last executing test programs: 7.13304614s ago: executing program 1 (id=2780): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000000c0)={0x24, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x22, 0x21, {[@global=@item_012={0x2, 0x1, 0x9, "231b"}, @global=@item_012={0x1, 0x1, 0x2, "e5"}, @global=@item_4={0x3, 0x1, 0x7, "0100"}, @local=@item_012={0x2, 0x2, 0x2, "9006"}, @main=@item_4={0x3, 0x0, 0x9, "749e821d"}, @local=@item_4={0x3, 0x2, 0xa, "8b923659"}, @local=@item_4={0x3, 0x2, 0xa, "09007a15"}, @main=@item_4={0x3, 0x0, 0x9, "85900eb7"}]}}, 0x0}, 0x0) 5.355679977s ago: executing program 1 (id=2791): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000300)={0x1, 0x0, [{0x486, 0x0, 0x3}]}) r3 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x458, 0x5013, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, "", [{{0x9, 0x4, 0x0, 0x10, 0x3, 0x3, 0x0, 0x6, 0x0, {0x9, 0x21, 0x222, 0x0, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0x0, 0x38, 0xc6}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) semctl$IPC_INFO(0x0, 0x2, 0x3, &(0x7f0000000000)=""/141) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000000), 0x208e24b) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r6, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x40020}, 0x80) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r6, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r8 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r9 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r11 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r11, &(0x7f0000000200)={0x0, 0x5f, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r10, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) r12 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r12, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r10, {0x0, 0xe}, {0x6, 0xffff}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40001}, 0x8010) r13 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r13, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {0x1, 0x3}, {0x0, 0x2}, {0x8, 0xfff1}}}, 0x24}}, 0x40004) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xd) preadv(r6, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x4d, 0x5, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) 5.14014042s ago: executing program 4 (id=2794): r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x1) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_SET(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x3c, r1, 0x205, 0xffffffec, 0x25dfdbfd, {}, [@ETHTOOL_A_CHANNELS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_CHANNELS_TX_COUNT={0x8, 0x7, 0x4}, @ETHTOOL_A_CHANNELS_COMBINED_COUNT={0x8, 0x9, 0xfffff801}]}, 0x3c}}, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r2 = syz_open_dev$vbi(&(0x7f0000000340), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(r2, 0xc0945662, &(0x7f0000000100)={0x0, 0x0, '\x00', {0x0, @bt={0xe4d4, 0x4, 0x1, 0x1, 0x0, 0x4, 0x4, 0x800, 0x8, 0x8, 0x595, 0xcc4f, 0x80, 0x9cb, 0x11, 0x1, {0x33}, 0x1}}}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x14, 0x7, 0x6, 0x201, 0x0, 0x0, {0xa, 0x0, 0xa}}, 0x14}, 0x1, 0x0, 0x0, 0x4008888}, 0x24008000) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x5ac, 0x262, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x15d7eebbc78c1761, 0x1, "", [{{0x9, 0x4, 0x0, 0x58, 0x9, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0xfffd, 0x3, 0x1, {0x22, 0x102c}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x10, 0x4, 0x44}}}}}]}}]}}, 0x0) ioctl$F2FS_IOC_START_VOLATILE_WRITE(r6, 0xf503, 0x0) sendmsg$TIPC_NL_LINK_SET(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)={0x38, r5, 0x601, 0x0, 0x25dfdbff, {}, [@TIPC_NLA_LINK={0x24, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xa1}]}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x20044885}, 0x0) r7 = fsmount(r0, 0x0, 0x86) r8 = add_key$keyring(&(0x7f0000002280), &(0x7f00000022c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffb) pipe2$watch_queue(&(0x7f0000002300)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r8, r9, 0x6f) r10 = add_key$fscrypt_provisioning(&(0x7f0000002a40), &(0x7f0000002a80)={'syz', 0x2}, &(0x7f0000002ac0)={0x2, 0x0, @b}, 0x48, r8) keyctl$KEYCTL_MOVE(0x1e, r10, r8, 0xfffffffffffffffb, 0x1) fchdir(r7) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x20) mkdir(&(0x7f0000000680)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) syz_emit_ethernet(0x3c2, &(0x7f0000000d80)={@link_local, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x38c, 0x3a, 0xff, @dev, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, [{0x0, 0xa, "a741e54006598080a8030000004023493b87aafaff0500ffffffe723732472eefa45ad96579269748e254c1e4a948b580a9bc430d3be27df3e34060000ca0a5c15b37adac15084dbaf736b41e5af1802"}, {0x0, 0x1, "000100000000001995319c08"}, {0x3, 0x18, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978"}, {0x0, 0x1d, "06aa85616177c61bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0822a18b79f7c5eba31fb68b2d734a6671e27182aee4df24a4a5c6186c0d3baa75af390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5acaa556b9f30dcab2b90aa235a670670ffc5dc49dfb58d89310000000000"}, {0x3, 0xb, "d47ae6e8805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4619f91394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1a9f51a948b5b303f4f003"}, {0x21, 0x8, "fcf98a102ec1876d4e6fa3b20519bbaa8a029cee00b8d3485e3b63ed09bdb5f143b1481d2c2e2e3fa47c0cb7aafe68a356f542b043059ff05932e740e077e1d16212fb"}, {0x0, 0x14, "5e14f0e74d2d42cfb3f27fafb60845f90b6dfc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d18065daa76ffff9ef083611c9f6ae2e1eb3d8bf9c6ab2642c4828288e62afbf03269f1f98aea6a58cf45d7c5fdaabc2c676d8800871a6aa54155dea2d995cb22c9924e0ad38c6967052cc7786d779b8353aac33a57d79b05613a12328f61129017fb632dbf04542188b196e213408c258a6f"}, {0x0, 0x5, "d5170000dce9674a36da018dff16e70b8b14c4b7a94fe18e88605aa6be1a02c226a6bce65f81ed"}]}}}}}}, 0x0) rename(&(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000200)='./file0\x00') 4.790902485s ago: executing program 0 (id=2797): openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ff1000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ff3000/0x1000)=nil, &(0x7f0000ff1000/0x1000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xc89d, 0xc000, 0xa, 0x3c}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xfff1, 0xfff0}, {0xe, 0xffff}}}, 0x24}}, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3, &(0x7f0000000000)=0x6, 0x4) io_uring_enter(r0, 0x2219, 0x7721, 0x96, 0x0, 0x0) r1 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, 0x0, &(0x7f0000000040)) 4.473447089s ago: executing program 0 (id=2801): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) syz_emit_vhci(&(0x7f00000000c0)=@HCI_VENDOR_PKT, 0x2) r1 = dup(r0) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x48043) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000100)={0x0, 0xa, 0x10}, 0xc) r2 = dup(r0) write$binfmt_script(r1, &(0x7f0000000140)={'#! ', './file0'}, 0xb) futex(&(0x7f00000040c0), 0x6, 0x0, 0x0, 0x0, 0x0) r3 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) syz_usb_control_io(r3, 0x0, &(0x7f0000000300)={0x84, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r4, 0x5b23, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) futex(&(0x7f00000040c0), 0x86, 0x0, 0x0, 0x0, 0x40) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='ip6gretap0\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000400)={0x0, @in={{0x2, 0x4e24, @empty}}, 0x8003, 0xbffc, 0xe652, 0x5, 0x134, 0x48, 0xff}, 0x9c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0xce20, 0x6, @private0={0xfc, 0x0, '\x00', 0x1}, 0x2d}}, 0x6fcd, 0x1, 0xf06, 0x3, 0x95, 0x7c, 0x9}, 0x9c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e60, 0xeffffff2, @empty, 0x5}}, 0x10001fc, 0x6, 0xffff1896, 0x3, 0x26, 0xffffffb9, 0x1a}, 0x9c) recvmmsg(r1, &(0x7f00000035c0)=[{{&(0x7f00000004c0)=@l2tp={0x2, 0x0, @private}, 0x80, &(0x7f0000000600)=[{&(0x7f0000000540)=""/149, 0x95}], 0x1, &(0x7f0000000640)=""/209, 0xd1}, 0x3}, {{0x0, 0x0, &(0x7f0000000740)}, 0x90}, {{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000840)=""/130, 0x82}], 0x1, &(0x7f0000000940)=""/110, 0x6e}, 0x120}, {{0x0, 0x0, &(0x7f0000001a80)=[{&(0x7f00000009c0)=""/4096, 0x1000}, {&(0x7f00000019c0)=""/143, 0x8f}], 0x2, &(0x7f0000001ac0)=""/237, 0xed}, 0x8}, {{0x0, 0x0, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/169, 0xa9}], 0x1, &(0x7f0000001cc0)=""/120, 0x78}, 0x9}, {{&(0x7f0000001d40)=@qipcrtr, 0x80, &(0x7f00000032c0)=[{&(0x7f0000001dc0)=""/216, 0xd8}, {&(0x7f0000001ec0)}, {&(0x7f0000001f00)=""/4096, 0x1000}, {&(0x7f0000002f00)=""/32, 0x20}, {&(0x7f0000002f40)=""/239, 0xef}, {&(0x7f0000003040)=""/214, 0xd6}, {&(0x7f0000003140)=""/255, 0xff}, {&(0x7f0000003240)=""/88, 0x58}], 0x8, &(0x7f0000003340)=""/19, 0x13}, 0x7}, {{&(0x7f0000003380)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003500)=[{&(0x7f0000003400)=""/56, 0x38}, {&(0x7f0000003440)=""/109, 0x6d}, {&(0x7f00000034c0)=""/16, 0x10}], 0x3, &(0x7f0000003540)=""/70, 0x46}, 0x3}], 0x7, 0x0, &(0x7f0000003780)={0x0, 0x989680}) 3.720723472s ago: executing program 3 (id=2804): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) (async) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) fchdir(r0) (async, rerun: 64) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) (async, rerun: 64) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = io_uring_setup(0x524, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) (async, rerun: 64) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, 0x0}, 0x0) (rerun: 64) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000000)={'veth0_to_hsr\x00', 0x0}) (async, rerun: 64) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) (async, rerun: 64) close(r0) (async) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) removexattr(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)=@known='system.advise\x00') 3.659026156s ago: executing program 4 (id=2806): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x82, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000280)={r0, 0x5}, &(0x7f00000002c0)=0x8) 3.53940177s ago: executing program 3 (id=2807): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb49, 0x9, 0xfffffffffffffff7, 0x0, 0x3e}, 0x0) r0 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x5) ioctl$SG_IO(r0, 0x2285, 0x0) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000340)="aefdda9d240300005a90f57f07703aeff0f64ebbee07962c22772e11b44e65d76641cb010052f436dd2a", 0x2a}], 0x1) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="5800000010003b1500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000380012800b00010065727370616e000028000280080015004b25120006000f00000000000400120006000e00000000000500160001"], 0x58}}, 0x0) r8 = dup(r6) syz_ublk_setup_queues(r8, r5, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x255}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6941, 0x8, 0x2000, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x35bc, 0x1, 0x0, 0x30b}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1cf, 0x0, 0x0, 0x1c3, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8200, 0xfffffffe, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0], 0x48) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000001fc0)=@delchain={0x5e4, 0x65, 0x400, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x1, 0x2}, {0x0, 0x1}, {0x5}}, [@filter_kind_options=@f_bpf={{0x8}, {0x5b8, 0x2, [@TCA_BPF_ACT={0x5b4, 0x1, [@m_bpf={0x130, 0x11, 0x0, 0x0, {{0x8}, {0x38, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_NAME={0x5, 0x6, '\x00'}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0xffffffff, 0x3, 0xffffffffffffffff, 0x10001, 0x6}}]}, {0xd1, 0x6, "a41f25d22b1bae1b6bfb4a42ad5ba9db462fca41280c331f630e2c9f0be1093117392575082305ebc27660464ef802792ce06133244235023f0f4882fc0a47f4d5e499a8857cd81b0e6fda422cbc53ad098872214190756df6bbd0e760248aa97e200702fd569bd27d4a70df1d4a123ffc42d2592c81751e15e260622f14aeaaca5dc8acab93651fdd1d5614d98f28fc76d402e1028d91028270a2722b141a9140c47e37d068e7193d463a6444e424bc792ab1295f79842a501700a5cc2f71eefaf131a98821e712b03d552c87"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}, @m_xt={0x144, 0x5, 0x0, 0x0, {{0x7}, {0x30, 0x2, 0x0, 0x1, [@TCA_IPT_TARG={0x2a, 0x6, {0x7, 'raw\x00', 0x7, 0x100}}]}, {0xed, 0x6, "a5fd64840366fd7ad44f3f053221ded9ced495590e2bc8690a2765e56ded8425cb3eb0e04bbcfec50e639bf373167e617b24eccd260f28bb850873b1e2154b158987d6e585e10ffeaba32641bae47de041e1169d8e4a65b8ce3633a4469c93c5228320c572237d92a9ae6bbc2d2bd3a2d1e27de283017ecf9fca6b2cd8a119dee59702830717b694625f60f5c81f688775c5e292f76a0ffa39e1d2cabd639d1c111c01e0d2f9faa220154db33399242bca9f4fac65c74cb6264c28ac7a50037564c7b417fb61d617d212ab3243c30e0e82d9a12651b74553d539b991a302489af94626e5aac41c53b2"}, {0xc, 0x7, {0x1, 0xeb0757422c733451}}, {0xc, 0x8, {0x3, 0x3}}}}, @m_bpf={0xfc, 0x8, 0x0, 0x0, {{0x8}, {0x54, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_OPS={0x14, 0x4, [{0xa3b7, 0x9, 0xb, 0x7}, {0x28a3, 0x4, 0x4, 0xfffffffa}]}, @TCA_ACT_BPF_OPS={0x2c, 0x4, [{0x0, 0x0, 0x9, 0xffff0000}, {0xb, 0xf6, 0x5, 0xfffffffc}, {0x401, 0xb0, 0x32}, {0x6092, 0x70, 0x6, 0x1ff}, {0xfff9, 0x2, 0xf7}]}]}, {0x81, 0x6, "5d3aee85a6264cff4a2163adaec321e008985cfa435b8922eeb16f1932265618158a3fe72c442a68b182e8f673f9251a03dc831c5947be17ca906c3dcb99adb55bc5f0ad8886f235f45d7e29bb727715f2e7a3200ac63eb79f7a023835874514b60b0177c40370157c0c21b37875e7e4a2e75b3cc54be7d719fa695469"}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}, @m_tunnel_key={0xb8, 0x8, 0x0, 0x0, {{0xf}, {0x4}, {0x85, 0x6, "51719d53a2b05eda58a80a40d29b01394b8749d7d9ef9f47cce75187b6f333f4bfe797fa4227bf38cf0b71e1b4888d8d1ed410a788c182ba498076ca9ab3d63a8f29175d44a2e8364296c34ac0cdb8972288ecf6515bec4861a53e1e18e54679f5666b0536d0a008aa9b3be1f5e00c4c72460249c372de16eb2cfc15714543d6f3"}, {0xc}, {0xc, 0x8, {0x3, 0xddc47d017e85c037}}}}, @m_xt={0x188, 0x13, 0x0, 0x0, {{0x7}, {0x160, 0x2, 0x0, 0x1, [@TCA_IPT_TARG={0x2a, 0x6, {0x9, 'nat\x00', 0xef, 0x7}}, @TCA_IPT_TABLE={0x24, 0x1, 'security\x00'}, @TCA_IPT_TARG={0x101, 0x6, {0x8, 'filter\x00', 0xd, 0x6ccd, "51100666dd78f1337c421065ba00caa97aaa8e1aa207a78c6d7e2a3e620334de1a64a8d40af7536c5a07a1997c6fd28e7ed1f866f9454e1014a5129fbeaf1a76cb7b54d80907f7d86c39ff782b12b0422666997d539a25e55b0591b44929ef0dcea5434727f1d8aa8d1ec3a7d56965dae69f90f152f907a0ab28fc8d30bcdb763cd5f45e6a19be6dae4c5659ea76f0641d19c50157b11a5d9f8f9f5d0efd5d7395e68091c82db3f276f07384e742f6eb8057fef83bef07c6aa6d1f59fcb13c45fc7005a222e6fa0e7c9c3fe6e6ce9aa661d734ae3b49d5"}}, @TCA_IPT_INDEX={0x8, 0x3, 0x2}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}]}]}}]}, 0x5e4}, 0x1, 0x0, 0x0, 0x2404c080}, 0x20000080) r9 = socket(0x10, 0x803, 0x0) sendto(r9, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) r10 = socket(0x11, 0x80a, 0x0) r11 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x2, 0x80000) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r11, 0xc0045540, &(0x7f0000000040)=0x7) bind$inet6(r10, 0x0, 0x0) r12 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r12, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r12, 0x7a0, &(0x7f0000000340)={@local}) ioctl$IOCTL_VMCI_QUEUEPAIR_SETPF(r12, 0x7a9, &(0x7f0000000000)={{@hyper, 0xae}, 0x6, 0x0, 0xa, 0x9, 0x9, 0x6, 0x200, 0xff}) recvmmsg(r9, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) 3.531483763s ago: executing program 2 (id=2808): r0 = syz_open_procfs(0x0, &(0x7f0000000040)='oom_score_adj\x00') mremap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x400000, 0x3, &(0x7f0000c00000/0x400000)=nil) write$binfmt_format(r0, &(0x7f0000000140)='1\x00', 0x2) socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000300)={@empty, @empty, @mcast1, 0x9, 0x0, 0x0, 0x500, 0x0, 0x4d30356, r2}) socket(0x2b, 0x1, 0x1) syz_usb_connect(0x5, 0x46, &(0x7f0000000600)=ANY=[@ANYBLOB="1201100335fe6510ca1a8eb232920102030109023400010d0190020904329e0201039e0809050806100006040802230725010305f804090507020002040266072a0101030300b8eb"], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0}) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r6, 0x0) r7 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) ioctl$KVM_RUN(r8, 0xae80, 0x0) setrlimit(0xf, &(0x7f0000000000)={0x1, 0x5}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x60440a8}, 0x800) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/consoles\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x18, 0x0, 0x0, 0x0, 0xb, 0x0, 0x0, 0x41100, 0x6e, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xf}, 0x94) 3.530713779s ago: executing program 4 (id=2809): mremap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000001000/0x4000)=nil) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0xd81c, 0x10103, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000002c0), 0x3) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r3 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r3, 0xc0045516, &(0x7f00000001c0)=0x7) read(r3, &(0x7f0000001140)=""/4096, 0x48) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x2, 0x4) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x2000010, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r4, &(0x7f0000009200)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r4, &(0x7f0000000040)={0x50, 0x0, r5, {0x7, 0x1f, 0x9, 0x9104, 0x40, 0x0, 0x6, 0x3fffff, 0x0, 0x0, 0x40}}, 0x50) syz_fuse_handle_req(r4, &(0x7f00000021c0)="d56cea33946c0eae3241d3604bfce89adddb2eb96960338db7572fa254eb7c69dc0cb526989630e26224c258c8d70ccacc5564d67723f4756c0399174c5460c4995942d24092c36dc820e97344798b5bb45423f853bf50e374323abacf0388cd091016b7a3d7843f4d3ae1658bd34d967e3323a64908442788dbc99c1f4248da53fb5be2c8001236b994ca594e3b3c588beaf3cb1c32c072d768b9e665e7d87044fdfc1fd6452593e6793963153f3850bf85042a5c139799ba8f6cb8d877fc436c4f1601270d6e29d60a4c80d6315e46f4219494ce897127d0b76f5d681e90f4e9282468ef7993cd92076aed266c1db8b81b93adc4969c9b89b32b8768c9f39f2d148e933dbb651746a9364f49986ef73b4c29f647b82b83216bb8179fe5346fdacdc5fda4bd48875cd2f1cf57a0c9a91e059446bac310a6d68948675c35a8e442168fd84d78d9800e5b05bdbce3a6eac65bee7279a3628f2a08931d3d52ce490652c20f8ae529eaf24bf421dad976c68b234ee6f6210c9f9aac3a55c6939d6aa3805b95619546264ff3ff82d0dc690e8ead61b6ed528c3c117cd771a3b7feb214ce8d720640d97f14b399b7f46dc4aad83117e8e642ccb117d13f345536fc3801c124cfaf8aa7aafff6c8df3fdd4469c077eccbd8ddacad80d9113dfde26ae67b226185743b2d53667fb3016fe114f87484ab614ddf0887c4b2c85351ab21a0ece6c066a154b38b4d7c1792d2db2cc5f8ceb42078187949d354b7a08d1529f3d10814757179c860db031dad4a3dc13ca01d1013238ed5f7a9674fcc77f0d34e2118fb851c970d86ecf9de1cfdb8d3ab197480e263c3207c3d7ebe17f9547c7c56b08e83de875294d0fd68df1926ecac24350b2c70bd73e14122ed480c564353d34049e67c26036fc35d04022cd35d6ac00756d3b8550bb22ae80a4bd630a00268d07fa249b0bf545dfbf01bea2f12b30738c6e13156244eb24e6d69ba7c3acdbbefe8bbc06b821aebf836ca07a3cc7b6b24686ed8f3b23085c893e72188b797651c5ab5cceb1465414a325f793a3af6d06eed7eb734ad05bc1f6619e8485259f570a482a67273ee01fe15dd938afce026f1111c7a38ed6d1aba34f009ce1e99140fd0db2de74150541fd48dd2ec5b1d15669de2ffe3a198184b6186ccda31aa64c585ff8cb65b67fe1455753895a88b6ab4c6bf1bb8329739178147e6f15801bfa707bd9ec9da662573ce07af684bb7c880a7d63b0a0a7300881408c44e95c679ea32b0eab845d0b333f245e8d6006258678704aa8cccdaf80cc46138d5b7a0804fdfa34c91d61a0d2fa6c62e7d1a675e5743f845ab40ea5df0182d6eb9781905c94751c75a411699a76f48433142c5f109d5dfddcc0b1dc6254efd5ea50d6ffbc7b9ca031e1a0123844b63c48b964645c6d24707582825e219bcd61677ed4fc45ee1f4be91b4c1b856d65a86acf22b8b0d588bc473248ac040326b1490c2fea24bc0c0a721e2ed63e39973cd4d38df1001dba9b9d995c229655dd26f3cd3d64077ec111e2c370717cb4cd068e0d3a52f1027d3df953e1f1ac768a7215a3695722b1b6714ce43801451a9532212b651d073c780d61712aebadd145c1cd95c1dc0dcf51850046ae5771e365f45858a36e48afe563ec0afee3803ff6a35bc25217b53eda39bb813b8d3d728c21a0b80d014003143666c0d1398cc46a01aaaf97117edda217f984010e7c5cf32535a669d4f11f6b70e3a3b823987ef7c9f878415063bf05205e13bcf7acb287bd0bb0fce77529a711f0ed145ea2ecf2194658dff17c5681cf8c7ad8521d235a705292af4878b3f124be2df661026c091d6c07aae1a74c919f7478d1083f70b3a0fe00c2e220ab998b4595268b6f7cabbfc85e59dfb6ab7a794cd3fd70d5cc4d70ca933a4452df5a345cb31f3267de53519ba39c915d492cd4652843f1d30a5fb311e3b5d868347969f013c5e3b4841b22240abcb61a14ff567186766ce8f6ae64877f672835dbff4fcf19c8230d8a402397630effb698a8b0c9a28ae028d7938ffde488fd64113085bce504cd0551e0eb3730c3f781cbecf0c41d2338766d3f6096661c1f1bec3162b8a0c4099fccd9480e821df8782c2e070530befb62bccd8539fe9dc7d8d3f9bded1bb34db3f2d6050885c8f1d57f5e603f629de7491f5fd9fafcceb565abeaec838b10a763a00a4607d4330bdcedc066d8cf9790d806e03c219866bb8f053a6e602645436d1f469df1d5008f5dcd4bdb7ce5b76ec015a8f4693cb2a63ceb2be00bcf221f0ca32db4efaf8f7022622b335fa8dea4afdd86be10be6c4d66e5f57416add4480509cb98cf31cdda84644eeb782eea041d4bc0e005a20bccc3c4a08cefcdb91cc2c61d9231c4e36e96f6edd2133f9b34e7da90ce20d1c60ff223c6a204bb942766a359b923573bbbaf2a827d79e4f649e79a840216ac4ddb3409c94e71ff08d109bc3f0cf6583219de7d7131a956f835ecf5c131a0b1e056a86d800a0204243f3b695029578c064306a31db53f28a8f0c0302486cd05970904e9b5c53100ac1aabb3110a89820e4d8307c3d46084999d0456c53fec61a9242b486eb41a90f3300fdfd0d8a472e8da7a842588721d1df1f5e4cc425efebc75a904ef4cc881346a4bc23eef4d492e3efccebab86ae4213f42671370579ee7f8341396e9515619e100a8fae2c5cba0139a088579ece7a603c8b8bab9998223fe862dff8480aeaa5970c90b894e5f71c2784e4dfd50ed3e9ed91036e8356c09464de13b4a95227203133b2c2c71cd6323492f083bda58ad7721b6666b9cd93f93f0288482813fd8aade02cca81cd35257e023504ac4f86be1c7a810b67c6d7077f5cdbd305b618a05c03d196894bfb1a6ff511e59ac8ce45d16cee95e1de0797a543728caaa43e5ae42a12b6bb7910d18d4e1ea89d264491287eb23a76095a12a39c46a7c85349e2969edaed3c1fa6a2150494f63f4c98c65fcdd650ac7424ac1ae64421294356ac1e4dbf9d4c817f081f4f7751ebf56788d799bac29dc0bfe83ead7ab3e338b8b84df4cad2b549aaac4e6048a6fa8f8f6f1f7e0e51c8b3c872f18c466e590222b03230f46bc8e9a0171bbd2096c7a480d6a6f29bd74b60105bebda42e59cc830c4b31f6c52687b4ec2ba869149ae363d711d099f94ceade1ada193e931ed9aea0a280ed5f25ad5ab3b4083f140ca17b43e5f6aef2c24a28a0262c80a040187e052ea7d54a528b6fcc176ed3afc07fe6a661d050fb4a3a6abfa3dac5f3230540b45af060781cb5499c2894d6a4a2bf908ddd48d6b34207f56c31229e206c88db3552ceb6e82a0fa2bf7f97baf603d37d6a8b1f2b1f5f95b251129ed05351681908b7cf5cf6cc86dd854174cc19713b4d262b021952b6da5f20f57bbacca62f5b7124409aa625bbea59819baebc1bc2dd188feba48c998d0dbed60d44b8a4f0ac28f6c1c8c9998f7406f1a34e4ce902be2420f7ff51a5ab3b1faa86ab2ec1edbea2493cae090abde43ff27d685c993dedb24eb255772cc56fbd104f4f5275f10d54d7cacb8cbf188ae1a4d29ea880068fb2696b3ba6e8a7c15939e1f7c394ab4bd4c4bef2383121cbeb18646a8e013d570cee3eeecd7fbe84a619f8aa2e34f2e1e9b99d0c7d7d179d9df8d2e2f1cd7ba2c7e60166dc14e5e4ed9c41195935e2884b5bd0057ed0155a5d4c6482e8f554e4cd0d0aef7d6487801ab54d54eb41755d833ab83883b40f47595063ad2a0fee5c661f86b8ab04ad0047d988ad86b3c520eb78dc3d750a57e777f5d766349f1a687e090f744206cb5d048346061b414060f6826d8a884e93f73f1f1f4cb8bd6e8d1215d436d390dbda35b555f550e11e6d8008fce1c429bd9bbd04a1fbb9de28663c1be4d8d7e506bc681ada28a69014b972919b5f70cbb770349324c9af0b7ee7ff4cc8bfe807fb9faa0a69498448b22192d578a1e82582b943051beb543ddca8b643ee6c76ee32278aa8bc92b44a8439a24ed5040545349ab05e831d4511a8da03ca539659585b2267a73775f1cb7c2c5548d3508c896f99a8e5cb55160ab1267e320ac2d7c8f8b57079dd14d301636a1374e24541f8d453978998ed256b381bcf638bb372ce1ebefb341656c02f4092a7667ffec5505e4938dcb03d404654430e244f9f7f7d0fb4189a93f7c2bd7a4fcb3ccff79e41a98adcac3e4c19eebebaec15bd8cea1df0e509cdef62ae10c66734d162caf35a6e511baa717f769c2e449892224fa8ae78de9138cf6ea1d939998a8cb68b0e83cf604e03b99634796d3d495e4617f8fdd9764631e7ed6eafa797deb1159259777bf2915d48b63286f6d6528ad4ca5783609263d9a03aad41ec8ef1e2e1e77734d27229f801192be238468854945c20dab4e1baff9dd593361efda1de95e04561d33cd73a45dff5f85b2e85b0747a49345ac8d38add8ef9c14685eb3d3432f3f994e3ddd4e45b16005870485253afc4f08d8a6d8023b722284d11d56c6ff9209a5bacb7ce1708244bd21878b8cd5c13ab453bd589f6196322de9faede39ce6f94c75d008d2d7ced27a2375cc62c3d5c15c1c4301a01299d8f4c41e5a44e4130e9555a356d6b19728c7d3c86cb9a1ddf906ab63a9447f8233bcd09bd74cf9749f085f0c4689ef40dbc41a7a299f0f891d9d0d3e39409d4d774da53bfb6e8ce668ce50885558e909add2cb9bda2f7e9232541b1a7f742a99740f486ef4f7c98e4052f2da705c56a18d5a8289ae6cbb9dc7de13a8cf420b7a930abaae813b40517d