last executing test programs: 8.825519493s ago: executing program 0 (id=381): syz_usb_connect$cdc_ecm(0x1, 0x150, &(0x7f0000000980)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x13e, 0x1, 0x1, 0x8, 0x0, 0x9, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x2, 0x6, 0x0, 0xe, {{0x5}, {0x5, 0x24, 0x0, 0x40}, {0xd, 0x24, 0xf, 0x1, 0x9, 0x3, 0x8, 0x7}, [@mdlm_detail={0x103, 0x24, 0x13, 0xf0, "d97792d89d9902f18e5cfd87df8177f865780f802a133357b6156b7189072eb6891117435d7c3d5a714b3472723ada5aaceb3d4b40e57e04623d036682edb305499be44bfb9b2d0615b79841b17d1c23f824c02f2bef4e8b742b69a43f3a3997b329628eb9be905766ef29bceaae6f14cd1860ac5ead7354a09293f18249b257630b7f1b02d2b9279f48402ffe0f7861a2e1b9607f8429b3e88215ec1b1a83453b2ecce5794dae2877f5b282530c9c5cad5d789bebcb9fe91baa3fcb1ef24e4913b7dfd0937a670b8e94bb145908ef20c87b9f489aa8c969d071fb5186146b504fa880aae7a670c09762a001326e8d2ac27b1ad566b04da2f5dc730dfd4cec"}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x20, 0x81, 0x1, 0xa}}, {{0x9, 0x5, 0x3, 0x2, 0x29c5396d1452a9a7, 0xf, 0x0, 0x2}}}}}]}}]}}, &(0x7f0000000d80)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]}) write$sysctl(0xffffffffffffffff, 0x0, 0x0) 7.446837549s ago: executing program 0 (id=397): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) r2 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000000000040bd28420000000000000109022400010000000009040100020300000009210000000122070009058103"], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\"\a'], 0x0}, 0x0) landlock_restrict_self(r1, 0x0) landlock_restrict_self(r1, 0x0) landlock_restrict_self(r1, 0x0) landlock_restrict_self(r1, 0x0) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) write$cgroup_int(r3, &(0x7f0000000080)=0xfffffffffffffffa, 0x12) mkdirat(r3, &(0x7f0000000240)='./file1/file2\x00', 0x116) r4 = landlock_create_ruleset(&(0x7f0000000040)={0x2, 0x3, 0x3}, 0x18, 0x0) landlock_restrict_self(r4, 0x0) landlock_restrict_self(r4, 0x9) landlock_restrict_self(r4, 0x0) landlock_restrict_self(r4, 0x0) landlock_restrict_self(r4, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x1c0) r5 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_int(r5, 0x29, 0x21, &(0x7f0000000100)=0x5, 0x4) sendmmsg$inet6(r5, &(0x7f0000000540)=[{{&(0x7f0000000040)={0xa, 0x4e20, 0x8, @remote, 0x8}, 0x1c, 0x0, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1400000000000000290000000b000000000000040000004a0cdb5179ff9c80fb1bfab4d02107000000000000000029000000080000ddc48e3ea1613d4a0b7e0d00000000000000000018000000000000002900"], 0x48}}], 0x1, 0x14) r6 = landlock_create_ruleset(&(0x7f0000000200)={0x2081, 0x1, 0x3}, 0x18, 0x0) landlock_restrict_self(r6, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000240), 0x8840, 0x0) r7 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', &(0x7f0000000340)={0x800, 0x1c0, 0x31}, 0x18) mknodat(r7, &(0x7f0000000280)='./file0\x00', 0x80, 0x80000005) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1/file2\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x2) sendmsg$kcm(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="d8000000100081046a81f782db44b904021d080b01000000e8fe55a11800150006001400030000120800040043000000a8001600a400014020000900feffff7f3626feffff7fb94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8dcef52a9d7c7c0b7a196e6f66112c88a6bbace80177ccbec4c2ee5a7cef4090000001f3c29643a5ee4ce1b14d6d930dfe1d9d322d4acd9b575730d0080000000000000b5675025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb14feb9f5588a63644caf1ce1bd6c769ad809d52a9ecbee28a0", 0xd8}], 0x1}, 0x0) 6.53244141s ago: executing program 2 (id=404): lsm_list_modules(0x0, 0x0, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000240), r0) sendmsg$IEEE802154_START_REQ(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x18000}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_BEACONS(r6, &(0x7f0000003900)={0x0, 0x0, &(0x7f00000038c0)={&(0x7f0000001500)={0x30, r3, 0x1, 0x70bd07, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0xe}, @val={0x8, 0x3, r5}, @val={0xc, 0x99, {0xb, 0x43}}}}}, 0x30}, 0x1, 0x0, 0x0, 0x40000a0}, 0x810) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000040)={r2, 0x4, 0xb, 0x2}) r8 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_STATS(r7, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x1c, r8, 0x100, 0x70bd2c, 0x25dfdbfb, {}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004041}, 0x240088c5) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001", @ANYRES16=r2], 0x7c}}, 0x10) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a80000000060a0b0400000000000000000200000054000480500001800a000100696e6e6572000000400002800800024000000084080003400000000a080004400000000f08000140000000001c000580090001006d657461000000000c00028008000240000000030900010073797a30000000000900020073797a3200000000140000001100010000400000000000000100000a5d6a01f3a2a609243d9a8d0b8b871567cf7acb5e2b42222b92a88c3faecb8d403a076f16fa57a2fa30152121d3d523c72bd8eab036e50e2f512dcadb41d6b73528790f974f29c23c937c5ce2e931af95dfb26f50d95770fc5c5a5db294da6fadbaedc1bb3e71612b796dcf6204da5c152e7eba4771df5b0c7d77c6755857c0693ef8d68d609f711cd508ef23a8802e750d76e634da2b8d2f88f3f07e35497ceddf3d1cb631a4742f79cb6175fbeb59ac3bde497ba5f1d23f7c00d262c81d7f5c734bb8b40c38d5f4002c"], 0xa8}, 0x1, 0x0, 0x0, 0x11}, 0x0) 6.28861502s ago: executing program 2 (id=407): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x32) r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x6c6882, 0x13d) renameat2(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', r0, &(0x7f0000000000)='./file0\x00', 0x4) 6.031901446s ago: executing program 2 (id=411): r0 = landlock_create_ruleset(&(0x7f0000000080)={0x10}, 0x10, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) r1 = landlock_create_ruleset(&(0x7f00000000c0)={0x8152}, 0x18, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r1, 0x0) landlock_restrict_self(r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x32) r2 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x6c6882, 0x13d) r3 = landlock_create_ruleset(&(0x7f0000000040)={0x4905, 0x3}, 0x18, 0x0) landlock_restrict_self(r3, 0x9) landlock_restrict_self(r1, 0xa) landlock_restrict_self(r1, 0x6) r4 = landlock_create_ruleset(&(0x7f00000001c0)={0x1005, 0x1}, 0x18, 0x0) landlock_restrict_self(r4, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', r2, &(0x7f0000000000)='./file0\x00', 0x4) 5.806324387s ago: executing program 2 (id=412): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000002c0), r0) sendmsg$NLBL_UNLABEL_C_STATICADD(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)={0x14, r1, 0x201, 0xfffffffc, 0x25dfdbfe, {0x3, 0x0, 0x26}}, 0x14}, 0x8, 0x3000000000002}, 0x40850) r2 = syz_usb_connect(0x3, 0x3f, &(0x7f0000000580)=ANY=[@ANYBLOB="120123001650c2cc3d5f3b3767e40102230109022d0001000000000904000003030000000905be3b077c54db46db26095ec47ca7e2d282fe77a6e34ca87fb346937f52fcd13be3a7028086ee6fae07846f1fb53466008b3bb668e57486ccbe7072ffd1fa59ed66588acebe582107de68b80ab6af017aef84f4cc398e078b912a90a8210f372e2807295bc33cde53c7a52bee8f1faf98909d91620bff97b9987f4924ca84dfc1c25578dd70d7e42a1e200abd6dce6b231ec6ea4a1feb4dc0df939c9e6853ae568442a06b06cc423b9c4e6244e32463d833cefa9d949f7102d08dcbd5929613901b2a8b1c7a1a7feda5a998f8d8dc2bd3f627cd733dd92dad9b88273011076db397a21e1a0469aae740be7d5669188e236854b8cf301190e545e40812e4d9b0f35daeaa47df894ca2a4960f6e5de0e909ff34b9", @ANYRESHEX, @ANYRES32], 0x0) syz_usb_control_io$printer(r2, 0x0, &(0x7f00000003c0)={0x34, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)={0x20, 0x1, 0x1, 0x6}, 0x0}) syz_clone(0x240080, 0x0, 0x0, 0x0, 0x0, 0x0) mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000740)=@updpolicy={0xb8, 0x19, 0x1, 0x70bd2b, 0x10000, {{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x2, 0x0, 0xa, 0x20}, {0x8, 0x10, 0x100000002, 0x0, 0xffe, 0xffffffffffffb473, 0xffffffffffffffff}, {0x1000000000, 0x2000000000000000, 0x2, 0xffffffffffffffff}, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0xb8}}, 0x4004) ioperm(0xc614, 0x1, 0x7) prctl$PR_SET_MM_MAP(0x41555856, 0xe, 0x0, 0xfffffffffffffe69) sendmsg$TIPC_CMD_SHOW_PORTS(r3, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0xa04, 0x70bd28, 0x25dfdbff, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x401}, 0xc000) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {0x0, 0x0, 0x200000000000000}}}, 0xb8}}, 0x2c000010) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x5, 0xfffffffffffffffb}, {0x0, 0x40000000000000, 0x200000000000000}, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x4000015}, 0x2c000010) syz_usb_control_io$uac2(r2, 0x0, &(0x7f0000000500)={0x44, &(0x7f00000001c0)={0x0, 0x7, 0x24, "5a2c6172a937cde4f4d7a770297913ca3f24bf0d38fda8b4568ec64970fea556da991831"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=ANY=[@ANYBLOB="1c000000180001efff00000000000000050000000800b8"], 0x1c}, 0x1, 0x0, 0x0, 0x44}, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) 5.302687467s ago: executing program 0 (id=417): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000140)="ad76b6c5", 0x4) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000000540), 0x0, 0x4080) syz_genetlink_get_family_id$ethtool(&(0x7f0000000a80), r1) 4.877421675s ago: executing program 1 (id=418): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000002c0)={0x34, 0x0, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x700}, @NL80211_ATTR_TDLS_DIALOG_TOKEN={0x5}, @NL80211_ATTR_TDLS_ACTION={0x5, 0x88, 0x1}]}, 0x34}}, 0x0) 4.801450995s ago: executing program 1 (id=419): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYRES32=0x0], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000080)={0x24, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x22, 0xf, {[@main=@item_4={0x3, 0x0, 0x8, '\t\x00'}, @local=@item_4={0x3, 0x2, 0x0, "112000"}, @main=@item_4={0x3, 0x0, 0xb, "7488dffc"}]}}, 0x0}, 0x0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) io_setup(0x1, &(0x7f0000000040)=0x0) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="14"], 0x14}, 0x1, 0x0, 0x0, 0x4810}, 0x8008000) io_submit(r2, 0x1, &(0x7f0000000440)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x8, 0x1, r1, &(0x7f0000000100)="653de841f0", 0x5, 0x8000}]) r3 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCINITREPORT(r3, 0x4805, 0x0) 4.407313728s ago: executing program 0 (id=421): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, 0x0, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x30, 0x0, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x30}}, 0x0) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)={0x2c, r2, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0x99}]}, 0x2c}}, 0x0) 4.252547912s ago: executing program 0 (id=422): r0 = landlock_create_ruleset(&(0x7f0000000080)={0x10}, 0x10, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) r1 = landlock_create_ruleset(&(0x7f00000000c0)={0x8152}, 0x18, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x32) r2 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x6c6882, 0x13d) r3 = landlock_create_ruleset(&(0x7f0000000040)={0x4905, 0x3}, 0x18, 0x0) landlock_restrict_self(r3, 0x9) landlock_restrict_self(r3, 0x0) landlock_restrict_self(r1, 0xa) landlock_restrict_self(r1, 0x6) landlock_restrict_self(r3, 0xa) landlock_restrict_self(r3, 0x0) r4 = landlock_create_ruleset(&(0x7f00000001c0)={0x1005, 0x1}, 0x18, 0x0) landlock_restrict_self(r4, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', r2, &(0x7f0000000000)='./file0\x00', 0x4) 4.093500048s ago: executing program 0 (id=425): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x4000000) r1 = mq_open(&(0x7f0000000080)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x0, 0x0) mq_timedsend(r1, 0x0, 0x0, 0x6, 0x0) mq_timedreceive(r1, &(0x7f0000004600)=""/102381, 0xfffffceb, 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000140)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x4}]}) close_range(r2, 0xffffffffffffffff, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="5000000002060500000000010000000000000000050005000a000000050004000000000005000100070000000900020073797a310000000016000300686173683a6e65742c706f72742c6e6574"], 0x50}}, 0x0) syslog(0x1, 0x0, 0x0) syslog(0x3, 0x0, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000300000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) r4 = socket$netlink(0x10, 0x3, 0xc) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) 2.608144856s ago: executing program 2 (id=426): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000019080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c000000070601080000000000000000000000000500010006"], 0x1c}}, 0x0) recvmmsg(r2, &(0x7f0000003840), 0x4000000000001d6, 0x20, 0x0) 2.540699716s ago: executing program 3 (id=427): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000002c0)={0x34, 0x0, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x700}, @NL80211_ATTR_TDLS_DIALOG_TOKEN={0x5}, @NL80211_ATTR_TDLS_ACTION={0x5, 0x88, 0x1}]}, 0x34}}, 0x0) 2.327405643s ago: executing program 3 (id=428): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r1, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_RW(r0, 0x3ba0, &(0x7f0000001200)={0x48, 0x8, r2, 0xffff0000, 0xffff, 