last executing test programs: 5.214105548s ago: executing program 4 (id=2344): r0 = socket$inet6(0xa, 0x802, 0x0) r1 = add_key(&(0x7f0000000480)='cifs.idmap\x00', 0x0, &(0x7f0000000200)="308201d43082017ba00302010202142eea648d7f17e62e9e5869c887c68e1bd0f86fde300a06082a8648ce3d040302303a3138303606035504030c2f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793020170d3234303431333232313632365a180f32313234303332303232313632365a303a3138303606035504030c2f43657274696669636174652076657269666963617428a2e0861e1ae90d412073656c662d74657374696e67206b65793059301306072a8648ce3d020106082a8648ce3d0301070342000407e56b51affc19412c88926b775771039ee2fe6e6a714ec7299f90e177189fc2e70a82d08ae181a9717c5a73fb25b95b1e248c739ff838f848b4ad1619c022c6a35d305b301d0603551d0e041604142900bcea1deb7bc8479a84a23d758efdfdd2b2d3301f0603551d230418301680142900bcea1deb7bc8479a84a23d758efdfdd2b2d3300c0603551d130101ff04023000300b0603551d0f040403020780300a06082a8648ce3d040302034700304402201ad7ac07c89738f489437ec7666ea5007c121db409760c996b8c265de9705cb4022073b7c77a5adb670a964219cf4f674f356aee2925f24fc810149d79691c7ad75d", 0x1d8, 0x0) keyctl$KEYCTL_PKEY_QUERY(0x18, r1, 0x0, &(0x7f00000000c0)='\x00', 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r3, &(0x7f00000002c0)={0x24, &(0x7f0000000380)=ANY=[@ANYBLOB="c60009"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000001640)={0x24, 0x0, 0x0, &(0x7f0000001bc0)=ANY=[@ANYBLOB="002290"], 0x0}, 0x0) syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x8000) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r8, 0xc008ae88, &(0x7f0000000040)={0x1, 0x0, [{0xc0010140}]}) syz_genetlink_get_family_id$batadv(&(0x7f0000000740), r4) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000002c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000540)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYBLOB="070300170000000000d80600000008010300", @ANYRESOCT=0x0, @ANYRES32=r9, @ANYBLOB="0800050002000000"], 0x24}}, 0x10) sendmsg$NL80211_CMD_CONNECT(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYBLOB='8\x00\t\x00', @ANYRES16=r5, @ANYBLOB="050000000000000000002e00000008000300", @ANYRES32=r9, @ANYBLOB="0a00340002020202020200000800350000000000"], 0x30}}, 0x0) sendmsg$NL80211_CMD_DEL_INTERFACE(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="8b1431bd70008100"/18, @ANYRES8=r4, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x8c4}, 0x20000000) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff7000/0x3000)=nil, &(0x7f0000ff2000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff5000/0x2000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff6000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r10 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000500)=[{&(0x7f0000001480)}], 0x10000133) io_uring_enter(r10, 0x2219, 0xcf74, 0x16, 0x0, 0x0) ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f0000000200)={0xffffffffffffffff, &(0x7f0000000000)=':\\&\x00', 0x10100, 0x0, 0xbdd3, 0x0, 0x0}) setsockopt$inet6_buf(r0, 0x29, 0x39, &(0x7f0000000100)="ff02040000ffffffffffffffff1f2be82d22c4fd8c2dbbdc03c7413c3e4396488a6c969a90ed8944f9156748b1af0000000000af0200000000000000643934eacc0d48706586f3439bbb0a01736dbf6be9e2fdae4881dcefd905a591749ff208409bb63ee309580fc1cb0e59fc44cac7916d9eae114a2c9319d2055ab313aeba27487810c28ba8290dcf7432feaab166aa6d6cc6d8b74d48d8ddcc3a46d9d45d60a6cf0d71bdd48774afa83645f2246489c37e7ade34c85f33b9a66e", 0xbc) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0x3}, 0x31) 3.561216587s ago: executing program 2 (id=2358): r0 = fsopen(&(0x7f0000000040)='binder\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) close(r0) ioctl$DVB_DEMUX_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, &(0x7f0000000180)={0x4, 0x0, r0}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = dup(0xffffffffffffffff) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) eventfd(0x1) io_setup(0x6, &(0x7f0000000540)) r4 = syz_open_procfs(0x0, &(0x7f0000000200)='task\x00') lseek(r4, 0x0, 0x1) syz_open_dev$vbi(&(0x7f00000003c0), 0x2, 0x2) socket$inet6_udp(0xa, 0x2, 0x0) r5 = syz_open_dev$video4linux(&(0x7f0000000080), 0xff, 0x100082) ioctl$VIDIOC_SUBDEV_S_CROP(r5, 0xc038563c, &(0x7f0000000040)={0x0, 0x0, {0xffffffff, 0xa, 0x2, 0x9}}) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r7 = syz_open_dev$vbi(&(0x7f0000000000), 0x3, 0x2) poll(&(0x7f0000000100)=[{r7, 0x6086}, {r7, 0x1a0}], 0x2, 0x4) ioctl$TCSETS(r6, 0x40045431, &(0x7f0000000080)={0x0, 0x8a, 0x4, 0x7fffffff, 0xd, "00080000000000000000000cadf100004000"}) getsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x42, 0x0, &(0x7f00000000c0)) syz_open_pts(r6, 0x200) r8 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x41100, 0x0) ioctl$TCSETS(r8, 0x40045431, &(0x7f0000000140)={0x0, 0xdffffffa, 0x81, 0xfffffffe, 0x0, "8100e1c8e80b598c36ff000800"}) r9 = syz_open_pts(r8, 0x141601) fcntl$setstatus(r3, 0x4, 0x142000) write(r9, &(0x7f0000000000)="d5", 0xfffffedf) ioctl$TIOCSETD(r9, 0x5423, &(0x7f0000000040)=0xe) r10 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x2, &(0x7f0000000240)=[{0x6, 0xf, 0x0, 0x7fff8000}, {0x5, 0x7, 0x1, 0xfffffffa}]}) close_range(r10, 0xffffffffffffffff, 0x0) 3.413760839s ago: executing program 4 (id=2359): r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x56a9, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x3938700}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec778000) r2 = socket$unix(0x1, 0x2, 0x0) r3 = socket$unix(0x1, 0x2, 0x0) sendmmsg(r3, &(0x7f0000002dc0), 0x3a, 0x408c4) connect$unix(r2, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) io_setup(0x81, &(0x7f0000001100)=0x0) io_submit(r4, 0x0, &(0x7f00000008c0)) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) syz_usb_connect(0x0, 0x2d, &(0x7f00000005c0)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870fd00090582020002"], 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x50, 0xffffffffffffffff, 0xec778000) r5 = syz_open_dev$sndctrl(&(0x7f0000000040), 0xe26, 0x101400) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xb10692d486d5f5b4, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r6, 0x0) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r7 = syz_open_dev$loop(&(0x7f0000000000), 0x7b, 0xa004) fadvise64(r7, 0x401, 0xffffffff, 0x4) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r5, 0xc0045520, &(0x7f00000000c0)=""/92) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) 3.378395283s ago: executing program 1 (id=2360): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$sequencer(r1, &(0x7f0000000040)=[@v={0x93, 0x8, 0x90, 0xa, @generic=0x9, 0x4, 0x100}, @l={0x92, 0x0, 0xb0, 0x1c, 0x1, 0x6, 0x2}], 0x10) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_SUPPORTED(r2, 0x84, 0x81, &(0x7f0000000000)={0x0, 0x2}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f0000000140)={r3, 0x1000}, 0x8) write(r2, &(0x7f0000000200)='nqn=test,transport=tcp,traddr=:.', 0x20) socket$inet6_sctp(0xa, 0x1, 0x84) syz_emit_ethernet(0x42, &(0x7f0000000500)={@local, @remote, @val={@void, {0x8100, 0x0, 0x0, 0x1}}, {@ipv4={0x800, @tcp={{0x7, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0xa3, 0x6, 0x0, @remote, @local, {[@generic={0x88, 0x7, "bb94f2d8dc"}]}}, {{0x4e22, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000001940)={0x0, 0xffffffffffffff01, &(0x7f0000001900)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000100001000000000000000000622396535cb8fe79d577bf92f1bd030094ae575dcc03406035100c4d472c000a200000000b0a010400000000000000000a0000090900010073797a300000000014190000110001ff00003133ad1767f0fa59d7ae"], 0x48}, 0x1, 0x0, 0x0, 0x40091}, 0x4000840) 3.141816241s ago: executing program 1 (id=2361): r0 = open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x80) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x1c1040, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000e80)='./bus\x00', 0x1c1002, 0x40) write(r2, &(0x7f0000004200)='t', 0x1) sendfile(r2, r1, 0x0, 0x7fffffff) ftruncate(r0, 0x2007ffb) sendfile(r0, r0, 0x0, 0x1000000201005) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) utimes(&(0x7f00000000c0)='./bus\x00', &(0x7f0000000280)={{r3, r4/1000+10000}, {r5, r6/1000+10000}}) 2.952175946s ago: executing program 2 (id=2362): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0xd, &(0x7f0000000500)={0x0, 0x30b5, 0x0, 0x2, 0x377}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000300)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x6, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0x20fb87, 0x800, 0xfffffffd, 0x32c}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x1006, 0x15a, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ac7, 0x8000, 0x10000000, 0x546}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88de, 0x8, 0x3, 0xfffffffc}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0xbd}}], 0x1, &(0x7f0000000340)={0x2e, 0x54, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0x3, 0x826, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, 0x0, 0x0, 0x0, 0xffffffffffffff4f, 0x0, 0x0, 0x7}, 0x94) 2.452078206s ago: executing program 3 (id=2365): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0x78b}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)=0x3) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r2, 0x0) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000c80)={"43d064455ca79c3698dcca60005c1ba163b1d8f04d69d873792c0cbfc95dacc7cd39a49df12a052d0d8f1bd04b722b4f262437efc030e706916de618763f4600660b41f320706e06860fe29f1bb455ef507156d0a5738f130784a1aad99f74b3e592254eede14eb1b64af356cfaa8ff002c4deed28995dc5e6ee13c4a1b39ba72979c5f3ed91ff89e73e09f7f88fe58bce505f0500764c95c8bed7499213d10731b60ed6c8806ab094843295ac02f06dc46485bb56f2eb2eb3c5ef1e50a2431a2082b54c4b0e1357daaefd30e08322fb5f922f6d9fa3226faf7aeb9630aabe81617fe2849d8ab92fb80f07dfa9d831f4f7ef48923e28553f0c31cf1343d4c0d4dee937e639670fc2ceab9e5048d5bcd9f52a9c90ddd1fee1fda90a114fdf7298b7607c5294efdea04743a0045e96aae496fcb06636a8620f6e007ee5f5c24ab0d0f85cfb3a7820dbe2241b017e917eafb27d13feba7de3a28dd4c29c7959ae5c0724c848f8960fbea5f7b7a35ac32fa6bbf869030a1b61fb0d20a5631dcea68ffa7d456869c4e79f6033f38fa88ccd53dc1feb5381c01dd71ec0446e3633270b7fb961e04ad7e1f44e3fd0d96c724499e1ec2cff23a3d5a97952ec0a44dd967491dc45d4df48ad83027df0be02e35ca4c107bdf957f4c7a831dff89f998a2e1302445dc02b5fc38f7c8a6260723e535062319cb68cb309e91b88c55014bb436c5d9f6bf35cbe24605821baf9ea6aaa31cb2dd74e29863a0c71e3367846cffe17c4a29a76eb635e95c6d7f4d846f3369aedbfb70b3716c1c0234a0deb9abfac12686d45ba97952e8a50480c5f44e038b1a4d5cd9301d02b942afacfaa30b6ef315d72eaf41dddda4983608dc2f5d5e92392a141b0f2f8d34042d1a6cd45d9f9df4c83b8c8b55959d58843ab3564d3f49d81ed2ccd42bb8ad9c8e4b92c2df872c9383c88f4b1bbaf116fff233f55d99b43677eb29ad63e00ea4eee69c72a604b2cdd7641d9c682d1d4ea8e5bd0de857ac1a55b2d6374a4a18af8f27887ffb4b2168e764a5aa9b303a35873d2177de8c5a00be39726baa6d336b6a36b8ec6743454b4542f3fb3ca678a0ecca17ba7c2655931f38ed26219fde45ab8469db2a156953b028abec63c6b841c8bd9f9f0861e7aeb8195013444d2d326cad53718e40be06aea644573a9ef22b13692a17ed8a451af9e2de15b4bfce7c257063e28c07e4c3301a1bff37d72efc14d34ddabbb286f53264e0c8122f215de4f2e06f6e0472674c2476a61ad2e309abfed7e3367bc7373876507764e60b193e8c5abbe95f42adfc74dd25c9098dfba8272f7361d0000000000000000000000000000000000000000000000000000e000"}) (async) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000c80)={"43d064455ca79c3698dcca60005c1ba163b1d8f04d69d873792c0cbfc95dacc7cd39a49df12a052d0d8f1bd04b722b4f262437efc030e706916de618763f4600660b41f320706e06860fe29f1bb455ef507156d0a5738f130784a1aad99f74b3e592254eede14eb1b64af356cfaa8ff002c4deed28995dc5e6ee13c4a1b39ba72979c5f3ed91ff89e73e09f7f88fe58bce505f0500764c95c8bed7499213d10731b60ed6c8806ab094843295ac02f06dc46485bb56f2eb2eb3c5ef1e50a2431a2082b54c4b0e1357daaefd30e08322fb5f922f6d9fa3226faf7aeb9630aabe81617fe2849d8ab92fb80f07dfa9d831f4f7ef48923e28553f0c31cf1343d4c0d4dee937e639670fc2ceab9e5048d5bcd9f52a9c90ddd1fee1fda90a114fdf7298b7607c5294efdea04743a0045e96aae496fcb06636a8620f6e007ee5f5c24ab0d0f85cfb3a7820dbe2241b017e917eafb27d13feba7de3a28dd4c29c7959ae5c0724c848f8960fbea5f7b7a35ac32fa6bbf869030a1b61fb0d20a5631dcea68ffa7d456869c4e79f6033f38fa88ccd53dc1feb5381c01dd71ec0446e3633270b7fb961e04ad7e1f44e3fd0d96c724499e1ec2cff23a3d5a97952ec0a44dd967491dc45d4df48ad83027df0be02e35ca4c107bdf957f4c7a831dff89f998a2e1302445dc02b5fc38f7c8a6260723e535062319cb68cb309e91b88c55014bb436c5d9f6bf35cbe24605821baf9ea6aaa31cb2dd74e29863a0c71e3367846cffe17c4a29a76eb635e95c6d7f4d846f3369aedbfb70b3716c1c0234a0deb9abfac12686d45ba97952e8a50480c5f44e038b1a4d5cd9301d02b942afacfaa30b6ef315d72eaf41dddda4983608dc2f5d5e92392a141b0f2f8d34042d1a6cd45d9f9df4c83b8c8b55959d58843ab3564d3f49d81ed2ccd42bb8ad9c8e4b92c2df872c9383c88f4b1bbaf116fff233f55d99b43677eb29ad63e00ea4eee69c72a604b2cdd7641d9c682d1d4ea8e5bd0de857ac1a55b2d6374a4a18af8f27887ffb4b2168e764a5aa9b303a35873d2177de8c5a00be39726baa6d336b6a36b8ec6743454b4542f3fb3ca678a0ecca17ba7c2655931f38ed26219fde45ab8469db2a156953b028abec63c6b841c8bd9f9f0861e7aeb8195013444d2d326cad53718e40be06aea644573a9ef22b13692a17ed8a451af9e2de15b4bfce7c257063e28c07e4c3301a1bff37d72efc14d34ddabbb286f53264e0c8122f215de4f2e06f6e0472674c2476a61ad2e309abfed7e3367bc7373876507764e60b193e8c5abbe95f42adfc74dd25c9098dfba8272f7361d0000000000000000000000000000000000000000000000000000e000"}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000280)={[0x400004, 0x2f4, 0x100000008, 0x0, 0x1, 0x6, 0x4, 0x8, 0x37b7, 0xe9, 0x0, 0x6, 0x7, 0x2, 0x3ff, 0x45d], 0xeeef0000, 0x4fb40}) (async) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000280)={[0x400004, 0x2f4, 0x100000008, 0x0, 0x1, 0x6, 0x4, 0x8, 0x37b7, 0xe9, 0x0, 0x6, 0x7, 0x2, 0x3ff, 0x45d], 0xeeef0000, 0x4fb40}) ioctl$KVM_RUN(r2, 0xae80, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0xc00, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x17, 0x5, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @cgroup_sysctl=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x17, 0x5, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @cgroup_sysctl=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_open_dev$loop(0x0, 0xffffffffffff2c1c, 0x20402) (async) r3 = syz_open_dev$loop(0x0, 0xffffffffffff2c1c, 0x20402) fallocate(r3, 0x11, 0x0, 0x5345) (async) fallocate(r3, 0x11, 0x0, 0x5345) syz_mount_image$fuse(0x0, 0x0, 0x244007, &(0x7f0000000340)=ANY=[@ANYBLOB="66493d04000d23c3eebb27c8f00239ed556562411dc35c189092e3a134e7ebe58763b2719aeb277eedc26a3f11d061ca1e416931723d4353e49e576f081335b92274ed4daf7d23864255eaaacf4f6396b7f634bc366946ba", @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000120000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x1, 0x0, 0x0) ioctl$FUSE_DEV_IOC_CLONE(0xffffffffffffffff, 0x8004e500, 0x0) 2.099160138s ago: executing program 2 (id=2367): syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xffde}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000d00)=@newtfilter={0x24c, 0x2c, 0xd27, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0xe, 0x5}, {}, {0x7, 0xb}}, [@filter_kind_options=@f_flower={{0xb}, {0x21c, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS_MASK={0x100, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x24, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x4}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0xdd13}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x8}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x1af}]}, @TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0x1c, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5, 0x2, 0xd}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5, 0x2, 0x2}]}, @TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x44, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x2}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x2}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0xa}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x400}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x800}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x9}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0xffff}]}, @TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0xc, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS={0x6, 0x1, 0xcc}]}, @TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x4}, @TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x2c, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_DIR={0x5, 0x3, 0xf}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0xa44a}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_HWID={0x5, 0x4, 0x5}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}]}, @TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x3c, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x2}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x4}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x2}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x2}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0xe147}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x9}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x8}]}]}, @TCA_FLOWER_KEY_ENC_OPTS={0x4c, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0xc, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x5}]}, @TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x3c, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x30000}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x7}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0xe}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x7b}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x6}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x4}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x6}]}]}, @TCA_FLOWER_KEY_ICMPV6_TYPE_MASK={0x5}, @TCA_FLOWER_KEY_ENC_OPTS_MASK={0xac, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x4}, @TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x2c, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x4000086}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x6}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x6}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x8}]}, @TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0x34, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0x8c}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0x3}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0x9b}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5, 0x2, 0x3}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS={0x6, 0x1, 0x9}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0xe7}]}, @TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0xc, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x3}]}, @TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x1c, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0xd40}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0xfc64}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x5}]}, @TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x1c, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x7fff}]}]}, @TCA_FLOWER_KEY_ENC_IPV4_SRC_MASK={0x8, 0x1c, 0xffffffff}, @TCA_FLOWER_KEY_TCP_SRC={0x6}, @TCA_FLOWER_KEY_MPLS_TC={0x5, 0x45, 0x80}]}}]}, 0x24c}, 0x1, 0x0, 0x0, 0x80}, 0x0) 1.934476799s ago: executing program 1 (id=2368): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc08000340"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x4, 0x70bd2d, 0x4, {0x0, 0x0, 0x0, 0x0, {0x8, 0x3}, {0xa, 0xffe0}, {0xfff1, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_FLOWS={0x8, 0x2, 0xfb0e}, @TCA_FQ_PIE_ECN_PROB={0x8, 0x9, 0x16}]}}]}, 0x44}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r1, @ANYBLOB="1000000000000000280012800b000100627269646765000018000280050019"], 0x48}}, 0x4084) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) 1.90091465s ago: executing program 3 (id=2369): mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r0 = socket$inet_sctp(0x2, 0x0, 0x84) read$FUSE(0xffffffffffffffff, 0x0, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000004ac0)={0x0, 0x0, 0x0}, 0x4002) listen(r0, 0xda90) 1.734352632s ago: executing program 2 (id=2370): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000200)=0x437b, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendmmsg(r0, &(0x7f0000000980)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f00000003c0)="3a189489562fad5f8c60f48c13ab18046bb1f5ba621d742dc99c0655f8410836d10500c23b2cdd", 0x27}], 0x1}}], 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000340)=[@window={0x3, 0x1, 0x8}, @window={0x3, 0x6, 0x7}, @sack_perm, @window={0x3, 0x0, 0x4}, @mss={0x2, 0x4}, @timestamp, @window={0x3, 0x1, 0x10}, @sack_perm], 0x20000000000002a1) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f00000004c0)='<', 0x381, 0x805, 0x0, 0x241) 1.507965084s ago: executing program 2 (id=2371): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r4, 0x80010040) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) syz_emit_ethernet(0x36, &(0x7f0000000080)={@local, @local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x3d, 0x28, 0x67, 0x0, 0x2, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x3c, 0xfffe, 0x0, 0x95, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0xa, 0x40, 0xb, 0x0, 0x0, {[@generic={0x0, 0x2}, @exp_fastopen={0xfe, 0x4}, @mptcp=@mp_fclose={0x1e, 0xc, 0x1c0, 0x0, 