last executing test programs: 12.896265097s ago: executing program 2 (id=1538): openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x8ca443, 0x0) socket$alg(0x26, 0x5, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r2, &(0x7f00000009c0)=[{{&(0x7f0000000000)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000200)="9a", 0x1}], 0x1}}], 0x1, 0x4000000) connect$inet(r2, &(0x7f0000000400)={0x2, 0x4e22, @private=0xa010101}, 0x10) r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000340)={r4, 0xfffffffe, 0x20}, 0xc) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r1, 0x84, 0x79, &(0x7f0000000040)={r4, 0x5, 0x8001}, 0x8) r5 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000040), 0x0) sendto$l2tp(r5, &(0x7f0000000000)="bcd9ab", 0x3, 0x40090, &(0x7f0000000100)={0x2, 0x0, @loopback, 0x4}, 0x10) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x48043) socket$key(0xf, 0x3, 0x2) 12.895934234s ago: executing program 2 (id=1539): ioctl$SCSI_IOCTL_GET_IDLUN(0xffffffffffffffff, 0x5382, 0x0) (async, rerun: 64) r0 = syz_open_dev$sg(&(0x7f0000000180), 0x1, 0x0) (rerun: 64) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x1000c957}, 0x0) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x0, 0x413, 0x0) r2 = syz_usb_connect(0x0, 0x36, &(0x7f0000000680)=ANY=[@ANYBLOB="12010000f2303920422c021240850102030109022400010000100009040c0202c17f0c00090502020002020000090582020002"], 0x0) syz_usb_control_io$lan78xx(r2, 0x0, 0x0) (async) syz_usb_control_io(r2, 0x0, &(0x7f0000000200)={0x84, &(0x7f0000000040)={0x40, 0x1, 0x1, "ac"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 64) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) ioctl$VIDIOC_QBUF(r4, 0xc058560f, &(0x7f0000000200)=@fd={0xffffffff, 0x1, 0x4, 0x80, 0xf8d, {}, {0x3, 0x0, 0x2a, 0x2, 0x7, 0x8, "d87b6755"}, 0x7f, 0x4, {}, 0x9}) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYRESHEX=r5, @ANYRESOCT=r0], 0xcc}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) (async) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000000)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000000c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="0100fdffffff000000001e00000008000300", @ANYRES32=r8], 0x5c}}, 0x800) (async) quotactl_fd$Q_SETINFO(r0, 0xffffffff80000600, 0xee01, &(0x7f0000000480)={0x0, 0x3, 0x0, 0x4}) (async) sendmsg$IEEE802154_LLSEC_ADD_KEY(r3, &(0x7f0000000380)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x60, 0x0, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r8}, @IEEE802154_ATTR_LLSEC_KEY_BYTES={0x14, 0x30, "52c819c1925e59ff56da74097819686d"}]}, 0x60}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) (async) syz_usb_control_io$uac2(r2, &(0x7f0000000140)={0x14, 0x0, 0x0}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendmsg$FOU_CMD_DEL(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x58, 0x0, 0x20, 0x70bd28, 0x25dfdbfb, {}, [@FOU_ATTR_IFINDEX={0x8}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @FOU_ATTR_AF={0x5, 0x2, 0x2}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e20}, @FOU_ATTR_IFINDEX={0x8}, @FOU_ATTR_TYPE={0x5, 0x4, 0x2}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e22}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x80) r9 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$SO_TIMESTAMP(r9, 0x1, 0x1d, &(0x7f0000000040)=0xd8a0, 0x4) (async, rerun: 32) r10 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (rerun: 32) ioctl$FBIOGET_CON2FBMAP(r10, 0x460f, &(0x7f0000000100)={0x16}) socket$nl_route(0x10, 0x3, 0x0) 11.934050915s ago: executing program 2 (id=1541): syz_usb_connect(0x1, 0x24, &(0x7f0000000380)={{0x12, 0x1, 0x300, 0x3d, 0x81, 0x9c, 0x8, 0x403, 0xf2d0, 0x535e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x4, 0x56, 0x0, 0x0, "", [{{0x9, 0x4, 0x59, 0x5, 0x0, 0xe5, 0xa9, 0x55, 0x3}}]}}]}}, &(0x7f0000001000)={0x0, 0x0, 0xf, &(0x7f0000000dc0)={0x5, 0xf, 0xf, 0x1, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0xb, 0x4, 0x2, 0xffff}]}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]}) r0 = syz_open_dev$cec(&(0x7f0000000000), 0xffffffffffffffff, 0x4aac0) ioctl$CEC_RECEIVE(r0, 0xc0386106, &(0x7f0000001600)={0x7, 0x9, 0x98, 0xfffffff5, 0xffff, 0x7ff, "aeda2dd7ad6edb107b23ee87b5068faa", 0x7f, 0x9, 0x4, 0x6, 0x8b, 0x0, 0x4}) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x2c, 0x300, 0x0, 0x4, {0xfe}}, 0x14}, 0x1, 0x0, 0x0, 0x20000001}, 0x8000) keyctl$set_reqkey_keyring(0xe, 0x5) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) 11.607337051s ago: executing program 2 (id=1543): r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreq(r1, 0x0, 0x20, &(0x7f0000000080)={@private=0xa010101, @dev={0xac, 0x14, 0x14, 0x31}}, 0x8) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000500000aa4000000060a010400000000000000000a0600010900010073797a31000000000900020073797a3200000000780004806400018009000100686173680000000054000280080007400000000108000540000000"], 0xcc}, 0x1, 0x0, 0x0, 0x80c6}, 0x24000840) (async) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000500000aa4000000060a010400000000000000000a0600010900010073797a31000000000900020073797a3200000000780004806400018009000100686173680000000054000280080007400000000108000540000000"], 0xcc}, 0x1, 0x0, 0x0, 0x80c6}, 0x24000840) 11.479118452s ago: executing program 2 (id=1544): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x208202) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) pipe2(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r4) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r5, &(0x7f00000001c0)=[{{&(0x7f0000000240)={0xa, 0x4e22, 0x1, @local, 0xa}, 0x1c, 0x0}}], 0x1, 0x200890c0) mount$9p_fd(0x0, &(0x7f0000000400)='./file0\x00', &(0x7f0000000440), 0x800000, &(0x7f0000000480)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r5}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r3, 0xc08c5335, &(0x7f0000000140)={0x6, 0x8001, 0x0, 'queue0\x00', 0x4}) ioctl$XFS_IOC_SET_RESBLKS(r0, 0xc0105872, &(0x7f0000000280)={0x8, 0x5036f546}) r6 = syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0xc0686611, &(0x7f0000000180)={0x900, 0x0, 0xdddd0000, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) ioctl$FE_SET_VOLTAGE(r6, 0x6f43, &(0x7f00000002c0)) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010028bd7000fbd2df2568000000c2629b388ca635a5469419f6041fedc2a6961800000000", @ANYRES32=r2, @ANYBLOB="1400c700020a7d070607080561c632e7578d8d38"], 0x30}, 0x1, 0x0, 0x0, 0x20001081}, 0x40000) sendmsg$NL80211_CMD_JOIN_MESH(r6, &(0x7f0000000640)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000600)={&(0x7f00000004c0)={0x120, r1, 0x20, 0x70bd28, 0x25dfdbfd, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_BASIC_RATES={0xa, 0x24, [{0x12}, {0x5}, {0x1b}, {0x12}, {0x5f, 0x1}, {0xb}]}, @NL80211_ATTR_MESH_SETUP={0x100, 0x70, [@NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC={0x5, 0x6, 0x1}, @NL80211_MESH_SETUP_AUTH_PROTOCOL={0x5, 0x8, 0xe2}, @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_IE={0xdf, 0x3, "960eb0efb97cfeb88cc23619361abd9ae8a69474c7e3c9da54221305de97bacceeb132bda7223ec199cb20d6a683cf2a7ed4f4da0f59196ed73e9c497438239b351c3d6277eedd818052f4151025b974291c114defe0ff2561653378711efb26435f3c9840d19b0c1c4672e95f99281b67bdb53bb6dad8ed22bc62db5dc6aa7dc3082f2437c7d04251c32ca67926c3335e47382f5a4dd167265061330c06e869e5acc641cad4a494ef97bcac8c7498eac91af947aad22d49da1e2fa393e02ebac4cf209291abb1336df04c8c81ab2ade29dfdd4f11738aee959f03"}, @NL80211_MESH_SETUP_USERSPACE_AUTH={0x4}]}]}, 0x120}, 0x1, 0x0, 0x0, 0x800}, 0x8080) 11.41625999s ago: executing program 2 (id=1546): openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x8ca443, 0x0) socket$alg(0x26, 0x5, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r2, &(0x7f00000009c0)=[{{&(0x7f0000000000)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000200)="9a", 0x1}], 0x1}}], 0x1, 0x4000000) connect$inet(r2, &(0x7f0000000400)={0x2, 0x4e22, @private=0xa010101}, 0x10) r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000340)={r4, 0xfffffffe, 0x20}, 0xc) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r1, 0x84, 0x79, &(0x7f0000000040)={r4, 0x5, 0x8001}, 0x8) r5 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000040), 0x0) sendto$l2tp(r5, &(0x7f0000000000)="bcd9ab", 0x3, 0x40090, &(0x7f0000000100)={0x2, 0x0, @loopback, 0x4}, 0x10) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x48043) socket$key(0xf, 0x3, 0x2) 10.344768103s ago: executing program 