0x2, &(0x7f0000000480)='|0', 0x4}) 2.06789643s ago: executing program 3 (id=429): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, 0x0, 0x0) mkdir(&(0x7f00000003c0)='./file0\x00', 0x136) openat$fuse(0xffffffffffffff9c, &(0x7f0000000240), 0x42, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000000)='./file0/file0\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) r1 = syz_open_procfs(0xffffffffffffffff, 0x0) read$FUSE(r1, 0x0, 0x0) chdir(0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000002100), 0x280449c, &(0x7f0000000080)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f00000001c0)={0x28, 0x1d, 0xfffffffb, 0xffffffff}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r5 = accept4$alg(r4, 0x0, 0x0, 0x0) read$alg(r5, &(0x7f0000002300)=""/4128, 0x1020) sendmmsg$alg(r5, &(0x7f0000000880)=[{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000100)="08e0211db1d69fa4593039c5ad01", 0xe}, {&(0x7f00000001c0)="2df1", 0x2}], 0x2, 0x0, 0x0, 0x804}], 0x1, 0x4048091) write(r5, &(0x7f0000000100)="3635a4a1a66ee9666c90ead83a097191e80599a6adf3485f95f91d6ac8f9a135b73d8d38e3b743b577c7", 0x2a) socket$netlink(0x10, 0x3, 0x14) write(r3, &(0x7f0000000000)="240000005e00cf5767c3fffffffffff807000000000000000000008eb8fc0942637d8856", 0x24) mount$bind(&(0x7f0000000080)='./file0/file0\x00', 0x0, 0x0, 0x8b101a, 0x0) mount(0x0, &(0x7f0000000280)='./file0/file0\x00', 0x0, 0x80000, 0x0) unshare(0x6020400) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') 1.613096627s ago: executing program 1 (id=430): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, 0x0, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x30, 0x0, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x30}}, 0x0) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)={0x2c, r2, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0x99}]}, 0x2c}}, 0x0) 1.497164767s ago: executing program 3 (id=431): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000140)="ad76b6c5", 0x4) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000000540)=[{0x0, 0x0, 0x0, 0x0, 0x0, 0x60}], 0x1, 0x4080) syz_genetlink_get_family_id$ethtool(&(0x7f0000000a80), r1) 1.347101166s ago: executing program 1 (id=432): r0 = landlock_create_ruleset(&(0x7f0000000080)={0x10}, 0x10, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) r1 = landlock_create_ruleset(&(0x7f00000000c0)={0x8152}, 0x18, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r1, 0x0) landlock_restrict_self(r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x32) r2 = landlock_create_ruleset(&(0x7f0000000040)={0x4905, 0x3}, 0x18, 0x0) landlock_restrict_self(r2, 0x9) landlock_restrict_self(r2, 0x0) landlock_restrict_self(r1, 0xa) landlock_restrict_self(r1, 0x6) landlock_restrict_self(r2, 0xa) r3 = landlock_create_ruleset(&(0x7f00000001c0)={0x1005, 0x1}, 0x18, 0x0) landlock_restrict_self(r3, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', 0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x4) 1.284863589s ago: executing program 1 (id=433): r0 = landlock_create_ruleset(&(0x7f0000000080)={0x10}, 0x10, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) r1 = landlock_create_ruleset(&(0x7f00000000c0)={0x8152}, 0x18, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x32) r2 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x6c6882, 0x13d) r3 = landlock_create_ruleset(&(0x7f0000000040)={0x4905, 0x3}, 0x18, 0x0) landlock_restrict_self(r3, 0x9) landlock_restrict_self(r3, 0x0) landlock_restrict_self(r1, 0xa) landlock_restrict_self(r1, 0x6) landlock_restrict_self(r3, 0xa) landlock_restrict_self(r3, 0x0) r4 = landlock_create_ruleset(&(0x7f00000001c0)={0x1005, 0x1}, 0x18, 0x0) landlock_restrict_self(r4, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', r2, &(0x7f0000000000)='./file0\x00', 0x4) 1.131725143s ago: executing program 1 (id=434): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nfc(&(0x7f00000001c0), r0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000240)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000300)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000340)=0x0) sendmsg$NFC_CMD_DEV_UP(r0, &(0x7f0000000440)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000400)={&(0x7f0000000480)=ANY=[@ANYBLOB="2c00000023ca6f62aec5985a73dad8319e308bc014e6b5b0a40958c7f25b6edc3668c9c7f6912156b73c7c37e13c1286da1eb135", @ANYRES16=r1, @ANYBLOB="00082abd7000fcdbdf250200000008000100", @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32=r3, @ANYBLOB="08000100", @ANYRES32=r4, @ANYBLOB], 0x2c}, 0x1, 0x0, 0x0, 0x4040040}, 0x40800) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.effective_mems\x00', 0x275a, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x6, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) r7 = dup3(r5, r6, 0x80000) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000240)={0x8, 0x0, &(0x7f0000000000)=[@enter_looper, @register_looper], 0x0, 0x0, 0x0}) fcntl$lock(r5, 0x7, &(0x7f0000000100)={0x0, 0x2, 0x2, 0xfffffffc}) fcntl$lock(r5, 0x6, &(0x7f0000000000)={0x0, 0x1, 0x9, 0x7}) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.effective_mems\x00', 0x275a, 0x0) fcntl$lock(r8, 0x7, &(0x7f0000000100)={0x0, 0x2, 0x6, 0x2}) r9 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r9) r10 = syz_open_dev$vbi(&(0x7f0000000040), 0x1, 0x2) ioctl$VIDIOC_SUBSCRIBE_EVENT(r10, 0x4020565a, &(0x7f0000000180)={0x3, 0x98f904, 0x3}) ptrace$poke(0xffffffffffffffff, r9, &(0x7f00000011c0), 0x40000000007) fcntl$lock(r8, 0x6, &(0x7f0000000040)={0x2, 0x0, 0x9, 0xb, r9}) fcntl$lock(r5, 0x7, &(0x7f0000000180)={0x1, 0x0, 0xfff, 0x59}) fcntl$lock(r5, 0x7, &(0x7f00000003c0)={0x0, 0x2, 0x5, 0x5}) r11 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r11, 0x7a7, &(0x7f0000000000)=0x10000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r11, 0x7a0, &(0x7f0000000100)={@local}) ioctl$IOCTL_VMCI_CTX_GET_CPT_STATE(r11, 0x7b1, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x4}) r12 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), r0) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[@ANYBLOB="f9ffffff", @ANYRES16=r12, @ANYBLOB="01002dbd7000fddbdf2509000000"], 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0x4040088) syz_usb_connect(0x3, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="120100001ca37b10720c1300bebaaf020301090212eb00000000000904"], 0x0) 622.556386ms ago: executing program 2 (id=435): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f00000002c0)=ANY=[@ANYBLOB="9c000000", @ANYRES16=r3, @ANYBLOB="01002cbd700000100000010000000c0002000200000000000000700007800c00018008000100", @ANYRES32=r0, @ANYBLOB="0c00018008000100", @ANYRES32=r0, @ANYBLOB="0c00018008000100", @ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r0, @ANYBLOB="0c00018008000100", @ANYRES32, @ANYBLOB="0c00018008000100", @ANYRES32=r1, @ANYBLOB="0c00018008000100", @ANYRES32, @ANYBLOB="0c00018008000100", @ANYRES32=r1, @ANYBLOB="0c00018008000100", @ANYRES32=r1, @ANYBLOB="0c0005002801"], 0x9c}}, 0x4) 226.374112ms ago: executing program 3 (id=436): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000002c0)={0x34, 0x0, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x700}, @NL80211_ATTR_TDLS_DIALOG_TOKEN={0x5}, @NL80211_ATTR_TDLS_ACTION={0x5, 0x88, 0x1}]}, 0x34}}, 0x0) 0s ago: executing program 3 (id=437): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = fsopen(&(0x7f0000000140)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x9) fchdir(r2) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYRES8=r1], 0x58}, 0x1, 0x0, 0x0, 0x48800}, 0x0) r3 = syz_open_dev$dvb_frontend(&(0x7f0000000180), 0x0, 0x400c3) r4 = openat$comedi(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/comedi4\x00', 0x101040, 0x0) ioctl$COMEDI_DEVINFO(r4, 0x80b06401, &(0x7f0000001580)) ioctl$FE_SET_FRONTEND(r3, 0x40246f4c, &(0x7f0000000080)={0x30a32c0, 0x1, @ofdm={0x6, 0x11, 0x1b, 0xf, 0x5, 0xa, 0x4}}) r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000090003206d0414c34000ffff000109022400010400a000090400000103010100093700086ce82201000905015f"], 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000240)='net/netstat\x00') writev(r6, &(0x7f00000002c0)=[{&(0x7f0000000280)='3', 0x1}], 0x1) syz_usb_control_io(r5, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.14' (ED25519) to the list of known hosts. [ 84.365153][ T5599] cgroup: Unknown subsys name 'net' [ 84.606539][ T5599] cgroup: Unknown subsys name 'cpuset' [ 84.661940][ T5599] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 86.690356][ T5599] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 90.412381][ T4928] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 90.420651][ T4928] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 90.451122][ T4928] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 90.458131][ T4928] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 90.458978][ T4928] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 90.497897][ T5622] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 90.526534][ T5622] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 90.552023][ T5625] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 90.575873][ T60] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 90.585217][ T60] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 90.588105][ T5625] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 90.598375][ T60] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 90.611894][ T60] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 90.630421][ T60] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 90.632434][ T60] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 90.667830][ T60] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 90.669694][ T60] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 90.679845][ T5628] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 90.726077][ T60] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 90.728049][ T60] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 91.957333][ T9] cfg80211: failed to load regulatory.db [ 92.653231][ T5615] Bluetooth: hci0: command tx timeout [ 92.890995][ T5615] Bluetooth: hci2: command tx timeout [ 92.891022][ T60] Bluetooth: hci1: command tx timeout [ 92.892127][ T4928] Bluetooth: hci3: command tx timeout [ 92.965192][ T5611] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.966626][ T5611] bridge0: port 1(bridge_slave_0) entered disabled state [ 92.966852][ T5611] bridge_slave_0: entered allmulticast mode [ 92.970536][ T5611] bridge_slave_0: entered promiscuous mode [ 93.046918][ T5611] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.047199][ T5611] bridge0: port 2(bridge_slave_1) entered disabled state [ 93.047411][ T5611] bridge_slave_1: entered allmulticast mode [ 93.050029][ T5611] bridge_slave_1: entered promiscuous mode [ 93.092471][ T5616] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.092762][ T5616] bridge0: port 1(bridge_slave_0) entered disabled state [ 93.093014][ T5616] bridge_slave_0: entered allmulticast mode [ 93.095613][ T5616] bridge_slave_0: entered promiscuous mode [ 93.169732][ T5616] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.169990][ T5616] bridge0: port 2(bridge_slave_1) entered disabled state [ 93.170219][ T5616] bridge_slave_1: entered allmulticast mode [ 93.187640][ T5616] bridge_slave_1: entered promiscuous mode [ 93.269519][ T5611] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 93.270007][ T5614] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.270357][ T5614] bridge0: port 1(bridge_slave_0) entered disabled state [ 93.291203][ T5614] bridge_slave_0: entered allmulticast mode [ 93.300566][ T5614] bridge_slave_0: entered promiscuous mode [ 93.361687][ T5611] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 93.432788][ T5614] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.433126][ T5614] bridge0: port 2(bridge_slave_1) entered disabled state [ 93.433356][ T5614] bridge_slave_1: entered allmulticast mode [ 93.435950][ T5614] bridge_slave_1: entered promiscuous mode [ 93.487737][ T5616] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 93.533072][ T5612] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.533349][ T5612] bridge0: port 1(bridge_slave_0) entered disabled state [ 93.533564][ T5612] bridge_slave_0: entered allmulticast mode [ 93.536194][ T5612] bridge_slave_0: entered promiscuous mode [ 93.566552][ T5616] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 93.614581][ T5612] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.614951][ T5612] bridge0: port 2(bridge_slave_1) entered disabled state [ 93.615466][ T5612] bridge_slave_1: entered allmulticast mode [ 93.618136][ T5612] bridge_slave_1: entered promiscuous mode [ 93.661686][ T5611] team0: Port device team_slave_0 added [ 93.667944][ T5614] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 93.717814][ T5611] team0: Port device team_slave_1 added [ 93.727006][ T5614] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 93.756959][ T5616] team0: Port device team_slave_0 added [ 93.825791][ T5612] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 93.829483][ T5616] team0: Port device team_slave_1 added [ 93.887744][ T5612] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 93.916362][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 93.916376][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 93.916396][ T5611] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 93.929516][ T5614] team0: Port device team_slave_0 added [ 93.998584][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 93.998597][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 93.998617][ T5611] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 94.010079][ T5614] team0: Port device team_slave_1 added [ 94.060370][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 94.060382][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 94.060402][ T5616] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 94.136221][ T5612] team0: Port device team_slave_0 added [ 94.138241][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 94.138253][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 94.138273][ T5616] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 94.206443][ T5612] team0: Port device team_slave_1 added [ 94.223724][ T5614] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 94.223736][ T5614] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 94.223756][ T5614] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 94.305386][ T5614] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 94.305399][ T5614] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 94.305420][ T5614] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 94.387388][ T5612] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 94.387401][ T5612] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 94.387421][ T5612] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 94.450727][ T5611] hsr_slave_0: entered promiscuous mode [ 94.459721][ T5611] hsr_slave_1: entered promiscuous mode [ 94.471374][ T5612] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 94.471386][ T5612] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 94.471407][ T5612] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 94.731018][ T5615] Bluetooth: hci0: command tx timeout [ 94.793565][ T5616] hsr_slave_0: entered promiscuous mode [ 94.795220][ T5616] hsr_slave_1: entered promiscuous mode [ 94.796760][ T5616] debugfs: 'hsr0' already exists in 'hsr' [ 94.796854][ T5616] Cannot create hsr debugfs directory [ 94.931752][ T5614] hsr_slave_0: entered promiscuous mode [ 94.933676][ T5614] hsr_slave_1: entered promiscuous mode [ 94.935924][ T5614] debugfs: 'hsr0' already exists in 'hsr' [ 94.935952][ T5614] Cannot create hsr debugfs directory [ 94.972182][ T5615] Bluetooth: hci1: command tx timeout [ 94.972215][ T5615] Bluetooth: hci2: command tx timeout [ 94.972238][ T5615] Bluetooth: hci3: command tx timeout [ 95.129429][ T5612] hsr_slave_0: entered promiscuous mode [ 95.137768][ T5612] hsr_slave_1: entered promiscuous mode [ 95.139899][ T5612] debugfs: 'hsr0' already exists in 'hsr' [ 95.139926][ T5612] Cannot create hsr debugfs directory [ 95.995785][ T5611] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 96.074932][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 96.096949][ T5611] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 96.136475][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 96.150035][ T5611] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 96.186992][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 96.215014][ T5611] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 96.248261][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 96.422676][ T5616] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 96.463838][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 96.469640][ T5616] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 96.503528][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 96.507026][ T5616] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 96.537697][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 96.565950][ T5616] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 96.605820][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 96.768887][ T5614] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 96.808406][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 96.812989][ T4928] Bluetooth: hci0: command tx timeout [ 96.824005][ T5614] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 96.865063][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 96.881690][ T5614] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 96.925629][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 96.969016][ T5614] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 97.013757][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 97.061200][ T4928] Bluetooth: hci3: command tx timeout [ 97.061231][ T4928] Bluetooth: hci2: command tx timeout [ 97.061253][ T4928] Bluetooth: hci1: command tx timeout [ 97.214709][ T5612] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 97.253172][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 97.273089][ T5612] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 97.306469][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 97.326963][ T5612] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 97.366946][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 97.385227][ T5612] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 97.427061][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 97.473049][ T5611] 8021q: adding VLAN 0 to HW filter on device bond0 [ 97.592738][ T5611] 8021q: adding VLAN 0 to HW filter on device team0 [ 97.689506][ T1030] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.706321][ T1030] bridge0: port 1(bridge_slave_0) entered forwarding state [ 97.766331][ T1186] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.766817][ T1186] bridge0: port 2(bridge_slave_1) entered forwarding state [ 97.814508][ T5616] 8021q: adding VLAN 0 to HW filter on device bond0 [ 97.961356][ T5616] 8021q: adding VLAN 0 to HW filter on device team0 [ 98.018065][ T1534] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.018237][ T1534] bridge0: port 1(bridge_slave_0) entered forwarding state [ 98.065324][ T5614] 8021q: adding VLAN 0 to HW filter on device bond0 [ 98.110321][ T1534] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.110499][ T1534] bridge0: port 2(bridge_slave_1) entered forwarding state [ 98.238330][ T5614] 8021q: adding VLAN 0 to HW filter on device team0 [ 98.332731][ T5612] 8021q: adding VLAN 0 to HW filter on device bond0 [ 98.360599][ T1186] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.368866][ T1186] bridge0: port 1(bridge_slave_0) entered forwarding state [ 98.443435][ T1534] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.443692][ T1534] bridge0: port 2(bridge_slave_1) entered forwarding state [ 98.567134][ T5612] 8021q: adding VLAN 0 to HW filter on device team0 [ 98.619635][ T4450] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.619818][ T4450] bridge0: port 1(bridge_slave_0) entered forwarding state [ 98.767354][ T4450] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.767575][ T4450] bridge0: port 2(bridge_slave_1) entered forwarding state [ 98.891454][ T4928] Bluetooth: hci0: command tx timeout [ 99.133011][ T4928] Bluetooth: hci1: command tx timeout [ 99.133051][ T4928] Bluetooth: hci2: command tx timeout [ 99.133074][ T4928] Bluetooth: hci3: command tx timeout [ 99.336729][ T5611] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 99.764067][ T5611] veth0_vlan: entered promiscuous mode [ 99.852218][ T5611] veth1_vlan: entered promiscuous mode [ 99.993414][ T5616] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 100.174679][ T5611] veth0_macvtap: entered promiscuous mode [ 100.253119][ T5614] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 100.269332][ T5611] veth1_macvtap: entered promiscuous mode [ 100.441824][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 100.477079][ T5616] veth0_vlan: entered promiscuous mode [ 100.487610][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 100.526498][ T5612] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 100.562171][ T1030] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.587293][ T1030] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.594899][ T5616] veth1_vlan: entered promiscuous mode [ 100.606441][ T1030] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.640290][ T1030] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.790597][ T5614] veth0_vlan: entered promiscuous mode [ 101.019122][ T5614] veth1_vlan: entered promiscuous mode [ 101.158594][ T5616] veth0_macvtap: entered promiscuous mode [ 101.181776][ T149] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.181804][ T149] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.218643][ T5612] veth0_vlan: entered promiscuous mode [ 101.266664][ T5616] veth1_macvtap: entered promiscuous mode [ 101.343678][ T5612] veth1_vlan: entered promiscuous mode [ 101.376229][ T1534] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.376260][ T1534] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.426265][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 101.446250][ T5614] veth0_macvtap: entered promiscuous mode [ 101.503946][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 101.519899][ T5614] veth1_macvtap: entered promiscuous mode [ 101.575119][ T149] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.589749][ T149] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.608886][ T149] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.635200][ T149] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.741308][ T5612] veth0_macvtap: entered promiscuous mode [ 101.775498][ T5614] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 101.902987][ T5612] veth1_macvtap: entered promiscuous mode [ 101.980676][ T5614] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 101.982591][ T5765] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1'. [ 102.163713][ T1509] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.218682][ T1509] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.234048][ T1509] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.266232][ T1509] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.408248][ T5612] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 102.634425][ T5612] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 102.636055][ T1509] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.636072][ T1509] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.877287][ T149] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.880223][ T149] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.919623][ T149] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.048954][ T149] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.049056][ T4450] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.049072][ T4450] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.595227][ T1030] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.595248][ T1030] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.003907][ T5771] netlink: 'syz.1.2': attribute type 1 has an invalid length. [ 104.166924][ T1030] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.166948][ T1030] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.398358][ T1291] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.398380][ T1291] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.648662][ T1030] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.648684][ T1030] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.269125][ T5775] trusted_key: syz.1.5 sent an empty control message without MSG_MORE. [ 105.472890][ T5773] lo speed is unknown, defaulting to 1000 [ 105.574840][ T5777] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 105.615302][ T5773] lo speed is unknown, defaulting to 1000 [ 105.712965][ T5773] lo speed is unknown, defaulting to 1000 [ 107.302546][ T38] audit: type=1800 audit(1780150154.146:2): pid=5793 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.10" name="file1" dev="tmpfs" ino=28 res=0 errno=0 [ 107.403457][ T5781] lo speed is unknown, defaulting to 1000 [ 107.433056][ T5773] infiniband sz1: set active [ 107.433339][ T5773] infiniband sz1: added lo [ 107.621716][ T5773] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 107.690448][ T5773] infiniband sz1: Couldn't open port 1 [ 107.718001][ T5773] smbdirect: ib_dev[sz1]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 107.718043][ T5773] smbdirect: ib_dev[sz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 107.718088][ T5773] smbdirect: ib_dev[sz1]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 108.613963][ T5773] RDS/IB: sz1: added [ 108.614984][ T5773] smc: adding ib device sz1 with port count 1 [ 108.643490][ T5773] smc: ib device sz1 port 1 has no pnetid [ 108.793485][ T5723] lo speed is unknown, defaulting to 1000 [ 108.887066][ T5773] lo speed is unknown, defaulting to 1000 [ 109.816792][ T5831] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 109.843613][ T5832] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 109.938357][ T5773] lo speed is unknown, defaulting