last executing test programs: 3m28.441390468s ago: executing program 0 (id=2673): set_mempolicy(0x5, &(0x7f0000000000)=0x2, 0x6) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000280)={{0x12, 0x1, 0x201, 0xc3, 0xdf, 0xde, 0x40, 0x1bc7, 0x9201, 0xcdcd, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0xa2, 0x7, 0x0, 0x3, "", [{{0x9, 0x4, 0x1a, 0x6, 0x0, 0x9e, 0x0, 0x94, 0x1}}]}}]}}, &(0x7f0000000880)={0x0, 0x0, 0x5, &(0x7f0000000840)=ANY=[@ANYBLOB="050f"]}) r0 = userfaultfd(0x80801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x54}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) 3m27.069329448s ago: executing program 0 (id=2671): syz_ublk_setup_queues(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x4, &(0x7f00000000c0)={0x2e, 0x55, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {0x100}, 0x0, 0x0, '\x00', {0x2, 0xacc, 0x0, &(0x7f0000000540)=@buf_max_buf="55f636d012d7e4fcb0d02555a43cbcf9f46f5bbeb3c78e5427f6f9c53adb438ada5a2ffb810d96cf3aead27dcd5332b4a17a4c05bdbce98e67ff373960d04eeec282b6182231849c22aae2c755cdd262587ac1099d34b3da10fa53e53ab0174e85c6a36c0870c554fe76b5df54b2e886afee45a5311ffdc07c52cd55cd7f9b79f6cd58a8cfbbfeffe2bac592d1d3d7b2ec1838785ec9c7f7afd56ca76d171ad90478e0d397452b420c6dd6030aed886c3da6b69dd2cc249ec7ced3c1d4ce71ea8702280e15376a5f38e139e33ee35c6c3ce03efdd9ca0edca7141646efe9cb8e32918f43ece169ee9f71320a6060428ec84b4322fc5f5b4c0c998c62c8f54a9fb39b6b2a7b434f2798b960e7bb001539977924479639e1de51775055e37dfcae9b3cd635b69c0b500d5a08580c4343c8db9f2fc560e481191d7787c49a9f4df4d62eb750f7aeca93c05b3cc077a5c4c8db0ae25edd83f6bdb217fc606a17f1ffb653a18077ab67f01644003e6a1eec3164f5d1d09e12e5086d68797583412fb6c11dd643f884003a69eb101a60495b3610991237d54f95ea2b8cfebb82f41d599814933e15f2dbdd42003a605d41b962c16a2ef5957f6fb18057b9c80e2accabcd1e336f7be01a25ea79e0f58e5d14df9057eba71ccfc1e1c759ba2e4fc7cb2ac1fb5d774dc6605ffa7aa5855cf9b289e8d211d86b644e91b8c410e4df07b52cda9c20e424e21efd34d0236bde6d1aeeb1f6dd1903ba27c49ffb64cf55c3431d7be44f6cbb450260ef2ec48097a4cf91ca9f799d40d96023121488c149adb91d93af8b8692a2a00231d4e382435f6fbbaddf25da3bf3260b6f7f18328a8b4019bf11dbf435c27fa78dd76da19d2710e56f1112544705ff8fe7100a3b1aaea8c68c93f053dd34e220f240e546c8b5f6d0300e2393ffe212683aa02570ebae371eb9c7b1346959ebb7940e535388545775d45a1e3073c9cdebd796e6741074903e2964d736665ad46e2735370e7bf7b17c9912c4658f79a09778b8cfad752ad60aade9ffbb631acfa39b8cec8b012779b743fa73bb4114be0f356722139d76d2b701c8a5a91e97a65bfe8fc81bd16773f3d39139f2b04980e5cc0791f7394f57a1f1d905f3506e1a60a6d8dea2b2b12f80feb9e22936ca22a9740575b469623202235ae2657fa9c8ff95451ee8218c3b8269d7d287e5edeeac9bbd36ac788dfe22561809a11e8b1abec4d066d332a0c4d793e358712e16a0d11edd2d511e99d6ac224547c8f152560de9ef68167e5e768465bc5951375e4e0097790580e615aaccffe75e1a42ca75d2c376609c15af7713299b258fb760169ecf916fbe6a7a540dc975da95dcdbbae330d8d45093fca6f434fb3475494c6341d6a0abba50aaad739a7056bde990b3098288d22ff7d060e7a3bf21d40af804fa309a476f801f8111ccd73989ae1df1011070c77f5456d994212fbe3a288e4827b3b857d6469e1341120701b5d2cb6f6b5eacfd20544e2fe8f9dc8122c3124fe1ba60062d697edcf17b5c312ff0962a1d241a8bd1ad1cec1bd434334dcacd3b80c4a529fdf0d7b9161e89bbf76a03eb237dbe281419927bb01934310c5b454fb9ba289fbb9676be40bce25014b730778f00e35ec5f6ee2ba04b9ce388a25176682171b1b2c3387c0a34f143ecf4d8617fd47bfc48df55d057ab25c29a0e69d5e451dca8eb2756c9372504905a513707a3763d320ce67b60c31fdbca229bdc6aa1f33a14effe3cc23288244e12aa2c6c5681bce6736f467bde81bd04569ffcf8eeaaa8f8bede2eef19ae55f38a2ef6b0990983edcfc4d795556cea07ac537b08c997f6e4d8f3e59402f8f8662495fcfd6f5deac6d3cef71aac54d66c912e7362e7232d5a724a2b59dcd1f898e43d92b5eb6da6eb0854e33520ebef187344aea65f84462d284880d4ede37add51e57029390f8cc0fb6564ca8ca8587c6c41ebe9b82b0fb6626470336c8a1f27827b75a6f59298cb526dc6f6bdfa9f0c86ded9daec957597c82729f04efa2e0262316a500bad405ad33fffbae5e1067928d9e284fd3d0a2774d6de78276fb4c6e02529289ab4b8afdb8bec2e5c1a7d76be71f1092681a38f51a5bc28820867a4bb75f1e953915c50924d75c028efe1768571f82c04d0863ccd891a127ac6e0d8472015cebc640a440e6d564118b5d3e4abeb4494802a7842584a18e55fca4680e4880d5f38a26c4678d599d9c8fe2d6eaf71f93ed30f08a4177d7c6ab41caa945521e27de56ff65d5143ab12fc9bf3cda2dd428de586b4166c28d5f502f72479c69036afb6d04cc5827f2214f61da1b506e02d97dcf16763079978a5dc93a90d4f38b0564764282f0bb093592c490c42ea94cb57605598c635d049b872192bcffc1d08f6fe06214745e41444c5832d7ccc306ceb15b0d73e4aaaf816d86f9dfee32cc50602bb661f4106528f925ba1c1222674e3e2c3547346524a2cea3e6b912deee8810909df68853fd15c741eebef460deb590bc5420f14cbc980f51932cd6a5ed2780080cccf1c225a71bd9f887ae6b0f6f920980df56c64368d671d452d35e2f3e80bbe5c8428d4aadb053a94691cc0f2ae5273b65b45b598cc62ed4c3f18dbdd4fc090f67b145df85aec712100335219d0278d68b43b8032c5c1528f7dfc998edb96697384da44bd2b61edffd1cc4299ff47acb524b96714250dee83c64a03dd9cf5c6b83a31feb425f9b3ff3a3bc29a987975be9b7a36096f2b25e1f07f7c4ab7c40741a11b180669a462319e13abc3687b45334a90c6b901273f617f613c59a6fba171d2a4ae7584be30ec0a3fce157d311172c983b23abe19b182233c98cc6a757b8ea6e10d4807268a4af17007c8d4167fa0a790af301f57a2204e21b15ef6074c20154e14fb9b81e17266699f0fd890aed848e981589292a8e493039f27ec1969ae4dad2ae4fc2ce46dde50de0eaa463fafc348a9bb75c1bb4464d2b01108e21f46ccc3052e707320cc4968214820d63531d1762192c24a7a94373a69402e0f050eabcccef22a1cf5a86ee359daa1d1a1b3f32dfa5241dc233a5d33374441b1acfd6bcfb8ad696842a447555c1e407f076fd210de2649060b1ef384cec10a303d791daec9f00d0860c8dcf82f4a5a7a38c70ab5c9b2dbaf1fc8f4675f8fd436986304786c1c545217683e3b42f0255de259417d79170b670825f46db807ef2dbf0e41c3772ac5bb205259470e78fec7db38c7e68ca5f3f6a3851fed7e8e9c73a7de8a6abf472a5e1ffffa76876d53e58b1c2be846f78a2ddc8233899014f3bb54034c8e3bcb857dd11376c1f287a8f5224817d3edfb41704bd05c255eca68b60c81bed814723b6adaee12cf30838a0962eb16e9e65f9f2e12a84630181742416e43273dda581f2968c0c26d1d5c2839cd6293d4a078ce2f578a118aa44c88f445570f38e2931ea3ca6f79760f15930141a2797f2db10855d963a47ba776ef670c70230e9011ec0a599a9cef1d5d9ca099b1fdf7f2861c6ef5609aa93bc849a226edecc31dddd7e89ea28f3f6b3d2bc9fc509d367621424e0517a37afedd889ed3a1f5bcb48386368cea1673ea03beb43401af5cdc7d94691d52f16df2d2e0790c0e8257ac45a61b350404802ad834981418b12e1935cbe98f0b0a3a459deb85f7fee5af9a81b6a4df5fa66f225d7e6836e2aa2e9c84d3ac071c05e7c9bb5cbf75c3efa8831e1b98136c1f7ed7bcc16f032c970ded99229d666e4ab91d135340140a2cbbe481e080a07912e63ff1a8f11ab62ca8966cebc80efbc36294097592e81b0fbdb99ca5b39d35dbf0984f92c8a409a0b8f35854dae72f422a8817f7b2480e667ead9d24282123cbc5c4c84c2599dee645a0525c669f90d505304c6ca2af457dccea1ca311166343f483dc9aeb551a1ae6165ebafa22fbd6c683aceed8c6672056e4e08984f24d6dff983e5c900ea5b1d3e3fd8a9154806ee534f433fc2d51af784de985f532fa4b20b74c4c194017c44c0987f4c6e42a6c6410fe0eccfb19911e4b6e87e352cd464c2b6afbcdde397b5fc6a6e8bfc9d3cc5e77118a3e7677a62159623ff4fe6163145fc78238f73c877c4d7614be1d32599d0c7330694d8d97565417f8419d61e4d12770f9df5d40f272b36fafbd03d303a2fa33acfcf5674567741ce9bddc84bdb6ea3dff97daffeefdb9fa0df084f95b39bb00059e4a62e1b42b2ec32fc9f9fe73ad12205a9e5ef74cdd4dcb37d16853e3dd0709ba68c11cc19ebf7bc42762fef26159853904421a1d45b84cfa9c27eee8400cd1df436552fd793401856a9b72e5db17ae2f7b40e74d07ec3563e797c9147588a5690032b342e4cf08e32cf0708c42d194ccad2b49a2ff69577b55cda387e801ef73062ddbe12ae16f9268736ad7a23cc80a1d9950083f8dbc8dfbf5474429b309ce6fd4f52fe24cdc75a9e047b66136c5be3f25d4839fedcb5d46f0ce55e640418f46799455c1f4924ac322b38376400c4581ffbcb08b2001874ca79b2a6f12f6f0dd42ef8df46a138f1ca94325ff789be3df9f95e1ec47c8f1d9e16c877146fc745acaa7711bd493205da37732f67c7008cae170ce4e4dcc2a9d13b31b8601523564ca1adccebece6bb0e34f93d586f824709469b22d8a8889c0ebc592fcd7eb6d541400d3baea6ce93077188637d2d475e8e31d4656ce0fe8b4adc5fafdd3caf63ee1be95ea2b145787b35d8dddc1ad3f48e77853944036a87401f6a0d9af7443122af733bea37b6edf99c1266482ec458d2114f13fe4dc918e3f39ee8390148f723def34e8c812afda68f4e0828644177321a7d92d6cde31f518c57baa9432f310ef9e216c24e3fe57921086a2335982a60bc69eddb6ba76752f87c382840d075f131d081f1303535593f4c7946be0d42959a2b533dc2add63e808ba3789b6125a86c0ee432b3bc7523df5cb4ef47ef3b10447f5e82f93b152b64184a626e5bd966138c4e6468f698b81e5da8c80e0b075573dce4b7e7bd13fb48549c68183ed8bb5fcdece1747640e7da1afcffb6ec66d4311b9cec7dbf0e38cb1d3873d701ed8c998497519fdd8e1b220730c1d2d6855362e9ce2b563e6bfda973a95e77c150064a8161310045d0b72f357fa5ee978862c483cec0b9d1796cd82013235612faae01e8e26406a462d0024150532c08fcf5a8bf7201d2cfa46a47d696828f0454a27638ca835500a2266a5084d3f61df1e59919e8bc4a039ccfb19f98891a660af82edf07f4c4923eadf0629ff4a8f2aa0af1b5c96dba0ff489cd81e7a9e394fa81f8884021051d4bdaa9f69f1fd48f6382f0a5fdc0f8982b72192dc0c9083c56d455908e97a7a57d4063ab7c4b26b67bd5312c4e4e8cddb1027ac54ed8270bef265e531395e0d977b82d985c26164628d2097e826970920467a0512f5cc70c99115b52d8e61e839935bbea750f7463b004898e69641449aeb95cda7755f5391337012fc5ab12114c90e6e6cc08d0beda96a17d6a09b99c548d005ef2ee5cc3e8d8600022758f4ce8fae54bad407ab4913c727745c36291ef3f3fb21e8cf29fe718eef75233575b3ada3315a2b1668382cc27af8cddeddc40c18067eb7c1827409158c4f4106337fd38d227d7b74d63481c3742cd55bded76223ce8aba13d9026890e30325a88a7b673d7d5ba4bfb5ad7050f8b6f1e04147ec83264afe23f058e5d6517684bf0de015c8a8350f66122ad133e337bfa4f1ef865bc9bd3bd2baca7ada5c31d7e83b226f00"}}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$SEG6(&(0x7f0000003e40), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$SEG6_CMD_SETHMAC(r3, &(0x7f0000004440)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000000c0)={0x2c, r2, 0x20d, 0x70bd2a, 0x25dfdbfe, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x2}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x1}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x6}]}, 0x2c}, 0x1, 0x0, 0x0, 0xc051}, 0x4000) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000300)=ANY=[@ANYBLOB="d8010000", @ANYRESOCT=r1, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r1, @ANYBLOB="bc01330080000000ffffffffffff080211000000f7ab87594b3f00000000000801000100dd7118aae49bd5937bad5fda023b2a5a78c05782f92fe27196352514ed223d61c8fc17d2692f2a2eecd8d55db037f220440957ec558232ad7346e19d0ffba41dae1bdf25fc38ceb7a7a77ac466c2bb6feb8de070b227826541a0d118d508fc18f3cc6f5f98db435cd2d27a5c0ce49292e72bb2dd32681a1a58e3ff43cdadc26f69deb1ef3ede9aec85a6554b2c7cd5af891f933549794b8d0f911ffdaed3ba6833441f94f5721cddaf7e6127b1f68192b4d5902dd5c215d8df43165c4061282fcbe5430fdf2448206d0e1561b338289d64b802476b"], 0x1d8}, 0x1, 0x0, 0x0, 0x805}, 0x0) 3m26.915924479s ago: executing program 0 (id=2672): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f00000001c0)) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000640)=0x40000) 3m26.711947263s ago: executing program 0 (id=2676): socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) r0 = syz_usb_connect(0x5, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100001a77aa4094225b4210a20102030109022400010000000009040000029233500009050602ff030000000905ba3e79"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000240)=ANY=[@ANYBLOB="40010400000003"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) keyctl$setperm(0x5, 0x0, 0x22480) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text16={0x10, 0x0}], 0x1, 0x6d, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000080)={0x3, 0xbde, 0x0, &(0x7f0000000180)="a1984ec3aec3fc2e025f90eda6dbc903939aac644fd36f1e65174cae030c42cbacc392851a695f247112e91f059460a2c031929dc0515ac7cd20775ff9da9c2b6cb48968dcd6d8d982c492932c572f084d3af58650d207eec0794b3e47c5678c36b99eed61e1dbac68ce8a79aa21a51202018bdc4a51489844f785887083841d65c129992bbe5a51c71b95a9847d2bdede66c6e3184c386faf938fd6db888e73a5c0dcc69c3de7458e68ed33226a8d1c8e17", 0x0, 0xb2}) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4400ae8f, &(0x7f0000000140)=@x86={0x40, 0x1, 0x10, 0x0, 0x8, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x1, 0x0, 0x0, 0xfffffff8, 0x0, 0xff, 0xff, 0x1}) 3m22.991077073s ago: executing program 0 (id=2687): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f00000004c0), r0) sendmsg$NL802154_CMD_NEW_SEC_KEY(r0, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0, 0x12c}, 0x1, 0x0, 0x0, 0x24004821}, 0x0) 3m22.69438185s ago: executing program 0 (id=2688): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000480), 0x0, &(0x7f0000000040)={[], [], 0x2c}) setxattr(&(0x7f0000000180)='./file0\x00', &(0x7f00000004c0)=@known='trusted.overlay.redirect\x00', 0x0, 0x0, 0x0) llistxattr(&(0x7f0000002300)='./file0\x00', 0x0, 0xfffffdf3) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000004f00)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000002dc0)={0x14, 0x26, 0x303, 0x70bd28, 0x25dfdbfe, {0x1f}}, 0x14}, 0x1, 0x0, 0x0, 0x4000010}, 0x24000844) syz_genetlink_get_family_id$smc(&(0x7f0000000100), r1) removexattr(&(0x7f0000000140)='./file2\x00', &(0x7f0000000200)=@random={'os2.', 'trusted.overlay.redirect\x00'}) openat$urandom(0xffffffffffffff9c, 0x0, 0x101000, 0x0) syz_usb_connect$uac1(0x5, 0x72, &(0x7f0000000080)=ANY=[@ANYBLOB="12010003000000201e04423040000102030109026000030108c00709049b8100010100000201020904010000010200000931f54ba04d8b1b2109050109000401033f07250100470600090402000001020000090402010101020000090582095344000d000725010c47050000000000000000"], &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0}) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="50000000020605000000000000000000000000000c00078008000640400000000500010006000000050005000200000005000400000000000900020073797a31000000000c000300686173683a6970"], 0x50}}, 0x0) pipe(&(0x7f0000000280)) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000740)={0x40, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x18, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty=0xfffffffe}}, @IPSET_ATTR_CIDR={0x5, 0x3, 0x8}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x10004057}, 0x4000084) 3m7.534322403s ago: executing program 32 (id=2688): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000480), 0x0, &(0x7f0000000040)={[], [], 0x2c}) setxattr(&(0x7f0000000180)='./file0\x00', &(0x7f00000004c0)=@known='trusted.overlay.redirect\x00', 0x0, 0x0, 0x0) llistxattr(&(0x7f0000002300)='./file0\x00', 0x0, 0xfffffdf3) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000004f00)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000002dc0)={0x14, 0x26, 0x303, 0x70bd28, 0x25dfdbfe, {0x1f}}, 0x14}, 0x1, 0x0, 0x0, 0x4000010}, 0x24000844) syz_genetlink_get_family_id$smc(&(0x7f0000000100), r1) removexattr(&(0x7f0000000140)='./file2\x00', &(0x7f0000000200)=@random={'os2.', 'trusted.overlay.redirect\x00'}) openat$urandom(0xffffffffffffff9c, 0x0, 0x101000, 0x0) syz_usb_connect$uac1(0x5, 0x72, &(0x7f0000000080)=ANY=[@ANYBLOB="12010003000000201e04423040000102030109026000030108c00709049b8100010100000201020904010000010200000931f54ba04d8b1b2109050109000401033f07250100470600090402000001020000090402010101020000090582095344000d000725010c47050000000000000000"], &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0}) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="50000000020605000000000000000000000000000c00078008000640400000000500010006000000050005000200000005000400000000000900020073797a31000000000c000300686173683a6970"], 0x50}}, 0x0) pipe(&(0x7f0000000280)) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000740)={0x40, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x18, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty=0xfffffffe}}, @IPSET_ATTR_CIDR={0x5, 0x3, 0x8}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x10004057}, 0x4000084) 12.954223987s ago: executing program 2 (id=3403): syz_usb_connect(0x5, 0x36, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text16={0x10, 0x0}], 0x1, 0x6d, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000037c0)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x64}, {&(0x7f0000000280)=""/85, 0x55}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {0x0}], 0x4, &(0x7f0000000600)=""/191, 0xbf}}], 0x1, 0x2040000, &(0x7f0000003700)={0x77359400}) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000080)={0x3, 0xbde, 0x0, &(0x7f0000000180)="a1984ec3aec3fc2e025f90eda6dbc903939aac644fd36f1e65174cae030c42cbacc392851a695f247112e91f059460a2c031929dc0515ac7cd20775ff9da9c2b6cb48968dcd6d8d982c492932c572f084d3af58650d207eec0794b3e47c5678c36b99eed61e1dbac68ce8a79aa21a51202018bdc4a51489844f785887083841d65c129992bbe5a51c71b95a9847d2bdede66c6e3184c386faf938fd6db888e73a5c0dcc69c3de7458e68ed33226a8d1c8e17", 0x0, 0xb2}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x40, 0x1, 0x10, 0x0, 0x8, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x1, 0x0, 0x0, 0xfffffff8, 0x0, 0xff, 0xff, 0x1}) 9.912899621s ago: executing program 2 (id=3410): r0 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x56e, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xc0, 0xb, "", [{{0x9, 0x4, 0x0, 0xf, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0xc, 0xfc, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x1, 0x4b, 0x6}}}}}]}}]}}, 0x0) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x10) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/cpu/smt/control\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='off', 0x3) syz_usb_control_io(r0, &(0x7f0000000b00)={0x18, &(0x7f0000000080)={0x40, 0x24, 0x28, {0x28, 0x23, "1ba57fb004529937682e35f832ac5b940f07fe00160800000068e84b9f2798b297551fc634f2"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 7.624127481s ago: executing program 3 (id=3417): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000280)={@in={{0x2, 0x4e21, @loopback}}, 0x0, 0x0, 0x24, 0x0, "e83ae75240c2d6d8ec87bb53fab0910000000000000007a5922406b64cddaeb9d339ba3c35dc0a08df8e61740b7cf2d4e499d58654a4cf0fa0ce1f830c3079cffcfd00"}, 0xd8) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000000040)=0xce, 0x4) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$inet(r0, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x0) r1 = accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x0) getsockopt$bt_BT_POWER(r1, 0x112, 0x9, &(0x7f0000000080)=0x8, &(0x7f00000000c0)=0x1) recvmsg(r0, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x700) 7.469996765s ago: executing program 2 (id=3420): syz_usb_connect(0x5, 0x36, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text16={0x10, 0x0}], 0x1, 0x6d, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000037c0)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x64}, {0x0}], 0x2, &(0x7f0000000600)=""/191, 0xbf}}], 0x1, 0x2040000, &(0x7f0000003700)={0x77359400}) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000080)={0x3, 0xbde, 0x0, &(0x7f0000000180)="a1984ec3aec3fc2e025f90eda6dbc903939aac644fd36f1e65174cae030c42cbacc392851a695f247112e91f059460a2c031929dc0515ac7cd20775ff9da9c2b6cb48968dcd6d8d982c492932c572f084d3af58650d207eec0794b3e47c5678c36b99eed61e1dbac68ce8a79aa21a51202018bdc4a51489844f785887083841d65c129992bbe5a51c71b95a9847d2bdede66c6e3184c386faf938fd6db888e73a5c0dcc69c3de7458e68ed33226a8d1c8e17", 0x0, 0xb2}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x40, 0x1, 0x10, 0x0, 0x8, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x1, 0x0, 0x0, 0xfffffff8, 0x0, 0xff, 0xff, 0x1}) 6.669460366s ago: executing program 3 (id=3421): syz_usb_connect(0x5, 0x36, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text16={0x10, 0x0}], 0x1, 0x6d, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000037c0)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x64}, {&(0x7f0000000280)=""/85, 0x55}, {0x0}], 0x3, &(0x7f0000000600)=""/191, 0xbf}}], 0x1, 0x2040000, &(0x7f0000003700)={0x77359400}) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000080)={0x3, 0xbde, 0x0, &(0x7f0000000180)="a1984ec3aec3fc2e025f90eda6dbc903939aac644fd36f1e65174cae030c42cbacc392851a695f247112e91f059460a2c031929dc0515ac7cd20775ff9da9c2b6cb48968dcd6d8d982c492932c572f084d3af58650d207eec0794b3e47c5678c36b99eed61e1dbac68ce8a79aa21a51202018bdc4a51489844f785887083841d65c129992bbe5a51c71b95a9847d2bdede66c6e3184c386faf938fd6db888e73a5c0dcc69c3de7458e68ed33226a8d1c8e17", 0x0, 0xb2}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x40, 0x1, 0x10, 0x0, 0x8, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x1, 0x0, 0x0, 0xfffffff8, 0x0, 0xff, 0xff, 0x1}) 5.688742254s ago: executing program 4 (id=3423): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0xa8240, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f00000001c0)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b000ee6d6c2f800000c00f3266bac0000f3066b808008ed0660f38806f008ee0", 0x3a}], 0x1, 0x8, 0x0, 0xfffffffffffffd52) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12014101f2c59620d016b8108ede0102030109022400010000100009040002020083ec0009050602000202000a09058202"], 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io$lan78xx(r2, 0x0, &(0x7f0000000380)={0x34, &(0x7f0000000180)={0x40, 0xe, 0xc, "2bab101573208c0b30429519"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r2, 