last executing test programs: 8.320834021s ago: executing program 3 (id=8238): r0 = socket(0x10, 0x3, 0x0) syz_open_dev$dvb_frontend(&(0x7f00000002c0), 0x0, 0x2840) socket$inet_icmp_raw(0x2, 0x3, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) setfsgid(0xee00) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='syscall\x00') sendmsg$inet(0xffffffffffffffff, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000000300), 0x0, &(0x7f0000001480)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @private, @multicast1}}}], 0x20}, 0x0) r2 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, 0xffffffffffffffff, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000002700)=""/102392, 0x18ff8) read$FUSE(r1, &(0x7f000001b700)={0x2020}, 0x2020) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) syz_open_dev$tty1(0xc, 0x4, 0x1) openat$binfmt(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x0, 0x413, &(0x7f0000000340)={{}, 0x2c, {'rootmode', 0x3d, 0x8000}}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0xc000}, 0xc018) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x9}, 0x50) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@newqdisc={0x34, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_codel={{0xa}, {0x4}}]}, 0x34}}, 0x2000400c) r6 = socket$inet6(0x10, 0x3, 0x0) sendmsg$NFNL_MSG_CTHELPER_NEW(r0, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x64, 0x0, 0x9, 0x101, 0x0, 0x0, {0x2, 0x0, 0x6}, [@NFCTH_STATUS={0x8, 0x6, 0x1, 0x0, 0x1}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x81}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0xe}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x1a}, @NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8, 0x1, 0x1, 0x0, 0x3ff}}, @NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8, 0x1, 0x1, 0x0, 0x80000001}}, @NFCTH_TUPLE={0x18, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2d}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x80}, 0x4004) sendto$inet6(r6, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) socket$nl_route(0x10, 0x3, 0x0) 8.048682624s ago: executing program 3 (id=8239): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x50110, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWSET={0x14, 0x12, 0xa, 0x9, 0x0, 0x0, {0x2}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x3c}}, 0x0) mremap(&(0x7f0000fc4000/0x4000)=nil, 0x4000, 0x1000, 0x7, &(0x7f0000fc5000/0x1000)=nil) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0xc4) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x24004840) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102400, 0x19000) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x2, 0x4, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x4, 0x0, 0xfffffffffffffffc, 0x0, 0x0, '\x00', 0x0, 0x30}, 0x94) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x8001, 0x2, {0xffffffffffffffff}, {0xee01}, 0x401}) r2 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) write$6lowpan_enable(r2, &(0x7f00000002c0)='1', 0x1) 7.710144235s ago: executing program 3 (id=8241): r0 = socket$inet6_udp(0xa, 0x2, 0x0) timer_create(0x3, 0x0, &(0x7f0000044000)) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000005580)=""/102392, 0x18ff8) removexattr(&(0x7f00000002c0)='./cgroup.cpu/cgroup.procs\x00', &(0x7f0000000000)=@known='security.apparmor\x00') r2 = syz_open_dev$video(&(0x7f0000000040), 0x3ff, 0x0) ioctl$VIDIOC_STREAMOFF(r2, 0x40045613, &(0x7f0000000200)=0x1) setsockopt$inet6_int(r0, 0x29, 0x12, &(0x7f00000002c0)=0x804, 0x4) syz_usb_connect$midi(0x3, 0x24, &(0x7f0000000080)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x10, 0x1430, 0x474b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x1, 0xf8, 0x110, 0x4, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x3, 0x30, 0x9}}}}}]}}, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x8, [{0xd2, &(0x7f00000000c0)=@string={0xd2, 0x3, "35d030018f80a1531f748b99beaaf98aef8b9d8e9408d578e3b28217db1db0b79ddaad212f8680221a5e83c1a1e0c4613cfffc228e29b82e9b33c0b8edd4d40d2e59d0ca661ab4988752da4c049442f23a82e97f6c4eacd98837a5ef0d4aa40367dbb5956e569745ee7dd962a819586883462376c1e4306a2cd7b963d6ebeb20f85909ca27ea7dfe02b176daf8bfdc57fc2b9335a897c47ce0e65468483001d452f4d9ea5b2a1c6b6f195cfb68e78060784fad2072a07868bff9a2fd7035e4bffde72ed4ab900ec34f672e9d18365bab"}}, {0xc3, &(0x7f00000001c0)=@string={0xc3, 0x3, "17499e8c587e612776736d03f1211ea9b9078cfbf705d0e5240154952548a99fd623ef6d9d874d369942b51ca252707ac6411329ef26bb67118c02632e0b5645ab05f6248050478fa71f2923a6261e7da23075c411a6a67f0e56ae79e2ff0787147d977ce5f8a3454c86eeb2f0ce0375c8e07a5a189f22ac30f609dc6fdbc38dc78988f9289faf38a68406e8f7830a7601a091f1894b80a855712d3d86dc4847ecdeaf1c9627de631853c4d6be924fdf17a7b1df77ea2af881db84b1fd733e8196"}}, {0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x457}}, {0x2c, &(0x7f0000000000)=@string={0x2c, 0x3, "4c00d5c758a512ffd357eff972cb917a370fff181a5ae463b7164a253f294cc95205785b531ab8a403b9"}}, {0xe4, &(0x7f0000000340)=@string={0xe4, 0x3, "ce1a576a6fbf47c7f78969f169b2d404f0d27b998628f3eaf1e711d8e2de85bf7d1a57941b7eacec69d660813752f3c69d45ecd1c47acd2b825360bd9ed7797df11e3cb58e7ae0df1782a80654abb3acd21ad329d2796734b4e2ebc794f8eb553ba0715ae38c44a93c45d4a16d67bdcced8beed7668d0037d7cbbdd006fe0a1d5d51b253ce57ede4c57a0a8c53e7b4886e8dfcd513f62d2299fa2efb96880ee6876b27166692123b02bf8e5890aee549dc6abfcffe7252872cd90d716b442f1aa9fc85c25e5931307392858617124c7a844473a0279d580c0e07eba70ccfc80ff90e"}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x438}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x407}}, {0xba, &(0x7f0000000500)=@string={0xba, 0x3, "cc8f09dd82c8da58362effb95287b8ae23f5f963616d791e43fcfa06bf4677ba644a2ed33ffe60bf4a19f36dacdd41a0805c6e370a889ac60fefeb55d3bb6b0769cde4c2e02aa922d0f2c84fbcc6c983572427ade79666369cf65ed772a5febe7cb4310c5b92627fc71e1bec77cf91bafac8ac038f0b393570531535436eca187003a72474a84cfd75801b55ba8bef9ce8ab39adf74db01d47a8aab6d0147b44ca5ae7b79c28360cef40846693cdbb38f781b7be42d89a6c"}}]}) 6.557742819s ago: executing program 1 (id=8245): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = semget$private(0x0, 0x4000000009, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_BLANKSCREEN(r2, 0x560e, &(0x7f0000000000)) ioctl$KDSKBENT(r2, 0x4b47, &(0x7f0000000180)={0x2, 0x3, 0x40}) ioctl$TIOCSWINSZ(r2, 0x5414, &(0x7f0000000040)={0x9, 0x2, 0x1000, 0x6}) semop(r1, 0x0, 0x0) semctl$IPC_RMID(r1, 0x0, 0x0) pipe(&(0x7f0000002680)) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() sched_setaffinity(0x0, 0x4f, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x0, &(0x7f0000000240)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x0, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) 5.758403567s ago: executing program 1 (id=8251): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)=0x0) r2 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) ioctl$FE_GET_EVENT(r2, 0x80286f4e, &(0x7f0000000100)) timer_settime(r1, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x17, 0x0, 0x4, 0xff, 0x0, 0x1}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005800000095"], 0x0}, 0x90) r4 = syz_create_resource$binfmt(&(0x7f0000000000)='./file0\x00') r5 = openat$binfmt(0xffffffffffffff9c, r4, 0x41, 0x1ff) fcntl$setlease(r5, 0x400, 0x1) open$dir(&(0x7f0000000100)='./file0\x00', 0x4000, 0xc) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000680)=@base={0x4, 0x4, 0x4, 0x10005}, 0x50) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r6, 0x58, &(0x7f0000000340)={0x0, 0x0}}, 0x10) r8 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000080)={r7}, 0xc) close(r8) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000240)={0x0, 0x0, 0x20}, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) 5.2352698s ago: executing program 3 (id=8253): r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) mkdir(0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x6) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) chdir(&(0x7f0000000040)='./file0\x00') write$binfmt_elf64(r0, &(0x7f0000000200)={{0x7f, 0x45, 0x4c, 0x46, 0x20, 0x6, 0x0, 0x0, 0x0, 0x2, 0x3e, 0x9, 0x7c, 0x40, 0x2, 0x7f, 0x6, 0x38, 0x0, 0xfffe, 0x3, 0x3}}, 0x40) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) getpid() shmget(0x1, 0x4000, 0x200, &(0x7f0000ffb000/0x4000)=nil) r1 = syz_io_uring_setup(0xf04, &(0x7f0000000500)={0x0, 0x1e58, 0x800, 0x0, 0x2ff}, &(0x7f0000000240), &(0x7f00000004c0), &(0x7f0000000000)) io_uring_enter(r1, 0x1, 0x71a3, 0x1, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, 0x0, 0x0) gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x2, @thr={&(0x7f0000000300)="c79438a8c0a1abc0f9b3c898f1714e67a66c7596f3cb11", 0x0}}, &(0x7f0000bbdffc)) r3 = socket$netlink(0x10, 0x3, 0x10) r4 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000200)={'netdevsim0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000000)=@framed, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r5}, 0x94) r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r6, 0x1, 0x100, 0x25dfdbfd, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x6048800) syz_usb_connect(0x2, 0x2d, 0x0, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) prctl$PR_SET_IO_FLUSHER(0x43, 0x0) socket$netlink(0x10, 0x3, 0xc) 5.005530522s ago: executing program 0 (id=8256): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x400000, &(0x7f0000000000)={0xffffffffffffffff}, 0x111, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000340)={0x15, 0x110, 0xfa08, {r1, 0x0, 0x10, 0x10, 0x0, @in={0x2, 0x4, @loopback}, @in={0x2, 0x4000, @broadcast}}}, 0x118) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x161140, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r4, 0x4008ae8a, &(0x7f00000015c0)={0x1, 0x0, [{0x1, 0x9, 0x7, 0x1, 0x8}]}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) ioctl$KVM_SET_MP_STATE(r4, 0x4004ae99, &(0x7f00000000c0)=0x3) ioctl$KVM_SET_LAPIC(r4, 0x4400ae8f, &(0x7f0000000880)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1000700000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34cf2645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd673c1eeda4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d06c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235eaa92143ce4bb5c5acb290e8976dcac779ff0000f5620000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05be23dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe656c9c46bffbe9dd03970800000000000000d372bdd6f89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"}) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x400000, &(0x7f0000000000)={0xffffffffffffffff}, 0x111, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r5, &(0x7f0000000340)={0x15, 0x110, 0xfa08, {r6, 0x0, 0x10, 0x10, 0x0, @in={0x2, 0x4e23, @empty}, @in={0x2, 0x4000, @broadcast}}}, 0x118) r7 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) ioctl$VIDIOC_S_FMT(r7, 0xc0d05605, &(0x7f0000000080)={0x1, @pix_mp={0xfffffff7, 0x0, 0x47524247, 0x2, 0x8, [{0x3, 0x4}, {0x5, 0x4}, {0x7f, 0x3}, {0x9, 0x6}, {0x4, 0x30000000}, {0x7, 0x38}, {0xe, 0x2}, {0x9, 0x15}], 0x3b, 0x6, 0x1, 0x0, 0x1}}) 4.52248985s ago: executing program 4 (id=8257): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x50110, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) mremap(&(0x7f0000fc4000/0x4000)=nil, 0x4000, 0x1000, 0x7, &(0x7f0000fc5000/0x1000)=nil) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0xc4) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102400, 0x19000) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x2, 0x4, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000ad0000009500000000000000ecd2dd823827ece5c88aaeec889e3a9a2c0be91129505d11d948a3e026c427069526b6a0751b87d6ec378460d7f4d3bc15e7b9c24aa17dff4ca0b347aff2b607fb4d1ceb2981cf643ed1db07b67e86348b4e168e697811619b29b721bb859b70d1239aa9002b9ddb46c9908e78964c729743379e420ec989bdbb0451b4ce643d00000000"], &(0x7f0000000000)='syzkaller\x00', 0x4, 0x1e, 0xfffffffffffffffc, 0x0, 0x0, '\x00', 0x0, 0x30}, 0x94) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x8001, 0x2, {0xffffffffffffffff}, {0xee01}, 0x401}) write$6lowpan_enable(0xffffffffffffffff, &(0x7f00000002c0)='1', 0x1) sendmsg$IPVS_CMD_DEL_DEST(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000540)={&(0x7f0000000480)={0x8c, 0x0, 0x10, 0x70bd25, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_SERVICE={0x48, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e23}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x0, 0x2a}}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x51}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x30}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wlc\x00'}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wlc\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x5b}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'dh\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8437}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x18dc}]}, 0x8c}, 0x1, 0x0, 0x0, 0x24004880}, 0x200008d0) r2 = syz_open_dev$vim2m(&(0x7f0000000080), 0x1, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r2, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix={0x0, 0xcf6, 0x34424752, 0x9, 0x0, 0x0, 0x0, 0xfffffffd}}) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000040)={0x80000001, 0x1, 0x4}) ioctl$vim2m_VIDIOC_STREAMOFF(r2, 0x40045612, &(0x7f0000000240)=0x1) r3 = open_tree(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x80800) ioctl$VT_SETMODE(r3, 0x5602, &(0x7f00000001c0)={0x6, 0x1, 0x3, 0x1, 0x3}) r4 = io_uring_setup(0x5513, &(0x7f0000000100)={0x0, 0x857, 0x2, 0x3, 0x2}) r5 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x19, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x280000b, 0x28011, r5, 0x724c6000) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r4, 0x10, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0}, 0x20) mount$cgroup(0x0, &(0x7f0000000000)='.\x00', &(0x7f00000000c0), 0x10012, 0x0) 4.500742045s ago: executing program 1 (id=8258): r0 = socket$inet6(0xa, 0x2, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r1, &(0x7f0000000300)=""/102400, 0x19000) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) 4.147872201s ago: executing program 3 (id=8259): socket$inet6(0xa, 0x2, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000080)={'netdevsim0\x00', &(0x7f0000000380)=@ethtool_flash={0x33, 0x0, './file0\x00'}}) r1 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) r2 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x0) fchdir(r3) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, &(0x7f0000000080)={0x9, 0x2, "b754288da9182c1acb33c25900ca45d15b36567189769c8dead4357cc5210ea7a8dc266c3ffea12e44ad5d49655bc053ed43cd7819ab21d069eab60f636d625221e6a478b002f2cb6dba214b9eaf25428c730a07a4f066144ed7fe803d81996c74e65379c315928e124ec91dab11b941315e17620a79a1e4a65b72cb75a1fce9185230957dee80f6f39953afa3bec7c082a92efa87d51a396a8d95dc61359dea46f5115120f3e8cb885e9d64e139cccee78992d48f3177f5da0041ea6cac25ddfdd938d6ec95b1ff359bc5f9084aef582a3a4901ad5343e4f2b009889bae41179ac115cdff750e0e87254fea32ff0b85c4018f745889db2bd66476cabe01636d"}) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) getdents64(0xffffffffffffffff, 0x0, 0x0) socket(0x1e, 0x805, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) shmget(0x1, 0x4000, 0xa20, &(0x7f0000ffb000/0x4000)=nil) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e130100c9"], 0x16) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) read$msr(r1, &(0x7f0000000300)=""/102400, 0x19000) 3.974891186s ago: executing program 0 (id=8261): socket$inet6(0xa, 0x2, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) sched_getscheduler(r0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SFACILITIES(r1, 0x89e3, &(0x7f0000000000)={0x400006d, 0x4d, 0x8, 0x9, 0xa, 0x81}) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_STOP_NAN(r3, 0x0, 0x0) r4 = getpid() sched_setscheduler(r4, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000d80)) ioctl$NS_GET_USERNS(r5, 0x8008b70d, 0xf8ffffffffff0f00) ioctl$USBDEVFS_ALLOW_SUSPEND(r2, 0x5522) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = openat$cgroup_ro(r6, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r7, &(0x7f0000000200)=0x1, 0x12) ioctl$USBDEVFS_DISCONNECT_CLAIM(r7, 0x8108551b, &(0x7f0000019300)={0x1, 0x3, "46eeb065bfa8edae395164ed658a6973a8edf8d8115bf9a1318b8773168a94d8bb250cbdbd08793946881e0021731951e7a27519c80942ad8c55a5db9d8d683a995c8f9c26dfcc8f14d1a0c131eadf71304ee2ae661827467c764cf2773414799c3dd8477efc5a10ec72c2949ad484dfff1973fb30c92cba2023f20bd53527cb4fd31c1f49deac4120821ef19555cc70c0be9508c63c93f185909476a1d177511774f5c0422dd63d0e0112a5506a19a232c5a0b579d7c94262099b82173d3efe0338bbb46dca5f21955ca94482a3a36327e8893dd2ef07188079979f63e9408f9b3158308d2494bb8b2e4e777edb4bab8e0ecd22dd22195bb448de6809501b8d"}) 2.558518307s ago: executing program 2 (id=8262): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0a000000050000000300000004"], 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x8, 0x1014}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000003000000850000008600000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff) read$msr(r7, &(0x7f0000032680)=""/102400, 0x19000) r8 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r8, 0x0, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000240), 0x802, 0x0) socket$netlink(0x10, 0x3, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r9, 0x0, 0x0) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r10, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000500)=ANY=[@ANYBLOB="f800000016002102000000000000000000000000000000000000ffff0a010101ac1e00010000000000000000000000004e230000000000000000808000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe80000000000000000005000000003e000004d633000000fe80000000000000000000000000000e0000000000000000020000000000000000000000000000000000000000000000ffffffffffffffffedfffff0c511aaf6210cffffffffff03000000000000000000000000000000000000000000000000000000000000000200000000000000fefffffffffffbff000000000000000096070000000000000000000002000002be0020000000000000000000b1a00100b34083832d70da80"], 0xf8}, 0x1, 0x0, 0x0, 0x40040}, 0x0) sendmsg$nl_xfrm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="fc0000001c000100feffffbf000100"/40], 0xfc}, 0x1, 0x0, 0x0, 0x8801}, 0x10) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000cc0)={r5}, 0xc) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050000000000000000002e00000008000300", @ANYRES32=r2], 0x38}}, 0x40014) 2.409400372s ago: executing program 4 (id=8263): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) prlimit64(0x0, 0xe, 0x0, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000140), 0x1400, 0x0) read$msr(r0, 0x0, 0x0) 2.210521496s ago: executing program 2 (id=8264): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = semget$private(0x0, 0x4000000009, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_BLANKSCREEN(r2, 0x560e, &(0x7f0000000000)) ioctl$KDSKBENT(r2, 0x4b47, &(0x7f0000000180)={0x2, 0x3, 0x40}) ioctl$TIOCSWINSZ(r2, 0x5414, &(0x7f0000000040)={0x9, 0x2, 0x1000, 0x6}) semop(r1, 0x0, 0x0) semctl$IPC_RMID(r1, 0x0, 0x0) pipe(&(0x7f0000002680)) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() sched_setaffinity(0x0, 