last executing test programs: 7m13.996036453s ago: executing program 2 (id=115): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000640)=ANY=[@ANYBLOB="440000001000ffff27bd7000fadbdf2500000000", @ANYRES32=0x0, @ANYBLOB="ba7e0600000000002400128009000100626f6e64000000001400028008000b0012f0"], 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x4000010) (async) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) (async) madvise(&(0x7f0000003000/0x1000)=nil, 0x7f7884acbfff, 0x14) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) (async) r1 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0xfffffffd, @local, 0x2}, 0x1c) fcntl$setstatus(r1, 0x4, 0x44000) (async) sendmmsg$inet6(r1, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) munmap(&(0x7f0000294000/0x1000)=nil, 0x1000) (async) ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(0xffffffffffffffff, 0xc02064b9, &(0x7f00000002c0)={&(0x7f0000000240)=[0x0, 0x0], &(0x7f0000000300), 0x2}) syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_ATOMIC(0xffffffffffffffff, 0xc03864bc, &(0x7f0000000580)={0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0xc) (async, rerun: 64) socket$igmp6(0xa, 0x3, 0x2) (rerun: 64) r2 = msgget$private(0x0, 0x193) msgsnd(r2, &(0x7f0000000d40)=ANY=[@ANYBLOB="03"], 0x3f9, 0x0) msgrcv(r2, 0x0, 0x0, 0x3, 0x2000) (async, rerun: 64) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240), 0x50) (rerun: 64) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x7, 0x1c, &(0x7f00000002c0)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x4, 0x9, 0x0, 0x2, 0x300}, {0x6e}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9, 0xfff0}, {0x5, 0x0, 0xc, 0x9}, {0x3, 0x0, 0x6, 0xa, 0xa}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {}, {0x18, 0x2, 0x2, 0x0, r3}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_clone(0x80842111, 0x0, 0x0, 0x0, 0x0, 0x0) 7m10.405130431s ago: executing program 2 (id=124): r0 = socket$netlink(0x10, 0x3, 0x0) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x18, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000e500030000000000180000000700000000000000050000007a0ac0ff1000000018", @ANYRES32, @ANYBLOB="000000000300000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) (async) r1 = socket$unix(0x1, 0x1, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000004400000008000300", @ANYRES32=r4, @ANYBLOB="08002600851600000a00180000000000000000001c005a8018000180140003"], 0x4c}}, 0x0) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000340)={'syztnl1\x00', &(0x7f0000000140)={'ip6tnl0\x00', 0x0, 0x2f, 0xff, 0x6, 0x7ff, 0x28, @mcast2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x1, 0x8, 0x3, 0x6}}) setsockopt$MRT6_ADD_MIF(0xffffffffffffffff, 0x29, 0xca, &(0x7f0000000380)={0xfffc, 0x0, 0x5, r7, 0x7fff}, 0xc) (async) sendmsg$IPVS_CMD_NEW_DAEMON(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01000000000000000000090000003c000380140002007663616e30000000000000000000000014000600ff0500000000000000000000000000010800010001000000080003"], 0x50}}, 0x0) sendmsg$IPVS_CMD_FLUSH(r3, &(0x7f0000000580)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x88, r5, 0x10, 0x70bd2d, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xcc0}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7}, @IPVS_CMD_ATTR_SERVICE={0x54, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local}, @IPVS_SVC_ATTR_SCHED_NAME={0xa, 0x6, 'lblcr\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x14, 0xc}}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@remote}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x20000}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x10}]}, 0x88}, 0x1, 0x0, 0x0, 0x40000}, 0x20000003) r8 = socket(0x10, 0x3, 0x0) getsockname$packet(r8, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f0", @ANYRES32=r9, @ANYBLOB="0000000000000000280012000c"], 0x48}}, 0x0) 7m8.777390444s ago: executing program 2 (id=126): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) get_robust_list(0x0, 0x0, 0x0) r0 = syz_open_dev$mtd(&(0x7f0000000100), 0x48a99fbe, 0x10b241) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x24, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x4c}, 0x1, 0x0, 0x0, 0x4000851}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000e00)={{0x14}, [@NFT_MSG_NEWRULE={0x2c, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x94}}, 0x40000) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r3 = openat$smackfs_netlabel(0xffffffffffffff9c, &(0x7f0000001140), 0x2, 0x0) write$smackfs_netlabel(r3, &(0x7f0000000180)=ANY=[@ANYBLOB="30303030303030303030303030303030313533372e303030303030309d50ba2f30303030fb1aebf4a5d80a30303030382e31383434363734343037333730393535313631302e30303030303030303030303030303030303030362e2f30303030303030303030303030303030303030352029232d7b00"], 0x6f) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='dir0/per_cpu/cpu0/trace_pipe\x00', 0x300, 0x140) bpf$OBJ_PIN_PROG(0x6, &(0x7f00000000c0)=@generic={&(0x7f0000000040)='dir0/per_cpu/cpu0/trace_pipe\x00', r4}, 0x18) readv(r4, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000002c0)={0x1, &(0x7f0000000200)=[{0x16, 0xfd, 0x4, 0x7fff0000}]}) ioctl$MTDFILEMODE(r0, 0x4d13, 0x1) r5 = syz_io_uring_setup(0x652b, &(0x7f0000000400)={0x0, 0xfffffffc, 0x9000c, 0x2, 0x55}, &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000080)) r6 = socket$inet_sctp(0x2, 0x5, 0x84) r7 = socket(0x2, 0x80805, 0x0) fcntl$notify(r5, 0x402, 0xc) getsockopt$inet_sctp_SCTP_MAX_BURST(r7, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000001080)=0x4) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x8, 0x32, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x12, &(0x7f0000000240)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x38dd53c5}, {}, {}, [@func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffc}, @func={0x85, 0x0, 0x1, 0x0, 0x1}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff8}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x7, 0xd9, &(0x7f0000000f80)=""/217, 0x41000, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x400000}, 0x94) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r6, 0x84, 0x77, &(0x7f0000000040)=ANY=[@ANYRES32=r8], 0x14) io_uring_enter(r5, 0x1, 0xfffffffd, 0x9, 0x0, 0x18) 7m7.99336977s ago: executing program 2 (id=133): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) mount$fuse(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000080)={0x50, 0x0, r1, {0x7, 0x29, 0x5, 0xffffffff9080edc4, 0x7, 0x0, 0x0, 0x4, 0x0, 0x0, 0x2, 0x4}}, 0x50) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x40000, 0x73) syz_fuse_handle_req(r0, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0x8000000000, {0x0, 0x1c}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r2, 0x40806685, &(0x7f0000000000)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r3 = getpgrp(0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000040)=0x5) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000680)={'\x00', 0x1, 0x2, 0xd, 0x6, 0x139, r3}) prctl$PR_SCHED_CORE(0x3e, 0x4002000000800001, r4, 0x1, 0x0) r5 = getpid() msgctl$MSG_INFO(0x0, 0xc, 0x0) sched_setscheduler(r5, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee7, 0x8031, 0xffffffffffffffff, 0x8ccbf000) r6 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r6, 0x1, 0x0) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) syz_clone3(&(0x7f0000000600)={0x100100c00, &(0x7f0000000240), &(0x7f00000002c0), &(0x7f00000003c0), {0x38}, &(0x7f0000000440)=""/250, 0xfa, &(0x7f0000000540)=""/120, &(0x7f00000005c0)=[r6, r3, r3, r6, r5, r6, r6], 0x7, {r7}}, 0x58) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) r8 = socket$key(0xf, 0x3, 0x2) r9 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_MOVE(0x3, r9, 0x0, 0x0, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000340)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaa62f0b965825b3d30b286d895aaaaaabb86dd600fe10400143afffe8000000000000000000000000000aaff02000000000000000000000000002100"/85], 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000014000000000000000000000005000600000000000a00000000000000fc0100000000000000000000ea2fa43c000000000000000005000500000000000a00000000000000000000000000000000000000000000000000000000000000080012000200020000000000000000001000330002"], 0xa0}}, 0x0) syz_open_dev$vcsu(&(0x7f00000000c0), 0x0, 0x80) 7m2.467105678s ago: executing program 2 (id=141): clock_gettime(0x0, &(0x7f0000000040)) semtimedop(0x0, &(0x7f0000000000)=[{0x1, 0x9}, {0x0, 0xc, 0x1000}, {0x0, 0x0, 0x1000}], 0x3, 0x0) semctl$SETVAL(0x0, 0x1, 0x10, &(0x7f0000000100)=0x1) 6m58.087786314s ago: executing program 2 (id=151): mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0xb89046, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x4, 0x40, 0x7fff0000}]}) getpid() r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='smaps\x00') writev(r0, &(0x7f0000000a80)=[{&(0x7f0000000a00)="14", 0x1}, {0x0}], 0x2) chroot(0x0) mount$bpf(0x0, &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000200)='.\x00', 0x0, 0x8b7840, 0x0) mlock(&(0x7f0000ffc000/0x3000)=nil, 0x3000) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x9000, 0x3, &(0x7f0000164000/0x9000)=nil) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x84000, 0x0) mkdir(&(0x7f0000000140)='./file0/../file0\x00', 0x190) mount$bpf(0x200000000000, &(0x7f0000000200)='.\x00', 0x0, 0x8b7840, 0x0) 6m57.185245212s ago: executing program 32 (id=151): mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0xb89046, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x4, 0x40, 0x7fff0000}]}) getpid() r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='smaps\x00') writev(r0, &(0x7f0000000a80)=[{&(0x7f0000000a00)="14", 0x1}, {0x0}], 0x2) chroot(0x0) mount$bpf(0x0, &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000200)='.\x00', 0x0, 0x8b7840, 0x0) mlock(&(0x7f0000ffc000/0x3000)=nil, 0x3000) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x9000, 0x3, &(0x7f0000164000/0x9000)=nil) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x84000, 0x0) mkdir(&(0x7f0000000140)='./file0/../file0\x00', 0x190) mount$bpf(0x200000000000, &(0x7f0000000200)='.\x00', 0x0, 0x8b7840, 0x0) 8.505248106s ago: executing program 1 (id=1928): bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x8000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fd3000/0x18000)=nil, &(0x7f0000000000)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000003680)=@vmx={0x0, 0x0, 0x2080, {0x0, 0x0, {}, 0x0, 0xffffffffffffffff}}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, &(0x7f0000000180)="660f388084000072baf80c66b860b4498c66efbafc0c66b80e00000066ef64f30fc7b000100f850100f30fc7b1030066b9800000c00f326635000400000f30d2bc0a000f23c80f21f86635040040000f23f8b8f4008ee0", 0x57}], 0x1, 0x2e, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) 8.274336227s ago: executing program 5 (id=1931): openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x4048aec9, &(0x7f0000000080)={[{0xfffffffe, 0xffff, 0x0, 0x8, 0x8, 0x81, 0x9, 0xfd, 0x3, 0x0, 0x46, 0x0, 0x2}, {0x3746, 0x400, 0x2, 0x1, 0x0, 0x61, 0x0, 0x0, 0x0, 0x0, 0x42, 0xfd, 0xfffffffffffffffe}, {0x200003, 0x2, 0x60, 0x80, 0x9, 0x4, 0x5d, 0x1, 0x42, 0x2, 0xff}], 0x1ffffff}) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="020a040007000000b6f1ffff0000854105001a"], 0x38}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="020100090e000000030000000000000405000600000000000a0000000000000400000000000000000000002100000000000100000000000002000100010000000000010200fd000005000500000000000a"], 0x70}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x3ef, 0x0) 7.995527706s ago: executing program 5 (id=1934): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x38, r1, 0x5, 0x3, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @crypto_settings=[@NL80211_ATTR_CONTROL_PORT_OVER_NL80211={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_CIPHER_SUITES_PAIRWISE={0x8, 0x49, [0xfac0c]}]]}, 0x38}}, 0x0) 7.778727309s ago: executing program 5 (id=1935): syz_open_procfs(0x0, &(0x7f0000000100)='smaps_rollup\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) ioctl$UI_SET_EVBIT(r4, 0x40045564, 0x12) (fail_nth: 1) ioctl$UI_DEV_SETUP(r4, 0x405c5503, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) 7.642082857s ago: executing program 0 (id=1936): bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) fsopen(0x0, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000080)={0x0, 0x8a, 0x4, 0x40000000, 0x8c, "00080000000000000000000cadf100004000"}) r2 = syz_open_pts(r1, 0x141401) write(r2, &(0x7f0000000000)="d5", 0xfffffedf) close_range(r0, 0xffffffffffffffff, 0x0) 7.127873691s ago: executing program 0 (id=1938): r0 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) write$binfmt_register(r0, &(0x7f0000000580)={0x3a, 'syz0', 0x3a, 'M', 0x3a, 0xb, 0x3a, '%!{!&)[\\', 0x3a, '\x00', 0x3a, './file0', 0x3a, [0x50, 0x43]}, 0x32) 6.661355198s ago: executing program 3 (id=1939): r0 = socket(0xa, 0x6, 0x3a) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, &(0x7f0000000040)=0x2) readv(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000700)=""/4109, 0x100d}], 0x1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4080}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000540)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @synproxy={{0xd}, @void}}, {0xc, 0x1, 0x0, 0x1, @osf={{0x8}, @void}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000580)=ANY=[@ANYBLOB="e80100000001050500000000000000000a0000003c0002802c00018014000300ff01000000000000000000000000000114000400ff0200000000000000000000000000010c00028005000100000000003c0001800c00028005000100000000002c00018014000300ff020d40f799000000000000000000011400040020010000000000000000000000000001080007400000000010000d800c000380060002004e210000080007400000000da800068004000380080002006401010124000380060001004e230000060001004e230000060001004e210000060002004e24000008000200e000000234000380060002004e230000060002004e2400fa050001"], 0x1e8}, 0x1, 0x0, 0x0, 0x48895}, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000140)={@local, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "c6dd00", 0x10, 0x3a, 0x1, @ipv4={'\x00', '\xff\xff', @remote}, @mcast2, {[], @ndisc_ra={0x89, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0xffffffff}}}}}}, 0x0) recvmmsg(r0, &(0x7f0000005d40)=[{{0x0, 0x0, 0x0}, 0xffffffff}, {{0x0, 0x0, 0x0}, 0x7}], 0x2, 0x20, 0x0) 6.661084796s ago: executing program 4 (id=1940): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000008000000", 0xfe60) 6.58334433s ago: executing program 0 (id=1941): r0 = socket$igmp(0x2, 0x3, 0x2) unshare(0x20000400) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x8, 0x1014}, 0x50) bind$inet(r0, 0x0, 0x0) 6.571730533s ago: executing program 1 (id=1942): pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000180)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(aes)\x00'}, 0x7c) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000440)="cb56b6cc04f01f56bb6e284f5fab5c66", 0x10) r3 = accept4(r2, 0x0, 0x0, 0x800) write$binfmt_misc(r1, &(0x7f00000005c0)='C', 0x1) splice(r0, 0x0, r3, 0x0, 0x6, 0x6) 4.459430724s ago: executing program 5 (id=1943): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r0, 0x0, 0xb, &(0x7f0000000000)=0xfffffffd, 0x4) sendto$inet(r0, 0x0, 0xfff5, 0x20000000, &(0x7f0000000240)={0x2, 0x4e20, @remote}, 0x10) recvfrom$inet(r0, 0x0, 0x0, 0x2042, 0x0, 0x0) 4.459165136s ago: executing program 4 (id=1944): socket$packet(0x11, 0x2, 0x300) syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000e131f8104c1302007eac0102030109021b0001000000000904000001098b7500090583"], 0x0) syz_open_dev$evdev(&(0x7f0000000000), 0x6f1022e4, 0x101) 4.401216428s ago: executing program 1 (id=1945): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f0000004040)=@filename='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0x0, 0x0) getsockname$packet(r2, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x7) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x8}, {0xfff1, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x20, &(0x7f00000001c0)={&(0x7f0000000000)=@delchain={0x24, 0x11, 0x1, 0x1f, 0x0, {0x0, 0x0, 0x0, r3}}, 0x24}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) 4.394629372s ago: executing program 0 (id=1946): connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x4e24, 0xa, @private1, 0x8}, 0x1c) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) sendmsg$NL80211_CMD_SET_TID_CONFIG(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x30}, 0x1, 0x0, 0x0, 0x8441}, 0x4000000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10008000}, 0x40095) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_CPUID(r3, 0x4008ae8a, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x2a7, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0xffffffffffffffc6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ff}, 0x94) ioctl$KVM_RUN(r3, 0xae80, 0x0) 3.625828123s ago: executing program 3 (id=1947): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000580)={'veth0_to_team\x00', 0x0}) close(0xffffffffffffffff) socket$packet(0x11, 0x3, 0x300) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000004c0)={r0, r2, 0x25, 0x0, @void}, 0x10) ioctl$sock_bt_hci(0xffffffffffffffff, 0x400448e6, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000140)=[{0x6, 0x2, 0x0, 0x7fff0000}]}) close_range(r3, 0xffffffffffffffff, 0x0) 3.518945838s ago: executing program 1 (id=1948): setsockopt$MRT_ADD_MFC(0xffffffffffffffff, 0x0, 0xcc, &(0x7f00000001c0)={@private=0xa010101, @loopback, 0x1, "0ae3d8e9150ed0255388ebfbf9f1c4cd59ae10bb8b2951776b0133aacf6eda2c", 0x0, 0x8, 0xb24, 0x7}, 0x3c) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x82401, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x143042, 0x58) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) pidfd_getfd(r3, r3, 0x0) copy_file_range(r1, 0x0, r1, &(0x7f00000000c0)=0xae8, 0x863, 0xae8) eventfd2(0x100000, 0x80000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000340)={0x4, &(0x7f0000000100)=[{0x9, 0x3a, 0xb}, {0x0, 0xb, 0x7f, 0x9}, {0x2, 0x2, 0x7, 0x1}, {0x4, 0x0, 0x4, 0x2}]}) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$SEG6(&(0x7f0000000180), 0xffffffffffffffff) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x6, 0x13, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r4, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000300)=""/8, 0x8a, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, 0x0, 0x4008894) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) syz_80211_inject_frame(&(0x7f0000000400)=@device_b, &(0x7f0000000a00)=@data_frame={@msdu=@type11={{0x0, 0x2, 0xc, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1}, {0x1}, @device_b, @device_a, @device_b, {0x8, 0x81}, @device_a, @value={0x3, 0x1, 0x1, 0x0, 