last executing test programs: 21.234843883s ago: executing program 1 (id=1226): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) pipe2$watch_queue(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r1, 0x5760, 0xb) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r2, 0x5760, 0x1d) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e21, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) mount(0x0, &(0x7f00000005c0)='./sys_mnt\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r4 = socket(0x21, 0x5, 0x0) setsockopt$RDS_CONG_MONITOR(r4, 0x114, 0x6, 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys_mnt/class/rtc/rtc0/date\x00', 0x0, 0x0) read(r5, &(0x7f0000001000)=""/1000, 0x3e8) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='qnx6\x00', 0x364432d95f13a4f4, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) fsmount(0xffffffffffffffff, 0x1, 0x0) r6 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r7 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r7, 0xc0285700, &(0x7f0000000040)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r6, 0xc0285700, &(0x7f0000000100)={0x8, "b546baa5cc590d3033de259c2996817bb959ebab028deda501009bdeffafde25", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r8, 0xc0303e03, &(0x7f00000001c0)={"0080bced01eb0100000000000000000700000000000000c900", r9, 0xffffffffffffffff}) ioctl$SW_SYNC_IOC_INC(r7, 0x40045701, &(0x7f00000000c0)=0x402) ppoll(&(0x7f0000000500)=[{r10, 0x200}], 0x1, 0x0, 0x0, 0x0) close(0x3) r11 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0xfe, 0x7fff0000}]}) close_range(r11, 0xffffffffffffffff, 0x0) r12 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x109) write(r12, &(0x7f0000000000)='7', 0x1) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x7a, &(0x7f0000000340)={r3, @in6={{0xa, 0x3, 0xdb83, @local, 0x1}}}, &(0x7f0000000040)=0x84) 21.113993001s ago: executing program 1 (id=1227): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000280)='./binderfs/binder1\x00', 0x0, 0x0) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x10) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r2, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) (async) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r3, 0xc040aed5, &(0x7f0000000340)={0x10000, 0x1000000}) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f0000000780)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c67726f75705f69643d8a86e8aa676f7906dd84890358841eb7e55a8dd09f260b842e1455a196672466efa6a561e21bc13dc53a710e8f23e1c624673c9e51e12eae802e8ca038e3dd05c1c03f7425412a79787326470497945fe4b781d418a22075279266e8", @ANYRESDEC=0x0, @ANYBLOB=',\x00']) (async) read$FUSE(r4, &(0x7f00000021c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r4, &(0x7f0000000080)={0x50, 0x0, r5, {0x7, 0x29, 0x9, 0xffffffff9080edc4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x2}}, 0x50) (async, rerun: 64) syz_fuse_handle_req(r4, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={0x20, 0x0, 0x5, {0x0, 0x17}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 64) syz_fuse_handle_req(r4, &(0x7f00000063c0)="99529ca7d265e2dba44891e35e7d5dab7921b730436ecd4e999a25bcf86a25f8f029c0dd50373e90b7cf7779b12ecd4423c5b13cfac186975cd723976f3c747612913029d42517c189364bc59d8ebad53ed1b86f8f66c99b1f9b5b40d78cef1f14f81815d53bdca7fef40607358db69eb8c0b1f6b0942ab4b1ee7ca8deb4eddef06381a3d1c52d6147fc5109c7c607591497a6b2477f60cc881d3219c96bffb34aadec3fa97250713cce17cd536721bf9c40a019531ed0bbad139e26a3d4d39b68ab1bf37cb1a4bd197a8789cb1940cd86d9e56713bc36c7cffd07a311f5bc2e91f16d152eb480645e85ec9b3bf09c7fa140dced0afd55d7b99e90a96e7748e2d0dc09672ac199ce529e631efe1783769819c182ca106f6184bcbb387ed246c43562d74c36ac3a7ec2f0e11f70bad0007c03bb9c0d2dacc2148cce4a4aea327c7319016ad146b52bfae0357f9e892e9bec61a13c93551cfa3d4f4bfa7585c93bb0bef01a9114f3dc54179cf9a57fe88f5cff3403e33c9d09e3e9c2e10f1f16894e1b59e3cad47c1f202cf7b756f2851fc96d09459c9a8d34c19e6a3525cd5001aac5181f57286d0e1e88ce5092c7c76b6abdaebf2c499aa47587b48eb12a2b72548c190b0324ebedb81a63333b6edb25550f859c5ccc404a944ff7f61af8800888192fbd4c8e0e417d1d181b4b335a6f52e0a7dae18397e81e3f747cab7be902ed903bdd6a622f178f9b4244718ee1206237257374d2fd1466ab6135ef7ef4a114ae170eafe9cd78cf9ffc36974cbc4b8003072bed78765a0b9f1240f24dec6a9e46db9bb498d40f727c0cbf8f4a6a49539bd0805caf65d80130d7fb60a69dc7ed890874a17530c042cf33a977d331435d68ef33885f638c777ad49564ca77d8b81ddd853a21cd55d95b627310dd633a4f005853a5506cd8f744c367f3cb6998b0fa97de6bb35b166b0c6408c4e0a38ed26235a88520c38ca97ac8a6dc81e6dc6483d383fa09f198997b8eea1c68c9e3320683c9a02dd89ddc34c241e7294ccc88d6b35762892e8746e558bfbc2251949f2ecb763dad5b975eaf36e2864be6a41d3e20514d32f5d4b6350dc7e3cc3a85428ea98efb3b1edc2a2ec1e618452949cc7e2ba1251990168fee342d4f304b7a7af9162bcbe6b09c75d7420d2c547b4e3cee1836df6eddd5dff73a4e308fcd8eaa7a33e6980a6f8ead03257a37d72d3b265d02fa42f57db877654ed513e31c35e1af0bd28511d6b57cfe07b27cbe9767a534b426dfc3dd257d5899444f34cbf4dc74b9eab2e7e3e1e1a8a6ac5e4359d653506b299a5b7c67b92dc462f1216655f952362a3387ad9966b606d98e8d1b544dc27dc6bc78fd18a446736e25c51143db9886b6c09812d5825b5d9e0932f218ff8bea4d9e1c4df9c9d4eb19336d48163a921c4ff1f0beef26b01b7e8c0d23fb59b84e229eaabb791f2cffc9aa4db75162cbfe4c9ae8d76a5b6bc4bff20e3f8f125b9aadb3e728d7f78d61fd55f46b7f59511b876e6563256686e44f25cf38d393a9b762bada272eba8df28e4086c4cd2fe3c9fab97756fb145373e6ca1991bb1ee6589e49c821ff29f047970819f88f724bd077cd3f0ae463d99b3e53078431e3f9bebabc5289a65479359efe3909186aac60a29f561de8c590988c913c9e693ab8106e8287f6565eee6735f7c88cad7124d1c8d9ff347e97912824088ee954de01c6d8a06447f06899607eadbfd078bc3df506252005749378dbd7399c9eca60b81dc0d88dedec31e5cf6e7b6d6d411958df8f9e0bf4443e8d3bdfe49d05f811d17088024d0629fc8ab8e05e309bf55e8e60d342623765f4e8d2dc4a90291cd4354ff9568c8170e6ea56e028bcf2719595253adb8c84050bb9ce4927a1c1f4560da87d109ceda90bbe45a1717763d8025f1ff40f157185ddf17079da272ae10c4f34162caf4b0d31221a57b3059fd449c87554d968a54b2eebd760dc3263c40d9eedf5905d5699d29706ea6e9e81ff2bf92489a06deffe7e978661f37a88450783e23f107c2bfce000dfc91c5fca49e46d9ea978f215a45984699f0d2503b30a741e13be56b7abe3e5663c0825c3cb04ead44ce97719c4ee6f4cdd3c452775ad7163d5c9034583cc2dbc2b0c04917a3e1aa3d0a8bb6fcf94d7922eb1d543c09185827aeb1b72ae7103ef2c014af2ff4b47fca40fb0e66ddf0264476d7a84e9b8dc551d4c407bdbac6757f7a25bd404b45bec1091696203cc438860131ad5f2fd80e3c45629864dd9f7d302b66fb8fb86735c9a6dcf8b135a273dd2ae9473bc905081be9fcb8f91b1ddba1ac692798dac0b9ccffe0319a779f5e10c65f294b22fe475283b023f9cd890e92c5447b1bc1528255c5af383bc1fb6e72cb9a67215a9e25cde63c89baa8c7125c7e8b748b728d07d9cb66778404f54e6a9e3ae1ae82f3d0ce77199f23f94a01b71b805b476fedbebeb52c83a1b857f23ba438c56a6c4c2a5909f721e6e3d240e4a16455e92220d13022ce7ec0b1365ba4e67aa6ecb324f8826579e12cebdfc0d8af63e83b5e5624d5b791f99093f9a27f7baea9fd10111209c0857a04f07408111063ef34026aee27a3d51b40e53883f9094402534bdd21cc49d7f5593e99cb204cd805bee4add0f82cf4b6dc5da14d6b79fbc68c9ccf7fb5fe774f8879e13079b024a8ad24bf123c420d630837a84ba05abf0ae4dc3fc04f25c7f74ff91d0d609c958642a48551e51b5c0074a56a7da10ce153b08cabea636f8489d8e7b655758a41d7f7474c9d76bf4d54d789bfceaffef139854065de6a94b0275a9626aab99ae838364b1a491e55017e4212b6b01f7a41bc9c215ecd17c49a8610db28c699259c58b81a0e84c45fd8e719c05c48501c49e8a6515044d247f58e4cd0bf22fd6ae31f45339d1f801196d426c52269b1aaffaf18e2a03760bb231cb7cefa6d72f1d7eb6a3bbd65d0914221b8fbf531dbd562eb4a1b28983ac7d83d4813b10b34c9525ba644f61a2c4800d4fe96a7bca63da1041ed73cc57fb9d42f9dfc8ca41d80292bbb311c89b0a0fcee1d88a025a7416863342aea00e6f049cb2ddebd17c5c617ff562a8af0c965cbe8341431a30ea239e4a62aa2b19757a3b0de04229a9907f8610c27b26591405845bf8b5b83706ed18d910c4f68777378366ff565617b19168a04560a32ce5ad64aaef9f4377118c4335b24826cdcde78fb4bdb11498553f56d8dfeb3a482c70cc6580c399b92339cbdb3464fcc7b00e9839fd0d2b8b6db90c56b33593a0048bf7983421f29b1285c81a239045b96a9b0cacd70d6d9853206471f06915efc8d3ec4c50fb13601abc73247a656066fd7b329159b3ce9e3302b4c0d6aec58cb0946a8ee8e7f55f1af604f1edb4d887fa6292dc0ce57705c1a25dc62650c127d11a364b397aefc2fcc3a164bdc53165a461b01de9180c1461b309c75af0911b4cc1b8aa05652b62119c87b4b235c573aa15b1516cddf61efd6a7f8c953fbaaee9c0e800e8f519e1494de850ddb976864088fe0cf90bbc54395078ea2501e8baa84d6807e184105bc2a140b663416496886422643bbf764d406af06e7d086678828defda0b648b25666b7b5ea29e927141740d5be0e61bf25d40b8404ffd3c67bb855b11d4faf82b7b8051615c101c3deb0601a0fa9ecd8b4a95082ccbc8222b0982802dd8430e653d6eea2786dc3a91397135faffdc65a5bae048f5c463b1a6648becce961d39d063d28d1ad6dafcea0b0878379adb16cc0d4cea572abeacd9a168a4fe2e338092b5bc93ecf02ac6ccda03e5b23adf511fdf7a79442093233b79c67d3fdd3c36c96a8f67aa79e4743d99cf963ae6161877f73656eb0314d889f4b8649bbce8a759f90eac6c006197b54b2bbac7c9b237f1e3dc099c62a65481960e6ad697fc66316ac084ba99c60f58bf44ff45f3b2006cbc4196a25f124dfaf247e863a855ef6070deb45219a922dcf2be9bd01c340e1ca5ed7c3ddac9f7a677c5d00610991d21e0751ac8044585b39f3fec5b672a11a9bce32196c2003d01ea50b0f0403e16df188ecbbb74f295f01398363ddfecdb63a49347c912c125670205d7b6be999688df85bb7d5ac12b62b4fdc4eadcc2a9a7897028404f697b007603a0ad588c772952d6670ee870771774ad157c0b9cccd4b2192d835606198ea0c65036ae4e406cdc539ff3aa81fa20b7ab58d6f3abdb69cc1f503d593f7025d2035e7f21db76336efc2843a0dc9bd2eb8794718134ee68fc57d4d2bcc18969d08177f442b87433b48540c661940cf9e2462c53efa310c7e47487deab2ae15b1978ef05aa1e14110943f649d82486f710a39854409e74edcaf06b4a92d3580b9cdabf83c6351657698d3d5af7514f382e75d1c912cded577258603fc9ed002e010747cddf7885d34afc9a84d82696c6660cb5ecafb68b564908fc49c4db6a187d037241a26b1141cf20f2e968a53366db0f60b79cd98cf3c897c50b7b9728e6e7100f99e4d5ed2428dbd285516ca6660777a39b4b2617c1be5b0232d60b9c8099f5daedbf190109439c40b46090985200d6c0501313f3fa4d244864575c275faca47aeff32c7b3e3c59392618562a7c2d4b3af85a37a8847f595352024cb63d3a9085c2a502c6a3248f43c5fc828e636cb634b2d393d853ae2dc9605985cf85c060860a90256c7b574c1e01c320687a2bb0b2d51cc2950c485f2ffa5db0ad7aaf753f543de7f86efb775c6bac2989a33757a28836fd27f9347229a0004bd2e546994c69c678fe5717f613f905d945c072004c3a80e0e54215e19ff9972521890d4e705e429f16fc35fe5a15f2e6b75cd719d38f76b087b62e4b5dcdb35f4baa2bab167150bafb6c69e260ca51004bc826d46b77c3f67eaa08497294868e6d91b7b867e4da62052f4f891677256cfbaf19cf32bad99a7da69d8a66537686f89a58d78c7eeaa99cd38009a1a32582bedc5c718e57b19cd405ae659a89909356a07fcef89384d160fa5ae6683cc379642aea4f0c915f72d679bd521399cb16112f2abdede3001400b4a64d2173e153a68631183679b56b8f389ba889784133453a7e892fd3b092f5040870a3cfd6f982990143e7c0882b4ff4c5d049192d36925a25ae4be441aa30dc7e74398b340c45b52c73ed3b0cd640e3cc9fd4be24e7355f386106f65895f1ee850b2a781d1d1d322ca5a3b0fdb78ce1eda048ece94af25437969c99c58c08f1446ca5541e03987a20fd75283e3e116dc4c9222ab7522e4ccf6da14aef49cac9a6a2cd4aba1c54d49e6da4179a66b84e384cd3da53908579b28c11d525ebdc4dc69074cef8a9ecd3aab98f2858769d656b46141c3a4e69a5ed6c0a732c9ec1fce080eaebf537fa5e17236a44ba9c931f555d193e475ffafd20c53ccbab607c1a15fd06742a64691205eb0d00f7f40e4dd8efb279cf09b2522aac0729a631aacb92d5cfa2ce6bb07385b981890b5916755d5cc3a51c8c36bd2987068cc24fcf73840895ca9bbb9aff1059601f771afedf0a48d5921103920515b27d7e607951982feba197df8c61600feb3622b9eea13a4db4068728cb98cca76cfae197f6258758490bf41673ee29acd91fd296ec863c646e0ca6a0f0e9de146c663ba13d962964d7c32804fd12a14c1ca7212ad48bdfab469c6570dca562220ecbe7b6b163ed4c9361c5c10bed5c92861b8786ada20a99245d282e4454187ec02adfe354e30647cb10661c85168f7958e3ce69ab48c9455214707a63c9b1167f0845a6bfcce2a96cd53eab430f13cd527f1666290719a47c517cfa22fec2e9916af8aa93c78e567993d7fb8ee60fc4b903b8c67a3658302c5e5f35250c30427e4c055b6c54705bc599861f80b7200d361965ff98c88cc698a2615cadeac4bdfd3d613377cea52d2bbcb7e6b78ac31d4b2c33eaf0b2ed40b963e3cb25c7dfea3ebfe7b4c9f2aaaaf184dc80ab649a108e2c830ce7eaea58a263392aa9cd13d7f7bd607dc7c804b19dfa41b3e5a5155201a87311e22062c93896e70f3a5c4b03521300b61cc311ebd5beb9838d0ed207c6bfc99e4392508e95804b10b36024f32e1fe1138e9ee7773f797b2bc6be7416f4e9691ef4c2a8d06af6c8b84bd1e6fd1ba3d3183475ef6c139ccf8dcf37671fbb96a2ab5e0e042f7c4728cf30bcc1a0de28a5024276ceaa194b4926e7f6a97b78bac36e47f832d56a96cd266434d37bcf2c2f57877717d91b1854972f832354acc207a2ee8caace7504e0e6197dd7e64a01c4c67bb2de8acc0cccc6c6bff0b0cbfe345542c5a795dfa48cc0990ab5702574d36494bc44c20f5b324f7c984d986cc8cb40cb2550076d96a069b6688d22171beed2dc5b6ff3ede8fff4c4a9de6d3817357a7ca7d24d87300b4545ebbac8cf7f09ec637a4f4d6bd07673709b6c363a75ccef585610c5f15de7851b5ab53e02a757bfc3caeb9a9a8996beffdc0cfd1201b6cd99cb035584e51a6c15a5d2e17d2f8aa6b41e26809392fac6caed1e02a53dcea8a413203608780dab33315a76eba24d540e4c5b9790420834bc8d4e47bc65ae52a54c0ff308427a8d7aff746aa6589d17514e40fee5d0b3533cf4ad2c5f9d96db9f50bd69ed8c92b860e199a35cf268c66ed13516a3b4b024f62d4b2a656067eece95575bdb4907efc488a9821bc3a9c81dd11b2128b7a01aa7a9ce6e73de3b4e9beced70206f91575baddbcbe5722337953c8016a0f4b62120d776c43b7d1a879b692107954f45acdf8967dcaa994aad4922d4fe093e16c2d0090906f5036af99e50bb09b04e9c9b3b5085abf621297ce203010249cede92e9b66b446b86b43eaaae228dfdd3b4408c12b404bb727f7e969e7da04fc59900112bf8d38af0416dc616e75f167aa1352215f07115a6f4eb6bb5fff6f5c2fc9ab906392036b44090e65fdaf017dc53bc94e0807d679d793df18cc44e6c846d414cef1569530f7692daf91eaaf4ae89fe2522f2c9cf33b6ca508ebcd006bc1a61f0c800553aff9dc7d57200b25ecb83e1e0b8cd29520b63aa649d3f71a62570eee56e03223ddf31f0c04fa686b7f6dd054e7a259d9ba335c2c5b2c508897506c0db7f01878dec1411c33f0af61b81dbcf9ff8bdc0c50044963a79f3ee1462150c6bd03a32dbdfef8d72f0b8b3a395ffb0cc85792e7bc867feb5e312cb64e29e193388e9f173c162f4a1320a6f99ea3795fb77d982605959909a1aa11076fcc779ea6b80ec1bf0edfc2569ec04d15a0bdeebccf3c75393dca5e81663532f8ced12d08e4c2ae6e2954d427c7bf053dc4718f56f453bc88d74045bd2f9747aae9b5298a0de927f1d6b1308f4e1483487f083e71ed09298deb52bb10079b13def7453eb432498069edb5ade70c5c54913684d934a3febf78753ac13300a91f467ff3f6e2f00898f015d08f7739047b321b3eaee5ad8aa7adbf7833f014d8c576a491af9fca6843b327ed513821cb3951b2e67a275225d7af6b382e2f955adaacba5d1fdea2223202dee132b91d5cf381b51da94145255f584a70c5e8d11e06a44afa6599bf3ed0cb61703eba254333af53afac60e54cf6397f9f7302249ab644f0b576c713b15007be1f4f9bb213660bca8a70251472b86669d361ef968f542e81ddbe8f4d2e9cabe8d7bf6a31f14a2cc272963553a424c105e7750437ec5bf316e30ce60b4b0c27ccc1eb27e60f6472fef27654da49905ff9c01b28695310ecd8701aedff25a83da4b7c41995f902bdf249769dcb53a3efa894710dd66ba8745ae2253cc6b75a038183a0bee21226d48239320efad6727093e4f94bbc2fdcc216200d903c32bb9f16dd17d5dac423ae0696f3decc576b8f1fdce63d0532370af7d1e2fa2ca5c5d17bd88f5e3abb4792dac8689ca13752f83d753b06b037bf5a80a3748983790352775685b0414c9d74849fd217e388f904278ddb6b0abdda941b61579c796e2bb77a9bc363b18642c401faa502a31011544111b6eedaa369976c814773d83220a75f31026d6ad0b8b4298ea6062234db232bc435e096e84f740e55bb14d46ae04af0500aa5bb218aff6c76aa8a8e3140a1b0d6638538fd7f30fa8d992e53abf8af2fbc16b9e8a668c1aac72cea1a746ee5f7f3392a4ec8f1d19f2f426b6069b1cd347cbc38bceba96ce5da49198083403143c740c04639cd1089abb34fe812d85921c47437604f684bca44a1eaa965c0a6e1c1fd1f70ee932af3455b36184cc15934cdb3f28959d37d8fc10696f8ec1e4b0c3d1b9ff74a01b796d1bb68954a3768c8bcec741b3b69da892f8922142b16b2cabb469a9906b34216243fac80374c10e178c5fd36440f8d7a8588a9c2510d86ffa8cb68ce8c330d2111c94724e522f04573dad43bce252eb505d29ca9379a6b281519d38b7174f3ae8f185544f3003c936a7e6b23ca97a313aac6a061caa45fda73522f3061767bb4e33dbe4bde390eb0f07225a8aef939cb6ab2ada10c02527281abad394cd4ea9f59467a08b72047cdb75d7b2b98e5b4542554a60f953ac7a4b980f42518eec05ff2c044549cab0cf33eef36dfbabcbc0300009d898862d2194cfcdd9a713c30bbe52291105193656ea5eb830873ac956469d31689cc3c69edb5cb9a6e31ce3e6fb50ddd4e52ef9fdeacfc0db21e1e83e0d8d0a64f17cacb4dc208a893e7fd8ffa86cfc554dfba3d9fd281115eccb4b9d909f2fbf3fbb66bedd7b5db3f6d4f07ef5d8fb54f8832896f8ef6f624162f1dd589be7a8e87dd5065708a8b0bfb18a5c2299f5605ac8981c1add55b2018e6099380a70bee3e0727ca6ec58928fe6eb3147b47401e8d822eebade713b58335787669e5e0de5d328a1067df4cd9124665bb02ee8adfd1b3618374ef167df1f0fe79456f78aee3da4c1bf397e4637b0cf41a0f4a2910efd02b17bf5f3c15b0084b36fa7d4e85a53e5be366b428244eeba7499c3e54397227928e2ff6e583f332d6f7e8cf4d058f379b58a7d03a4bfa454bb4b6d543804b8970e6a9fe8886179eb418a8ce9e509e8433571f7d32378f2e983fa418c8c91760ec9fb20968e7fc23b7c4ac71693b2576ac0f8ce2020ff1e7a7ff24301b48b544fb29a1ca4f2502daded865e488a16dd33ec67b2eee3025cdc5ef90f253c4b5e0a61d51e495b675c5a1d55b4ba3812c5f44cd08487e61d36b0c2dc32d27333a5ee8a0906bfbcd388bd9389d1509912c0471c7b706a5aff880569a3fb11ac5f14d780deb4c1b1afe30fb6b8daf87b27a4ceb869d587a97f2f5af8d819aa47bbf207db68a6ecbbefb1e109ed0bfbbf3b54fba9e79de8fad9c3bcd3e74b8b92ccea3ff5c558c6cd72d78a711fc39df603bd4aa1439dd302258edd2204e52d7f435c6f552b612fbc321bea971195cd4d8bb033e2a779e239164d7eea6d8fd233b0b9b776246564cfcf44b31a83031a2413bf98a398c9f93da243cef9ce73d81bade8ad551fb0ffa75bc874c11d23ac9d7752f22a0f54c3870f3314a83e64332db810da1ebb288e10c4eb9be9ec037317b8f813e68160a887da3f5c0389510a0734b69ef275e19973b169d340610cf2112e9964cc0566b9b690c3feb36c8526491d3a563f0bead2abbcf0665e048aa3f929351b2f89876580633a403250ae3b5244c8c0e996bf888938dfc8920348d88e272e6eadc7c0387ca1dae228bd620ce3975d43b58758d9412d304a227245587065f58c4573ba2557f1d8333ba007709b1239d682f03405b22135757178fb701bbde81d2f8faaa7666c025d8a8bb426dc4b8e61aed79b3b3d3a9b01ee9142772d869677ede166e7a8be8ab84cdd6946b1478ce77ba307213971cfb24c86c344310f279e38d22254bf4caf83c02e715cb0550e615dc9f8dd2400fa749e3527493c15fb454c158e4c0603ae6e962b7890058ec7c10f0618ee274a15bca6ca9fe5bc5f9e7797c0950299912be9c58463c07d667d4bffe8aa590ae43db08512b40f3d265026bef2facdd508984e5f6d2ac7ef573397f14ed2e2ccdcbe5796e60ae64d173814906d1da5a5bfe8a2a4c5d6bb0b3315b878b4877d0c045f6e6cfa0dfc1ea4de7abe26f2b2d8c93299ed1d83f1b7853c756bfa346cd53b008fec169883983fe0f2405777dd85e17b2e4e8b23432c0dc4c386d67b6597184d0b4b95877362304638484cc0951400f66ee8391dd44417c58b3d46a8345a8049fcd70f7b5f4a6f912e2b18760947c74ef2b732b342878d7e7cc99902de87db36469555fbbfe76189f108d6ab31f4727fe4e22d075afaf6cc726ab17a5e1b4ab6c8f29a459da3c4266b5ad8ff55906a190f8b19a3bb92a50df49647c03d5d6106ec07e9300038d059a75b54ac31683ef8e5eee946e1c84d016ee1e7800a92c0a3823b62e0417fe86b191951f65abc0c38c1e0e8f1121a04b62a8a720790560f922804b1b7e7eaa497e1bede6e3d0dcf0312dbf221561958fa1e85a8f99e6fc82f919e78c17d1beda16cfef25fb5d00f7c32df9a51eac76000c988ffdf011564aa0e319764b16a5a7c728a470ff70772fb76c9ada26a0ac073fcbfa12501c2454b19e02d928e3939a40bfff76c002533b3849cdf8016728445131e5f1e292b7d3dc06bb3a3cfff6fabae0b7341694a8938c1d2497cd70b76c337c9a312e96c8f736d7625a535e1906eba53d199221ca60202a65be0f7e530aca10e61fa39c7601d65954e5ed4cab94345c6b89c7f8a0de5c61a7945e1564731b6715331d13263b2961a163382f7c4934d847033860e402f3aadb4f3e6cf47a97a2031401da4d2c8de8c80cdad71b97b4deb2075a02282f958ac6772354e67f097ca693778224b80892490015e7d697fb9107f75cea708178ffec93fb1d44e8493bad1d42c918e661219ea819e0200759037a5a585c0fe074fd407536fe58013f42612c41bfc66e16870d7a9c00ee93a3122b253fecbf5de3837641f4a1376af0f053463413c26c29f9a346318565276856b963da30ba6ab8c4c8ef6cfddc432328586d9d9829895835759bcde0851ae0c838a3927ea63fe5ba793fae94da61cab00fc05f3a265a2da1221bb2b66775ed7ba856b41011652d4984991e56249360ddfc997245ac1547a1c16382d42df383a8d1c852643b24895c422712e79c436fdfffece4ed1c50922d4f25296aaf6b204522086d188bee254f8303b60537ead1195ac5dd301286f0042dd68aa05a70e4beb779aa0b61a316f736b72c9ab7ed860a0908a078f4b8a53f2df0abf993f689de4b02b9138ca5047fb0bfc9ba3b92bff033e36fc9553260b008cef3d147c62d1d3944fd1eaff79bc5a922ec2190907bfda1b51c2c7fb867db1f8e13a37b5e3ae0165e93350b958a239ec1f2b78561cff854b975307b5b5dd23b040602a5a36bd79947ee04c7d0e5e30f9c4c79f7b4e6eada98bfc6c357cdf8939213423f1b21ba26cfc2b2756ea3eb992372db0ab8a7c37d8ae96bf3ed6be873c1891550ef741812032e1ae938326c399ee43a3061602dda006f1b6b620bebb6a5752bee77e8acf9921ebf4d4c8af7eb5e937c65697c0664c594e31a62377a25605051996c474ca322ce8e0e6ef8a7988be", 0x2000, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x158, 0x0, 0xfffffffffffffffd, [{{0x3, 0x0, 0x5, 0x6, 0x6, 0x4, {0x4, 0x7, 0x8000, 0x0, 0x8, 0x3, 0x10000, 0xfffffff9, 0x7f, 0x6000, 0x7, r6, r7, 0xd, 0xdf}}, {0x6, 0x6, 0xc, 0x0, 'cpuset.cpus\x00'}}, {{0x5, 0x2, 0x707, 0x9, 0xd, 0x1000, {0x3, 0x637a, 0x8000000000000000, 0xa2, 0x3, 0x8000000000000001, 0xe, 0x7d, 0x80, 0x1000, 0xff, r6, 0x0, 0x9, 0x6}}, {0x3, 0x7, 0x7, 0xe, 'user_id'}}]}, 0x0, 0x0, 0x0}) (async) quotactl_fd$Q_GETINFO(r0, 0xffffffff80000502, r6, &(0x7f0000000500)) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r9 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r9, 0x10e, 0xc, &(0x7f0000000040)={0x1, 0x0, 0x0, 0xffffffff}, 0x10) (async) write(r9, &(0x7f0000000000)="240000001a005f0214f9f407000904001f00000000000000000000000800040001000000", 0x24) (async) fcntl$addseals(r0, 0x409, 0x4) (async, rerun: 64) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) (async, rerun: 64) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) (async) r10 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r10, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) r11 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./gadget/ep1in-bulk\x00', 0x2, 0x24) write(r11, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) (async, rerun: 64) r12 = dup3(r8, r0, 0x0) (async, rerun: 64) r13 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r13, 0x4018620d, &(0x7f0000000300)) (async) ioctl$BINDER_WRITE_READ(r12, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) 21.004300164s ago: executing program 1 (id=1228): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010004000000000000006600002008000300", @ANYRES32=r2, @ANYBLOB="08002600940900000800b700cb000000"], 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc"], 0xfc}}, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_timeval(r8, 0x1, 0x14, &(0x7f0000000000)={0x0, 0xea60}, 0x10) recvmmsg(r8, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}, 0x8b}], 0x1, 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r9, 0xae60) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a28000000000a010200000000000000000200000908000240000000030900010073797a300000000098000000160a030000000000000000000200000a6c"], 0xe8}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$KVM_SET_LAPIC(r10, 0x4400ae8f, &(0x7f0000000440)={"db4c1421593cb4d3f8fe6094dc821bbbe06520701fc6de7b0349f34b0f8c556a9e9aff1355aab8d6da26d74608530f150f127f9e3f0a2f1fff0be9774c95d6c007c91903f78616596487bf50017c56b15385ab264cba5b168c62d971e67e6f3e73d60b5a8adbaaf2af8610c6a91c0a116f619adce4aa91d5a68faf8ee98693d32d8d8244381b5720ef596600e39491d216c22d0725904bab7d90fa8afb8fa04b707410aa300ef098609b4fa6dd77b1b7c321b1fc6356564ce3f90826be3a9a5be186ffc48eb13824e9dae77ed212a0f802074ff4f1725c4ad88cf5bbd36e3406bc59d96e82047631d8be9462ee7e54e5b2897c3fff38eabf67e1e160c2b5e18be06457844d89c9a606b7d25fbde713f4759da0bee1fabe3f71dcca63540f113a2b5edc4b327d1f9610377b97265d4aa875b4bc3c44bf8110d5df1beb1fe54794a0aa52dfc80df1caf7d812b4f1cdba1a6836b45ea2180d08439d411ce8e0755868cc839eaeac73e5d28f9f1990584038cf5fa6bee0c4095a27cc8c7b59519bf2a9bf1fedf54cc2dc6aea6c42c32de40c291e5f422f5c7792a08926af160fb379576dd81bac746232fb246817fc3248097914b75e83cc5eb518ce8fb643b34ca69c3b61f0d94e7db62dd480198d41e0862f1ec4429ab637569884a5ba446a0b09edfd986a2b3e15ee35bbd18610dad6271681ed240b0ffab9199b541013c0aadc36484da57511896c14776a41602aa1426edfbb828897d9c218b7936a0572840ebbc796e888a439b24e640324b511deb6ed0b2ce2f7567447826944b4f34101e492e8d20a2deda950e96e78f86d6d4c976f0c99041c94944309e6ce08d84a7c96677d570d9a57ec0506a4321d9e049b55be883ca3648c27772fc5dbaea5e6c2ded2ce72fb68989ae381fe1394cf6966ab04285d5ff8256bc2e85462b8d89aeeebd5432157c945b5dc1960d9282c6cc007fe029325d6078aef94d4954f956c71bcdf846f41392ebe0d3b289438d24ec4bc073617459a6b232445dd636a9f21140e14b162fd5ef1d626b0ff84884fd63d22cc1b05befb77ea937f3045cc15b125479b262c1e32fca75a5468423288c5776efee744b1fccb5e6d661d9d287cfa8582c96ea34a33c1bbc29c0035657da66a87150bbb885be5ee123e431fd793ea179a0fc77aaee66d874c0616cb32324826b36d0e27d14217ad1131cace3bae4ef82dfbc790e78de53a9bfbdb468bf0eb3ff134073b380858965de2d108862daf3fc6b49ad46f20832238aeaa5d010cf08e37938f0bb7bbeaa970c39ce9327a16fe07565708266ce9ef639bfa08538693b456228aa1c370d64ef9795b7cc208a2c528d381a042d149ed5c7f34ed26a7d5a4401b86434f054389e5dac7a4ee896e406d7b27240d925d478e0eb2202797832d3e2c74f4925ad58377b0d6ae9b97034f94"}) ioctl$KVM_SET_SREGS(r10, 