0x4f, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x0, &(0x7f0000000240)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x0, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) 2.209982289s ago: executing program 4 (id=8265): bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb7020000080000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], 0x0, 0x400, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="06000000040000000800000007"], 0x50) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000000, 0xc3072, 0xffffffffffffffff, 0x200000) socket$nl_route(0x10, 0x3, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000018110000", @ANYRES32=r0], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r3, 0x400448cb, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x80383, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r4, 0x40085112, &(0x7f00000002c0)=@generic={0x2}) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r2}, 0xc) openat$vnet(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) ioctl$PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, &(0x7f00000001c0)={0x60, 0x0, &(0x7f0000001000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x0, &(0x7f0000000000)=[{0x7, 0x0, 0x83}], 0x1, 0x201, 0x0, 0xa, 0x42, 0x5c}) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x250, 0xca, 0xe, 0x0, 0x8, 0x56c, 0x8007, 0xa5c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x56, 0x80, 0x10, 0x29, "", [{{0x9, 0x4, 0x95, 0x8, 0x0, 0xd8, 0x30, 0x81, 0x10}}]}}]}}, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0}) 1.714535889s ago: executing program 1 (id=8266): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x7, 0x0, &(0x7f0000006680)=0x1) socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x7e, &(0x7f00000003c0)={@local, @random="56c9d5282097", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x4, 0x70, 0x68, 0x0, 0x1, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x43}}, @parameter_prob={0xc, 0x0, 0x0, 0x6, 0xc, 0x0, {0x15, 0x4, 0x1, 0x5, 0x9, 0x64, 0x9, 0x8, 0x32, 0x5, @multicast1, @loopback, {[@generic={0x83, 0x2}, @generic={0x88, 0xa, "9b8feced469c7269"}, @cipso={0x86, 0x31, 0x1, [{0x7, 0xa, "1060fb88b5b4452c"}, {0x1, 0x5, "3bee8a"}, {0x6, 0x11, "28fa5f9711aa76a0053be6ceeeea9b"}, {0x2, 0xb, "71fd35ebaeb683f518"}]}]}}}}}}}, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/devices.allow\x00', 0x2, 0x48) write$cgroup_devices(r0, &(0x7f0000000280)=ANY=[@ANYBLOB='b 7:', @ANYRESDEC], 0x54) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1a1740, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000480), r4) ioctl$IOCTL_GET_NCIDEV_IDX(r3, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r6], 0x1c}}, 0xc080) write$nci(r3, &(0x7f0000000400)=ANY=[@ANYBLOB="71050201020203f10901"], 0x17) r7 = syz_kvm_setup_syzos_vm$x86(r2, &(0x7f0000c00000/0x400000)=nil) r8 = syz_kvm_add_vcpu$x86(r7, &(0x7f0000000480)={0x0, 0x0}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000eeb000/0x18000)=nil, &(0x7f0000000540)=[@textreal={0x8, 0x0}], 0x1, 0x12, 0x0, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x58, 0x3, 0x8, 0x201, 0x0, 0x0, {0x7, 0x0, 0x7}, [@CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}, @CTA_TIMEOUT_DATA={0x3c, 0x4, 0x0, 0x1, @icmpv6=[@CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x4}, @CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8}, @CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0xfffffff8}, @CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x3}, @CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x3}, @CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x7}, @CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x6}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000085) r9 = socket$netlink(0x10, 0x3, 0xf) ioctl$sock_SIOCETHTOOL(r9, 0x8946, &(0x7f0000000040)={'veth1_to_hsr\x00', &(0x7f0000003f40)=@ethtool_gstrings={0x1b, 0x5}}) prlimit64(0x0, 0xe, 0x0, 0x0) r10 = syz_open_dev$MSR(&(0x7f0000000140), 0x1400, 0x0) read$msr(r10, 0x0, 0x0) 1.59684425s ago: executing program 0 (id=8267): madvise(&(0x7f0000000000/0x600000)=nil, 0xffffffffdfffffff, 0xb) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0x80) getdents64(r0, 0x0, 0x0) openat$fb0(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) 1.596561038s ago: executing program 0 (id=8268): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect(0x2, 0x24, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x2d, 0x9e, 0x3d, 0x20, 0xb95, 0x178a, 0x2f69, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x5, 0x9, 0x80, 0x80, "", [{{0x9, 0x4, 0xe4, 0x9, 0x0, 0xff, 0xff, 0x0, 0x6}}]}}]}}, 0x0) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000040)=ANY=[@ANYBLOB="d0000000", @ANYRES16=r1, @ANYBLOB="010000000000000000000100000008000100000000000400048008000c8004000b800800020001000000"], 0xd0}}, 0x571f68543cec8180) 1.569052165s ago: executing program 3 (id=8269): r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) mkdir(0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x6) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) chdir(&(0x7f0000000040)='./file0\x00') write$binfmt_elf64(r0, &(0x7f0000000200)={{0x7f, 0x45, 0x4c, 0x46, 0x20, 0x6, 0x0, 0x0, 0x0, 0x2, 0x3e, 0x9, 0x7c, 0x40, 0x2, 0x7f, 0x6, 0x38, 0x0, 0xfffe, 0x3, 0x3}}, 0x40) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) getpid() io_uring_enter(0xffffffffffffffff, 0x1, 0x71a3, 0x1, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x2, @thr={&(0x7f0000000300), 0x0}}, &(0x7f0000bbdffc)) r2 = socket$netlink(0x10, 0x3, 0x10) r3 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000200)={'netdevsim0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000000)=@framed, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r4}, 0x94) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r5, 0x1, 0x100, 0x25dfdbfd, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x6048800) syz_usb_connect(0x2, 0x2d, 0x0, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) prctl$PR_SET_IO_FLUSHER(0x43, 0x0) socket$netlink(0x10, 0x3, 0xc) 1.559026684s ago: executing program 1 (id=8270): r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$FBIOPUTCMAP(r0, 0x4605, &(0x7f0000000040)={0xfffffffc, 0x23, 0x0, 0x0, 0x0, 0x0}) openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x400000, 0x38) ioctl$F2FS_IOC_GET_PIN_FILE(r0, 0x8004f50e, &(0x7f0000000140)) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) ftruncate(r1, 0x8008976) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r4 = syz_open_dev$loop(&(0x7f0000000140), 0x75f, 0xa382) r5 = memfd_create(&(0x7f0000000880)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc90\xb9voI\xa5/\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\x81\x00V\xd6/N\xc5\xc6f\xb1\x95Z\xe5w^\xd8\xe7J\x80\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93\x9c5\xcf\t\x04\x00\x00\x00\x00\x00\x00v\xef\xee+\xab\x9c\x00^R\xb2n?i=\xbe\x16\x8a\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\x94\x13^\x13\xaf\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n0xffffffffffffffff}, 0x111, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000340)={0x15, 0x110, 0xfa08, {r1, 0x0, 0x10, 0x10, 0x0, @in={0x2, 0x4, @loopback}, @in={0x2, 0x4000, @broadcast}}}, 0x118) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x161140, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r4, 0x4008ae8a, &(0x7f00000015c0)={0x1, 0x0, [{0x1, 0x9, 0x7, 0x1, 0x8}]}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) ioctl$KVM_SET_MP_STATE(r4, 0x4004ae99, &(0x7f00000000c0)=0x3) ioctl$KVM_SET_LAPIC(r4, 0x4400ae8f, &(0x7f0000000880)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1000700000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34cf2645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd673c1eeda4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d06c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235eaa92143ce4bb5c5acb290e8976dcac779ff0000f5620000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05be23dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe656c9c46bffbe9dd03970800000000000000d372bdd6f89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"}) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x400000, &(0x7f0000000000)={0xffffffffffffffff}, 0x111, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r5, &(0x7f0000000340)={0x15, 0x110, 0xfa08, {r6, 0x0, 0x10, 0x10, 0x0, @in={0x2, 0x4e23, @empty}, @in={0x2, 0x4000, @broadcast}}}, 0x118) r7 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) ioctl$VIDIOC_S_FMT(r7, 0xc0d05605, &(0x7f0000000080)={0x1, @pix_mp={0xfffffff7, 0x0, 0x47524247, 0x2, 0x8, [{0x3, 0x4}, {0x5, 0x4}, {0x7f, 0x3}, {0x9, 0x6}, {0x4, 0x30000000}, {0x7, 0x38}, {0xe, 0x2}, {0x9, 0x15}], 0x3b, 0x6, 0x1, 0x0, 0x1}}) 1.146324373s ago: executing program 2 (id=8272): ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000140)={@map=0x1, 0x1, 0x1, 0x7, &(0x7f0000000040)=[0x0, 0x0, 0x0], 0x3, 0x0, &(0x7f0000000080), &(0x7f00000000c0)=[0x0, 0x0, 0x0], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0x40) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r3, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r3, 0x28, 0x2, &(0x7f00000000c0)=0x33, 0x8) listen(r3, 0x0) r4 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r4, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) r5 = accept4(r3, 0x0, 0x0, 0x0) sendto(r5, &(0x7f0000000000), 0xfeb5, 0x0, 0x0, 0x0) recvfrom(r4, &(0x7f00000001c0)=""/62, 0xfeb5, 0x10120, 0x0, 0x0) r6 = landlock_create_ruleset(&(0x7f0000000040)={0x2, 0x3, 0x3}, 0x18, 0x0) landlock_restrict_self(r6, 0x9) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x11, 0x3, &(0x7f0000000280)=ANY=[@ANYRESDEC=r2, @ANYRES32=r1, @ANYRES32=r0, @ANYRES32=r0], &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x100}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000001c0)={r7, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000680)={r8}, 0x4) listen(r4, 0x65) 924.85637ms ago: executing program 2 (id=8273): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$kcm(0x10, 0x0, 0x10) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000140), 0x75f, 0xa382) socket$can_raw(0x1d, 0x3, 0x1) r2 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r2, 0xc0205647, 0x0) r3 = memfd_create(&(0x7f0000000880)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc90\xb9voI\xa5/\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\x81\x00V\xd6/N\xc5\xc6f\xb1\x95Z\xe5w^\xd8\xe7J\x80\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93\x9c5\xcf\t\x04\x00\x00\x00\x00\x00\x00v\xef\xee+\xab\x9c\x00^R\xb2n?i=\xbe\x16\x8a\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\x94\x13^\x13\xaf\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\x94\x13^\x13\xaf\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="7c0000001000010400"/20, @ANYRES32=r2, @ANYBLOB="00000000000000005c001280110001006272696467655f736c6176"], 0x7c}}, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x400000000000235, 0x0) 141.420818ms ago: executing program 0 (id=8277): r0 = syz_open_dev$sndctrl(&(0x7f0000000240), 0x2d963994, 0x80800) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r0, 0xc0505510, 0x0) 101.192061ms ago: executing program 4 (id=8278): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, 0x0, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x66, &(0x7f0000000ac0)={0x0, 0xd0}, &(0x7f0000000b00)=0x8) read$FUSE(0xffffffffffffffff, 0x0, 0x0) write$FUSE_DIRENTPLUS(0xffffffffffffffff, 0x0, 0xb0) ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, 0x0) r4 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10) setsockopt$SO_BINDTODEVICE_wg(r4, 0x1, 0x19, &(0x7f0000000080)='wg1\x00', 0x4) sendto$inet(r4, &(0x7f0000000040)="e5", 0xffffffe4, 0x0, 0x0, 0x0) (fail_nth: 1) syz_emit_ethernet(0x46, &(0x7f00000003c0)={@link_local, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "0300", 0x10, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x8}}}}}}, 0x0) 10.449504ms ago: executing program 0 (id=8279): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x50110, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) mremap(&(0x7f0000fc4000/0x4000)=nil, 0x4000, 0x1000, 0x7, &(0x7f0000fc5000/0x1000)=nil) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0xc4) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102400, 0x19000) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x2, 0x4, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000ad0000009500000000000000ecd2dd823827ece5c88aaeec889e3a9a2c0be91129505d11d948a3e026c427069526b6a0751b87d6ec378460d7f4d3bc15e7b9c24aa17dff4ca0b347aff2b607fb4d1ceb2981cf643ed1db07b67e86348b4e168e697811619b29b721bb859b70d1239aa9002b9ddb46c9908e78964c729743379e420ec989bdbb0451b4ce643d00000000"], &(0x7f0000000000)='syzkaller\x00', 0x4, 0x1e, 0xfffffffffffffffc, 0x0, 0x0, '\x00', 0x0, 0x30}, 0x94) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x8001, 0x2, {0xffffffffffffffff}, {0xee01}, 0x401}) write$6lowpan_enable(0xffffffffffffffff, &(0x7f00000002c0)='1', 0x1) sendmsg$IPVS_CMD_DEL_DEST(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000540)={&(0x7f0000000480)={0x8c, 0x0, 0x10, 0x70bd25, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_SERVICE={0x48, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e23}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x0, 0x2a}}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x51}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x30}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wlc\x00'}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wlc\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x5b}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'dh\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8437}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x18dc}]}, 0x8c}, 0x1, 0x0, 0x0, 0x24004880}, 0x200008d0) r2 = syz_open_dev$vim2m(&(0x7f0000000080), 0x1, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r2, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix={0x0, 0xcf6, 0x34424752, 0x9, 0x0, 0x0, 0x0, 0xfffffffd}}) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000040)={0x80000001, 0x1, 0x4}) ioctl$vim2m_VIDIOC_STREAMOFF(r2, 0x40045612, &(0x7f0000000240)=0x1) r3 = open_tree(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x80800) ioctl$VT_SETMODE(r3, 0x5602, &(0x7f00000001c0)={0x6, 0x1, 0x3, 0x1, 0x3}) r4 = io_uring_setup(0x5513, &(0x7f0000000100)={0x0, 0x857, 0x2, 0x3, 0x2}) r5 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x19, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x280000b, 0x28011, r5, 0x724c6000) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r4, 0x10, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0}, 0x20) mount$cgroup(0x0, &(0x7f0000000000)='.\x00', &(0x7f00000000c0), 0x10012, 0x0) 0s ago: executing program 2 (id=8280): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x50110, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) mremap(&(0x7f0000fc4000/0x4000)=nil, 0x4000, 0x1000, 0x7, &(0x7f0000fc5000/0x1000)=nil) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0xc4) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102400, 0x19000) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x2, 0x4, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000ad0000009500000000000000ecd2dd823827ece5c88aaeec889e3a9a2c0be91129505d11d948a3e026c427069526b6a0751b87d6ec378460d7f4d3bc15e7b9c24aa17dff4ca0b347aff2b607fb4d1ceb2981cf643ed1db07b67e86348b4e168e697811619b29b721bb859b70d1239aa9002b9ddb46c9908e78964c729743379e420ec989bdbb0451b4ce643d00000000"], &(0x7f0000000000)='syzkaller\x00', 0x4, 0x1e, 0xfffffffffffffffc, 0x0, 0x0, '\x00', 0x0, 0x30}, 0x94) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x8001, 0x2, {0xffffffffffffffff}, {0xee01}, 0x401}) write$6lowpan_enable(0xffffffffffffffff, &(0x7f00000002c0)='1', 0x1) sendmsg$IPVS_CMD_DEL_DEST(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000540)={&(0x7f0000000480)={0x8c, 0x0, 0x10, 0x70bd25, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_SERVICE={0x48, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e23}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x0, 0x2a}}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x51}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x30}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wlc\x00'}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wlc\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x5b}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'dh\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8437}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x18dc}]}, 0x8c}, 0x1, 0x0, 0x0, 0x24004880}, 0x200008d0) r2 = syz_open_dev$vim2m(&(0x7f0000000080), 0x1, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r2, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix={0x0, 0xcf6, 0x34424752, 0x9, 0x0, 0x0, 0x0, 0xfffffffd}}) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000040)={0x80000001, 0x1, 0x4}) ioctl$vim2m_VIDIOC_STREAMOFF(r2, 0x40045612, &(0x7f0000000240)=0x1) r3 = open_tree(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x80800) ioctl$VT_SETMODE(r3, 0x5602, &(0x7f00000001c0)={0x6, 0x1, 0x3, 0x1, 0x3}) r4 = io_uring_setup(0x5513, &(0x7f0000000100)={0x0, 0x857, 0x2, 0x3, 0x2}) r5 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x19, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x280000b, 0x28011, r5, 0x724c6000) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r4, 0x10, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0}, 0x20) mount$cgroup(0x0, &(0x7f0000000000)='.