0x7f}, @value=@ver_80211n={0x0, 0x4, 0x2, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1}}, @random="bf6a0fb5c46e8c6f956f5ef47950da3eefc59b18d29db1e930bf5f9301cb1b4fcc6aca7ebfa7be3b0eb8702b8d226ba6b1deb13dff28d1152528f76a0dd96922d0971bf76e8aaa040277c984ebdce4c5bf3fa446bb26341ccbafb5172d002e990d68a9e8e823084ed99494769b65d8f9c9f86d3ec3b6f90bee1ce04f5cac8b6078e33b40305afc82679c96ba3bf2d81699f93ce601311da9d14a70c17df76f4ec9a77bc98da0918fef44372423459f985b683ebac6e0d3976de7667e283759f1a6bf69c43c11c9bdb95cdf3f5cbf08ef8096597034ee8b1a87eadc8ea0dc63b2c2491c661adda5e1f0466d8de03e177bfc0048dc9404ae0803b1c78b6a39ba4fec60ac7f437fabb7cafc8a31809469b58a0e3d55bd3740d8412a0cef3b4e2c1cace3a111b2fa596e1980a06c8068927c6357aa411a7433ddd09393d4912637a93c670c3535c5b16e77ce8e4eac591a7457f1572b87fea3369b499f7239a4d8bc5e9319abc318eff0289d08a58aa36a6154a79741cc132af2df5e3b414e05f914907bfd1a8602f7f2df8bed7ba3b9b62c6a136d03487c8148e0f88ec0e6378b132d5cd5aa388838c3b4e6f29a60cf88ee46817ced3ba140a725204b2436b3f22f8ffd98506e0d5cfe830a234dbe8ec8a4a1c5096094cbc67561e7c7630c4454dde696587c26f6b81fca046fe77178c579c0936e6fee05d99fd2b414c63cf1faa3a54e77b3ddc7ae7e77dedebd4c3c28250cb9101d0e96c6b742cf3de8a725619eccde329d4cc2ea39741afa9d6b81d6fc661f23c3ed6a2a5d33a4a94654bd934fff9ce312e3903833e9a2994111830c76b17a0fdc1b90eacf147c16dc185789d9de67a71b99146d38a6fa3d19c213e3c782f9aceb49750120af88300a70a6f337cb1e2557e88b4f38ab5089c964b9ababf242b8fc4358181c1ad7f5fa540ddc86c4860bdc8ef28184bfa97d799dcbfc4a53d2a290d06da4047269fe209b8e689556ef6a641044f0193bb997e78a0eadbc27fc3c5b0767184b1b64597ff94aee4188dc063aba914e2e12f7a10255e45aedd6237d5aae449f896a3bc5eddee1c68e203c5dfb0f7f95c8e409d8380bdb89550ce3093e94b15e1b66de5c06f5a52dcfe4767d4d2ed8547f14210f99a7af14e235264e668cd7dd722450a89a7acf33994582853ea1924c1ba3a0328a856b388f504879771692993ce5b12e047bccd3f9d75df9525bc647b4cb9eae9670810d13e81cbc6452d9ecaf63b2e97867ef3090ab240b5ee6a2e41aa150f5b1720323568e756040cc1c6820cc3e251bef9c62e812fe77edc2f4c78feba926a2546e8234781bb193db31291dcd5f1bb61e75885add6c7e66a9c05dcda17b0e88c405f0bd3dee3137783b36d07877fbe5ec83233e372417c35efe59f8d608dffd39af765955f5e04eb73cd92e26a1b8883ae1f88849accdb6e2e70853705cd525bc66d00d109d29989d4f26bae92f2d0febfe0b1853a434774bf0afe225892b1a95bd4acf94eed61219f54db566dc851bddfb8cfb788da3755d44f7a77693371a133f48f42cb4f273447b311ed0b8676f7b800fddddc7fc563fc410111bc36e7a40a3f1e0b2e87b08e8217e8984088755bbd220daf11bb909273d1361c95d4f55f93eec96afcfe7f8c911ff17bf4b97496e055322f3728744d1055052c3657f369ffc13136322da937dadc3db0c01853efade48609b1f374ba74969cf170a78deca023d0a548a58c7dbaae10d55d2857f2fb73cbbdc63461ac2c874e22001415f9f982e1580ef215a1b771b74cfcc03340a15363adf61d26e4138c098d7a41a5553362b4b5bec3d9e2386eb7abc6e7c70b425fc26fd7b0239dc8d6962738117b71e98bb321590003bde633ccb477f09256584ffd2ac9b2891a367235fad08dfdaff38e8631ef6e751b9fcce61e33c8116fbdace693089af01f3d9431528a8f0734b04d61cc1e60590079ee077ef78ca63206e72d6562f35a9e03ca092aa93a22e04d0b45501408245e004af37b271f8c9242dd73219350d898b162ca3b8f2d51cb5a795a36a6cea9ed66b413503f16afa0372f5ea715d743659c5628f7aba97f6c008f1317d58838a2593f8cd810182e0cefa93e82f60e83e6ac0c5825d4a84f782520ecb303ca412362ae84021451d30fc01814113f8dde44fe206061df66f58a38d49af5691f4ada06b568df7f35b39cbdc9009b7d953e65f81538df5caf74075a5e239152eb27b75135de1da6e67043b41d6f2562c535f3a375b12d3277c42d4dbdd54c88ce9dfcd7c964a00659019bcf8c1320febadca39c1503ebdb8623e7ccce7de065a224d511a942d4555b8db72561d29c0f55d5081b78105001b9360216a3d07c42c414e9f2ef2076f2fae7f2990cb2de2a5b5df8ad7ac26cbea8c0b096d2204e60ba85104bd34fc5b"}, 0x6dd) socket$nl_netfilter(0x10, 0x3, 0xc) r6 = syz_open_dev$sndpcmc(0x0, 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_DRAIN(r6, 0xc06c4124, 0x40944f9c780000) 3.151523013s ago: executing program 3 (id=1949): setxattr$incfs_metadata(0x0, 0x0, 0x0, 0x0, 0x3) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000c80), 0x802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000cc0)={0x2e, {0x8, 0x7be51e11, 0x5, 0xfffffff9, 0x3, 0xd9}}) 3.030009768s ago: executing program 3 (id=1950): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB="180000000000000000000000000000009500000000000000e8adb83d379df92cc65008b38b2abf1bdd7674c5289619c883cc24f4d96e479b2d0080db065d82f2cce099b0ff7eb0e0eefda0bff07037016b4ba0a90b4a89e16de5977a1b453f0af7319502601b41a3"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x80) r1 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000200)={@cgroup=r2, r0, 0x12, 0x2}, 0x10) 2.960908896s ago: executing program 4 (id=1951): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) r4 = syz_open_dev$usbfs(&(0x7f0000000080), 0x206, 0x20182) ioctl$USBDEVFS_ALLOW_SUSPEND(r4, 0x5522) write(0xffffffffffffffff, &(0x7f0000000340)='&\x00\x00\x00\"\x00', 0x6) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000d9bffc), 0x4) sendto(0xffffffffffffffff, &(0x7f0000000380)="120000001200e7ef007b00000000000000a1", 0x12, 0x20000090, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, &(0x7f0000000140)={0x0, 0x2, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d80672e65a6a0a72e19c2b60bd6276fd8bb6366e9d1ed9a60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d10d1f600"}) ioctl$USBDEVFS_SETINTERFACE(r3, 0x80045510, &(0x7f0000000040)={0x0, 0x200000}) 2.921373051s ago: executing program 3 (id=1952): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000740)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd2d, 0x0, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xc, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x407ffffffffffe, 0x800000000000002}, 0xffffffff, 0x0, 0x1, 0x0, 0x6}, [@tmpl={0x44, 0x5, [{{@in6=@dev={0xfe, 0x80, '\x00', 0x29}, 0x1, 0x3c}, 0x2, @in6=@empty, 0x6, 0x4, 0x3}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "4dd308", 0x14, 0x6, 0x0, @local, @local, {[], {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) 2.879961689s ago: executing program 0 (id=1953): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x800001000087}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = openat(0xffffffffffffff9c, 0x0, 0x442, 0x0) write$binfmt_aout(r3, 0x0, 0x20) splice(r3, 0x0, 0xffffffffffffffff, 0x0, 0x807, 0x0) syz_usb_connect(0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r4, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) 1.881457452s ago: executing program 3 (id=1954): socket(0x400000000010, 0x3, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'macvtap0\x00', 0x2}) socket$unix(0x1, 0x5, 0x0) capset(0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = syz_usb_connect$uac1(0x0, 0xb1, &(0x7f00000005c0)=ANY=[@ANYBLOB="12010000000000106b1d0101890f0000030109029f0003010000000904000000010100000a24010000000201020d24060000030800000031ce21c798329740594c137d0000000c24020201010608000010000c24020000000300000000000924060006010000000924030000000005000b2406050001", @ANYRES64=r1], 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000000040)={0x84, &(0x7f0000000680)=ANY=[@ANYBLOB="200704"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r2, 0x0, &(0x7f0000000400)={0x44, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="2082020000000b"], 0x0, 0x0, 0x0}) 1.801433274s ago: executing program 1 (id=1955): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x28) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000009d973ec5f18fb6ba25bfa35134f1ac8166b3890c15b91f5b889b123d67dd9a32cecc7f77f10fa999308a29f10bf118353a61ff9cf0bfc00a2970825a97100c0e434d9f93dac5ae9cd91c4e136a91ab89b372de3f52b353f1"], &(0x7f0000000080)='GPL\x00', 0x5, 0x1f6, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @sock_ops, r0, 0x8, 0x0, 0x0, 0x18, &(0x7f0000000200), 0x1}, 0x6d) unshare(0x28000600) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000a00)={r1, 0x105, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000400), 0x0, 0x8, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x10, 0x8, 0x0, 0x0}}, 0x10) 1.798961202s ago: executing program 4 (id=1956): mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0xc0) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff097b00000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000340)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@access_uid={'access', 0x3d, 0xee00}}]}}) lstat(&(0x7f0000000140)='./file0/file0\x00', 0x0) 1.632187639s ago: executing program 1 (id=1957): unshare(0x6a040000) r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000440)={@private0, 0x7e, r1}) 1.361642128s ago: executing program 5 (id=1958): msgctl$IPC_SET(0x0, 0x1, 0x0) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) tkill(r0, 0x30) socket$igmp(0x2, 0x3, 0x2) ptrace$peeksig(0x4209, r0, &(0x7f0000000140)={0xffffffffffffffff, 0x0, 0xfffffffffffffddd}, &(0x7f00000001c0)=[{}, {}, {}, {}, {}]) 1.300596244s ago: executing program 4 (id=1959): openat$ptmx(0xffffffffffffff9c, 0x0, 0x20d00, 0x0) socket(0x2, 0x80805, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x12, 0x4, 0x4, 0x12}, 0x50) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000040)={@map=r5, r4, 0x26}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000a80)={r5, &(0x7f0000000940), &(0x7f0000000a40)=@tcp6=r3}, 0x20) shutdown(r3, 0x0) recvmmsg(r3, &(0x7f0000000300)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000b80)=""/4119, 0x1017}], 0x1}}], 0x1, 0x4002, 0x0) 992.281937ms ago: executing program 5 (id=1960): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000100)={0x1, 0x0, [{0x40000080, 0x0, 0x175}]}) 61.092483ms ago: executing program 4 (id=1961): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000080)=0xfff, 0x4) creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r0, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp={0x2c, 0x0, r2}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x36}], 0x1}}], 0x1, 0x0) 0s ago: executing program 0 (id=1962): r0 = syz_usb_connect$uac2(0x5, 0x83, &(0x7f0000000180)=ANY=[@ANYBLOB="120100020000000882052500400001020301090271000301f81005080b020001052008090400000001012000092401fdff0a11004708240a0000057f00090401000001022000090401010101022000090501"], 0x0) syz_usb_control_io$uac2(r0, &(0x7f0000000100)={0x14, 0x0, &(0x7f00000000c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x500a}}}, 0x0) syz_usb_control_io$uac2(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000009c0)={0x84, &(0x7f00000004c0)={0x40, 0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) kernel console output (not intermixed with test programs): 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 436.303868][ T10] usb 2-1: config 1 interface 1 has no altsetting 0 [ 436.346823][ T10] usb 2-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 436.346867][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 436.346889][ T10] usb 2-1: Product: syz [ 436.346905][ T10] usb 2-1: Manufacturer: syz [ 436.346937][ T10] usb 2-1: SerialNumber: syz [ 436.376783][T10091] Dev loop2: unable to read RDB block 7 [ 436.379710][T10091] loop2: unable to read partition table [ 436.380322][T10091] loop2: partition table beyond EOD, truncated [ 436.390134][T10091] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 436.551091][ T476] bridge_slave_0: left allmulticast mode [ 436.564789][ T476] bridge_slave_0: left promiscuous mode [ 436.565383][ T476] bridge0: port 1(bridge_slave_0) entered disabled state [ 436.618874][T10081] FAULT_INJECTION: forcing a failure. [ 436.618874][T10081] name failslab, interval 1, probability 0, space 0, times 0 [ 436.618911][T10081] CPU: 1 UID: 0 PID: 10081 Comm: syz.1.1446 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 436.618939][T10081] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 436.618952][T10081] Call Trace: [ 436.618960][T10081] [ 436.618970][T10081] dump_stack_lvl+0xe8/0x150 [ 436.619011][T10081] should_fail_ex+0x467/0x600 [ 436.619064][T10081] should_failslab+0xa8/0x100 [ 436.619094][T10081] __kmalloc_noprof+0xfe/0x780 [ 436.619120][T10081] ? rcu_is_watching+0x15/0xb0 [ 436.619149][T10081] ? tomoyo_realpath_from_path+0xef/0x640 [ 436.619180][T10081] ? tomoyo_realpath_from_path+0xef/0x640 [ 436.619219][T10081] tomoyo_realpath_from_path+0xef/0x640 [ 436.619261][T10081] ? tomoyo_path_number_perm+0x219/0x5f0 [ 436.619288][T10081] tomoyo_path_number_perm+0x246/0x5f0 [ 436.619318][T10081] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 436.619342][T10081] ? __lock_acquire+0x683/0x2ce0 [ 436.619382][T10081] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 436.619412][T10081] ? hook_file_ioctl+0x1f3/0x600 [ 436.619446][T10081] ? lockdep_hardirqs_on+0x7a/0x110 [ 436.619496][T10081] ? __fget_files+0x2a/0x420 [ 436.619525][T10081] ? __fget_files+0x2a/0x420 [ 436.619548][T10081] ? __fget_files+0x3a8/0x420 [ 436.619570][T10081] ? __fget_files+0x2a/0x420 [ 436.619600][T10081] security_file_ioctl+0xc3/0x2a0 [ 436.619630][T10081] __se_sys_ioctl+0x47/0x170 [ 436.619663][T10081] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 436.619687][T10081] do_syscall_64+0x174/0x580 [ 436.619716][T10081] ? trace_irq_disable+0x3b/0x140 [ 436.619739][T10081] ? clear_bhb_loop+0x40/0x90 [ 436.619765][T10081] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 436.619787][T10081] RIP: 0033:0x7fa68179e019 [ 436.619810][T10081] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 436.619831][T10081] RSP: 002b:00007fa67f9f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 436.619854][T10081] RAX: ffffffffffffffda RBX: 00007fa681a25fa0 RCX: 00007fa68179e019 [ 436.619870][T10081] RDX: 00002000000002c0 RSI: 00000000400445a0 RDI: 0000000000000006 [ 436.619884][T10081] RBP: 00007fa67f9f6090 R08: 0000000000000000 R09: 0000000000000000 [ 436.619898][T10081] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 436.619910][T10081] R13: 00007fa681a26038 R14: 00007fa681a25fa0 R15: 00007ffdd9f77cf8 [ 436.619945][T10081] [ 436.623386][T10081] ERROR: Out of memory at tomoyo_realpath_from_path. [ 437.264836][ T10] usb 2-1: Audio class v2/v3 interfaces need an interface association [ 437.265406][ T10] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 437.344995][T10105] FAULT_INJECTION: forcing a failure. [ 437.344995][T10105] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 437.345028][T10105] CPU: 1 UID: 0 PID: 10105 Comm: syz.1.1454 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 437.345051][T10105] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 437.345062][T10105] Call Trace: [ 437.345069][T10105] [ 437.345077][T10105] dump_stack_lvl+0xe8/0x150 [ 437.345122][T10105] should_fail_ex+0x467/0x600 [ 437.345156][T10105] _copy_to_user+0x31/0xb0 [ 437.345180][T10105] simple_read_from_buffer+0xe1/0x170 [ 437.345205][T10105] proc_fail_nth_read+0x1be/0x230 [ 437.345233][T10105] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 437.345262][T10105] ? rw_verify_area+0x250/0x4d0 [ 437.345289][T10105] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 437.345307][T10105] vfs_read+0x219/0xa90 [ 437.345334][T10105] ? __pfx_vfs_read+0x10/0x10 [ 437.345358][T10105] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 437.345382][T10105] ? lockdep_hardirqs_on+0x7a/0x110 [ 437.345404][T10105] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 437.345427][T10105] ? mutex_lock_nested+0x152/0x1d0 [ 437.345444][T10105] ? fdget_pos+0x252/0x320 [ 437.345470][T10105] ksys_read+0x156/0x270 [ 437.345494][T10105] ? __pfx_ksys_read+0x10/0x10 [ 437.345524][T10105] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 437.345545][T10105] do_syscall_64+0x174/0x580 [ 437.345570][T10105] ? trace_irq_disable+0x3b/0x140 [ 437.345590][T10105] ? clear_bhb_loop+0x40/0x90 [ 437.345612][T10105] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 437.345628][T10105] RIP: 0033:0x7fa68175e84e [ 437.345645][T10105] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 437.345660][T10105] RSP: 002b:00007fa67f9f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 437.345680][T10105] RAX: ffffffffffffffda RBX: 00007fa67f9f66c0 RCX: 00007fa68175e84e [ 437.345692][T10105] RDX: 000000000000000f RSI: 00007fa67f9f60a0 RDI: 0000000000000004 [ 437.345703][T10105] RBP: 00007fa67f9f6090 R08: 0000000000000000 R09: 0000000000000000 [ 437.345713][T10105] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 437.345723][T10105] R13: 00007fa681a26038 R14: 00007fa681a25fa0 R15: 00007ffdd9f77cf8 [ 437.345750][T10105] [ 437.644333][ T10] usb 2-1: USB disconnect, device number 29 [ 437.773401][ T5628] udevd[5628]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 438.683499][ T9919] IPVS: starting estimator thread 0... [ 439.124755][T10124] IPVS: using max 7 ests per chain, 16800 per kthread [ 439.857394][ T476] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 439.901243][ T476] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 439.919318][ T476] bond0 (unregistering): Released all slaves [ 440.267444][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.380548][ T9919] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 440.533119][ T9902] bridge0: port 1(bridge_slave_0) entered blocking state [ 440.533247][ T9902] bridge0: port 1(bridge_slave_0) entered disabled state [ 440.533466][ T9902] bridge_slave_0: entered allmulticast mode [ 440.560653][ T9919] usb 6-1: Using ep0 maxpacket: 8 [ 440.565924][ T9919] usb 6-1: config 1 interface 0 altsetting 226 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 440.565961][ T9919] usb 6-1: config 1 interface 0 has no altsetting 0 [ 440.595677][ T9919] usb 6-1: New USB device found, idVendor=07b5, idProduct=0312, bcdDevice= 0.40 [ 440.595710][ T9919] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 440.595733][ T9919] usb 6-1: Product: ìž‚à¹­çˆ”ì¾¶ä“˜ì¹ [ 440.595749][ T9919] usb 6-1: Manufacturer: Ãꑉ췥敘鳩⎊Ỉ㶷觧勄ⶒá砱컚⃴äšá– [ 440.595768][ T9919] usb 6-1: SerialNumber: Ї [ 440.853105][ T9902] bridge_slave_0: entered promiscuous mode [ 441.828897][ T9902] bridge0: port 2(bridge_slave_1) entered blocking state [ 441.829024][ T9902] bridge0: port 2(bridge_slave_1) entered disabled state [ 441.829266][ T9902] bridge_slave_1: entered allmulticast mode [ 441.836277][ T9902] bridge_slave_1: entered promiscuous mode [ 441.878111][ T9919] usbhid 6-1:1.0: can't add hid device: -71 [ 441.878242][ T9919] usbhid 6-1:1.0: probe with driver usbhid failed with error -71 [ 441.987828][ T9919] usb 6-1: USB disconnect, device number 27 [ 442.215576][T10150] FAULT_INJECTION: forcing a failure. [ 442.215576][T10150] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 442.215612][T10150] CPU: 0 UID: 0 PID: 10150 Comm: syz.4.1469 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 442.215637][T10150] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 442.215651][T10150] Call Trace: [ 442.215659][T10150] [ 442.215669][T10150] dump_stack_lvl+0xe8/0x150 [ 442.215707][T10150] should_fail_ex+0x467/0x600 [ 442.215746][T10150] _copy_from_user+0x2d/0xb0 [ 