0 (id=1553): r0 = openat$random(0xffffffffffffff9c, &(0x7f0000000100), 0x142, 0x0) r1 = dup(r0) set_mempolicy(0x1, &(0x7f0000000080)=0x4, 0x7) ioctl$VIDIOC_TRY_DECODER_CMD(r1, 0xc0485661, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(r1, 0xc05c6104, &(0x7f0000000000)={"b38ec197", 0x4, 0x2, 0xd, 0x7a, 0x5, "ea30438389eb3e1c2eb2fc3752c1a6", "9631dd3a", "250f4880", "2ff43267", ["60afceb34f74641f0363f9f7", "4e11aa494b487bb79ed360cc", "86b8042311e12e2b3df543ea", "8750aa980b3dcdd54f9fb13a"]}) 10.261027478s ago: executing program 0 (id=1555): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) r1 = socket$igmp(0x2, 0x3, 0x2) getsockopt$IP_VS_SO_GET_INFO(r1, 0x0, 0x481, &(0x7f0000000180), &(0x7f00000001c0)=0xc) ioctl$sock_TIOCOUTQ(r0, 0x5411, &(0x7f0000000040)) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r3 = dup2(r2, r2) setsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, 0x0, 0x0) bind$bt_l2cap(r0, &(0x7f0000000400)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe) connect$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0xffff, @none, 0x1ff, 0x1}, 0xe) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a3100000000140007800800124000000a000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x0) r5 = syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r6 = socket$inet_icmp(0x2, 0x2, 0x1) getsockopt$inet_buf(r6, 0x0, 0x20, 0x0, &(0x7f0000000240)) socket$unix(0x1, 0x2, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x20040040) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r5, 0xc0305710, &(0x7f00000001c0)={0x2, 0x7e, 0x1e, 0x0, 0x2000407}) read$midi(r5, 0x0, 0x3b) r7 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x80383, 0x0) ioctl$SNDCTL_SEQ_RESET(r7, 0x5100) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000240), 0x4180, 0x0) r8 = socket(0x10, 0x3, 0x0) sendto$inet6(r8, &(0x7f0000000200)="7800000018002507b9409b14ffff00000200be040205fe056402040c5c0009003f0040030a0000000d0085a168d0bf46d32345653600648d27000b000a00000049935ade4a460c89b6ec0cff3959547f509058ba86c902007a00004a32000402160048010a00000000e000e218bcddf66ed538f252325000", 0x78, 0x2400c090, 0x0, 0x0) r9 = syz_open_procfs(0x0, &(0x7f00000000c0)='environ\x00') pread64(r9, 0x0, 0x0, 0x0) r10 = syz_usb_connect(0x5, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100001a77aa4094225b4210a20102030109022400010000000009040000029233500009050602ff030000000905ba3e79"], 0x0) syz_usb_control_io$cdc_ncm(r10, 0x0, &(0x7f0000000100)={0x57, &(0x7f0000000080)=ANY=[@ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r10, 0x0, &(0x7f0000000b40)={0x44, &(0x7f00000008c0)=ANY=[@ANYBLOB="00171a"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) listen(r0, 0x0) 7.182534581s ago: executing program 0 (id=1568): syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) r1 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r1}, &(0x7f0000000000)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r2, 0x1, &(0x7f0000000040)={{0x0, 0x989680}}, 0x0) read(r0, &(0x7f0000000080)=""/250, 0xfa) syz_open_dev$midi(&(0x7f0000000000), 0x3, 0x1cbe42) 4.020829129s ago: executing program 0 (id=1577): r0 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) write(r0, &(0x7f0000000040)="a9", 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x3) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0xc0010002, 0x20000, 0xffffff}]}) 3.585995554s ago: executing program 3 (id=1578): r0 = add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)="50540aeff7574b186b5cdf1769189fe6ed814a1d39641828469184b2c329368eab588e799f8fa74fde6af4f42f43fcf9f12843c8283489de45f34aa7db3d7aa6aac9700de4f7e80ac15bbd3339817f303b7883055c993ffbdb730979a686c471236fa360669447cccd581ed12d4756c67c4806ceeb957d0f994ff034df0ccd", 0x7f, 0xfffffffffffffffb) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, r0, r1, 0xb3) r2 = add_key$keyring(&(0x7f00000011c0), &(0x7f0000001200)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) add_key$user(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x1}, &(0x7f00000001c0)="6f792ac42a573e870f9a614e92a1b2a96313f4359b5dd36d9ae053257a679db8c1176a28ef09d36a30e5f8a0db491fef296aeb613b3756f2ae9f8c5793964acd07e88544233c8fb39c5ef448b278a76736214ba57f269438da898ff83f1d5aa7355f1d333de89cf5ac21a9cb902efdb063048ee700393ce060d92eb9a1d9c2b2fc33cd27ad21cd3cd4f57e22f71c8d4a85759aabae8f571b44e7cd2fbcb9aa61b5b05631d4a0d36a1da649013832bd61a7cfd949b93f86324d82cb897da6b2baf5b20855bd63031b840f697cc5eebe8b0431762abb8dd6cdebe0e7a000bb3a355b77d1f0c0c09bdb3b2fcb4f687bddfb9b0c260be4ff4a16ca103d173fdfe51941f387fb577123131aaf4e746ebf4f997850147797aad253c7314e3f1c53f3483687d6c8577a079c6e00e7acf739fc784028f0297c83561bfabe2e659ceee7e87e966e7276147db469a557166302fc332242cb7ea9fb00b37f9725a4599fc091aaede72b9d39433236af7989ae42544817a54b291e3e9d28daf6d5fe30e2b1e63b5eaee81a080bffd1e920a423886c6c8237b13584c126664abcd79c3b9672a98a364845ef1f131888eeb8f0cc5d11f30d48702f293b05ea869df69d0b282915adbf3b3629d0a89ed2336f4cd49adf16d31ef899d970262c5112bac10a3e8e4e33530fe01fafbc19cae4d210e3c9e46ebf3abdc53b679cd955e1da94c0765fd5e4a6cd82c81839cb95fb4bb59a453c7f583ccffa05d117aad88cd2bd18cf26e3e0451d6c9568d819aa8dad9745ea3e88c5462025b88c5a136a62a993ac919c515f86a360b68a5b42b16fa6b5b17faf1610c0c1518728a34158ff0b2960ee0c6bac4d07f5d6e8820f4de0e6b8450b4823a49e22828871a7de138ad5f4f04bfa156082cd3b32f2a8ce0dd296b14750d2da5126c0ea2071fbba9f5e40b33b6e567354087cd4711474c2c43e048915e2fea8cad6dbc86c8357eda117e7f70e260447532b7bae17c630b20c306987cc08d88d193ba73c6f66b0087701ec1026974cdb4aa046a6baa6acfa21d035b2dd988914c4cdffbd6f77cb010097148fca8e2b991f156b91650ed2b97f9ee313c67ed706a5bdf087c14e4b864d6185c85c4cff323160928d5e09ed9bb9410897acd75b2a155670d8fa6b35c3fa912eae5280209a009736e1e65467964335b2110f898d385d8691886000a12553ee86e6959698f00a97bc19c2ab3cbef1a7747ae9af8785bbc0c49ea0a83c49419c20020b39537fab7b667afd900e16defb36cd2decc33b3e50ac49bf880da28d3c37339f2f385171bf9936fe9d26655ff774a4b537a279b6208626cf72c7f45aeae35e29d573a896b1017902afb68e9d1ba19539626f1cec9f549aecb5ee0ba9e22e9a6a7def14ecc823c1447b6682f198a510999203cf13fbd6ca67e10df7b7f96c70495041144a0c13efdd838f54efb987e0ecdb8238e2904595cd6bf85957763cef3bf09384c6e0f319576aec1db9bdae5a633b62d3502afa6cfd85353eae740313d63b258f7e24378f88b684ffa8cca2127736efdfd4bd5c7148822ebd781eca72876e5f71de2b095aa099cb36219fa4202bd115f12dd992c2ead955144ac3648d49109368cbd92d590779c2e6d7ee3366ed4ac219c5cba11f0758a37879878fe25eca3d23c1e1b162d41acbbe1133f1e9b24e4549113211205ea1df7e646a21d592c2a34ec6be155d0e518115d540a2296971f91847b83489eaaa8dca18721091e03478cf9fbadb878c9483fcdd3f9376ea3d57403bacb24333403505e0324be07ff00657d790cf48dedca3d235bc83815247f90bea25d57f723470316cd6b09607f123d5645e3e5d5bfe1d0489c1fe08f7147eadbf6d1d63800873641ea6cdd4f2b017ad7496d1b513a97f570ee326e1ab604fea5d7de2a70754b78597bc5b6ca0a3d00ff53f4fc27f1b3cad5c5b3190f05f75042fceb3cba8eb1f1998a768006c2b034752c066f0cbd7750f56525b1164a53aa9bf3bb127c43c3cbc78069d85e60de4c2b0fcac87746feee7ae2b999e6ceb029baa536a116376401fad981a867f4a3f50e0ce4bd4cb9b5fd025d8e40a851a485f0f8b5db6064a9bc2b1f542ad62bdf1a494ae333119f8c16cc54e403e7da46fb71f4b049a0f99371038157232a5238ec800d4e2b1e15aa594fc55d701182169bd775eb69ebaa6d0febc191aac57c6ef8fbdec9fd72e29c20e4c0d6beaf9760d1075b8f82b124a09c7e6b85b6885e7286a75e32f62dee78b65fcc4b66767f57f2ba84a61389620a037507b546f31ed7499f7706cbf2a96a8a73e1e9d474822dcb39f3ad41c2d78749424994a6d8184e33be523e80a359509d9d64601cb3ccffe53724c2c6376001624845966324c8a35b9cdf6cb3ade493ce5891a1815bcd6ecb8800d6df50aa22c6605789e210dcb5de0c7b3ad0aab2fad62be52b84557953c6c2a739036ad21afa9948a652e1a198213383de46430c83172b1e55c2ff724d7b77035ce3a8abd703af454309e08bbc83199d1aed8b5db58494429fe2581eb6c9ffb12f54152c0d909ff1d2b69c3bb6f307b8dbbc4ef3cbba63e5f42841e50df3648f1758982bcf3da815d9e4c1e7145acca503f85c09546e6067a2e46a5dd286316282663a214ec6b9848a535586d4d56bb77923f143af2d6f3d3fca7b72af85fbfccf0dff49bc8147defb5a4396bf84011de97301a4b7dfd5522a14281ff31a3a902866813a8f9277fa41bf37c547c72ea43023f0df6572507aa3a12929c749236b09ed28f96ced3a1e487b8b88de5e2f8cfcfed10475089c237098f8082d08caf7a7f56f6cb484509265325705bdd8e2c91645b0e233106fcef9ccad355c2414fea65a9a16d85a9784f6b433cdbe788b31dbd42a979a51e668ef29c8a0b57728503e3114ff5fa06e15eb07e70c03c4d6d47e6c1ddb290fee2e328b0840b1a7fbcd844c10f8bff6d9b800ca5410ff573e47b238f814329b929c19b1cf18d2865f8ceeb4f1ff7a67efb79add46933a62838f9d907bd47a9e9c16f49bd56c22ac5b471164ce6e538afef0e7f546da6bab64b5ea41f09b6a91422e9d9ae1b467c6