84ae984dfc94cd1021e0e4a7a9e7de841018d474083ca28a829ee03fe625cafcbedadcdef6621ccd679fcd9c9a9ab2136211f8c9a679895aa39facf2d6668e5098b3dd8e0ad78d8caf250dc38f2c9518bccb353ef3418d3906827514c1959d58344ee11a0ef1c1424495cc1a9910187685a47d6dd91f07e5081c5ac3f1b6e363069694dd9072684c5ab0ba56157c10f5fa8409e5bc43b38b31f24a306ca5f7e3de9a392eac1984e877ecb3dfd044f1449b4ae9b586051b1780c0ce462919f4a4b54ad8011d013c3962fc6697d33c2dc6771fec664c82cb16144619b207deb4391866d6c1976b945c5959d19018f15376ce3b05666747743527f22b54171da4dabee2f4e469a5521067de4f92e2bad02e15e812b6cbd27ec88a9eccf600ce7f5643392da9ff6b6412f8e7c68d8c8b9e0006e41777e2a1363a9556befbbb110dff3a84b179da3838acde0b25f53798733a9fb463d76b630aef7c8a43f6219482b34b893fd99cf3a013ecefde7c5c6528e304c1868ff3fd8dd5aba348a05dc950b1c4c281cbb28b800d6d0da180fdee06ec3bad6f97180295ed1d77078156a885b5b0c501ea563e8871adb97dd6052de0ab369bf2d98f434bb2d172d9967bb73d3eba6b52bb8d55d8963bf58d310afedb51c0f94c7814b6da30fd8056ab7be74ac31b1b75c217e3ab93eadcb2d253e5d8bbe47c0f1a411a9e502cf4301d898d905cd5db828e56a722394fa11cca64a03a42e7fc1b3481b71ca0b6a3d9bd1fc8229f7f9d3e6aa0d48051942579fb759201d4715db9a2d399e0745a66dbbd571accf1f2e15573ce832e91bd1f042ab758d9ec13e354f38454cc42668c8d60358916f7e937015f6c38732bcf6131ecde001892cb20fe47153e7e23b1cd2fc4a22662e7bde09f7df10fcbf475783fe23a0fdcb2c3bd8b28453ce523ac19ff77e68c3e9fa0193b796ea68f44132b3a96adebc04181e503f52be4778ef422ce3e6ca38514fa18b500ca518590479e8c73a7942dc2e237d82cda953ae1b296b97ee8ed62e2e755d6ddea7c0334e1b8d76c278bdc454724003106cb6fdc85340d1e784ac8b6551eaabc33c502163ce0d401627bd22ba6be90089372bfa3f91ee745e45844ef8dc0fe3936bef07f9c1d3aadfa4c8e99be6b038bed6beb9597add881da2acc1a3a471f500d68f639cd2bf6f4afab919a2cf747bcbb42b95684e8741b485c3297cf07c7bd98d6653421b61f701a06b82be0fbeecd32eb00feca9c5732bb5e565bccf8c9feb27a50760a785bbb50402768cbd458811e284a604b3374faf3480e1736743665617de9c32fd10e37105ac6dd5303f1a6dc78950bce56215c2a2f9e0ccbc0bf9fe8ccf7647ed29e2aa4948689d681a7a9fe582631338f3eea3df846f28564038ab75aa2a8ee5416b66ceeda9d8f56ecefe07f6a21ace83a2e15ad408d0a480f56708e3d1c96020b124c58f6ff5247f73aff7f77d389167650b8a0b98c97f87a1e5d6c08fa99874ff144bfa905e9da3812f010eeee00f3c9b594450faab5342e1b6e98fed5714a802b67b3e5b1964a62606aacb8222efd4980823f076675ae859e64de7b08f7a0b3d8bc829e1a93eb3b4975b4761cd7fa743e393da537c91f658ea2b23c94244498cdc4bc32c8b9859b9d9792eeabdce635b2d61c311949204826054dba0880505e2b53cc3521fa8b68bbba2ec05050bd3244c02752af1555625ddf50a3656c0043005c43c26a2dc907d5dd67efa831ad974151067b436a75fe99b8c94c9ca9737279fa1aaa09b0108c48c79c7e4ec1eeccfd43aa8e7ab6cacf5a956fc47d4ce77fe719d6eec1730d3e3b3be71d313f644177b6d16df0180848c28b850fbf71168a1ee4e5639bc46f2555b3984dbb91520538dfa6a1905abfb7238ff344d0a7d760f040718a57cfb56634e7de7584097f69f87630693bcf410796266cc3f50302feacfb556bad2506b7191023817527dfe5973101712bda922472076633133a11a76e8bc7d763a2cdaa53fa8d47d442fcc572f791d66d10d8d6a9058ecbbcd6d3dbe45d67b75e1091dd0368bea33ef0f56ba68885630429c24800922062e1066f2d4c4b795332ab03239548df4e6e01c432fe5eb29e8e63f6c7ba4f2edefa208c69e781786e4717c2f71dc2032a98cf1e6d66c10831e17ee776edc6b060ae20d025dc570a88e17da771acd32b7b93d46e43a917b8e2ba8232ad2707324b9b04dd8ee50c3c5a4372c0b1461ab2b7424faf00c7162bd8e8ffc7fadcb055403b0fa7087226ba4330e746af97a3f915f0b9e105759e81fe94a0df0cd6c324fb0b871491b5516c2fbc82c77b07159e3f4c0b7952b74cb4e203a69f241485191e1afc76d12a56db065b0513a41582f655340603c73cb39b728c97d1e919ecf963b91ec2282d25dc426db873394055beb0f9ba20545e2465ce2d0d962f42e1e4c79bdea4cd2829269ff7ef650bbeb5083d39dc7aad668af0b01c521192c548857473b29991f7bb917b5814fe945f4c3ed9bbe0563f4004b391b76860e9fd6b7c0baae82e4ac033f62a2c6ce6a2311b8700b06b5215e604a9b99d37e00450fc7790e893176e9fecda220f838a078a8ef7da7d499b1fe0eb8780c4b9705a6a10674e61b5c228fae1c13488f98c10c1792fa40229dba44b1cb534f9fab6a14407687761d738c91f4b8d4371a1de1a47bde0563a6fc88c4886be5d48c4cb89078c255eb1639598379daf50a672cbf4d8add2d4af6c02aeb1d0f86b611abd363409c7c7fc0b66f307ad3df24241fe06d0f7617d6c3987bb9e5d8f1712aebf095fad19b3b4fcb9cc4fb39012f333c4b040666259ee7bc43cff299a527a8914d71324e91c774b84e9392e615453e9fc648c539059b66f780c888892fe8b30eba799ed18fab08ebc3b9da8bc12a249456351bc0ebafc9f54d5d24697fb53eeb5e734527d690620989f605f57dc65a15a754d304be592acc616cd528b6986064b4457b96cf1fb0ab383a0585acf9887b18e1d6d3aff1e7f2328ea0313a2b36f6f79d671d9ddc4d34fb8fb55a596b2a16c63757083fb4bd01be2e1d82e47c5a44e052279097c5a18feae9884e102cf087611a3b94467ad61635dae6275974f6e6ca7a42ded0ee4577574d56b142853a8c955d92d1eb780de11dc9289acd193214ed4c9f5f26d0481cb3c0c0b8d4c9ad929c61ffeed66bf2e4f7018049593b99358d93559847d55654cee93da30f6578d2e295909791d227a12c09cd4a0edec25d3155086b64a787997a53265cbffb7fe6a2bfd589e12b4d0e21a600276e920397888443584aa99a06d7cfef8e68eeab8fa739c3d8fb74581ceff295110742e763320bed3a4be982b3ebed15ecde37e849aaa91959327d25149f38854ea1137f870aff99979e5e74cc9e45be12e3f0f9912a0955e718a4917e835bca50f43ce92a6bc60ed006b8f623fbacebbfb3dcb4fabd9941a5487c6f637de9a2005a6bc4062e1210a08a51d6f8a5e3f6f97fe90dc7e2e21d4d2f038c0fbc1918aa00e230a4a0e5c41a4808fb9a731271fcc1e73713c9592aa4b2ddccd0d13c3cb68d51166623153445c9ec955c6870dc8543c0684883186082e34ea5714febf8b46921015c3623220d17529896e1a6edac6e32fea2ba30db203238300353602c17dddad7608cad8170b520f6d9d32cdf0156a1de4e9b9eea78f73255ddc6da6994a6018ff900d9886590602ca6a072d8aa5645e2adac0744e2d5b2e1038c746635d5814692c3498aa9043b68f8ce79c44678c5a7d5bc26c085475853b229b2af3dc822ec58047f313c778aae2b64995148174e42908f3ecacd3921855790c0c5a25814416930293010b4f917979d837f4ef9d2d6dce804f5c0926244097746252124a6e0055559ffab197c38778f717362152af8f6dbf7ee03df050ab9b8909556691c2c2775f0f9c26a545db7ba698a4ce37de877705ea97ac0a002db274ea8360a4aa732c2d5e7417138c60cbea69d3b4993ada6a9d8f51d851543a6500a31bac5a057dbef498001f08a44e3c4141900e18b6d73c28c8c67dca805edeb5376384cefe75be1f127225e4d9724b7047d68fa2ed4629e91711a37c80158a07dbce78918931402b472a98a5d5c6b66a2d116314577e94298c37bc441499a9ecea132d87c5d305a0f8f0b3ed16f3b820941082c73b28391d8482ca0cfa78e1e09aa588b0eb1849c6c7916a6bbe56134a6bd93ea306dec125982628dea1db6d022d210627959e1dc819c841f173ed25f356909222e481a1ebb31185fbaeacbd359d2779efe4554ccdac7f4bcc528f656a45049331e16e9c0c796423ec9c7cba15c69d4a8a7741699910f33cc9798a8bf1e48182f08029a14d0131654fd388225d7509e1d7a484e9c7df34d1680bfc6b8d1f6f3920cc4113509fe42dfbd6b261000da9651f7e18088f6c2564472046e5eb7e8c9f8b5286a7452741a7103ced710bfb8e699fb8b1a85c0ae887cc06ef2ff9e2a2b1a77bb4d44ddd4a4e1ba60afcb92baaef108b60486d409889cbb2b1cc77ddff7e4b6caf8cf3488764d84bf3605eb9df709ac6cb36d1a3de89cdd6657f0e6b4009e6dac5d9be14f4ed997cf61e5aaec932520c321359cf286adf6e2dc3094794ae61a4f16089d06e3dc62c958950e73213c1e865c894fe7b8a30de65f5534a1e9c5d19ed49397980126322cb9c72c46a86d7487571300d85b3b5661555f20ab63a78f846c1b8f51a19610a11ffee44f7ccf0f1d67f4148b2c828d74c7f3993965c9067114467a71d242113a68574e28601fce343a023ecc68a72d75259f9a5dce144a7f61ef327192f6474d2bbd06fde3049fe7fb306ba3f54337008d7dbdeaf28a37a224e38ade23adb076cefd3148efcb62539a96d4dfc53f369e34c3d493ac3a5e8c8881133be630a2a906703da62ce7cc02ace9f666d6c3d4b9763a83548825ee1efb54ee3475b09e2616c5bdde3d193181bf020e8ac9ac25f32604b6c11de8ad1a15b9f908c6d7e79181aad1d741b7434aa92597a835c53b9e4b61d6069fa4ee921824d17c98784a8c04590f8d2cf877662b410cae4ebd1ba3616074c020d8cb6099a095735635490d318821310ddd016150edb80370b8d4e2f05557fd619b17192c13353cdae76d495821c610c8641e5b3dff1e7f2ea77b17810ca7975b8e36b7f501a8710b326ef92672096ef66598510902fe663e2a9ef00c3a052f1cfb1739fccb4371f8f28bb92654de5bf87cc2863e92e6d7e4b45d773f90f434eafc8f8398a48527af829a6cae359e7af5941bef158f53798058351107ce58f79ed21036770f6e10e7da92bbca25f369ee83a0f894bbf366a1361f8125b4ffd8e8b4d47ec68cd6b37c840cc5beb8cf65b2269ea1a0e9c371a571f30458ff8ad9bbf8723c19ddae1de5ca7461a436ffcd103c01a20f3252ba0965ee928cfb0d002b9aa4d4f20c805b77e67c8d991c4d07e5419bec9626a32c115d28253dd5f16c17182c1779edf49bdfe3823d87fec88929801163a27bfaeddfd8cdccae8cc3bfd6a9f2e2fec5971fa560c434debd434ff4d0058dcb05d9f3ac5193c458472d6d1685f9f46c8864900c5edbaeeee08971ee1c087f2e11467ff4766743bccf9e3414feedd6dcb904b92a05eec5de8db95444b920c995c770edcedcf7bffc48836c8f30037dde47f0e66fd79550de0ebc3c0c3eba0b66e2a353542eeb20397800e5f41635c5ec2f9a271461bcee8e570ddf945b186f15ab5cabe2a3123189935c6b9010b31732c425a9b2582b097486a5a7b1880b2f16104484e1ca83fa9c278b87e30e4b0cf6ed66c87a979c05683ac94a295d1c53e6f0975a079dd9a2825fdd6ae0926ba1a69f3f69f408eea9d00fbd43235a52c53d11963a611b81dd9f5e05582e1822398873e883662a64c225be19e0b85e102e23fb73d5dcb11435a5437d7418b0409f2e60793038f55ed54c79882b3a17e74ae2148bd558d131dbf446edeb0d05353492534e216761cfcf6582d066a8235a2bd5eb383350a52d7fc2761514e27b6125cb3e387c103dd62e31f5b789c217811c80ccbe3f10fec7a19ad32dc9271368b6d6ba549c45dfd8018507c40962b6ac6468c3078edb71d8ec7f728be8cc23dea1139ac30c2e8d0fc077280e420fbbffc896863db5f1e76922d7dd8e4479c1be822e74212c6f74765e108f916a1b83f6efc8ea54080e9a28b1ba5813a1fefddbe2d0cda413ee1463985b51b59f818f440c9b6a10e4ebf71d37995ae9694ba5867ca2eb2f7bf4e58d26149f2b25943fba216beb3de1f954bcf1bd32ce358b5d23023ab456ebbc493ead41e25b62b5b4ace6c5c18c9a8d512a9cbb4dd59f33663f6138d6b06bc8eb1ec9caccc0077b2e68e7a09d412dfa352e7e5c3942b710ab1648e16d0adda424d9fc2d15c619f4e8093c2b9521e4cdb3f22e655f52ce0fcc1bfd94e56cba8decadb68214451be53f9286c82d2a4912bd2394d1133be908409d791d6d8c2194ca37a76a38d6d0a1fced6478848891d9264cfc08fa849d720339ce00977cad8d9738372184098a7333dd1564d1d7754b4aa4afd6217585804159d31f53017869cb78b718c837b7fd176ce19e3d6996b6f055ed3ba7cd55b0349676c0c113c33d070081ce4ef29af156c4ac8ce760013688d0295d90271e23ef3ca10ec2b3b889855a153c867ce79297a10a02d21e5e8995fbc10d2f4d4bf521565376053b80937bfafaac688108f9962b7c72cf0111874ac8ae27d024ee2f9d57f15b9910a7486ef7542c6629fb0520c93a445542d", 0x2000, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0x26d01, 0x0) io_setup(0x202, &(0x7f0000000200)=0x0) io_submit(r7, 0x1, &(0x7f0000000700)=[&(0x7f0000000000)={0xfff0, 0x20000000, 0x4, 0x1, 0xc, r6, &(0x7f00000009c0)='1', 0x1, 0xf, 0x0, 0x0, r6}]) write$FUSE_DIRENT(r6, 0x0, 0x10) write$FUSE_NOTIFY_STORE(r4, &(0x7f00000000c0)=ANY=[@ANYBLOB="2d0000000400000000000000000000000100000000000000000000800000230005"], 0x2d) dup3(r6, r4, 0x80000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r3, 0xc1105517, &(0x7f0000000340)={{0x9, 0x0, 0x0, 0x7, 'syz0\x00'}, 0x6, 0x2, 0x4, 0x0, 0x0, 0x0, 'syz1\x00', 0x0}) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x4, 0x0, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) 2.857696078s ago: executing program 2 (id=2810): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x5}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000640)=ANY=[@ANYBLOB="2c0000001a0001000b000000000000000a000000000000000000000008001a00", @ANYRES32=0x0, @ANYBLOB="080019"], 0x2c}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x14, r2, 0x2fa77e8ce0582f97, 0x70bd2a, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0xc005}, 0x400c814) r3 = add_key(&(0x7f0000000000)='big_key\x00', 0x0, &(0x7f0000000140)="8b", 0x1, 0xfffffffffffffffe) keyctl$restrict_keyring(0x1d, r3, 0x0, &(0x7f0000000280)=')\'+\x00') add_key$keyring(&(0x7f0000000080), &(0x7f0000000240)={'syz', 0x1}, 0x0, 0x0, r3) add_key$keyring(&(0x7f00000002c0), &(0x7f0000000340)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) r4 = socket$kcm(0xa, 0x2, 0x0) r5 = socket(0x2, 0x80805, 0x0) r6 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r6, 0x0, 0x482, &(0x7f0000000140)={0x84, @rand_addr=0x64010105, 0x4e22, 0x3, 'rr\x00', 0x30, 0x80001, 0x6f}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r5, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e21, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@remote, 0x4e20, 0x2, 0xcd, 0x4}}, 0x44) sendmsg$sock(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@in6={0x2, 0x4e21, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x2000006, 0x4010, 0xffffffffffffffff, 0xec776000) rseq(0xfffffffffffffffe, 0x20, 0x0, 0x0) r7 = socket$alg(0x26, 0x5, 0x0) ioctl$sock_SIOCGIFBR(r7, 0x8940, &(0x7f0000004180)=@get={0x1, &(0x7f0000003180)=""/4096, 0x5}) prctl$PR_SET_MM(0x23, 0x5, &(0x7f00000bc000/0x2000)=nil) 2.750645332s ago: executing program 2 (id=2811): openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ff1000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ff3000/0x1000)=nil, &(0x7f0000ff1000/0x1000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xc89d, 0xc000, 0xa, 0x3c}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xfff1, 0xfff0}, {0xe, 0xffff}}}, 0x24}}, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3, &(0x7f0000000000)=0x6, 0x4) io_uring_enter(r0, 0x2219, 0x7721, 0x96, 0x0, 0x0) r1 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, 0x0) 2.679063059s ago: executing program 0 (id=2812): r0 = socket$kcm(0x2, 0x200000000000001, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x5452, &(0x7f0000000040)={r0}) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x3000c0c0) 2.584233231s ago: executing program 0 (id=2813): openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, 0x0, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x8002) ioctl$SG_IO(r2, 0x2285, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001340)=ANY=[], 0xc8}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000440)={'sit0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x0, 0x0, 0xfffffffc, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x64, 0x0, 0xd1, 0x0, 0x0, @loopback, @multicast1}}}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f5, &(0x7f0000000200)={'syztnl0\x00', &(0x7f0000000140)={'erspan0\x00', r4, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast2, @multicast2}}}}) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x9, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x9}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}}, 0x800) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r3, 0x89f2, &(0x7f00000000c0)={'syztnl0\x00', 0x0}) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffffff, &(0x7f00000000c0)='./file2\x00', 0x8000, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000040)={'pim6reg1\x00', &(0x7f0000000540)=@ethtool_modinfo={0x42, 0x101, 0x9}}) r6 = socket$kcm(0x10, 0x2, 0x0) removexattr(&(0x7f0000000280)='./file2\x00', &(0x7f0000000580)=ANY=[@ANYBLOB="74c3eaf56b8957fe42990945b79ab1108023af03ede4eed4b81e0166e43ea55e64053b6f035594d4c4e222238eea47a2f148ea975b92a14619ad6eb04b319bfab69ed6da1e423378be0f5d8601575bb8072aec5aba6156542f29"]) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$sock_inet6_SIOCADDRT(r7, 0x890b, &(0x7f0000000200)={@dev={0xfe, 0x80, '\x00', 0x2c}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xa, 0x0, 0x6, 0x0, 0x4000000000000009, 0x10200}) sendmsg$kcm(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602000000000e000a00100000000280", 0x2a}, {&(0x7f0000000400)="6a6f8e5e", 0x4}], 0x2}, 0x0) sendmsg$kcm(r6, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602240000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000002180)='blkio.bfq.io_merged\x00', 0x275a, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)={0x7c, 0x41, 0x9, 0x70bd29, 0x0, {0x3}, [@generic="aa56ff28a4d1ca3340e119e4544214c0fbfaefeaf539438c78adb097354307eb8af44109e18e4d42c5c057ca4980375e1290d59ef247ff9ccb9680c579e051babf1c388dc4bd2939240b5489f7d85f", @typed={0x15, 0x9, 0x0, 0x0, @binary="615e262f100d02a8e253a834e1263a7f1f"}]}, 0x7c}}, 0x0) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2000007, 0x12, r8, 0x5a83e000) openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x20002, 0x0) 2.473683669s ago: executing program 3 (id=2814): recvmmsg(0xffffffffffffffff, &(0x7f0000000980)=[{{0x0, 0x0, 0x0}, 0x7fff}, {{0x0, 0x0, 0x0}, 0x9}], 0x2, 0x10000, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000001c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-512\x00'}, 0x58) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000100)="2e3b4d0793c0907a06a1c65afd96e5c997cc6fe980972c7c01fcfa7c85b0db039afd7c02884bfed5faf093fd548fca4f3a6e7391c8acfda620b96e71569873b28a43558b1c85f34b806418d36165411c9ebd66", 0x53}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c5b5ad28a834e43f387c8282e50e7d6b0cd91a93f87f645b32c1f200f7d9f101c7bcf701e4462f36e5fe550", 0xa6}, {&(0x7f0000000440)}], 0x3, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x1) ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000280)=@urb_type_control={0x2, {}, 0x2, 0x40, &(0x7f0000000040)={0x1, 0xb, 0xfffe, 0x42}, 0x8, 0x203ffffd, 0x300, 0x0, 0xeeb, 0x20002, 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYRES64=r0, @ANYBLOB="42678c8ed7891f2632ee5c7218a043ab94965c7f41113267a303e1c21c68e1dd50de8df22dfd084cf5b7b46c2d2f6e8969f09fa2217a0f94b1278b4f99545671b87e28895ee4a4da9dcaabac00e2c06af2b8060be9a595e34bcdfb5ac75126820c4e7d1e0c3671f37e05683d0a1d3c0ea70e6123b635a2d09541bac2cdf7503a35e9a57108116c6236ea652f", @ANYRESHEX, @ANYRESHEX, @ANYRESHEX, @ANYRES32], 0x50) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) dup(r1) accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3={0x7ffe, 0x200, 0x80, 0x6}, 0x1c) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xc, &(0x7f0000000040)=0x401, 0x4) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) 2.332937025s ago: executing program 2 (id=2815): openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x80d02, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) r0 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000280)={@multicast2, @local, @remote}, 0xc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_TDX_CAPABILITIES(0xffffffffffffffff, 0xc008aeba, &(0x7f0000000e40)={0x0, 0x0, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/2000, {0x2, 0x0, [{}, {}]}}}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="280100000000000001000000"], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x2f) ioctl$KVM_XEN_HVM_CONFIG(r4, 0x4038ae7a, &(0x7f0000000040)={0x22, 0x40000000, 0x0, 0x0}) ioctl(r4, 0x4048aec9, &(0x7f0000000200)="01000000000000000900"/72) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x1000, 0x1000, &(0x7f000000b000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000500)={0x101ff, 0x0, 0x9000, 0x1000, &(0x7f000000c000/0x1000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) mmap$KVM_VCPU(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x11, r5, 0x0) ioctl(r5, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff0100"/72) ioctl(r5, 0x4048aecb, &(0x7f0000000300)="0000000000000000001000"/72) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f00000000c0)=ANY=[@ANYBLOB="e0000002ac1414aa0000000003"], 0x1c) syz_emit_ethernet(0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="0180c2000000aaaaaa32aaaa0800450000280064a9f700d7b846f90715c2a9c10000040290780000ff00e00000000000000079045ecaeefd105a01f9aa4caa00"/79, @ANYRES8=r5, @ANYRESDEC=r3, @ANYRESOCT=r6], 0x0) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(0xffffffffffffffff, 0x40505330, &(0x7f0000000040)={{0xf5, 0x5}, {0x18, 0x80}}) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000180), 0x0) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r7, 0x40505331, &(0x7f0000000540)={{}, {0x18}, 0x0, 0x6}) r8 = syz_io_uring_complete(0x0, 0x0) ioctl$USBDEVFS_RELEASEINTERFACE(r8, 0x80045510, &(0x7f0000000140)=0x8001) r9 = socket$inet6_sctp(0xa, 0x801, 0x84) shutdown(r9, 0x1) syz_open_dev$dri(&(0x7f0000000080), 0xc, 0x0) 2.332139051s ago: executing program 1 (id=2816): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f0000000000)=0x5) (async) r2 = epoll_create1(0x0) (async) socketpair(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x0, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00'/12, @ANYRES32, @ANYRES8=r3], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xe820}, 0x94) (async, rerun: 64) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f00000000c0)={0x0, @rand_addr, @loopback}, &(0x7f0000000100)=0xc) (async, rerun: 64) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000040)={0x90000005}) connect$unix(r0, &(0x7f0000000140)=@abs={0x0, 0x0, 0x4e20}, 0x6e) 2.275417805s ago: executing program 4 (id=2817): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r2, &(0x7f0000003440)=[{{&(0x7f0000000040)={0xa, 0x4e20, 0x9, @private2, 0x5}, 0x1c, &(0x7f0000000b40)=[{&(0x7f0000000000)="f2", 0x1}], 0x1}}], 0x1, 0x0) shutdown(r2, 0x1) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000000140)={0x0, 0x1, 0xffff}, 0x8) sendmmsg$inet(r1, &(0x7f0000002380)=[{{&(0x7f00000008c0)={0x2, 0x4e21, @loopback}, 0x10, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="338f1ee5676d26f882d4af8f9ce7f1c1c05b0d8a47a1aaaaa7e2c73c58af73a57b25857d49ae01af3447e4e275caf3f4fef58cbde7e847eaa6f197ad709f4e8175eb35c6994d2ca465ca4cea42122859c5ecc717c0995c6ead5f615664b505b5476bcecd3355da380678f98742f603dcd8e621b76c5c53171422c7ec9940d0744291bd6f5b9ccb2bb0a5da1ba250a57b9caecfa62152165996d6b76abb930b55f4dbac6ed025cdd13b71d50e8465646308e1bd3cde3d21a73cd915f358bdabd7a05b40e883afc8ef937cb074262c765bf1b79e786a859a8cb45f2deaae956d4ea50e8697c0a422", @ANYBLOB="ac41adda39eda420f515c4d2a957c72d735a3ad739c553347c2c95c8490f7e3fbb18bfa8dd961af60181f330ccab3192116953182fc925e8c51d9f7376ae786af18f71a6631ea07028d2d9c51edf50e383227eb3c9f6ae64b440fb6ba66ef5132a8e81f2059e9c13209d7ce915f453980b2c1b4516a04a3e14f27f1f48639737774b5f33e2d1bb2cf4deb92b2d261de0f665d940e226386af36a3c1bf014a73d877b46", @ANYRES32=r0, @ANYRESHEX=0x0, @ANYBLOB="2cd284f41b92d5acdb6f5a705c89cc581c81471f99cf1441a9ea0c88b9ebc8e02b83b0f1b97a7bd821af1e0346f91267f6251cc4117d9836471b889520cf646923718b019b73945b37fc0c7c5cca60099e87f0df3539d47ebe1d032460cd36f8796ba349918d4eb8663fbfbe8244b274c0bd8f83a3fb39b10622f3d06d7486b6d5f166033727d0cabfe7f9fa03bfdd3de76bb76df72e171a4d8b7c6c03543e5b815cb95d268f875d64a3a9bedbc9ae37186581ce2f8cec5a6357a5b7e1395cfd668295cf5bda382ebaf9880aa3e2", @ANYRESOCT, @ANYRES64=0x0, @ANYRESOCT=r0], 0x50}}], 0x1, 0x800) 2.244388843s ago: executing program 3 (id=2818): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) (async) r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) read$FUSE(r0, 0x0, 0x0) (async) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) (async) socket(0x10, 0x3, 0x7) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) 2.107572275s ago: executing program 1 (id=2819): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x82, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000280)={r1, 0x5}, &(0x7f00000002c0)=0x8) 1.660246059s ago: executing program 1 (id=2820): rt_sigprocmask(0x2, &(0x7f0000000340)={[0xffffffffffffffff]}, 0x0, 0x8) syz_clone3(&(0x7f0000000600)={0x100000000, 0x0, 0x0, 0x0, {0xe}, 0x0, 0x0, 0x0, 0x0}, 0x58) rt_sigtimedwait(&(0x7f0000000040)={[0xfffffffffffffff8]}, 0x0, 0x0, 0x8) ppoll(0x0, 0x0, 0x0, &(0x7f00000000c0)={[0xfffffffffffffff8]}, 0x8) 1.659959113s ago: executing program 4 (id=2821): r0 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, &(0x7f0000001b80)={0x0, 0x0, &(0x7f0000001b40)={&(0x7f0000001bc0)={0x14, 0x0, 0x300, 0x70bd28, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x895}, 0x8000) sendmmsg$inet(r0, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}}], 0x40000cf, 0x0) (fail_nth: 3) 1.551205948s ago: executing program 4 (id=2822): r0 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x800, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000080)={0x4e, 0x2, 0x2, "d02066000000000000000000565c000f30807278f8983c3c0a31965ebd9ca8ac", 0x20363059}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000500), 0x2, 0x0) write$6lowpan_enable(r2, &(0x7f0000000580)='0', 0x1) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r3, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000057010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000100)={0x30, r5, 0x801, 0x70bd2a, 0x25dfdbff, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_STA_PLINK_ACTION={0x5, 0x19, 0x2}]}, 0x30}, 0x1, 0x0, 0x0, 0x24000804}, 0x20000050) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002005279510000204f0453b640000102030109022400010102a0010904004901030104080921c8000f0122070d09058132a9cfc7b46812d5f944d16e67a46d030004070102"], &(0x7f0000000400)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x310, 0x9, 0x0, 0x0, 0x10, 0x5}, 0x5, &(0x7f0000000140)={0x5, 0xf, 0x5}, 0x7, [{0x7a, &(0x7f0000000180)=@string={0x7a, 0x3, "2c629ff9c0addd0680448f564148d6b8fe5ed230ee11d775d92f1d6793e978000f3757671ecc92a9021aa3b610a085cb34b08ae48689cc9276521625ad51ee29cc4a0c793917d7b5472597eba69043470de01246a63ebc92ca8558915102adaa8802cb161742fe40b6444220dded1fd6086696c568afa8a7"}}, {0x4, &(0x7f0000000200)=@lang_id={0x4, 0x3, 0x4ff}}, {0x50, &(0x7f0000000240)=@string={0x50, 0x3, "f4020ebc2787aa536265fb826b0f2a67c4fe8e955c0302b3adb8fbdbfed878463925ffd6938da7f5d438eca11ed7af1e2274cc9d78902a6a9519924e6561f24de6dcafc5687171c02a472a2e5954"}}, {0x5, &(0x7f00000002c0)=@string={0x5, 0x3, "34b576"}}, {0x24, &(0x7f0000000300)=@string={0x24, 0x3, "23b7867e1679a1f7b3eeb88551cdd49e3b8091c91f90995fb142e4850d667ac50a3e"}}, {0x30, &(0x7f0000000340)=@string={0x30, 0x3, "72936b0935d172fadd4a4244150b93dafe8ef5361b5b3c251336b67c4176a900003b28c60b44e6e102932089fac4"}}, {0x12, &(0x7f00000003c0)=@string={0x12, 0x3, "b70769b87e5525b093acc948cd0bd9b8"}}]}) 1.092697881s ago: executing program 2 (id=2823): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x2, 0x0, 0x0, 0x30e}]}) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f00000003c0)='./bus\x00', &(0x7f0000000540)='system.posix_acl_access\x00', &(0x7f0000001080)=ANY=[@ANYBLOB="020000000100000000000000040001000000ffff0049a027fe5eb9433dc8d8a18c0006000000000020000000e7d80000"], 0x24, 0x0) unshare(0x28000600) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x143042, 0xc4) syz_open_dev$video4linux(0x0, 0x0, 0x0) socket(0x80000000000000a, 0x2, 0x0) flistxattr(0xffffffffffffffff, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$tty1(0xc, 0x4, 0x1) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="0600000090000500000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x2710, @ANYBLOB="00000080010000000200008006010000690f5aad86d95c8b"], 0x48}, 0x1, 0x0, 0x0, 0x20080810}, 0x80) r0 = socket(0x2b, 0x1, 0x1) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x0, 0x0, &(0x7f0000000000)='GPL\x00'}, 0x94) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001180)='blkio.bfq.empty_time\x00', 0x275a, 0x0) r2 = socket(0x40000000015, 0x5, 0x0) bind$inet(r2, &(0x7f00008a5ff0)={0x2, 0x0, @loopback}, 0x10) recvmmsg(r2, &(0x7f0000001380)=[{{0x0, 0x0, 0x0}, 0x4}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001400)=""/249, 0xf9}, 0xffffffff}], 0x2, 0x60010000, 0x0) sendto$inet(r2, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2, 0x0, @loopback}, 0x10) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0x32600) r3 = fsopen(&(0x7f0000000040)='ceph\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000700)='source', &(0x7f0000000580)='c:::/\x83\xc1\xcfD\xc4AO\x06)\xb03\xfcI\x95w\x96\x9b\xe9\xa6\x1a\x96\xael\x11\xa6\x06\xe3G\xb1\x1d$\xc2;\x8f\xf3\x13\xebB\x93\x94\x01\x8b\x88\xeb\xa3\x01\rx\x86bK&\x13a~\x04/\x18\x14ZM\xcb\xad\x92>\xe5\x01V\xdc\x05#\x13\xe9F\xa0\x1b\xf8\xe12\xe9\x80\x988\xd8?