0x4138ae84, &(0x7f0000000840)={{0xfec00000, 0x111e5001, 0x9, 0x6, 0xd, 0x2, 0x10, 0xc, 0x9, 0x7f, 0x2c, 0x8}, {0x8080000, 0x25000, 0xd, 0x3, 0x7f, 0x3, 0x6, 0x3, 0x40, 0x5, 0x0, 0x4}, {0x1, 0x41000, 0x4, 0x4, 0x0, 0x2, 0xc8, 0x5, 0x3, 0x5, 0x80, 0x8c}, {0x58000, 0x2, 0x8, 0x40, 0x80, 0x1, 0x6, 0x2, 0xb, 0x5, 0x5, 0x1}, {0x5000, 0x6000, 0xa, 0x10, 0xff, 0xed, 0x6, 0xb, 0x5, 0x1, 0x6, 0x4}, {0x60000, 0x8080000, 0x10, 0xd7, 0x2, 0x4, 0x84, 0x8, 0x3, 0xfa, 0x5f, 0xd}, {0x50000, 0x26000, 0xf, 0xc, 0x4, 0x5, 0x9, 0xff, 0x0, 0x7, 0x40, 0x6}, {0x40000, 0x9000, 0x0, 0x3e, 0x4, 0x2, 0xf, 0x7, 0x95, 0x0, 0x2, 0x6}, {0xf000, 0x3}, {0x1, 0x9}, 0x20000000, 0x0, 0xa000, 0x20001, 0x5, 0x2101, 0x0, [0x6, 0x2, 0x2040000001000, 0xffffffffffff5adc]}) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000440)={0x48, r3, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_FRAME={0x22, 0x33, @action={{{}, {}, @device_a, @device_a, @from_mac=@broadcast, {0x0, 0xff}}, @ext_ch_sw={0x4, 0x4, {{0x0, 0x0, 0x5}, @void}}}}, @NL80211_ATTR_CSA_C_OFFSETS_TX={0x6, 0xcd, [0x0]}]}, 0x48}, 0x1, 0x0, 0x0, 0xc0}, 0x0) 20.83397009s ago: executing program 1 (id=1229): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file7\x00', 0x1ac) renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file7/file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r1, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 20.722384399s ago: executing program 1 (id=1230): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000440)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = syz_open_dev$vcsu(&(0x7f0000000040), 0x401, 0x4000c0) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000080)={0x6, 0x8, 0x8, 0x3, 0x7fff}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='base=0', 0x6) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1fc, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x90}, 0x4000000) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="04010000020901010000000000000000010000015c0002001400018008000100ac14141d080002007f1e00010c000280050001002f000000060003400003000006000340000400000c00028005000100010000000c0002800500010000000000060003400966000006000340000000000800054000000008080003400000006c08000540000000157c0002000600034000020000060003400001000006000340000400002c000180140003000000000000000000000000000000000114000400fe8000000000000000000000000000072c00018014000300ff01000000000000000000000000000114000400000000000000000000000000000000000600034000dd1bb3"], 0x104}, 0x1, 0x0, 0x0, 0x4}, 0x80) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r6, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000003c0)=[@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x3, 0x0}}]}, &(0x7f0000000340)=0x10) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r6, 0x84, 0x78, &(0x7f0000000200)=r7, 0x4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={0x0, 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) r8 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) dup(r8) syz_kvm_setup_cpu$x86(r8, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040da0b29010001000000010902200001010080320904000002ffffff00070501020002"], 0x0) 20.403793737s ago: executing program 1 (id=1231): syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000100)={0x0, &(0x7f00000001c0)=[@code={0x1, 0x49, {"0f01ca2e646740c159368266bad004b0bdee66baa100ed640f017c9993660f38816da4470f019d0d000000f3430fc776100f01c3460f013a"}}], 0x49}) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f00000000c0)={0x2, 0x3, 0x0, 0x3, 0xc, 0x0, 0x700, 0x25dfdbfc, [@sadb_key={0x2, 0x9, 0x8, 0x0, 'S'}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x6}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @dev}}]}, 0x60}, 0x1, 0x7}, 0x800) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)={0xa8, 0x19, 0x1, 0x0, 0x25dfdbfb, {0x1d, 0xd601, 0x9}, [@nested={0x50, 0x12, 0x0, 0x1, [@nested={0x49, 0xf8, 0x0, 0x1, [@generic="78057c67001c274b77a33a15462348ca6f102294cd508cd48f01daa89988bfb72d95c4210c8dadd28149d2cd9ce63704d4c45a0c457b9150f39565b984a1b03e764e5f60b9"]}]}, @nested={0x44, 0x5, 0x0, 0x1, [@nested={0x40, 0xce, 0x0, 0x1, [@nested={0x3c, 0x13e, 0x0, 0x1, [@nested={0x38, 0xa0, 0x0, 0x1, [@nested={0x34, 0x61, 0x0, 0x1, [@nested={0x30, 0x9d, 0x0, 0x1, [@nested={0x2c, 0x63, 0x0, 0x1, [@typed={0x4, 0xa5}, @nested={0x10, 0x90, 0x0, 0x1, [@nested={0xc, 0x19, 0x0, 0x1, [@typed={0x8, 0x110, 0x0, 0x0, @fd=r1}]}]}, @typed={0xc, 0x11c, 0x0, 0x0, @u64=0x9}, @typed={0x8, 0x12e, 0x0, 0x0, @uid}]}]}]}]}]}]}]}]}, 0xa8}, 0x1, 0x0, 0x0, 0x5}, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') ioctl$sock_inet6_udp_SIOCINQ(r4, 0xc02063a1, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f00000000c0)={0x1fd, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) syz_usb_connect$uac3(0x0, 0xa0, &(0x7f0000000c00)=ANY=[@ANYBLOB="12011003000000403512100040000102030109028e000301002040080b0201012130c60904000000010130000a2401042a00ff0f0000132403050001020602028000000700100002000d24090201"], &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0}) 20.265045415s ago: executing program 32 (id=1231): syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000100)={0x0, &(0x7f00000001c0)=[@code={0x1, 0x49, {"0f01ca2e646740c159368266bad004b0bdee66baa100ed640f017c9993660f38816da4470f019d0d000000f3430fc776100f01c3460f013a"}}], 0x49}) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f00000000c0)={0x2, 0x3, 0x0, 0x3, 0xc, 0x0, 0x700, 0x25dfdbfc, [@sadb_key={0x2, 0x9, 0x8, 0x0, 'S'}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x6}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @dev}}]}, 0x60}, 0x1, 0x7}, 0x800) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)={0xa8, 0x19, 0x1, 0x0, 0x25dfdbfb, {0x1d, 0xd601, 0x9}, [@nested={0x50, 0x12, 0x0, 0x1, [@nested={0x49, 0xf8, 0x0, 0x1, [@generic="78057c67001c274b77a33a15462348ca6f102294cd508cd48f01daa89988bfb72d95c4210c8dadd28149d2cd9ce63704d4c45a0c457b9150f39565b984a1b03e764e5f60b9"]}]}, @nested={0x44, 0x5, 0x0, 0x1, [@nested={0x40, 0xce, 0x0, 0x1, [@nested={0x3c, 0x13e, 0x0, 0x1, [@nested={0x38, 0xa0, 0x0, 0x1, [@nested={0x34, 0x61, 0x0, 0x1, [@nested={0x30, 0x9d, 0x0, 0x1, [@nested={0x2c, 0x63, 0x0, 0x1, [@typed={0x4, 0xa5}, @nested={0x10, 0x90, 0x0, 0x1, [@nested={0xc, 0x19, 0x0, 0x1, [@typed={0x8, 0x110, 0x0, 0x0, @fd=r1}]}]}, @typed={0xc, 0x11c, 0x0, 0x0, @u64=0x9}, @typed={0x8, 0x12e, 0x0, 0x0, @uid}]}]}]}]}]}]}]}]}, 0xa8}, 0x1, 0x0, 0x0, 0x5}, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') ioctl$sock_inet6_udp_SIOCINQ(r4, 0xc02063a1, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f00000000c0)={0x1fd, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) syz_usb_connect$uac3(0x0, 0xa0, &(0x7f0000000c00)=ANY=[@ANYBLOB="12011003000000403512100040000102030109028e000301002040080b0201012130c60904000000010130000a2401042a00ff0f0000132403050001020602028000000700100002000d24090201"], &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0}) 19.000500649s ago: executing program 0 (id=1239): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000440)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = syz_open_dev$vcsu(&(0x7f0000000040), 0x401, 0x4000c0) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000080)={0x6, 0x8, 0x8, 0x3, 0x7fff}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='base=0', 0x6) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1fc, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x90}, 0x4000000) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="04010000020901010000000000000000010000015c0002001400018008000100ac14141d080002007f1e00010c000280050001002f000000060003400003000006000340000400000c00028005000100010000000c0002800500010000000000060003400966000006000340000000000800054000000008080003400000006c08000540000000157c0002000600034000020000060003400001000006000340000400002c000180140003000000000000000000000000000000000114000400fe8000000000000000000000000000072c00018014000300ff01000000000000000000000000000114000400000000000000000000000000000000000600034000dd1bb3"], 0x104}, 0x1, 0x0, 0x0, 0x4}, 0x80) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r6, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000003c0)=[@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x3, 0x0}}]}, &(0x7f0000000340)=0x10) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r6, 0x84, 0x78, &(0x7f0000000200)=r7, 0x4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, 0x0) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={0x0, 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) r8 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) dup(r8) syz_kvm_setup_cpu$x86(r8, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040da0b29010001000000010902200001010080320904000002ffffff00070501020002"], 0x0) 17.334351233s ago: executing program 0 (id=1244): r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$VIDIOC_S_STD(r0, 0x40085618, &(0x7f00000000c0)=0xb000) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) r4 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_S_INPUT(r4, 0xc0045627, &(0x7f0000000040)=0x8) 17.115398521s ago: executing program 0 (id=1245): ioctl$VIDIOC_ENUM_FREQ_BANDS(0xffffffffffffffff, 0xc0405665, &(0x7f0000000000)={0x8b4, 0x4, 0x9, 0x200, 0x0, 0x181, 0x8}) r0 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000040), 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000080)={[{0x2d, 'hugetlb'}, {0x6, 'cpuacct'}]}, 0x12) rmdir(&(0x7f00000000c0)='./file0\x00') rmdir(&(0x7f0000000100)='./file0\x00') openat$iommufd(0xffffffffffffff9c, &(0x7f0000000140), 0x101000, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x34, 0x2, 0x3, 0x101, 0x0, 0x0, {0x5, 0x0, 0x4}, [@NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0x6}, @NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x33}, @NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x34}, @NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0x24}]}, 0x34}, 0x1, 0x0, 0x0, 0x4008050}, 0x20000001) write$cgroup_subtree(r0, &(0x7f0000000280)={[{0x2b, 'cpuset'}, {0x2b, 'rdma'}, {0x2d, 'rlimit'}, {0x2d, 'perf_event'}, {0x2b, 'perf_event'}, {0x2d, 'devices'}, {0x2b, 'rdma'}]}, 0x3d) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000300)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000340)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000380)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000003c0)=0x0) sendmsg$NFC_CMD_LLC_SDREQ(r3, &(0x7f0000000640)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000600)={&(0x7f0000000400)={0x200, 0x0, 0x0, 0x70bd26, 0x25dfdbff, {}, [@NFC_ATTR_LLC_SDP={0x48, 0x13, 0x0, 0x1, [{0x44, 0x0, 0x0, 0x1, [{0xe, 0x1, 'perf_event'}, {0x4}, {0x1b, 0x1, 'cgroup.subtree_control\x00'}, {0x5, 0x1, '\x00'}, {0x7, 0x1, '[*@'}]}]}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r4}, @NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r5}, @NFC_ATTR_LLC_SDP={0x88, 0x13, 0x0, 0x1, [{0x6c, 0x0, 0x0, 0x1, [{0xb, 0x1, 'cpuacct'}, {0xa, 0x1, 'cpuset'}, {0xe, 0x1, 'perf_event'}, {0xb, 0x1, 'devices'}, {0xb, 0x1, '!+)[[&}'}, {0x9, 0x1, '^(+\\$'}, {0xe, 0x1, 'perf_event'}, {0xa, 0x1, 'cpuset'}]}, {0x18, 0x0, 0x0, 0x1, [{0xf, 0x1, '/dev/iommu\x00'}, {0x4}]}]}, @NFC_ATTR_LLC_SDP={0xf4, 0x13, 0x0, 0x1, [{0x30, 0x0, 0x0, 0x1, [{0xb, 0x1, 'hugetlb'}, {0x7, 0x1, '.\\,'}, {0x6, 0x1, '!!'}, {0x5, 0x1, '$'}, {0x8, 0x1, '{[$@'}]}, {0x28, 0x0, 0x0, 0x1, [{0x5, 0x1, ','}, {0xb, 0x1, 'cpuacct'}, {0xe, 0x1, ':.\v[}*&}&@'}]}, {0x98, 0x0, 0x0, 0x1, [{0xf, 0x1, '/dev/iommu\x00'}, {0x1b, 0x1, 'cgroup.subtree_control\x00'}, {0x7, 0x1, '^}-'}, {0x1b, 0x1, 'cgroup.subtree_control\x00'}, {0xb, 0x1, 'cpuacct'}, {0x5, 0x1, '%'}, {0x14, 0x1, '-{[[^\x00(\\\\-!$\x05$[!'}, {0x4}, {0xb, 0x1, 'devices'}, {0xc, 0x1, '&!*/).@}'}]}]}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r6}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r7}]}, 0x200}, 0x1, 0x0, 0x0, 0x41}, 0x4084) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000680)={{0x1, 0x1, 0x18, r2, {0xffffffffffffffff, 0xee00}}, './file0\x00'}) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000700), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000740)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_STATION(r8, &(0x7f0000000840)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x7c, r9, 0x4, 0x70bd26, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x4a6, 0x78}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x79c}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x200}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x3f8}, @NL80211_ATTR_STA_VLAN={0x8, 0x14, r10}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x70d}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x5}, @NL80211_ATTR_STA_TX_POWER={0x6, 0x114, 0x1ae}, @NL80211_ATTR_STA_SUPPORTED_RATES={0x9, 0x13, [{0x6}, {0x16, 0x1}, {0x6c, 0x1}, {0x6}, {0x30, 0x1}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x40}, 0x8000) r11 = syz_genetlink_get_family_id$tipc(&(0x7f00000008c0), r8) sendmsg$TIPC_CMD_RESET_LINK_STATS(r8, &(0x7f0000000980)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x28, r11, 0x800, 0x70bd25, 0x25dfdbfb, {{}, {}, {0xc, 0x14, 'syz0\x00'}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x8001) r12 = openat$cgroup_type(r8, &(0x7f00000009c0), 0x2, 0x0) r13 = openat$null(0xffffffffffffff9c, &(0x7f0000000a00), 0x290000, 0x0) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r13, &(0x7f0000000b00)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x30015038}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x1c, r11, 0x200, 0x70bd25, 0x25dfdbfc, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8040}, 0x0) r14 = syz_genetlink_get_family_id$tipc(&(0x7f0000000b80), r13) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r13, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x28, r14, 0x100, 0x70bd2c, 0x25dfdbfb, {{}, {}, {0xc, 0x14, 'syz0\x00'}}, ["", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4000}, 0x800) ioctl$MEDIA_REQUEST_IOC_QUEUE(r8, 0x7c80, 0x0) ioctl$AUTOFS_IOC_FAIL(r12, 0x9361, 0x80000001) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(r8, &(0x7f0000000e80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000e40)={&(0x7f0000000dc0)={0x68, 0x0, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0xc, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}]}, @MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0xa}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}]}, @MPTCP_PM_ATTR_ADDR_REMOTE={0xc, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x14}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xf7}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x5f}]}, 0x68}, 0x1, 0x0, 0x0, 0x4040008}, 0x20004804) 17.065333782s ago: executing program 0 (id=1246): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) listen(r0, 0x5) connect$inet(r1, &(0x7f0000000010)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000020), 0x4) setsockopt$inet_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000030)=@gcm_128={{0x303}}, 0x28) ioctl$vim2m_VIDIOC_S_CTRL(0xffffffffffffffff, 0xc008561c, 0x0) mknodat(0xffffffffffffff9c, 0x0, 0x81c0, 0x7fffffff) write$binfmt_register(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) sendmsg$inet(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000440)="68c9", 0xffffff1b}], 0x1, &(0x7f0000000180)=[@ip_ttl={{0x14, 0x11a, 0x1, 0x15}}, @ip_retopts={{0x34, 0x0, 0x7, {[@ra={0x94, 0x4, 0x1}, @generic={0x86, 0x4, 'Z '}, @timestamp_prespec={0x44, 0x1c, 0x7b, 0x3, 0xf, [{@multicast2, 0x7ff}, {@broadcast, 0x4}, {@broadcast, 0x1}]}]}}}], 0x20000}, 0x0) 16.964893069s ago: executing program 0 (id=1247): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$video(&(0x7f0000000080), 0x7, 0x40000) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r0, 0xc034564b, &(0x7f0000000000)={0x4, 0x34325258, 0x1280, 0x168, 0x1, @stepwise={{0x80000001, 0x8}, {0x1, 0x6}, {0x7, 0xfd34}}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sec\x00', &(0x7f0000000140)='securityfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000000e0)='./sec/tomoyo/profile\x00', 0x1, 0x0) write(r1, &(0x7f0000000040)="3c5c783ecd2d036a2762bb626c65640a", 0x10) preadv(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x3) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) syz_clone(0x20802600, &(0x7f0000000380), 0x0, 0x0, 0x0, 0x0) r2 = syz_clone(0x0, 0x0, 0xffffffffffffff59, 0x0, 0x0, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) ioctl$F2FS_IOC_ABORT_ATOMIC_WRITE(r0, 0xf505, 0x0) prctl$PR_SET_PTRACER(0x59616d61, r3) process_vm_writev(r2, &(0x7f0000002180)=[{&(0x7f0000000080)=""/203, 0xcb}], 0x1, &(0x7f0000002540)=[{&(0x7f00000021c0)=""/233, 0xe9}], 0x1, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xee776000) 16.009605397s ago: executing program 0 (id=1249): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000300)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r2, 0x84, 0x1c, 0x0, &(0x7f0000000480)) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000000)='batadv_slave_1\x00', 0x10) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200047bd, &(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10) r3 = socket$kcm(0x10, 0x2, 0x4) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) splice(r4, 0x0, r4, 0x0, 0x1, 0x0) r5 = eventfd(0x5) ioctl$VHOST_SET_LOG_FD(r4, 0x4004af07, &(0x7f00000000c0)=r5) sendmsg$kcm(r3, &(0x7f0000000240)={0x0, 0xf0ffffff, &(0x7f0000000140)=[{&(0x7f0000000280)="89000000120081ae08060cdc030000007f03e3f700004e236ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec0012100001400d0c0c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x0) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1, 0xa, 0x158}, 0x0, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043ef50d"], 0xf8) 7.367873294s ago: executing program 4 (id=1274): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/rnullb0/zone_nr_conv\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='1\n', 0x2) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000001b80)={0x0, @in6={{0xa, 0x4e24, 0xbe, @remote, 0xc1}}, 0x6, 0x7, 0x7, 0x8, 0x11, 0xd758, 0x9}, 0x9c) ioctl$USBDEVFS_FREE_STREAMS(r0, 0x8008551d, &(0x7f0000000040)={0x43ab, 0x5, [{0x6, 0x1}, {0x7}, {0xb}, {0xa, 0x1}, {0xe, 0x1}]}) 7.282268823s ago: executing program 4 (id=1275): userfaultfd(0x80001) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000001040)=ANY=[@ANYBLOB="1201000040154220a9055015bbe4010203010902120001000000000904"], 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x298}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000040)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00005cf000/0x4000)=nil, 0x400000, 0x2, 0x2}) ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f00000000c0)={{&(0x7f000067f000/0x1000)=nil, 0x1000}, 0x1}) syz_usb_control_io$uac3(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) ioctl$COMEDI_INSN(0xffffffffffffffff, 0x8028640c, &(0x7f0000000000)={0x4000000, 0x92, 0x0, 0x0, 0x80000000}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, &(0x7f0000000800)={0x14, &(0x7f00000006c0)={0x20, 0xd, 0xdb, {0xdb, 0x22, "417f11d16a290d7a897fbb6cb7cc77f7fa153648fe8960b76a7d6837ed4569af65b012e1147722a3bbad46953f6c36d855c18f9e81388f46cfcf7ca2d2af0c546072450dc574b026dd59385a5310ab5ee27a77e6b5252177441bbbfc686fa6f52f6445e56a9478100199ff106700e375a9791946173e487bb7fb9b44c59512b76f022e047bba642fdec3342f27a10501061479a9a566aa7f362adc965daa6b1ac35af42800c3ccb1838c703567d20019853c74a1fafcd08be0f2c25226fc119ced8cdb5185d4a36b0585e72fe9d408c72c07fa125a9150038e"}}, &(0x7f00000007c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x415}}}, &(0x7f00000009c0)={0x2c, &(0x7f0000000840)={0x0, 0x13, 0x54, "250608449970d15e31160d8ff1350acb5f246f345783f53a2cf743577035ddb62cf0013322b37579997242abcdf9d86987e357e5b462fa190bd0b14510eedd29999a40e90795dccaeacd209c14b6b6fda087f4e0"}, &(0x7f00000008c0)={0x0, 0xa, 0x1, 0xfe}, &(0x7f0000000900)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000000940), &(0x7f0000000980)={0x40, 0x5, 0x1, "be"}}) 6.945994116s ago: executing program 3 (id=1278): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000440)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = syz_open_dev$vcsu(&(0x7f0000000040), 0x401, 0x4000c0) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000080)={0x6, 0x8, 0x8, 0x3, 0x7fff}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='base=0', 0x6) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1fc, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x90}, 0x4000000) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="04010000020901010000000000000000010000015c0002001400018008000100ac14141d080002007f1e00010c000280050001002f000000060003400003000006000340000400000c00028005000100010000000c0002800500010000000000060003400966000006000340000000000800054000000008080003400000006c08000540000000157c0002000600034000020000060003400001000006000340000400002c000180140003000000000000000000000000000000000114000400fe8000000000000000000000000000072c00018014000300ff01000000000000000000000000000114000400000000000000000000000000000000000600034000dd1bb3"], 0x104}, 0x1, 0x0, 0x0, 0x4}, 0x80) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r6, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000003c0)=[@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x3, 0x0}}]}, &(0x7f0000000340)=0x10) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r6, 0x84, 0x78, &(0x7f0000000200)=r7, 0x4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, 0x0, 0x4000000) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) r8 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) dup(r8) syz_kvm_setup_cpu$x86(r8, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040da0b29010001000000010902200001010080320904000002ffffff00070501020002"], 0x0) 5.588709521s ago: executing program 2 (id=1279): r0 = syz_usb_connect(0x5, 