df80a09aa7a241264b6b18b2729a969a786d864654f9e0ef6ec360c82e9fc7f25bd4b7c9860ad2da8a15c1a6cff07366b03a36fc869373d0df23f2cd0db9441851ccdecfd6584db75220ca48a1363beb5af9785b5ebffa41e8b0bf290f46faf4fda59f4da5c2547b55f6322e954080e90381a2443f3dd520fc491642719299468952013c7e5d6dfab9704af0068e7ec1e26320d8e40fc57b9589aa40813ac2d66c0fe7d93e28d5c2489481143ca071f53bca13c748a41feb052f8b004ca18c766a8b3b5ae4df27d1e0d5a60a3d7b9bfc237a6a7a02b7841eaa8fa9f2ebfd6d3a13a2d3b2cc89651a807ecd90d79c6f2a65370360688a28b760e32929da54ddd02a8c1e826dbfd912b71c036f71f60f346be3890c940c00a19dee5f83005510d80cfac3b067a3c0aa63e916b64ef37523b9d4f8b90d25384207b9e03d196f866f638f3836464314cbbfca7e3663bd4d45363b4fd0649e3823197c34f258a440767b83600995de52724c3a6ff6ee471e29993dc9902d0b44a4f609a75b585c99b4540d7edb4dac2b1f4f44b4a1cb5fe0b8d37650d230f355fa2e2a093308238749b99a689035a884161dfacc01563f03a5af725598cb7139359142513e5998c486e3d224bdde110ea7700be3bede0b2a07a8365f55f27f211e3ac00f7eaaf2f2c44c51ab7f696257e224958780feffb2441e920ee18de5995348b309d5d199446af7e97314691881027f71bd8d3ad9ac0c27dcc516a6905b6bbec0cdc278548c6eb15a987afc1e63f06938bb96264ab7a457aa9b4f94e2326cb15874ec2261afc07acb39c71760b02742efbf2717851aeb255dd128c1b0e466ea5d556feacb842cd5d6d5e782a5c4739e322eb78cff4eb8d401d9c50376cdb135acf29e96a64969fe50f75f9affd5cebab7b0674bcbc359ee9b09f57ec18cfa433211c25b1f683285a236373a8ebaa81ae862aa69341ee24331f5b7503ffa7cd6cd23cb484124015b3ecffb5b1fec9f3bc370f67eea71c818962663ebb341faf0864e55417751a369a962dda35079da8e85b005fd29b4e5277d3a9f7f2eddfd7bded608bbb1c62e43f66b4d0a63b7d1e7c9d73676438e70350bb0cbc878f39621fa81fa3ec74016975337a9e5de723c4154cb0b4e1440afd91bd4ab32702d0e70032ba7839384db572b6d67c8f9fcb2db8ee95c78919c04f77e3b92513018211a7c09997be555356733d03ee89ac39b82fdbcd755fa0fe0005ee369e393576251edc53f0cadd74bb3a7c24168d411219a4c6331820bd9f33ef70a0484d341ed88aaf4c9d6c23b26e916c14048938d3cc4c178758fa854ae7dc582aad562b1d4245fdacb5ea9ba8a75a33b8b85a2a236a746c40202666acd3f24ceed069fc4d298d31ec943189ed5c58771640006d2813fb52819b532202529ba8ba3d1095a980487b8b83984636e7f800d60380344fbe837d02c47cf677590a98f36ce4399492448f820cf4ada724259b99eecc710639205a9500558def84ce6a92a2916ecbcfc40c375fe30d89d01849b4e0d9a6251a407842a9745d7936d660cfb5d525d3575d564cae5bcfc83fe7a9294bad2328792c7f9447327f18d023c4a76df3406825c50c0352be268b14aa8d9df884783c09b1d73eb79c4422ef64ef757239b30d27a1f38859331cc54ce78be216534fa84dd37c21c5ee1bd5074ba3f92f12cfa779a1a21634103c53a7543bd155099d64006530767ca9d628e9c5f684f025363d7d399d55ab85bd0691e268469ecec6e8f9a494a6a8516727d60cf8ce0258d0115b3517783292d64b5d75ff1c6328bb16580773221fc5876a6a075376d9022701bc90c03286d6bc0c2a460a4ea46aae2c51c954f771b4102f30868bd95522ec200f9d06afac756fc38a1bfc45c8a92e17b32bc56c09fa316000a3c140a7ceb87ee207a004fdc6d642b89d8b3175f0534350f5d1beb1e743d218faf466b0dbe68648224c2281bc33e88d039d62055517047d7275c0e496c9231dd1f440c5fa55603c3c6b5077efe9fa95a53b6b051205e1c61637bb1272f36c3d30a1b1f517d6614f0e6d13e01b417248444f9283dc4b87d6546e1875d40f3c58968bda0a8b80c382dcb82141591e916265e90c1131374fe2446db6756925f0f50283b093d2ed9e72a9f13212cb03d5b94321fc573b2c9c5e72bc6f72b8dcbe28b6a0ac728e45fe5c56b4280dbb6e2fc59dbf0cd00426927628d1e159ed838ffe7634dab8a0b8d7ba83b6e929faa16d88a89dccdac24b001c611ea202cf78c15f32d639565d53af5f2fb7490450311959017ac5c1db1d7702600a6480f43d304c5190f716ae85e688e078deb25f8e67f8b494e33222e21fa7a3b74d770eabb8b7f8963ff47320e6c98aaad5a4f21f9a3b6686d5196c1f70a0b57e15c4d4691fd0f674f0412ae65d3f1d63e617e13a3354e659ed5e1940508ecea3b4465f3312950decbc85c344714ce258c1d79c6023e7e633835f83c78974591b70bd867c0df651da5c46c43f5ff1d6cdc6e9922e71d880e49904e37b3a71eecab6212ea10a205c3c500e27e2a53e0188f07faf0b84126387f5b610f345638ccd30d2e3e357f4bb21af310642a4cc137d7d6616f3157266bcd3a97e88b27b4f295e3a9022787a8177a025aad4a63533d95135d91ad6375e4e39611274acb6d351d70e8cbb9b20", 0x1000, r2) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000001240)='./binderfs2/binder0\x00', 0x2, 0x0) preadv(r3, &(0x7f0000001700)=[{&(0x7f0000001280)=""/211, 0xd3}, {&(0x7f0000001380)=""/246, 0xf6}, {&(0x7f0000001480)=""/214, 0xd6}, {&(0x7f0000001580)=""/61, 0x3d}, {&(0x7f00000015c0)=""/45, 0x2d}, {&(0x7f0000001600)=""/234, 0xea}], 0x6, 0x0, 0x4) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000001780)={0x0, {0xfffffff7, 0x5}}) keyctl$restrict_keyring(0x1d, r2, 0x0, &(0x7f00000017c0)='-\x00') openat$nci(0xffffffffffffff9c, &(0x7f0000001800), 0x2, 0x0) syz_emit_vhci(&(0x7f0000001840)=@HCI_VENDOR_PKT={0xff, 0x1}, 0x2) bind$tipc(r1, &(0x7f0000001880)=@name={0x1e, 0x2, 0x3, {{0x0, 0x3}, 0x2}}, 0x10) socket$xdp(0x2c, 0x3, 0x0) ioctl$KVM_CAP_MEMORY_FAULT_INFO(r1, 0x4068aea3, &(0x7f00000018c0)) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000001940), 0x200001, 0x0) add_key$user(&(0x7f0000001980), &(0x7f00000019c0)={'syz', 0x3}, &(0x7f0000001a00)="f07546bdddc833e1695624e839c9f3e68b07e818f61750a6961cfb5b6d813c2a3d65dbbb9b7dcedb52463219f2a24c091197428cd70bc1c8a710d0026afc5e927dbb8039e0ba4858ee7b5302d9a3ec7ebfccfedfab3158d61a9b955966c601e4343016678c5069ab511f5f53dc5155333ba93167aaee95bc3dd2ea03cad8fb0402f0ac22b7c36808c149", 0x8a, r2) r4 = add_key$keyring(&(0x7f0000001bc0), &(0x7f0000001c00)={'syz', 0x1}, 0x0, 0x0, r2) r5 = add_key$fscrypt_provisioning(&(0x7f0000001ac0), &(0x7f0000001b00)={'syz', 0x0}, &(0x7f0000001b40)={0x2, 0x0, @b}, 0x48, r4) syz_emit_vhci(&(0x7f0000001c40)=@HCI_EVENT_PKT={0x4, @hci_ev_conn_request={{0x4, 0xa}, {@none, "3bfce4", 0x1}}}, 0xd) sendmsg$AUDIT_MAKE_EQUIV(r1, &(0x7f0000001d40)={&(0x7f0000001c80)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001cc0)={0x28, 0x3f7, 0x400, 0x70bd2a, 0x25dfdbfd, {0x7, 0x7, './file0', './file0'}, ["", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x10}, 0x8000) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000001d80), 0x8000, 0x0) r7 = add_key(&(0x7f0000001dc0)='id_legacy\x00', &(0x7f0000001e00)={'syz', 0x2}, &(0x7f0000001e40)="15fddf69fc8f1b3321d18ee92524a26acb478638f8ec8cf6bef88434a2e221fb1596aaa614cdc1d1bbed735dd09bce4276d4af3c5b90ec4e9a9248678057090272d53f659c7fdbd65ecc17e483c5009106adaa97df2c76137ff855922d2d862e4e11e090b6e450a731e988be54a1e788bf9d1159990b8b52e69b51aef612e276708142b91482", 0x86, r2) r8 = syz_clone(0x80000, &(0x7f0000001f00)="f006961f4441681e839878f98ca8551350a09dc673c1d00a7feb83ac30110295788dfbf5feeddc0275c73e9c9f052fd5947b9cad8a1004c252c78b68672d3e114a34afbe3f90c6925ba3a7af7248a052f94c862879d1ec131419b29e5678a95a9e273e718c94399185819f599bd741f578eb1a6deccff6060bb597f626b719e6a578f2314da1", 0x86, &(0x7f0000001fc0), &(0x7f0000002000), &(0x7f0000002040)="e77ab148e4a64ef8a5310f8f0bde26bfb8bc918d058e7255a5bf7a8131733e95095bed357cec2571f35a278465bfef3df7e1684615ad08c85ab2124735793798c6919db89b78acf7b801ecf3bab333644340d7f214e26479cd399d2b52e391a2436f61eeeb6c58ce9e0896939af098b78119833c81005683bed0efff48d5c225f935b8b1a38dc89959db0960f740466a0f2fba30bcf5b1175c3c031e6dad31ead6e25fd1ff6ea9681270a5c6e58c6138") syz_open_procfs$pagemap(r8, &(0x7f0000002100)) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000002140)={0x1, 0x1, 0xfec4d000, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) keyctl$revoke(0x3, r5) syz_emit_vhci(&(0x7f0000002180)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x2, 0x0, 0x10}, @l2cap_cid_le_signaling={{0xc}, @l2cap_conn_param_update_req={{0x12, 0x80, 0x8}, {0x6a, 0x8, 0x5, 0x7}}}}, 0x15) add_key$fscrypt_v1(&(0x7f00000021c0), &(0x7f0000002200)={'fscrypt:', @desc2}, &(0x7f0000002240)={0x0, "c71487931eedba3081e4fa5492e9c4eac5971f474381434ca9082abb857e196032a2a4c7c0dfe6b42a56754d2f7037b2855d4a68e42c5ebc8f89f6aa39f37d32", 0x18}, 0x48, r7) r9 = openat$nvram(0xffffffffffffff9c, &(0x7f00000022c0), 0x0, 0x0) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x810, r9, 0x8efad000) 3.348000359s ago: executing program 0 (id=1580): r0 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000280)={@multicast2, @local, @remote}, 0xc) setsockopt$inet_msfilter(r0, 0x2000000, 0x29, &(0x7f0000000040)=ANY=[@ANYBLOB="e0000002ac1414aa0000000003"], 0x1c) 2.828930265s ago: executing program 3 (id=1584): r0 = socket(0x2, 0x80805, 0x0) sendmmsg$inet_sctp(r0, &(0x7f00000032c0)=[{&(0x7f00000000c0)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000100)='a', 0x1}], 0x1}], 0x1, 0x0) sendmmsg$inet_sctp(r0, &(0x7f00000032c0)=[{&(0x7f00000000c0)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0xff0f, &(0x7f00000004c0)=[{&(0x7f0000000080)='a', 0x1}], 0x1, &(0x7f0000000000)=[@sndrcv={0x30, 0x84, 