\x86\xe9i\x7f\xa8\xe0c\x94\xc1\xae\x9c\xba\x1c\xfa\xbc\xa8\xbf\xff\xfe\xfe!\x7f2\xf1\xc7P\x80A\x1c2k\xf6}P\x19\xee:i|0\x1c\x13u\xb0I\xaa\xe3\x14\x9a\x1f\x9f(\xd1$\x06\xa8&t&A0\xa7\xef\x9cL\x8e1K', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000700)='source', &(0x7f00000004c0)='c:::/\x83\xc1\xcfD\xc4AO\x06)\xb03\xfcI\x95w\x96\x9b\xe9\xa6\x1a\x96\xael,\xc4\x00\x00\x00\x00\x00\x00\xc2;\x8f\xf3\x13\xebB\x93\x94\x01\x8b\x88\xeb\xa3\x01\rx\x86bK&\x13a~\x04/\x18\x14ZM\xcb\xad\x92>\xe5\x01V\xdc\x05#\x00\x00\x00\x00\x1b\xf8\xe12\xe9\x80\x988\xd8?\x86\xe9i\x7f\xa8\xe0c\x94\xc1\xae\xf9\xff\x1b\xfa\xbc\xa8\xbf\xff\xfe\xfe!\x7f2\xf1\xc7P\x80A\x1c2k\xf6}P\x19\xee:i|0\x1c\x13u\xb0I\xaa\xe3\x14\x9a\x1f\x9f(\xd1$\x06\xa8&\xc1&A0\xa7\xef\x9cL\x8e1K', 0x0) r4 = socket$inet(0x2, 0x3, 0xd) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000080)={0x1, &(0x7f0000000000)=[{0x7, 0x0, 0x0, 0xfffffffb}]}) getsockopt$inet_mreqsrc(r4, 0x0, 0x53, &(0x7f0000000000)={@dev, @local, @broadcast}, &(0x7f0000000040)=0x28) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000200)=@mangle={'mangle\x00', 0x1f, 0x6, 0x3b0, 0x0, 0x238, 0x170, 0xd8, 0x0, 0x410, 0x410, 0x410, 0x410, 0x410, 0x6, 0x0, {[{{@ip={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1, 0xffffff00, 0x0, 'veth0\x00', 'veth0_to_bridge\x00', {}, {0xff}, 0x62, 0x0, 0x50}, 0x0, 0x70, 0xb0}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0xb, 0x4, @ipv4=@loopback, 0x4e24}}}, {{@ip={@loopback, @initdev={0xac, 0x1e, 0x1, 0x0}, 0xff000000, 0xff, 'geneve0\x00', 'veth1_to_team\x00', {}, {}, 0x89, 0x6, 0x24}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@rand_addr=0x64010100, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0xff, 'ip6_vti0\x00', 'geneve0\x00', {}, {}, 0x0, 0x0, 0x1}, 0x0, 0x70, 0x98}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x5}, {0x0, 0x6}}}}, {{@uncond, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x31, 0x7, 0x1}}}, {{@ip={@loopback, @multicast1, 0xff, 0xff, 'veth0_to_batadv\x00', 'bridge_slave_0\x00', {0xff}, {0xff}, 0x44, 0x1, 0x15}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x55d, 0x3, @multicast1, 0x4e21}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0xcf8a) 928.056072ms ago: executing program 3 (id=2824): r0 = socket$kcm(0x2, 0x200000000000001, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x5452, &(0x7f0000000040)={r0}) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x3000c0c0) (fail_nth: 3) 578.184916ms ago: executing program 3 (id=2825): r0 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write(r0, &(0x7f0000000080)='transport=loop,nqn=nqn.2014-08.org.nvmexpress.discovery\x00', 0x38) ioctl$TIOCGISO7816(r0, 0x80285442, &(0x7f0000000000)) r1 = syz_usb_connect$uac2(0x5, 0x83, &(0x7f0000000180)=ANY=[@ANYBLOB="120100020000000882052500400001020301090271000301f81005080b020001052008090400000001012000092401fdff0a11004708240a0000057f00090401000001022000090401010101022000090501"], 0x0) syz_usb_control_io$uac2(r1, &(0x7f0000000100)={0x14, 0x0, &(0x7f00000000c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x500a}}}, 0x0) syz_usb_control_io$uac2(r1, 0x0, 0x0) syz_usb_control_io$uac2(r1, 0x0, &(0x7f0000000240)={0x44, &(0x7f0000000500)=ANY=[@ANYBLOB="400903000000451cd732fe62ebd7b6179fa5e6c9cc57eb47019ac175f73ae25214df4f1fb87ec40f3b65b33f25ef721b67bb86443e647fc8e1e30128062c1a8f6d0bf529ce78942c1779eb19ca9bd66aa314c835a920bac74bd847e728858bf056b8dd6264e9361ed6bc66c4370f06dfd9c9e68257406be84a36b73de2abdbdb91db94147474d55c155d51ef557fa015ed33da7c4ce57995beee8fb9aa90b5a3674300192b452806133613139bc2014b2bc5033a962638bcc3330edb"], 0x0, &(0x7f00000004c0)={0x0, 0x8, 0x1, 0xe}, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/asound/timers\x00', 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f00000019c0)={&(0x7f0000000300)=@newtfilter={0x64, 0x2c, 0x200, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xf}, {}, {0x6, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x3, 0x2, [@TCA_U32_SEL={0x34, 0x5, {0x1, 0x1, 0x3, 0x1, 0x4, 0x2, 0x6, 0x7ffffffa, [{0x200, 0x500, 0x3, 0x6}, {0x6783, 0x2, 0x8000, 0x10}]}}]}}]}, 0x64}}, 0x24040084) r3 = socket$alg(0x26, 0x5, 0x0) r4 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@newqdisc={0x60, 0x24, 0xf0b, 0x0, 0x0, {0x60, 0x0, 0x0, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_pfifo={{0xa}, {0x7, 0x2, 0xfff1}}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, {0x6, 0x2, [0x0]}}]}]}, 0x60}}, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000340)="71e67a15cdf0311cfcf33a52a7d86bd1", 0x20) read$FUSE(r2, &(0x7f0000001580)={0x2020}, 0x2020) r7 = syz_open_dev$vim2m(&(0x7f0000000080), 0x2, 0x2) r8 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_SETFMT(r8, 0xc0045005, &(0x7f0000000640)=0x10) r9 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r9, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r9, 0x7a0, &(0x7f0000000000)={@local}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r9, 0x7a8, &(0x7f0000000540)={{@hyper, 0x2}, @hyper, 0x0, 0x0, 0x5e}) ioctl$IOCTL_VMCI_QUEUEPAIR_SETPF(r9, 0x7a9, &(0x7f0000000340)={{@hyper, 0x2}, 0xe148, 0x3, 0x69c9, 0x4, 0xd, 0x385a2d2f, 0x4, 0x100000000}) ioctl$vim2m_VIDIOC_ENUM_FMT(r7, 0xc0405668, &(0x7f0000000100)={0xaa, 0x2, 0x1, "0000087aba10fdffe13c417debfffffd00", 0x49433554}) open(&(0x7f00000002c0)='./file0\x00', 0x400, 0x112) syz_open_procfs(0x0, &(0x7f0000000000)='gid_map\x00') 557.649044ms ago: executing program 1 (id=2826): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000300)={0x1, 0x0, [{0x486, 0x0, 0x3}]}) r3 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x458, 0x5013, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, "", [{{0x9, 0x4, 0x0, 0x10, 0x3, 0x3, 0x0, 0x6, 0x0, {0x9, 0x21, 0x222, 0x0, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0x0, 0x38, 0xc6}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) semctl$IPC_INFO(0x0, 0x2, 0x3, &(0x7f0000000000)=""/141) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000000), 0x208e24b) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r6, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x40020}, 0x80) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r6, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r8 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r9 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r11 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r11, &(0x7f0000000200)={0x0, 0x5f, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r10, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) r12 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r12, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r10, {0x0, 0xe}, {0x6, 0xffff}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40001}, 0x8010) r13 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r13, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {0x1, 0x3}, {0x0, 0x2}, {0x8, 0xfff1}}}, 0x24}}, 0x40004) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xd) preadv(r6, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x4d, 0x5, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) 140.205138ms ago: executing program 2 (id=2827): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(ecb-aes-aesni)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="1000000000d957d2b903c6bf46b4abf3629ff075475e4ba1c59262b01468c1dc", 0x20) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="4df3d99a134ba79554ba3a23", 0xc}], 0x1, 0x0, 0x0, 0x4000800}, 0x4048086) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000200000040d90470a00000000000010902240001200010200904000002030003000921030033888d000122280009058103400048e783"], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000000)={0x2c, &(0x7f0000000200)=ANY=[@ANYBLOB="20232c0000002c0c00010000030000000000000000cb4fdca0561fb30d54f365c5b1d43ee43ebf6dc93f080887cc1b1fcadc"], 0x0, 0x0, 0x0, 0x0}, 0x0) sendmmsg$alg(r1, &(0x7f0000000140), 0x0, 0x891) recvmsg(r1, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000300)=""/135, 0x87}, {&(0x7f0000000100)=""/45, 0x2d}], 0x2}, 0x21) r3 = socket$kcm(0x2, 0x200000000000001, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="230100004106cd40cd060f011bd500000001090224"], 0x0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_int(r4, 0x29, 0x24, &(0x7f00000001c0)=0x6, 0x4) socket(0x2b, 0x1, 0x7fffffff) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r5, 0x84, 0x75, 0x0, &(0x7f0000000040)) syz_usb_connect$hid(0x1, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f0000000300)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x2, 0xffffffffffffffff, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0xbd) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_IPV6_HOPOPTS(0xffffffffffffffff, 0x29, 0x48, &(0x7f0000000440)=ANY=[@ANYBLOB="63cb7e47c4a234654f72c37c0fc6840ff30b6acc78e2bbdaa05441cc1b92c6a517795cfec41d2579dfc5076488bef822b12903699cca487d4830477767f47cedc218a2ed3d425196075516d055d60b7dc1737e45fc9d9c3a50b32d9d8750e77646d7a037ab5e99fda3469743607633a0763715565dbfe7a923d56dc9c70149e92ed14a9fd50a1db276dcdf0d3c8cda11ce9fa4b9d9ea36524b83e693f5fb1ea73154ec597605ce7eb7f26b4a8fb25664563f9410841542", @ANYRESHEX=r3], 0x18) 138.461957ms ago: executing program 0 (id=2828): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000002c80)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) recvmmsg(r0, &(0x7f0000005280)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000001d40)=""/61, 0x3d}], 0x1}, 0x10009}], 0x1, 0x10000, 0x0) sendmmsg$inet6(r0, &(0x7f0000000840)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000000)="290288ac4d770dd953f7fa7534f3c73cc21e1beedba555dee2095863cb6ddd2179d7a0c65bcb1b99a8041996038bec5a13ecb4ef64431583554ec5162f030e1b4855c0d162da72db7b01878b849fc5e2dff7ac3d012ea6b5c805d3e6411a46096005b07235e5c504f9e485e05ddda0c62263d5003962ef720e1d9f8810457154a1d378207d118456da7bbc965ea2fd7f24be", 0x92}, {&(0x7f0000000100)="647bbd91424f1e8a897a38c6926d", 0xe}, {&(0x7f0000000200)="f84cc67aad65bb2a26656f47b4177f20cf556169729cc68c0f4f7cd14bb97a291f0e83d1dc6a57b0bc996c2b80fb0231fcf11bc9d5e9caf6cd59860e2c567e95b1532e9b2d32b2a9944caa289fac2c732722b797373ee57824ee4672c8bb1d9546a45621e262ef00a4", 0x69}, {&(0x7f0000000280)="6ca827ab5ff587c25583970974d4cab0b1cfc9b49c94f5b43333c0040a52a28089d003075763745f6b36b4a0bdb9", 0x2e}], 0x4, &(0x7f00000008c0)=[@rthdr_2292={{0xb8, 0x29, 0x39, {0x2e, 0x14, 0x0, 0x1f, 0x0, [@empty, @local, @private1, @local, @remote, @empty, @loopback, @local, @mcast2, @empty]}}}, @flowinfo={{0x14, 0x29, 0xb, 0x1}}, @flowinfo={{0x14, 0x29, 0xb, 0x7}}, @tclass={{0x14, 0x29, 0x43, 0x7f}}, @hopopts={{0xc8, 0x29, 0x36, {0x6, 0x15, '\x00', [@calipso={0x7, 0x10, {0x0, 0x2, 0xd7, 0x3, [0x1]}}, @ra={0x5, 0x2, 0x8}, @generic={0x0, 0x91, "085b0b318354e5082a9355bf591e72614f4fa53a44dc2a4f0e296eabb5ffd758531ab6025ce0f0b7abe1bb9e26f1cdd2411c3d040a879dd5bcf7b9972cf38482e9ff0d66e99b73f1b67580b3f1184c92f2a267be4ffeaab53cde10078b9443a8be1cad217e68377845671713491a746fff07000082dc354d7cc1bdac59baa30fa77d25b07715d79351a591fcd3ace081b9"}, @ra={0x5, 0x2, 0x7}]}}}, @tclass={{0x14, 0x29, 0x43, 0x4}}], 0x1e0}}, {{0x0, 0x0, &(0x7f0000000500), 0x0, &(0x7f0000000600)=[@hopopts={{0xd0, 0x29, 0x36, {0x67, 0x17, '\x00', [@padn={0x1, 0x2, [0x0, 0x0]}, @hao={0xc9, 0x10, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x1c}}}, @calipso={0x7, 0x50, {0x1, 0x12, 0xe0, 0x4, [0x9, 0x7, 0x5, 0x3, 0xffffffffffffffff, 0x2f9, 0x5, 0xfffffffffffffffc, 0x9]}}, @pad1, @generic={0xe, 0x4b, "83a37127c961a6d9476c8c3440d20040c64285636bee7a81467e8395e6931c8e4115147c3d778fd9bbdbd539d6542431ebd1fa1784d2e8a118d5995787dc8e7c52917da932f124d1d7a485"}]}}}, @dstopts_2292={{0x20, 0x29, 0x4, {0x67, 0x0, '\x00', [@jumbo={0xc2, 0x4, 0x1ff}]}}}, @rthdr_2292={{0x58, 0x29, 0x39, {0x2b, 0x8, 0x0, 0xe8, 0x0, [@remote, @private2, @rand_addr=' \x01\x00', @private2={0xfc, 0x2, '\x00', 0x1}]}}}, @hoplimit={{0x14, 0x29, 0x34, 0x3}}, @pktinfo={{0x24, 0x29, 0x32, {@private0={0xfc, 0x0, '\x00', 0x1}}}}, @rthdr_2292={{0xa8, 0x29, 0x39, {0x88, 0x12, 0x0, 0xe, 0x0, [@rand_addr=' \x01\x00', @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, @dev={0xfe, 0x80, '\x00', 0x20}, @empty, @mcast1, @mcast1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @ipv4={'\x00', '\xff\xff', @loopback}]}}}], 0x230}}], 0x2, 0x20e8086) sendto$inet6(r0, &(0x7f0000000180)="e4eba9c15d1ee9eb1913bcf106c6b1bb86172d891122171bc44f929c668058cce40ea874", 0x24, 0x800, 0x0, 0x0) 0s ago: executing program 0 (id=2829): r0 = syz_open_procfs(0x0, &(0x7f0000000100)='syscall\x00') r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r2, 0x29, 0x24, &(0x7f0000000080)=0x2, 0x4) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x100}) r3 = socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000140)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=@gettclass={0x24, 0x2a, 0x4, 0x70b92d, 0x25dfdbff, {0x0, 0x0, 0x0, r4, {0x10, 0xffff}, {0x2, 0x8}, {0xfff1, 0x9}}, ["", "", "", ""]}, 0x24}}, 0x4008044) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000340)=@newtfilter={0x2c, 0x2c, 0x800, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x4, 0x5}, {}, {0x4, 0xfff2}}, [@TCA_RATE={0x6, 0x5, {0xc, 0x1}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x48001}, 0x40010) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x149540, 0x0) close(r9) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) r10 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r10, &(0x7f00000001c0)={&(0x7f0000000840)=@xdp={0x2c, 0x7, r11, 0x31}, 0x80, &(0x7f00000000c0)=[{&(0x7f00000002c0)='\x00', 0x5dc}], 0x1}, 0x4) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, &(0x7f0000000140)=@gcm_128={{0x304}, "05e5e82cdfc5c29d", "4c4c40faa7c95a750c3da1848eb38a3f", "71d188dc", "18e11daf2e5fc3b6"}, 0x28) r12 = socket$inet6_tcp(0xa, 0x1, 0x0) r13 = dup(r12) ioctl$SIOCSIFHWADDR(r13, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) write$tun(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="001c86dd0700100000002800000060ec97000fc83a00fe8000000000000000000000000000aaff0200"/51], 0xffe) ioctl$SNAPSHOT_UNFREEZE(r0, 0x3302) socket$nl_route(0x10, 0x3, 0x0) kernel console output (not intermixed with test programs): t power cycle [ 519.292920][ T24] usb 5-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 519.314744][ T24] usb 5-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 519.345447][T13587] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 519.349875][ T24] usb 5-1: config 0 interface 0 has no altsetting 0 [ 519.366604][T13587] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 519.377418][ T24] usb 5-1: New USB device found, idVendor=0458, idProduct=5013, bcdDevice= 0.00 [ 519.391956][T12468] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 519.407237][T13585] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 519.419192][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 519.445201][ T24] usb 5-1: config 0 descriptor?? [ 519.492013][ T9] usb 4-1: new low-speed USB device number 83 using dummy_hcd [ 519.601146][ T5722] usb 1-1: new full-speed USB device number 114 using dummy_hcd [ 519.641932][ T5722] usb 1-1: device descriptor read/8, error -71 [ 519.653714][ T9] usb 4-1: config 0 interface 0 altsetting 88 endpoint 0x81 has invalid maxpacket 1023, setting to 8 [ 519.666117][ T9] usb 4-1: config 0 interface 0 altsetting 88 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 519.679857][ T9] usb 4-1: config 0 interface 0 has no altsetting 0 [ 519.687320][ T9] usb 4-1: New USB device found, idVendor=05ac, idProduct=0262, bcdDevice= 0.00 [ 519.697058][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 519.709298][ T9] usb 4-1: config 0 descriptor?? [ 519.721390][T13583] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 519.752231][ T9] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input40 [ 519.891257][ T5722] usb 1-1: new full-speed USB device number 115 using dummy_hcd [ 519.911891][ T5722] usb 1-1: device descriptor read/8, error -71 [ 519.973931][ T4978] bcm5974 4-1:0.0: could not read from device [ 519.993287][ T4978] bcm5974 4-1:0.0: could not read from device [ 520.007189][ T4978] bcm5974 4-1:0.0: could not read from device [ 520.018179][ T9] usb 4-1: USB disconnect, device number 83 [ 520.031561][ T4978] bcm5974 4-1:0.0: could not read from device [ 520.038554][ T5722] usb usb1-port1: unable to enumerate USB device [ 520.060443][T13478] udevd[13478]: Error opening device "/dev/input/event4": No such file or directory [ 520.085738][T13478] udevd[13478]: Unable to EVIOCGABS device "/dev/input/event4" [ 520.110061][T13478] udevd[13478]: Unable to EVIOCGABS device "/dev/input/event4" [ 520.128194][T13478] udevd[13478]: Unable to EVIOCGABS device "/dev/input/event4" [ 520.143492][T13478] udevd[13478]: Unable to EVIOCGABS device "/dev/input/event4" [ 520.383414][ T7838] nvmet: connect request for invalid subsystem n! [ 520.394149][T13589] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "n" [ 520.560667][ T24] usbhid 5-1:0.0: can't add hid device: -71 [ 520.584594][ T24] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 520.614214][ T24] usb 5-1: USB disconnect, device number 95 [ 521.044422][T13602] sctp: [Deprecated]: syz.3.2483 (pid 13602) Use of struct sctp_assoc_value in delayed_ack socket option. [ 521.044422][T13602] Use struct sctp_sack_info instead [ 521.089778][T13602] sctp: [Deprecated]: syz.3.2483 (pid 13602) Use of struct sctp_assoc_value in delayed_ack socket option. [ 521.089778][T13602] Use struct sctp_sack_info instead [ 521.329277][ T7830] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 521.360264][T13608] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 521.541378][ T9] usb 4-1: new high-speed USB device number 84 using dummy_hcd [ 521.711324][T13627] syzkaller0: entered promiscuous mode [ 521.717020][T13627] syzkaller0: entered allmulticast mode [ 521.800908][T13629] FAULT_INJECTION: forcing a failure. [ 521.800908][T13629] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 521.800965][T13629] CPU: 0 UID: 0 PID: 13629 Comm: syz.4.2489 Tainted: G L syzkaller #0 PREEMPT(full) [ 521.800980][T13629] Tainted: [L]=SOFTLOCKUP [ 521.800983][T13629] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 521.800989][T13629] Call Trace: [ 521.800994][T13629] [ 521.801002][T13629] dump_stack_lvl+0xe8/0x150 [ 521.801031][T13629] should_fail_ex+0x40c/0x560 [ 521.801055][T13629] _copy_from_user+0x2d/0xb0 [ 521.801073][T13629] input_event_from_user+0xb1/0x290 [ 521.801185][T13629] ? __pfx_input_event_from_user+0x10/0x10 [ 521.801217][T13629] evdev_write+0x2c7/0x4c0 [ 521.801275][T13629] ? __lock_acquire+0x683/0x2cf0 [ 521.801303][T13629] ? __pfx_evdev_write+0x10/0x10 [ 521.801326][T13629] ? bpf_lsm_file_permission+0x9/0x20 [ 521.801344][T13629] ? security_file_permission+0x75/0x260 [ 521.801369][T13629] ? rw_verify_area+0x203/0x4c0 [ 521.801387][T13629] ? __pfx_evdev_write+0x10/0x10 [ 521.801409][T13629] vfs_write+0x296/0xba0 [ 521.801432][T13629] ? __pfx_vfs_write+0x10/0x10 [ 521.801450][T13629] ? __fget_files+0x2a/0x420 [ 521.801474][T13629] ? __fget_files+0x2a/0x420 [ 521.801493][T13629] ? __fget_files+0x3a2/0x420 [ 521.801513][T13629] ? __fget_files+0x2a/0x420 [ 521.801541][T13629] ksys_write+0x150/0x270 [ 521.801559][T13629] ? __pfx_ksys_write+0x10/0x10 [ 521.801583][T13629] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 521.801601][T13629] do_syscall_64+0x174/0x580 [ 521.801617][T13629] ? trace_irq_disable+0x3b/0x140 [ 521.801631][T13629] ? clear_bhb_loop+0x40/0x90 [ 521.801643][T13629] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 521.801652][T13629] RIP: 0033:0x7fbd4db9e019 [ 521.801663][T13629] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 521.801672][T13629] RSP: 002b:00007fbd4bdf6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 521.801683][T13629] RAX: ffffffffffffffda RBX: 00007fbd4de25fa0 RCX: 00007fbd4db9e019 [ 521.801702][T13629] RDX: 0000000000002250 RSI: 0000200000000040 RDI: 0000000000000003 [ 521.801709][T13629] RBP: 00007fbd4bdf6090 R08: 0000000000000000 R09: 0000000000000000 [ 521.801714][T13629] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 521.801726][T13629] R13: 00007fbd4de26038 R14: 00007fbd4de25fa0 R15: 00007fbd4df4fa48 [ 521.801742][T13629] [ 521.821324][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 521.826941][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 521.826959][ T9] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 521.826990][ T9] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 521.828973][ T9] usb 4-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 521.829002][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 521.829022][ T9] usb 4-1: Product: syz [ 521.829036][ T9] usb 4-1: Manufacturer: syz [ 521.829046][ T9] usb 4-1: SerialNumber: syz [ 522.064304][T13634] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2491'. [ 522.077031][T13634] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2491'. [ 522.466622][T13639] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2494'. [ 522.491404][T13639] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2494'. [ 522.733209][T13645] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 522.752159][T13645] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 522.826207][ T9] usb 4-1: 1:1: cannot get freq (v2/v3): err -71 [ 522.865445][ T9] usb 4-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 522.959384][T13652] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2499'. [ 