0x0, &(0x7f0000000940)={0x84, &(0x7f0000000340)=ANY=[@ANYBLOB="400028000000e2"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 5.415364897s ago: executing program 2 (id=3425): r0 = syz_usb_connect$cdc_ncm(0x2, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESDEC], 0x0) syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000080)="00012c615bc2") syz_usb_control_io$cdc_ncm(r0, &(0x7f00000003c0)={0x14, &(0x7f0000000280)={0x40, 0x10, 0xee, {0xee, 0x21, "492640682fe563209d0e3c9d4817b0f7e6e8b16a4e7c9c744bfc484f98da0be5430591691494c32e1341212195005a2d1de950e62e2843797c74b2c0ffb583bec95ca4e5f37db8d41aaa70a201a23b1c4351ce53ffcf0e04c24e4698f00ddccdd6f60cafec3e55e937fedde54304b93cbd7a31531f5a5dafe466241663c3b5c5202ad09224cc9f5eeffca627269cf6b698fa4e2cb4552e89bb882cc5234f119a3cb4eec16100ce31943d004976a1ff8994a2c621bda9af7e36e65d9cd8b178dcc2ab16ef4658a0d7255673987816d1ed5d7e913a23a063bd591f6886cf7a023910f0e621b648952f8bfb9f1d"}}, &(0x7f0000000380)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000640)={0x44, &(0x7f0000000400)={0x0, 0x13, 0x26, "32d1a061258d3ea54ef4e5a55546de06439d22fcb78b08e76a5d3036d4fc10e7b638d0c1cd80"}, &(0x7f0000000440)={0x0, 0xa, 0x1, 0x94}, &(0x7f00000004c0)={0x0, 0x8, 0x1, 0xf}, &(0x7f0000000500)={0x20, 0x80, 0x1c, {0x1, 0x82, 0x4, 0x100, 0x12de, 0x4, 0x1ff, 0x9, 0x1, 0x2, 0x8, 0x7ff}}, &(0x7f0000000540)={0x20, 0x85, 0x4, 0x7d}, &(0x7f0000000580)={0x20, 0x83, 0x2, 0x1}, &(0x7f00000005c0)={0x20, 0x87, 0x2, 0x4}, &(0x7f0000000600)={0x20, 0x89, 0x2, 0x1}}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) 4.607804579s ago: executing program 3 (id=3427): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x41, 0x0) r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xa8, &(0x7f0000000080)=ANY=[@ANYBLOB="6b0ee0b3d41b1b", @ANYRES8=r0]) 3.552161669s ago: executing program 1 (id=3429): r0 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000580), 0x0, 0x0) read$FUSE(r0, &(0x7f0000000a00)={0x2020}, 0xfffffffffffffce7) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080), 0x200002, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0xc, &(0x7f0000000140)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f00000000c0)={r4, 0x5}, 0x8) r5 = openat$cgroup_type(r1, &(0x7f0000000100), 0x2, 0x0) openat$cgroup_freezer_state(r1, &(0x7f0000000040), 0x2, 0x0) write$cgroup_type(r5, &(0x7f0000000280), 0x9) openat$cgroup_procs(r1, 0x0, 0x2, 0x0) 3.487069789s ago: executing program 1 (id=3430): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r0) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x4206, r1) tkill(r1, 0x8) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) waitid(0x1, r2, 0x0, 0x61000006, &(0x7f0000000340)={{0x0, 0x0}}) ptrace$getregset(0x4205, r2, 0x202, &(0x7f0000000240)={&(0x7f0000000180)=""/120, 0xffffffffffffff28}) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f0000002540)={0x0, 0x0, &(0x7f0000002500)={&(0x7f0000000280)=ANY=[@ANYRES32=r3, @ANYRES16=r2, @ANYBLOB="010027bd7000000000000c00000010000380040004000800020003000000180001801400020076657468305f746f43bbabe335c648d9"], 0x3c}, 0x1, 0x0, 0x0, 0x4044801}, 0x48000) r4 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/tcp_recovery\x00', 0x1, 0x0) write$sysctl(r4, &(0x7f0000000140)='6\x00', 0x2) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0xa, 0x0) r5 = open$dir(&(0x7f0000000080)='./nfsd/portlist\x00', 0x151200, 0x90) r6 = openat(r5, &(0x7f0000000000)='./nfsd/portlist\x00', 0x9c041, 0x1a) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_SET(r7, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x34, r8, 0x3f, 0x0, 0x0, {0x2d}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x0) write(r6, &(0x7f0000000300)='5', 0x1) 3.362327371s ago: executing program 4 (id=3431): r0 = userfaultfd(0x801) shmat(0x0, &(0x7f000051b000/0x3000)=nil, 0x2000) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl(r1, 0x8b33, &(0x7f0000000040)) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000140)='/dev/comedi1\x00', 0x2, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x3000007, 0x13, r2, 0x2000) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_80211_inject_frame(0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$alg(0x26, 0x5, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$UBLK_U_CMD_SET_PARAMS(r3, 0xc0207508, &(0x7f00000000c0)={0x0, 0xffff, 0x0, 0x0}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000900)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a20000000000a05000000000000000000070000000900010073797a300000000060000000090a0103fe00000000000008070000000800084000a105010900010073797a30000000001c0009801000028060b5e6940800014000000002080001405fffffff080005400000000408000a40000000000900"], 0xa8}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r3, 0x81f8943c, 0x0) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000340)=0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r3, 0xc0c89425, &(0x7f0000000380)={"b57328a21a070000000000f4ff66a38e", 0x0, r5, {0x6, 0x9}, {0x9, 0x4}, 0xb, [0x4, 0x8000000000000000, 0x7fffffff, 0x1d51abb0, 0xfffffffffffffffc, 0x9, 0x5, 0x3, 0x2, 0x9, 0x1ff, 0x1000, 0x5, 0x8000000000000000, 0x1000000000008, 0x7]}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) umount2(&(0x7f00000004c0)='./file0/file0\x00', 0x3) r7 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x2c00, 0x0) r8 = open_tree(r7, &(0x7f0000000480)='./file0/file0\x00', 0x100) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r8, 0xc0045516, &(0x7f0000000500)=0xc5e) close_range(r7, r7, 0x0) syz_emit_vhci(&(0x7f0000000840)=ANY=[@ANYBLOB="040504", @ANYRES16=r6], 0x7) 2.668057162s ago: executing program 1 (id=3432): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000180)={0x0, 0xea60}, 0x10) sendmmsg$unix(r0, &(0x7f00000bd000), 0x800019e, 0x0) r1 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) ioctl$VIDIOC_QUERYMENU(r1, 0xc008561c, &(0x7f0000000000)={0x9f0902, 0xfffffff2, @name="82bf06255c32514ef266824307509e39f5e892343710c37e48a72f12e53542fb"}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r2, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r2, &(0x7f0000000380)='63', 0x2, 0x20000845, &(0x7f00000001c0)={0xa, 0x0, 0x4, @loopback, 0xa8b}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f00000010c0)='cdg', 0x3) shutdown(r2, 0x1) 2.448482263s ago: executing program 4 (id=3433): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r0, &(0x7f0000000380)='63', 0x2, 0x24000045, &(0x7f00000001c0)={0xa, 0x2, 0x8, @loopback, 0xa8e}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000010c0)='cdg', 0x3) shutdown(r0, 0x1) 2.213712097s ago: executing program 2 (id=3434): syz_usb_connect(0x5, 0x36, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text16={0x10, 0x0}], 0x1, 0x6d, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000037c0)=[{{0x0, 0x0, &(0x7f0000000380)=[{0x0}], 0x1, &(0x7f0000000600)=""/191, 0xbf}}], 0x1, 0x2040000, &(0x7f0000003700)={0x77359400}) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000080)={0x3, 0xbde, 0x0, &(0x7f0000000180)="a1984ec3aec3fc2e025f90eda6dbc903939aac644fd36f1e65174cae030c42cbacc392851a695f247112e91f059460a2c031929dc0515ac7cd20775ff9da9c2b6cb48968dcd6d8d982c492932c572f084d3af58650d207eec0794b3e47c5678c36b99eed61e1dbac68ce8a79aa21a51202018bdc4a51489844f785887083841d65c129992bbe5a51c71b95a9847d2bdede66c6e3184c386faf938fd6db888e73a5c0dcc69c3de7458e68ed33226a8d1c8e17", 0x0, 0xb2}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x40, 0x1, 0x10, 0x0, 0x8, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x1, 0x0, 0x0, 0xfffffff8, 0x0, 0xff, 0xff, 0x1}) 2.158712772s ago: executing program 4 (id=3435): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text16={0x10, 0x0}], 0x1, 0x6d, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x40, 0x1, 0x10, 0x0, 0x8, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x1, 0x0, 0x0, 0xfffffff8, 0x0, 0xff, 0xff, 0x1}) 1.968055289s ago: executing program 1 (id=3436): r0 = syz_ublk_setup_io_uring(0xd, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x154}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000300)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x20fb87, 0x800, 0x1, 0x32c, 0x0, r6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x0, 0x15a, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x8000, 0x10000000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88de, 0x8, 0x3, 0x0, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffffff, 0x8, 0x82, 0xbd}}], 0x1, &(0x7f0000000340)={0x2e, 0x54, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x700, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x826, 0x0, 0x0}}, 0x0) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f0000000340)={0x25, {0x0, 0x0, 0x0, 0x4, 0x5}}) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) 1.566637929s ago: executing program 1 (id=3437): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r1, 0x4138ae84, &(0x7f0000000080)={{0x2000, 0x0, 0xa, 0xea, 0x8, 0x0, 0x3a, 0x7, 0x7, 0xfa, 0x4, 0x2}, {0xc000, 0xeeee8000, 0xe, 0x1, 0x6, 0x1, 0xff, 0x4, 0x7, 0x53, 0x5, 0x5}, {0xeee90002, 0x6000, 0x2, 0x7, 0x8, 0x6, 0x3, 0x6e, 0xb0, 0x7, 0x5, 0x7}, {0x80a0000, 0x57800, 0xa, 0x8, 0x7, 0x9, 0xff, 0x1, 0x8, 0x8, 0x2, 0x9}, {0xffff1000, 0x41000, 0xe, 0x5, 0x5, 0x5, 0x9, 0x0, 0x80, 0x8, 0x0, 0xe0}, {0x6000, 0x50000, 0x10, 0x1, 0x98, 0x7, 0x56, 0xda, 0x3, 0xa, 0x4, 0x81}, {0xdddd1000, 0x4000, 0x9, 0x7, 0x80, 0xf7, 0x0, 0x2, 0x4, 0x0, 0x2a, 0x1}, {0x10000, 0x4000, 0x2, 0x0, 0x2, 0x7, 0x3, 0x7d, 0x5, 0xfd, 0x20, 0x8}, {0x8080000, 0xfffc}, {0x26000}, 0x18, 0x0, 0x8000000, 0x200000, 0x8, 0x11c00, 0x41000, [0xfffffffffffffffe, 0x18, 0x0, 0x830]}) 1.441100249s ago: executing program 3 (id=3438): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r0, &(0x7f0000000380)='63', 0x2, 0x24000045, &(0x7f00000001c0)={0xa, 0x2, 0x8, @loopback, 0xa8e}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000010c0)='cdg', 0x3) shutdown(r0, 0x1) (fail_nth: 1) 1.324043453s ago: executing program 1 (id=3439): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0xa8240, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f00000001c0)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b000ee6d6c2f800000c00f3266bac0000f3066b808008ed0660f38806f008ee0", 0x3a}], 0x1, 0x8, 0x0, 0xfffffffffffffd52) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12014101f2c59620d016b8108ede0102030109022400010000100009040002020083ec0009050602000202000a09058202"], 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io$lan78xx(r2, 0x0, &(0x7f0000000380)={0x34, &(0x7f0000000180)={0x40, 0xe, 0xc, "2bab101573208c0b30429519"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r2, 0x0, &(0x7f0000000940)={0x84, &(0x7f0000000340)=ANY=[@ANYBLOB="400028000000e2"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.316343682s ago: executing program 3 (id=3440): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x5, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x25cd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe4, 0x6, 0xfc000004, 0x402, 0xbbf, 0x4a732f64, 0x1, 0x1c0, 0xd, 0x0, 0x2a3, 0x6, 0x1, 0x2, 0xc3, 0x7, 0x81, 0x8a, 0x79, 0x2, 0x10000, 0x0, 0x91, 0x4, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x0, 0xf9a2, 0x80000001, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x9, 0x4], [0x9, 0x40, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x20000073, 0x8e, 0xd50, 0x7, 0x5, 0x4, 0x809, 0x4, 0xa7, 0x1000, 0x0, 0x200b398, 0x400080, 0x1, 0x4, 0x1c, 0x7, 0x1, 0x2, 0x3, 0x8, 0xffffff7f, 0x400, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x80004, 0x46, 0xf1, 0x4, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xffffeffe, 0xffff, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x8, 0x400, 0x6, 0xffff0000, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x7, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x9, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0xd, 0x7, 0x10010, 0x101, 0xdd81, 0x2, 0x7f, 0x9d27, 0x10000, 0x1, 0x100, 0x2, 0x6, 0x7ffd, 0x5, 0x3, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0x1], [0xa772, 0x6, 0x5, 0x1afa, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0x9, 0x1005, 0x1, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0xd, 0xfffffff7, 0x8, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x1, 0x26e, 0x6, 0xc, 0x4, 0xfffffff9, 0x9, 0x5d9, 0x463f, 0x4, 0xb0, 0x6, 0x6, 0x14000, 0x1, 0x9]}, 0x45c) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="14000000100001000000000000000000bd"], 0xac}}, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x42002, 0x180) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000100)={0x10, 0x56, 0x601}, 0x10}], 0x1, 0x0, 0x0, 0x4000001}, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x54}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x1c, 0x0, &(0x7f00000001c0)) ioctl$KVM_SET_REGS(r3, 0x4090ae82, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 975.166984ms ago: executing program 4 (id=3441): r0 = userfaultfd(0x801) shmat(0x0, &(0x7f000051b000/0x3000)=nil, 0x2000) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl(r1, 0x8b33, &(0x7f0000000040)) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000140)='/dev/comedi1\x00', 0x2, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x3000007, 0x13, r2, 0x2000) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_80211_inject_frame(0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$alg(0x26, 0x5, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$UBLK_U_CMD_SET_PARAMS(r3, 0xc0207508, &(0x7f00000000c0)={0x0, 0xffff, 0x0, 0x0}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000900)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a20000000000a05000000000000000000070000000900010073797a300000000060000000090a0103fe00000000000008070000000800084000a105010900010073797a30000000001c0009801000028060b5e6940800014000000002080001405fffffff080005400000000408000a40000000000900"], 0xa8}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r3, 0x81f8943c, 0x0) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000340)=0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r3, 0xc0c89425, &(0x7f0000000380)={"b57328a21a070000000000f4ff66a38e", 0x0, r5, {0x6, 0x9}, {0x9, 0x4}, 0xb, [0x4, 0x8000000000000000, 0x7fffffff, 0x1d51abb0, 0xfffffffffffffffc, 0x9, 0x5, 0x3, 0x2, 0x9, 0x1ff, 0x1000, 0x5, 0x8000000000000000, 0x1000000000008, 0x7]}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) umount2(&(0x7f00000004c0)='./file0/file0\x00', 0x3) r7 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x2c00, 0x0) r8 = open_tree(r7, &(0x7f0000000480)='./file0/file0\x00', 0x100) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r8, 0xc0045516, &(0x7f0000000500)=0xc5e) close_range(r7, r7, 0x0) syz_emit_vhci(&(0x7f0000000840)=ANY=[@ANYBLOB="04050400c9", @ANYRES16=r6], 0x7) 214.156889ms ago: executing program 3 (id=3442): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x169802, 0x0) r1 = dup(r0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='wchan\x00') lseek(r2, 0x1, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/functions/mass_storage.usb0\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/mass_storage.usb0/num_buffers\x00', 0x1, 0x0) write(r3, &(0x7f0000000500)='4\x00', 0x1) close(r3) symlinkat(&(0x7f0000000200)='./config/usb_gadget/g1/functions/mass_storage.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/configs/c.1/mass_storage.usb0\x00') unlinkat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/configs/c.1/mass_storage.usb0\x00', 0x0) rmdir(&(0x7f0000000200)='./config/usb_gadget/g1/functions/mass_storage.usb0\x00') ioctl$BLKREPORTZONE(r2, 0xc0101282, &(0x7f0000000000)={0xfffffffffffffff8, 0x8, 0x0, [{0x5, 0x20, 0xcc, 0x40, 0x8, 0xb, 0x40, '\x00', 0x1}, {0x8, 0x2, 0xfffffffffffffff4, 0x5, 0x45, 0xc, 0x3, '\x00', 0x4}, {0x400, 0xfffffffffffffffe, 0x7a, 0x6, 0x96, 0x48, 0x5, '\x00', 0x6}, {0xffffffffffff5cd1, 0x3f, 0x7000000000000000, 0x9, 0x4, 0xb, 0x2, '\x00', 0x3}, {0xb, 0x4, 0x1, 0x3, 0xc, 0x1}, {0x80000001, 0xfff, 0x8, 0x6, 0x9, 0x9, 0x59, '\x00', 0x1ff}, {0x4, 0x1, 0x9, 0x0, 0x9, 0x5, 0x80, '\x00', 0xc5}, {0x200, 0x101, 0xb, 0x2, 0x4, 0x3c, 0xab, '\x00', 0x6}]}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x13, r1, 0x0) 143.643954ms ago: executing program 2 (id=3443): r0 = syz_usb_connect$cdc_ncm(0x2, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESDEC], 0x0) syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000080)="00012c615bc2") syz_usb_control_io$cdc_ncm(r0, &(0x7f00000003c0)={0x14, &(0x7f0000000280)={0x40, 0x10, 0xee, {0xee, 0x21, "492640682fe563209d0e3c9d4817b0f7e6e8b16a4e7c9c744bfc484f98da0be5430591691494c32e1341212195005a2d1de950e62e2843797c74b2c0ffb583bec95ca4e5f37db8d41aaa70a201a23b1c4351ce53ffcf0e04c24e4698f00ddccdd6f60cafec3e55e937fedde54304b93cbd7a31531f5a5dafe466241663c3b5c5202ad09224cc9f5eeffca627269cf6b698fa4e2cb4552e89bb882cc5234f119a3cb4eec16100ce31943d004976a1ff8994a2c621bda9af7e36e65d9cd8b178dcc2ab16ef4658a0d7255673987816d1ed5d7e913a23a063bd591f6886cf7a023910f0e621b648952f8bfb9f1d"}}, &(0x7f0000000380)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000640)={0x44, &(0x7f0000000400)={0x0, 0x13, 0x26, "32d1a061258d3ea54ef4e5a55546de06439d22fcb78b08e76a5d3036d4fc10e7b638d0c1cd80"}, &(0x7f0000000440)={0x0, 0xa, 0x1, 0x94}, &(0x7f00000004c0)={0x0, 0x8, 0x1, 0xf}, &(0x7f0000000500)={0x20, 0x80, 0x1c, {0x1, 0x82, 0x4, 0x100, 0x12de, 0x4, 0x1ff, 0x9, 0x1, 0x2, 0x8, 0x7ff}}, &(0x7f0000000540)={0x20, 0x85, 0x4, 0x7d}, &(0x7f0000000580)={0x20, 0x83, 0x2, 0x1}, &(0x7f00000005c0)={0x20, 0x87, 0x2, 0x4}, &(0x7f0000000600)={0x20, 0x89, 0x2, 0x1}}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) 0s ago: executing program 4 (id=3444): r0 = socket$packet(0x11, 0x3, 0x300) recvmmsg(r0, &(0x7f0000000600)=[{{&(0x7f0000000240)=@isdn, 0x80, &(0x7f00000004c0)=[{&(0x7f00000002c0)=""/11, 0xb}, {&(0x7f0000000400)=""/161, 0xa1}], 0x2, &(0x7f0000000500)=""/207, 0xcf}, 0x98}], 0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'ipvlan0\x00', 0x0}) r2 = socket$inet6(0xa, 0x3, 0x9) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x1c) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) listns(&(0x7f0000000080)={0x20, 0x0, 0xa, 0x80, 0x0, 0xffffffffffffffff}, 0x0, 0xf4240, 0x0) setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x30, 0x0, 0x0) r3 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r3, 0xc0405602, &(0x7f0000000380)={0x11, 0x1, 0x3, "33c500100000000040fcd817a45b729fd5085780ee0f00", 0x20363059}) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_FILL_RING(r5, 0x11b, 0x5, &(0x7f0000000140)=0x4000, 0x4) setsockopt$XDP_UMEM_FILL_RING(r5, 0x11b, 0x5, &(0x7f0000000040)=0x800, 0x4) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='qnx6\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./dev/g_printer0\x00', 0x2, 0x0) r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000f00), r6) sendmsg$IEEE802154_ASSOCIATE_RESP(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)=ANY=[@ANYBLOB="14000000", @ANYRES16=r8, @ANYBLOB="f631c6ebf1b1ace3223bf025bd7000ffdbdf2513000000"], 0x14}, 0x1, 0x0, 0x0, 0x48800}, 0x4000040) getsockopt$inet_IP_XFRM_POLICY(r7, 0x0, 0x11, &(0x7f00000006c0)={{{@in=@loopback, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={""/10, ""/2, @dev}}, 0x0, @in6}}, &(0x7f00000007c0)=0xe8) mount$9p_unix(&(0x7f0000000300)='./file0\x00', &(0x7f0000000640)='./dev/g_printer0\x00', &(0x7f0000000680), 0x2000000, &(0x7f00000008c0)={'trans=unix,', {[{@cache_loose}, {@access_user}, {@dfltuid={'dfltuid', 0x3d, r9}}], [{@seclabel}, {@func={'func', 0x3d, 'PATH_CHECK'}}, {@obj_type={'obj_type', 0x3d, 'NLBL_CALIPSO\x00'}}, {@fsuuid={'fsuuid', 0x3d, {[0x36, 0x62, 0x53, 0x35, 0x32, 0xd, 0x6c, 0x62], 0x2d, [0x32, 0x31, 0x32, 0x32], 0x2d, [0x62, 0x37, 0x34, 0x65], 0x2d, [0x36, 0x65, 0x34, 0x30], 0x2d, [0x31, 0x63, 0x0, 0x33, 0x66, 0x38, 0x34, 0x33]}}}, {@obj_type={'obj_type', 0x3d, '*/,*'}}, {@smackfstransmute={'smackfstransmute', 0x3d, '\'{'}}, {@measure}]}}) sendto$packet(r0, &(0x7f00000000c0)="91685102d300000013000010888e", 0xe, 0x0, &(0x7f0000000080)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r10 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000100), r6) sendmsg$NLBL_CALIPSO_C_LIST(r4, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x54, r10, 0x300, 0x70bd28, 0x25dfdbfd, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000005}, 0x10891) kernel console output (not intermixed with test programs): usb 3-1: new full-speed USB device number 25 using dummy_hcd [ 820.649784][ T5699] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 820.649820][ T5699] usb 3-1: config 1 has an invalid descriptor of length 52, skipping remainder of the config [ 820.649836][ T5699] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 820.649872][ T5699] usb 3-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xF7, changing to 0x87 [ 820.649891][ T5699] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 52, changing to 4 [ 820.649910][ T5699] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x87 has invalid maxpacket 13368, setting to 1023 [ 820.687401][ T5699] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 820.687522][ T5699] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 820.687578][ T5699] usb 3-1: Product: syz [ 820.687619][ T5699] usb 3-1: Manufacturer: syz [ 820.742803][T14223] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 820.759352][T14223] usb 5-1: device descriptor read/8, error -71 [ 820.781111][ T5699] cdc_wdm 3-1:1.0: skipping garbage [ 820.781128][ T5699] cdc_wdm 3-1:1.0: skipping garbage [ 820.783071][ T5699] cdc_wdm 3-1:1.0: probe with driver cdc_wdm failed with error -22 [ 820.997452][T14223] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 821.029215][T14223] usb 5-1: device descriptor read/8, error -71 [ 821.096125][T16234] gadgetfs: bound to dummy_udc driver [ 821.148917][T14223] usb usb5-port1: unable to enumerate USB device [ 821.457317][T14223] usb 4-1: new full-speed USB device number 103 using dummy_hcd [ 821.620222][T14223] usb 4-1: unable to get BOS descriptor or descriptor too short [ 821.620822][T14223] usb 4-1: not running at top speed; connect to a high speed hub [ 821.622048][T14223] usb 4-1: config 14 has an invalid interface number: 57 but max is 1 [ 821.622160][T14223] usb 4-1: config 14 has an invalid interface number: 228 but max is 1 [ 821.622186][T14223] usb 4-1: config 14 has an invalid descriptor of length 0, skipping remainder of the config [ 821.622206][T14223] usb 4-1: config 14 has no interface number 0 [ 821.622223][T14223] usb 4-1: config 14 has no interface number 1 [ 821.622281][T14223] usb 4-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 821.622299][T14223] usb 4-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 821.622318][T14223] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 821.622422][T14223] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 137, setting to 64 [ 821.622453][T14223] usb 4-1: config 14 interface 57 has no altsetting 0 [ 821.622486][T14223] usb 4-1: config 14 interface 228 has no altsetting 0 [ 821.625335][T14223] usb 4-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 821.625364][T14223] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 821.625384][T14223] usb 4-1: Product: syz [ 821.625398][T14223] usb 4-1: Manufacturer: syz [ 821.625419][T14223] usb 4-1: SerialNumber: syz [ 822.197357][T14223] legousbtower 4-1:14.57: interrupt endpoints not found [ 822.600730][T14223] legousbtower 4-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 822.603013][T14223] legousbtower 4-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 822.787314][T12255] usb 5-1: new full-speed USB device number 19 using dummy_hcd [ 822.952184][T12255] usb 5-1: unable to get BOS descriptor or descriptor too short [ 822.952810][T12255] usb 5-1: not running at top speed; connect to a high speed hub [ 822.954045][T12255] usb 5-1: config 14 has an invalid interface number: 57 but max is 1 [ 822.954073][T12255] usb 5-1: config 14 has an invalid interface number: 228 but max is 1 [ 822.954094][T12255] usb 5-1: config 14 has an invalid descriptor of length 0, skipping remainder of the config [ 822.954113][T12255] usb 5-1: config 14 has no interface number 0 [ 822.954133][T12255] usb 5-1: config 14 has no interface number 1 [ 822.954184][T12255] usb 5-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 822.954202][T12255] usb 5-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 822.954221][T12255] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 822.954242][T12255] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 137, setting to 64 [ 822.954268][T12255] usb 5-1: config 14 interface 57 has no altsetting 0 [ 822.954282][T12255] usb 5-1: config 14 interface 228 has no altsetting 0 [ 822.956858][T12255] usb 5-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 822.956886][T12255] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 822.956918][T12255] usb 5-1: Product: syz [ 822.956929][T12255] usb 5-1: Manufacturer: syz [ 822.956940][T12255] usb 5-1: SerialNumber: syz [ 823.217320][T12254] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 823.292839][ T32] usb 3-1: USB disconnect, device number 25 [ 823.400157][T12254] usb 2-1: unable to get BOS descriptor or descriptor too short [ 823.403075][T12254] usb 2-1: not running at top speed; connect to a high speed hub [ 823.422070][T12254] usb 2-1: config 14 has an invalid interface number: 57 but max is 1 [ 823.422162][T12254] usb 2-1: config 14 has an invalid interface number: 228 but max is 1 [ 823.422187][T12254] usb 2-1: config 14 has an invalid descriptor of length 0, skipping remainder of the config [ 823.422209][T12254] usb 2-1: config 14 has no interface number 0 [ 823.422229][T12254] usb 2-1: config 14 has no interface number 1 [ 823.422403][T12254] usb 2-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 823.422432][T12254] usb 2-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 823.422524][T12254] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 823.422554][T12254] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 137, setting to 64 [ 823.422584][T12254] usb 2-1: config 14 interface 57 has no altsetting 0 [ 823.422605][T12254] usb 2-1: config 14 interface 228 has no altsetting 0 [ 823.426680][T12254] usb 2-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 823.426710][T12254] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 823.426799][T12254] usb 2-1: Product: syz [ 823.426818][T12254] usb 2-1: Manufacturer: syz [ 823.426835][T12254] usb 2-1: SerialNumber: syz [ 823.471370][ C0] usb 4-1: tower_interrupt_in_callback: usb_submit_urb failed (-1) [ 823.639623][ T5699] usb 4-1: USB disconnect, device number 103 [ 823.671045][ T5699] legousbtower 4-1:14.228: LEGO USB Tower #-160 now disconnected [ 823.723286][T12255] legousbtower 5-1:14.57: interrupt endpoints not found [ 823.841814][T16247] FAULT_INJECTION: forcing a failure. [ 823.841814][T16247] name failslab, interval 1, probability 0, space 0, times 0 [ 823.841847][T16247] CPU: 1 UID: 0 PID: 16247 Comm: syz.2.3257 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 823.841867][T16247] Tainted: [L]=SOFTLOCKUP [ 823.841872][T16247] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 823.841882][T16247] Call Trace: [ 823.841888][T16247] [ 823.841894][T16247] dump_stack_lvl+0xe8/0x150 [ 823.841921][T16247] should_fail_ex+0x467/0x600 [ 823.841944][T16247] should_failslab+0xa8/0x100 [ 823.841960][T16247] __kmalloc_noprof+0xfb/0x790 [ 823.841982][T16247] ? tomoyo_realpath_from_path+0xef/0x640 [ 823.842006][T16247] ? tomoyo_realpath_from_path+0xef/0x640 [ 823.842033][T16247] tomoyo_realpath_from_path+0xef/0x640 [ 823.842062][T16247] ? tomoyo_path_number_perm+0x219/0x5f0 [ 823.842081][T16247] tomoyo_path_number_perm+0x246/0x5f0 [ 823.842102][T16247] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 823.842121][T16247] ? do_raw_spin_lock+0x12b/0x2f0 [ 823.842151][T16247] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 823.842166][T16247] ? lockdep_hardirqs_on+0x7a/0x110 [ 823.842191][T16247] ? __fget_files+0x2a/0x420 [ 823.842209][T16247] ? __fget_files+0x3a8/0x420 [ 823.842223][T16247] ? __fget_files+0x2a/0x420 [ 823.842241][T16247] security_file_ioctl+0xb9/0x260 [ 823.842260][T16247] __se_sys_ioctl+0x47/0x170 [ 823.842281][T16247] do_syscall_64+0x17b/0x530 [ 823.842296][T16247] ? irqentry_exit+0x10f/0x8f0 [ 823.842310][T16247] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 823.842328][T16247] ? clear_bhb_loop+0x40/0x90 [ 823.842346][T16247] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 823.842360][T16247] RIP: 0033:0x7f076e42de99 [ 823.842374][T16247] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 823.842387][T16247] RSP: 002b:00007f076c686028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 823.842403][T16247] RAX: ffffffffffffffda RBX: 00007f076e6b5fa0 RCX: 00007f076e42de99 [ 823.842414][T16247] RDX: 0000200000000340 RSI: 000000004048ae9b RDI: 0000000000000005 [ 823.842424][T16247] RBP: 00007f076c686090 R08: 0000000000000000 R09: 0000000000000000 [ 823.842433][T16247] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 823.842442][T16247] R13: 00007f076e6b6038 R14: 00007f076e6b5fa0 R15: 00007ffe4abc5428 [ 823.842464][T16247] [ 823.842515][T16247] ERROR: Out of memory at tomoyo_realpath_from_path. [ 824.129819][T12255] legousbtower 5-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 824.178079][T12254] legousbtower 2-1:14.57: interrupt endpoints not found [ 824.193167][T12255] legousbtower 5-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 824.336219][T16250] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3258'. [ 824.558982][T12254] legousbtower 2-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 824.561754][T12254] legousbtower 2-1:14.228: LEGO USB Tower #-159 now attached to major 180 minor 1 [ 824.566214][T16255] netlink: 'syz.3.3260': attribute type 1 has an invalid length. [ 824.566233][T16255] netlink: 'syz.3.3260': attribute type 2 has an invalid length. [ 824.679250][T16265] FAULT_INJECTION: forcing a failure. [ 824.679250][T16265] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 824.679290][T16265] CPU: 1 UID: 0 PID: 16265 Comm: syz.4.3254 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 824.679322][T16265] Tainted: [L]=SOFTLOCKUP [ 824.679330][T16265] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 824.679343][T16265] Call Trace: [ 824.679352][T16265] [ 824.679362][T16265] dump_stack_lvl+0xe8/0x150 [ 824.679395][T16265] should_fail_ex+0x467/0x600 [ 824.679429][T16265] _copy_from_user+0x2d/0xb0 [ 824.679451][T16265] do_sys_poll+0x258/0xf50 [ 824.679471][T16265] ? lock_acquire+0x115/0x350 [ 824.679515][T16265] ? __lock_acquire+0x6df/0x2e40 [ 824.679535][T16265] ? __pfx_do_sys_poll+0x10/0x10 [ 824.679558][T16265] ? is_bpf_text_address+0x26/0x2b0 [ 824.679586][T16265] ? kernel_text_address+0xa5/0xe0 [ 824.679737][T16265] ? set_user_sigmask+0xcd/0x1c0 [ 824.679764][T16265] ? __pfx_set_user_sigmask+0x10/0x10 [ 824.679788][T16265] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 824.679835][T16265] __se_sys_ppoll+0x209/0x2b0 [ 824.679870][T16265] ? fput+0xa0/0xd0 [ 824.679906][T16265] ? __pfx___se_sys_ppoll+0x10/0x10 [ 824.679941][T16265] ? __pfx_ksys_write+0x10/0x10 [ 824.679973][T16265] ? __x64_sys_ppoll+0x20/0xc0 [ 824.680009][T16265] do_syscall_64+0x17b/0x530 [ 824.680032][T16265] ? irqentry_exit+0x10f/0x8f0 [ 824.680052][T16265] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 824.680075][T16265] ? clear_bhb_loop+0x40/0x90 [ 824.680103][T16265] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 824.680126][T16265] RIP: 0033:0x7f150b29de99 [ 824.680146][T16265] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 824.680166][T16265] RSP: 002b:00007f15094d5028 EFLAGS: 00000246 ORIG_RAX: 000000000000010f [ 824.680189][T16265] RAX: ffffffffffffffda RBX: 00007f150b526090 RCX: 00007f150b29de99 [ 824.680206][T16265] RDX: 0000000000000000 RSI: 20000000000000dc RDI: 00002000000000c0 [ 824.680222][T16265] RBP: 00007f15094d5090 R08: 0000000000000000 R09: 0000000000000000 [ 824.680237][T16265] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 824.680250][T16265] R13: 00007f150b526128 R14: 00007f150b526090 R15: 00007fffa37ebab8 [ 824.680284][T16265] [ 824.923945][ C1] usb 5-1: tower_interrupt_in_callback: usb_submit_urb failed (-1) [ 824.937586][ T5694] usb 5-1: USB disconnect, device number 19 [ 824.975022][ T5694] legousbtower 5-1:14.228: LEGO USB Tower #-160 now disconnected [ 825.113122][T16267] gadgetfs: bound to dummy_udc driver [ 825.311505][T16272] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3255'. [ 825.349164][T16273] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3263'. [ 825.349298][T16273] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3263'. [ 825.467334][ T5694] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 825.617432][ T5694] usb 4-1: device descriptor read/64, error -71 [ 825.767365][T12254] usb 5-1: new full-speed USB device number 20 using dummy_hcd [ 825.857437][ T5694] usb 4-1: new high-speed USB device number 105 using dummy_hcd [ 825.919741][T12254] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 825.919774][T12254] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 825.919795][T12254] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 825.919857][T12254] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 14385, setting to 64 [ 825.921711][T12254] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 825.921740][T12254] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 825.921761][T12254] usb 5-1: Product: syz [ 825.921777][T12254] usb 5-1: Manufacturer: syz [ 825.974811][T12254] cdc_wdm 5-1:1.0: skipping garbage [ 825.974858][T12254] cdc_wdm 5-1:1.0: skipping garbage [ 826.003937][T12254] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 826.004001][T12254] cdc_wdm 5-1:1.0: Unknown control protocol [ 826.057431][ T5694] usb 4-1: device descriptor read/64, error -71 [ 826.168352][ T5694] usb usb4-port1: attempt power cycle [ 826.342773][ T5699] usb 2-1: USB disconnect, device number 7 [ 826.368155][ T5699] legousbtower 2-1:14.228: LEGO USB Tower #-159 now disconnected [ 826.393889][T16281] FAULT_INJECTION: forcing a failure. [ 826.393889][T16281] name failslab, interval 1, probability 0, space 0, times 0 [ 826.394957][T16281] CPU: 0 UID: 0 PID: 16281 Comm: syz.2.3266 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 826.394988][T16281] Tainted: [L]=SOFTLOCKUP [ 826.394996][T16281] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 826.395009][T16281] Call Trace: [ 826.395017][T16281] [ 826.395027][T16281] dump_stack_lvl+0xe8/0x150 [ 826.395067][T16281] should_fail_ex+0x467/0x600 [ 826.395118][T16281] should_failslab+0xa8/0x100 [ 826.395143][T16281] __kmalloc_noprof+0xfb/0x790 [ 826.395175][T16281] ? tomoyo_realpath_from_path+0xef/0x640 [ 826.395209][T16281] ? tomoyo_realpath_from_path+0xef/0x640 [ 826.395248][T16281] tomoyo_realpath_from_path+0xef/0x640 [ 826.395291][T16281] ? tomoyo_path_number_perm+0x219/0x5f0 [ 826.395319][T16281] tomoyo_path_number_perm+0x246/0x5f0 [ 826.395350][T16281] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 826.395379][T16281] ? do_raw_spin_lock+0x12b/0x2f0 [ 826.395424][T16281] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 826.395447][T16281] ? lockdep_hardirqs_on+0x7a/0x110 [ 826.395486][T16281] ? __fget_files+0x2a/0x420 [ 826.395514][T16281] ? __fget_files+0x3a8/0x420 [ 826.395536][T16281] ? __fget_files+0x2a/0x420 [ 826.395563][T16281] security_file_ioctl+0xb9/0x260 [ 826.395592][T16281] __se_sys_ioctl+0x47/0x170 [ 826.395625][T16281] do_syscall_64+0x17b/0x530 [ 826.395646][T16281] ? irqentry_exit+0x10f/0x8f0 [ 826.395667][T16281] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 826.395690][T16281] ? clear_bhb_loop+0x40/0x90 [ 826.395718][T16281] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 826.395741][T16281] RIP: 0033:0x7f076e42de99 [ 826.395762][T16281] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 826.395783][T16281] RSP: 002b:00007f076c665028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 826.395807][T16281] RAX: ffffffffffffffda RBX: 00007f076e6b6090 RCX: 00007f076e42de99 [ 826.395824][T16281] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 000000000000000b [ 826.395839][T16281] RBP: 00007f076c665090 R08: 0000000000000000 R09: 0000000000000000 [ 826.395853][T16281] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 826.395867][T16281] R13: 00007f076e6b6128 R14: 00007f076e6b6090 R15: 00007ffe4abc5428 [ 826.395907][T16281] [ 826.395929][T16281] ERROR: Out of memory at tomoyo_realpath_from_path. [ 826.538256][ T5694] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 826.587837][ T5694] usb 4-1: device descriptor read/8, error -71 [ 826.827065][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 826.857359][ T5694] usb 4-1: new high-speed USB device number 107 using dummy_hcd [ 826.880693][ T5694] usb 4-1: device descriptor read/8, error -71 [ 826.998288][ T5694] usb usb4-port1: unable to enumerate USB device [ 827.729265][T16298] gadgetfs: bound to dummy_udc driver [ 827.873295][T16300] FAULT_INJECTION: forcing a failure. [ 827.873295][T16300] name failslab, interval 1, probability 0, space 0, times 0 [ 827.873332][T16300] CPU: 1 UID: 0 PID: 16300 Comm: syz.2.3272 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 827.873362][T16300] Tainted: [L]=SOFTLOCKUP [ 827.873369][T16300] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 827.873387][T16300] Call Trace: [ 827.873395][T16300] [ 827.873404][T16300] dump_stack_lvl+0xe8/0x150 [ 827.873436][T16300] should_fail_ex+0x467/0x600 [ 827.873467][T16300] should_failslab+0xa8/0x100 [ 827.873489][T16300] __kmalloc_noprof+0xfb/0x790 [ 827.873519][T16300] ? tomoyo_realpath_from_path+0xef/0x640 [ 827.873562][T16300] ? tomoyo_realpath_from_path+0xef/0x640 [ 827.873600][T16300] tomoyo_realpath_from_path+0xef/0x640 [ 827.873640][T16300] ? tomoyo_path_number_perm+0x219/0x5f0 [ 827.873666][T16300] tomoyo_path_number_perm+0x246/0x5f0 [ 827.873697][T16300] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 827.873725][T16300] ? do_raw_spin_lock+0x12b/0x2f0 [ 827.873765][T16300] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 827.873786][T16300] ? lockdep_hardirqs_on+0x7a/0x110 [ 827.873823][T16300] ? __fget_files+0x2a/0x420 [ 827.873850][T16300] ? __fget_files+0x3a8/0x420 [ 827.873871][T16300] ? __fget_files+0x2a/0x420 [ 827.873897][T16300] security_file_ioctl+0xb9/0x260 [ 827.873923][T16300] __se_sys_ioctl+0x47/0x170 [ 827.873954][T16300] do_syscall_64+0x17b/0x530 [ 827.873975][T16300] ? irqentry_exit+0x10f/0x8f0 [ 827.873994][T16300] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 827.874016][T16300] ? clear_bhb_loop+0x40/0x90 [ 827.874042][T16300] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 827.874064][T16300] RIP: 0033:0x7f076e42de99 [ 827.874082][T16300] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 827.874100][T16300] RSP: 002b:00007f076c686028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 827.874123][T16300] RAX: ffffffffffffffda RBX: 00007f076e6b5fa0 RCX: 00007f076e42de99 [ 827.874138][T16300] RDX: 0000200000000040 RSI: 00000000c008ae88 RDI: 0000000000000005 [ 827.874153][T16300] RBP: 00007f076c686090 R08: 0000000000000000 R09: 0000000000000000 [ 827.874166][T16300] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 827.874179][T16300] R13: 00007f076e6b6038 R14: 00007f076e6b5fa0 R15: 00007ffe4abc5428 [ 827.874212][T16300] [ 827.874326][T16300] ERROR: Out of memory at tomoyo_realpath_from_path. [ 828.620931][ T32] usb 5-1: USB disconnect, device number 20 [ 828.682662][T16317] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3275'. [ 828.797829][T14223] usb 4-1: new full-speed USB device number 108 using dummy_hcd [ 828.968839][T14223] usb 4-1: config index 0 descriptor too short (expected 5924, got 36) [ 828.968871][T14223] usb 4-1: config 250 has an invalid interface number: 228 but max is -1 [ 828.968894][T14223] usb 4-1: config 250 has 1 interface, different from the descriptor's value: 0 [ 828.968917][T14223] usb 4-1: config 250 has no interface number 0 [ 828.968964][T14223] usb 4-1: config 250 interface 228 altsetting 255 endpoint 0x1 has invalid maxpacket 65280, setting to 64 [ 828.968986][T14223] usb 4-1: config 250 interface 228 altsetting 255 endpoint 0x82 has invalid wMaxPacketSize 0 [ 828.969003][T14223] usb 4-1: config 250 interface 228 altsetting 255 has 2 endpoint descriptors, different from the interface descriptor's value: 17 [ 828.969023][T14223] usb 4-1: config 250 interface 228 has no altsetting 0 [ 829.001862][T14223] usb 4-1: New USB device found, idVendor=0525, idProduct=d292, bcdDevice= 0.07 [ 829.001940][T14223] usb 4-1: New USB device strings: Mfr=0, Product=106, SerialNumber=59 [ 829.002004][T14223] usb 4-1: Product: syz [ 829.002042][T14223] usb 4-1: SerialNumber: syz [ 829.119755][T14223] hub 4-1:250.228: bad descriptor, ignoring hub [ 829.119785][T14223] hub 4-1:250.228: probe with driver hub failed with error -5 [ 830.092532][T16331] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3278'. [ 830.309570][T12255] usb 5-1: new full-speed USB device number 21 using dummy_hcd [ 830.379651][T16333] gadgetfs: bound to dummy_udc driver [ 830.485183][T12255] usb 5-1: New USB