to 1000 [ 110.227146][ T5773] lo speed is unknown, defaulting to 1000 [ 110.464264][ T5773] lo speed is unknown, defaulting to 1000 [ 110.756951][ T5615] block nbd1: Receive control failed (result -107) [ 110.875503][ T5839] nbd1: detected capacity change from 0 to 8589934592 [ 110.895139][ T5770] block nbd1: Dead connection, failed to find a fallback [ 110.895168][ T5770] block nbd1: shutting down sockets [ 110.895262][ T5770] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 110.895362][ T5770] Buffer I/O error on dev nbd1, logical block 0, async page read [ 110.895676][ T5770] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 110.896800][ T5770] Buffer I/O error on dev nbd1, logical block 0, async page read [ 110.896989][ T5770] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 110.897015][ T5770] Buffer I/O error on dev nbd1, logical block 0, async page read [ 110.897176][ T5770] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 110.897201][ T5770] Buffer I/O error on dev nbd1, logical block 0, async page read [ 110.897391][ T5770] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 110.897416][ T5770] Buffer I/O error on dev nbd1, logical block 0, async page read [ 110.897601][ T5770] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 110.897627][ T5770] Buffer I/O error on dev nbd1, logical block 0, async page read [ 110.897804][ T5770] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 110.897830][ T5770] Buffer I/O error on dev nbd1, logical block 0, async page read [ 110.897990][ T5770] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 110.898016][ T5770] Buffer I/O error on dev nbd1, logical block 0, async page read [ 110.898446][ T5770] ldm_validate_partition_table(): Disk read failed. [ 110.898528][ T5770] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 110.898554][ T5770] Buffer I/O error on dev nbd1, logical block 0, async page read [ 110.898715][ T5770] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 110.898740][ T5770] Buffer I/O error on dev nbd1, logical block 0, async page read [ 110.899132][ T5770] Dev nbd1: unable to read RDB block 0 [ 110.929450][ T5770] nbd1: unable to read partition table [ 111.124464][ T5770] ldm_validate_partition_table(): Disk read failed. [ 111.162486][ T5787] infiniband syz1: set active [ 111.162620][ T5787] infiniband syz1: added syz_tun [ 111.176616][ T5770] Dev nbd1: unable to read RDB block 0 [ 111.202493][ T5770] nbd1: unable to read partition table [ 111.250308][ T5787] smbdirect: ib_dev[syz1]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 111.250353][ T5787] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 111.250400][ T5787] smbdirect: ib_dev[syz1]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 111.410133][ T5787] RDS/IB: syz1: added [ 111.410220][ T5787] smc: adding ib device syz1 with port count 1 [ 111.410475][ T5787] smc: ib device syz1 port 1 has no pnetid [ 111.722609][ T5615] block nbd0: Receive control failed (result -107) [ 111.814248][ T5846] nbd0: detected capacity change from 0 to 8589934592 [ 111.824969][ T5770] block nbd0: Dead connection, failed to find a fallback [ 111.825045][ T5770] block nbd0: shutting down sockets [ 111.877665][ T5770] ldm_validate_partition_table(): Disk read failed. [ 111.891124][ T5770] Dev nbd0: unable to read RDB block 0 [ 111.911166][ T5770] nbd0: unable to read partition table [ 112.429892][ T5861] netlink: 12 bytes leftover after parsing attributes in process `syz.2.31'. [ 112.563157][ T38] audit: type=1800 audit(1780150159.456:3): pid=5864 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.33" name="file1" dev="tmpfs" ino=86 res=0 errno=0 [ 112.635538][ T5868] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 114.665821][ T5886] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 114.895569][ T5615] block nbd2: Receive control failed (result -107) [ 114.994968][ T5889] block nbd2: shutting down sockets [ 115.405429][ T5900] rdma_rxe: rxe_newlink: failed to add syz_tun [ 115.933020][ T5908] rdma_rxe: rxe_newlink: failed to add lo [ 115.983320][ T5618] usb 4-1: new low-speed USB device number 2 using dummy_hcd [ 116.155612][ T5911] netlink: 'syz.0.51': attribute type 1 has an invalid length. [ 116.293842][ T5618] usb 4-1: unable to get BOS descriptor or descriptor too short [ 116.374691][ T5618] usb 4-1: config 1 has an invalid descriptor of length 42, skipping remainder of the config [ 116.374755][ T5618] usb 4-1: config 1 interface 0 altsetting 8 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 116.374785][ T5618] usb 4-1: config 1 interface 0 has no altsetting 0 [ 117.467581][ T5937] rdma_rxe: rxe_newlink: failed to add syz_tun [ 117.513572][ T5938] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 118.463543][ T5618] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 118.463621][ T5618] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 118.463643][ T5618] usb 4-1: Product: 헳큸貱쩾᡻魧ᣚ⻒ꦂჇ옊恉菍䈶⧺檺ￜ俥퉝଒쀯窼╏뮦㯖쥛Ọ퐁ﮙ䵹뭘脅촱꽇⛧줙㐥擣흖쟪鹴⎈謭缘ﬗ逷ࣷ脢銾鲸ᴷ覃뾕㧚栧覙஗쉗쵩 [ 118.463672][ T5618] usb 4-1: Manufacturer: ࠊ [ 118.611237][ T5723] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 118.762621][ T5723] usb 1-1: Using ep0 maxpacket: 8 [ 118.765106][ T5723] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 118.765136][ T5723] usb 1-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 118.765188][ T5723] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 118.765214][ T5723] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 118.946000][ T5618] usb 4-1: can't set config #1, error -71 [ 119.007584][ T5618] usb 4-1: USB disconnect, device number 2 [ 119.207849][ T37] usb 1-1: USB disconnect, device number 2 [ 119.399079][ T5975] netlink: 12 bytes leftover after parsing attributes in process `syz.1.79'. [ 119.637212][ T5982] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 121.202691][ T5723] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 121.361689][ T5723] usb 1-1: Using ep0 maxpacket: 8 [ 121.367091][ T5723] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 121.367125][ T5723] usb 1-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 121.367176][ T5723] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 121.367201][ T5723] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 121.686910][ T6013] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 121.905161][ T6021] netlink: 12 bytes leftover after parsing attributes in process `syz.3.98'. [ 122.219178][ T37] usb 1-1: USB disconnect, device number 3 [ 122.221576][ T5620] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 122.413917][ T5620] usb 2-1: Using ep0 maxpacket: 32 [ 122.442618][ T5620] usb 2-1: config 0 has an invalid interface number: 35 but max is 0 [ 122.442651][ T5620] usb 2-1: config 0 has no interface number 0 [ 122.493467][ T5620] usb 2-1: config 0 interface 35 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 122.493505][ T5620] usb 2-1: config 0 interface 35 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 122.528755][ T5620] usb 2-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.ad [ 122.528780][ T5620] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 122.528795][ T5620] usb 2-1: Product: syz [ 122.528806][ T5620] usb 2-1: Manufacturer: syz [ 122.528816][ T5620] usb 2-1: SerialNumber: syz [ 122.584566][ T5620] usb 2-1: config 0 descriptor?? [ 122.787861][ T5620] radio-si470x 2-1:0.35: this is not a si470x device. [ 123.005114][ T6045] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 123.010172][ T6045] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 123.013171][ T5620] radio-raremono 2-1:0.35: this is not Thanko's Raremono. [ 123.202924][ T6048] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 123.389054][ T5620] usb 2-1: USB disconnect, device number 2 [ 123.393529][ T10] wlan1: authenticate with 08:02:11:00:00:00 (local address=08:02:11:00:00:01) [ 123.393573][ T10] wlan1: send auth to 08:02:11:00:00:00 (try 1/3) [ 123.655226][ T1037] wlan1: send auth to 08:02:11:00:00:00 (try 2/3) [ 123.683419][ T6059] block nbd2: shutting down sockets [ 123.830887][ T67] wlan1: send auth to 08:02:11:00:00:00 (try 3/3) [ 123.930585][ T6072] netlink: 12 bytes leftover after parsing attributes in process `syz.1.121'. [ 123.953519][ T1037] wlan1: authentication with 08:02:11:00:00:00 timed out [ 124.493959][ T6092] netlink: 12 bytes leftover after parsing attributes in process `syz.1.132'. [ 124.550722][ T6090] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 124.689765][ T6097] netlink: 12 bytes leftover after parsing attributes in process `syz.1.135'. [ 124.966406][ T6105] block nbd1: shutting down sockets [ 125.117134][ T6114] netlink: 12 bytes leftover after parsing attributes in process `syz.2.143'. [ 125.755107][ T6137] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 126.170927][ T5723] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 126.332594][ T5723] usb 1-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 126.332626][ T5723] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 126.332650][ T5723] usb 1-1: Product: syz [ 126.332666][ T5723] usb 1-1: Manufacturer: syz [ 126.332682][ T5723] usb 1-1: SerialNumber: syz [ 126.385129][ T5723] usb 1-1: config 0 descriptor?? [ 126.437290][ T5723] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 126.516981][ T6159] block nbd3: shutting down sockets [ 126.949376][ T6175] netlink: 12 bytes leftover after parsing attributes in process `syz.2.169'. [ 127.189658][ T6180] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 127.257710][ T5618] wlan1: authenticate with 08:02:11:00:00:00 (local address=08:02:11:00:00:01) [ 127.257740][ T5618] wlan1: send auth to 08:02:11:00:00:00 (try 1/3) [ 127.391563][ T4450] wlan1: send auth to 08:02:11:00:00:00 (try 2/3) [ 127.500980][ T1509] wlan1: send auth to 08:02:11:00:00:00 (try 3/3) [ 127.614464][ T4450] wlan1: authentication with 08:02:11:00:00:00 timed out [ 128.136828][ T6199] loop5: detected capacity change from 0 to 7 [ 128.242790][ T6142] netlink: 4 bytes leftover after parsing attributes in process `syz.0.156'. [ 128.427430][ T6199] loop5: [POWERTEC] p1 p2 p3 p4 [ 128.526283][ T5723] gspca_stk1135: reg_w 0x200 err -110 [ 128.527371][ T5723] gspca_stk1135: serial bus timeout: status=0x00 [ 128.527386][ T5723] gspca_stk1135: Sensor write failed [ 128.527425][ T5723] gspca_stk1135: serial bus timeout: status=0x00 [ 128.527436][ T5723] gspca_stk1135: Sensor write failed [ 128.527478][ T5723] gspca_stk1135: serial bus timeout: status=0x00 [ 128.527489][ T5723] gspca_stk1135: Sensor read failed [ 128.527526][ T5723] gspca_stk1135: serial bus timeout: status=0x00 [ 128.527536][ T5723] gspca_stk1135: Sensor read failed [ 128.527544][ T5723] gspca_stk1135: Detected sensor type unknown (0x0) [ 128.527586][ T5723] gspca_stk1135: serial bus timeout: status=0x00 [ 128.527597][ T5723] gspca_stk1135: Sensor read failed [ 128.527633][ T5723] gspca_stk1135: serial bus timeout: status=0x00 [ 128.527643][ T5723] gspca_stk1135: Sensor read failed [ 128.527679][ T5723] gspca_stk1135: serial bus timeout: status=0x00 [ 128.527690][ T5723] gspca_stk1135: Sensor write failed [ 128.527727][ T5723] gspca_stk1135: serial bus timeout: status=0x00 [ 128.527738][ T5723] gspca_stk1135: Sensor write failed [ 128.527833][ T5723] stk1135 1-1:0.0: probe with driver stk1135 failed with error -110 [ 128.567913][ T37] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 128.718387][ T6199] loop5: p1 size 1153433600 extends beyond EOD, truncated [ 128.720199][ T5723] usb 1-1: USB disconnect, device number 4 [ 128.753566][ T37] usb 3-1: Using ep0 maxpacket: 32 [ 128.756805][ T37] usb 3-1: config index 0 descriptor too short (expected 11556, got 36) [ 128.756835][ T37] usb 3-1: config 0 has an invalid descriptor of length 169, skipping remainder of the config [ 128.756857][ T37] usb 3-1: config 0 has no interfaces? [ 128.813214][ T37] usb 3-1: New USB device found, idVendor=05ac, idProduct=020f, bcdDevice= 0.22 [ 128.813246][ T37] usb 3-1: New USB device strings: Mfr=1, Product=130, SerialNumber=131 [ 128.813267][ T37] usb 3-1: Product: syz [ 128.813282][ T37] usb 3-1: Manufacturer: syz [ 128.813297][ T37] usb 3-1: SerialNumber: syz [ 128.976751][ T37] usb 3-1: config 0 descriptor?? [ 129.018306][ T6199] loop5: p2 size 327680 extends beyond EOD, truncated [ 129.041810][ T6199] loop5: p3 start 589824 is beyond EOD, truncated [ 129.041842][ T6199] loop5: p4 start 1848407154 is beyond EOD, truncated [ 129.129963][ T6215] netlink: 12 bytes leftover after parsing attributes in process `syz.3.186'. [ 129.251742][ T5620] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 129.343482][ T37] usb 3-1: USB disconnect, device number 2 [ 129.392482][ T6217] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 129.423140][ T5620] usb 2-1: Using ep0 maxpacket: 32 [ 129.427074][ T5620] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 127, changing to 10 [ 129.427107][ T5620] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 129.427138][ T5620] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2dbe, bcdDevice= 0.00 [ 129.427155][ T5620] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 129.540295][ T5620] usb 2-1: config 0 descriptor?? [ 129.792303][ T5620] konepure 0003:1E7D:2DBE.0001: unknown global tag 0xe [ 129.792331][ T5620] konepure 0003:1E7D:2DBE.0001: item 0 4 1 14 parsing failed [ 129.794013][ T5620] konepure 0003:1E7D:2DBE.0001: parse failed [ 129.794097][ T5620] konepure 0003:1E7D:2DBE.0001: probe with driver konepure failed with error -22 [ 129.968591][ T5620] usb 2-1: USB disconnect, device number 3 [ 130.663810][ T6244] netlink: 12 bytes leftover after parsing attributes in process `syz.2.198'. [ 131.091082][ T6263] warning: `syz.3.208' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 131.831080][ T5620] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 131.991863][ T5620] usb 2-1: Using ep0 maxpacket: 8 [ 131.997230][ T5620] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 131.997261][ T5620] usb 2-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 131.997323][ T5620] usb 2-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 131.997362][ T5620] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 131.997383][ T5620] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 132.088692][ T6295] netlink: 12 bytes leftover after parsing attributes in process `syz.3.223'. [ 132.194669][ T5620] usbtmc 2-1:16.0: bulk endpoints not found [ 132.369388][ T6299] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 132.730395][ T5723] usb 2-1: USB disconnect, device number 4 [ 132.908840][ T1341] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.909227][ T1341] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.952071][ T5620] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 133.079646][ T6318] netlink: 12 bytes leftover after parsing attributes in process `syz.0.232'. [ 133.110886][ T5620] usb 4-1: Using ep0 maxpacket: 16 [ 133.113928][ T5620] usb 4-1: config 0 has an invalid interface number: 34 but max is 0 [ 133.113958][ T5620] usb 4-1: config 0 has no interface number 0 [ 133.114005][ T5620] usb 4-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 133.114033][ T5620] usb 4-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 133.119626][ T5620] usb 4-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 133.119659][ T5620] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 133.119682][ T5620] usb 4-1: Product: syz [ 133.119698][ T5620] usb 4-1: Manufacturer: syz [ 133.119714][ T5620] usb 4-1: SerialNumber: syz [ 133.218232][ T5620] usb 4-1: config 0 descriptor?? [ 133.219557][ T6308] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 133.219933][ T6308] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 133.383247][ T5723] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 133.447725][ T6308] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 133.447917][ T6308] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 133.565522][ T5723] usb 3-1: Using ep0 maxpacket: 16 [ 133.597859][ T5723] usb 3-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 133.597894][ T5723] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 133.597917][ T5723] usb 3-1: Product: syz [ 133.597933][ T5723] usb 3-1: Manufacturer: syz [ 133.597949][ T5723] usb 3-1: SerialNumber: syz [ 133.652829][ T5723] usb 3-1: config 0 descriptor?? [ 133.667979][ T5620] asix 4-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 133.873971][ T5620] asix 4-1:0.34 (unnamed net_device) (uninitialized): invalid PHY address: 122 [ 133.904166][ T5723] dvb_usb_dtv5100 3-1:0.0: probe with driver dvb_usb_dtv5100 failed with error -71 [ 133.950725][ T5723] usb 3-1: USB disconnect, device number 3 [ 134.051851][ T37] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 134.112314][ T6328] lo speed is unknown, defaulting to 1000 [ 134.229598][ T6308] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 134.254594][ T6308] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 134.274745][ T37] usb 1-1: config 220 has an invalid interface number: 76 but max is 2 [ 134.274777][ T37] usb 1-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 134.274797][ T37] usb 1-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 134.274817][ T37] usb 1-1: config 220 has no interface number 2 [ 134.274888][ T37] usb 1-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 134.274917][ T37] usb 1-1: config 220 interface 0 has no altsetting 0 [ 134.274936][ T37] usb 1-1: config 220 interface 76 has no altsetting 0 [ 134.274955][ T37] usb 1-1: config 220 interface 1 has no altsetting 0 [ 134.285453][ T6308] process 'syz.3.228' launched './file1' with NULL argv: empty string added [ 134.361134][ T6334] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 134.385744][ T6334] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 134.399369][ T37] usb 1-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 134.399401][ T37] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 134.399421][ T37] usb 1-1: Product: syz [ 134.399437][ T37] usb 1-1: Manufacturer: syz [ 134.399452][ T37] usb 1-1: SerialNumber: syz [ 134.613255][ T6214] usb 4-1: USB disconnect, device number 3 [ 134.831207][ T6347] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 134.880113][ T6349] netlink: 12 bytes leftover after parsing attributes in process `syz.1.243'. [ 135.021234][ T6351] faux_driver vkms: [drm] Unknown color mode 6; guessing buffer size. [ 135.556397][ T6356] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 136.070357][ T6370] loop5: detected capacity change from 0 to 127 [ 136.117764][ T6370] loop5: unable to read partition table [ 136.120047][ T6370] loop_reread_partitions: partition scan of loop5 (被x) failed (rc=-5) [ 136.179429][ T6372] netlink: 12 bytes leftover after parsing attributes in process `syz.1.252'. [ 136.323519][ T6374] FAULT_INJECTION: forcing a failure. [ 136.323519][ T6374] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 136.323580][ T6374] CPU: 0 UID: 0 PID: 6374 Comm: syz.2.254 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 136.323606][ T6374] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 136.323629][ T6374] Call Trace: [ 136.323642][ T6374] [ 136.323652][ T6374] dump_stack_lvl+0xe8/0x150 [ 136.323697][ T6374] should_fail_ex+0x46b/0x600 [ 136.323736][ T6374] _copy_from_user+0x2d/0xb0 [ 136.323764][ T6374] do_sock_getsockopt+0x200/0x7e0 [ 136.323805][ T6374] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 136.323848][ T6374] ? __fget_files+0x3a6/0x420 [ 136.323873][ T6374] ? __fget_files+0x2a/0x420 [ 136.323910][ T6374] __x64_sys_getsockopt+0x1aa/0x250 [ 136.323951][ T6374] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.323976][ T6374] do_syscall_64+0x174/0x580 [ 136.324007][ T6374] ? trace_irq_disable+0x3b/0x140 [ 136.324032][ T6374] ? clear_bhb_loop+0x40/0x90 [ 136.324060][ T6374] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.324082][ T6374] RIP: 0033:0x7f600bd2ce59 [ 136.324110][ T6374] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 136.324128][ T6374] RSP: 002b:00007f6009f86028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 136.324152][ T6374] RAX: ffffffffffffffda RBX: 00007f600bfa5fa0 RCX: 00007f600bd2ce59 [ 136.324168][ T6374] RDX: 0000000000000076 RSI: 0000000000000084 RDI: 0000000000000003 [ 136.324181][ T6374] RBP: 00007f6009f86090 R08: 00002000000000c0 R09: 0000000000000000 [ 136.324195][ T6374] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000001 [ 136.324209][ T6374] R13: 00007f600bfa6038 R14: 00007f600bfa5fa0 R15: 00007ffdd76f0fd8 [ 136.324260][ T6374] [ 137.056965][ T6378] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 138.222793][ T5618] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 138.381049][ T5618] usb 4-1: Using ep0 maxpacket: 8 [ 138.383313][ T5618] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 138.383341][ T5618] usb 4-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 138.383387][ T5618] usb 4-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 138.383428][ T5618] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 138.383453][ T5618] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 138.514042][ T5618] usbtmc 4-1:16.0: bulk endpoints not found [ 138.553268][ T824] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 138.732803][ T824] usb 3-1: Using ep0 maxpacket: 8 [ 138.735821][ T824] usb 3-1: config 0 has no interfaces? [ 138.735862][ T824] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 138.735888][ T824] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 138.824246][ T824] usb 3-1: config 0 descriptor?? [ 138.836938][ T6410] netlink: 12 bytes leftover after parsing attributes in process `syz.1.268'. [ 139.117712][ T6414] FAULT_INJECTION: forcing a failure. [ 139.117712][ T6414] name failslab, interval 1, probability 0, space 0, times 1 [ 139.117746][ T6414] CPU: 0 UID: 0 PID: 6414 Comm: syz.2.265 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 139.117766][ T6414] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 139.117777][ T6414] Call Trace: [ 139.117784][ T6414] [ 139.117791][ T6414] dump_stack_lvl+0xe8/0x150 [ 139.117820][ T6414] should_fail_ex+0x46b/0x600 [ 139.117853][ T6414] should_failslab+0xa8/0x100 [ 139.117881][ T6414] __kmalloc_noprof+0xdf/0x7b0 [ 139.117906][ T6414] ? tomoyo_encode+0x28b/0x550 [ 139.117933][ T6414] tomoyo_encode+0x28b/0x550 [ 139.117960][ T6414] tomoyo_realpath_from_path+0x58d/0x5d0 [ 139.117986][ T6414] ? tomoyo_domain+0xd7/0x130 [ 139.118020][ T6414] ? tomoyo_path_number_perm+0x219/0x630 [ 139.118053][ T6414] tomoyo_path_number_perm+0x246/0x630 [ 139.118086][ T6414] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 139.118115][ T6414] ? __lock_acquire+0x6b5/0x2d10 [ 139.118151][ T6414] ? do_raw_spin_lock+0x12b/0x2f0 [ 139.118194][ T6414] ? __fget_files+0x2a/0x420 [ 139.118217][ T6414] ? __fget_files+0x2a/0x420 [ 139.118236][ T6414] ? __fget_files+0x3a6/0x420 [ 139.118256][ T6414] ? __fget_files+0x2a/0x420 [ 139.118280][ T6414] security_file_ioctl+0xc3/0x2a0 [ 139.118311][ T6414] __se_sys_ioctl+0x47/0x170 [ 139.118338][ T6414] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 139.118357][ T6414] do_syscall_64+0x174/0x580 [ 139.118386][ T6414] ? clear_bhb_loop+0x40/0x90 [ 139.118408][ T6414] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 139.118426][ T6414] RIP: 0033:0x7f600bd2ce59 [ 139.118445][ T6414] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 139.118461][ T6414] RSP: 002b:00007f6009f44028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 139.118482][ T6414] RAX: ffffffffffffffda RBX: 00007f600bfa6180 RCX: 00007f600bd2ce59 [ 139.118496][ T6414] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 139.118508][ T6414] RBP: 00007f6009f44090 R08: 0000000000000000 R09: 0000000000000000 [ 139.118519][ T6414] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 139.118531][ T6414] R13: 00007f600bfa6218 R14: 00007f600bfa6180 R15: 00007ffdd76f0fd8 [ 139.118561][ T6414] [ 139.118708][ T6414] ERROR: Out of memory at tomoyo_realpath_from_path. [ 139.501978][ T823] usb 4-1: USB disconnect, device number 4 [ 139.680226][ T6418] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 139.749212][ T37] usb 1-1: selecting invalid altsetting 0 [ 139.807305][ T824] usb 3-1: USB disconnect, device number 4 [ 139.807740][ T37] uvcvideo 1-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 139.807789][ T37] uvcvideo 1-1:220.0: No valid video chain found. [ 139.897586][ T37] usb 1-1: selecting invalid altsetting 0 [ 139.897615][ T37] usbtest 1-1:220.1: probe with driver usbtest failed with error -22 [ 140.607872][ T5618] usb 1-1: USB disconnect, device number 5 [ 140.675257][ T6430] Zero length message leads to an empty skb [ 140.690960][ T37] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 140.719590][ T6434] netlink: 12 bytes leftover after parsing attributes in process `syz.1.277'. [ 140.902696][ T37] usb 4-1: Using ep0 maxpacket: 8 [ 140.905645][ T37] usb 4-1: config 0 has no interfaces? [ 140.905684][ T37] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 140.905710][ T37] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 140.984235][ T37] usb 4-1: config 0 descriptor?? [ 141.078907][ T6438] netlink: 'syz.2.281': attribute type 25 has an invalid length. [ 141.226529][ T6445] fuseblk: Bad value for 'fd' [ 141.340945][ T37] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 141.490936][ T37] usb 1-1: Using ep0 maxpacket: 8 [ 141.492789][ T37] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 141.492818][ T37] usb 1-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 141.492867][ T37] usb 1-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 141.492913][ T37] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 141.492938][ T37] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 141.580368][ T37] usbtmc 1-1:16.0: bulk endpoints not found [ 141.735870][ T5618] usb 4-1: USB disconnect, device number 5 [ 141.839461][ T6456] netlink: 28 bytes leftover after parsing attributes in process `syz.2.286'. [ 142.111028][ T5620] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 142.150571][ T824] usb 1-1: USB disconnect, device number 6 [ 142.271029][ T5620] usb 2-1: Using ep0 maxpacket: 8 [ 142.289750][ T5620] usb 2-1: config 0 has no interfaces? [ 142.289789][ T5620] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 142.289814][ T5620] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 142.318531][ T5620] usb 2-1: config 0 descriptor?? [ 142.334467][ T37] usb 3-1: new full-speed USB device number 5 using dummy_hcd [ 142.505571][ T37] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 142.505625][ T37] usb 3-1: New USB device found, idVendor=0f30, idProduct=0111, bcdDevice= 0.00 [ 142.505651][ T37] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 142.566215][ T37] usb 3-1: config 0 descriptor?? [ 142.629112][ T37] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 142.673509][ T6469] netlink: 324 bytes leftover after parsing attributes in process `syz.3.290'. [ 143.036530][ T37] usb 2-1: USB disconnect, device number 5 [ 143.201151][ T5620] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 143.319849][ T6486] netlink: 20 bytes leftover after parsing attributes in process `syz.3.298'. [ 143.361010][ T5620] usb 1-1: Using ep0 maxpacket: 16 [ 143.363291][ T5620] usb 1-1: unable to get BOS descriptor or descriptor too short [ 143.364325][ T5620] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 143.366580][ T5620] usb 1-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 143.366601][ T5620] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 143.366616][ T5620] usb 1-1: Product: syz [ 143.366626][ T5620] usb 1-1: Manufacturer: syz [ 143.366637][ T5620] usb 1-1: SerialNumber: syz [ 143.581696][ T37] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 143.685260][ T5620] usb 1-1: Audio class v2/v3 interfaces need an interface association [ 143.705167][ T5620] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 143.733615][ T37] usb 4-1: unable to get BOS descriptor or descriptor too short [ 143.735374][ T37] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 143.735438][ T37] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 32 [ 143.735514][ T37] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 143.813520][ T37] usb 4-1: New USB device found, idVendor=09e8, idProduct=0062, bcdDevice= 0.40 [ 143.813554][ T37] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 143.813576][ T37] usb 4-1: Product: syz [ 143.813592][ T37] usb 4-1: Manufacturer: syz [ 143.813608][ T37] usb 4-1: SerialNumber: syz [ 143.864786][ T5620] usb 1-1: 2:1 : can't get High Capability descriptor [ 143.963728][ T6486] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 144.254187][ T6492] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 144.255877][ T6492] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 144.384082][ T32] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 144.591517][ T32] usb 2-1: Using ep0 maxpacket: 16 [ 144.595280][ T32] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 144.595328][ T32] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 144.595653][ T32] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 144.595682][ T32] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 144.634477][ T32] usb 2-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 144.634575][ T32] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 144.634599][ T32] usb 2-1: Product: syz [ 144.634615][ T32] usb 2-1: Manufacturer: syz [ 144.634630][ T32] usb 2-1: SerialNumber: syz [ 144.798569][ T32] usb 2-1: config 0 descriptor?? [ 144.917198][ T32] appledisplay 2-1:0.0: Submitting URB failed [ 144.917652][ T32] appledisplay 2-1:0.0: probe with driver appledisplay failed with error -5 [ 145.167755][ T32] usb 2-1: USB disconnect, device number 6 [ 145.190523][ T37] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 145.354836][ T37] usb 4-1: USB disconnect, device number 6 [ 145.386254][ T5620] usb 3-1: USB disconnect, device number 5 [ 146.004767][ T824] usb 1-1: USB disconnect, device number 7 [ 146.283128][ T6517] netlink: 20 bytes leftover after parsing attributes in process `syz.3.307'. [ 146.542106][ T6525] netlink: 16 bytes leftover after parsing attributes in process `syz.3.310'. [ 146.572497][ T6528] FAULT_INJECTION: forcing a failure. [ 146.572497][ T6528] name failslab, interval 1, probability 0, space 0, times 0 [ 146.572536][ T6528] CPU: 1 UID: 0 PID: 6528 Comm: syz.1.313 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 146.572554][ T6528] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 146.572564][ T6528] Call Trace: [ 146.572570][ T6528] [ 146.572577][ T6528] dump_stack_lvl+0xe8/0x150 [ 146.572601][ T6528] should_fail_ex+0x46b/0x600 [ 146.572630][ T6528] should_failslab+0xa8/0x100 [ 146.572653][ T6528] __kmalloc_noprof+0xdf/0x7b0 [ 146.572672][ T6528] ? kfree+0x4d/0x6c0 [ 146.572688][ T6528] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 146.572712][ T6528] tomoyo_realpath_from_path+0xe3/0x5d0 [ 146.572733][ T6528] ? tomoyo_domain+0xd7/0x130 [ 146.572756][ T6528] ? tomoyo_path_number_perm+0x219/0x630 [ 146.572782][ T6528] tomoyo_path_number_perm+0x246/0x630 [ 146.572809][ T6528] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 146.572834][ T6528] ? __lock_acquire+0x6b5/0x2d10 [ 146.572855][ T6528] ? do_raw_spin_lock+0x12b/0x2f0 [ 146.572897][ T6528] ? __fget_files+0x2a/0x420 [ 146.572918][ T6528] ? __fget_files+0x2a/0x420 [ 146.572936][ T6528] ? __fget_files+0x3a6/0x420 [ 146.572953][ T6528] ? __fget_files+0x2a/0x420 [ 146.572975][ T6528] security_file_ioctl+0xc3/0x2a0 [ 146.573000][ T6528] __se_sys_ioctl+0x47/0x170 [ 146.573024][ T6528] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 146.573041][ T6528] do_syscall_64+0x174/0x580 [ 146.573065][ T6528] ? trace_irq_disable+0x3b/0x140 [ 146.573083][ T6528] ? clear_bhb_loop+0x40/0x90 [ 146.573103][ T6528] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 146.573119][ T6528] RIP: 0033:0x7fbdc6a6ce59 [ 146.573134][ T6528] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 146.573147][ T6528] RSP: 002b:00007fbdc4cc6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 146.573163][ T6528] RAX: ffffffffffffffda RBX: 00007fbdc6ce5fa0 RCX: 00007fbdc6a6ce59 [ 146.573175][ T6528] RDX: 9999999999999999 RSI: 0000000000005415 RDI: 0000000000000003 [ 146.573186][ T6528] RBP: 00007fbdc4cc6090 R08: 0000000000000000 R09: 0000000000000000 [ 146.573195][ T6528] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 146.573204][ T6528] R13: 00007fbdc6ce6038 R14: 00007fbdc6ce5fa0 R15: 00007ffe2a066738 [ 146.573228][ T6528] [ 146.573235][ T6528] ERROR: Out of memory at tomoyo_realpath_from_path. [ 146.844682][ T6530] trusted_key: encrypted_key: insufficient parameters specified [ 147.282825][ T6541] netlink: 20 bytes leftover after parsing attributes in process `syz.1.318'. [ 148.171055][ T824] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 148.320981][ T824] usb 3-1: Using ep0 maxpacket: 8 [ 148.330699][ T824] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 148.331295][ T824] usb 3-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 148.331354][ T824] usb 3-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 148.331403][ T824] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 148.331430][ T824] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 148.422450][ T824] usbtmc 3-1:16.0: bulk endpoints not found [ 148.569076][ T6581] netlink: 112 bytes leftover after parsing attributes in process `syz.1.334'. [ 148.569133][ T6581] netlink: 32 bytes leftover after parsing attributes in process `syz.1.334'. [ 148.620126][ T823] usb 3-1: USB disconnect, device number 6 [ 149.550922][ T823] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 149.700878][ T823] usb 3-1: Using ep0 maxpacket: 8 [ 149.703793][ T823] usb 3-1: config 0 has no interfaces? [ 149.703833][ T823] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 149.703859][ T823] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 149.750457][ T823] usb 3-1: config 0 descriptor?? [ 150.492123][ T824] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 150.664824][ T824] usb 2-1: unable to get BOS descriptor or descriptor too short [ 150.666482][ T824] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 150.666509][ T824] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 150.670238][ T824] usb 2-1: string descriptor 0 read error: -22 [ 150.670392][ T824] usb 2-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 150.670427][ T824] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 150.763987][ T824] usb 2-1: selecting invalid altsetting 1 [ 150.765123][ T824] usb 2-1: unit 6 not found! [ 151.491794][ T37] usb 4-1: new low-speed USB device number 7 using dummy_hcd [ 151.508170][ T823] usb 3-1: USB disconnect, device number 7 [ 151.570929][ T6584] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 151.571968][ T6584] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 151.574636][ T824] usb 2-1: 2:0: failed to get current value for ch 0 (-71) [ 151.644414][ T37] usb 4-1: unable to get BOS descriptor or descriptor too short [ 151.647578][ T37] usb 4-1: config 1 has an invalid descriptor of length 42, skipping remainder of the config [ 151.647626][ T37] usb 4-1: config 1 interface 0 altsetting 8 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 151.647654][ T37] usb 4-1: config 1 interface 0 has no altsetting 0 [ 151.745759][ T37] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 151.745793][ T37] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 151.950648][ T824] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 151.976041][ T824] usb 2-1: USB disconnect, device number 7 [ 152.026302][ T37] cdc_ether 4-1:1.0: skipping garbage [ 152.026614][ T37] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -22 [ 152.058437][ T37] usb 4-1: USB disconnect, device number 7 [ 152.514910][ T5620] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 152.671010][ T5620] usb 1-1: Using ep0 maxpacket: 8 [ 152.675766][ T5620] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 152.675800][ T5620] usb 1-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 152.675847][ T5620] usb 1-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 152.675890][ T5620] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 152.675915][ T5620] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 152.739160][ T5620] usbtmc 1-1:16.0: bulk endpoints not found [ 153.457183][ T6646] FAULT_INJECTION: forcing a failure. [ 153.457183][ T6646] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 153.457220][ T6646] CPU: 0 UID: 0 PID: 6646 Comm: syz.2.357 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 153.457246][ T6646] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 153.457260][ T6646] Call Trace: [ 153.457268][ T6646] [ 153.457277][ T6646] dump_stack_lvl+0xe8/0x150 [ 153.457310][ T6646] should_fail_ex+0x46b/0x600 [ 153.457349][ T6646] _copy_from_iter+0x1d3/0x1670 [ 153.457380][ T6646] ? trace_kmem_cache_alloc+0x29/0xe0 [ 153.457407][ T6646] ? __alloc_skb+0x27d/0x7d0 [ 153.457441][ T6646] ? __pfx__copy_from_iter+0x10/0x10 [ 153.457462][ T6646] ? kmem_cache_alloc_node_noprof+0x27c/0x6e0 [ 153.457489][ T6646] ? __alloc_skb+0x27d/0x7d0 [ 153.457526][ T6646] ? netlink_sendmsg+0x650/0xb40 [ 153.457547][ T6646] ? skb_put+0x11b/0x210 [ 153.457583][ T6646] netlink_sendmsg+0x6c0/0xb40 [ 153.457614][ T6646] ? __pfx_netlink_sendmsg+0x10/0x10 [ 153.457639][ T6646] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 153.457673][ T6646] ? aa_sock_msg_perm+0x122/0x200 [ 153.457698][ T6646] ? __pfx_netlink_sendmsg+0x10/0x10 [ 153.457719][ T6646] sock_sendmsg_nosec+0x13a/0x180 [ 153.457750][ T6646] ____sys_sendmsg+0x55c/0x870 [ 153.457798][ T6646] ? __pfx_____sys_sendmsg+0x10/0x10 [ 153.457842][ T6646] ? import_iovec+0x73/0xa0 [ 153.457871][ T6646] ___sys_sendmsg+0x2a5/0x360 [ 153.457905][ T6646] ? __lock_acquire+0x6b5/0x2d10 [ 153.457936][ T6646] ? __pfx____sys_sendmsg+0x10/0x10 [ 153.458008][ T6646] ? __fget_files+0x2a/0x420 [ 153.458034][ T6646] ? __fget_files+0x3a6/0x420 [ 153.458072][ T6646] __x64_sys_sendmsg+0x1c3/0x2a0 [ 153.458110][ T6646] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 153.458156][ T6646] ? __pfx_ksys_write+0x10/0x10 [ 153.458197][ T6646] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 153.458222][ T6646] do_syscall_64+0x174/0x580 [ 153.458256][ T6646] ? trace_irq_disable+0x3b/0x140 [ 153.458281][ T6646] ? clear_bhb_loop+0x40/0x90 [ 153.458309][ T6646] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 153.458332][ T6646] RIP: 0033:0x7f600bd2ce59 [ 153.458352][ T6646] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 153.458371][ T6646] RSP: 002b:00007f6009f86028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 153.458394][ T6646] RAX: ffffffffffffffda RBX: 00007f600bfa5fa0 RCX: 00007f600bd2ce59 [ 153.458411][ T6646] RDX: 0000000000000000 RSI: 0000200000000a00 RDI: 0000000000000003 [ 153.458425][ T6646] RBP: 00007f6009f86090 R08: 0000000000000000 R09: 0000000000000000 [ 153.458439][ T6646] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 153.458452][ T6646] R13: 00007f600bfa6038 R14: 00007f600bfa5fa0 R15: 00007ffdd76f0fd8 [ 153.458487][ T6646] [ 153.608781][ T824] usb 1-1: USB disconnect, device number 8 [ 154.037188][ T6654] overlayfs: option "workdir=./cgroup" is useless in a non-upper mount, ignore [ 154.037258][ T6654] overlayfs: missing 'lowerdir' [ 154.055129][ T37] usb 2-1: new low-speed USB device number 8 using dummy_hcd [ 154.220300][ T37] usb 2-1: unable to get BOS descriptor or descriptor too short [ 154.230209][ T37] usb 2-1: config 1 has an invalid descriptor of length 42, skipping remainder of the config [ 154.230295][ T37] usb 2-1: config 1 interface 0 altsetting 8 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 154.230326][ T37] usb 2-1: config 1 interface 0 has no altsetting 0 [ 154.240544][ T37] usb 2-1: string descriptor 0 read error: -22 [ 154.240698][ T37] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 154.249374][ T37] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 154.318242][ T37] cdc_ether 2-1:1.0: skipping garbage [ 154.318535][ T37] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -22 [ 154.541075][ T37] usb 2-1: USB disconnect, device number 8 [ 154.842245][ T824] usb 4-1: new full-speed USB device number 8 using dummy_hcd [ 155.032048][ T824] usb 4-1: too many endpoints for config 1 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 155.032101][ T824] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 155.032133][ T824] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 155.032157][ T824] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 255 [ 155.039867][ T824] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 155.039902][ T824] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 155.039926][ T824] usb 4-1: SerialNumber: syz [ 155.141526][ T824] cdc_acm 4-1:1.0: probe with driver cdc_acm failed with error -12 [ 155.332425][ T824] usb 4-1: USB disconnect, device number 8 [ 155.858053][ T6690] syz.1.378 uses obsolete (PF_INET,SOCK_PACKET) [ 156.382243][ T824] usb 1-1: new low-speed USB device number 9 using dummy_hcd [ 156.424453][ T6718] loop2: detected capacity change from 0 to 7 [ 156.471866][ T6718] Dev loop2: unable to read RDB block 7 [ 156.471912][ T6718] loop2: unable to read partition table [ 156.472200][ T6718] loop2: partition table beyond EOD, truncated [ 156.472239][ T6718] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 156.554234][ T824] usb 1-1: unable to get BOS descriptor or descriptor too short [ 156.556278][ T824] usb 1-1: config 1 has an invalid descriptor of length 42, skipping remainder of the config [ 156.556335][ T824] usb 1-1: config 1 interface 0 altsetting 8 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 156.556364][ T824] usb 1-1: config 1 interface 0 has no altsetting 0 [ 156.582045][ T824] usb 1-1: string descriptor 0 read error: -22 [ 156.582278][ T824] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 156.582352][ T824] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 156.647759][ T824] cdc_ether 1-1:1.0: skipping garbage [ 156.648048][ T824] cdc_ether 1-1:1.0: probe with driver cdc_ether failed with error -22 [ 156.851740][ T5620] usb 1-1: USB disconnect, device number 9 [ 157.791322][ T5723] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 157.944713][ T5723] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 157.944746][ T5723] usb 1-1: config 0 has no interface number 0 [ 157.944793][ T5723] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 157.944823][ T5723] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 157.944848][ T5723] usb 1-1: config 0 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 157.944892][ T5723] usb 1-1: New USB device found, idVendor=28bd, idProduct=0042, bcdDevice= 0.00 [ 157.944916][ T5723] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 158.022365][ T5723] usb 1-1: config 0 descriptor?? [ 158.235942][ T6757] binder: 6756:6757 ioctl c0306201 2000000001c0 returned -14 [ 158.856752][ T6746] netlink: 128 bytes leftover after parsing attributes in process `syz.0.397'. [ 158.883096][ T6746] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 158.911920][ T5723] uclogic 0003:28BD:0042.0002: failed retrieving string descriptor #100: -71 [ 158.911987][ T5723] uclogic 0003:28BD:0042.0002: failed retrieving pen parameters: -71 [ 158.912019][ T5723] uclogic 0003:28BD:0042.0002: pen probing failed: -71 [ 158.912040][ T5723] uclogic 0003:28BD:0042.0002: failed probing parameters: -71 [ 158.912163][ T5723] uclogic 0003:28BD:0042.0002: probe with driver uclogic failed with error -71 [ 158.964639][ T5723] usb 1-1: USB disconnect, device number 10 [ 159.358002][ T6781] usb usb9: usbfs: process 6781 (syz.3.415) did not claim interface 0 before use [ 159.440912][ T5723] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 159.571331][ T5723] usb 3-1: device descriptor read/64, error -71 [ 159.637999][ T6786] evm: overlay not supported [ 159.830886][ T5723] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 159.962078][ T5723] usb 3-1: device descriptor read/64, error -71 [ 160.080937][ T5723] usb usb3-port1: attempt power cycle [ 160.391186][ T37] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 160.470897][ T5723] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 160.494075][ T5723] usb 3-1: device descriptor read/8, error -71 [ 160.526978][ T37] usb 2-1: device descriptor read/64, error -71 [ 160.731357][ T5723] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 160.752874][ T5723] usb 3-1: device descriptor read/8, error -71 [ 160.781032][ T37] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 160.837301][ T6802] lo speed is unknown, defaulting to 1000 [ 160.862008][ T5723] usb usb3-port1: unable to enumerate USB device [ 160.910916][ T37] usb 2-1: device descriptor read/64, error -71 [ 160.990916][ T9] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 161.021243][ T37] usb usb2-port1: attempt power cycle [ 161.160929][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 161.163258][ T9] usb 4-1: config 32 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 161.163311][ T9] usb 4-1: New USB device found, idVendor=19b5, idProduct=0021, bcdDevice=98.c7 [ 161.163336][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 161.360884][ T37] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 161.381863][ T37] usb 2-1: device descriptor read/8, error -71 [ 161.428972][ T6800] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 161.429568][ T6800] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 161.474492][ T6800] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 161.493553][ T6800] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 161.532991][ T38] audit: type=1326 audit(1780150208.386:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6801 comm="syz.0.425" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3ea127ce59 code=0x0 [ 161.630941][ T37] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 161.655303][ T37] usb 2-1: device descriptor read/8, error -71 [ 161.675948][ T9] usb 4-1: string descriptor 0 read error: -71 [ 161.676618][ T9] hub 4-1:32.0: USB hub found [ 161.687925][ T9] hub 4-1:32.0: config failed, can't read hub descriptor (err -22) [ 161.761260][ T37] usb usb2-port1: unable to enumerate USB device [ 162.736416][ T9] usb 4-1: USB disconnect, device number 9 [ 164.121436][ T824] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 164.383489][ T824] usb 2-1: Using ep0 maxpacket: 16 [ 164.390085][ T824] usb 2-1: config index 0 descriptor too short (expected 60178, got 18) [ 164.390144][ T824] usb 2-1: config 0 has an invalid interface number: 0 but max is -1 [ 164.390167][ T824] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 164.429351][ T824] usb 2-1: New USB device found, idVendor=0c72, idProduct=0013, bcdDevice=ba.be [ 164.429385][ T824] usb 2-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 164.429410][ T824] usb 2-1: Product: syz [ 164.429426][ T824] usb 2-1: Manufacturer: syz [ 164.429441][ T824] usb 2-1: SerialNumber: syz [ 164.479761][ T824] usb 2-1: config 0 descriptor?? [ 165.076061][ T824] peak_usb 2-1:0.0 can0: unable to request usb[type=0 value=1] err=-71 [ 165.076094][ T824] peak_usb 2-1:0.0: unable to read PCAN-Chip USB firmware info (err -71) [ 165.169334][ T6836] i2c i2c-0: Frontend requested software zigzag, but didn't set the frequency step size [ 165.262265][ T6830] [ 165.262278][ T6830] ====================================================== [ 165.262287][ T6830] WARNING: possible circular locking dependency detected [ 165.262309][ T6830] syzkaller #0 Not tainted [ 165.262320][ T6830] ------------------------------------------------------ [ 165.262329][ T6830] syz.2.435/6830 is trying to acquire lock: [ 165.262340][ T6830] ffff88801c2bb2c0 (&root->kernfs_iattr_rwsem){++++}-{4:4}, at: kernfs_link_sibling+0x4ed/0x5c0 [ 165.262401][ T6830] [ 165.262401][ T6830] but task is already holding lock: [ 165.262407][ T6830] ffff88801c2bb238 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_add_one+0x41/0x5d0 [ 165.262453][ T6830] [ 165.262453][ T6830] which lock already depends on the new lock. [ 165.262453][ T6830] [ 165.262461][ T6830] [ 165.262461][ T6830] the existing dependency chain (in reverse order) is: [ 165.262468][ T6830] [ 165.262468][ T6830] -> #10 (&root->kernfs_rwsem){++++}-{4:4}: [ 165.262498][ T6830] down_write+0x3a/0x50 [ 165.262518][ T6830] kernfs_add_one+0x41/0x5d0 [ 165.262543][ T6830] kernfs_create_dir_ns+0xde/0x130 [ 165.262567][ T6830] internal_create_group+0x425/0x1190 [ 165.262591][ T6830] cpuhp_invoke_callback+0x445/0x860 [ 165.262612][ T6830] cpuhp_issue_call+0x430/0x7a0 [ 165.262653][ T6830] __cpuhp_setup_state_cpuslocked+0x3d9/0x6b0 [ 165.262687][ T6830] __cpuhp_setup_state+0x3f/0x60 [ 165.262718][ T6830] do_one_initcall+0x250/0x870 [ 165.262744][ T6830] do_initcall_level+0x104/0x190 [ 165.262768][ T6830] do_initcalls+0x59/0xa0 [ 165.262790][ T6830] kernel_init_freeable+0x2a6/0x3e0 [ 165.262813][ T6830] kernel_init+0x1d/0x1d0 [ 165.262834][ T6830] ret_from_fork+0x514/0xb70 [ 165.262858][ T6830] ret_from_fork_asm+0x1a/0x30 [ 165.262885][ T6830] [ 165.262885][ T6830] -> #9 (cpuhp_state_mutex){+.+.}-{4:4}: [ 165.262915][ T6830] [ 165.262915][ T6830] -> #8 (cpu_hotplug_lock){++++}-{0:0}: [ 165.262943][ T6830] cpus_read_lock+0x42/0x160 [ 165.262966][ T6830] static_key_disable+0x12/0x20 [ 165.262983][ T6830] __inet_hash_connect+0x2623/0x2630 [ 165.263002][ T6830] tcp_v4_connect+0xd5f/0x19b0 [ 165.263027][ T6830] __inet_stream_connect+0x25a/0xdd0 [ 165.263055][ T6830] inet_stream_connect+0x66/0xa0 [ 165.263076][ T6830] __sys_connect+0x315/0x450 [ 165.263100][ T6830] __x64_sys_connect+0x7a/0x90 [ 165.263123][ T6830] do_syscall_64+0x174/0x580 [ 165.263151][ T6830] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 165.263168][ T6830] [ 165.263168][ T6830] -> #7 (sk_lock-AF_INET){+.+.}-{0:0}: [ 165.263191][ T6830] lock_sock_nested+0x41/0x130 [ 165.263211][ T6830] inet_shutdown+0x6a/0x390 [ 165.263232][ T6830] nbd_mark_nsock_dead+0x2e9/0x560 [ 165.263251][ T6830] recv_work+0x1c4c/0x1d60 [ 165.263269][ T6830] process_one_work+0x98b/0x1630 [ 165.263294][ T6830] worker_thread+0xb49/0x1140 [ 165.263319][ T6830] kthread+0x388/0x470 [ 165.263336][ T6830] ret_from_fork+0x514/0xb70 [ 165.263354][ T6830] ret_from_fork_asm+0x1a/0x30 [ 165.263377][ T6830] [ 165.263377][ T6830] -> #6 (&nsock->tx_lock){+.+.}-{4:4}: [ 165.263400][ T6830] mutex_lock_nested+0x5a/0x1d0 [ 165.263419][ T6830] nbd_queue_rq+0x37b/0x1100 [ 165.263436][ T6830] blk_mq_dispatch_rq_list+0xa77/0x1910 [ 165.263462][ T6830] __blk_mq_sched_dispatch_requests+0xddb/0x1610 [ 165.263491][ T6830] blk_mq_sched_dispatch_requests+0xda/0x1a0 [ 165.263518][ T6830] blk_mq_run_hw_queue+0x368/0x520 [ 165.263541][ T6830] blk_mq_dispatch_list+0xd1f/0xe20 [ 165.263568][ T6830] blk_mq_flush_plug_list+0x48d/0x570 [ 165.263594][ T6830] __blk_flush_plug+0x3ed/0x4d0 [ 165.263619][ T6830] __submit_bio+0x28d/0x580 [ 165.263641][ T6830] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 165.263665][ T6830] block_read_full_folio+0x7b7/0x830 [ 165.263683][ T6830] filemap_read_folio+0x137/0x3b0 [ 165.263708][ T6830] do_read_cache_folio+0x2bf/0x560 [ 165.263733][ T6830] read_part_sector+0xb8/0x2b0 [ 165.263758][ T6830] adfspart_check_ICS+0xb1/0x960 [ 165.263784][ T6830] bdev_disk_changed+0x840/0x1780 [ 165.263810][ T6830] blkdev_get_whole+0x2e5/0x480 [ 165.263836][ T6830] bdev_open+0x31e/0xcc0 [ 165.263860][ T6830] blkdev_open+0x485/0x620 [ 165.263874][ T6830] do_dentry_open+0x83d/0x13e0 [ 165.263892][ T6830] vfs_open+0x3b/0x350 [ 165.263907][ T6830] path_openat+0x2eea/0x3960 [ 165.263931][ T6830] do_file_open+0x23e/0x4a0 [ 165.263953][ T6830] do_sys_openat2+0x115/0x200 [ 165.263971][ T6830] __x64_sys_openat+0x138/0x170 [ 165.263989][ T6830] do_syscall_64+0x174/0x580 [ 165.264015][ T6830] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 165.264032][ T6830] [ 165.264032][ T6830] -> #5 (&cmd->lock){+.+.