0x58, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x8e, 0x3a, 0xc6, 0x20, 0x694, 0x1, 0x7813, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x46, 0x2, 0xe, 0x6, 0x10, 0x3, "", [{{0x9, 0x4, 0x39, 0xd8, 0x1, 0x1a, 0xda, 0xa8, 0x8, [], [{{0x9, 0x5, 0x8, 0x10, 0x20, 0x7, 0x9, 0x80}}]}}, {{0x9, 0x4, 0xe4, 0x5, 0x3, 0xb9, 0x56, 0xda, 0x2, [], [{{0x9, 0x5, 0x8, 0x0, 0x400, 0x1, 0x12, 0xfc}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x7, 0x3, 0x9a, [@generic={0x7, 0x5, "d15b89f26d"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x40, 0x7a, 0xa, 0x84}}]}}]}}]}}, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi4\x00', 0x8200, 0x0) ioctl$COMEDI_INSN(r1, 0x8028640c, &(0x7f0000000080)={0xc000002, 0x0, 0x0, 0x0, 0x4080003}) syz_usb_control_io$hid(r0, &(0x7f0000000bc0)={0x24, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0003040000000403"], 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000011c0)={0x24, 0x0, &(0x7f0000001040)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001600)={0x24, 0x0, &(0x7f0000001540)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x44a}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000500)={0x18, &(0x7f0000000300)=ANY=[@ANYBLOB='@\b\b'], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000002280)={0x84, &(0x7f0000001e00)={0x20, 0xd, 0x4, "348b35e5"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) writev(r2, &(0x7f0000000540)=[{0x0}, {&(0x7f00000000c0)="2abcd13ec37d94689c9dc5cae099", 0xe}, {0x0, 0xe00}, {0x0}], 0x4) 5.541162239s ago: executing program 3 (id=1280): r0 = openat$nci(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./nfsd\x00', &(0x7f0000000280)='nfsd\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./nfsd/threads\x00', 0x1, 0x0) write(r2, &(0x7f0000000100)="a542", 0x2) r3 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) ioctl$VIDIOC_QUERYMENU(r3, 0xc008561c, &(0x7f0000000000)={0x9f0902, 0xfffffff2, @name="82bf06255c32514ef266824307509e39f5e892343710c37e48a72f12e53542fb"}) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x2, 0x2000007, 0x10, 0xffffffffffffffff, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="c4000000190001000000000000004000e00000020000000000000000000000000000000000000000000000000000000000000000000000000a00000087000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000053260e130000000000000000000000fbfffffffff5ffff00000000001b00000000000000000000000000000000000200000000000000b912"], 0xc4}, 0x1, 0x0, 0x0, 0x40100}, 0x2c000010) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r2, 0xc018937d, &(0x7f0000000040)={{0x1, 0x1, 0x18, r3, {0x6}}, './nfsd\x00'}) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {0x0, 0x3, 0x200000000000000}}}, 0xb8}}, 0x2c000010) r7 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r4) sendmsg$NFC_CMD_DEV_UP(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x1c, r7, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}]}, 0x1c}}, 0x0) read$nci(r0, 0x0, 0x0) 5.201801696s ago: executing program 4 (id=1281): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r0) sendmsg$NFC_CMD_ACTIVATE_TARGET(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000200)=ANY=[@ANYRESOCT=r1, @ANYRESHEX=r0, @ANYBLOB="010023010000340200001c000000080076ec50696e498cf60c3fd20100", @ANYRES32=0x0, @ANYBLOB="0800040000000000"], 0x24}}, 0x1400c011) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x88010820}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r2, 0x400, 0x70bd2d, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_PHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20020000) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, 0x0, 0x225834, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) epoll_pwait(r3, &(0x7f0000000140)=[{}], 0x1, 0x2d516fb6, 0x0, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r5, &(0x7f0000000100)={0x20000014}) ppoll(&(0x7f0000000080)=[{r3, 0x401}], 0x1, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_emit_vhci(&(0x7f0000000840)=ANY=[@ANYBLOB="04050400c900", @ANYRES16], 0x7) 5.027835963s ago: executing program 2 (id=1282): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r0 = userfaultfd(0x1) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) (fail_nth: 4) 4.842613348s ago: executing program 2 (id=1283): sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={0x0}, 0x1, 0x0, 0x0, 0x44410}, 0x4004054) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) sendmsg$IEEE802154_LIST_PHY(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x404c857}, 0x20060000) (async) sendmsg$IEEE802154_LIST_PHY(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x404c857}, 0x20060000) socket$inet6(0xa, 0x2, 0x0) (async) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_LIST_DEV(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x14, 0x0, 0x20, 0x70bd27, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4000800}, 0x4) r2 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000100), 0xffffffffffffffff) (async) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000100), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'wpan3\x00', 0x0}) sendmsg$NL802154_CMD_GET_INTERFACE(r3, &(0x7f0000000400)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000003c0)={&(0x7f00000002c0)={0x38, r4, 0x400, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x10) (async) sendmsg$NL802154_CMD_GET_INTERFACE(r3, &(0x7f0000000400)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000003c0)={&(0x7f00000002c0)={0x38, r4, 0x400, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x10) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x2000000035, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x5, 0xf2, 0xd, 0x7fffffffffffe, 0xcd3, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.380856785s ago: executing program 2 (id=1284): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffd) mprotect(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x8) write(r2, &(0x7f0000000280)='0', 0x1) r3 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x200, 0x0) ioctl$SNDCTL_DSP_SETFMT(r3, 0xc0045005, &(0x7f0000000640)=0x10) mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x8012, r3, 0x0) ioctl$int_out(r3, 0x2, &(0x7f0000000040)) socket$packet(0x11, 0x2, 0x300) unshare(0x42000000) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002840)={0x24, 0x26, 0x109, 0x870bd22, 0xfffffff8, {0x2}, [@nested={0x8, 0x59, 0x0, 0x1, [@nested={0x4, 0x14c}]}, @typed={0x8, 0x3, 0x0, 0x0, @binary='G\x00\x00\x00'}]}, 0x24}, 0x1, 0x0, 0x0, 0x1000c957}, 0x600c800) 2.292304826s ago: executing program 4 (id=1285): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000000)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000200)={0x2, 0x0, {&(0x7f0000000080)=""/23, 0x17, 0x0, 0x1, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f0000001b80)={0x2, 0x0, {&(0x7f0000000b00)=""/4096, 0x1000, 0x0, 0x1, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f0000000500)={0x2, 0x0, {&(0x7f0000001c00)=""/158, 0x9e, 0x0, 0x1, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f0000000800)={0x2, 0x0, {&(0x7f0000000700)=""/82, 0x52, 0x0, 0x1, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f0000000180)={0x2, 0x0, {&(0x7f0000000280)=""/184, 0x2562bac182d8b35a, 0x0, 0x2, 0x3}}, 0x48) ioctl$VHOST_SET_LOG_BASE(r0, 0x4008af04, &(0x7f0000000380)=&(0x7f00000000c0)) r1 = syz_usb_connect$uac3(0x3, 0x9c, &(0x7f0000000100)=ANY=[@ANYBLOB="12010003000000403512100040000102030109028a000301046008080b0001012430010904000000010130000a2401f5260005000000132403050004030306070000000400010004000924050602"], &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) setns(0xc9, 0x0) r2 = socket(0x21, 0x3, 0x87) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'ip6gre0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000000)={@dev={0xfe, 0x80, '\x00', 0x3a}, 0x40, r3}) ioctl$sock_inet6_tcp_SIOCINQ(r2, 0x8936, &(0x7f0000000000)) syz_usb_control_io(r1, &(0x7f0000000300)={0x2c, &(0x7f0000000000)={0x0, 0xd, 0x1e, {0x1e, 0x31, "d3af9befa1b443fd63d143e7351bc03173ceeef648d70136f49d0eaf"}}, &(0x7f00000001c0)={0x0, 0x3, 0x2, @string={0x2}}, &(0x7f0000000240)={0x0, 0xf, 0x12, {0x5, 0xf, 0x12, 0x2, [@ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x4, 0xf0, 0x2, 0x3}]}}, 0x0, &(0x7f00000002c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x6, 0x18, 0x8, 0x22, 0x9, 0x7}}}, &(0x7f0000000800)={0xc0, &(0x7f0000000340)={0x20, 0xc}, 0x0, 0x0, &(0x7f00000004c0)={0x20, 0x0, 0x4, {0x0, 0x1}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x6}, 0x0, 0x0}) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000d8ca8d40d10521200029001000010902120001050000000904"], 0x0) 2.291858899s ago: executing program 3 (id=1286): r0 = socket(0x10, 0x3, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0x5, &(0x7f00000000c0)=@req={0x6e6, 0x7ff, 0x1ff, 0x80}, 0xffffffffffffff11) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) write(r1, &(0x7f0000000000)='7', 0x1) write$USERIO_CMD_SEND_INTERRUPT(r1, &(0x7f0000000040)={0x2, 0x3}, 0x2) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="1400000041000102ffffffff43e0ad30a0fe2f00"], 0x14}}, 0x40044c4) syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), r0) 1.828310355s ago: executing program 2 (id=1287): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r0) sendmsg$NFC_CMD_ACTIVATE_TARGET(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000200)=ANY=[@ANYRESOCT=r1, @ANYRESHEX=r0, @ANYBLOB="010023010000340200001c000000080076ec50696e498cf60c3fd20100", @ANYRES32=0x0, @ANYBLOB="0800040000000000"], 0x24}}, 0x1400c011) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x88010820}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r2, 0x400, 0x70bd2d, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_PHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20020000) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, 0x0, 0x225834, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$igmp6(0xa, 0x3, 0x2) r3 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) epoll_pwait(r3, &(0x7f0000000140)=[{}], 0x1, 0x2d516fb6, 0x0, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r5, &(0x7f0000000100)={0x20000014}) ppoll(&(0x7f0000000080)=[{r3, 0x401}], 0x1, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_80211_inject_frame(0x0, 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_vhci(&(0x7f0000000840)=ANY=[@ANYBLOB="04050400c900", @ANYRES16=r6], 0x7) 1.729089432s ago: executing program 3 (id=1288): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x19) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000002c0)={0x54, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) 1.502733238s ago: executing program 3 (id=1289): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000440)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = syz_open_dev$vcsu(&(0x7f0000000040), 0x401, 0x4000c0) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000080)={0x6, 0x8, 0x8, 0x3, 0x7fff}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='base=0', 0x6) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1fc, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x90}, 0x4000000) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="04010000020901010000000000000000010000015c0002001400018008000100ac14141d080002007f1e00010c000280050001002f000000060003400003000006000340000400000c00028005000100010000000c0002800500010000000000060003400966000006000340000000000800054000000008080003400000006c08000540000000157c0002000600034000020000060003400001000006000340000400002c000180140003000000000000000000000000000000000114000400fe8000000000000000000000000000072c00018014000300ff01000000000000000000000000000114000400000000000000000000000000000000000600034000dd1bb3"], 0x104}, 0x1, 0x0, 0x0, 0x4}, 0x80) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r6, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000003c0)=[@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x3, 0x0}}]}, &(0x7f0000000340)=0x10) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r6, 0x84, 0x78, &(0x7f0000000200)=r7, 0x4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, 0x0, 0x4000000) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) r8 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) dup(r8) syz_kvm_setup_cpu$x86(r8, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040da0b29010001000000010902200001010080320904000002ffffff00070501020002"], 0x0) 701.36589ms ago: executing program 33 (id=1249): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000300)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r2, 0x84, 0x1c, 0x0, &(0x7f0000000480)) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000000)='batadv_slave_1\x00', 0x10) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200047bd, &(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10) r3 = socket$kcm(0x10, 0x2, 0x4) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) splice(r4, 0x0, r4, 0x0, 0x1, 0x0) r5 = eventfd(0x5) ioctl$VHOST_SET_LOG_FD(r4, 0x4004af07, &(0x7f00000000c0)=r5) sendmsg$kcm(r3, &(0x7f0000000240)={0x0, 0xf0ffffff, &(0x7f0000000140)=[{&(0x7f0000000280)="89000000120081ae08060cdc030000007f03e3f700004e236ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec0012100001400d0c0c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x0) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1, 0xa, 0x158}, 0x0, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043ef50d"], 0xf8) 678.682232ms ago: executing program 4 (id=1291): r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x140, 0x0) r1 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r1) 276.903777ms ago: executing program 2 (id=1292): r0 = creat(&(0x7f00000003c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) r1 = fanotify_init(0xf00, 0x0) fanotify_mark(r1, 0x105, 0x40009975, r0, 0x0) creat(&(0x7f00000006c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x6b) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r3 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r3, 0x403c6f2b, &(0x7f0000001e40)={0x4, {"0dbad96fff01000008ff002084000100", "3dfab043e15fad27a639f105b5e9f977", "a7c947420000000000000000ff4a70f3"}, 0x4000c, 0x5}) preadv(r3, &(0x7f0000000480)=[{&(0x7f0000000100)=""/15, 0xf}], 0x1, 0x1, 0xaadd) ioctl$DVB_DEMUX_DMX_SET_FILTER(r3, 0x403c6f2b, &(0x7f0000000080)={0x6, {"7fb13911afb5ea7f027063aa876dd358", "cfe484e50900", "d9ca451d96249a1dee77476cc87f7d0a"}, 0x6}) openat$dir(0xffffffffffffff9c, &(0x7f0000000800)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x20000, 0x4a40c5a98b373c73) 270.762126ms ago: executing program 4 (id=1293): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r0) sendmsg$NFC_CMD_ACTIVATE_TARGET(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000200)=ANY=[@ANYRESOCT=r1, @ANYRESHEX=r0, @ANYBLOB="010023010000340200001c000000080076ec50696e498cf60c3fd20100", @ANYRES32=0x0, @ANYBLOB="0800040000000000"], 0x24}}, 0x1400c011) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x88010820}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r2, 0x400, 0x70bd2d, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_PHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20020000) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, 0x0, 0x225834, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) socket$igmp6(0xa, 0x3, 0x2) r3 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) epoll_pwait(r3, &(0x7f0000000140)=[{}], 0x1, 0x2d516fb6, 0x0, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r5, &(0x7f0000000100)={0x20000014}) ppoll(&(0x7f0000000080)=[{r3, 0x401}], 0x1, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_emit_vhci(&(0x7f0000000840)=ANY=[@ANYBLOB="04050400c900", @ANYRES16], 0x7) 0s ago: executing program 3 (id=1294): r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x140, 0x0) r1 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r1) (fail_nth: 1) kernel console output (not intermixed with test programs): 986'. [ 382.183474][ T8854] genirq: Flags mismatch irq 7. 00200080 (ttyS3) vs. 00200000 (das16m1) [ 382.210946][ T8832] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 382.230539][ T5764] usb 4-1: new high-speed USB device number 105 using dummy_hcd [ 382.383727][ T5764] usb 4-1: unable to get BOS descriptor or descriptor too short [ 382.383779][ T5764] usb 4-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 382.384911][ T5764] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 382.384935][ T5764] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 382.390548][ T5764] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 382.390621][ T5764] usb 4-1: Product: syz [ 382.390665][ T5764] usb 4-1: Manufacturer: syz [ 382.390707][ T5764] usb 4-1: SerialNumber: syz [ 382.455275][ T5764] usb 4-1: selecting invalid altsetting 1 [ 382.456056][ T5764] usb 4-1: unit 6 not found! [ 382.527164][ T5764] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 382.581431][ T5860] udevd[5860]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 382.630881][ T5764] usb 4-1: USB disconnect, device number 105 [ 382.938177][ T6227] gspca_ov534_9: reg_w failed -71 [ 383.240587][ T6227] gspca_ov534_9: Unknown sensor 0000 [ 383.240677][ T6227] ov534_9 1-1:0.0: probe with driver ov534_9 failed with error -22 [ 383.243616][ T6227] usb 1-1: USB disconnect, device number 110 [ 383.273728][ T989] usb 3-1: new high-speed USB device number 107 using dummy_hcd [ 383.421454][ T989] usb 3-1: New USB device found, idVendor=0bda, idProduct=0129, bcdDevice= 1.00 [ 383.422562][ T989] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 383.422614][ T989] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 383.422658][ T989] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 383.481725][ T30] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 383.629734][ T989] rtsx_usb 3-1:1.0: probe with driver rtsx_usb failed with error -71 [ 383.631267][ T30] usb 4-1: Using ep0 maxpacket: 16 [ 383.633414][ T30] usb 4-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.00 [ 383.636228][ T30] usb 4-1: config 0 interface 0 altsetting 3 endpoint 0x81 has invalid wMaxPacketSize 0 [ 383.636256][ T30] usb 4-1: config 0 interface 0 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 383.636327][ T30] usb 4-1: config 0 interface 0 has no altsetting 0 [ 383.636390][ T30] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 383.706022][ T30] usb 4-1: config 0 descriptor?? [ 383.706294][ T989] usb 3-1: USB disconnect, device number 107 [ 383.827094][ T8875] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 383.841394][ T8875] befs: (nullb0): invalid magic header [ 383.856900][ T8875] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 384.114670][ T30] elan 0003:04F3:074D.0026: failed to start in urb: -90 [ 384.117916][ T30] input: HID 04f3:074d as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:04F3:074D.0026/input/input42 [ 384.148007][ T30] elan 0003:04F3:074D.0026: input,hidraw0: USB HID v0.00 Joystick [HID 04f3:074d] on usb-dummy_hcd.3-1/input0 [ 384.298273][ T8878] netlink: 1688 bytes leftover after parsing attributes in process `syz.1.995'. [ 384.340042][ T8869] pimreg: entered allmulticast mode [ 384.428944][ T8883] FAULT_INJECTION: forcing a failure. [ 384.428944][ T8883] name fail_futex, interval 1, probability 0, space 0, times 1 [ 384.428983][ T8883] CPU: 1 UID: 0 PID: 8883 Comm: syz.2.997 Tainted: G L syzkaller #0 PREEMPT(full) [ 384.429020][ T8883] Tainted: [L]=SOFTLOCKUP [ 384.429030][ T8883] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 384.429045][ T8883] Call Trace: [ 384.429054][ T8883] [ 384.429065][ T8883] dump_stack_lvl+0xe8/0x150 [ 384.429102][ T8883] should_fail_ex+0x3eb/0x540 [ 384.429135][ T8883] get_futex_key+0x1b4/0x1580 [ 384.429198][ T8883] ? __pfx_get_futex_key+0x10/0x10 [ 384.429234][ T8883] ? kasan_save_free_info+0x40/0x50 [ 384.429265][ T8883] ? __kasan_slab_free+0x5c/0x80 [ 384.429286][ T8883] ? kfree+0x1c5/0x650 [ 384.429313][ T8883] ? __se_sys_add_key+0x3ad/0x420 [ 384.429344][ T8883] ? do_syscall_64+0x166/0x520 [ 384.429375][ T8883] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 384.429410][ T8883] futex_wake+0x119/0x5f0 [ 384.429448][ T8883] ? __pfx_futex_wake+0x10/0x10 [ 384.429495][ T8883] do_futex+0x458/0x4e0 [ 384.429527][ T8883] ? __pfx_do_futex+0x10/0x10 [ 384.429562][ T8883] __se_sys_futex+0x3a8/0x450 [ 384.429595][ T8883] ? __pfx___se_sys_futex+0x10/0x10 [ 384.429630][ T8883] ? __x64_sys_futex+0x21/0xf0 [ 384.429658][ T8883] do_syscall_64+0x166/0x520 [ 384.429679][ T8883] ? trace_irq_disable+0x3b/0x140 [ 384.429714][ T8883] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 384.429738][ T8883] ? clear_bhb_loop+0x70/0xc0 [ 384.429768][ T8883] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 384.429792][ T8883] RIP: 0033:0x7f932819e159 [ 384.429814][ T8883] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 384.429834][ T8883] RSP: 002b:00007f93290cd0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 384.429860][ T8883] RAX: ffffffffffffffda RBX: 00007f9328425fa8 RCX: 00007f932819e159 [ 384.429899][ T8883] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f9328425fac [ 384.429916][ T8883] RBP: 00007f9328425fa0 R08: 3fffffffffffffff R09: 0000000000000000 [ 384.429932][ T8883] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 384.429948][ T8883] R13: 00007f9328426038 R14: 00007ffce34f9b20 R15: 00007ffce34f9c08 [ 384.429985][ T8883] [ 384.685049][ T8886] pimreg: left allmulticast mode [ 385.038009][ T989] usb 4-1: USB disconnect, device number 106 [ 385.077480][ T8890] device-mapper: table: 248:0: integrity: Error reading superblock (-EIO) [ 385.077522][ T8890] device-mapper: ioctl: error adding target to table [ 385.339510][ T5693] usb 3-1: new high-speed USB device number 108 using dummy_hcd [ 385.496284][ T5693] usb 3-1: unable to get BOS descriptor or descriptor too short [ 385.496343][ T5693] usb 3-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 385.497843][ T5693] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 385.497862][ T5693] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 385.502760][ T5693] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 385.502826][ T5693] usb 3-1: Product: syz [ 385.502867][ T5693] usb 3-1: Manufacturer: syz [ 385.502938][ T5693] usb 3-1: SerialNumber: syz [ 385.544494][ T6227] usb 2-1: new high-speed USB device number 105 using dummy_hcd [ 385.548920][ T5693] usb 3-1: selecting invalid altsetting 1 [ 385.564236][ T8887] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 385.572639][ T5693] usb 3-1: unit 6 not found! [ 385.656305][ T5693] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 385.697367][ T8904] sctp: [Deprecated]: syz.3.1002 (pid 8904) Use of int in max_burst socket option. [ 385.697367][ T8904] Use struct sctp_assoc_value instead [ 385.717831][ T6227] usb 2-1: Using ep0 maxpacket: 32 [ 385.718439][ T5634] udevd[5634]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 