\x00', &(0x7f00000000c0), 0x10012, 0x0) kernel console output (not intermixed with test programs): 6d:08ae [ 1985.362723][T28895] usb 1-1: new full-speed USB device number 13 using dummy_hcd [ 1985.525463][ T804] gspca_zc3xx: reg_w_i err -110 [ 1985.526593][T28895] usb 1-1: config 5 has an invalid interface number: 228 but max is 0 [ 1985.539044][T28895] usb 1-1: config 5 has no interface number 0 [ 1985.545222][T28895] usb 1-1: config 5 interface 228 has no altsetting 0 [ 1985.554602][T28895] usb 1-1: New USB device found, idVendor=0b95, idProduct=178a, bcdDevice=2f.69 [ 1985.564308][T28895] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1985.572809][T28895] usb 1-1: Product: syz [ 1985.577218][T28895] usb 1-1: Manufacturer: syz [ 1985.582134][T28895] usb 1-1: SerialNumber: syz [ 1985.628791][ T4575] netlink: 140 bytes leftover after parsing attributes in process `syz.1.7904'. [ 1985.731362][T26169] gspca_zc3xx: reg_w_i err -110 [ 1985.811212][T28895] ax88179_178a 1-1:5.228: probe with driver ax88179_178a failed with error -22 [ 1985.832190][T28895] usb 1-1: USB disconnect, device number 13 [ 1986.175480][ T804] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1986.181932][ T804] gspca_zc3xx 4-1:0.0: probe with driver gspca_zc3xx failed with error -110 [ 1986.363682][ T4579] tipc: Enabled bearer , priority 0 [ 1986.373462][T26169] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1986.383202][T26169] gspca_zc3xx 5-1:0.0: probe with driver gspca_zc3xx failed with error -110 [ 1986.561603][ T4579] syzkaller0: entered promiscuous mode [ 1986.669970][ T4584] fuse: Unknown parameter '0xffffffffffffffff00000000000000000007' [ 1986.676505][ T4579] syzkaller0: entered allmulticast mode [ 1986.690881][ T4579] tipc: Resetting bearer [ 1986.729287][ T4578] tipc: Resetting bearer [ 1986.782955][ T4578] tipc: Disabling bearer [ 1986.906696][ T4596] fuse: Bad value for 'fd' [ 1987.097760][ T4598] FAULT_INJECTION: forcing a failure. [ 1987.097760][ T4598] name failslab, interval 1, probability 0, space 0, times 0 [ 1987.111814][ T4598] CPU: 1 UID: 0 PID: 4598 Comm: syz.0.7911 Tainted: G L syzkaller #0 PREEMPT(full) [ 1987.111846][ T4598] Tainted: [L]=SOFTLOCKUP [ 1987.111852][ T4598] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1987.111859][ T4598] Call Trace: [ 1987.111863][ T4598] [ 1987.111867][ T4598] dump_stack_lvl+0x100/0x190 [ 1987.111883][ T4598] should_fail_ex.cold+0x5/0xa [ 1987.111896][ T4598] ? __kmalloc_cache_noprof+0x53/0x6e0 [ 1987.111911][ T4598] should_failslab+0xc2/0x120 [ 1987.111928][ T4598] __kmalloc_cache_noprof+0x7a/0x6e0 [ 1987.111940][ T4598] ? alloc_pipe_info+0x10e/0x590 [ 1987.111957][ T4598] alloc_pipe_info+0x10e/0x590 [ 1987.111969][ T4598] splice_direct_to_actor+0x78f/0xa30 [ 1987.111981][ T4598] ? __pfx_direct_splice_actor+0x10/0x10 [ 1987.111993][ T4598] ? kstrtouint_from_user+0x13c/0x1d0 [ 1987.112006][ T4598] ? rcu_is_watching+0x12/0xc0 [ 1987.112021][ T4598] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 1987.112033][ T4598] ? rcu_is_watching+0x12/0xc0 [ 1987.112046][ T4598] ? get_pid_task+0xfc/0x250 [ 1987.112061][ T4598] ? lock_release+0x24d/0x310 [ 1987.112073][ T4598] do_splice_direct+0x174/0x240 [ 1987.112085][ T4598] ? __pfx_do_splice_direct+0x10/0x10 [ 1987.112096][ T4598] ? avc_policy_seqno+0x9/0x20 [ 1987.112112][ T4598] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 1987.112124][ T4598] ? bpf_lsm_file_permission+0x9/0x10 [ 1987.112138][ T4598] ? security_file_permission+0x76/0x210 [ 1987.112153][ T4598] ? rw_verify_area+0xce/0x6d0 [ 1987.112168][ T4598] do_sendfile+0xadc/0xe20 [ 1987.112184][ T4598] ? __pfx_do_sendfile+0x10/0x10 [ 1987.112198][ T4598] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1987.112213][ T4598] ? __fget_files+0x21f/0x3d0 [ 1987.112225][ T4598] __x64_sys_sendfile64+0x1d8/0x220 [ 1987.112237][ T4598] ? ksys_write+0x1ac/0x250 [ 1987.112245][ T4598] ? __pfx___x64_sys_sendfile64+0x10/0x10 [ 1987.112258][ T4598] ? rcu_is_watching+0x12/0xc0 [ 1987.112273][ T4598] do_syscall_64+0x115/0x870 [ 1987.112285][ T4598] ? clear_bhb_loop+0x40/0x90 [ 1987.112298][ T4598] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1987.112309][ T4598] RIP: 0033:0x7fda4319ce59 [ 1987.112318][ T4598] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1987.112329][ T4598] RSP: 002b:00007fda43fba028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 1987.112340][ T4598] RAX: ffffffffffffffda RBX: 00007fda43415fa0 RCX: 00007fda4319ce59 [ 1987.112347][ T4598] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000006 [ 1987.112353][ T4598] RBP: 00007fda43fba090 R08: 0000000000000000 R09: 0000000000000000 [ 1987.112360][ T4598] R10: 00004000000053d2 R11: 0000000000000246 R12: 0000000000000001 [ 1987.112366][ T4598] R13: 00007fda43416038 R14: 00007fda43415fa0 R15: 00007ffd13275218 [ 1987.112376][ T4598] [ 1987.602738][ T804] usb 4-1: USB disconnect, device number 41 [ 1987.793494][T26169] usb 5-1: USB disconnect, device number 29 [ 1987.919066][ T30] audit: type=1400 audit(1781909591.941:1376): avc: denied { watch watch_reads } for pid=4616 comm="syz.3.7918" path="pipe:[193011]" dev="pipefs" ino=193011 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 1987.998717][ T30] audit: type=1400 audit(1781909591.941:1377): avc: denied { relabelfrom } for pid=4616 comm="syz.3.7918" name="" dev="pipefs" ino=193013 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 1988.324963][ T30] audit: type=1800 audit(1781909592.319:1378): pid=4605 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.7912" name="bus" dev="ramfs" ino=192997 res=0 errno=0 [ 1988.949861][T29787] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 1989.010029][ T4639] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1989.084783][ T4639] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1989.147234][ T4639] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1989.158067][T29787] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1989.167127][T29787] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1989.179619][T29787] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1989.192936][T29787] usb 3-1: config 1 has no interface number 1 [ 1989.204242][T29787] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1989.222388][ T4639] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1989.232716][T29787] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1989.250729][T29787] usb 3-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 1989.259971][ T804] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 1989.268147][T29787] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1989.276763][T29787] usb 3-1: Product: syz [ 1989.280927][T29787] usb 3-1: Manufacturer: syz [ 1989.288741][T29787] usb 3-1: SerialNumber: syz [ 1989.303246][T20417] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1989.316420][T20417] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1989.324907][T20417] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1989.333422][T20417] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1989.437297][ T804] usb 2-1: Using ep0 maxpacket: 8 [ 1989.443599][ T804] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 1989.452099][ T804] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 1989.463374][ T804] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1989.475015][ T804] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1989.487052][ T804] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1989.498295][ T804] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1989.509897][ T804] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 1989.523368][ T804] usb 2-1: config 168 interface 0 has no altsetting 0 [ 1989.531111][ T804] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 1989.539404][ T804] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 1989.550976][ T804] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1989.563320][ T804] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1989.575582][ T804] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1989.586907][ T804] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1989.600495][ T804] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 1989.621725][ T4643] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1989.621803][ T804] usb 2-1: config 168 interface 0 has no altsetting 0 [ 1989.630876][ T4643] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1989.638742][ T804] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 1989.663589][ T804] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 1989.673689][ T4643] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1989.674958][ T30] audit: type=1804 audit(1781909593.565:1379): pid=4643 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.2.7921" name="bus" dev="ramfs" ino=194072 res=1 errno=0 [ 1989.683961][ T4643] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1989.704941][T17779] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 1989.729168][ T804] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1989.747164][ T804] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1989.759746][ T804] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1989.840251][ T804] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1989.860076][ T804] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 1989.881545][ T804] usb 2-1: config 168 interface 0 has no altsetting 0 [ 1989.897236][ T804] usb 2-1: string descriptor 0 read error: -22 [ 1989.905420][ T804] usb 2-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 1989.915005][ T804] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1989.935803][T17779] usb 1-1: Using ep0 maxpacket: 8 [ 1989.947047][T17779] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1989.964147][T17779] usb 1-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1989.979419][T17779] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1990.029638][T17779] usb 1-1: Product: syz [ 1990.040054][ T804] adutux 2-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 1990.081473][T17779] usb 1-1: Manufacturer: syz [ 1990.102438][T17779] usb 1-1: SerialNumber: syz [ 1990.123127][T17779] usb 1-1: config 0 descriptor?? [ 1990.132164][T17779] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1990.223746][ T4646] netlink: 20 bytes leftover after parsing attributes in process `syz.4.7926'. [ 1990.439018][T29787] usb 3-1: 2:1 : invalid UAC_AS_GENERAL desc [ 1990.455101][T29787] usb 3-1: USB disconnect, device number 46 [ 1990.489403][T28766] udevd[28766]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1990.545959][ T4650] syzkaller0: entered promiscuous mode [ 1990.552007][ T4650] syzkaller0: entered allmulticast mode [ 1990.638255][ T4638] Failed to initialize the IGMP autojoin socket (err -2) [ 1990.645708][ T4655] netlink: 40 bytes leftover after parsing attributes in process `syz.4.7928'. [ 1990.684138][T17779] gspca_zc3xx: reg_w_i err -110 [ 1991.333684][T17779] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1991.345765][T17779] gspca_zc3xx 1-1:0.0: probe with driver gspca_zc3xx failed with error -110 [ 1992.231057][ T4670] fuse: Bad value for 'fd' [ 1992.363242][T28895] usb 2-1: USB disconnect, device number 36 [ 1992.408639][ T4672] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7934'. [ 1992.457500][ T4676] netlink: 40 bytes leftover after parsing attributes in process `syz.4.7936'. [ 1992.642896][ T4685] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7939'. [ 1992.748886][T28895] usb 1-1: USB disconnect, device number 14 [ 1994.323723][ T4711] "syz.4.7947" (4711) uses obsolete ecb(arc4) skcipher [ 1994.346489][T23925] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 1994.503295][ T4713] netlink: 43 bytes leftover after parsing attributes in process `syz.1.7948'. [ 1994.552110][T23925] usb 4-1: Using ep0 maxpacket: 8 [ 1994.560112][T23925] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 1994.568877][ T4720] Failed to initialize the IGMP autojoin socket (err -2) [ 1994.576562][T23925] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 1994.591357][T23925] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1994.606157][T23925] usb 4-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1994.618448][T23925] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1994.644538][T23925] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1994.669517][T23925] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 1994.696701][T23925] usb 4-1: config 168 interface 0 has no altsetting 0 [ 1994.710237][T23925] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 1994.718458][T23925] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 1994.736507][T23925] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1994.753307][T23925] usb 4-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1994.765578][T23925] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1994.778853][T23925] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1994.790512][T23925] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 1994.804698][T23925] usb 4-1: config 168 interface 0 has no altsetting 0 [ 1994.813304][T23925] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 1994.829094][T23925] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 1994.841452][T23925] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1994.853340][T23925] usb 4-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1994.866507][T23925] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1994.878181][T23925] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1994.890768][T23925] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 1994.905041][T23925] usb 4-1: config 168 interface 0 has no altsetting 0 [ 1994.914629][T23925] usb 4-1: string descriptor 0 read error: -22 [ 1994.921695][T23925] usb 4-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 1994.930834][T23925] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1995.020774][T23925] adutux 4-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 1995.133354][ T4725] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7950'. [ 1996.487393][ T4739] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7954'. [ 1997.209304][ T4752] netlink: 68 bytes leftover after parsing attributes in process `syz.1.7958'. [ 1997.433819][ T4756] fuse: Unknown parameter '0xffffffffffffffff00000000000000000007' [ 1997.560962][T23925] usb 4-1: USB disconnect, device number 42 [ 1998.026569][ T4771] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 1998.884739][ T4778] Can't find ip_set type has [ 1999.415021][ T4785] fuse: Unknown parameter '0xffffffffffffffff00000000000000000007' [ 1999.727616][ T4791] gfs2: path_lookup on  returned error -2 [ 2000.377884][ T4798] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer. [ 2000.686116][ T4802] FAULT_INJECTION: forcing a failure. [ 2000.686116][ T4802] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2000.699458][ T4802] CPU: 0 UID: 0 PID: 4802 Comm: syz.2.7971 Tainted: G L syzkaller #0 PREEMPT(full) [ 2000.699485][ T4802] Tainted: [L]=SOFTLOCKUP [ 2000.699489][ T4802] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2000.699496][ T4802] Call Trace: [ 2000.699501][ T4802] [ 2000.699505][ T4802] dump_stack_lvl+0x100/0x190 [ 2000.699521][ T4802] should_fail_ex.cold+0x5/0xa [ 2000.699534][ T4802] _copy_to_user+0x32/0xd0 [ 2000.699554][ T4802] simple_read_from_buffer+0xcb/0x170 [ 2000.699565][ T4802] proc_fail_nth_read+0x1af/0x230 [ 2000.699583][ T4802] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2000.699600][ T4802] ? security_file_permission+0x76/0x210 [ 2000.699615][ T4802] ? rw_verify_area+0xce/0x6d0 [ 2000.699629][ T4802] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2000.699646][ T4802] vfs_read+0x1e4/0xb40 [ 2000.699662][ T4802] ? __pfx_vfs_read+0x10/0x10 [ 2000.699678][ T4802] ? rcu_is_watching+0x12/0xc0 [ 2000.699694][ T4802] ? __fget_files+0x21f/0x3d0 [ 2000.699706][ T4802] ksys_read+0x12a/0x250 [ 2000.699721][ T4802] ? __pfx_ksys_read+0x10/0x10 [ 2000.699737][ T4802] ? trace_hardirqs_off+0x70/0x170 [ 2000.699750][ T4802] ? rcu_is_watching+0x12/0xc0 [ 2000.699764][ T4802] do_syscall_64+0x115/0x870 [ 2000.699778][ T4802] ? clear_bhb_loop+0x40/0x90 [ 2000.699790][ T4802] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2000.699801][ T4802] RIP: 0033:0x7f378195d68e [ 2000.699810][ T4802] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 2000.699821][ T4802] RSP: 002b:00007f37828d1fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2000.699832][ T4802] RAX: ffffffffffffffda RBX: 00007f37828d26c0 RCX: 00007f378195d68e [ 2000.699839][ T4802] RDX: 000000000000000f RSI: 00007f37828d20a0 RDI: 0000000000000008 [ 2000.699846][ T4802] RBP: 00007f37828d2090 R08: 0000000000000000 R09: 0000000000000000 [ 2000.699852][ T4802] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2000.699859][ T4802] R13: 00007f3781c16128 R14: 00007f3781c16090 R15: 00007ffe467eb878 [ 2000.699868][ T4802] [ 2001.176634][ T4804] netlink: 68 bytes leftover after parsing attributes in process `syz.2.7972'. [ 2001.986011][T18542] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 2002.160347][T18542] usb 5-1: Using ep0 maxpacket: 8 [ 2002.333570][T18542] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 2002.350974][T18542] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 2002.502098][T18542] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 2002.515747][T18542] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 2002.528692][T18542] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 2002.542124][T18542] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 2002.554711][T18542] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 2002.694505][ T4820] fuse: Unknown parameter '0xffffffffffffffff00000000000000000007' [ 2002.708863][T18542] usb 5-1: config 168 interface 0 has no altsetting 0 [ 2002.900044][T18542] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 2002.935227][T18542] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 2002.978245][T18542] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 2003.012140][T18542] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 2003.047921][T18542] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 2003.082922][T18542] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 2003.113009][T18542] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 2003.134894][T18542] usb 5-1: config 168 interface 0 has no altsetting 0 [ 2003.149863][T18542] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 2003.190175][T18542] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 2003.728278][T18542] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 2003.766378][T18542] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 2003.820408][T18542] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 2003.861581][T18542] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 2003.913961][T18542] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 2003.934709][T18542] usb 5-1: config 168 interface 0 has no altsetting 0 [ 2003.948063][T18542] usb 5-1: string descriptor 0 read error: -22 [ 2003.958370][T18542] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 2004.003951][T18542] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2004.041708][T18542] adutux 5-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 2004.138793][ T4840] netlink: 68 bytes leftover after parsing attributes in process `syz.1.7983'. [ 2006.138839][ T4856] Can't find ip_set type has [ 2006.259600][T17779] usb 5-1: USB disconnect, device number 30 [ 2006.632535][ T4865] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer. [ 2006.820793][ T4871] FAULT_INJECTION: forcing a failure. [ 2006.820793][ T4871] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2006.835919][ T4871] CPU: 1 UID: 0 PID: 4871 Comm: syz.1.7990 Tainted: G L syzkaller #0 PREEMPT(full) [ 2006.835946][ T4871] Tainted: [L]=SOFTLOCKUP [ 2006.835950][ T4871] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2006.835957][ T4871] Call Trace: [ 2006.835962][ T4871] [ 2006.835966][ T4871] dump_stack_lvl+0x100/0x190 [ 2006.835981][ T4871] should_fail_ex.cold+0x5/0xa [ 2006.835995][ T4871] _copy_to_user+0x32/0xd0 [ 2006.836012][ T4871] simple_read_from_buffer+0xcb/0x170 [ 2006.836023][ T4871] proc_fail_nth_read+0x1af/0x230 [ 2006.836040][ T4871] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2006.836057][ T4871] ? security_file_permission+0x76/0x210 [ 2006.836073][ T4871] ? rw_verify_area+0xce/0x6d0 [ 2006.836094][ T4871] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2006.836119][ T4871] vfs_read+0x1e4/0xb40 [ 2006.836143][ T4871] ? __pfx_vfs_read+0x10/0x10 [ 2006.836165][ T4871] ? rcu_is_watching+0x12/0xc0 [ 2006.836181][ T4871] ? __fget_files+0x21f/0x3d0 [ 2006.836193][ T4871] ksys_read+0x12a/0x250 [ 2006.836209][ T4871] ? __pfx_ksys_read+0x10/0x10 [ 2006.836225][ T4871] ? rcu_is_watching+0x12/0xc0 [ 2006.836239][ T4871] do_syscall_64+0x115/0x870 [ 2006.836252][ T4871] ? clear_bhb_loop+0x40/0x90 [ 2006.836264][ T4871] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2006.836275][ T4871] RIP: 0033:0x7fda0e55d68e [ 2006.836284][ T4871] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 2006.836294][ T4871] RSP: 002b:00007fda0c7f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2006.836305][ T4871] RAX: ffffffffffffffda RBX: 00007fda0c7f66c0 RCX: 00007fda0e55d68e [ 2006.836314][ T4871] RDX: 000000000000000f RSI: 00007fda0c7f60a0 RDI: 0000000000000003 [ 2006.836321][ T4871] RBP: 00007fda0c7f6090 R08: 0000000000000000 R09: 0000000000000000 [ 2006.836327][ T4871] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2006.836334][ T4871] R13: 00007fda0e816038 R14: 00007fda0e815fa0 R15: 00007ffc4e68f568 [ 2006.836343][ T4871] [ 2007.101599][ T30] audit: type=1804 audit(1781909609.649:1380): pid=4876 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.0.7991" name="/newroot/375/file0" dev="tmpfs" ino=2024 res=1 errno=0 [ 2007.125616][ T4876] ref_ctr increment failed for inode: 0x7e8 offset: 0x5 ref_ctr_offset: 0x2 of mm: 0xffff88802c9a4c80 [ 2007.138221][ T4872] uprobe: syz.0.7991:4872 failed to unregister, leaking uprobe [ 2007.198679][ T4873] binder: 4868:4873 ioctl c0306201 200000000040 returned -22 [ 2007.306846][T17779] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 2007.524746][T17779] usb 2-1: Using ep0 maxpacket: 16 [ 2007.542840][T17779] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2007.556395][T17779] usb 2-1: config 1 interface 1 altsetting 1 has an endpoint descriptor with address 0xFE, changing to 0x8E [ 2007.612421][T17779] usb 2-1: New USB device found, idVendor=08e4, idProduct=017f, bcdDevice= 0.40 [ 2007.635871][T17779] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2007.669114][T17779] usb 2-1: Product: syz [ 2007.686773][T17779] usb 2-1: Manufacturer: syz [ 2007.704594][T17779] usb 2-1: SerialNumber: syz [ 2007.928079][ T4888] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 2008.066392][T17779] usb 2-1: Can't get UAC3 power state for id 11 [ 2008.080659][T17779] usb 2-1: BAAD SPEAKERPHONE c_chmask mismatch [ 2008.179164][T17779] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 2008.213627][T17779] usb 2-1: USB disconnect, device number 37 [ 2008.312889][T28763] udevd[28763]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2008.825113][T18542] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 2009.889290][ T4902] Can't find ip_set type has [ 2010.059575][T18542] usb 5-1: Using ep0 maxpacket: 16 [ 2010.077626][T18542] usb 5-1: unable to get BOS descriptor or descriptor too short [ 2010.106588][T18542] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 64 [ 2010.130085][T18542] usb 5-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 2010.143252][T18542] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2010.151702][T18542] usb 5-1: Product: ї [ 2010.152452][ T4905] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2010.155870][T18542] usb 5-1: Manufacturer: 䤗貞繘❡獶ͭ⇱ꤞ޹ﮌ׷Ĥ镔䠥龩⏖淯螝㙍䊙Ჵ劢穰䇆⤓⛯枻谑挂ମ䕖֫⓶傀轇ᾧ〈⚦紞ア쑵ꘑ羦嘎禮￢蜇純粗䖣虌닮컰甃婺鼘갢跃觇麗鼨㢯蒦菷瘊ꀁ䮉ꢀ煕㴭䝈Ჯ➖揞匘후銾ꜗ놄珽脾 [ 2010.227582][T18542] usb 5-1: SerialNumber: L쟕ꕘ２埓璘쭲窑༷᣿娚揤ᚷ╊⤿쥌Ւ學ᩓ꒸뤃 [ 2010.247026][ T4894] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 2010.278663][ T4905] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2010.365554][ T4905] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2010.430526][ T4905] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2010.707801][T18542] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 2010.720811][T18542] usb 5-1: MIDIStreaming interface descriptor not found [ 2010.802254][T18542] usb 5-1: USB disconnect, device number 31 [ 2010.864002][T10088] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2010.912507][T10088] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2010.953254][T10088] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2010.972904][T17950] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2011.287497][ T4927] gfs2: path_lookup on  returned error -2 [ 2011.635363][ T30] audit: type=1800 audit(1781909613.829:1381): pid=4930 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=set_data cause=unavailable-hash-algorithm comm="syz.0.8005" name="/newroot/379" dev="tmpfs" ino=2040 res=0 errno=0 [ 2012.449821][ T30] audit: type=1800 audit(1781909614.374:1382): pid=4926 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.2.8004" name="bus" dev="ramfs" ino=196206 res=0 errno=0 [ 2013.407988][T23925] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 2013.494351][ T4972] FAULT_INJECTION: forcing a failure. [ 2013.494351][ T4972] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2013.508833][ T4972] CPU: 1 UID: 0 PID: 4972 Comm: syz.3.8017 Tainted: G L syzkaller #0 PREEMPT(full) [ 2013.508870][ T4972] Tainted: [L]=SOFTLOCKUP [ 2013.508877][ T4972] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2013.508888][ T4972] Call Trace: [ 2013.508894][ T4972] [ 2013.508901][ T4972] dump_stack_lvl+0x100/0x190 [ 2013.508926][ T4972] should_fail_ex.cold+0x5/0xa [ 2013.508948][ T4972] _copy_from_user+0x2e/0xd0 [ 2013.508976][ T4972] copy_msghdr_from_user+0x9f/0x4c0 [ 2013.508998][ T4972] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 2013.509020][ T4972] ? kstrtouint_from_user+0x13c/0x1d0 [ 2013.509043][ T4972] ___sys_sendmsg+0x106/0x1e0 [ 2013.509063][ T4972] ? __pfx____sys_sendmsg+0x10/0x10 [ 2013.509083][ T4972] ? get_pid_task+0x106/0x250 [ 2013.509111][ T4972] ? rcu_is_watching+0x12/0xc0 [ 2013.509142][ T4972] __sys_sendmsg+0x160/0x210 [ 2013.509168][ T4972] ? __pfx___sys_sendmsg+0x10/0x10 [ 2013.509197][ T4972] ? rcu_is_watching+0x12/0xc0 [ 2013.509221][ T4972] do_syscall_64+0x115/0x870 [ 2013.509244][ T4972] ? clear_bhb_loop+0x40/0x90 [ 2013.509263][ T4972] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2013.509282][ T4972] RIP: 0033:0x7fa9b159ce59 [ 2013.509296][ T4972] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2013.509313][ T4972] RSP: 002b:00007fa9b2412028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2013.509332][ T4972] RAX: ffffffffffffffda RBX: 00007fa9b1815fa0 RCX: 00007fa9b159ce59 [ 2013.509343][ T4972] RDX: 0000000024000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 2013.509354][ T4972] RBP: 00007fa9b2412090 R08: 0000000000000000 R09: 0000000000000000 [ 2013.509365][ T4972] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2013.509376][ T4972] R13: 00007fa9b1816038 R14: 00007fa9b1815fa0 R15: 00007ffc5b87d9e8 [ 2013.509393][ T4972] [ 2013.745221][T23925] usb 3-1: unable to get BOS descriptor or descriptor too short [ 2013.753757][T23925] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2013.764521][T23925] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 2013.774188][T23925] usb 3-1: config 1 has no interface number 1 [ 2013.781961][T23925] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 2013.794883][T23925] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 2013.809060][T23925] usb 3-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 2013.818195][T23925] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2013.826359][T23925] usb 3-1: Product: syz [ 2013.830662][T23925] usb 3-1: Manufacturer: syz [ 2013.835255][T23925] usb 3-1: SerialNumber: syz [ 2014.015267][T18541] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 2014.149854][ T4983] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2014.158882][ T4983] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2014.177672][ T4983] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2014.186720][ T4983] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2014.188192][ T30] audit: type=1804 audit(1781909616.173:1383): pid=4983 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.2.8013" name="bus" dev="ramfs" ino=195070 res=1 errno=0 [ 2014.242174][T18541] usb 4-1: Using ep0 maxpacket: 8 [ 2014.430668][T18541] usb 4-1: config 1 has an invalid descriptor of length 62, skipping remainder of the config [ 2014.447943][T23925] usb 3-1: 2:1 : invalid UAC_AS_GENERAL desc [ 2014.454110][T18541] usb 4-1: too many endpoints for config 1 interface 2 altsetting 0: 53, using maximum allowed: 30 [ 2014.465072][T18541] usb 4-1: config 1 interface 2 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 53 [ 2014.937430][T23925] usb 3-1: USB disconnect, device number 47 [ 2014.980668][T18541] usb 4-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 2014.991776][T18541] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2015.000658][T28766] udevd[28766]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2015.025167][T18541] usb 4-1: Product: syz [ 2015.234769][T18541] usb 4-1: Manufacturer: syz [ 2015.242527][T18541] usb 4-1: SerialNumber: syz [ 2015.462458][ T5001] fuse: Unknown parameter '0xffffffffffffffff00000000000000000007' [ 2015.615880][ T5004] FAULT_INJECTION: forcing a failure. [ 2015.615880][ T5004] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2015.678539][ T5004] CPU: 0 UID: 0 PID: 5004 Comm: syz.2.8026 Tainted: G L syzkaller #0 PREEMPT(full) [ 2015.678560][ T5004] Tainted: [L]=SOFTLOCKUP [ 2015.678564][ T5004] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2015.678570][ T5004] Call Trace: [ 2015.678575][ T5004] [ 2015.678579][ T5004] dump_stack_lvl+0x100/0x190 [ 2015.678595][ T5004] should_fail_ex.cold+0x5/0xa [ 2015.678609][ T5004] _copy_from_user+0x2e/0xd0 [ 2015.678628][ T5004] move_addr_to_kernel+0x65/0x170 [ 2015.678641][ T5004] __sys_sendto+0x1b8/0x4e0 [ 2015.678655][ T5004] ? __pfx___sys_sendto+0x10/0x10 [ 2015.678671][ T5004] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 2015.678688][ T5004] ? exit_to_user_mode_loop+0x166/0x6f0 [ 2015.678700][ T5004] ? rcu_is_watching+0x12/0xc0 [ 2015.678716][ T5004] __x64_sys_sendto+0xe0/0x1c0 [ 2015.678730][ T5004] ? trace_irq_enable.constprop.0+0x122/0x160 [ 2015.678743][ T5004] do_syscall_64+0x115/0x870 [ 2015.678756][ T5004] ? clear_bhb_loop+0x40/0x90 [ 2015.678767][ T5004] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2015.678778][ T5004] RIP: 0033:0x7f378199ce59 [ 2015.678787][ T5004] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2015.678798][ T5004] RSP: 002b:00007f37828f3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 2015.678809][ T5004] RAX: ffffffffffffffda RBX: 00007f3781c15fa0 RCX: 00007f378199ce59 [ 2015.678816][ T5004] RDX: 000000000000fce0 RSI: 00002000000002c0 RDI: 0000000000000003 [ 2015.678823][ T5004] RBP: 00007f37828f3090 R08: 0000200000000140 R09: 0000000000000014 [ 2015.678829][ T5004] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000001 [ 2015.678836][ T5004] R13: 00007f3781c16038 R14: 00007f3781c15fa0 R15: 00007ffe467eb878 [ 2015.678846][ T5004] [ 2016.249754][ T5019] siw: device registration error -23 [ 2016.702385][T18541] usb 4-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 2016.791650][T18541] usb 4-1: clock source 0 is not valid, cannot use [ 2016.798524][T18541] usb 4-1: 1:1: cannot get freq (v2/v3): err -71 [ 2016.805310][T18541] usb 4-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 2016.814473][T18541] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 2016.865774][T18541] snd-usb-audio 4-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 2017.192429][T18541] snd-usb-audio 4-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 2017.199889][ T30] audit: type=1800 audit(1781909618.960:1384): pid=5018 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.8027" name="bus" dev="ramfs" ino=196365 res=0 errno=0 [ 2017.215613][T18541] usb 4-1: USB disconnect, device number 43 [ 2017.246033][T28801] udevd[28801]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2018.085836][ T5048] comedi comedi3: comedi_test: 8193 microvolt, 100000 microsecond waveform attached [ 2018.095797][ T30] audit: type=1800 audit(1781909619.791:1385): pid=5020 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.4.8028" name="bus" dev="ramfs" ino=195125 res=0 errno=0 [ 2018.253136][ T5053] fuse: Unknown parameter '0xffffffffffffffff00000000000000000007' [ 2018.491366][ T5057] netlink: 20 bytes leftover after parsing attributes in process `syz.2.8040'. [ 2018.579740][ T5060] FAULT_INJECTION: forcing a failure. [ 2018.579740][ T5060] name failslab, interval 1, probability 0, space 0, times 0 [ 2018.592431][ T5060] CPU: 1 UID: 0 PID: 5060 Comm: syz.1.8039 Tainted: G L syzkaller #0 PREEMPT(full) [ 2018.592460][ T5060] Tainted: [L]=SOFTLOCKUP [ 2018.592468][ T5060] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2018.592479][ T5060] Call Trace: [ 2018.592486][ T5060] [ 2018.592493][ T5060] dump_stack_lvl+0x100/0x190 [ 2018.592516][ T5060] should_fail_ex.cold+0x5/0xa [ 2018.592538][ T5060] ? __kmalloc_cache_noprof+0x53/0x6e0 [ 2018.592560][ T5060] should_failslab+0xc2/0x120 [ 2018.592587][ T5060] __kmalloc_cache_noprof+0x7a/0x6e0 [ 2018.592607][ T5060] ? assoc_array_clear+0x75/0x200 [ 2018.592629][ T5060] ? __pfx_down_write+0x10/0x10 [ 2018.592655][ T5060] assoc_array_clear+0x75/0x200 [ 2018.592675][ T5060] keyring_clear+0xb2/0x270 [ 2018.592700][ T5060] ? __pfx_keyring_clear+0x10/0x10 [ 2018.592724][ T5060] ? fput+0x79/0x100 [ 2018.592744][ T5060] ? ksys_write+0x1ac/0x250 [ 2018.592761][ T5060] keyctl_keyring_clear+0xd3/0x1a0 [ 2018.592779][ T5060] __do_sys_keyctl+0x3c6/0x5a0 [ 2018.592799][ T5060] do_syscall_64+0x115/0x870 [ 2018.592819][ T5060] ? clear_bhb_loop+0x40/0x90 [ 2018.592840][ T5060] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2018.592858][ T5060] RIP: 0033:0x7fda0e59ce59 [ 2018.592873][ T5060] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2018.592890][ T5060] RSP: 002b:00007fda0c7b4028 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 2018.592909][ T5060] RAX: ffffffffffffffda RBX: 00007fda0e816180 RCX: 00007fda0e59ce59 [ 2018.592922][ T5060] RDX: 0000000000000000 RSI: 000000000bdc8ea3 RDI: 0000000000000007 [ 2018.592933][ T5060] RBP: 00007fda0c7b4090 R08: 0000000000000000 R09: 0000000000000000 [ 2018.592944][ T5060] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2018.592954][ T5060] R13: 00007fda0e816218 R14: 00007fda0e816180 R15: 00007ffc4e68f568 [ 2018.592972][ T5060] [ 2018.593444][T23925] usb 1-1: new full-speed USB device number 15 using dummy_hcd [ 2019.300001][ T5068] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 2019.501405][T23925] usb 1-1: config 0 has an invalid interface number: 8 but max is 0 [ 2019.513319][T23925] usb 1-1: config 0 has no interface number 0 [ 2019.519963][T23925] usb 1-1: config 0 interface 8 altsetting 0 has an endpoint descriptor with address 0x9F, changing to 0x8F [ 2019.532248][T23925] usb 1-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 2019.547404][T23925] usb 1-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 2019.562345][T23925] usb 1-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 2019.572092][T23925] usb 1-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 2019.725866][T23925] usb 1-1: Product: syz [ 2019.802844][T23925] usb 1-1: SerialNumber: syz [ 2019.836778][T23925] usb 1-1: config 0 descriptor?? [ 2020.052081][T23925] cm109 1-1:0.8: invalid payload size 0, expected 4 [ 2020.064814][T23925] input: CM109 USB driver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.8/input/input108 [ 2020.406000][ T5084] netlink: 'syz.0.8035': attribute type 10 has an invalid length. [ 2020.567924][ T5092] bridge_slave_0: left allmulticast mode [ 2020.587205][ T5092] bridge_slave_0: left promiscuous mode [ 2020.605991][ T5092] bridge0: port 1(bridge_slave_0) entered disabled state [ 2020.643052][ T5092] bridge_slave_1: left allmulticast mode [ 2020.657685][ T5092] bridge0: port 2(bridge_slave_1) entered disabled state [ 2020.670196][ T5092] bond0: (slave bond_slave_0): Releasing backup interface [ 2020.696403][ T5092] bond0: (slave bond_slave_1): Releasing backup interface [ 2020.727353][ T5092] team0: Port device team_slave_0 removed [ 2020.760940][ T5092] team0: Port device team_slave_1 removed [ 2020.791733][ T5092] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2020.810240][ T5092] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2020.846558][ T5092] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2020.868932][ T5092] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2020.959266][ T5092] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 2020.980263][T18541] wg1 speed is unknown, defaulting to 1000 [ 2021.054666][ T5102] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8049'. [ 2021.064075][ T5102] netlink: 20 bytes leftover after parsing attributes in process `syz.2.8049'. [ 2021.119234][ T5102] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8049'. [ 2021.128354][ T5102] netlink: 20 bytes leftover after parsing attributes in process `syz.2.8049'. [ 2021.291298][ T5102] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8049'. [ 2021.484610][ T5108] fuse: Unknown parameter '0xffffffffffffffff00000000000000000007' [ 2021.772609][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 2021.772770][T18541] usb 1-1: USB disconnect, device number 15 [ 2021.779593][ C1] cm109 1-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 2022.858757][ T5111] FAULT_INJECTION: forcing a failure. [ 2022.858757][ T5111] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2022.871955][ T5111] CPU: 0 UID: 0 PID: 5111 Comm: syz.4.8052 Tainted: G L syzkaller #0 PREEMPT(full) [ 2022.871974][ T5111] Tainted: [L]=SOFTLOCKUP [ 2022.871978][ T5111] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2022.871985][ T5111] Call Trace: [ 2022.871988][ T5111] [ 2022.871992][ T5111] dump_stack_lvl+0x100/0x190 [ 2022.872008][ T5111] should_fail_ex.cold+0x5/0xa [ 2022.872021][ T5111] _copy_to_user+0x32/0xd0 [ 2022.872038][ T5111] simple_read_from_buffer+0xcb/0x170 [ 2022.872049][ T5111] proc_fail_nth_read+0x1af/0x230 [ 2022.872066][ T5111] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2022.872084][ T5111] ? security_file_permission+0x76/0x210 [ 2022.872099][ T5111] ? rw_verify_area+0xce/0x6d0 [ 2022.872113][ T5111] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2022.872129][ T5111] vfs_read+0x1e4/0xb40 [ 2022.872146][ T5111] ? __pfx_vfs_read+0x10/0x10 [ 2022.872161][ T5111] ? rcu_is_watching+0x12/0xc0 [ 2022.872177][ T5111] ? __fget_files+0x21f/0x3d0 [ 2022.872189][ T5111] ksys_read+0x12a/0x250 [ 2022.872205][ T5111] ? __pfx_ksys_read+0x10/0x10 [ 2022.872221][ T5111] ? rcu_is_watching+0x12/0xc0 [ 2022.872235][ T5111] do_syscall_64+0x115/0x870 [ 2022.872249][ T5111] ? clear_bhb_loop+0x40/0x90 [ 2022.872261][ T5111] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2022.872271][ T5111] RIP: 0033:0x7f096cd5d68e [ 2022.872280][ T5111] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 2022.872291][ T5111] RSP: 002b:00007f096dbb7fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2022.872302][ T5111] RAX: ffffffffffffffda RBX: 00007f096dbb86c0 RCX: 00007f096cd5d68e [ 2022.872309][ T5111] RDX: 000000000000000f RSI: 00007f096dbb80a0 RDI: 0000000000000004 [ 2022.872316][ T5111] RBP: 00007f096dbb8090 R08: 0000000000000000 R09: 0000000000000000 [ 2022.872322][ T5111] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2022.872328][ T5111] R13: 00007f096d016038 R14: 00007f096d015fa0 R15: 00007ffe3f459688 [ 2022.872338][ T5111] [ 2023.090226][T18541] cm109 1-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 2023.116232][ T5112] Can't find ip_set type hash:ip, [ 2023.469851][ T5126] FAULT_INJECTION: forcing a failure. [ 2023.469851][ T5126] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2023.483077][ T5126] CPU: 0 UID: 0 PID: 5126 Comm: syz.4.8055 Tainted: G L syzkaller #0 PREEMPT(full) [ 2023.483104][ T5126] Tainted: [L]=SOFTLOCKUP [ 2023.483110][ T5126] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2023.483118][ T5126] Call Trace: [ 2023.483122][ T5126] [ 2023.483127][ T5126] dump_stack_lvl+0x100/0x190 [ 2023.483142][ T5126] should_fail_ex.cold+0x5/0xa [ 2023.483156][ T5126] _copy_from_user+0x2e/0xd0 [ 2023.483173][ T5126] io_uring_setup+0xc0/0x160 [ 2023.483185][ T5126] ? __pfx_io_uring_setup+0x10/0x10 [ 2023.483196][ T5126] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 2023.483215][ T5126] ? rcu_is_watching+0x12/0xc0 [ 2023.483230][ T5126] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 2023.483245][ T5126] ? lock_release+0x24d/0x310 [ 2023.483260][ T5126] ? __x64_sys_io_uring_setup+0x7f/0x170 [ 2023.483272][ T5126] ? security_uring_allowed+0x7a/0x1c0 [ 2023.483286][ T5126] __x64_sys_io_uring_setup+0xc2/0x170 [ 2023.483298][ T5126] do_syscall_64+0x115/0x870 [ 2023.483311][ T5126] ? clear_bhb_loop+0x40/0x90 [ 2023.483323][ T5126] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2023.483334][ T5126] RIP: 0033:0x7f096cd9ce59 [ 2023.483343][ T5126] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2023.483354][ T5126] RSP: 002b:00007f096db94ee8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 2023.483364][ T5126] RAX: ffffffffffffffda RBX: 00002000000002c8 RCX: 00007f096cd9ce59 [ 2023.483372][ T5126] RDX: 0000200000000348 RSI: 00002000000002c8 RDI: 0000000000000e50 [ 2023.483378][ T5126] RBP: 00002000000002c0 R08: 0000200000001540 R09: 0000000000000000 [ 2023.483385][ T5126] R10: 0000200000000350 R11: 0000000000000206 R12: 0000200000000348 [ 2023.483392][ T5126] R13: 0000200000000350 R14: 00007f096db94fd8 R15: 0000000000000000 [ 2023.483401][ T5126] [ 2024.060176][T28895] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 2024.159381][ T5145] FAULT_INJECTION: forcing a failure. [ 2024.159381][ T5145] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2024.179584][ T5145] CPU: 0 UID: 0 PID: 5145 Comm: syz.3.8061 Tainted: G L syzkaller #0 PREEMPT(full) [ 2024.179613][ T5145] Tainted: [L]=SOFTLOCKUP [ 2024.179620][ T5145] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2024.179629][ T5145] Call Trace: [ 2024.179635][ T5145] [ 2024.179642][ T5145] dump_stack_lvl+0x100/0x190 [ 2024.179664][ T5145] should_fail_ex.cold+0x5/0xa [ 2024.179681][ T5145] _copy_from_user+0x2e/0xd0 [ 2024.179702][ T5145] copy_msghdr_from_user+0x9f/0x4c0 [ 2024.179720][ T5145] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 2024.179737][ T5145] ? kstrtouint_from_user+0x13c/0x1d0 [ 2024.179755][ T5145] ___sys_sendmsg+0x106/0x1e0 [ 2024.179771][ T5145] ? __pfx____sys_sendmsg+0x10/0x10 [ 2024.179786][ T5145] ? get_pid_task+0x106/0x250 [ 2024.179807][ T5145] ? rcu_is_watching+0x12/0xc0 [ 2024.179830][ T5145] __sys_sendmsg+0x160/0x210 [ 2024.179849][ T5145] ? __pfx___sys_sendmsg+0x10/0x10 [ 2024.179871][ T5145] ? rcu_is_watching+0x12/0xc0 [ 2024.179889][ T5145] do_syscall_64+0x115/0x870 [ 2024.179905][ T5145] ? clear_bhb_loop+0x40/0x90 [ 2024.179920][ T5145] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2024.179933][ T5145] RIP: 0033:0x7fa9b159ce59 [ 2024.179944][ T5145] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2024.179957][ T5145] RSP: 002b:00007fa9b2412028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2024.179971][ T5145] RAX: ffffffffffffffda RBX: 00007fa9b1815fa0 RCX: 00007fa9b159ce59 [ 2024.179980][ T5145] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000003 [ 2024.179989][ T5145] RBP: 00007fa9b2412090 R08: 0000000000000000 R09: 0000000000000000 [ 2024.179997][ T5145] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2024.180005][ T5145] R13: 00007fa9b1816038 R14: 00007fa9b1815fa0 R15: 00007ffc5b87d9e8 [ 2024.180018][ T5145] [ 2024.418371][T28895] usb 3-1: Using ep0 maxpacket: 8 [ 2024.427170][T28895] usb 3-1: config 1 has an invalid descriptor of length 62, skipping remainder of the config [ 2024.437459][T28895] usb 3-1: too many endpoints for config 1 interface 2 altsetting 0: 53, using maximum allowed: 30 [ 2024.448793][T28895] usb 3-1: config 1 interface 2 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 53 [ 2024.480297][T28895] usb 3-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 2024.493717][T28895] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2024.501884][T28895] usb 3-1: Product: syz [ 2024.507228][T28895] usb 3-1: Manufacturer: syz [ 2024.511848][T28895] usb 3-1: SerialNumber: syz [ 2024.764998][T17779] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 2024.938165][T17779] usb 4-1: Using ep0 maxpacket: 16 [ 2024.947950][T17779] usb 4-1: config 9 has an invalid interface number: 83 but max is 0 [ 2024.956274][T17779] usb 4-1: config 9 has no interface number 0 [ 2024.962550][T17779] usb 4-1: config 9 interface 83 has no altsetting 0 [ 2024.973324][T17779] usb 4-1: New USB device found, idVendor=1164, idProduct=0871, bcdDevice=b8.ed [ 2024.982841][T17779] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2024.983481][ T5155] fuse: Unknown parameter 'fdP0x0000000000000003' [ 2024.997792][T17779] usb 4-1: Product: syz [ 2025.002008][T17779] usb 4-1: Manufacturer: syz [ 2025.007804][T17779] usb 4-1: SerialNumber: syz [ 2025.146294][ T5159] FAULT_INJECTION: forcing a failure. [ 2025.146294][ T5159] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2025.159538][ T5159] CPU: 0 UID: 0 PID: 5159 Comm: syz.1.8067 Tainted: G L syzkaller #0 PREEMPT(full) [ 2025.159566][ T5159] Tainted: [L]=SOFTLOCKUP [ 2025.159572][ T5159] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2025.159582][ T5159] Call Trace: [ 2025.159588][ T5159] [ 2025.159594][ T5159] dump_stack_lvl+0x100/0x190 [ 2025.159618][ T5159] should_fail_ex.cold+0x5/0xa [ 2025.159638][ T5159] _copy_to_user+0x32/0xd0 [ 2025.159664][ T5159] simple_read_from_buffer+0xcb/0x170 [ 2025.159687][ T5159] proc_fail_nth_read+0x1af/0x230 [ 2025.159712][ T5159] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2025.159735][ T5159] ? security_file_permission+0x76/0x210 [ 2025.159754][ T5159] ? rw_verify_area+0xce/0x6d0 [ 2025.159776][ T5159] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2025.159799][ T5159] vfs_read+0x1e4/0xb40 [ 2025.159824][ T5159] ? __pfx_vfs_read+0x10/0x10 [ 2025.159848][ T5159] ? rcu_is_watching+0x12/0xc0 [ 2025.159873][ T5159] ? __fget_files+0x21f/0x3d0 [ 2025.159892][ T5159] ksys_read+0x12a/0x250 [ 2025.159914][ T5159] ? __pfx_ksys_read+0x10/0x10 [ 2025.159938][ T5159] ? rcu_is_watching+0x12/0xc0 [ 2025.159960][ T5159] do_syscall_64+0x115/0x870 [ 2025.159979][ T5159] ? clear_bhb_loop+0x40/0x90 [ 2025.159998][ T5159] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2025.160015][ T5159] RIP: 0033:0x7fda0e55d68e [ 2025.160029][ T5159] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 2025.160046][ T5159] RSP: 002b:00007fda0c7d4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2025.160063][ T5159] RAX: ffffffffffffffda RBX: 00007fda0c7d56c0 RCX: 00007fda0e55d68e [ 2025.160074][ T5159] RDX: 000000000000000f RSI: 00007fda0c7d50a0 RDI: 0000000000000005 [ 2025.160085][ T5159] RBP: 00007fda0c7d5090 R08: 0000000000000000 R09: 0000000000000000 [ 2025.160096][ T5159] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2025.160106][ T5159] R13: 00007fda0e816128 R14: 00007fda0e816090 R15: 00007ffc4e68f568 [ 2025.160123][ T5159] [ 2025.715464][T17779] dvb-usb: found a 'YUAN High-Tech MC770' in warm state. [ 2025.827500][T17779] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 2025.849050][T17779] dvbdev: DVB: registering new adapter (YUAN High-Tech MC770) [ 2025.856941][T17779] usb 4-1: media controller created [ 2025.857039][T28895] usb 3-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 2025.866877][T17779] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2025.873467][T28895] usb 3-1: clock source 0 is not valid, cannot use [ 2026.047358][T28895] usb 3-1: 1:1: cannot get freq (v2/v3): err -71 [ 2026.085146][T28895] usb 3-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 2026.110059][T28895] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 2026.372003][T17779] DVB: Unable to find symbol dib7000p_attach() [ 2026.378272][T17779] dvb-usb: no frontend was attached by 'YUAN High-Tech MC770' [ 2026.402414][T28895] snd-usb-audio 3-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 2026.468476][T17779] rc_core: IR keymap rc-dib0700-rc5 not found [ 2026.474728][T17779] Registered IR keymap rc-empty [ 2026.488579][T17779] dvb-usb: could not initialize remote control. [ 2026.523364][T17779] dvb-usb: YUAN High-Tech MC770 successfully initialized and connected. [ 2026.527679][T28895] snd-usb-audio 3-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 2026.565515][T28895] usb 3-1: USB disconnect, device number 48 [ 2026.614977][T28764] udevd[28764]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2026.772172][ T5179] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 2027.051294][T18541] usb 4-1: USB disconnect, device number 44 [ 2027.076012][T18541] dvb-usb: YUAN High-Tech MC770 successfully deinitialized and disconnected. [ 2027.612444][ T5185] siw: device registration error -23 [ 2028.264732][T18541] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 2028.276991][T23925] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 2028.449224][T23925] usb 4-1: Using ep0 maxpacket: 8 [ 2028.633544][T23925] usb 4-1: config 1 has an invalid descriptor of length 62, skipping remainder of the config [ 2028.700152][T23925] usb 4-1: too many endpoints for config 1 interface 2 altsetting 0: 53, using maximum allowed: 30 [ 2028.701454][T18541] usb 1-1: unable to get BOS descriptor or descriptor too short [ 2028.730215][T23925] usb 4-1: config 1 interface 2 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 53 [ 2028.730922][T18541] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2028.754772][T18541] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 2028.763842][T18541] usb 1-1: config 1 has no interface number 1 [ 2028.772114][T18541] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 2028.787620][T18541] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 2028.791097][T23925] usb 4-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 2028.811839][T18541] usb 1-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 2028.823055][T23925] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2028.836312][T18541] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2028.846597][T23925] usb 4-1: Product: syz [ 2028.847185][T18541] usb 1-1: Product: syz [ 2028.855097][T23925] usb 4-1: Manufacturer: syz [ 2028.859786][T18541] usb 1-1: Manufacturer: syz [ 2028.867935][T23925] usb 4-1: SerialNumber: syz [ 2028.868582][T18541] usb 1-1: SerialNumber: syz [ 2029.423094][ T5218] siw: device registration error -23 [ 2029.456747][ T5218] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2029.467178][ T5218] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2029.561265][ T5218] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2029.572570][ T5218] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2029.646849][ T30] audit: type=1804 audit(1781909630.357:1386): pid=5218 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.0.8077" name="bus" dev="ramfs" ino=195582 res=1 errno=0 [ 2029.958180][T28895] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 2030.194381][T23925] usb 4-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 2030.215296][T23925] usb 4-1: clock source 0 is not valid, cannot use [ 2030.226999][T23925] usb 4-1: 1:1: cannot get freq (v2/v3): err -71 [ 2030.241640][T23925] usb 4-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 2030.242192][T28895] usb 3-1: unable to get BOS descriptor or descriptor too short [ 2030.251123][T23925] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 2030.258954][T18541] usb 1-1: 2:1 : invalid UAC_AS_GENERAL desc [ 2030.282017][T28895] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2030.296919][ T5229] FAULT_INJECTION: forcing a failure. [ 2030.296919][ T5229] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2030.310145][T28895] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 2030.310646][ T5229] CPU: 1 UID: 0 PID: 5229 Comm: syz.4.8088 Tainted: G L syzkaller #0 PREEMPT(full) [ 2030.310669][ T5229] Tainted: [L]=SOFTLOCKUP [ 2030.310675][ T5229] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2030.310684][ T5229] Call Trace: [ 2030.310689][ T5229] [ 2030.310695][ T5229] dump_stack_lvl+0x100/0x190 [ 2030.310719][ T5229] should_fail_ex.cold+0x5/0xa [ 2030.310738][ T5229] _copy_to_user+0x32/0xd0 [ 2030.310762][ T5229] simple_read_from_buffer+0xcb/0x170 [ 2030.310779][ T5229] proc_fail_nth_read+0x1af/0x230 [ 2030.310803][ T5229] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2030.310826][ T5229] ? security_file_permission+0x76/0x210 [ 2030.310846][ T5229] ? rw_verify_area+0xce/0x6d0 [ 2030.310866][ T5229] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2030.310889][ T5229] vfs_read+0x1e4/0xb40 [ 2030.310911][ T5229] ? __pfx_vfs_read+0x10/0x10 [ 2030.310933][ T5229] ? rcu_is_watching+0x12/0xc0 [ 2030.310954][ T5229] ? __fget_files+0x21f/0x3d0 [ 2030.310972][ T5229] ksys_read+0x12a/0x250 [ 2030.310993][ T5229] ? __pfx_ksys_read+0x10/0x10 [ 2030.311015][ T5229] ? rcu_is_watching+0x12/0xc0 [ 2030.311035][ T5229] do_syscall_64+0x115/0x870 [ 2030.311053][ T5229] ? clear_bhb_loop+0x40/0x90 [ 2030.311070][ T5229] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2030.311085][ T5229] RIP: 0033:0x7f096cd5d68e [ 2030.311098][ T5229] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 2030.311113][ T5229] RSP: 002b:00007f096dbb7fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2030.311129][ T5229] RAX: ffffffffffffffda RBX: 00007f096dbb86c0 RCX: 00007f096cd5d68e [ 2030.311140][ T5229] RDX: 000000000000000f RSI: 00007f096dbb80a0 RDI: 0000000000000005 [ 2030.311154][ T5229] RBP: 00007f096dbb8090 R08: 0000000000000000 R09: 0000000000000000 [ 2030.311163][ T5229] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2030.311173][ T5229] R13: 00007f096d016038 R14: 00007f096d015fa0 R15: 00007ffe3f459688 [ 2030.311188][ T5229] [ 2030.311615][T23925] snd-usb-audio 4-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 2030.325494][T18541] usb 1-1: USB disconnect, device number 16 [ 2030.519101][T23925] snd-usb-audio 4-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 2030.532512][T28895] usb 3-1: config 1 has no interface number 1 [ 2030.548488][T28895] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 2030.561269][T28895] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 2030.582052][T28895] usb 3-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 2030.591233][T28895] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2030.599585][T28895] usb 3-1: Product: syz [ 2030.608057][T28895] usb 3-1: Manufacturer: syz [ 2030.619562][T28895] usb 3-1: SerialNumber: syz [ 2030.661301][T23925] usb 4-1: USB disconnect, device number 45 [ 2030.664753][T28803] udevd[28803]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.2/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 2031.043241][ T5237] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2031.054528][ T5237] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2031.453979][ T30] audit: type=1804 audit(1781909632.119:1387): pid=5219 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.2.8085" name="bus" dev="ramfs" ino=197157 res=1 errno=0 [ 2031.461559][T23925] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 2031.484748][ T5219] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2031.493528][ T5219] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2031.508931][T28895] usb 3-1: 2:1 : invalid UAC_AS_GENERAL desc [ 2031.524224][ T30] audit: type=1400 audit(1781909632.184:1388): avc: denied { map } for pid=5247 comm="syz.3.8093" path="socket:[197164]" dev="sockfs" ino=197164 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 2031.548873][ T5249] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8093'. [ 2031.620903][T28895] usb 3-1: USB disconnect, device number 49 [ 2031.645865][ T30] audit: type=1400 audit(1781909632.184:1389): avc: denied { accept } for pid=5247 comm="syz.3.8093" path="socket:[197164]" dev="sockfs" ino=197164 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 2031.710816][T23925] usb 1-1: Using ep0 maxpacket: 8 [ 2031.777808][T23925] usb 1-1: config 1 has an invalid descriptor of length 62, skipping remainder of the config [ 2031.810910][T28766] udevd[28766]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2031.829768][T23925] usb 1-1: too many endpoints for config 1 interface 2 altsetting 0: 53, using maximum allowed: 30 [ 2031.876476][T23925] usb 1-1: config 1 interface 2 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 53 [ 2031.990187][T23925] usb 1-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 2032.015555][T23925] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2032.023786][T23925] usb 1-1: Product: syz [ 2032.030617][T23925] usb 1-1: Manufacturer: syz [ 2032.035346][T23925] usb 1-1: SerialNumber: syz [ 2032.130713][ T5258] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 2032.421123][ T5263] fuse: Unknown parameter '0xffffffffffffffff00000000000000000007' [ 2032.815178][T23925] usb 1-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 2032.989316][T23925] usb 1-1: clock source 0 is not valid, cannot use [ 2032.999838][T23925] usb 1-1: 1:1: cannot get freq (v2/v3): err -71 [ 2033.006897][T23925] usb 1-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 2033.020865][T23925] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 2033.042093][T23925] snd-usb-audio 1-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 2033.078588][T23925] snd-usb-audio 1-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 2033.091150][T23925] usb 1-1: USB disconnect, device number 17 [ 2033.118787][T28763] udevd[28763]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2033.143234][T18542] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 2033.337566][T18542] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2033.348080][T18542] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 2033.357448][T18542] usb 3-1: config 1 has no interface number 0 [ 2033.364386][T18542] usb 3-1: config 1 interface 2 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 2033.377556][T18542] usb 3-1: Duplicate descriptor for config 1 interface 2 altsetting 0, skipping [ 2033.388939][T18542] usb 3-1: config 1 interface 2 has no altsetting 1 [ 2033.397237][T18542] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 2033.406479][T18542] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2033.415663][T18542] usb 3-1: Product: syz [ 2033.421509][T18542] usb 3-1: Manufacturer: syz [ 2033.426295][T18542] usb 3-1: SerialNumber: syz [ 2033.968515][T18542] usb 3-1: USB disconnect, device number 50 [ 2034.018109][ T5296] [U] v3f"S/4:XTzWtlW= [ 2034.024337][ T5296] [U] J"e:" [ 2035.200743][ T5326] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 2035.275980][T28895] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 