.636759][ T6743] ___sys_sendmsg+0x2a5/0x360 [ 111.636770][ T6743] ? __lock_acquire+0x747/0x2de0 [ 111.636787][ T6743] ? __pfx____sys_sendmsg+0x10/0x10 [ 111.636814][ T6743] ? __fget_files+0x2a/0x420 [ 111.636827][ T6743] ? __fget_files+0x3a2/0x420 [ 111.636844][ T6743] __x64_sys_sendmsg+0x1b1/0x290 [ 111.636857][ T6743] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 111.636878][ T6743] do_syscall_64+0x166/0x520 [ 111.636888][ T6743] ? trace_irq_disable+0x3b/0x140 [ 111.636909][ T6743] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.636924][ T6743] ? clear_bhb_loop+0x70/0xc0 [ 111.636937][ T6743] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.636947][ T6743] RIP: 0033:0x7f2748b9e159 [ 111.636958][ T6743] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 111.636966][ T6743] RSP: 002b:00007f2749a46028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 111.636979][ T6743] RAX: ffffffffffffffda RBX: 00007f2748e25fa0 RCX: 00007f2748b9e159 [ 111.636986][ T6743] RDX: 0000000000000800 RSI: 00002000000000c0 RDI: 0000000000000003 [ 111.636993][ T6743] RBP: 00007f2749a46090 R08: 0000000000000000 R09: 0000000000000000 [ 111.636999][ T6743] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 111.637005][ T6743] R13: 00007f2748e26038 R14: 00007f2748e25fa0 R15: 00007ffdd6109448 [ 111.637021][ T6743] [ 111.660283][ T942] usb 1-1: New USB device found, idVendor=17cc, idProduct=1969, bcdDevice= 1.00 [ 111.661223][ T942] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 111.661271][ T942] usb 1-1: config 1 interface 0 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 111.661313][ T942] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 112.088762][ C0] usb 1-1: received EP1 urb->status = -2 [ 112.088812][ T942] usb 1-1: unable to init card! (ret=-110) [ 112.089109][ T942] snd-usb-caiaq 1-1:1.0: probe with driver snd-usb-caiaq failed with error -110 [ 112.208325][ T5760] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 112.358971][ T5760] usb 2-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 112.360210][ T5760] usb 2-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 112.360263][ T5760] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 112.376697][ T5760] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 112.929286][ T6762] capability: warning: `syz.1.312' uses deprecated v2 capabilities in a way that may be insecure [ 113.573766][ T5350] usb 4-1: USB disconnect, device number 7 [ 113.948559][ T5760] gspca_stv0680: usb_control_msg error 0, request = 0x88, error = -110 [ 113.948589][ T5760] stv0680 2-1:4.0: STV(e): camera ping failed!! [ 113.948951][ T5760] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -32 [ 113.948969][ T5760] stv0680 2-1:4.0: last error: 0, command = 0x0 [ 114.049125][ T6771] netlink: 'syz.3.317': attribute type 10 has an invalid length. [ 114.231738][ T5760] usb 1-1: USB disconnect, device number 20 [ 114.287262][ T6774] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 114.287682][ T6774] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 114.588275][ T5760] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 114.740346][ T5760] usb 1-1: New USB device found, idVendor=0cf2, idProduct=6250, bcdDevice= 0.00 [ 114.743554][ T5760] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 114.743582][ T5760] usb 1-1: Product: syz [ 114.743596][ T5760] usb 1-1: Manufacturer: syz [ 114.743610][ T5760] usb 1-1: SerialNumber: syz [ 114.783502][ T5760] ums_eneub6250 1-1:1.0: USB Mass Storage device detected [ 114.806622][ T5760] scsi host1: usb-storage 1-1:1.0 [ 114.833147][ T6790] FAULT_INJECTION: forcing a failure. [ 114.833147][ T6790] name failslab, interval 1, probability 0, space 0, times 0 [ 114.833184][ T6790] CPU: 1 UID: 0 PID: 6790 Comm: syz.3.322 Tainted: G L syzkaller #0 PREEMPT(full) [ 114.833209][ T6790] Tainted: [L]=SOFTLOCKUP [ 114.833215][ T6790] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 114.833222][ T6790] Call Trace: [ 114.833227][ T6790] [ 114.833232][ T6790] dump_stack_lvl+0xe8/0x150 [ 114.833261][ T6790] should_fail_ex+0x3eb/0x540 [ 114.833280][ T6790] should_failslab+0xa8/0x100 [ 114.833304][ T6790] __kmalloc_noprof+0xf9/0x710 [ 114.833332][ T6790] ? argv_split+0x18d/0x400 [ 114.833358][ T6790] ? argv_split+0x18d/0x400 [ 114.833380][ T6790] argv_split+0x18d/0x400 [ 114.833396][ T6790] ? __pfx___trace_uprobe_create+0x10/0x10 [ 114.833413][ T6790] trace_probe_create+0x94/0x130 [ 114.833430][ T6790] ? __pfx_trace_probe_create+0x10/0x10 [ 114.833461][ T6790] ? __might_fault+0xaf/0x130 [ 114.833487][ T6790] dyn_event_create+0x59/0x80 [ 114.833508][ T6790] create_or_delete_trace_uprobe+0x65/0xa0 [ 114.833528][ T6790] trace_parse_run_command+0x1f3/0x380 [ 114.833543][ T6790] ? __pfx_create_or_delete_trace_uprobe+0x10/0x10 [ 114.833559][ T6790] ? __pfx_probes_write+0x10/0x10 [ 114.833573][ T6790] vfs_write+0x296/0xba0 [ 114.833607][ T6790] ? __pfx_vfs_write+0x10/0x10 [ 114.833634][ T6790] ? __fget_files+0x2a/0x420 [ 114.833661][ T6790] ? __fget_files+0x3a2/0x420 [ 114.833682][ T6790] ? __fget_files+0x2a/0x420 [ 114.833714][ T6790] ksys_write+0x150/0x270 [ 114.833742][ T6790] ? __pfx_ksys_write+0x10/0x10 [ 114.833787][ T6790] do_syscall_64+0x166/0x520 [ 114.833806][ T6790] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.833819][ T6790] ? clear_bhb_loop+0x70/0xc0 [ 114.833832][ T6790] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.833842][ T6790] RIP: 0033:0x7f453579e159 [ 114.833858][ T6790] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 114.833866][ T6790] RSP: 002b:00007f45365c5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 114.833890][ T6790] RAX: ffffffffffffffda RBX: 00007f4535a25fa0 RCX: 00007f453579e159 [ 114.833904][ T6790] RDX: 0000000000000022 RSI: 0000200000000300 RDI: 0000000000000004 [ 114.833917][ T6790] RBP: 00007f45365c5090 R08: 0000000000000000 R09: 0000000000000000 [ 114.833929][ T6790] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 114.833941][ T6790] R13: 00007f4535a26038 R14: 00007f4535a25fa0 R15: 00007ffc83d75258 [ 114.833968][ T6790] [ 115.236287][ T5759] usb 2-1: USB disconnect, device number 20 [ 115.307657][ T6801] netlink: 'syz.2.327': attribute type 10 has an invalid length. [ 115.419699][ T5350] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 115.548307][ T5350] usb 4-1: device descriptor read/64, error -71 [ 115.596421][ T1221] usb 1-1: USB disconnect, device number 21 [ 115.660650][ T13] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 115.803827][ T5350] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 115.859195][ T5625] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 115.860570][ T13] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 115.863300][ T5625] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 115.864194][ T5625] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 115.865638][ T5625] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 115.866233][ T5625] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 115.978547][ T5350] usb 4-1: device descriptor read/64, error -71 [ 116.015361][ T13] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 116.073320][ T13] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 116.089143][ T5350] usb usb4-port1: attempt power cycle [ 116.159075][ T5759] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 116.289133][ T5759] usb 3-1: device descriptor read/64, error -71 [ 116.316418][ T13] bridge0: port 3(team0) entered disabled state [ 116.328112][ T13] bridge_slave_1: left allmulticast mode [ 116.331203][ T13] bridge_slave_1: left promiscuous mode [ 116.331538][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 116.347775][ T13] bridge_slave_0: left allmulticast mode [ 116.347797][ T13] bridge_slave_0: left promiscuous mode [ 116.347983][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 116.439780][ T5350] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 116.462876][ T5350] usb 4-1: device descriptor read/8, error -71 [ 116.494077][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 116.496665][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 116.499190][ T13] bond0 (unregistering): (slave batadv0): Releasing backup interface [ 116.510542][ T13] bond0 (unregistering): Released all slaves [ 116.528239][ T5759] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 116.658774][ T5759] usb 3-1: device descriptor read/64, error -71 [ 116.708909][ T5350] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 116.730856][ T5350] usb 4-1: device descriptor read/8, error -71 [ 116.770165][ T5759] usb usb3-port1: attempt power cycle [ 116.838708][ T5350] usb usb4-port1: unable to enumerate USB device [ 116.902648][ T13] hsr_slave_0: left promiscuous mode [ 116.903485][ T13] hsr_slave_1: left promiscuous mode [ 116.904481][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 116.904514][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 116.906239][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 116.906257][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 116.962465][ T13] veth1_macvtap: left promiscuous mode [ 116.962526][ T13] veth0_macvtap: left promiscuous mode [ 116.962683][ T13] veth1_vlan: left promiscuous mode [ 116.962773][ T13] veth0_vlan: left promiscuous mode [ 117.114128][ T5759] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 117.143524][ T5759] usb 3-1: device descriptor read/8, error -71 [ 117.224298][ T83] Bluetooth: hci4: Frame reassembly failed (-84) [ 117.224390][ T83] Bluetooth: hci4: Frame reassembly failed (-84) [ 117.224449][ T83] Bluetooth: hci4: Frame reassembly failed (-84) [ 117.224520][ T83] Bluetooth: hci4: Frame reassembly failed (-84) [ 117.224581][ T83] Bluetooth: hci4: Frame reassembly failed (-84) [ 117.346617][ T13] team_slave_1 (unregistering): left promiscuous mode [ 117.346645][ T13] team_slave_1 (unregistering): left allmulticast mode [ 117.347631][ T13] team0 (unregistering): Port device team_slave_1 removed [ 117.368989][ T13] team_slave_0 (unregistering): left promiscuous mode [ 117.369013][ T13] team_slave_0 (unregistering): left allmulticast mode [ 117.372333][ T13] team0 (unregistering): Port device team_slave_0 removed [ 117.386019][ T5759] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 117.408949][ T5759] usb 3-1: device descriptor read/8, error -71 [ 117.494948][ T5279] 8021q: adding VLAN 0 to HW filter on device eth1 [ 117.519091][ T5759] usb usb3-port1: unable to enumerate USB device [ 117.632192][ T6805] bridge0: port 1(bridge_slave_0) entered blocking state [ 117.632355][ T6805] bridge0: port 1(bridge_slave_0) entered disabled state [ 117.632496][ T6805] bridge_slave_0: entered allmulticast mode [ 117.634556][ T6805] bridge_slave_0: entered promiscuous mode [ 117.663763][ T6805] bridge0: port 2(bridge_slave_1) entered blocking state [ 117.663859][ T6805] bridge0: port 2(bridge_slave_1) entered disabled state [ 117.664040][ T6805] bridge_slave_1: entered allmulticast mode [ 117.665731][ T6805] bridge_slave_1: entered promiscuous mode [ 117.728770][ T6805] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 117.732135][ T6805] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 117.773786][ T6805] team0: Port device team_slave_0 added [ 117.781589][ T6805] team0: Port device team_slave_1 added [ 117.827959][ T6805] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 117.827977][ T6805] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 117.828001][ T6805] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 117.830179][ T6805] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 117.830193][ T6805] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 117.830217][ T6805] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 117.881977][ T6805] hsr_slave_0: entered promiscuous mode [ 117.882958][ T6805] hsr_slave_1: entered promiscuous mode [ 117.884498][ T6805] debugfs: 'hsr0' already exists in 'hsr' [ 117.884516][ T6805] Cannot create hsr debugfs directory [ 117.921131][ T5614] Bluetooth: hci1: command tx timeout [ 118.134171][ T6805] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 118.138029][ T6805] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 118.140180][ T6805] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 118.161520][ T6805] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 118.163136][ T6805] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 118.182323][ T6805] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 118.183040][ T6805] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 118.206480][ T6805] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 118.274706][ T6805] bridge0: port 2(bridge_slave_1) entered blocking state [ 118.274828][ T6805] bridge0: port 2(bridge_slave_1) entered forwarding state [ 118.275079][ T6805] bridge0: port 1(bridge_slave_0) entered blocking state [ 118.275191][ T6805] bridge0: port 1(bridge_slave_0) entered forwarding state [ 118.380206][ T5279] 8021q: adding VLAN 0 to HW filter on device eth2 [ 118.405372][ T6805] 8021q: adding VLAN 0 to HW filter on device bond0 [ 118.423454][ T83] bridge0: port 1(bridge_slave_0) entered disabled state [ 118.424139][ T83] bridge0: port 2(bridge_slave_1) entered disabled state [ 118.448018][ T6805] 8021q: adding VLAN 0 to HW filter on device team0 [ 118.462646][ T3800] bridge0: port 1(bridge_slave_0) entered blocking state [ 118.462751][ T3800] bridge0: port 1(bridge_slave_0) entered forwarding state [ 118.469797][ T3800] bridge0: port 2(bridge_slave_1) entered blocking state [ 118.469901][ T3800] bridge0: port 2(bridge_slave_1) entered forwarding state [ 118.560993][ T1221] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 118.698354][ T1221] usb 4-1: device descriptor read/64, error -71 [ 118.949182][ T1221] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 118.996331][ T6805] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 119.074225][ T5279] 8021q: adding VLAN 0 to HW filter on device eth3 [ 119.078310][ T1221] usb 4-1: device descriptor read/64, error -71 [ 119.188536][ T1221] usb usb4-port1: attempt power cycle [ 119.261159][ T6902] netdevsim netdevsim2: Direct firmware load for .® failed with error -2 [ 119.261194][ T6902] netdevsim netdevsim2: Falling back to sysfs fallback for: .® [ 119.286914][ T5614] Bluetooth: hci4: command 0x1003 tx timeout [ 119.287722][ T5625] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 119.426233][ T6910] netlink: 'syz.0.338': attribute type 10 has an invalid length. [ 119.492629][ T6805] veth0_vlan: entered promiscuous mode [ 119.505962][ T6805] veth1_vlan: entered promiscuous mode [ 119.539318][ T1221] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 119.560389][ T1221] usb 4-1: device descriptor read/8, error -71 [ 119.566109][ T6805] veth0_macvtap: entered promiscuous mode [ 119.580744][ T6805] veth1_macvtap: entered promiscuous mode [ 119.601678][ T6805] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 119.616185][ T6805] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 119.648474][ T3800] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.648527][ T3800] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.648560][ T3800] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.648591][ T3800] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.747873][ T3800] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 119.747895][ T3800] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 119.805544][ T1110] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 119.805565][ T1110] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 119.808354][ T1221] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 119.844453][ T1221] usb 4-1: device descriptor read/8, error -71 [ 119.914169][ T5279] 8021q: adding VLAN 0 to HW filter on device eth4 [ 119.960288][ T1221] usb usb4-port1: unable to enumerate USB device [ 120.000084][ T5625] Bluetooth: hci1: command tx timeout [ 120.533344][ T6927] netlink: 8 bytes leftover after parsing attributes in process `syz.0.339'. [ 121.273960][ T6933] rust_binder: 6932:6933 error while translating object: EINVAL [ 121.274043][ T6933] rust_binder: Failure in copy_transaction_data: EINVAL [ 121.274067][ T6933] rust_binder: 6932:6933 transaction call to 6932:0 failed EINVAL, code 0 size 72-24 [ 121.274910][ T5760] rust_binder: 6932: undelivered TRANSACTION_ERROR: 29201 [ 121.476732][ T6936] /dev/nullb0: Can't open blockdev [ 121.727710][ T6945] netlink: 'syz.3.348': attribute type 3 has an invalid length. [ 122.086542][ T5625] Bluetooth: hci1: command tx timeout [ 122.219761][ T1221] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 122.361523][ T6959] netlink: 'syz.0.340': attribute type 2 has an invalid length. [ 122.361565][ T6959] netlink: 'syz.0.340': attribute type 8 has an invalid length. [ 122.361578][ T6959] netlink: 132 bytes leftover after parsing attributes in process `syz.0.340'. [ 122.378846][ T1221] usb 3-1: Using ep0 maxpacket: 32 [ 122.379623][ T1221] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 122.380573][ T1221] usb 3-1: config 0 has an invalid interface number: 51 but max is 0 [ 122.380594][ T1221] usb 3-1: config 0 has no interface number 0 [ 122.385596][ T1221] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 122.385620][ T1221] usb 3-1: Product: syz [ 122.385634][ T1221] usb 3-1: Manufacturer: syz [ 122.385647][ T1221] usb 3-1: SerialNumber: syz [ 122.395435][ T1221] usb 3-1: config 0 descriptor?? [ 122.420561][ T1221] quatech2 3-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 122.791681][ T6967] input: syz1 as /devices/virtual/input/input5 [ 122.808491][ T5697] usb 4-1: new full-speed USB device number 16 using dummy_hcd [ 122.938314][ T5697] usb 4-1: device descriptor read/64, error -71 [ 122.962576][ T1221] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 122.976540][ T1221] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 123.188399][ T5697] usb 4-1: new full-speed USB device number 17 using dummy_hcd [ 123.234107][ T6973] netlink: 'syz.0.358': attribute type 6 has an invalid length. [ 123.330733][ T5697] usb 4-1: device descriptor read/64, error -71 [ 123.445652][ T5697] usb usb4-port1: attempt power cycle [ 123.788913][ T5697] usb 4-1: new full-speed USB device number 18 using dummy_hcd [ 123.809734][ T5697] usb 4-1: device descriptor read/8, error -71 [ 124.079879][ T5697] usb 4-1: new full-speed USB device number 19 using dummy_hcd [ 124.100468][ T5697] usb 4-1: device descriptor read/8, error -71 [ 124.159031][ T5625] Bluetooth: hci1: command tx timeout [ 124.210298][ T5697] usb usb4-port1: unable to enumerate USB device [ 124.276980][ T6979] netlink: 'syz.0.361': attribute type 4 has an invalid length. [ 124.277464][ T6979] netlink: 'syz.0.361': attribute type 4 has an invalid length. [ 124.537593][ C1] usb 3-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 124.538070][ T5697] usb 3-1: USB disconnect, device number 10 [ 124.550188][ T5697] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 124.567675][ T5697] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 124.576597][ T5697] quatech2 3-1:0.51: device disconnected [ 125.383620][ T7008] netlink: 'syz.0.368': attribute type 10 has an invalid length. [ 125.383640][ T7008] netlink: 40 bytes leftover after parsing attributes in process `syz.0.368'. [ 125.530604][ T7019] netlink: 12 bytes leftover after parsing attributes in process `syz.0.370'. [ 125.773000][ T5697] usb 3-1: new full-speed USB device number 11 using dummy_hcd [ 125.846542][ T7028] FAULT_INJECTION: forcing a failure. [ 125.846542][ T7028] name failslab, interval 1, probability 0, space 0, times 0 [ 125.846575][ T7028] CPU: 1 UID: 0 PID: 7028 Comm: syz.0.374 Tainted: G L syzkaller #0 PREEMPT(full) [ 125.846601][ T7028] Tainted: [L]=SOFTLOCKUP [ 125.846608][ T7028] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 125.846619][ T7028] Call Trace: [ 125.846638][ T7028] [ 125.846646][ T7028] dump_stack_lvl+0xe8/0x150 [ 125.846678][ T7028] should_fail_ex+0x3eb/0x540 [ 125.846704][ T7028] should_failslab+0xa8/0x100 [ 125.846725][ T7028] ? skb_clone+0x212/0x3a0 [ 125.846747][ T7028] kmem_cache_alloc_noprof+0x9c/0x600 [ 125.846776][ T7028] ? skb_clone+0x212/0x3a0 [ 125.846804][ T7028] skb_clone+0x212/0x3a0 [ 125.846829][ T7028] __netlink_deliver_tap+0x413/0x860 [ 125.846865][ T7028] ? netlink_deliver_tap+0x2e/0x1b0 [ 125.846893][ T7028] netlink_deliver_tap+0x19c/0x1b0 [ 125.846918][ T7028] netlink_unicast+0x781/0x940 [ 125.846950][ T7028] netlink_sendmsg+0x7c3/0xae0 [ 125.846980][ T7028] ? __pfx_netlink_sendmsg+0x10/0x10 [ 125.847013][ T7028] ? apparmor_socket_sendmsg+0x98/0x360 [ 125.847036][ T7028] ? __pfx_netlink_sendmsg+0x10/0x10 [ 125.847059][ T7028] sock_sendmsg_nosec+0x13a/0x180 [ 125.847088][ T7028] ____sys_sendmsg+0x54e/0x850 [ 125.847115][ T7028] ? __pfx_____sys_sendmsg+0x10/0x10 [ 125.847145][ T7028] ? import_iovec+0x73/0xa0 [ 125.847172][ T7028] ___sys_sendmsg+0x2a5/0x360 [ 125.847192][ T7028] ? __lock_acquire+0x747/0x2de0 [ 125.847224][ T7028] ? __pfx____sys_sendmsg+0x10/0x10 [ 125.847279][ T7028] ? __fget_files+0x2a/0x420 [ 125.847302][ T7028] ? __fget_files+0x3a2/0x420 [ 125.847335][ T7028] __x64_sys_sendmsg+0x1b1/0x290 [ 125.847360][ T7028] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 125.847401][ T7028] do_syscall_64+0x166/0x520 [ 125.847419][ T7028] ? trace_irq_disable+0x3b/0x140 [ 125.847444][ T7028] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.847464][ T7028] ? clear_bhb_loop+0x70/0xc0 [ 125.847488][ T7028] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.847507][ T7028] RIP: 0033:0x7fbbae99e159 [ 125.847526][ T7028] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 125.847542][ T7028] RSP: 002b:00007fbbaf8ae028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 125.847564][ T7028] RAX: ffffffffffffffda RBX: 00007fbbaec25fa0 RCX: 00007fbbae99e159 [ 125.847579][ T7028] RDX: 0000000000000800 RSI: 00002000000000c0 RDI: 0000000000000003 [ 125.847592][ T7028] RBP: 00007fbbaf8ae090 R08: 0000000000000000 R09: 0000000000000000 [ 125.847605][ T7028] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 125.847616][ T7028] R13: 00007fbbaec26038 R14: 00007fbbaec25fa0 R15: 00007ffeee2537c8 [ 125.847653][ T7028] [ 125.848104][ T7028] wireguard: wg0: Could not create IPv4 socket [ 125.935209][ T5697] usb 3-1: New USB device found, idVendor=0c70, idProduct=f00a, bcdDevice= 0.00 [ 125.937948][ T5697] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 125.937992][ T5697] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 125.947979][ T5697] usb 3-1: config 0 descriptor?? [ 126.211100][ T7032] netlink: 76 bytes leftover after parsing attributes in process `syz.3.375'. [ 126.403109][ T5697] aquacomputer_d5next 0003:0C70:F00A.0004: unknown main item tag 0x2 [ 126.403147][ T5697] aquacomputer_d5next 0003:0C70:F00A.0004: unknown main item tag 0x1 [ 126.403221][ T5697] aquacomputer_d5next 0003:0C70:F00A.0004: unknown main item tag 0x0 [ 126.403248][ T5697] aquacomputer_d5next 0003:0C70:F00A.0004: unknown main item tag 0x0 [ 126.403274][ T5697] aquacomputer_d5next 0003:0C70:F00A.0004: unknown main item tag 0x0 [ 126.403300][ T5697] aquacomputer_d5next 0003:0C70:F00A.0004: ignoring exceeding usage max [ 126.411415][ T5697] aquacomputer_d5next 0003:0C70:F00A.0004: unknown main item tag 0x5 [ 126.411455][ T5697] aquacomputer_d5next 0003:0C70:F00A.0004: unknown main item tag 0x6 [ 126.431818][ T5697] aquacomputer_d5next 0003:0C70:F00A.0004: hidraw0: USB HID v0.c4 Device [HID 0c70:f00a] on usb-dummy_hcd.2-1/input0 [ 126.653389][ T5697] usb 3-1: USB disconnect, device number 11 [ 127.141906][ T7054] FAULT_INJECTION: forcing a failure. [ 127.141906][ T7054] name failslab, interval 1, probability 0, space 0, times 0 [ 127.141939][ T7054] CPU: 1 UID: 0 PID: 7054 Comm: syz.0.383 Tainted: G L syzkaller #0 PREEMPT(full) [ 127.141969][ T7054] Tainted: [L]=SOFTLOCKUP [ 127.141976][ T7054] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 127.141989][ T7054] Call Trace: [ 127.141996][ T7054] [ 127.142005][ T7054] dump_stack_lvl+0xe8/0x150 [ 127.142044][ T7054] should_fail_ex+0x3eb/0x540 [ 127.142071][ T7054] should_failslab+0xa8/0x100 [ 127.142094][ T7054] __kmalloc_node_track_caller_noprof+0xf6/0x720 [ 127.142125][ T7054] ? __trace_uprobe_create+0x2c1/0xe40 [ 127.142151][ T7054] ? __trace_uprobe_create+0x2c1/0xe40 [ 127.142184][ T7054] kstrdup+0x42/0x100 [ 127.142215][ T7054] __trace_uprobe_create+0x2c1/0xe40 [ 127.142245][ T7054] ? rcu_is_watching+0x16/0xb0 [ 127.142266][ T7054] ? trace_kmalloc+0x2a/0xf0 [ 127.142292][ T7054] ? __pfx___trace_uprobe_create+0x10/0x10 [ 127.142320][ T7054] ? __kmalloc_noprof+0x387/0x710 [ 127.142346][ T7054] ? __kmalloc_noprof+0x1a6/0x710 [ 127.142371][ T7054] ? argv_split+0x18d/0x400 [ 127.142398][ T7054] ? argv_split+0x18d/0x400 [ 127.142431][ T7054] ? argv_split+0x378/0x400 [ 127.142465][ T7054] trace_probe_create+0xce/0x130 [ 127.142491][ T7054] ? __pfx___trace_uprobe_create+0x10/0x10 [ 127.142519][ T7054] ? __pfx_trace_probe_create+0x10/0x10 [ 127.142547][ T7054] ? __might_fault+0xaf/0x130 [ 127.142574][ T7054] dyn_event_create+0x59/0x80 [ 127.142595][ T7054] create_or_delete_trace_uprobe+0x65/0xa0 [ 127.142625][ T7054] trace_parse_run_command+0x1f3/0x380 [ 127.142654][ T7054] ? __pfx_create_or_delete_trace_uprobe+0x10/0x10 [ 127.142684][ T7054] ? __pfx_probes_write+0x10/0x10 [ 127.142712][ T7054] vfs_write+0x296/0xba0 [ 127.142747][ T7054] ? __pfx_vfs_write+0x10/0x10 [ 127.142775][ T7054] ? __fget_files+0x2a/0x420 [ 127.142804][ T7054] ? __fget_files+0x3a2/0x420 [ 127.142826][ T7054] ? __fget_files+0x2a/0x420 [ 127.142859][ T7054] ksys_write+0x150/0x270 [ 127.142887][ T7054] ? __pfx_ksys_write+0x10/0x10 [ 127.142924][ T7054] do_syscall_64+0x166/0x520 [ 127.142941][ T7054] ? trace_irq_disable+0x3b/0x140 [ 127.142967][ T7054] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 127.142987][ T7054] ? clear_bhb_loop+0x70/0xc0 [ 127.143011][ T7054] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 127.143046][ T7054] RIP: 0033:0x7fbbae99e159 [ 127.143063][ T7054] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 127.143080][ T7054] RSP: 002b:00007fbbaf8ae028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 127.143101][ T7054] RAX: ffffffffffffffda RBX: 00007fbbaec25fa0 RCX: 00007fbbae99e159 [ 127.143115][ T7054] RDX: 0000000000000022 RSI: 0000200000000300 RDI: 0000000000000004 [ 127.143128][ T7054] RBP: 00007fbbaf8ae090 R08: 0000000000000000 R09: 0000000000000000 [ 127.143140][ T7054] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 127.143152][ T7054] R13: 00007fbbaec26038 R14: 00007fbbaec25fa0 R15: 00007ffeee2537c8 [ 127.143185][ T7054] [ 127.949859][ T5697] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 128.098400][ T5697] usb 4-1: Using ep0 maxpacket: 32 [ 128.100648][ T5697] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 128.103744][ T5697] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 128.103769][ T5697] usb 4-1: config 0 has no interface number 0 [ 128.103808][ T5697] usb 4-1: config 0 interface 184 has no altsetting 0 [ 128.107041][ T5697] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 128.107064][ T5697] usb 4-1: Product: syz [ 128.107078][ T5697] usb 4-1: Manufacturer: syz [ 128.107091][ T5697] usb 4-1: SerialNumber: syz [ 128.112574][ T5697] usb 4-1: config 0 descriptor?? [ 128.290360][ T5350] usb 1-1: new full-speed USB device number 22 using dummy_hcd [ 128.462099][ T5350] usb 1-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 128.465740][ T5350] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 128.465766][ T5350] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 128.492056][ T5350] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 128.492081][ T5350] usb 1-1: Product: syz [ 128.492095][ T5350] usb 1-1: Manufacturer: syz [ 128.492131][ T5350] usb 1-1: SerialNumber: syz [ 128.752663][ T5697] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 128.752696][ T5697] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 128.828048][ T7102] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 128.830092][ T7102] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 129.102717][ T5350] usb 1-1: unit 4 not found! [ 129.150658][ T1221] usb 3-1: new low-speed USB device number 12 using dummy_hcd [ 129.185027][ T5350] snd-usb-audio 1-1:1.1: probe with driver snd-usb-audio failed with error -16 [ 129.195180][ T5350] usb 1-1: USB disconnect, device number 22 [ 129.300550][ T1221] usb 3-1: device descriptor read/64, error -71 [ 129.559716][ T1221] usb 3-1: new low-speed USB device number 13 using dummy_hcd [ 129.698718][ T1221] usb 3-1: device descriptor read/64, error -71 [ 129.812332][ T1221] usb usb3-port1: attempt power cycle [ 130.027767][ T7001] Bluetooth: hci4: Frame reassembly failed (-84) [ 130.161298][ T1221] usb 3-1: new low-speed USB device number 14 using dummy_hcd [ 130.190628][ T1221] usb 3-1: device descriptor read/8, error -71 [ 130.439793][ T1221] usb 3-1: new low-speed USB device number 15 using dummy_hcd [ 130.470127][ T1221] usb 3-1: device descriptor read/8, error -71 [ 130.591044][ T1221] usb usb3-port1: unable to enumerate USB device [ 131.588454][ T5697] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000034: -71 [ 131.588485][ T5697] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to write BURST_CAP: -71 [ 131.588504][ T5697] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 131.588741][ T5697] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -71 [ 131.603406][ T5697] usb 4-1: USB disconnect, device number 20 [ 132.080198][ T5625] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 132.148216][ T1221] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 132.682785][ T7146] netlink: 8 bytes leftover after parsing attributes in process `syz.3.397'. [ 133.194287][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.194344][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.269592][ T1221] usb 3-1: Using ep0 maxpacket: 16 [ 133.271785][ T1221] usb 3-1: New USB device found, idVendor=0b05, idProduct=17e0, bcdDevice= 0.00 [ 133.274477][ T1221] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 133.274507][ T1221] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 133.274553][ T1221] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 133.282554][ T1221] usb 3-1: config 0 descriptor?? [ 133.591926][ T7156] rust_binder: 7155:7156 error while translating object: EINVAL [ 133.592013][ T7156] rust_binder: Failure in copy_transaction_data: EINVAL [ 133.592040][ T7156] rust_binder: 7155:7156 transaction call to 7155:0 failed EINVAL, code 0 size 72-24 [ 133.594142][ T5760] rust_binder: 7155: undelivered TRANSACTION_ERROR: 29201 [ 134.176025][ T1221] usbhid 3-1:0.0: can't add hid device: -71 [ 134.176130][ T1221] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 134.204360][ T1221] usb 3-1: USB disconnect, device number 16 [ 134.932092][ T7197] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(3) [ 134.932117][ T7197] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 134.932850][ T7197] vhci_hcd vhci_hcd.0: Device attached [ 134.976438][ T7198] vhci_hcd: unknown pdu 1 [ 134.993483][ T83] vhci_hcd vhci_hcd.2: stop threads [ 134.993506][ T83] vhci_hcd vhci_hcd.2: release socket [ 134.993538][ T83] vhci_hcd vhci_hcd.2: disconnect device [ 135.014250][ T7193] fuse: Bad value for 'group_id' [ 135.014270][ T7193] fuse: Bad value for 'group_id' [ 135.138563][ T1221] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 135.298932][ T1221] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 135.300086][ T1221] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 135.300119][ T1221] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 135.300143][ T1221] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 135.300210][ T1221] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 135.307409][ T1221] usb 4-1: config 0 descriptor?? [ 135.822629][ T7216] netlink: 'syz.0.408': attribute type 1 has an invalid length. [ 135.881804][ T1221] plantronics 0003:047F:FFFF.0005: hiddev0,hidraw0: USB HID v0.00 Joystick [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 136.006399][ T7223] FAULT_INJECTION: forcing a failure. [ 136.006399][ T7223] name failslab, interval 1, probability 0, space 0, times 0 [ 136.006425][ T7223] CPU: 0 UID: 0 PID: 7223 Comm: syz.0.408 Tainted: G L syzkaller #0 PREEMPT(full) [ 136.006441][ T7223] Tainted: [L]=SOFTLOCKUP [ 136.006445][ T7223] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 136.006452][ T7223] Call Trace: [ 136.006456][ T7223] [ 136.006461][ T7223] dump_stack_lvl+0xe8/0x150 [ 136.006479][ T7223] should_fail_ex+0x3eb/0x540 [ 136.006494][ T7223] should_failslab+0xa8/0x100 [ 136.006507][ T7223] __kmalloc_noprof+0xf9/0x710 [ 136.006521][ T7223] ? __might_fault+0xaf/0x130 [ 136.006534][ T7223] ? anon_vma_name_alloc+0x40/0xf0 [ 136.006549][ T7223] ? anon_vma_name_alloc+0x40/0xf0 [ 136.006567][ T7223] anon_vma_name_alloc+0x40/0xf0 [ 136.006583][ T7223] set_anon_vma_name+0x1e4/0x460 [ 136.006595][ T7223] ? __pfx_set_anon_vma_name+0x10/0x10 [ 136.006606][ T7223] ? cap_task_prctl+0x1bb/0xa40 [ 136.006618][ T7223] ? static_key_count+0x41/0x70 [ 136.006633][ T7223] ? security_task_prctl+0x163/0x190 [ 136.006649][ T7223] __se_sys_prctl+0x13a7/0x1910 [ 136.006668][ T7223] ? __pfx___se_sys_prctl+0x10/0x10 [ 136.006686][ T7223] ? __x64_sys_prctl+0x20/0xc0 [ 136.006701][ T7223] do_syscall_64+0x166/0x520 [ 136.006712][ T7223] ? trace_irq_disable+0x3b/0x140 [ 136.006726][ T7223] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.006738][ T7223] ? clear_bhb_loop+0x70/0xc0 [ 136.006751][ T7223] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.006761][ T7223] RIP: 0033:0x7fbbae99e159 [ 136.006772][ T7223] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 136.006781][ T7223] RSP: 002b:00007fbbaf84b028 EFLAGS: 00000246 ORIG_RAX: 000000000000009d [ 136.006794][ T7223] RAX: ffffffffffffffda RBX: 00007fbbaec26270 RCX: 00007fbbae99e159 [ 136.006802][ T7223] RDX: 0000200000ffc000 RSI: 0000000000000000 RDI: 0000000053564d41 [ 136.006809][ T7223] RBP: 00007fbbaea3503b R08: 0000200000000b40 R09: 0000000000000000 [ 136.006816][ T7223] R10: 0000000000001000 R11: 0000000000000246 R12: 0000000000000000 [ 136.006823][ T7223] R13: 00007fbbaec26308 R14: 00007fbbaec26270 R15: 00007ffeee2537c8 [ 136.006838][ T7223] [ 136.275996][ T7216] smpboot: CPU 1 is now offline [ 136.462714][ T7218] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 136.669402][ T7233] netlink: 40 bytes leftover after parsing attributes in process `syz.2.410'. [ 136.669453][ T7233] nbd: must specify at least one socket [ 136.995622][ T5614] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 136.998218][ T5614] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 137.012470][ T5614] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 137.016324][ T5614] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 137.017156][ T5614] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 137.050584][ T7241] netlink: 4608 bytes leftover after parsing attributes in process `syz.0.412'. [ 137.050612][ T7241] netlink: 4608 bytes leftover after parsing attributes in process `syz.0.412'. [ 137.077698][ T7241] netlink: 'syz.0.412': attribute type 1 has an invalid length. [ 137.077718][ T7241] netlink: 16150 bytes leftover after parsing attributes in process `syz.0.412'. [ 137.138524][ T7241] netlink: 'syz.0.412': attribute type 1 has an invalid length. [ 137.138547][ T7241] netlink: 16150 bytes leftover after parsing attributes in process `syz.0.412'. [ 137.187251][ T7241] bond0: option slaves: interface -VetÚÿN¶¾6h0-g does not exist! [ 137.408401][ T7255] netlink: 80 bytes leftover after parsing attributes in process `syz.2.415'. [ 137.501857][ T7261] netlink: 'syz.0.416': attribute type 6 has an invalid length. [ 137.623397][ T7266] FAULT_INJECTION: forcing a failure. [ 137.623397][ T7266] name failslab, interval 1, probability 0, space 0, times 0 [ 137.623426][ T7266] CPU: 0 UID: 0 PID: 7266 Comm: syz.2.417 Tainted: G L syzkaller #0 PREEMPT(full) [ 137.623451][ T7266] Tainted: [L]=SOFTLOCKUP [ 137.623457][ T7266] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 137.623467][ T7266] Call Trace: [ 137.623474][ T7266] [ 137.623481][ T7266] dump_stack_lvl+0xe8/0x150 [ 137.623509][ T7266] should_fail_ex+0x3eb/0x540 [ 137.623531][ T7266] should_failslab+0xa8/0x100 [ 137.623549][ T7266] __kmalloc_noprof+0xf9/0x710 [ 137.623571][ T7266] ? tomoyo_encode+0x2ad/0x570 [ 137.623590][ T7266] ? tomoyo_encode+0x2ad/0x570 [ 137.623616][ T7266] tomoyo_encode+0x2ad/0x570 [ 137.623653][ T7266] tomoyo_realpath_from_path+0x5fa/0x640 [ 137.623687][ T7266] tomoyo_check_open_permission+0x229/0x470 [ 137.623707][ T7266] ? tomoyo_check_open_permission+0x1d3/0x470 [ 137.623726][ T7266] ? __pfx_tomoyo_check_open_permission+0x10/0x10 [ 137.623748][ T7266] ? __asan_memset+0x22/0x50 [ 137.623777][ T7266] ? lockdep_hardirqs_on+0x7b/0x110 [ 137.623826][ T7266] ? tomoyo_file_open+0x163/0x220 [ 137.623849][ T7266] ? devcgroup_check_permission+0x31/0x8f0 [ 137.623879][ T7266] security_file_open+0xa9/0x240 [ 137.623899][ T7266] do_dentry_open+0x495/0x1360 [ 137.623930][ T7266] vfs_open_consume+0x4a/0x350 [ 137.623949][ T7266] ? path_openat+0x14bb/0x1e40 [ 137.623979][ T7266] path_openat+0x14d7/0x1e40 [ 137.624024][ T7266] do_file_open+0x23e/0x4a0 [ 137.624057][ T7266] ? __pfx_do_file_open+0x10/0x10 [ 137.624106][ T7266] ? _raw_spin_unlock+0x28/0x50 [ 137.624130][ T7266] ? alloc_fd+0x651/0x6c0 [ 137.624163][ T7266] do_sys_openat2+0x115/0x200 [ 137.624184][ T7266] ? __se_sys_futex+0x3a8/0x450 [ 137.624206][ T7266] ? __pfx_do_sys_openat2+0x10/0x10 [ 137.624234][ T7266] ? rcu_is_watching+0x16/0xb0 [ 137.624258][ T7266] __x64_sys_openat+0x138/0x170 [ 137.624285][ T7266] do_syscall_64+0x166/0x520 [ 137.624306][ T7266] ? trace_irq_disable+0x3b/0x140 [ 137.624333][ T7266] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 137.624352][ T7266] ? clear_bhb_loop+0x70/0xc0 [ 137.624376][ T7266] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 137.624396][ T7266] RIP: 0033:0x7f306079e159 [ 137.624414][ T7266] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 137.624432][ T7266] RSP: 002b:00007f306162c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 137.624454][ T7266] RAX: ffffffffffffffda RBX: 00007f3060a26090 RCX: 00007f306079e159 [ 137.624468][ T7266] RDX: 0000000000000002 RSI: 00002000000002c0 RDI: ffffffffffffff9c [ 137.624480][ T7266] RBP: 00007f306083503b R08: 0000000000000000 R09: 0000000000000000 [ 137.624492][ T7266] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 137.624504][ T7266] R13: 00007f3060a26128 R14: 00007f3060a26090 R15: 00007ffd47c3e678 [ 137.624536][ T7266] [ 137.638599][ T7266] ERROR: Out of memory at tomoyo_realpath_from_path. [ 137.650421][ T5759] usb 4-1: reset high-speed USB device number 21 using dummy_hcd [ 137.794924][ T83] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 137.827537][ T7265] nvme_fc: nvme_fc_parse_traddr: bad traddr string [ 137.969213][ T7274] netlink: 'syz.0.419': attribute type 4 has an invalid length. [ 138.001507][ T83] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 138.007483][ T7274] netlink: 'syz.0.419': attribute type 4 has an invalid length. [ 138.105403][ T83] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 138.169871][ T83] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 138.632237][ T7296] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=none:owns=io+mem [ 138.643932][ T83] bridge_slave_1: left allmulticast mode [ 138.643957][ T83] bridge_slave_1: left promiscuous mode [ 138.644182][ T83] bridge0: port 2(bridge_slave_1) entered disabled state [ 138.651894][ T7298] netlink: 'syz.3.427': attribute type 10 has an invalid length. [ 138.651913][ T7298] netlink: 40 bytes leftover after parsing attributes in process `syz.3.427'. [ 138.666059][ T83] bridge_slave_0: left allmulticast mode [ 138.666082][ T83] bridge_slave_0: left promiscuous mode [ 138.666278][ T83] bridge0: port 1(bridge_slave_0) entered disabled state [ 138.798260][ T1221] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 138.816843][ T83] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 138.828973][ T83] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 138.830180][ T83] bond0 (unregistering): Released all slaves [ 138.951174][ T1221] usb 1-1: Using ep0 maxpacket: 16 [ 138.952095][ T1221] usb 1-1: New USB device found, idVendor=077d, idProduct=0410, bcdDevice=ec.c1 [ 138.953206][ T1221] usb 1-1: config 129 has too many interfaces: 160, using maximum allowed: 32 [ 138.953229][ T1221] usb 1-1: config 129 has 1 interface, different from the descriptor's value: 160 [ 138.953271][ T1221] usb 1-1: config 129 interface 0 altsetting 0 has an endpoint descriptor with address 0xDF, changing to 0x8F [ 138.953298][ T1221] usb 1-1: config 129 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 138.955685][ T1221] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 138.955707][ T1221] usb 1-1: Product: syz [ 138.955721][ T1221] usb 1-1: Manufacturer: syz [ 138.955735][ T1221] usb 1-1: SerialNumber: syz [ 139.046113][ T7301] netlink: 12 bytes leftover after parsing attributes in process `syz.3.428'. [ 139.118243][ T5625] Bluetooth: hci4: command tx timeout [ 139.304768][ T1221] powermate 1-1:129.0: probe with driver powermate failed with error -5 [ 139.321891][ T1221] usb 1-1: USB disconnect, device number 23 [ 139.354559][ T5750] usb 4-1: USB disconnect, device number 21 [ 139.387327][ T7314] comedi comedi0: comedi_test: 1000000 microvolt, 100000 microsecond waveform attached [ 139.529754][ T7319] FAULT_INJECTION: forcing a failure. [ 139.529754][ T7319] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 139.529784][ T7319] CPU: 1 UID: 0 PID: 7319 Comm: syz.2.433 Tainted: G L syzkaller #0 PREEMPT(full) [ 139.529806][ T7319] Tainted: [L]=SOFTLOCKUP [ 139.529811][ T7319] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 139.529821][ T7319] Call Trace: [ 139.529827][ T7319] [ 139.529834][ T7319] dump_stack_lvl+0xe8/0x150 [ 139.529860][ T7319] should_fail_ex+0x3eb/0x540 [ 139.529882][ T7319] _copy_to_user+0x31/0xb0 [ 139.529905][ T7319] simple_read_from_buffer+0xe1/0x170 [ 139.529931][ T7319] proc_fail_nth_read+0x1bb/0x230 [ 139.529957][ T7319] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 139.529980][ T7319] ? rw_verify_area+0x24a/0x4c0 [ 139.530000][ T7319] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 139.530032][ T7319] vfs_read+0x213/0xa80 [ 139.530057][ T7319] ? __pfx___mutex_lock+0x10/0x10 [ 139.530075][ T7319] ? __pfx_vfs_read+0x10/0x10 [ 139.530097][ T7319] ? __fget_files+0x2a/0x420 [ 139.530123][ T7319] ? __fget_files+0x3a2/0x420 [ 139.530143][ T7319] ? __fget_files+0x2a/0x420 [ 139.530169][ T7319] ksys_read+0x150/0x270 [ 139.530194][ T7319] ? __pfx_ksys_read+0x10/0x10 [ 139.530225][ T7319] do_syscall_64+0x166/0x520 [ 139.530240][ T7319] ? trace_irq_disable+0x3b/0x140 [ 139.530264][ T7319] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 139.530284][ T7319] ? clear_bhb_loop+0x70/0xc0 [ 139.530306][ T7319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 139.530320][ T7319] RIP: 0033:0x7f306075e98e [ 139.530336][ T7319] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 139.530351][ T7319] RSP: 002b:00007f306164cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 139.530370][ T7319] RAX: ffffffffffffffda RBX: 00007f306164d6c0 RCX: 00007f306075e98e [ 139.530383][ T7319] RDX: 000000000000000f RSI: 00007f306164d0a0 RDI: 0000000000000004 [ 139.530395][ T7319] RBP: 00007f306164d090 R08: 0000000000000000 R09: 0000000000000000 [ 139.530405][ T7319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 139.530415][ T7319] R13: 00007f3060a26038 R14: 00007f3060a25fa0 R15: 00007ffd47c3e678 [ 139.530452][ T7319] [ 139.795758][ T83] hsr_slave_0: left promiscuous mode [ 139.796974][ T83] hsr_slave_1: left promiscuous mode [ 139.800129][ T83] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 139.800164][ T83] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 139.826535][ T83] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 139.826557][ T83] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 139.876298][ T83] veth1_macvtap: left promiscuous mode [ 139.876355][ T83] veth0_macvtap: left promiscuous mode [ 139.876471][ T83] veth1_vlan: left promiscuous mode [ 139.876550][ T83] veth0_vlan: left promiscuous mode [ 140.178618][ T5750] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 140.318066][ T7344] FAULT_INJECTION: forcing a failure. [ 140.318066][ T7344] name failslab, interval 1, probability 0, space 0, times 0 [ 140.318098][ T7344] CPU: 1 UID: 0 PID: 7344 Comm: syz.2.439 Tainted: G L syzkaller #0 PREEMPT(full) [ 140.318127][ T7344] Tainted: [L]=SOFTLOCKUP [ 140.318134][ T7344] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 140.318144][ T7344] Call Trace: [ 140.318151][ T7344] [ 140.318159][ T7344] dump_stack_lvl+0xe8/0x150 [ 140.318188][ T7344] should_fail_ex+0x3eb/0x540 [ 140.318213][ T7344] should_failslab+0xa8/0x100 [ 140.318233][ T7344] ? do_getname_kernel+0x54/0x230 [ 140.318255][ T7344] kmem_cache_alloc_noprof+0x9c/0x600 [ 140.318281][ T7344] ? trace_kmalloc+0x2a/0xf0 [ 140.318307][ T7344] ? do_getname_kernel+0x54/0x230 [ 140.318329][ T7344] ? __kmalloc_node_track_caller_noprof+0x4cd/0x720 [ 140.318363][ T7344] do_getname_kernel+0x54/0x230 [ 140.318383][ T7344] ? kern_path+0x1b/0x150 [ 140.318409][ T7344] kern_path+0x25/0x150 [ 140.318445][ T7344] __trace_uprobe_create+0x396/0xe40 [ 140.318481][ T7344] ? trace_kmalloc+0x2a/0xf0 [ 140.318508][ T7344] ? __pfx___trace_uprobe_create+0x10/0x10 [ 140.318535][ T7344] ? __kmalloc_noprof+0x387/0x710 [ 140.318562][ T7344] ? __kmalloc_noprof+0x1a6/0x710 [ 140.318586][ T7344] ? argv_split+0x18d/0x400 [ 140.318613][ T7344] ? argv_split+0x18d/0x400 [ 140.318647][ T7344] ? argv_split+0x378/0x400 [ 140.318678][ T7344] trace_probe_create+0xce/0x130 [ 140.318703][ T7344] ? __pfx___trace_uprobe_create+0x10/0x10 [ 140.318729][ T7344] ? __pfx_trace_probe_create+0x10/0x10 [ 140.318759][ T7344] ? __might_fault+0xaf/0x130 [ 140.318786][ T7344] dyn_event_create+0x59/0x80 [ 140.318807][ T7344] create_or_delete_trace_uprobe+0x65/0xa0 [ 140.318837][ T7344] trace_parse_run_command+0x1f3/0x380 [ 140.318866][ T7344] ? __pfx_create_or_delete_trace_uprobe+0x10/0x10 [ 140.318896][ T7344] ? __pfx_probes_write+0x10/0x10 [ 140.318922][ T7344] vfs_write+0x296/0xba0 [ 140.318956][ T7344] ? __pfx_vfs_write+0x10/0x10 [ 140.318984][ T7344] ? __fget_files+0x2a/0x420 [ 140.319013][ T7344] ? __fget_files+0x3a2/0x420 [ 140.319036][ T7344] ? __fget_files+0x2a/0x420 [ 140.319069][ T7344] ksys_write+0x150/0x270 [ 140.319097][ T7344] ? __pfx_ksys_write+0x10/0x10 [ 140.319135][ T7344] do_syscall_64+0x166/0x520 [ 140.319153][ T7344] ? trace_irq_disable+0x3b/0x140 [ 140.319179][ T7344] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 140.319199][ T7344] ? clear_bhb_loop+0x70/0xc0 [ 140.319224][ T7344] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 140.319243][ T7344] RIP: 0033:0x7f306079e159 [ 140.319262][ T7344] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 140.319279][ T7344] RSP: 002b:00007f306164d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 140.319300][ T7344] RAX: ffffffffffffffda RBX: 00007f3060a25fa0 RCX: 00007f306079e159 [ 140.319315][ T7344] RDX: 0000000000000022 RSI: 0000200000000300 RDI: 0000000000000004 [ 140.319328][ T7344] RBP: 00007f306164d090 R08: 0000000000000000 R09: 0000000000000000 [ 140.319340][ T7344] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 140.319352][ T7344] R13: 00007f3060a26038 R14: 00007f3060a25fa0 R15: 00007ffd47c3e678 [ 140.319384][ T7344] [ 140.382708][ T5750] usb 4-1: Using ep0 maxpacket: 8 [ 140.396257][ T5750] usb 4-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 140.414177][ T5750] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 140.698638][ T5750] pvrusb2: Hardware description: Terratec Grabster AV400 [ 140.698660][ T5750] pvrusb2: ********** [ 140.698667][ T5750] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 140.698680][ T5750] pvrusb2: Important functionality might not be entirely working. [ 140.698688][ T5750] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 140.698699][ T5750] pvrusb2: ********** [ 140.755716][ T83] team0 (unregistering): Port device team_slave_1 removed [ 140.777187][ T83] team0 (unregistering): Port device team_slave_0 removed [ 140.873477][ T7351] netlink: 'syz.0.442': attribute type 63 has an invalid length. [ 140.873503][ T7351] netlink: 16 bytes leftover after parsing attributes in process `syz.0.442'. [ 140.904652][ T2352] pvrusb2: Invalid write control endpoint [ 140.964249][ T5760] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 140.999367][ T2352] pvrusb2: Invalid write control endpoint [ 140.999382][ T2352] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 140.999391][ T2352] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 140.999400][ T2352] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 140.999409][ T2352] pvrusb2: Device being rendered inoperable [ 141.001129][ T2352] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 141.001177][ T2352] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 141.005591][ T2352] pvrusb2: Attached sub-driver cx25840 [ 141.005612][ T2352] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 141.005623][ T2352] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 141.061733][ T5279] 8021q: adding VLAN 0 to HW filter on device eth5 [ 141.114072][ T5750] usb 4-1: USB disconnect, device number 22 [ 141.140233][ T5760] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 141.143764][ T5760] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 141.143795][ T5760] usb 3-1: Product: syz [ 141.143809][ T5760] usb 3-1: Manufacturer: syz [ 141.143823][ T5760] usb 3-1: SerialNumber: syz [ 141.171804][ T7246] bridge0: port 1(bridge_slave_0) entered blocking state [ 141.171964][ T7246] bridge0: port 1(bridge_slave_0) entered disabled state [ 141.172085][ T7246] bridge_slave_0: entered allmulticast mode [ 141.173929][ T7246] bridge_slave_0: entered promiscuous mode [ 141.176612][ T7246] bridge0: port 2(bridge_slave_1) entered blocking state [ 141.176708][ T7246] bridge0: port 2(bridge_slave_1) entered disabled state [ 141.176818][ T7246] bridge_slave_1: entered allmulticast mode [ 141.178464][ T7246] bridge_slave_1: entered promiscuous mode [ 141.198640][ T5625] Bluetooth: hci4: command tx timeout [ 141.220442][ T7246] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 141.227388][ T7246] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 141.228533][ T7351] wireguard: wg0: Could not create IPv4 socket [ 141.371750][ T7246] team0: Port device team_slave_0 added [ 141.382249][ T7246] team0: Port device team_slave_1 added [ 141.411765][ T5759] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 141.487935][ T7246] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 141.487948][ T7246] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 141.487974][ T7246] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 141.530248][ T7246] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 141.530264][ T7246] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 141.530290][ T7246] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 141.651414][ T7246] hsr_slave_0: entered promiscuous mode [ 141.652809][ T7246] hsr_slave_1: entered promiscuous mode [ 141.653785][ T7246] debugfs: 'hsr0' already exists in 'hsr' [ 141.653805][ T7246] Cannot create hsr debugfs directory [ 141.836303][ T1221] usb 3-1: USB disconnect, device number 17 [ 141.911441][ T6998] IPVS: starting estimator thread 0... [ 142.004723][ T7372] IPVS: using max 30 ests per chain, 72000 per kthread [ 142.096120][ T7383] sock: sock_timestamping_bind_phc: sock not bind to device [ 142.139321][ T7380] syzkaller1: entered promiscuous mode [ 142.139344][ T7380] syzkaller1: entered allmulticast mode [ 142.228567][ T7246] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 142.234126][ T7246] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 142.235068][ T7246] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 142.259579][ T7246] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 142.260404][ T7246] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 142.277832][ T7246] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 142.281767][ T7246] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 142.305690][ T7246] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 142.430712][ T5279] 8021q: adding VLAN 0 to HW filter on device eth6 [ 142.478838][ T5759] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 142.479079][ T5759] ath9k_htc: Failed to initialize the device [ 142.484663][ T1221] usb 3-1: ath9k_htc: USB layer deinitialized [ 142.633196][ T6998] Bluetooth: hci1: Frame reassembly failed (-84) [ 142.716289][ T7246] 8021q: adding VLAN 0 to HW filter on device bond0 [ 142.745849][ T7246] 8021q: adding VLAN 0 to HW filter on device team0 [ 142.761266][ T6998] bridge0: port 1(bridge_slave_0) entered blocking state [ 142.761371][ T6998] bridge0: port 1(bridge_slave_0) entered