0x1, {0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x1}}], 0x30}], 0x1, 0x0) 2.691714583s ago: executing program 3 (id=1585): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000140)='cdg', 0x3) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000), 0x4) sendto$inet(r0, &(0x7f0000000080)='<', 0xffffffffffffffef, 0x4805, 0x0, 0xfe8d) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) socket(0x1, 0x80802, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) close(r1) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r2, 0xc004743e, 0x110e22fff6) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x6, 0x3e}]}) ioctl$TUNGETVNETLE(r1, 0x40107447, &(0x7f0000000180)) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) write$cgroup_type(r3, &(0x7f0000000280), 0x9) connect$inet(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) 2.633214879s ago: executing program 0 (id=1586): r0 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$inet_mreq(r0, 0x0, 0x20, &(0x7f0000000040)={@dev={0xac, 0x14, 0x14, 0x43}, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x401c2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/drivers\x00', 0x0, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201500285d5c2086004040031960154030109021b000100031003090458080119662194090586d7"], &(0x7f00000004c0)={0x60, 0x0, 0x0, 0x0, 0x2, [{0x0, 0x0}, {0x2a, &(0x7f0000000300)=@string={0x2a, 0x3, "ed5f1bf567f25c93df2433d748adf660e21f16bebc3db85a0aa76685c75c176402847e64ebf35583"}}, {0x0, &(0x7f0000000340)}, {0x0, &(0x7f0000000380)=@lang_id={0x0, 0x3, 0x40f}}, {0x0, &(0x7f00000003c0)=@lang_id={0x0, 0x3, 0x41b}}, {0x0, &(0x7f0000000400)=@string={0x0, 0x3, "dbfcf7fa857881d878ff3c952ce94b05c1adec332a6e71cc6e07d03376af1094099672042d692ae92d7d4cf73c64e01d1577e508c8df2c900dec767d38caa3003452771ac968552ab46e1ec95d4b9133a81cd50053e5059e8f598f3e5024667cda0727fdb1534c2ec820e8283c4269e565db74509adbb62d140cc4a22e08131a3dbad574c63be467fd02ef102cb83d9f2bf03ae715147231d6f8fdde42aa28c2528035409072fc5d7f1376c4e877e80a0e8fd84969a15b3071"}}]}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r3, &(0x7f0000002540)={0x0, 0x0, &(0x7f0000002500)={&(0x7f0000004e00)=ANY=[@ANYBLOB="98140000", @ANYRES16=r4, @ANYBLOB="0100fefffff7000000000c0000002800038004000100200003800c0001800800010003000000100001800600020026000000040003005c1403800800020004000000440103803c000180060002002b0000000800010001000000040003000c000200657468746f6f6c001200020076657468305f746f5f626f6e6400000004000300540001801200020076657468305f746f5f626f6e640000001200020076657468305f746f5f626f6e640000001a000200235d21407d2a285b2d5c7d2d5e5b295d2a00000008000100470c00000400030048000180040003000800010007000000160002002f70726f632f7474792f6472697665727300000004000300100002003b212e292f2d25245b295d000800010006000000040003001c0001800c000200657468746f6f6c0009000200287b262a00000000100001800400030008000100010100003c00018004000300070002002a270000080001002773ffff040003000800010009000000160002002f70726f632f7474792f64726976657273000000040103800c00018008000100030000003c000180080001000900000005000200000000000800010006000000160002002f70726f632f7474792f64726976657273000000080001002f3900005c00018008000100ad2dd30e0400030008000100030000000400030008000200405b240008000100ff7f0000130002006272696467655f73896176655f3100001200020076657468305f746f5f626f6e6400000008000100060000005c0001800800010079800000040003000400030008000100780000001200020076657468305f746f5f626f6e64000000080001000900000005000200000000001200020076657468305f746f5f626f6e64000000070002002d2a000004100500f6a4e0ad14499b32db842c5fe126b7d9f2e70091a1242acecce32129366249fc16da2c1c3c577cc9bcb7f66f2df95e5851f59967feaac29a9d4df27e6f8b3a9c048bba6cd7e9ee213e794d9edcf40aba1a543aa0c74989fcf5d895578bf725e964f60c6188b6c6d69b197990f52aa07f68d255fec0d6bf58a2652ddcd47be981614ad07ff4ddb24446e58f5ad4b7cccf96a36ba1953f6cf05d8a65cc19c9260d3bcd8e2a8f7a07b42bfc704956b8e1a06566509fa3dbc7db5c99d0ab3763edcfa722419a6eca713720baef11eedc10bec86fc1ea06af2b9b6e5a5f83425a87a37b244226830fd13cb05e0846dc22dc47f9d28efde7b707cb84bb84bd535aa01b10458f3d1db39718caa2b502f9ef216def3b9530bc0f135bbed50599b7cd7401aef132d2881fe5804eb8326482b7ec7aa39c2d33e77a82f2cb284f48b9f930170aca42b4a9232de3df32d13f9780758da69bc0cb1d2117e15c7e33238673a2d00b1d880877a93cb7af2d0a6e39ee76cb677765db4e9a780f2e9a9bd3dd36a6ab0c37373360702cc8749b18d64113da865e0e16db8d23ac22c5a05ff52b3dbcb6833c4345090a584d82a6ba16fe61f487c73309b1140bb4c32dce27784d8c782aa979b400e1f523e4a87ada92a54be6684dbdb4121c59a490f9c5fac9aa34ebb82088ed7106c007d13c7024cf82a1332a70040c206caf24355e64ae9d4364f211b6981075d5df9bd414f3a1849be901aca87d3a217c55d57a2fa56323ad26dd5bdfeb78f7b95e908def1e1c1c6d5101b1b2e01c0ce4c8dc39f6385d2c536d910a93621389da8f98ad9e6035fdd0a5baf4c1ef122540c5d7f513a244e02e43ec2570f284d60e853c2b476d21a57d55387c692e2e832f9eb0beac9363bc43ae89a19c3e97978fea5bb7842dce648f952c16d905969085560a93c61e545d8dde3bf7ef4549b3df18de18faae8f8034a58a5a937846fe605d45f915cc30b60bd6f64b13bf58f3150b17164ce495fd136706091fd4193469b44a22a57e3a33350a79c33dc8a7357467292484d7783f1090c4468dd755bd08a92ca9667bdd152c0c0700433a2a1a5c3a3e4ec5d96b63c83fd43c686f79b0da3c303b78efbb7ce135b9ade30b6b09c89e9770e9f9169a436716ef4abcfc37bf281f7a939f49b78bc7b085f30c67c088090a02bc060a9adcb176d8e6b63f5b83ac1d9594566700828c2978481b902e3685551412c7395caad1f8ef1f6013f2c64a1b6ce857817c636f880b058914afd1e7d114416480dd60dfdcbc8916c18a62b839a4717e5de66f5ad8e1c0fd327a70b7284a2b4794e103289e0614105d2a0f5d4b019f6d515f8c512d93d13cb4fead8d68b3330342fb1e833bd29aad386722b053ed68e7b77334ba12124157087aa4957dbfbdbe557c461091d7d254a43459208aefc4e4cda47ccc464882d01d5ec761f7af4f2092db762094cf334deb3f2611fe6b1dec51b9f0416a7eb51c705ba6fe20d8b6538260c8c79e076a981e88636d2f9135e4c3c1cf2f1f3678372e02f8c7fa5cebb86ecb58bef12189002dd46fac3e68676ba34dffcfc32c70f72b143a1f81328936da03e98439d2f6823d0d840b0084b976ebe683882cd7da9857cc5056d70a8b0473eece64203aeb2295f877ae21c84d9f90d34bf2e9701e9da09b19fa65d704a67b2e8b2a4f99d1d322723f47ad3cec7027c224f04e0ff999e76bb04b89936fc013cfb5c5ce97c100c0e39c5d4c154796c085aaa725d8103244c8517d67d71a364c470861d1ec18d7e78dd0af2944de121be25a8208801d1b07834d3739849e536401490727d9c0c9ce7ebc0c5b0c7b7fd79eb26c6ba78e8c40014b3e274b50b2ea6420f64a8a52cf50d910f121c557f086b86b418bdbcf11cd93ef8d91b468ae23d3519375ac0ecdf436ab257060d7c8cd9ad860bf355bb41b890fadfa0341d2ce6c8dd30b2b9ceaa806516b5af92144b3bb38a3311dde618b05ab1b7be97ed0112f4e99777694d6cf17f56fd16ba9d5bbffb57fea144753e21d0181b1ddce573a6d84c1cad0265df824483790fa2d6ca6fdbbb5a297b5610159f8955bbf0325ccd2941ddf6e700c8badb5cbb871eaf03d763e3dd0d420d6af92cb6d718e79c77321658664aeeed2bca7808b21d856781cbba1e04291e94a525845f8f9548b73f41f0af9891d917b4617e09839d8f2efb3f153769af91675c77c0b24c08e0fbd7bf622ee3f0554c6f462b19e2b903207261e1e33098be25b49f56f8eb1de83ac6ccdc8fc195d2f744627b47a7c569835529fa097dcf87d2b2bbc98a2d4c0816aa443bb6c2ff38246f4419a0d1918f0938cbeadf852c1480c464e057143104ca4a57b83d6aa9bb5fdeaef73daadb1cd4291e05f6ecff0adc2d9c7deefcbbd2317a014bea7a07315742852c940ea184972a5393c48ee3ac752723343ca691930086f9081f4879819f26e8564f8191536ef0c4f5ac1f5ba06c7d9db048cd644765ede0bdb5e78bbf6b6ce2640ec36be2d0a9abe134ff7824c8f6dd5a1e562267ed1a6a8e5f07913650cbd919ff234e5c4b2361910590882b679e6f6636a2ca89905be68b6220e5cf9d75963d9583a0724d043259d47c65037998e46e0197645c77f4e2e7fef202163cae91aa598d28ff19f8ec74fd17d377837f7930600fe1aaafd369ba6c7719cc14ca9e7c8f3af4f3f580856b02613bd7fc2473f80c25869cbdaf7adb5f782a59099e6563f26379a01d35d10bd0fb27aad8391da7c048e155ff015e274d51bddbda2f984ec4e50a385f1b279747ddcfb2730fd37ffc4432ceb17de320d48748a256f58c39e9ec38b5ee3c4a833b21266faa5f71aa1e0e298e6471f5ae9d2378990d5dfce4bd6f88019315e948bc572bf0fd9d3d0a8f1ca041667781f80de1f1de044b3b60d32df909225cf625d88872e756665b626fab2380b9185ca36f0c7788e41279bc21cdc1799d67cfda686f62f32a86924d14ae6b4ce98f1a8ac02f6b422f4400fd102f2ccbde33bf00ec181096cb5222e139eed5d03e5bf99c0d8ee0fb2be4ed82c98c6f10a5dee891241c0881188c8b50c8982be0dba4f2a44f02c68847325f9ddab528b71f1f916e0bf836400da8e55e5f005bb476ea0260dd66ce1eef4aa4554f95b274bb290b67a50cd9809e95e9127c10fd10d2a356de5a3705f411b72984519dd34bf77d68c2a5f09bc976bbd5e35e1af102f045f487fdd4ec764e5946bf54e92b0da77277ec9b9c2e54c699dbdbe17931c97ba451c3c2b398733372b9d1092091377bba0b4676e18e76f5377f680764b109802b55057e521a120e4eccaaf4010e82817e1df8b2baacd40681d2b289860527577e2575c1e42ede501cfaa11070914be695705f8a384424390cae2f53328719e648c21e188d5e6162a46c1214884b11039fed0f2c95aa48898b5b14258405ff6c9c6a5ab209dba5f6beca10e4690a68