442.215773][T10150] __sys_bpf+0x2e7/0xd90 [ 442.215805][T10150] ? __pfx___sys_bpf+0x10/0x10 [ 442.215831][T10150] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 442.215866][T10150] ? rt_mutex_slowunlock+0x219/0x460 [ 442.215918][T10150] ? ksys_write+0x248/0x270 [ 442.215949][T10150] ? __pfx_ksys_write+0x10/0x10 [ 442.215981][T10150] __x64_sys_bpf+0xba/0xd0 [ 442.216016][T10150] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 442.216041][T10150] do_syscall_64+0x174/0x580 [ 442.216071][T10150] ? trace_irq_disable+0x3b/0x140 [ 442.216093][T10150] ? clear_bhb_loop+0x40/0x90 [ 442.216123][T10150] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 442.216145][T10150] RIP: 0033:0x7ff59636e019 [ 442.216171][T10150] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 442.216191][T10150] RSP: 002b:00007ff5945c6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 442.216214][T10150] RAX: ffffffffffffffda RBX: 00007ff5965f5fa0 RCX: 00007ff59636e019 [ 442.216230][T10150] RDX: 0000000000000038 RSI: 0000200000000080 RDI: 0000000000000019 [ 442.216243][T10150] RBP: 00007ff5945c6090 R08: 0000000000000000 R09: 0000000000000000 [ 442.216256][T10150] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 442.216267][T10150] R13: 00007ff5965f6038 R14: 00007ff5965f5fa0 R15: 00007ffe393e8308 [ 442.216305][T10150] [ 442.560728][ T9902] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 442.633046][ T9902] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 442.744680][T10163] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1475'. [ 444.215340][T10179] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 444.822632][ T9902] team0: Port device team_slave_0 added [ 444.862198][ T9902] team0: Port device team_slave_1 added [ 447.005310][ T5264] 8021q: adding VLAN 0 to HW filter on device eth5 [ 447.017640][ T9902] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 447.017657][ T9902] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 447.017689][ T9902] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 447.768857][ T36] IPVS: starting estimator thread 0... [ 447.984476][ T9902] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 447.984497][ T9902] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 447.984529][ T9902] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 448.031780][T10221] IPVS: using max 11 ests per chain, 26400 per kthread [ 448.405908][T10229] FAULT_INJECTION: forcing a failure. [ 448.405908][T10229] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 448.405944][T10229] CPU: 1 UID: 0 PID: 10229 Comm: syz.5.1494 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 448.405979][T10229] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 448.405993][T10229] Call Trace: [ 448.406001][T10229] [ 448.406010][T10229] dump_stack_lvl+0xe8/0x150 [ 448.406049][T10229] should_fail_ex+0x467/0x600 [ 448.406089][T10229] _copy_from_user+0x2d/0xb0 [ 448.406147][T10229] ucma_write+0x166/0x2f0 [ 448.406174][T10229] ? __pfx_ucma_write+0x10/0x10 [ 448.406199][T10229] ? security_file_permission+0x75/0x260 [ 448.406229][T10229] ? rw_verify_area+0x209/0x4d0 [ 448.406259][T10229] vfs_writev+0x4c4/0x990 [ 448.406282][T10229] ? __pfx_ucma_write+0x10/0x10 [ 448.406313][T10229] ? __pfx_vfs_writev+0x10/0x10 [ 448.406347][T10229] ? __fget_files+0x2a/0x420 [ 448.406375][T10229] ? __fget_files+0x3a8/0x420 [ 448.406396][T10229] ? __fget_files+0x2a/0x420 [ 448.406428][T10229] do_writev+0x15a/0x2e0 [ 448.406451][T10229] ? __pfx_do_writev+0x10/0x10 [ 448.406479][T10229] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 448.406503][T10229] do_syscall_64+0x174/0x580 [ 448.406533][T10229] ? trace_irq_disable+0x3b/0x140 [ 448.406554][T10229] ? clear_bhb_loop+0x40/0x90 [ 448.406581][T10229] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 448.406604][T10229] RIP: 0033:0x7eff7fc5e019 [ 448.406625][T10229] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 448.406643][T10229] RSP: 002b:00007eff7deb6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 448.406666][T10229] RAX: ffffffffffffffda RBX: 00007eff7fee5fa0 RCX: 00007eff7fc5e019 [ 448.406683][T10229] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 0000000000000010 [ 448.406698][T10229] RBP: 00007eff7deb6090 R08: 0000000000000000 R09: 0000000000000000 [ 448.406712][T10229] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 448.406725][T10229] R13: 00007eff7fee6038 R14: 00007eff7fee5fa0 R15: 00007ffcbbe6bd48 [ 448.406758][T10229] [ 448.618478][T10230] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1492'. [ 448.896892][T10245] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 448.986676][ T5615] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 448.986984][ T476] hsr_slave_0: left promiscuous mode [ 449.038001][ T476] hsr_slave_1: left promiscuous mode [ 449.146864][ T5615] usb 4-1: Using ep0 maxpacket: 32 [ 449.154659][ T5615] usb 4-1: config index 0 descriptor too short (expected 35577, got 27) [ 449.154692][ T5615] usb 4-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 449.154716][ T5615] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 449.154741][ T5615] usb 4-1: config 1 has no interface number 0 [ 449.154792][ T5615] usb 4-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 449.154824][ T5615] usb 4-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 449.154875][ T5615] usb 4-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 449.154903][ T5615] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 449.239361][ T476] veth1_macvtap: left promiscuous mode [ 449.239440][ T476] veth0_macvtap: left promiscuous mode [ 449.239994][ T476] veth1_vlan: left promiscuous mode [ 449.267926][T10252] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1501'. [ 449.298222][ T476] veth0_vlan: left promiscuous mode [ 449.307370][ T5615] snd_usb_pod 4-1:1.1: Line 6 Pocket POD found [ 449.510848][ T5615] snd_usb_pod 4-1:1.1: Line 6 Pocket POD now attached [ 450.078215][ T5615] usb 4-1: USB disconnect, device number 33 [ 450.081068][ T5615] snd_usb_pod 4-1:1.1: Line 6 Pocket POD now disconnected [ 450.657635][ T476] team0 (unregistering): Port device team_slave_1 removed [ 450.741906][ T476] team0 (unregistering): Port device team_slave_0 removed [ 451.147566][ T9902] hsr_slave_0: entered promiscuous mode [ 451.149403][ T9902] hsr_slave_1: entered promiscuous mode [ 451.156463][ T9902] debugfs: 'hsr0' already exists in 'hsr' [ 451.157038][ T9902] Cannot create hsr debugfs directory [ 452.630778][T10286] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1508'. [ 453.225190][T10299] vivid-000: disconnect [ 453.315906][ T5264] 8021q: adding VLAN 0 to HW filter on device eth6 [ 453.566673][ T5945] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 453.716636][ T5945] usb 2-1: Using ep0 maxpacket: 32 [ 453.732642][T10299] vivid-000: reconnect [ 453.958774][T10319] FAULT_INJECTION: forcing a failure. [ 453.958774][T10319] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 453.958808][T10319] CPU: 0 UID: 0 PID: 10319 Comm: syz.5.1515 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 453.958830][T10319] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 453.958841][T10319] Call Trace: [ 453.958851][T10319] [ 453.958859][T10319] dump_stack_lvl+0xe8/0x150 [ 453.958891][T10319] should_fail_ex+0x467/0x600 [ 453.958929][T10319] _copy_from_user+0x2d/0xb0 [ 453.958953][T10319] ___sys_recvmsg+0x173/0x5a0 [ 453.958984][T10319] ? __pfx____sys_recvmsg+0x10/0x10 [ 453.959010][T10319] ? __fget_files+0x2a/0x420 [ 453.959043][T10319] ? __fget_files+0x3a8/0x420 [ 453.959068][T10319] __x64_sys_recvmsg+0x1b4/0x290 [ 453.959094][T10319] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 453.959132][T10319] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 453.959152][T10319] do_syscall_64+0x174/0x580 [ 453.959178][T10319] ? clear_bhb_loop+0x40/0x90 [ 453.959200][T10319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 453.959219][T10319] RIP: 0033:0x7eff7fc5e019 [ 453.959237][T10319] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 453.959254][T10319] RSP: 002b:00007eff7deb6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 453.959275][T10319] RAX: ffffffffffffffda RBX: 00007eff7fee5fa0 RCX: 00007eff7fc5e019 [ 453.959288][T10319] RDX: 0000000000010002 RSI: 0000200000001600 RDI: 0000000000000004 [ 453.959299][T10319] RBP: 00007eff7deb6090 R08: 0000000000000000 R09: 0000000000000000 [ 453.959309][T10319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 453.959318][T10319] R13: 00007eff7fee6038 R14: 00007eff7fee5fa0 R15: 00007ffcbbe6bd48 [ 453.959344][T10319] [ 454.581882][T10314] netlink: 'syz.3.1514': attribute type 2 has an invalid length. [ 454.658788][T10329] netlink: 80 bytes leftover after parsing attributes in process `syz.5.1516'. [ 454.830142][ T476] IPVS: stop unused estimator thread 0... [ 455.625144][ T5945] usb 2-1: unable to get BOS descriptor or descriptor too short [ 455.633553][ T5945] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 455.633595][ T5945] usb 2-1: can't read configurations, error -71 [ 456.176773][ T10] usb 6-1: new low-speed USB device number 28 using dummy_hcd [ 456.331059][ T10] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x82 is Bulk; changing to Interrupt [ 456.331096][ T10] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x3 is Bulk; changing to Interrupt [ 456.331121][ T10] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 456.398256][ T10] usb 6-1: string descriptor 0 read error: -22 [ 456.398371][ T10] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 456.398389][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 456.406837][T10350] FAULT_INJECTION: forcing a failure. [ 456.406837][T10350] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 456.406867][T10350] CPU: 1 UID: 0 PID: 10350 Comm: syz.3.1523 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 456.406887][T10350] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 456.406898][T10350] Call Trace: [ 456.406904][T10350] [ 456.406911][T10350] dump_stack_lvl+0xe8/0x150 [ 456.406943][T10350] should_fail_ex+0x467/0x600 [ 456.406975][T10350] _copy_to_user+0x31/0xb0 [ 456.406999][T10350] simple_read_from_buffer+0xe1/0x170 [ 456.407022][T10350] proc_fail_nth_read+0x1be/0x230 [ 456.407046][T10350] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 456.407068][T10350] ? rw_verify_area+0x250/0x4d0 [ 456.407091][T10350] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 456.407110][T10350] vfs_read+0x219/0xa90 [ 456.407139][T10350] ? __pfx_vfs_read+0x10/0x10 [ 456.407163][T10350] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 456.407188][T10350] ? lockdep_hardirqs_on+0x7a/0x110 [ 456.407212][T10350] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 456.407237][T10350] ? mutex_lock_nested+0x152/0x1d0 [ 456.407254][T10350] ? fdget_pos+0x252/0x320 [ 456.407279][T10350] ksys_read+0x156/0x270 [ 456.407302][T10350] ? __pfx_ksys_read+0x10/0x10 [ 456.407329][T10350] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 456.407348][T10350] do_syscall_64+0x174/0x580 [ 456.407370][T10350] ? trace_irq_disable+0x3b/0x140 [ 456.407387][T10350] ? clear_bhb_loop+0x40/0x90 [ 456.407408][T10350] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 456.407425][T10350] RIP: 0033:0x7fcb0571e84e [ 456.407442][T10350] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 456.407456][T10350] RSP: 002b:00007fcb03994fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 456.407474][T10350] RAX: ffffffffffffffda RBX: 00007fcb039956c0 RCX: 00007fcb0571e84e [ 456.407487][T10350] RDX: 000000000000000f RSI: 00007fcb039950a0 RDI: 0000000000000007 [ 456.407498][T10350] RBP: 00007fcb03995090 R08: 0000000000000000 R09: 0000000000000000 [ 456.407507][T10350] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 456.407517][T10350] R13: 00007fcb059e6128 R14: 00007fcb059e6090 R15: 00007fff4eb4e388 [ 456.407543][T10350] [ 456.664630][T10343] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 456.664770][T10343] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 456.697772][ T10] cdc_ether 6-1:1.0: probe with driver cdc_ether failed with error -22 [ 460.239929][ T6017] usb 6-1: USB disconnect, device number 28 [ 461.248313][T10413] netlink: 'syz.5.1535': attribute type 5 has an invalid length. [ 461.326829][ T10] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 461.367622][ T9902] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 461.452692][ T9902] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 461.465717][ T9902] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 461.486238][T10429] loop2: detected capacity change from 0 to 7 [ 461.506853][ T10] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 461.506922][ T10] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 461.506949][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 461.550904][ T9902] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 461.552129][ T9902] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 461.575055][ T10] usb 4-1: config 0 descriptor?? [ 461.585222][T10429] Dev loop2: unable to read RDB block 7 [ 461.585280][T10429] loop2: unable to read partition table [ 461.585534][T10429] loop2: partition table beyond EOD, truncated [ 461.585577][T10429] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 461.644591][ T10] pwc: Askey VC010 type 2 USB webcam detected. [ 462.107999][ T10] pwc: recv_control_msg error -32 req 02 val 2b00 [ 462.113712][ T10] pwc: recv_control_msg error -32 req 02 val 2700 [ 462.456825][ T9902] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 463.321358][ T9902] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 463.468822][ T10] pwc: recv_control_msg error -71 req 04 val 1000 [ 463.469464][ T10] pwc: recv_control_msg error -71 req 04 val 1300 [ 463.472806][ T10] pwc: recv_control_msg error -71 req 04 val 1400 [ 463.473332][ T10] pwc: recv_control_msg error -71 req 02 val 2000 [ 463.473815][ T10] pwc: recv_control_msg error -71 req 02 val 2100 [ 463.475563][ T10] pwc: recv_control_msg error -71 req 04 val 1500 [ 463.480694][ T10] pwc: recv_control_msg error -71 req 02 val 2500 [ 463.485828][ T10] pwc: recv_control_msg error -71 req 02 val 2400 [ 463.494701][ T10] pwc: recv_control_msg error -71 req 02 val 2600 [ 463.532076][ T10] pwc: recv_control_msg error -71 req 02 val 2900 [ 463.543109][ T10] pwc: recv_control_msg error -71 req 02 val 2800 [ 463.546192][ T10] pwc: recv_control_msg error -71 req 04 val 1100 [ 463.546984][ T10] pwc: recv_control_msg error -71 req 04 val 1200 [ 463.691177][ T9902] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 463.966424][ T10] pwc: Registered as video103. [ 464.147534][ T10] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input16 [ 464.294131][ T10] usb 4-1: USB disconnect, device number 34 [ 465.483198][T10468] netlink: 14 bytes leftover after parsing attributes in process `syz.5.1544'. [ 465.782533][ T9902] 8021q: adding VLAN 0 to HW filter on device bond0 [ 465.809848][ T197] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 466.000686][ T197] usb 5-1: Using ep0 maxpacket: 32 [ 466.013852][ T197] usb 5-1: config index 0 descriptor too short (expected 35577, got 27) [ 466.013887][ T197] usb 5-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 466.013925][ T197] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 466.013952][ T197] usb 5-1: config 1 has no interface number 0 [ 466.014005][ T197] usb 5-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 466.014038][ T197] usb 5-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 466.014089][ T197] usb 5-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 466.014118][ T197] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 466.134998][ T10] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 466.209753][ T5615] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 466.305331][ T9902] 8021q: adding VLAN 0 to HW filter on device team0 [ 466.419228][ T5615] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 466.419277][ T5615] usb 2-1: New USB device found, idVendor=046d, idProduct=c71f, bcdDevice= 0.00 [ 466.419300][ T5615] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 466.474417][ T5615] usb 2-1: config 0 descriptor?? [ 466.475572][T10480] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 466.578246][ T1465] bridge0: port 1(bridge_slave_0) entered blocking state [ 466.578582][ T1465] bridge0: port 1(bridge_slave_0) entered forwarding state [ 466.629365][ T197] snd_usb_pod 5-1:1.1: Line 6 Pocket POD found [ 466.645286][ T197] snd_usb_pod 5-1:1.1: Line 6 Pocket POD now attached [ 466.883520][ T5615] hid (null): unknown global tag 0xe [ 466.883562][ T5615] hid (null): global environment stack underflow [ 466.883595][ T5615] hid (null): report_id 2446331248 is invalid [ 466.883611][ T5615] hid (null): unknown global tag 0xe [ 466.989953][ T5615] logitech-djreceiver 0003:046D:C71F.000A: unknown main item tag 0x0 [ 466.989987][ T5615] logitech-djreceiver 0003:046D:C71F.000A: unknown main item tag 0x0 [ 466.990011][ T5615] logitech-djreceiver 0003:046D:C71F.000A: unknown main item tag 0x0 [ 466.990049][ T5615] logitech-djreceiver 0003:046D:C71F.000A: unknown main item tag 0x0 [ 466.990073][ T5615] logitech-djreceiver 0003:046D:C71F.000A: unknown main item tag 0x0 [ 466.990097][ T5615] logitech-djreceiver 0003:046D:C71F.000A: unknown main item tag 0x0 [ 466.990121][ T5615] logitech-djreceiver 0003:046D:C71F.000A: unknown main item tag 0x0 [ 466.990146][ T5615] logitech-djreceiver 0003:046D:C71F.000A: unknown main item tag 0x0 [ 466.990169][ T5615] logitech-djreceiver 0003:046D:C71F.000A: unknown main item tag 0x0 [ 466.990193][ T5615] logitech-djreceiver 0003:046D:C71F.000A: unknown main item tag 0x0 [ 466.990683][ T5615] logitech-djreceiver 0003:046D:C71F.000A: unknown global tag 0xe [ 466.990701][ T5615] logitech-djreceiver 0003:046D:C71F.000A: item 0 4 1 14 parsing failed [ 466.991274][ T5615] logitech-djreceiver 0003:046D:C71F.000A: logi_dj_probe: parse failed [ 466.991335][ T5615] logitech-djreceiver 0003:046D:C71F.000A: probe with driver logitech-djreceiver failed with error -22 [ 467.129200][ T5615] usb 2-1: USB disconnect, device number 32 [ 467.339241][ T197] usb 5-1: USB disconnect, device number 29 [ 467.356035][ T1465] bridge0: port 2(bridge_slave_1) entered blocking state [ 467.356352][ T1465] bridge0: port 2(bridge_slave_1) entered forwarding state [ 467.364392][ T197] snd_usb_pod 5-1:1.1: Line 6 Pocket POD now disconnected [ 467.452666][T10496] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1549'. [ 468.331112][T10504] dmxdev: DVB (dvb_dmxdev_filter_start): could not set feed [ 468.331144][T10504] dvb_demux: dvb_demux_feed_del: feed not in list (type=1 state=0 pid=ffff) [ 469.842069][T10531] FAULT_INJECTION: forcing