device found, idVendor=0c72, idProduct=000d, bcdDevice=27.9b [ 830.485217][T12255] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 830.485241][T12255] usb 5-1: Product: syz [ 830.485258][T12255] usb 5-1: Manufacturer: syz [ 830.485275][T12255] usb 5-1: SerialNumber: syz [ 830.527924][T12255] usb 5-1: config 0 descriptor?? [ 831.175007][T12255] peak_usb 5-1:0.0 can0: unable to request usb[type=0 value=1] err=-71 [ 831.175040][T12255] peak_usb 5-1:0.0: unable to read PCAN-USB Pro firmware info (err -71) [ 831.205287][T16334] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 831.459629][T12255] peak_usb 5-1:0.0: probe with driver peak_usb failed with error -71 [ 831.465542][T16343] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 831.491288][T16344] FAULT_INJECTION: forcing a failure. [ 831.491288][T16344] name failslab, interval 1, probability 0, space 0, times 0 [ 831.491329][T16344] CPU: 0 UID: 0 PID: 16344 Comm: syz.4.3282 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 831.491360][T16344] Tainted: [L]=SOFTLOCKUP [ 831.491369][T16344] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 831.491386][T16344] Call Trace: [ 831.491395][T16344] [ 831.491405][T16344] dump_stack_lvl+0xe8/0x150 [ 831.491440][T16344] should_fail_ex+0x467/0x600 [ 831.491476][T16344] should_failslab+0xa8/0x100 [ 831.491500][T16344] __kmalloc_noprof+0xfb/0x790 [ 831.491532][T16344] ? tomoyo_realpath_from_path+0xef/0x640 [ 831.491565][T16344] ? tomoyo_realpath_from_path+0xef/0x640 [ 831.491607][T16344] tomoyo_realpath_from_path+0xef/0x640 [ 831.491652][T16344] ? tomoyo_path_number_perm+0x219/0x5f0 [ 831.491681][T16344] tomoyo_path_number_perm+0x246/0x5f0 [ 831.491722][T16344] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 831.491752][T16344] ? do_raw_spin_lock+0x12b/0x2f0 [ 831.491789][T16344] ? __pfx___schedule+0x10/0x10 [ 831.491859][T16344] ? tomoyo_file_ioctl+0x11/0x30 [ 831.491889][T16344] security_file_ioctl+0xb9/0x260 [ 831.491919][T16344] __se_sys_ioctl+0x47/0x170 [ 831.491953][T16344] do_syscall_64+0x17b/0x530 [ 831.491976][T16344] ? irqentry_exit+0x10f/0x8f0 [ 831.491998][T16344] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 831.492032][T16344] ? clear_bhb_loop+0x40/0x90 [ 831.492059][T16344] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 831.492080][T16344] RIP: 0033:0x7f150b29de99 [ 831.492098][T16344] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 831.492118][T16344] RSP: 002b:00007f15094f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 831.492141][T16344] RAX: ffffffffffffffda RBX: 00007f150b525fa0 RCX: 00007f150b29de99 [ 831.492157][T16344] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 831.492171][T16344] RBP: 00007f15094f6090 R08: 0000000000000000 R09: 0000000000000000 [ 831.492184][T16344] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 831.492198][T16344] R13: 00007f150b526038 R14: 00007f150b525fa0 R15: 00007fffa37ebab8 [ 831.492232][T16344] [ 831.493853][T16344] ERROR: Out of memory at tomoyo_realpath_from_path. [ 831.748253][T12255] usb 5-1: USB disconnect, device number 21 [ 831.936172][T16344] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 832.347391][ T5694] usb 3-1: new full-speed USB device number 26 using dummy_hcd [ 832.520130][ T5694] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 832.520168][ T5694] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 832.520183][ T5694] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 832.520265][ T5694] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 14385, setting to 64 [ 832.522114][ T5694] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 832.522135][ T5694] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 832.522149][ T5694] usb 3-1: Product: syz [ 832.522202][ T5694] usb 3-1: Manufacturer: syz [ 832.593714][T12255] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 832.640565][ T5694] cdc_wdm 3-1:1.0: skipping garbage [ 832.640586][ T5694] cdc_wdm 3-1:1.0: skipping garbage [ 832.670975][ T5694] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 832.671000][ T5694] cdc_wdm 3-1:1.0: Unknown control protocol [ 832.737414][T12255] usb 5-1: Using ep0 maxpacket: 32 [ 832.739724][T12255] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 832.739753][T12255] usb 5-1: config 0 has no interface number 0 [ 832.745293][T12255] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 832.745325][T12255] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 832.745347][T12255] usb 5-1: Product: syz [ 832.745363][T12255] usb 5-1: Manufacturer: syz [ 832.745380][T12255] usb 5-1: SerialNumber: syz [ 832.814129][T12255] usb 5-1: config 0 descriptor?? [ 832.833948][T12255] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 833.173478][T12255] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 833.230369][T12255] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 833.449249][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 833.485768][ C1] usb 5-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 833.486863][ T5694] usb 5-1: USB disconnect, device number 22 [ 833.554267][ T5694] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 833.589800][ T5694] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 833.611460][ T5694] quatech2 5-1:0.51: device disconnected [ 834.263811][T14223] usblp 4-1:250.228: usblp1: USB Bidirectional printer dev 108 if 228 alt 255 proto 3 vid 0x0525 pid 0xD292 [ 834.385411][T16375] gadgetfs: bound to dummy_udc driver [ 835.212932][ T37] usb 3-1: USB disconnect, device number 26 [ 835.352124][T16385] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 835.837351][ T37] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 835.930432][T12255] usb 4-1: USB disconnect, device number 108 [ 835.985951][T12255] usblp1: removed [ 835.990328][ T37] usb 3-1: Using ep0 maxpacket: 32 [ 835.996311][ T37] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid maxpacket 56288, setting to 1024 [ 835.996350][ T37] usb 3-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 1024 [ 835.996378][ T37] usb 3-1: config 0 interface 0 has no altsetting 0 [ 836.003237][ T37] usb 3-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 836.003267][ T37] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 836.003289][ T37] usb 3-1: Product: syz [ 836.003305][ T37] usb 3-1: Manufacturer: syz [ 836.003321][ T37] usb 3-1: SerialNumber: syz [ 836.043329][ T37] usb 3-1: config 0 descriptor?? [ 836.044751][T16395] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 836.462760][ T37] gs_usb 3-1:0.0: Configuring for 22 interfaces [ 836.517469][T12255] usb 5-1: new full-speed USB device number 23 using dummy_hcd [ 836.670700][T12255] usb 5-1: config 0 interface 0 has no altsetting 0 [ 836.670748][T12255] usb 5-1: New USB device found, idVendor=04b4, idProduct=0001, bcdDevice= 0.00 [ 836.670766][T12255] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 836.713022][T12255] usb 5-1: config 0 descriptor?? [ 836.870169][ T37] gs_usb 3-1:0.0: Couldn't get bit timing const for channel 1 (-EPROTO) [ 837.105904][T16420] gadgetfs: bound to dummy_udc driver [ 837.148917][T12255] hid_parser_main: 5 callbacks suppressed [ 837.148965][T12255] cypress 0003:04B4:0001.000D: unknown main item tag 0x1 [ 837.149024][T12255] cypress 0003:04B4:0001.000D: unknown main item tag 0x5 [ 837.149043][T12255] cypress 0003:04B4:0001.000D: unknown main item tag 0x6 [ 837.149067][T12255] cypress 0003:04B4:0001.000D: unknown main item tag 0x0 [ 837.149086][T12255] cypress 0003:04B4:0001.000D: unknown main item tag 0x0 [ 837.149132][T12255] cypress 0003:04B4:0001.000D: unknown main item tag 0x0 [ 837.149159][T12255] cypress 0003:04B4:0001.000D: unknown main item tag 0x0 [ 837.149188][T12255] cypress 0003:04B4:0001.000D: unknown main item tag 0x0 [ 837.149216][T12255] cypress 0003:04B4:0001.000D: unknown main item tag 0x0 [ 837.149246][T12255] cypress 0003:04B4:0001.000D: unknown main item tag 0x0 [ 837.156848][T12255] cypress 0003:04B4:0001.000D: hidraw0: USB HID vff.fe Device [HID 04b4:0001] on usb-dummy_hcd.4-1/input0 [ 837.222764][ T37] gs_usb 3-1:0.0: probe with driver gs_usb failed with error -71 [ 837.283671][ T37] usb 3-1: USB disconnect, device number 27 [ 837.727376][T12255] usb 4-1: new full-speed USB device number 109 using dummy_hcd [ 837.881643][T12255] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 837.881676][T12255] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 837.881698][T12255] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 837.881751][T12255] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 14385, setting to 64 [ 837.883860][T12255] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 837.883891][T12255] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 837.883914][T12255] usb 4-1: Product: syz [ 837.883929][T12255] usb 4-1: Manufacturer: syz [ 837.974793][T12255] cdc_wdm 4-1:1.0: skipping garbage [ 837.974817][T12255] cdc_wdm 4-1:1.0: skipping garbage [ 838.053276][T12255] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 838.053301][T12255] cdc_wdm 4-1:1.0: Unknown control protocol [ 838.258032][T16438] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 838.380119][ T5694] usb 5-1: USB disconnect, device number 23 [ 838.739815][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 839.077352][ T197] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 839.183280][T16460] gadgetfs: bound to dummy_udc driver [ 839.247374][ T197] usb 3-1: Using ep0 maxpacket: 32 [ 839.254630][ T197] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 839.254678][ T197] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 839.254720][ T197] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 839.254745][ T197] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 839.307953][ T197] usb 3-1: config 0 descriptor?? [ 839.344103][ T197] hub 3-1:0.0: USB hub found [ 839.427432][ T5699] usb 1-1: new full-speed USB device number 34 using dummy_hcd [ 839.427764][ C0] gadgetfs: connected [ 839.428088][ T5699] gadgetfs: disconnected [ 839.566410][T16458] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 839.582422][T16458] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 839.599728][ T197] hub 3-1:0.0: 1 port detected [ 839.848444][ T197] hub 3-1:0.0: hub_hub_status failed (err = -71) [ 839.848579][ T197] hub 3-1:0.0: config failed, can't get hub status (err -71) [ 839.885025][ T197] usbhid 3-1:0.0: can't add hid device: -71 [ 839.885173][ T197] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 839.938552][ T197] usb 3-1: USB disconnect, device number 28 [ 840.177323][ T1247] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 840.347434][ T1247] usb 5-1: Using ep0 maxpacket: 32 [ 840.356993][ T1247] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid maxpacket 56288, setting to 1024 [ 840.357035][ T1247] usb 5-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 1024 [ 840.388843][ T1247] usb 5-1: config 0 interface 0 has no altsetting 0 [ 840.405196][ T1247] usb 5-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 840.405234][ T1247] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 840.405259][ T1247] usb 5-1: Product: syz [ 840.405279][ T1247] usb 5-1: Manufacturer: syz [ 840.405297][ T1247] usb 5-1: SerialNumber: syz [ 840.446117][ T1247] usb 5-1: config 0 descriptor?? [ 840.454853][T16469] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 840.551731][ T5699] usb 4-1: USB disconnect, device number 109 [ 840.877833][T16475] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3313'. [ 840.882156][ T1247] gs_usb 5-1:0.0: Configuring for 22 interfaces [ 841.297122][ T1247] gs_usb 5-1:0.0: Couldn't get bit timing const for channel 1 (-EPROTO) [ 841.298474][T16479] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 841.457879][ T1247] gs_usb 5-1:0.0: probe with driver gs_usb failed with error -71 [ 841.478653][ T1247] usb 5-1: USB disconnect, device number 24 [ 841.547470][T12255] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 841.697317][T12255] usb 2-1: Using ep0 maxpacket: 32 [ 841.699257][T12255] usb 2-1: config 0 has an invalid interface number: 51 but max is 0 [ 841.699283][T12255] usb 2-1: config 0 has no interface number 0 [ 841.701889][T12255] usb 2-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 841.701918][T12255] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 841.701939][T12255] usb 2-1: Product: syz [ 841.701960][T12255] usb 2-1: Manufacturer: syz [ 841.701972][T12255] usb 2-1: SerialNumber: syz [ 841.706660][T12255] usb 2-1: config 0 descriptor?? [ 841.773208][T12255] quatech2 2-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 841.911151][T16502] gadgetfs: bound to dummy_udc driver [ 841.981605][T12255] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 841.997702][T12255] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 842.196344][T16505] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3320'. [ 842.208020][T16505] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3320'. [ 842.209120][T16505] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3320'. [ 842.211632][T16505] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3320'. [ 842.212248][T16505] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3320'. [ 842.212903][T16505] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3320'. [ 842.213556][T16505] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3320'. [ 842.214168][T16505] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3320'. [ 842.214806][T16505] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3320'. [ 842.382618][ C1] usb 2-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 842.387063][ T1247] usb 2-1: USB disconnect, device number 9 [ 842.430824][ T1247] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 842.465674][ T1247] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 842.479648][ T1247] quatech2 2-1:0.51: device disconnected [ 842.587417][T12255] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 842.605096][T16518] bridge0: entered promiscuous mode [ 842.615073][T16518] qnx4: unable to read the superblock [ 842.737460][T12255] usb 3-1: Using ep0 maxpacket: 32 [ 842.743873][T12255] usb 3-1: unable to get BOS descriptor or descriptor too short [ 842.745125][T12255] usb 3-1: config 64 has an invalid interface number: 74 but max is 0 [ 842.745163][T12255] usb 3-1: config 64 has no interface number 0 [ 842.745199][T12255] usb 3-1: config 64 interface 74 has no altsetting 0 [ 842.767922][T12255] usb 3-1: New USB device found, idVendor=04b4, idProduct=1002, bcdDevice=6f.78 [ 842.768006][T12255] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 842.768069][T12255] usb 3-1: Product: syz [ 842.768112][T12255] usb 3-1: Manufacturer: syz [ 842.768155][T12255] usb 3-1: SerialNumber: syz [ 842.798506][T16520] FAULT_INJECTION: forcing a failure. [ 842.798506][T16520] name failslab, interval 1, probability 0, space 0, times 0 [ 842.798612][T16520] CPU: 1 UID: 0 PID: 16520 Comm: syz.3.3325 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 842.798715][T16520] Tainted: [L]=SOFTLOCKUP [ 842.798737][T16520] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 842.798770][T16520] Call Trace: [ 842.798797][T16520] [ 842.798820][T16520] dump_stack_lvl+0xe8/0x150 [ 842.798913][T16520] should_fail_ex+0x467/0x600 [ 842.799004][T16520] should_failslab+0xa8/0x100 [ 842.799067][T16520] __kmalloc_noprof+0xfb/0x790 [ 842.799160][T16520] ? tomoyo_realpath_from_path+0xef/0x640 [ 842.799243][T16520] ? tomoyo_realpath_from_path+0xef/0x640 [ 842.799376][T16520] tomoyo_realpath_from_path+0xef/0x640 [ 842.799502][T16520] ? tomoyo_path_number_perm+0x219/0x5f0 [ 842.799574][T16520] tomoyo_path_number_perm+0x246/0x5f0 [ 842.799659][T16520] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 842.799734][T16520] ? do_raw_spin_lock+0x12b/0x2f0 [ 842.799879][T16520] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 842.799945][T16520] ? lockdep_hardirqs_on+0x7a/0x110 [ 842.800045][T16520] ? __fget_files+0x2a/0x420 [ 842.800127][T16520] ? __fget_files+0x3a8/0x420 [ 842.800191][T16520] ? __fget_files+0x2a/0x420 [ 842.800266][T16520] security_file_ioctl+0xb9/0x260 [ 842.800343][T16520] __se_sys_ioctl+0x47/0x170 [ 842.800429][T16520] do_syscall_64+0x17b/0x530 [ 842.800492][T16520] ? irqentry_exit+0x10f/0x8f0 [ 842.800545][T16520] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 842.800610][T16520] ? clear_bhb_loop+0x40/0x90 [ 842.800688][T16520] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 842.800743][T16520] RIP: 0033:0x7fa11b18de99 [ 842.800802][T16520] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 842.800855][T16520] RSP: 002b:00007fa1193e6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 842.800913][T16520] RAX: ffffffffffffffda RBX: 00007fa11b415fa0 RCX: 00007fa11b18de99 [ 842.800958][T16520] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 842.800992][T16520] RBP: 00007fa1193e6090 R08: 0000000000000000 R09: 0000000000000000 [ 842.801027][T16520] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 842.801067][T16520] R13: 00007fa11b416038 R14: 00007fa11b415fa0 R15: 00007ffe60961158 [ 842.801182][T16520] [ 842.806422][T16520] ERROR: Out of memory at tomoyo_realpath_from_path. [ 843.504528][T16504] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 843.565555][T16524] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 843.605965][T12255] usb 3-1: USB disconnect, device number 29 [ 843.870814][T16532] gadgetfs: bound to dummy_udc driver [ 844.208242][T16545] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 844.275437][T16540] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 844.548844][T12254] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 844.637483][T12255] usb 2-1: new full-speed USB device number 10 using dummy_hcd [ 844.697335][T12254] usb 5-1: Using ep0 maxpacket: 32 [ 844.717726][T12254] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid maxpacket 56288, setting to 1024 [ 844.717752][T12254] usb 5-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 1024 [ 844.717770][T12254] usb 5-1: config 0 interface 0 has no altsetting 0 [ 844.720124][T12254] usb 5-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 844.720159][T12254] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 844.720174][T12254] usb 5-1: Product: syz [ 844.720185][T12254] usb 5-1: Manufacturer: syz [ 844.720196][T12254] usb 5-1: SerialNumber: syz [ 844.740660][T12254] usb 5-1: config 0 descriptor?? [ 844.767783][T12255] usb 2-1: device descriptor read/64, error -71 [ 844.804980][T16542] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 844.872263][T16555] FAULT_INJECTION: forcing a failure. [ 844.872263][T16555] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 844.872302][T16555] CPU: 1 UID: 0 PID: 16555 Comm: syz.2.3335 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 844.872336][T16555] Tainted: [L]=SOFTLOCKUP [ 844.872344][T16555] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 844.872358][T16555] Call Trace: [ 844.872367][T16555] [ 844.872376][T16555] dump_stack_lvl+0xe8/0x150 [ 844.872411][T16555] should_fail_ex+0x467/0x600 [ 844.872445][T16555] _copy_from_user+0x2d/0xb0 [ 844.872467][T16555] __sys_sendto+0x2b5/0x5d0 [ 844.872503][T16555] ? __pfx___sys_sendto+0x10/0x10 [ 844.872579][T16555] ? __pfx_ksys_write+0x10/0x10 [ 844.872612][T16555] __x64_sys_sendto+0xde/0x100 [ 844.872659][T16555] do_syscall_64+0x17b/0x530 [ 844.872682][T16555] ? irqentry_exit+0x10f/0x8f0 [ 844.872702][T16555] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 844.872725][T16555] ? clear_bhb_loop+0x40/0x90 [ 844.872753][T16555] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 844.872776][T16555] RIP: 0033:0x7f076e42de99 [ 844.872796][T16555] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 844.872816][T16555] RSP: 002b:00007f076c686028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 844.872840][T16555] RAX: ffffffffffffffda RBX: 00007f076e6b5fa0 RCX: 00007f076e42de99 [ 844.872857][T16555] RDX: 0000000000000001 RSI: 0000200000000300 RDI: 0000000000000004 [ 844.872880][T16555] RBP: 00007f076c686090 R08: 0000200000000200 R09: 0000000000000014 [ 844.872895][T16555] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 844.872907][T16555] R13: 00007f076e6b6038 R14: 00007f076e6b5fa0 R15: 00007ffe4abc5428 [ 844.872941][T16555] [ 844.894128][ T37] usb 4-1: new high-speed USB device number 110 using dummy_hcd [ 845.135718][T12255] usb 2-1: new full-speed USB device number 11 using dummy_hcd [ 845.159460][ T37] usb 4-1: Using ep0 maxpacket: 32 [ 845.165606][ T37] usb 4-1: config 0 has an invalid interface number: 51 but max is 0 [ 845.165628][ T37] usb 4-1: config 