f51e0ec710a40640113b9051354f1190bbf1f780500e0e62ee9f433edb780f65bd535f0f78b0de518e587083352130524824d377deced8fe5b3d02685d6104e2a1680e694f961ef22895bf25a9e82a80eb7248c84ad049a557dc2fd846c7cb0e48c151c573157fc4af5bf116f8364f2a1f05a9c54e4977f8745ee8a0c0ebb190d4a33ba99192661b8316f2b6254bef42b56eeaefddbf93d57c81616954401aaf35cabe903694b1c4618fe8dab91d8f6304772cab1c3b43ba31f37690221187a84d40c6d1dcedd52c6b9d1779bdc0c1f7b3689d7e318c16586f647d714d4c3bb966dc7e9aa68b74a4d7be06dbbd4818f43950435c0ba42e9e6b03477ce1f6fda3672c66c2ca24fcf62c98fbdecf4fa5f3f80fa8dee68bf635942228a080520affd47af2e3a870a4d9c501807d2da1583dc1a6ef6c9e59bbfa367bdb4a1f9431e63130b5f783e74ff17ad68ddb007951e097940c4d6c061e5634783399dad2af39a07cd054b07110574e3d2a7ed8a28c31f85b322f2c31245f0f53b130acbabafa431a6d5ed217da068e5d7164b1bdfc84343b7195d0a78687d2acab5443f887e6c02e2190d069890a915274cf8445531ae53a42ac65131b001da84f3dc3d41b26d58c63b8373a901a541ddf580953db034caf048985656118af256e209a5ef84da1cebf146fbff31b8feedc74d60e45bbe4cbe1ececb0ad82e39468fadcbbca9a724758f606a88825204db5d0f2e71e55218ca228a6f8f34d03173a1c5f508b9c99685f23073aa03f3232417be3176bf13896890b60f6e2077e311394f568c25bcdbeb61bf248a23585919000ce1593ae72ab8b77f16f8d46a034f772441ae2470ea66b2cf172563f91d4d978d8ec735b3ba80d3062cee40ef6817bf5e6d8083995475aaae00a82b2b78fe6e661ed0cf31f16923c1dbb06253390c5dec5c6a0adec3294b12befa9af2d81d2454c7e89735918e67c612a0ed0e6b12abb974f539bec36ffb5b1e4e7ca6c0ebf477402fe2a3c8f41a201bf3314794cbe9033bae4afa68848a61bfb70f43f91db936c89a1bdac9cae9cc3f3956facf15820c4f0ad8b86935c1881ae750f12cc7f22186c1edf119ef265315a62ba2896ddd7e28a8f6b95e85e7f168c156eda2a80f7dd21584f0526e690af1d931fa3afb38ec82ec0d2cdb7312f96d59bb9c5750cd0dd1e5cfbbc010ab1b010e70d38cd0e7207cbc8facae96e55acfe55a9efac13b6b1fa0eda56a77551a8e7a7ea51ca8569cae3dc57c63e8ba5a10798a900770e99a73f15d9e074a3e8f49c04c93e92c9f67a93c34e23d51e26136dac80fbc16bd64827a74831f88000c74a45de27611bad27ebb829f0396da6fd81715d1e0120035e13814be71e662bf6e643e71e1d3f6bf22f0d414499de23c9dbb5c171eaa1605e304f28db281e194da2734390daf61f9be47061dbde2d8ef65d0e26b211b0dc66281b92c5c94fc13b9cae92b7520a42f63392f45b855739afc164b6d807fee73bbd9ddc0aaa71e3e487a4b484484b2b46d56f0a1dc43b46509229130e7024998d1deab5aebfa41de044687f5e3e7fe99ca7a8df430507016a4846075afeae01692620ea777d12154ea03b68c119b873174d869842b5ca8c9c4926ea2c9346687136d514fe5f49fcac831f06da241c0402699ad3889690a63196d18a6acea3881c0e4245e9bf5d1f8590b45cc5e333afe13a7ea5ee9d1581732d79e7a300d9e499ab46e3c1fd69d065e18067ee9a0706db665d168341b9463679a8fb76f4f39148ff222c57d6d5fbdedff0f95247c97726fede3b6b7fe94a08e751a0d57320328e1567c98ac25a9ea9053de4d7eccd582bc9b3f7d9b57ef1a623570a9176998e55f46dcf83ad2758e8d2d5ddf386a82292206d345443409def657bd4566feba7a4e8831b96cc510f39e601c61456a0f98a3aa96148fac825bc55437b4bcd508855bb76ca7e457a386bcd027eae28d6909bf881b6d2d5fc38a1641f1583520195946f9c9bcf2946699a2f68ca99d0220e973209a2dc2f8ee0d2384cd47be6f4e9126f6556e4835850b718a41a576940ab53d5091d2f5804fa0deb4a93f8e9a9f5a9f014c55d63febe791b17cba2286a94d875f31d225da31ad7fe8a90deed23be45f1304d9b373abde23b42d79e30eb7e350c3d460175fcf9598b60eccace1e119ede370023fb70b0845ec58901e110482e464f5802f86948102a524bf607e02b7bad05ab163fe165e7fa1a6527d0d28bbd5335a26961c0f134aea447c8a4e6f652e149486c726c8e3062a91caf4c7f779c255a6ef9c44b575c381cc3d7c523171f401038004000180080001800400030018000180050002000000000004000300040003000400030038000180160002002f70726f632f7474792f647269766572730000000400030004000300130002006272696467655f736c6176655f3100002c00018008000100000000000c000200657468746f6f6c0004000300080001000900000004000300040003001c000180080001000000000008000100450000000400030004000300200001800400030004000300130002006272696467655f736c6176655f3100003c000180040003000800010004000000040003000e000200285225272727152628000000040003000400030008000100040000000800010004000000d8000180060002002c0000000400030008000100bfb3000004000300a30002006272696467655f736c6176655f3100752bc6f34fc855abbe14e11e0b033a4044050216774e75642a320ac3eeac16f48eebb902dbaf04a919fae3b1c8dab45eb90f4db161f4439decc8c1bc8b6f8d8d27046f51543c2f5292b8df42ac60e4b56dfd238ea2d9571743a9f885ae08167e9798c4bb99755dd381fbad811683530c205cc9bac0d8228adc22c1c200a013bfa75101a956bc056a13e73e98b28451100004000300080001002d0000000a0002002d2d5bc5270000001800018006000200400000000400030005000200000000000800020001000000000000"], 0x1498}}, 0x84) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) close(r5) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r6, 0x84, 0x7e, &(0x7f00000002c0)="1400000009000000", 0x8) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r5, 0x84, 0x5, 0x0, 0x0) read$rfkill(r2, &(0x7f0000000040), 0xfdef) r7 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) ioctl$VHOST_SET_VRING_ERR(r7, 0x4008af22, &(0x7f00000001c0)) r8 = socket$inet_sctp(0x2, 0x1, 0x84) ioctl$sock_inet_SIOCSIFFLAGS(r8, 0x8914, &(0x7f0000000000)={'bridge_slave_1\x00', 0xf5fd}) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000200)=0x0) prlimit64(r9, 0x3, &(0x7f0000000240)={0x7, 0xfffffffffffffc00}, &(0x7f0000000280)) sched_setscheduler(0x0, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="30000000410007012bbd700000000000047c00000400c2800c00018006000600843b00000c000a"], 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) ftruncate(r1, 0x8800000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r12 = syz_open_dev$vim2m(&(0x7f0000000080), 0x401, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r12, 0xc0405602, &(0x7f00000000c0)={0x10, 0x0, 0x80, "df0d6bee0a5ddf91a6f674538f47aef9eec3031eae9d0a1850e204ae7042c278", 0x50424752}) recvmmsg(r11, &(0x7f00000034c0)=[{{0x0, 0x0, &(0x7f0000001e40)=[{&(0x7f0000000b80)=""/4096, 0x20001b80}, {&(0x7f0000001b80)=""/112, 0x70}], 0x2, 0x0, 0xa0028cb4}}], 0x40000000000013c, 0x700, 0x0) 2.448473882s ago: executing program 1 (id=1587): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = dup(r0) ioctl$TIOCL_SETSEL(r1, 0x541c, &(0x7f0000000040)={0x2, {0x2, 0x103, 0x300, 0x400, 0x180}}) 2.336478986s ago: executing program 1 (id=1588): r0 = syz_open_dev$video(&(0x7f0000000040), 0xa8, 0x41841) ioctl$VIDIOC_CROPCAP(r0, 0xc02c563a, &(0x7f00000002c0)={0x2, {0x7f, 0x4, 0xbf, 0xfffffffc}, {0x0, 0x4, 0xc, 0x6}, {0x7, 0x2}}) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00', 0x0, 0x2) getdents(r1, &(0x7f0000000080)=""/43, 0x2b) getdents(r1, &(0x7f0000000300)=""/206, 0xce) 2.329800352s ago: executing program 1 (id=1589): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi4\x00', 0x500, 0x0) ioctl$COMEDI_INSNLIST(r0, 0x8010640b, &(0x7f0000000100)={0x2, &(0x7f00000e4280)=[{0xe000003, 0x202, &(0x7f0000000140)=[0x80000001, 0x5, 0xfffffff5, 0x3, 0x8, 0x6cf, 0x1, 0x3, 0x5, 0x53c000, 0x722, 0x4, 0x6, 0x2, 0x0, 0x7, 0x5, 0xc, 0x6ff08256, 0x6, 0x6c8, 0x7, 0x2, 0x2, 0x0, 0x80000001, 0x7, 0x2, 0x4, 0x9, 0x9, 0x5, 0xed8e, 0xffffffe2, 0x8, 0x1, 0x5, 0xa428, 0x0, 0x5, 0xa, 0x4, 0x2, 0x0, 0x7, 0x1ff, 0x2, 0x4, 0x5, 0x40, 0x4, 0x3, 0xffffffff, 0x200, 0xf, 0x91b9, 0xd39, 0x2, 0xff, 0x6, 0x2, 0x5, 0x3ff, 0x9, 0x7, 0xd, 0x1, 0x6, 0x6, 0x3, 0xffffffff, 0x90, 0x8, 0x1, 0xd, 0x0, 0x4, 0x6, 0xfffffffc, 0x4fc0724c, 0x6, 0x22, 0xfd, 0x3, 0x0, 0x5, 0x5f5, 0x5ae8, 0x0, 0x4, 0x9, 0x7fffffff, 0x0, 0x7f, 0x6, 0x3, 0x5, 0x4, 0x3e00, 0x4, 0x200, 0x0, 0x7ff, 0xe, 0x3, 0xf, 0x2, 0x9, 0x9, 0x10000, 0xa, 0xfffffffd, 0x3, 0x4, 0x9, 0x7fffffff, 0x8, 0x7b, 0x401, 0x8, 0x80000000, 0xffffffff, 0x8000, 0x81, 0x10001, 0xae, 0xfffffffa, 0x4, 0xbb, 0x10e9bf8e, 0xa1, 0x0, 0x1, 0x200, 0x6, 0x5, 0x3, 0x8c3, 0x8, 0x9, 0x7, 0xa21a, 0x10000, 0x1, 0x1, 0x800000, 0x10000000, 0x3, 0xe395, 0x6, 0xde, 0x5, 0xb0c1, 0xfff, 0x1, 0x7, 0x2, 0x3, 0x2, 0x8, 0x7, 0x9, 0x0, 0x80000000, 0x2, 0x8, 0x7f, 0xffffffff, 0xf24, 0xfffffffb, 0x8001, 0xfffffff7, 0x3, 0x4, 0x7, 0x0, 0x3, 0x88, 0x6, 0x3bed, 0x8, 0xb4ddbda, 0xfffffffc, 0x4, 0x1, 0x7, 0x800, 0x7, 0xfffff3e5, 0x0, 0x8, 0x6, 0x7, 0x10, 0x8000, 0xc5, 0x6, 0x8, 0x3, 0x7fffffff, 0x7fff, 0x9, 0x3, 0xfffffff9, 0x7f, 0x7, 0xac1, 0x8000, 0x4, 0x7, 0x5, 0xfffffff8, 0x722, 0x8000, 0x7, 0x9, 0x1, 0x5, 0x80000000, 0x400, 0x7, 0x100, 0x2, 0xfffffff7, 0x6, 0x6, 0x2, 0x2, 0x200, 0xf, 0x8, 0x4fea, 0xd, 0x7, 0x2, 0x6, 0x2, 0x4, 0x4, 0x8, 0x7fff, 0xa04, 0x40, 0x9, 0x1, 0xff, 0x8, 0x7, 0x5, 0xd0, 0x2, 0x530, 0x7b, 0x100, 0x6, 0xffffdee6, 0x6, 0x8, 0x1, 0x1, 0x78, 0xfffffff7, 0xb, 0x8, 0x82, 0x102d, 0xef7c, 0xf3d, 0x9, 0x5, 0xef1, 0x1000, 0x400, 0x4a8, 0x7fffffff, 0x594a, 0xfffffff7, 0x10, 0x9, 0x9, 0x3, 0x7, 0x5, 0x200, 0x1, 0x5, 0x800, 