385.718968][ T6227] usb 2-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 385.754480][ T5693] usb 3-1: USB disconnect, device number 108 [ 385.758910][ T6227] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 385.758939][ T6227] usb 2-1: Product: syz [ 385.758955][ T6227] usb 2-1: Manufacturer: syz [ 385.758972][ T6227] usb 2-1: SerialNumber: syz [ 385.798547][ T6227] usb 2-1: config 0 descriptor?? [ 385.815441][ T6227] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 386.624927][ T8919] fuse: Bad value for 'fd' [ 386.842691][ T6227] gspca_ov534_9: reg_w failed -71 [ 386.889548][ T5693] usb 3-1: new high-speed USB device number 109 using dummy_hcd [ 386.989411][ T989] usb 4-1: new high-speed USB device number 107 using dummy_hcd [ 387.050128][ T5693] usb 3-1: New USB device found, idVendor=0bda, idProduct=0129, bcdDevice= 1.00 [ 387.051323][ T5693] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 387.051360][ T5693] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 387.051391][ T5693] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 387.129543][ T6227] gspca_ov534_9: Unknown sensor 0000 [ 387.129636][ T6227] ov534_9 2-1:0.0: probe with driver ov534_9 failed with error -22 [ 387.133773][ T6227] usb 2-1: USB disconnect, device number 105 [ 387.159821][ T989] usb 4-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 387.160960][ T989] usb 4-1: config 220 has an invalid interface number: 76 but max is 2 [ 387.160986][ T989] usb 4-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 387.161007][ T989] usb 4-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 387.161029][ T989] usb 4-1: config 220 has no interface number 2 [ 387.161174][ T989] usb 4-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 387.161246][ T989] usb 4-1: config 220 interface 0 has no altsetting 0 [ 387.161267][ T989] usb 4-1: config 220 interface 76 has no altsetting 0 [ 387.161287][ T989] usb 4-1: config 220 interface 1 has no altsetting 0 [ 387.165076][ T989] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 387.165103][ T989] usb 4-1: Product: syz [ 387.165120][ T989] usb 4-1: Manufacturer: syz [ 387.165138][ T989] usb 4-1: SerialNumber: syz [ 387.274510][ T5693] rtsx_usb 3-1:1.0: probe with driver rtsx_usb failed with error -71 [ 387.296727][ T5693] usb 3-1: USB disconnect, device number 109 [ 387.621602][ T989] uvcvideo 4-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 387.621647][ T989] uvcvideo 4-1:220.0: No valid video chain found. [ 387.621772][ T989] usb 4-1: selecting invalid altsetting 0 [ 387.670597][ T989] usb 4-1: selecting invalid altsetting 0 [ 387.670629][ T989] usbtest 4-1:220.1: probe with driver usbtest failed with error -22 [ 387.674472][ T989] usb 4-1: USB disconnect, device number 107 [ 388.262074][ T6227] usb 3-1: new high-speed USB device number 110 using dummy_hcd [ 388.398963][ T8948] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1017'. [ 388.414489][ T6227] usb 3-1: unable to get BOS descriptor or descriptor too short [ 388.414542][ T6227] usb 3-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 388.415529][ T6227] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 388.415555][ T6227] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 388.459682][ T6227] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 388.459712][ T6227] usb 3-1: Product: syz [ 388.459739][ T6227] usb 3-1: Manufacturer: syz [ 388.459754][ T6227] usb 3-1: SerialNumber: syz [ 388.470316][ T6227] usb 3-1: selecting invalid altsetting 1 [ 388.498941][ T6227] usb 3-1: unit 6 not found! [ 388.506670][ T8932] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 388.520216][ T5693] usb 4-1: new high-speed USB device number 108 using dummy_hcd [ 388.589165][ T6227] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 388.622146][ T5634] udevd[5634]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 388.667736][ T8286] usb 3-1: USB disconnect, device number 110 [ 388.670777][ T5693] usb 4-1: Using ep0 maxpacket: 32 [ 388.676951][ T5693] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 388.685638][ T5693] usb 4-1: config 0 has an invalid interface number: 51 but max is 0 [ 388.685708][ T5693] usb 4-1: config 0 has no interface number 0 [ 388.702677][ T5693] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 388.702753][ T5693] usb 4-1: Product: syz [ 388.702797][ T5693] usb 4-1: Manufacturer: syz [ 388.702840][ T5693] usb 4-1: SerialNumber: syz [ 388.734945][ T5693] usb 4-1: config 0 descriptor?? [ 388.750631][ T5693] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 388.829482][ T5764] usb 2-1: new high-speed USB device number 106 using dummy_hcd [ 388.950455][ T5693] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 388.953885][ T5693] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 388.979622][ T5764] usb 2-1: Using ep0 maxpacket: 32 [ 388.981546][ T5764] usb 2-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 389.003011][ T5764] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 389.003045][ T5764] usb 2-1: Product: syz [ 389.003056][ T5764] usb 2-1: Manufacturer: syz [ 389.003108][ T5764] usb 2-1: SerialNumber: syz [ 389.017430][ T5764] usb 2-1: config 0 descriptor?? [ 389.049119][ T5764] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 389.366335][ C0] usb 4-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 389.367865][ T8286] usb 4-1: USB disconnect, device number 108 [ 389.394416][ T8286] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 389.409241][ T8286] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 389.431139][ T8286] quatech2 4-1:0.51: device disconnected [ 389.609419][ T6227] usb 3-1: new high-speed USB device number 111 using dummy_hcd [ 389.760197][ T6227] usb 3-1: New USB device found, idVendor=0a5c, idProduct=2033, bcdDevice=c8.51 [ 389.761351][ T6227] usb 3-1: config 2 has an invalid interface number: 56 but max is 0 [ 389.761375][ T6227] usb 3-1: config 2 has no interface number 0 [ 389.763714][ T6227] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 389.763750][ T6227] usb 3-1: Product: syz [ 389.763761][ T6227] usb 3-1: Manufacturer: syz [ 389.763772][ T6227] usb 3-1: SerialNumber: syz [ 390.062835][ T5764] gspca_ov534_9: reg_w failed -71 [ 390.319408][ T989] usb 4-1: new high-speed USB device number 109 using dummy_hcd [ 390.349367][ T5764] gspca_ov534_9: Unknown sensor 0000 [ 390.349487][ T5764] ov534_9 2-1:0.0: probe with driver ov534_9 failed with error -22 [ 390.354284][ T5764] usb 2-1: USB disconnect, device number 106 [ 390.470213][ T989] usb 4-1: New USB device found, idVendor=0bda, idProduct=0129, bcdDevice= 1.00 [ 390.471395][ T989] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 390.471451][ T989] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 390.471481][ T989] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 390.679735][ T989] rtsx_usb 4-1:1.0: probe with driver rtsx_usb failed with error -71 [ 390.720032][ T989] usb 4-1: USB disconnect, device number 109 [ 390.919352][ T8977] FAULT_INJECTION: forcing a failure. [ 390.919352][ T8977] name failslab, interval 1, probability 0, space 0, times 0 [ 390.919390][ T8977] CPU: 0 UID: 0 PID: 8977 Comm: syz.0.1028 Tainted: G L syzkaller #0 PREEMPT(full) [ 390.919421][ T8977] Tainted: [L]=SOFTLOCKUP [ 390.919430][ T8977] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 390.919452][ T8977] Call Trace: [ 390.919472][ T8977] [ 390.919483][ T8977] dump_stack_lvl+0xe8/0x150 [ 390.919521][ T8977] should_fail_ex+0x3eb/0x540 [ 390.919554][ T8977] should_failslab+0xa8/0x100 [ 390.919589][ T8977] __kvmalloc_node_noprof+0x171/0x820 [ 390.919626][ T8977] ? __pfx_down_write+0x10/0x10 [ 390.919652][ T8977] ? cache_write+0xc8/0x210 [ 390.919690][ T8977] ? cache_write+0xc8/0x210 [ 390.919731][ T8977] cache_write+0xc8/0x210 [ 390.919771][ T8977] ? cache_write_procfs+0x26/0x80 [ 390.919807][ T8977] ? __pfx_cache_write_procfs+0x10/0x10 [ 390.919840][ T8977] proc_reg_write+0x1e9/0x2e0 [ 390.919873][ T8977] ? __pfx_proc_reg_write+0x10/0x10 [ 390.919895][ T8977] vfs_write+0x296/0xba0 [ 390.919938][ T8977] ? __pfx_vfs_write+0x10/0x10 [ 390.919972][ T8977] ? __fget_files+0x2a/0x420 [ 390.920027][ T8977] ? __fget_files+0x3a2/0x420 [ 390.920064][ T8977] ? __fget_files+0x2a/0x420 [ 390.920109][ T8977] ksys_write+0x150/0x270 [ 390.920144][ T8977] ? __pfx_ksys_write+0x10/0x10 [ 390.920188][ T8977] do_syscall_64+0x166/0x520 [ 390.920210][ T8977] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 390.920234][ T8977] ? clear_bhb_loop+0x70/0xc0 [ 390.920262][ T8977] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 390.920285][ T8977] RIP: 0033:0x7f43bdb9e159 [ 390.920307][ T8977] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 390.920325][ T8977] RSP: 002b:00007f43beb38028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 390.920371][ T8977] RAX: ffffffffffffffda RBX: 00007f43bde25fa0 RCX: 00007f43bdb9e159 [ 390.920400][ T8977] RDX: 000000000000002b RSI: 0000200000000000 RDI: 0000000000000003 [ 390.920455][ T8977] RBP: 00007f43beb38090 R08: 0000000000000000 R09: 0000000000000000 [ 390.920470][ T8977] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 390.920485][ T8977] R13: 00007f43bde26038 R14: 00007f43bde25fa0 R15: 00007ffc10e083f8 [ 390.920522][ T8977] [ 391.479458][ T989] usb 1-1: new high-speed USB device number 111 using dummy_hcd [ 391.631352][ T989] usb 1-1: unable to get BOS descriptor or descriptor too short [ 391.631408][ T989] usb 1-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 391.632462][ T989] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 391.632488][ T989] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 391.634832][ T989] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 391.634861][ T989] usb 1-1: Product: syz [ 391.634878][ T989] usb 1-1: Manufacturer: syz [ 391.634896][ T989] usb 1-1: SerialNumber: syz [ 391.657265][ T989] usb 1-1: selecting invalid altsetting 1 [ 391.657982][ T989] usb 1-1: unit 6 not found! [ 391.735576][ T8975] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 391.751675][ T989] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 391.804167][ T5634] udevd[5634]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 391.847374][ T6227] usb 1-1: USB disconnect, device number 111 [ 392.149547][ T989] usb 2-1: new high-speed USB device number 107 using dummy_hcd [ 392.311241][ T989] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 392.311289][ T989] usb 2-1: too many configurations: 180, using maximum allowed: 8 [ 392.337157][ T989] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 392.337206][ T989] usb 2-1: Product: syz [ 392.337224][ T989] usb 2-1: Manufacturer: syz [ 392.337253][ T989] usb 2-1: SerialNumber: syz [ 392.383588][ T5720] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 392.406836][ T8992] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.1032'. [ 392.488558][ T8994] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 392.498282][ T8994] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 392.737597][ T8996] genirq: Flags mismatch irq 7. 00200080 (ttyS3) vs. 00200000 (das16m1) [ 392.753153][ T8996] dummy0: entered allmulticast mode [ 392.765306][ T8996] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 392.766816][ T8996] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 392.788446][ T8995] dummy0: left allmulticast mode [ 392.805695][ T8990] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 392.806357][ T8990] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 392.818653][ T5764] usb 1-1: new high-speed USB device number 112 using dummy_hcd [ 393.010595][ T9007] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1035'. [ 393.011280][ T9007] netlink: 'syz.3.1035': attribute type 1 has an invalid length. [ 393.105258][ T989] usb 2-1: USB disconnect, device number 107 [ 393.303633][ T9012] FAULT_INJECTION: forcing a failure. [ 393.303633][ T9012] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 393.303670][ T9012] CPU: 0 UID: 0 PID: 9012 Comm: syz.2.1036 Tainted: G L syzkaller #0 PREEMPT(full) [ 393.303701][ T9012] Tainted: [L]=SOFTLOCKUP [ 393.303711][ T9012] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 393.303725][ T9012] Call Trace: [ 393.303735][ T9012] [ 393.303746][ T9012] dump_stack_lvl+0xe8/0x150 [ 393.303782][ T9012] should_fail_ex+0x3eb/0x540 [ 393.303814][ T9012] _copy_to_user+0x31/0xb0 [ 393.303847][ T9012] simple_read_from_buffer+0xe1/0x170 [ 393.303884][ T9012] proc_fail_nth_read+0x1bb/0x230 [ 393.303934][ T9012] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 393.303973][ T9012] ? rw_verify_area+0x24a/0x4c0 [ 393.304007][ T9012] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 393.304041][ T9012] vfs_read+0x213/0xa80 [ 393.304079][ T9012] ? __pfx___mutex_lock+0x10/0x10 [ 393.304104][ T9012] ? __pfx_vfs_read+0x10/0x10 [ 393.304137][ T9012] ? __fget_files+0x2a/0x420 [ 393.304173][ T9012] ? __fget_files+0x3a2/0x420 [ 393.304201][ T9012] ? __fget_files+0x2a/0x420 [ 393.304240][ T9012] ksys_read+0x150/0x270 [ 393.304275][ T9012] ? __pfx_ksys_read+0x10/0x10 [ 393.304306][ T9012] ? __pfx_sync_file_ioctl+0x10/0x10 [ 393.304350][ T9012] do_syscall_64+0x166/0x520 [ 393.304372][ T9012] ? trace_irq_disable+0x3b/0x140 [ 393.304405][ T9012] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 393.304430][ T9012] ? clear_bhb_loop+0x70/0xc0 [ 393.304460][ T9012] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 393.304485][ T9012] RIP: 0033:0x7f932815e98e [ 393.304506][ T9012] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 393.304527][ T9012] RSP: 002b:00007f93290ccfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 393.304553][ T9012] RAX: ffffffffffffffda RBX: 00007f93290cd6c0 RCX: 00007f932815e98e [ 393.304571][ T9012] RDX: 000000000000000f RSI: 00007f93290cd0a0 RDI: 0000000000000009 [ 393.304587][ T9012] RBP: 00007f93290cd090 R08: 0000000000000000 R09: 0000000000000000 [ 393.304602][ T9012] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 393.304616][ T9012] R13: 00007f9328426038 R14: 00007f9328425fa0 R15: 00007ffce34f9c08 [ 393.304653][ T9012] [ 393.427783][ T5720] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 393.428279][ T5720] ath9k_htc: Failed to initialize the device [ 393.437986][ T989] usb 2-1: ath9k_htc: USB layer deinitialized [ 393.927809][ T9017] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 393.929043][ T9017] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 394.009024][ T9027] netlink: 1752 bytes leftover after parsing attributes in process `syz.1.1041'. [ 394.379429][ T52] Bluetooth: hci3: command tx timeout [ 394.499439][ T989] usb 2-1: new high-speed USB device number 108 using dummy_hcd [ 394.629025][ T9036] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 394.629800][ T9036] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 394.657201][ T989] usb 2-1: unable to get BOS descriptor or descriptor too short [ 394.657250][ T989] usb 2-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 394.668703][ T989] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 394.668780][ T989] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 394.686993][ T989] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 394.687021][ T989] usb 2-1: Product: syz [ 394.687038][ T989] usb 2-1: Manufacturer: syz [ 394.687055][ T989] usb 2-1: SerialNumber: syz [ 394.709653][ T9021] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 394.751214][ T989] usb 2-1: selecting invalid altsetting 1 [ 394.751713][ T989] usb 2-1: unit 6 not found! [ 394.799537][ T989] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 394.832669][ T5634] udevd[5634]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 394.942864][ T10] usb 2-1: USB disconnect, device number 108 [ 395.551109][ T5764] usb 4-1: new full-speed USB device number 110 using dummy_hcd [ 395.709962][ T5764] usb 4-1: New USB device found, idVendor=06a3, idProduct=0ccd, bcdDevice= 0.00 [ 395.709995][ T5764] usb 4-1: too many configurations: 49, using maximum allowed: 8 [ 395.711101][ T5764] usb 4-1: invalid descriptor for config index 0: type = 0x2, length = 0 [ 395.711126][ T5764] usb 4-1: can't read configurations, error -22 [ 395.790178][ T989] usb 2-1: new full-speed USB device number 109 using dummy_hcd [ 395.839388][ T5764] usb 4-1: new full-speed USB device number 111 using dummy_hcd [ 395.940107][ T989] usb 2-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 395.941328][ T989] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 395.943360][ T989] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 395.943377][ T989] usb 2-1: Product: syz [ 395.943388][ T989] usb 2-1: Manufacturer: syz [ 395.943399][ T989] usb 2-1: SerialNumber: syz [ 395.945888][ T989] usb 2-1: config 0 descriptor?? [ 395.961399][ T989] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 396.021756][ T5764] usb 4-1: New USB device found, idVendor=06a3, idProduct=0ccd, bcdDevice= 0.00 [ 396.021802][ T5764] usb 4-1: too many configurations: 49, using maximum allowed: 8 [ 396.024081][ T5764] usb 4-1: invalid descriptor for config index 0: type = 0x2, length = 0 [ 396.024118][ T5764] usb 4-1: can't read configurations, error -22 [ 396.024470][ T5764] usb usb4-port1: attempt power cycle [ 396.265116][ T9052] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.1050'. [ 396.359661][ T5764] usb 4-1: new full-speed USB device number 112 using dummy_hcd [ 396.382333][ T5764] usb 4-1: New USB device found, idVendor=06a3, idProduct=0ccd, bcdDevice= 0.00 [ 396.382383][ T5764] usb 4-1: too many configurations: 49, using maximum allowed: 8 [ 396.383364][ T5764] usb 4-1: invalid descriptor for config index 0: type = 0x2, length = 0 [ 396.383401][ T5764] usb 4-1: can't read configurations, error -22 [ 396.497529][ T9060] random: crng reseeded on system resumption [ 396.515371][ T9054] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 396.515872][ T9054] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 396.519651][ T5764] usb 4-1: new full-speed USB device number 113 using dummy_hcd [ 396.552826][ T5764] usb 4-1: New USB device found, idVendor=06a3, idProduct=0ccd, bcdDevice= 0.00 [ 396.552874][ T5764] usb 4-1: too many configurations: 49, using maximum allowed: 8 [ 396.556622][ T5764] usb 4-1: invalid descriptor for config index 0: type = 0x2, length = 0 [ 396.556664][ T5764] usb 4-1: can't read configurations, error -22 [ 396.557134][ T5764] usb usb4-port1: unable to enumerate USB device [ 397.227740][ T9067] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 397.228472][ T9067] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 397.508464][ T9062] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 397.975342][ T989] gspca_zc3xx: reg_r err -32 [ 398.349466][ T30] usb 1-1: new high-speed USB device number 113 using dummy_hcd [ 398.501314][ T30] usb 1-1: unable to get BOS descriptor or descriptor too short [ 398.501360][ T30] usb 1-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 398.502239][ T30] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 398.502257][ T30] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 398.504003][ T30] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 398.504040][ T30] usb 1-1: Product: syz [ 398.504052][ T30] usb 1-1: Manufacturer: syz [ 398.504063][ T30] usb 1-1: SerialNumber: syz [ 398.526380][ T30] usb 1-1: selecting invalid altsetting 1 [ 398.527135][ T30] usb 1-1: unit 6 not found! [ 398.560350][ T989] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 398.560605][ T989] gspca_zc3xx 2-1:0.0: probe with driver gspca_zc3xx failed with error -32 [ 398.625268][ T30] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 398.658644][ T5634] udevd[5634]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 398.731777][ T30] usb 1-1: USB disconnect, device number 113 [ 398.923737][ T9089] vlan0: entered allmulticast mode [ 398.924154][ T9089] vlan0: entered promiscuous mode [ 398.928060][ T9089] netlink: 148 bytes leftover after parsing attributes in process `syz.2.1061'. [ 398.955479][ T9089] bridge0: port 1(bridge_slave_0) entered disabled state [ 398.971266][ T9089] bridge_slave_0 (unregistering): left allmulticast mode [ 398.971288][ T9089] bridge_slave_0 (unregistering): left promiscuous mode [ 398.974069][ T9089] bridge0: port 1(bridge_slave_0) entered disabled state [ 399.020912][ T5693] usb 2-1: USB disconnect, device number 109 [ 399.049390][ T9088] vlan0: left promiscuous mode [ 399.056039][ T9088] vlan0: left allmulticast mode [ 399.116239][ T9092] 9p: Bad value for 'rfdno' [ 399.224442][ T9094] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 399.225148][ T9094] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 399.609391][ T989] usb 1-1: new high-speed USB device number 114 using dummy_hcd [ 399.759472][ T989] usb 1-1: Using ep0 maxpacket: 32 [ 399.760218][ T989] usb 1-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 399.763006][ T989] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 399.763025][ T989] usb 1-1: Product: syz [ 399.763043][ T989] usb 1-1: Manufacturer: syz [ 399.763054][ T989] usb 1-1: SerialNumber: syz [ 399.765464][ T989] usb 1-1: config 0 descriptor?? [ 399.775198][ T989] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 399.938400][ T9107] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 399.938876][ T9107] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 400.319405][ T5693] usb 2-1: new high-speed USB device number 110 using dummy_hcd [ 400.470202][ T5693] usb 2-1: New USB device found, idVendor=1d34, idProduct=000a, bcdDevice= 0.00 [ 400.471309][ T5693] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 400.471343][ T5693] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 400.471388][ T5693] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 400.474239][ T5693] usb 2-1: config 0 descriptor?? [ 400.568114][ T9099] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 400.881643][ T9110] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 400.882355][ T9110] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 400.900682][ T9110] FAULT_INJECTION: forcing a failure. [ 400.900682][ T9110] name failslab, interval 1, probability 0, space 0, times 0 [ 400.901081][ T9110] CPU: 1 UID: 0 PID: 9110 Comm: syz.1.1068 Tainted: G L syzkaller #0 PREEMPT(full) [ 400.901176][ T9110] Tainted: [L]=SOFTLOCKUP [ 400.901201][ T9110] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 400.901252][ T9110] Call Trace: [ 400.901283][ T9110] [ 400.901306][ T9110] dump_stack_lvl+0xe8/0x150 [ 400.901398][ T9110] should_fail_ex+0x3eb/0x540 [ 400.901477][ T9110] should_failslab+0xa8/0x100 [ 400.901553][ T9110] __kmalloc_cache_noprof+0x9e/0x600 [ 400.901649][ T9110] ? proc_self_get_link+0xe5/0x180 [ 400.901739][ T9110] ? proc_self_get_link+0xe5/0x180 [ 400.901846][ T9110] ? __task_pid_nr_ns+0x399/0x470 [ 400.901954][ T9110] proc_self_get_link+0xe5/0x180 [ 400.902066][ T9110] ? __pfx_proc_self_get_link+0x10/0x10 [ 400.902155][ T9110] pick_link+0x77d/0xfd0 [ 400.902264][ T9110] step_into_slowpath+0x58a/0x820 [ 400.902347][ T9110] ? __pfx_step_into_slowpath+0x10/0x10 [ 400.902457][ T9110] link_path_walk+0xd5e/0x1910 [ 400.902605][ T9110] path_openat+0x1c4/0x1e40 [ 400.902748][ T9110] do_file_open+0x23e/0x4a0 [ 400.902855][ T9110] ? __pfx_do_file_open+0x10/0x10 [ 400.902998][ T9110] ? _raw_spin_unlock+0x28/0x50 [ 400.903083][ T9110] ? alloc_fd+0x651/0x6c0 [ 400.903184][ T9110] do_sys_openat2+0x115/0x200 [ 400.903252][ T9110] ? __se_sys_futex+0x3a8/0x450 [ 400.903327][ T9110] ? __pfx_do_sys_openat2+0x10/0x10 [ 400.903422][ T9110] ? rcu_is_watching+0x16/0xb0 [ 400.903505][ T9110] __x64_sys_openat+0x138/0x170 [ 400.903585][ T9110] do_syscall_64+0x166/0x520 [ 400.903650][ T9110] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 400.903716][ T9110] ? clear_bhb_loop+0x70/0xc0 [ 400.903787][ T9110] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 400.903862][ T9110] RIP: 0033:0x7f13e795e98e [ 400.903919][ T9110] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 400.903974][ T9110] RSP: 002b:00007f13e8834ec8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 400.904041][ T9110] RAX: ffffffffffffffda RBX: 00007f13e88356c0 RCX: 00007f13e795e98e [ 400.904088][ T9110] RDX: 0000000000000002 RSI: 00007f13e8834f90 RDI: ffffffffffffff9c [ 400.904132][ T9110] RBP: 00007f13e7a3506b R08: 0000000000000000 R09: 0000000000000000 [ 400.904176][ T9110] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 400.904211][ T9110] R13: 00007f13e7c26038 R14: 00007f13e7c25fa0 R15: 00007ffdbdd71338 [ 400.904305][ T9110] [ 400.956712][ T9110] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 400.975532][ T9110] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 401.027464][ T989] gspca_ov534_9: reg_w failed -71 [ 401.191909][ T5693] hid-led 0003:1D34:000A.0027: collection stack underflow [ 401.191944][ T5693] hid-led 0003:1D34:000A.0027: item 0 2 0 12 parsing failed [ 401.192764][ T5693] hid-led 0003:1D34:000A.0027: probe with driver hid-led failed with error -22 [ 401.229233][ T5720] usb 2-1: USB disconnect, device number 110 [ 401.310034][ T989] gspca_ov534_9: Unknown sensor 0000 [ 401.310098][ T989] ov534_9 1-1:0.0: probe with driver ov534_9 failed with error -22 [ 401.313580][ T989] usb 1-1: USB disconnect, device number 114 [ 401.620374][ T10] usb 4-1: new high-speed USB device number 114 using dummy_hcd [ 401.782323][ T10] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 401.784094][ T10] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 401.784150][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 401.788786][ T10] usb 4-1: config 0 descriptor?? [ 401.836826][ T10] pwc: Askey VC010 type 2 USB webcam detected. [ 401.999365][ T5720] usb 1-1: new high-speed USB device number 115 using dummy_hcd [ 402.149609][ T989] usb 2-1: new high-speed USB device number 111 using dummy_hcd [ 402.151789][ T5720] usb 1-1: unable to get BOS descriptor or descriptor too short [ 402.151851][ T5720] usb 1-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 402.152834][ T5720] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 402.152859][ T5720] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 402.154903][ T5720] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 402.154930][ T5720] usb 1-1: Product: syz [ 402.154947][ T5720] usb 1-1: Manufacturer: syz [ 402.154965][ T5720] usb 1-1: SerialNumber: syz [ 402.177999][ T5720] usb 1-1: selecting invalid altsetting 1 [ 402.199010][ T5720] usb 1-1: unit 6 not found! [ 402.239518][ T10] pwc: recv_control_msg error -32 req 02 val 2b00 [ 402.241385][ T10] pwc: recv_control_msg error -32 req 02 val 2700 [ 402.241993][ T10] pwc: recv_control_msg error -32 req 02 val 2c00 [ 402.242744][ T10] pwc: recv_control_msg error -32 req 04 val 1000 [ 402.277339][ T10] pwc: recv_control_msg error -32 req 04 val 1300 [ 402.278920][ T10] pwc: recv_control_msg error -32 req 04 val 1400 [ 402.292561][ T10] pwc: recv_control_msg error -32 req 02 val 2000 [ 402.294088][ T10] pwc: recv_control_msg error -32 req 02 val 2100 [ 402.294523][ T10] pwc: recv_control_msg error -71 req 04 val 1500 [ 402.295837][ T10] pwc: recv_control_msg error -71 req 02 val 2500 [ 402.296268][ T10] pwc: recv_control_msg error -71 req 02 val 2400 [ 402.296676][ T10] pwc: recv_control_msg error -71 req 02 val 2600 [ 402.297090][ T10] pwc: recv_control_msg error -71 req 02 val 2900 [ 402.297455][ T10] pwc: recv_control_msg error -71 req 02 val 2800 [ 402.312790][ T10] pwc: recv_control_msg error -71 req 04 val 1100 [ 402.314400][ T989] usb 2-1: New USB device found, idVendor=0bda, idProduct=0129, bcdDevice= 1.00 [ 402.319604][ T10] pwc: recv_control_msg error -71 req 04 val 1200 [ 402.333706][ T989] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 402.333849][ T989] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 402.334887][ T989] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 402.415406][ T10] pwc: Registered as video103. [ 402.425158][ T10] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input43 [ 402.443603][ T10] usb 4-1: USB disconnect, device number 114 [ 402.491315][ T5720] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 402.495670][ T5720] usb 1-1: USB disconnect, device number 115 [ 402.593781][ T5634] udevd[5634]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 402.685070][ T989] rtsx_usb 2-1:1.0: probe with driver rtsx_usb failed with error -71 [ 402.705712][ T989] usb 2-1: USB disconnect, device number 111 [ 403.047471][ T9130] FAULT_INJECTION: forcing a failure. [ 403.047471][ T9130] name failslab, interval 1, probability 0, space 0, times 0 [ 403.047499][ T9130] CPU: 1 UID: 0 PID: 9130 Comm: syz.2.1076 Tainted: G L syzkaller #0 PREEMPT(full) [ 403.047521][ T9130] Tainted: [L]=SOFTLOCKUP [ 403.047527][ T9130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 403.047557][ T9130] Call Trace: [ 403.047566][ T9130] [ 403.047577][ T9130] dump_stack_lvl+0xe8/0x150 [ 403.047613][ T9130] should_fail_ex+0x3eb/0x540 [ 403.047647][ T9130] should_failslab+0xa8/0x100 [ 403.047673][ T9130] __kmalloc_cache_noprof+0x9e/0x600 [ 403.047699][ T9130] ? crypto_larval_alloc+0x59/0x290 [ 403.047723][ T9130] ? crypto_larval_alloc+0x59/0x290 [ 403.047753][ T9130] crypto_larval_alloc+0x59/0x290 [ 403.047780][ T9130] crypto_alg_mod_lookup+0x1a1/0x5d0 [ 403.047813][ T9130] crypto_alloc_tfm_node+0x135/0x3e0 [ 403.047836][ T9130] kdf_alloc+0x1f/0x100 [ 403.047858][ T9130] __keyctl_dh_compute+0x4f9/0xd10 [ 403.047882][ T9130] ? __lock_acquire+0x747/0x2de0 [ 403.047910][ T9130] ? __pfx___keyctl_dh_compute+0x10/0x10 [ 403.047951][ T9130] ? __might_fault+0xaf/0x130 [ 403.047976][ T9130] keyctl_dh_compute+0x124/0x180 [ 403.048000][ T9130] ? __pfx_keyctl_dh_compute+0x10/0x10 [ 403.048033][ T9130] __se_sys_keyctl+0x44c/0xbc0 [ 403.048051][ T9130] ? __pfx___se_sys_keyctl+0x10/0x10 [ 403.048066][ T9130] ? __mutex_unlock_slowpath+0x731/0x900 [ 403.048084][ T9130] ? __fget_files+0x2a/0x420 [ 403.048128][ T9130] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 403.048152][ T9130] ? __fget_files+0x3a2/0x420 [ 403.048191][ T9130] ? fput+0xa0/0xd0 [ 403.048210][ T9130] ? ksys_write+0x242/0x270 [ 403.048234][ T9130] ? __pfx_ksys_write+0x10/0x10 [ 403.048261][ T9130] ? __x64_sys_keyctl+0x20/0xc0 [ 403.048278][ T9130] do_syscall_64+0x166/0x520 [ 403.048293][ T9130] ? trace_irq_disable+0x3b/0x140 [ 403.048316][ T9130] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 403.048333][ T9130] ? clear_bhb_loop+0x70/0xc0 [ 403.048367][ T9130] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 403.048383][ T9130] RIP: 0033:0x7f932819e159 [ 403.048399][ T9130] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 403.048413][ T9130] RSP: 002b:00007f93290cd028 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 403.048431][ T9130] RAX: ffffffffffffffda RBX: 00007f9328425fa0 RCX: 00007f932819e159 [ 403.048443][ T9130] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000017 [ 403.048454][ T9130] RBP: 00007f93290cd090 R08: 00002000000003c0 R09: 0000000000000000 [ 403.048464][ T9130] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 403.048474][ T9130] R13: 00007f9328426038 R14: 00007f9328425fa0 R15: 00007ffce34f9c08 [ 403.048498][ T9130] [ 403.048505][ T9130] could not allocate digest TFM handle cmac(tea) [ 403.770141][ T9148] could not allocate digest TFM handle sha384-avx2 [ 403.819549][ T10] usb 1-1: new high-speed USB device number 116 using dummy_hcd [ 403.887661][ T9153] bond0: (slave dummy0): Error: Device can not be enslaved while up [ 403.971355][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 403.972204][ T10] usb 1-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 403.977425][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 403.977452][ T10] usb 1-1: Product: syz [ 403.977467][ T10] usb 1-1: Manufacturer: syz [ 403.977482][ T10] usb 1-1: SerialNumber: syz [ 403.981064][ T10] usb 1-1: config 0 descriptor?? [ 404.023276][ T10] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 404.191354][ T9133] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 404.275436][ T9158] netlink: 'syz.3.1085': attribute type 10 has an invalid length. [ 404.275455][ T9158] netlink: 55 bytes leftover after parsing attributes in process `syz.3.1085'. [ 404.832501][ T9166] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 404.833030][ T9166] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 404.889388][ T989] usb 2-1: new high-speed USB device number 112 using dummy_hcd [ 405.042853][ T989] usb 2-1: unable to get BOS descriptor or descriptor too short [ 405.042909][ T989] usb 2-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 405.043941][ T989] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 405.043959][ T989] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 405.046191][ T989] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 405.046216][ T989] usb 2-1: Product: syz [ 405.046232][ T989] usb 2-1: Manufacturer: syz [ 405.046247][ T989] usb 2-1: SerialNumber: syz [ 405.112422][ T989] usb 2-1: selecting invalid altsetting 1 [ 405.113181][ T989] usb 2-1: unit 6 not found! [ 405.169107][ T989] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 405.224568][ T5860] udevd[5860]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 405.269046][ T10] gspca_ov534_9: reg_w failed -71 [ 405.311459][ T8286] usb 2-1: USB disconnect, device number 112 [ 405.548195][ T9180] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1094'. [ 405.548428][ T9181] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1094'. [ 405.549226][ T9182] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1094'. [ 405.549934][ T10] gspca_ov534_9: Unknown sensor 0000 [ 405.550021][ T10] ov534_9 1-1:0.0: probe with driver ov534_9 failed with error -22 [ 405.559491][ T10] usb 1-1: USB disconnect, device number 116 [ 405.839418][ T5721] usb 4-1: new high-speed USB device number 115 using dummy_hcd [ 405.990134][ T5721] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 405.991376][ T5721] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 405.991451][ T5721] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 405.996381][ T5721] usb 4-1: config 0 descriptor?? [ 406.225653][ T5721] savu 0003:1E7D:2D5A.0028: invalid report_count 63011 [ 406.225681][ T5721] savu 0003:1E7D:2D5A.0028: item 0 2 1 9 parsing failed [ 406.226484][ T5721] savu 0003:1E7D:2D5A.0028: parse failed [ 406.226553][ T5721] savu 0003:1E7D:2D5A.0028: probe with driver savu failed with error -22 [ 406.768873][ T9188] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 406.787845][ T9198] FAULT_INJECTION: forcing a failure. [ 406.787845][ T9198] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 406.787880][ T9198] CPU: 0 UID: 0 PID: 9198 Comm: syz.0.1097 Tainted: G L syzkaller #0 PREEMPT(full) [ 406.787911][ T9198] Tainted: [L]=SOFTLOCKUP [ 406.787920][ T9198] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 406.787934][ T9198] Call Trace: [ 406.787948][ T9198] [ 406.787958][ T9198] dump_stack_lvl+0xe8/0x150 [ 406.787992][ T9198] should_fail_ex+0x3eb/0x540 [ 406.788024][ T9198] _copy_from_user+0x2d/0xb0 [ 406.788073][ T9198] ___sys_recvmsg+0x173/0x5a0 [ 406.788107][ T9198] ? __pfx____sys_recvmsg+0x10/0x10 [ 406.788139][ T9198] ? lock_acquire+0x115/0x350 [ 406.788189][ T9198] ? __fget_files+0x3a2/0x420 [ 406.788230][ T9198] __x64_sys_recvmsg+0x1ae/0x290 [ 406.788261][ T9198] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 406.788310][ T9198] do_syscall_64+0x166/0x520 [ 406.788332][ T9198] ? trace_irq_disable+0x3b/0x140 [ 406.788365][ T9198] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 406.788390][ T9198] ? clear_bhb_loop+0x70/0xc0 [ 406.788419][ T9198] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 406.788443][ T9198] RIP: 0033:0x7f43bdb9e159 [ 406.788464][ T9198] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 406.788485][ T9198] RSP: 002b:00007f43beb17028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 406.788509][ T9198] RAX: ffffffffffffffda RBX: 00007f43bde26090 RCX: 00007f43bdb9e159 [ 406.788527][ T9198] RDX: 0000000000000700 RSI: 0000200000000580 RDI: 0000000000000003 [ 406.788542][ T9198] RBP: 00007f43beb17090 R08: 0000000000000000 R09: 0000000000000000 [ 406.788557][ T9198] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 406.788572][ T9198] R13: 00007f43bde26128 R14: 00007f43bde26090 R15: 00007ffc10e083f8 [ 406.788608][ T9198] [ 407.082079][ T9202] FAULT_INJECTION: forcing a failure. [ 407.082079][ T9202] name fail_futex, interval 1, probability 0, space 0, times 0 [ 407.082107][ T9202] CPU: 0 UID: 0 PID: 9202 Comm: syz.2.1099 Tainted: G L syzkaller #0 PREEMPT(full) [ 407.082130][ T9202] Tainted: [L]=SOFTLOCKUP [ 407.082136][ T9202] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 407.082147][ T9202] Call Trace: [ 407.082154][ T9202] [ 407.082161][ T9202] dump_stack_lvl+0xe8/0x150 [ 407.082188][ T9202] should_fail_ex+0x3eb/0x540 [ 407.082210][ T9202] get_futex_key+0x1b4/0x1580 [ 407.082240][ T9202] ? kfree+0x4d/0x650 [ 407.082261][ T9202] ? import_iovec+0x73/0xa0 [ 407.082284][ T9202] ? __pfx_get_futex_key+0x10/0x10 [ 407.082309][ T9202] ? ___sys_sendmsg+0x2b5/0x360 [ 407.082330][ T9202] ? __lock_acquire+0x747/0x2de0 [ 407.082389][ T9202] futex_wake+0x119/0x5f0 [ 407.082427][ T9202] ? __pfx_futex_wake+0x10/0x10 [ 407.082475][ T9202] do_futex+0x458/0x4e0 [ 407.082511][ T9202] ? __pfx_do_futex+0x10/0x10 [ 407.082536][ T9202] __se_sys_futex+0x3a8/0x450 [ 407.082559][ T9202] ? __pfx___se_sys_futex+0x10/0x10 [ 407.082595][ T9202] ? __x64_sys_futex+0x21/0xf0 [ 407.082614][ T9202] do_syscall_64+0x166/0x520 [ 407.082630][ T9202] ? trace_irq_disable+0x3b/0x140 [ 407.082652][ T9202] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 407.082668][ T9202] ? clear_bhb_loop+0x70/0xc0 [ 407.082688][ T9202] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 407.082704][ T9202] RIP: 0033:0x7f932819e159 [ 407.082719][ T9202] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 407.082732][ T9202] RSP: 002b:00007f93290cd0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 407.082750][ T9202] RAX: ffffffffffffffda RBX: 00007f9328425fa8 RCX: 00007f932819e159 [ 407.082762][ T9202] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f9328425fac [ 407.082772][ T9202] RBP: 00007f9328425fa0 R08: 3fffffffffffffff R09: 0000000000000000 [ 407.082783][ T9202] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 407.082793][ T9202] R13: 00007f9328426038 R14: 00007ffce34f9b20 R15: 00007ffce34f9c08 [ 407.082823][ T9202] [ 407.809787][ T10] usb 2-1: new high-speed USB device number 113 using dummy_hcd [ 407.970101][ T10] usb 2-1: New USB device found, idVendor=0bda, idProduct=0129, bcdDevice= 1.00 [ 407.971453][ T10] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 407.971511][ T10] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 407.971556][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 408.187043][ T10] rtsx_usb 2-1:1.0: probe with driver rtsx_usb failed with error -71 [ 408.208083][ T10] usb 2-1: USB disconnect, device number 113 [ 408.311355][ T9218] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 408.311977][ T9218] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 408.562130][ T10] usb 4-1: USB disconnect, device number 115 [ 408.959548][ T10] usb 4-1: new high-speed USB device number 116 using dummy_hcd [ 409.111535][ T10] usb 4-1: unable to get BOS descriptor or descriptor too short [ 409.111594][ T10] usb 4-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 409.112583][ T10] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 409.112609][ T10] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 409.114539][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 409.114567][ T10] usb 4-1: Product: syz [ 409.114585][ T10] usb 4-1: Manufacturer: syz [ 409.114601][ T10] usb 4-1: SerialNumber: syz [ 409.127813][ T10] usb 4-1: selecting invalid altsetting 1 [ 409.130909][ T10] usb 4-1: unit 6 not found! [ 409.209583][ T10] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 409.241783][ T5634] udevd[5634]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 409.321898][ T30] usb 4-1: USB disconnect, device number 116 [ 410.461034][ T9241] FAULT_INJECTION: forcing a failure. [ 410.461034][ T9241] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 410.461063][ T9241] CPU: 1 UID: 0 PID: 9241 Comm: syz.2.1113 Tainted: G L syzkaller #0 PREEMPT(full) [ 410.461085][ T9241] Tainted: [L]=SOFTLOCKUP [ 410.461091][ T9241] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 410.461102][ T9241] Call Trace: [ 410.461108][ T9241] [ 410.461122][ T9241] dump_stack_lvl+0xe8/0x150 [ 410.461150][ T9241] should_fail_ex+0x3eb/0x540 [ 410.461172][ T9241] _copy_from_user+0x2d/0xb0 [ 410.461195][ T9241] __sys_sendto+0x2a9/0x5a0 [ 410.461216][ T9241] ? __pfx___sys_sendto+0x10/0x10 [ 410.461250][ T9241] ? __pfx___se_sys_futex+0x10/0x10 [ 410.461269][ T9241] ? rcu_is_watching+0x16/0xb0 [ 410.461290][ T9241] __x64_sys_sendto+0xde/0x100 [ 410.461309][ T9241] do_syscall_64+0x166/0x520 [ 410.461325][ T9241] ? trace_irq_disable+0x3b/0x140 [ 410.461349][ T9241] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 410.461370][ T9241] ? clear_bhb_loop+0x70/0xc0 [ 410.461391][ T9241] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 410.461408][ T9241] RIP: 0033:0x7f932819e159 [ 410.461424][ T9241] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 410.461438][ T9241] RSP: 002b:00007f93290cd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 410.461456][ T9241] RAX: ffffffffffffffda RBX: 00007f9328425fa0 RCX: 00007f932819e159 [ 410.461468][ T9241] RDX: 0000000000000001 RSI: 0000200000000080 RDI: 0000000000000004 [ 410.461479][ T9241] RBP: 00007f932823506b R08: 0000200000000140 R09: 000000000000001c [ 410.461490][ T9241] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 410.461500][ T9241] R13: 00007f9328426038 R14: 00007f9328425fa0 R15: 00007ffce34f9c08 [ 410.461524][ T9241] [ 410.467503][ T9241] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 410.468182][ T9241] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 410.511274][ T5720] usb 2-1: new high-speed USB device number 114 using dummy_hcd [ 410.709388][ T5720] usb 2-1: Using ep0 maxpacket: 16 [ 410.711044][ T5720] usb 2-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 410.712324][ T5720] usb 2-1: config 0 has an invalid interface number: 34 but max is 0 [ 410.712352][ T5720] usb 2-1: config 0 has no interface number 0 [ 410.712395][ T5720] usb 2-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 410.712428][ T5720] usb 2-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 410.714475][ T5720] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 410.714501][ T5720] usb 2-1: Product: syz [ 410.714515][ T5720] usb 2-1: Manufacturer: syz [ 410.714530][ T5720] usb 2-1: SerialNumber: syz [ 410.717050][ T5720] usb 2-1: config 0 descriptor?? [ 410.717943][ T9235] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 410.718092][ T9235] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 410.752442][ T9230] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 410.933106][ T9235] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 410.933250][ T9235] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 411.095145][ T9246] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 411.095691][ T9246] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 411.134319][ T5720] asix 2-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 411.289451][ T30] usb 1-1: new high-speed USB device number 117 using dummy_hcd [ 411.335130][ T5720] asix 2-1:0.34 (unnamed net_device) (uninitialized): invalid PHY address: 174 [ 411.442499][ T30] usb 1-1: New USB device found, idVendor=0bda, idProduct=0129, bcdDevice= 1.00 [ 411.443491][ T30] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 411.443537][ T30] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 411.443578][ T30] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 411.685372][ T30] rtsx_usb 1-1:1.0: probe with driver rtsx_usb failed with error -71 [ 411.714726][ T30] usb 1-1: USB disconnect, device number 117 [ 411.732501][ T5720] usb 4-1: new high-speed USB device number 117 using dummy_hcd [ 411.881651][ T5720] usb 4-1: unable to get BOS descriptor or descriptor too short [ 411.881711][ T5720] usb 4-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 411.882675][ T5720] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 411.882692][ T5720] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 411.884752][ T5720] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 411.884770][ T5720] usb 4-1: Product: syz [ 411.884781][ T5720] usb 4-1: Manufacturer: syz [ 411.884793][ T5720] usb 4-1: SerialNumber: syz [ 411.952656][ T5720] usb 4-1: selecting invalid altsetting 1 [ 411.953265][ T5720] usb 4-1: unit 6 not found! [ 411.991191][ T5720] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 412.023747][ T5634] udevd[5634]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 412.091306][ T10] usb 4-1: USB disconnect, device number 117 [ 413.049402][ T30] usb 4-1: new high-speed USB device number 118 using dummy_hcd [ 413.199395][ T30] usb 4-1: Using ep0 maxpacket: 32 [ 413.200130][ T30] usb 4-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 413.205289][ T30] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 413.205334][ T30] usb 4-1: Product: syz [ 413.205353][ T30] usb 4-1: Manufacturer: syz [ 413.205369][ T30] usb 4-1: SerialNumber: syz [ 413.216922][ T30] usb 4-1: config 0 descriptor?? [ 413.255394][ T30] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 413.287858][ T5720] usb 2-1: USB disconnect, device number 114 [ 413.462658][ T9287] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 413.463223][ T9287] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 