522.968834][T13652] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2499'. [ 523.011731][T13654] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2499'. [ 523.025222][ T9] usb 4-1: USB disconnect, device number 84 [ 523.052099][T13654] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2499'. [ 523.082231][ T24] usb 1-1: new high-speed USB device number 116 using dummy_hcd [ 523.103913][ T6927] udevd[6927]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 523.127034][T13652] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2499'. [ 523.163859][T13652] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2499'. [ 523.272485][ T24] usb 1-1: Using ep0 maxpacket: 32 [ 523.296189][ T24] usb 1-1: config 0 has an invalid interface number: 51 but max is 0 [ 523.344949][ T24] usb 1-1: config 0 has no interface number 0 [ 523.366028][ T24] usb 1-1: config 0 interface 51 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 523.405537][ T24] usb 1-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 523.452370][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 523.489217][ T24] usb 1-1: Product: syz [ 523.517347][ T24] usb 1-1: Manufacturer: syz [ 523.539893][ T24] usb 1-1: SerialNumber: syz [ 523.555844][ T24] usb 1-1: config 0 descriptor?? [ 523.586300][ T24] quatech2 1-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 523.791072][ T24] usb 1-1: qt2_setup_urbs - submit read urb failed -8 [ 523.814105][ T24] quatech2 1-1:0.51: probe with driver quatech2 failed with error -8 [ 524.006301][ T24] usb 1-1: USB disconnect, device number 116 [ 524.431938][ T7830] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 524.447505][T13689] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 524.506556][T13695] syzkaller0: entered promiscuous mode [ 524.513005][T13695] syzkaller0: entered allmulticast mode [ 524.651463][ T10] usb 2-1: new high-speed USB device number 89 using dummy_hcd [ 524.811179][ T10] usb 2-1: Using ep0 maxpacket: 8 [ 524.823008][ T10] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 524.844948][ T10] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 524.871252][ T10] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 524.883401][T13702] FAULT_INJECTION: forcing a failure. [ 524.883401][T13702] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 524.893640][ T10] usb 2-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 524.906192][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 524.922911][ T10] usb 2-1: Product: syz [ 524.925089][T13702] CPU: 1 UID: 0 PID: 13702 Comm: syz.4.2515 Tainted: G L syzkaller #0 PREEMPT(full) [ 524.925116][T13702] Tainted: [L]=SOFTLOCKUP [ 524.925123][T13702] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 524.925134][T13702] Call Trace: [ 524.925142][T13702] [ 524.925150][T13702] dump_stack_lvl+0xe8/0x150 [ 524.925180][T13702] should_fail_ex+0x40c/0x560 [ 524.925206][T13702] _copy_from_iter+0x1d3/0x1660 [ 524.925228][T13702] ? kmem_cache_alloc_node_noprof+0x141/0x610 [ 524.925251][T13702] ? rcu_is_watching+0x15/0xb0 [ 524.925269][T13702] ? trace_kmem_cache_alloc+0x29/0xe0 [ 524.925291][T13702] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 524.925312][T13702] ? __pfx__copy_from_iter+0x10/0x10 [ 524.925334][T13702] ? __alloc_skb+0x276/0x7a0 [ 524.925351][T13702] ? __alloc_skb+0x276/0x7a0 [ 524.925373][T13702] ? netlink_sendmsg+0x650/0xb40 [ 524.925393][T13702] ? skb_put+0x112/0x210 [ 524.925414][T13702] netlink_sendmsg+0x6c0/0xb40 [ 524.925443][T13702] ? __pfx_netlink_sendmsg+0x10/0x10 [ 524.925467][T13702] ? aa_sock_msg_perm+0xf1/0x1b0 [ 524.925491][T13702] ? __pfx_netlink_sendmsg+0x10/0x10 [ 524.925510][T13702] sock_sendmsg_nosec+0x13a/0x180 [ 524.925543][T13702] ____sys_sendmsg+0x54e/0x850 [ 524.925568][T13702] ? __pfx_____sys_sendmsg+0x10/0x10 [ 524.925595][T13702] ? import_iovec+0x73/0xa0 [ 524.925615][T13702] ___sys_sendmsg+0x2a5/0x360 [ 524.925633][T13702] ? __lock_acquire+0x683/0x2cf0 [ 524.925660][T13702] ? __pfx____sys_sendmsg+0x10/0x10 [ 524.925710][T13702] ? __fget_files+0x2a/0x420 [ 524.925731][T13702] ? __fget_files+0x3a2/0x420 [ 524.925762][T13702] __x64_sys_sendmsg+0x1b1/0x290 [ 524.925784][T13702] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 524.925818][T13702] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 524.925837][T13702] do_syscall_64+0x174/0x580 [ 524.925857][T13702] ? trace_irq_disable+0x3b/0x140 [ 524.925879][T13702] ? clear_bhb_loop+0x40/0x90 [ 524.925899][T13702] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 524.925916][T13702] RIP: 0033:0x7fbd4db9e019 [ 524.925932][T13702] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 524.925946][T13702] RSP: 002b:00007fbd4bdf6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 524.925965][T13702] RAX: ffffffffffffffda RBX: 00007fbd4de25fa0 RCX: 00007fbd4db9e019 [ 524.925978][T13702] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 524.925988][T13702] RBP: 00007fbd4bdf6090 R08: 0000000000000000 R09: 0000000000000000 [ 524.925999][T13702] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 524.926010][T13702] R13: 00007fbd4de26038 R14: 00007fbd4de25fa0 R15: 00007fbd4df4fa48 [ 524.926036][T13702] [ 525.199758][ T10] usb 2-1: Manufacturer: syz [ 525.204763][ T10] usb 2-1: SerialNumber: syz [ 525.769839][T13718] FAULT_INJECTION: forcing a failure. [ 525.769839][T13718] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 525.783389][T13718] CPU: 1 UID: 0 PID: 13718 Comm: syz.2.2520 Tainted: G L syzkaller #0 PREEMPT(full) [ 525.783419][T13718] Tainted: [L]=SOFTLOCKUP [ 525.783426][T13718] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 525.783436][T13718] Call Trace: [ 525.783445][T13718] [ 525.783453][T13718] dump_stack_lvl+0xe8/0x150 [ 525.783494][T13718] should_fail_ex+0x40c/0x560 [ 525.783521][T13718] _copy_from_iter+0x1d3/0x1660 [ 525.783544][T13718] ? kmem_cache_alloc_node_noprof+0x141/0x610 [ 525.783567][T13718] ? rcu_is_watching+0x15/0xb0 [ 525.783586][T13718] ? trace_kmem_cache_alloc+0x29/0xe0 [ 525.783610][T13718] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 525.783632][T13718] ? __pfx__copy_from_iter+0x10/0x10 [ 525.783655][T13718] ? __alloc_skb+0x276/0x7a0 [ 525.783673][T13718] ? __alloc_skb+0x276/0x7a0 [ 525.783696][T13718] ? netlink_sendmsg+0x650/0xb40 [ 525.783716][T13718] ? skb_put+0x112/0x210 [ 525.783738][T13718] netlink_sendmsg+0x6c0/0xb40 [ 525.783768][T13718] ? __pfx_netlink_sendmsg+0x10/0x10 [ 525.783793][T13718] ? aa_sock_msg_perm+0xf1/0x1b0 [ 525.783819][T13718] ? __pfx_netlink_sendmsg+0x10/0x10 [ 525.783839][T13718] sock_sendmsg_nosec+0x13a/0x180 [ 525.783867][T13718] ____sys_sendmsg+0x54e/0x850 [ 525.783893][T13718] ? __pfx_____sys_sendmsg+0x10/0x10 [ 525.783922][T13718] ? import_iovec+0x73/0xa0 [ 525.783943][T13718] ___sys_sendmsg+0x2a5/0x360 [ 525.783963][T13718] ? __lock_acquire+0x683/0x2cf0 [ 525.783990][T13718] ? __pfx____sys_sendmsg+0x10/0x10 [ 525.784041][T13718] ? __fget_files+0x2a/0x420 [ 525.784063][T13718] ? __fget_files+0x3a2/0x420 [ 525.784090][T13718] __x64_sys_sendmsg+0x1b1/0x290 [ 525.784113][T13718] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 525.784150][T13718] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 525.784170][T13718] do_syscall_64+0x174/0x580 [ 525.784192][T13718] ? trace_irq_disable+0x3b/0x140 [ 525.784215][T13718] ? clear_bhb_loop+0x40/0x90 [ 525.784239][T13718] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 525.784257][T13718] RIP: 0033:0x7f6e51f9e019 [ 525.784274][T13718] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 525.784289][T13718] RSP: 002b:00007f6e501f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 525.784307][T13718] RAX: ffffffffffffffda RBX: 00007f6e52225fa0 RCX: 00007f6e51f9e019 [ 525.784320][T13718] RDX: 0000000000000000 RSI: 0000200000000340 RDI: 0000000000000003 [ 525.784331][T13718] RBP: 00007f6e501f6090 R08: 0000000000000000 R09: 0000000000000000 [ 525.784341][T13718] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 525.784351][T13718] R13: 00007f6e52226038 R14: 00007f6e52225fa0 R15: 00007f6e5234fa48 [ 525.784380][T13718] [ 526.426965][ T10] usb 2-1: 1:1: cannot get freq (v2/v3): err -71 [ 526.447459][ T10] usb 2-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 526.572415][ T10] usb 2-1: USB disconnect, device number 89 [ 526.712812][T13729] syzkaller0: entered promiscuous mode [ 526.725743][T13729] syzkaller0: entered allmulticast mode [ 526.760576][ T5721] usb 5-1: new full-speed USB device number 96 using dummy_hcd [ 526.798061][T13729] tipc: Enabled bearer , priority 0 [ 526.810212][T13728] tipc: Resetting bearer [ 526.836654][T13728] tipc: Disabling bearer [ 526.913217][ T5721] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 526.925013][ T5721] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 526.963202][ T5721] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 526.997154][ T5721] usb 5-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 527.010146][ T5721] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 527.019546][ T5721] usb 5-1: Product: syz [ 527.023940][ T5721] usb 5-1: Manufacturer: syz [ 527.029140][ T5721] usb 5-1: SerialNumber: syz [ 527.038143][ T5721] usb 5-1: config 0 descriptor?? [ 527.048566][T13725] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 527.122957][T13736] FAULT_INJECTION: forcing a failure. [ 527.122957][T13736] name failslab, interval 1, probability 0, space 0, times 0 [ 527.137321][T13736] CPU: 1 UID: 0 PID: 13736 Comm: syz.1.2528 Tainted: G L syzkaller #0 PREEMPT(full) [ 527.137349][T13736] Tainted: [L]=SOFTLOCKUP [ 527.137355][T13736] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 527.137366][T13736] Call Trace: [ 527.137373][T13736] [ 527.137380][T13736] dump_stack_lvl+0xe8/0x150 [ 527.137409][T13736] should_fail_ex+0x40c/0x560 [ 527.137434][T13736] should_failslab+0xa8/0x100 [ 527.137461][T13736] __kmalloc_noprof+0xfe/0x720 [ 527.137482][T13736] ? percpu_ref_get_many+0x21/0x1e0 [ 527.137505][T13736] ? io_cache_alloc_new+0x40/0x100 [ 527.137612][T13736] ? io_cache_alloc_new+0x40/0x100 [ 527.137640][T13736] io_cache_alloc_new+0x40/0x100 [ 527.137663][T13736] __io_prep_rw+0x281/0xe70 [ 527.137714][T13736] ? percpu_ref_get_many+0x18c/0x1e0 [ 527.137736][T13736] ? __io_alloc_req_refill+0x284/0x310 [ 527.137765][T13736] ? __pfx___io_prep_rw+0x10/0x10 [ 527.137801][T13736] io_prep_writev_fixed+0x25/0xe0 [ 527.137827][T13736] io_submit_sqes+0xbde/0x2310 [ 527.137876][T13736] __se_sys_io_uring_enter+0x35b/0x1bb0 [ 527.137908][T13736] ? __fget_files+0x3a2/0x420 [ 527.137933][T13736] ? __pfx___se_sys_io_uring_enter+0x10/0x10 [ 527.137955][T13736] ? fput+0xa0/0xd0 [ 527.137987][T13736] ? ksys_write+0x242/0x270 [ 527.138004][T13736] ? __pfx_ksys_write+0x10/0x10 [ 527.138024][T13736] ? __x64_sys_io_uring_enter+0x21/0xf0 [ 527.138046][T13736] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 527.138064][T13736] do_syscall_64+0x174/0x580 [ 527.138084][T13736] ? trace_irq_disable+0x3b/0x140 [ 527.138106][T13736] ? clear_bhb_loop+0x40/0x90 [ 527.138126][T13736] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 527.138142][T13736] RIP: 0033:0x7f635979e019 [ 527.138158][T13736] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 527.138171][T13736] RSP: 002b:00007f635a70c028 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 527.138188][T13736] RAX: ffffffffffffffda RBX: 00007f6359a25fa0 RCX: 00007f635979e019 [ 527.138199][T13736] RDX: 0000000000000001 RSI: 0000000000000001 RDI: 0000000000000003 [ 527.138209][T13736] RBP: 00007f635a70c090 R08: 0000000000000000 R09: 0000000000000000 [ 527.138218][T13736] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001 [ 527.138228][T13736] R13: 00007f6359a26038 R14: 00007f6359a25fa0 R15: 00007f6359b4fa48 [ 527.138256][T13736] [ 527.378153][ T10] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 527.513749][ T5721] rc_core: IR keymap rc-streamzap not found [ 527.519728][ T5721] Registered IR keymap rc-empty [ 527.526078][ T5721] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 527.532977][ T10] usb 4-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 527.539540][ T5721] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input43 [ 527.555687][T13741] __nla_validate_parse: 22 callbacks suppressed [ 527.555807][T13741] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2530'. [ 527.589268][ T10] usb 4-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 527.665839][ T10] usb 4-1: config 0 interface 0 has no altsetting 0 [ 527.700151][ T10] usb 4-1: New USB device found, idVendor=0458, idProduct=5013, bcdDevice= 0.00 [ 527.713818][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 527.762872][ T10] usb 4-1: config 0 descriptor?? [ 527.786652][T13744] netlink: 'syz.1.2529': attribute type 61 has an invalid length. [ 528.026793][T13733] loop8: detected capacity change from 0 to 8 [ 528.080093][T13733] Dev loop8: unable to read RDB block 8 [ 528.119783][T13733] loop8: unable to read partition table [ 528.145024][T13733] loop8: partition table beyond EOD, truncated [ 528.195375][T13733] loop_reread_partitions: partition scan of loop8 (þ被xü^>æ) failed (rc=-5) [ 528.775106][ T9] usb 5-1: USB disconnect, device number 96 [ 528.811538][T12385] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 528.975976][T12385] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 528.986134][T12385] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 528.997833][T12385] usb 2-1: Product: syz [ 529.004681][ T10] usbhid 4-1:0.0: can't add hid device: -71 [ 529.023701][T12385] usb 2-1: Manufacturer: syz [ 529.029885][ T10] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 529.039012][T12385] usb 2-1: SerialNumber: syz [ 529.064035][ T10] usb 4-1: USB disconnect, device number 85 [ 529.105002][T13761] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 529.462276][T12385] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 529.476797][T12385] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 529.490528][T12385] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 529.503568][T12385] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 529.514988][T12385] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 529.525283][T12385] lan78xx 2-1:1.0: probe with driver lan78xx failed with error -32 [ 529.684236][ T10] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 529.821108][ T10] usb 5-1: device descriptor read/64, error -71 [ 529.868435][ T5721] usb 2-1: USB disconnect, device number 90 [ 529.990492][T13777] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 530.000348][T13777] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 530.071489][ T10] usb 5-1: new high-speed USB device number 98 using dummy_hcd [ 530.211126][ T10] usb 5-1: device descriptor read/64, error -71 [ 530.321914][ T10] usb usb5-port1: attempt power cycle [ 530.580418][T13786] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 530.605737][T13786] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 530.661680][ T10] usb 5-1: new high-speed USB device number 99 using dummy_hcd [ 530.704559][ T10] usb 5-1: device descriptor read/8, error -71 [ 530.961409][ T10] usb 5-1: new high-speed USB device number 100 using dummy_hcd [ 530.994273][ T10] usb 5-1: device descriptor read/8, error -71 [ 531.121350][ T10] usb usb5-port1: unable to enumerate USB device [ 531.181173][ T9] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 531.246555][T13805] program syz.2.2547 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 531.361753][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 531.379574][ T9] usb 4-1: config 0 has an invalid interface number: 51 but max is 0 [ 531.379592][ T9] usb 4-1: config 0 has no interface number 0 [ 531.379616][ T9] usb 4-1: config 0 interface 51 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 531.382850][ T9] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 531.382868][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 531.382879][ T9] usb 4-1: Product: syz [ 531.382887][ T9] usb 4-1: Manufacturer: syz [ 531.382896][ T9] usb 4-1: SerialNumber: syz [ 531.385365][ T9] usb 4-1: config 0 descriptor?? [ 531.390656][ T9] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 531.433342][T13809] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 531.440420][T13809] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 531.605251][ T9] usb 4-1: qt2_setup_urbs - submit read urb failed -8 [ 531.605467][ T9] quatech2 4-1:0.51: probe with driver quatech2 failed with error -8 [ 531.826050][ T24] usb 4-1: USB disconnect, device number 86 [ 531.951335][ T5721] usb 1-1: new low-speed USB device number 117 using dummy_hcd [ 532.111499][ T5721] usb 1-1: device descriptor read/64, error -71 [ 532.164074][T13818] netlink: 196 bytes leftover after parsing attributes in process `syz.2.2550'. [ 532.352620][ T5721] usb 1-1: new low-speed USB device number 118 using dummy_hcd [ 532.501159][ T5721] usb 1-1: device descriptor read/64, error -71 [ 532.597988][T13825] vlan3: entered promiscuous mode [ 532.621562][ T5721] usb usb1-port1: attempt power cycle [ 532.633357][T13825] bridge0: entered promiscuous mode [ 532.983146][ T5721] usb 1-1: new low-speed USB device number 119 using dummy_hcd [ 533.032745][ T5721] usb 1-1: device descriptor read/8, error -71 [ 533.104244][T12385] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 533.161215][ T5714] usb 5-1: new high-speed USB device number 101 using dummy_hcd [ 533.273037][T12385] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 128, changing to 11 [ 533.281155][ T5721] usb 1-1: new low-speed USB device number 120 using dummy_hcd [ 533.294617][T12385] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1023 [ 533.308983][T13861] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 533.316077][T12385] usb 4-1: config 1 interface 1 altsetting 1 has an endpoint descriptor with address 0xBF, changing to 0x8F [ 533.324171][ T5721] usb 1-1: device descriptor read/8, error -71 [ 533.336089][ T5714] usb 5-1: Using ep0 maxpacket: 16 [ 533.339161][T12385] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x8F has an invalid bInterval 145, changing to 11 [ 533.343074][T13861] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 533.363895][ T5714] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 533.365257][T12385] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice= 0.40 [ 533.376446][ T5714] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 533.396449][T12385] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 533.408066][T12385] usb 4-1: Product: syz [ 533.413876][T12385] usb 4-1: Manufacturer: syz [ 533.417705][ T5714] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 533.418727][T12385] usb 4-1: SerialNumber: syz [ 533.429226][ T5714] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 533.450768][ T5714] usb 5-1: Product: syz [ 533.455257][ T5714] usb 5-1: Manufacturer: syz [ 533.459908][ T5714] usb 5-1: SerialNumber: syz [ 533.468833][ T5714] usb 5-1: config 0 descriptor?? [ 533.474305][ T5721] usb usb1-port1: unable to enumerate USB device [ 533.485952][ T5714] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 533.495399][ T5714] em28xx 5-1:0.0: Audio interface 0 found (Vendor Class) [ 533.652723][T13840] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 533.668073][T13840] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 533.705755][T12385] cdc_ncm 4-1:1.0: bind() failure [ 533.713726][T12385] usbtest 4-1:1.0: Linux gadget zero [ 533.719072][T12385] usbtest 4-1:1.0: high-speed {control in/out int-in} tests (+alt) [ 533.733919][T12385] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 533.753886][T12385] cdc_ncm 4-1:1.1: bind() failure [ 533.765899][T12385] usbtest 4-1:1.1: couldn't get endpoints, -71 [ 533.773274][T12385] usbtest 4-1:1.1: probe with driver usbtest failed with error -71 [ 533.786358][T12385] usb 4-1: USB disconnect, device number 87 [ 534.086776][ T5714] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 534.099488][ T5714] em28xx 5-1:0.0: Config register raw data: 0x20 [ 534.108366][ T5714] em28xx 5-1:0.0: I2S Audio (1 sample rate(s)) [ 534.119883][ T5714] em28xx 5-1:0.0: No AC97 audio processor [ 534.492776][T13876] ptrace attach of "ci-upstream-kasan-gce/syz-executor exec"[5642] was attempted by " Àÿ Ðÿ ð¥ Àÿ Àÿ Ðÿ àÿ ðÿ °ÿ Àÿ ÿÿÿÿ @ ¾R4HA+¨ ¤·$n\x0cæ\x5cÎ8bâ3°–%wƒ3ÆïÈÐB艄3UéÐ;3bçôPeî¯ïÐÒ\x09öÚ¹§\x22ß¡¥†ª’ªï¥ô±Ãm„\x0aa–7Âͧyö Ñì×Á{Ñv…Ä=&1Bm”ЦÊx?õ’lªCBƒî‚‘üÿÈ“ØVŠ>ˆ¦‘\x0b€ý%J€K©Ú¾÷/âpÕ×-nGÓ‰4Hk0¶?áŠeÑíeÔⲓ_6y­íÃèî¦vÒÖ±;~ЯàX“\x0cpé„£!Jß\x07¨%bíc™Ç&ÜÕ>=þ\x099«ÁÞßà \x0bä_3‘u—5ü9J:¼«Êa,5fPð•™³I5ZšKî¸|`ŠiÔ@|u#Ÿ\x1b‰çqï×C!8…0™\x5c¸¹|èЋŒÂ2Š~9u­\x0aZ™8—KAݹKtÍ×nÌŠiëœRY+Úܹp‚¯&bˆþÊË\x5cŽ×ü°¿…”¼qm_`z£4YŠó›ôZªO\x5cK™Ÿ\x0d\x0bÀZù«gíæÄcˇpÛ“ \x07µáò€š:=^hX;ÛöÛ`K&Îæ_ÝÆÍäàžê~}JÛ¥,—‹-f„cö*’ÛÓ­‹~4'ƒ)z¿¹\x07Ú\x22YIm4ª~$ñ‰‹¨\x0cÏgm«.eÏØjÑŠ0€ª¨¯Åèè³µén&ãé1›¢®o­0<”¤\x09«€Õ=L\x5ck&F™œ¼Fõ‚Z¡p‡C,`¥ÖŽ{³Îÿµ•[¦åQ¿:ÊodÍ›1Øï.á÷y3,ê¡q$+–g |¬ÑÖâktì! Vݲ»¯ÉØRBJ­Í3âN¥¥Ù0OlýG¦0éqª××àƒCév\x0blà?