0x7}]}}}}}}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000680)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x130}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x6c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c0001800600010058c6000014000000110001"], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000900)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELSETELEM={0x2c, 0xe, 0xa, 0x23f, 0x0, 0x0, {0xa}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x54}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=@ipv6_getroute={0x24, 0x1a, 0x501, 0x70bd2a, 0x0, {0xa, 0x0, 0x0, 0x0, 0xfd, 0x0, 0x0, 0x9}, [@RTA_OIF={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x0) 1.505688445s ago: executing program 0 (id=2372): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r0) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) recvmmsg(r0, &(0x7f0000005f80)=[{{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, &(0x7f0000001840)=[{&(0x7f0000000180)=""/192, 0xc0}, {&(0x7f0000000440)=""/16, 0x10}, {&(0x7f0000000540)=""/159, 0x9f}, {&(0x7f00000006c0)=""/4096, 0x1000}, {&(0x7f00000016c0)=""/220, 0xdc}, {&(0x7f00000017c0)=""/111, 0x6f}], 0x6}, 0x257a}, {{0x0, 0x0, 0x0}, 0x9}], 0x3, 0x20, 0x0) 1.462539829s ago: executing program 3 (id=2373): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={0x0, 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x4000006, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000002280)=[{&(0x7f0000000280)={0x1a8, 0x14, 0x8, 0x70bd2c, 0x25dfdbfb, "", [@nested={0xc, 0x56, 0x0, 0x1, [@nested={0x4, 0x166}, @nested={0x4, 0xa6}]}, @generic="950368a3b26efdada008808323cad28697da35af0c8cbd32960cac24a0ad3e8a6abd3535aaabf76e13fd28dcc3c30475c21b4f7a3e2dba2f9181a787d244849ec8447cb2308e119f9a01e9e58678a8ae3a5eec46d62a4bf58dfa5791826570f4a5d5b4b0718205eade2052e48689a40e9f8e8d652ccd5a2f5adafb325508cd646c5ed6c0c3c1d7acbaca5b3feb791252550c78326ca4f5a3d629ebe1d0367be9e026e80b7eaa8e42e9ae9963d1477fe79e47693168", @generic="dbda042f4b59ce724c23c824a7396731f4dc806d540f28cb223fa7b4c10aa58aa7b59d1085bcb4e3e1f29a3055696dc120b72e0717578fc70091ca3b307d180993a38bdbb323492bd236da283bb48b0ee7b3a6cca6bc4d8a7a670011af18fdd809b8cc3bd6c83c10063170d7c899553823518c52d7136b756c2bfbb7c68ae08abf04ffb959819f26e1be9ea6ea98eb17d8eed0768b02b1a30266aaab25a10908df090aebf7f9eb531ab41273823aee7da6bce935f6ee1635", @typed={0x8, 0xaa, 0x0, 0x0, @u32=0x8}, @typed={0x14, 0x12e, 0x0, 0x0, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}]}, 0x1a8}], 0x1, 0x0, 0x0, 0x55c2499837e1ced9}, 0x24000000) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r2, 0x4020aed2, &(0x7f00000001c0)={0x60000, 0x18000, 0x9fef19c9430e26b8}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@getlink={0x28, 0x12, 0x1, 0x0, 0x0, {}, [@IFLA_EXT_MASK={0x8, 0x1d, 0x3ff}]}, 0x28}, 0x1, 0x0, 0x0, 0x2000}, 0x0) (async) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) clock_nanosleep(0x4, 0x0, &(0x7f0000000100)={0x0, 0x989680}, &(0x7f0000000140)) (async) r5 = fsmount(0xffffffffffffffff, 0x1, 0x70) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000005c0)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xec, 0x9, 0x6, 0x301, 0x0, 0x0, {0x7, 0x0, 0xa}, [@IPSET_ATTR_ADT={0x28, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x8}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_CIDR2={0x5}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e22}}]}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x10001}, @IPSET_ATTR_DATA={0x4c, 0x7, 0x0, 0x1, [@IPSET_ATTR_SKBPRIO={0x8, 0x1c, 0x1, 0x0, 0x6}, @IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x5}, @IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @local}}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0xcd}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e24}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x2f}, @IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x721d}]}, @IPSET_ATTR_ADT={0x1c, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x2}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x2b9}}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_NAME={0x9, 0x12, 'syz1\x00'}]}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x7}]}, 0xec}, 0x1, 0x0, 0x0, 0x4000081}, 0x0) r6 = dup(r4) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f00000005c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SET_FLAGS(r7, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000600)={0x28, r8, 0x1, 0x70bd2c, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000004}, 0x48000) r9 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r9, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) (async) ioctl$KVM_RUN(r9, 0xae80, 0x0) 1.280327018s ago: executing program 1 (id=2374): sendmsg$SMC_PNETID_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x9) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x11, &(0x7f00000002c0)={&(0x7f0000000100)=@newlink={0x68, 0x10, 0x437, 0x3, 0x3, {0x0, 0x0, 0x0, r0, 0x51b0b}, [@IFLA_LINKINFO={0x48, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x38, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r0}, @IFLA_GRE_LOCAL={0x14, 0x6, @remote}, @IFLA_GRE_REMOTE={0x14, 0x7, @private1}, @IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x68}, 0x1, 0x0, 0x0, 0x48800}, 0x4008010) 1.239252149s ago: executing program 0 (id=2375): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, 0x0, 0x0) sendmsg$inet6(r0, &(0x7f00000000c0)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x5}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000002c0)="13", 0x1}], 0x1}, 0x48043) r2 = dup(r0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='ip6gretap0\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000400)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x8003, 0xbffc, 0xe652, 0x2, 0x4, 0x48, 0xff}, 0x9c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0xce20, 0x6, @empty, 0x2d}}, 0x7, 0x1, 0xf06, 0x3, 0xb4, 0x7f, 0x9}, 0x9c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e60, 0xeffffff2, @empty, 0x5}}, 0xfffffffb, 0x6, 0xffff1896, 0x3, 0x26, 0xffffffa9, 0x4c}, 0x9c) 1.226028389s ago: executing program 2 (id=2376): r0 = socket$kcm(0x10, 0x400000002, 0x0) sendmsg$inet(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)="1b0000001a007f029e", 0x9}], 0x1}, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c) uname(0x0) sendto$inet6(r1, &(0x7f0000000000)="ed", 0x1, 0x20004000, &(0x7f0000000040)={0xa, 0x6e63, 0x0, @private2, 0x5}, 0x1c) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x4e22, @loopback}, 0x10) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1, 0x5, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x9, 0x0, 0x0, 0x0, 0x3}, 0x94) r4 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000e2793b10d10501200006010203010902120008000000"], 0x0) syz_usb_control_io$uac1(r4, 0x0, 0x0) r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYRES64=r4, @ANYRES64, @ANYRESOCT=r3, @ANYRES64=r4, @ANYRES32], 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io$hid(r5, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="0222217607000000930000000f2b09007a150b5d8c000000b12abd62bbd46559000000000000e3745a02efbfc0df2f9c7d64b645a48c57050dd8909b2c0689f4fadaebfdc6c824b21c78e7267f84f52c0b3539f384f1084f57fbf31e8dcb7e55c7574137ab69900bf01fe4a94b73a1fce1b7a6a4a9863dc0da156fa5cde5e516bc1774fe8c90a40db40d134352b9e93291208912f47b171ef7c52a59d54e8e8fe90f8dfbfa7d1af82193b08ba85dadd94d5e5009c714276bd9663ff2ec029d22933235167f4399ce6cc21d75f9f2d25e2f72c97f6074743d"], 0x0}, 0x0) syz_usb_control_io$hid(r5, &(0x7f00000003c0)={0x24, &(0x7f0000000000)={0x20, 0x30, 0x1e, {0x1e, 0x21, "ff3876dbe24a47c53cb32690edfafe5d20915e8f8733314210f90278"}}, &(0x7f00000002c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x61c43bd071c67828}}, &(0x7f0000000280)={0x0, 0x22, 0x17, {[@global=@item_4={0x3, 0x1, 0x4, "e83e83a4"}, @global=@item_4={0x3, 0x1, 0x9, "d132af43"}, @global=@item_4={0x3, 0x1, 0x6, "cc2e879d"}, @global=@item_012={0x1, 0x1, 0x2, "fc"}, @local=@item_012={0x2, 0x2, 0x3, "ed7c"}, @global=@item_012={0x1, 0x1, 0x4, "d9"}, @local=@item_012={0x0, 0x2, 0x5}]}}, &(0x7f0000000380)={0x0, 0x21, 0x9, {0x9, 0x21, 0x207, 0x2, 0x1, {0x22, 0x15c}}}}, &(0x7f0000000680)={0x2c, &(0x7f0000000400)={0x0, 0x19, 0x81, "5e19c338fa789b7c96aa62fcbd85437f62d54d47e30c94bce63cc4efde44a6ae3f4dd725138685d84ee1b329e5ea55ca76bd751dd2bc8fee4585123e674df5a5424cf2aae853cc8440960d87b7777bb0b78758db3cb40a83a4f8d9542bb88628f825e3b70f8ab677239ea5c0f8d7e8ce8364d37b9910921c12fc4e054e984eeb14"}, &(0x7f00000004c0)={0x0, 0xa, 0x1, 0x7}, &(0x7f0000000540)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000000580)=ANY=[@ANYBLOB="20017e0000008da7be7ba59d69d1248f1feadeecf957b05a42abcd548a5b12e525c196e1e659b5d8c93768391bf3d357b28eeca57dcd55208bd7b1c6061ac646bd20ff7a8f022e028fbf3edf74fdc6d9749b4f68a416619ba1c1e8e587d0c2c5b815275254857a94f065adf195919531f260d1d9104b5783433100"/132], 0x0}) r6 = socket$rxrpc(0x21, 0x2, 0x2) r7 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000a00), 0x800, 0x0) readv(r7, &(0x7f0000003200)=[{&(0x7f0000000d00)=""/4096, 0x1000}], 0x1) bind$rxrpc(r6, &(0x7f0000000040)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x24) sendmsg(r6, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[], 0x18}, 0x80) recvfrom$inet(r2, &(0x7f0000000180)=""/144, 0x90, 0x0, 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000500)="000000020104", 0x6) socket$nl_route(0x10, 0x3, 0x0) socket$inet6(0xa, 0xa, 0x7accdc06) read(0xffffffffffffffff, &(0x7f0000000310), 0x6) r8 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.net/blkio.throttle.write_iops_device\x00', 0x1, 0x0) write(r8, &(0x7f0000000480)='252:0 1', 0x7) 1.076372288s ago: executing program 0 (id=2377): r0 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x2, 0x5, @loopback={0x1000000}, 0x7}, 0x17) 1.057393799s ago: executing program 1 (id=2378): r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603) ioctl$I2C_SMBUS(r0, 0x720, &(0x7f0000000100)={0x1, 0x5, 0x6, &(0x7f0000000080)={0x2, "1a9c66bf2f615e4200000000e200"}}) 961.149922ms ago: executing program 1 (id=2379): r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f00000006c0)={0x14, 0x0, &(0x7f0000000680)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603) r2 = memfd_create(&(0x7f00000013c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf#2\x99\x1e\xa1`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\f<\x8f\xc1\x99\x89r\xe1?\xbdu\x98\xc3\xf8\xd2Q#\xc6g\xa0\x85\xd6G\x85\x11X\x8d,\x02\xd45\xb8\xca\x97\x9d\xcb\x1e\x80\xd6\xd5>N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9b5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec\x8aog\x87BR\x9d\xad\xd4FcB\xda\x95\xc3\xdd\x9d\x8f\x1a\xce\x18\x80\"j\xe1\xba\x1e\x97uX\xccv\xd6\vcz\x92A^\xbc\xceF\\\xb0:\xaf\xc5~\xbcJ e\r\x88c\x9d\xb92\xb6i4zq\xb3c\x0f\xb2t\x93\xf2E6b\xfa\xcdJ5\xe3W]`4\xd8D\x05\v\xfc)\xca\xedQ\xd0]Ot\'\xc2tDF\xf9\xa7\xb5(\x83\xa5\x0f\x1d\x1d\x06Dg\x13>\x19\xe85#\aaT\x89=\x104\xd5\x85l\x96\x91\xea\x172P\xb3:\xadZ\xbc\xbe\x00\xf0\x14\x96\xd9M\xd7y`~7\x16\x02\x00(v\xe6`\"6\xfcgC\xb5\xf0\x13.zj\xc5bj+@\x00\x00\x00\x00\x00\x00\x00.\xd4`=z\xd1n\x8d\x8f\xa5hS\x8e[\xb3\xa3\x87\xb9\xe2_Z\x11\xef\xc2]V\xf3\x03\x94\xb9\xe1\xa68\x8d\\\xe5\xef\xacpM\xf0\xa6\x04\x10\xb7\xc0t\x83\\\xf7\x12k\x9f\x10\xd5Z\x19\xc1\xc1\x80\\o\x97\xce=U\xdd\xaa\x1b\x05\x14\x13\xa6\xbd#\xde\x04\xe6$\xec$3\xf6\x97\xc6\xeaSL\xb7A72M\x88k@\xe5\xa3\n&\x1exQ-2p\xd62\'\xec\x0f\x13;I\x95fE_\r\xe7\t!A\x05\xe4\x8f\x9e0\xf8/T\x18\xf7\xa1\x9f\xde1\xd5\x80<\xf5\b\xa9\xec\x85\xaeW\xb3\xd8#)bn \xfb\xf2\x88\xfaR\xff\xdd\x80\x96_\xec5\xf0\x1c\a\x8a\x80\x00@=\r8u+\xa0\x1c\x14\x01\x82\xfap\xf6\x89\xea\xba\xe3\xbbM%F\xdb\\\xd1eJJ*\xc67\xca\x03\xa3\xf7(\xbb\xecN\xd4\xe7\xf2:u\x8a\b\xd5\v\xca\xfd\\\xd6\xe3\x05\xb3\x03\xd5\xe0\xd2\xf2{\'\x8b\xdf\xa1.E\b1\xcb\xa2\xbe}\xb2\xe4y\xbb\xe6\x1f\x10\x95y\x8e\xa6\x82\x04\x01C\x83,\x90\x1a\xfa\x8e\x17\x89\xe2\xedX\x8d\rmq\t\xb5$\xb4\x9b\x92z\xd6/-\x13,\xb5%\x8eM/\x04\xa7\x7f\x1b\x85\xf1\xa4X\x17\xbb\x1cR14\xfb!\b\x10\xe8\xb2\xd41gK\xe4\xea\xe39d\bL\xe5\x1b\xbd[\x9bWD:\r&\xe9\vn^\xcc\x86\xe3\xce1>3{\xaa{\xbd0P\x9f\xa68\xf5\x82\xb8\x9aD\x9c{\xe6\xf8\xcbD\xb5aJ\xb0\x92\x89\xbc\x82\x1ch\x89\xe7\xdd]q,\xec\xc4\xa5\x93\xe5,\x0e,>/\xaf|\xf0\x01V\x7f\xc9?\xba\x16\xe4$+}5dy\xb1\xef\xf1m\xa5\x94d9\xaf\xcfq\x8b=\x026\xef\r\x91\x18\xc5\xb6\xb9fM\x8ayZ\xbcd\xa5\x8a\x88\x98\xc3\xfc`\xa6\xba\x1f\x17\v$\x88g\xb4\xad\b\xc1\xddW\xa6\xc1\xb7\xb0\xa3\x84Q\x13GoU\xe2\xb7\x03\x9c\xd5\x0f\xa8\x0ef\"\x15\x82\xe7\xbd\xf8\xca\x10f\xfe6h\xe9\xc3\xc2\xa0O:\xac~\x1a\xf7\xbeF\xbe\xe5\xf0\x81\xd6&\xc00x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xffde}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000d00)=@newtfilter={0x24c, 0x2c, 0xd27, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0xe, 0x5}, {}, {0x7, 0xb}}, [@filter_kind_options=@f_flower={{0xb}, {0x21c, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS_MASK={0x100, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x24, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x4}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0xdd13}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x8}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x1af}]}, @TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0x1c, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5, 0x2, 0xd}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5, 0x2, 0x2}]}, @TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x44, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x2}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x2}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0xa}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x400}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x800}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x9}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0xffff}]}, @TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0xc, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS={0x6, 0x1, 0xcc}]}, @TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x4}, @TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x2c, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_DIR={0x5, 0x3, 0xf}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0xa44a}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_HWID={0x5, 0x4, 0x5}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}]}, @TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x3c, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x2}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x4}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x2}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x2}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0xe147}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x9}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x8}]}]}, @TCA_FLOWER_KEY_ENC_OPTS={0x4c, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0xc, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x5}]}, @TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x3c, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x30000}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x7}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0xe}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x7b}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x6}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x4}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x6}]}]}, @TCA_FLOWER_KEY_ICMPV6_TYPE_MASK={0x5}, @TCA_FLOWER_KEY_ENC_OPTS_MASK={0xac, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x4}, @TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x2c, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x4000086}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x6}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x6}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x8}]}, @TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0x34, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0x8c}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0x3}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0x9b}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5, 0x2, 0x3}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS={0x6, 0x1, 0x9}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0xe7}]}, @TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0xc, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x3}]}, @TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x1c, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0xd40}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0xfc64}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x5}]}, @TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x1c, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x7fff}]}]}, @TCA_FLOWER_KEY_ENC_IPV4_SRC_MASK={0x8, 0x1c, 0xffffffff}, @TCA_FLOWER_KEY_TCP_SRC={0x6}, @TCA_FLOWER_KEY_MPLS_TC={0x5, 0x45, 0x80}]}}]}, 0x24c}, 0x1, 0x0, 0x0, 0x80}, 0x0) 806.823287ms ago: executing program 3 (id=2381): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x14, 0x14, 0x3, [@enum={0x0, 0x1, 0x0, 0x6, 0x4, [{0x2}]}]}, {0x0, [0x0]}}, 0x0, 0x2f, 0x0, 0xb}, 0x20) r0 = accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000000180)) sendto$packet(r0, 0x0, 0x0, 0x22008080, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000100)=0x8) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f0000000200)='blkio.throttle.io_serviced_recursive\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r3, 0x40305829, &(0x7f00000000c0)={0x604, 0x20, 0x3, 0xffffffff}) 733.762791ms ago: executing program 3 (id=2382): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000700)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff3}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x20040084) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000900)={0x0, 0x700, &(0x7f0000000140)={&(0x7f00000000c0)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r6, {0xf000, 0xffff}, {}, {0x7}}, [@filter_kind_options=@f_route={{0xa}, {0xc, 0x2, [@TCA_ROUTE4_CLASSID={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) 715.469657ms ago: executing program 0 (id=2383): bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0700000004000000000900000100000028"], 0x50) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000280), 0x80a00, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x1, "0600000000000000c64c3b6e6ff82a75e5318fca4288c2ffbdbec772020acd2c"}) r1 = syz_ublk_setup_io_uring(0xd, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x154}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000300)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0xe, &(0x7f00000004c0)=@any_dev={0x7, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff}}}, &(0x7f0000000480)=0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r6 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r6, 0x5393, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x138, 0x10, 0x1, 0x70bd27, 0x102, {{@in6=@local, @in6=@mcast1, 0x1, 0x4, 0x4e23, 0x0, 0x0, 0x0, 0x0, 0x3a, 0x0, 0xee00}, {@in=@loopback, 0x4d4, 0x6c}, @in=@loopback, {0x0, 0x9, 0x6, 0xffff, 0x8251a, 0x2, 0x83}, {0xfffffffffffffffc, 0x7fff, 0x1f, 0x1ff}, {0x2, 0xfffffffc}, 0x70bd25, 0x0, 0x2, 0x1, 0xfd, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0xc801}, 0x10) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000002340)=ANY=[@ANYBLOB="28000000110001002bbd700000dbdf257f0000010000f8bea551c371000000000000000000000004"], 0x28}}, 0x0) r9 = socket$alg(0x26, 0x5, 0x0) shutdown(0xffffffffffffffff, 0x1) bind$alg(r9, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="200000006800e97800000000000000000a0000000000000008000500", @ANYRES16], 0x20}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000004380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="240000001800090400000000000000000a000000000000030000000008001e0001"], 0x24}}, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@ipv4_newroute={0x24, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}}, 0x24}}, 0x0) sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="48cb0000100001004670689c3ca9e070b8c3ba00", @ANYRES32=0x0, @ANYBLOB="200400000000000008001b0000000000"], 0x28}}, 0x0) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PAUSE_SET(r12, &(0x7f00000013c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000200)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r13, @ANYBLOB="01042ebd7000fadbdf251600000018000180140002006e657464657673696d3000000000000500020001000000"], 0x34}}, 0x14008080) socket$inet6_tcp(0xa, 0x1, 0x0) syz_ublk_setup_queues(0xffffffffffffffff, r5, &(0x7f0000000180)={0x0, 0x20fb87, 0x800, 0x1, 0x32c}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x1006, 0x15a, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7d, 0x8000, 0x10000000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88de, 0x8, 0x3, 0xffffffff}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0xbd}}], 0x1, &(0x7f0000000340)={0x2e, 0x54, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x826, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a80)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) 466.741764ms ago: executing program 0 (id=2384): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000780)=ANY=[@ANYBLOB="12010000cf8bed20d90f25004029000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603) ioctl$I2C_RDWR(r1, 0x707, &(0x7f00000000c0)={&(0x7f0000000300)=[{0xd0, 0x8801, 0x0, 0x0}], 0x1}) 370.39828ms ago: executing program 3 (id=2385): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, 0x0, 0x0) r3 = syz_open_dev$video(&(0x7f0000000040), 0x8, 0x101840) ioctl$VIDIOC_S_SELECTION(r3, 0xc040565f, &(0x7f0000000080)={0xa, 0x0, 0x1, {0xe7ff, 0x1, 0x406, 0x870}}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r4, 0x3ba0, &(0x7f0000000380)={0x48, 0x2, r5}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r8, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtfilter={0x2c, 0x2c, 0xd24, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, r8, {0x2, 0xa}, {0x0, 0x9}, {0xd, 0x5}}, [@TCA_CHAIN={0x8, 0xb, 0x9}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004041}, 0x64048014) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f0000000000)={0x28, 0x7, r5, 0x0, &(0x7f0000c00000/0x400000)=nil, 0x400000, 0x1004000}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) socket$nl_route(0x10, 0x3, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) syz_usb_connect$uac1(0x4, 0x9e, &(0x7f00000004c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x499, 0x1051, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x8c, 0x3, 0x1, 0x2, 0x90, 0x5, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x8000, 0x16}, [@input_terminal={0xc, 0x24, 0x2, 0x2, 0x100, 0x4, 0x2, 0xa, 0x6, 0x5}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x3ff, 0xf2, 0x3, 0x1a, {0x7, 0x25, 0x1, 0x4, 0xd0, 0xfff}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0xb, 0x24, 0x2, 0x1, 0x9, 0x3, 0x4, 0x9, "a4966f"}, @format_type_ii_discrete={0xe, 0x24, 0x2, 0x2, 0x400, 0x0, 0x0, "240b4afd32"}, @as_header={0x7, 0x24, 0x1, 0x9, 0xff}]}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x2, 0x4, 0x4, {0x7, 0x25, 0x1, 0x8, 0xc2, 0x964}}}}}}}}]}}, &(0x7f0000000a80)={0xa, &(0x7f0000000580)={0xa, 0x6, 0x250, 0x5, 0x8, 0x4d, 0x8, 0x4d}, 0x13, &(0x7f00000005c0)={0x5, 0xf, 0x13, 0x2, [@ptm_cap={0x3}, @wireless={0xb, 0x10, 0x1, 0x4, 0x80, 0xfd, 0x0, 0xc3, 0x7}]}, 0x6, [{0xf9, &(0x7f0000000600)=@string={0xf9, 0x3, "f208570d1c0397001632f26879bead9a6704a1c9ccb4bccbcf192aa2d9af55b96916ae19af33690a55c96fa9c2fa632dd36462a3989a05f4007d28f2824652a2b0fae1055a3192286a220c9723817314f44d5f6a800b305a730298f32115bcb89f0c9a091f00136a415b2efc36b1639dbbe40bb93645571e7e7248bb7e46b520ad21ab261686b76bcefff5c383f13b5d9e83d9fb9bb61fe582c59684458533165015ff31c0f0e8a1ea4f0e8d8b8cd47b25d03e673771e9c287184e03619a89a8403c1565613e9506248f7af2fe6daf7ecd379f2320773289284f2d068404b6ce6033a807142053ed4dfc8ef08962f358d3ed854260a64e"}}, {0x66, &(0x7f0000000700)=@string={0x66, 0x3, "2a7f1e611ddf9bfd32ea5ea2cb9f41ee91d3bef5de64fe55ad9bb89153a2434b008a9fd2c7c80c9582d3c20d9017c3af3169767f1d15ed72d7c14a4267bc02735da700e9bf6a05e44f31adeadf211d4da0894c7b8d7223719f989f344959ed41438f62eb"}}, {0xd2, &(0x7f0000000780)=@string={0xd2, 0x3, "fc54b1a2fbc683112350fadd18d8fcb30be83e47b1b158e17dad0300bbfbea1653ab29d50524e8ccd21c325530ce34ae1eaa5a078c4bef70c496711bca134bbd876bfd307153add04ead2b8785668a229d8b1ea2c0bc768d18a6e520bb3fbb5b5165babf5ac73bd8005a1e65036e2d0b854adf035764538312cd9f07ae66671930a789410ffe530ba7d55cdb9f0d35db68c70fbd189d5c984ce20ed79656ecdcb1df78000b9fa2ca8fe862401da2aa159ffed4f072a33ce0a90788add9ec2121afcac3b9945c749a790bc03fd4096339"}}, {0xe0, &(0x7f0000000880)=@string={0xe0, 0x3, "1b9bfb7c3f049f85184ca1d7d5f0464ccc81188c1c49e5c8684f6fd916faed2903dff3288b3f83e57f3f753699b5663cc266fff129c9ef36c2afc808c824cacc9d9f3367dcb9118c31882f1d153e07b65a745245aa8168625e93851b48aca6fef7a62e1e75cd2d373529664046157d13236e71e4d88bbe7a359357eee2deffc96475c38d074d37218e858b3507cd7ad0bcf328f1b561c92c747500b370e32d071645828e200740112a84b4c3f118dff91ae845bf706b23e0aa011e3815294ed79343d93ebe2571dbd1cd26c309b25fcba529e86cc808de16fd8e5ec67467"}}, {0x12, &(0x7f0000000980)=@string={0x12, 0x3, "5338289f558304e9aaa622646b65a2aa"}}, {0x4, &(0x7f00000009c0)=@lang_id={0x4, 0x3, 0x443}}]}) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0xcc, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000008, &(0x7f00000001c0)={0xa, 0x4e20, 0x8, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4}, 0xffffffffffffff18) openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x4c00, 0x0) socket$netlink(0x10, 0x3, 0xf) 364.287856ms ago: executing program 4 (id=2386): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000380)={0x0, 0x1, 0x101, 0x1}) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000040)=0x4) syz_emit_ethernet(0x22, &(0x7f00000001c0)=ANY=[@ANYBLOB="ff"], 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x7, 0x8, 0xc5, 0x0, 0x6, 0x0, 0x0, 0x6, 0x1, 0xf8, 0x3, 0x1, 0x0, 0x7, 0x6, 0x6, 0x9, 0x4, 0xfe, '\x00', 0x4, 0x4}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 240.536998ms ago: executing program 4 (id=2387): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, 0x0, 0x0) sendmsg$inet6(r0, &(0x7f00000000c0)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x5}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000002c0)="13", 0x1}], 0x1}, 0x48043) r2 = dup(r0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='ip6gretap0\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000400)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x8003, 0xbffc, 0xe652, 0x2, 0x4, 0x48, 0xff}, 0x9c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0xce20, 0x6, @empty, 0x2d}}, 0x7, 0x1, 0xf06, 0x3, 0xb4, 0x7f, 0x9}, 0x9c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e60, 0xeffffff2, @empty, 0x5}}, 0xfffffffb, 0x6, 0xffff1896, 0x3, 0x26, 0xffffffa9, 0x4c}, 0x9c) 68.25387ms ago: executing program 4 (id=2388): sendmsg$SMC_PNETID_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x9) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x11, &(0x7f00000002c0)={&(0x7f0000000100)=@newlink={0x68, 0x10, 0x437, 0x3, 0x3, {0x0, 0x0, 0x0, r0, 0x51b0b}, [@IFLA_LINKINFO={0x48, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x38, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r0}, @IFLA_GRE_LOCAL={0x14, 0x6, @remote}, @IFLA_GRE_REMOTE={0x14, 0x7, @private1}, @IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x68}, 0x1, 0x0, 0x0, 0x48800}, 0x4008010) 0s ago: executing program 4 (id=2389): r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603) ioctl$I2C_SMBUS(r0, 0x720, &(0x7f0000000100)={0x1, 0x5, 0x6, &(0x7f0000000080)={0x2, "1a9c66bf2f615e4200000000e200"}}) kernel console output (not intermixed with test programs): ULT_INJECTION: forcing a failure. [ 438.316264][T11995] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 438.316307][T11995] CPU: 1 UID: 0 PID: 11995 Comm: syz.1.2021 Tainted: G L syzkaller #0 PREEMPT(full) [ 438.316336][T11995] Tainted: [L]=SOFTLOCKUP [ 438.316343][T11995] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 438.316354][T11995] Call Trace: [ 438.316362][T11995] [ 438.316371][T11995] dump_stack_lvl+0xe8/0x150 [ 438.316403][T11995] should_fail_ex+0x410/0x560 [ 438.316433][T11995] _copy_to_user+0x31/0xb0 [ 438.316462][T11995] simple_read_from_buffer+0xe1/0x170 [ 438.316495][T11995] proc_fail_nth_read+0x1bb/0x230 [ 438.316515][T11995] ? common_file_perm+0x20e/0x2b0 [ 438.316543][T11995] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 438.316564][T11995] ? rw_verify_area+0x24a/0x4c0 [ 438.316581][T11995] ? tun_chr_write_iter+0x18a/0x200 [ 438.316605][T11995] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 438.316624][T11995] vfs_read+0x213/0xa80 [ 438.316649][T11995] ? __pfx___mutex_lock+0x10/0x10 [ 438.316678][T11995] ? __pfx_vfs_read+0x10/0x10 [ 438.316698][T11995] ? __fget_files+0x2a/0x420 [ 438.316729][T11995] ? __fget_files+0x3a2/0x420 [ 438.316754][T11995] ? __fget_files+0x2a/0x420 [ 438.316790][T11995] ksys_read+0x150/0x270 [ 438.316809][T11995] ? __pfx_ksys_read+0x10/0x10 [ 438.316839][T11995] do_syscall_64+0x166/0x520 [ 438.316865][T11995] ? trace_irq_disable+0x3b/0x140 [ 438.316886][T11995] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 438.316905][T11995] ? clear_bhb_loop+0x70/0xc0 [ 438.316929][T11995] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 438.316947][T11995] RIP: 0033:0x7f6b33b5e9ce [ 438.316965][T11995] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 438.316981][T11995] RSP: 002b:00007f6b34ad3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 438.317002][T11995] RAX: ffffffffffffffda RBX: 00007f6b34ad46c0 RCX: 00007f6b33b5e9ce [ 438.317016][T11995] RDX: 000000000000000f RSI: 00007f6b34ad40a0 RDI: 0000000000000004 [ 438.317028][T11995] RBP: 00007f6b34ad4090 R08: 0000000000000000 R09: 0000000000000000 [ 438.317040][T11995] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 438.317051][T11995] R13: 00007f6b33e26038 R14: 00007f6b33e25fa0 R15: 00007f6b33f4fa48 [ 438.317083][T11995] [ 438.541105][T11998] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 438.548959][T11998] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 438.586743][ T5697] hid_parser_main: 231 callbacks suppressed [ 438.586771][ T5697] cp2112 0003:10C4:EA90.003D: unknown main item tag 0x0 [ 438.586802][ T5697] cp2112 0003:10C4:EA90.003D: unknown main item tag 0x0 [ 438.586829][ T5697] cp2112 0003:10C4:EA90.003D: unknown main item tag 0x0 [ 438.586855][ T5697] cp2112 0003:10C4:EA90.003D: unknown main item tag 0x0 [ 438.586880][ T5697] cp2112 0003:10C4:EA90.003D: unknown main item tag 0x0 [ 438.586904][ T5697] cp2112 0003:10C4:EA90.003D: unknown main item tag 0x0 [ 438.586930][ T5697] cp2112 0003:10C4:EA90.003D: unknown main item tag 0x0 [ 438.609679][ T5697] cp2112 0003:10C4:EA90.003D: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.3-1/input0 [ 438.679975][ T5697] cp2112 0003:10C4:EA90.003D: Part Number: 0x00 Device Version: 0x00 [ 438.950927][T12003] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2024'. [ 439.347374][T12008] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 439.376362][T12008] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 439.505253][T11980] cp2112 0003:10C4:EA90.003D: Error starting transaction: -38 [ 439.598612][ T1227] usb 2-1: new high-speed USB device number 125 using dummy_hcd [ 439.678623][ T5697] usb 3-1: new high-speed USB device number 120 using dummy_hcd [ 439.740885][ T1227] usb 2-1: device descriptor read/64, error -71 [ 439.838615][ T5697] usb 3-1: Using ep0 maxpacket: 32 [ 439.868545][ T25] usb 4-1: reset high-speed USB device number 123 using dummy_hcd [ 439.978603][ T1227] usb 2-1: new high-speed USB device number 126 using dummy_hcd [ 440.087829][ T10] usb 5-1: unable to get BOS descriptor or descriptor too short [ 440.087880][ T10] usb 5-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=f8.13 [ 440.090151][ T10] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 440.090186][ T10] usb 5-1: can't read configurations, error -71 [ 440.124936][ T1227] usb 2-1: device descriptor read/64, error -71 [ 440.125754][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.125804][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.228962][ T1227] usb usb2-port1: attempt power cycle [ 440.425215][ T5697] usb 3-1: unable to get BOS descriptor or descriptor too short [ 440.425264][ T5697] usb 3-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=f8.13 [ 440.426120][ T5697] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 440.426153][ T5697] usb 3-1: can't read configurations, error -71 [ 440.471998][ T6590] usb 1-1: USB disconnect, device number 93 [ 440.578811][ T1227] usb 2-1: new high-speed USB device number 127 using dummy_hcd [ 440.601094][ T1227] usb 2-1: device descriptor read/8, error -71 [ 440.650596][ T30] usb 4-1: USB disconnect, device number 123 [ 440.848790][ T1227] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 440.886216][ T1227] usb 2-1: device descriptor read/8, error -71 [ 440.929196][ T6590] usb 1-1: new high-speed USB device number 94 using dummy_hcd [ 440.992539][ T1227] usb usb2-port1: unable to enumerate USB device [ 441.079644][ T6590] usb 1-1: Using ep0 maxpacket: 16 [ 441.080328][ T6590] usb 1-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 441.082653][ T6590] usb 1-1: config 0 interface 0 altsetting 64 endpoint 0x81 has invalid wMaxPacketSize 0 [ 441.082679][ T6590] usb 1-1: config 0 interface 0 has no altsetting 0 [ 441.082698][ T6590] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 441.086899][ T6590] usb 1-1: config 0 descriptor?? [ 441.144262][ T6590] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 441.211321][T12039] FAULT_INJECTION: forcing a failure. [ 441.211321][T12039] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 441.211350][T12039] CPU: 0 UID: 0 PID: 12039 Comm: syz.4.2039 Tainted: G L syzkaller #0 PREEMPT(full) [ 441.211364][T12039] Tainted: [L]=SOFTLOCKUP [ 441.211368][T12039] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 441.211375][T12039] Call Trace: [ 441.211380][T12039] [ 441.211385][T12039] dump_stack_lvl+0xe8/0x150 [ 441.211405][T12039] should_fail_ex+0x410/0x560 [ 441.211421][T12039] _copy_from_user+0x2d/0xb0 [ 441.211437][T12039] kvm_arch_vm_ioctl+0x3e1/0x1a10 [ 441.211485][T12039] ? __pfx_kvm_arch_vm_ioctl+0x10/0x10 [ 441.211497][T12039] ? __lock_acquire+0x747/0x2de0 [ 441.211514][T12039] ? __lock_acquire+0x747/0x2de0 [ 441.211535][T12039] ? lock_acquire+0x115/0x350 [ 441.211549][T12039] ? lock_acquire+0x115/0x350 [ 441.211566][T12039] ? is_bpf_text_address+0x292/0x2b0 [ 441.211580][T12039] ? is_bpf_text_address+0x26/0x2b0 [ 441.211593][T12039] ? kernel_text_address+0xa5/0xe0 [ 441.211614][T12039] ? __kernel_text_address+0xd/0x30 [ 441.211625][T12039] ? unwind_get_return_address+0x4d/0x90 [ 441.211644][T12039] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 441.211656][T12039] ? arch_stack_walk+0xfb/0x150 [ 441.211673][T12039] ? stack_trace_save+0xa9/0x100 [ 441.211683][T12039] ? __pfx_stack_trace_save+0x10/0x10 [ 441.211693][T12039] ? kasan_save_track+0x4f/0x80 [ 441.211707][T12039] ? stack_depot_save_flags+0x33/0x7f0 [ 441.211722][T12039] ? __lock_acquire+0x747/0x2de0 [ 441.211734][T12039] ? kasan_save_track+0x4f/0x80 [ 441.211744][T12039] ? kasan_save_track+0x3e/0x80 [ 441.211755][T12039] ? kasan_save_free_info+0x40/0x50 [ 441.211764][T12039] ? __kasan_slab_free+0x5c/0x80 [ 441.211775][T12039] ? kfree+0x1c5/0x650 [ 441.211784][T12039] ? tomoyo_path_number_perm+0x4ba/0x5f0 [ 441.211796][T12039] ? security_file_ioctl+0xc3/0x2a0 [ 441.211807][T12039] ? __se_sys_ioctl+0x47/0x170 [ 441.211819][T12039] ? do_syscall_64+0x166/0x520 [ 441.211838][T12039] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 441.211856][T12039] kvm_vm_ioctl+0x8f7/0xd30 [ 441.211871][T12039] ? __pfx_kvm_vm_ioctl+0x10/0x10 [ 441.211894][T12039] ? kasan_quarantine_put+0xbb/0x1f0 [ 441.211910][T12039] ? tomoyo_path_number_perm+0x219/0x5f0 [ 441.211923][T12039] ? tomoyo_path_number_perm+0x219/0x5f0 [ 441.211936][T12039] ? do_vfs_ioctl+0x116f/0x1530 [ 441.211949][T12039] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 441.211966][T12039] ? hook_file_ioctl+0x1f2/0x600 [ 441.211989][T12039] ? __fget_files+0x2a/0x420 [ 441.212004][T12039] ? __fget_files+0x2a/0x420 [ 441.212017][T12039] ? __fget_files+0x3a2/0x420 [ 441.212030][T12039] ? __fget_files+0x2a/0x420 [ 441.212045][T12039] ? bpf_lsm_file_ioctl+0x9/0x20 [ 441.212061][T12039] ? __pfx_kvm_vm_ioctl+0x10/0x10 [ 441.212074][T12039] __se_sys_ioctl+0xfc/0x170 [ 441.212087][T12039] do_syscall_64+0x166/0x520 [ 441.212100][T12039] ? trace_irq_disable+0x3b/0x140 [ 441.212111][T12039] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 441.212121][T12039] ? clear_bhb_loop+0x70/0xc0 [ 441.212134][T12039] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 441.212144][T12039] RIP: 0033:0x7fea6499e199 [ 441.212155][T12039] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 441.212164][T12039] RSP: 002b:00007fea62bf6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 441.212175][T12039] RAX: ffffffffffffffda RBX: 00007fea64c25fa0 RCX: 00007fea6499e199 [ 441.212182][T12039] RDX: 0000200000000140 RSI: 000000004048aec9 RDI: 0000000000000004 [ 441.212189][T12039] RBP: 00007fea62bf6090 R08: 0000000000000000 R09: 0000000000000000 [ 441.212196][T12039] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 441.212202][T12039] R13: 00007fea64c26038 R14: 00007fea64c25fa0 R15: 00007fea64d4fa48 [ 441.212218][T12039] [ 441.259409][ T5697] usb 3-1: new high-speed USB device number 121 using dummy_hcd [ 441.489246][ T5697] usb 3-1: device descriptor read/64, error -71 [ 441.618190][ T5697] usb usb3-port1: attempt power cycle [ 441.706028][T12047] [U] M٭Q& K4 [ 441.706454][T12047] [U] [)U}ǔJϬ}NSEF* NZF[F_H'W"X~;VA)^`1C':ZFOB *?۟CZS<8ZNѷјEY TT<$CRƖ/VG {Y~Y5\;ƃZDXYA"XIF{`A$í55?SAMOͻ*K [ 441.706471][T12047] [U] O4 [ 441.706697][T12047] [U] UB+ '~GIރRQ^,(-|ڟ-<6&H.Z9/RJΩˈ+)֭KΦ.NHA#LW#RF7P٪MAX]LN"KM +,GSBHJX̧CQ [ 441.928793][ T5695] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 442.029511][ T5697] usb 3-1: new high-speed USB device number 122 using dummy_hcd [ 442.059210][ T5697] usb 3-1: device descriptor read/8, error -71 [ 442.079333][ T5695] usb 5-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 442.080321][ T5695] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 442.080348][ T5695] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 442.080377][ T5695] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 442.082861][ T5695] usb 5-1: config 0 descriptor?? [ 442.250513][ T30] usb 4-1: new high-speed USB device number 124 using dummy_hcd [ 442.299205][ T5697] usb 3-1: new high-speed USB device number 123 using dummy_hcd [ 442.319808][ T5697] usb 3-1: device descriptor read/8, error -71 [ 442.386166][T12068] FAULT_INJECTION: forcing a failure. [ 442.386166][T12068] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 442.386192][T12068] CPU: 1 UID: 0 PID: 12068 Comm: syz.1.2051 Tainted: G L syzkaller #0 PREEMPT(full) [ 442.386213][T12068] Tainted: [L]=SOFTLOCKUP [ 442.386220][T12068] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 442.386231][T12068] Call Trace: [ 442.386239][T12068] [ 442.386247][T12068] dump_stack_lvl+0xe8/0x150 [ 442.386280][T12068] should_fail_ex+0x410/0x560 [ 442.386302][T12068] _copy_to_user+0x31/0xb0 [ 442.386318][T12068] simple_read_from_buffer+0xe1/0x170 [ 442.386337][T12068] proc_fail_nth_read+0x1bb/0x230 [ 442.386348][T12068] ? common_file_perm+0x20e/0x2b0 [ 442.386382][T12068] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 442.386406][T12068] ? rw_verify_area+0x24a/0x4c0 [ 442.386424][T12068] ? tun_chr_write_iter+0x18a/0x200 [ 442.386447][T12068] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 442.386458][T12068] vfs_read+0x213/0xa80 [ 442.386470][T12068] ? __pfx___mutex_lock+0x10/0x10 [ 442.386486][T12068] ? __pfx_vfs_read+0x10/0x10 [ 442.386497][T12068] ? __fget_files+0x2a/0x420 [ 442.386523][T12068] ? __fget_files+0x3a2/0x420 [ 442.386548][T12068] ? __fget_files+0x2a/0x420 [ 442.386583][T12068] ksys_read+0x150/0x270 [ 442.386600][T12068] ? __pfx_ksys_read+0x10/0x10 [ 442.386616][T12068] do_syscall_64+0x166/0x520 [ 442.386629][T12068] ? trace_irq_disable+0x3b/0x140 [ 442.386640][T12068] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 442.386651][T12068] ? clear_bhb_loop+0x70/0xc0 [ 442.386671][T12068] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 442.386690][T12068] RIP: 0033:0x7f6b33b5e9ce [ 442.386707][T12068] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 442.386722][T12068] RSP: 002b:00007f6b34ad3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 442.386742][T12068] RAX: ffffffffffffffda RBX: 00007f6b34ad46c0 RCX: 00007f6b33b5e9ce [ 442.386749][T12068] RDX: 000000000000000f RSI: 00007f6b34ad40a0 RDI: 0000000000000004 [ 442.386755][T12068] RBP: 00007f6b34ad4090 R08: 0000000000000000 R09: 0000000000000000 [ 442.386762][T12068] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 442.386768][T12068] R13: 00007f6b33e26038 R14: 00007f6b33e25fa0 R15: 00007f6b33f4fa48 [ 442.386783][T12068] [ 442.429846][ T30] usb 4-1: Using ep0 maxpacket: 16 [ 442.433622][ T30] usb 4-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 6.00 [ 442.434018][ T5697] usb usb3-port1: unable to enumerate USB device [ 442.463058][ T30] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 442.463084][ T30] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 8 [ 442.505129][ T5695] cp2112 0003:10C4:EA90.003E: unknown main item tag 0x0 [ 442.505163][ T5695] cp2112 0003:10C4:EA90.003E: unknown main item tag 0x0 [ 442.505189][ T5695] cp2112 0003:10C4:EA90.003E: unknown main item tag 0x0 [ 442.522468][ T5695] cp2112 0003:10C4:EA90.003E: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.4-1/input0 [ 442.525049][ T30] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 442.525075][ T30] usb 4-1: Product: syz [ 442.525089][ T30] usb 4-1: Manufacturer: syz [ 442.525102][ T30] usb 4-1: SerialNumber: syz [ 442.701391][ T5695] cp2112 0003:10C4:EA90.003E: Part Number: 0x00 Device Version: 0x00 [ 442.722619][ T30] usb 4-1: config 0 descriptor?? [ 443.028607][ T30] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 443.168586][ T30] usb 2-1: device descriptor read/64, error -71 [ 443.310028][T12076] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 443.312270][T12076] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 443.408571][ T30] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 443.509593][T12045] cp2112 0003:10C4:EA90.003E: Error starting transaction: -38 [ 443.538564][ T30] usb 2-1: device descriptor read/64, error -71 [ 443.631271][ T5697] usb 1-1: USB disconnect, device number 94 [ 443.652065][ T30] usb usb2-port1: attempt power cycle [ 443.748632][ T5695] usb 5-1: reset high-speed USB device number 93 using dummy_hcd [ 443.877814][T12088] ip_tables: iptables: counters copy to user failed while replacing table [ 443.998544][ T30] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 444.019785][ T30] usb 2-1: device descriptor read/8, error -71 [ 444.148637][ T1227] usb 1-1: new high-speed USB device number 95 using dummy_hcd [ 444.258573][ T30] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 444.280554][ T30] usb 2-1: device descriptor read/8, error -71 [ 444.298522][ T1227] usb 1-1: Using ep0 maxpacket: 8 [ 444.301259][ T1227] usb 1-1: unable to get BOS descriptor or descriptor too short [ 444.301308][ T1227] usb 1-1: New USB device found, idVendor=2c42, idProduct=16f8, bcdDevice=5d.24 [ 444.302597][ T1227] usb 1-1: config 117 has an invalid interface number: 163 but max is 0 [ 444.302620][ T1227] usb 1-1: config 117 has no interface number 0 [ 444.302647][ T1227] usb 1-1: config 117 interface 163 has no altsetting 0 [ 444.308411][ T1227] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 444.308517][ T1227] usb 1-1: Product: syz [ 444.308532][ T1227] usb 1-1: Manufacturer: syz [ 444.308544][ T1227] usb 1-1: SerialNumber: syz [ 444.390096][ T30] usb usb2-port1: unable to enumerate USB device [ 444.628844][ T6590] usb 5-1: USB disconnect, device number 93 [ 444.737135][ T1227] f81534a_ctrl 1-1:117.163: probe with driver f81534a_ctrl failed with error -71 [ 444.753540][ T1227] usb 1-1: USB disconnect, device number 95 [ 444.770448][T12101] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2062'. [ 444.770481][T12101] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2062'. [ 444.888671][ T30] usb 3-1: new high-speed USB device number 124 using dummy_hcd [ 445.006451][T12107] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2065'. [ 445.043646][ T1227] usb 4-1: USB disconnect, device number 124 [ 445.058594][ T30] usb 3-1: Using ep0 maxpacket: 32 [ 445.150141][T12110] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2067'. [ 445.368729][ T5681] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 445.488772][ T1227] usb 4-1: new high-speed USB device number 125 using dummy_hcd [ 445.528700][ T5681] usb 5-1: Using ep0 maxpacket: 16 [ 445.529549][ T5681] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 445.530785][ T5681] usb 5-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 445.530813][ T5681] usb 5-1: config 0 interface 0 altsetting 64 endpoint 0x81 has invalid wMaxPacketSize 0 [ 445.530833][ T5681] usb 5-1: config 0 interface 0 has no altsetting 0 [ 445.530886][ T5681] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 445.535626][ T5681] usb 5-1: config 0 descriptor?? [ 445.635992][ T30] usb 3-1: unable to get BOS descriptor or descriptor too short [ 445.636051][ T30] usb 3-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=f8.13 [ 445.637395][ T30] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 445.637430][ T30] usb 3-1: can't read configurations, error -71 [ 445.664770][ T1227] usb 4-1: New USB device found, idVendor=056a, idProduct=0084, bcdDevice= 0.00 [ 445.681440][ T1227] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 445.681510][ T1227] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 445.684532][ T1227] usb 4-1: config 0 descriptor?? [ 445.685211][T12110] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 445.766074][T12122] FAULT_INJECTION: forcing a failure. [ 445.766074][T12122] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 445.766108][T12122] CPU: 1 UID: 0 PID: 12122 Comm: syz.0.2072 Tainted: G L syzkaller #0 PREEMPT(full) [ 445.766133][T12122] Tainted: [L]=SOFTLOCKUP [ 445.766140][T12122] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 445.766152][T12122] Call Trace: [ 445.766160][T12122] [ 445.766169][T12122] dump_stack_lvl+0xe8/0x150 [ 445.766204][T12122] should_fail_ex+0x410/0x560 [ 445.766233][T12122] _copy_from_user+0x2d/0xb0 [ 445.766260][T12122] ___sys_sendmsg+0x1c6/0x360 [ 445.766288][T12122] ? __lock_acquire+0x747/0x2de0 [ 445.766313][T12122] ? __pfx____sys_sendmsg+0x10/0x10 [ 445.766373][T12122] ? __fget_files+0x2a/0x420 [ 445.766399][T12122] ? __fget_files+0x3a2/0x420 [ 445.766435][T12122] __x64_sys_sendmsg+0x1b1/0x290 [ 445.766466][T12122] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 445.766512][T12122] do_syscall_64+0x166/0x520 [ 445.766538][T12122] ? trace_irq_disable+0x3b/0x140 [ 445.766558][T12122] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 445.766575][T12122] ? clear_bhb_loop+0x70/0xc0 [ 445.766597][T12122] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 445.766614][T12122] RIP: 0033:0x7f6d2c99e199 [ 445.766630][T12122] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 445.766644][T12122] RSP: 002b:00007f6d2d879028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 445.766663][T12122] RAX: ffffffffffffffda RBX: 00007f6d2cc25fa0 RCX: 00007f6d2c99e199 [ 445.766676][T12122] RDX: 0000000004000020 RSI: 0000200000000180 RDI: 0000000000000003 [ 445.766689][T12122] RBP: 00007f6d2d879090 R08: 0000000000000000 R09: 0000000000000000 [ 445.766701][T12122] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 445.766713][T12122] R13: 00007f6d2cc26038 R14: 00007f6d2cc25fa0 R15: 00007f6d2cd4fa48 [ 445.766743][T12122] [ 445.967885][ T5681] usbhid 5-1:0.0: can't add hid device: -71 [ 445.968016][ T5681] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 445.997747][ T5681] usb 5-1: USB disconnect, device number 94 [ 446.243329][ T1227] hid_parser_main: 4 callbacks suppressed [ 446.243353][ T1227] wacom 0003:056A:0084.003F: unknown main item tag 0x0 [ 446.245713][ T1227] wacom 0003:056A:0084.003F: unknown main item tag 0x0 [ 446.245735][ T1227] wacom 0003:056A:0084.003F: unknown main item tag 0x0 [ 446.245752][ T1227] wacom 0003:056A:0084.003F: unknown main item tag 0x0 [ 446.245767][ T1227] wacom 0003:056A:0084.003F: unknown main item tag 0x0 [ 446.245783][ T1227] wacom 0003:056A:0084.003F: unknown main item tag 0x0 [ 446.245800][ T1227] wacom 0003:056A:0084.003F: unknown main item tag 0x0 [ 446.245824][ T1227] wacom 0003:056A:0084.003F: unknown main item tag 0x0 [ 446.245849][ T1227] wacom 0003:056A:0084.003F: unknown main item tag 0x0 [ 446.245866][ T1227] wacom 0003:056A:0084.003F: unknown main item tag 0x0 [ 446.247683][ T1227] wacom 0003:056A:0084.003F: collection stack underflow [ 446.247699][ T1227] wacom 0003:056A:0084.003F: item 0 0 0 12 parsing failed [ 446.256149][ T1227] wacom 0003:056A:0084.003F: parse failed [ 446.256251][ T1227] wacom 0003:056A:0084.003F: probe with driver wacom failed with error -22 [ 446.381462][T12133] netlink: 584 bytes leftover after parsing attributes in process `syz.0.2073'. [ 446.458632][ T30] usb 3-1: new high-speed USB device number 125 using dummy_hcd [ 446.464640][T12133] bond0: (slave bridge0): Releasing backup interface [ 446.488534][ T6590] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 446.489230][T12133] bridge0: port 4(veth0) entered disabled state [ 446.489445][T12133] bridge0: port 2(bridge_slave_1) entered disabled state [ 446.489667][T12133] bridge0: port 1(bridge_slave_0) entered disabled state [ 446.615730][T12133] veth0: left allmulticast mode [ 446.615758][T12133] veth0: left promiscuous mode [ 446.615984][T12133] bridge0: port 4(veth0) entered disabled state [ 446.623973][ T30] usb 3-1: unable to get BOS descriptor or descriptor too short [ 446.624028][ T30] usb 3-1: New USB device found, idVendor=1235, idProduct=8201, bcdDevice= 0.40 [ 446.631599][ T30] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 32 [ 446.631629][ T30] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 446.637959][ T30] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 446.637986][ T30] usb 3-1: Product: syz [ 446.638000][ T30] usb 3-1: Manufacturer: syz [ 446.638013][ T30] usb 3-1: SerialNumber: syz [ 446.643216][ T6590] usb 2-1: Using ep0 maxpacket: 32 [ 446.653152][ T6590] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 446.677681][ T6590] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 446.697363][ T6590] usb 2-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 446.697392][ T6590] usb 2-1: Product: syz [ 446.697406][ T6590] usb 2-1: Manufacturer: syz [ 446.697419][ T6590] usb 2-1: SerialNumber: syz [ 446.721797][T12136] FAULT_INJECTION: forcing a failure. [ 446.721797][T12136] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 446.721861][T12136] CPU: 1 UID: 0 PID: 12136 Comm: syz.4.2077 Tainted: G L syzkaller #0 PREEMPT(full) [ 446.721886][T12136] Tainted: [L]=SOFTLOCKUP [ 446.721892][T12136] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 446.721903][T12136] Call Trace: [ 446.721911][T12136] [ 446.721920][T12136] dump_stack_lvl+0xe8/0x150 [ 446.721953][T12136] should_fail_ex+0x410/0x560 [ 446.721983][T12136] _copy_to_user+0x31/0xb0 [ 446.722012][T12136] simple_read_from_buffer+0xe1/0x170 [ 446.722045][T12136] proc_fail_nth_read+0x1bb/0x230 [ 446.722065][T12136] ? common_file_perm+0x20e/0x2b0 [ 446.722092][T12136] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 446.722115][T12136] ? rw_verify_area+0x24a/0x4c0 [ 446.722135][T12136] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 446.722154][T12136] vfs_read+0x213/0xa80 [ 446.722179][T12136] ? __pfx_vfs_read+0x10/0x10 [ 446.722204][T12136] ? __pfx_timespec64_add_safe+0x10/0x10 [ 446.722236][T12136] ksys_read+0x150/0x270 [ 446.722257][T12136] ? __pfx_ksys_read+0x10/0x10 [ 446.722284][T12136] do_syscall_64+0x166/0x520 [ 446.722310][T12136] ? trace_irq_disable+0x3b/0x140 [ 446.722329][T12136] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 446.722348][T12136] ? clear_bhb_loop+0x70/0xc0 [ 446.722371][T12136] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 446.722389][T12136] RIP: 0033:0x7fea6495e9ce [ 446.722406][T12136] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 446.722421][T12136] RSP: 002b:00007fea62bf5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 446.722441][T12136] RAX: ffffffffffffffda RBX: 00007fea62bf66c0 RCX: 00007fea6495e9ce [ 446.722455][T12136] RDX: 000000000000000f RSI: 00007fea62bf60a0 RDI: 0000000000000004 [ 446.722466][T12136] RBP: 00007fea62bf6090 R08: 0000000000000000 R09: 0000000000000000 [ 446.722478][T12136] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 446.722489][T12136] R13: 00007fea64c26038 R14: 00007fea64c25fa0 R15: 00007fea64d4fa48 [ 446.722517][T12136] [ 446.727104][T12126] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 446.854771][ T6590] usb 2-1: config 0 descriptor?? [ 446.880562][T12132] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 447.041975][T12133] bridge_slave_0: left allmulticast mode [ 447.042026][T12133] bridge_slave_0: left promiscuous mode [ 447.044996][T12133] bridge0: port 1(bridge_slave_0) entered disabled state [ 447.105459][T12133] bridge_slave_1: left allmulticast mode [ 447.105489][T12133] bridge_slave_1: left promiscuous mode [ 447.105717][T12133] bridge0: port 2(bridge_slave_1) entered disabled state [ 447.287930][T12133] bond0: (slave bond_slave_0): Releasing backup interface [ 447.467571][T12133] bond0: (slave bond_slave_1): Releasing backup interface [ 447.486829][ T30] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 447.486880][ T30] usb 3-1: MIDIStreaming interface descriptor not found [ 447.727075][ T30] usb 3-1: USB disconnect, device number 125 [ 447.833633][T12133] team0: Port device team_slave_0 removed [ 447.944008][T12133] team0: Port device team_slave_1 removed [ 447.959699][T12133] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 447.959726][T12133] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 448.016817][T12133] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 448.016841][T12133] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 448.088761][T12133] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 448.159200][ T5681] usb 4-1: USB disconnect, device number 125 [ 448.641175][T12154] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 448.839227][ T6590] usb 2-1: USB disconnect, device number 7 [ 448.916647][T12160] FAULT_INJECTION: forcing a failure. [ 448.916647][T12160] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 448.916681][T12160] CPU: 0 UID: 0 PID: 12160 Comm: syz.2.2083 Tainted: G L syzkaller #0 PREEMPT(full) [ 448.916706][T12160] Tainted: [L]=SOFTLOCKUP [ 448.916714][T12160] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 448.916725][T12160] Call Trace: [ 448.916733][T12160] [ 448.916741][T12160] dump_stack_lvl+0xe8/0x150 [ 448.916781][T12160] should_fail_ex+0x410/0x560 [ 448.916812][T12160] _copy_from_user+0x2d/0xb0 [ 448.916840][T12160] ___sys_recvmsg+0x173/0x5a0 [ 448.916859][T12160] ? lock_acquire+0x115/0x350 [ 448.916883][T12160] ? __pfx____sys_recvmsg+0x10/0x10 [ 448.916906][T12160] ? lock_acquire+0x115/0x350 [ 448.916939][T12160] ? __fget_files+0x3a2/0x420 [ 448.916976][T12160] do_recvmmsg+0x31a/0x7f0 [ 448.917003][T12160] ? __pfx_do_recvmmsg+0x10/0x10 [ 448.917031][T12160] ? get_timespec64+0x119/0x1b0 [ 448.917054][T12160] ? __pfx_get_timespec64+0x10/0x10 [ 448.917085][T12160] __x64_sys_recvmmsg+0x1b7/0x250 [ 448.917106][T12160] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 448.917134][T12160] do_syscall_64+0x166/0x520 [ 448.917160][T12160] ? trace_irq_disable+0x3b/0x140 [ 448.917179][T12160] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 448.917197][T12160] ? clear_bhb_loop+0x70/0xc0 [ 448.917218][T12160] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 448.917237][T12160] RIP: 0033:0x7fc27c19e199 [ 448.917255][T12160] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 448.917271][T12160] RSP: 002b:00007fc27a3f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 448.917290][T12160] RAX: ffffffffffffffda RBX: 00007fc27c425fa0 RCX: 00007fc27c19e199 [ 448.917304][T12160] RDX: 04000000000003b4 RSI: 00002000000037c0 RDI: 0000000000000003 [ 448.917318][T12160] RBP: 00007fc27a3f6090 R08: 0000200000003700 R09: 0000000000000000 [ 448.917331][T12160] R10: 0000000000002000 R11: 0000000000000246 R12: 0000000000000001 [ 448.917343][T12160] R13: 00007fc27c426038 R14: 00007fc27c425fa0 R15: 00007fc27c54fa48 [ 448.917373][T12160] [ 449.509754][ T30] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 449.538907][ T5681] usb 3-1: new high-speed USB device number 126 using dummy_hcd [ 449.662701][ T30] usb 5-1: Using ep0 maxpacket: 16 [ 449.663717][ T30] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 449.665594][ T30] usb 5-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 449.665624][ T30] usb 5-1: config 0 interface 0 altsetting 64 endpoint 0x81 has invalid wMaxPacketSize 0 [ 449.665645][ T30] usb 5-1: config 0 interface 0 has no altsetting 0 [ 449.665676][ T30] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 449.668600][ T5681] usb 3-1: device descriptor read/64, error -71 [ 449.684488][ T30] usb 5-1: config 0 descriptor?? [ 449.797803][T12182] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 449.908559][ T5681] usb 3-1: new high-speed USB device number 127 using dummy_hcd [ 450.038679][ T5681] usb 3-1: device descriptor read/64, error -71 [ 450.094370][ T30] usbhid 5-1:0.0: can't add hid device: -71 [ 450.094473][ T30] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 450.111946][ T30] usb 5-1: USB disconnect, device number 95 [ 450.149830][ T5681] usb usb3-port1: attempt power cycle [ 450.168948][ T975] usb 1-1: new high-speed USB device number 96 using dummy_hcd [ 450.319371][ T975] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 450.320421][ T975] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 450.320451][ T975] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 450.323870][ T975] usb 1-1: config 0 descriptor?? [ 450.339359][ T975] pwc: Askey VC010 type 2 USB webcam detected. [ 450.488575][ T5681] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 450.509941][ T5681] usb 3-1: device descriptor read/8, error -71 [ 450.733598][ T975] pwc: recv_control_msg error -32 req 02 val 2b00 [ 450.736379][ T975] pwc: recv_control_msg error -32 req 02 val 2700 [ 450.759013][ T5681] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 450.763951][ T975] pwc: recv_control_msg error -32 req 02 val 2c00 [ 450.764626][ T975] pwc: recv_control_msg error -32 req 04 val 1000 [ 450.779662][ T975] pwc: recv_control_msg error -32 req 04 val 1300 [ 450.789450][ T5681] usb 3-1: device descriptor read/8, error -71 [ 450.793075][ T975] pwc: recv_control_msg error -32 req 04 val 1400 [ 450.806284][ T975] pwc: recv_control_msg error -32 req 02 val 2000 [ 450.813692][ T975] pwc: recv_control_msg error -32 req 02 val 2100 [ 450.827766][ T975] pwc: recv_control_msg error -32 req 04 val 1500 [ 450.836022][ T975] pwc: recv_control_msg error -32 req 02 val 2500 [ 450.838045][ T975] pwc: recv_control_msg error -32 req 02 val 2400 [ 450.852052][ T975] pwc: recv_control_msg error -32 req 02 val 2600 [ 450.900753][ T5681] usb usb3-port1: unable to enumerate USB device [ 451.068361][ T975] pwc: recv_control_msg error -71 req 02 val 2800 [ 451.076148][ T975] pwc: recv_control_msg error -71 req 04 val 1100 [ 451.077157][ T975] pwc: recv_control_msg error -71 req 04 val 1200 [ 451.094139][ T975] pwc: Registered as video103. [ 451.104225][ T975] input: PWC snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/input/input36 [ 451.119576][ T975] usb 1-1: USB disconnect, device number 96 [ 451.149359][T12203] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2102'. [ 451.149394][T12203] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2102'. [ 451.311428][T12209] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 451.311446][T12209] IPv6: NLM_F_CREATE should be set when creating new route [ 451.377154][T12211] [U] M٭Q& K4 [ 451.377887][T12211] [U] [)U}ǔJϬ}NSEF* NZF[F_H'W"X~;VA)^`1C':ZFOB *?۟CZS<8ZNѷјEY TT<$CRƖ/VG {Y~Y5\;ƃZDXYA"XIF{`A$í55?SAMOͻ*K [ 451.377923][T12211] [U] O4 [ 451.378338][T12211] [U] UB+ '~GIރRQ^,(-|ڟ-<6&H.Z9/RJΩˈ+)֭KΦ.NHA#LW#RF7P٪MAX]LN"KM +,GSBHJX̧CQ [ 451.434305][T12211] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1006300934 (16100814944 ns) > initial count (1516955264 ns). Using initial count to start timer. [ 451.922203][T12228] FAULT_INJECTION: forcing a failure. [ 451.922203][T12228] name failslab, interval 1, probability 0, space 0, times 0 [ 451.922226][T12228] CPU: 0 UID: 0 PID: 12228 Comm: syz.3.2112 Tainted: G L syzkaller #0 PREEMPT(full) [ 451.922240][T12228] Tainted: [L]=SOFTLOCKUP [ 451.922245][T12228] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 451.922251][T12228] Call Trace: [ 451.922256][T12228] [ 451.922261][T12228] dump_stack_lvl+0xe8/0x150 [ 451.922281][T12228] should_fail_ex+0x410/0x560 [ 451.922298][T12228] should_failslab+0xa8/0x100 [ 451.922313][T12228] ? skb_clone+0x212/0x3a0 [ 451.922324][T12228] kmem_cache_alloc_noprof+0xa1/0x600 [ 451.922336][T12228] ? skb_clone+0x212/0x3a0 [ 451.922349][T12228] skb_clone+0x212/0x3a0 [ 451.922361][T12228] __netlink_deliver_tap+0x413/0x860 [ 451.922378][T12228] ? netlink_deliver_tap+0x2e/0x1b0 [ 451.922390][T12228] netlink_deliver_tap+0x19c/0x1b0 [ 451.922405][T12228] netlink_unicast+0x781/0x940 [ 451.922421][T12228] netlink_sendmsg+0x813/0xb40 [ 451.922436][T12228] ? __pfx_netlink_sendmsg+0x10/0x10 [ 451.922451][T12228] ? apparmor_socket_sendmsg+0x98/0x360 [ 451.922467][T12228] ? __pfx_netlink_sendmsg+0x10/0x10 [ 451.922477][T12228] sock_sendmsg_nosec+0x13a/0x180 [ 451.922491][T12228] ____sys_sendmsg+0x54e/0x850 [ 451.922509][T12228] ? __pfx_____sys_sendmsg+0x10/0x10 [ 451.922527][T12228] ? import_iovec+0x73/0xa0 [ 451.922543][T12228] ___sys_sendmsg+0x2a5/0x360 [ 451.922557][T12228] ? __lock_acquire+0x747/0x2de0 [ 451.922570][T12228] ? __pfx____sys_sendmsg+0x10/0x10 [ 451.922602][T12228] ? __fget_files+0x2a/0x420 [ 451.922616][T12228] ? __fget_files+0x3a2/0x420 [ 451.922634][T12228] __x64_sys_sendmsg+0x1b1/0x290 [ 451.922651][T12228] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 451.922675][T12228] do_syscall_64+0x166/0x520 [ 451.922690][T12228] ? trace_irq_disable+0x3b/0x140 [ 451.922701][T12228] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 451.922711][T12228] ? clear_bhb_loop+0x70/0xc0 [ 451.922724][T12228] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 451.922734][T12228] RIP: 0033:0x7fc81c39e199 [ 451.922744][T12228] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 451.922753][T12228] RSP: 002b:00007fc81d299028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 451.922765][T12228] RAX: ffffffffffffffda RBX: 00007fc81c625fa0 RCX: 00007fc81c39e199 [ 451.922773][T12228] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000003 [ 451.922779][T12228] RBP: 00007fc81d299090 R08: 0000000000000000 R09: 0000000000000000 [ 451.922786][T12228] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 451.922792][T12228] R13: 00007fc81c626038 R14: 00007fc81c625fa0 R15: 00007fc81c74fa48 [ 451.922811][T12228] [ 451.959706][ T975] usb 1-1: new high-speed USB device number 97 using dummy_hcd [ 452.033123][ T6590] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 452.038547][ T5681] usb 5-1: new high-speed USB device number 96 using dummy_hcd [ 452.069661][T12230] FAULT_INJECTION: forcing a failure. [ 452.069661][T12230] name failslab, interval 1, probability 0, space 0, times 0 [ 452.069693][T12230] CPU: 1 UID: 0 PID: 12230 Comm: syz.3.2113 Tainted: G L syzkaller #0 PREEMPT(full) [ 452.069718][T12230] Tainted: [L]=SOFTLOCKUP [ 452.069726][T12230] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 452.069737][T12230] Call Trace: [ 452.069745][T12230] [ 452.069754][T12230] dump_stack_lvl+0xe8/0x150 [ 452.069786][T12230] should_fail_ex+0x410/0x560 [ 452.069814][T12230] should_failslab+0xa8/0x100 [ 452.069838][T12230] ? dst_alloc+0x105/0x170 [ 452.069948][T12230] kmem_cache_alloc_noprof+0xa1/0x600 [ 452.069971][T12230] ? dst_alloc+0x105/0x170 [ 452.069996][T12230] dst_alloc+0x105/0x170 [ 452.070020][T12230] ip_route_output_key_hash_rcu+0x14ac/0x2720 [ 452.070081][T12230] ? ip_route_output_key_hash+0xd8/0x2a0 [ 452.070105][T12230] ip_route_output_key_hash+0x18d/0x2a0 [ 452.070126][T12230] ? ns_capable+0x89/0xe0 [ 452.070163][T12230] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 452.070187][T12230] ? lock_acquire+0x115/0x350 [ 452.070217][T12230] ip_route_output_flow+0x2a/0x150 [ 452.070236][T12230] ? security_sk_classify_flow+0x6d/0x150 [ 452.070294][T12230] udp_sendmsg+0x144a/0x2140 [ 452.070335][T12230] ? __pfx_udp_sendmsg+0x10/0x10 [ 452.070367][T12230] ? tomoyo_supervisor+0x4d2/0x1560 [ 452.070423][T12230] ? get_random_u32+0x497/0x8b0 [ 452.070528][T12230] ? lockdep_hardirqs_on+0x7b/0x110 [ 452.070554][T12230] ? get_random_u32+0x13a/0x8b0 [ 452.070577][T12230] ? get_random_u32+0x4ce/0x8b0 [ 452.070608][T12230] udpv6_sendmsg+0x915/0x2610 [ 452.070684][T12230] ? __pfx_udpv6_sendmsg+0x10/0x10 [ 452.070709][T12230] ? udp_lib_get_port+0x177b/0x1c60 [ 452.070755][T12230] ? inet_send_prepare+0x1b4/0x260 [ 452.070811][T12230] ? lockdep_hardirqs_on+0x7b/0x110 [ 452.070835][T12230] ? inet_send_prepare+0x1b4/0x260 [ 452.070854][T12230] ? __local_bh_enable_ip+0xd6/0x140 [ 452.070878][T12230] ? inet_send_prepare+0x1b4/0x260 [ 452.070901][T12230] ? inet6_sendmsg+0xe4/0x120 [ 452.070950][T12230] ? __pfx_inet6_sendmsg+0x10/0x10 [ 452.070969][T12230] sock_sendmsg_nosec+0x90/0x180 [ 452.070995][T12230] ____sys_sendmsg+0x54e/0x850 [ 452.071028][T12230] ? __pfx_____sys_sendmsg+0x10/0x10 [ 452.071062][T12230] ? import_iovec+0x73/0xa0 [ 452.071091][T12230] ___sys_sendmsg+0x2a5/0x360 [ 452.071117][T12230] ? __lock_acquire+0x747/0x2de0 [ 452.071140][T12230] ? __pfx____sys_sendmsg+0x10/0x10 [ 452.071200][T12230] ? __fget_files+0x2a/0x420 [ 452.071223][T12230] ? __fget_files+0x3a2/0x420 [ 452.071255][T12230] __x64_sys_sendmsg+0x1b1/0x290 [ 452.071281][T12230] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 452.071327][T12230] do_syscall_64+0x166/0x520 [ 452.071350][T12230] ? trace_irq_disable+0x3b/0x140 [ 452.071368][T12230] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 452.071393][T12230] ? clear_bhb_loop+0x70/0xc0 [ 452.071413][T12230] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 452.071430][T12230] RIP: 0033:0x7fc81c39e199 [ 452.071447][T12230] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 452.071462][T12230] RSP: 002b:00007fc81d299028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 452.071481][T12230] RAX: ffffffffffffffda RBX: 00007fc81c625fa0 RCX: 00007fc81c39e199 [ 452.071495][T12230] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 452.071506][T12230] RBP: 00007fc81d299090 R08: 0000000000000000 R09: 0000000000000000 [ 452.071517][T12230] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 452.071527][T12230] R13: 00007fc81c626038 R14: 00007fc81c625fa0 R15: 00007fc81c74fa48 [ 452.071554][T12230] [ 452.164531][ T975] usb 1-1: Using ep0 maxpacket: 16 [ 452.181644][ T975] usb 1-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 6.00 [ 452.188543][ T5681] usb 5-1: Using ep0 maxpacket: 16 [ 452.189253][ T5681] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 452.190943][ T5681] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 452.190969][ T5681] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 452.196889][ T5681] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 452.196915][ T5681] usb 5-1: Product: syz [ 452.196929][ T5681] usb 5-1: Manufacturer: syz [ 452.196942][ T5681] usb 5-1: SerialNumber: syz [ 452.208741][ T5681] usb 5-1: config 0 descriptor?? [ 452.217685][ T5681] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 452.217717][ T5681] em28xx 5-1:0.0: Audio interface 0 found (Vendor Class) [ 452.218822][ T975] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 452.218916][ T975] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 8 [ 452.235227][ T6590] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 452.300443][ T975] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 452.300470][ T975] usb 1-1: Product: syz [ 452.300485][ T975] usb 1-1: Manufacturer: syz [ 452.300498][ T975] usb 1-1: SerialNumber: syz [ 452.375355][ T6590] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 452.375381][ T6590] usb 2-1: Product: syz [ 452.375395][ T6590] usb 2-1: Manufacturer: syz [ 452.375408][ T6590] usb 2-1: SerialNumber: syz [ 452.462243][ T975] usb 1-1: config 0 descriptor?? [ 452.588586][ T30] usb 4-1: new full-speed USB device number 126 using dummy_hcd [ 452.650290][T12237] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 452.652644][T12237] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2116'. [ 452.749403][ T30] usb 4-1: New USB device found, idVendor=06cd, idProduct=0121, bcdDevice=dd.3d [ 452.750739][ T30] usb 4-1: config 0 has an invalid interface number: 133 but max is 0 [ 452.750762][ T30] usb 4-1: config 0 has no interface number 0 [ 452.753380][ T30] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 452.753403][ T30] usb 4-1: Product: syz [ 452.753417][ T30] usb 4-1: Manufacturer: syz [ 452.753430][ T30] usb 4-1: SerialNumber: syz [ 452.763483][ T30] usb 4-1: config 0 descriptor?? [ 452.871089][ T5681] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 452.876706][ T5681] em28xx 5-1:0.0: Config register raw data: 0xfffffffb [ 453.016286][ T30] keyspan 4-1:0.133: Keyspan 1 port adapter converter detected [ 453.022214][ T30] keyspan 4-1:0.133: found no endpoint descriptor for endpoint 81 [ 453.022318][ T30] keyspan 4-1:0.133: found no endpoint descriptor for endpoint 1 [ 453.022394][ T30] keyspan 4-1:0.133: found no endpoint descriptor for endpoint 2 [ 453.024413][ T30] usb 4-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 453.036198][T12244] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 453.036680][T12244] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 453.046974][ T30] usb 4-1: USB disconnect, device number 126 [ 453.057897][ T30] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 453.060796][ T30] keyspan 4-1:0.133: device disconnected [ 453.096193][ T6590] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 453.096254][ T6590] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 453.286279][T12226] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 453.287715][T12226] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 453.511845][T12226] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 453.514806][T12226] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 453.813074][T12249] [U] M٭q& K4 [ 453.813134][T12249] [U] [)U}ǔJ}Nsef* nZf[F_h'W"x~;vA)^`1C':zFOb *?۟czs<8zN񷐚Ey TT<$cR斻/Vg {y~Y5\;zDxyA"xIf{`A$㭡55?samo*K [ 453.813180][T12249] [U] o4 [ 453.813203][T12249] [U] Ub+ '~GIރrQ^,(-|-<6&h.z9/rJ+)֭KΦ.nHA#lw#Rf7P٪max]ln"km +,GSbhjxCQ [ 453.867735][T12249] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1006300934 (16100814944 ns) > initial count (1516955264 ns). Using initial count to start timer. [ 453.919460][ T5681] em28xx 5-1:0.0: AC97 vendor ID = 0x00fc0000 [ 454.023929][T12254] usb usb8: usbfs: process 12254 (syz.3.2120) did not claim interface 7 before use [ 454.092113][T12258] [U] M٭Q& K4 [ 454.092981][T12258] [U] [)U}ǔJϬ}NSEF* NZF[F_H'W"X~;VA)^`1C':ZFOB *?۟CZS<8ZNѷјEY TT<$CRƖ/VG {Y~Y5\;ƃZDXYA"XIF{`A$í55?SAMOͻ*K [ 454.093042][T12258] [U] O4 [ 454.093398][T12258] [U] UB+ '~GIރRQ^,(-|ڟ-<6&H.Z9/RJΩˈ+)֭KΦ.NHA#LW#RF7P٪MAX]LN"KM +,GSBHJX̧CQ [ 454.154357][T12258] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1006300934 (16100814944 ns) > initial count (1516955264 ns). Using initial count to start timer. [ 454.279571][ T30] usb 4-1: new high-speed USB device number 127 using dummy_hcd [ 454.325766][ T6590] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 454.327247][ T6590] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00001000. ret = -EPROTO [ 454.327672][ T6590] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x0000011c. ret = -EPROTO [ 454.327722][ T6590] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 454.328788][ T6590] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 454.342349][ T6590] lan78xx 2-1:1.0: probe with driver lan78xx failed with error -71 [ 454.385364][ T5681] em28xx 5-1:0.0: Unknown AC97 audio processor detected! [ 454.393831][ T5681] em28xx 5-1:0.0: couldn't setup AC97 register 2 [ 454.401150][ T6590] usb 2-1: USB disconnect, device number 8 [ 454.414797][ T5681] em28xx 5-1:0.0: couldn't setup AC97 register 4 [ 454.415188][ T5681] em28xx 5-1:0.0: couldn't setup AC97 register 6 [ 454.415542][ T5681] em28xx 5-1:0.0: couldn't setup AC97 register 54 [ 454.416005][ T5681] em28xx 5-1:0.0: couldn't setup AC97 register 56 [ 454.449173][ T5681] usb 5-1: USB disconnect, device number 96 [ 454.500032][ T30] usb 4-1: Using ep0 maxpacket: 32 [ 454.500552][ T30] usb 4-1: New USB device found, idVendor=046d, idProduct=c20e, bcdDevice= 0.00 [ 454.501529][ T30] usb 4-1: config 0 interface 0 altsetting 14 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 454.501557][ T30] usb 4-1: config 0 interface 0 has no altsetting 0 [ 454.501589][ T30] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 454.505015][ T30] usb 4-1: config 0 descriptor?? [ 454.608800][ T1227] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 454.691384][ T5681] usb 1-1: USB disconnect, device number 97 [ 454.779959][ T1227] usb 3-1: Using ep0 maxpacket: 16 [ 454.783386][ T1227] usb 3-1: unable to get BOS descriptor or descriptor too short [ 454.783437][ T1227] usb 3-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 454.784618][ T1227] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 454.784714][ T1227] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 454.784752][ T1227] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 454.787266][ T1227] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 454.787291][ T1227] usb 3-1: Product: syz [ 454.787306][ T1227] usb 3-1: Manufacturer: syz [ 454.787320][ T1227] usb 3-1: SerialNumber: syz [ 454.964947][T12254] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 455.010560][T12269] netlink: 68 bytes leftover after parsing attributes in process `syz.1.2127'. [ 455.073921][T12272] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 455.097239][ T1227] usb 3-1: Audio class v2/v3 interfaces need an interface association [ 455.107466][ T1227] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 455.126244][ T1227] usb 3-1: 2:1 : can't get High Capability descriptor [ 455.208651][ T6590] usb 1-1: new high-speed USB device number 98 using dummy_hcd [ 455.334429][ T975] usb 3-1: USB disconnect, device number 4 [ 455.360690][ T6590] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 455.365128][ T6590] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 455.365156][ T6590] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 455.365173][ T6590] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 455.365212][ T6590] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 455.365226][ T6590] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 455.373493][ T6590] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 455.373519][ T6590] usb 1-1: Product: syz [ 455.373533][ T6590] usb 1-1: Manufacturer: syz [ 455.455824][ T6590] cdc_wdm 1-1:1.0: skipping garbage [ 455.455847][ T6590] cdc_wdm 1-1:1.0: skipping garbage [ 455.556330][ T6590] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 455.556352][ T6590] cdc_wdm 1-1:1.0: Unknown control protocol [ 455.706168][T12291] netlink: 540 bytes leftover after parsing attributes in process `syz.0.2126'. [ 455.789610][T12296] ip_tables: iptables: counters copy to user failed while replacing table [ 456.078646][ T25] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 456.118999][ T975] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 456.248753][ T25] usb 2-1: Using ep0 maxpacket: 8 [ 456.251641][ T25] usb 2-1: unable to get BOS descriptor or descriptor too short [ 456.251687][ T25] usb 2-1: New USB device found, idVendor=2c42, idProduct=16f8, bcdDevice=5d.24 [ 456.252739][ T25] usb 2-1: config 117 has an invalid interface number: 163 but max is 0 [ 456.252760][ T25] usb 2-1: config 117 has no interface number 0 [ 456.252787][ T25] usb 2-1: config 117 interface 163 has no altsetting 0 [ 456.254984][ T25] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 456.255001][ T25] usb 2-1: Product: syz [ 456.255009][ T25] usb 2-1: Manufacturer: syz [ 456.255016][ T25] usb 2-1: SerialNumber: syz [ 456.291231][ T975] usb 3-1: Using ep0 maxpacket: 16 [ 456.314025][ T975] usb 3-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 6.00 [ 456.343498][ T975] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 456.343524][ T975] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 8 [ 456.346252][ T975] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 456.346279][ T975] usb 3-1: Product: syz [ 456.346294][ T975] usb 3-1: Manufacturer: syz [ 456.346331][ T975] usb 3-1: SerialNumber: syz [ 456.393535][ T975] usb 3-1: config 0 descriptor?? [ 456.681923][ T25] f81534a_ctrl 2-1:117.163: probe with driver f81534a_ctrl failed with error -71 [ 456.688341][ T25] usb 2-1: USB disconnect, device number 9 [ 456.949514][T12300] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 456.950273][T12300] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 457.045635][ T30] usbhid 4-1:0.0: can't add hid device: -71 [ 457.045994][ T30] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 457.070346][ T30] usb 4-1: USB disconnect, device number 127 [ 457.305841][T12311] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2137'. [ 457.548592][ T25] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 457.700844][ T25] usb 2-1: New USB device found, idVendor=056a, idProduct=0084, bcdDevice= 0.00 [ 457.701924][ T25] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 457.701969][ T25] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 457.704599][ T25] usb 2-1: config 0 descriptor?? [ 457.705316][T12311] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 457.929266][ T975] usb 1-1: USB disconnect, device number 98 [ 458.055698][T12315] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 458.055717][T12315] IPv6: NLM_F_CREATE should be set when creating new route [ 458.076094][T12315] netlink: 68 bytes leftover after parsing attributes in process `syz.3.2139'. [ 458.138721][ T25] hid_parser_main: 231 callbacks suppressed [ 458.138747][ T25] wacom 0003:056A:0084.0040: unknown main item tag 0x0 [ 458.138778][ T25] wacom 0003:056A:0084.0040: unknown main item tag 0x0 [ 458.139325][ T25] wacom 0003:056A:0084.0040: unknown main item tag 0x0 [ 458.139357][ T25] wacom 0003:056A:0084.0040: unknown main item tag 0x0 [ 458.139383][ T25] wacom 0003:056A:0084.0040: unknown main item tag 0x0 [ 458.139409][ T25] wacom 0003:056A:0084.0040: unknown main item tag 0x0 [ 458.139433][ T25] wacom 0003:056A:0084.0040: unknown main item tag 0x0 [ 458.139457][ T25] wacom 0003:056A:0084.0040: unknown main item tag 0x0 [ 458.139480][ T25] wacom 0003:056A:0084.0040: unknown main item tag 0x0 [ 458.139505][ T25] wacom 0003:056A:0084.0040: unknown main item tag 0x0 [ 458.145808][ T25] wacom 0003:056A:0084.0040: collection stack underflow [ 458.145839][ T25] wacom 0003:056A:0084.0040: item 0 0 0 12 parsing failed [ 458.147159][ T25] wacom 0003:056A:0084.0040: parse failed [ 458.147271][ T25] wacom 0003:056A:0084.0040: probe with driver wacom failed with error -22 [ 458.532140][T12332] FAULT_INJECTION: forcing a failure. [ 458.532140][T12332] name failslab, interval 1, probability 0, space 0, times 0 [ 458.532174][T12332] CPU: 0 UID: 0 PID: 12332 Comm: syz.4.2144 Tainted: G L syzkaller #0 PREEMPT(full) [ 458.532197][T12332] Tainted: [L]=SOFTLOCKUP [ 458.532203][T12332] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 458.532213][T12332] Call Trace: [ 458.532220][T12332] [ 458.532229][T12332] dump_stack_lvl+0xe8/0x150 [ 458.532262][T12332] should_fail_ex+0x410/0x560 [ 458.532289][T12332] should_failslab+0xa8/0x100 [ 458.532324][T12332] ? skb_clone+0x212/0x3a0 [ 458.532343][T12332] kmem_cache_alloc_noprof+0xa1/0x600 [ 458.532366][T12332] ? skb_clone+0x212/0x3a0 [ 458.532391][T12332] skb_clone+0x212/0x3a0 [ 458.532413][T12332] __netlink_deliver_tap+0x413/0x860 [ 458.532445][T12332] ? netlink_deliver_tap+0x2e/0x1b0 [ 458.532468][T12332] netlink_deliver_tap+0x19c/0x1b0 [ 458.532491][T12332] netlink_unicast+0x781/0x940 [ 458.532520][T12332] netlink_sendmsg+0x813/0xb40 [ 458.532549][T12332] ? __pfx_netlink_sendmsg+0x10/0x10 [ 458.532576][T12332] ? apparmor_socket_sendmsg+0x18b/0x360 [ 458.532601][T12332] ? __pfx_netlink_sendmsg+0x10/0x10 [ 458.532619][T12332] sock_sendmsg_nosec+0x13a/0x180 [ 458.532643][T12332] ____sys_sendmsg+0x54e/0x850 [ 458.532674][T12332] ? __pfx_____sys_sendmsg+0x10/0x10 [ 458.532710][T12332] ? import_iovec+0x73/0xa0 [ 458.532737][T12332] ___sys_sendmsg+0x2a5/0x360 [ 458.532763][T12332] ? __lock_acquire+0x747/0x2de0 [ 458.532786][T12332] ? __pfx____sys_sendmsg+0x10/0x10 [ 458.532844][T12332] ? __fget_files+0x2a/0x420 [ 458.532870][T12332] ? __fget_files+0x3a2/0x420 [ 458.532906][T12332] __x64_sys_sendmsg+0x1b1/0x290 [ 458.532937][T12332] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 458.532980][T12332] do_syscall_64+0x166/0x520 [ 458.533006][T12332] ? trace_irq_disable+0x3b/0x140 [ 458.533024][T12332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 458.533043][T12332] ? clear_bhb_loop+0x70/0xc0 [ 458.533066][T12332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 458.533085][T12332] RIP: 0033:0x7fea6499e199 [ 458.533103][T12332] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 458.533118][T12332] RSP: 002b:00007fea62bf6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 458.533138][T12332] RAX: ffffffffffffffda RBX: 00007fea64c25fa0 RCX: 00007fea6499e199 [ 458.533151][T12332] RDX: 000000002000c8c0 RSI: 0000200000000000 RDI: 0000000000000003 [ 458.533164][T12332] RBP: 00007fea62bf6090 R08: 0000000000000000 R09: 0000000000000000 [ 458.533175][T12332] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 458.533185][T12332] R13: 00007fea64c26038 R14: 00007fea64c25fa0 R15: 00007fea64d4fa48 [ 458.533214][T12332] [ 458.540108][T12332] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2144'. [ 458.896527][ T1227] usb 2-1: USB disconnect, device number 10 [ 458.954236][ T25] usb 3-1: USB disconnect, device number 5 [ 459.049407][ T5695] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 459.098357][T12350] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 459.103929][T12350] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2151'. [ 459.201927][ T5695] usb 4-1: Using ep0 maxpacket: 32 [ 459.223956][T12356] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2154'. [ 459.248369][ T5695] usb 4-1: unable to get BOS descriptor or descriptor too short [ 459.249416][ T5695] usb 4-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=f8.13 [ 459.250515][ T5695] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 459.250545][ T5695] usb 4-1: can't read configurations, error -71 [ 459.336295][T12363] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2157'. [ 459.358558][ T25] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 459.415402][T12367] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2159'. [ 459.415425][T12367] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2159'. [ 459.418696][ T975] usb 1-1: new high-speed USB device number 99 using dummy_hcd [ 459.503276][T12369] input: syz0 as /devices/virtual/input/input37 [ 459.518547][ T25] usb 3-1: Using ep0 maxpacket: 32 [ 459.570177][ T975] usb 1-1: Using ep0 maxpacket: 32 [ 459.571010][ T975] usb 1-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 459.572091][ T975] usb 1-1: config index 0 descriptor too short (expected 19, got 18) [ 459.599409][ T975] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 459.599437][ T975] usb 1-1: Product: syz [ 459.599451][ T975] usb 1-1: Manufacturer: syz [ 459.599465][ T975] usb 1-1: SerialNumber: syz [ 459.607107][ T975] usb 1-1: config 0 descriptor?? [ 459.635330][ T975] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 459.635417][ T975] dvb-usb: bulk message failed: -22 (2/0) [ 459.648393][ T975] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 459.654141][ T975] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 459.654201][ T975] usb 1-1: media controller created [ 459.687573][ T975] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 459.707386][ T975] usb 1-1: selecting invalid altsetting 7 [ 459.707408][ T975] cxusb: set interface failed [ 459.707420][ T975] dvb-usb: bulk message failed: -22 (1/0) [ 459.777381][ T975] DVB: Unable to find symbol lgdt330x_attach() [ 459.777399][ T975] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 459.868611][ T5695] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 459.886164][ T975] rc_core: IR keymap rc-dvico-portable not found [ 