413.496577][ T9269] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 413.529007][ T52] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 414.208959][ T9294] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 414.219513][ T9294] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 414.260056][ T30] gspca_ov534_9: reg_w failed -71 [ 414.309407][ T5720] usb 1-1: new high-speed USB device number 118 using dummy_hcd [ 414.460340][ T5720] usb 1-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.01 [ 414.461362][ T5720] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 414.461417][ T5720] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 414.489970][ T5720] as10x_usb: device has been detected [ 414.500663][ T5720] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan) [ 414.526500][ T5720] usb 1-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)... [ 414.549368][ T30] gspca_ov534_9: Unknown sensor 0000 [ 414.549451][ T30] ov534_9 4-1:0.0: probe with driver ov534_9 failed with error -22 [ 414.557468][ T30] usb 4-1: USB disconnect, device number 118 [ 414.626644][ T5720] as10x_usb: error during firmware upload part1 [ 414.626999][ T5720] Registered device Abilis Systems DVB-Titan [ 414.831280][ T9296] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 414.833932][ T9296] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 415.558675][ T9316] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 415.571685][ T9316] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 415.577475][ T9316] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 415.584699][ T9316] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 415.633999][ T9316] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1138'. [ 415.634039][ T9316] openvswitch: netlink: Missing key (keys=c0, expected=100) [ 416.272697][ T9325] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 416.273157][ T9325] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 416.619724][ T30] usb 4-1: new high-speed USB device number 119 using dummy_hcd [ 416.688501][ T9320] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 416.779834][ T30] usb 4-1: Using ep0 maxpacket: 16 [ 416.780703][ T30] usb 4-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 416.784382][ T30] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 416.784409][ T30] usb 4-1: Product: syz [ 416.784427][ T30] usb 4-1: Manufacturer: syz [ 416.784443][ T30] usb 4-1: SerialNumber: syz [ 417.002783][ T30] usb 4-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 417.003192][ T9331] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1143'. [ 417.032925][ T30] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 417.033415][ T30] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 417.033468][ T30] usb 4-1: media controller created [ 417.074167][ T9331] hsr_slave_0 (unregistering): left promiscuous mode [ 417.596449][ T9339] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 417.596929][ T9339] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 417.689421][ T10] usb 2-1: new high-speed USB device number 115 using dummy_hcd [ 417.839508][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 417.841976][ T10] usb 2-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 417.845742][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 417.845767][ T10] usb 2-1: Product: syz [ 417.845784][ T10] usb 2-1: Manufacturer: syz [ 417.845802][ T10] usb 2-1: SerialNumber: syz [ 417.849083][ T10] usb 2-1: config 0 descriptor?? [ 417.892049][ T10] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 419.095302][ T10] gspca_ov534_9: reg_w failed -71 [ 419.379478][ T10] gspca_ov534_9: Unknown sensor 0000 [ 419.379573][ T10] ov534_9 2-1:0.0: probe with driver ov534_9 failed with error -22 [ 419.387184][ T10] usb 2-1: USB disconnect, device number 115 [ 419.763289][ T9362] FAULT_INJECTION: forcing a failure. [ 419.763289][ T9362] name failslab, interval 1, probability 0, space 0, times 0 [ 419.763332][ T9362] CPU: 1 UID: 0 PID: 9362 Comm: syz.1.1154 Tainted: G L syzkaller #0 PREEMPT(full) [ 419.763364][ T9362] Tainted: [L]=SOFTLOCKUP [ 419.763370][ T9362] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 419.763381][ T9362] Call Trace: [ 419.763387][ T9362] [ 419.763394][ T9362] dump_stack_lvl+0xe8/0x150 [ 419.763444][ T9362] should_fail_ex+0x3eb/0x540 [ 419.763474][ T9362] should_failslab+0xa8/0x100 [ 419.763500][ T9362] __kmalloc_noprof+0xf9/0x710 [ 419.763531][ T9362] ? rcu_is_watching+0x16/0xb0 [ 419.763548][ T9362] ? tomoyo_realpath_from_path+0xef/0x640 [ 419.763587][ T9362] ? tomoyo_realpath_from_path+0xef/0x640 [ 419.763637][ T9362] tomoyo_realpath_from_path+0xef/0x640 [ 419.763679][ T9362] tomoyo_check_open_permission+0x229/0x470 [ 419.763697][ T9362] ? tomoyo_check_open_permission+0x1d3/0x470 [ 419.763714][ T9362] ? __pfx_tomoyo_check_open_permission+0x10/0x10 [ 419.763752][ T9362] ? __asan_memset+0x22/0x50 [ 419.763813][ T9362] ? mnt_get_write_access+0x66/0x280 [ 419.763847][ T9362] ? tomoyo_file_open+0x163/0x220 [ 419.763872][ T9362] security_file_open+0xa9/0x240 [ 419.763908][ T9362] do_dentry_open+0x495/0x1360 [ 419.763943][ T9362] vfs_open_consume+0x4a/0x350 [ 419.763965][ T9362] ? path_openat+0x14bb/0x1e40 [ 419.763999][ T9362] path_openat+0x14d7/0x1e40 [ 419.764051][ T9362] do_file_open+0x23e/0x4a0 [ 419.764091][ T9362] ? __pfx_do_file_open+0x10/0x10 [ 419.764146][ T9362] ? _raw_spin_unlock+0x28/0x50 [ 419.764168][ T9362] ? alloc_fd+0x651/0x6c0 [ 419.764210][ T9362] do_sys_openat2+0x115/0x200 [ 419.764239][ T9362] ? __pfx_do_sys_openat2+0x10/0x10 [ 419.764265][ T9362] ? ksys_write+0x242/0x270 [ 419.764306][ T9362] ? __pfx_ksys_write+0x10/0x10 [ 419.764331][ T9362] __x64_sys_openat+0x138/0x170 [ 419.764369][ T9362] do_syscall_64+0x166/0x520 [ 419.764392][ T9362] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 419.764414][ T9362] ? clear_bhb_loop+0x70/0xc0 [ 419.764440][ T9362] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 419.764464][ T9362] RIP: 0033:0x7f13e799e159 [ 419.764479][ T9362] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 419.764493][ T9362] RSP: 002b:00007f13e8835028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 419.764526][ T9362] RAX: ffffffffffffffda RBX: 00007f13e7c25fa0 RCX: 00007f13e799e159 [ 419.764544][ T9362] RDX: 000000000000275a RSI: 0000200000000280 RDI: ffffffffffffff9c [ 419.764560][ T9362] RBP: 00007f13e8835090 R08: 0000000000000000 R09: 0000000000000000 [ 419.764574][ T9362] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 419.764587][ T9362] R13: 00007f13e7c26038 R14: 00007f13e7c25fa0 R15: 00007ffdbdd71338 [ 419.764621][ T9362] [ 419.764628][ T9362] ERROR: Out of memory at tomoyo_realpath_from_path. [ 420.329374][ T8286] usb 2-1: new high-speed USB device number 116 using dummy_hcd [ 420.400161][ T30] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 420.424815][ T10] usb 1-1: USB disconnect, device number 118 [ 420.471390][ T30] zl10353_read_register: readreg error (reg=127, ret==-71) [ 420.487604][ T8286] usb 2-1: New USB device found, idVendor=9710, idProduct=7810, bcdDevice= 1.00 [ 420.500042][ T8286] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 420.500077][ T8286] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 420.507657][ T8286] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 420.507685][ T8286] usb 2-1: Product: syz [ 420.507702][ T8286] usb 2-1: Manufacturer: syz [ 420.513669][ T9356] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 420.538933][ T10] Unregistered device Abilis Systems DVB-Titan [ 420.563610][ T10] as10x_usb: device has been disconnected [ 420.602751][ T8286] mos7840 2-1:1.0: Moschip 7840/7820 USB Serial Driver converter detected [ 420.618615][ T30] dvb_usb_gl861 4-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 420.634085][ T30] usb 4-1: USB disconnect, device number 119 [ 420.959481][ T30] usb 4-1: new high-speed USB device number 120 using dummy_hcd [ 421.161702][ T30] usb 4-1: New USB device found, idVendor=0bda, idProduct=0129, bcdDevice= 1.00 [ 421.166348][ T30] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 421.166423][ T30] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 421.166466][ T30] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 421.221997][ T8286] mos7840 ttyUSB0: probe with driver mos7840 failed with error -71 [ 421.252730][ T8286] usb 2-1: USB disconnect, device number 116 [ 421.259683][ T8286] mos7840 2-1:1.0: device disconnected [ 421.285053][ T9378] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 421.288433][ T9378] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 421.432482][ T30] rtsx_usb 4-1:1.0: probe with driver rtsx_usb failed with error -71 [ 421.437487][ T30] usb 4-1: USB disconnect, device number 120 [ 421.646530][ T9380] FAULT_INJECTION: forcing a failure. [ 421.646530][ T9380] name failslab, interval 1, probability 0, space 0, times 0 [ 421.646556][ T9380] CPU: 1 UID: 0 PID: 9380 Comm: syz.0.1159 Tainted: G L syzkaller #0 PREEMPT(full) [ 421.646577][ T9380] Tainted: [L]=SOFTLOCKUP [ 421.646583][ T9380] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 421.646593][ T9380] Call Trace: [ 421.646599][ T9380] [ 421.646606][ T9380] dump_stack_lvl+0xe8/0x150 [ 421.646631][ T9380] should_fail_ex+0x3eb/0x540 [ 421.646655][ T9380] should_failslab+0xa8/0x100 [ 421.646674][ T9380] __kmalloc_noprof+0xf9/0x710 [ 421.646696][ T9380] ? rcu_is_watching+0x16/0xb0 [ 421.646712][ T9380] ? tomoyo_realpath_from_path+0xef/0x640 [ 421.646732][ T9380] ? tomoyo_realpath_from_path+0xef/0x640 [ 421.646757][ T9380] tomoyo_realpath_from_path+0xef/0x640 [ 421.646784][ T9380] ? tomoyo_path_number_perm+0x219/0x5f0 [ 421.646800][ T9380] tomoyo_path_number_perm+0x246/0x5f0 [ 421.646818][ T9380] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 421.646834][ T9380] ? __lock_acquire+0x747/0x2de0 [ 421.646898][ T9380] ? hook_file_ioctl+0x1f2/0x600 [ 421.646960][ T9380] ? __fget_files+0x2a/0x420 [ 421.646993][ T9380] ? __fget_files+0x2a/0x420 [ 421.647025][ T9380] ? __fget_files+0x3a2/0x420 [ 421.647044][ T9380] ? __fget_files+0x2a/0x420 [ 421.647068][ T9380] security_file_ioctl+0xc3/0x2a0 [ 421.647096][ T9380] __se_sys_ioctl+0x47/0x170 [ 421.647124][ T9380] do_syscall_64+0x166/0x520 [ 421.647139][ T9380] ? trace_irq_disable+0x3b/0x140 [ 421.647169][ T9380] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 421.647186][ T9380] ? clear_bhb_loop+0x70/0xc0 [ 421.647206][ T9380] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 421.647222][ T9380] RIP: 0033:0x7f43bdb9e159 [ 421.647237][ T9380] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 421.647252][ T9380] RSP: 002b:00007f43beb38028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 421.647269][ T9380] RAX: ffffffffffffffda RBX: 00007f43bde25fa0 RCX: 00007f43bdb9e159 [ 421.647282][ T9380] RDX: 0000200000000080 RSI: 00000000401c5820 RDI: 0000000000000003 [ 421.647292][ T9380] RBP: 00007f43beb38090 R08: 0000000000000000 R09: 0000000000000000 [ 421.647303][ T9380] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 421.647313][ T9380] R13: 00007f43bde26038 R14: 00007f43bde25fa0 R15: 00007ffc10e083f8 [ 421.647337][ T9380] [ 421.647344][ T9380] ERROR: Out of memory at tomoyo_realpath_from_path. [ 422.112005][ T9391] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 422.112493][ T9391] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 422.399560][ T8286] usb 2-1: new high-speed USB device number 117 using dummy_hcd [ 422.529493][ T8286] usb 2-1: device descriptor read/64, error -71 [ 422.766393][ T9398] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 422.766875][ T9398] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 422.780272][ T8286] usb 2-1: new high-speed USB device number 118 using dummy_hcd [ 422.797652][ T9398] kvm [9397]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x9d00 [ 422.797788][ T9398] kvm [9397]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0x9d00 [ 422.909606][ T8286] usb 2-1: device descriptor read/64, error -71 [ 422.998739][ T9393] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 423.020528][ T8286] usb usb2-port1: attempt power cycle [ 423.359794][ T8286] usb 2-1: new high-speed USB device number 119 using dummy_hcd [ 423.381420][ T8286] usb 2-1: device descriptor read/8, error -71 [ 423.598330][ T9414] tmpfs: Bad value for 'uid' [ 423.598356][ T9414] tmpfs: Bad value for 'uid' [ 423.621239][ T8286] usb 2-1: new high-speed USB device number 120 using dummy_hcd [ 423.641006][ T8286] usb 2-1: device descriptor read/8, error -71 [ 423.749677][ T8286] usb usb2-port1: unable to enumerate USB device [ 423.799437][ T989] usb 1-1: new high-speed USB device number 119 using dummy_hcd [ 423.951575][ T989] usb 1-1: unable to get BOS descriptor or descriptor too short [ 423.951614][ T989] usb 1-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 423.952575][ T989] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 423.952592][ T989] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 423.954686][ T989] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 423.954704][ T989] usb 1-1: Product: syz [ 423.954715][ T989] usb 1-1: Manufacturer: syz [ 423.954727][ T989] usb 1-1: SerialNumber: syz [ 423.969780][ T989] usb 1-1: selecting invalid altsetting 1 [ 423.973455][ T989] usb 1-1: unit 6 not found! [ 424.030315][ T5700] usb 4-1: new high-speed USB device number 121 using dummy_hcd [ 424.066150][ T989] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 424.102270][ T5634] udevd[5634]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 424.161424][ T8286] usb 1-1: USB disconnect, device number 119 [ 424.180143][ T5700] usb 4-1: New USB device found, idVendor=0bda, idProduct=0129, bcdDevice= 1.00 [ 424.182502][ T5700] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 424.182551][ T5700] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 424.182607][ T5700] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 424.380321][ T9425] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 424.381060][ T9425] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 424.408276][ T5700] rtsx_usb 4-1:1.0: probe with driver rtsx_usb failed with error -71 [ 424.428291][ T5700] usb 4-1: USB disconnect, device number 121 [ 425.076493][ T9433] sg_write: data in/out 563552/136 bytes for SCSI command 0x0-- guessing data in; [ 425.076493][ T9433] program syz.2.1178 not setting count and/or reply_len properly [ 425.320996][ T9443] input: syz0 as /devices/virtual/input/input44 [ 425.416480][ T9447] FAULT_INJECTION: forcing a failure. [ 425.416480][ T9447] name failslab, interval 1, probability 0, space 0, times 0 [ 425.416506][ T9447] CPU: 1 UID: 0 PID: 9447 Comm: syz.1.1182 Tainted: G L syzkaller #0 PREEMPT(full) [ 425.416527][ T9447] Tainted: [L]=SOFTLOCKUP [ 425.416533][ T9447] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 425.416543][ T9447] Call Trace: [ 425.416549][ T9447] [ 425.416556][ T9447] dump_stack_lvl+0xe8/0x150 [ 425.416582][ T9447] should_fail_ex+0x3eb/0x540 [ 425.416604][ T9447] should_failslab+0xa8/0x100 [ 425.416621][ T9447] ? skb_clone+0x212/0x3a0 [ 425.416640][ T9447] kmem_cache_alloc_noprof+0x9c/0x600 [ 425.416664][ T9447] ? skb_clone+0x212/0x3a0 [ 425.416686][ T9447] skb_clone+0x212/0x3a0 [ 425.416707][ T9447] __netlink_deliver_tap+0x413/0x860 [ 425.416736][ T9447] ? netlink_deliver_tap+0x2e/0x1b0 [ 425.416757][ T9447] netlink_deliver_tap+0x19c/0x1b0 [ 425.416778][ T9447] netlink_sendskb+0x68/0x140 [ 425.416798][ T9447] netlink_rcv_skb+0x2a4/0x4a0 [ 425.416818][ T9447] ? __pfx_genl_rcv_msg+0x10/0x10 [ 425.416875][ T9447] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 425.416919][ T9447] ? down_read+0x2b9/0x320 [ 425.416948][ T9447] genl_rcv+0x28/0x40 [ 425.416979][ T9447] netlink_unicast+0x7bd/0x940 [ 425.417011][ T9447] netlink_sendmsg+0x7c3/0xae0 [ 425.417047][ T9447] ? __pfx_netlink_sendmsg+0x10/0x10 [ 425.417084][ T9447] ? apparmor_socket_sendmsg+0x98/0x360 [ 425.417109][ T9447] ? __pfx_netlink_sendmsg+0x10/0x10 [ 425.417156][ T9447] sock_sendmsg_nosec+0x13a/0x180 [ 425.417191][ T9447] ____sys_sendmsg+0x54e/0x850 [ 425.417222][ T9447] ? __pfx_____sys_sendmsg+0x10/0x10 [ 425.417265][ T9447] ? import_iovec+0x73/0xa0 [ 425.417292][ T9447] ___sys_sendmsg+0x2a5/0x360 [ 425.417309][ T9447] ? __lock_acquire+0x747/0x2de0 [ 425.417337][ T9447] ? __pfx____sys_sendmsg+0x10/0x10 [ 425.417418][ T9447] ? __fget_files+0x2a/0x420 [ 425.417448][ T9447] ? __fget_files+0x3a2/0x420 [ 425.417492][ T9447] __x64_sys_sendmsg+0x1b1/0x290 [ 425.417513][ T9447] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 425.417547][ T9447] do_syscall_64+0x166/0x520 [ 425.417562][ T9447] ? trace_irq_disable+0x3b/0x140 [ 425.417586][ T9447] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 425.417603][ T9447] ? clear_bhb_loop+0x70/0xc0 [ 425.417623][ T9447] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 425.417640][ T9447] RIP: 0033:0x7f13e799e159 [ 425.417655][ T9447] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 425.417669][ T9447] RSP: 002b:00007f13e8835028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 425.417686][ T9447] RAX: ffffffffffffffda RBX: 00007f13e7c25fa0 RCX: 00007f13e799e159 [ 425.417699][ T9447] RDX: 0000000000000000 RSI: 0000200000000c00 RDI: 0000000000000005 [ 425.417709][ T9447] RBP: 00007f13e8835090 R08: 0000000000000000 R09: 0000000000000000 [ 425.417720][ T9447] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 425.417730][ T9447] R13: 00007f13e7c26038 R14: 00007f13e7c25fa0 R15: 00007ffdbdd71338 [ 425.417754][ T9447] [ 425.983334][ T9436] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 425.995988][ T8286] usb 2-1: new high-speed USB device number 121 using dummy_hcd [ 426.055045][ T9453] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 426.055738][ T9453] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 426.161353][ T8286] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 426.163709][ T8286] usb 2-1: config index 0 descriptor too short (expected 45, got 36) [ 426.163762][ T8286] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 426.163796][ T8286] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 426.163813][ T8286] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 426.163844][ T8286] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 426.167442][ T8286] usb 2-1: config 0 descriptor?? [ 426.519399][ T10] usb 1-1: new high-speed USB device number 120 using dummy_hcd [ 426.586203][ T8286] plantronics 0003:047F:FFFF.0029: reserved main item tag 0xd [ 426.603799][ T8286] plantronics 0003:047F:FFFF.0029: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 426.679743][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 426.695351][ T10] usb 1-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 426.721486][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 426.721518][ T10] usb 1-1: Product: syz [ 426.721535][ T10] usb 1-1: Manufacturer: syz [ 426.721552][ T10] usb 1-1: SerialNumber: syz [ 426.726201][ T10] usb 1-1: config 0 descriptor?? [ 426.728312][ T9457] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 426.728339][ T9457] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 426.728415][ T9457] vhci_hcd vhci_hcd.0: Device attached [ 426.774842][ T9457] vhci_hcd vhci_hcd.0: pdev(3) rhport(1) sockfd(8) [ 426.774925][ T9457] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 426.775052][ T9457] vhci_hcd vhci_hcd.0: Device attached [ 426.801203][ T10] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 426.829803][ T9457] vhci_hcd vhci_hcd.0: pdev(3) rhport(2) sockfd(10) [ 426.829834][ T9457] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 426.829929][ T9457] vhci_hcd vhci_hcd.0: Device attached [ 426.830720][ T9466] vhci_hcd: connection closed [ 426.831688][ T6943] vhci_hcd vhci_hcd.3: stop threads [ 426.831842][ T6943] vhci_hcd vhci_hcd.3: release socket [ 426.831867][ T6943] vhci_hcd vhci_hcd.3: disconnect device [ 426.832044][ T9462] vhci_hcd: connection closed [ 426.832368][ T6943] vhci_hcd vhci_hcd.3: stop threads [ 426.832388][ T6943] vhci_hcd vhci_hcd.3: release socket [ 426.832410][ T6943] vhci_hcd vhci_hcd.3: disconnect device [ 426.832768][ T9460] vhci_hcd: connection closed [ 426.833190][ T6943] vhci_hcd vhci_hcd.3: stop threads [ 426.833222][ T6943] vhci_hcd vhci_hcd.3: release socket [ 426.833243][ T6943] vhci_hcd vhci_hcd.3: disconnect device [ 426.923790][ T8286] usb 2-1: USB disconnect, device number 121 [ 426.994426][ T9465] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 426.995087][ T9465] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 427.743606][ T9478] openvswitch: netlink: Message has 8 unknown bytes. [ 427.984535][ T10] gspca_ov534_9: reg_w failed -71 [ 428.269457][ T10] gspca_ov534_9: Unknown sensor 0000 [ 428.269550][ T10] ov534_9 1-1:0.0: probe with driver ov534_9 failed with error -22 [ 428.272485][ T10] usb 1-1: USB disconnect, device number 120 [ 428.376620][ T9491] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 428.377358][ T9491] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 428.831395][ T9483] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 429.024825][ T9500] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 429.025338][ T9500] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 429.047410][ T5700] usb 1-1: new high-speed USB device number 121 using dummy_hcd [ 429.169386][ T5700] usb 1-1: device descriptor read/64, error -71 [ 429.367992][ T9503] FAULT_INJECTION: forcing a failure. [ 429.367992][ T9503] name failslab, interval 1, probability 0, space 0, times 0 [ 429.368018][ T9503] CPU: 0 UID: 0 PID: 9503 Comm: syz.1.1201 Tainted: G L syzkaller #0 PREEMPT(full) [ 429.368040][ T9503] Tainted: [L]=SOFTLOCKUP [ 429.368046][ T9503] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 429.368057][ T9503] Call Trace: [ 429.368063][ T9503] [ 429.368071][ T9503] dump_stack_lvl+0xe8/0x150 [ 429.368096][ T9503] should_fail_ex+0x3eb/0x540 [ 429.368121][ T9503] should_failslab+0xa8/0x100 [ 429.368139][ T9503] ? __kernfs_new_node+0xe6/0x980 [ 429.368164][ T9503] kmem_cache_alloc_noprof+0x9c/0x600 [ 429.368194][ T9503] ? kstrdup+0x81/0x100 [ 429.368218][ T9503] ? __kernfs_new_node+0xe6/0x980 [ 429.368247][ T9503] __kernfs_new_node+0xe6/0x980 [ 429.368278][ T9503] ? __pfx___kernfs_new_node+0x10/0x10 [ 429.368302][ T9503] ? kernfs_root+0x1c/0x230 [ 429.368329][ T9503] ? kernfs_root+0x1c/0x230 [ 429.368352][ T9503] ? kernfs_root+0x1c/0x230 [ 429.368378][ T9503] kernfs_new_node+0xea/0x140 [ 429.368405][ T9503] kernfs_create_link+0xa7/0x200 [ 429.368427][ T9503] sysfs_do_create_link_sd+0x83/0x110 [ 429.368452][ T9503] driver_sysfs_add+0x89/0x210 [ 429.368474][ T9503] really_probe+0x142/0xae0 [ 429.368499][ T9503] __driver_probe_device+0x1e8/0x360 [ 429.368522][ T9503] driver_probe_device+0x4f/0x240 [ 429.368546][ T9503] __driver_attach+0x339/0x600 [ 