forwarding state [ 142.786901][ T83] bridge0: port 2(bridge_slave_1) entered blocking state [ 142.787002][ T83] bridge0: port 2(bridge_slave_1) entered forwarding state [ 142.890483][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 143.808374][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 143.882444][ T5614] Bluetooth: hci4: command tx timeout [ 143.886032][ T7246] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 143.968323][ T5759] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 144.121879][ T5759] usb 3-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 144.138310][ T5759] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 144.138336][ T5759] usb 3-1: Product: syz [ 144.138350][ T5759] usb 3-1: Manufacturer: syz [ 144.138364][ T5759] usb 3-1: SerialNumber: syz [ 144.375467][ T7425] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 144.376016][ T7425] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 144.442153][ T7430] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 144.442570][ T7430] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 144.458846][ T7425] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 144.463704][ T7425] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 144.638287][ T5625] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 144.677394][ T5759] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x00000010. ret = -EPROTO [ 144.677452][ T5759] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 144.712708][ T5759] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 144.732869][ T5759] lan78xx 3-1:1.0: probe with driver lan78xx failed with error -71 [ 144.748658][ T5759] usb 3-1: USB disconnect, device number 18 [ 144.871769][ T5279] 8021q: adding VLAN 0 to HW filter on device eth7 [ 145.003350][ T7246] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 145.138648][ T30] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 145.288529][ T30] usb 1-1: Using ep0 maxpacket: 8 [ 145.294553][ T30] usb 1-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.00 [ 145.298983][ T30] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 253, changing to 11 [ 145.299013][ T30] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 145.299060][ T30] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 145.305575][ T30] usb 1-1: config 0 descriptor?? [ 145.430052][ T7460] rust_binder: 7459:7460 error while translating object: EINVAL [ 145.430136][ T7460] rust_binder: Failure in copy_transaction_data: EINVAL [ 145.430160][ T7460] rust_binder: 7459:7460 transaction call to 7459:0 failed EINVAL, code 0 size 72-24 [ 145.430604][ T5759] rust_binder: 7459: undelivered TRANSACTION_ERROR: 29201 [ 145.595285][ T7246] veth0_vlan: entered promiscuous mode [ 145.615957][ T7246] veth1_vlan: entered promiscuous mode [ 145.701421][ T7246] veth0_macvtap: entered promiscuous mode [ 145.707653][ T7246] veth1_macvtap: entered promiscuous mode [ 145.741403][ T30] lenovo 0003:17EF:6047.0006: unknown main item tag 0x0 [ 145.741441][ T30] lenovo 0003:17EF:6047.0006: unknown main item tag 0x0 [ 145.741467][ T30] lenovo 0003:17EF:6047.0006: unknown main item tag 0x0 [ 145.741492][ T30] lenovo 0003:17EF:6047.0006: unknown main item tag 0x0 [ 145.741517][ T30] lenovo 0003:17EF:6047.0006: unknown main item tag 0x0 [ 145.741541][ T30] lenovo 0003:17EF:6047.0006: unknown main item tag 0x0 [ 145.741566][ T30] lenovo 0003:17EF:6047.0006: unknown main item tag 0x0 [ 145.741592][ T30] lenovo 0003:17EF:6047.0006: unknown main item tag 0x0 [ 145.741619][ T30] lenovo 0003:17EF:6047.0006: unknown main item tag 0x3 [ 145.741643][ T30] lenovo 0003:17EF:6047.0006: collection stack underflow [ 145.741667][ T30] lenovo 0003:17EF:6047.0006: item 0 0 0 12 parsing failed [ 145.745787][ T30] lenovo 0003:17EF:6047.0006: hid_parse failed [ 145.745857][ T30] lenovo 0003:17EF:6047.0006: probe with driver lenovo failed with error -22 [ 145.812534][ T7246] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 145.887578][ T7246] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 145.919761][ T5614] Bluetooth: hci4: command tx timeout [ 145.953573][ T5279] 8021q: adding VLAN 0 to HW filter on device eth8 [ 145.965645][ T1221] usb 1-1: USB disconnect, device number 24 [ 146.107170][ T41] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 146.107215][ T41] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 146.107248][ T41] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 146.107279][ T41] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 146.140980][ T6997] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 146.141001][ T6997] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 146.200626][ T41] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 146.200648][ T41] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 146.540174][ T7482] netlink: 'syz.2.463': attribute type 10 has an invalid length. [ 146.540197][ T7482] netlink: 40 bytes leftover after parsing attributes in process `syz.2.463'. [ 146.540396][ T7482] team0: entered promiscuous mode [ 146.540413][ T7482] team_slave_0: entered promiscuous mode [ 146.540669][ T7482] team_slave_1: entered promiscuous mode [ 146.540864][ T7482] team0: entered allmulticast mode [ 146.540877][ T7482] team_slave_0: entered allmulticast mode [ 146.540891][ T7482] team_slave_1: entered allmulticast mode [ 146.541992][ T7482] 8021q: adding VLAN 0 to HW filter on device team0 [ 146.542665][ T7482] bridge0: port 3(team0) entered blocking state [ 146.542832][ T7482] bridge0: port 3(team0) entered disabled state [ 146.654163][ T7496] netlink: 8 bytes leftover after parsing attributes in process `syz.0.465'. [ 147.380449][ T7524] netlink: 'syz.2.473': attribute type 6 has an invalid length. [ 147.507585][ T7526] misc userio: No port type given on /dev/userio [ 147.515251][ T7526] misc userio: No port type given on /dev/userio [ 147.574473][ T7526] misc userio: The device must be registered before sending interrupts [ 147.776563][ T7534] netlink: 'syz.0.476': attribute type 4 has an invalid length. [ 147.779302][ T7534] netlink: 'syz.0.476': attribute type 4 has an invalid length. [ 148.038604][ T5350] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 148.047701][ T7511] Bluetooth: hci0: Opcode 0x0c20 failed: -4 [ 148.189556][ T5350] usb 3-1: Using ep0 maxpacket: 16 [ 148.193778][ T5350] usb 3-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 148.197165][ T5350] usb 3-1: config 0 has no interfaces? [ 148.204599][ T5350] usb 3-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 148.204624][ T5350] usb 3-1: Product: syz [ 148.204638][ T5350] usb 3-1: Manufacturer: syz [ 148.204651][ T5350] usb 3-1: SerialNumber: syz [ 148.216716][ T5350] usb 3-1: config 0 descriptor?? [ 148.294593][ T7545] netlink: 'syz.3.482': attribute type 10 has an invalid length. [ 148.294630][ T7545] netlink: 40 bytes leftover after parsing attributes in process `syz.3.482'. [ 148.502995][ T7535] netlink: 180 bytes leftover after parsing attributes in process `syz.2.477'. [ 148.507007][ T5350] usb 3-1: USB disconnect, device number 19 [ 148.697010][ T7551] netlink: 12 bytes leftover after parsing attributes in process `syz.0.485'. [ 149.199992][ T5614] Bluetooth: hci0: command 0x0c20 tx timeout [ 149.501866][ T7586] FAULT_INJECTION: forcing a failure. [ 149.501866][ T7586] name failslab, interval 1, probability 0, space 0, times 0 [ 149.501898][ T7586] CPU: 0 UID: 0 PID: 7586 Comm: syz.2.493 Tainted: G L syzkaller #0 PREEMPT(full) [ 149.501924][ T7586] Tainted: [L]=SOFTLOCKUP [ 149.501932][ T7586] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 149.501943][ T7586] Call Trace: [ 149.501951][ T7586] [ 149.501960][ T7586] dump_stack_lvl+0xe8/0x150 [ 149.501992][ T7586] should_fail_ex+0x3eb/0x540 [ 149.502018][ T7586] should_failslab+0xa8/0x100 [ 149.502041][ T7586] __kmalloc_cache_noprof+0x9e/0x600 [ 149.502070][ T7586] ? __trace_uprobe_create+0x7d6/0xe40 [ 149.502095][ T7586] ? __trace_uprobe_create+0x7d6/0xe40 [ 149.502127][ T7586] __trace_uprobe_create+0x7d6/0xe40 [ 149.502167][ T7586] ? trace_kmalloc+0x2a/0xf0 [ 149.502192][ T7586] ? __pfx___trace_uprobe_create+0x10/0x10 [ 149.502219][ T7586] ? __kmalloc_noprof+0x387/0x710 [ 149.502246][ T7586] ? __kmalloc_noprof+0x1a6/0x710 [ 149.502272][ T7586] ? argv_split+0x18d/0x400 [ 149.502298][ T7586] ? argv_split+0x18d/0x400 [ 149.502333][ T7586] ? argv_split+0x378/0x400 [ 149.502368][ T7586] trace_probe_create+0xce/0x130 [ 149.502395][ T7586] ? __pfx___trace_uprobe_create+0x10/0x10 [ 149.502421][ T7586] ? __pfx_trace_probe_create+0x10/0x10 [ 149.502448][ T7586] ? __pfx_create_or_delete_trace_uprobe+0x10/0x10 [ 149.502479][ T7586] ? create_or_delete_trace_uprobe+0x56/0xa0 [ 149.502512][ T7586] dyn_event_create+0x59/0x80 [ 149.502531][ T7586] create_or_delete_trace_uprobe+0x65/0xa0 [ 149.502561][ T7586] trace_parse_run_command+0x1f3/0x380 [ 149.502591][ T7586] ? __pfx_create_or_delete_trace_uprobe+0x10/0x10 [ 149.502622][ T7586] ? __pfx_probes_write+0x10/0x10 [ 149.502650][ T7586] vfs_write+0x296/0xba0 [ 149.502686][ T7586] ? __pfx_vfs_write+0x10/0x10 [ 149.502714][ T7586] ? __fget_files+0x2a/0x420 [ 149.502744][ T7586] ? __fget_files+0x3a2/0x420 [ 149.502767][ T7586] ? __fget_files+0x2a/0x420 [ 149.502799][ T7586] ksys_write+0x150/0x270 [ 149.502828][ T7586] ? __pfx_ksys_write+0x10/0x10 [ 149.502866][ T7586] do_syscall_64+0x166/0x520 [ 149.502884][ T7586] ? trace_irq_disable+0x3b/0x140 [ 149.502911][ T7586] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 149.502932][ T7586] ? clear_bhb_loop+0x70/0xc0 [ 149.502957][ T7586] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 149.502976][ T7586] RIP: 0033:0x7f306079e159 [ 149.502994][ T7586] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 149.503011][ T7586] RSP: 002b:00007f306164d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 149.503032][ T7586] RAX: ffffffffffffffda RBX: 00007f3060a25fa0 RCX: 00007f306079e159 [ 149.503047][ T7586] RDX: 0000000000000022 RSI: 0000200000000300 RDI: 0000000000000004 [ 149.503060][ T7586] RBP: 00007f306164d090 R08: 0000000000000000 R09: 0000000000000000 [ 149.503073][ T7586] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 149.503085][ T7586] R13: 00007f3060a26038 R14: 00007f3060a25fa0 R15: 00007ffd47c3e678 [ 149.503117][ T7586] [ 149.859186][ T7594] fuse: Unknown parameter 'fd0x0000000000000003' [ 150.208242][ T30] usb 6-1: new full-speed USB device number 2 using dummy_hcd [ 150.339148][ T30] usb 6-1: device descriptor read/64, error -71 [ 150.538386][ T5759] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 150.578288][ T30] usb 6-1: new full-speed USB device number 3 