459.886184][ T975] Registered IR keymap rc-empty [ 459.887966][ T975] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 459.892958][ T975] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input38 [ 459.899231][ T975] dvb-usb: schedule remote query interval to 100 msecs. [ 459.899252][ T975] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 459.907019][ T975] usb 1-1: USB disconnect, device number 99 [ 460.019853][ T5695] usb 4-1: Using ep0 maxpacket: 16 [ 460.020883][ T5695] usb 4-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 6.00 [ 460.021998][ T5695] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 460.022021][ T5695] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 8 [ 460.026379][ T5695] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 460.026396][ T5695] usb 4-1: Product: syz [ 460.026404][ T5695] usb 4-1: Manufacturer: syz [ 460.026412][ T5695] usb 4-1: SerialNumber: syz [ 460.034993][ T5695] usb 4-1: config 0 descriptor?? [ 460.127749][ T975] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 460.199849][ T25] usb 3-1: unable to get BOS descriptor or descriptor too short [ 460.199900][ T25] usb 3-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=f8.13 [ 460.205152][ T25] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 460.205177][ T25] usb 3-1: can't read configurations, error -71 [ 460.284072][T12385] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 460.286299][T12385] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2164'. [ 460.467621][T12390] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2167'. [ 460.572848][T12393] usb usb7: usbfs: process 12393 (syz.2.2168) did not claim interface 0 before use [ 460.614509][T12400] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 460.614957][T12400] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 460.651209][ T1227] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 460.714316][T12396] mac80211_hwsim hwsim7 syzkaller1: entered promiscuous mode [ 460.714343][T12396] mac80211_hwsim hwsim7 syzkaller1: entered allmulticast mode [ 460.808556][ T1227] usb 5-1: Using ep0 maxpacket: 32 [ 460.884824][ T1227] usb 5-1: unable to get BOS descriptor or descriptor too short [ 460.884877][ T1227] usb 5-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=f8.13 [ 460.885948][ T1227] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 460.885980][ T1227] usb 5-1: can't read configurations, error -71 [ 461.087643][T12421] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 461.369315][ T6590] usb 1-1: new high-speed USB device number 100 using dummy_hcd [ 461.498703][ T6590] usb 1-1: device descriptor read/64, error -71 [ 461.558667][ T1227] usb 5-1: new high-speed USB device number 98 using dummy_hcd [ 461.584549][T12431] fuse: Unknown parameter 'm)BWiyeܙ+ˑI-Dɇ1{1in8w2$5_`@Jdm>tIP07ΖS-o-I8S4/DC ff2/J>5#NTت@t@97ִ̯} [ 461.584549][T12431] 1i|9[ѕ #wKDPPTXj(QrnO' [ 461.709115][ T1227] usb 5-1: Using ep0 maxpacket: 8 [ 461.710987][ T1227] usb 5-1: New USB device found, idVendor=2b73, idProduct=000a, bcdDevice= 0.40 [ 461.712236][ T1227] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 461.712258][ T1227] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 461.718242][ T1227] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 461.718258][ T1227] usb 5-1: Product: syz [ 461.718266][ T1227] usb 5-1: Manufacturer: syz [ 461.718274][ T1227] usb 5-1: SerialNumber: syz [ 461.738651][ T6590] usb 1-1: new high-speed USB device number 101 using dummy_hcd [ 461.908715][ T6590] usb 1-1: device descriptor read/64, error -71 [ 462.018910][ T6590] usb usb1-port1: attempt power cycle [ 462.108652][ T975] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 462.111128][ T1227] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 462.117747][ T1227] usb 5-1: USB disconnect, device number 98 [ 462.176028][ T5634] udevd[5634]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 462.362573][ T6590] usb 1-1: new high-speed USB device number 102 using dummy_hcd [ 462.379297][ T6590] usb 1-1: device descriptor read/8, error -71 [ 462.421193][ T5695] usb 4-1: USB disconnect, device number 3 [ 462.619076][ T6590] usb 1-1: new high-speed USB device number 103 using dummy_hcd [ 462.639459][ T6590] usb 1-1: device descriptor read/8, error -71 [ 462.749111][ T6590] usb usb1-port1: unable to enumerate USB device [ 462.956573][T12460] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 463.133893][T12467] fuse: Unknown parameter 'm)BWiyeܙ+ˑI-Dɇ1{1in8w2$5_`@Jdm>tIP07ΖS-o-I8S4/DC ff2/J>5#NTت@t@97ִ̯} [ 463.133893][T12467] 1i|9[ѕ #wKDPPTXj(QrnO' [ 463.244818][T12465] nvme_rdma: malformed address passed: 172.20.20.24:+ [ 463.354562][T12475] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 463.569164][ T10] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 463.719175][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 463.720058][ T10] usb 3-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 6.00 [ 463.721509][ T10] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 463.721532][ T10] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 8 [ 463.723928][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 463.723977][ T10] usb 3-1: Product: syz [ 463.723991][ T10] usb 3-1: Manufacturer: syz [ 463.724006][ T10] usb 3-1: SerialNumber: syz [ 463.729147][ T10] usb 3-1: config 0 descriptor?? [ 464.048365][T12478] FAULT_INJECTION: forcing a failure. [ 464.048365][T12478] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 464.048401][T12478] CPU: 0 UID: 0 PID: 12478 Comm: syz.3.2195 Tainted: G L syzkaller #0 PREEMPT(full) [ 464.048425][T12478] Tainted: [L]=SOFTLOCKUP [ 464.048432][T12478] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 464.048442][T12478] Call Trace: [ 464.048449][T12478] [ 464.048458][T12478] dump_stack_lvl+0xe8/0x150 [ 464.048489][T12478] should_fail_ex+0x410/0x560 [ 464.048517][T12478] _copy_from_iter+0x1d3/0x1660 [ 464.048542][T12478] ? __alloc_skb+0x27a/0x7a0 [ 464.048569][T12478] ? __alloc_skb+0x27a/0x7a0 [ 464.048595][T12478] ? __alloc_skb+0x27a/0x7a0 [ 464.048619][T12478] ? __pfx__copy_from_iter+0x10/0x10 [ 464.048640][T12478] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 464.048660][T12478] ? __alloc_skb+0x27a/0x7a0 [ 464.048682][T12478] ? __alloc_skb+0x27a/0x7a0 [ 464.048711][T12478] ? netlink_sendmsg+0x650/0xb40 [ 464.048731][T12478] ? skb_put+0x112/0x210 [ 464.048759][T12478] netlink_sendmsg+0x6c0/0xb40 [ 464.048788][T12478] ? __pfx_netlink_sendmsg+0x10/0x10 [ 464.048815][T12478] ? apparmor_socket_sendmsg+0x98/0x360 [ 464.048840][T12478] ? __pfx_netlink_sendmsg+0x10/0x10 [ 464.048859][T12478] sock_sendmsg_nosec+0x13a/0x180 [ 464.048884][T12478] ____sys_sendmsg+0x54e/0x850 [ 464.048917][T12478] ? __pfx_____sys_sendmsg+0x10/0x10 [ 464.048953][T12478] ? import_iovec+0x73/0xa0 [ 464.048981][T12478] ___sys_sendmsg+0x2a5/0x360 [ 464.049006][T12478] ? __lock_acquire+0x747/0x2de0 [ 464.049031][T12478] ? __pfx____sys_sendmsg+0x10/0x10 [ 464.049089][T12478] ? __fget_files+0x2a/0x420 [ 464.049115][T12478] ? __fget_files+0x3a2/0x420 [ 464.049150][T12478] __x64_sys_sendmsg+0x1b1/0x290 [ 464.049181][T12478] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 464.049228][T12478] do_syscall_64+0x166/0x520 [ 464.049253][T12478] ? trace_irq_disable+0x3b/0x140 [ 464.049274][T12478] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 464.049293][T12478] ? clear_bhb_loop+0x70/0xc0 [ 464.049316][T12478] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 464.049335][T12478] RIP: 0033:0x7fc81c39e199 [ 464.049359][T12478] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 464.049376][T12478] RSP: 002b:00007fc81d299028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 464.049398][T12478] RAX: ffffffffffffffda RBX: 00007fc81c625fa0 RCX: 00007fc81c39e199 [ 464.049412][T12478] RDX: 0000000000000000 RSI: 00002000000006c0 RDI: 0000000000000003 [ 464.049425][T12478] RBP: 00007fc81d299090 R08: 0000000000000000 R09: 0000000000000000 [ 464.049437][T12478] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 464.049448][T12478] R13: 00007fc81c626038 R14: 00007fc81c625fa0 R15: 00007fc81c74fa48 [ 464.049478][T12478] [ 464.304095][T12483] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 464.304643][T12483] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 464.419196][ T6590] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 464.570942][ T6590] usb 4-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 464.572602][ T6590] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 464.572648][ T6590] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 464.572670][ T6590] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 464.572691][ T6590] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 464.572751][ T6590] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 465.261626][T12502] [U] M٭Q& K4 [ 465.262261][T12502] [U] [)U}ǔJϬ}NSEF* NZF[F_H'W"X~;VA)^`1C':ZFOB *?۟CZS<8ZNѷјEY TT<$CRƖ/VG {Y~Y5\;ƃZDXYA"XIF{`A$í55?SAMOͻ*K [ 465.262280][T12502] [U] O4 [ 465.262697][T12502] [U] UB+ '~GIރRQ^,(-|ڟ-<6&H.Z9/RJΩˈ+)֭KΦ.NHA#LW#RF7P٪MAX]LN"KM +,GSBHJX̧CQ [ 465.378783][ T10] usb 1-1: new high-speed USB device number 104 using dummy_hcd [ 465.529341][ T10] usb 1-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 465.530472][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 465.530499][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 465.530560][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 465.532780][ T10] usb 1-1: config 0 descriptor?? [ 465.633935][ T6590] [drm] Initialized gud 1.0.0 for 4-1:1.0 on minor 1 [ 465.946000][ T10] hid_parser_main: 231 callbacks suppressed [ 465.946053][ T10] cp2112 0003:10C4:EA90.0041: unknown main item tag 0x0 [ 465.946256][ T10] cp2112 0003:10C4:EA90.0041: unknown main item tag 0x0 [ 465.946307][ T10] cp2112 0003:10C4:EA90.0041: unknown main item tag 0x0 [ 465.946359][ T10] cp2112 0003:10C4:EA90.0041: unknown main item tag 0x0 [ 465.946384][ T10] cp2112 0003:10C4:EA90.0041: unknown main item tag 0x0 [ 465.946411][ T10] cp2112 0003:10C4:EA90.0041: unknown main item tag 0x0 [ 465.946436][ T10] cp2112 0003:10C4:EA90.0041: unknown main item tag 0x0 [ 466.011401][ T10] cp2112 0003:10C4:EA90.0041: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.0-1/input0 [ 466.141967][ T10] cp2112 0003:10C4:EA90.0041: Part Number: 0x00 Device Version: 0x00 [ 466.241184][ T6590] gud 4-1:1.0: Unexpected status OK for failed transfer [ 466.245315][T12510] ip_tables: iptables: counters copy to user failed while replacing table [ 466.324777][ T975] usb 3-1: USB disconnect, device number 8 [ 466.453578][T12514] FAULT_INJECTION: forcing a failure. [ 466.453578][T12514] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 466.463041][T12514] CPU: 0 UID: 0 PID: 12514 Comm: syz.4.2208 Tainted: G L syzkaller #0 PREEMPT(full) [ 466.463071][T12514] Tainted: [L]=SOFTLOCKUP [ 466.463079][T12514] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 466.463091][T12514] Call Trace: [ 466.463101][T12514] [ 466.463111][T12514] dump_stack_lvl+0xe8/0x150 [ 466.463144][T12514] should_fail_ex+0x410/0x560 [ 466.463173][T12514] _copy_from_iter+0x1d3/0x1660 [ 466.463196][T12514] ? __alloc_skb+0x27a/0x7a0 [ 466.463222][T12514] ? __alloc_skb+0x27a/0x7a0 [ 466.463243][T12514] ? __alloc_skb+0x27a/0x7a0 [ 466.463265][T12514] ? __pfx__copy_from_iter+0x10/0x10 [ 466.463284][T12514] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 466.463302][T12514] ? __alloc_skb+0x27a/0x7a0 [ 466.463322][T12514] ? __alloc_skb+0x27a/0x7a0 [ 466.463348][T12514] ? netlink_sendmsg+0x650/0xb40 [ 466.463367][T12514] ? skb_put+0x112/0x210 [ 466.463394][T12514] netlink_sendmsg+0x6c0/0xb40 [ 466.463422][T12514] ? __pfx_netlink_sendmsg+0x10/0x10 [ 466.463445][T12514] ? apparmor_socket_sendmsg+0x98/0x360 [ 466.463468][T12514] ? __pfx_netlink_sendmsg+0x10/0x10 [ 466.463485][T12514] sock_sendmsg_nosec+0x13a/0x180 [ 466.463509][T12514] ____sys_sendmsg+0x54e/0x850 [ 466.463540][T12514] ? __pfx_____sys_sendmsg+0x10/0x10 [ 466.463570][T12514] ? import_iovec+0x73/0xa0 [ 466.463596][T12514] ___sys_sendmsg+0x2a5/0x360 [ 466.463623][T12514] ? __lock_acquire+0x747/0x2de0 [ 466.463656][T12514] ? __pfx____sys_sendmsg+0x10/0x10 [ 466.463716][T12514] ? __fget_files+0x2a/0x420 [ 466.463740][T12514] ? __fget_files+0x3a2/0x420 [ 466.463774][T12514] __x64_sys_sendmsg+0x1b1/0x290 [ 466.463805][T12514] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 466.463853][T12514] do_syscall_64+0x166/0x520 [ 466.463880][T12514] ? trace_irq_disable+0x3b/0x140 [ 466.463901][T12514] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 466.463920][T12514] ? clear_bhb_loop+0x70/0xc0 [ 466.463943][T12514] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 466.463963][T12514] RIP: 0033:0x7fea6499e199 [ 466.463981][T12514] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 466.463997][T12514] RSP: 002b:00007fea62bf6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 466.464017][T12514] RAX: ffffffffffffffda RBX: 00007fea64c25fa0 RCX: 00007fea6499e199 [ 466.464031][T12514] RDX: 0000000004048010 RSI: 0000200000000000 RDI: 0000000000000003 [ 466.464044][T12514] RBP: 00007fea62bf6090 R08: 0000000000000000 R09: 0000000000000000 [ 466.464056][T12514] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 466.464067][T12514] R13: 00007fea64c26038 R14: 00007fea64c25fa0 R15: 00007fea64d4fa48 [ 466.464097][T12514] [ 466.465100][ T6590] gud 4-1:1.0: [drm] Cannot find any crtc or sizes [ 466.487741][ T6590] usb 4-1: USB disconnect, device number 4 [ 466.534657][ T30] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 466.754003][ T30] usb 2-1: Using ep0 maxpacket: 8 [ 466.775995][T12518] FAULT_INJECTION: forcing a failure. [ 466.775995][T12518] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 466.776031][T12518] CPU: 0 UID: 0 PID: 12518 Comm: syz.2.2209 Tainted: G L syzkaller #0 PREEMPT(full) [ 466.776056][T12518] Tainted: [L]=SOFTLOCKUP [ 466.776063][T12518] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 466.776074][T12518] Call Trace: [ 466.776082][T12518] [ 466.776090][T12518] dump_stack_lvl+0xe8/0x150 [ 466.776126][T12518] should_fail_ex+0x410/0x560 [ 466.776155][T12518] _copy_from_iter+0x1d3/0x1660 [ 466.776190][T12518] ? __pfx__copy_from_iter+0x10/0x10 [ 466.776212][T12518] ? alloc_pages_noprof+0x140/0x2b0 [ 466.776240][T12518] ? skb_page_frag_refill+0x119/0x460 [ 466.776265][T12518] tcp_sendmsg_locked+0x20cf/0x5400 [ 466.776422][T12518] ? __pfx_tcp_sendmsg_locked+0x10/0x10 [ 466.776454][T12518] ? tcp_sendmsg+0x21/0x50 [ 466.776480][T12518] ? __local_bh_enable_ip+0xd6/0x140 [ 466.776508][T12518] tcp_sendmsg+0x2f/0x50 [ 466.776532][T12518] ? __pfx_inet_sendmsg+0x10/0x10 [ 466.776560][T12518] sock_sendmsg_nosec+0x10e/0x180 [ 466.776585][T12518] __sys_sendto+0x408/0x5a0 [ 466.776610][T12518] ? ksys_write+0x1e6/0x270 [ 466.776631][T12518] ? __pfx___sys_sendto+0x10/0x10 [ 466.776654][T12518] ? __mutex_unlock_slowpath+0x731/0x900 [ 466.776707][T12518] ? __pfx_ksys_write+0x10/0x10 [ 466.776731][T12518] __x64_sys_sendto+0xde/0x100 [ 466.776758][T12518] do_syscall_64+0x166/0x520 [ 466.776784][T12518] ? trace_irq_disable+0x3b/0x140 [ 466.776803][T12518] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 466.776822][T12518] ? clear_bhb_loop+0x70/0xc0 [ 466.776844][T12518] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 466.776862][T12518] RIP: 0033:0x7fc27c19e199 [ 466.776880][T12518] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 466.776896][T12518] RSP: 002b:00007fc27a3f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 466.776916][T12518] RAX: ffffffffffffffda RBX: 00007fc27c425fa0 RCX: 00007fc27c19e199 [ 466.776930][T12518] RDX: 0000000000000032 RSI: 0000200000000500 RDI: 0000000000000003 [ 466.776943][T12518] RBP: 00007fc27a3f6090 R08: 0000000000000000 R09: 0000000000000000 [ 466.776955][T12518] R10: 0000000000004885 R11: 0000000000000246 R12: 0000000000000001 [ 466.776966][T12518] R13: 00007fc27c426038 R14: 00007fc27c425fa0 R15: 00007fc27c54fa48 [ 466.776996][T12518] [ 466.879045][ T975] usb 5-1: new high-speed USB device number 99 using dummy_hcd [ 466.888657][ T30] usb 2-1: unable to get BOS descriptor or descriptor too short [ 466.888708][ T30] usb 2-1: New USB device found, idVendor=2c42, idProduct=16f8, bcdDevice=5d.24 [ 466.923872][ T30] usb 2-1: config 117 has an invalid interface number: 163 but max is 0 [ 466.923899][ T30] usb 2-1: config 117 has no interface number 0 [ 466.923928][ T30] usb 2-1: config 117 interface 163 has no altsetting 0 [ 467.018790][ T30] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 467.018817][ T30] usb 2-1: Product: syz [ 467.018832][ T30] usb 2-1: Manufacturer: syz [ 467.018845][ T30] usb 2-1: SerialNumber: syz [ 467.032224][ T975] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 467.033938][ T975] usb 5-1: config 1 interface 0 altsetting 4 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 467.033968][ T975] usb 5-1: config 1 interface 0 has no altsetting 0 [ 467.040740][ T975] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 467.040765][ T975] usb 5-1: SerialNumber: syz [ 467.116869][T12523] cp2112 0003:10C4:EA90.0041: Error starting transaction: -38 [ 467.242222][ T6590] usb 1-1: reset high-speed USB device number 104 using dummy_hcd [ 467.281204][ T975] cdc_ether 5-1:1.0: probe with driver cdc_ether failed with error -22 [ 467.440452][T12533] [U] M٭Q& K4 [ 467.441219][T12533] [U] [)U}ǔJϬ}NSEF* NZF[F_H'W"X~;VA)^`1C':ZFOB *?۟CZS<8ZNѷјEY TT<$CRƖ/VG {Y~Y5\;ƃZDXYA"XIF{`A$í55?SAMOͻ*K [ 467.441278][T12533] [U] O4 [ 467.441639][T12533] [U] UB+ '~GIރRQ^,(-|ڟ-<6&H.Z9/RJΩˈ+)֭KΦ.NHA#LW#RF7P٪MAX]LN"KM +,GSBHJX̧CQ [ 467.499523][ T975] usb 5-1: USB disconnect, device number 99 [ 467.577022][ T30] f81534a_ctrl 2-1:117.163: probe with driver f81534a_ctrl failed with error -71 [ 467.593297][ T30] usb 2-1: USB disconnect, device number 12 [ 467.918677][ T5695] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 467.944468][T12545] __nla_validate_parse: 1 callbacks suppressed [ 467.944481][T12545] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2220'. [ 468.068572][ T5695] usb 4-1: Using ep0 maxpacket: 16 [ 468.072460][ T5695] usb 4-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 6.00 [ 468.073881][ T5695] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 468.073905][ T5695] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 8 [ 468.078392][ T5695] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 468.078416][ T5695] usb 4-1: Product: syz [ 468.080342][ T5695] usb 4-1: Manufacturer: syz [ 468.080359][ T5695] usb 4-1: SerialNumber: syz [ 468.087887][ T5695] usb 4-1: config 0 descriptor?? [ 468.252361][ T10] usb 1-1: USB disconnect, device number 104 [ 468.297904][T12557] [U] M٭Q& K4 [ 468.298337][T12557] [U] [)U}ǔJϬ}NSEF* NZF[F_H'W"X~;VA)^`1C':ZFOB *?