a failure. [ 469.842069][T10531] name failslab, interval 1, probability 0, space 0, times 0 [ 469.842161][T10531] CPU: 1 UID: 0 PID: 10531 Comm: syz.5.1556 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 469.842189][T10531] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 469.842204][T10531] Call Trace: [ 469.842213][T10531] [ 469.842223][T10531] dump_stack_lvl+0xe8/0x150 [ 469.842366][T10531] should_fail_ex+0x467/0x600 [ 469.842443][T10531] should_failslab+0xa8/0x100 [ 469.842498][T10531] __kmalloc_noprof+0xfe/0x780 [ 469.842528][T10531] ? rcu_is_watching+0x15/0xb0 [ 469.842645][T10531] ? tomoyo_realpath_from_path+0xef/0x640 [ 469.842694][T10531] ? tomoyo_realpath_from_path+0xef/0x640 [ 469.842735][T10531] tomoyo_realpath_from_path+0xef/0x640 [ 469.842779][T10531] ? tomoyo_path_number_perm+0x219/0x5f0 [ 469.842807][T10531] tomoyo_path_number_perm+0x246/0x5f0 [ 469.842837][T10531] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 469.842863][T10531] ? __lock_acquire+0x683/0x2ce0 [ 469.842911][T10531] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 469.843023][T10531] ? hook_file_ioctl+0x1f3/0x600 [ 469.843065][T10531] ? lockdep_hardirqs_on+0x7a/0x110 [ 469.843141][T10531] ? __fget_files+0x2a/0x420 [ 469.843182][T10531] ? __fget_files+0x2a/0x420 [ 469.843205][T10531] ? __fget_files+0x3a8/0x420 [ 469.843228][T10531] ? __fget_files+0x2a/0x420 [ 469.843264][T10531] security_file_ioctl+0xc3/0x2a0 [ 469.843294][T10531] __se_sys_ioctl+0x47/0x170 [ 469.843332][T10531] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 469.843379][T10531] do_syscall_64+0x174/0x580 [ 469.843434][T10531] ? trace_irq_disable+0x3b/0x140 [ 469.843487][T10531] ? clear_bhb_loop+0x40/0x90 [ 469.843515][T10531] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 469.843539][T10531] RIP: 0033:0x7eff7fc5e019 [ 469.843561][T10531] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 469.843581][T10531] RSP: 002b:00007eff7de54028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 469.843605][T10531] RAX: ffffffffffffffda RBX: 00007eff7fee6090 RCX: 00007eff7fc5e019 [ 469.843622][T10531] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000009 [ 469.843636][T10531] RBP: 00007eff7de54090 R08: 0000000000000000 R09: 0000000000000000 [ 469.843650][T10531] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 469.843663][T10531] R13: 00007eff7fee6128 R14: 00007eff7fee6090 R15: 00007ffcbbe6bd48 [ 469.843700][T10531] [ 469.876878][T10531] ERROR: Out of memory at tomoyo_realpath_from_path. [ 470.680939][ T9902] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 472.200358][T10545] netlink: 14 bytes leftover after parsing attributes in process `syz.1.1559'. [ 472.211527][T10555] IPv6: Can't replace route, no match found [ 472.432347][ T9902] veth0_vlan: entered promiscuous mode [ 472.445529][T10560] type: 10 invalid [ 472.528138][ T36] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 472.649508][ T5613] Bluetooth: hci0: unexpected event for opcode 0x8c11 [ 472.734417][ T9902] veth1_vlan: entered promiscuous mode [ 472.831085][ T36] usb 6-1: config 0 has an invalid interface number: 117 but max is 0 [ 472.831115][ T36] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 472.831135][ T36] usb 6-1: config 0 has no interface number 0 [ 472.831183][ T36] usb 6-1: config 0 interface 117 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 472.831211][ T36] usb 6-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 472.831234][ T36] usb 6-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 472.834389][ T36] usb 6-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 472.834419][ T36] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 472.834441][ T36] usb 6-1: Product: syz [ 472.834465][ T36] usb 6-1: Manufacturer: syz [ 472.834481][ T36] usb 6-1: SerialNumber: syz [ 472.937463][ T36] usb 6-1: config 0 descriptor?? [ 473.516653][ T9902] veth0_macvtap: entered promiscuous mode [ 473.550697][ T36] input: syz syz as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.117/input/input17 [ 473.637781][ T9902] veth1_macvtap: entered promiscuous mode [ 473.780320][T10561] __kmem_cache_create_args(nfsd_file) failed with error -12 [ 473.780354][T10561] CPU: 1 UID: 0 PID: 10561 Comm: syz.3.1564 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 473.780397][T10561] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 473.780412][T10561] Call Trace: [ 473.780421][T10561] [ 473.780432][T10561] dump_stack_lvl+0xe8/0x150 [ 473.780475][T10561] __kmem_cache_create_args+0x3ee/0x450 [ 473.780525][T10561] nfsd_file_cache_init+0x197/0x530 [ 473.780580][T10561] ? __pfx_nfsd_file_cache_init+0x10/0x10 [ 473.780610][T10561] ? net_generic+0x1e/0x240 [ 473.780645][T10561] ? net_generic+0x1e/0x240 [ 473.780670][T10561] ? net_generic+0x1e/0x240 [ 473.780698][T10561] ? net_generic+0x1f4/0x240 [ 473.780727][T10561] nfsd_svc+0x330/0x7d0 [ 473.780762][T10561] write_threads+0x3d3/0x5a0 [ 473.780794][T10561] ? __might_fault+0xaf/0x130 [ 473.780821][T10561] ? __pfx_write_threads+0x10/0x10 [ 473.780875][T10561] ? _copy_from_user+0x94/0xb0 [ 473.780905][T10561] ? simple_transaction_get+0x130/0x170 [ 473.780935][T10561] nfsctl_transaction_write+0x112/0x160 [ 473.780971][T10561] ? __pfx_nfsctl_transaction_write+0x10/0x10 [ 473.781006][T10561] vfs_write+0x29f/0xbb0 [ 473.781046][T10561] ? __pfx_vfs_write+0x10/0x10 [ 473.781079][T10561] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 473.781112][T10561] ? lockdep_hardirqs_on+0x7a/0x110 [ 473.781143][T10561] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 473.781174][T10561] ? mutex_lock_nested+0x152/0x1d0 [ 473.781197][T10561] ? fdget_pos+0x252/0x320 [ 473.781233][T10561] ksys_write+0x156/0x270 [ 473.781266][T10561] ? __pfx_ksys_write+0x10/0x10 [ 473.781307][T10561] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 473.781334][T10561] do_syscall_64+0x174/0x580 [ 473.781365][T10561] ? trace_irq_disable+0x3b/0x140 [ 473.781435][T10561] ? clear_bhb_loop+0x40/0x90 [ 473.781465][T10561] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 473.781489][T10561] RIP: 0033:0x7fcb0575e019 [ 473.781512][T10561] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 473.781533][T10561] RSP: 002b:00007fcb03995028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 473.781559][T10561] RAX: ffffffffffffffda RBX: 00007fcb059e6090 RCX: 00007fcb0575e019 [ 473.781577][T10561] RDX: 0000000000000002 RSI: 0000200000000600 RDI: 0000000000000003 [ 473.781592][T10561] RBP: 00007fcb057f500c R08: 0000000000000000 R09: 0000000000000000 [ 473.781606][T10561] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 473.781628][T10561] R13: 00007fcb059e6128 R14: 00007fcb059e6090 R15: 00007fff4eb4e388 [ 473.781667][T10561] [ 473.781776][T10561] nfsd: unable to create nfsd_file_slab [ 473.799560][ T9902] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 473.939270][ T197] usb 6-1: USB disconnect, device number 29 [ 474.029218][ T9902] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 475.641810][T10561] svc: failed to register nfsdv3 RPC service (errno 111). [ 475.646230][T10561] svc: failed to register nfsaclv3 RPC service (errno 512). [ 475.646261][T10561] failed to unregister tcp with rpcbind [ 475.745390][T10561] svc: failed to register nfsdv3 RPC service (errno 97). [ 475.745419][T10561] svc: failed to register nfsaclv3 RPC service (errno 97). [ 475.745435][T10561] failed to unregister tcp with rpcbind [ 476.621295][ T1390] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 476.621349][ T1390] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 476.621391][ T1390] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 476.743419][ T1390] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 476.838055][ T1390] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 476.838077][ T1390] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 477.224321][ T1059] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 477.224346][ T1059] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 477.328094][ T5945] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 477.512402][T10604] gtp0: entered promiscuous mode [ 477.512432][T10604] gtp0: entered allmulticast mode [ 477.696717][ T5945] usb 2-1: Using ep0 maxpacket: 32 [ 478.899688][ T5945] usb 2-1: unable to get BOS descriptor or descriptor too short [ 478.900811][ T5945] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 478.900846][ T5945] usb 2-1: can't read configurations, error -71 [ 479.006958][T10620] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1580'. [ 479.033789][T10620] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1580'. [ 479.699671][ T5619] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 479.791165][ T5619] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 479.815215][ T5619] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 479.834280][ T5619] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 479.876206][ T5619] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 480.073959][T10632] syz.1.1583 uses obsolete (PF_INET,SOCK_PACKET) [ 481.968804][ T5613] Bluetooth: hci1: command tx timeout [ 484.047186][ T5613] Bluetooth: hci1: command tx timeout [ 484.083209][ T6017] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 484.246706][ T6017] usb 6-1: Using ep0 maxpacket: 16 [ 484.249227][ T6017] usb 6-1: config 64 has an invalid interface number: 238 but max is 0 [ 484.249256][ T6017] usb 6-1: config 64 has an invalid descriptor of length 0, skipping remainder of the config [ 484.249279][ T6017] usb 6-1: config 64 has no interface number 0 [ 484.249312][ T6017] usb 6-1: config 64 interface 238 has no altsetting 0 [ 484.253223][ T6017] usb 6-1: New USB device found, idVendor=046d, idProduct=087c, bcdDevice=b0.7a [ 484.253253][ T6017] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 484.253276][ T6017] usb 6-1: Product: syz [ 484.253291][ T6017] usb 6-1: Manufacturer: syz [ 484.253308][ T6017] usb 6-1: SerialNumber: syz [ 484.620508][T10665] netlink: 14 bytes leftover after parsing attributes in process `syz.1.1591'. [ 484.712318][ T6017] uvcvideo 6-1:64.238: Found Unit with invalid ID 0 [ 484.712524][ T6017] uvcvideo 6-1:64.238: Found UVC 0.00 device syz (046d:087c) [ 484.712601][ T6017] uvcvideo 6-1:64.238: No valid video chain found. [ 484.744123][ T6017] usb 6-1: USB disconnect, device number 30 [ 484.864650][ T3367] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 486.342195][ T5613] Bluetooth: hci1: command tx timeout [ 486.446108][ T36] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 486.609064][ T36] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 486.609100][ T36] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 486.641135][ T36] usb 4-1: config 0 descriptor?? [ 486.658952][ T36] cp210x 4-1:0.0: cp210x converter detected [ 486.749523][ T3367] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 486.849825][ T6017] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 487.020324][ T6017] usb 2-1: Using ep0 maxpacket: 32 [ 487.052621][ T6017] usb 2-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 487.052879][ T6017] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 487.052905][ T6017] usb 2-1: Product: syz [ 487.052921][ T6017] usb 2-1: Manufacturer: syz [ 487.052938][ T6017] usb 2-1: SerialNumber: syz [ 487.128245][ T6017] usb 2-1: config 0 descriptor?? [ 487.161065][ T6017] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 487.546680][ T5945] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 487.582179][ T3367] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 487.696874][ T5945] usb 6-1: Using ep0 maxpacket: 16 [ 487.699392][ T5945] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 487.699420][ T5945] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 487.699461][ T5945] usb 6-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 487.699486][ T5945] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 487.884663][ T5945] usb 6-1: config 0 descriptor?? [ 488.790578][ T6017] gspca_ov534_9: reg_w failed -110 [ 488.792792][ T5613] Bluetooth: hci1: command tx timeout [ 488.949217][ T36] cp210x 4-1:0.0: failed to get vendor val 0x370c size 73: -71 [ 488.949250][ T36] cp210x 4-1:0.0: GPIO initialisation failed: -71 [ 489.287597][ T36] usb 4-1: cp210x converter now attached to ttyUSB0 [ 489.332475][ T36] usb 4-1: USB disconnect, device number 36 [ 489.399884][ T6017] gspca_ov534_9: Unknown sensor 0000 [ 489.400063][ T6017] ov534_9 2-1:0.0: probe with driver ov534_9 failed with error -22 [ 489.454859][ T36] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 489.469292][ T36] cp210x 4-1:0.0: device disconnected [ 489.968844][ T36] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 490.121590][ T36] usb 4-1: Using ep0 maxpacket: 16 [ 490.136000][ T36] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 490.136030][ T36] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 490.163376][ T36] usb 4-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 490.163411][ T36] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 490.163434][ T36] usb 4-1: Product: syz [ 490.163452][ T36] usb 4-1: Manufacturer: syz [ 490.163468][ T36] usb 4-1: SerialNumber: syz [ 490.166181][ T3367] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 490.249762][ T36] usb 4-1: config 0 descriptor?? [ 490.480859][T10711] netlink: 'syz.5.1600': attribute type 5 has an invalid length. [ 491.625996][ T5945] usb 6-1: USB disconnect, device number 31 [ 491.747336][ T197] usb 2-1: USB disconnect, device number 35 [ 492.003367][T10746] FAULT_INJECTION: forcing a failure. [ 492.003367][T10746] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 492.003407][T10746] CPU: 1 UID: 0 PID: 10746 Comm: syz.5.1611 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 492.003434][T10746] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 492.003449][T10746] Call Trace: [ 492.003458][T10746] [ 492.003468][T10746] dump_stack_lvl+0xe8/0x150 [ 492.003510][T10746] should_fail_ex+0x467/0x600 [ 492.003553][T10746] _copy_from_user+0x2d/0xb0 [ 492.003583][T10746] io_register_rsrc_update+0xc4/0x1c0 [ 492.003647][T10746] ? __pfx_io_register_rsrc_update+0x10/0x10 [ 492.003678][T10746] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 492.003711][T10746] ? mutex_lock_nested+0x152/0x1d0 [ 492.003735][T10746] ? __se_sys_io_uring_register+0x221/0x1a20 [ 492.003768][T10746] __se_sys_io_uring_register+0xf4c/0x1a20 [ 492.003803][T10746] ? __pfx___se_sys_io_uring_register+0x10/0x10 [ 492.003832][T10746] ? ksys_write+0x248/0x270 [ 492.003865][T10746] ? __pfx_ksys_write+0x10/0x10 [ 492.003913][T10746] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 492.003939][T10746] do_syscall_64+0x174/0x580 [ 492.003969][T10746] ? trace_irq_disable+0x3b/0x140 [ 492.003994][T10746] ? clear_bhb_loop+0x40/0x90 [ 492.004023][T10746] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 492.004046][T10746] RIP: 0033:0x7eff7fc5e019 [ 492.004068][T10746] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 492.004088][T10746] RSP: 002b:00007eff7deb6028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ab [ 492.004113][T10746] RAX: ffffffffffffffda RBX: 00007eff7fee5fa0 RCX: 00007eff7fc5e019 [ 492.004131][T10746] RDX: 00002000000024c0 RSI: 0000000000000010 RDI: 0000000000000003 [ 492.004146][T10746] RBP: 00007eff7deb6090 R08: 0000000000000000 R09: 0000000000000000 [ 492.004160][T10746] R10: 0000000000000020 R11: 0000000000000246 R12: 0000000000000001 [ 492.004174][T10746] R13: 00007eff7fee6038 R14: 00007eff7fee5fa0 R15: 00007ffcbbe6bd48 [ 492.004210][T10746] [ 492.269043][ T3367] bridge_slave_1: left allmulticast mode [ 492.269082][ T3367] bridge_slave_1: left promiscuous mode [ 492.269344][ T3367] bridge0: port 2(bridge_slave_1) entered disabled state [ 492.336664][ T5740] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 492.458350][ T3367] bridge_slave_0: left allmulticast mode [ 492.458389][ T3367] bridge_slave_0: left promiscuous mode [ 492.459827][ T3367] bridge0: port 1(bridge_slave_0) entered disabled state [ 492.466893][ T5740] usb 6-1: device descriptor read/64, error -71 [ 492.611094][ T5615] usb 4-1: USB disconnect, device number 37 [ 492.697233][ T6017] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 492.943463][ T5740] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 492.999133][ T36] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 492.999291][ T6017] usb 2-1: device descriptor read/64, error -71 [ 493.137232][T10757] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1615'. [ 494.018818][ T5740] usb 6-1: device descriptor read/64, error -71 [ 495.156988][ T5740] usb usb6-port1: attempt power cycle [ 495.183900][ T36] usb 5-1: Using ep0 maxpacket: 16 [ 495.227488][ T6017] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 496.388617][ T36] usb 5-1: device descriptor read/all, error -71 [ 496.726887][ T5740] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 496.747474][ T5740] usb 6-1: Using ep0 maxpacket: 16 [ 496.749414][ T5740] usb 6-1: config 0 has an invalid interface number: 34 but max is 0 [ 496.749442][ T5740] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 496.749469][ T5740] usb 6-1: config 0 has no interface number 0 [ 496.749552][ T5740] usb 6-1: config 0 interface 34 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 496.749570][ T5740] usb 6-1: config 0 interface 34 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 496.752268][ T5740] usb 6-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 496.752294][ T5740] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 496.752351][ T5740] usb 6-1: Product: syz [ 496.752364][ T5740] usb 6-1: Manufacturer: syz [ 496.752375][ T5740] usb 6-1: SerialNumber: syz [ 496.845861][ T5740] usb 6-1: config 0 descriptor?? [ 496.881604][ T5740] asix 6-1:0.34: probe with driver asix failed with error -22 [ 497.107447][ T3367] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 497.169163][ T3367] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 497.221824][ T3367] bond0 (unregistering): Released all slaves [ 497.676295][T10772] gretap0: entered promiscuous mode [ 497.749207][T10772] vlan2: entered promiscuous mode [ 498.050572][T10784] netlink: 14 bytes leftover after parsing attributes in process `syz.3.1619'. [ 500.103730][ T9922] usb 6-1: USB disconnect, device number 34 [ 500.549156][ T6017] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 500.575762][T10809] netlink: 68 bytes leftover after parsing attributes in process `syz.5.1628'. [ 501.616673][ T6017] usb 2-1: Using ep0 maxpacket: 8 [ 501.621532][ T6017] usb 2-1: New USB device found, idVendor=22b8, idProduct=6425, bcdDevice=d3.6c [ 501.621569][ T6017] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 501.621585][ T6017] usb 