0 has no interface number 0 [ 845.194669][ T37] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 845.194692][ T37] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 845.194757][ T37] usb 4-1: Product: syz [ 845.194769][ T37] usb 4-1: Manufacturer: syz [ 845.194780][ T37] usb 4-1: SerialNumber: syz [ 845.244612][ T37] usb 4-1: config 0 descriptor?? [ 845.264918][ T37] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 845.289001][T12255] usb 2-1: device descriptor read/64, error -71 [ 845.294590][T12254] gs_usb 5-1:0.0: Configuring for 22 interfaces [ 845.421054][T12255] usb usb2-port1: attempt power cycle [ 845.485990][ T37] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 845.540427][ T37] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 845.739488][T12254] gs_usb 5-1:0.0: Couldn't get bit timing const for channel 1 (-EPROTO) [ 845.777504][T12255] usb 2-1: new full-speed USB device number 12 using dummy_hcd [ 845.802727][T12255] usb 2-1: device descriptor read/8, error -71 [ 845.874566][ C1] usb 4-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 845.876220][ T197] usb 4-1: USB disconnect, device number 110 [ 845.911624][ T197] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 845.966803][ T197] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 845.981865][ T197] quatech2 4-1:0.51: device disconnected [ 846.009108][T12254] gs_usb 5-1:0.0: probe with driver gs_usb failed with error -71 [ 846.038752][T12255] usb 2-1: new full-speed USB device number 13 using dummy_hcd [ 846.047617][T12254] usb 5-1: USB disconnect, device number 25 [ 846.061303][T12255] usb 2-1: device descriptor read/8, error -71 [ 846.173306][T12255] usb usb2-port1: unable to enumerate USB device [ 846.573596][T16568] gadgetfs: bound to dummy_udc driver [ 846.827484][T12255] usb 4-1: new full-speed USB device number 111 using dummy_hcd [ 846.938890][ T5699] usb 5-1: new full-speed USB device number 26 using dummy_hcd [ 846.967419][T14223] usb 3-1: new full-speed USB device number 30 using dummy_hcd [ 846.984453][T12255] usb 4-1: unable to get BOS descriptor or descriptor too short [ 846.985397][T12255] usb 4-1: not running at top speed; connect to a high speed hub [ 846.990068][T12255] usb 4-1: config 160 has an invalid interface number: 187 but max is 0 [ 846.990154][T12255] usb 4-1: config 160 has no interface number 0 [ 846.990293][T12255] usb 4-1: config 160 interface 187 altsetting 8 has an endpoint descriptor with address 0xF4, changing to 0x84 [ 846.990376][T12255] usb 4-1: config 160 interface 187 altsetting 8 endpoint 0x84 has invalid maxpacket 49717, setting to 64 [ 846.990451][T12255] usb 4-1: config 160 interface 187 altsetting 8 has an invalid descriptor for endpoint zero, skipping [ 846.990510][T12255] usb 4-1: config 160 interface 187 altsetting 8 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 846.990594][T12255] usb 4-1: config 160 interface 187 has no altsetting 0 [ 846.995996][T12255] usb 4-1: New USB device found, idVendor=0caa, idProduct=3001, bcdDevice=3e.c2 [ 846.996081][T12255] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 846.996137][T12255] usb 4-1: Product: syz [ 846.996197][T12255] usb 4-1: Manufacturer: syz [ 846.996240][T12255] usb 4-1: SerialNumber: syz [ 847.018822][T16570] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 847.018952][T16570] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 847.150780][ T5699] usb 5-1: unable to get BOS descriptor or descriptor too short [ 847.151647][ T5699] usb 5-1: not running at top speed; connect to a high speed hub [ 847.156326][ T5699] usb 5-1: config 14 has an invalid interface number: 57 but max is 1 [ 847.156360][ T5699] usb 5-1: config 14 has an invalid interface number: 228 but max is 1 [ 847.156385][ T5699] usb 5-1: config 14 has an invalid descriptor of length 0, skipping remainder of the config [ 847.156410][ T5699] usb 5-1: config 14 has no interface number 0 [ 847.156431][ T5699] usb 5-1: config 14 has no interface number 1 [ 847.156515][ T5699] usb 5-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 847.156547][ T5699] usb 5-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 847.156589][ T5699] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 847.156621][ T5699] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 137, setting to 64 [ 847.156655][ T5699] usb 5-1: config 14 interface 57 has no altsetting 0 [ 847.156679][ T5699] usb 5-1: config 14 interface 228 has no altsetting 0 [ 847.217288][ T5699] usb 5-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 847.217321][ T5699] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 847.217343][ T5699] usb 5-1: Product: syz [ 847.217359][ T5699] usb 5-1: Manufacturer: syz [ 847.217376][ T5699] usb 5-1: SerialNumber: syz [ 847.316658][T14223] usb 3-1: unable to get BOS descriptor or descriptor too short [ 847.317774][T14223] usb 3-1: not running at top speed; connect to a high speed hub [ 847.321349][T14223] usb 3-1: config 14 has an invalid interface number: 57 but max is 1 [ 847.321378][T14223] usb 3-1: config 14 has an invalid interface number: 228 but max is 1 [ 847.321401][T14223] usb 3-1: config 14 has an invalid descriptor of length 0, skipping remainder of the config [ 847.321423][T14223] usb 3-1: config 14 has no interface number 0 [ 847.321441][T14223] usb 3-1: config 14 has no interface number 1 [ 847.321512][T14223] usb 3-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 847.321538][T14223] usb 3-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 847.321566][T14223] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 847.321594][T14223] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 137, setting to 64 [ 847.321624][T14223] usb 3-1: config 14 interface 57 has no altsetting 0 [ 847.321643][T14223] usb 3-1: config 14 interface 228 has no altsetting 0 [ 847.391250][T12255] pl2303 4-1:160.187: required interrupt-in endpoint missing [ 847.448378][T14223] usb 3-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 847.448628][T14223] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 847.448652][T14223] usb 3-1: Product: syz [ 847.448667][T14223] usb 3-1: Manufacturer: syz [ 847.448682][T14223] usb 3-1: SerialNumber: syz [ 847.493044][T12255] usb 4-1: USB disconnect, device number 111 [ 847.812059][ T5699] legousbtower 5-1:14.57: interrupt endpoints not found [ 847.967443][T14223] legousbtower 3-1:14.57: interrupt endpoints not found [ 848.150790][T12255] usb 4-1: new high-speed USB device number 112 using dummy_hcd [ 848.215294][ T5699] legousbtower 5-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 848.242574][ T5699] legousbtower 5-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 848.310913][T12255] usb 4-1: Using ep0 maxpacket: 32 [ 848.327352][T12255] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 848.327382][T12255] usb 4-1: config 0 has no interfaces? [ 848.334945][T12255] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 848.334983][T12255] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 848.335006][T12255] usb 4-1: Product: syz [ 848.335021][T12255] usb 4-1: Manufacturer: syz [ 848.335037][T12255] usb 4-1: SerialNumber: syz [ 848.375126][T12255] usb 4-1: config 0 descriptor?? [ 848.405447][T14223] legousbtower 3-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 848.425504][T14223] legousbtower 3-1:14.228: LEGO USB Tower #-159 now attached to major 180 minor 1 [ 848.453214][T16572] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 848.477739][T16572] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 848.478616][T16584] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 848.827348][T12255] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 848.977436][T12255] usb 2-1: Using ep0 maxpacket: 32 [ 848.989852][T12255] usb 2-1: config 0 has an invalid interface number: 51 but max is 0 [ 848.990047][T12255] usb 2-1: config 0 has no interface number 0 [ 848.994734][T12255] usb 2-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 848.994930][T12255] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 848.994955][T12255] usb 2-1: Product: syz [ 848.994971][T12255] usb 2-1: Manufacturer: syz [ 848.995118][T12255] usb 2-1: SerialNumber: syz [ 849.093385][T12255] usb 2-1: config 0 descriptor?? [ 849.097412][T16591] FAULT_INJECTION: forcing a failure. [ 849.097412][T16591] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 849.100018][T16591] CPU: 1 UID: 0 PID: 16591 Comm: syz.2.3339 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 849.100147][T16591] Tainted: [L]=SOFTLOCKUP [ 849.100183][T16591] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 849.100225][T16591] Call Trace: [ 849.100254][T16591] [ 849.100278][T16591] dump_stack_lvl+0xe8/0x150 [ 849.100374][T16591] should_fail_ex+0x467/0x600 [ 849.100470][T16591] _copy_to_user+0x31/0xb0 [ 849.100530][T16591] simple_read_from_buffer+0xe1/0x170 [ 849.100581][T16591] proc_fail_nth_read+0x1be/0x230 [ 849.100643][T16591] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 849.100726][T16591] ? rw_verify_area+0x250/0x4d0 [ 849.100803][T16591] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 849.100875][T16591] vfs_read+0x219/0xa90 [ 849.100962][T16591] ? __pfx_vfs_read+0x10/0x10 [ 849.101040][T16591] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 849.101105][T16591] ? lockdep_hardirqs_on+0x7a/0x110 [ 849.101166][T16591] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 849.101239][T16591] ? mutex_lock_nested+0x152/0x1d0 [ 849.101312][T16591] ? fdget_pos+0x252/0x320 [ 849.101395][T16591] ksys_read+0x156/0x270 [ 849.101461][T16591] ? __pfx_ksys_read+0x10/0x10 [ 849.101569][T16591] do_syscall_64+0x17b/0x530 [ 849.101635][T16591] ? irqentry_exit+0x10f/0x8f0 [ 849.101692][T16591] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 849.101740][T16591] ? clear_bhb_loop+0x40/0x90 [ 849.101805][T16591] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 849.101873][T16591] RIP: 0033:0x7f076e3ee6ce [ 849.101933][T16591] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 849.101983][T16591] RSP: 002b:00007f076c643fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 849.102044][T16591] RAX: ffffffffffffffda RBX: 00007f076c6446c0 RCX: 00007f076e3ee6ce [ 849.102086][T16591] RDX: 000000000000000f RSI: 00007f076c6440a0 RDI: 0000000000000005 [ 849.102125][T16591] RBP: 00007f076c644090 R08: 0000000000000000 R09: 0000000000000000 [ 849.102165][T16591] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 849.102197][T16591] R13: 00007f076e6b6218 R14: 00007f076e6b6180 R15: 00007ffe4abc5428 [ 849.102285][T16591] [ 849.260305][T12255] quatech2 2-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 849.528032][ T5694] usb 3-1: USB disconnect, device number 30 [ 849.603298][ T5694] legousbtower 3-1:14.228: LEGO USB Tower #-159 now disconnected [ 849.634702][T12255] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 849.695391][T12255] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 849.913713][ T5694] usb 2-1: USB disconnect, device number 14 [ 849.916206][ C1] usb 2-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 849.916300][ T197] usb 5-1: USB disconnect, device number 26 [ 850.089174][ T197] legousbtower 5-1:14.228: LEGO USB Tower #-160 now disconnected [ 850.091570][ T5694] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 850.123960][T16595] dvmrp12: entered allmulticast mode [ 850.134767][ T5694] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 850.152713][ T5694] quatech2 2-1:0.51: device disconnected [ 850.498784][T16601] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 850.595178][T16603] 9p: Unknown Cache mode or invalid value f [ 850.684372][T16607] FAULT_INJECTION: forcing a failure. [ 850.684372][T16607] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 850.684433][T16607] CPU: 1 UID: 0 PID: 16607 Comm: syz.2.3354 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 850.684464][T16607] Tainted: [L]=SOFTLOCKUP [ 850.684472][T16607] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 850.684487][T16607] Call Trace: [ 850.684496][T16607] [ 850.684506][T16607] dump_stack_lvl+0xe8/0x150 [ 850.684542][T16607] should_fail_ex+0x467/0x600 [ 850.684579][T16607] _copy_from_user+0x2d/0xb0 [ 850.684601][T16607] core_sys_select+0x50b/0xb40 [ 850.684635][T16607] ? get_pid_task+0x20/0x1f0 [ 850.684678][T16607] ? __pfx_core_sys_select+0x10/0x10 [ 850.684750][T16607] ? __pfx_set_user_sigmask+0x10/0x10 [ 850.684776][T16607] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 850.684814][T16607] __se_sys_pselect6+0x267/0x320 [ 850.684854][T16607] ? __pfx___se_sys_pselect6+0x10/0x10 [ 850.684888][T16607] ? __pfx_ksys_write+0x10/0x10 [ 850.684918][T16607] ? __x64_sys_pselect6+0x21/0xf0 [ 850.684955][T16607] do_syscall_64+0x17b/0x530 [ 850.684977][T16607] ? irqentry_exit+0x10f/0x8f0 [ 850.685016][T16607] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 850.685040][T16607] ? clear_bhb_loop+0x40/0x90 [ 850.685081][T16607] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 850.685104][T16607] RIP: 0033:0x7f076e42de99 [ 850.685126][T16607] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 850.685145][T16607] RSP: 002b:00007f076c686028 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 850.685173][T16607] RAX: ffffffffffffffda RBX: 00007f076e6b5fa0 RCX: 00007f076e42de99 [ 850.685190][T16607] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000040 [ 850.685205][T16607] RBP: 00007f076c686090 R08: 0000000000000000 R09: 0000000000000000 [ 850.685220][T16607] R10: 00002000000002c0 R11: 0000000000000246 R12: 0000000000000001 [ 850.685235][T16607] R13: 00007f076e6b6038 R14: 00007f076e6b5fa0 R15: 00007ffe4abc5428 [ 850.685270][T16607] [ 850.888892][T12253] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 850.954946][ T37] usb 4-1: USB disconnect, device number 112 [ 851.058753][T12253] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 851.058791][T12253] usb 2-1: New USB device found, idVendor=046d, idProduct=c71f, bcdDevice= 0.00 [ 851.058815][T12253] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 851.098039][T12253] usb 2-1: config 0 descriptor?? [ 851.098877][T16603] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 851.176131][T16613] trusted_key: encrypted_key: keylen parameter is missing [ 851.213620][T16610] __nla_validate_parse: 5 callbacks suppressed [ 851.213642][T16610] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3355'. [ 851.417310][ T197] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 851.505784][T12253] hid (null): unknown global tag 0xd [ 851.505809][T12253] hid (null): unknown global tag 0xe9 [ 851.505820][T12253] hid (null): unknown global tag 0xd [ 851.505850][T12253] hid (null): unknown global tag 0xd [ 851.505860][T12253] hid (null): unknown global tag 0xc [ 851.505870][T12253] hid (null): unknown global tag 0xe5 [ 851.550209][T12253] logitech-djreceiver 0003:046D:C71F.000E: unknown main item tag 0x0 [ 851.550237][T12253] logitech-djreceiver 0003:046D:C71F.000E: unknown main item tag 0x0 [ 851.550258][T12253] logitech-djreceiver 0003:046D:C71F.000E: unknown main item tag 0x0 [ 851.550279][T12253] logitech-djreceiver 0003:046D:C71F.000E: unknown main item tag 0x0 [ 851.550300][T12253] logitech-djreceiver 0003:046D:C71F.000E: unknown main item tag 0x0 [ 851.550319][T12253] logitech-djreceiver 0003:046D:C71F.000E: unknown main item tag 0x0 [ 851.550339][T12253] logitech-djreceiver 0003:046D:C71F.000E: unknown main item tag 0x0 [ 851.550358][T12253] logitech-djreceiver 0003:046D:C71F.000E: unknown main item tag 0x0 [ 851.550378][T12253] logitech-djreceiver 0003:046D:C71F.000E: unknown main item tag 0x0 [ 851.550397][T12253] logitech-djreceiver 0003:046D:C71F.000E: unknown main item tag 0x0 [ 851.550748][T12253] logitech-djreceiver 0003:046D:C71F.000E: unknown global tag 0xd [ 851.550760][T12253] logitech-djreceiver 0003:046D:C71F.000E: item 0 2 1 13 parsing failed [ 851.551381][T12253] logitech-djreceiver 0003:046D:C71F.000E: logi_dj_probe: parse failed [ 851.551477][T12253] logitech-djreceiver 0003:046D:C71F.000E: probe with driver logitech-djreceiver failed with error -22 [ 851.635842][ T197] usb 3-1: Using ep0 maxpacket: 32 [ 851.697505][ T197] usb 3-1: New USB device found, idVendor=0c72, idProduct=000d, bcdDevice=27.9b [ 851.697542][ T197] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 851.697566][ T197] usb 3-1: Product: syz [ 851.697584][ T197] usb 3-1: Manufacturer: syz [ 851.697601][ T197] usb 3-1: SerialNumber: syz [ 851.734793][ T197] usb 3-1: config 0 descriptor?? [ 851.758112][T12253] usb 2-1: USB disconnect, device number 15 [ 851.942008][ T197] peak_usb 3-1:0.0 can0: unable to request usb[type=0 value=1] err=-71 [ 851.942042][ T197] peak_usb 3-1:0.0: unable to read PCAN-USB Pro firmware info (err -71) [ 852.091846][ T197] peak_usb 3-1:0.0: probe with driver peak_usb failed with error -71 [ 852.131879][ T197] usb 3-1: USB disconnect, device number 31 [ 852.433023][T16638] FAULT_INJECTION: forcing a failure. [ 852.433023][T16638] name failslab, interval 1, probability 0, space 0, times 0 [ 852.433052][T16638] CPU: 0 UID: 0 PID: 16638 Comm: syz.1.3362 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 852.433074][T16638] Tainted: [L]=SOFTLOCKUP [ 852.433079][T16638] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 852.433089][T16638] Call Trace: [ 852.433095][T16638] [ 852.433103][T16638] dump_stack_lvl+0xe8/0x150 [ 852.433128][T16638] should_fail_ex+0x467/0x600 [ 852.433152][T16638] should_failslab+0xa8/0x100 [ 852.433175][T16638] kmem_cache_alloc_node_noprof+0xac/0x660 [ 852.433199][T16638] ? __alloc_skb+0x1d7/0x7a0 [ 852.433219][T16638] ? __alloc_skb+0x1d7/0x7a0 [ 852.433244][T16638] __alloc_skb+0x1d7/0x7a0 [ 852.433285][T16638] tcp_stream_alloc_skb+0x3f/0x5c0 [ 852.433313][T16638] tcp_sendmsg_locked+0x143d/0x55c0 [ 852.433376][T16638] ? __pfx_tcp_sendmsg_locked+0x10/0x10 [ 852.433409][T16638] ? __local_bh_enable_ip+0x1ae/0x2b0 [ 852.433427][T16638] ? lockdep_hardirqs_on+0x7a/0x110 [ 852.433447][T16638] tcp_sendmsg+0x2f/0x50 [ 852.433471][T16638] ? __pfx_inet_sendmsg+0x10/0x10 [ 852.433491][T16638] sock_sendmsg_nosec+0x10e/0x180 [ 852.433512][T16638] __sys_sendto+0x41e/0x5d0 [ 852.433538][T16638] ? __pfx___sys_sendto+0x10/0x10 [ 852.433581][T16638] ? __pfx_ksys_write+0x10/0x10 [ 852.433603][T16638] __x64_sys_sendto+0xde/0x100 [ 852.433628][T16638] do_syscall_64+0x17b/0x530 [ 852.433644][T16638] ? irqentry_exit+0x10f/0x8f0 [ 852.433660][T16638] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 852.433678][T16638] ? clear_bhb_loop+0x40/0x90 [ 852.433698][T16638] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 852.433714][T16638] RIP: 0033:0x7f94fb55de99 [ 852.433729][T16638] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 852.433743][T16638] RSP: 002b:00007f94f97b6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 852.433760][T16638] RAX: ffffffffffffffda RBX: 00007f94fb7e5fa0 RCX: 00007f94fb55de99 [ 852.433772][T16638] RDX: 00000000ffffffe4 RSI: 0000200000000040 RDI: 0000000000000004 [ 852.433783][T16638] RBP: 00007f94f97b6090 R08: 0000000000000000 R09: 0000000000000000 [ 852.433793][T16638] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 852.433803][T16638] R13: 00007f94fb7e6038 R14: 00007f94fb7e5fa0 R15: 00007ffec2a31b38 [ 852.433827][T16638] [ 852.767346][ T5699] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 852.933191][T16644] netlink: 'syz.2.3363': attribute type 1 has an invalid length. [ 852.933231][T16644] netlink: 'syz.2.3363': attribute type 1 has an invalid length. [ 852.947262][ T5699] usb 5-1: Using ep0 maxpacket: 32 [ 852.962311][ T5699] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 852.962340][ T5699] usb 5-1: config 0 has no interface number 0 [ 852.981588][ T5699] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 852.981622][ T5699] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 852.981645][ T5699] usb 5-1: Product: syz [ 852.981661][ T5699] usb 5-1: Manufacturer: syz [ 852.981677][ T5699] usb 5-1: SerialNumber: syz [ 853.023130][T16645] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3363'. [ 853.026054][ T5699] usb 5-1: config 0 descriptor?? [ 853.045526][ T5699] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 853.261852][ T5694] usb 4-1: new high-speed USB device number 113 using dummy_hcd [ 853.292617][ T5699] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 853.310004][ T5699] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 853.428102][ T5694] usb 4-1: Using ep0 maxpacket: 32 [ 853.430751][ T5694] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 853.430899][ T5694] usb 4-1: config 0 has no interfaces? [ 853.443634][ T5694] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 853.443688][ T5694] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 853.443902][ T5694] usb 4-1: Product: syz [ 853.444116][ T5694] usb 4-1: Manufacturer: syz [ 853.444166][ T5694] usb 4-1: SerialNumber: syz [ 853.529342][ T5694] usb 4-1: config 0 descriptor?? [ 853.689541][ C0] usb 5-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 853.690264][T12253] usb 5-1: USB disconnect, device number 27 [ 853.716681][T12253] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 853.738706][T12253] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 853.739637][T12253] quatech2 5-1:0.51: device disconnected [ 853.769287][ T37] usb 2-1: new low-speed USB device number 16 using dummy_hcd [ 853.955784][ T37] usb 2-1: config 0 interface 0 altsetting 15 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 853.955810][ T37] usb 2-1: config 0 interface 0 altsetting 15 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 853.955830][ T37] usb 2-1: config 0 interface 0 has no altsetting 0 [ 853.955854][ T37] usb 2-1: New USB device found, idVendor=056e, idProduct=00fc, bcdDevice= 0.00 [ 853.955871][ T37] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 853.974883][ T37] usb 2-1: config 0 descriptor?? [ 853.982267][T16647] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 854.497974][ T37] elecom 0003:056E:00FC.000F: invalid report_count 885399381 [ 854.498001][ T37] elecom 0003:056E:00FC.000F: item 0 4 1 9 parsing failed [ 854.498830][ T37] elecom 0003:056E:00FC.000F: probe with driver elecom failed with error -22 [ 854.672715][T16647] smpboot: CPU 1 is now offline [ 854.910547][ T5694] usb 2-1: USB disconnect, device number 16 [ 855.079520][T16660] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3369'. [ 855.279008][ T5699] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 855.434403][T16663] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3370'. [ 855.440134][ T5699] usb 5-1: Using ep0 maxpacket: 32 [ 855.468914][ T5699] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 855.468936][ T5699] usb 5-1: config 0 has no interface number 0 [ 855.473654][ T5699] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 855.473678][ T5699] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 855.473693][ T5699] usb 5-1: Product: syz [ 855.473705][ T5699] usb 5-1: Manufacturer: syz [ 855.473778][ T5699] usb 5-1: SerialNumber: syz [ 855.584586][ T5699] usb 5-1: config 0 descriptor?? [ 855.679099][ T5699] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 855.807063][T16667] FAULT_INJECTION: forcing a failure. [ 855.807063][T16667] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 855.807093][T16667] CPU: 0 UID: 0 PID: 16667 Comm: syz.1.3371 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 855.807116][T16667] Tainted: [L]=SOFTLOCKUP [ 855.807122][T16667] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 855.807132][T16667] Call Trace: [ 855.807141][T16667] [ 855.807149][T16667] dump_stack_lvl+0xe8/0x150 [ 855.807175][T16667] should_fail_ex+0x467/0x600 [ 855.807201][T16667] _copy_from_user+0x2d/0xb0 [ 855.807217][T16667] ucma_write+0x166/0x2f0 [ 855.807241][T16667] ? __pfx_ucma_write+0x10/0x10 [ 855.807260][T16667] ? security_file_permission+0x68/0x220 [ 855.807281][T16667] ? rw_verify_area+0x209/0x4d0 [ 855.807303][T16667] vfs_writev+0x4c4/0x990 [ 855.807328][T16667] ? __pfx_ucma_write+0x10/0x10 [ 855.807351][T16667] ? __pfx_vfs_writev+0x10/0x10 [ 855.807385][T16667] ? __fget_files+0x2a/0x420 [ 855.807405][T16667] ? __fget_files+0x3a8/0x420 [ 855.807421][T16667] ? __fget_files+0x2a/0x420 [ 855.807444][T16667] do_writev+0x15a/0x2e0 [ 855.807469][T16667] ? __pfx_do_writev+0x10/0x10 [ 855.807500][T16667] do_syscall_64+0x17b/0x530 [ 855.807517][T16667] ? irqentry_exit+0x10f/0x8f0 [ 855.807532][T16667] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 855.807550][T16667] ? clear_bhb_loop+0x40/0x90 [ 855.807576][T16667] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 855.807593][T16667] RIP: 0033:0x7f94fb55de99 [ 855.807608][T16667] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 855.807623][T16667] RSP: 002b:00007f94f9795028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 855.807640][T16667] RAX: ffffffffffffffda RBX: 00007f94fb7e6090 RCX: 00007f94fb55de99 [ 855.807653][T16667] RDX: 0000000000000002 RSI: 0000200000000040 RDI: 0000000000000011 [ 855.807663][T16667] RBP: 00007f94f9795090 R08: 0000000000000000 R09: 0000000000000000 [ 855.807673][T16667] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 855.807682][T16667] R13: 00007f94fb7e6128 R14: 00007f94fb7e6090 R15: 00007ffec2a31b38 [ 855.807707][T16667] [ 856.109058][ T5699] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 856.206526][ T5699] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 856.220353][ T5694] usb 4-1: USB disconnect, device number 113 [ 856.262939][ C0] usb 5-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 856.312072][ T5699] usb 5-1: USB disconnect, device number 28 [ 856.393221][ T5699] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 856.450142][ T5699] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 856.454104][ T5699] quatech2 5-1:0.51: device disconnected [ 857.707396][ T5694] usb 4-1: new low-speed USB device number 114 using dummy_hcd [ 857.797306][T14223] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 857.857265][ T5694] usb 4-1: Invalid ep0 maxpacket: 64 [ 857.948229][T14223] usb 3-1: Using ep0 maxpacket: 32 [ 857.950556][T14223] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 857.950576][T14223] usb 3-1: config 0 has no interfaces? [ 857.953212][T14223] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 857.953234][T14223] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 857.953249][T14223] usb 3-1: Product: syz [ 857.953347][T14223] usb 3-1: Manufacturer: syz [ 857.953359][T14223] usb 3-1: SerialNumber: syz [ 857.998321][ T5694] usb 4-1: new low-speed USB device number 115 using dummy_hcd [ 858.027620][T14223] usb 3-1: config 0 descriptor?? [ 858.168389][ T5694] usb 4-1: Invalid ep0 maxpacket: 64 [ 858.168812][ T5694] usb usb4-port1: attempt power cycle [ 858.362388][T16701] FAULT_INJECTION: forcing a failure. [ 858.362388][T16701] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 858.362417][T16701] CPU: 0 UID: 0 PID: 16701 Comm: syz.1.3383 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 858.362439][T16701] Tainted: [L]=SOFTLOCKUP [ 858.362445][T16701] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 858.362455][T16701] Call Trace: [ 858.362461][T16701] [ 858.362468][T16701] dump_stack_lvl+0xe8/0x150 [ 858.362494][T16701] should_fail_ex+0x467/0x600 [ 858.362518][T16701] _copy_from_user+0x2d/0xb0 [ 858.362534][T16701] ___sys_recvmsg+0x173/0x5a0 [ 858.362563][T16701] ? __pfx____sys_recvmsg+0x10/0x10 [ 858.362592][T16701] ? lock_acquire+0x115/0x350 [ 858.362628][T16701] ? __fget_files+0x3a8/0x420 [ 858.362652][T16701] __x64_sys_recvmsg+0x1b4/0x290 [ 858.362679][T16701] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 858.362717][T16701] do_syscall_64+0x17b/0x530 [ 858.362734][T16701] ? irqentry_exit+0x10f/0x8f0 [ 858.362760][T16701] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 858.362775][T16701] ? clear_bhb_loop+0x40/0x90 [ 858.362812][T16701] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 858.362827][T16701] RIP: 0033:0x7f94fb55de99 [ 858.362842][T16701] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 858.362856][T16701] RSP: 002b:00007f94f97b6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 858.362872][T16701] RAX: ffffffffffffffda RBX: 00007f94fb7e5fa0 RCX: 00007f94fb55de99 [ 858.362890][T16701] RDX: 0000000000000700 RSI: 0000200000000580 RDI: 0000000000000003 [ 858.362900][T16701] RBP: 00007f94f97b6090 R08: 0000000000000000 R09: 0000000000000000 [ 858.362911][T16701] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 858.362920][T16701] R13: 00007f94fb7e6038 R14: 00007f94fb7e5fa0 R15: 00007ffec2a31b38 [ 858.362943][T16701] [ 858.627539][ T5694] usb 4-1: new low-speed USB device number 116 using dummy_hcd [ 858.647874][ T5694] usb 4-1: Invalid ep0 maxpacket: 64 [ 858.768978][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805d735800: rx timeout, send abort [ 858.769222][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff88805d735800: 0x20000: (3) A timeout occurred and this is the connection abort to close the session. [ 858.782347][ T5694] usb 4-1: new low-speed USB device number 117 using dummy_hcd [ 858.798185][ T5694] usb 4-1: Invalid ep0 maxpacket: 64 [ 858.799666][ T5694] usb usb4-port1: unable to enumerate USB device [ 859.207388][ T5699] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 859.357346][ T5699] usb 5-1: Using ep0 maxpacket: 32 [ 859.359861][ T5699] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 859.359881][ T5699] usb 5-1: config 0 has no interface number 0 [ 859.362271][ T5699] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 859.362292][ T5699] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 859.362313][ T5699] usb 5-1: Product: syz [ 859.362324][ T5699] usb 5-1: Manufacturer: syz [ 859.362335][ T5699] usb 5-1: SerialNumber: syz [ 859.421633][ T5699] usb 5-1: config 0 descriptor?? [ 859.438049][ T5699] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 859.557266][T14223] usb 2-1: new full-speed USB device number 17 using dummy_hcd [ 859.636160][ T5699] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 859.663783][ T5699] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 859.733782][T14223] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 859.733805][T14223] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 859.733820][T14223] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 859.733855][T14223] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 14385, setting to 64 [ 859.782760][T14223] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 859.782784][T14223] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 859.782799][T14223] usb 2-1: Product: syz [ 859.782810][T14223] usb 2-1: Manufacturer: syz [ 859.876267][T14223] cdc_wdm 2-1:1.0: skipping garbage [ 859.876283][T14223] cdc_wdm 2-1:1.0: skipping garbage [ 859.983446][T14223] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 859.983464][T14223] cdc_wdm 2-1:1.0: Unknown control protocol [ 860.063841][ C0] usb 5-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 860.074849][T14223] usb 5-1: USB disconnect, device number 29 [ 860.114187][T14223] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 860.167528][T14223] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 860.169201][T14223] quatech2 5-1:0.51: device disconnected [ 860.538989][ T1247] usb 3-1: USB disconnect, device number 32 [ 860.808305][T14223] usb 4-1: new high-speed USB device number 118 using dummy_hcd [ 860.843954][T16712] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 860.844687][T16712] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 860.873399][ T5694] usb 2-1: USB disconnect, device number 17 [ 860.957418][ T5699] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 860.962774][T14223] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 860.962845][T14223] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 860.962865][T14223] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 860.962883][T14223] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 64 [ 860.962901][T14223] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 64 [ 860.962918][T14223] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 64 [ 860.962936][T14223] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 64 [ 860.962954][T14223] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x87 has invalid maxpacket 64 [ 860.962972][T14223] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 860.962990][T14223] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 860.963008][T14223] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [ 860.963219][T14223] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 64 [ 860.963238][T14223] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 860.963254][T14223] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 860.963271][T14223] usb 4-1: config 1 interface 0 altsetting 0 has 12 endpoint descriptors, different from the interface descriptor's value: 14 [ 861.074828][T14223] usb 4-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 861.074853][T14223] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 861.074868][T14223] usb 4-1: Product: syz [ 861.074879][T14223] usb 4-1: Manufacturer: syz [ 861.074890][T14223] usb 4-1: SerialNumber: syz [ 861.135697][ T1247] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 861.221986][T16714] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 861.222138][T16714] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 861.222453][T16714] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 861.247753][ T5699] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 861.247837][ T5699] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 861.247856][ T5699] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 861.247874][ T5699] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 64 [ 861.247892][ T5699] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 64 [ 861.247909][ T5699] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 64 [ 861.247926][ T5699] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 64 [ 861.247985][ T5699] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x87 has invalid maxpacket 64 [ 861.248004][ T5699] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 861.248021][ T5699] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 861.248045][ T5699] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [ 861.248062][ T5699] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 64 [ 861.248080][ T5699] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 861.248135][ T5699] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 861.248151][ T5699] usb 5-1: config 1 interface 0 altsetting 0 has 12 endpoint descriptors, different from the interface descriptor's value: 14 [ 861.266159][T16714] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 861.299660][T16714] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 861.330223][ T5699] usb 5-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 861.330247][ T5699] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 861.330263][ T5699] usb 5-1: Product: syz [ 861.334448][T16714] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 861.346870][ T5699] usb 5-1: Manufacturer: syz [ 861.346887][ T5699] usb 5-1: SerialNumber: syz [ 861.365742][T16714] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 861.386077][ T1247] usb 3-1: Using ep0 maxpacket: 32 [ 861.393211][T16714] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 861.465719][ T1247] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid maxpacket 56288, setting to 1024 [ 861.465747][ T1247] usb 3-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 1024 [ 861.481350][ T1247] usb 3-1: config 0 interface 0 has no altsetting 0 [ 861.487517][T16714] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 861.525119][T16714] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 861.538618][T16714] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 861.554265][ T1247] usb 3-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 861.554288][ T1247] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 861.554303][ T1247] usb 3-1: Product: syz [ 861.554314][ T1247] usb 3-1: Manufacturer: syz [ 861.554325][ T1247] usb 3-1: SerialNumber: syz [ 861.601668][T14223] keyspan 4-1:1.0: Keyspan 2 port adapter converter detected [ 861.605878][T14223] keyspan 4-1:1.0: found no endpoint descriptor for endpoint 7 [ 861.633280][ T1247] usb 3-1: config 0 descriptor?? [ 861.646602][T16717] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 861.681341][T16719] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 861.681476][T16719] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 861.681658][T16719] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 861.681796][T16719] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 861.681935][T16719] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 861.682105][T16719] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 861.682240][T16719] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 861.682376][T16719] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 861.682471][T16719] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 861.687659][T16719] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 861.761503][T16719] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 861.798613][T14223] usb 4-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 861.804511][ T5699] keyspan 5-1:1.0: Keyspan 2 port adapter converter detected [ 861.827867][ T5699] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 7 [ 861.829588][T14223] keyspan 4-1:1.0: found no endpoint descriptor for endpoint 6 [ 861.861431][T14223] usb 4-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 861.906625][ T5699] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB2 [ 861.975357][ T5699] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 6 [ 862.051322][ T5699] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB3 [ 862.082138][T16720] FAULT_INJECTION: forcing a failure. [ 862.082138][T16720] name failslab, interval 1, probability 0, space 0, times 0 [ 862.082169][T16720] CPU: 0 UID: 0 PID: 16720 Comm: syz.4.3391 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 862.082191][T16720] Tainted: [L]=SOFTLOCKUP [ 862.082197][T16720] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 862.082207][T16720] Call Trace: [ 862.082216][T16720] [ 862.082223][T16720] dump_stack_lvl+0xe8/0x150 [ 862.082250][T16720] should_fail_ex+0x467/0x600 [ 862.082275][T16720] should_failslab+0xa8/0x100 [ 862.082292][T16720] ? do_getname+0x2e/0x250 [ 862.082316][T16720] kmem_cache_alloc_noprof+0x9e/0x680 [ 862.082340][T16720] ? do_getname+0x2e/0x250 [ 862.082369][T16720] do_getname+0x2e/0x250 [ 862.082392][T16720] ? getname_flags+0x11/0x20 [ 862.082418][T16720] do_sys_openat2+0xcc/0x200 [ 862.082446][T16720] ? __pfx_do_sys_openat2+0x10/0x10 [ 862.082475][T16720] ? ksys_write+0x248/0x270 [ 862.082496][T16720] ? __pfx_ksys_write+0x10/0x10 [ 862.082516][T16720] __x64_sys_openat+0x138/0x170 [ 862.082545][T16720] do_syscall_64+0x17b/0x530 [ 862.082562][T16720] ? irqentry_exit+0x10f/0x8f0 [ 862.082577][T16720] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 862.082594][T16720] ? clear_bhb_loop+0x40/0x90 [ 862.082614][T16720] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 862.082631][T16720] RIP: 0033:0x7f150b29de99 [ 862.082646][T16720] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 862.082660][T16720] RSP: 002b:00007f15094d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 862.082678][T16720] RAX: ffffffffffffffda RBX: 00007f150b526090 RCX: 00007f150b29de99 [ 862.082690][T16720] RDX: 0000000000000002 RSI: 00002000000001c0 RDI: ffffffffffffff9c [ 862.082701][T16720] RBP: 00007f15094d5090 R08: 0000000000000000 R09: 0000000000000000 [ 862.082726][T16720] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 862.082736][T16720] R13: 00007f150b526128 R14: 00007f150b526090 R15: 00007fffa37ebab8 [ 862.082760][T16720] [ 862.091167][ T1247] gs_usb 3-1:0.0: Configuring for 22 interfaces [ 862.401473][ T5699] usb 5-1: USB disconnect, device number 30 [ 862.602051][ T197] usb 4-1: USB disconnect, device number 118 [ 862.630216][ T5699] keyspan_2 ttyUSB2: Keyspan 2 port adapter converter now disconnected from ttyUSB2 [ 862.648607][ T1247] gs_usb 3-1:0.0: Couldn't get bit timing const for channel 1 (-EPROTO) [ 862.704406][ T5699] keyspan_2 ttyUSB3: Keyspan 2 port adapter converter now disconnected from ttyUSB3 [ 862.705909][ T5699] keyspan 5-1:1.0: device disconnected [ 862.823952][ T1247] gs_usb 3-1:0.0: probe with driver gs_usb failed with error -71 [ 862.848752][ T197] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 862.919482][ T1247] usb 3-1: USB disconnect, device number 33 [ 862.934691][ T197] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 862.961796][ T197] keyspan 4-1:1.0: device disconnected [ 863.251628][T16727] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3394'. [ 863.274455][T16727] netlink: 256 bytes leftover after parsing attributes in process `syz.3.3394'. [ 863.417603][ T197] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 863.521991][T16735] FAULT_INJECTION: forcing a failure. [ 