۟CZS<8ZNѷјEY TT<$CRƖ/VG {Y~Y5\;ƃZDXYA"XIF{`A$í55?SAMOͻ*K [ 468.298356][T12557] [U] O4 [ 468.298822][T12557] [U] UB+ '~GIރRQ^,(-|ڟ-<6&H.Z9/RJΩˈ+)֭KΦ.NHA#LW#RF7P٪MAX]LN"KM +,GSBHJX̧CQ [ 468.399048][ T5695] usb 5-1: new high-speed USB device number 100 using dummy_hcd [ 468.515063][T12564] FAULT_INJECTION: forcing a failure. [ 468.515063][T12564] name failslab, interval 1, probability 0, space 0, times 0 [ 468.515097][T12564] CPU: 1 UID: 0 PID: 12564 Comm: syz.2.2227 Tainted: G L syzkaller #0 PREEMPT(full) [ 468.515123][T12564] Tainted: [L]=SOFTLOCKUP [ 468.515130][T12564] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 468.515141][T12564] Call Trace: [ 468.515150][T12564] [ 468.515158][T12564] dump_stack_lvl+0xe8/0x150 [ 468.515190][T12564] should_fail_ex+0x410/0x560 [ 468.515219][T12564] should_failslab+0xa8/0x100 [ 468.515244][T12564] ? skb_clone+0x212/0x3a0 [ 468.515263][T12564] kmem_cache_alloc_noprof+0xa1/0x600 [ 468.515283][T12564] ? skb_clone+0x212/0x3a0 [ 468.515315][T12564] skb_clone+0x212/0x3a0 [ 468.515337][T12564] __netlink_deliver_tap+0x413/0x860 [ 468.515369][T12564] ? netlink_deliver_tap+0x2e/0x1b0 [ 468.515391][T12564] netlink_deliver_tap+0x19c/0x1b0 [ 468.515413][T12564] netlink_unicast+0x781/0x940 [ 468.515442][T12564] netlink_sendmsg+0x813/0xb40 [ 468.515471][T12564] ? __pfx_netlink_sendmsg+0x10/0x10 [ 468.515499][T12564] ? apparmor_socket_sendmsg+0x98/0x360 [ 468.515524][T12564] ? __pfx_netlink_sendmsg+0x10/0x10 [ 468.515544][T12564] sock_sendmsg_nosec+0x13a/0x180 [ 468.515569][T12564] ____sys_sendmsg+0x54e/0x850 [ 468.515601][T12564] ? __pfx_____sys_sendmsg+0x10/0x10 [ 468.515638][T12564] ? import_iovec+0x73/0xa0 [ 468.515667][T12564] ___sys_sendmsg+0x2a5/0x360 [ 468.515694][T12564] ? __lock_acquire+0x747/0x2de0 [ 468.515717][T12564] ? __pfx____sys_sendmsg+0x10/0x10 [ 468.515776][T12564] ? __fget_files+0x2a/0x420 [ 468.515803][T12564] ? __fget_files+0x3a2/0x420 [ 468.515838][T12564] __x64_sys_sendmsg+0x1b1/0x290 [ 468.515870][T12564] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 468.515916][T12564] do_syscall_64+0x166/0x520 [ 468.515943][T12564] ? trace_irq_disable+0x3b/0x140 [ 468.515963][T12564] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 468.515982][T12564] ? clear_bhb_loop+0x70/0xc0 [ 468.516005][T12564] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 468.516024][T12564] RIP: 0033:0x7fc27c19e199 [ 468.516042][T12564] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 468.516058][T12564] RSP: 002b:00007fc27a3f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 468.516078][T12564] RAX: ffffffffffffffda RBX: 00007fc27c425fa0 RCX: 00007fc27c19e199 [ 468.516093][T12564] RDX: 0000000002000000 RSI: 0000200000000280 RDI: 0000000000000003 [ 468.516108][T12564] RBP: 00007fc27a3f6090 R08: 0000000000000000 R09: 0000000000000000 [ 468.516119][T12564] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 468.516131][T12564] R13: 00007fc27c426038 R14: 00007fc27c425fa0 R15: 00007fc27c54fa48 [ 468.516161][T12564] [ 468.548745][ T5695] usb 5-1: Using ep0 maxpacket: 16 [ 468.549491][ T5695] usb 5-1: New USB device found, idVendor=0471, idProduct=0327, bcdDevice=61.a4 [ 468.550736][ T5695] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 468.582236][ T5695] usb 5-1: config 0 descriptor?? [ 468.595467][ T5695] gspca_main: sonixj-2.14.0 probing 0471:0327 [ 468.684344][T12565] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 468.684863][T12565] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 468.914362][T12571] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2229'. [ 469.096617][T12574] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2230'. [ 469.096652][T12574] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2230'. [ 469.167910][T12576] fuse: Unknown parameter 'm)BWiyeܙ+ˑI-Dɇ1{1in8w2$5_`@Jdm>tIP07ΖS-o-I8S4/DC ff2/J>5#NTت@t@97ִ̯} [ 469.167910][T12576] 1i|9[ѕ #wKDPPTXj(QrnO' [ 469.510950][ T5695] gspca_sonixj: reg_w1 err -71 [ 469.511004][ T5695] sonixj 5-1:0.0: probe with driver sonixj failed with error -71 [ 469.514391][ T5695] usb 5-1: USB disconnect, device number 100 [ 469.610313][T12585] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2234'. [ 469.627953][ T30] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 469.713597][T12587] ip_tables: iptables: counters copy to user failed while replacing table [ 469.789872][ T30] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 469.809479][ T30] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 469.809511][ T30] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 469.809532][ T30] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 469.809572][ T30] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 469.813436][ T30] usb 2-1: config 0 descriptor?? [ 469.968609][ T5695] usb 1-1: new high-speed USB device number 105 using dummy_hcd [ 470.119124][ T5695] usb 1-1: Using ep0 maxpacket: 8 [ 470.126683][ T5695] usb 1-1: unable to get BOS descriptor or descriptor too short [ 470.126734][ T5695] usb 1-1: New USB device found, idVendor=2c42, idProduct=16f8, bcdDevice=5d.24 [ 470.128668][ T5695] usb 1-1: config 117 has an invalid interface number: 163 but max is 0 [ 470.128691][ T5695] usb 1-1: config 117 has no interface number 0 [ 470.128719][ T5695] usb 1-1: config 117 interface 163 has no altsetting 0 [ 470.133829][ T5695] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 470.133856][ T5695] usb 1-1: Product: syz [ 470.133869][ T5695] usb 1-1: Manufacturer: syz [ 470.133883][ T5695] usb 1-1: SerialNumber: syz [ 470.408639][ T10] usb 5-1: new high-speed USB device number 101 using dummy_hcd [ 470.529768][T12591] l2tp_ppp: sess 2/0: no socket in recv [ 470.529842][T12591] FAULT_INJECTION: forcing a failure. [ 470.529842][T12591] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 470.529870][T12591] CPU: 0 UID: 0 PID: 12591 Comm: syz.2.2237 Tainted: G L syzkaller #0 PREEMPT(full) [ 470.529895][T12591] Tainted: [L]=SOFTLOCKUP [ 470.529902][T12591] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 470.529914][T12591] Call Trace: [ 470.529921][T12591] [ 470.529930][T12591] dump_stack_lvl+0xe8/0x150 [ 470.529953][T12591] should_fail_ex+0x410/0x560 [ 470.529969][T12591] _copy_to_user+0x31/0xb0 [ 470.529985][T12591] simple_read_from_buffer+0xe1/0x170 [ 470.530017][T12591] proc_fail_nth_read+0x1bb/0x230 [ 470.530037][T12591] ? common_file_perm+0x20e/0x2b0 [ 470.530066][T12591] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 470.530086][T12591] ? rw_verify_area+0x24a/0x4c0 [ 470.530096][T12591] ? tun_chr_write_iter+0x18a/0x200 [ 470.530110][T12591] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 470.530120][T12591] vfs_read+0x213/0xa80 [ 470.530133][T12591] ? __pfx___mutex_lock+0x10/0x10 [ 470.530156][T12591] ? __pfx_vfs_read+0x10/0x10 [ 470.530176][T12591] ? __fget_files+0x2a/0x420 [ 470.530208][T12591] ? __fget_files+0x3a2/0x420 [ 470.530233][T12591] ? __fget_files+0x2a/0x420 [ 470.530251][T12591] ksys_read+0x150/0x270 [ 470.530265][T12591] ? __pfx_ksys_read+0x10/0x10 [ 470.530280][T12591] do_syscall_64+0x166/0x520 [ 470.530296][T12591] ? trace_irq_disable+0x3b/0x140 [ 470.530315][T12591] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 470.530335][T12591] ? clear_bhb_loop+0x70/0xc0 [ 470.530358][T12591] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 470.530377][T12591] RIP: 0033:0x7fc27c15e9ce [ 470.530390][T12591] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 470.530398][T12591] RSP: 002b:00007fc27a3f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 470.530410][T12591] RAX: ffffffffffffffda RBX: 00007fc27a3f66c0 RCX: 00007fc27c15e9ce [ 470.530418][T12591] RDX: 000000000000000f RSI: 00007fc27a3f60a0 RDI: 0000000000000006 [ 470.530424][T12591] RBP: 00007fc27a3f6090 R08: 0000000000000000 R09: 0000000000000000 [ 470.530431][T12591] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 470.530437][T12591] R13: 00007fc27c426038 R14: 00007fc27c425fa0 R15: 00007fc27c54fa48 [ 470.530464][T12591] [ 470.539091][ T10] usb 5-1: device descriptor read/64, error -71 [ 470.572049][ T5695] f81534a_ctrl 1-1:117.163: probe with driver f81534a_ctrl failed with error -71 [ 470.596135][ T5695] usb 1-1: USB disconnect, device number 105 [ 470.778617][ T10] usb 5-1: new high-speed USB device number 102 using dummy_hcd [ 470.820935][ T30] usbhid 2-1:0.0: can't add hid device: -71 [ 470.821033][ T30] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 470.822843][ T5695] usb 4-1: USB disconnect, device number 5 [ 470.852069][ T30] usb 2-1: USB disconnect, device number 13 [ 470.908877][ T10] usb 5-1: device descriptor read/64, error -71 [ 471.020920][ T10] usb usb5-port1: attempt power cycle [ 471.039569][T12602] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2242'. [ 471.039606][T12602] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2242'. [ 471.200376][T12609] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2244'. [ 471.200414][T12609] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2244'. [ 471.239219][ T5695] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 471.359026][ T10] usb 5-1: new high-speed USB device number 103 using dummy_hcd [ 471.380552][ T10] usb 5-1: device descriptor read/8, error -71 [ 471.388640][ T5695] usb 4-1: Using ep0 maxpacket: 16 [ 471.389774][ T5695] usb 4-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 471.390821][ T5695] usb 4-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 471.390848][ T5695] usb 4-1: config 0 interface 0 altsetting 64 endpoint 0x81 has invalid wMaxPacketSize 0 [ 471.390868][ T5695] usb 4-1: config 0 interface 0 has no altsetting 0 [ 471.390898][ T5695] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 471.393784][ T5695] usb 4-1: config 0 descriptor?? [ 471.418575][ T975] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 471.570873][ T975] usb 3-1: Using ep0 maxpacket: 16 [ 471.572665][ T975] usb 3-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 6.00 [ 471.573957][ T975] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 8 [ 471.577087][ T975] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 471.577112][ T975] usb 3-1: Product: syz [ 471.577149][ T975] usb 3-1: Manufacturer: syz [ 471.577158][ T975] usb 3-1: SerialNumber: syz [ 471.619872][ T10] usb 5-1: new high-speed USB device number 104 using dummy_hcd [ 471.639638][ T10] usb 5-1: device descriptor read/8, error -71 [ 471.641429][ T975] usb 3-1: config 0 descriptor?? [ 471.749167][ T10] usb usb5-port1: unable to enumerate USB device [ 471.804929][ T5695] usbhid 4-1:0.0: can't add hid device: -71 [ 471.805029][ T5695] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 471.882672][ T5695] usb 4-1: USB disconnect, device number 6 [ 472.042078][T12627] ip6gre2: entered promiscuous mode [ 472.042095][T12627] ip6gre2: entered allmulticast mode [ 472.062475][ T975] usb 3-1: USB disconnect, device number 9 [ 472.209393][T12632] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 472.396422][T12634] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2253'. [ 472.604962][T12638] ip_tables: iptables: counters copy to user failed while replacing table [ 472.679892][ T5695] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 472.767268][ T31] audit: type=1804 audit(1791387850.132:550): pid=12642 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.2257" name="bus" dev="ramfs" ino=56313 res=1 errno=0 [ 472.812495][ T31] audit: type=1804 audit(1791387850.172:551): pid=12642 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.2257" name="bus" dev="ramfs" ino=56313 res=1 errno=0 [ 472.859564][ T10] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 472.872709][ T5695] usb 4-1: Using ep0 maxpacket: 32 [ 472.877117][ T5695] usb 4-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 472.885248][ T5695] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 472.885273][ T5695] usb 4-1: config 0 has no interface number 0 [ 472.908972][ T5695] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 472.909000][ T5695] usb 4-1: Product: syz [ 472.909013][ T5695] usb 4-1: Manufacturer: syz [ 472.909027][ T5695] usb 4-1: SerialNumber: syz [ 472.921742][ T5695] usb 4-1: config 0 descriptor?? [ 472.935121][ T5695] usb 4-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 472.935148][ T5695] usb 4-1: selecting invalid altsetting 1 [ 472.935162][ T5695] usb 4-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 472.964039][ T5695] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 472.967076][ T5695] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 472.967111][ T5695] usb 4-1: media controller created [ 473.011149][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 473.025776][ T10] usb 3-1: unable to get BOS descriptor or descriptor too short [ 473.025827][ T10] usb 3-1: New USB device found, idVendor=2c42, idProduct=16f8, bcdDevice=5d.24 [ 473.028001][ T10] usb 3-1: config 117 has an invalid interface number: 163 but max is 0 [ 473.028024][ T10] usb 3-1: config 117 has no interface number 0 [ 473.028052][ T10] usb 3-1: config 117 interface 163 has no altsetting 0 [ 473.041900][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 473.041927][ T10] usb 3-1: Product: syz [ 473.041940][ T10] usb 3-1: Manufacturer: syz [ 473.041954][ T10] usb 3-1: SerialNumber: syz [ 473.111659][ T5695] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 473.404443][T12636] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 473.406552][T12636] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 473.522392][ T10] f81534a_ctrl 3-1:117.163: probe with driver f81534a_ctrl failed with error -71 [ 473.547079][ T10] usb 3-1: USB disconnect, device number 10 [ 473.645135][ T30] usb 4-1: USB disconnect, device number 7 [ 473.851017][T12650] nvme_fc: nvme_fc_parse_traddr: bad traddr string [ 474.091007][ T30] usb 5-1: new high-speed USB device number 105 using dummy_hcd [ 474.249166][ T30] usb 5-1: Using ep0 maxpacket: 8 [ 474.249893][ T30] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 474.251698][ T30] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 474.251826][ T30] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 474.251848][ T30] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 474.251870][ T30] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 474.251892][ T30] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 474.251931][ T30] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 474.308151][ T25] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 474.370185][T12662] __nla_validate_parse: 2 callbacks suppressed [ 474.370231][T12662] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2264'. [ 474.370256][T12662] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2264'. [ 474.536849][ T30] usb 5-1: usb_control_msg returned -32 [ 474.536897][ T30] usbtmc 5-1:16.0: can't read capabilities [ 474.889991][T12669] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2267'. [ 474.983138][T12672] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2268'. [ 474.983206][T12672] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2268'. [ 475.119552][ T6590] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 475.274679][ T6590] usb 3-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 475.279978][ T6590] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 475.290765][ T6590] usb 3-1: config 0 descriptor?? [ 475.514699][ T6590] udl 3-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 475.625936][ T10] usb 5-1: USB disconnect, device number 105 [ 476.288060][T12693] [U] M٭Q& K4 [ 476.296152][T12693] [U] [)U}ǔJϬ}NSEF* NZF[F_H'W"X~;VA)^`1C':ZFOB *?۟CZS<8ZNѷјEY TT<$CRƖ/VG {Y~Y5\;ƃZDXYA"XIF{`A$í55?SAMOͻ*K [ 476.296213][T12693] [U] O4 [ 476.308683][T12693] [U] UB+ '~GIރRQ^,(-|ڟ-<6&H.Z9/RJΩˈ+)֭KΦ.NHA#LW#RF7P٪MAX]LN"KM +,GSBHJX̧CQ [ 476.425857][T12693] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1006300934 (16100814944 ns) > initial count (1516955264 ns). Using initial count to start timer. [ 476.921136][ T31] audit: type=1800 audit(1791387854.292:552): pid=12654 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2261" name="cgroup.freeze" dev="ramfs" ino=58381 res=0 errno=0 [ 477.090615][T12710] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2282'. [ 477.090699][T12710] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2282'. [ 477.134593][ T31] audit: type=1800 audit(1791387854.502:553): pid=12657 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2262" name="cgroup.freeze" dev="ramfs" ino=58397 res=0 errno=0 [ 477.253715][ T6590] [drm:udl_init] *ERROR* Selecting channel failed [ 477.411375][ T6590] [drm] Initialized udl 0.0.1 for 3-1:0.0 on minor 1 [ 477.411400][ T6590] [drm] Initialized udl on minor 1 [ 477.414264][ T6590] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 477.480145][ T6590] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 477.519756][ T6590] usb 3-1: USB disconnect, device number 11 [ 477.840384][T12722] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2287'. [ 477.840432][T12722] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2287'. [ 478.045226][T12726] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2290'. [ 478.117589][T12730] [U] M٭Q& K4 [ 478.118956][ T6590] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 478.132856][T12730] [U] [)U}ǔJϬ}NSEF* NZF[F_H'W"X~;VA)^`1C':ZFOB *?۟CZS<8ZNѷјEY TT<$CRƖ/VG {Y~Y5\;ƃZDXYA"XIF{`A$í55?SAMOͻ*K [ 478.132896][T12730] [U] O4 [ 478.133569][T12730] [U] UB+ '~GIރRQ^,(-|ڟ-<6&H.Z9/RJΩˈ+)֭KΦ.NHA#LW#RF7P٪MAX]LN"KM +,GSBHJX̧CQ [ 478.220383][T12730] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1006300934 (16100814944 ns) > initial count (1516955264 ns). Using initial count to start timer. [ 478.285761][ T6590] usb 3-1: Using ep0 maxpacket: 16 [ 478.286371][ T6590] usb 3-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 478.290642][ T5695] usb 5-1: new high-speed USB device number 106 using dummy_hcd [ 478.308103][ T6590] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 478.308157][ T6590] usb 3-1: Product: syz [ 478.308172][ T6590] usb 3-1: Manufacturer: syz [ 478.308185][ T6590] usb 3-1: SerialNumber: syz [ 478.348851][ T31] audit: type=1804 audit(1791387855.712:554): pid=12736 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.2293" name="bus" dev="ramfs" ino=58768 res=1 errno=0 [ 478.385407][ T31] audit: type=1804 audit(1791387855.752:555): pid=12736 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.2293" name="bus" dev="ramfs" ino=58768 res=1 errno=0 [ 478.440947][ T5695] usb 5-1: New USB device found, idVendor=0846, idProduct=1001, bcdDevice= 1.00 [ 478.446043][ T5695] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 478.446078][ T5695] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 478.479785][ T5695] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 478.479846][ T5695] usb 5-1: Product: syz [ 478.479860][ T5695] usb 5-1: Manufacturer: syz [ 478.479874][ T5695] usb 5-1: SerialNumber: syz [ 478.536331][ T6590] usb 3-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 478.551027][ T6590] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 478.551290][ T6590] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 478.551336][ T6590] usb 3-1: media controller created [ 478.587129][ T6590] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 478.678625][ T10] usb 1-1: new high-speed USB device number 106 using dummy_hcd [ 478.746458][ T5695] kaweth 5-1:1.0: Firmware present in device. [ 478.762125][T12724] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 478.762435][T12724] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 478.829660][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 478.861662][ T6590] zl10353_read_register: readreg error (reg=127, ret==-110) [ 478.910491][ T10] usb 1-1: unable to get BOS descriptor or descriptor too short [ 478.910542][ T10] usb 1-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=f8.13 [ 478.912642][ T10] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 478.912665][ T10] usb 1-1: can't read configurations, error -71 [ 478.939682][ T5695] kaweth 5-1:1.0: Statistics collection: 0 [ 478.939703][ T5695] kaweth 5-1:1.0: Multicast filter limit: 0 [ 478.939717][ T5695] kaweth 5-1:1.0: MTU: 0 [ 478.939729][ T5695] kaweth 5-1:1.0: Read MAC address 00:00:00:00:00:00 [ 479.021375][ T6590] dvb_usb_gl861 3-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 479.047778][ T6590] usb 3-1: USB disconnect, device number 12 [ 479.169759][ T5695] kaweth 5-1:1.0: probe with driver kaweth failed with error -5 [ 479.194955][ T5695] usb 5-1: USB disconnect, device number 106 [ 479.569447][T12750] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2299'. [ 479.569480][T12750] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2299'. [ 479.772735][T12761] [U] M٭Q& K4 [ 479.773558][T12761] [U] [)U}ǔJϬ}NSEF* NZF[F_H'W"X~;VA)^`1C':ZFOB *?