2-1: Product: syz [ 501.621596][ T6017] usb 2-1: Manufacturer: syz [ 501.621607][ T6017] usb 2-1: SerialNumber: syz [ 501.626092][ T6017] usb 2-1: config 0 descriptor?? [ 501.664092][T10812] FAULT_INJECTION: forcing a failure. [ 501.664092][T10812] name failslab, interval 1, probability 0, space 0, times 0 [ 501.664407][T10812] CPU: 1 UID: 0 PID: 10812 Comm: syz.4.1629 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 501.664436][T10812] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 501.664451][T10812] Call Trace: [ 501.664461][T10812] [ 501.664470][T10812] dump_stack_lvl+0xe8/0x150 [ 501.664517][T10812] should_fail_ex+0x467/0x600 [ 501.664560][T10812] should_failslab+0xa8/0x100 [ 501.664592][T10812] __kmalloc_noprof+0xfe/0x780 [ 501.664615][T10812] ? rcu_is_watching+0x15/0xb0 [ 501.664646][T10812] ? tomoyo_realpath_from_path+0xef/0x640 [ 501.664677][T10812] ? tomoyo_realpath_from_path+0xef/0x640 [ 501.664715][T10812] tomoyo_realpath_from_path+0xef/0x640 [ 501.664758][T10812] ? tomoyo_path_number_perm+0x219/0x5f0 [ 501.664784][T10812] tomoyo_path_number_perm+0x246/0x5f0 [ 501.664814][T10812] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 501.664839][T10812] ? __lock_acquire+0x683/0x2ce0 [ 501.664880][T10812] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 501.664914][T10812] ? hook_file_ioctl+0x1f3/0x600 [ 501.664925][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.664948][T10812] ? lockdep_hardirqs_on+0x7a/0x110 [ 501.665005][T10812] ? __fget_files+0x2a/0x420 [ 501.665035][T10812] ? __fget_files+0x2a/0x420 [ 501.665058][T10812] ? __fget_files+0x3a8/0x420 [ 501.665082][T10812] ? __fget_files+0x2a/0x420 [ 501.665111][T10812] security_file_ioctl+0xc3/0x2a0 [ 501.665142][T10812] __se_sys_ioctl+0x47/0x170 [ 501.665174][T10812] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 501.665201][T10812] do_syscall_64+0x174/0x580 [ 501.665234][T10812] ? clear_bhb_loop+0x40/0x90 [ 501.665263][T10812] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 501.665292][T10812] RIP: 0033:0x7ff59636e019 [ 501.665315][T10812] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 501.665334][T10812] RSP: 002b:00007ff5945a5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 501.665355][T10812] RAX: ffffffffffffffda RBX: 00007ff5965f6090 RCX: 00007ff59636e019 [ 501.665370][T10812] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000007 [ 501.665473][T10812] RBP: 00007ff5945a5090 R08: 0000000000000000 R09: 0000000000000000 [ 501.665490][T10812] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 501.665504][T10812] R13: 00007ff5965f6128 R14: 00007ff5965f6090 R15: 00007ffe393e8308 [ 501.665540][T10812] [ 501.667369][T10812] ERROR: Out of memory at tomoyo_realpath_from_path. [ 501.798290][ T6017] cdc_ether 2-1:0.0: bad CDC descriptors [ 501.833825][ T6017] usb 2-1: unsupported MDLM descriptors [ 502.122182][T10626] bridge0: port 1(bridge_slave_0) entered blocking state [ 502.123407][T10626] bridge0: port 1(bridge_slave_0) entered disabled state [ 502.123555][T10626] bridge_slave_0: entered allmulticast mode [ 502.156206][T10626] bridge_slave_0: entered promiscuous mode [ 502.231731][T10626] bridge0: port 2(bridge_slave_1) entered blocking state [ 502.231855][T10626] bridge0: port 2(bridge_slave_1) entered disabled state [ 502.232084][T10626] bridge_slave_1: entered allmulticast mode [ 502.263277][T10626] bridge_slave_1: entered promiscuous mode [ 502.491712][T10626] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 502.579186][T10626] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 502.682865][ T5945] usb 2-1: USB disconnect, device number 38 [ 504.236703][ T5945] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 504.386669][ T5945] usb 2-1: Using ep0 maxpacket: 16 [ 504.389110][ T5945] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 504.389139][ T5945] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 504.389179][ T5945] usb 2-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 504.389206][ T5945] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 504.436398][ T5945] usb 2-1: config 0 descriptor?? [ 504.595271][T10846] loop2: detected capacity change from 0 to 7 [ 504.601429][T10846] Dev loop2: unable to read RDB block 7 [ 504.601574][T10846] loop2: unable to read partition table [ 504.602108][T10846] loop2: partition table beyond EOD, truncated [ 504.602162][T10846] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 504.659558][T10626] team0: Port device team_slave_0 added [ 504.697563][T10626] team0: Port device team_slave_1 added [ 504.737833][T10855] FAULT_INJECTION: forcing a failure. [ 504.737833][T10855] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 504.737873][T10855] CPU: 1 UID: 0 PID: 10855 Comm: syz.3.1641 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 504.737900][T10855] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 504.737913][T10855] Call Trace: [ 504.737922][T10855] [ 504.737932][T10855] dump_stack_lvl+0xe8/0x150 [ 504.737973][T10855] should_fail_ex+0x467/0x600 [ 504.738016][T10855] _copy_from_user+0x2d/0xb0 [ 504.738046][T10855] __se_sys_rt_sigtimedwait+0x10e/0x300 [ 504.738123][T10855] ? __pfx___se_sys_rt_sigtimedwait+0x10/0x10 [ 504.738156][T10855] ? fput+0xa0/0xd0 [ 504.738181][T10855] ? ksys_write+0x248/0x270 [ 504.738212][T10855] ? __pfx_ksys_write+0x10/0x10 [ 504.738251][T10855] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 504.738277][T10855] do_syscall_64+0x174/0x580 [ 504.738309][T10855] ? trace_irq_disable+0x3b/0x140 [ 504.738334][T10855] ? clear_bhb_loop+0x40/0x90 [ 504.738362][T10855] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 504.738386][T10855] RIP: 0033:0x7fcb0575e019 [ 504.738415][T10855] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 504.738435][T10855] RSP: 002b:00007fcb039b6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000080 [ 504.738459][T10855] RAX: ffffffffffffffda RBX: 00007fcb059e5fa0 RCX: 00007fcb0575e019 [ 504.738477][T10855] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000200000000000 [ 504.738493][T10855] RBP: 00007fcb039b6090 R08: 0000000000000000 R09: 0000000000000000 [ 504.738508][T10855] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000001 [ 504.738522][T10855] R13: 00007fcb059e6038 R14: 00007fcb059e5fa0 R15: 00007fff4eb4e388 [ 504.738558][T10855] [ 505.217536][ T3367] hsr_slave_0: left promiscuous mode [ 505.262968][ T3367] hsr_slave_1: left promiscuous mode [ 505.264283][ T3367] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 505.264421][ T3367] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 505.471361][ T3367] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 505.471392][ T3367] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 505.754759][ T3367] veth1_macvtap: left promiscuous mode [ 505.754874][ T3367] veth0_macvtap: left promiscuous mode [ 505.755140][ T3367] veth1_vlan: left promiscuous mode [ 505.755335][ T3367] veth0_vlan: left promiscuous mode [ 506.699283][ T3367] team0 (unregistering): Port device team_slave_1 removed [ 506.777887][ T3367] team0 (unregistering): Port device team_slave_0 removed [ 507.086221][ T5264] 8021q: adding VLAN 0 to HW filter on device eth5 [ 507.092049][T10869] netlink: 'syz.1.1635': attribute type 5 has an invalid length. [ 507.110709][T10626] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 507.110723][T10626] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 507.110745][T10626] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 507.133346][T10626] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 507.133399][T10626] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 507.133483][T10626] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 507.443874][ T6017] usb 2-1: USB disconnect, device number 39 [ 507.537662][T10893] CUSE: info not properly terminated [ 507.756642][ T5740] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 507.916752][ T5740] usb 6-1: Using ep0 maxpacket: 16 [ 507.922712][ T5740] usb 6-1: config 64 has an invalid interface number: 238 but max is 0 [ 507.922743][ T5740] usb 6-1: config 64 has an invalid descriptor of length 0, skipping remainder of the config [ 507.922766][ T5740] usb 6-1: config 64 has no interface number 0 [ 507.922800][ T5740] usb 6-1: config 64 interface 238 has no altsetting 0 [ 507.969870][ T5740] usb 6-1: New USB device found, idVendor=046d, idProduct=087c, bcdDevice=b0.7a [ 507.969909][ T5740] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 507.969932][ T5740] usb 6-1: Product: syz [ 507.969949][ T5740] usb 6-1: Manufacturer: syz [ 507.969965][ T5740] usb 6-1: SerialNumber: syz [ 508.016857][T10626] hsr_slave_0: entered promiscuous mode [ 508.022571][T10626] hsr_slave_1: entered promiscuous mode [ 508.024137][T10626] debugfs: 'hsr0' already exists in 'hsr' [ 508.024221][T10626] Cannot create hsr debugfs directory [ 508.056762][ T36] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 508.216674][ T36] usb 5-1: Using ep0 maxpacket: 32 [ 508.275870][ T36] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 508.275967][ T36] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 508.276012][ T36] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 508.276038][ T36] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 508.366520][ T36] usb 5-1: config 0 descriptor?? [ 508.439986][ T5740] uvcvideo 6-1:64.238: Found Unit with invalid ID 0 [ 508.440050][ T5740] uvcvideo 6-1:64.238: Found UVC 0.00 device syz (046d:087c) [ 508.440081][ T5740] uvcvideo 6-1:64.238: No valid video chain found. [ 508.476995][ T36] hub 5-1:0.0: USB hub found [ 508.481343][ T5740] usb 6-1: USB disconnect, device number 35 [ 508.597896][ T36] hub 5-1:0.0: 1 port detected [ 508.795046][T10911] FAULT_INJECTION: forcing a failure. [ 508.795046][T10911] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 508.795084][T10911] CPU: 1 UID: 0 PID: 10911 Comm: syz.3.1653 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 508.795111][T10911] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 508.795128][T10911] Call Trace: [ 508.795137][T10911] [ 508.795147][T10911] dump_stack_lvl+0xe8/0x150 [ 508.795188][T10911] should_fail_ex+0x467/0x600 [ 508.795230][T10911] _copy_to_user+0x31/0xb0 [ 508.795261][T10911] simple_read_from_buffer+0xe1/0x170 [ 508.795292][T10911] proc_fail_nth_read+0x1be/0x230 [ 508.795365][T10911] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 508.795395][T10911] ? rw_verify_area+0x250/0x4d0 [ 508.795423][T10911] ? __lock_acquire+0x683/0x2ce0 [ 508.795449][T10911] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 508.795475][T10911] vfs_read+0x219/0xa90 [ 508.795512][T10911] ? __pfx_vfs_read+0x10/0x10 [ 508.795545][T10911] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 508.795578][T10911] ? lockdep_hardirqs_on+0x7a/0x110 [ 508.795608][T10911] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 508.795638][T10911] ? mutex_lock_nested+0x152/0x1d0 [ 508.795659][T10911] ? fdget_pos+0x252/0x320 [ 508.795692][T10911] ksys_read+0x156/0x270 [ 508.795723][T10911] ? __pfx_ksys_read+0x10/0x10 [ 508.795761][T10911] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 508.795787][T10911] do_syscall_64+0x174/0x580 [ 508.795817][T10911] ? trace_irq_disable+0x3b/0x140 [ 508.795841][T10911] ? clear_bhb_loop+0x40/0x90 [ 508.795868][T10911] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 508.795891][T10911] RIP: 0033:0x7fcb0571e84e [ 508.795913][T10911] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 508.795933][T10911] RSP: 002b:00007fcb039b5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 508.795958][T10911] RAX: ffffffffffffffda RBX: 00007fcb039b66c0 RCX: 00007fcb0571e84e [ 508.795975][T10911] RDX: 000000000000000f RSI: 00007fcb039b60a0 RDI: 0000000000000004 [ 508.795990][T10911] RBP: 00007fcb039b6090 R08: 0000000000000000 R09: 0000000000000000 [ 508.796015][T10911] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 508.796030][T10911] R13: 00007fcb059e6038 R14: 00007fcb059e5fa0 R15: 00007fff4eb4e388 [ 508.796066][T10911] [ 508.849297][ T36] hub 5-1:0.0: hub_hub_status failed (err = -71) [ 508.849327][ T36] hub 5-1:0.0: config failed, can't get hub status (err -71) [ 509.006629][ T36] usbhid 5-1:0.0: can't add hid device: -71 [ 509.006742][ T36] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 509.192459][ T36] usb 5-1: USB disconnect, device number 32 [ 509.513763][T10919] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1655'. [ 509.978173][ T5740] usb 2-1: new full-speed USB device number 40 using dummy_hcd [ 511.447375][ T5264] 8021q: adding VLAN 0 to HW filter on device eth6 [ 511.536865][T10949] netlink: 48 bytes leftover after parsing attributes in process `syz.5.1663'. [ 511.544533][T10949] ip6gre1: entered allmulticast mode [ 511.700743][ T5719] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 511.846701][ T5719] usb 4-1: Using ep0 maxpacket: 16 [ 511.849128][ T5719] usb 4-1: config 0 has an invalid interface number: 34 but max is 0 [ 511.849160][ T5719] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 511.849183][ T5719] usb 4-1: config 0 has no interface number 0 [ 511.849230][ T5719] usb 4-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 511.849258][ T5719] usb 4-1: config 0 interface 34 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 511.856007][ T5719] usb 4-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 511.856037][ T5719] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 511.856058][ T5719] usb 4-1: Product: syz [ 511.856072][ T5719] usb 4-1: Manufacturer: syz [ 511.856088][ T5719] usb 4-1: SerialNumber: syz [ 511.953507][ T5719] usb 4-1: config 0 descriptor?? [ 511.955682][T10947] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 512.004854][ T5719] asix 4-1:0.34: probe with driver asix failed with error -22 [ 513.693974][T11001] netlink: 14 bytes leftover after parsing attributes in process `syz.4.1678'. [ 514.694325][ T5719] usb 4-1: USB disconnect, device number 38 [ 515.480754][T11034] FAULT_INJECTION: forcing a failure. [ 515.480754][T11034] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 515.480792][T11034] CPU: 1 UID: 0 PID: 11034 Comm: syz.1.1685 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 515.480820][T11034] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 515.480834][T11034] Call Trace: [ 515.480843][T11034] [ 515.480853][T11034] dump_stack_lvl+0xe8/0x150 [ 515.480895][T11034] should_fail_ex+0x467/0x600 [ 515.480936][T11034] _copy_from_user+0x2d/0xb0 [ 515.480966][T11034] ___sys_sendmsg+0x1c6/0x360 [ 515.481110][T11034] ? __lock_acquire+0x683/0x2ce0 [ 515.481141][T11034] ? __pfx____sys_sendmsg+0x10/0x10 [ 515.481207][T11034] ? __fget_files+0x2a/0x420 [ 515.481232][T11034] ? __fget_files+0x3a8/0x420 [ 515.481267][T11034] __x64_sys_sendmsg+0x1b7/0x290 [ 515.481300][T11034] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 515.481350][T11034] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 515.481377][T11034] do_syscall_64+0x174/0x580 [ 515.481414][T11034] ? trace_irq_disable+0x3b/0x140 [ 515.481438][T11034] ? clear_bhb_loop+0x40/0x90 [ 515.481467][T11034] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 515.481491][T11034] RIP: 0033:0x7fa68179e019 [ 515.481512][T11034] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 515.481532][T11034] RSP: 002b:00007fa67f9f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 515.481556][T11034] RAX: ffffffffffffffda RBX: 00007fa681a25fa0 RCX: 00007fa68179e019 [ 515.481573][T11034] RDX: 0000000000000840 RSI: 0000200000000640 RDI: 0000000000000004 [ 515.481587][T11034] RBP: 00007fa67f9f6090 R08: 0000000000000000 R09: 0000000000000000 [ 515.481601][T11034] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 515.481615][T11034] R13: 00007fa681a26038 R14: 00007fa681a25fa0 R15: 00007ffdd9f77cf8 [ 515.481656][T11034] [ 518.586769][ T6017] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 519.590917][T11064] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 519.661750][T10626] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 519.815400][T10626] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 519.823482][T10626] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 519.990560][T10626] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 520.009442][ T5740] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 520.123194][T11080] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1695'. [ 520.146446][T11071] dvmrp8: entered allmulticast mode [ 520.148288][T10626] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 520.156728][ T9922] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 520.166841][ T5740] usb 5-1: Using ep0 maxpacket: 16 [ 520.184184][ T5740] usb 5-1: config 4 has an invalid interface number: 9 but max is 0 [ 520.184276][ T5740] usb 5-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 520.184331][ T5740] usb 5-1: config 4 has no interface number 0 [ 520.184486][ T5740] usb 5-1: config 4 interface 9 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 520.184559][ T5740] usb 5-1: config 4 interface 9 has no altsetting 0 [ 520.292677][ T5740] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=76.fe [ 520.292712][ T5740] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 520.292735][ T5740] usb 5-1: Product: syz [ 520.292752][ T5740] usb 5-1: Manufacturer: syz [ 520.292769][ T5740] usb 5-1: SerialNumber: syz [ 520.329559][ T9922] usb 2-1: Using ep0 maxpacket: 32 [ 520.333461][ T9922] usb 2-1: unable to get BOS descriptor or descriptor too short [ 520.334961][ T9922] usb 2-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 520.371093][ T9922] usb 2-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 520.371128][ T9922] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 520.371153][ T9922] usb 2-1: Product: syz [ 520.371170][ T9922] usb 2-1: Manufacturer: syz [ 520.371187][ T9922] usb 2-1: SerialNumber: syz [ 520.425548][T10626] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 520.455121][T10626] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 520.692535][T10626] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 520.705559][ C0] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 520.844527][ T5740] usb 5-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 520.884078][ T5740] usb 5-1: USB disconnect, device number 33 [ 520.900682][ T3367] usb 5-1: Failed to submit usb control message: -19 [ 520.900722][ T3367] usb 5-1: unable to send the bmi data to the device: -19 [ 520.900743][ T3367] usb 5-1: unable to get target info from device [ 520.900780][ T3367] usb 5-1: could not get target info (-19) [ 520.900883][ T3367] usb 5-1: could not probe fw (-19) [ 521.050771][ T9922] usb 2-1: Cannot retrieve CPort count: -110 [ 521.050826][ T9922] usb 2-1: Cannot retrieve CPort