¶’˜4tNu“XÀò4£&”Èä4aáI„z¦Þ$ÂÂ\x0cŠ®0\ [ 534.630845][T13882] netlink: 'syz.0.2574': attribute type 2 has an invalid length. [ 534.747759][T13878] netlink: 'syz.1.2571': attribute type 13 has an invalid length. [ 534.825972][ T5714] usb 5-1: USB disconnect, device number 101 [ 534.851705][ T10] usb 4-1: new low-speed USB device number 88 using dummy_hcd [ 534.935519][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 535.002922][ T10] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 535.012884][ T10] usb 4-1: config 0 has no interface number 0 [ 535.031769][ T10] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 535.056490][ T10] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 535.060037][T13890] fuse: Bad value for 'fd' [ 535.087861][ T10] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 535.105015][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 535.119311][ T10] usb 4-1: config 0 descriptor?? [ 535.132453][T13881] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 535.155682][ T10] iowarrior 4-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 535.222440][ T24] usb 1-1: new high-speed USB device number 121 using dummy_hcd [ 535.254961][T13884] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 535.270856][T13884] syzkaller0: entered promiscuous mode [ 535.277000][ T5714] ip6_tunnel: G„ðl xmit: Local address not yet configured! [ 535.294590][T13884] syzkaller0: entered allmulticast mode [ 535.355621][T13881] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 535.381488][ T24] usb 1-1: Using ep0 maxpacket: 32 [ 535.396522][T13881] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 535.396939][ T24] usb 1-1: unable to get BOS descriptor or descriptor too short [ 535.449743][ T24] usb 1-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0x95, changing to 0x85 [ 535.488154][ T24] usb 1-1: string descriptor 0 read error: -22 [ 535.506031][ T24] usb 1-1: New USB device found, idVendor=249c, idProduct=931c, bcdDevice= 0.40 [ 535.546059][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 535.602953][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 535.642435][ T24] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 535.672762][ T24] usb 1-1: MIDIStreaming interface descriptor not found [ 535.697743][ T7838] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 535.715741][T13892] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 535.821130][ T5714] usb 5-1: new high-speed USB device number 102 using dummy_hcd [ 536.002402][ T24] usb 1-1: USB disconnect, device number 121 [ 536.011311][ T5714] usb 5-1: Using ep0 maxpacket: 8 [ 536.054681][ T5714] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 536.090632][ T5714] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 536.135213][ T5714] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 536.164918][ T5714] usb 5-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 536.189391][ T5714] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 536.205389][ T5714] usb 5-1: Product: syz [ 536.215441][ T5714] usb 5-1: Manufacturer: syz [ 536.236281][ T5714] usb 5-1: SerialNumber: syz [ 536.272281][ T5722] ip6_tunnel: G„ðl xmit: Local address not yet configured! [ 536.764453][ T9] usb 1-1: new high-speed USB device number 122 using dummy_hcd [ 536.931491][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 536.947657][ T9] usb 1-1: config 0 has an invalid interface number: 51 but max is 0 [ 536.969246][ T9] usb 1-1: config 0 has no interface number 0 [ 536.976176][ T9] usb 1-1: config 0 interface 51 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 536.986439][ T9] usb 1-1: config 0 interface 51 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 537.006586][ T9] usb 1-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 537.016356][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 537.025140][ T9] usb 1-1: Product: syz [ 537.029608][ T9] usb 1-1: Manufacturer: syz [ 537.038953][ T9] usb 1-1: SerialNumber: syz [ 537.059369][ T9] usb 1-1: config 0 descriptor?? [ 537.084565][ T9] quatech2 1-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 537.217353][T13901] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 537.245137][ T5714] usb 5-1: 1:1: cannot get freq (v2/v3): err -71 [ 537.252240][ T5714] usb 5-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 537.263203][T13901] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 537.295143][ T9] usb 1-1: qt2_setup_urbs - submit read urb failed -90 [ 537.304203][ T9] quatech2 1-1:0.51: probe with driver quatech2 failed with error -90 [ 537.317586][T13901] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 537.336032][T13901] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 537.371529][ T5714] usb 5-1: USB disconnect, device number 102 [ 537.504918][ T9] usb 1-1: USB disconnect, device number 122 [ 537.660214][ T10] usb 4-1: USB disconnect, device number 88 [ 537.712248][T13907] FAULT_INJECTION: forcing a failure. [ 537.712248][T13907] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 537.730533][T13907] CPU: 1 UID: 0 PID: 13907 Comm: syz.1.2581 Tainted: G L syzkaller #0 PREEMPT(full) [ 537.730561][T13907] Tainted: [L]=SOFTLOCKUP [ 537.730568][T13907] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 537.730578][T13907] Call Trace: [ 537.730585][T13907] [ 537.730592][T13907] dump_stack_lvl+0xe8/0x150 [ 537.730623][T13907] should_fail_ex+0x40c/0x560 [ 537.730649][T13907] _copy_from_user+0x2d/0xb0 [ 537.730668][T13907] dev_ethtool+0xdb/0x29c0 [ 537.730782][T13907] ? __lock_acquire+0x683/0x2cf0 [ 537.730819][T13907] ? __pfx_dev_ethtool+0x10/0x10 [ 537.730844][T13907] ? kasan_quarantine_put+0xbb/0x1f0 [ 537.730869][T13907] ? dev_load+0x21/0x1f0 [ 537.730940][T13907] ? dev_load+0x21/0x1f0 [ 537.730960][T13907] ? dev_load+0x21/0x1f0 [ 537.730979][T13907] dev_ioctl+0x392/0x1150 [ 537.731003][T13907] sock_do_ioctl+0x23e/0x320 [ 537.731027][T13907] ? __pfx_sock_do_ioctl+0x10/0x10 [ 537.731048][T13907] ? hook_file_ioctl+0x1f0/0x5f0 [ 537.731080][T13907] sock_ioctl+0x57a/0x7e0 [ 537.731104][T13907] ? __pfx_sock_ioctl+0x10/0x10 [ 537.731126][T13907] ? __fget_files+0x2a/0x420 [ 537.731149][T13907] ? __fget_files+0x3a2/0x420 [ 537.731170][T13907] ? __fget_files+0x2a/0x420 [ 537.731195][T13907] ? bpf_lsm_file_ioctl+0x9/0x20 [ 537.731215][T13907] ? __pfx_sock_ioctl+0x10/0x10 [ 537.731237][T13907] __se_sys_ioctl+0xfc/0x170 [ 537.731255][T13907] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 537.731274][T13907] do_syscall_64+0x174/0x580 [ 537.731295][T13907] ? trace_irq_disable+0x3b/0x140 [ 537.731317][T13907] ? clear_bhb_loop+0x40/0x90 [ 537.731338][T13907] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 537.731355][T13907] RIP: 0033:0x7f635979e019 [ 537.731371][T13907] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 537.731386][T13907] RSP: 002b:00007f635a70c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 537.731405][T13907] RAX: ffffffffffffffda RBX: 00007f6359a25fa0 RCX: 00007f635979e019 [ 537.731418][T13907] RDX: 0000200000000540 RSI: 0000000000008946 RDI: 0000000000000004 [ 537.731429][T13907] RBP: 00007f635a70c090 R08: 0000000000000000 R09: 0000000000000000 [ 537.731440][T13907] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 537.731450][T13907] R13: 00007f6359a26038 R14: 00007f6359a25fa0 R15: 00007f6359b4fa48 [ 537.731479][T13907] [ 537.984975][T13915] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 537.996959][T13915] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 538.020984][T13917] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 538.060190][T13917] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 538.076151][T13917] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 538.089159][T13917] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 538.139506][T13919] FAULT_INJECTION: forcing a failure. [ 538.139506][T13919] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 538.155271][T13919] CPU: 1 UID: 0 PID: 13919 Comm: syz.4.2587 Tainted: G L syzkaller #0 PREEMPT(full) [ 538.155301][T13919] Tainted: [L]=SOFTLOCKUP [ 538.155308][T13919] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 538.155318][T13919] Call Trace: [ 538.155325][T13919] [ 538.155333][T13919] dump_stack_lvl+0xe8/0x150 [ 538.155364][T13919] should_fail_ex+0x40c/0x560 [ 538.155391][T13919] _copy_to_user+0x31/0xb0 [ 538.155411][T13919] simple_read_from_buffer+0xe1/0x170 [ 538.155440][T13919] proc_fail_nth_read+0x1bb/0x230 [ 538.155467][T13919] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 538.155493][T13919] ? rw_verify_area+0x24a/0x4c0 [ 538.155512][T13919] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 538.155534][T13919] vfs_read+0x213/0xa80 [ 538.155556][T13919] ? __pfx___mutex_lock+0x10/0x10 [ 538.155578][T13919] ? __pfx_vfs_read+0x10/0x10 [ 538.155596][T13919] ? __fget_files+0x2a/0x420 [ 538.155622][T13919] ? __fget_files+0x3a2/0x420 [ 538.155642][T13919] ? __fget_files+0x2a/0x420 [ 538.155671][T13919] ksys_read+0x150/0x270 [ 538.155698][T13919] ? __pfx_ksys_read+0x10/0x10 [ 538.155712][T13919] ? fput+0xa0/0xd0 [ 538.155740][T13919] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 538.155759][T13919] do_syscall_64+0x174/0x580 [ 538.155776][T13919] ? trace_irq_disable+0x3b/0x140 [ 538.155796][T13919] ? clear_bhb_loop+0x40/0x90 [ 538.155815][T13919] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 538.155830][T13919] RIP: 0033:0x7fbd4db5e84e [ 538.155847][T13919] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 538.155860][T13919] RSP: 002b:00007fbd4bdf5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 538.155876][T13919] RAX: ffffffffffffffda RBX: 00007fbd4bdf66c0 RCX: 00007fbd4db5e84e [ 538.155889][T13919] RDX: 000000000000000f RSI: 00007fbd4bdf60a0 RDI: 0000000000000004 [ 538.155900][T13919] RBP: 00007fbd4bdf6090 R08: 0000000000000000 R09: 0000000000000000 [ 538.155911][T13919] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 538.155922][T13919] R13: 00007fbd4de26038 R14: 00007fbd4de25fa0 R15: 00007fbd4df4fa48 [ 538.155949][T13919] [ 538.637740][T13929] vlan3: entered allmulticast mode [ 538.643332][T13929] bridge0: port 3(vlan3) entered blocking state [ 538.649821][T13929] bridge0: port 3(vlan3) entered disabled state [ 538.660003][T13929] vlan3: entered promiscuous mode [ 538.671218][ T5777] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 538.825680][ T5777] usb 2-1: New USB device found, idVendor=6547, idProduct=0232, bcdDevice= 0.00 [ 538.835365][ T5777] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 538.843578][ T5777] usb 2-1: Product: syz [ 538.848014][ T5777] usb 2-1: Manufacturer: syz [ 538.853996][ T5777] usb 2-1: SerialNumber: syz [ 538.868469][ T5777] ark3116 2-1:1.0: ark3116 converter detected [ 539.038748][T13945] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 539.061537][T13945] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 539.088200][T13945] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 539.093346][ T5777] ark3116 ttyUSB0: using RS232 mode [ 539.097142][T13945] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 539.114428][ T5777] usb 2-1: ark3116 converter now attached to ttyUSB0 [ 539.160004][ T5777] usb 2-1: USB disconnect, device number 91 [ 539.198950][ T5777] ark3116 ttyUSB0: ark3116 converter now disconnected from ttyUSB0 [ 539.209399][ T5777] ark3116 2-1:1.0: device disconnected [ 539.404501][T13953] tipc: Resetting bearer [ 539.422979][ T5714] usb 5-1: new high-speed USB device number 103 using dummy_hcd [ 539.563125][ T5714] usb 5-1: device descriptor read/64, error -71 [ 539.706304][T13962] ip6erspan0: entered allmulticast mode [ 539.759507][T13971] FAULT_INJECTION: forcing a failure. [ 539.759507][T13971] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 539.801168][T13971] CPU: 1 UID: 0 PID: 13971 Comm: syz.0.2605 Tainted: G L syzkaller #0 PREEMPT(full) [ 539.801200][T13971] Tainted: [L]=SOFTLOCKUP [ 539.801206][T13971] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 539.801216][T13971] Call Trace: [ 539.801224][T13971] [ 539.801232][T13971] dump_stack_lvl+0xe8/0x150 [ 539.801262][T13971] should_fail_ex+0x40c/0x560 [ 539.801289][T13971] _copy_from_user+0x2d/0xb0 [ 539.801308][T13971] ___sys_sendmsg+0x1c6/0x360 [ 539.801329][T13971] ? __lock_acquire+0x683/0x2cf0 [ 539.801356][T13971] ? __pfx____sys_sendmsg+0x10/0x10 [ 539.801380][T13971] ? kstrtouint+0x6e/0xe0 [ 539.801424][T13971] ? __fget_files+0x2a/0x420 [ 539.801445][T13971] ? __fget_files+0x3a2/0x420 [ 539.801475][T13971] __sys_sendmmsg+0x273/0x4d0 [ 539.801499][T13971] ? __pfx___sys_sendmmsg+0x10/0x10 [ 539.801526][T13971] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 539.801562][T13971] ? ksys_write+0x242/0x270 [ 539.801590][T13971] ? __pfx_ksys_write+0x10/0x10 [ 539.801614][T13971] __x64_sys_sendmmsg+0xa0/0xc0 [ 539.801635][T13971] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 539.801653][T13971] do_syscall_64+0x174/0x580 [ 539.801674][T13971] ? trace_irq_disable+0x3b/0x140 [ 539.801696][T13971] ? clear_bhb_loop+0x40/0x90 [ 539.801718][T13971] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 539.801735][T13971] RIP: 0033:0x7f6d7879e019 [ 539.801752][T13971] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 539.801767][T13971] RSP: 002b:00007f6d795ca028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 539.801786][T13971] RAX: ffffffffffffffda RBX: 00007f6d78a25fa0 RCX: 00007f6d7879e019 [ 539.801799][T13971] RDX: 0000000000000002 RSI: 000020000000a440 RDI: 0000000000000004 [ 539.801811][T13971] RBP: 00007f6d795ca090 R08: 0000000000000000 R09: 0000000000000000 [ 539.801822][T13971] R10: 0000000000044051 R11: 0000000000000246 R12: 0000000000000001 [ 539.801833][T13971] R13: 00007f6d78a26038 R14: 00007f6d78a25fa0 R15: 00007f6d78b4fa48 [ 539.801861][T13971] [ 539.963695][ T5777] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 539.973661][ T5714] usb 5-1: new high-speed USB device number 104 using dummy_hcd [ 540.281116][ T5714] usb 5-1: device descriptor read/64, error -71 [ 540.321083][ T5777] usb 2-1: Using ep0 maxpacket: 8 [ 540.328079][ T5777] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 540.339667][ T5777] usb 2-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 540.349092][ T5777] usb 2-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 540.367672][ T5777] usb 2-1: Product: syz [ 540.372117][ T5777] usb 2-1: Manufacturer: syz [ 540.387768][ T5777] usb 2-1: SerialNumber: syz [ 540.395293][ T5714] usb usb5-port1: attempt power cycle [ 540.493570][ T9] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 540.608826][ T5777] usb 2-1: Invalid connection information received from device [ 540.651681][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 540.663853][ T9] usb 4-1: config 0 interface 0 altsetting 88 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 540.678155][ T9] usb 4-1: config 0 interface 0 has no altsetting 0 [ 540.685307][ T9] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d50, bcdDevice= 0.00 [ 540.695711][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 540.728665][ T9] usb 4-1: config 0 descriptor?? [ 540.741395][ T5714] usb 5-1: new high-speed USB device number 105 using dummy_hcd [ 540.771887][ T5714] usb 5-1: device descriptor read/8, error -71 [ 540.926931][T13989] FAULT_INJECTION: forcing a failure. [ 540.926931][T13989] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 540.984194][T13989] CPU: 1 UID: 0 PID: 13989 Comm: syz.2.2610 Tainted: G L syzkaller #0 PREEMPT(full) [ 540.984225][T13989] Tainted: [L]=SOFTLOCKUP [ 540.984231][T13989] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 540.984242][T13989] Call Trace: [ 540.984250][T13989] [ 540.984258][T13989] dump_stack_lvl+0xe8/0x150 [ 540.984291][T13989] should_fail_ex+0x40c/0x560 [ 540.984320][T13989] _copy_from_iter+0x1d3/0x1660 [ 540.984344][T13989] ? kmem_cache_alloc_node_noprof+0x141/0x610 [ 540.984369][T13989] ? rcu_is_watching+0x15/0xb0 [ 540.984388][T13989] ? trace_kmem_cache_alloc+0x29/0xe0 [ 540.984411][T13989] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 540.984433][T13989] ? __pfx__copy_from_iter+0x10/0x10 [ 540.984461][T13989] ? __alloc_skb+0x276/0x7a0 [ 540.984477][T13989] ? __alloc_skb+0x276/0x7a0 [ 540.984500][T13989] ? netlink_sendmsg+0x650/0xb40 [ 540.984521][T13989] ? skb_put+0x112/0x210 [ 540.984540][T13989] netlink_sendmsg+0x6c0/0xb40 [ 540.984564][T13989] ? __pfx_netlink_sendmsg+0x10/0x10 [ 540.984588][T13989] ? aa_sock_msg_perm+0xf1/0x1b0 [ 540.984611][T13989] ? __pfx_netlink_sendmsg+0x10/0x10 [ 540.984638][T13989] sock_sendmsg_nosec+0x13a/0x180 [ 540.984677][T13989] ____sys_sendmsg+0x54e/0x850 [ 540.984719][T13989] ? __pfx_____sys_sendmsg+0x10/0x10 [ 540.984766][T13989] ? import_iovec+0x73/0xa0 [ 540.984787][T13989] ___sys_sendmsg+0x2a5/0x360 [ 540.984806][T13989] ? __lock_acquire+0x683/0x2cf0 [ 540.984834][T13989] ? __pfx____sys_sendmsg+0x10/0x10 [ 540.984885][T13989] ? __fget_files+0x2a/0x420 [ 540.984908][T13989] ? __fget_files+0x3a2/0x420 [ 540.984940][T13989] __x64_sys_sendmsg+0x1b1/0x290 [ 540.984964][T13989] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 540.985000][T13989] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 540.985019][T13989] do_syscall_64+0x174/0x580 [ 540.985040][T13989] ? trace_irq_disable+0x3b/0x140 [ 540.985063][T13989] ? clear_bhb_loop+0x40/0x90 [ 540.985084][T13989] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 540.985102][T13989] RIP: 0033:0x7f6e51f9e019 [ 540.985120][T13989] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 540.985143][T13989] RSP: 002b:00007f6e501f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 540.985163][T13989] RAX: ffffffffffffffda RBX: 00007f6e52225fa0 RCX: 00007f6e51f9e019 [ 540.985176][T13989] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000005 [ 540.985187][T13989] RBP: 00007f6e501f6090 R08: 0000000000000000 R09: 0000000000000000 [ 540.985198][T13989] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 540.985209][T13989] R13: 00007f6e52226038 R14: 00007f6e52225fa0 R15: 00007f6e5234fa48 [ 540.985238][T13989] [ 541.265054][ T5714] usb 5-1: new high-speed USB device number 106 using dummy_hcd [ 541.276877][ T9] kovaplus 0003:1E7D:2D50.0017: unknown main item tag 0x0 [ 541.296564][ T9] kovaplus 0003:1E7D:2D50.0017: unknown main item tag 0x0 [ 541.312043][ T5714] usb 5-1: device descriptor read/8, error -71 [ 541.321723][ T9] kovaplus 0003:1E7D:2D50.0017: unknown main item tag 0x0 [ 541.341858][ T9] kovaplus 0003:1E7D:2D50.0017: unknown main item tag 0x0 [ 541.369904][ T9] kovaplus 0003:1E7D:2D50.0017: unknown main item tag 0x0 [ 541.393375][ T9] kovaplus 0003:1E7D:2D50.0017: unknown main item tag 0x0 [ 541.418389][ T10] usb 2-1: USB disconnect, device number 92 [ 541.431335][ T5714] usb usb5-port1: unable to enumerate USB device [ 541.442968][ T9] kovaplus 0003:1E7D:2D50.0017: unknown main item tag 0x0 [ 541.477897][ T9] kovaplus 0003:1E7D:2D50.0017: unknown main item tag 0x0 [ 541.514554][ T9] kovaplus 0003:1E7D:2D50.0017: unknown main item tag 0x0 [ 541.554817][ T9] kovaplus 0003:1E7D:2D50.0017: unknown main item tag 0x0 [ 541.567024][T13995] IPVS: rr: FWM 3 0x00000003 - no destination available [ 541.589753][ T9] kovaplus 0003:1E7D:2D50.0017: hidraw0: USB HID v0.81 Device [HID 1e7d:2d50] on usb-dummy_hcd.3-1/input0 [ 541.752859][T14002] netlink: 64 bytes leftover after parsing attributes in process `syz.0.2613'. [ 541.772803][T14002] syzkaller1: entered promiscuous mode [ 541.780493][T14002] syzkaller1: entered allmulticast mode [ 541.794588][T14002] FAULT_INJECTION: forcing a failure. [ 541.794588][T14002] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 541.824807][T14002] CPU: 1 UID: 0 PID: 14002 Comm: syz.0.2613 Tainted: G L syzkaller #0 PREEMPT(full) [ 541.824835][T14002] Tainted: [L]=SOFTLOCKUP [ 541.824842][T14002] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 541.824853][T14002] Call Trace: [ 541.824861][T14002] [ 541.824869][T14002] dump_stack_lvl+0xe8/0x150 [ 541.824898][T14002] should_fail_ex+0x40c/0x560 [ 541.824926][T14002] _copy_from_iter+0x1d3/0x1660 [ 541.824948][T14002] ? skb_set_owner_w+0x263/0x3d0 [ 541.824980][T14002] ? __pfx__copy_from_iter+0x10/0x10 [ 541.825011][T14002] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 541.825035][T14002] skb_copy_datagram_from_iter+0xe6/0x720 [ 541.825062][T14002] ? skb_put+0x112/0x210 [ 541.825083][T14002] tun_get_user+0x1520/0x4370 [ 541.825123][T14002] ? aa_file_perm+0x18b/0x15f0 [ 541.825148][T14002] ? aa_file_perm+0x4ed/0x15f0 [ 541.825168][T14002] ? __pfx_tun_get_user+0x10/0x10 [ 541.825193][T14002] ? __lock_acquire+0x683/0x2cf0 [ 541.825220][T14002] ? kstrtoull+0x12f/0x1d0 [ 541.825248][T14002] ? ref_tracker_alloc+0x341/0x4b0 [ 541.825269][T14002] ? get_pid_task+0x20/0x1f0 [ 541.825293][T14002] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 541.825316][T14002] ? tun_get+0x1c/0x2f0 [ 541.825340][T14002] ? tun_get+0x1c/0x2f0 [ 541.825368][T14002] ? tun_get+0x1c/0x2f0 [ 541.825391][T14002] ? tun_get+0x1c/0x2f0 [ 541.825426][T14002] tun_chr_write_iter+0x113/0x200 [ 541.825454][T14002] vfs_write+0x612/0xba0 [ 541.825479][T14002] ? __pfx_vfs_write+0x10/0x10 [ 541.825506][T14002] ? __fget_files+0x2a/0x420 [ 541.825534][T14002] ksys_write+0x150/0x270 [ 541.825553][T14002] ? __pfx_ksys_write+0x10/0x10 [ 541.825578][T14002] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 541.825598][T14002] do_syscall_64+0x174/0x580 [ 541.825620][T14002] ? trace_irq_disable+0x3b/0x140 [ 541.825643][T14002] ? clear_bhb_loop+0x40/0x90 [ 541.825664][T14002] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 541.825682][T14002] RIP: 0033:0x7f6d7879e019 [ 541.825699][T14002] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 541.825715][T14002] RSP: 002b:00007f6d795ca028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 541.825734][T14002] RAX: ffffffffffffffda RBX: 00007f6d78a25fa0 RCX: 00007f6d7879e019 [ 541.825747][T14002] RDX: 000000000000003e RSI: 0000200000000840 RDI: 0000000000000003 [ 541.825759][T14002] RBP: 00007f6d795ca090 R08: 0000000000000000 R09: 0000000000000000 [ 541.825770][T14002] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 541.825781][T14002] R13: 00007f6d78a26038 R14: 00007f6d78a25fa0 R15: 00007f6d78b4fa48 [ 541.825810][T14002] [ 542.131941][T14004] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 542.214373][T14004] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 542.235997][ T9] kovaplus 0003:1E7D:2D50.0017: couldn't init struct kovaplus_device [ 542.254253][T14004] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 542.258346][ T9] kovaplus 0003:1E7D:2D50.0017: couldn't install mouse [ 542.275362][T14004] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 542.306320][T14010] netlink: 392 bytes leftover after parsing attributes in process `syz.0.2617'. [ 542.344798][ T9] kovaplus 0003:1E7D:2D50.0017: probe with driver kovaplus failed with error -71 [ 542.389607][ T9] usb 4-1: USB disconnect, device number 89 [ 542.487164][T14010] netlink: 'syz.0.2617': attribute type 2 has an invalid length. [ 542.541614][T12385] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 542.571424][ T10] usb 5-1: new low-speed USB device number 107 using dummy_hcd [ 542.701324][T12385] usb 2-1: Using ep0 maxpacket: 16 [ 542.709508][T12385] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 542.732550][T12385] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 542.750161][ T10] usb 5-1: No LPM exit latency info found, disabling LPM. [ 542.761056][T12385] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 542.791177][T12385] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 542.810563][ T10] usb 5-1: config 5 has an invalid interface number: 10 but max is 0 [ 542.822645][ T10] usb 5-1: config 5 has no interface number 0 [ 542.831576][T12385] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 542.840651][ T10] usb 5-1: config 5 interface 10 altsetting 212 endpoint 0xB has invalid maxpacket 1023, setting to 0 [ 542.855160][ T10] usb 5-1: config 5 interface 10 altsetting 212 endpoint 0x9 has invalid maxpacket 16, setting to 8 [ 542.867884][T12385] usb 2-1: config 0 descriptor?? [ 542.873617][ T10] usb 5-1: config 5 interface 10 altsetting 212 endpoint 0xD has invalid maxpacket 1023, setting to 8 [ 542.908992][ T10] usb 5-1: config 5 interface 10 altsetting 212 has a duplicate endpoint with address 0x1, skipping [ 542.950784][ T10] usb 5-1: config 5 interface 10 altsetting 212 has an invalid descriptor for endpoint zero, skipping [ 542.973227][ T10] usb 5-1: config 5 interface 10 altsetting 212 endpoint 0x7 has invalid maxpacket 64, setting to 8 [ 543.001348][ T10] usb 5-1: config 5 interface 10 altsetting 212 has a duplicate endpoint with address 0x5, skipping [ 543.023745][T14018] fuse: Bad value for 'fd' [ 543.028842][ T10] usb 5-1: config 5 interface 10 altsetting 212 has a duplicate endpoint with address 0x1, skipping [ 543.054069][ T10] usb 5-1: config 5 interface 10 has no altsetting 0 [ 543.067741][ T10] usb 5-1: Dual-Role OTG device on HNP port [ 543.077539][ T10] usb 5-1: New USB device found, idVendor=1199, idProduct=9079, bcdDevice=b4.63 [ 543.100145][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 543.131141][ T10] usb 5-1: Product: Ðœ [ 543.133636][T14023] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2621'. [ 543.135298][ T10] usb 5-1: Manufacturer:  [ 543.153562][ T10] usb 5-1: SerialNumber: Ñ… [ 543.175238][T14009] raw-gadget.4 gadget.4: fail, usb_ep_enable returned -22 [ 543.183186][T14009] raw-gadget.4 gadget.4: fail, usb_ep_enable returned -22 [ 543.265045][T14023] binder: 14022:14023 ioctl c0145608 200000000140 returned -22 [ 543.351247][T14029] netlink: 'syz.3.2622': attribute type 25 has an invalid length. [ 543.371202][T14029] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2622'. [ 543.398565][T14029] fuse: Bad value for 'fd' [ 543.463333][ T10] usb 5-1: USB disconnect, device number 107 [ 543.493947][T12385] usbhid 2-1:0.0: can't add hid device: -71 [ 543.516222][T12385] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 543.550467][T12385] usb 2-1: USB disconnect, device number 93 [ 543.590364][T14034] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 543.641499][T14034] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 543.931129][ T9] usb 1-1: new high-speed USB device number 123 using dummy_hcd [ 543.971189][ T5714] usb 4-1: new high-speed USB device number 90 using dummy_hcd [ 544.093397][ T9] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 544.101127][ T5714] usb 4-1: device descriptor read/64, error -71 [ 544.104009][ T9] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 544.129285][ T9] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 544.139094][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 544.147317][ T9] usb 1-1: SerialNumber: syz [ 544.361309][ T5714] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 544.502575][ T5714] usb 4-1: device descriptor read/64, error -71 [ 544.550452][T14054] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2630'. [ 544.610371][T14054] binder: 14053:14054 ioctl c0145608 200000000140 returned -22 [ 544.622716][ T5714] usb usb4-port1: attempt power cycle [ 544.951203][ T5722] usb 5-1: new high-speed USB device number 108 using dummy_hcd [ 544.971143][ T5714] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 544.991788][ T5714] usb 4-1: device descriptor read/8, error -71 [ 545.101189][ T5722] usb 5-1: Using ep0 maxpacket: 16 [ 545.108840][ T5722] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x5 has an invalid bInterval 0, changing to 7 [ 545.120313][ T5722] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 545.135215][ T5722] usb 5-1: New USB device found, idVendor=0d46, idProduct=2011, bcdDevice=82.8f [ 545.144779][ T5722] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 545.153357][ T5722] usb 5-1: Product: syz [ 545.157704][ T5722] usb 5-1: Manufacturer: syz [ 545.162591][ T5722] usb 5-1: SerialNumber: syz [ 545.170101][ T5722] usb 5-1: config 0 descriptor?? [ 545.178241][ T5722] kobil_sct 5-1:0.0: KOBIL USB smart card terminal converter detected [ 545.189463][ T5722] usb 5-1: KOBIL USB smart card terminal converter now attached to ttyUSB0 [ 545.231241][ T5714] usb 4-1: new high-speed USB device number 93 using dummy_hcd [ 545.263271][ T5714] usb 4-1: device descriptor read/8, error -71 [ 545.346350][T14061] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2632'. [ 545.372784][T14061] binder: 14060:14061 ioctl c0145608 200000000140 returned -22 [ 545.381574][ T5714] usb usb4-port1: unable to enumerate USB device [ 545.403633][T14057] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 545.421745][T14057] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 545.439869][T14057] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2631'. [ 545.449249][T14057] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 545.475519][ T5714] usb 5-1: USB disconnect, device number 108 [ 545.493330][ T5714] kobil ttyUSB0: KOBIL USB smart card terminal converter now disconnected from ttyUSB0 [ 545.511437][ T5714] kobil_sct 5-1:0.0: device disconnected [ 545.795894][T14068] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2635'. [ 545.815200][T14068] binder: 14067:14068 ioctl c0145608 200000000140 returned -22 [ 546.066946][T14075] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2638'. [ 546.123489][T14075] binder: 14074:14075 ioctl c0145608 200000000140 returned -22 [ 546.501166][ T5714] usb 5-1: new high-speed USB device number 109 using dummy_hcd [ 546.527707][T14081] FAULT_INJECTION: forcing a failure. [ 546.527707][T14081] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 546.546240][T14081] CPU: 0 UID: 0 PID: 14081 Comm: syz.1.2640 Tainted: G L syzkaller #0 PREEMPT(full) [ 546.546270][T14081] Tainted: [L]=SOFTLOCKUP [ 546.546277][T14081] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 546.546288][T14081] Call Trace: [ 546.546295][T14081] [ 546.546303][T14081] dump_stack_lvl+0xe8/0x150 [ 546.546330][T14081] should_fail_ex+0x40c/0x560 [ 546.546356][T14081] _copy_from_user+0x2d/0xb0 [ 546.546374][T14081] ___sys_sendmsg+0x1c6/0x360 [ 546.546393][T14081] ? __lock_acquire+0x683/0x2cf0 [ 546.546421][T14081] ? __pfx____sys_sendmsg+0x10/0x10 [ 546.546439][T14081] ? __lock_acquire+0x683/0x2cf0 [ 546.546466][T14081] ? kstrtouint+0x6e/0xe0 [ 546.546520][T14081] __sys_sendmmsg+0x273/0x4d0 [ 546.546545][T14081] ? __pfx___sys_sendmmsg+0x10/0x10 [ 546.546572][T14081] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 546.546604][T14081] ? ksys_write+0x242/0x270 [ 546.546623][T14081] ? __pfx_ksys_write+0x10/0x10 [ 546.546646][T14081] __x64_sys_sendmmsg+0xa0/0xc0 [ 546.546665][T14081] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 546.546681][T14081] do_syscall_64+0x174/0x580 [ 546.546702][T14081] ? trace_irq_disable+0x3b/0x140 [ 546.546724][T14081] ? clear_bhb_loop+0x40/0x90 [ 546.546746][T14081] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 546.546762][T14081] RIP: 0033:0x7f635979e019 [ 546.546779][T14081] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 546.546793][T14081] RSP: 002b:00007f635a70c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 546.546811][T14081] RAX: ffffffffffffffda RBX: 00007f6359a25fa0 RCX: 00007f635979e019 [ 546.546824][T14081] RDX: 0000000000000300 RSI: 0000200000004d00 RDI: 0000000000000003 [ 546.546835][T14081] RBP: 00007f635a70c090 R08: 0000000000000000 R09: 0000000000000000 [ 546.546847][T14081] R10: 0000000000000f00 R11: 0000000000000246 R12: 0000000000000001 [ 546.546856][T14081] R13: 00007f6359a26038 R14: 00007f6359a25fa0 R15: 00007f6359b4fa48 [ 546.546890][T14081] [ 546.553882][T14083] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 546.670501][ T9] usb 1-1: 0:2 : does not exist [ 546.693937][T14085] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2642'. [ 546.792349][ T5714] usb 5-1: Using ep0 maxpacket: 32 [ 546.807745][ T9] usb 1-1: USB disconnect, device number 123 [ 546.819873][ T5714] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 546.852337][ T5714] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 546.873228][ T5714] usb 5-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 546.875849][T14086] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 546.913649][ T5714] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 546.942278][ T5714] usb 5-1: config 0 descriptor?? [ 546.955268][T13478] udevd[13478]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 547.026376][T14085] binder: 14084:14085 ioctl c0145608 200000000140 returned -22 [ 547.373668][T14105] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 547.384635][T14105] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 547.405800][ T5714] hid_parser_main: 34 callbacks suppressed [ 547.405824][ T5714] ft260 0003:0403:6030.0018: unknown main item tag 0x0 [ 547.431873][ T5714] ft260 0003:0403:6030.0018: unknown main item tag 0x0 [ 547.482359][ T29] audit: type=1326 audit(1785577692.574:727): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14106 comm="syz.1.2649" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f635979e019 code=0x7ffc0000 [ 547.522304][ T5721] usb 4-1: new high-speed USB device number 94 using dummy_hcd [ 547.558554][ T29] audit: type=1326 audit(1785577692.574:728): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14106 comm="syz.1.2649" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f635979e019 code=0x7ffc0000 [ 547.639024][ T29] audit: type=1326 audit(1785577692.604:729): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14106 comm="syz.1.2649" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f635979e019 code=0x7ffc0000 [ 547.687284][ T5721] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 547.711717][T14112] sctp: [Deprecated]: syz.1.2650 (pid 14112) Use of int in max_burst socket option. [ 547.711717][T14112] Use struct sctp_assoc_value instead [ 547.734322][ T29] audit: type=1326 audit(1785577692.624:730): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14106 comm="syz.1.2649" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f635979e019 code=0x7ffc0000 [ 547.770319][ T5721] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 248, changing to 11 [ 547.803808][ T5721] usb 4-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 547.818420][ T29] audit: type=1326 audit(1785577692.624:731): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14106 comm="syz.1.2649" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f635979e019 code=0x7ffc0000 [ 547.829510][ T5721] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 547.884649][ T5721] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 547.922009][ T5721] usb 4-1: Product: syz [ 547.928327][ T5721] usb 4-1: Manufacturer: syz [ 547.933873][ T29] audit: type=1326 audit(1785577692.634:732): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14106 comm="syz.1.2649" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f635979f887 code=0x7ffc0000 [ 547.978306][ T29] audit: type=1326 audit(1785577692.634:733): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14106 comm="syz.1.2649" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7f635975e84e code=0x7ffc0000 [ 548.005799][ T29] audit: type=1326 audit(1785577692.634:734): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14106 comm="syz.1.2649" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7f635975e84e code=0x7ffc0000 [ 548.033311][ T5721] usb 4-1: SerialNumber: syz [ 548.042981][ T29] audit: type=1326 audit(1785577692.634:735): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14106 comm="syz.1.2649" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7f635975e84e code=0x7ffc0000 [ 548.072107][ T29] audit: type=1326 audit(1785577692.634:736): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14106 comm="syz.1.2649" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7f635975e84e code=0x7ffc0000 [ 548.108292][ T5721] usb 4-1: selecting invalid altsetting 1 [ 548.221337][T12385] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 548.240504][ T5714] ft260 0003:0403:6030.0018: failed to retrieve chip version [ 548.250734][ T5714] ft260 0003:0403:6030.0018: probe with driver ft260 failed with error -71 [ 548.275112][ T5714] usb 5-1: USB disconnect, device number 109 [ 548.381564][T12385] usb 2-1: Using ep0 maxpacket: 8 [ 548.392492][T12385] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 548.404437][T12385] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 548.414982][T12385] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 548.432829][T12385] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 548.464968][T12385] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 548.486273][T12385] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 548.608716][T14119] netlink: 'syz.2.2652': attribute type 61 has an invalid length. [ 548.696798][T14120] CUSE: unknown device info "n¸Þ|’zQC*¯" [ 548.697973][T14122] FAULT_INJECTION: forcing a failure. [ 548.697973][T14122] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 548.714471][T14120] CUSE: unknown device info ">2¢“‰a"ëî V­Ä|ÿ#Úyï€S—ioåLåÎà”¢8†9ÔIÿèܥѮžÃ‡Å[¥<^ÎQÎÓ>”nHw Ý×'0QVÆ,†¹${\d+" [ 548.731673][T14122] CPU: 1 UID: 0 PID: 14122 Comm: syz.0.2653 Tainted: G L syzkaller #0 PREEMPT(full) [ 548.731706][T14122] Tainted: [L]=SOFTLOCKUP [ 548.731713][T14122] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 548.731723][T14122] Call Trace: [ 548.731731][T14122] [ 548.731739][T14122] dump_stack_lvl+0xe8/0x150 [ 548.731771][T14122] should_fail_ex+0x40c/0x560 [ 548.731797][T14122] _copy_from_user+0x2d/0xb0 [ 548.731814][T14122] memdup_user+0x5e/0xd0 [ 548.731839][T14122] strndup_user+0x68/0xd0 [ 548.731864][T14122] __se_sys_fsconfig+0x5e0/0x810 [ 548.731890][T14122] ? __pfx___se_sys_fsconfig+0x10/0x10 [ 548.731906][T14122] ? ksys_write+0x242/0x270 [ 548.731925][T14122] ? __pfx_ksys_write+0x10/0x10 [ 548.731945][T14122] ? __x64_sys_fsconfig+0x20/0xc0 [ 548.731963][T14122] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 548.731981][T14122] do_syscall_64+0x174/0x580 [ 548.731999][T14122] ? trace_irq_disable+0x3b/0x140 [ 548.732018][T14122] ? clear_bhb_loop+0x40/0x90 [ 548.732039][T14122] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 548.732053][T14122] RIP: 0033:0x7f6d7879e019 [ 548.732070][T14122] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 548.732084][T14122] RSP: 002b:00007f6d795ca028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 548.732103][T14122] RAX: ffffffffffffffda RBX: 00007f6d78a25fa0 RCX: 00007f6d7879e019 [ 548.732116][T14122] RDX: 0000200000001100 RSI: 0000000000000001 RDI: 0000000000000003 [ 548.732127][T14122] RBP: 00007f6d795ca090 R08: 0000000000000000 R09: 0000000000000000 [ 548.732137][T14122] R10: 0000200000001140 R11: 0000000000000246 R12: 0000000000000001 [ 548.732149][T14122] R13: 00007f6d78a26038 R14: 00007f6d78a25fa0 R15: 00007f6d78b4fa48 [ 548.732177][T14122] [ 548.732661][T12385] usb 2-1: GET_CAPABILITIES returned 0 [ 548.927003][T14120] CUSE: unknown device info "Ýÿÿÿ" [ 548.938603][T14120] CUSE: unknown device info "ÙLÐP§ô¿’t|%Í€IŸ¸èžOØÙäKu GìÂÏǪ|ÜQá(o9Ð{uáöº[§èµ¨‘²égIÁPÌÍYV" [ 548.971598][T14120] CUSE: DEVNAME unspecified [ 549.084681][T12385] usbtmc 2-1:16.0: can't read capabilities [ 549.164848][T12385] usb 2-1: USB disconnect, device number 94 [ 549.847942][ T5721] cdc_ncm 4-1:1.0: bind() failure [ 549.896641][ T5721] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 549.927076][ T5721] cdc_ncm 4-1:1.1: bind() failure [ 549.969634][ T5721] usb 4-1: USB disconnect, device number 94 [ 550.301418][T14147] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2659'. [ 550.368676][T14148] syzkaller1: entered promiscuous mode [ 550.385077][T12385] hid-generic 0000:0000:0000.0019: unknown main item tag 0x0 [ 550.430563][T14148] syzkaller1: entered allmulticast mode [ 550.451912][T14139] input: syz0 as /devices/virtual/input/input44 [ 550.468890][T12385] hid-generic 0000:0000:0000.0019: hidraw0: HID v0.00 Device [syz1] on syz0 [ 550.645365][T14150] fido_id[14150]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 551.153462][T14161] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 551.170633][T14161] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 551.339346][ T7843] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 551.370244][T14162] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 551.413237][T14153] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2661'. [ 551.486259][T14153] fuse: Unknown parameter 'eroup_id' [ 551.511258][ T5722] usb 2-1: new high-speed USB device number 95 using dummy_hcd [ 551.565761][T14153] netlink: 312 bytes leftover after parsing attributes in process `syz.3.2661'. [ 551.606032][T14153] netlink: 'syz.3.2661': attribute type 1 has an invalid length. [ 551.691200][ T5714] usb 5-1: new full-speed USB device number 110 using dummy_hcd [ 551.700577][ T5722] usb 2-1: Using ep0 maxpacket: 8 [ 551.714315][ T5722] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 551.739262][ T5722] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 551.755380][ T5722] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 551.782417][ T5722] usb 2-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 551.794333][ T5722] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 551.822231][ T5722] usb 2-1: Product: syz [ 551.835485][ T5722] usb 2-1: Manufacturer: syz [ 551.846955][ T5722] usb 2-1: SerialNumber: syz [ 551.853732][ T5714] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 551.877819][ T5714] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 551.892990][ T5714] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 551.930080][ T5714] usb 5-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 551.940944][ T5714] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 551.964850][ T5714] usb 5-1: Product: syz [ 551.976865][ T5714] usb 5-1: Manufacturer: syz [ 551.991083][ T5714] usb 5-1: SerialNumber: syz [ 552.027580][ T5714] usb 5-1: config 0 descriptor?? [ 552.045727][T14170] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 552.116952][T14179] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2668'. [ 552.130279][T14176] netlink: 'syz.3.2666': attribute type 61 has an invalid length. [ 552.336266][ T5714] rc_core: IR keymap rc-streamzap not found [ 552.355253][ T5714] Registered IR keymap rc-empty [ 552.378046][ T5714] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 552.424319][ T5714] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input45 [ 552.720655][T14162] lo: Caught tx_queue_len zero misconfig [ 553.003779][ T5722] usb 2-1: 1:1: cannot get freq (v2/v3): err -71 [ 553.013515][ T5722] usb 2-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 553.337541][ T5722] usb 2-1: USB disconnect, device number 95 [ 553.549466][ T6927] udevd[6927]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 554.370063][T14207] syz.0.2674 (14207) used obsolete PPPIOCDETACH ioctl [ 554.442912][ T24] usb 5-1: USB disconnect, device number 110 [ 554.656995][T14214] kAFS: unable to lookup cell '(G' [ 555.021321][ T24] usb 2-1: new high-speed USB device number 96 using dummy_hcd [ 555.115351][T14222] binder: 14221:14222 ioctl c0306201 0 returned -14 [ 555.185732][ T24] usb 2-1: Using ep0 maxpacket: 8 [ 555.222908][ T24] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 555.236649][ T24] usb 2-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 555.250615][ T24] usb 2-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 555.282955][ T24] usb 2-1: Product: syz [ 555.302692][ T24] usb 2-1: Manufacturer: syz [ 555.318975][ T24] usb 2-1: SerialNumber: syz [ 555.554452][ T24] usb 2-1: Invalid connection information received from device [ 555.570230][T14227] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 555.623010][T14227] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 555.991120][ T24] usb 5-1: new high-speed USB device number 111 using dummy_hcd [ 556.171208][ T24] usb 5-1: Using ep0 maxpacket: 16 [ 556.179697][ T24] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1023, setting to 64 [ 556.218589][ T24] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0xF has invalid maxpacket 1535, setting to 64 [ 556.245233][ T24] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 133, changing to 7 [ 556.268576][ T24] usb 5-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 556.298042][ T24] usb 5-1: New USB device found, idVendor=0582, idProduct=00eb, bcdDevice= 0.40 [ 556.313285][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 556.337144][ T24] usb 5-1: Product: syz [ 556.350673][ T24] usb 5-1: Manufacturer: syz [ 556.365563][ T24] usb 5-1: SerialNumber: syz [ 556.540323][ T7843] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 556.558878][T14233] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 556.715347][ T10] usb 1-1: new high-speed USB device number 124 using dummy_hcd [ 556.838181][ T24] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 556.891293][ T10] usb 1-1: Using ep0 maxpacket: 8 [ 556.898363][ T10] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 556.929328][ T10] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 556.959072][ T10] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 556.987240][ T10] usb 1-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 557.009197][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 557.052640][ T10] usb 1-1: Product: syz [ 557.062888][ T10] usb 1-1: Manufacturer: syz [ 557.072102][ T10] usb 1-1: SerialNumber: syz [ 557.132532][T14229] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 557.159671][ T24] usb 5-1: USB disconnect, device number 111 [ 557.463943][T14240] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 557.476936][T14240] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 557.748437][T12385] usb 2-1: USB disconnect, device number 96 [ 558.030318][ T10] usb 1-1: 1:1: cannot get freq (v2/v3): err -71 [ 558.057639][ T10] usb 1-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 558.229252][ T10] usb 1-1: USB disconnect, device number 124 [ 558.311969][ T9091] udevd[9091]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 559.024626][T14273] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 559.149084][T14273] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 559.411234][ T24] usb 5-1: new high-speed USB device number 112 using dummy_hcd [ 559.611229][ T24] usb 5-1: Using ep0 maxpacket: 16 [ 559.630233][ T24] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 559.653350][ T24] usb 5-1: config 0 has no interface number 0 [ 559.668785][ T24] usb 5-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 559.686808][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 559.708411][ T24] usb 5-1: Product: syz [ 559.720275][ T24] usb 5-1: Manufacturer: syz [ 559.732996][ T24] usb 5-1: SerialNumber: syz [ 559.752091][ T24] usb 5-1: config 0 descriptor?? [ 559.777376][ T24] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 561.116505][T14209] Set syz0 is full, maxelem 65536 reached [ 561.121924][ T24] gspca_spca1528: reg_w err -110 [ 561.140873][ T24] spca1528 5-1:0.1: probe with driver spca1528 failed with error -110 [ 561.356064][T14295] syzkaller1: entered promiscuous mode [ 561.369482][ T5714] usb 5-1: USB disconnect, device number 112 [ 561.382987][T14295] syzkaller1: entered allmulticast mode [ 561.425870][T14295] PF_CAN: dropped non conform CAN skbuff: dev type 280, len 324 [ 561.604202][T14304] program syz.4.2701 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 561.701468][ T5777] usb 4-1: new high-speed USB device number 95 using dummy_hcd [ 561.861854][ T5777] usb 4-1: Using ep0 maxpacket: 8 [ 561.870628][ T5777] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 561.883788][ T5777] usb 4-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 561.894242][ T5777] usb 4-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 561.906783][ T5777] usb 4-1: Product: syz [ 561.916769][ T5777] usb 4-1: Manufacturer: syz [ 561.926877][ T5777] usb 4-1: SerialNumber: syz [ 562.042138][ T10] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 562.074644][T14321] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2708'. [ 562.089286][T14321] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2708'. [ 562.176071][ T5777] usb 4-1: Invalid connection information received from device [ 562.225962][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 562.253552][ T10] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 562.287698][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 562.303039][ T10] usb 2-1: config 0 descriptor?? [ 562.353222][T14327] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 562.489573][ T5777] usb 4-1: USB disconnect, device number 95 [ 562.539017][ T10] usbhid 2-1:0.0: can't add hid device: -71 [ 562.549835][ T10] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 562.566088][ T10] usb 2-1: USB disconnect, device number 97 [ 562.832996][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.839516][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.012627][ T10] usb 2-1: new high-speed USB device number 98 using dummy_hcd [ 563.205669][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 563.229364][ T10] usb 2-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 563.254359][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 563.297348][ T10] usb 2-1: config 0 descriptor?? [ 563.302774][ T24] usb 5-1: new high-speed USB device number 113 using dummy_hcd [ 563.354945][T14340] FAULT_INJECTION: forcing a failure. [ 563.354945][T14340] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 563.420408][T14340] CPU: 1 UID: 0 PID: 14340 Comm: syz.2.2714 Tainted: G L syzkaller #0 PREEMPT(full) [ 563.420438][T14340] Tainted: [L]=SOFTLOCKUP [ 563.420445][T14340] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 563.420455][T14340] Call Trace: [ 563.420462][T14340] [ 563.420470][T14340] dump_stack_lvl+0xe8/0x150 [ 563.420502][T14340] should_fail_ex+0x40c/0x560 [ 563.420529][T14340] _copy_from_iter+0x1d3/0x1660 [ 563.420551][T14340] ? kmem_cache_alloc_node_noprof+0x141/0x610 [ 563.420575][T14340] ? rcu_is_watching+0x15/0xb0 [ 563.420593][T14340] ? trace_kmem_cache_alloc+0x29/0xe0 [ 563.420616][T14340] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 563.420637][T14340] ? __pfx__copy_from_iter+0x10/0x10 [ 563.420660][T14340] ? __alloc_skb+0x276/0x7a0 [ 563.420677][T14340] ? __alloc_skb+0x276/0x7a0 [ 563.420701][T14340] ? netlink_sendmsg+0x650/0xb40 [ 563.420721][T14340] ? skb_put+0x112/0x210 [ 563.420742][T14340] netlink_sendmsg+0x6c0/0xb40 [ 563.420772][T14340] ? __pfx_netlink_sendmsg+0x10/0x10 [ 563.420796][T14340] ? aa_sock_msg_perm+0xf1/0x1b0 [ 563.420821][T14340] ? __pfx_netlink_sendmsg+0x10/0x10 [ 563.420841][T14340] sock_sendmsg_nosec+0x13a/0x180 [ 563.420867][T14340] ____sys_sendmsg+0x54e/0x850 [ 563.420893][T14340] ? __pfx_____sys_sendmsg+0x10/0x10 [ 563.420922][T14340] ? import_iovec+0x73/0xa0 [ 563.420942][T14340] ___sys_sendmsg+0x2a5/0x360 [ 563.420965][T14340] ? __lock_acquire+0x683/0x2cf0 [ 563.420991][T14340] ? __pfx____sys_sendmsg+0x10/0x10 [ 563.421046][T14340] ? __fget_files+0x2a/0x420 [ 563.421067][T14340] ? __fget_files+0x3a2/0x420 [ 563.421099][T14340] __x64_sys_sendmsg+0x1b1/0x290 [ 563.421122][T14340] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 563.421157][T14340] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 563.421176][T14340] do_syscall_64+0x174/0x580 [ 563.421198][T14340] ? trace_irq_disable+0x3b/0x140 [ 563.421220][T14340] ? clear_bhb_loop+0x40/0x90 [ 