using dummy_hcd [ 150.689307][ T5759] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 150.692690][ T5759] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 150.692736][ T5759] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 150.697820][ T5759] usb 4-1: config 0 descriptor?? [ 150.728316][ T30] usb 6-1: device descriptor read/64, error -71 [ 150.848660][ T30] usb usb6-port1: attempt power cycle [ 150.950152][ T5759] usbhid 4-1:0.0: can't add hid device: -71 [ 150.950267][ T5759] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 150.953030][ T5759] usb 4-1: USB disconnect, device number 23 [ 151.209311][ T30] usb 6-1: new full-speed USB device number 4 using dummy_hcd [ 151.240072][ T30] usb 6-1: device descriptor read/8, error -71 [ 151.277193][ T41] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 151.365777][ T41] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 151.388220][ T5759] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 151.450242][ T41] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 151.490816][ T30] usb 6-1: new full-speed USB device number 5 using dummy_hcd [ 151.531021][ T30] usb 6-1: device descriptor read/8, error -71 [ 151.548224][ T5759] usb 4-1: Using ep0 maxpacket: 8 [ 151.548743][ T5759] usb 4-1: New USB device found, idVendor=06cb, idProduct=0007, bcdDevice= 8.00 [ 151.559147][ T5625] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 151.566262][ T5625] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 151.568940][ T5625] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 151.570673][ T5625] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 151.571235][ T5625] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 151.584208][ T5759] usb 4-1: config 0 has an invalid interface number: 52 but max is 0 [ 151.584233][ T5759] usb 4-1: config 0 has no interface number 0 [ 151.584273][ T5759] usb 4-1: config 0 interface 52 altsetting 1 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 151.584299][ T5759] usb 4-1: config 0 interface 52 has no altsetting 0 [ 151.584332][ T5759] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 151.603773][ T41] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 151.648582][ T30] usb usb6-port1: unable to enumerate USB device [ 151.678825][ T5759] usb 4-1: config 0 descriptor?? [ 151.767552][ T83] Bluetooth: hci1: Frame reassembly failed (-84) [ 151.770336][ T7635] netlink: 'syz.2.509': attribute type 27 has an invalid length. [ 151.913138][ T41] bridge0: port 3(team0) entered disabled state [ 151.940253][ T5759] input: USB Synaptics Device 06cb:0007 (Stick) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.52/input/input7 [ 151.940997][ T41] bridge_slave_1: left allmulticast mode [ 151.941020][ T41] bridge_slave_1: left promiscuous mode [ 151.941221][ T41] bridge0: port 2(bridge_slave_1) entered disabled state [ 151.963707][ T41] bridge_slave_0: left allmulticast mode [ 151.963731][ T41] bridge_slave_0: left promiscuous mode [ 151.963910][ T41] bridge0: port 1(bridge_slave_0) entered disabled state [ 152.199062][ T5759] usb 4-1: USB disconnect, device number 24 [ 152.413843][ T41] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 152.417915][ T41] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 152.436579][ T41] bond0 (unregistering): (slave batadv0): Releasing backup interface [ 152.437709][ T41] bond0 (unregistering): Released all slaves [ 152.599030][ T41] rxrpc: Leaked peer 123 {1} 127.0.0.1:7003 [ 152.656757][ T5279] 8021q: adding VLAN 0 to HW filter on device eth9 [ 152.863473][ T41] hsr_slave_0: left promiscuous mode [ 152.887400][ T41] hsr_slave_1: left promiscuous mode [ 152.889557][ T41] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 152.899832][ T41] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 152.915287][ T41] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 152.915330][ T41] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 152.939943][ T41] veth1_macvtap: left promiscuous mode [ 152.940457][ T41] veth0_macvtap: left promiscuous mode [ 152.940557][ T41] veth1_vlan: left promiscuous mode [ 152.943025][ T41] veth0_vlan: left promiscuous mode [ 153.056960][ T7670] rust_binder: 7669:7670 error while translating object: EINVAL [ 153.057050][ T7670] rust_binder: Failure in copy_transaction_data: EINVAL [ 153.057065][ T7670] rust_binder: 7669:7670 transaction async to 7669:0 failed EINVAL, code 0 size 72-24 [ 153.057545][ T5750] rust_binder: 7669: undelivered TRANSACTION_ERROR: 29201 [ 153.261020][ T7675] program syz.5.513 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 153.509188][ T41] team_slave_1 (unregistering): left promiscuous mode [ 153.509213][ T41] team_slave_1 (unregistering): left allmulticast mode [ 153.510074][ T41] team0 (unregistering): Port device team_slave_1 removed [ 153.525117][ T41] team_slave_0 (unregistering): left promiscuous mode [ 153.525142][ T41] team_slave_0 (unregistering): left allmulticast mode [ 153.534607][ T41] team0 (unregistering): Port device team_slave_0 removed [ 153.598846][ T5614] Bluetooth: hci0: command tx timeout [ 153.704522][ T5279] 8021q: adding VLAN 0 to HW filter on device eth10 [ 153.708245][ T5350] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 153.841458][ T5614] Bluetooth: hci1: command 0x1003 tx timeout [ 153.843196][ T5625] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 153.868551][ T5350] usb 6-1: Using ep0 maxpacket: 32 [ 153.869249][ T5350] usb 6-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=8c.92 [ 153.870257][ T5350] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 153.887016][ T5350] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 153.901245][ T7630] bridge0: port 1(bridge_slave_0) entered blocking state [ 153.901423][ T7630] bridge0: port 1(bridge_slave_0) entered disabled state [ 153.901586][ T7630] bridge_slave_0: entered allmulticast mode [ 153.903437][ T7630] bridge_slave_0: entered promiscuous mode [ 153.944073][ T7630] bridge0: port 2(bridge_slave_1) entered blocking state [ 153.944194][ T7630] bridge0: port 2(bridge_slave_1) entered disabled state [ 153.944372][ T7630] bridge_slave_1: entered allmulticast mode [ 153.957464][ T7630] bridge_slave_1: entered promiscuous mode [ 154.141830][ T5350] gspca_nw80x: reg_w err -71 [ 154.141894][ T5350] nw80x 6-1:16.0: probe with driver nw80x failed with error -71 [ 154.147057][ T5350] usb 6-1: USB disconnect, device number 6 [ 154.219738][ T7630] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 154.271955][ T7630] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 154.278304][ T5750] usb 4-1: new low-speed USB device number 25 using dummy_hcd [ 154.362354][ T7630] team0: Port device team_slave_0 added [ 154.365005][ T7630] team0: Port device team_slave_1 added [ 154.413010][ T7630] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 154.413028][ T7630] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 154.413053][ T7630] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 154.418599][ T5750] usb 4-1: device descriptor read/64, error -71 [ 154.459970][ T7630] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 154.459987][ T7630] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 154.460014][ T7630] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 154.554508][ T7630] hsr_slave_0: entered promiscuous mode [ 154.555510][ T7630] hsr_slave_1: entered promiscuous mode [ 154.615135][ T7720] netlink: 'syz.2.521': attribute type 10 has an invalid length. [ 154.615157][ T7720] netlink: 40 bytes leftover after parsing attributes in process `syz.2.521'. [ 154.655684][ T7720] 8021q: adding VLAN 0 to HW filter on device team0 [ 154.658420][ T5750] usb 4-1: new low-speed USB device number 26 using dummy_hcd [ 154.798270][ T5750] usb 4-1: device descriptor read/64, error -71 [ 154.908604][ T5750] usb usb4-port1: attempt power cycle [ 154.910097][ T7630] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 154.932219][ T7630] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 154.933390][ T7630] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 154.962283][ T7630] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 154.963312][ T7630] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 154.988774][ T7630] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 154.989638][ T7630] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 154.994607][ T7630] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 155.020349][ T5759] usb 6-1: new full-speed USB device number 7 using dummy_hcd [ 155.043067][ T5279] 8021q: adding VLAN 0 to HW filter on device eth11 [ 155.165353][ T7630] 8021q: adding VLAN 0 to HW filter on device bond0 [ 155.180911][ T5759] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 155.182072][ T5759] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 1023, setting to 64 [ 155.187526][ T5759] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 155.187549][ T5759] usb 6-1: Product: Ђ [ 155.187562][ T5759] usb 6-1: Manufacturer: ж [ 155.187575][ T5759] usb 6-1: SerialNumber: й [ 155.248441][ T7630] 8021q: adding VLAN 0 to HW filter on device team0 [ 155.264289][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 155.264388][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 155.271007][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 155.271102][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 155.296028][ T5750] usb 4-1: new low-speed USB device number 27 using dummy_hcd [ 155.309149][ T5750] usb 4-1: device descriptor read/8, error -71 [ 155.460010][ T5759] cdc_ncm 6-1:1.0: bind() failure [ 155.492459][ T5759] cdc_ncm 6-1:1.1: CDC Union missing and no IAD found [ 155.492504][ T5759] cdc_ncm 6-1:1.1: bind() failure [ 155.515372][ T5759] usb 6-1: USB disconnect, device number 7 [ 155.548264][ T5750] usb 4-1: new low-speed USB device number 28 using dummy_hcd [ 155.571638][ T5750] usb 4-1: device descriptor read/8, error -71 [ 155.678715][ T5625] Bluetooth: hci0: command tx timeout [ 155.680534][ T5750] usb usb4-port1: unable to enumerate USB device [ 155.896380][ T5279] 8021q: adding VLAN 0 to HW filter on device eth12 [ 155.995248][ T7630] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 156.396120][ T7630] veth0_vlan: entered promiscuous mode [ 156.422587][ T7630] veth1_vlan: entered promiscuous mode [ 156.440868][ T7796] netlink: 'syz.5.532': attribute type 4 has an invalid length. [ 156.447766][ T7796] netlink: 'syz.5.532': attribute type 4 has an invalid length. [ 156.511458][ T7630] veth0_macvtap: entered promiscuous mode [ 156.528065][ T7630] veth1_macvtap: entered promiscuous mode [ 156.554912][ T7630] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 156.585513][ T7630] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 156.611158][ T83] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 156.611221][ T83] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 156.611257][ T83] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 156.688746][ T7000] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 156.789116][ T7000] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 156.789137][ T7000] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 156.805082][ T7804] netlink: 'syz.5.535': attribute type 10 has an invalid length. [ 156.805101][ T7804] netlink: 40 bytes leftover after parsing attributes in process `syz.5.535'. [ 156.872408][ T7000] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 156.872429][ T7000] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 157.977310][ T5625] Bluetooth: hci0: command tx timeout [ 158.149904][ T7818] netlink: 12 bytes leftover after parsing attributes in process `syz.3.539'. [ 158.589337][ T5697] usb 6-1: new low-speed USB device number 8 using dummy_hcd [ 158.798888][ T5697] usb 6-1: device descriptor read/64, error -71 [ 159.049410][ T5697] usb 6-1: new low-speed USB device number 9 using dummy_hcd [ 159.178496][ T5697] usb 6-1: device descriptor read/64, error -71 [ 159.198679][ T10] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 159.241780][ T7855] FAULT_INJECTION: forcing a failure. [ 159.241780][ T7855] name failslab, interval 1, probability 0, space 0, times 0 [ 159.241820][ T7855] CPU: 1 UID: 0 PID: 7855 Comm: syz.3.548 Tainted: G L syzkaller #0 PREEMPT(full) [ 159.241847][ T7855] Tainted: [L]=SOFTLOCKUP [ 159.241854][ T7855] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 159.241866][ T7855] Call Trace: [ 159.241874][ T7855] [ 159.241883][ T7855] dump_stack_lvl+0xe8/0x150 [ 159.241913][ T7855] should_fail_ex+0x3eb/0x540 [ 159.241940][ T7855] should_failslab+0xa8/0x100 [ 159.241964][ T7855] __kmalloc_noprof+0xf9/0x710 [ 159.241991][ T7855] ? alloc_trace_uprobe+0x32/0x2a0 [ 159.242017][ T7855] ? alloc_trace_uprobe+0x32/0x2a0 [ 159.242050][ T7855] alloc_trace_uprobe+0x32/0x2a0 [ 159.242080][ T7855] __trace_uprobe_create+0x9b8/0xe40 [ 159.242114][ T7855] ? trace_kmalloc+0x2a/0xf0 [ 159.242140][ T7855] ? __pfx___trace_uprobe_create+0x10/0x10 [ 159.242167][ T7855] ? __kmalloc_noprof+0x387/0x710 [ 159.242194][ T7855] ? __kmalloc_noprof+0x1a6/0x710 [ 159.242219][ T7855] ? argv_split+0x18d/0x400 [ 159.242248][ T7855] ? argv_split+0x18d/0x400 [ 159.242282][ T7855] ? argv_split+0x378/0x400 [ 159.242315][ T7855] trace_probe_create+0xce/0x130 [ 159.242342][ T7855] ? __pfx___trace_uprobe_create+0x10/0x10 [ 159.242369][ T7855] ? __pfx_trace_probe_create+0x10/0x10 [ 159.242399][ T7855] ? __might_fault+0xaf/0x130 [ 159.242426][ T7855] dyn_event_create+0x59/0x80 [ 159.242446][ T7855] create_or_delete_trace_uprobe+0x65/0xa0 [ 159.242475][ T7855] trace_parse_run_command+0x1f3/0x380 [ 159.242503][ T7855] ? __pfx_create_or_delete_trace_uprobe+0x10/0x10 [ 159.242534][ T7855] ? __pfx_probes_write+0x10/0x10 [ 159.242560][ T7855] vfs_write+0x296/0xba0 [ 159.242596][ T7855] ? __pfx_vfs_write+0x10/0x10 [ 159.242624][ T7855] ? __fget_files+0x2a/0x420 [ 159.242652][ T7855] ? __fget_files+0x3a2/0x420 [ 159.242675][ T7855] ? __fget_files+0x2a/0x420 [ 159.242707][ T7855] ksys_write+0x150/0x270 [ 159.242736][ T7855] ? __pfx_ksys_write+0x10/0x10 [ 159.242774][ T7855] do_syscall_64+0x166/0x520 [ 159.242791][ T7855] ? trace_irq_disable+0x3b/0x140 [ 159.242824][ T7855] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 159.242844][ T7855] ? clear_bhb_loop+0x70/0xc0 [ 159.242868][ T7855] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 159.242888][ T7855] RIP: 0033:0x7f453579e159 [ 159.242906][ T7855] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 159.242924][ T7855] RSP: 002b:00007f45365c5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 159.242945][ T7855] RAX: ffffffffffffffda RBX: 00007f4535a25fa0 RCX: 00007f453579e159 [ 159.242960][ T7855] RDX: 0000000000000022 RSI: 0000200000000300 RDI: 0000000000000004 [ 159.242972][ T7855] RBP: 00007f45365c5090 R08: 0000000000000000 R09: 0000000000000000 [ 159.242985][ T7855] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 159.242997][ T7855] R13: 00007f4535a26038 R14: 00007f4535a25fa0 R15: 00007ffc83d75258 [ 159.243030][ T7855] [ 159.244273][ T7855] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI [ 159.348233][ T10] usb 3-1: Using ep0 maxpacket: 32 [ 159.348752][ T10] usb 3-1: New USB device found, idVendor=0b57, idProduct=e6d7, bcdDevice=32.78 [ 159.349538][ T10] usb 3-1: config 4 has an invalid interface number: 169 but max is 0 [ 159.349559][ T10] usb 3-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 159.349576][ T10] usb 3-1: config 4 has no interface number 0 [ 159.349602][ T10] usb 3-1: config 4 interface 169 altsetting 6 has an endpoint descriptor with address 0xEE, changing to 0x8E [ 159.349625][ T10] usb 3-1: config 4 interface 169 altsetting 6 endpoint 0x8E has an invalid bInterval 0, changing to 7 [ 159.349649][ T10] usb 3-1: config 4 interface 169 altsetting 6 endpoint 0x8E has invalid wMaxPacketSize 0 [ 159.349669][ T10] usb 3-1: config 4 interface 169 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 159.349693][ T10] usb 3-1: config 4 interface 169 has no altsetting 0 [ 159.352156][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 159.352176][ T10] usb 3-1: Product: syz [ 159.352189][ T10] usb 3-1: Manufacturer: syz [ 159.352203][ T10] usb 3-1: SerialNumber: syz [ 159.667166][ T7855] KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] [ 159.675571][ T7855] CPU: 1 UID: 0 PID: 7855 Comm: syz.3.548 Tainted: G L syzkaller #0 PREEMPT(full) [ 159.686320][ T7855] Tainted: [L]=SOFTLOCKUP [ 159.690629][ T7855] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 159.700670][ T7855] RIP: 0010:path_put+0x24/0x60 [ 159.705429][ T7855] Code: 90 90 90 90 90 90 f3 0f 1e fa 41 56 53 48 89 fb 49 be 00 00 00 00 00 fc ff df e8 37 18 79 ff 48 8d 7b 08 48 89 f8 48 c1 e8 03 <42> 80 3c 30 00 74 05 e8 40 41 e9 ff 48 8b 7b 08 e8 17 93 03 00 48 [ 159.725199][ T7855] RSP: 0018:ffffc90005b2f9c8 EFLAGS: 00010203 [ 159.731259][ T7855] RAX: 0000000000000008 RBX: 000000000000003c RCX: ffff88801f395dc0 [ 159.739218][ T7855] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000044 [ 159.747266][ T7855] RBP: ffffc90005b2fb50 R08: ffffffff9aca9e37 R09: 0000000000000000 [ 159.755225][ T7855] R10: ffffffff9aca9e20 R11: fffffbfff35953c7 R12: fffffffffffffff4 [ 159.763305][ T7855] R13: dffffc0000000000 R14: dffffc0000000000 R15: 0000000000000000 [ 159.771307][ T7855] FS: 00007f45365c56c0(0000) GS:ffff88812495b000(0000) knlGS:0000000000000000 [ 159.780249][ T7855] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 159.786856][ T7855] CR2: 00007f4535670050 CR3: 000000007834a000 CR4: 00000000003526f0 [ 159.794833][ T7855] Call Trace: [ 159.798118][ T7855] [ 159.801054][ T7855] __trace_uprobe_create+0x53f/0xe40 [ 159.806344][ T7855] ? trace_kmalloc+0x2a/0xf0 [ 159.810933][ T7855] ? __pfx___trace_uprobe_create+0x10/0x10 [ 159.816753][ T7855] ? __kmalloc_noprof+0x387/0x710 [ 159.821778][ T7855] ? __kmalloc_noprof+0x1a6/0x710 [ 159.826802][ T7855] ? argv_split+0x18d/0x400 [ 159.831304][ T7855] ? argv_split+0x18d/0x400 [ 159.835803][ T7855] ? argv_split+0x378/0x400 [ 159.840308][ T7855] trace_probe_create+0xce/0x130 [ 159.845239][ T7855] ? __pfx___trace_uprobe_create+0x10/0x10 [ 159.851038][ T7855] ? __pfx_trace_probe_create+0x10/0x10 [ 159.856579][ T7855] ? __might_fault+0xaf/0x130 [ 159.861249][ T7855] dyn_event_create+0x59/0x80 [ 159.865918][ T7855] create_or_delete_trace_uprobe+0x65/0xa0 [ 159.871719][ T7855] trace_parse_run_command+0x1f3/0x380 [ 159.877175][ T7855] ? __pfx_create_or_delete_trace_uprobe+0x10/0x10 [ 159.883681][ T7855] ? __pfx_probes_write+0x10/0x10 [ 159.888699][ T7855] vfs_write+0x296/0xba0 [ 159.892939][ T7855] ? __pfx_vfs_write+0x10/0x10 [ 159.897694][ T7855] ? __fget_files+0x2a/0x420 [ 159.902280][ T7855] ? __fget_files+0x3a2/0x420 [ 159.906949][ T7855] ? __fget_files+0x2a/0x420 [ 159.911532][ T7855] ksys_write+0x150/0x270 [ 159.915858][ T7855] ? __pfx_ksys_write+0x10/0x10 [ 159.920703][ T7855] do_syscall_64+0x166/0x520 [ 159.925283][ T7855] ? trace_irq_disable+0x3b/0x140 [ 159.930302][ T7855] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 159.936356][ T7855] ? clear_bhb_loop+0x70/0xc0 [ 159.941020][ T7855] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 159.946901][ T7855] RIP: 0033:0x7f453579e159 [ 159.951310][ T7855] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 159.970907][ T7855] RSP: 002b:00007f45365c5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 159.979317][ T7855] RAX: ffffffffffffffda RBX: 00007f4535a25fa0 RCX: 00007f453579e159 [ 159.987292][ T7855] RDX: 0000000000000022 RSI: 0000200000000300 RDI: 0000000000000004 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 159.995262][ T7855] RBP: 00007f45365c5090 R08: 0000000000000000 R09: 0000000000000000 [ 160.003231][ T7855] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 160.011222][ T7855] R13: 00007f4535a26038 R14: 00007f4535a25fa0 R15: 00007ffc83d75258 [ 160.019195][ T7855] [ 160.022203][ T7855] Modules linked in: [ 160.028401][ T7855] ---[ end trace 0000000000000000 ]--- [ 160.046058][ T5697] usb usb6-port1: attempt power cycle [ 160.047313][ T5625] Bluetooth: hci0: command tx timeout [ 160.100770][ T7855] RIP: 0010:path_put+0x24/0x60 [ 160.100807][ T7855] Code: 90 90 90 90 90 90 f3 0f 1e fa 41 56 53 48 89 fb 49 be 00 00 00 00 00 fc ff df e8 37 18 79 ff 48 8d 7b 08 48 89 f8 48 c1 e8 03 <42> 80 3c 30 00 74 05 e8 40 41 e9 ff 48 8b 7b 08 e8 17 93 03 00 48 [ 160.100824][ T7855] RSP: 0018:ffffc90005b2f9c8 EFLAGS: 00010203 [ 160.100842][ T7855] RAX: 0000000000000008 RBX: 000000000000003c RCX: ffff88801f395dc0 [ 160.100856][ T7855] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000044 [ 160.100867][ T7855] RBP: ffffc90005b2fb50 R08: ffffffff9aca9e37 R09: 0000000000000000 [ 160.100881][ T7855] R10: ffffffff9aca9e20 R11: fffffbfff35953c7 R12: fffffffffffffff4 [ 160.100896][ T7855] R13: dffffc0000000000 R14: dffffc0000000000 R15: 0000000000000000 [ 160.100910][ T7855] FS: 00007f45365c56c0(0000) GS:ffff88812495b000(0000) knlGS:0000000000000000 [ 160.100927][ T7855] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 160.100941][ T7855] CR2: 000055ff409ed950 CR3: 000000007834a000 CR4: 00000000003526f0 [ 160.100961][ T7855] Kernel panic - not syncing: Fatal exception [ 160.201105][ T7855] Kernel Offset: disabled [ 160.205461][ T7855] Rebooting in 86400 seconds..