0x2, 0x10, 0xf88d, 0xaf888e92, 0xd, 0x3, 0x849, 0x64, 0x0, 0x7, 0x101, 0x400, 0x8, 0x5, 0x8, 0x3, 0x8075, 0x8000, 0x0, 0x7fff, 0x0, 0x8000, 0x7, 0x3, 0x4b, 0x81, 0x3, 0x8f8, 0x2, 0x2, 0xfffffff3, 0x0, 0xff, 0x4, 0x2835, 0x8, 0x400, 0xd, 0x48c, 0x640, 0x4, 0x80000000, 0x8, 0x9, 0x0, 0x6, 0x8865, 0x0, 0x0, 0x7, 0x7f, 0x9, 0x7, 0x9, 0x0, 0xa934380f, 0x69, 0x8, 0x7, 0xc161, 0x7, 0xfffff000, 0x7fffffff, 0x10, 0x1, 0x5, 0x0, 0xb39, 0xe55, 0x1, 0x4, 0x4, 0x1, 0x0, 0x9, 0x8, 0x7, 0x7, 0x7fff, 0xfffffff8, 0x3, 0x3, 0xffffffd4, 0xc74, 0x400, 0x6, 0x312c, 0x5, 0x401, 0x2, 0x500, 0x554, 0x101, 0x4, 0xc, 0x2, 0x8, 0x7, 0x9, 0x7, 0x3c000, 0x1, 0x101, 0x1, 0x4, 0x0, 0x1ff, 0xecd, 0xfba, 0x7, 0x3b, 0x3ed9, 0x81, 0x0, 0x400, 0x0, 0x800, 0x60000, 0xffffff80, 0xffffffff, 0xa, 0x5, 0x7f, 0x8, 0x5, 0x9, 0xfffffffb, 0x4, 0xf4, 0x2, 0x5, 0x2, 0xabec, 0xd, 0x6, 0x9, 0x800, 0x3, 0x200, 0xfffff80d, 0x9, 0x5, 0x8000, 0x2, 0x8, 0x9, 0x7, 0x1ef8, 0x3, 0xcfa, 0x3, 0x0, 0x3, 0x7, 0x90000, 0x8, 0x5, 0x5, 0x3, 0x1000, 0x4, 0x4, 0x7, 0xc, 0xfffffffc, 0x5, 0x0, 0x4, 0x4, 0x80000000, 0xb3e4, 0xfff, 0x0, 0x9, 0x10001, 0x8000, 0x7, 0x8020, 0x8, 0x7fff, 0x0, 0x2, 0xbf2, 0x9, 0xbc, 0x9, 0x856, 0x6, 0x9, 0x6, 0x9, 0x80000001, 0xc2, 0x5, 0x0, 0x9, 0x0, 0x7, 0x80c8, 0x3, 0x9, 0x9, 0x6, 0x0, 0x5, 0xc, 0xad, 0x3, 0x3ff, 0xd, 0xf, 0x4, 0x8, 0x7, 0x3, 0x2, 0x4, 0x101, 0x1, 0x1, 0x1, 0x401, 0x3, 0x4a2, 0x0, 0xc0000000, 0xdd1], 0x5348, 0x7}, {0xe000003, 0x0, 0x0, 0xfffffff4, 0x7}]}) 2.290299524s ago: executing program 1 (id=1590): r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs\x00') lseek(r0, 0x400, 0x0) (fail_nth: 2) 1.886270453s ago: executing program 1 (id=1591): pidfd_send_signal(0xffffffffffffffff, 0x12, &(0x7f00000001c0)={0x23, 0x7fff, 0x2}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100), r0) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000480)={0x124, r1, 0x718, 0x70bd2c, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_SERVICE={0x38, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x2f}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'sh\x00'}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@private2}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x1d}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}]}, @IPVS_CMD_ATTR_SERVICE={0x50, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x3c}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@remote}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@dev={0xfe, 0x80, '\x00', 0xc}}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0xa}}]}, @IPVS_CMD_ATTR_DEST={0x24, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x80000000}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x5}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x160d}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x9}]}, @IPVS_CMD_ATTR_DEST={0x64, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x1}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x81}, @IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x3}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x101}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x5}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e20}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e24}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e22}]}]}, 0x124}, 0x1, 0x0, 0x0, 0x20004004}, 0xc000) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r0, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002000a00000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x801}, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000100)=0x1) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) fcntl$F_SET_FILE_RW_HINT(r3, 0x40e, &(0x7f0000000140)) connect$inet(r5, &(0x7f0000000180)={0x2, 0x4e21, @loopback}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000040)='lp', 0x2) sendto$inet(r5, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r5, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) getsockopt$EBT_SO_GET_ENTRIES(r5, 0x0, 0x81, &(0x7f0000000800)={'broute\x00', 0x0, 0x3, 0xdb, [0x401, 0x8, 0x800, 0x10, 0x5], 0x9, &(0x7f00000005c0)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], &(0x7f0000000700)=""/219}, &(0x7f0000000880)=0x78) ioctl$TCSETS(r4, 0x89f0, &(0x7f00000011c0)={0x6, 0xffff, 0x0, 0xd, 0x0, "5dee0000ea584000"}) r6 = socket$qrtr(0x2a, 0x2, 0x0) r7 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001080)={0x6c, 0x19, 0x1, 0x0, 0x25dfdbfb, {0x1d, 0xd601, 0x9}, [@nested={0x50, 0x12, 0x0, 0x1, [@nested={0x4c, 0xf8, 0x0, 0x1, [@typed={0x14, 0x133, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}}, @nested={0x31, 0xfb, 0x0, 0x1, [@generic="b5416b2b80f72979594745504f3a0aa6b036f86ce32d83591c6224e53de96804e6172083eaaa90cf56dd042b72"]}]}]}, @nested={0x8, 0x5, 0x0, 0x1, [@nested={0x4, 0x60}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x5}, 0x0) flistxattr(r6, &(0x7f0000003900)=""/68, 0x44) ioctl$TCXONC(r3, 0x540a, 0x8b4c754b649485ee) syz_usb_connect$uac3(0x0, 0x9e, &(0x7f0000000340)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0x41e, 0x323b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x8c, 0x3, 0x1, 0xab, 0x60, 0x7, {0x8, 0xb, 0x0, 0x1, 0x1, 0x1, 0x30, 0x6}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xe, 0x1e, 0x800}, [@input_terminal={0x14, 0x24, 0x2, 0x2, 0x401, 0x4, 0x1, 0xccd, 0x5c, 0x5, 0x10a, 0x5}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_discrete={0xa, 0x24, 0x2, 0x1, 0x1, 0x1, 0x5, 0x4, 'l~'}]}, {{0x9, 0x5, 0x1, 0x9, 0x3df, 0x6, 0x2, 0x4, {0xa, 0x25, 0x25, 0x9, 0xed, 0x3ff}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x40, 0x0, 0x3, 0x5, {0xa, 0x25, 0x25, 0x1, 0x7, 0x6}}}}}}}}]}}, &(0x7f00000006c0)={0xa, &(0x7f0000000440)={0xa, 0x6, 0x300, 0xfe, 0x4, 0x5, 0xff, 0x10}, 0x0, 0x0}) syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000040)={{0x12, 0x1, 0x10, 0x0, 0x0, 0x0, 0x8, 0x1430, 0x474b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x5, 0x40, 0xd, {0x8, 0xb, 0x0, 0x1, 0x1, 0x1, 0x30, 0x1}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x0, 0xa, 0x80000001}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x6, 0xff, 0xff, {0xa, 0x25, 0x25, 0x101, 0x7, 0xd6a3}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x2e, 0x0, 0x6, {0xa, 0x25, 0x25, 0x92, 0xe5, 0xf54c}}}}}}}}]}}, 0x0) 1.594386943s ago: executing program 3 (id=1592): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='dctcp', 0x5) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) sendto$inet6(r0, &(0x7f00000003c0), 0x0, 0x200080c0, &(0x7f0000000400)={0xa, 0x2, 0x3ff, @loopback, 0xffffff1e}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='lp', 0x2) sendto$inet6(r0, &(0x7f0000000180)='9', 0xfffffffffffffd46, 0x4820, 0x0, 0xffffffffffffff3e) r1 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000700), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_POLICER_SET(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x54, r3, 0x1, 0x0, 0x3, {0x22}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}, {0xc}, {0xc}}]}, 0x54}, 0x1, 0x0, 0x0, 0xd0}, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_int(r4, 0x29, 0x1a, 0x0, 0x0) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="0100ffffffff0000400001000000050007000000000008000900000000101400200000000000000000000000ffff0000000008000a000000000014001f0000000000000000000000000000000000060002000000000006001b004e200000050021"], 0x6c}, 0x1, 0x620b}, 0x0) 645.339599ms ago: executing program 3 (id=1593): r0 = openat$yama_ptrace_scope(0xffffffffffffff9c, &(0x7f0000001400), 0x2, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=ANY=[@ANYBLOB="4c0000000906010200000000000000000500ffff240022801800018014000240fe8000000000000000400000000000aa08000a40000000020900020073797a31000000000500010007000000"], 0x4c}}, 0x4000080) sendmsg$IPSET_CMD_DESTROY(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x1c, 0x3, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x8005}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x200000c0) openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x182000, 0x0) fstat(r0, &(0x7f0000001440)) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) readv(r0, &(0x7f00000000c0)=[{&(0x7f0000000080)=""/56, 0x38}], 0x1) 300.209774ms ago: executing program 3 (id=1594): kexec_load(0x3, 0x2, &(0x7f00000005c0)=[{&(0x7f0000000100)="047715ac7141c111fab2fcda5de4dc8b278029bcb1bd17524f177856cac105f463c77e2d2ab44d875217dc82baa911f236f959fb9227524d4fe6b621a19823457d04c39928", 