563.421242][T14340] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 563.421259][T14340] RIP: 0033:0x7f6e51f9e019 [ 563.421277][T14340] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 563.421292][T14340] RSP: 002b:00007f6e501f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 563.421311][T14340] RAX: ffffffffffffffda RBX: 00007f6e52225fa0 RCX: 00007f6e51f9e019 [ 563.421325][T14340] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 563.421336][T14340] RBP: 00007f6e501f6090 R08: 0000000000000000 R09: 0000000000000000 [ 563.421347][T14340] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 563.421357][T14340] R13: 00007f6e52226038 R14: 00007f6e52225fa0 R15: 00007f6e5234fa48 [ 563.421386][T14340] [ 563.939349][ T5777] usb 4-1: new high-speed USB device number 96 using dummy_hcd [ 563.953164][ T7843] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 563.954551][ T24] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 563.972890][T14337] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 563.987068][ T24] usb 5-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 564.000771][ T24] usb 5-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice= 1.00 [ 564.009966][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 564.121592][ T5777] usb 4-1: Using ep0 maxpacket: 8 [ 564.166247][ T5777] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 564.180522][ T5777] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 564.193803][ T5777] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 564.214615][ T5777] usb 4-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 564.224051][ T5777] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 564.237053][ T5777] usb 4-1: Product: syz [ 564.243693][ T5777] usb 4-1: Manufacturer: syz [ 564.250775][ T5777] usb 4-1: SerialNumber: syz [ 564.263978][ T24] dvbdev: DVB: registering new adapter (DEC2000-t) [ 564.328479][ T24] usb 5-1: DVB: registering adapter 1 frontend 0 (TechnoTrend/Hauppauge DEC2000-t Frontend)... [ 564.462139][ T10] aiptek 2-1:0.0: Aiptek using 400 ms programming speed [ 564.472027][ T10] input: Aiptek as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input46 [ 564.481440][T14313] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 564.510764][T14313] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 564.681874][T14354] fuse: Bad value for 'group_id' [ 564.686889][T14354] fuse: Bad value for 'group_id' [ 564.689454][ T24] ttusb_dec_send_command: command bulk message failed: error -71 [ 564.754307][ T24] usb 5-1: USB disconnect, device number 113 [ 564.856542][T14313] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 564.872354][T14313] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 564.890833][ T5714] usb 2-1: USB disconnect, device number 98 [ 564.892279][ C0] aiptek 2-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 565.122988][T14360] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 565.141672][T14360] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 565.219556][ T5777] usb 4-1: 1:1: cannot get freq (v2/v3): err -71 [ 565.228962][ T5777] usb 4-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 565.318855][ T5777] usb 4-1: USB disconnect, device number 96 [ 565.365948][ T9091] udevd[9091]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 565.473318][T14363] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2719'. [ 565.658878][T14370] FAULT_INJECTION: forcing a failure. [ 565.658878][T14370] name failslab, interval 1, probability 0, space 0, times 0 [ 565.678914][T14370] CPU: 0 UID: 0 PID: 14370 Comm: syz.1.2723 Tainted: G L syzkaller #0 PREEMPT(full) [ 565.678942][T14370] Tainted: [L]=SOFTLOCKUP [ 565.678949][T14370] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 565.678958][T14370] Call Trace: [ 565.678967][T14370] [ 565.678974][T14370] dump_stack_lvl+0xe8/0x150 [ 565.679004][T14370] should_fail_ex+0x40c/0x560 [ 565.679031][T14370] should_failslab+0xa8/0x100 [ 565.679056][T14370] ? __pfx_ip6_dst_gc+0x10/0x10 [ 565.679165][T14370] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 565.679187][T14370] ? dst_alloc+0x105/0x170 [ 565.679268][T14370] ? dst_alloc+0x105/0x170 [ 565.679291][T14370] ? __pfx_ip6_dst_gc+0x10/0x10 [ 565.679313][T14370] dst_alloc+0x105/0x170 [ 565.679333][T14370] ? fib6_node_lookup+0x147/0x1d0 [ 565.679360][T14370] ip6_create_rt_rcu+0x234/0x4f0 [ 565.679413][T14370] ? __pfx_ip6_create_rt_rcu+0x10/0x10 [ 565.679442][T14370] ip6_pol_route_lookup+0xcd6/0xf30 [ 565.679466][T14370] ? ip6_pol_route_lookup+0xd0/0xf30 [ 565.679494][T14370] ? __pfx_ip6_pol_route_lookup+0x10/0x10 [ 565.679515][T14370] ? kasan_save_track+0x4f/0x80 [ 565.679536][T14370] ? kasan_save_track+0x3e/0x80 [ 565.679554][T14370] ? __kasan_kmalloc+0x93/0xb0 [ 565.679574][T14370] ? __kmalloc_noprof+0x375/0x720 [ 565.679592][T14370] ? sock_kmalloc+0xd6/0x160 [ 565.679613][T14370] ? ipv6_sock_ac_join+0x306/0x820 [ 565.679666][T14370] ? do_ipv6_setsockopt+0x20d1/0x3180 [ 565.679685][T14370] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 565.679709][T14370] fib6_rule_lookup+0x631/0x730 [ 565.679760][T14370] ? __pfx_ip6_pol_route_lookup+0x10/0x10 [ 565.679782][T14370] ? __pfx_fib6_rule_lookup+0x10/0x10 [ 565.679807][T14370] ? __lock_acquire+0x683/0x2cf0 [ 565.679840][T14370] ? rt6_lookup+0xe0/0x220 [ 565.679866][T14370] rt6_lookup+0x145/0x220 [ 565.679900][T14370] ? __pfx_rt6_lookup+0x10/0x10 [ 565.679933][T14370] ? ipv6_sock_ac_join+0x357/0x820 [ 565.679961][T14370] ipv6_sock_ac_join+0x4e1/0x820 [ 565.679992][T14370] ? __pfx_ipv6_sock_ac_join+0x10/0x10 [ 565.680019][T14370] ? _copy_from_user+0x94/0xb0 [ 565.680041][T14370] do_ipv6_setsockopt+0x20d1/0x3180 [ 565.680069][T14370] ? __pfx_do_ipv6_setsockopt+0x10/0x10 [ 565.680086][T14370] ? get_pid_task+0x20/0x1f0 [ 565.680120][T14370] ? __lock_acquire+0x683/0x2cf0 [ 565.680161][T14370] ? aa_sk_perm+0x6d5/0x900 [ 565.680180][T14370] ? __fget_files+0x2a/0x420 [ 565.680212][T14370] ? __fget_files+0x2a/0x420 [ 565.680236][T14370] ? aa_sock_opt_perm+0xff/0x1a0 [ 565.680259][T14370] ipv6_setsockopt+0x59/0x170 [ 565.680276][T14370] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 565.680304][T14370] do_sock_setsockopt+0x17c/0x1b0 [ 565.680329][T14370] __x64_sys_setsockopt+0x13d/0x1b0 [ 565.680348][T14370] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 565.680366][T14370] do_syscall_64+0x174/0x580 [ 565.680386][T14370] ? trace_irq_disable+0x3b/0x140 [ 565.680409][T14370] ? clear_bhb_loop+0x40/0x90 [ 565.680431][T14370] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 565.680449][T14370] RIP: 0033:0x7f635979e019 [ 565.680467][T14370] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 565.680482][T14370] RSP: 002b:00007f635a70c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 565.680502][T14370] RAX: ffffffffffffffda RBX: 00007f6359a25fa0 RCX: 00007f635979e019 [ 565.680515][T14370] RDX: 000000000000001b RSI: 0000000000000029 RDI: 0000000000000003 [ 565.680526][T14370] RBP: 00007f635a70c090 R08: 0000000000000014 R09: 0000000000000000 [ 565.680537][T14370] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000001 [ 565.680549][T14370] R13: 00007f6359a26038 R14: 00007f6359a25fa0 R15: 00007f6359b4fa48 [ 565.680580][T14370] [ 566.098172][T14377] netlink: 72 bytes leftover after parsing attributes in process `syz.3.2725'. [ 566.217116][T14380] Cannot find del_set index 2 as target [ 566.247379][T14367] netlink: 'syz.4.2721': attribute type 10 has an invalid length. [ 566.263067][T14380] sg_write: data in/out 431068/146 bytes for SCSI command 0x0-- guessing data in; [ 566.263067][T14380] program syz.3.2726 not setting count and/or reply_len properly [ 566.274401][T14367] team0: Port device geneve0 added [ 566.668338][T14393] macvtap1: entered allmulticast mode [ 566.699058][T14393] netlink: 72 bytes leftover after parsing attributes in process `syz.4.2731'. [ 566.951873][T14404] netlink: 'syz.4.2733': attribute type 4 has an invalid length. [ 566.990227][T14404] netlink: 'syz.4.2733': attribute type 4 has an invalid length. [ 567.745562][T14411] bridge0: port 3(vlan3) entered blocking state [ 567.752044][T14411] bridge0: port 3(vlan3) entered forwarding state [ 567.762685][T14411] 8021q: adding VLAN 0 to HW filter on device bond1 [ 567.770632][T14411] bond1: entered allmulticast mode [ 567.780372][T14411] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 568.328145][T14415] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 568.356342][T14415] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 568.409964][T14415] binder: 14414:14415 ioctl 2285 200000000400 returned -22 [ 568.421474][ T5714] usb 5-1: new high-speed USB device number 114 using dummy_hcd [ 568.574886][ T5714] usb 5-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 568.584380][ T5714] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 568.595972][ T5714] usb 5-1: Product: syz [ 568.600252][ T5714] usb 5-1: Manufacturer: syz [ 568.615336][ T5714] usb 5-1: SerialNumber: syz [ 568.639464][ T5714] usb 5-1: config 0 descriptor?? [ 568.894108][ T5714] usb 5-1: USB disconnect, device number 114 [ 569.124426][T14411] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2736'. [ 569.148844][T14411] tipc: Invalid UDP bearer configuration [ 569.148894][T14411] tipc: Enabling of bearer rejected, failed to enable media [ 569.206107][T14424] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 570.021105][ T9] usb 1-1: new high-speed USB device number 125 using dummy_hcd [ 570.397231][T14387] Set syz0 is full, maxelem 65536 reached [ 571.221211][ T5714] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 571.371857][ T5714] usb 2-1: Using ep0 maxpacket: 16 [ 571.378893][ T5714] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 571.398797][ T5714] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 571.421362][ T5714] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 571.455298][ T5714] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 571.495744][ T5714] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 571.554270][ T5714] usb 2-1: config 0 descriptor?? [ 571.572836][T14469] bridge0: port 2(vlan2) entered blocking state [ 571.594723][T14469] bridge0: port 2(vlan2) entered disabled state [ 571.617765][T14469] vlan2: entered allmulticast mode [ 571.623428][T14469] geneve0: entered allmulticast mode [ 571.636025][T14469] vlan2: entered promiscuous mode [ 571.643353][T14469] geneve0: entered promiscuous mode [ 572.178868][ T5714] usbhid 2-1:0.0: can't add hid device: -71 [ 572.210367][ T5714] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 572.247260][ T5714] usb 2-1: USB disconnect, device number 99 [ 572.291265][T14477] Set syz0 is full, maxelem 65536 reached [ 572.497351][T14480] vivid-000: ================= START STATUS ================= [ 572.511413][T14480] vivid-000: Test Pattern: 75% Colorbar [ 572.578326][T14480] vivid-000: Fill Percentage of Frame: 100 [ 572.616832][T14480] vivid-000: Horizontal Movement: No Movement [ 572.643265][T14480] vivid-000: Vertical Movement: No Movement [ 572.674189][T14480] vivid-000: OSD Text Mode: All [ 572.699237][T14480] vivid-000: Show Border: false [ 572.721465][T14480] vivid-000: Show Square: false [ 572.753591][T14480] vivid-000: Sensor Flipped Horizontally: false [ 572.799332][T14480] vivid-000: Sensor Flipped Vertically: false [ 572.827675][T14480] vivid-000: Insert SAV Code in Image: false [ 572.843036][T14480] vivid-000: Insert EAV Code in Image: false [ 572.859278][T14480] vivid-000: Insert Video Guard Band: false [ 572.878874][T14480] vivid-000: Reduced Framerate: false [ 572.905951][T14480] vivid-000: HDMI 000-0 Is Connected To: Test Pattern Generator [ 572.936355][T14480] vivid-000: S-Video 000-0 Is Connected To: Test Pattern Generator [ 572.963842][T14486] FAULT_INJECTION: forcing a failure. [ 572.963842][T14486] name failslab, interval 1, probability 0, space 0, times 0 [ 572.972863][T14480] vivid-000: Enable Capture Cropping: true [ 573.008281][T14480] vivid-000: Enable Capture Composing: [ 573.008279][T14486] CPU: 1 UID: 0 PID: 14486 Comm: syz.1.2757 Tainted: G L syzkaller #0 PREEMPT(full) [ 573.008306][T14486] Tainted: [L]=SOFTLOCKUP [ 573.008313][T14486] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 573.008321][T14486] Call Trace: [ 573.008329][T14486] [ 573.008337][T14486] dump_stack_lvl+0xe8/0x150 [ 573.008368][T14486] should_fail_ex+0x40c/0x560 [ 573.008395][T14486] should_failslab+0xa8/0x100 [ 573.008422][T14486] __kmalloc_noprof+0xfe/0x720 [ 573.008444][T14486] ? copy_splice_read+0x16f/0xaa0 [ 573.008466][T14486] ? copy_splice_read+0x16f/0xaa0 [ 573.008494][T14486] copy_splice_read+0x16f/0xaa0 [ 573.008524][T14486] ? rcu_is_watching+0x15/0xb0 [ 573.008542][T14486] ? __pfx_copy_splice_read+0x10/0x10 [ 573.008566][T14486] ? look_up_lock_class+0x57/0x110 [ 573.008588][T14486] ? register_lock_class+0x31/0x2e0 [ 573.008612][T14486] ? __pfx_pipe_lock_cmp_fn+0x10/0x10 [ 573.008634][T14486] ? alloc_pipe_info+0x35d/0x4c0 [ 573.008653][T14486] ? __pfx_shmem_file_splice_read+0x10/0x10 [ 573.008673][T14486] splice_direct_to_actor+0x4b6/0xcb0 [ 573.008713][T14486] ? __pfx_direct_splice_actor+0x10/0x10 [ 573.008736][T14486] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 573.008768][T14486] do_splice_direct+0x195/0x290 [ 573.008797][T14486] ? __pfx_do_splice_direct+0x10/0x10 [ 573.008821][T14486] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 573.008840][T14486] ? bpf_lsm_file_permission+0x9/0x20 [ 573.008859][T14486] ? security_file_permission+0x75/0x260 [ 573.008884][T14486] ? rw_verify_area+0x203/0x4c0 [ 573.008904][T14486] do_sendfile+0x52e/0x7c0 [ 573.008932][T14486] ? __pfx_do_sendfile+0x10/0x10 [ 573.008953][T14486] ? __fget_files+0x3a2/0x420 [ 573.008984][T14486] __se_sys_sendfile64+0x144/0x1a0 [ 573.009006][T14486] ? __pfx___se_sys_sendfile64+0x10/0x10 [ 573.009041][T14486] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 573.009060][T14486] do_syscall_64+0x174/0x580 [ 573.009079][T14486] ? trace_irq_disable+0x3b/0x140 [ 573.009100][T14486] ? clear_bhb_loop+0x40/0x90 [ 573.009122][T14486] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 573.009139][T14486] RIP: 0033:0x7f635979e019 [ 573.009155][T14486] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 573.009170][T14486] RSP: 002b:00007f635a70c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 573.009188][T14486] RAX: ffffffffffffffda RBX: 00007f6359a25fa0 RCX: 00007f635979e019 [ 573.009201][T14486] RDX: 0000000000000000 RSI: 000000000000000c RDI: 000000000000000d [ 573.009211][T14486] RBP: 00007f635a70c090 R08: 0000000000000000 R09: 0000000000000000 [ 573.009222][T14486] R10: 0000000100000002 R11: 0000000000000246 R12: 0000000000000001 [ 573.009233][T14486] R13: 00007f6359a26038 R14: 00007f6359a25fa0 R15: 00007f6359b4fa48 [ 573.009260][T14486] [ 573.371179][T14480] true [ 573.373990][T14480] vivid-000: Enable Capture Scaler: true [ 573.391482][T14480] vivid-000: Timestamp Source: End of Frame [ 573.422802][T14480] vivid-000: Colorspace: Rec. 709 [ 573.433155][T14480] vivid-000: Transfer Function: Default [ 573.462196][T14480] vivid-000: Y'CbCr Encoding: Default [ 573.476053][T14480] vivid-000: HSV Encoding: Hue 0-179 [ 573.482000][T14480] vivid-000: Quantization: Default [ 573.496606][T14480] vivid-000: Apply Alpha To Red Only: false [ 573.519526][T14480] vivid-000: Standard Aspect Ratio: 4x3 [ 573.525995][T14480] vivid-000: DV Timings Signal Mode: Current DV Timings [ 573.550084][T14480] vivid-000: DV Timings: 640x480p59 inactive [ 573.561130][T14480] vivid-000: DV Timings Aspect Ratio: Source Width x Height [ 573.576371][T14480] vivid-000: Maximum EDID Blocks: 2 [ 573.586486][T14480] vivid-000: Limited RGB Range (16-235): true [ 573.623127][T14480] vivid-000: Rx RGB Quantization Range: Automatic [ 573.629851][T14480] vivid-000: Power Present: 0x00000001 [ 573.715460][T14480] tpg source WxH: 1280x720 (R'G'B) [ 573.734836][ T5714] usb 1-1: new full-speed USB device number 126 using dummy_hcd [ 573.743225][T14480] tpg field: 1 [ 573.754890][T14480] tpg crop: (0,0)/64x64 [ 573.771113][T14480] tpg compose: (0,0)/16x16 [ 573.779648][T14480] tpg colorspace: 3 [ 573.807606][T14480] tpg transfer function: 0/0 [ 573.817752][T14480] tpg quantization: 0/0 [ 573.838035][T14480] tpg RGB range: 0/1 [ 573.845756][T14480] vivid-000: ================== END STATUS ================== [ 573.906254][ T5714] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 573.949808][ T5714] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 573.994046][ T5714] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 574.043820][ T5714] usb 1-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 574.074209][ T5714] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 574.100690][ T5714] usb 1-1: Product: syz [ 574.125760][ T5714] usb 1-1: Manufacturer: syz [ 574.135873][ T5714] usb 1-1: SerialNumber: syz [ 574.149137][ T5714] usb 1-1: config 0 descriptor?? [ 574.158293][T14495] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 574.311095][ T5714] rc_core: IR keymap rc-streamzap not found [ 574.318389][ T5714] Registered IR keymap rc-empty [ 574.337793][ T5714] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 574.425160][ T5714] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input47 [ 574.601491][ T5722] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 574.787335][ T5722] usb 2-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 574.840511][ T5722] usb 2-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 574.913929][ T5722] usb 2-1: config 0 interface 0 has no altsetting 0 [ 574.947345][ T5722] usb 2-1: New USB device found, idVendor=0458, idProduct=5013, bcdDevice= 0.00 [ 574.977361][ T5722] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 575.022645][ T5722] usb 2-1: config 0 descriptor?? [ 575.676746][T14511] Set syz0 is full, maxelem 65536 reached [ 575.815648][T14525] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2764'. [ 576.017755][ T5721] usb 1-1: USB disconnect, device number 126 [ 576.048893][T14515] program syz.3.2764 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 576.743695][ T5777] usb 5-1: new high-speed USB device number 116 using dummy_hcd [ 576.916815][ T5722] usbhid 2-1:0.0: can't add hid device: -71 [ 576.933292][ T5777] usb 5-1: Using ep0 maxpacket: 32 [ 576.951514][ T5722] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 576.963774][ T5777] usb 5-1: config 10 has an invalid interface number: 111 but max is 1 [ 576.987452][ T5777] usb 5-1: config 10 has an invalid interface number: 253 but max is 1 [ 577.009009][ T5722] usb 2-1: USB disconnect, device number 100 [ 577.015901][ T5777] usb 5-1: config 10 has no interface number 0 [ 577.025770][ T5777] usb 5-1: config 10 has no interface number 1 [ 577.047403][ T5777] usb 5-1: config 10 interface 111 has no altsetting 0 [ 577.069364][ T5777] usb 5-1: config 10 interface 253 has no altsetting 0 [ 577.095160][ T5777] usb 5-1: New USB device found, idVendor=147f, idProduct=2758, bcdDevice=be.e6 [ 577.118785][T14541] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2774'. [ 577.133432][ T5777] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 577.160325][ T5777] usb 5-1: Product: syz [ 577.175081][ T5777] usb 5-1: Manufacturer: syz [ 577.184892][ T5777] usb 5-1: SerialNumber: syz [ 577.241065][T14539] kvm: emulating exchange as write [ 577.563424][T14555] FAULT_INJECTION: forcing a failure. [ 577.563424][T14555] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 577.622628][T14555] CPU: 1 UID: 0 PID: 14555 Comm: syz.0.2778 Tainted: G L syzkaller #0 PREEMPT(full) [ 577.622658][T14555] Tainted: [L]=SOFTLOCKUP [ 577.622665][T14555] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 577.622676][T14555] Call Trace: [ 577.622684][T14555] [ 577.622692][T14555] dump_stack_lvl+0xe8/0x150 [ 577.622732][T14555] should_fail_ex+0x40c/0x560 [ 577.622759][T14555] _copy_from_user+0x2d/0xb0 [ 577.622778][T14555] cec_ioctl+0xa74/0x3050 [ 577.622903][T14555] ? __pfx_cec_ioctl+0x10/0x10 [ 577.622935][T14555] ? kasan_quarantine_put+0xbb/0x1f0 [ 577.622965][T14555] ? tomoyo_path_number_perm+0x219/0x5f0 [ 577.622992][T14555] ? tomoyo_path_number_perm+0x219/0x5f0 [ 577.623020][T14555] ? do_vfs_ioctl+0x116f/0x1530 [ 577.623042][T14555] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 577.623091][T14555] ? __fget_files+0x2a/0x420 [ 577.623118][T14555] ? __fget_files+0x2a/0x420 [ 577.623139][T14555] ? __fget_files+0x3a2/0x420 [ 577.623160][T14555] ? __fget_files+0x2a/0x420 [ 577.623185][T14555] ? bpf_lsm_file_ioctl+0x9/0x20 [ 577.623206][T14555] ? __pfx_cec_ioctl+0x10/0x10 [ 577.623225][T14555] __se_sys_ioctl+0xfc/0x170 [ 577.623244][T14555] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 577.623263][T14555] do_syscall_64+0x174/0x580 [ 577.623284][T14555] ? trace_irq_disable+0x3b/0x140 [ 577.623307][T14555] ? clear_bhb_loop+0x40/0x90 [ 577.623328][T14555] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 577.623346][T14555] RIP: 0033:0x7f6d7879e019 [ 577.623362][T14555] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 577.623377][T14555] RSP: 002b:00007f6d795ca028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 577.623396][T14555] RAX: ffffffffffffffda RBX: 00007f6d78a25fa0 RCX: 00007f6d7879e019 [ 577.623410][T14555] RDX: 0000200000000080 RSI: 00000000c05c6104 RDI: 0000000000000003 [ 577.623421][T14555] RBP: 00007f6d795ca090 R08: 0000000000000000 R09: 0000000000000000 [ 577.623431][T14555] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 577.623441][T14555] R13: 00007f6d78a26038 R14: 00007f6d78a25fa0 R15: 00007f6d78b4fa48 [ 577.623466][T14555] [ 577.940566][T14551] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 577.953408][ T5722] usb 4-1: new high-speed USB device number 97 using dummy_hcd [ 578.061588][T14563] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2781'. [ 578.091484][ T5722] usb 4-1: device descriptor read/64, error -71 [ 578.108564][T14535] fuse: Bad value for 'fd' [ 578.122528][ T5777] dvb-usb: found a 'Hama DVB=T Hybrid USB Stick' in cold state, will try to load a firmware [ 578.237467][ T5777] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 578.247839][ T5777] dib0700: firmware download failed at 7 with -22 [ 578.274563][ T5777] dvb-usb: found a 'Hama DVB=T Hybrid USB Stick' in cold state, will try to load a firmware [ 578.281169][ T5714] usb 2-1: new high-speed USB device number 101 using dummy_hcd [ 578.309235][ T5777] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 578.328124][ T5777] dib0700: firmware download failed at 7 with -22 [ 578.331109][ T5722] usb 4-1: new high-speed USB device number 98 using dummy_hcd [ 578.348373][ T5777] usb 5-1: USB disconnect, device number 116 [ 578.441133][ T5714] usb 2-1: Using ep0 maxpacket: 16 [ 578.452862][ T5714] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 578.468926][ T5714] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 578.478777][ T5722] usb 4-1: device descriptor read/64, error -71 [ 578.494947][ T5714] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 578.517068][ T5714] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 578.541107][ T5714] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 578.561780][ T5714] usb 2-1: config 0 descriptor?? [ 578.585066][T14567] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2782'. [ 578.601909][ T5722] usb usb4-port1: attempt power cycle [ 578.941125][ T5722] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 578.975026][ T5722] usb 4-1: device descriptor read/8, error -71 [ 579.011849][ T29] kauditd_printk_skb: 6 callbacks suppressed [ 579.011865][ T29] audit: type=1326 audit(1785577724.114:743): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14571 comm="syz.4.2784" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbd4db9e019 code=0x7ffc0000 [ 579.050226][ T29] audit: type=1326 audit(1785577724.114:744): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14571 comm="syz.4.2784" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbd4db9e019 code=0x7ffc0000 [ 579.084267][ T29] audit: type=1326 audit(1785577724.114:745): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14571 comm="syz.4.2784" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=14 