429.368568][ T9503] bus_for_each_dev+0x23b/0x2c0 [ 429.368584][ T9503] ? __pfx___driver_attach+0x10/0x10 [ 429.368604][ T9503] ? __pfx_bus_for_each_dev+0x10/0x10 [ 429.368622][ T9503] ? do_raw_spin_unlock+0xf5/0x200 [ 429.368644][ T9503] bus_add_driver+0x345/0x670 [ 429.368667][ T9503] driver_register+0x23a/0x320 [ 429.368695][ T9503] usb_gadget_register_driver_owner+0xf9/0x270 [ 429.368719][ T9503] raw_ioctl+0x1541/0x41c0 [ 429.368740][ T9503] ? tomoyo_path_number_perm+0x219/0x5f0 [ 429.368759][ T9503] ? do_vfs_ioctl+0x116f/0x1530 [ 429.368776][ T9503] ? __pfx_raw_ioctl+0x10/0x10 [ 429.368800][ T9503] ? hook_file_ioctl+0x1f2/0x600 [ 429.368832][ T9503] ? __fget_files+0x2a/0x420 [ 429.368855][ T9503] ? __fget_files+0x2a/0x420 [ 429.368873][ T9503] ? __fget_files+0x3a2/0x420 [ 429.368892][ T9503] ? __fget_files+0x2a/0x420 [ 429.368915][ T9503] ? bpf_lsm_file_ioctl+0x9/0x20 [ 429.368935][ T9503] ? __pfx_raw_ioctl+0x10/0x10 [ 429.368950][ T9503] __se_sys_ioctl+0xfc/0x170 [ 429.368976][ T9503] do_syscall_64+0x166/0x520 [ 429.368990][ T9503] ? trace_irq_disable+0x3b/0x140 [ 429.369013][ T9503] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 429.369029][ T9503] ? clear_bhb_loop+0x70/0xc0 [ 429.369048][ T9503] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 429.369064][ T9503] RIP: 0033:0x7f13e799ddeb [ 429.369078][ T9503] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 429.369092][ T9503] RSP: 002b:00007f13e8832f00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 429.369109][ T9503] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00007f13e799ddeb [ 429.369120][ T9503] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000006 [ 429.369130][ T9503] RBP: 00007f13e8833fd0 R08: 0000000000000001 R09: 00000000ffffffff [ 429.369140][ T9503] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 429.369150][ T9503] R13: 0000200000000000 R14: 0000000000000000 R15: 0000000000000000 [ 429.369179][ T9503] [ 429.418247][ T5700] usb 1-1: new high-speed USB device number 122 using dummy_hcd [ 429.418300][ T9503] raw-gadget.2 gadget.1: really_probe: driver_sysfs_add failed [ 429.428253][ T9503] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 429.454130][ T9503] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 429.564123][ T5700] usb 1-1: device descriptor read/64, error -71 [ 429.692856][ T5700] usb usb1-port1: attempt power cycle [ 430.102878][ T5700] usb 1-1: new high-speed USB device number 123 using dummy_hcd [ 430.122767][ T5700] usb 1-1: device descriptor read/8, error -71 [ 430.176167][ T9523] xt_hashlimit: size too large, truncated to 1048576 [ 430.176242][ T9523] xt_hashlimit: max too large, truncated to 1048576 [ 430.176300][ T9523] xt_hashlimit: Unknown mode mask 4718EC78, kernel too old? [ 430.359760][ T5700] usb 1-1: new high-speed USB device number 124 using dummy_hcd [ 430.375469][ T9529] device-mapper: table: 248:0: integrity: Invalid argument count (-EINVAL) [ 430.375495][ T9529] device-mapper: ioctl: error adding target to table [ 430.396008][ T5700] usb 1-1: device descriptor read/8, error -71 [ 430.419642][ T5720] usb 2-1: new high-speed USB device number 122 using dummy_hcd [ 430.468569][ T9535] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 430.481419][ T9535] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 430.499660][ T5700] usb usb1-port1: unable to enumerate USB device [ 430.569743][ T5720] usb 2-1: Using ep0 maxpacket: 32 [ 430.570573][ T5720] usb 2-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 430.574746][ T5720] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 430.574773][ T5720] usb 2-1: Product: syz [ 430.574789][ T5720] usb 2-1: Manufacturer: syz [ 430.574806][ T5720] usb 2-1: SerialNumber: syz [ 430.578105][ T5720] usb 2-1: config 0 descriptor?? [ 430.623829][ T5720] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 431.621658][ T5720] gspca_ov534_9: reg_w failed -71 [ 431.939834][ T5720] gspca_ov534_9: Unknown sensor 0000 [ 431.939925][ T5720] ov534_9 2-1:0.0: probe with driver ov534_9 failed with error -22 [ 431.946428][ T5720] usb 2-1: USB disconnect, device number 122 [ 432.013529][ T9557] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 432.289392][ T6227] usb 1-1: new high-speed USB device number 125 using dummy_hcd [ 432.440169][ T6227] usb 1-1: New USB device found, idVendor=0bda, idProduct=0129, bcdDevice= 1.00 [ 432.441334][ T6227] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 432.441391][ T6227] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 432.441436][ T6227] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 432.653420][ T6227] rtsx_usb 1-1:1.0: probe with driver rtsx_usb failed with error -71 [ 432.682985][ T6227] usb 1-1: USB disconnect, device number 125 [ 432.821980][ T9607] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 432.823543][ T9607] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 432.893145][ T9611] FAULT_INJECTION: forcing a failure. [ 432.893145][ T9611] name failslab, interval 1, probability 0, space 0, times 0 [ 432.893174][ T9611] CPU: 1 UID: 0 PID: 9611 Comm: syz.3.1219 Tainted: G L syzkaller #0 PREEMPT(full) [ 432.893196][ T9611] Tainted: [L]=SOFTLOCKUP [ 432.893202][ T9611] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 432.893212][ T9611] Call Trace: [ 432.893219][ T9611] [ 432.893226][ T9611] dump_stack_lvl+0xe8/0x150 [ 432.893252][ T9611] should_fail_ex+0x3eb/0x540 [ 432.893275][ T9611] should_failslab+0xa8/0x100 [ 432.893293][ T9611] ? sk_prot_alloc+0x57/0x210 [ 432.893319][ T9611] kmem_cache_alloc_noprof+0x9c/0x600 [ 432.893342][ T9611] ? trace_kmem_cache_alloc+0x29/0xe0 [ 432.893365][ T9611] ? sk_prot_alloc+0x57/0x210 [ 432.893387][ T9611] sk_prot_alloc+0x57/0x210 [ 432.893406][ T9611] sk_clone+0x7c/0x1080 [ 432.893430][ T9611] sctp_clone_sock+0x31/0x1680 [ 432.893457][ T9611] ? security_socket_post_create+0x83/0x330 [ 432.893485][ T9611] ? sock_create_lite+0x2e4/0x4e0 [ 432.893524][ T9611] sctp_getsockopt_peeloff_common+0x3dd/0x7e0 [ 432.893555][ T9611] ? __pfx_sctp_getsockopt_peeloff_common+0x10/0x10 [ 432.893583][ T9611] ? __might_fault+0xaf/0x130 [ 432.893627][ T9611] sctp_getsockopt_peeloff_flags+0x14b/0x240 [ 432.893652][ T9611] ? __pfx_sctp_getsockopt_peeloff_flags+0x10/0x10 [ 432.893673][ T9611] ? sctp_getsockopt+0x12f/0xb90 [ 432.893699][ T9611] ? __local_bh_enable_ip+0xd6/0x140 [ 432.893722][ T9611] sctp_getsockopt+0x3a5/0xb90 [ 432.893746][ T9611] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 432.893771][ T9611] do_sock_getsockopt+0x51d/0x7e0 [ 432.893794][ T9611] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 432.893826][ T9611] ? __fget_files+0x3a2/0x420 [ 432.893848][ T9611] ? __fget_files+0x2a/0x420 [ 432.893874][ T9611] __x64_sys_getsockopt+0x1a4/0x240 [ 432.893898][ T9611] do_syscall_64+0x166/0x520 [ 432.893913][ T9611] ? trace_irq_disable+0x3b/0x140 [ 432.893938][ T9611] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 432.893956][ T9611] ? clear_bhb_loop+0x70/0xc0 [ 432.893976][ T9611] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 432.893992][ T9611] RIP: 0033:0x7fafec19e159 [ 432.894007][ T9611] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 432.894022][ T9611] RSP: 002b:00007fafed04c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 432.894039][ T9611] RAX: ffffffffffffffda RBX: 00007fafec425fa0 RCX: 00007fafec19e159 [ 432.894071][ T9611] RDX: 000000000000007a RSI: 0000000000000084 RDI: 0000000000000003 [ 432.894088][ T9611] RBP: 00007fafec23506b R08: 0000200000000040 R09: 0000000000000000 [ 432.894104][ T9611] R10: 0000200000000340 R11: 0000000000000246 R12: 0000000000000000 [ 432.894119][ T9611] R13: 00007fafec426038 R14: 00007fafec425fa0 R15: 00007ffd3fdd8f68 [ 432.894154][ T9611] [ 433.389445][ T6227] usb 4-1: new high-speed USB device number 122 using dummy_hcd [ 433.414358][ T9617] syz.0.1221 (9617): attempted to duplicate a private mapping with mremap. This is not supported. [ 433.561321][ T6227] usb 4-1: Using ep0 maxpacket: 32 [ 433.563600][ T6227] usb 4-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 433.567052][ T6227] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 433.567081][ T6227] usb 4-1: Product: syz [ 433.567097][ T6227] usb 4-1: Manufacturer: syz [ 433.567113][ T6227] usb 4-1: SerialNumber: syz [ 433.569906][ T6227] usb 4-1: config 0 descriptor?? [ 433.615770][ T6227] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 434.083247][ T9637] rust_binder: 9636:9637 no such ref 0 [ 434.385979][ T9647] gadgetfs: bound to dummy_udc driver [ 434.438847][ T9621] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 434.471369][ T5623] overlayfs: failed lookup in lower (newroot/313, name='bus', err=-40): overlapping layers [ 434.471602][ T5623] overlayfs: failed lookup in lower (newroot/313, name='bus', err=-40): overlapping layers [ 434.633662][ T6227] gspca_ov534_9: reg_w failed -71 [ 434.929751][ T6227] gspca_ov534_9: Unknown sensor 0000 [ 434.929854][ T6227] ov534_9 4-1:0.0: probe with driver ov534_9 failed with error -22 [ 434.936203][ T6227] usb 4-1: USB disconnect, device number 122 [ 434.970711][ T9650] 9p: Bad value for 'wfdno' [ 434.975530][ T9650] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 434.975994][ T9650] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 435.098306][ T5617] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 435.109164][ T5617] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 435.119590][ T5617] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 435.121288][ T5617] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 435.122679][ T5617] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 435.216316][ T9655] gadgetfs: bound to dummy_udc driver [ 435.396266][ T9662] FAULT_INJECTION: forcing a failure. [ 435.396266][ T9662] name failslab, interval 1, probability 0, space 0, times 0 [ 435.396305][ T9662] CPU: 1 UID: 0 PID: 9662 Comm: syz.0.1236 Tainted: G L syzkaller #0 PREEMPT(full) [ 435.396336][ T9662] Tainted: [L]=SOFTLOCKUP [ 435.396346][ T9662] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 435.396361][ T9662] Call Trace: [ 435.396371][ T9662] [ 435.396381][ T9662] dump_stack_lvl+0xe8/0x150 [ 435.396417][ T9662] should_fail_ex+0x3eb/0x540 [ 435.396449][ T9662] should_failslab+0xa8/0x100 [ 435.396477][ T9662] __kmalloc_cache_noprof+0x9e/0x600 [ 435.396513][ T9662] ? vep_alloc_request+0x81/0x140 [ 435.396547][ T9662] ? vep_alloc_request+0x81/0x140 [ 435.396588][ T9662] vep_alloc_request+0x81/0x140 [ 435.396626][ T9662] usb_ep_alloc_request+0x67/0x280 [ 435.396655][ T9662] composite_dev_prepare+0x71/0x320 [ 435.396688][ T9662] configfs_composite_bind+0xa5/0x1410 [ 435.396720][ T9662] ? kernfs_put+0x7b9/0x820 [ 435.396757][ T9662] ? __pfx_configfs_composite_bind+0x10/0x10 [ 435.396782][ T9662] gadget_bind_driver+0x2ca/0x9e0 [ 435.396827][ T9662] ? __pfx_gadget_bind_driver+0x10/0x10 [ 435.396856][ T9662] really_probe+0x254/0xae0 [ 435.396894][ T9662] __driver_probe_device+0x1e8/0x360 [ 435.396930][ T9662] driver_probe_device+0x4f/0x240 [ 435.396967][ T9662] __driver_attach+0x339/0x600 [ 435.397001][ T9662] bus_for_each_dev+0x23b/0x2c0 [ 435.397025][ T9662] ? __pfx___driver_attach+0x10/0x10 [ 435.397055][ T9662] ? __pfx_bus_for_each_dev+0x10/0x10 [ 435.397093][ T9662] ? do_raw_spin_unlock+0xf5/0x200 [ 435.397128][ T9662] bus_add_driver+0x345/0x670 [ 435.397162][ T9662] driver_register+0x23a/0x320 [ 435.397203][ T9662] usb_gadget_register_driver_owner+0xf9/0x270 [ 435.397284][ T9662] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 435.397318][ T9662] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10 [ 435.397355][ T9662] configfs_write_iter+0x337/0x430 [ 435.397397][ T9662] vfs_write+0x612/0xba0 [ 435.397441][ T9662] ? __pfx_vfs_write+0x10/0x10 [ 435.397485][ T9662] ? __fget_files+0x2a/0x420 [ 435.397526][ T9662] ksys_write+0x150/0x270 [ 435.397563][ T9662] ? __pfx_ksys_write+0x10/0x10 [ 435.397609][ T9662] do_syscall_64+0x166/0x520 [ 435.397632][ T9662] ? trace_irq_disable+0x3b/0x140 [ 435.397665][ T9662] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 435.397690][ T9662] ? clear_bhb_loop+0x70/0xc0 [ 435.397719][ T9662] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 435.397743][ T9662] RIP: 0033:0x7f43bdb9e159 [ 435.397765][ T9662] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 435.397786][ T9662] RSP: 002b:00007f43beb38028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 435.397812][ T9662] RAX: ffffffffffffffda RBX: 00007f43bde25fa0 RCX: 00007f43bdb9e159 [ 435.397830][ T9662] RDX: 000000000000000c RSI: 0000200000000480 RDI: 0000000000000003 [ 435.397845][ T9662] RBP: 00007f43beb38090 R08: 0000000000000000 R09: 0000000000000000 [ 435.397861][ T9662] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 435.397875][ T9662] R13: 00007f43bde26038 R14: 00007f43bde25fa0 R15: 00007ffc10e083f8 [ 435.397914][ T9662] [ 435.443029][ T9662] udc usbip-vudc.0: failed to start g1: -12 [ 435.443058][ T9662] configfs-gadget.g1 gadget.32: probe with driver configfs-gadget.g1 failed with error -12 [ 435.763938][ T9666] FAULT_INJECTION: forcing a failure. [ 435.763938][ T9666] name failslab, interval 1, probability 0, space 0, times 0 [ 435.763974][ T9666] CPU: 0 UID: 0 PID: 9666 Comm: syz.3.1237 Tainted: G L syzkaller #0 PREEMPT(full) [ 435.764006][ T9666] Tainted: [L]=SOFTLOCKUP [ 435.764015][ T9666] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 435.764029][ T9666] Call Trace: [ 435.764039][ T9666] [ 435.764049][ T9666] dump_stack_lvl+0xe8/0x150 [ 435.764085][ T9666] should_fail_ex+0x3eb/0x540 [ 435.764116][ T9666] should_failslab+0xa8/0x100 [ 435.764157][ T9666] __kmalloc_cache_noprof+0x9e/0x600 [ 435.764192][ T9666] ? __kmalloc_cache_noprof+0x148/0x600 [ 435.764225][ T9666] ? kvm_arch_vcpu_create+0x2e2/0x8a0 [ 435.764270][ T9666] ? kvm_arch_vcpu_create+0x2e2/0x8a0 [ 435.764309][ T9666] kvm_arch_vcpu_create+0x2e2/0x8a0 [ 435.764346][ T9666] kvm_vm_ioctl_create_vcpu+0x29a/0x720 [ 435.764386][ T9666] kvm_vm_ioctl+0x886/0xd30 [ 435.764418][ T9666] ? __pfx_kvm_vm_ioctl+0x10/0x10 [ 435.764467][ T9666] ? kasan_quarantine_put+0xbb/0x1f0 [ 435.764510][ T9666] ? tomoyo_path_number_perm+0x219/0x5f0 [ 435.764536][ T9666] ? tomoyo_path_number_perm+0x219/0x5f0 [ 435.764562][ T9666] ? do_vfs_ioctl+0x116f/0x1530 [ 435.764587][ T9666] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 435.764622][ T9666] ? hook_file_ioctl+0x1f2/0x600 [ 435.764667][ T9666] ? __fget_files+0x2a/0x420 [ 435.764698][ T9666] ? __fget_files+0x2a/0x420 [ 435.764725][ T9666] ? __fget_files+0x3a2/0x420 [ 435.764751][ T9666] ? __fget_files+0x2a/0x420 [ 435.764801][ T9666] ? bpf_lsm_file_ioctl+0x9/0x20 [ 435.764831][ T9666] ? __pfx_kvm_vm_ioctl+0x10/0x10 [ 435.764861][ T9666] __se_sys_ioctl+0xfc/0x170 [ 435.764899][ T9666] do_syscall_64+0x166/0x520 [ 435.764922][ T9666] ? trace_irq_disable+0x3b/0x140 [ 435.764954][ T9666] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 435.764979][ T9666] ? clear_bhb_loop+0x70/0xc0 [ 435.765008][ T9666] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 435.765032][ T9666] RIP: 0033:0x7fafec19e159 [ 435.765054][ T9666] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 435.765074][ T9666] RSP: 002b:00007fafed04c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 435.765099][ T9666] RAX: ffffffffffffffda RBX: 00007fafec425fa0 RCX: 00007fafec19e159 [ 435.765124][ T9666] RDX: 0000000000000002 RSI: 000000000000ae41 RDI: 0000000000000004 [ 435.765140][ T9666] RBP: 00007fafed04c090 R08: 0000000000000000 R09: 0000000000000000 [ 435.765155][ T9666] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 435.765170][ T9666] R13: 00007fafec426038 R14: 00007fafec425fa0 R15: 00007ffd3fdd8f68 [ 435.765205][ T9666] [ 436.047254][ T9662] UDC core: g1: couldn't find an available UDC or it's busy [ 436.136867][ T9671] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 436.138932][ T9671] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 436.557397][ T9651] bridge0: port 1(bridge_slave_0) entered blocking state [ 436.557540][ T9651] bridge0: port 1(bridge_slave_0) entered disabled state [ 436.557818][ T9651] bridge_slave_0: entered allmulticast mode [ 436.560851][ T9651] bridge_slave_0: entered promiscuous mode [ 436.569829][ T9651] bridge0: port 2(bridge_slave_1) entered blocking state [ 436.570102][ T9651] bridge0: port 2(bridge_slave_1) entered disabled state [ 436.570502][ T9651] bridge_slave_1: entered allmulticast mode [ 436.575385][ T9651] bridge_slave_1: entered promiscuous mode [ 436.614019][ T5720] usb 1-1: new high-speed USB device number 126 using dummy_hcd [ 436.642432][ T9651] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 436.645419][ T9651] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 436.684654][ T9651] team0: Port device team_slave_0 added [ 436.687115][ T9651] team0: Port device team_slave_1 added [ 436.720752][ T9651] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 436.720774][ T9651] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 436.720803][ T9651] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 436.722359][ T9651] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 436.722381][ T9651] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 436.722402][ T9651] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 436.774344][ T5720] usb 1-1: New USB device found, idVendor=0bda, idProduct=0129, bcdDevice= 1.00 [ 436.812868][ T5720] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 436.813006][ T5720] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 436.813102][ T5720] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 436.904350][ T9651] hsr_slave_0: entered promiscuous mode [ 436.905570][ T9651] hsr_slave_1: entered promiscuous mode [ 436.906435][ T9651] debugfs: 'hsr0' already exists in 'hsr' [ 436.906457][ T9651] Cannot create hsr debugfs directory [ 437.067300][ T5720] rtsx_usb 1-1:1.0: probe with driver rtsx_usb failed with error -71 [ 437.087345][ T5720] usb 1-1: USB disconnect, device number 126 [ 437.167262][ T9679] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 437.184000][ T5617] Bluetooth: hci2: command tx timeout [ 437.237637][ T9651] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 437.248577][ T9651] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 437.257279][ T9651] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 437.268538][ T9651] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 437.276757][ T9651] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 437.286785][ T9651] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 437.287739][ T9651] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 437.305128][ T9651] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 437.334036][ T9651] bridge0: port 2(bridge_slave_1) entered blocking state [ 437.334123][ T9651] bridge0: port 2(bridge_slave_1) entered forwarding state [ 437.334300][ T9651] bridge0: port 1(bridge_slave_0) entered blocking state [ 437.334399][ T9651] bridge0: port 1(bridge_slave_0) entered forwarding state [ 437.414445][ T9651] 8021q: adding VLAN 0 to HW filter on device bond0 [ 437.434023][ T59] bridge0: port 1(bridge_slave_0) entered disabled state [ 437.434696][ T59] bridge0: port 2(bridge_slave_1) entered disabled state [ 437.456261][ T9651] 8021q: adding VLAN 0 to HW filter on device team0 [ 437.467773][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 437.467864][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 437.485914][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 437.485988][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 437.985647][ T9651] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 438.041518][ T5693] usb 4-1: new high-speed USB device number 123 using dummy_hcd [ 438.199480][ T5693] usb 4-1: Using ep0 maxpacket: 32 [ 438.200214][ T5693] usb 4-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 438.203867][ T5693] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 438.203893][ T5693] usb 4-1: Product: syz [ 438.203908][ T5693] usb 4-1: Manufacturer: syz [ 438.203924][ T5693] usb 4-1: SerialNumber: syz [ 438.208537][ T5693] usb 4-1: config 0 descriptor?? [ 438.261389][ T5693] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 438.414866][ T9651] veth0_vlan: entered promiscuous mode [ 438.450009][ T9651] veth1_vlan: entered promiscuous mode [ 438.531733][ T9651] veth0_macvtap: entered promiscuous mode [ 438.537004][ T9651] veth1_macvtap: entered promiscuous mode [ 438.575787][ T9651] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 438.594779][ T9651] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 438.672585][ T6933] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 438.672944][ T43] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 438.672988][ T43] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 438.673056][ T43] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 438.804722][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 438.804747][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 438.866931][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 438.866955][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 439.259513][ T5617] Bluetooth: hci2: command tx timeout [ 439.364163][ T5693] gspca_ov534_9: reg_w failed -71 [ 439.827075][ T50] IPVS: starting estimator thread 0... [ 439.869633][ T5693] gspca_ov534_9: Unknown sensor 0000 [ 439.869711][ T5693] ov534_9 4-1:0.0: probe with driver ov534_9 failed with error -22 [ 439.872156][ T5693] usb 4-1: USB disconnect, device number 123 [ 439.919393][ T9745] IPVS: using max 27 ests per chain, 64800 per kthread [ 440.126837][ T9736] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 440.144294][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.144350][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.549441][ T6227] usb 4-1: new high-speed USB device number 124 using dummy_hcd [ 440.704547][ T6227] usb 4-1: New USB device found, idVendor=0bda, idProduct=0129, bcdDevice= 1.00 [ 440.709706][ T6227] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 440.709853][ T6227] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 440.709974][ T6227] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 440.968612][ T6227] rtsx_usb 4-1:1.0: probe with driver rtsx_usb failed with error -71 [ 441.016021][ T6227] usb 4-1: USB disconnect, device number 124 [ 441.061312][ T9755] netlink: 'syz.2.1254': attribute type 89 has an invalid length. [ 441.340923][ T5617] Bluetooth: hci2: command tx timeout [ 441.527740][ T9765] FAULT_INJECTION: forcing a failure. [ 441.527740][ T9765] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 441.527777][ T9765] CPU: 0 UID: 0 PID: 9765 Comm: syz.2.1256 Tainted: G L syzkaller #0 PREEMPT(full) [ 441.527807][ T9765] Tainted: [L]=SOFTLOCKUP [ 441.527816][ T9765] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 441.527830][ T9765] Call Trace: [ 441.527839][ T9765] [ 