۟CZS<8ZNѷјEY TT<$CRƖ/VG {Y~Y5\;ƃZDXYA"XIF{`A$í55?SAMOͻ*K [ 479.773592][T12761] [U] O4 [ 479.774036][T12761] [U] UB+ '~GIރRQ^,(-|ڟ-<6&H.Z9/RJΩˈ+)֭KΦ.NHA#LW#RF7P٪MAX]LN"KM +,GSBHJX̧CQ [ 479.879768][ T25] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 480.029212][ T25] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 480.032272][ T25] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 480.032325][ T25] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 480.036587][ T25] usb 2-1: config 0 descriptor?? [ 480.091065][ T25] pwc: Askey VC010 type 2 USB webcam detected. [ 480.198983][ T30] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 480.251013][T12776] FAULT_INJECTION: forcing a failure. [ 480.251013][T12776] name failslab, interval 1, probability 0, space 0, times 0 [ 480.251048][T12776] CPU: 0 UID: 0 PID: 12776 Comm: syz.4.2310 Tainted: G L syzkaller #0 PREEMPT(full) [ 480.251070][T12776] Tainted: [L]=SOFTLOCKUP [ 480.251074][T12776] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 480.251080][T12776] Call Trace: [ 480.251086][T12776] [ 480.251091][T12776] dump_stack_lvl+0xe8/0x150 [ 480.251111][T12776] should_fail_ex+0x410/0x560 [ 480.251131][T12776] should_failslab+0xa8/0x100 [ 480.251156][T12776] ? skb_clone+0x212/0x3a0 [ 480.251176][T12776] kmem_cache_alloc_noprof+0xa1/0x600 [ 480.251199][T12776] ? skb_clone+0x212/0x3a0 [ 480.251221][T12776] skb_clone+0x212/0x3a0 [ 480.251230][T12776] ? ip_rcv_core+0x126/0xd50 [ 480.251248][T12776] ip_rcv_core+0x148/0xd50 [ 480.251266][T12776] ip_rcv+0x4d/0x90 [ 480.251283][T12776] __netif_receive_skb_core+0x2878/0x30c0 [ 480.251383][T12776] ? __lock_acquire+0x747/0x2de0 [ 480.251400][T12776] ? __pfx___netif_receive_skb_core+0x10/0x10 [ 480.251412][T12776] ? __kasan_slab_alloc+0x6c/0x80 [ 480.251424][T12776] ? kmem_cache_alloc_noprof+0x2b9/0x600 [ 480.251444][T12776] ? __build_skb+0x62/0x440 [ 480.251467][T12776] ? build_skb+0x23/0x180 [ 480.251489][T12776] ? tun_get_user+0x1c6d/0x44d0 [ 480.251511][T12776] ? tun_chr_write_iter+0x113/0x200 [ 480.251526][T12776] ? vfs_write+0x612/0xba0 [ 480.251536][T12776] ? ksys_write+0x150/0x270 [ 480.251544][T12776] ? do_syscall_64+0x166/0x520 [ 480.251559][T12776] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 480.251580][T12776] ? netif_receive_skb+0x102/0xbf0 [ 480.251601][T12776] ? netif_receive_skb+0x102/0xbf0 [ 480.251624][T12776] netif_receive_skb+0x1fe/0xbf0 [ 480.251653][T12776] ? __pfx_netif_receive_skb+0x10/0x10 [ 480.251675][T12776] ? rcu_is_watching+0x16/0xb0 [ 480.251695][T12776] ? tun_rx_batched+0x185/0x790 [ 480.251716][T12776] tun_rx_batched+0x1de/0x790 [ 480.251742][T12776] ? __pfx_tun_rx_batched+0x10/0x10 [ 480.251766][T12776] ? lock_acquire+0x115/0x350 [ 480.251793][T12776] ? tun_get_user+0x23ba/0x44d0 [ 480.251814][T12776] ? __local_bh_enable_ip+0xd6/0x140 [ 480.251828][T12776] ? tun_get_user+0x27b0/0x44d0 [ 480.251841][T12776] tun_get_user+0x2be0/0x44d0 [ 480.251866][T12776] ? tun_get_user+0x27b0/0x44d0 [ 480.251887][T12776] ? aa_file_perm+0x4ed/0x15f0 [ 480.251916][T12776] ? __pfx_tun_get_user+0x10/0x10 [ 480.251941][T12776] ? __lock_acquire+0x747/0x2de0 [ 480.251970][T12776] ? ref_tracker_alloc+0x341/0x4b0 [ 480.251983][T12776] ? lock_acquire+0x115/0x350 [ 480.251994][T12776] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 480.252008][T12776] ? lock_acquire+0x115/0x350 [ 480.252018][T12776] ? tun_get+0x1c/0x2f0 [ 480.252040][T12776] ? tun_get+0x1c/0x2f0 [ 480.252061][T12776] ? tun_get+0x1c/0x2f0 [ 480.252088][T12776] tun_chr_write_iter+0x113/0x200 [ 480.252114][T12776] vfs_write+0x612/0xba0 [ 480.252129][T12776] ? __pfx_vfs_write+0x10/0x10 [ 480.252143][T12776] ? __fget_files+0x2a/0x420 [ 480.252162][T12776] ksys_write+0x150/0x270 [ 480.252173][T12776] ? __pfx_ksys_write+0x10/0x10 [ 480.252201][T12776] do_syscall_64+0x166/0x520 [ 480.252227][T12776] ? trace_irq_disable+0x3b/0x140 [ 480.252247][T12776] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 480.252265][T12776] ? clear_bhb_loop+0x70/0xc0 [ 480.252277][T12776] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 480.252288][T12776] RIP: 0033:0x7fea6495e9ce [ 480.252299][T12776] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 480.252307][T12776] RSP: 002b:00007fea62bf5fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 480.252320][T12776] RAX: ffffffffffffffda RBX: 00007fea62bf66c0 RCX: 00007fea6495e9ce [ 480.252331][T12776] RDX: 000000000000006a RSI: 00002000000001c0 RDI: 00000000000000c8 [ 480.252343][T12776] RBP: 00007fea62bf6090 R08: 0000000000000000 R09: 0000000000000000 [ 480.252354][T12776] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 480.252365][T12776] R13: 00007fea64c26038 R14: 00007fea64c25fa0 R15: 00007fea64d4fa48 [ 480.252396][T12776] [ 480.285387][ T31] audit: type=1804 audit(1791387857.632:556): pid=12775 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.2309" name="bus" dev="ramfs" ino=58188 res=1 errno=0 [ 480.295830][ T31] audit: type=1804 audit(1791387857.662:557): pid=12775 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.2309" name="bus" dev="ramfs" ino=58188 res=1 errno=0 [ 480.370831][ T30] usb 4-1: Using ep0 maxpacket: 32 [ 480.408062][T12754] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2301'. [ 480.504717][T12754] bridge3: port 1(dummy0) entered blocking state [ 480.504890][T12754] bridge3: port 1(dummy0) entered disabled state [ 480.505079][T12754] dummy0: entered allmulticast mode [ 480.518168][T12754] dummy0: entered promiscuous mode [ 480.736001][T12754] netlink: 'syz.1.2301': attribute type 10 has an invalid length. [ 480.736022][T12754] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2301'. [ 480.760908][T12754] bridge3: port 1(dummy0) entered blocking state [ 480.761085][T12754] bridge3: port 1(dummy0) entered forwarding state [ 480.813205][ T30] usb 4-1: unable to get BOS descriptor or descriptor too short [ 480.813259][ T30] usb 4-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=f8.13 [ 480.814243][ T30] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 480.814278][ T30] usb 4-1: can't read configurations, error -71 [ 480.864347][T12754] dummy0: left allmulticast mode [ 480.888281][T12754] bridge3: port 1(dummy0) entered disabled state [ 480.915383][ T25] pwc: send_video_command error -71 [ 480.915404][ T25] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 480.915500][ T25] Philips webcam 2-1:0.0: probe with driver Philips webcam failed with error -71 [ 480.964791][ T25] usb 2-1: USB disconnect, device number 15 [ 481.083989][T12789] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2314'. [ 481.100484][T12786] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2312'. [ 481.100507][T12786] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2312'. [ 481.466451][T12805] [U] M٭Q& K4 [ 481.467369][T12805] [U] [)U}ǔJϬ}NSEF* NZF[F_H'W"X~;VA)^`1C':ZFOB *?۟CZS<8ZNѷјEY TT<$CRƖ/VG {Y~Y5\;ƃZDXYA"XIF{`A$í55?SAMOͻ*K [ 481.467408][T12805] [U] O4 [ 481.467881][T12805] [U] UB+ '~GIރRQ^,(-|ڟ-<6&H.Z9/RJΩˈ+)֭KΦ.NHA#LW#RF7P٪MAX]LN"KM +,GSBHJX̧CQ [ 481.507969][T12805] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1006300934 (16100814944 ns) > initial count (1516955264 ns). Using initial count to start timer. [ 481.651644][T12814] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2322'. [ 481.656623][T12814] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2322'. [ 481.865431][T12821] ip6gre1: entered promiscuous mode [ 481.865454][T12821] ip6gre1: entered allmulticast mode [ 481.968610][ T10] usb 5-1: new high-speed USB device number 107 using dummy_hcd [ 481.974484][T12825] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2326'. [ 482.119006][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 482.191215][ T10] usb 5-1: unable to get BOS descriptor or descriptor too short [ 482.191265][ T10] usb 5-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=f8.13 [ 482.194435][ T10] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 482.194473][ T10] usb 5-1: can't read configurations, error -71 [ 482.555170][T12845] [U] M٭Q& K4 [ 482.557868][T12845] [U] [)U}ǔJϬ}NSEF* NZF[F_H'W"X~;VA)^`1C':ZFOB *?۟CZS<8ZNѷјEY TT<$CRƖ/VG {Y~Y5\;ƃZDXYA"XIF{`A$í55?SAMOͻ*K [ 482.557906][T12845] [U] O4 [ 482.558288][T12845] [U] UB+ '~GIރRQ^,(-|ڟ-<6&H.Z9/RJΩˈ+)֭KΦ.NHA#LW#RF7P٪MAX]LN"KM +,GSBHJX̧CQ [ 482.691723][T12845] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1006300934 (16100814944 ns) > initial count (1516955264 ns). Using initial count to start timer. [ 482.841135][T12846] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 483.682145][T12872] program syz.2.2343 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 483.771110][ T25] usb 1-1: new high-speed USB device number 108 using dummy_hcd [ 483.841157][T12882] FAULT_INJECTION: forcing a failure. [ 483.841157][T12882] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 483.841192][T12882] CPU: 1 UID: 0 PID: 12882 Comm: syz.3.2346 Tainted: G L syzkaller #0 PREEMPT(full) [ 483.841216][T12882] Tainted: [L]=SOFTLOCKUP [ 483.841224][T12882] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 483.841235][T12882] Call Trace: [ 483.841242][T12882] [ 483.841251][T12882] dump_stack_lvl+0xe8/0x150 [ 483.841283][T12882] should_fail_ex+0x410/0x560 [ 483.841315][T12882] _copy_from_user+0x2d/0xb0 [ 483.841342][T12882] video_usercopy+0x359/0x1430 [ 483.841479][T12882] ? hook_file_ioctl+0x1f2/0x600 [ 483.841506][T12882] ? __pfx___video_do_ioctl+0x10/0x10 [ 483.841530][T12882] ? __pfx_video_usercopy+0x10/0x10 [ 483.841561][T12882] ? __fget_files+0x2a/0x420 [ 483.841591][T12882] ? __fget_files+0x2a/0x420 [ 483.841615][T12882] ? __fget_files+0x3a2/0x420 [ 483.841642][T12882] v4l2_ioctl+0x18d/0x1e0 [ 483.841662][T12882] ? __pfx_v4l2_ioctl+0x10/0x10 [ 483.841681][T12882] __se_sys_ioctl+0xfc/0x170 [ 483.841706][T12882] do_syscall_64+0x166/0x520 [ 483.841733][T12882] ? trace_irq_disable+0x3b/0x140 [ 483.841753][T12882] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 483.841773][T12882] ? clear_bhb_loop+0x70/0xc0 [ 483.841796][T12882] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 483.841815][T12882] RIP: 0033:0x7fc81c39e199 [ 483.841834][T12882] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 483.841857][T12882] RSP: 002b:00007fc81d299028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 483.841878][T12882] RAX: ffffffffffffffda RBX: 00007fc81c625fa0 RCX: 00007fc81c39e199 [ 483.841892][T12882] RDX: 00002000000000c0 RSI: 00000000c0cc5616 RDI: 0000000000000003 [ 483.841905][T12882] RBP: 00007fc81d299090 R08: 0000000000000000 R09: 0000000000000000 [ 483.841918][T12882] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 483.841930][T12882] R13: 00007fc81c626038 R14: 00007fc81c625fa0 R15: 00007fc81c74fa48 [ 483.841960][T12882] [ 483.863541][T12884] [U] M٭Q& K4 [ 483.864319][T12884] [U] [)U}ǔJϬ}NSEF* NZF[F_H'W"X~;VA)^`1C':ZFOB *?۟CZS<8ZNѷјEY TT<$CRƖ/VG {Y~Y5\;ƃZDXYA"XIF{`A$í55?SAMOͻ*K [ 483.864359][T12884] [U] O4 [ 483.864797][T12884] [U] UB+ '~GIރRQ^,(-|ڟ-<6&H.Z9/RJΩˈ+)֭KΦ.NHA#LW#RF7P٪MAX]LN"KM +,GSBHJX̧CQ [ 483.894325][T12884] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1006300934 (16100814944 ns) > initial count (1516955264 ns). Using initial count to start timer. [ 483.956860][ T25] usb 1-1: unable to get BOS descriptor or descriptor too short [ 483.956913][ T25] usb 1-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 483.984030][ T25] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 483.984058][ T25] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 483.984102][ T25] usb 1-1: too many endpoints for config 1 interface 1 altsetting 76: 188, using maximum allowed: 30 [ 483.984137][ T25] usb 1-1: config 1 interface 1 altsetting 76 has 0 endpoint descriptors, different from the interface descriptor's value: 188 [ 483.984172][ T25] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 483.984196][ T25] usb 1-1: config 1 interface 1 has no altsetting 0 [ 484.026106][T12887] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 484.033108][ T1227] usb 5-1: new high-speed USB device number 109 using dummy_hcd [ 484.105234][ T5681] usb 3-1: new full-speed USB device number 13 using dummy_hcd [ 484.108760][ T25] usb 1-1: string descriptor 0 read error: -22 [ 484.108898][ T25] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 484.289959][ T1227] usb 5-1: Using ep0 maxpacket: 32 [ 484.291316][ T1227] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 484.292421][ T1227] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 484.292448][ T1227] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 484.292512][ T1227] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 484.296899][ T1227] usb 5-1: config 0 descriptor?? [ 484.325053][ T5681] usb 3-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 484.360428][ T5681] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 484.360454][ T5681] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 484.360687][ T1227] hub 5-1:0.0: USB hub found [ 484.363817][ T5681] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 484.363842][ T5681] usb 3-1: Product: syz [ 484.363855][ T5681] usb 3-1: Manufacturer: syz [ 484.363868][ T5681] usb 3-1: SerialNumber: syz [ 484.680471][T12904] ip_tables: iptables: counters copy to user failed while replacing table [ 484.713109][ T1227] hub 5-1:0.0: config failed, can't read hub descriptor (err -22) [ 484.829600][ T1227] usbhid 5-1:0.0: can't add hid device: -71 [ 484.829726][ T1227] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 484.855034][ T1227] usb 5-1: USB disconnect, device number 109 [ 485.039848][T12868] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 485.040176][T12868] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 485.108413][ T5681] usb 3-1: unit 4 not found! [ 485.273166][ T5681] usb 3-1: USB disconnect, device number 13 [ 485.423234][ T5622] udevd[5622]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 485.644252][T12917] nvme_tcp: malformed address passed: :.:8009 [ 486.566066][ T5681] usb 1-1: USB disconnect, device number 108 [ 487.433335][T12956] __nla_validate_parse: 3 callbacks suppressed [ 487.433355][T12956] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2368'. [ 487.438116][T12956] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2368'. [ 487.748647][ T5681] usb 5-1: new high-speed USB device number 110 using dummy_hcd [ 487.978596][ T1227] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 488.150855][ T1227] usb 3-1: Using ep0 maxpacket: 16 [ 488.151646][ T1227] usb 3-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 6.00 [ 488.152999][ T1227] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 488.153020][ T1227] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 8 [ 488.155462][ T1227] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 488.155485][ T1227] usb 3-1: Product: syz [ 488.155499][ T1227] usb 3-1: Manufacturer: syz [ 488.155539][ T1227] usb 3-1: SerialNumber: syz [ 488.219709][ T1227] usb 3-1: config 0 descriptor?? [ 488.248670][ T25] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 488.367776][T12989] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2383'. [ 488.410954][ T25] usb 2-1: Using ep0 maxpacket: 16 [ 488.412391][ T25] usb 2-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 488.416770][ T25] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 488.416797][ T25] usb 2-1: Product: syz [ 488.416812][ T25] usb 2-1: Manufacturer: syz [ 488.416826][ T25] usb 2-1: SerialNumber: syz [ 488.561004][T12998] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 488.650999][ T10] usb 1-1: new high-speed USB device number 109 using dummy_hcd [ 488.684851][ T25] usb 2-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 488.700092][ T25] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 488.700463][ T25] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 488.700523][ T25] usb 2-1: media controller created [ 488.752539][ T25] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 488.798762][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 488.799509][ T10] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 488.800851][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 488.806351][ T10] usb 1-1: config 0 descriptor?? [ 488.828975][T13004] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 488.829505][T13004] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 488.887584][T12979] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 488.889884][T12979] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 489.000433][ T25] zl10353_read_register: readreg error (reg=127, ret==-110) [ 489.029926][ T10] dvb-usb: found a 'Elgato EyeTV Sat' in cold state, will try to load a firmware [ 489.031652][T12992] ------------[ cut here ]------------ [ 489.031662][T12992] usb 2-1: BOGUS control dir, pipe 80001080 doesn't match bRequestType c0 [ 489.033716][T12992] WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1057/0x18b0, CPU#0: syz.0.2384/12992 [ 489.069351][T12992] Modules linked in: [ 489.075321][T12992] CPU: 0 UID: 0 PID: 12992 Comm: syz.0.2384 Tainted: G L syzkaller #0 PREEMPT(full) [ 489.086481][T12992] Tainted: [L]=SOFTLOCKUP [ 489.090920][T12992] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 489.102971][T12992] RIP: 0010:usb_submit_urb+0x1100/0x18b0 [ 489.108931][T12992] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89 [ 489.128853][T12992] RSP: 0018:ffffc900201cf8d8 EFLAGS: 00010246 [ 489.135034][T12992] RAX: 0000000000000000 RBX: ffff88802c5bd500 RCX: 0000000080001080 [ 489.143248][T12992] RDX: ffff88802ccbe420 RSI: ffffffff8cc53540 RDI: ffffffff90881c10 [ 489.151383][T12992] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000 [ 489.159538][T12992] R10: ffffc900201cf9c0 R11: fffff52004039f44 R12: 1ffff1100467aa50 [ 489.167609][T12992] R13: ffff8880233d5280 R14: ffff88802ccbe420 R15: 0000000080001080 [ 489.175717][T12992] FS: 00007f6d2d8796c0(0000) GS:ffff888124cc6000(0000) knlGS:0000000000000000 [ 489.184786][T12992] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 489.191522][T12992] CR2: 000000110c3a8469 CR3: 000000004959e000 CR4: 00000000003526f0 [ 489.199653][T12992] DR0: 0000000000000000 DR1: 000000000000000a DR2: 0000000000000000 [ 489.207727][T12992] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 489.216965][T12992] Call Trace: [ 489.220728][T12992] [ 489.224111][T12992] usb_start_wait_urb+0x13f/0x5b0 [ 489.229719][T12992] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 489.235439][T12992] usb_control_msg+0x234/0x3e0 [ 489.240433][T12992] gl861_ctrl_msg+0x207/0x420 [ 489.245356][T12992] ? __pfx_gl861_ctrl_msg+0x10/0x10 [ 489.250766][T12992] gl861_i2c_master_xfer+0x439/0x6a0 [ 489.256163][T12992] __i2c_transfer+0x7bf/0x1fe0 [ 489.261085][T12992] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 489.266950][T12992] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 489.272943][T12992] ? rt_mutex_lock_nested+0x156/0x1c0 [ 489.278405][T12992] ? i2c_transfer+0xc7/0x2d0 [ 489.283145][T12992] i2c_transfer+0x1cb/0x2d0 [ 489.287693][T12992] i2cdev_ioctl_rdwr+0x460/0x740 [ 489.292845][T12992] i2cdev_ioctl+0x6a5/0x880 [ 489.297416][T12992] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 489.302585][T12992] ? __fget_files+0x3a2/0x420 [ 489.307370][T12992] ? __fget_files+0x2a/0x420 [ 489.312144][T12992] ? bpf_lsm_file_ioctl+0x9/0x20 [ 489.317157][T12992] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 489.322487][T12992] __se_sys_ioctl+0xfc/0x170 [ 489.327186][T12992] do_syscall_64+0x166/0x520 [ 489.331926][T12992] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 489.338062][T12992] ? clear_bhb_loop+0x70/0xc0 [ 489.342870][T12992] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 489.348919][T12992] RIP: 0033:0x7f6d2c99e199 [ 489.353423][T12992] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 489.373322][T12992] RSP: 002b:00007f6d2d879028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 489.382126][T12992] RAX: ffffffffffffffda RBX: 00007f6d2cc25fa0 RCX: 00007f6d2c99e199 [ 489.390236][T12992] RDX: 00002000000000c0 RSI: 0000000000000707 RDI: 0000000000000004 [ 489.398322][T12992] RBP: 00007f6d2ca358e0 R08: 0000000000000000 R09: 0000000000000000 [ 489.406727][T12992] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 489.414881][T12992] R13: 00007f6d2cc26038 R14: 00007f6d2cc25fa0 R15: 00007f6d2cd4fa48 [ 489.423192][T12992] [ 489.426285][T12992] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 489.433573][T12992] CPU: 0 UID: 0 PID: 12992 Comm: syz.0.2384 Tainted: G L syzkaller #0 PREEMPT(full) [ 489.444520][T12992] Tainted: [L]=SOFTLOCKUP [ 489.448849][T12992] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 489.458997][T12992] Call Trace: [ 489.462302][T12992] [ 489.465255][T12992] vpanic+0x56d/0xa60 [ 489.469330][T12992] ? __pfx__printk+0x10/0x10 [ 489.473942][T12992] ? __pfx_vpanic+0x10/0x10 [ 489.478469][T12992] ? is_bpf_text_address+0x292/0x2b0 [ 489.483786][T12992] ? is_bpf_text_address+0x26/0x2b0 [ 489.489017][T12992] panic+0xc5/0xd0 [ 489.492757][T12992] ? __pfx_panic+0x10/0x10 [ 489.497199][T12992] __warn+0x315/0x4c0 [ 489.501214][T12992] ? usb_submit_urb+0x1057/0x18b0 [ 489.506283][T12992] ? usb_submit_urb+0x1057/0x18b0 [ 489.511321][T12992] __report_bug+0x276/0x570 [ 489.515966][T12992] ? usb_submit_urb+0x1057/0x18b0 [ 489.521013][T12992] ? __pfx___report_bug+0x10/0x10 [ 489.526066][T12992] ? stack_depot_save_flags+0x404/0x7f0 [ 489.531692][T12992] report_bug_entry+0x19b/0x290 [ 489.536567][T12992] ? usb_submit_urb+0x1100/0x18b0 [ 489.541615][T12992] ? usb_submit_urb+0x1105/0x18b0 [ 489.546666][T12992] handle_bug+0xce/0x200 [ 489.550929][T12992] exc_invalid_op+0x1a/0x50 [ 489.555433][T12992] asm_exc_invalid_op+0x1a/0x20 [ 489.560286][T12992] RIP: 0010:usb_submit_urb+0x1100/0x18b0 [ 489.565936][T12992] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89 [ 489.585545][T12992] RSP: 0018:ffffc900201cf8d8 EFLAGS: 00010246 [ 489.591616][T12992] RAX: 0000000000000000 RBX: ffff88802c5bd500 RCX: 0000000080001080 [ 489.599580][T12992] RDX: ffff88802ccbe420 RSI: ffffffff8cc53540 RDI: ffffffff90881c10 [ 489.607550][T12992] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000 [ 489.615517][T12992] R10: ffffc900201cf9c0 R11: fffff52004039f44 R12: 1ffff1100467aa50 [ 489.623519][T12992] R13: ffff8880233d5280 R14: ffff88802ccbe420 R15: 0000000080001080 [ 489.631546][T12992] ? usb_submit_urb+0x1091/0x18b0 [ 489.636604][T12992] usb_start_wait_urb+0x13f/0x5b0 [ 489.641647][T12992] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 489.647212][T12992] usb_control_msg+0x234/0x3e0 [ 489.651984][T12992] gl861_ctrl_msg+0x207/0x420 [ 489.656670][T12992] ? __pfx_gl861_ctrl_msg+0x10/0x10 [ 489.661876][T12992] gl861_i2c_master_xfer+0x439/0x6a0 [ 489.667184][T12992] __i2c_transfer+0x7bf/0x1fe0 [ 489.671955][T12992] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 489.677769][T12992] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 489.683583][T12992] ? rt_mutex_lock_nested+0x156/0x1c0 [ 489.688954][T12992] ? i2c_transfer+0xc7/0x2d0 [ 489.693548][T12992] i2c_transfer+0x1cb/0x2d0 [ 489.698053][T12992] i2cdev_ioctl_rdwr+0x460/0x740 [ 489.702999][T12992] i2cdev_ioctl+0x6a5/0x880 [ 489.707595][T12992] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 489.712620][T12992] ? __fget_files+0x3a2/0x420 [ 489.717306][T12992] ? __fget_files+0x2a/0x420 [ 489.721906][T12992] ? bpf_lsm_file_ioctl+0x9/0x20 [ 489.726869][T12992] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 489.731898][T12992] __se_sys_ioctl+0xfc/0x170 [ 489.736504][T12992] do_syscall_64+0x166/0x520 [ 489.741100][T12992] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 489.747165][T12992] ? clear_bhb_loop+0x70/0xc0 [ 489.751842][T12992] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 489.757740][T12992] RIP: 0033:0x7f6d2c99e199 [ 489.762326][T12992] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 489.781931][T12992] RSP: 002b:00007f6d2d879028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 489.790347][T12992] RAX: ffffffffffffffda RBX: 00007f6d2cc25fa0 RCX: 00007f6d2c99e199 [ 489.798316][T12992] RDX: 00002000000000c0 RSI: 0000000000000707 RDI: 0000000000000004 [ 489.806301][T12992] RBP: 00007f6d2ca358e0 R08: 0000000000000000 R09: 0000000000000000 [ 489.814269][T12992] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 489.822238][T12992] R13: 00007f6d2cc26038 R14: 00007f6d2cc25fa0 R15: 00007f6d2cd4fa48 [ 489.830247][T12992] [ 489.833804][T12992] Kernel Offset: disabled [ 489.838165][T12992] Rebooting in 86400 seconds..