count: -110 [ 521.050865][ T9922] es2_ap_driver 2-1:7.0: probe with driver es2_ap_driver failed with error -110 [ 521.175209][T11093] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1697'. [ 521.175254][T11093] block nbd0: Unsupported socket: should be TCP or UNIX. [ 521.205043][ T6017] usb 2-1: USB disconnect, device number 41 [ 521.761282][T11125] FAULT_INJECTION: forcing a failure. [ 521.761282][T11125] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 521.761316][T11125] CPU: 0 UID: 0 PID: 11125 Comm: syz.5.1701 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 521.761336][T11125] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 521.761347][T11125] Call Trace: [ 521.761353][T11125] [ 521.761361][T11125] dump_stack_lvl+0xe8/0x150 [ 521.761396][T11125] should_fail_ex+0x467/0x600 [ 521.761431][T11125] _copy_from_user+0x2d/0xb0 [ 521.761454][T11125] ___sys_sendmsg+0x1c6/0x360 [ 521.761479][T11125] ? __lock_acquire+0x683/0x2ce0 [ 521.761503][T11125] ? __pfx____sys_sendmsg+0x10/0x10 [ 521.761559][T11125] ? __fget_files+0x2a/0x420 [ 521.761578][T11125] ? __fget_files+0x3a8/0x420 [ 521.761606][T11125] __x64_sys_sendmsg+0x1b7/0x290 [ 521.761633][T11125] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 521.761696][T11125] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 521.761717][T11125] do_syscall_64+0x174/0x580 [ 521.761744][T11125] ? clear_bhb_loop+0x40/0x90 [ 521.761766][T11125] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 521.761783][T11125] RIP: 0033:0x7eff7fc5e019 [ 521.761801][T11125] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 521.761817][T11125] RSP: 002b:00007eff7de95028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 521.761836][T11125] RAX: ffffffffffffffda RBX: 00007eff7fee6090 RCX: 00007eff7fc5e019 [ 521.761849][T11125] RDX: 0000000000000008 RSI: 0000200000000100 RDI: 0000000000000005 [ 521.761860][T11125] RBP: 00007eff7de95090 R08: 0000000000000000 R09: 0000000000000000 [ 521.761871][T11125] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 521.761881][T11125] R13: 00007eff7fee6128 R14: 00007eff7fee6090 R15: 00007ffcbbe6bd48 [ 521.761915][T11125] [ 522.266274][T10626] 8021q: adding VLAN 0 to HW filter on device bond0 [ 522.445487][T11128] ptrace attach of "ci-upstream-kasan-gce-smack-root/syz-executor exec"[11131] was attempted by "ci-upstream-kasan-gce-smack-root/syz-executor exec"[11128] [ 522.513564][T10626] 8021q: adding VLAN 0 to HW filter on device team0 [ 522.606651][ T5740] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 522.611804][ T1390] bridge0: port 1(bridge_slave_0) entered blocking state [ 522.612076][ T1390] bridge0: port 1(bridge_slave_0) entered forwarding state [ 522.819513][ T1390] bridge0: port 2(bridge_slave_1) entered blocking state [ 522.819649][ T1390] bridge0: port 2(bridge_slave_1) entered forwarding state [ 522.828689][ T5740] usb 6-1: Using ep0 maxpacket: 16 [ 522.847133][ T5740] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 522.847192][ T5740] usb 6-1: config 0 interface 0 altsetting 16 has 0 endpoint descriptors, different from the interface descriptor's value: 28 [ 522.847224][ T5740] usb 6-1: config 0 interface 0 has no altsetting 0 [ 522.847261][ T5740] usb 6-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 522.847287][ T5740] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 522.966947][ T5740] usb 6-1: config 0 descriptor?? [ 523.019526][ T5740] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 524.208279][ T5719] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 524.379148][ T5719] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 524.379208][ T5719] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 524.379298][ T5719] usb 2-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 524.379325][ T5719] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 524.436431][ T5719] usb 2-1: config 0 descriptor?? [ 524.455248][ T5719] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 524.669880][T11148] FAULT_INJECTION: forcing a failure. [ 524.669880][T11148] name failslab, interval 1, probability 0, space 0, times 0 [ 524.669918][T11148] CPU: 1 UID: 0 PID: 11148 Comm: syz.1.1706 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 524.669945][T11148] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 524.669960][T11148] Call Trace: [ 524.669969][T11148] [ 524.669980][T11148] dump_stack_lvl+0xe8/0x150 [ 524.670021][T11148] should_fail_ex+0x467/0x600 [ 524.670063][T11148] should_failslab+0xa8/0x100 [ 524.670105][T11148] kmem_cache_alloc_node_noprof+0xae/0x670 [ 524.670133][T11148] ? __alloc_skb+0x1d7/0x7a0 [ 524.670279][T11148] ? __alloc_skb+0x1d7/0x7a0 [ 524.670313][T11148] __alloc_skb+0x1d7/0x7a0 [ 524.670344][T11148] netlink_sendmsg+0x5d4/0xb40 [ 524.670412][T11148] ? _parse_integer_limit+0x192/0x1e0 [ 524.670455][T11148] ? __pfx_netlink_sendmsg+0x10/0x10 [ 524.670487][T11148] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 524.670526][T11148] ? get_pid_task+0x20/0x1f0 [ 524.670562][T11148] ? __pfx_netlink_sendmsg+0x10/0x10 [ 524.670592][T11148] sock_sendmsg_nosec+0x13a/0x180 [ 524.670637][T11148] sock_write_iter+0x2e4/0x3f0 [ 524.670674][T11148] ? __pfx_sock_write_iter+0x10/0x10 [ 524.670716][T11148] ? bpf_lsm_file_permission+0x9/0x20 [ 524.670767][T11148] ? security_file_permission+0x75/0x260 [ 524.670803][T11148] vfs_write+0x61e/0xbb0 [ 524.670843][T11148] ? __pfx_vfs_write+0x10/0x10 [ 524.670881][T11148] ? __fget_files+0x2a/0x420 [ 524.670912][T11148] ksys_write+0x156/0x270 [ 524.670943][T11148] ? __pfx_ksys_write+0x10/0x10 [ 524.670979][T11148] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 524.671005][T11148] do_syscall_64+0x174/0x580 [ 524.671035][T11148] ? trace_irq_disable+0x3b/0x140 [ 524.671058][T11148] ? clear_bhb_loop+0x40/0x90 [ 524.671096][T11148] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 524.671118][T11148] RIP: 0033:0x7fa68179e019 [ 524.671141][T11148] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 524.671160][T11148] RSP: 002b:00007fa67f9f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 524.671182][T11148] RAX: ffffffffffffffda RBX: 00007fa681a25fa0 RCX: 00007fa68179e019 [ 524.671198][T11148] RDX: 0000000000000024 RSI: 0000200000000040 RDI: 0000000000000008 [ 524.671212][T11148] RBP: 00007fa67f9f6090 R08: 0000000000000000 R09: 0000000000000000 [ 524.671225][T11148] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 524.671238][T11148] R13: 00007fa681a26038 R14: 00007fa681a25fa0 R15: 00007ffdd9f77cf8 [ 524.671272][T11148] [ 525.054827][T11161] netlink: 'syz.5.1704': attribute type 5 has an invalid length. [ 525.151749][T11159] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1707'. [ 525.783026][T11166] FAULT_INJECTION: forcing a failure. [ 525.783026][T11166] name failslab, interval 1, probability 0, space 0, times 0 [ 525.783087][T11166] CPU: 0 UID: 0 PID: 11166 Comm: syz.3.1708 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 525.783114][T11166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 525.783127][T11166] Call Trace: [ 525.783137][T11166] [ 525.783152][T11166] dump_stack_lvl+0xe8/0x150 [ 525.783183][T11166] should_fail_ex+0x467/0x600 [ 525.783213][T11166] should_failslab+0xa8/0x100 [ 525.783234][T11166] kmem_cache_alloc_noprof+0xa4/0x650 [ 525.783251][T11166] ? do_getname+0x2e/0x250 [ 525.783274][T11166] ? do_getname+0x2e/0x250 [ 525.783298][T11166] ? __sanitizer_cov_trace_const_cmp8+0x2a/0xa0 [ 525.783349][T11166] do_getname+0x2e/0x250 [ 525.783372][T11166] ? getname_flags+0x11/0x20 [ 525.783398][T11166] do_sys_openat2+0xcc/0x200 [ 525.783414][T11166] ? lockdep_hardirqs_on+0x7a/0x110 [ 525.783437][T11166] ? __pfx_do_sys_openat2+0x10/0x10 [ 525.783458][T11166] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 525.783477][T11166] __x64_sys_openat+0x138/0x170 [ 525.783496][T11166] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 525.783512][T11166] do_syscall_64+0x174/0x580 [ 525.783541][T11166] ? clear_bhb_loop+0x40/0x90 [ 525.783561][T11166] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 525.783577][T11166] RIP: 0033:0x7fcb0575e019 [ 525.783591][T11166] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 525.783605][T11166] RSP: 002b:00007fcb03995028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 525.783622][T11166] RAX: ffffffffffffffda RBX: 00007fcb059e6090 RCX: 00007fcb0575e019 [ 525.783634][T11166] RDX: 0000000000000002 RSI: 0000200000000040 RDI: ffffffffffffff9c [ 525.783645][T11166] RBP: 00007fcb03995090 R08: 0000000000000000 R09: 0000000000000000 [ 525.783655][T11166] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 525.783665][T11166] R13: 00007fcb059e6128 R14: 00007fcb059e6090 R15: 00007fff4eb4e388 [ 525.783689][T11166] [ 527.244595][ T5719] usb 2-1: USB disconnect, device number 42 [ 527.262435][ T36] usb 6-1: USB disconnect, device number 36 [ 530.745237][T11196] netlink: 'syz.5.1716': attribute type 4 has an invalid length. [ 530.893410][T10626] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 531.066731][ T5719] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 531.140797][T10626] veth0_vlan: entered promiscuous mode [ 531.199179][T10626] veth1_vlan: entered promiscuous mode [ 531.226718][ T5719] usb 5-1: Using ep0 maxpacket: 16 [ 531.229955][ T5719] usb 5-1: config 64 has an invalid interface number: 238 but max is 0 [ 531.229987][ T5719] usb 5-1: config 64 has an invalid descriptor of length 0, skipping remainder of the config [ 531.230008][ T5719] usb 5-1: config 64 has no interface number 0 [ 531.230043][ T5719] usb 5-1: config 64 interface 238 has no altsetting 0 [ 531.308070][ T5719] usb 5-1: New USB device found, idVendor=046d, idProduct=087c, bcdDevice=b0.7a [ 531.308111][ T5719] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 531.308127][ T5719] usb 5-1: Product: syz [ 531.308138][ T5719] usb 5-1: Manufacturer: syz [ 531.308150][ T5719] usb 5-1: SerialNumber: syz [ 531.406354][T11201] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1718'. [ 531.652962][ T5719] uvcvideo 5-1:64.238: Found Unit with invalid ID 0 [ 531.653029][ T5719] uvcvideo 5-1:64.238: Found UVC 0.00 device syz (046d:087c) [ 531.653061][ T5719] uvcvideo 5-1:64.238: No valid video chain found. [ 531.699068][ T5719] usb 5-1: USB disconnect, device number 34 [ 531.706614][T10626] veth0_macvtap: entered promiscuous mode [ 531.775337][T10626] veth1_macvtap: entered promiscuous mode [ 532.042261][T10626] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 532.129201][T11211] FAULT_INJECTION: forcing a failure. [ 532.129201][T11211] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 532.129266][T11211] CPU: 0 UID: 0 PID: 11211 Comm: syz.3.1710 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 532.129294][T11211] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 532.129309][T11211] Call Trace: [ 532.129318][T11211] [ 532.129329][T11211] dump_stack_lvl+0xe8/0x150 [ 532.129371][T11211] should_fail_ex+0x467/0x600 [ 532.129414][T11211] _copy_from_user+0x2d/0xb0 [ 532.129444][T11211] ___sys_sendmsg+0x1c6/0x360 [ 532.129483][T11211] ? __pfx____sys_sendmsg+0x10/0x10 [ 532.129551][T11211] ? __fget_files+0x2a/0x420 [ 532.129576][T11211] ? __fget_files+0x3a8/0x420 [ 532.129612][T11211] __x64_sys_sendmsg+0x1b7/0x290 [ 532.129646][T11211] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 532.129697][T11211] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 532.129723][T11211] do_syscall_64+0x174/0x580 [ 532.129757][T11211] ? clear_bhb_loop+0x40/0x90 [ 532.129786][T11211] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 532.129810][T11211] RIP: 0033:0x7fcb0575e019 [ 532.129831][T11211] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 532.129851][T11211] RSP: 002b:00007fcb03974028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 532.129876][T11211] RAX: ffffffffffffffda RBX: 00007fcb059e6180 RCX: 00007fcb0575e019 [ 532.129892][T11211] RDX: 000000002000c8c0 RSI: 0000200000000100 RDI: 0000000000000006 [ 532.129907][T11211] RBP: 00007fcb03974090 R08: 0000000000000000 R09: 0000000000000000 [ 532.129922][T11211] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 532.129935][T11211] R13: 00007fcb059e6218 R14: 00007fcb059e6180 R15: 00007fff4eb4e388 [ 532.129972][T11211] [ 532.787676][T10626] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 532.960161][ T36] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 533.038939][T11214] FAULT_INJECTION: forcing a failure. [ 533.038939][T11214] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 533.039019][T11214] CPU: 1 UID: 0 PID: 11214 Comm: syz.5.1721 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 533.039047][T11214] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 533.039061][T11214] Call Trace: [ 533.039070][T11214] [ 533.039080][T11214] dump_stack_lvl+0xe8/0x150 [ 533.039122][T11214] should_fail_ex+0x467/0x600 [ 533.039182][T11214] _copy_from_user+0x2d/0xb0 [ 533.039212][T11214] __sys_bpf+0x2e7/0xd90 [ 533.039247][T11214] ? __pfx___sys_bpf+0x10/0x10 [ 533.039276][T11214] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 533.039314][T11214] ? rt_mutex_slowunlock+0x219/0x460 [ 533.039359][T11214] ? ksys_write+0x248/0x270 [ 533.039392][T11214] ? __pfx_ksys_write+0x10/0x10 [ 533.039425][T11214] __x64_sys_bpf+0xba/0xd0 [ 533.039461][T11214] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 533.039486][T11214] do_syscall_64+0x174/0x580 [ 533.039516][T11214] ? trace_irq_disable+0x3b/0x140 [ 533.039553][T11214] ? clear_bhb_loop+0x40/0x90 [ 533.039583][T11214] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 533.039606][T11214] RIP: 0033:0x7eff7fc5e019 [ 533.039627][T11214] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 533.039646][T11214] RSP: 002b:00007eff7deb6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 533.039670][T11214] RAX: ffffffffffffffda RBX: 00007eff7fee5fa0 RCX: 00007eff7fc5e019 [ 533.039687][T11214] RDX: 000000000000006b RSI: 0000200000000440 RDI: 0000000000000005 [ 533.039702][T11214] RBP: 00007eff7deb6090 R08: 0000000000000000 R09: 0000000000000000 [ 533.039716][T11214] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 533.039730][T11214] R13: 00007eff7fee6038 R14: 00007eff7fee5fa0 R15: 00007ffcbbe6bd48 [ 533.039765][T11214] [ 533.106587][ T36] usb 2-1: Using ep0 maxpacket: 32 [ 533.159291][ T36] usb 2-1: config index 0 descriptor too short (expected 35577, got 27) [ 533.159323][ T36] usb 2-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 533.159346][ T36] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 533.159369][ T36] usb 2-1: config 1 has no interface number 0 [ 533.159429][ T36] usb 2-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 533.159459][ T36] usb 2-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 533.159505][ T36] usb 2-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 533.159531][ T36] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 533.367769][ T36] snd_usb_pod 2-1:1.1: Line 6 Pocket POD found [ 533.632912][ T36] snd_usb_pod 2-1:1.1: Line 6 Pocket POD now attached [ 533.639712][ T3367] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 533.645058][ T3367] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 533.645771][ T3367] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 533.646450][ T3367] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 533.785025][ T5719] usb 2-1: USB disconnect, device number 43 [ 533.805614][ T5719] snd_usb_pod 2-1:1.1: Line 6 Pocket POD now disconnected [ 533.960346][ T5740] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 533.991539][T11222] ": renamed from veth0_virt_wifi (while UP) [ 534.151428][ T5740] usb 6-1: Using ep0 maxpacket: 8 [ 534.154776][ T5740] usb 6-1: config 2 has an invalid interface number: 31 but max is 0 [ 534.154801][ T5740] usb 6-1: config 2 has no interface number 0 [ 534.154842][ T5740] usb 6-1: config 2 interface 31 has no altsetting 0 [ 534.211916][ T5740] usb 6-1: New USB device found, idVendor=1a86, idProduct=e092, bcdDevice=53.3f [ 534.211947][ T5740] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 534.211969][ T5740] usb 6-1: Product: syz [ 534.211985][ T5740] usb 6-1: Manufacturer: syz [ 534.212001][ T5740] usb 6-1: SerialNumber: syz [ 534.580161][T11229] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 534.778355][ T5740] ch9200 6-1:2.31: probe with driver ch9200 failed with error -22 [ 534.871713][ T5740] usb 6-1: USB disconnect, device number 37 [ 534.918054][ T1059] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 534.918077][ T1059] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 535.093209][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 535.093234][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 535.273138][T11239] FAULT_INJECTION: forcing a failure. [ 535.273138][T11239] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 535.273186][T11239] CPU: 1 UID: 0 PID: 11239 Comm: syz.4.1729 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 535.273212][T11239] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 535.273225][T11239] Call Trace: [ 535.273234][T11239] [ 535.273245][T11239] dump_stack_lvl+0xe8/0x150 [ 535.273285][T11239] should_fail_ex+0x467/0x600 [ 535.273327][T11239] _copy_from_user+0x2d/0xb0 [ 535.273356][T11239] __sys_connect+0x155/0x470 [ 535.273387][T11239] ? __pfx___sys_connect+0x10/0x10 [ 535.273436][T11239] ? __pfx_ksys_write+0x10/0x10 [ 535.273472][T11239] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 535.273497][T11239] __x64_sys_connect+0x7a/0x90 [ 535.273525][T11239] do_syscall_64+0x174/0x580 [ 535.273555][T11239] ? trace_irq_disable+0x3b/0x140 [ 535.273578][T11239] ? clear_bhb_loop+0x40/0x90 [ 535.273606][T11239] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 535.273629][T11239] RIP: 0033:0x7ff59636e019 [ 535.273651][T11239] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 535.273671][T11239] RSP: 002b:00007ff5945c6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 535.273695][T11239] RAX: ffffffffffffffda RBX: 00007ff5965f5fa0 RCX: 00007ff59636e019 [ 535.273711][T11239] RDX: 0000000000000010 RSI: 0000200000000000 RDI: 0000000000000005 [ 535.273726][T11239] RBP: 00007ff5945c6090 R08: 0000000000000000 R09: 0000000000000000 [ 535.273739][T11239] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 535.273753][T11239] R13: 00007ff5965f6038 R14: 00007ff5965f5fa0 R15: 00007ffe393e8308 [ 535.273787][T11239] [ 535.506040][T11242] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1730'. [ 535.516263][ T37] kauditd_printk_skb: 1 callbacks suppressed [ 535.516326][ T37] audit: type=1326 audit(1785793947.960:481): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11240 comm="syz.1.1730" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fa68179e019 code=0x0 [ 535.614727][T11244] netlink: 'syz.5.1731': attribute