0x45, 0x5, 0xffffffff}, {0x0, 0x0, 0x7, 0x2}], 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002840)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback, 0x20}, 0x1c, 0x0}}], 0x1, 0x14018891) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x82, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) ioctl$SIOCSIFHWADDR(r3, 0x8914, 0x0) write$tun(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000001400000060ec97000fc82c00fe8000000000000000000000000000aaff02000000000000000000000000000106"], 0xffe) 0s ago: executing program 1 (id=1595): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120141014813442024040075ee69010203010902240001000010000904b8070259d1ca000905060200020d0006090582020002"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000940)={0x40, 0xa, 0x4, "a0e763a8"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000005c0)={0x1c, &(0x7f0000000100)=ANY=[@ANYBLOB="205aba"], 0x0, 0x0}) r1 = syz_usb_connect$rtl8150(0x2, 0x3f, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect(0x5, 0x71, &(0x7f0000002040)=ANY=[@ANYBLOB="00015002d48b86105e0468049cb20102030109025f00010340207f09044a0107b5efe409090505100002015b0d0905c3021a0201010809050510ff03d180fb09050d020800fc40090905070000008109000705b1a62325cc090504002000030900070549de57"], &(0x7f0000002500)={0x0, 0x0, 0x0, 0x0}) sendmsg$nl_route_sched_retired(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000600)=@newtaction={0x44, 0x30, 0x1, 0x70bd29, 0x25dfdbfa, {}, [{0x30, 0x1, [@m_ipt={0x2c, 0x1, 0x0, 0x0, {{0x8}, {0x4}, {0x4}, {0x3fad7e17a27f2d2d, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1}}}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x8080}, 0x9080) syz_usb_control_io$rtl8150(r1, &(0x7f00000002c0)={0x14, &(0x7f0000000140)={0x20, 0x22, 0xff, {0xff, 0x23, "25856a78424d258ba987d284099dee41f1ccb08df3466aa4d2db753070cda03e84bb4df17c008be5464c3d34dea838e5e565f16eb1382aba76fd6b24c92b72ab0cf6f23529a4d410e1ea1bfb19819a94dfa6047142a29356bfedda6ba58167f0f525827dbd73c62cce2b4e4eb1c5fd2c91a4d9e202a51b9a01e6b640ea20ec05705fd127a3e0c99f89375a8961e873a73c29eca531a719e895eda25cf6598099c2a85714b776f8c33b481af28b433ed827358dbb876be73475edae6d61ba80f905d3868034d67b8fd3be24a5c75fa37e67707e1d3257efa76e1be30012c9b7dad4efa1b9f1ffb786c99091395aa971616bf39be503947c2184fe271d34"}}, &(0x7f0000000280)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x427}}}, &(0x7f0000000480)={0x2c, &(0x7f0000000300)={0x20, 0xe, 0x56, "36207b646a2b1219864ef517c5efb6c36fe2ac195db6e7830bec2f9a005dfc77c5bdf3a4bfd36766048c82e5c065d15e90317a482bfb36516f12471dc6cdbeaa3fbaed755ba4d3da1fa5e932f6063cb67deca508c0ee"}, &(0x7f0000000380)={0x0, 0xa, 0x1, 0x81}, &(0x7f00000003c0)={0x0, 0x8, 0x1, 0x58}, &(0x7f0000000400)={0xc0, 0x5, 0x6, "1951baaceddf"}, &(0x7f0000000440)}) kernel console output (not intermixed with test programs): /0x580 [ 176.571227][ T8071] ? trace_irq_disable+0x3b/0x140 [ 176.571247][ T8071] ? clear_bhb_loop+0x40/0x90 [ 176.571266][ T8071] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 176.571280][ T8071] RIP: 0033:0x7f84f44dce59 [ 176.571294][ T8071] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 176.571307][ T8071] RSP: 002b:00007f84f272e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 176.571323][ T8071] RAX: ffffffffffffffda RBX: 00007f84f4755fa0 RCX: 00007f84f44dce59 [ 176.571335][ T8071] RDX: 000000000000004e RSI: 0000000000000029 RDI: 0000000000000003 [ 176.571344][ T8071] RBP: 00007f84f272e090 R08: 0000000000000004 R09: 0000000000000000 [ 176.571353][ T8071] R10: 00002000000000c0 R11: 0000000000000246 R12: 0000000000000001 [ 176.571363][ T8071] R13: 00007f84f4756038 R14: 00007f84f4755fa0 R15: 00007ffde0169118 [ 176.571386][ T8071] [ 176.572247][ T8071] socket: no more sockets [ 176.626253][ T8073] sit0: entered promiscuous mode [ 176.694785][ T8073] netlink: 'syz.3.994': attribute type 1 has an invalid length. [ 176.694846][ T8073] netlink: 1 bytes leftover after parsing attributes in process `syz.3.994'. [ 176.726070][ T822] usb 1-1: device descriptor read/64, error -71 [ 176.852982][ T822] usb usb1-port1: attempt power cycle [ 176.955585][ T8078] sg_write: data in/out 504197/136 bytes for SCSI command 0x0-- guessing data in; [ 176.955585][ T8078] program syz.1.996 not setting count and/or reply_len properly [ 177.048737][ T8082] sg_write: data in/out 548864/136 bytes for SCSI command 0x0-- guessing data in; [ 177.048737][ T8082] program syz.3.998 not setting count and/or reply_len properly [ 177.053350][ T8083] netlink: 104 bytes leftover after parsing attributes in process `syz.3.998'. [ 177.256435][ T822] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 177.276945][ T822] usb 1-1: device descriptor read/8, error -71 [ 177.456415][ T5696] usb 4-1: new full-speed USB device number 36 using dummy_hcd [ 177.483553][ T8108] sg_write: data in/out 504197/136 bytes for SCSI command 0x0-- guessing data in; [ 177.483553][ T8108] program syz.2.1010 not setting count and/or reply_len properly [ 177.516155][ T822] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 177.548869][ T822] usb 1-1: device descriptor read/8, error -71 [ 177.611188][ T5696] usb 4-1: New USB device found, idVendor=0c72, idProduct=000d, bcdDevice=27.9b [ 177.611217][ T5696] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 177.611237][ T5696] usb 4-1: Product: syz [ 177.611252][ T5696] usb 4-1: Manufacturer: syz [ 177.611267][ T5696] usb 4-1: SerialNumber: syz [ 177.620946][ T5696] usb 4-1: config 0 descriptor?? [ 177.669333][ T822] usb usb1-port1: unable to enumerate USB device [ 178.070135][ T8118] FAULT_INJECTION: forcing a failure. [ 178.070135][ T8118] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 178.070161][ T8118] CPU: 1 UID: 0 PID: 8118 Comm: syz.2.1014 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 178.070180][ T8118] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 178.070190][ T8118] Call Trace: [ 178.070196][ T8118] [ 178.070202][ T8118] dump_stack_lvl+0xe8/0x150 [ 178.070224][ T8118] should_fail_ex+0x467/0x600 [ 178.070255][ T8118] _copy_from_user+0x2d/0xb0 [ 178.070275][ T8118] ___sys_sendmsg+0x1c6/0x360 [ 178.070296][ T8118] ? __lock_acquire+0x683/0x2ce0 [ 178.070322][ T8118] ? __pfx____sys_sendmsg+0x10/0x10 [ 178.070368][ T8118] ? __fget_files+0x2a/0x420 [ 178.070385][ T8118] ? __fget_files+0x3a8/0x420 [ 178.070411][ T8118] __sys_sendmmsg+0x279/0x4d0 [ 178.070438][ T8118] ? __pfx___sys_sendmmsg+0x10/0x10 [ 178.070467][ T8118] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 178.070493][ T8118] ? ksys_write+0x248/0x270 [ 178.070515][ T8118] ? __pfx_ksys_write+0x10/0x10 [ 178.070563][ T8118] __x64_sys_sendmmsg+0xa0/0xc0 [ 178.070595][ T8118] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 178.070619][ T8118] do_syscall_64+0x174/0x580 [ 178.070647][ T8118] ? trace_irq_disable+0x3b/0x140 [ 178.070679][ T8118] ? clear_bhb_loop+0x40/0x90 [ 178.070699][ T8118] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 178.070715][ T8118] RIP: 0033:0x7f84f44dce59 [ 178.070729][ T8118] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 178.070742][ T8118] RSP: 002b:00007f84f272e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 178.070759][ T8118] RAX: ffffffffffffffda RBX: 00007f84f4755fa0 RCX: 00007f84f44dce59 [ 178.070771][ T8118] RDX: 0000000000000001 RSI: 00002000000073c0 RDI: 0000000000000003 [ 178.070781][ T8118] RBP: 00007f84f272e090 R08: 0000000000000000 R09: 0000000000000000 [ 178.070790][ T8118] R10: 0000000020004814 R11: 0000000000000246 R12: 0000000000000001 [ 178.070800][ T8118] R13: 00007f84f4756038 R14: 00007f84f4755fa0 R15: 00007ffde0169118 [ 178.070824][ T8118] [ 178.290110][ T5696] peak_usb 4-1:0.0: PEAK-System PCAN-USB Pro hwrev 0 serial 00000000.00000000 (2 channels) [ 178.290152][ T5696] peak_usb 4-1:0.0 can0: sending command failure: -22 [ 178.290202][ T5696] peak_usb 4-1:0.0 can0: sending command failure: -22 [ 178.443511][ T5696] peak_usb 4-1:0.0: probe with driver peak_usb failed with error -22 [ 178.508973][ T5696] usb 4-1: USB disconnect, device number 36 [ 179.148110][ T32] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 179.301857][ T32] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 179.301881][ T32] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 179.304009][ T32] usb 2-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice=9e.7f [ 179.304038][ T32] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 