2035.449484][T28895] usb 1-1: Using ep0 maxpacket: 8 [ 2035.455919][T28895] usb 1-1: config 1 has an invalid descriptor of length 62, skipping remainder of the config [ 2035.469286][T28895] usb 1-1: too many endpoints for config 1 interface 2 altsetting 0: 53, using maximum allowed: 30 [ 2035.497387][T28895] usb 1-1: config 1 interface 2 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 53 [ 2035.515496][T28895] usb 1-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 2035.525633][T28895] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2035.533676][T28895] usb 1-1: Product: syz [ 2035.538323][T28895] usb 1-1: Manufacturer: syz [ 2035.546480][T28895] usb 1-1: SerialNumber: syz [ 2035.785374][T18542] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 2035.947895][T18542] usb 2-1: Using ep0 maxpacket: 8 [ 2036.040566][T18542] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 2036.057130][T18542] usb 2-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 2036.066871][T18542] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2036.076144][T18542] usb 2-1: Product: syz [ 2036.081009][T18542] usb 2-1: Manufacturer: syz [ 2036.085701][T18542] usb 2-1: SerialNumber: syz [ 2036.092882][T18542] usb 2-1: config 0 descriptor?? [ 2036.098975][ T5332] fuse: Unknown parameter '0xffffffffffffffff00000000000000000007' [ 2036.109258][T18542] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 2036.511377][T28895] usb 1-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 2036.619841][T28895] usb 1-1: clock source 0 is not valid, cannot use [ 2036.699409][T28895] usb 1-1: 1:1: cannot get freq (v2/v3): err -71 [ 2036.705782][T18542] gspca_zc3xx: reg_w_i err -110 [ 2036.719189][T28895] usb 1-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 2036.733473][T28895] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 2036.755428][T28895] snd-usb-audio 1-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 2036.946830][T28895] snd-usb-audio 1-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 2037.017074][T28895] usb 1-1: USB disconnect, device number 18 [ 2037.034307][T28801] udevd[28801]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2037.346475][T18542] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 2037.353208][T18542] gspca_zc3xx 2-1:0.0: probe with driver gspca_zc3xx failed with error -110 [ 2038.288589][T23925] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 2038.474278][T23925] usb 3-1: unable to get BOS descriptor or descriptor too short [ 2038.482826][T23925] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2038.493140][T23925] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 2038.502373][T23925] usb 3-1: config 1 has no interface number 1 [ 2038.508672][T23925] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 2038.521580][T23925] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 2038.534035][T23925] usb 3-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 2038.543151][T23925] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2038.551202][T23925] usb 3-1: Product: syz [ 2038.555369][T23925] usb 3-1: Manufacturer: syz [ 2038.559973][T23925] usb 3-1: SerialNumber: syz [ 2038.745030][ T5375] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2038.767726][T17779] usb 2-1: USB disconnect, device number 38 [ 2038.853880][ T5376] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2038.862961][ T5376] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2038.945370][ T5376] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2038.954799][ T5376] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2039.064815][ T30] audit: type=1804 audit(1781909639.031:1390): pid=5376 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.2.8126" name="bus" dev="ramfs" ino=198133 res=1 errno=0 [ 2039.142792][ T5380] FAULT_INJECTION: forcing a failure. [ 2039.142792][ T5380] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2039.155955][ T5380] CPU: 0 UID: 0 PID: 5380 Comm: syz.0.8130 Tainted: G L syzkaller #0 PREEMPT(full) [ 2039.155980][ T5380] Tainted: [L]=SOFTLOCKUP [ 2039.155984][ T5380] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2039.155990][ T5380] Call Trace: [ 2039.155994][ T5380] [ 2039.155998][ T5380] dump_stack_lvl+0x100/0x190 [ 2039.156013][ T5380] should_fail_ex.cold+0x5/0xa [ 2039.156027][ T5380] _copy_from_user+0x2e/0xd0 [ 2039.156049][ T5380] core_sys_select+0x2d0/0xbb0 [ 2039.156067][ T5380] ? __pfx_core_sys_select+0x10/0x10 [ 2039.156083][ T5380] ? get_pid_task+0xfc/0x250 [ 2039.156114][ T5380] ? __pfx_set_user_sigmask+0x10/0x10 [ 2039.156125][ T5380] ? __mutex_unlock_slowpath+0x35d/0x930 [ 2039.156140][ T5380] do_pselect.constprop.0+0x238/0x270 [ 2039.156151][ T5380] ? __pfx_do_pselect.constprop.0+0x10/0x10 [ 2039.156163][ T5380] ? ksys_write+0x1ac/0x250 [ 2039.156174][ T5380] __x64_sys_pselect6+0x149/0x1c0 [ 2039.156189][ T5380] do_syscall_64+0x115/0x870 [ 2039.156208][ T5380] ? clear_bhb_loop+0x40/0x90 [ 2039.156227][ T5380] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2039.156243][ T5380] RIP: 0033:0x7fda4319ce59 [ 2039.156255][ T5380] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2039.156269][ T5380] RSP: 002b:00007fda43fba028 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 2039.156281][ T5380] RAX: ffffffffffffffda RBX: 00007fda43415fa0 RCX: 00007fda4319ce59 [ 2039.156288][ T5380] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000040 [ 2039.156294][ T5380] RBP: 00007fda43fba090 R08: 0000000000000000 R09: 0000000000000000 [ 2039.156301][ T5380] R10: 00002000000002c0 R11: 0000000000000246 R12: 0000000000000001 [ 2039.156307][ T5380] R13: 00007fda43416038 R14: 00007fda43415fa0 R15: 00007ffd13275218 [ 2039.156317][ T5380] [ 2039.360713][ T5375] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2039.378075][T23925] usb 3-1: 2:1 : invalid UAC_AS_GENERAL desc [ 2039.404372][T23925] usb 3-1: USB disconnect, device number 51 [ 2039.431204][T28766] udevd[28766]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2039.508045][ T5385] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 2039.826197][ T5375] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2040.938810][ T5375] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2041.202812][ T48] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2041.225445][ T30] audit: type=1400 audit(1781909641.144:1391): avc: denied { write } for pid=5399 comm="syz.2.8135" name="cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 2041.369112][ T5406] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 2041.549466][ T48] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2041.809030][ T36] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2041.878016][ T36] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2042.287888][ T5425] netlink: 92 bytes leftover after parsing attributes in process `syz.2.8140'. [ 2042.304288][ T5419] siw: device registration error -23 [ 2042.341474][T26169] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 2042.564317][T26169] usb 5-1: Using ep0 maxpacket: 8 [ 2042.571079][T26169] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 2042.582996][T26169] usb 5-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 2042.592725][T26169] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2042.600731][T26169] usb 5-1: Product: syz [ 2042.605163][T26169] usb 5-1: Manufacturer: syz [ 2042.609773][T26169] usb 5-1: SerialNumber: syz [ 2042.622141][T26169] usb 5-1: config 0 descriptor?? [ 2043.251430][T26169] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 2043.274914][ T5440] FAULT_INJECTION: forcing a failure. [ 2043.274914][ T5440] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2043.288114][ T5440] CPU: 0 UID: 0 PID: 5440 Comm: syz.1.8144 Tainted: G L syzkaller #0 PREEMPT(full) [ 2043.288133][ T5440] Tainted: [L]=SOFTLOCKUP [ 2043.288137][ T5440] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2043.288146][ T5440] Call Trace: [ 2043.288151][ T5440] [ 2043.288155][ T5440] dump_stack_lvl+0x100/0x190 [ 2043.288171][ T5440] should_fail_ex.cold+0x5/0xa [ 2043.288185][ T5440] _copy_from_user+0x2e/0xd0 [ 2043.288202][ T5440] copy_msghdr_from_user+0x9f/0x4c0 [ 2043.288216][ T5440] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 2043.288230][ T5440] ? kstrtouint_from_user+0x13c/0x1d0 [ 2043.288243][ T5440] ___sys_sendmsg+0x106/0x1e0 [ 2043.288255][ T5440] ? __pfx____sys_sendmsg+0x10/0x10 [ 2043.288267][ T5440] ? get_pid_task+0x106/0x250 [ 2043.288285][ T5440] ? rcu_is_watching+0x12/0xc0 [ 2043.288302][ T5440] __sys_sendmsg+0x160/0x210 [ 2043.288318][ T5440] ? __pfx___sys_sendmsg+0x10/0x10 [ 2043.288335][ T5440] ? rcu_is_watching+0x12/0xc0 [ 2043.288349][ T5440] do_syscall_64+0x115/0x870 [ 2043.288363][ T5440] ? clear_bhb_loop+0x40/0x90 [ 2043.288375][ T5440] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2043.288386][ T5440] RIP: 0033:0x7fda0e59ce59 [ 2043.288395][ T5440] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2043.288406][ T5440] RSP: 002b:00007fda0c7f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2043.288417][ T5440] RAX: ffffffffffffffda RBX: 00007fda0e815fa0 RCX: 00007fda0e59ce59 [ 2043.288424][ T5440] RDX: 0000000000044001 RSI: 00002000000005c0 RDI: 0000000000000003 [ 2043.288431][ T5440] RBP: 00007fda0c7f6090 R08: 0000000000000000 R09: 0000000000000000 [ 2043.288437][ T5440] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2043.288443][ T5440] R13: 00007fda0e816038 R14: 00007fda0e815fa0 R15: 00007ffc4e68f568 [ 2043.288453][ T5440] [ 2043.895550][T28895] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 2043.904201][T26169] gspca_zc3xx: reg_w_i err -110 [ 2044.190172][T28895] usb 3-1: unable to get BOS descriptor or descriptor too short [ 2044.199128][T28895] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2044.216521][T28895] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 2044.227085][T28895] usb 3-1: config 1 has no interface number 1 [ 2044.233275][T28895] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 2044.248278][T28895] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 2044.262131][T28895] usb 3-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 2044.272645][T28895] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2044.281102][T28895] usb 3-1: Product: syz [ 2044.285634][T28895] usb 3-1: Manufacturer: syz [ 2044.290270][T28895] usb 3-1: SerialNumber: syz [ 2044.845795][T26169] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 2044.924050][T26169] gspca_zc3xx 5-1:0.0: probe with driver gspca_zc3xx failed with error -110 [ 2044.944115][ T5469] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 2045.108077][ T5467] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2045.135567][ T5467] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2045.255074][ T5442] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2045.263739][ T5442] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2045.272960][ T30] audit: type=1804 audit(1781909644.854:1392): pid=5442 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.2.8145" name="bus" dev="ramfs" ino=199059 res=1 errno=0 [ 2045.299534][T28895] usb 3-1: 2:1 : invalid UAC_AS_GENERAL desc [ 2045.304975][T17779] usb 5-1: USB disconnect, device number 32 [ 2045.733382][T28895] usb 3-1: USB disconnect, device number 52 [ 2045.774406][T28766] udevd[28766]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2045.919211][ T5477] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8154'. [ 2045.946330][ T5477] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8154'. [ 2045.969391][ T5477] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8154'. [ 2046.127200][ T5492] FAULT_INJECTION: forcing a failure. [ 2046.127200][ T5492] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2046.141872][ T5492] CPU: 0 UID: 0 PID: 5492 Comm: syz.1.8160 Tainted: G L syzkaller #0 PREEMPT(full) [ 2046.141900][ T5492] Tainted: [L]=SOFTLOCKUP [ 2046.141906][ T5492] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2046.141917][ T5492] Call Trace: [ 2046.141923][ T5492] [ 2046.141930][ T5492] dump_stack_lvl+0x100/0x190 [ 2046.141953][ T5492] should_fail_ex.cold+0x5/0xa [ 2046.141973][ T5492] _copy_from_user+0x2e/0xd0 [ 2046.141997][ T5492] __sys_bpf+0x2f5/0x4e80 [ 2046.142030][ T5492] ? kstrtouint_from_user+0x80/0x1d0 [ 2046.142051][ T5492] ? __pfx___sys_bpf+0x10/0x10 [ 2046.142073][ T5492] ? rcu_is_watching+0x12/0xc0 [ 2046.142096][ T5492] ? get_pid_task+0xfc/0x250 [ 2046.142120][ T5492] ? rcu_is_watching+0x12/0xc0 [ 2046.142142][ T5492] ? get_pid_task+0xfc/0x250 [ 2046.142161][ T5492] ? lock_release+0x24d/0x310 [ 2046.142183][ T5492] ? ksys_write+0x12a/0x250 [ 2046.142198][ T5492] ? rcu_is_watching+0x12/0xc0 [ 2046.142220][ T5492] ? preempt_count_add+0x76/0x150 [ 2046.142238][ T5492] ? ksys_write+0x190/0x250 [ 2046.142251][ T5492] ? rcu_is_watching+0x12/0xc0 [ 2046.142272][ T5492] ? ksys_write+0x190/0x250 [ 2046.142285][ T5492] ? lock_release+0x24d/0x310 [ 2046.142309][ T5492] ? fput+0x79/0x100 [ 2046.142330][ T5492] ? __x64_sys_bpf+0xce/0x140 [ 2046.142353][ T5492] __x64_sys_bpf+0xce/0x140 [ 2046.142376][ T5492] ? trace_irq_enable.constprop.0+0x122/0x160 [ 2046.142397][ T5492] do_syscall_64+0x115/0x870 [ 2046.142417][ T5492] ? clear_bhb_loop+0x40/0x90 [ 2046.142437][ T5492] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2046.142454][ T5492] RIP: 0033:0x7fda0e59ce59 [ 2046.142467][ T5492] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2046.142482][ T5492] RSP: 002b:00007fda0c7f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 2046.142499][ T5492] RAX: ffffffffffffffda RBX: 00007fda0e815fa0 RCX: 00007fda0e59ce59 [ 2046.142511][ T5492] RDX: 0000000000000050 RSI: 0000200000000080 RDI: 000000000000000a [ 2046.142521][ T5492] RBP: 00007fda0c7f6090 R08: 0000000000000000 R09: 0000000000000000 [ 2046.142531][ T5492] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2046.142541][ T5492] R13: 00007fda0e816038 R14: 00007fda0e815fa0 R15: 00007ffc4e68f568 [ 2046.142556][ T5492] [ 2046.143042][ T5494] FAULT_INJECTION: forcing a failure. [ 2046.143042][ T5494] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2046.158821][ T5493] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2046.292216][ T5494] CPU: 0 UID: 0 PID: 5494 Comm: syz.4.8159 Tainted: G L syzkaller #0 PREEMPT(full) [ 2046.292243][ T5494] Tainted: [L]=SOFTLOCKUP [ 2046.292249][ T5494] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2046.292258][ T5494] Call Trace: [ 2046.292264][ T5494] [ 2046.292270][ T5494] dump_stack_lvl+0x100/0x190 [ 2046.292291][ T5494] should_fail_ex.cold+0x5/0xa [ 2046.292311][ T5494] _copy_to_user+0x32/0xd0 [ 2046.292334][ T5494] simple_read_from_buffer+0xcb/0x170 [ 2046.292351][ T5494] proc_fail_nth_read+0x1af/0x230 [ 2046.292375][ T5494] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2046.292398][ T5494] ? security_file_permission+0x76/0x210 [ 2046.292418][ T5494] ? rw_verify_area+0xce/0x6d0 [ 2046.292439][ T5494] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2046.292461][ T5494] vfs_read+0x1e4/0xb40 [ 2046.292484][ T5494] ? __pfx_vfs_read+0x10/0x10 [ 2046.292505][ T5494] ? rcu_is_watching+0x12/0xc0 [ 2046.292527][ T5494] ? __fget_files+0x21f/0x3d0 [ 2046.292544][ T5494] ksys_read+0x12a/0x250 [ 2046.292565][ T5494] ? __pfx_ksys_read+0x10/0x10 [ 2046.292588][ T5494] ? rcu_is_watching+0x12/0xc0 [ 2046.292608][ T5494] do_syscall_64+0x115/0x870 [ 2046.292626][ T5494] ? clear_bhb_loop+0x40/0x90 [ 2046.292643][ T5494] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2046.292658][ T5494] RIP: 0033:0x7f096cd5d68e [ 2046.292671][ T5494] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 2046.292686][ T5494] RSP: 002b:00007f096dbb7fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2046.292702][ T5494] RAX: ffffffffffffffda RBX: 00007f096dbb86c0 RCX: 00007f096cd5d68e [ 2046.292712][ T5494] RDX: 000000000000000f RSI: 00007f096dbb80a0 RDI: 0000000000000003 [ 2046.292722][ T5494] RBP: 00007f096dbb8090 R08: 0000000000000000 R09: 0000000000000000 [ 2046.292731][ T5494] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2046.292740][ T5494] R13: 00007f096d016038 R14: 00007f096d015fa0 R15: 00007ffe3f459688 [ 2046.292755][ T5494] [ 2046.669935][ T30] audit: type=1400 audit(1781909646.164:1393): avc: denied { create } for pid=5491 comm="syz.2.8158" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 2046.691527][ T5493] fuse: Unknown parameter '0x000000000000000a' [ 2046.703487][ T30] audit: type=1400 audit(1781909646.183:1394): avc: denied { mounton } for pid=5491 comm="syz.2.8158" path="/393/file0" dev="tmpfs" ino=2117 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 2046.807950][ T5502] netlink: 52 bytes leftover after parsing attributes in process `syz.1.8161'. [ 2047.695446][ T5519] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 2048.184234][T28895] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 2048.432212][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 2048.438533][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 2048.632324][T28895] usb 1-1: unable to get BOS descriptor or descriptor too short [ 2048.641557][T28895] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2048.652263][T28895] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 2049.702710][T28895] usb 1-1: config 1 has no interface number 1 [ 2049.708818][T28895] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 2049.726043][T28895] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 2049.753855][ T5535] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2049.773072][T28895] usb 1-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 2049.791614][T28895] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2049.816010][T28895] usb 1-1: Product: syz [ 2049.834119][T28895] usb 1-1: Manufacturer: syz [ 2049.885561][ T5544] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 2049.893135][ T5544] UDF-fs: Scanning with blocksize 512 failed [ 2049.901272][ T5544] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 2049.909176][ T5544] UDF-fs: Scanning with blocksize 1024 failed [ 2049.916534][ T5544] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 2049.924038][ T5544] UDF-fs: Scanning with blocksize 2048 failed [ 2049.931233][ T5544] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 2049.955195][ T5544] UDF-fs: Scanning with blocksize 4096 failed [ 2050.127734][T28895] usb 1-1: SerialNumber: syz [ 2050.164803][ T5548] FAULT_INJECTION: forcing a failure. [ 2050.164803][ T5548] name failslab, interval 1, probability 0, space 0, times 0 [ 2050.182624][ T5548] CPU: 1 UID: 0 PID: 5548 Comm: syz.2.8175 Tainted: G L syzkaller #0 PREEMPT(full) [ 2050.182651][ T5548] Tainted: [L]=SOFTLOCKUP [ 2050.182658][ T5548] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2050.182667][ T5548] Call Trace: [ 2050.182673][ T5548] [ 2050.182680][ T5548] dump_stack_lvl+0x100/0x190 [ 2050.182702][ T5548] should_fail_ex.cold+0x5/0xa [ 2050.182718][ T5548] ? fs_reclaim_acquire+0x70/0x100 [ 2050.182729][ T5548] ? tomoyo_realpath_from_path+0xb6/0x690 [ 2050.182744][ T5548] should_failslab+0xc2/0x120 [ 2050.182761][ T5548] __kmalloc_noprof+0xe0/0x840 [ 2050.182773][ T5548] ? kfree+0x1e5/0x6c0 [ 2050.182792][ T5548] tomoyo_realpath_from_path+0xb6/0x690 [ 2050.182819][ T5548] tomoyo_path_number_perm+0x23c/0x580 [ 2050.182836][ T5548] ? tomoyo_path_number_perm+0x22e/0x580 [ 2050.182853][ T5548] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 2050.182867][ T5548] ? preempt_count_add+0x76/0x150 [ 2050.182881][ T5548] ? rcu_is_watching+0x12/0xc0 [ 2050.182895][ T5548] ? __fget_files+0x215/0x3d0 [ 2050.182906][ T5548] ? hook_file_ioctl_common+0x149/0x410 [ 2050.182925][ T5548] ? lock_release+0x24d/0x310 [ 2050.182942][ T5548] ? __fget_files+0x21f/0x3d0 [ 2050.182959][ T5548] security_file_ioctl+0xd3/0x230 [ 2050.182979][ T5548] __x64_sys_ioctl+0xb7/0x210 [ 2050.183000][ T5548] do_syscall_64+0x115/0x870 [ 2050.183013][ T5548] ? clear_bhb_loop+0x40/0x90 [ 2050.183025][ T5548] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2050.183036][ T5548] RIP: 0033:0x7f378199ce59 [ 2050.183045][ T5548] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2050.183055][ T5548] RSP: 002b:00007f37828f3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2050.183072][ T5548] RAX: ffffffffffffffda RBX: 00007f3781c15fa0 RCX: 00007f378199ce59 [ 2050.183083][ T5548] RDX: 0000200000000100 RSI: 0000000000004605 RDI: 0000000000000003 [ 2050.183093][ T5548] RBP: 00007f37828f3090 R08: 0000000000000000 R09: 0000000000000000 [ 2050.183103][ T5548] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2050.183118][ T5548] R13: 00007f3781c16038 R14: 00007f3781c15fa0 R15: 00007ffe467eb878 [ 2050.183134][ T5548] [ 2050.183171][ T5548] ERROR: Out of memory at tomoyo_realpath_from_path. [ 2050.513329][ T5551] siw: device registration error -23 [ 2050.568034][ T5551] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2050.581387][ T5551] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2050.621646][ T5551] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2050.632363][ T5551] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2050.693128][ T30] audit: type=1804 audit(1781909649.800:1395): pid=5551 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.0.8169" name="bus" dev="ramfs" ino=198479 res=1 errno=0 [ 2050.781955][T28895] usb 1-1: 2:1 : invalid UAC_AS_GENERAL desc [ 2050.818883][T28895] usb 1-1: USB disconnect, device number 19 [ 2051.043369][T17779] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 2051.216666][T17779] usb 3-1: Using ep0 maxpacket: 8 [ 2051.349190][T17779] usb 3-1: config 1 has an invalid descriptor of length 62, skipping remainder of the config [ 2051.366808][T17779] usb 3-1: too many endpoints for config 1 interface 2 altsetting 0: 53, using maximum allowed: 30 [ 2051.383282][T17779] usb 3-1: config 1 interface 2 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 53 [ 2051.408237][T17779] usb 3-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 2051.418585][T17779] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2051.426800][T17779] usb 3-1: Product: syz [ 2051.431316][T17779] usb 3-1: Manufacturer: syz [ 2051.436691][T17779] usb 3-1: SerialNumber: syz [ 2052.623903][ T5572] fuse: Unknown parameter '0xffffffffffffffff' [ 2052.642815][ T5572] FAULT_INJECTION: forcing a failure. [ 2052.642815][ T5572] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2052.746085][ T5572] CPU: 1 UID: 0 PID: 5572 Comm: syz.4.8183 Tainted: G L syzkaller #0 PREEMPT(full) [ 2052.746123][ T5572] Tainted: [L]=SOFTLOCKUP [ 2052.746129][ T5572] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2052.746139][ T5572] Call Trace: [ 2052.746145][ T5572] [ 2052.746152][ T5572] dump_stack_lvl+0x100/0x190 [ 2052.746175][ T5572] should_fail_ex.cold+0x5/0xa [ 2052.746192][ T5572] _copy_from_user+0x2e/0xd0 [ 2052.746209][ T5572] copy_msghdr_from_user+0x9f/0x4c0 [ 2052.746222][ T5572] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 2052.746236][ T5572] ? kstrtouint_from_user+0x13c/0x1d0 [ 2052.746250][ T5572] ___sys_sendmsg+0x106/0x1e0 [ 2052.746262][ T5572] ? __pfx____sys_sendmsg+0x10/0x10 [ 2052.746274][ T5572] ? get_pid_task+0x106/0x250 [ 2052.746291][ T5572] ? rcu_is_watching+0x12/0xc0 [ 2052.746308][ T5572] __sys_sendmsg+0x160/0x210 [ 2052.746324][ T5572] ? __pfx___sys_sendmsg+0x10/0x10 [ 2052.746341][ T5572] ? rcu_is_watching+0x12/0xc0 [ 2052.746355][ T5572] do_syscall_64+0x115/0x870 [ 2052.746368][ T5572] ? clear_bhb_loop+0x40/0x90 [ 2052.746380][ T5572] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2052.746391][ T5572] RIP: 0033:0x7f096cd9ce59 [ 2052.746399][ T5572] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2052.746410][ T5572] RSP: 002b:00007f096db97028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2052.746421][ T5572] RAX: ffffffffffffffda RBX: 00007f096d016090 RCX: 00007f096cd9ce59 [ 2052.746428][ T5572] RDX: 0000000000008000 RSI: 0000200000000280 RDI: 0000000000000003 [ 2052.746435][ T5572] RBP: 00007f096db97090 R08: 0000000000000000 R09: 0000000000000000 [ 2052.746441][ T5572] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2052.746447][ T5572] R13: 00007f096d016128 R14: 00007f096d016090 R15: 00007ffe3f459688 [ 2052.746457][ T5572] [ 2053.309018][T17779] usb 3-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 2053.349476][T17779] usb 3-1: clock source 0 is not valid, cannot use [ 2053.561843][ T5593] fuse: Unknown parameter '0xffffffffffffffff' [ 2053.717222][T17779] usb 3-1: 1:1: cannot get freq (v2/v3): err -71 [ 2053.734191][T17779] usb 3-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 2053.745850][T17779] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 2053.771005][ T5593] dummy0: entered promiscuous mode [ 2053.774541][T17779] snd-usb-audio 3-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 2053.787968][ T5593] macvlan2: entered promiscuous mode [ 2053.829732][T17779] snd-usb-audio 3-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 2053.841805][T17779] usb 3-1: USB disconnect, device number 53 [ 2053.857336][T28763] udevd[28763]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2053.913917][ T5603] FAULT_INJECTION: forcing a failure. [ 2053.913917][ T5603] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2053.927856][ T5603] CPU: 0 UID: 0 PID: 5603 Comm: syz.1.8189 Tainted: G L syzkaller #0 PREEMPT(full) [ 2053.927881][ T5603] Tainted: [L]=SOFTLOCKUP [ 2053.927885][ T5603] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2053.927892][ T5603] Call Trace: [ 2053.927896][ T5603] [ 2053.927900][ T5603] dump_stack_lvl+0x100/0x190 [ 2053.927916][ T5603] should_fail_ex.cold+0x5/0xa [ 2053.927930][ T5603] _copy_to_user+0x32/0xd0 [ 2053.927947][ T5603] simple_read_from_buffer+0xcb/0x170 [ 2053.927958][ T5603] proc_fail_nth_read+0x1af/0x230 [ 2053.927977][ T5603] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2053.927994][ T5603] ? security_file_permission+0x76/0x210 [ 2053.928008][ T5603] ? rw_verify_area+0xce/0x6d0 [ 2053.928023][ T5603] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2053.928040][ T5603] vfs_read+0x1e4/0xb40 [ 2053.928057][ T5603] ? __pfx_vfs_read+0x10/0x10 [ 2053.928072][ T5603] ? rcu_is_watching+0x12/0xc0 [ 2053.928087][ T5603] ? __fget_files+0x21f/0x3d0 [ 2053.928100][ T5603] ksys_read+0x12a/0x250 [ 2053.928116][ T5603] ? __pfx_ksys_read+0x10/0x10 [ 2053.928132][ T5603] ? rcu_is_watching+0x12/0xc0 [ 2053.928147][ T5603] do_syscall_64+0x115/0x870 [ 2053.928160][ T5603] ? clear_bhb_loop+0x40/0x90 [ 2053.928172][ T5603] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2053.928182][ T5603] RIP: 0033:0x7fda0e55d68e [ 2053.928194][ T5603] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 2053.928205][ T5603] RSP: 002b:00007fda0c7f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2053.928216][ T5603] RAX: ffffffffffffffda RBX: 00007fda0c7f66c0 RCX: 00007fda0e55d68e [ 2053.928223][ T5603] RDX: 000000000000000f RSI: 00007fda0c7f60a0 RDI: 0000000000000003 [ 2053.928229][ T5603] RBP: 00007fda0c7f6090 R08: 0000000000000000 R09: 0000000000000000 [ 2053.928236][ T5603] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2053.928242][ T5603] R13: 00007fda0e816038 R14: 00007fda0e815fa0 R15: 00007ffc4e68f568 [ 2053.928251][ T5603] [ 2054.165974][T28895] libceph: mon0 (1)[c::]:6789 connect error [ 2054.227830][T17779] libceph: mon0 (1)[c::]:6789 connect error [ 2054.235092][T17779] libceph: mon0 (1)[c::]:6789 connect error [ 2054.447827][T28895] libceph: mon0 (1)[c::]:6789 connect error [ 2054.499900][ T5619] input: syz1 as /devices/virtual/input/input110 [ 2054.521920][T17779] libceph: mon0 (1)[c::]:6789 connect error [ 2054.634838][ T5627] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2054.668219][ T5629] FAULT_INJECTION: forcing a failure. [ 2054.668219][ T5629] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2054.681654][ T5629] CPU: 1 UID: 0 PID: 5629 Comm: syz.2.8196 Tainted: G L syzkaller #0 PREEMPT(full) [ 2054.681682][ T5629] Tainted: [L]=SOFTLOCKUP [ 2054.681688][ T5629] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2054.681697][ T5629] Call Trace: [ 2054.681703][ T5629] [ 2054.681709][ T5629] dump_stack_lvl+0x100/0x190 [ 2054.681732][ T5629] should_fail_ex.cold+0x5/0xa [ 2054.681753][ T5629] _copy_to_user+0x32/0xd0 [ 2054.681776][ T5629] simple_read_from_buffer+0xcb/0x170 [ 2054.681791][ T5629] proc_fail_nth_read+0x1af/0x230 [ 2054.681814][ T5629] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2054.681835][ T5629] ? security_file_permission+0x76/0x210 [ 2054.681853][ T5629] ? rw_verify_area+0xce/0x6d0 [ 2054.681871][ T5629] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2054.681891][ T5629] vfs_read+0x1e4/0xb40 [ 2054.681912][ T5629] ? __pfx_vfs_read+0x10/0x10 [ 2054.681931][ T5629] ? rcu_is_watching+0x12/0xc0 [ 2054.681951][ T5629] ? __fget_files+0x21f/0x3d0 [ 2054.681967][ T5629] ksys_read+0x12a/0x250 [ 2054.681986][ T5629] ? __pfx_ksys_read+0x10/0x10 [ 2054.682013][ T5629] ? rcu_is_watching+0x12/0xc0 [ 2054.682031][ T5629] do_syscall_64+0x115/0x870 [ 2054.682048][ T5629] ? clear_bhb_loop+0x40/0x90 [ 2054.682064][ T5629] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2054.682077][ T5629] RIP: 0033:0x7f378195d68e [ 2054.682088][ T5629] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 2054.682102][ T5629] RSP: 002b:00007f37828f2fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2054.682117][ T5629] RAX: ffffffffffffffda RBX: 00007f37828f36c0 RCX: 00007f378195d68e [ 2054.682126][ T5629] RDX: 000000000000000f RSI: 00007f37828f30a0 RDI: 0000000000000003 [ 2054.682134][ T5629] RBP: 00007f37828f3090 R08: 0000000000000000 R09: 0000000000000000 [ 2054.682142][ T5629] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2054.682150][ T5629] R13: 00007f3781c16038 R14: 00007f3781c15fa0 R15: 00007ffe467eb878 [ 2054.682163][ T5629] [ 2054.890949][T28895] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 2054.902743][ T5631] FAULT_INJECTION: forcing a failure. [ 2054.902743][ T5631] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2054.938971][ T5631] CPU: 0 UID: 0 PID: 5631 Comm: syz.2.8197 Tainted: G L syzkaller #0 PREEMPT(full) [ 2054.939002][ T5631] Tainted: [L]=SOFTLOCKUP [ 2054.939008][ T5631] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2054.939018][ T5631] Call Trace: [ 2054.939023][ T5631] [ 2054.939030][ T5631] dump_stack_lvl+0x100/0x190 [ 2054.939057][ T5631] should_fail_ex.cold+0x5/0xa [ 2054.939076][ T5631] _copy_to_user+0x32/0xd0 [ 2054.939101][ T5631] simple_read_from_buffer+0xcb/0x170 [ 2054.939118][ T5631] proc_fail_nth_read+0x1af/0x230 [ 2054.939139][ T5631] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2054.939162][ T5631] ? security_file_permission+0x76/0x210 [ 2054.939184][ T5631] ? rw_verify_area+0xce/0x6d0 [ 2054.939205][ T5631] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2054.939231][ T5631] vfs_read+0x1e4/0xb40 [ 2054.939256][ T5631] ? __pfx_vfs_read+0x10/0x10 [ 2054.939280][ T5631] ? rcu_is_watching+0x12/0xc0 [ 2054.939304][ T5631] ? __fget_files+0x21f/0x3d0 [ 2054.939321][ T5631] ksys_read+0x12a/0x250 [ 2054.939336][ T5631] ? __pfx_ksys_read+0x10/0x10 [ 2054.939353][ T5631] ? rcu_is_watching+0x12/0xc0 [ 2054.939367][ T5631] do_syscall_64+0x115/0x870 [ 2054.939380][ T5631] ? clear_bhb_loop+0x40/0x90 [ 2054.939392][ T5631] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2054.939403][ T5631] RIP: 0033:0x7f378195d68e [ 2054.939412][ T5631] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 2054.939422][ T5631] RSP: 002b:00007f37828f2fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2054.939433][ T5631] RAX: ffffffffffffffda RBX: 00007f37828f36c0 RCX: 00007f378195d68e [ 2054.939440][ T5631] RDX: 000000000000000f RSI: 00007f37828f30a0 RDI: 0000000000000003 [ 2054.939447][ T5631] RBP: 00007f37828f3090 R08: 0000000000000000 R09: 0000000000000000 [ 2054.939453][ T5631] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2054.939459][ T5631] R13: 00007f3781c16038 R14: 00007f3781c15fa0 R15: 00007ffe467eb878 [ 2054.939469][ T5631] [ 2055.147254][T23925] libceph: mon0 (1)[c::]:6789 connect error [ 2055.148850][T26169] libceph: mon0 (1)[c::]:6789 connect error [ 2055.229417][ T5610] ceph: No mds server is up or the cluster is laggy [ 2055.349320][ T5627] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2055.364756][ T5605] ceph: No mds server is up or the cluster is laggy [ 2055.403035][T28895] usb 5-1: unable to get BOS descriptor or descriptor too short [ 2055.411521][T28895] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2055.421813][T28895] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 2055.431075][T28895] usb 5-1: config 1 has no interface number 1 [ 2055.438233][T28895] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 2055.453340][T28895] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 2055.472789][T28895] usb 5-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 2055.487976][ T5627] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2055.498104][T28895] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2055.506158][T28895] usb 5-1: Product: syz [ 2055.516983][T28895] usb 5-1: Manufacturer: syz [ 2055.526588][T28895] usb 5-1: SerialNumber: syz [ 2055.545753][ T5642] Failed to initialize the IGMP autojoin socket (err -2) [ 2055.592366][ T5627] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2055.599584][ T30] audit: type=1400 audit(1781909654.405:1396): avc: denied { create } for pid=5637 comm="syz.1.8199" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 2055.908439][ T5646] siw: device registration error -23 [ 2055.949976][ T5646] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2055.961775][ T5646] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2056.060618][ T5646] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2056.072507][ T5646] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2056.134848][ T30] audit: type=1400 audit(1781909654.423:1397): avc: denied { getopt } for pid=5637 comm="syz.1.8199" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 2056.155442][ T30] audit: type=1804 audit(1781909654.811:1398): pid=5646 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.4.8194" name="bus" dev="ramfs" ino=198615 res=1 errno=0 [ 2056.213457][T28895] usb 5-1: 2:1 : invalid UAC_AS_GENERAL desc [ 2056.244603][ T5651] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 2056.443338][T28895] usb 5-1: USB disconnect, device number 33 [ 2056.534023][T28766] udevd[28766]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2056.783062][ T48] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2056.895720][ T6668] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2056.947496][ T6668] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2057.040406][ T6668] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2057.276295][ T5666] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8206'. [ 2057.816438][ T5671] SELinux: policydb magic number 0x0 does not match expected magic number 0xf97cff8c [ 2057.826077][ T30] audit: type=1400 audit(1781909656.454:1399): avc: denied { load_policy } for pid=5660 comm="syz.4.8205" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 2057.846791][ T5671] SELinux: failed to load policy [ 2058.237206][ T5684] siw: device registration error -23 [ 2058.801542][ T5692] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 2059.096944][ T5695] netlink: 24 bytes leftover after parsing attributes in process `syz.0.8214'. [ 2059.348001][ T5702] fuse: Unknown parameter '0xffffffffffffffff00000000000000000007' [ 2059.564342][ T5711] syzkaller0: entered promiscuous mode [ 2059.581142][ T5711] syzkaller0: entered allmulticast mode [ 2059.788469][T28895] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 2059.966385][T28895] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 2059.979533][T28895] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2059.987640][T28895] usb 4-1: Product: syz [ 2059.991860][T28895] usb 4-1: Manufacturer: syz [ 2060.009678][T28895] usb 4-1: SerialNumber: syz [ 2060.145568][ T5730] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 2060.528189][T28895] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 2060.540057][T28895] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 2060.666151][T18542] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 2060.688202][ T5436] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 2060.769145][ T5712] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2060.778064][ T5712] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2060.828872][T18542] usb 5-1: Using ep0 maxpacket: 16 [ 2060.835776][T18542] usb 5-1: unable to get BOS descriptor or descriptor too short [ 2060.845983][T18542] usb 5-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 2060.855076][ T5436] usb 3-1: Using ep0 maxpacket: 8 [ 2060.860149][T18542] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2060.868343][T18542] usb 5-1: Product: ї [ 2060.872560][T18542] usb 5-1: Manufacturer: 䤗貞繘❡獶ͭ⇱ꤞ޹ﮌ׷Ĥ镔䠥龩⏖淯螝㙍䊙Ჵ劢穰䇆⤓⛯枻谑挂ମ䕖֫⓶傀轇ᾧ〈⚦紞ア쑵ꘑ羦嘎禮￢蜇純粗䖣虌닮컰甃婺鼘갢跃觇麗鼨㢯蒦菷瘊ꀁ䮉ꢀ煕㴭䝈Ჯ➖揞匘후銾ꜗ놄珽脾 [ 2060.899933][T18542] usb 5-1: SerialNumber: L쟕ꕘ２埓璘쭲窑༷᣿娚揤ᚷ╊⤿쥌Ւ學ᩓ꒸뤃 [ 2060.910169][ T5436] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2060.920566][ T5436] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 2060.926307][T17779] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 2060.939673][ T5436] usb 3-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 2060.950268][ T5436] usb 3-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 2060.959424][ T5436] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2060.967449][ T5436] usb 3-1: Product: syz [ 2060.971651][ T5436] usb 3-1: Manufacturer: syz [ 2060.976241][ T5436] usb 3-1: SerialNumber: syz [ 2061.099538][T17779] usb 2-1: Using ep0 maxpacket: 8 [ 2061.105856][T17779] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2061.116101][T17779] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 2061.125089][T17779] usb 2-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 2061.135711][T17779] usb 2-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 2061.144846][T17779] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2061.152901][T17779] usb 2-1: Product: syz [ 2061.155103][T18542] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 2061.157091][T17779] usb 2-1: Manufacturer: syz [ 2061.168986][T17779] usb 2-1: SerialNumber: syz [ 2061.171471][T18542] usb 5-1: MIDIStreaming interface descriptor not found [ 2061.203529][T18542] usb 5-1: USB disconnect, device number 34 [ 2061.212789][ T5436] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 2061.250465][ T5436] snd-usb-audio 3-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 2061.269271][T28764] udevd[28764]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2061.303510][T28794] udevd[28794]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.1/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 2061.397487][T17779] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 2061.423974][T17779] snd-usb-audio 2-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 2061.434779][T28766] udevd[28766]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2061.668441][ T5712] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2061.677083][ T5712] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2061.685664][T28895] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000118. ret = -EPROTO [ 2061.699959][T28895] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 2061.709861][T28895] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 2061.719331][T28895] lan78xx 4-1:1.0: probe with driver lan78xx failed with error -71 [ 2061.729847][T28895] usb 4-1: USB disconnect, device number 46 [ 2061.791923][ T5741] fuse: Bad value for 'fd' [ 2062.182957][T28895] usb 2-1: USB disconnect, device number 39 [ 2062.528395][ T5747] FAULT_INJECTION: forcing a failure. [ 2062.528395][ T5747] name failslab, interval 1, probability 0, space 0, times 0 [ 2062.564378][ T5747] CPU: 0 UID: 0 PID: 5747 Comm: syz.1.8230 Tainted: G L syzkaller #0 PREEMPT(full) [ 2062.564399][ T5747] Tainted: [L]=SOFTLOCKUP [ 2062.564404][ T5747] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2062.564410][ T5747] Call Trace: [ 2062.564415][ T5747] [ 2062.564419][ T5747] dump_stack_lvl+0x100/0x190 [ 2062.564435][ T5747] should_fail_ex.cold+0x5/0xa [ 2062.564453][ T5747] ? __kmalloc_cache_noprof+0x53/0x6e0 [ 2062.564468][ T5747] should_failslab+0xc2/0x120 [ 2062.564485][ T5747] __kmalloc_cache_noprof+0x7a/0x6e0 [ 2062.564497][ T5747] ? kobject_uevent_env+0x263/0x18b0 [ 2062.564510][ T5747] kobject_uevent_env+0x263/0x18b0 [ 2062.564521][ T5747] ? kernfs_remove_by_name_ns+0xbb/0x120 [ 2062.564537][ T5747] __kobject_del+0x168/0x220 [ 2062.564553][ T5747] kobject_put+0x348/0x640 [ 2062.564568][ T5747] netdev_queue_update_kobjects+0x4e5/0x6f0 [ 2062.564584][ T5747] netif_set_real_num_tx_queues+0x1eb/0xad0 [ 2062.564603][ T5747] __tun_detach+0xc43/0x16e0 [ 2062.564615][ T5747] ? __pfx_tun_chr_close+0x10/0x10 [ 2062.564626][ T5747] tun_chr_close+0xc2/0x220 [ 2062.564636][ T5747] ? __pfx_tun_chr_close+0x10/0x10 [ 2062.564646][ T5747] __fput+0x3ff/0xb50 [ 2062.564659][ T5747] fput_close_sync+0x118/0x250 [ 2062.564673][ T5747] ? __pfx_fput_close_sync+0x10/0x10 [ 2062.564688][ T5747] __x64_sys_close+0x8b/0x120 [ 2062.564702][ T5747] do_syscall_64+0x115/0x870 [ 2062.564714][ T5747] ? clear_bhb_loop+0x40/0x90 [ 2062.564726][ T5747] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2062.564737][ T5747] RIP: 0033:0x7fda0e59ce59 [ 2062.564750][ T5747] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2062.564769][ T5747] RSP: 002b:00007fda0c7b4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 2062.564786][ T5747] RAX: ffffffffffffffda RBX: 00007fda0e816180 RCX: 00007fda0e59ce59 [ 2062.564794][ T5747] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 2062.564801][ T5747] RBP: 00007fda0c7b4090 R08: 0000000000000000 R09: 0000000000000000 [ 2062.564807][ T5747] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2062.564813][ T5747] R13: 00007fda0e816218 R14: 00007fda0e816180 R15: 00007ffc4e68f568 [ 2062.564823][ T5747] [ 2062.793828][ T804] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 2062.975049][ T804] usb 1-1: Using ep0 maxpacket: 8 [ 2062.991251][ T804] usb 1-1: config 1 has an invalid descriptor of length 62, skipping remainder of the config [ 2063.004416][ T804] usb 1-1: too many endpoints for config 1 interface 2 altsetting 0: 53, using maximum allowed: 30 [ 2063.018090][ T804] usb 1-1: config 1 interface 2 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 53 [ 2063.086179][ T804] usb 1-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 2063.096573][ T804] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2063.105761][ T804] usb 1-1: Product: syz [ 2063.110646][ T804] usb 1-1: Manufacturer: syz [ 2063.116249][ T804] usb 1-1: SerialNumber: syz [ 2063.455126][ T5768] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2304 sclass=netlink_route_socket pid=5768 comm=syz.3.8238 [ 2063.478281][ T5768] netlink: 63 bytes leftover after parsing attributes in process `syz.3.8238'. [ 2063.691244][T29787] usb 3-1: USB disconnect, device number 54 [ 2064.496742][ T804] usb 1-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 2064.604695][ T804] usb 1-1: clock source 0 is not valid, cannot use [ 2064.618599][ T804] usb 1-1: 1:1: cannot get freq (v2/v3): err -71 [ 2064.651998][ T804] usb 1-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 2064.683745][ T804] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 2064.711193][ T804] snd-usb-audio 1-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 2064.761789][ T804] snd-usb-audio 1-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 2064.803318][T28801] udevd[28801]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2064.803585][ T804] usb 1-1: USB disconnect, device number 20 [ 2064.882179][T26169] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 2064.922473][ T5785] fuse: Bad value for 'fd' [ 2065.174123][T26169] usb 4-1: Using ep0 maxpacket: 16 [ 2065.187152][T26169] usb 4-1: unable to get BOS descriptor or descriptor too short [ 2065.418934][T26169] usb 4-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 2065.432264][T26169] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2065.443859][T26169] usb 4-1: Product: ї [ 2065.487761][ T30] audit: type=1400 audit(1781909663.522:1400): avc: denied { ioctl } for pid=5793 comm="syz.0.8246" path="socket:[200116]" dev="sockfs" ino=200116 ioctlcmd=0x5865 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 2065.539597][T26169] usb 4-1: Manufacturer: 䤗貞繘❡獶ͭ⇱ꤞ޹ﮌ׷Ĥ镔䠥龩⏖淯螝㙍䊙Ჵ劢穰䇆⤓⛯枻谑挂ମ䕖֫⓶傀轇ᾧ〈⚦紞ア쑵ꘑ羦嘎禮￢蜇純粗䖣虌닮컰甃婺鼘갢跃觇麗鼨㢯蒦菷瘊ꀁ䮉ꢀ煕㴭䝈Ჯ➖揞匘후銾ꜗ놄珽脾 [ 2065.583091][T26169] usb 4-1: SerialNumber: L쟕ꕘ２埓璘쭲窑༷᣿娚揤ᚷ╊⤿쥌Ւ學ᩓ꒸뤃 [ 2065.752342][ T5801] syzkaller1: entered promiscuous mode [ 2065.765945][ T5801] syzkaller1: entered allmulticast mode [ 2065.804527][T26169] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 2065.817765][T26169] usb 4-1: MIDIStreaming interface descriptor not found [ 2065.846008][ T5436] usb 5-1: new full-speed USB device number 35 using dummy_hcd [ 2065.893574][T26169] usb 4-1: USB disconnect, device number 47 [ 2066.066328][ T5436] usb 5-1: config 5 has an invalid interface number: 228 but max is 0 [ 2066.217508][ T5436] usb 5-1: config 5 has no interface number 0 [ 2066.223687][ T5436] usb 5-1: config 5 interface 228 has no altsetting 0 [ 2066.235296][ T5436] usb 5-1: New USB device found, idVendor=0b95, idProduct=178a, bcdDevice=2f.69 [ 2066.252607][ T5436] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2066.268328][ T5436] usb 5-1: Product: syz [ 2066.278410][ T5436] usb 5-1: Manufacturer: syz [ 2066.289303][ T5436] usb 5-1: SerialNumber: syz [ 2066.532690][ T5797] netlink: 160 bytes leftover after parsing attributes in process `syz.4.8247'. [ 2066.546241][ T5815] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2066.553610][ T5436] ax88179_178a 5-1:5.228: probe with driver ax88179_178a failed with error -22 [ 2066.568130][ T5436] usb 5-1: USB disconnect, device number 35 [ 2066.607426][ T5815] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2066.650839][ T5815] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2066.705447][ T5815] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2066.755863][T10088] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2066.765764][ T5825] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 2066.787283][T10088] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2066.803884][T10088] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2066.816205][T10088] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2069.301064][ T5849] netlink: 232 bytes leftover after parsing attributes in process `syz.2.8262'. [ 2070.253934][ T5872] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2070.348897][ T5874] loop7: detected capacity change from 0 to 16383 [ 2070.358937][ T5872] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2070.418789][ T5874] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[29586] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[5874] [ 2070.441120][T26169] usb 1-1: new full-speed USB device number 21 using dummy_hcd [ 2070.467724][ T5872] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2070.519265][ T5877] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 2070.620784][ T5872] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2070.658227][T26169] usb 1-1: config 5 has an invalid interface number: 228 but max is 0 [ 2070.667111][T26169] usb 1-1: config 5 has no interface number 0 [ 2070.673633][T26169] usb 1-1: config 5 interface 228 has no altsetting 0 [ 2070.713364][T26169] usb 1-1: New USB device found, idVendor=0b95, idProduct=178a, bcdDevice=2f.69 [ 2070.722884][T26169] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2070.731206][T26169] usb 1-1: Product: syz [ 2070.735822][T26169] usb 1-1: Manufacturer: syz [ 2070.755318][T26169] usb 1-1: SerialNumber: syz [ 2070.988638][ T5867] netlink: 160 bytes leftover after parsing attributes in process `syz.0.8268'. [ 2071.000509][T26169] ax88179_178a 1-1:5.228: probe with driver ax88179_178a failed with error -22 [ 2071.023764][ T5888] siw: device registration error -23 [ 2071.033899][T26169] usb 1-1: USB disconnect, device number 21 [ 2071.472589][ T5894] netlink: 20 bytes leftover after parsing attributes in process `syz.4.8276'. [ 2071.827805][ T5904] FAULT_INJECTION: forcing a failure. [ 2071.827805][ T5904] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2071.840903][ T5904] CPU: 1 UID: 0 PID: 5904 Comm: syz.4.8278 Tainted: G L syzkaller #0 PREEMPT(full) [ 2071.840932][ T5904] Tainted: [L]=SOFTLOCKUP [ 2071.840939][ T5904] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2071.840950][ T5904] Call Trace: [ 2071.840956][ T5904] [ 2071.840963][ T5904] dump_stack_lvl+0x100/0x190 [ 2071.840987][ T5904] should_fail_ex.cold+0x5/0xa [ 2071.841010][ T5904] _copy_to_user+0x32/0xd0 [ 2071.841038][ T5904] simple_read_from_buffer+0xcb/0x170 [ 2071.841057][ T5904] proc_fail_nth_read+0x1af/0x230 [ 2071.841084][ T5904] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2071.841111][ T5904] ? security_file_permission+0x76/0x210 [ 2071.841134][ T5904] ? rw_verify_area+0xce/0x6d0 [ 2071.841157][ T5904] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2071.841184][ T5904] vfs_read+0x1e4/0xb40 [ 2071.841210][ T5904] ? __pfx_vfs_read+0x10/0x10 [ 2071.841234][ T5904] ? rcu_is_watching+0x12/0xc0 [ 2071.841259][ T5904] ? __fget_files+0x21f/0x3d0 [ 2071.841279][ T5904] ksys_read+0x12a/0x250 [ 2071.841304][ T5904] ? __pfx_ksys_read+0x10/0x10 [ 2071.841330][ T5904] ? rcu_is_watching+0x12/0xc0 [ 2071.841354][ T5904] do_syscall_64+0x115/0x870 [ 2071.841375][ T5904] ? clear_bhb_loop+0x40/0x90 [ 2071.841399][ T5904] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2071.841417][ T5904] RIP: 0033:0x7f096cd5d68e [ 2071.841431][ T5904] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 2071.841448][ T5904] RSP: 002b:00007f096db75fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2071.841467][ T5904] RAX: ffffffffffffffda RBX: 00007f096db766c0 RCX: 00007f096cd5d68e [ 2071.841479][ T5904] RDX: 000000000000000f RSI: 00007f096db760a0 RDI: 0000000000000006 [ 2071.841490][ T5904] RBP: 00007f096db76090 R08: 0000000000000000 R09: 0000000000000000 [ 2071.841500][ T5904] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2071.841511][ T5904] R13: 00007f096d016218 R14: 00007f096d016180 R15: 00007ffe3f459688 [ 2071.841527][ T5904] [ 2072.067680][ T31] INFO: task kworker/0:0:24571 blocked for more than 144 seconds. [ 2072.075589][ T31] Tainted: G L syzkaller #0 [ 2072.082389][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 2072.091164][ T31] task:kworker/0:0 state:D stack:23192 pid:24571 tgid:24571 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 2072.103346][ T31] Workqueue: usb_hub_wq hub_event [ 2072.108467][ T31] Call Trace: [ 2072.111871][ T31] [ 2072.114794][ T31] __schedule+0x125c/0x6730 [ 2072.119280][ T31] ? __pfx___schedule+0x10/0x10 [ 2072.124255][ T31] ? rcu_is_watching+0x12/0xc0 [ 2072.129000][ T31] ? schedule+0x2bf/0x390 [ 2072.133469][ T31] ? lock_release+0x24d/0x310 [ 2072.138126][ T31] schedule+0xdd/0x390 [ 2072.142288][ T31] schedule_preempt_disabled+0x13/0x30 [ 2072.147723][ T31] __mutex_lock+0xccc/0x1bd0 [ 2072.152355][ T31] ? hub_event+0x2bfb/0x4af0 [ 2072.157008][ T31] ? rcu_is_watching+0x12/0xc0 [ 2072.161752][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 2072.166854][ T31] ? __mutex_unlock_slowpath+0x35d/0x930 [ 2072.172481][ T31] ? hub_ext_port_status+0x3e4/0x600 [ 2072.177818][ T31] ? hub_event+0x2bfb/0x4af0 [ 2072.182386][ T31] hub_event+0x2bfb/0x4af0 [ 2072.186846][ T31] ? __pfx_hub_event+0x10/0x10 [ 2072.191588][ T31] ? debug_object_deactivate+0x2e4/0x3b0 [ 2072.197212][ T31] ? ioread32be+0xb0/0xd0 [ 2072.201521][ T31] ? rcu_is_watching+0x12/0xc0 [ 2072.206266][ T31] ? lock_acquire+0x301/0x370 [ 2072.210952][ T31] ? rcu_is_watching+0x12/0xc0 [ 2072.215694][ T31] ? rcu_is_watching+0x12/0xc0 [ 2072.220450][ T31] process_one_work+0xa23/0x1940 [ 2072.225380][ T31] ? __pfx_process_one_work+0x10/0x10 [ 2072.230761][ T31] ? __pfx_hub_event+0x10/0x10 [ 2072.235504][ T31] worker_thread+0x5ef/0xe50 [ 2072.240089][ T31] ? __pfx_worker_thread+0x10/0x10 [ 2072.245183][ T31] ? kthread+0x13a/0x450 [ 2072.249405][ T31] ? __pfx_worker_thread+0x10/0x10 [ 2072.254870][ T31] kthread+0x370/0x450 [ 2072.259018][ T31] ? __pfx_kthread+0x10/0x10 [ 2072.263653][ T31] ret_from_fork+0x72b/0xd50 [ 2072.268432][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 2072.286927][ T31] ? rcu_is_watching+0x12/0xc0 [ 2072.291777][ T31] ? __switch_to+0x800/0x10f0 [ 2072.296681][ T31] ? __pfx_kthread+0x10/0x10 [ 2072.319355][ T31] ret_from_fork_asm+0x1a/0x30 [ 2072.574534][ T31] [ 2072.584690][ T31] INFO: lockdep is turned off. [ 2072.648743][ T31] NMI backtrace for cpu 1 [ 2072.648767][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 2072.648794][ T31] Tainted: [L]=SOFTLOCKUP [ 2072.648801][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2072.648812][ T31] Call Trace: [ 2072.648818][ T31] [ 2072.648825][ T31] dump_stack_lvl+0x100/0x190 [ 2072.648848][ T31] nmi_cpu_backtrace.cold+0x12d/0x151 [ 2072.648870][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 2072.648892][ T31] nmi_trigger_cpumask_backtrace+0x1d7/0x230 [ 2072.648921][ T31] sys_info+0x141/0x190 [ 2072.648945][ T31] watchdog+0xcb1/0x1030 [ 2072.648965][ T31] ? trace_irq_enable.constprop.0+0x122/0x160 [ 2072.648986][ T31] ? __pfx_watchdog+0x10/0x10 [ 2072.649002][ T31] ? __kthread_parkme+0x18c/0x230 [ 2072.649027][ T31] ? kthread+0x13a/0x450 [ 2072.649050][ T31] ? __pfx_watchdog+0x10/0x10 [ 2072.649066][ T31] kthread+0x370/0x450 [ 2072.649090][ T31] ? __pfx_kthread+0x10/0x10 [ 2072.649115][ T31] ret_from_fork+0x72b/0xd50 [ 2072.649137][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 2072.649159][ T31] ? __switch_to+0x800/0x10f0 [ 2072.649184][ T31] ? __pfx_kthread+0x10/0x10 [ 2072.649209][ T31] ret_from_fork_asm+0x1a/0x30 [ 2072.649236][ T31] [ 2072.649257][ T31] Sending NMI from CPU 1 to CPUs 0: [ 2072.780343][ C0] NMI backtrace for cpu 0 [ 2072.780365][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G L syzkaller #0 PREEMPT(full) [ 2072.780384][ C0] Tainted: [L]=SOFTLOCKUP [ 2072.780390][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2072.780398][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 2072.780420][ C0] Code: 76 89 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 23 e8 15 00 fb f4 bc 48 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 2072.780433][ C0] RSP: 0018:ffffffff8e407e10 EFLAGS: 00000246 [ 2072.780446][ C0] RAX: 00000000125d1a94 RBX: ffffffff8e491480 RCX: ffffffff8b95b2d5 [ 2072.780455][ C0] RDX: 0000000000000001 RSI: ffffffff8c1d1d80 RDI: ffffffff81de4aa7 [ 2072.780465][ C0] RBP: fffffbfff1c92290 R08: 0000000000000000 R09: ffffed101708678d [ 2072.780474][ C0] R10: ffff8880b8433c6b R11: 0000000000000001 R12: 0000000000000000 [ 2072.780483][ C0] R13: 0000000000000000 R14: 1ffffffff1c80fc6 R15: dffffc0000000000 [ 2072.780492][ C0] FS: 0000000000000000(0000) GS:ffff888124323000(0000) knlGS:0000000000000000 [ 2072.780506][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2072.780518][ C0] CR2: 0000200000000080 CR3: 000000005a973000 CR4: 00000000003526f0 [ 2072.780527][ C0] DR0: 0000000000000001 DR1: 0000000000000000 DR2: 0000000000000000 [ 2072.780536][ C0] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 2072.780545][ C0] Call Trace: [ 2072.780551][ C0] [ 2072.780556][ C0] default_idle+0x9/0x10 [ 2072.780573][ C0] default_idle_call+0x6c/0xb0 [ 2072.780590][ C0] do_idle+0x3a7/0x5b0 [ 2072.780608][ C0] ? __pfx_do_idle+0x10/0x10 [ 2072.780626][ C0] cpu_startup_entry+0x4f/0x60 [ 2072.780643][ C0] rest_init+0x251/0x260 [ 2072.780661][ C0] ? __pfx_x86_late_time_init+0x10/0x10 [ 2072.780675][ C0] start_kernel+0x484/0x490 [ 2072.780695][ C0] x86_64_start_reservations+0x24/0x30 [ 2072.780715][ C0] x86_64_start_kernel+0x12b/0x130 [ 2072.780734][ C0] common_startup_64+0x13e/0x158 [ 2072.780757][ C0] [ 2072.982586][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 2072.989438][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 2073.000086][ T31] Tainted: [L]=SOFTLOCKUP [ 2073.004412][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2073.014440][ T31] Call Trace: [ 2073.017693][ T31] [ 2073.020605][ T31] dump_stack_lvl+0x100/0x190 [ 2073.025257][ T31] vpanic+0x552/0x970 [ 2073.029211][ T31] ? __pfx_vpanic+0x10/0x10 [ 2073.033695][ T31] ? rcu_is_watching+0x12/0xc0 [ 2073.038435][ T31] ? nmi_trigger_cpumask_backtrace+0x182/0x230 [ 2073.044569][ T31] panic+0xd1/0xe0 [ 2073.048260][ T31] ? __pfx_panic+0x10/0x10 [ 2073.052655][ T31] ? nmi_trigger_cpumask_backtrace+0x1b5/0x230 [ 2073.058786][ T31] ? nmi_trigger_cpumask_backtrace+0x1f6/0x230 [ 2073.064918][ T31] ? nmi_trigger_cpumask_backtrace+0x200/0x230 [ 2073.071058][ T31] ? watchdog.cold+0x1ec/0x234 [ 2073.075794][ T31] ? watchdog+0xcc1/0x1030 [ 2073.080181][ T31] watchdog.cold+0x1fd/0x234 [ 2073.084743][ T31] ? trace_irq_enable.constprop.0+0x122/0x160 [ 2073.090795][ T31] ? __pfx_watchdog+0x10/0x10 [ 2073.095442][ T31] ? __kthread_parkme+0x18c/0x230 [ 2073.100442][ T31] ? kthread+0x13a/0x450 [ 2073.104666][ T31] ? __pfx_watchdog+0x10/0x10 [ 2073.109313][ T31] kthread+0x370/0x450 [ 2073.113367][ T31] ? __pfx_kthread+0x10/0x10 [ 2073.117937][ T31] ret_from_fork+0x72b/0xd50 [ 2073.122516][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 2073.127612][ T31] ? __switch_to+0x800/0x10f0 [ 2073.132287][ T31] ? __pfx_kthread+0x10/0x10 [ 2073.136858][ T31] ret_from_fork_asm+0x1a/0x30 [ 2073.141602][ T31] [ 2073.144802][ T31] Kernel Offset: disabled [ 2073.149110][ T31] Rebooting in 86400 seconds..