type 1 has an invalid length. [ 535.876687][ T5720] usb 6-1: new high-speed USB device number 38 using dummy_hcd [ 536.107311][ T5740] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 536.570865][T11256] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1733'. [ 536.575087][ T5720] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 536.575116][ T5720] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 536.620198][ T5720] usb 6-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 536.620235][ T5720] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 536.620259][ T5720] usb 6-1: SerialNumber: syz [ 536.922656][T11259] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1734'. [ 536.922686][T11259] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 537.196691][T11262] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1731'. [ 538.065699][ T5720] usb 6-1: 0:2 : does not exist [ 539.406519][ T5720] usb 6-1: USB disconnect, device number 38 [ 541.666689][ T6017] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 541.700674][ T5628] udevd[5628]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 541.816885][ T6017] usb 4-1: Using ep0 maxpacket: 16 [ 541.821014][ T6017] usb 4-1: config 64 has an invalid interface number: 238 but max is 0 [ 541.821044][ T6017] usb 4-1: config 64 has an invalid descriptor of length 0, skipping remainder of the config [ 541.821082][ T6017] usb 4-1: config 64 has no interface number 0 [ 541.821106][ T6017] usb 4-1: config 64 interface 238 has no altsetting 0 [ 541.824254][ T6017] usb 4-1: New USB device found, idVendor=046d, idProduct=087c, bcdDevice=b0.7a [ 541.824290][ T6017] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 541.824306][ T6017] usb 4-1: Product: syz [ 541.824317][ T6017] usb 4-1: Manufacturer: syz [ 541.824328][ T6017] usb 4-1: SerialNumber: syz [ 542.361910][T11300] futex_wake_op: syz.0.1746 tries to shift op by 144; fix this program [ 542.477226][T11301] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1744'. [ 543.918025][ T6017] uvcvideo 4-1:64.238: Found Unit with invalid ID 0 [ 543.918107][ T6017] uvcvideo 4-1:64.238: Found UVC 0.00 device syz (046d:087c) [ 543.918139][ T6017] uvcvideo 4-1:64.238: No valid video chain found. [ 543.944738][ T6017] usb 4-1: USB disconnect, device number 40 [ 545.557014][ T5740] usb 6-1: new high-speed USB device number 39 using dummy_hcd [ 545.711994][T11313] hpfs: Bad magic ... probably not HPFS [ 545.721776][T11314] hpfs: Bad magic ... probably not HPFS [ 546.455820][T11320] type: 10 invalid [ 546.593210][ T5619] Bluetooth: hci0: unexpected event for opcode 0x8c11 [ 548.373190][T11339] FAULT_INJECTION: forcing a failure. [ 548.373190][T11339] name failslab, interval 1, probability 0, space 0, times 0 [ 548.373224][T11339] CPU: 0 UID: 0 PID: 11339 Comm: syz.0.1757 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 548.373252][T11339] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 548.373265][T11339] Call Trace: [ 548.373273][T11339] [ 548.373281][T11339] dump_stack_lvl+0xe8/0x150 [ 548.373317][T11339] should_fail_ex+0x467/0x600 [ 548.373352][T11339] should_failslab+0xa8/0x100 [ 548.373375][T11339] kmem_cache_alloc_noprof+0xa4/0x650 [ 548.373395][T11339] ? do_getname+0x2e/0x250 [ 548.373421][T11339] ? do_getname+0x2e/0x250 [ 548.373452][T11339] do_getname+0x2e/0x250 [ 548.373483][T11339] ? getname_uflags+0x11/0x30 [ 548.373507][T11339] vfs_open_tree+0x289/0x3d0 [ 548.373539][T11339] ? __pfx_vfs_open_tree+0x10/0x10 [ 548.373568][T11339] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 548.373587][T11339] __x64_sys_open_tree+0x96/0x110 [ 548.373606][T11339] do_syscall_64+0x174/0x580 [ 548.373630][T11339] ? trace_irq_disable+0x3b/0x140 [ 548.373648][T11339] ? clear_bhb_loop+0x40/0x90 [ 548.373669][T11339] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 548.373698][T11339] RIP: 0033:0x7f2ce006e019 [ 548.373716][T11339] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 548.373731][T11339] RSP: 002b:00007f2cde2c6028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ac [ 548.373750][T11339] RAX: ffffffffffffffda RBX: 00007f2ce02f5fa0 RCX: 00007f2ce006e019 [ 548.373764][T11339] RDX: 0000000000089801 RSI: 0000200000000300 RDI: 0000000000000003 [ 548.373775][T11339] RBP: 00007f2cde2c6090 R08: 0000000000000000 R09: 0000000000000000 [ 548.373787][T11339] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 548.373798][T11339] R13: 00007f2ce02f6038 R14: 00007f2ce02f5fa0 R15: 00007ffe884d3b18 [ 548.373826][T11339] [ 549.952960][T11347] nfs: Bad value for 'smackfstransmute' [ 550.493923][ T9922] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 550.640772][T11359] veth1_to_team: entered allmulticast mode [ 551.569582][ T9922] usb 2-1: Using ep0 maxpacket: 16 [ 551.573525][ T9922] usb 2-1: config 64 has an invalid interface number: 238 but max is 0 [ 551.573559][ T9922] usb 2-1: config 64 has an invalid descriptor of length 0, skipping remainder of the config [ 551.573585][ T9922] usb 2-1: config 64 has no interface number 0 [ 551.573624][ T9922] usb 2-1: config 64 interface 238 has no altsetting 0 [ 551.620759][ T9922] usb 2-1: New USB device found, idVendor=046d, idProduct=087c, bcdDevice=b0.7a [ 551.620799][ T9922] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 551.620826][ T9922] usb 2-1: Product: syz [ 551.620845][ T9922] usb 2-1: Manufacturer: syz [ 551.622669][ T9922] usb 2-1: SerialNumber: syz [ 551.643793][ T5740] usb 6-1: device descriptor read/64, error -110 [ 551.935280][ T9922] uvcvideo 2-1:64.238: Found Unit with invalid ID 0 [ 551.935359][ T9922] uvcvideo 2-1:64.238: Found UVC 0.00 device syz (046d:087c) [ 551.935392][ T9922] uvcvideo 2-1:64.238: No valid video chain found. [ 551.969089][ T9922] usb 2-1: USB disconnect, device number 44 [ 552.046632][ T5720] usb 1-1: new full-speed USB device number 18 using dummy_hcd [ 552.142830][T11363] genirq: Flags mismatch irq 7. 00202000 (das16m1) vs. 00202080 (ttyS3) [ 552.187021][T11325] svc: failed to register nfsdv3 RPC service (errno 512). [ 552.187260][T11325] svc: failed to register nfsaclv3 RPC service (errno 512). [ 552.187280][T11325] failed to unregister tcp with rpcbind [ 552.187547][T11325] svc: failed to register nfsdv3 RPC service (errno 97). [ 552.187567][T11325] svc: failed to register nfsaclv3 RPC service (errno 97). [ 552.187583][T11325] failed to unregister tcp with rpcbind [ 552.238718][ T5720] usb 1-1: unable to get BOS descriptor or descriptor too short [ 552.239472][ T5720] usb 1-1: not running at top speed; connect to a high speed hub [ 552.241024][ T5720] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid maxpacket 1024, setting to 1023 [ 552.248389][ T5720] usb 1-1: New USB device found, idVendor=245f, idProduct=931c, bcdDevice= 0.40 [ 552.248467][ T5720] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 552.248510][ T5720] usb 1-1: Product: syz [ 552.248527][ T5720] usb 1-1: Manufacturer: syz [ 552.248544][ T5720] usb 1-1: SerialNumber: syz [ 552.597978][T11372] ======================================================= [ 552.597978][T11372] WARNING: The mand mount option has been deprecated and [ 552.597978][T11372] and is ignored by this kernel. Remove the mand [ 552.597978][T11372] option from the mount to silence this warning. [ 552.597978][T11372] ======================================================= [ 552.675904][ T5720] usb 1-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 552.676358][ T5720] usb 1-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 552.831489][ T5720] usb 1-1: USB disconnect, device number 18 [ 552.953603][ T5628] udevd[5628]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 552.976305][ T6017] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 553.116740][ T10] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 553.148608][ T6017] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 553.148668][ T6017] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 18 [ 553.149876][ T6017] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 553.149905][ T6017] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 553.149929][ T6017] usb 2-1: SerialNumber: syz [ 553.216079][ T6017] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -22 [ 553.276618][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 553.279154][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 553.279190][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 553.279216][ T10] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 553.279272][ T10] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 553.279297][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 553.325619][ T10] usb 4-1: config 0 descriptor?? [ 553.861214][ T10] input: HID 045e:07da as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:045E:07DA.000B/input/input18 [ 554.592068][ T5740] usb 6-1: new high-speed USB device number 41 using dummy_hcd [ 554.728989][ T5740] usb 6-1: device descriptor read/64, error -71 [ 554.805198][T11417] netlink: 'syz.0.1785': attribute type 2 has an invalid length. [ 554.805222][T11417] netlink: 'syz.0.1785': attribute type 1 has an invalid length. [ 554.805238][T11417] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1785'. [ 554.969985][ T5740] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 554.974797][T11418] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1786'. [ 555.116756][ T5740] usb 6-1: device descriptor read/64, error -71 [ 555.562949][ T5740] usb usb6-port1: attempt power cycle [ 556.196833][ T9919] usb 2-1: USB disconnect, device number 45 [ 556.355331][T11430] fuse: Invalid rootmode [ 556.420027][ T5740] usb 6-1: new high-speed USB device number 43 using dummy_hcd [ 556.439966][ T5740] usb 6-1: device descriptor read/8, error -71 [ 556.676606][ T5740] usb 6-1: new high-speed USB device number 44 using dummy_hcd [ 556.701510][ T5740] usb 6-1: device descriptor read/8, error -71 [ 556.807127][ T5740] usb usb6-port1: unable to enumerate USB device [ 557.052209][ T10] microsoft 0003:045E:07DA.000B: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.3-1/input0 [ 557.118166][ T10] usb 4-1: USB disconnect, device number 41 [ 557.835518][ T5720] hid_parser_main: 47 callbacks suppressed [ 557.835545][ T5720] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 557.835574][ T5720] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 557.926674][ T9919] usb 5-1: new full-speed USB device number 35 using dummy_hcd [ 558.728194][ T5720] hid-generic 0000:0000:0000.000C: hidraw0: HID v0.00 Device [syz0] on syz0 [ 559.980710][ T197] usb 6-1: new high-speed USB device number 45 using dummy_hcd [ 560.146619][ T197] usb 6-1: Using ep0 maxpacket: 32 [ 560.173939][ T197] usb 6-1: unable to get BOS descriptor or descriptor too short [ 560.199999][ T197] usb 6-1: config 1 has an invalid interface number: 37 but max is 0 [ 560.200029][ T197] usb 6-1: config 1 has no interface number 0 [ 560.201004][ T197] usb 6-1: config 1 interface 37 has no altsetting 0 [ 560.205605][ T197] usb 6-1: New USB device found, idVendor=058b, idProduct=0041, bcdDevice=9e.7d [ 560.205636][ T197] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 560.205659][ T197] usb 6-1: Product: syz [ 560.205683][ T197] usb 6-1: Manufacturer: syz [ 560.205699][ T197] usb 6-1: SerialNumber: syz [ 560.667785][ T36] usb 1-1: new full-speed USB device number 19 using dummy_hcd [ 560.779409][ T197] usb_serial_simple 6-1:1.37: flashloader converter detected [ 560.830267][ T36] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 560.830389][ T36] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 560.832479][ T36] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a5, bcdDevice= 0.40 [ 560.832516][ T36] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 560.832600][ T36] usb 1-1: SerialNumber: syz [ 561.065729][ T197] usb 6-1: flashloader converter now attached to ttyUSB0 [ 561.106140][ T36] cdc_ether 1-1:1.0: probe with driver cdc_ether failed with error -22 [ 561.118250][ T36] usb-storage 1-1:1.0: USB Mass Storage device detected [ 561.123448][ T197] usb 6-1: USB disconnect, device number 45 [ 561.272120][ T36] usb-storage 1-1:1.0: Quirks match for vid 0525 pid a4a5: 10000 [ 561.273091][ T36] scsi host1: usb-storage 1-1:1.0 [ 561.336781][ T197] flashloader ttyUSB0: flashloader converter now disconnected from ttyUSB0 [ 561.517230][ T197] usb_serial_simple 6-1:1.37: device disconnected [ 562.223011][T11506] mac80211_hwsim hwsim6 wlan0: entered promiscuous mode [ 562.326615][ T9919] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 562.486603][ T9919] usb 5-1: Using ep0 maxpacket: 8 [ 562.491518][ T9919] usb 5-1: config 11 has an invalid interface number: 1 but max is 0 [ 562.491549][ T9919] usb 5-1: config 11 has no interface number 0 [ 562.491622][ T9919] usb 5-1: config 11 interface 1 altsetting 4 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 562.491654][ T9919] usb 5-1: config 11 interface 1 altsetting 4 endpoint 0x8 has invalid wMaxPacketSize 0 [ 562.491679][ T9919] usb 5-1: config 11 interface 1 has no altsetting 0 [ 562.571465][ T9919] usb 5-1: New USB device found, idVendor=147f, idProduct=2758, bcdDevice=fe.07 [ 562.571500][ T9919] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 562.571522][ T9919] usb 5-1: Product: syz [ 562.571539][ T9919] usb 5-1: Manufacturer: syz [ 562.571555][ T9919] usb 5-1: SerialNumber: syz [ 562.756747][ T6017] usb 6-1: new high-speed USB device number 46 using dummy_hcd [ 562.903227][ T9919] dvb-usb: found a 'Hama DVB=T Hybrid USB Stick' in cold state, will try to load a firmware [ 562.930941][ T6017] usb 6-1: unable to get BOS descriptor or descriptor too short [ 562.948174][ T6017] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7 [ 562.953586][ T6017] usb 6-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 562.953620][ T6017] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 562.953643][ T6017] usb 6-1: Product: syz [ 562.953719][ T6017] usb 6-1: Manufacturer: syz [ 562.953738][ T6017] usb 6-1: SerialNumber: syz [ 563.050501][ T36] usb 1-1: USB disconnect, device number 19 [ 563.132522][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.357110][ T6017] usb 6-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 563.532829][ T6017] usb 6-1: 2:1 : unknown format tag 0x4 is detected. processed as MPEG. [ 563.532862][ T6017] usb 6-1: found format II with max.bitrate = 4, frame size=7372 [ 563.953272][ T6017] usb 6-1: 2:1 : unknown format tag 0x4 is detected. processed as MPEG. [ 563.953304][ T6017] usb 6-1: found format II with max.bitrate = 4, frame size=7372 [ 564.150798][ T9919] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 564.151156][ T9919] dib0700: firmware download failed at 7 with -22 [ 564.153813][ T6017] usb 6-1: parse_audio_format_rates_v2v3(): unable to retrieve number of sample rates (clock 0) [ 564.255909][ T9919] usbhid 5-1:11.1: couldn't find an input interrupt endpoint [ 564.322194][ T9919] usb 5-1: USB disconnect, device number 36 [ 564.556869][ T6017] usb 6-1: USB disconnect, device number 46 [ 565.650606][ T5628] udevd[5628]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 565.736650][ T36] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 565.884515][T11549] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1835'. [ 565.956625][ T36] usb 1-1: Using ep0 maxpacket: 16 [ 565.959089][ T36] usb 1-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 565.959126][ T36] usb 1-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 565.959152][ T36] usb 1-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 28 [ 565.959183][ T36] usb 1-1: config 0 interface 0 has no altsetting 0 [ 565.959221][ T36] usb 1-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 565.959247][ T36] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 566.035696][ T36] usb 1-1: config 0 descriptor?? [ 566.502244][ T36] hid (null): bogus close delimiter [ 566.749241][ T36] usb 1-1: USB disconnect, device number 20 [ 566.906741][ T6017] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 567.060965][ T6017] usb 5-1: unable to get BOS descriptor or descriptor too short [ 567.063175][ T6017] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 567.063204][ T6017] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 567.063272][ T6017] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 567.108906][ T6017] usb 5-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 567.108952][ T6017] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 567.108990][ T6017] usb 5-1: Product: syz [ 567.109017][ T6017] usb 5-1: Manufacturer: syz [ 567.109045][ T6017] usb 5-1: SerialNumber: syz [ 567.547273][ T6017] usb 5-1: USB disconnect, device number 37 [ 567.648991][ T5628] udevd[5628]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 567.844041][T11585] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1851'. [ 569.198098][T11616] fuse: Bad value for 'fd' [ 569.708749][ T9919] usb 6-1: new high-speed USB device number 47 using dummy_hcd [ 569.877308][ T9919] usb 6-1: Using ep0 maxpacket: 32 [ 570.289704][T11595] Bluetooth: hci4: Opcode 0x0401 failed: -110 [ 570.508133][ T9919] usb 6-1: config 0 has an invalid interface number: 67 but max is 0 [ 570.508165][ T9919] usb 6-1: config 0 has no interface number 0 [ 570.511261][ T9919] usb 6-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 570.511293][ T9919] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 570.511316][ T9919] usb 6-1: Product: syz [ 570.511332][ T9919] usb 6-1: Manufacturer: syz [ 570.511348][ T9919] usb 6-1: SerialNumber: syz [ 570.518911][ T9919] usb 6-1: config 0 descriptor?? [ 570.955356][ T9919] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 570.955392][ T9919] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 571.074994][ T5720] hid-generic 0005:0000:0000.000E: unknown main item tag 0x0 [ 571.075033][ T5720] hid-generic 0005:0000:0000.000E: unknown main item tag 0x0 [ 571.075063][ T5720] hid-generic 0005:0000:0000.000E: unknown main item tag 0x0 [ 571.075092][ T5720] hid-generic 0005:0000:0000.000E: unknown main item tag 0x0 [ 571.137567][ T5720] hid-generic 0005:0000:0000.000E: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 571.335596][T11647] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1875'. [ 571.446705][ T9919] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000108: -71 [ 571.447009][ T9919] smsc95xx 6-1:0.67: probe with driver smsc95xx failed with error -71 [ 571.499260][ T9919] usb 6-1: USB disconnect, device number 47 [ 571.525442][T11652] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1875'. [ 571.696948][T11648] fido_id[11648]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 572.646663][ T9919] usb 6-1: new full-speed USB device number 48 using