863.521991][T16735] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 863.522020][T16735] CPU: 0 UID: 0 PID: 16735 Comm: syz.3.3397 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 863.522042][T16735] Tainted: [L]=SOFTLOCKUP [ 863.522048][T16735] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 863.522058][T16735] Call Trace: [ 863.522064][T16735] [ 863.522071][T16735] dump_stack_lvl+0xe8/0x150 [ 863.522096][T16735] should_fail_ex+0x467/0x600 [ 863.522120][T16735] _copy_from_user+0x2d/0xb0 [ 863.522135][T16735] ___sys_sendmsg+0x1c6/0x360 [ 863.522158][T16735] ? __lock_acquire+0x6df/0x2e40 [ 863.522176][T16735] ? __pfx____sys_sendmsg+0x10/0x10 [ 863.522222][T16735] ? __fget_files+0x2a/0x420 [ 863.522237][T16735] ? __fget_files+0x3a8/0x420 [ 863.522259][T16735] __x64_sys_sendmsg+0x1b7/0x290 [ 863.522284][T16735] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 863.522320][T16735] do_syscall_64+0x17b/0x530 [ 863.522335][T16735] ? irqentry_exit+0x10f/0x8f0 [ 863.522350][T16735] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 863.522366][T16735] ? clear_bhb_loop+0x40/0x90 [ 863.522385][T16735] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 863.522400][T16735] RIP: 0033:0x7fa11b18de99 [ 863.522414][T16735] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 863.522429][T16735] RSP: 002b:00007fa1193e6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 863.522445][T16735] RAX: ffffffffffffffda RBX: 00007fa11b415fa0 RCX: 00007fa11b18de99 [ 863.522458][T16735] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 863.522468][T16735] RBP: 00007fa1193e6090 R08: 0000000000000000 R09: 0000000000000000 [ 863.522478][T16735] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 863.522487][T16735] R13: 00007fa11b416038 R14: 00007fa11b415fa0 R15: 00007ffe60961158 [ 863.522510][T16735] [ 863.624103][ T197] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 863.624153][ T197] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 863.624173][ T197] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 863.624191][ T197] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 64 [ 863.624209][ T197] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 64 [ 863.624227][ T197] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 64 [ 863.624245][ T197] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 64 [ 863.624263][ T197] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x87 has invalid maxpacket 64 [ 863.624281][ T197] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 863.653277][ T197] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 863.653300][ T197] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [ 863.653336][ T197] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 64 [ 863.653354][ T197] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 863.653370][ T197] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 863.653388][ T197] usb 5-1: config 1 interface 0 altsetting 0 has 12 endpoint descriptors, different from the interface descriptor's value: 14 [ 863.903316][ T197] usb 5-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 863.903339][ T197] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 863.903354][ T197] usb 5-1: Product: syz [ 863.903365][ T197] usb 5-1: Manufacturer: syz [ 863.903377][ T197] usb 5-1: SerialNumber: syz [ 863.978841][T16724] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 863.978997][T16724] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 863.979126][T16724] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 863.979263][T16724] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 863.979349][T16724] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 863.979488][T16724] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 863.979612][T16724] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 863.979740][T16724] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 863.980055][T16724] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 863.980186][T16724] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 863.980268][T16724] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 864.084649][ T197] keyspan 5-1:1.0: Keyspan 2 port adapter converter detected [ 864.105069][ T197] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 7 [ 864.146812][ T197] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 864.170771][ T197] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 6 [ 864.262462][ T197] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 864.349853][T16739] sg_write: data in/out 335836/136 bytes for SCSI command 0x0-- guessing data in; [ 864.349853][T16739] program syz.3.3399 not setting count and/or reply_len properly [ 864.570003][ T1247] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 864.694230][ T5694] usb 5-1: USB disconnect, device number 31 [ 864.722139][ T1247] usb 3-1: Using ep0 maxpacket: 32 [ 864.724348][ T1247] usb 3-1: config 0 has an invalid interface number: 51 but max is 0 [ 864.724367][ T1247] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 864.724382][ T1247] usb 3-1: config 0 has no interface number 0 [ 864.724412][ T1247] usb 3-1: config 0 interface 51 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 864.726457][ T1247] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 864.726478][ T1247] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 864.726493][ T1247] usb 3-1: Product: syz [ 864.726504][ T1247] usb 3-1: Manufacturer: syz [ 864.726515][ T1247] usb 3-1: SerialNumber: syz [ 864.821534][ T1247] usb 3-1: config 0 descriptor?? [ 864.845460][ T5694] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 864.885187][ T1247] quatech2 3-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 864.908802][ T5694] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 864.917689][ T5699] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 864.937337][ T197] usb 4-1: new high-speed USB device number 119 using dummy_hcd [ 864.939496][ T5694] keyspan 5-1:1.0: device disconnected [ 865.067364][ T1247] usb 3-1: qt2_setup_urbs - submit read urb failed -8 [ 865.067608][ T1247] quatech2 3-1:0.51: probe with driver quatech2 failed with error -8 [ 865.091489][ T197] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 865.092151][ T5699] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 865.092186][ T5699] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 865.092205][ T5699] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 865.092222][ T5699] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 64 [ 865.092240][ T5699] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 64 [ 865.092257][ T5699] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 64 [ 865.092274][ T5699] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 64 [ 865.092292][ T5699] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x87 has invalid maxpacket 64 [ 865.092309][ T5699] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 865.092326][ T5699] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 865.092343][ T5699] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [ 865.092361][ T5699] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 64 [ 865.092388][ T5699] usb 2-1: config 1 interface 0 altsetting 0 has a duplicate endpoint with address 0x5, skipping [ 865.092404][ T5699] usb 2-1: config 1 interface 0 altsetting 0 has 12 endpoint descriptors, different from the interface descriptor's value: 14 [ 865.092700][ T197] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 865.092718][ T197] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 865.092736][ T197] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 64 [ 865.092753][ T197] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 64 [ 865.092771][ T197] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 64 [ 865.092788][ T197] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 64 [ 865.092851][ T197] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x87 has invalid maxpacket 64 [ 865.092869][ T197] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 865.092886][ T197] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 865.092904][ T197] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [ 865.092920][ T197] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 64 [ 865.092937][ T197] usb 4-1: config 1 interface 0 altsetting 0 has a duplicate endpoint with address 0x5, skipping [ 865.092953][ T197] usb 4-1: config 1 interface 0 altsetting 0 has 12 endpoint descriptors, different from the interface descriptor's value: 14 [ 865.137092][ T5699] usb 2-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 865.137117][ T5699] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 865.185475][ T5699] usb 2-1: Product: syz [ 865.185492][ T5699] usb 2-1: Manufacturer: syz [ 865.185503][ T5699] usb 2-1: SerialNumber: syz [ 865.285927][ T197] usb 4-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 865.285952][ T197] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 865.285973][ T197] usb 4-1: Product: syz [ 865.285984][ T197] usb 4-1: Manufacturer: syz [ 865.285995][ T197] usb 4-1: SerialNumber: syz [ 865.512177][T16743] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 865.512314][T16743] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 865.512401][T16743] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 865.512546][T16743] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 865.512673][T16743] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 865.512810][T16743] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 865.512939][T16743] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 865.513026][T16743] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 865.514099][T16743] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 865.516690][T16743] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 865.571219][T16743] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 865.624910][T16741] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 865.625081][T16741] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 865.625227][T16741] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 865.625373][T16741] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 865.625674][T16741] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 865.705675][T16741] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 865.705919][T16741] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 865.706009][T16741] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 865.706151][T16741] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 865.706282][T16741] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 865.706417][T16741] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 865.774184][ T5699] keyspan 2-1:1.0: Keyspan 2 port adapter converter detected [ 865.775718][ T197] keyspan 4-1:1.0: Keyspan 2 port adapter converter detected [ 865.808064][ T197] keyspan 4-1:1.0: found no endpoint descriptor for endpoint 7 [ 865.815636][ T5699] keyspan 2-1:1.0: found no endpoint descriptor for endpoint 7 [ 865.848996][T16743] FAULT_INJECTION: forcing a failure. [ 865.848996][T16743] name failslab, interval 1, probability 0, space 0, times 0 [ 865.849025][T16743] CPU: 0 UID: 0 PID: 16743 Comm: syz.3.3401 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 865.849048][T16743] Tainted: [L]=SOFTLOCKUP [ 865.849054][T16743] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 865.849064][T16743] Call Trace: [ 865.849070][T16743] [ 865.849078][T16743] dump_stack_lvl+0xe8/0x150 [ 865.849111][T16743] should_fail_ex+0x467/0x600 [ 865.849136][T16743] should_failslab+0xa8/0x100 [ 865.849152][T16743] ? do_getname+0x2e/0x250 [ 865.849177][T16743] kmem_cache_alloc_noprof+0x9e/0x680 [ 865.849200][T16743] ? do_getname+0x2e/0x250 [ 865.849229][T16743] do_getname+0x2e/0x250 [ 865.849252][T16743] ? getname_flags+0x11/0x20 [ 865.849278][T16743] do_sys_openat2+0xcc/0x200 [ 865.849307][T16743] ? __pfx_do_sys_openat2+0x10/0x10 [ 865.849335][T16743] ? ksys_write+0x248/0x270 [ 865.849356][T16743] ? __pfx_ksys_write+0x10/0x10 [ 865.849376][T16743] __x64_sys_openat+0x138/0x170 [ 865.849406][T16743] do_syscall_64+0x17b/0x530 [ 865.849423][T16743] ? irqentry_exit+0x10f/0x8f0 [ 865.849438][T16743] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 865.849455][T16743] ? clear_bhb_loop+0x40/0x90 [ 865.849475][T16743] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 865.849492][T16743] RIP: 0033:0x7fa11b18de99 [ 865.849507][T16743] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 865.849522][T16743] RSP: 002b:00007fa1193e6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 865.849539][T16743] RAX: ffffffffffffffda RBX: 00007fa11b415fa0 RCX: 00007fa11b18de99 [ 865.849551][T16743] RDX: 0000000000000002 RSI: 00002000000001c0 RDI: ffffffffffffff9c [ 865.849562][T16743] RBP: 00007fa1193e6090 R08: 0000000000000000 R09: 0000000000000000 [ 865.849573][T16743] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 865.849583][T16743] R13: 00007fa11b416038 R14: 00007fa11b415fa0 R15: 00007ffe60961158 [ 865.849607][T16743] [ 866.090178][ T5699] keyspan 2-1:1.0: found no endpoint descriptor for endpoint 5 [ 866.130129][ T197] keyspan 4-1:1.0: found no endpoint descriptor for endpoint 5 [ 866.157217][ T5694] usb 3-1: USB disconnect, device number 34 [ 866.183602][ T5699] usb 2-1: Keyspan 2 port adapter converter now attached to ttyUSB2 [ 866.183981][ T197] usb 4-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 866.230958][ T197] keyspan 4-1:1.0: found no endpoint descriptor for endpoint 6 [ 866.233243][ T5699] keyspan 2-1:1.0: found no endpoint descriptor for endpoint 6 [ 866.309223][ T5699] usb 2-1: Keyspan 2 port adapter converter now attached to ttyUSB3 [ 866.310733][ T197] usb 4-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 866.495063][ T5699] usb 2-1: USB disconnect, device number 18 [ 866.516477][ T197] usb 4-1: USB disconnect, device number 119 [ 866.684121][ T5699] keyspan_2 ttyUSB2: Keyspan 2 port adapter converter now disconnected from ttyUSB2 [ 866.743552][ T197] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 866.762095][ T5699] keyspan_2 ttyUSB3: Keyspan 2 port adapter converter now disconnected from ttyUSB3 [ 866.783515][ T5699] keyspan 2-1:1.0: device disconnected [ 866.797274][ T5694] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 866.854630][ T197] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 866.879962][ T197] keyspan 4-1:1.0: device disconnected [ 866.956041][ T5694] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 866.956079][ T5694] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 866.956099][ T5694] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 866.956116][ T5694] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 64 [ 866.956134][ T5694] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 64 [ 866.956152][ T5694] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 64 [ 866.956169][ T5694] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 64 [ 866.956187][ T5694] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x87 has invalid maxpacket 64 [ 866.956204][ T5694] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 866.956221][ T5694] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 866.956239][ T5694] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [ 866.956256][ T5694] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 64 [ 866.956273][ T5694] usb 5-1: config 1 interface 0 altsetting 0 has a duplicate endpoint with address 0x5, skipping [ 866.956290][ T5694] usb 5-1: config 1 interface 0 altsetting 0 has 12 endpoint descriptors, different from the interface descriptor's value: 14 [ 867.163313][ T5694] usb 5-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 867.163336][ T5694] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 867.163352][ T5694] usb 5-1: Product: syz [ 867.163363][ T5694] usb 5-1: Manufacturer: syz [ 867.163374][ T5694] usb 5-1: SerialNumber: syz [ 867.234690][T16749] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 867.234823][T16749] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 867.234948][T16749] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 867.235070][T16749] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 867.235154][T16749] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 867.235289][T16749] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 867.235456][T16749] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 867.235590][T16749] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 867.237110][T16749] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 867.276480][T16749] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 867.302950][T16749] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 867.341590][ T5694] keyspan 5-1:1.0: Keyspan 2 port adapter converter detected [ 867.361479][ T5694] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 7 [ 867.377661][ T5694] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 5 [ 867.401683][ T5694] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 867.406971][ T5694] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 6 [ 867.466175][ T5694] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 867.566687][ T5694] usb 5-1: USB disconnect, device number 32 [ 867.604943][ T5694] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 867.626047][ T5694] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 867.640218][ T5694] keyspan 5-1:1.0: device disconnected [ 867.698931][T14223] usb 4-1: new high-speed USB device number 120 using dummy_hcd [ 867.847556][T14223] usb 4-1: Using ep0 maxpacket: 32 [ 867.850258][T14223] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 867.850278][T14223] usb 4-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 867.850361][T14223] usb 4-1: config 0 interface 0 has no altsetting 0 [ 867.852603][T14223] usb 4-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 867.852624][T14223] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 867.852639][T14223] usb 4-1: Product: syz [ 867.852649][T14223] usb 4-1: Manufacturer: syz [ 867.852660][T14223] usb 4-1: SerialNumber: syz [ 867.923613][T14223] usb 4-1: config 0 descriptor?? [ 868.333391][T14223] gs_usb 4-1:0.0: Configuring for 22 interfaces [ 868.394235][T16763] kvm: requested 5866 ns i8254 timer period limited to 200000 ns [ 868.446588][T16759] FAULT_INJECTION: forcing a failure. [ 868.446588][T16759] name failslab, interval 1, probability 0, space 0, times 0 [ 868.446664][T16759] CPU: 0 UID: 0 PID: 16759 Comm: syz.1.3408 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 868.446687][T16759] Tainted: [L]=SOFTLOCKUP [ 868.446693][T16759] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 868.446704][T16759] Call Trace: [ 868.446711][T16759] [ 868.446718][T16759] dump_stack_lvl+0xe8/0x150 [ 868.446745][T16759] should_fail_ex+0x467/0x600 [ 868.446770][T16759] should_failslab+0xa8/0x100 [ 868.446787][T16759] __kmalloc_noprof+0xfb/0x790 [ 868.446812][T16759] ? tomoyo_realpath_from_path+0xef/0x640 [ 868.446837][T16759] ? tomoyo_realpath_from_path+0xef/0x640 [ 868.446868][T16759] tomoyo_realpath_from_path+0xef/0x640 [ 868.446900][T16759] ? tomoyo_path_number_perm+0x219/0x5f0 [ 868.446921][T16759] tomoyo_path_number_perm+0x246/0x5f0 [ 868.446944][T16759] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 868.446965][T16759] ? do_raw_spin_lock+0x12b/0x2f0 [ 868.446998][T16759] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 868.447015][T16759] ? lockdep_hardirqs_on+0x7a/0x110 [ 868.447043][T16759] ? __fget_files+0x2a/0x420 [ 868.447063][T16759] ? __fget_files+0x3a8/0x420 [ 868.447079][T16759] ? __fget_files+0x2a/0x420 [ 868.447098][T16759] security_file_ioctl+0xb9/0x260 [ 868.447119][T16759] __se_sys_ioctl+0x47/0x170 [ 868.447143][T16759] do_syscall_64+0x17b/0x530 [ 868.447159][T16759] ? irqentry_exit+0x10f/0x8f0 [ 868.447174][T16759] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 868.447192][T16759] ? clear_bhb_loop+0x40/0x90 [ 868.447212][T16759] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 868.447229][T16759] RIP: 0033:0x7f94fb55de99 [ 868.447244][T16759] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 868.447259][T16759] RSP: 002b:00007f94f97b6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 868.447276][T16759] RAX: ffffffffffffffda RBX: 00007f94fb7e5fa0 RCX: 00007f94fb55de99 [ 868.447289][T16759] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 868.447299][T16759] RBP: 00007f94f97b6090 R08: 0000000000000000 R09: 0000000000000000 [ 868.447310][T16759] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 868.447320][T16759] R13: 00007f94fb7e6038 R14: 00007f94fb7e5fa0 R15: 