441.527850][ T9765] dump_stack_lvl+0xe8/0x150 [ 441.527884][ T9765] should_fail_ex+0x3eb/0x540 [ 441.527916][ T9765] _copy_from_user+0x2d/0xb0 [ 441.527946][ T9765] __copy_msghdr+0x390/0x590 [ 441.527977][ T9765] ___sys_sendmsg+0x213/0x360 [ 441.528002][ T9765] ? __lock_acquire+0x747/0x2de0 [ 441.528040][ T9765] ? __pfx____sys_sendmsg+0x10/0x10 [ 441.528099][ T9765] ? __fget_files+0x2a/0x420 [ 441.528128][ T9765] ? __fget_files+0x3a2/0x420 [ 441.528167][ T9765] __x64_sys_sendmsg+0x1b1/0x290 [ 441.528195][ T9765] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 441.528242][ T9765] do_syscall_64+0x166/0x520 [ 441.528263][ T9765] ? trace_irq_disable+0x3b/0x140 [ 441.528294][ T9765] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 441.528317][ T9765] ? clear_bhb_loop+0x70/0xc0 [ 441.528345][ T9765] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 441.528369][ T9765] RIP: 0033:0x7f932819e159 [ 441.528390][ T9765] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 441.528409][ T9765] RSP: 002b:00007f93290ac028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 441.528435][ T9765] RAX: ffffffffffffffda RBX: 00007f9328426090 RCX: 00007f932819e159 [ 441.528452][ T9765] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000005 [ 441.528467][ T9765] RBP: 00007f93290ac090 R08: 0000000000000000 R09: 0000000000000000 [ 441.528481][ T9765] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 441.528496][ T9765] R13: 00007f9328426128 R14: 00007f9328426090 R15: 00007ffce34f9c08 [ 441.528530][ T9765] [ 442.854113][ T50] IPVS: starting estimator thread 0... [ 442.940633][ T9780] IPVS: using max 26 ests per chain, 62400 per kthread [ 443.120098][ T30] usb 4-1: new high-speed USB device number 125 using dummy_hcd [ 443.273086][ T30] usb 4-1: Using ep0 maxpacket: 32 [ 443.273892][ T30] usb 4-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 443.299226][ T30] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 443.299414][ T30] usb 4-1: Product: syz [ 443.299450][ T30] usb 4-1: Manufacturer: syz [ 443.299467][ T30] usb 4-1: SerialNumber: syz [ 443.308337][ T30] usb 4-1: config 0 descriptor?? [ 443.391929][ T30] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 443.419988][ T5617] Bluetooth: hci2: command tx timeout [ 443.761758][ T12] IPVS: stop unused estimator thread 0... [ 444.448137][ T30] gspca_ov534_9: reg_w failed -71 [ 444.494672][ T9787] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 444.529461][ T5700] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 444.680177][ T5700] usb 5-1: New USB device found, idVendor=0bda, idProduct=0129, bcdDevice= 1.00 [ 444.681558][ T5700] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 444.681616][ T5700] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 444.681668][ T5700] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 444.729677][ T30] gspca_ov534_9: Unknown sensor 0000 [ 444.730040][ T30] ov534_9 4-1:0.0: probe with driver ov534_9 failed with error -22 [ 444.754213][ T30] usb 4-1: USB disconnect, device number 125 [ 444.890736][ T5700] rtsx_usb 5-1:1.0: probe with driver rtsx_usb failed with error -71 [ 444.913247][ T5700] usb 5-1: USB disconnect, device number 2 [ 445.350093][ T5700] usb 4-1: new high-speed USB device number 126 using dummy_hcd [ 445.479399][ T5700] usb 4-1: device descriptor read/64, error -71 [ 445.719370][ T5700] usb 4-1: new high-speed USB device number 127 using dummy_hcd [ 445.827576][ T9812] Mount JFS Failure: -22 [ 445.849365][ T5700] usb 4-1: device descriptor read/64, error -71 [ 445.962429][ T5700] usb usb4-port1: attempt power cycle [ 446.299456][ T5700] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 446.320099][ T5700] usb 4-1: device descriptor read/8, error -71 [ 446.467572][ T9827] rust_binder: Failed to get security ctx for id 0: EINVAL [ 446.467612][ T9827] rust_binder: Failure in copy_transaction_data: EINVAL [ 446.467652][ T9827] rust_binder: 9826:9827 transaction async to 9826:0 failed EINVAL, code 0 size 0-0 [ 446.560118][ T5700] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 446.580187][ T5700] usb 4-1: device descriptor read/8, error -71 [ 446.693376][ T5700] usb usb4-port1: unable to enumerate USB device [ 446.749387][ T30] usb 5-1: new full-speed USB device number 3 using dummy_hcd [ 446.835898][ T9837] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 446.845317][ T9837] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 446.910083][ T30] usb 5-1: not running at top speed; connect to a high speed hub [ 446.910122][ T30] usb 5-1: New USB device found, idVendor=1df7, idProduct=2500, bcdDevice= 0.00 [ 446.911315][ T30] usb 5-1: config index 0 descriptor too short (expected 43, got 25) [ 446.911343][ T30] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 446.915044][ T30] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 446.915071][ T30] usb 5-1: Product: syz [ 446.915088][ T30] usb 5-1: Manufacturer: syz [ 447.246077][ T5700] rust_binder: 9826: undelivered TRANSACTION_ERROR: 29201 [ 447.355659][ T30] msi2500 5-1:1.0: Registered as swradio24 [ 447.355684][ T30] msi2500 5-1:1.0: SDR API is still slightly experimental and functionality changes may follow [ 447.377111][ T30] usb 5-1: USB disconnect, device number 3 [ 448.171354][ T5693] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 448.330073][ T5693] usb 5-1: Using ep0 maxpacket: 32 [ 448.330860][ T5693] usb 5-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 448.334420][ T5693] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 448.334448][ T5693] usb 5-1: Product: syz [ 448.334466][ T5693] usb 5-1: Manufacturer: syz [ 448.334482][ T5693] usb 5-1: SerialNumber: syz [ 448.338693][ T5693] usb 5-1: config 0 descriptor?? [ 448.385509][ T5693] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 448.549416][ T5721] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 448.722017][ T5721] usb 4-1: New USB device found, idVendor=0bda, idProduct=0129, bcdDevice= 1.00 [ 448.723562][ T5721] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 448.723710][ T5721] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 448.723757][ T5721] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 448.931937][ T5721] rtsx_usb 4-1:1.0: probe with driver rtsx_usb failed with error -71 [ 448.956551][ T9860] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 448.973581][ T5721] usb 4-1: USB disconnect, device number 4 [ 449.417137][ T5693] gspca_ov534_9: reg_w failed -71 [ 449.551887][ T9871] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 449.552388][ T9871] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 449.557839][ T9871] comedi comedi4: bad chanlist[0]=0x04080003 chan=3 range length=2 [ 449.669503][ T9873] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1280'. [ 449.752404][ T5693] gspca_ov534_9: Unknown sensor 0000 [ 449.752489][ T5693] ov534_9 5-1:0.0: probe with driver ov534_9 failed with error -22 [ 449.775189][ T5693] usb 5-1: USB disconnect, device number 4 [ 450.193038][ T9883] FAULT_INJECTION: forcing a failure. [ 450.193038][ T9883] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 450.193075][ T9883] CPU: 1 UID: 0 PID: 9883 Comm: syz.2.1282 Tainted: G L syzkaller #0 PREEMPT(full) [ 450.193105][ T9883] Tainted: [L]=SOFTLOCKUP [ 450.193114][ T9883] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 450.193128][ T9883] Call Trace: [ 450.193137][ T9883] [ 450.193148][ T9883] dump_stack_lvl+0xe8/0x150 [ 450.193183][ T9883] should_fail_ex+0x3eb/0x540 [ 450.193215][ T9883] prepare_alloc_pages+0x21e/0x5f0 [ 450.193258][ T9883] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 450.193308][ T9883] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 450.193362][ T9883] alloc_pages_mpol+0x21e/0x390 [ 450.193395][ T9883] folio_alloc_mpol_noprof+0x39/0x160 [ 450.193423][ T9883] swap_cache_alloc_folio+0x2c1/0x990 [ 450.193468][ T9883] swap_cache_read_folio+0x44/0x120 [ 450.193502][ T9883] swap_cluster_readahead+0x392/0x630 [ 450.193540][ T9883] ? __pfx_swap_cluster_readahead+0x10/0x10 [ 450.193595][ T9883] swapin_readahead+0x1a3/0xc60 [ 450.193624][ T9883] ? lock_acquire+0x115/0x350 [ 450.193668][ T9883] ? __pfx_swapin_readahead+0x10/0x10 [ 450.193704][ T9883] ? swap_table_get+0x1e/0x260 [ 450.193732][ T9883] ? swap_table_get+0x1e/0x260 [ 450.193757][ T9883] ? swap_table_get+0x1e/0x260 [ 450.193786][ T9883] ? swap_table_get+0x216/0x260 [ 450.193820][ T9883] ? swap_cache_get_folio+0x2e7/0x2f0 [ 450.193856][ T9883] do_swap_page+0x7bc/0x4db0 [ 450.193904][ T9883] ? do_swap_page+0x120/0x4db0 [ 450.193930][ T9883] ? __pfx_do_swap_page+0x10/0x10 [ 450.193954][ T9883] ? __pte_offset_map+0x1ae/0x240 [ 450.193986][ T9883] ? pte_offset_map_rw_nolock+0xea/0x160 [ 450.194017][ T9883] handle_mm_fault+0x1398/0x3750 [ 450.194057][ T9883] ? handle_mm_fault+0xf1/0x3750 [ 450.194095][ T9883] ? __pfx_handle_mm_fault+0x10/0x10 [ 450.194136][ T9883] ? __lock_acquire+0x747/0x2de0 [ 450.194172][ T9883] ? lock_mm_and_find_vma+0xa7/0x340 [ 450.194207][ T9883] do_user_addr_fault+0x7f6/0x1480 [ 450.194258][ T9883] exc_page_fault+0x6a/0xc0 [ 450.194303][ T9883] asm_exc_page_fault+0x26/0x30 [ 450.194326][ T9883] RIP: 0010:rep_movs_alternative+0x30/0xa0 [ 450.194355][ T9883] Code: 83 f9 08 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 8d 71 04 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 [ 450.194374][ T9883] RSP: 0018:ffffc9000362fdb8 EFLAGS: 00050202 [ 450.194395][ T9883] RAX: 00007ffffffff001 RBX: 0000000000000018 RCX: 0000000000000018 [ 450.194411][ T9883] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: ffffc9000362fe20 [ 450.194428][ T9883] RBP: ffffc9000362fea8 R08: ffffc9000362fe37 R09: 1ffff920006c5fc6 [ 450.194445][ T9883] R10: dffffc0000000000 R11: fffff520006c5fc7 R12: 00002000000000c0 [ 450.194462][ T9883] R13: 1ffff920006c5fc0 R14: ffffc9000362fe20 R15: 00002000000000c0 [ 450.194498][ T9883] _copy_from_user+0x7a/0xb0 [ 450.194530][ T9883] userfaultfd_ioctl+0xe4/0x560 [ 450.194558][ T9883] ? __fget_files+0x2a/0x420 [ 450.194590][ T9883] ? __pfx_userfaultfd_ioctl+0x10/0x10 [ 450.194616][ T9883] ? __fget_files+0x2a/0x420 [ 450.194645][ T9883] ? __fget_files+0x2a/0x420 [ 450.194678][ T9883] ? bpf_lsm_file_ioctl+0x9/0x20 [ 450.194707][ T9883] ? __pfx_userfaultfd_ioctl+0x10/0x10 [ 450.194736][ T9883] __se_sys_ioctl+0xfc/0x170 [ 450.194774][ T9883] do_syscall_64+0x166/0x520 [ 450.194795][ T9883] ? trace_irq_disable+0x3b/0x140 [ 450.194827][ T9883] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 450.194850][ T9883] ? clear_bhb_loop+0x70/0xc0 [ 450.194879][ T9883] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 450.194901][ T9883] RIP: 0033:0x7f932819e159 [ 450.194921][ T9883] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 450.194941][ T9883] RSP: 002b:00007f93290cd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 450.194963][ T9883] RAX: ffffffffffffffda RBX: 00007f9328425fa0 RCX: 00007f932819e159 [ 450.194980][ T9883] RDX: 00002000000000c0 RSI: 00000000c018aa3f RDI: 0000000000000003 [ 450.194996][ T9883] RBP: 00007f93290cd090 R08: 0000000000000000 R09: 0000000000000000 [ 450.195011][ T9883] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 450.195026][ T9883] R13: 00007f9328426038 R14: 00007f9328425fa0 R15: 00007ffce34f9c08 [ 450.195061][ T9883] [ 452.649407][ T9873] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 452.883245][ T9893] oom_control is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 453.045579][ T9898] netlink: 'syz.2.1284': attribute type 89 has an invalid length. [ 453.179412][ T5693] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 453.342265][ T5693] usb 5-1: unable to get BOS descriptor or descriptor too short [ 453.342319][ T5693] usb 5-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 453.343342][ T5693] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 453.343367][ T5693] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 453.346236][ T5693] usb 5-1: string descriptor 0 read error: -22 [ 453.346377][ T5693] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 453.421820][ T5693] usb 5-1: selecting invalid altsetting 1 [ 453.424100][ T5693] usb 5-1: unit 3 not found! [ 453.617376][ T5693] usb 5-1: unit 0 not found! [ 453.829575][ T9896] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 453.830122][ T9896] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 453.831304][ T5693] usb 5-1: USB disconnect, device number 5 [ 454.049420][ T6227] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 454.201024][ T6227] usb 4-1: New USB device found, idVendor=0bda, idProduct=0129, bcdDevice= 1.00 [ 454.202462][ T6227] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 454.202513][ T6227] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 454.202560][ T6227] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 454.317138][ T9900] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 454.418526][ T6227] rtsx_usb 4-1:1.0: probe with driver rtsx_usb failed with error -71 [ 454.445229][ T6227] usb 4-1: USB disconnect, device number 5 [ 454.744548][ T52] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 454.750860][ T52] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 454.763652][ T52] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 454.771119][ T52] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 454.772629][ T52] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 455.117157][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 455.280430][ T9930] FAULT_INJECTION: forcing a failure. [ 455.280430][ T9930] name failslab, interval 1, probability 0, space 0, times 0 [ 455.280469][ T9930] CPU: 0 UID: 0 PID: 9930 Comm: syz.3.1294 Tainted: G L syzkaller #0 PREEMPT(full) [ 455.280503][ T9930] Tainted: [L]=SOFTLOCKUP [ 455.280513][ T9930] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 455.280528][ T9930] Call Trace: [ 455.280538][ T9930] [ 455.280549][ T9930] dump_stack_lvl+0xe8/0x150 [ 455.280597][ T9930] should_fail_ex+0x3eb/0x540 [ 455.280629][ T9930] should_failslab+0xa8/0x100 [ 455.280657][ T9930] __kmalloc_noprof+0xf9/0x710 [ 455.280690][ T9930] ? rcu_is_watching+0x16/0xb0 [ 455.280714][ T9930] ? tomoyo_realpath_from_path+0xef/0x640 [ 455.280744][ T9930] ? tomoyo_realpath_from_path+0xef/0x640 [ 455.280781][ T9930] tomoyo_realpath_from_path+0xef/0x640 [ 455.280823][ T9930] ? tomoyo_path_number_perm+0x219/0x5f0 [ 455.280848][ T9930] tomoyo_path_number_perm+0x246/0x5f0 [ 455.280877][ T9930] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 455.280901][ T9930] ? __lock_acquire+0x747/0x2de0 [ 455.280953][ T9930] ? hook_file_ioctl+0x1f2/0x600 [ 455.281000][ T9930] ? __fget_files+0x2a/0x420 [ 455.281035][ T9930] ? __fget_files+0x2a/0x420 [ 455.281071][ T9930] ? __fget_files+0x3a2/0x420 [ 455.281105][ T9930] ? __fget_files+0x2a/0x420 [ 455.281158][ T9930] security_file_ioctl+0xc3/0x2a0 [ 455.281198][ T9930] __se_sys_ioctl+0x47/0x170 [ 455.281239][ T9930] do_syscall_64+0x166/0x520 [ 455.281263][ T9930] ? trace_irq_disable+0x3b/0x140 [ 455.281297][ T9930] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 455.281322][ T9930] ? clear_bhb_loop+0x70/0xc0 [ 455.281353][ T9930] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 455.281378][ T9930] RIP: 0033:0x7fafec19e159 [ 455.281407][ T9930] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 455.281428][ T9930] RSP: 002b:00007fafed04c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 455.281455][ T9930] RAX: ffffffffffffffda RBX: 00007fafec425fa0 RCX: 00007fafec19e159 [ 455.281473][ T9930] RDX: 0000000000000001 RSI: 0000000000004c81 RDI: 0000000000000003 [ 455.281489][ T9930] RBP: 00007fafed04c090 R08: 0000000000000000 R09: 0000000000000000 [ 455.281504][ T9930] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 455.281520][ T9930] R13: 00007fafec426038 R14: 00007fafec425fa0 R15: 00007ffd3fdd8f68 [ 455.281557][ T9930] [ 455.308064][ T9930] ERROR: Out of memory at tomoyo_realpath_from_path. [ 455.583616][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 455.802222][ T12] netdevsim netdevsim0 netd ** replaying previous printk message ** [ 455.802222][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 455.813420][ T9930] ------------[ cut here ]------------ [ 455.813507][ T9930] timer_delete_sync(&sdp->delay_work) && rcu_segcblist_n_cbs(&sdp->srcu_cblist) [ 455.813549][ T9930] WARNING: kernel/rcu/srcutree.c:707 at cleanup_srcu_struct+0x3d6/0x8b0, CPU#0: syz.3.1294/9930 [ 455.854083][ T9930] Modules linked in: [ 455.858018][ T9930] CPU: 0 UID: 0 PID: 9930 Comm: syz.3.1294 Tainted: G L syzkaller #0 PREEMPT(full) [ 455.869009][ T9930] Tainted: [L]=SOFTLOCKUP [ 455.874359][ T9930] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 455.884585][ T9930] RIP: 0010:cleanup_srcu_struct+0x3d6/0x8b0 [ 455.890583][ T9930] Code: 30 8c 00 48 83 7d 00 00 4c 8b 74 24 10 0f 85 dd 03 00 00 41 ff c5 41 83 e5 0f 41 83 fd 07 0f 86 e2 fe ff ff e9 ab 00 00 00 90 <0f> 0b 90 4c 8d b5 00 02 00 00 4c 89 f3 48 c1 eb 03 48 b8 00 00 00 [ 455.910482][ T9930] RSP: 0018:ffffc90005377cf0 EFLAGS: 00010206 [ 455.916595][ T9930] RAX: 1ffffd1ffff80fd5 RBX: 0000607edb3acdc0 RCX: dffffc0000000000 [ 455.924949][ T9930] RDX: 0000000000000001 RSI: ffffffff8e59e74c RDI: 00000000ffffffff [ 455.933076][ T9930] RBP: ffffe8ffffc07dc0 R08: ffffffff909bb37f R09: 1ffffffff213766f [ 455.941736][ T9930] R10: dffffc0000000000 R11: fffffbfff2137670 R12: ffff888021749000 [ 455.950034][ T9930] R13: 0000000000000000 R14: ffffe8ffffc07ea8 R15: 1ffffffff1d0e9de [ 455.958054][ T9930] FS: 00007fafed04c6c0(0000) GS:ffff88812485b000(0000) knlGS:0000000000000000 [ 455.967053][ T9930] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 455.973710][ T9930] CR2: 00007f0072ca7e9c CR3: 000000007e8d2000 CR4: 00000000003526f0 [ 455.982201][ T9930] Call Trace: [ 455.985524][ T9930] [ 455.988512][ T9930] blk_mq_free_tag_set+0x617/0x790 [ 455.993802][ T9930] loop_remove+0x4e/0xc0 [ 455.998108][ T9930] loop_control_ioctl+0x4a6/0x5a0 [ 456.003225][ T9930] ? __pfx_loop_control_ioctl+0x10/0x10 [ 456.008819][ T9930] ? __fget_files+0x2a/0x420 [ 456.013558][ T9930] ? bpf_lsm_file_ioctl+0x9/0x20 [ 456.018548][ T9930] ? __pfx_loop_control_ioctl+0x10/0x10 [ 456.024204][ T9930] __se_sys_ioctl+0xfc/0x170 [ 456.028857][ T9930] do_syscall_64+0x166/0x520 [ 456.033619][ T9930] ? trace_irq_disable+0x3b/0x140 [ 456.039309][ T9930] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 456.045524][ T9930] ? clear_bhb_loop+0x70/0xc0 [ 456.050568][ T9930] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 456.056506][ T9930] RIP: 0033:0x7fafec19e159 [ 456.061017][ T9930] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 456.080730][ T9930] RSP: 002b:00007fafed04c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 456.089210][ T9930] RAX: ffffffffffffffda RBX: 00007fafec425fa0 RCX: 00007fafec19e159 [ 456.097299][ T9930] RDX: 0000000000000001 RSI: 0000000000004c81 RDI: 0000000000000003 [ 456.105390][ T9930] RBP: 00007fafed04c090 R08: 0000000000000000 R09: 0000000000000000 [ 456.113525][ T9930] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 456.121588][ T9930] R13: 00007fafec426038 R14: 00007fafec425fa0 R15: 00007ffd3fdd8f68 [ 456.129661][ T9930] [ 456.132738][ T9930] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 456.140084][ T9930] CPU: 0 UID: 0 PID: 9930 Comm: syz.3.1294 Tainted: G L syzkaller #0 PREEMPT(full) [ 456.150972][ T9930] Tainted: [L]=SOFTLOCKUP [ 456.155329][ T9930] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 456.165443][ T9930] Call Trace: [ 456.168758][ T9930] [ 456.171718][ T9930] vpanic+0x56d/0xa70 [ 456.175755][ T9930] ? __pfx__printk+0x10/0x10 [ 456.180401][ T9930] ? __pfx_vpanic+0x10/0x10 [ 456.184959][ T9930] ? is_bpf_text_address+0x292/0x2b0 [ 456.190292][ T9930] ? is_bpf_text_address+0x26/0x2b0 [ 456.195535][ T9930] panic+0xc5/0xd0 [ 456.199306][ T9930] ? __pfx_panic+0x10/0x10 [ 456.203792][ T9930] __warn+0x315/0x4c0 [ 456.207835][ T9930] ? cleanup_srcu_struct+0x3d6/0x8b0 [ 456.213174][ T9930] ? cleanup_srcu_struct+0x3d6/0x8b0 [ 456.218521][ T9930] __report_bug+0x276/0x570 [ 456.223086][ T9930] ? cleanup_srcu_struct+0x3d6/0x8b0 [ 456.228448][ T9930] ? __pfx___report_bug+0x10/0x10 [ 456.233560][ T9930] ? do_raw_spin_lock+0x12b/0x2f0 [ 456.238668][ T9930] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 456.244093][ T9930] ? cleanup_srcu_struct+0x3d6/0x8b0 [ 456.249427][ T9930] report_bug+0x16b/0x220 [ 456.253808][ T9930] ? cleanup_srcu_struct+0x3d6/0x8b0 [ 456.259124][ T9930] ? cleanup_srcu_struct+0x3d8/0x8b0 [ 456.264436][ T9930] handle_bug+0x9c/0x200 [ 456.268709][ T9930] exc_invalid_op+0x1a/0x50 [ 456.273240][ T9930] asm_exc_invalid_op+0x1a/0x20 [ 456.278165][ T9930] RIP: 0010:cleanup_srcu_struct+0x3d6/0x8b0 [ 456.284090][ T9930] Code: 30 8c 00 48 83 7d 00 00 4c 8b 74 24 10 0f 85 dd 03 00 00 41 ff c5 41 83 e5 0f 41 83 fd 07 0f 86 e2 fe ff ff e9 ab 00 00 00 90 <0f> 0b 90 4c 8d b5 00 02 00 00 4c 89 f3 48 c1 eb 03 48 b8 00 00 00 [ 456.303722][ T9930] RSP: 0018:ffffc90005377cf0 EFLAGS: 00010206 [ 456.309881][ T9930] RAX: 1ffffd1ffff80fd5 RBX: 0000607edb3acdc0 RCX: dffffc0000000000 [ 456.317876][ T9930] RDX: 0000000000000001 RSI: ffffffff8e59e74c RDI: 00000000ffffffff [ 456.325866][ T9930] RBP: ffffe8ffffc07dc0 R08: ffffffff909bb37f R09: 1ffffffff213766f [ 456.333872][ T9930] R10: dffffc0000000000 R11: fffffbfff2137670 R12: ffff888021749000 [ 456.341881][ T9930] R13: 0000000000000000 R14: ffffe8ffffc07ea8 R15: 1ffffffff1d0e9de [ 456.349918][ T9930] blk_mq_free_tag_set+0x617/0x790 [ 456.355091][ T9930] loop_remove+0x4e/0xc0 [ 456.359371][ T9930] loop_control_ioctl+0x4a6/0x5a0 [ 456.364432][ T9930] ? __pfx_loop_control_ioctl+0x10/0x10 [ 456.370001][ T9930] ? __fget_files+0x2a/0x420 [ 456.374630][ T9930] ? bpf_lsm_file_ioctl+0x9/0x20 [ 456.379588][ T9930] ? __pfx_loop_control_ioctl+0x10/0x10 [ 456.385162][ T9930] __se_sys_ioctl+0xfc/0x170 [ 456.389797][ T9930] do_syscall_64+0x166/0x520 [ 456.394402][ T9930] ? trace_irq_disable+0x3b/0x140 [ 456.399457][ T9930] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 456.405545][ T9930] ? clear_bhb_loop+0x70/0xc0 [ 456.410248][ T9930] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 456.416202][ T9930] RIP: 0033:0x7fafec19e159 [ 456.420754][ T9930] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 456.440393][ T9930] RSP: 002b:00007fafed04c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 456.448834][ T9930] RAX: ffffffffffffffda RBX: 00007fafec425fa0 RCX: 00007fafec19e159 [ 456.456837][ T9930] RDX: 0000000000000001 RSI: 0000000000004c81 RDI: 0000000000000003 [ 456.464836][ T9930] RBP: 00007fafed04c090 R08: 0000000000000000 R09: 0000000000000000 [ 456.472828][ T9930] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 456.480828][ T9930] R13: 00007fafec426038 R14: 00007fafec425fa0 R15: 00007ffd3fdd8f68 [ 456.488840][ T9930] [ 456.492489][ T9930] Kernel Offset: disabled [ 456.496848][ T9930] Rebooting in 86400 seconds..