dummy_hcd [ 572.801305][ T9919] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 572.801374][ T9919] usb 6-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 572.801422][ T9919] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 572.801470][ T9919] usb 6-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 572.861245][ T9919] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 572.861269][ T9919] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 572.861284][ T9919] usb 6-1: Product: syz [ 572.861295][ T9919] usb 6-1: Manufacturer: syz [ 572.861305][ T9919] usb 6-1: SerialNumber: syz [ 572.959398][ T9919] cdc_ncm 6-1:1.0: skipping garbage [ 573.164261][T11663] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 574.820862][T11663] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 575.022355][ T9919] cdc_ncm 6-1:1.0: bind() failure [ 575.112029][ T9919] cdc_ncm 6-1:1.1: probe with driver cdc_ncm failed with error -71 [ 575.114385][ T9919] cdc_mbim 6-1:1.1: probe with driver cdc_mbim failed with error -71 [ 575.181031][ T9919] usbtest 6-1:1.1: probe with driver usbtest failed with error -71 [ 575.217368][ T9919] usb 6-1: USB disconnect, device number 48 [ 575.346745][ T10] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 575.519831][ T10] usb 5-1: unable to get BOS descriptor or descriptor too short [ 575.521513][ T10] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7 [ 575.524860][ T10] usb 5-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 575.524893][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 575.524918][ T10] usb 5-1: Product: syz [ 575.524934][ T10] usb 5-1: Manufacturer: syz [ 575.524950][ T10] usb 5-1: SerialNumber: syz [ 575.879597][ T10] usb 5-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 576.031717][ T10] usb 5-1: 2:1 : unknown format tag 0x4 is detected. processed as MPEG. [ 576.031748][ T10] usb 5-1: found format II with max.bitrate = 4, frame size=7372 [ 577.762355][ T10] usb 5-1: parse_audio_format_rates_v2v3(): unable to retrieve sample rate range (clock 0) [ 577.951600][ T10] usb 5-1: USB disconnect, device number 38 [ 578.129899][ T5628] udevd[5628]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 578.316676][ T6017] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 578.426660][ T9919] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 578.469047][ T6017] usb 4-1: config 220 has an invalid interface number: 76 but max is 2 [ 578.469079][ T6017] usb 4-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 578.469101][ T6017] usb 4-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 578.469123][ T6017] usb 4-1: config 220 has no interface number 2 [ 578.469194][ T6017] usb 4-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 578.469226][ T6017] usb 4-1: config 220 interface 0 has no altsetting 0 [ 578.469248][ T6017] usb 4-1: config 220 interface 76 has no altsetting 0 [ 578.469269][ T6017] usb 4-1: config 220 interface 1 has no altsetting 0 [ 578.473595][ T6017] usb 4-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 578.473629][ T6017] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 578.473652][ T6017] usb 4-1: Product: syz [ 578.473667][ T6017] usb 4-1: Manufacturer: syz [ 578.473685][ T6017] usb 4-1: SerialNumber: syz [ 578.598966][ T9919] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 578.599027][ T9919] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 578.599053][ T9919] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 578.599081][ T9919] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 578.602024][ T9919] usb 1-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice= 1.00 [ 578.602056][ T9919] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 578.602079][ T9919] usb 1-1: Product: syz [ 578.602097][ T9919] usb 1-1: Manufacturer: syz [ 578.602114][ T9919] usb 1-1: SerialNumber: syz [ 578.706165][T11736] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 578.867620][ T9919] usbserial_generic 1-1:1.0: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 578.867648][ T9919] usbserial_generic 1-1:1.0: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 578.867707][ T9919] usbserial_generic 1-1:1.0: generic converter detected [ 578.964526][ T6017] usb 4-1: selecting invalid altsetting 0 [ 578.965092][ T6017] uvcvideo 4-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 578.965127][ T6017] uvcvideo 4-1:220.0: No valid video chain found. [ 579.084676][ T6017] usb 4-1: selecting invalid altsetting 0 [ 579.084730][ T6017] usbtest 4-1:220.1: probe with driver usbtest failed with error -22 [ 579.123874][ T9919] usb 1-1: generic converter now attached to ttyUSB0 [ 579.138067][ T6017] usb 4-1: USB disconnect, device number 42 [ 579.192563][ T10] usb 1-1: USB disconnect, device number 21 [ 579.329675][ T10] generic ttyUSB0: generic converter now disconnected from ttyUSB0 [ 579.332593][ T10] usbserial_generic 1-1:1.0: device disconnected [ 579.656609][ T5720] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 579.754620][T11757] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 579.754620][T11757] The task syz.5.1912 (11757) triggered the difference, watch for misbehavior. [ 579.817139][ T5720] usb 5-1: Using ep0 maxpacket: 16 [ 579.821225][ T5720] usb 5-1: unable to get BOS descriptor or descriptor too short [ 579.824298][ T5720] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 579.824327][ T5720] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 579.865958][ T5720] usb 5-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 579.865990][ T5720] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 579.866014][ T5720] usb 5-1: Product: syz [ 579.866030][ T5720] usb 5-1: Manufacturer: syz [ 579.866046][ T5720] usb 5-1: SerialNumber: syz [ 580.108099][T11766] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 581.473577][ T5720] usb 5-1: USB disconnect, device number 39 [ 582.733989][ T9919] usb 4-1: new full-speed USB device number 43 using dummy_hcd [ 582.879342][ T9919] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 12336, setting to 64 [ 582.882107][ T9919] usb 4-1: New USB device found, idVendor=18ec, idProduct=3288, bcdDevice=69.cf [ 582.882141][ T9919] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 582.882164][ T9919] usb 4-1: Product: syz [ 582.882180][ T9919] usb 4-1: Manufacturer: syz [ 582.882196][ T9919] usb 4-1: SerialNumber: syz [ 582.888966][ T9919] usb 4-1: config 0 descriptor?? [ 582.951145][ T9919] uvcvideo 4-1:0.0: Found UVC 0.00 device syz (18ec:3288) [ 582.951172][ T9919] uvcvideo 4-1:0.0: No valid video chain found. [ 583.175097][ T197] usb 4-1: USB disconnect, device number 43 [ 583.621455][T11818] FAULT_INJECTION: forcing a failure. [ 583.621455][T11818] name failslab, interval 1, probability 0, space 0, times 0 [ 583.621494][T11818] CPU: 1 UID: 0 PID: 11818 Comm: syz.4.1937 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 583.621526][T11818] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 583.621541][T11818] Call Trace: [ 583.621551][T11818] [ 583.621560][T11818] dump_stack_lvl+0xe8/0x150 [ 583.621602][T11818] should_fail_ex+0x467/0x600 [ 583.621645][T11818] should_failslab+0xa8/0x100 [ 583.621676][T11818] __kvmalloc_node_noprof+0x17a/0x8a0 [ 583.621708][T11818] ? traverse+0xf1/0x620 [ 583.621738][T11818] ? traverse+0xf1/0x620 [ 583.621777][T11818] traverse+0xf1/0x620 [ 583.621812][T11818] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 583.621847][T11818] ? seq_read_iter+0xa5/0xcb0 [ 583.621879][T11818] seq_read_iter+0xb6b/0xcb0 [ 583.621930][T11818] seq_read+0x36a/0x490 [ 583.621960][T11818] ? kstrtoull+0x12f/0x1d0 [ 583.622004][T11818] ? __pfx_seq_read+0x10/0x10 [ 583.622043][T11818] ? __import_iovec+0x5d7/0x7e0 [ 583.622082][T11818] ? __pfx_seq_read+0x10/0x10 [ 583.622111][T11818] proc_reg_read+0x1f6/0x2f0 [ 583.622147][T11818] vfs_readv+0x588/0x850 [ 583.622171][T11818] ? __pfx_proc_reg_read+0x10/0x10 [ 583.622205][T11818] ? __pfx_vfs_readv+0x10/0x10 [ 583.622244][T11818] ? __fget_files+0x2a/0x420 [ 583.622274][T11818] ? __fget_files+0x3a8/0x420 [ 583.622298][T11818] ? __fget_files+0x2a/0x420 [ 583.622333][T11818] __x64_sys_preadv+0x19f/0x2c0 [ 583.622375][T11818] ? __pfx___x64_sys_preadv+0x10/0x10 [ 583.622418][T11818] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 583.622445][T11818] do_syscall_64+0x174/0x580 [ 583.622475][T11818] ? trace_irq_disable+0x3b/0x140 [ 583.622499][T11818] ? clear_bhb_loop+0x40/0x90 [ 583.622528][T11818] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 583.622551][T11818] RIP: 0033:0x7ff59636e019 [ 583.622573][T11818] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 583.622592][T11818] RSP: 002b:00007ff5945c6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 583.622627][T11818] RAX: ffffffffffffffda RBX: 00007ff5965f5fa0 RCX: 00007ff59636e019 [ 583.622642][T11818] RDX: 0000000000000001 RSI: 0000200000000500 RDI: 0000000000000003 [ 583.622655][T11818] RBP: 00007ff5945c6090 R08: 0000000000000007 R09: 0000000000000000 [ 583.622669][T11818] R10: 00000000fffffffd R11: 0000000000000246 R12: 0000000000000001 [ 583.622683][T11818] R13: 00007ff5965f6038 R14: 00007ff5965f5fa0 R15: 00007ffe393e8308 [ 583.622718][T11818] [ 584.308230][T11832] netlink: 148 bytes leftover after parsing attributes in process `syz.3.1939'. [ 584.308355][T11832] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1939'. [ 584.308375][T11832] netlink: 'syz.3.1939': attribute type 1 has an invalid length. [ 584.703987][T11813] FAULT_INJECTION: forcing a failure. [ 584.703987][T11813] name failslab, interval 1, probability 0, space 0, times 0 [ 584.704048][T11813] CPU: 0 UID: 0 PID: 11813 Comm: syz.5.1935 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 584.704077][T11813] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 584.704093][T11813] Call Trace: [ 584.704102][T11813] [ 584.704112][T11813] dump_stack_lvl+0xe8/0x150 [ 584.704155][T11813] should_fail_ex+0x467/0x600 [ 584.704191][T11813] should_failslab+0xa8/0x100 [ 584.704214][T11813] __kmalloc_noprof+0xfe/0x780 [ 584.704230][T11813] ? rcu_is_watching+0x15/0xb0 [ 584.704251][T11813] ? tomoyo_realpath_from_path+0xef/0x640 [ 584.704274][T11813] ? tomoyo_realpath_from_path+0xef/0x640 [ 584.704302][T11813] tomoyo_realpath_from_path+0xef/0x640 [ 584.704332][T11813] ? tomoyo_path_number_perm+0x219/0x5f0 [ 584.704351][T11813] tomoyo_path_number_perm+0x246/0x5f0 [ 584.704371][T11813] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 584.704394][T11813] ? preempt_schedule_thunk+0x16/0x40 [ 584.704421][T11813] ? hook_file_ioctl+0x1f3/0x600 [ 584.704463][T11813] ? __rcu_read_unlock+0x83/0xe0 [ 584.704478][T11813] ? __fget_files+0x2a/0x420 [ 584.704495][T11813] ? __fget_files+0x3a8/0x420 [ 584.704511][T11813] ? __fget_files+0x2a/0x420 [ 584.704532][T11813] security_file_ioctl+0xc3/0x2a0 [ 584.704553][T11813] __se_sys_ioctl+0x47/0x170 [ 584.704575][T11813] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 584.704593][T11813] do_syscall_64+0x174/0x580 [ 584.704618][T11813] ? clear_bhb_loop+0x40/0x90 [ 584.704638][T11813] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 584.704654][T11813] RIP: 0033:0x7eff7fc5e019 [ 584.704669][T11813] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 584.704687][T11813] RSP: 002b:00007eff7de95028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 584.704704][T11813] RAX: ffffffffffffffda RBX: 00007eff7fee6090 RCX: 00007eff7fc5e019 [ 584.704717][T11813] RDX: 0000000000000012 RSI: 0000000040045564 RDI: 0000000000000005 [ 584.704727][T11813] RBP: 00007eff7de95090 R08: 0000000000000000 R09: 0000000000000000 [ 584.704738][T11813] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 584.704748][T11813] R13: 00007eff7fee6128 R14: 00007eff7fee6090 R15: 00007ffcbbe6bd48 [ 584.704773][T11813] [ 584.704819][T11813] ERROR: Out of memory at tomoyo_realpath_from_path. [ 586.375965][T11839] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1945'. [ 586.497546][T11843] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1945'. [ 586.576610][ T9922] usb 5-1: new full-speed USB device number 40 using dummy_hcd [ 586.736768][ T9922] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 586.751690][ T9922] usb 5-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ac.7e [ 586.751724][ T9922] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 586.751749][ T9922] usb 5-1: Product: syz [ 586.751765][ T9922] usb 5-1: Manufacturer: syz [ 586.751783][ T9922] usb 5-1: SerialNumber: syz [ 586.807990][ T9922] usb 5-1: config 0 descriptor?? [ 586.837117][ T9922] hub 5-1:0.0: bad descriptor, ignoring hub [ 586.837162][ T9922] hub 5-1:0.0: probe with driver hub failed with error -5 [ 587.138536][ T6017] usb 5-1: USB disconnect, device number 40 [ 587.309732][T11851] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 589.126363][T11871] dummy_hcd dummy_hcd.0: remove, state 4 [ 589.126852][T11871] usb usb1: USB disconnect, device number 1 [ 589.167664][T11871] dummy_hcd dummy_hcd.0: stopped [ 589.167682][T11871] dummy_hcd dummy_hcd.0: USB bus 1 deregistered [ 589.327379][ T197] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 589.676631][ T197] usb 4-1: Using ep0 maxpacket: 16 [ 589.684121][ T197] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 589.684153][ T197] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 589.685682][ T197] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 589.685774][ T197] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 589.685799][ T197] usb 4-1: SerialNumber: syz [ 590.637974][ T197] usb 4-1: 0:2 : does not exist [ 590.810909][T11890] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI [ 590.810945][T11890] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 590.810969][T11890] CPU: 0 UID: 0 PID: 11890 Comm: syz.0.1962 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 590.810998][T11890] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 590.811013][T11890] RIP: 0010:dummy_udc_start+0xd0/0x1f0 [ 590.811183][T11890] Code: 41 83 ff 03 74 18 41 83 ff 05 0f 85 93 00 00 00 e8 a5 12 98 fa eb 0c e8 9e 12 98 fa eb 05 e8 97 12 98 fa 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 11 86 01 fb 4d 8b 36 4c 89 f7 e8 [ 590.811205][T11890] RSP: 0018:ffffc90007c97830 EFLAGS: 00010246 [ 590.811226][T11890] RAX: 0000000000000000 RBX: ffff888029cf2090 RCX: 0000000000080000 [ 590.811242][T11890] RDX: ffffc90012921000 RSI: 0000000000001d21 RDI: 0000000000001d22 [ 590.811255][T11890] RBP: ffff88802a57f000 R08: ffff8880603d9f00 R09: 0000000000000004 [ 590.811269][T11890] R10: 0000000000000100 R11: 0000000000000005 R12: dffffc0000000000 [ 590.811281][T11890] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000003 [ 590.811292][T11890] FS: 00007f2cde2c66c0(0000) GS:ffff888125c3e000(0000) knlGS:0000000000000000 [ 590.811308][T11890] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 590.811320][T11890] CR2: 00007f2ce0057180 CR3: 000000002c23e000 CR4: 00000000003526f0 [ 590.811337][T11890] Call Trace: [ 590.811344][T11890] [ 590.811352][T11890] ? __pfx_dummy_udc_start+0x10/0x10 [ 590.811378][T11890] gadget_bind_driver+0x3a8/0x9e0 [ 590.811436][T11890] ? __pfx_gadget_bind_driver+0x10/0x10 [ 590.811463][T11890] really_probe+0x254/0xae0 [ 590.811545][T11890] __driver_probe_device+0x1e8/0x360 [ 590.811573][T11890] driver_probe_device+0x4f/0x240 [ 590.811600][T11890] __driver_attach+0x339/0x600 [ 590.811627][T11890] bus_for_each_dev+0x23e/0x2c0 [ 590.811647][T11890] ? __pfx___driver_attach+0x10/0x10 [ 590.811672][T11890] ? __pfx_bus_for_each_dev+0x10/0x10 [ 590.811691][T11890] ? rt_spin_unlock+0x157/0x200 [ 590.811712][T11890] ? rt_spin_unlock+0x163/0x200 [ 590.811731][T11890] bus_add_driver+0x348/0x670 [ 590.811754][T11890] driver_register+0x23a/0x320 [ 590.811771][T11890] usb_gadget_register_driver_owner+0xf9/0x270 [ 590.811800][T11890] raw_ioctl+0x1503/0x40d0 [ 590.811891][T11890] ? tomoyo_path_number_perm+0x219/0x5f0 [ 590.811914][T11890] ? do_vfs_ioctl+0x1184/0x1550 [ 590.811941][T11890] ? __pfx_raw_ioctl+0x10/0x10 [ 590.811966][T11890] ? handle_mm_fault+0x1326/0x13f0 [ 590.811991][T11890] ? hook_file_ioctl+0x1f3/0x600 [ 590.812021][T11890] ? __asan_memset+0x22/0x50 [ 590.812053][T11890] ? smack_file_ioctl+0x263/0x360 [ 590.812072][T11890] ? __pfx_smack_file_ioctl+0x10/0x10 [ 590.812094][T11890] ? __fget_files+0x2a/0x420 [ 590.812112][T11890] ? __fget_files+0x3a8/0x420 [ 590.812130][T11890] ? __fget_files+0x2a/0x420 [ 590.812150][T11890] ? bpf_lsm_file_ioctl+0x9/0x20 [ 590.812167][T11890] ? __pfx_raw_ioctl+0x10/0x10 [ 590.812187][T11890] __se_sys_ioctl+0xff/0x170 [ 590.812211][T11890] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 590.812231][T11890] do_syscall_64+0x174/0x580 [ 590.812255][T11890] ? trace_irq_disable+0x3b/0x140 [ 590.812273][T11890] ? clear_bhb_loop+0x40/0x90 [ 590.812294][T11890] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 590.812312][T11890] RIP: 0033:0x7f2ce006dcab [ 590.812328][T11890] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 590.812344][T11890] RSP: 002b:00007f2cde2c3f00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 590.812363][T11890] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f2ce006dcab [ 590.812377][T11890] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000003 [ 590.812389][T11890] RBP: 00007f2cde2c4fd0 R08: 0000000000000001 R09: 00000000ffffffff [ 590.812401][T11890] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 590.812412][T11890] R13: 0000200000000180 R14: 0000000000000005 R15: 0000000000000000 [ 590.812432][T11890] [ 590.812444][T11890] Modules linked in: [ 590.812481][T11890] ---[ end trace 0000000000000000 ]--- [ 590.812542][T11890] RIP: 0010:dummy_udc_start+0xd0/0x1f0 [ 590.812574][T11890] Code: 41 83 ff 03 74 18 41 83 ff 05 0f 85 93 00 00 00 e8 a5 12 98 fa eb 0c e8 9e 12 98 fa eb 05 e8 97 12 98 fa 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 11 86 01 fb 4d 8b 36 4c 89 f7 e8 [ 590.812593][T11890] RSP: 0018:ffffc90007c97830 EFLAGS: 00010246 [ 590.812612][T11890] RAX: 0000000000000000 RBX: ffff888029cf2090 RCX: 0000000000080000 [ 590.812628][T11890] RDX: ffffc90012921000 RSI: 0000000000001d21 RDI: 0000000000001d22 [ 590.812692][T11890] RBP: ffff88802a57f000 R08: ffff8880603d9f00 R09: 0000000000000004 [ 590.812711][T11890] R10: 0000000000000100 R11: 0000000000000005 R12: dffffc0000000000 [ 590.812727][T11890] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000003 [ 590.812741][T11890] FS: 00007f2cde2c66c0(0000) GS:ffff888125c3e000(0000) knlGS:0000000000000000 [ 590.812762][T11890] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 590.812779][T11890] CR2: 00007f2ce0057180 CR3: 000000002c23e000 CR4: 00000000003526f0 [ 590.812803][T11890] Kernel panic - not syncing: Fatal exception [ 590.813439][T11890] Kernel Offset: disabled