}-{4:4}: [ 165.264055][ T6830] mutex_lock_nested+0x5a/0x1d0 [ 165.264073][ T6830] nbd_queue_rq+0xc6/0x1100 [ 165.264090][ T6830] blk_mq_dispatch_rq_list+0xa77/0x1910 [ 165.264116][ T6830] __blk_mq_sched_dispatch_requests+0xddb/0x1610 [ 165.264145][ T6830] blk_mq_sched_dispatch_requests+0xda/0x1a0 [ 165.264173][ T6830] blk_mq_run_hw_queue+0x368/0x520 [ 165.264196][ T6830] blk_mq_dispatch_list+0xd1f/0xe20 [ 165.264222][ T6830] blk_mq_flush_plug_list+0x48d/0x570 [ 165.264248][ T6830] __blk_flush_plug+0x3ed/0x4d0 [ 165.264273][ T6830] __submit_bio+0x28d/0x580 [ 165.264287][ T6830] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 165.264312][ T6830] block_read_full_folio+0x7b7/0x830 [ 165.264328][ T6830] filemap_read_folio+0x137/0x3b0 [ 165.264352][ T6830] do_read_cache_folio+0x2bf/0x560 [ 165.264376][ T6830] read_part_sector+0xb8/0x2b0 [ 165.264400][ T6830] adfspart_check_ICS+0xb1/0x960 [ 165.264426][ T6830] bdev_disk_changed+0x840/0x1780 [ 165.264450][ T6830] blkdev_get_whole+0x2e5/0x480 [ 165.264476][ T6830] bdev_open+0x31e/0xcc0 [ 165.264499][ T6830] blkdev_open+0x485/0x620 [ 165.264514][ T6830] do_dentry_open+0x83d/0x13e0 [ 165.264530][ T6830] vfs_open+0x3b/0x350 [ 165.264546][ T6830] path_openat+0x2eea/0x3960 [ 165.264569][ T6830] do_file_open+0x23e/0x4a0 [ 165.264591][ T6830] do_sys_openat2+0x115/0x200 [ 165.264609][ T6830] __x64_sys_openat+0x138/0x170 [ 165.264632][ T6830] do_syscall_64+0x174/0x580 [ 165.264658][ T6830] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 165.264675][ T6830] [ 165.264675][ T6830] -> #4 (set->srcu){.+.+}-{0:0}: [ 165.264697][ T6830] __synchronize_srcu+0xca/0x300 [ 165.264718][ T6830] elevator_switch+0x1e8/0x7a0 [ 165.264742][ T6830] elevator_change+0x2cc/0x450 [ 165.264766][ T6830] elevator_set_default+0x36c/0x430 [ 165.264790][ T6830] blk_register_queue+0x3e9/0x4e0 [ 165.264805][ T6830] __add_disk+0x677/0xd50 [ 165.264822][ T6830] add_disk_fwnode+0xfb/0x480 [ 165.264839][ T6830] nbd_dev_add+0x72c/0xb50 [ 165.264855][ T6830] nbd_init+0x168/0x1f0 [ 165.264873][ T6830] do_one_initcall+0x250/0x870 [ 165.264893][ T6830] do_initcall_level+0x104/0x190 [ 165.264911][ T6830] do_initcalls+0x59/0xa0 [ 165.264927][ T6830] kernel_init_freeable+0x2a6/0x3e0 [ 165.264945][ T6830] kernel_init+0x1d/0x1d0 [ 165.264963][ T6830] ret_from_fork+0x514/0xb70 [ 165.264981][ T6830] ret_from_fork_asm+0x1a/0x30 [ 165.265003][ T6830] [ 165.265003][ T6830] -> #3 (&q->elevator_lock){+.+.}-{4:4}: [ 165.265026][ T6830] mutex_lock_nested+0x5a/0x1d0 [ 165.265045][ T6830] elevator_change+0x1b3/0x450 [ 165.265068][ T6830] elevator_set_none+0xb5/0x140 [ 165.265092][ T6830] blk_mq_update_nr_hw_queues+0x607/0x1a80 [ 165.265110][ T6830] nbd_start_device+0x17f/0xb20 [ 165.265127][ T6830] nbd_genl_connect+0x1651/0x1c80 [ 165.265146][ T6830] genl_family_rcv_msg_doit+0x22a/0x330 [ 165.265168][ T6830] genl_rcv_msg+0x61c/0x7a0 [ 165.265187][ T6830] netlink_rcv_skb+0x232/0x4b0 [ 165.265213][ T6830] genl_rcv+0x28/0x40 [ 165.265231][ T6830] netlink_unicast+0x780/0x920 [ 165.265254][ T6830] netlink_sendmsg+0x813/0xb40 [ 165.265268][ T6830] sock_sendmsg_nosec+0x13a/0x180 [ 165.265287][ T6830] ____sys_sendmsg+0x55c/0x870 [ 165.265313][ T6830] ___sys_sendmsg+0x2a5/0x360 [ 165.265339][ T6830] __x64_sys_sendmsg+0x1c3/0x2a0 [ 165.265366][ T6830] do_syscall_64+0x174/0x580 [ 165.265392][ T6830] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 165.265408][ T6830] [ 165.265408][ T6830] -> #2 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 165.265436][ T6830] blk_alloc_queue+0x54e/0x690 [ 165.265459][ T6830] __blk_mq_alloc_disk+0x197/0x390 [ 165.265475][ T6830] nbd_dev_add+0x499/0xb50 [ 165.265490][ T6830] nbd_init+0x168/0x1f0 [ 165.265508][ T6830] do_one_initcall+0x250/0x870 [ 165.265531][ T6830] do_initcall_level+0x104/0x190 [ 165.265548][ T6830] do_initcalls+0x59/0xa0 [ 165.265564][ T6830] kernel_init_freeable+0x2a6/0x3e0 [ 165.265582][ T6830] kernel_init+0x1d/0x1d0 [ 165.265599][ T6830] ret_from_fork+0x514/0xb70 [ 165.265617][ T6830] ret_from_fork_asm+0x1a/0x30 [ 165.265644][ T6830] [ 165.265644][ T6830] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 165.265667][ T6830] fs_reclaim_acquire+0x71/0x100 [ 165.265689][ T6830] kmem_cache_alloc_noprof+0x44/0x680 [ 165.265708][ T6830] __kernfs_iattrs+0xdf/0x320 [ 165.265726][ T6830] kernfs_iop_setattr+0xea/0x3f0 [ 165.265743][ T6830] notify_change+0xc18/0xf60 [ 165.265771][ T6830] do_truncate+0x1c2/0x250 [ 165.265795][ T6830] path_openat+0x306c/0x3960 [ 165.265818][ T6830] do_file_open+0x23e/0x4a0 [ 165.265841][ T6830] do_sys_openat2+0x115/0x200 [ 165.265859][ T6830] __x64_sys_openat+0x138/0x170 [ 165.265877][ T6830] do_syscall_64+0x174/0x580 [ 165.265902][ T6830] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 165.265919][ T6830] [ 165.265919][ T6830] -> #0 (&root->kernfs_iattr_rwsem){++++}-{4:4}: [ 165.265948][ T6830] __lock_acquire+0x15a5/0x2d10 [ 165.265968][ T6830] lock_acquire+0x106/0x350 [ 165.265986][ T6830] down_write+0x3a/0x50 [ 165.266000][ T6830] kernfs_link_sibling+0x4ed/0x5c0 [ 165.266021][ T6830] kernfs_add_one+0x1ca/0x5d0 [ 165.266041][ T6830] kernfs_create_dir_ns+0xde/0x130 [ 165.266063][ T6830] sysfs_create_dir_ns+0x12f/0x2a0 [ 165.266080][ T6830] kobject_add_internal+0x631/0xd10 [ 165.266099][ T6830] kobject_add+0x163/0x240 [ 165.266116][ T6830] elevator_change_done+0x28a/0x5f0 [ 165.266142][ T6830] elv_update_nr_hw_queues+0x22f/0x290 [ 165.266166][ T6830] blk_mq_update_nr_hw_queues+0x11cb/0x1a80 [ 165.266184][ T6830] nbd_start_device+0x17f/0xb20 [ 165.266201][ T6830] nbd_genl_connect+0x1651/0x1c80 [ 165.266218][ T6830] genl_family_rcv_msg_doit+0x22a/0x330 [ 165.266239][ T6830] genl_rcv_msg+0x61c/0x7a0 [ 165.266258][ T6830] netlink_rcv_skb+0x232/0x4b0 [ 165.266283][ T6830] genl_rcv+0x28/0x40 [ 165.266301][ T6830] netlink_unicast+0x780/0x920 [ 165.266324][ T6830] netlink_sendmsg+0x813/0xb40 [ 165.266338][ T6830] sock_sendmsg_nosec+0x13a/0x180 [ 165.266357][ T6830] ____sys_sendmsg+0x55c/0x870 [ 165.266383][ T6830] ___sys_sendmsg+0x2a5/0x360 [ 165.266408][ T6830] __x64_sys_sendmsg+0x1c3/0x2a0 [ 165.266434][ T6830] do_syscall_64+0x174/0x580 [ 165.266460][ T6830] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 165.266476][ T6830] [ 165.266476][ T6830] other info that might help us debug this: [ 165.266476][ T6830] [ 165.266482][ T6830] Chain exists of: [ 165.266482][ T6830] &root->kernfs_iattr_rwsem --> cpuhp_state_mutex --> &root->kernfs_rwsem [ 165.266482][ T6830] [ 165.266511][ T6830] Possible unsafe locking scenario: [ 165.266511][ T6830] [ 165.266516][ T6830] CPU0 CPU1 [ 165.266521][ T6830] ---- ---- [ 165.266527][ T6830] lock(&root->kernfs_rwsem); [ 165.266538][ T6830] lock(cpuhp_state_mutex); [ 165.266551][ T6830] lock(&root->kernfs_rwsem); [ 165.266563][ T6830] lock(&root->kernfs_iattr_rwsem); [ 165.266575][ T6830] [ 165.266575][ T6830] *** DEADLOCK *** [ 165.266575][ T6830] [ 165.266580][ T6830] 5 locks held by syz.2.435/6830: [ 165.266590][ T6830] #0: ffffffff8f61d740 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 165.266641][ T6830] #1: ffffffff8f61d558 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 165.266685][ T6830] #2: ffff888027f2b9b0 (&set->update_nr_hwq_lock){++++}-{4:4}, at: blk_mq_update_nr_hw_queues+0xbf/0x1a80 [ 165.266730][ T6830] #3: ffff888027f2b8c8 (&set->tag_list_lock){+.+.}-{4:4}, at: blk_mq_update_nr_hw_queues+0xd2/0x1a80 [ 165.266774][ T6830] #4: ffff88801c2bb238 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_add_one+0x41/0x5d0 [ 165.266819][ T6830] [ 165.266819][ T6830] stack backtrace: [ 165.266831][ T6830] CPU: 1 UID: 0 PID: 6830 Comm: syz.2.435 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 165.266852][ T6830] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 165.266863][ T6830] Call Trace: [ 165.266871][ T6830] [ 165.266878][ T6830] dump_stack_lvl+0xe8/0x150 [ 165.266901][ T6830] print_circular_bug+0x2e1/0x300 [ 165.266930][ T6830] check_noncircular+0x12e/0x150 [ 165.266958][ T6830] __lock_acquire+0x15a5/0x2d10 [ 165.266982][ T6830] ? __lock_acquire+0x6b5/0x2d10 [ 165.267009][ T6830] ? kernfs_link_sibling+0x4ed/0x5c0 [ 165.267031][ T6830] lock_acquire+0x106/0x350 [ 165.267051][ T6830] ? kernfs_link_sibling+0x4ed/0x5c0 [ 165.267080][ T6830] down_write+0x3a/0x50 [ 165.267096][ T6830] ? kernfs_link_sibling+0x4ed/0x5c0 [ 165.267117][ T6830] kernfs_link_sibling+0x4ed/0x5c0 [ 165.267145][ T6830] kernfs_add_one+0x1ca/0x5d0 [ 165.267169][ T6830] kernfs_create_dir_ns+0xde/0x130 [ 165.267193][ T6830] sysfs_create_dir_ns+0x12f/0x2a0 [ 165.267214][ T6830] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 165.267235][ T6830] ? rcu_is_watching+0x15/0xb0 [ 165.267261][ T6830] kobject_add_internal+0x631/0xd10 [ 165.267285][ T6830] kobject_add+0x163/0x240 [ 165.267306][ T6830] ? __pfx_kobject_add+0x10/0x10 [ 165.267325][ T6830] ? lockdep_hardirqs_on+0x7a/0x110 [ 165.267353][ T6830] ? rt_mutex_slowunlock+0x1cb/0x300 [ 165.267376][ T6830] elevator_change_done+0x28a/0x5f0 [ 165.267404][ T6830] ? __pfx_elevator_change_done+0x10/0x10 [ 165.267432][ T6830] ? elv_update_nr_hw_queues+0x20c/0x290 [ 165.267460][ T6830] elv_update_nr_hw_queues+0x22f/0x290 [ 165.267488][ T6830] blk_mq_update_nr_hw_queues+0x11cb/0x1a80 [ 165.267508][ T6830] ? lock_acquire+0x106/0x350 [ 165.267534][ T6830] ? __pfx_blk_mq_update_nr_hw_queues+0x10/0x10 [ 165.267585][ T6830] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 165.267610][ T6830] ? nbd_start_device+0x174/0xb20 [ 165.267637][ T6830] nbd_start_device+0x17f/0xb20 [ 165.267658][ T6830] ? device_create_file+0xf4/0x1b0 [ 165.267679][ T6830] nbd_genl_connect+0x1651/0x1c80 [ 165.267697][ T6830] ? __pfx___nla_validate_parse+0x10/0x10 [ 165.267721][ T6830] ? __pfx_nbd_genl_connect+0x10/0x10 [ 165.267743][ T6830] ? rcu_is_watching+0x15/0xb0 [ 165.267770][ T6830] ? __nla_parse+0x40/0x60 [ 165.267790][ T6830] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 165.267813][ T6830] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 165.267840][ T6830] genl_family_rcv_msg_doit+0x22a/0x330 [ 165.267866][ T6830] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 165.267893][ T6830] ? lockdep_hardirqs_on+0x7a/0x110 [ 165.267920][ T6830] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 165.267950][ T6830] genl_rcv_msg+0x61c/0x7a0 [ 165.267973][ T6830] ? __pfx_genl_rcv_msg+0x10/0x10 [ 165.267994][ T6830] ? __pfx_nbd_genl_connect+0x10/0x10 [ 165.268018][ T6830] netlink_rcv_skb+0x232/0x4b0 [ 165.268047][ T6830] ? __pfx_genl_rcv_msg+0x10/0x10 [ 165.268069][ T6830] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 165.268102][ T6830] ? netlink_deliver_tap+0x2e/0x1b0 [ 165.268132][ T6830] ? netlink_deliver_tap+0x2e/0x1b0 [ 165.268162][ T6830] genl_rcv+0x28/0x40 [ 165.268181][ T6830] netlink_unicast+0x780/0x920 [ 165.268211][ T6830] netlink_sendmsg+0x813/0xb40 [ 165.268231][ T6830] ? __pfx_netlink_sendmsg+0x10/0x10 [ 165.268249][ T6830] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 165.268273][ T6830] ? aa_sock_msg_perm+0x122/0x200 [ 165.268292][ T6830] ? __pfx_netlink_sendmsg+0x10/0x10 [ 165.268308][ T6830] sock_sendmsg_nosec+0x13a/0x180 [ 165.268331][ T6830] ____sys_sendmsg+0x55c/0x870 [ 165.268361][ T6830] ? __pfx_____sys_sendmsg+0x10/0x10 [ 165.268392][ T6830] ? import_iovec+0x73/0xa0 [ 165.268414][ T6830] ___sys_sendmsg+0x2a5/0x360 [ 165.268441][ T6830] ? __lock_acquire+0x6b5/0x2d10 [ 165.268463][ T6830] ? __pfx____sys_sendmsg+0x10/0x10 [ 165.268499][ T6830] ? futex_wait+0x2a2/0x390 [ 165.268527][ T6830] ? __fget_files+0x2a/0x420 [ 165.268549][ T6830] ? __fget_files+0x3a6/0x420 [ 165.268574][ T6830] __x64_sys_sendmsg+0x1c3/0x2a0 [ 165.268604][ T6830] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 165.268641][ T6830] ? rcu_is_watching+0x15/0xb0 [ 165.268670][ T6830] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 165.268689][ T6830] do_syscall_64+0x174/0x580 [ 165.268717][ T6830] ? trace_irq_disable+0x3b/0x140 [ 165.268737][ T6830] ? clear_bhb_loop+0x40/0x90 [ 165.268757][ T6830] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 165.268776][ T6830] RIP: 0033:0x7f600bd2ce59 [ 165.268792][ T6830] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 165.268808][ T6830] RSP: 002b:00007f6009f86028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 165.268828][ T6830] RAX: ffffffffffffffda RBX: 00007f600bfa5fa0 RCX: 00007f600bd2ce59 [ 165.268846][ T6830] RDX: 0000000000000004 RSI: 0000200000001ac0 RDI: 0000000000000006 [ 165.268858][ T6830] RBP: 00007f600bdc2d6f R08: 0000000000000000 R09: 0000000000000000 [ 165.268870][ T6830] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 165.268881][ T6830] R13: 00007f600bfa6038 R14: 00007f600bfa5fa0 R15: 00007ffdd76f0fd8 [ 165.268903][ T6830] [ 165.548866][ T37] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 165.654910][ T824] peak_usb 2-1:0.0: probe with driver peak_usb failed with error -71 [ 165.714036][ T824] usb 2-1: USB disconnect, device number 13 [ 165.740841][ T37] usb 4-1: Using ep0 maxpacket: 32 [ 165.754769][ T37] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 165.754805][ T37] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 165.820557][ T37] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 165.820591][ T37] usb 4-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 165.820614][ T37] usb 4-1: Product: syz [ 165.820630][ T37] usb 4-1: Manufacturer: syz [ 166.207631][ T37] hub 4-1:4.0: bad descriptor, ignoring hub [ 166.207662][ T37] hub 4-1:4.0: probe with driver hub failed with error -5 [ 166.328616][ T37] usbhid 4-1:4.0: couldn't find an input interrupt endpoint [ 166.694707][ T37] usb 4-1: USB disconnect, device number 10