00007ffec2a31b38 [ 868.447344][T16759] [ 868.455917][T16759] ERROR: Out of memory at tomoyo_realpath_from_path. [ 868.688108][T14223] gs_usb 4-1:0.0: Couldn't register candev for channel 0 (-EINVAL) [ 868.741766][T14223] gs_usb 4-1:0.0: probe with driver gs_usb failed with error -22 [ 868.832582][T14223] usb 4-1: USB disconnect, device number 120 [ 869.641739][T14223] usb 3-1: new low-speed USB device number 35 using dummy_hcd [ 869.747060][T16779] FAULT_INJECTION: forcing a failure. [ 869.747060][T16779] name failslab, interval 1, probability 0, space 0, times 0 [ 869.747090][T16779] CPU: 0 UID: 0 PID: 16779 Comm: syz.3.3413 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 869.747113][T16779] Tainted: [L]=SOFTLOCKUP [ 869.747119][T16779] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 869.747130][T16779] Call Trace: [ 869.747137][T16779] [ 869.747144][T16779] dump_stack_lvl+0xe8/0x150 [ 869.747173][T16779] should_fail_ex+0x467/0x600 [ 869.747198][T16779] should_failslab+0xa8/0x100 [ 869.747216][T16779] __kmalloc_noprof+0xfb/0x790 [ 869.747239][T16779] ? tomoyo_realpath_from_path+0xef/0x640 [ 869.747264][T16779] ? tomoyo_realpath_from_path+0xef/0x640 [ 869.747295][T16779] tomoyo_realpath_from_path+0xef/0x640 [ 869.747326][T16779] ? tomoyo_path_number_perm+0x219/0x5f0 [ 869.747347][T16779] tomoyo_path_number_perm+0x246/0x5f0 [ 869.747382][T16779] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 869.747410][T16779] ? do_raw_spin_lock+0x12b/0x2f0 [ 869.747441][T16779] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 869.747457][T16779] ? lockdep_hardirqs_on+0x7a/0x110 [ 869.747483][T16779] ? __fget_files+0x2a/0x420 [ 869.747502][T16779] ? __fget_files+0x3a8/0x420 [ 869.747516][T16779] ? __fget_files+0x2a/0x420 [ 869.747534][T16779] security_file_ioctl+0xb9/0x260 [ 869.747553][T16779] __se_sys_ioctl+0x47/0x170 [ 869.747576][T16779] do_syscall_64+0x17b/0x530 [ 869.747591][T16779] ? irqentry_exit+0x10f/0x8f0 [ 869.747604][T16779] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 869.747620][T16779] ? clear_bhb_loop+0x40/0x90 [ 869.747639][T16779] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 869.747654][T16779] RIP: 0033:0x7fa11b18de99 [ 869.747668][T16779] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 869.747682][T16779] RSP: 002b:00007fa1193e6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 869.747699][T16779] RAX: ffffffffffffffda RBX: 00007fa11b415fa0 RCX: 00007fa11b18de99 [ 869.747711][T16779] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 869.747721][T16779] RBP: 00007fa1193e6090 R08: 0000000000000000 R09: 0000000000000000 [ 869.747748][T16779] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 869.747758][T16779] R13: 00007fa11b416038 R14: 00007fa11b415fa0 R15: 00007ffe60961158 [ 869.747783][T16779] [ 869.810226][T14223] usb 3-1: config 0 interface 0 altsetting 15 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 869.810254][T14223] usb 3-1: config 0 interface 0 altsetting 15 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 869.810274][T14223] usb 3-1: config 0 interface 0 has no altsetting 0 [ 869.810299][T14223] usb 3-1: New USB device found, idVendor=056e, idProduct=00fc, bcdDevice= 0.00 [ 869.810316][T14223] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 869.823109][T16779] ERROR: Out of memory at tomoyo_realpath_from_path. [ 869.823206][T16779] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 869.885302][ T5694] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 870.119745][T14223] usb 3-1: config 0 descriptor?? [ 870.142216][T16770] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 870.187235][ T5694] usb 2-1: Using ep0 maxpacket: 32 [ 870.206990][ T5694] usb 2-1: config 0 has an invalid interface number: 51 but max is 0 [ 870.207012][ T5694] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 870.207027][ T5694] usb 2-1: config 0 has no interface number 0 [ 870.207057][ T5694] usb 2-1: config 0 interface 51 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 870.269583][ T1339] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.280415][ T5694] usb 2-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 870.280439][ T5694] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 870.280455][ T5694] usb 2-1: Product: syz [ 870.280466][ T5694] usb 2-1: Manufacturer: syz [ 870.280477][ T5694] usb 2-1: SerialNumber: syz [ 870.422846][ T5694] usb 2-1: config 0 descriptor?? [ 870.450142][ T5694] quatech2 2-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 870.652101][ T5694] usb 2-1: qt2_setup_urbs - submit read urb failed -8 [ 870.652315][ T5694] quatech2 2-1:0.51: probe with driver quatech2 failed with error -8 [ 870.856292][T14223] hid_parser_main: 51 callbacks suppressed [ 870.856311][T14223] elecom 0003:056E:00FC.0010: unknown main item tag 0x2 [ 870.856334][T14223] elecom 0003:056E:00FC.0010: unknown main item tag 0x5 [ 870.856362][T14223] elecom 0003:056E:00FC.0010: unknown main item tag 0x3 [ 870.856382][T14223] elecom 0003:056E:00FC.0010: unknown main item tag 0x0 [ 870.856401][T14223] elecom 0003:056E:00FC.0010: unknown main item tag 0x0 [ 870.856421][T14223] elecom 0003:056E:00FC.0010: unknown main item tag 0x0 [ 870.856440][T14223] elecom 0003:056E:00FC.0010: invalid report_count 885399381 [ 870.856453][T14223] elecom 0003:056E:00FC.0010: item 0 4 1 9 parsing failed [ 870.921060][T14223] elecom 0003:056E:00FC.0010: probe with driver elecom failed with error -22 [ 870.999245][ T5694] usb 2-1: USB disconnect, device number 19 [ 871.087093][T14223] usb 3-1: USB disconnect, device number 35 [ 873.006370][T16801] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 873.967474][T14223] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 874.117249][T14223] usb 5-1: Using ep0 maxpacket: 32 [ 874.119334][T14223] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 874.119354][T14223] usb 5-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 874.119372][T14223] usb 5-1: config 0 interface 0 has no altsetting 0 [ 874.121603][T14223] usb 5-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 874.121624][T14223] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 874.121639][T14223] usb 5-1: Product: syz [ 874.121653][T14223] usb 5-1: Manufacturer: syz [ 874.121665][T14223] usb 5-1: SerialNumber: syz [ 874.126907][T14223] usb 5-1: config 0 descriptor?? [ 874.141085][ T5699] usb 3-1: new full-speed USB device number 36 using dummy_hcd [ 874.217484][ T197] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 874.330238][ T5699] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 874.330262][ T5699] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 874.330277][ T5699] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 874.330311][ T5699] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 14385, setting to 64 [ 874.332343][ T5699] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 874.332363][ T5699] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 874.332377][ T5699] usb 3-1: Product: syz [ 874.332386][ T5699] usb 3-1: Manufacturer: syz [ 874.385956][ T197] usb 2-1: Using ep0 maxpacket: 32 [ 874.416080][ T197] usb 2-1: config 0 has an invalid interface number: 51 but max is 0 [ 874.416098][ T197] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 874.416111][ T197] usb 2-1: config 0 has no interface number 0 [ 874.416137][ T197] usb 2-1: config 0 interface 51 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 874.477127][ T197] usb 2-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 874.477266][ T197] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 874.477282][ T197] usb 2-1: Product: syz [ 874.477294][ T197] usb 2-1: Manufacturer: syz [ 874.477305][ T197] usb 2-1: SerialNumber: syz [ 874.529692][ T197] usb 2-1: config 0 descriptor?? [ 874.530406][ T5699] cdc_wdm 3-1:1.0: skipping garbage [ 874.531787][ T5699] cdc_wdm 3-1:1.0: skipping garbage [ 874.572361][ T197] quatech2 2-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 874.575830][ T5699] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 874.575845][ T5699] cdc_wdm 3-1:1.0: Unknown control protocol [ 874.673069][T14223] gs_usb 5-1:0.0: Configuring for 22 interfaces [ 874.733421][ T197] usb 2-1: qt2_setup_urbs - submit read urb failed -8 [ 874.733777][ T197] quatech2 2-1:0.51: probe with driver quatech2 failed with error -8 [ 874.875503][T14223] gs_usb 5-1:0.0: Couldn't register candev for channel 0 (-EINVAL) [ 874.875845][T14223] gs_usb 5-1:0.0: probe with driver gs_usb failed with error -22 [ 874.943459][ T197] usb 2-1: USB disconnect, device number 20 [ 874.947310][ T5699] usb 4-1: new high-speed USB device number 121 using dummy_hcd [ 875.078232][ T9] usb 5-1: USB disconnect, device number 33 [ 875.102603][ T5699] usb 4-1: device descriptor read/64, error -71 [ 875.318852][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 6 bytes [ 875.337377][ T5699] usb 4-1: new high-speed USB device number 122 using dummy_hcd [ 875.467223][ T5699] usb 4-1: device descriptor read/64, error -71 [ 875.577650][ T5699] usb usb4-port1: attempt power cycle [ 875.929955][ T5699] usb 4-1: new high-speed USB device number 123 using dummy_hcd [ 875.954505][ T5699] usb 4-1: device descriptor read/8, error -71 [ 876.203888][T16824] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 876.236789][ T5699] usb 4-1: new high-speed USB device number 124 using dummy_hcd [ 876.261867][ T5699] usb 4-1: device descriptor read/8, error -71 [ 876.371042][ T5699] usb usb4-port1: unable to enumerate USB device [ 876.992019][T14223] usb 3-1: USB disconnect, device number 36 [ 878.427498][T14223] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 878.575438][T16858] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 878.577995][T14223] usb 2-1: Using ep0 maxpacket: 32 [ 878.602080][T14223] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 878.602104][T14223] usb 2-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 878.602193][T14223] usb 2-1: config 0 interface 0 has no altsetting 0 [ 878.605237][T14223] usb 2-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 878.605260][T14223] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 878.605275][T14223] usb 2-1: Product: syz [ 878.605287][T14223] usb 2-1: Manufacturer: syz [ 878.605298][T14223] usb 2-1: SerialNumber: syz [ 878.676769][T14223] usb 2-1: config 0 descriptor?? [ 879.096484][T14223] gs_usb 2-1:0.0: Configuring for 22 interfaces [ 879.331402][T14223] gs_usb 2-1:0.0: Couldn't register candev for channel 0 (-EINVAL) [ 879.356736][T14223] gs_usb 2-1:0.0: probe with driver gs_usb failed with error -22 [ 879.471169][T16864] Mass Storage Function, version: 2009/09/11 [ 879.472424][T16864] LUN: removable file: (no medium) [ 879.546315][T14223] usb 2-1: USB disconnect, device number 21 [ 879.597492][ T9] usb 3-1: new full-speed USB device number 37 using dummy_hcd [ 879.775159][ T9] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 879.775181][ T9] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 879.775194][ T9] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 879.775228][ T9] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 14385, setting to 64 [ 879.791754][ T9] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 879.791778][ T9] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 879.791793][ T9] usb 3-1: Product: syz [ 879.791805][ T9] usb 3-1: Manufacturer: syz [ 879.946511][ T9] cdc_wdm 3-1:1.0: skipping garbage [ 879.946528][ T9] cdc_wdm 3-1:1.0: skipping garbage [ 879.971382][ T9] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 879.971400][ T9] cdc_wdm 3-1:1.0: Unknown control protocol [ 880.245659][T16866] ================================================================== [ 880.245679][T16866] BUG: KASAN: slab-use-after-free in configfs_symlink+0x683/0x1030 [ 880.245710][T16866] Read of size 4 at addr ffff8880291fef00 by task syz.3.3442/16866 [ 880.245724][T16866] [ 880.245737][T16866] CPU: 0 UID: 0 PID: 16866 Comm: syz.3.3442 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 880.245761][T16866] Tainted: [L]=SOFTLOCKUP [ 880.245768][T16866] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 880.245778][T16866] Call Trace: [ 880.245784][T16866] [ 880.245792][T16866] dump_stack_lvl+0xe8/0x150 [ 880.245814][T16866] print_address_description+0x55/0x1e0 [ 880.245840][T16866] ? configfs_symlink+0x683/0x1030 [ 880.245862][T16866] print_report+0x58/0x70 [ 880.245885][T16866] kasan_report+0x117/0x150 [ 880.245901][T16866] ? configfs_symlink+0x683/0x1030 [ 880.245932][T16866] kasan_check_range+0x264/0x2c0 [ 880.245949][T16866] configfs_symlink+0x683/0x1030 [ 880.245972][T16866] ? lookup_one_qstr_excl+0x1d4/0x360 [ 880.245995][T16866] ? __pfx_configfs_symlink+0x10/0x10 [ 880.246019][T16866] ? bpf_lsm_inode_symlink+0x9/0x20 [ 880.246043][T16866] vfs_symlink+0x18b/0x330 [ 880.246066][T16866] ? security_path_symlink+0xf3/0x310 [ 880.246093][T16866] filename_symlinkat+0x1cd/0x420 [ 880.246119][T16866] ? __pfx_filename_symlinkat+0x10/0x10 [ 880.246143][T16866] ? strncpy_from_user+0x150/0x2c0 [ 880.246163][T16866] ? do_getname+0x151/0x250 [ 880.246189][T16866] __se_sys[ 880.246189][T16866] __se_sys_symlinkat+0x4e/0x2b0 [ 880.246215][T16866] do_syscall_64+0x17b/0x530 [ 880.246232][T16866] ? irqentry_exit+0x10f/0x8f0 [ 880.246247][T16866] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 880.246264][T16866] ? clear_bhb_loop+0x40/0x90 [ 880.246282][T16866] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 880.246299][T16866] RIP: 0033:0x7fa11b18de99 [ 880.246314][T16866] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 880.246328][T16866] RSP: 002b:00007fa1193c5028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 880.246346][T16866] RAX: ffffffffffffffda RBX: 00007fa11b416090 RCX: 00007fa11b18de99 [ 880.246359][T16866] RDX: 0000200000000300 RSI: ffffffffffffff9c RDI: 0000200000000200 [ 880.246371][T16866] RBP: 00007fa11b223eaf R08: 0000000000000000 R09: 0000000000000000 [ 880.246382][T16866] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 880.246392][T16866] R13: 00007fa11b416128 R14: 00007fa11b416090 R15: 00007ffe60961158 [ 880.246411][T16866] [ 880.246418][T16866] [ 880.246426][T16866] Allocated by task 16864: [ 880.246491][T16866] kasan_save_track+0x3e/0x80 [ 880.246514][T16866] __kasan_slab_alloc+0x6c/0x80 [ 880.246536][T16866] kmem_cache_alloc_noprof+0x358/0x680 [ 880.246559][T16866] configfs_new_dirent+0x59/0x470 [ 880.246576][T16866] configfs_attach_item+0xa1/0xd60 [ 880.246596][T16866] configfs_attach_group+0x2a/0x370 [ 880.246616][T16866] configfs_mkdir+0x6f0/0x9e0 [ 880.246634][T16866] vfs_mkdir+0x408/0x620 [ 880.246653][T16866] filename_mkdirat+0x289/0x520 [ 880.246678][T16866] __se_sys_mkdirat+0x35/0x150 [ 880.246698][T16866] do_syscall_64+0x17b/0x530 [ 880.246712][T16866] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 880.246728][T16866] [ 880.246732][T16866] Freed by task 16873: [ 880.246739][T16866] kasan_save_track+0x3e/0x80 [ 880.246761][T16866] kasan_save_free_info+0x40/0x50 [ 880.246778][T16866] __kasan_slab_free+0x5c/0x80 [ 880.246801][T16866] kmem_cache_free+0x187/0x6c0 [ 880.246824][T16866] configfs_d_iput+0x209/0x270 [ 880.246841][T16866] vfs_rmdir+0x24a/0x6b0 [ 880.246860][T16866] filename_rmdir+0x292/0x520 [ 880.246881][T16866] __se_sys_rmdir+0x2e/0x140 [ 880.246901][T16866] do_syscall_64+0x17b/0x530 [ 880.246915][T16866] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 880.246930][T16866] [ 880.246934][T16866] The buggy address belongs to the object at ffff8880291fef00 [ 880.246934][T16866] which belongs to the cache configfs_dir_cache of size 96 [ 880.246973][T16866] The buggy address is located 0 bytes inside of [ 880.246973][T16866] freed 96-byte region [ffff8880291fef00, ffff8880291fef60) [ 880.246990][T16866] [ 880.246994][T16866] The buggy address belongs to the physical page: [ 880.247028][T16866] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x291fe [ 880.247044][T16866] flags: 0x80000000000000(node=0|zone=1) [ 880.247062][T16866] page_type: f5(slab) [ 880.247077][T16866] raw: 0080000000000000 ffff88801f69e780 dead000000000122 0000000000000000 [ 880.247092][T16866] raw: 0000000000000000 0000000800200020 00000000f5000000 0000000000000000 [ 880.247101][T16866] page dumped because: kasan: bad access detected [ 880.247113][T16866] page_owner tracks the page as allocated [ 880.247119][T16866] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 9201342472 [ 880.247145][T16866] post_alloc_hook+0x1f9/0x250 [ 880.247166][T16866] get_page_from_freelist+0x264c/0x26c0 [ 880.247192][T16866] __alloc_frozen_pages_noprof+0x222/0x5b0 [ 880.247218][T16866] allocate_slab+0x7c/0x5e0 [ 880.247234][T16866] refill_objects+0x2d8/0x350 [ 880.247251][T16866] __pcs_replace_empty_main+0x330/0x690 [ 880.247268][T16866] kmem_cache_alloc_noprof+0x455/0x680 [ 880.247288][T16866] configfs_new_dirent+0x59/0x470 [ 880.247306][T16866] configfs_attach_item+0xa1/0xd60 [ 880.247326][T16866] configfs_attach_group+0x2a/0x370 [ 880.247346][T16866] configfs_register_subsystem+0x3a5/0x560 [ 880.247367][T16866] target_core_init_configfs+0x314/0x500 [ 880.247415][T16866] do_one_initcall+0x250/0x870 [ 880.247435][T16866] do_initcall_level+0x10a/0x1a0 [ 880.247464][T16866] do_initcalls+0x59/0xa0 [ 880.247481][T16866] kernel_init_freeable+0x29d/0x3e0 [ 880.247499][T16866] page_owner free stack trace missing [ 880.247505][T16866] [ 880.247509][T16866] Memory state around the buggy address: [ 880.247517][T16866] ffff8880291fee00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 880.247529][T16866] ffff8880291fee80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 880.247540][T16866] >ffff8880291fef00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 880.247548][T16866] ^ [ 880.247557][T16866] ffff8880291fef80: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 880.247568][T16866] ffff8880291ff000: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 880.247576][T16866] ================================================================== [ 880.410191][T16866] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 880.410211][T16866] CPU: 0 UID: 0 PID: 16866 Comm: syz.3.3442 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 880.410235][T16866] Tainted: [L]=SOFTLOCKUP [ 880.410241][T16866] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 880.410251][T16866] Call Trace: [ 880.410258][T16866] [ 880.410270][T16866] vpanic+0x56c/0xa60 [ 880.410292][T16866] ? __pfx_vpanic+0x10/0x10 [ 880.410308][T16866] ? __pfx___schedule+0x10/0x10 [ 880.410337][T16866] panic+0xc5/0xd0 [ 880.410351][T16866] ? __pfx_panic+0x10/0x10 [ 880.410369][T16866] ? preempt_schedule_common+0x82/0xd0 [ 880.410396][T16866] ? configfs_symlink+0x683/0x1030 [ 880.410419][T16866] check_panic_on_warn+0x89/0xb0 [ 880.410443][T16866] ? configfs_symlink+0x683/0x1030 [ 880.410465][T16866] end_report+0x73/0x170 [ 880.410481][T16866] ? configfs_symlink+0x683/0x1030 [ 880.410502][T16866] kasan_report+0x128/0x150 [ 880.410518][T16866] ? configfs_symlink+0x683/0x1030 [ 880.410544][T16866] kasan_check_range+0x264/0x2c0 [ 880.410561][T16866] configfs_symlink+0x683/0x1030 [ 880.410584][T16866] ? lookup_one_qstr_excl+0x1d4/0x360 [ 880.410606][T16866] ? __pfx_configfs_symlink+0x10/0x10 [ 880.410630][T16866] ? bpf_lsm_inode_symlink+0x9/0x20 [ 880.410661][T16866] vfs_symlink+0x18b/0x330 [ 880.410684][T16866] ? security_path_symlink+0xf3/0x310 [ 880.410711][T16866] filename_symlinkat+0x1cd/0x420 [ 880.410738][T16866] ? __pfx_filename_symlinkat+0x10/0x10 [ 880.410762][T16866] ? strncpy_from_user+0x150/0x2c0 [ 880.410784][T16866] ? do_getname+0x151/0x250 [ 880.410810][T16866] __se_sys_symlinkat+0x4e/0x2b0 [ 880.410836][T16866] do_syscall_64+0x17b/0x530 [ 880.410852][T16866] ? irqentry_exit+0x10f/0x8f0 [ 880.410867][T16866] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 880.410884][T16866] ? clear_bhb_loop+0x40/0x90 [ 880.410903][T16866] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 880.410919][T16866] RIP: 0033:0x7fa11b18de99 [ 880.410935][T16866] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 880.410961][T16866] RSP: 002b:00007fa1193c5028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 880.410978][T16866] RAX: ffffffffffffffda RBX: 00007fa11b416090 RCX: 00007fa11b18de99 [ 880.410990][T16866] RDX: 0000200000000300 RSI: ffffffffffffff9c RDI: 0000200000000200 [ 880.411002][T16866] RBP: 00007fa11b223eaf R08: 0000000000000000 R09: 0000000000000000 [ 880.411012][T16866] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 880.411023][T16866] R13: 00007fa11b416128 R14: 00007fa11b416090 R15: 00007ffe60961158 [ 880.411042][T16866] [ 880.411104][T16866] Kernel Offset: disabled