compat=0 ip=0x7fbd4db9e019 code=0x7ffc0000 [ 579.112150][ T29] audit: type=1326 audit(1785577724.114:746): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14571 comm="syz.4.2784" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbd4db9e019 code=0x7ffc0000 [ 579.143671][ T29] audit: type=1326 audit(1785577724.144:747): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14571 comm="syz.4.2784" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbd4db9e019 code=0x7ffc0000 [ 579.172759][T14577] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2785'. [ 579.184849][ T5714] usbhid 2-1:0.0: can't add hid device: -71 [ 579.190075][ T29] audit: type=1326 audit(1785577724.144:748): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14571 comm="syz.4.2784" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=222 compat=0 ip=0x7fbd4db9e019 code=0x7ffc0000 [ 579.193075][ T5714] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 579.241399][ T5722] usb 4-1: new high-speed USB device number 100 using dummy_hcd [ 579.274669][ T29] audit: type=1326 audit(1785577724.144:749): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14571 comm="syz.4.2784" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbd4db9e019 code=0x7ffc0000 [ 579.281938][ T5722] usb 4-1: device descriptor read/8, error -71 [ 579.318990][ T5714] usb 2-1: USB disconnect, device number 101 [ 579.339581][ T29] audit: type=1326 audit(1785577724.144:750): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14571 comm="syz.4.2784" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=223 compat=0 ip=0x7fbd4db9e019 code=0x7ffc0000 [ 579.370283][ T29] audit: type=1326 audit(1785577724.144:751): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14571 comm="syz.4.2784" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbd4db9e019 code=0x7ffc0000 [ 579.416779][ T29] audit: type=1326 audit(1785577724.144:752): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14571 comm="syz.4.2784" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=128 compat=0 ip=0x7fbd4db9e019 code=0x7ffc0000 [ 579.461442][ T5722] usb usb4-port1: unable to enumerate USB device [ 580.019356][T14601] netlink: 64 bytes leftover after parsing attributes in process `syz.0.2795'. [ 580.074521][ T5777] usb 2-1: new high-speed USB device number 102 using dummy_hcd [ 580.254110][ T5777] usb 2-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 580.275078][ T5777] usb 2-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 580.281107][ T5722] usb 5-1: new low-speed USB device number 117 using dummy_hcd [ 580.289264][ T5777] usb 2-1: config 0 interface 0 has no altsetting 0 [ 580.333981][ T5777] usb 2-1: New USB device found, idVendor=0458, idProduct=5013, bcdDevice= 0.00 [ 580.360250][ T5777] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 580.382282][ T5777] usb 2-1: config 0 descriptor?? [ 580.455513][ T5722] usb 5-1: config 0 interface 0 altsetting 88 endpoint 0x81 has invalid maxpacket 1023, setting to 8 [ 580.472958][ T5722] usb 5-1: config 0 interface 0 altsetting 88 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 580.504063][ T5722] usb 5-1: config 0 interface 0 has no altsetting 0 [ 580.513006][ T5722] usb 5-1: New USB device found, idVendor=05ac, idProduct=0262, bcdDevice= 0.00 [ 580.522571][ T5722] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 580.536213][ T5722] usb 5-1: config 0 descriptor?? [ 580.552024][T14603] raw-gadget.3 gadget.4: fail, usb_ep_enable returned -22 [ 580.570214][ T5722] input: bcm5974 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input48 [ 580.707944][T14617] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2800'. [ 580.858800][ T5722] usb 5-1: USB disconnect, device number 117 [ 580.871424][ T4978] bcm5974 5-1:0.0: could not read from device [ 581.021856][ T9] usb 1-1: new high-speed USB device number 127 using dummy_hcd [ 581.191960][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 581.206748][ T9] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 581.235841][ T9] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 581.259488][ T9] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 581.293531][ T9] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 581.322171][ T9] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 581.347140][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 581.595511][ T9] usb 1-1: GET_CAPABILITIES returned 0 [ 581.608832][ T9] usbtmc 1-1:16.0: can't read capabilities [ 581.868016][T14639] Context (ID=0x1) not attached to queue pair (handle=0x0:0xae) [ 581.884401][ T5721] usb 1-1: USB disconnect, device number 127 [ 581.916324][ T5777] usbhid 2-1:0.0: can't add hid device: -71 [ 581.938444][ T5777] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 581.973062][ T5777] usb 2-1: USB disconnect, device number 102 [ 582.287755][T14652] IPVS: rr: FWM 3 0x00000003 - no destination available [ 582.952674][T14666] netlink: 'syz.0.2813': attribute type 10 has an invalid length. [ 583.172241][T14666] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 583.247975][T14666] team0: Port device netdevsim1 added [ 583.263284][T14679] netlink: 'syz.0.2813': attribute type 10 has an invalid length. [ 583.311516][ C1] ip6_tunnel: G„ðl xmit: Local address not yet configured! [ 583.390852][ T7843] tipc: Resetting bearer [ 583.605989][T14679] team0: Port device netdevsim1 removed [ 583.768289][T14679] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 583.909353][T14679] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 583.971213][ T5721] usb 5-1: new high-speed USB device number 118 using dummy_hcd [ 584.131931][ T5721] usb 5-1: device descriptor read/64, error -71 [ 584.215819][T14700] FAULT_INJECTION: forcing a failure. [ 584.215819][T14700] name failslab, interval 1, probability 0, space 0, times 0 [ 584.239186][T14700] CPU: 1 UID: 0 PID: 14700 Comm: syz.3.2824 Tainted: G L syzkaller #0 PREEMPT(full) [ 584.239217][T14700] Tainted: [L]=SOFTLOCKUP [ 584.239223][T14700] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 584.239234][T14700] Call Trace: [ 584.239242][T14700] [ 584.239250][T14700] dump_stack_lvl+0xe8/0x150 [ 584.239284][T14700] should_fail_ex+0x40c/0x560 [ 584.239314][T14700] should_failslab+0xa8/0x100 [ 584.239344][T14700] __kmalloc_cache_noprof+0xa8/0x660 [ 584.239371][T14700] ? tcp_sendmsg_fastopen+0x1e7/0x5f0 [ 584.239395][T14700] ? tcp_sendmsg_fastopen+0x1e7/0x5f0 [ 584.239422][T14700] tcp_sendmsg_fastopen+0x1e7/0x5f0 [ 584.239451][T14700] tcp_sendmsg_locked+0x4cdc/0x55c0 [ 584.239476][T14700] ? tcp_sendmsg_locked+0x671/0x55c0 [ 584.239501][T14700] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 584.239522][T14700] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 584.239539][T14700] ? current_check_access_socket+0x26a/0xdf0 [ 584.239565][T14700] ? __lock_acquire+0x683/0x2cf0 [ 584.239615][T14700] ? __pfx_tcp_sendmsg_locked+0x10/0x10 [ 584.239643][T14700] ? tcp_sendmsg+0x21/0x50 [ 584.239665][T14700] ? __local_bh_enable_ip+0xd0/0x130 [ 584.239699][T14700] tcp_sendmsg+0x2f/0x50 [ 584.239719][T14700] ? __pfx_inet_sendmsg+0x10/0x10 [ 584.239736][T14700] sock_sendmsg_nosec+0x10e/0x180 [ 584.239766][T14700] ____sys_sendmsg+0x54e/0x850 [ 584.239793][T14700] ? __pfx_____sys_sendmsg+0x10/0x10 [ 584.239822][T14700] ? import_iovec+0x73/0xa0 [ 584.239843][T14700] ___sys_sendmsg+0x2a5/0x360 [ 584.239862][T14700] ? __lock_acquire+0x683/0x2cf0 [ 584.239889][T14700] ? __pfx____sys_sendmsg+0x10/0x10 [ 584.239943][T14700] ? __fget_files+0x2a/0x420 [ 584.239971][T14700] ? __fget_files+0x3a2/0x420 [ 584.240003][T14700] __x64_sys_sendmsg+0x1b1/0x290 [ 584.240028][T14700] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 584.240066][T14700] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 584.240088][T14700] do_syscall_64+0x174/0x580 [ 584.240111][T14700] ? trace_irq_disable+0x3b/0x140 [ 584.240135][T14700] ? clear_bhb_loop+0x40/0x90 [ 584.240158][T14700] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 584.240177][T14700] RIP: 0033:0x7fcea4d9e019 [ 584.240194][T14700] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 584.240209][T14700] RSP: 002b:00007fcea2ff6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 584.240229][T14700] RAX: ffffffffffffffda RBX: 00007fcea5025fa0 RCX: 00007fcea4d9e019 [ 584.240243][T14700] RDX: 000000003000c0c0 RSI: 0000200000000080 RDI: 0000000000000003 [ 584.240256][T14700] RBP: 00007fcea2ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 584.240268][T14700] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 584.240280][T14700] R13: 00007fcea5026038 R14: 00007fcea5025fa0 R15: 00007fcea514fa48 [ 584.240310][T14700] [ 584.651101][ T5721] usb 5-1: new high-speed USB device number 119 using dummy_hcd [ 584.728404][ T142] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 584.746334][T14702] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 584.781111][ T5721] usb 5-1: device descriptor read/64, error -71 [ 584.891316][ T5721] usb usb5-port1: attempt power cycle [ 584.896875][ T5714] usb 2-1: new high-speed USB device number 103 using dummy_hcd [ 584.941467][ T9] usb 4-1: new high-speed USB device number 101 using dummy_hcd [ 585.047000][T14708] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 585.055895][T14708] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 585.069815][ T5714] usb 2-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 585.083051][ T5714] usb 2-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 585.096146][ T5714] usb 2-1: config 0 interface 0 has no altsetting 0 [ 585.102957][ T5714] usb 2-1: New USB device found, idVendor=0458, idProduct=5013, bcdDevice= 0.00 [ 585.112052][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 585.117997][ T5714] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 585.126147][T14715] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 585.127946][T14715] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 585.141362][ T5714] usb 2-1: config 0 descriptor?? [ 585.152416][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 585.176151][ T9] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 585.186416][ T9] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 585.198978][ T9] usb 4-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 585.208675][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 585.216794][ T9] usb 4-1: Product: syz [ 585.221229][ T9] usb 4-1: Manufacturer: syz [ 585.225847][ T9] usb 4-1: SerialNumber: syz [ 585.246850][ T5721] usb 5-1: new high-speed USB device number 120 using dummy_hcd [ 585.247280][ T30] INFO: task kworker/0:3:5359 blocked for more than 143 seconds. [ 585.263453][ T30] Tainted: G L syzkaller #0 [ 585.270031][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 585.272906][ T5721] usb 5-1: device descriptor read/8, error -71 [ 585.279088][ T30] task:kworker/0:3 state:D stack:20304 pid:5359 tgid:5359 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 585.297926][ T30] Workqueue: usb_hub_wq hub_event [ 585.303560][ T30] Call Trace: [ 585.306997][ T30] [ 585.310035][ T30] __schedule+0x17d9/0x56c0 [ 585.315624][ T30] ? __pfx___schedule+0x10/0x10 [ 585.320621][ T30] ? schedule+0x90/0x2b0 [ 585.325083][ T30] schedule+0x164/0x2b0 [ 585.329300][ T30] schedule_timeout+0xc0/0x2c0 [ 585.334314][ T30] ? __pfx_schedule_timeout+0x10/0x10 [ 585.339761][ T30] ? do_raw_spin_lock+0x12b/0x2f0 [ 585.345029][ T30] ? _raw_spin_unlock_irq+0x23/0x50 [ 585.352437][ T30] ? wait_for_completion+0x272/0x5e0 [ 585.358013][ T30] wait_for_completion+0x2ca/0x5e0 [ 585.363317][ T30] ? __pfx_wait_for_completion+0x10/0x10 [ 585.369054][ T30] ? kobject_put+0x50f/0x550 [ 585.373885][ T30] i2c_del_adapter+0x281/0x430 [ 585.378806][ T30] ? __pfx_i2c_del_adapter+0x10/0x10 [ 585.384224][ T30] ? dvb_usbv2_exit+0x94d/0xb80 [ 585.389215][ T30] dvb_usbv2_probe+0x4bb/0x3950 [ 585.396597][ T30] ? __pfx_dvb_usbv2_probe+0x10/0x10 [ 585.403851][ T30] ? __pm_runtime_set_status+0x994/0xc80 [ 585.409657][ T30] usb_probe_interface+0x653/0xc60 [ 585.415980][ T30] ? __pfx_usb_probe_interface+0x10/0x10 [ 585.422217][ T30] really_probe+0x254/0xae0 [ 585.426904][ T30] __driver_probe_device+0x1e8/0x360 [ 585.432291][ T30] driver_probe_device+0x4f/0x240 [ 585.437352][ T30] __device_attach_driver+0x270/0x410 [ 585.442884][ T30] bus_for_each_drv+0x258/0x2f0 [ 585.447907][ T30] ? __pfx___device_attach_driver+0x10/0x10 [ 585.454371][ T30] ? __pfx_bus_for_each_drv+0x10/0x10 [ 585.459812][ T30] ? lockdep_hardirqs_on+0x7a/0x110 [ 585.466291][ T30] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 585.472758][ T30] __device_attach+0x2c4/0x450 [ 585.477587][ T30] ? __pfx___device_attach+0x10/0x10 [ 585.483039][ T30] ? do_raw_spin_unlock+0xf5/0x210 [ 585.488211][ T30] ? _raw_spin_unlock+0x28/0x50 [ 585.493172][ T30] device_initial_probe+0xa1/0xd0 [ 585.498245][ T30] bus_probe_device+0x12a/0x220 [ 585.504895][ T30] device_add+0x7d7/0xb80 [ 585.509279][ T30] usb_set_configuration+0x1ad8/0x2180 [ 585.514904][ T30] usb_generic_driver_probe+0x8d/0x150 [ 585.520419][ T30] usb_probe_device+0x1c3/0x3b0 [ 585.526407][ T30] ? __pfx_usb_probe_device+0x10/0x10 [ 585.532258][ T5721] usb 5-1: new high-speed USB device number 121 using dummy_hcd [ 585.540155][ T30] really_probe+0x254/0xae0 [ 585.545008][ T30] __driver_probe_device+0x1e8/0x360 [ 585.550381][ T30] driver_probe_device+0x4f/0x240 [ 585.555615][ T30] __device_attach_driver+0x270/0x410 [ 585.561259][ T30] bus_for_each_drv+0x258/0x2f0 [ 585.566228][ T30] ? __pfx___device_attach_driver+0x10/0x10 [ 585.572486][ T5721] usb 5-1: device descriptor read/8, error -71 [ 585.578736][ T30] ? __pfx_bus_for_each_drv+0x10/0x10 [ 585.584280][ T30] ? lockdep_hardirqs_on+0x7a/0x110 [ 585.589539][ T30] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 585.595451][ T30] __device_attach+0x2c4/0x450 [ 585.600280][ T30] ? __pfx___device_attach+0x10/0x10 [ 585.605742][ T30] ? do_raw_spin_unlock+0xf5/0x210 [ 585.610915][ T30] ? _raw_spin_unlock+0x28/0x50 [ 585.617142][ T30] device_initial_probe+0xa1/0xd0 [ 585.622413][ T30] bus_probe_device+0x12a/0x220 [ 585.627328][ T30] device_add+0x7d7/0xb80 [ 585.633266][ T30] usb_new_device+0x99d/0x1620 [ 585.638219][ T30] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 585.644364][ T30] ? __pfx_usb_new_device+0x10/0x10 [ 585.649630][ T30] ? _raw_spin_unlock_irq+0x23/0x50 [ 585.655026][ T30] hub_event+0x28e8/0x4d30 [ 585.659545][ T30] ? do_raw_spin_unlock+0xf5/0x210 [ 585.665231][ T30] ? __pfx_hub_event+0x10/0x10 [ 585.670574][ T30] ? process_scheduled_works+0xa20/0x14e0 [ 585.676459][ T30] ? rcu_is_watching+0x15/0xb0 [ 585.681821][ T5721] usb usb5-port1: unable to enumerate USB device [ 585.688395][ T30] ? process_scheduled_works+0xa20/0x14e0 [ 585.697488][ T30] process_scheduled_works+0xa8e/0x14e0 [ 585.703224][ T30] ? __pfx_process_scheduled_works+0x10/0x10 [ 585.709287][ T30] ? assign_work+0x3cf/0x5d0 [ 585.713997][ T30] worker_thread+0xa47/0xfb0 [ 585.718666][ T30] kthread+0x388/0x470 [ 585.723972][ T30] ? __pfx_worker_thread+0x10/0x10 [ 585.729149][ T30] ? __pfx_kthread+0x10/0x10 [ 585.734959][ T30] ret_from_fork+0x514/0xb70 [ 585.739630][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 585.746053][ T30] ? __switch_to+0xc89/0x1420 [ 585.750829][ T30] ? __pfx_kthread+0x10/0x10 [ 585.755562][ T30] ret_from_fork_asm+0x1a/0x30 [ 585.760399][ T30] [ 585.766988][ T30] [ 585.766988][ T30] Showing all locks held in the system: [ 585.780534][ T30] 6 locks held by kworker/0:0/9: [ 585.785744][ T30] #0: ffff8880206b2140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 585.799075][ T30] #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 585.813215][ T30] #2: ffff88802a5541d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 [ 585.822664][ T30] #3: ffff8880217011d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 [ 585.833507][ T30] #4: ffff88802eaf51a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 [ 585.844005][ T30] #5: ffffffff8ff93600 (register_mutex#6){+.+.}-{4:4}, at: usb_audio_probe+0x5e6/0x2280 [ 585.855310][ T30] 1 lock held by khungtaskd/30: [ 585.860221][ T30] #0: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 585.870290][ T30] 1 lock held by klogd/4982: [ 585.875752][ T30] #0: ffff8880b863b160 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2d/0x160 [ 585.886253][ T30] 5 locks held by kworker/0:3/5359: [ 585.891844][ T30] #0: ffff8880206b2140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 585.903333][ T30] #1: ffffc9000369fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 585.915299][ T30] #2: ffff88802a54a1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 [ 585.925701][ T30] #3: ffff88807d5101d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 [ 585.935192][ T30] #4: ffff888076f751a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 [ 585.945798][ T30] 2 locks held by getty/5379: [ 585.950574][ T30] #0: ffff888035e2f0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 585.964877][ T30] #1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 585.975568][ T30] 5 locks held by kworker/1:4/5714: [ 585.980827][ T30] #0: ffff8880206b2140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 585.992670][ T30] #1: ffffc900053ffc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 586.005277][ T30] #2: ffff88802a4ac1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 [ 586.014615][ T30] #3: ffff888025f391d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 [ 586.024044][ T30] #4: ffff88801e74e1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 [ 586.034800][ T30] 4 locks held by udevd/11366: [ 586.039604][ T30] #0: ffff88805f12aab8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 [ 586.048563][ T30] #1: ffff888055055c80 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 [ 586.058282][ T30] #2: ffff888075ecef08 (kn->active#31){++++}-{0:0}, at: kernfs_seq_start+0xb2/0x420 [ 586.067962][ T30] #3: ffff88807d5101d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 [ 586.077729][ T30] 1 lock held by syz.3.2825/14702: [ 586.083008][ T30] #0: ffffffff9002de40 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg+0x767/0xc00 [ 586.092662][ T30] 2 locks held by syz.1.2826/14705: [ 586.097884][ T30] #0: ffff88807fa2d6e8 (nlk_cb_mutex-ROUTE){+.+.}-{4:4}, at: __netlink_dump_start+0xf4/0x7b0 [ 586.108308][ T30] #1: ffffffff9002de40 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_dumpit+0x92/0x200 [ 586.117844][ T30] 2 locks held by syz.1.2826/14718: [ 586.123262][ T30] #0: ffffffff9002de40 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg+0x767/0xc00 [ 586.132848][ T30] #1: ffffffff8eb5ff68 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2d0/0x770 [ 586.146867][ T30] 1 lock held by syz.0.2829/14716: [ 586.152183][ T30] #0: ffffffff8eb5fe38 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 [ 586.162403][ T30] [ 586.164804][ T30] ============================================= [ 586.164804][ T30] [ 586.174941][ T30] NMI backtrace for cpu 1 [ 586.174961][ T30] CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 586.174987][ T30] Tainted: [L]=SOFTLOCKUP [ 586.174994][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 586.175004][ T30] Call Trace: [ 586.175010][ T30] [ 586.175018][ T30] dump_stack_lvl+0xe8/0x150 [ 586.175046][ T30] nmi_cpu_backtrace+0x274/0x2d0 [ 586.175151][ T30] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 586.175176][ T30] nmi_trigger_cpumask_backtrace+0x17a/0x380 [ 586.175194][ T30] sys_info+0x135/0x170 [ 586.175217][ T30] watchdog+0xfd7/0x1030 [ 586.175253][ T30] ? watchdog+0x1c7/0x1030 [ 586.175278][ T30] kthread+0x388/0x470 [ 586.175302][ T30] ? __pfx_watchdog+0x10/0x10 [ 586.175319][ T30] ? __pfx_kthread+0x10/0x10 [ 586.175342][ T30] ret_from_fork+0x514/0xb70 [ 586.175367][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 586.175391][ T30] ? __switch_to+0xc89/0x1420 [ 586.175414][ T30] ? __pfx_kthread+0x10/0x10 [ 586.175436][ T30] ret_from_fork_asm+0x1a/0x30 [ 586.175488][ T30] [ 586.175524][ T30] Sending NMI from CPU 1 to CPUs 0: [ 586.292494][ C0] NMI backtrace for cpu 0 [ 586.292520][ C0] CPU: 0 UID: 0 PID: 14707 Comm: syz.2.2827 Tainted: G L syzkaller #0 PREEMPT(full) [ 586.292542][ C0] Tainted: [L]=SOFTLOCKUP [ 586.292547][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 586.292557][ C0] RIP: 0010:__schedule+0x15b/0x56c0 [ 586.292580][ C0] Code: 00 00 42 80 3c 28 00 74 08 48 89 df e8 3e 2c 62 f6 48 89 5c 24 78 4c 8b 23 49 8d 5c 24 20 48 89 d8 48 c1 e8 03 42 80 3c 28 00 <74> 08 48 89 df e8 1b 2c 62 f6 48 8b 1b 48 89 d8 48 c1 e8 03 42 80 [ 586.292597][ C0] RSP: 0018:ffffc9000fdcf9e0 EFLAGS: 00000246 [ 586.292612][ C0] RAX: 1ffff11004fa9ba4 RBX: ffff888027d4dd20 RCX: 0000000080000001 [ 586.292624][ C0] RDX: 0000000000000000 RSI: ffffffff8c4bdd60 RDI: ffffffff8c4bdd20 [ 586.292636][ C0] RBP: ffffc9000fdcfbd8 R08: ffffffff90579d37 R09: 1ffffffff20af3a6 [ 586.292648][ C0] R10: dffffc0000000000 R11: fffffbfff20af3a7 R12: ffff888027d4dd00 [ 586.292660][ C0] R13: dffffc0000000000 R14: 1ffff92001fb9f60 R15: ffff888124f4c000 [ 586.292672][ C0] FS: 0000555578e7f500(0000) GS:ffff888124f4c000(0000) knlGS:0000000000000000 [ 586.292686][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 586.292697][ C0] CR2: 00007f6d789ef2f8 CR3: 00000000367bc000 CR4: 00000000003526f0 [ 586.292711][ C0] Call Trace: [ 586.292720][ C0] [ 586.292729][ C0] ? __lock_acquire+0x683/0x2cf0 [ 586.292757][ C0] ? do_raw_spin_unlock+0xf5/0x210 [ 586.292785][ C0] ? __pfx___schedule+0x10/0x10 [ 586.292810][ C0] ? schedule+0x90/0x2b0 [ 586.292828][ C0] schedule+0x164/0x2b0 [ 586.292845][ C0] do_nanosleep+0x21e/0x6a0 [ 586.292861][ C0] ? do_nanosleep+0x7e/0x6a0 [ 586.292876][ C0] ? __pfx_do_nanosleep+0x10/0x10 [ 586.292891][ C0] ? __asan_memset+0x22/0x50 [ 586.292909][ C0] ? __hrtimer_setup+0x1b7/0x260 [ 586.292925][ C0] ? __pfx_hrtimer_wakeup+0x10/0x10 [ 586.292944][ C0] hrtimer_nanosleep+0x18f/0x3a0 [ 586.292962][ C0] ? __pfx_hrtimer_nanosleep+0x10/0x10 [ 586.292981][ C0] ? __pfx_hrtimer_wakeup+0x10/0x10 [ 586.293000][ C0] ? irqentry_exit+0x218/0x8f0 [ 586.293022][ C0] __se_sys_clock_nanosleep+0x35b/0x3b0 [ 586.293041][ C0] ? __pfx___se_sys_clock_nanosleep+0x10/0x10 [ 586.293069][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 586.293085][ C0] do_syscall_64+0x174/0x580 [ 586.293105][ C0] ? clear_bhb_loop+0x40/0x90 [ 586.293123][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 586.293139][ C0] RIP: 0033:0x7f6e51f5e84e [ 586.293152][ C0] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 586.293165][ C0] RSP: 002b:00007f6e5234fb28 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6 [ 586.293180][ C0] RAX: ffffffffffffffda RBX: 0000555578e7f500 RCX: 00007f6e51f5e84e [ 586.293191][ C0] RDX: 00007f6e5234fb80 RSI: 0000000000000000 RDI: 0000000000000000 [ 586.293201][ C0] RBP: 00007f6e52227da0 R08: 0000000000000000 R09: 0000000000000000 [ 586.293211][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000008f989 [ 586.293221][ C0] R13: 00007f6e5222609c R14: 000000000008ee03 R15: 00007f6e52226090 [ 586.293241][ C0] [ 586.607620][ T30] Kernel panic - not syncing: hung_task: blocked tasks [ 586.614486][ T30] CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 586.625175][ T30] Tainted: [L]=SOFTLOCKUP [ 586.629504][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 586.639651][ T30] Call Trace: [ 586.642943][ T30] [ 586.645897][ T30] vpanic+0x56c/0xa60 [ 586.649907][ T30] ? __pfx___schedule+0x10/0x10 [ 586.654779][ T30] ? __pfx_vpanic+0x10/0x10 [ 586.659302][ T30] ? irqentry_exit+0x218/0x8f0 [ 586.664086][ T30] panic+0xc5/0xd0 [ 586.667828][ T30] ? __pfx_panic+0x10/0x10 [ 586.672278][ T30] watchdog+0x1030/0x1030 [ 586.676630][ T30] ? watchdog+0x1c7/0x1030 [ 586.681071][ T30] kthread+0x388/0x470 [ 586.685154][ T30] ? __pfx_watchdog+0x10/0x10 [ 586.689846][ T30] ? __pfx_kthread+0x10/0x10 [ 586.695069][ T30] ret_from_fork+0x514/0xb70 [ 586.699678][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 586.704800][ T30] ? __switch_to+0xc89/0x1420 [ 586.709496][ T30] ? __pfx_kthread+0x10/0x10 [ 586.714099][ T30] ret_from_fork_asm+0x1a/0x30 [ 586.718886][ T30] [ 586.722078][ T30] Kernel Offset: disabled [ 586.726410][ T30] Rebooting in 86400 seconds..