179.304060][ T32] usb 2-1: Product: syz [ 179.304075][ T32] usb 2-1: Manufacturer: syz [ 179.304089][ T32] usb 2-1: SerialNumber: syz [ 179.336632][ T32] usb 2-1: config 0 descriptor?? [ 179.486134][ T11] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 179.625715][ T8183] FAULT_INJECTION: forcing a failure. [ 179.625715][ T8183] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 179.625741][ T8183] CPU: 1 UID: 0 PID: 8183 Comm: syz.0.1046 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 179.625760][ T8183] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 179.625771][ T8183] Call Trace: [ 179.625777][ T8183] [ 179.625783][ T8183] dump_stack_lvl+0xe8/0x150 [ 179.625833][ T8183] should_fail_ex+0x467/0x600 [ 179.625873][ T8183] _copy_from_user+0x2d/0xb0 [ 179.625892][ T8183] ___sys_sendmsg+0x1c6/0x360 [ 179.625912][ T8183] ? __lock_acquire+0x683/0x2ce0 [ 179.625935][ T8183] ? __pfx____sys_sendmsg+0x10/0x10 [ 179.626002][ T8183] ? __fget_files+0x2a/0x420 [ 179.626025][ T8183] ? __fget_files+0x3a8/0x420 [ 179.626057][ T8183] __x64_sys_sendmsg+0x1b7/0x290 [ 179.626087][ T8183] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 179.626131][ T8183] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 179.626153][ T8183] do_syscall_64+0x174/0x580 [ 179.626179][ T8183] ? trace_irq_disable+0x3b/0x140 [ 179.626206][ T8183] ? clear_bhb_loop+0x40/0x90 [ 179.626230][ T8183] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 179.626249][ T8183] RIP: 0033:0x7efe2cdfce59 [ 179.626275][ T8183] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 179.626294][ T8183] RSP: 002b:00007efe2b04e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 179.626315][ T8183] RAX: ffffffffffffffda RBX: 00007efe2d075fa0 RCX: 00007efe2cdfce59 [ 179.626329][ T8183] RDX: 0000000000000804 RSI: 0000200000000300 RDI: 0000000000000003 [ 179.626342][ T8183] RBP: 00007efe2b04e090 R08: 0000000000000000 R09: 0000000000000000 [ 179.626354][ T8183] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 179.626366][ T8183] R13: 00007efe2d076038 R14: 00007efe2d075fa0 R15: 00007ffdbbb93ab8 [ 179.626396][ T8183] [ 179.736143][ T11] usb 3-1: unable to get BOS descriptor or descriptor too short [ 179.767560][ T11] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 179.767582][ T11] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 179.840191][ T32] usb 2-1: USB disconnect, device number 42 [ 179.847449][ T11] usb 3-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 179.847474][ T11] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 179.847493][ T11] usb 3-1: Product: syz [ 179.847504][ T11] usb 3-1: Manufacturer: syz [ 179.847518][ T11] usb 3-1: SerialNumber: syz [ 179.915224][ T11] usb 3-1: selecting invalid altsetting 1 [ 179.915918][ T11] usb 3-1: unit 6 not found! [ 180.053629][ T8187] syzkaller1: entered promiscuous mode [ 180.053650][ T8187] syzkaller1: entered allmulticast mode [ 180.158393][ T11] usb 3-1: 2:0: failed to get current value for ch 0 (-71) [ 180.302919][ T11] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 180.317196][ T11] usb 3-1: USB disconnect, device number 19 [ 180.347439][ T5620] usb 2-1: new full-speed USB device number 43 using dummy_hcd [ 180.389467][ T6220] udevd[6220]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 180.500179][ T5620] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 180.500204][ T5620] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 180.503659][ T5620] usb 2-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice=9e.7f [ 180.503692][ T5620] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 180.503711][ T5620] usb 2-1: Product: syz [ 180.503724][ T5620] usb 2-1: Manufacturer: syz [ 180.503736][ T5620] usb 2-1: SerialNumber: syz [ 180.570945][ T5620] usb 2-1: config 0 descriptor?? [ 180.779458][ T5696] usb 2-1: USB disconnect, device number 43 [ 180.870406][ T8224] FAULT_INJECTION: forcing a failure. [ 180.870406][ T8224] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 180.870439][ T8224] CPU: 0 UID: 0 PID: 8224 Comm: syz.2.1066 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 180.870461][ T8224] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 180.870472][ T8224] Call Trace: [ 180.870479][ T8224] [ 180.870487][ T8224] dump_stack_lvl+0xe8/0x150 [ 180.870512][ T8224] should_fail_ex+0x467/0x600 [ 180.870546][ T8224] _copy_to_user+0x31/0xb0 [ 180.870570][ T8224] simple_read_from_buffer+0xe1/0x170 [ 180.870597][ T8224] proc_fail_nth_read+0x1be/0x230 [ 180.870621][ T8224] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 180.870645][ T8224] ? rw_verify_area+0x250/0x4d0 [ 180.870671][ T8224] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 180.870691][ T8224] vfs_read+0x219/0xa90 [ 180.870723][ T8224] ? __pfx_vfs_read+0x10/0x10 [ 180.870750][ T8224] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 180.870778][ T8224] ? lockdep_hardirqs_on+0x7a/0x110 [ 180.870809][ T8224] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 180.870838][ T8224] ? mutex_lock_nested+0x152/0x1d0 [ 180.870867][ T8224] ? fdget_pos+0x252/0x320 [ 180.870897][ T8224] ksys_read+0x156/0x270 [ 180.870923][ T8224] ? __pfx_ksys_read+0x10/0x10 [ 180.870955][ T8224] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 180.870976][ T8224] do_syscall_64+0x174/0x580 [ 180.870999][ T8224] ? trace_irq_disable+0x3b/0x140 [ 180.871023][ T8224] ? clear_bhb_loop+0x40/0x90 [ 180.871047][ T8224] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 180.871064][ T8224] RIP: 0033:0x7f84f449d68e [ 180.871081][ T8224] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 180.871098][ T8224] RSP: 002b:00007f84f272dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 180.871118][ T8224] RAX: ffffffffffffffda RBX: 00007f84f272e6c0 RCX: 00007f84f449d68e [ 180.871132][ T8224] RDX: 000000000000000f RSI: 00007f84f272e0a0 RDI: 0000000000000005 [ 180.871143][ T8224] RBP: 00007f84f272e090 R08: 0000000000000000 R09: 0000000000000000 [ 180.871154][ T8224] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 180.871165][ T8224] R13: 00007f84f4756038 R14: 00007f84f4755fa0 R15: 00007ffde0169118 [ 180.871202][ T8224] [ 181.449879][ T8247] sg_write: data in/out 404444/42 bytes for SCSI command 0x0-- guessing data in; [ 181.449879][ T8247] program syz.1.1074 not setting count and/or reply_len properly [ 182.072657][ T8288] usb usb1: usbfs: process 8288 (syz.1.1093) did not claim interface 0 before use [ 182.075828][ T8288] Invalid source name [ 182.080622][ T8290] Invalid source name [ 182.346402][ T5620] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 182.476188][ T5620] usb 3-1: device descriptor read/64, error -71 [ 182.592516][ T8314] syz.0.1104 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 182.593484][ T8314] FAULT_INJECTION: forcing a failure. [ 182.593484][ T8314] name failslab, interval 1, probability 0, space 0, times 0 [ 182.593509][ T8314] CPU: 0 UID: 0 PID: 8314 Comm: syz.0.1104 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 182.593529][ T8314] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 182.593539][ T8314] Call Trace: [ 182.593546][ T8314] [ 182.593553][ T8314] dump_stack_lvl+0xe8/0x150 [ 182.593579][ T8314] should_fail_ex+0x467/0x600 [ 182.593607][ T8314] should_failslab+0xa8/0x100 [ 182.593625][ T8314] ? __pmd_alloc+0xa4/0x5e0 [ 182.593644][ T8314] kmem_cache_alloc_noprof+0x9e/0x680 [ 182.593660][ T8314] ? __pmd_alloc+0xa4/0x5e0 [ 182.593679][ T8314] __pmd_alloc+0xa4/0x5e0 [ 182.593697][ T8314] handle_mm_fault+0xfa7/0x1520 [ 182.593722][ T8314] ? handle_mm_fault+0xe9/0x1520 [ 182.593740][ T8314] ? __pfx_handle_mm_fault+0x10/0x10 [ 182.593783][ T8314] ? __lock_acquire+0x683/0x2ce0 [ 182.593831][ T8314] ? lock_mm_and_find_vma+0xa7/0x340 [ 182.593855][ T8314] do_user_addr_fault+0x744/0x1340 [ 182.593889][ T8314] exc_page_fault+0x6a/0xc0 [ 182.593913][ T8314] asm_exc_page_fault+0x26/0x30 [ 182.593930][ T8314] RIP: 0010:rep_movs_alternative+0xf/0xa0 [ 182.593949][ T8314] Code: c4 10 c3 cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 83 f9 40 73 44 83 f9 08 73 25 85 c9 74 0f <8a> 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 cc cc cc cc 66 2e [ 182.593965][ T8314] RSP: 0018:ffffc9000f88fcb8 EFLAGS: 00050202 [ 182.593981][ T8314] RAX: 00007ffffffff001 RBX: 0000000000000004 RCX: 0000000000000004 [ 182.593993][ T8314] RDX: 0000000000000001 RSI: 0000200000000180 RDI: ffffc9000f88fd70 [ 182.594005][ T8314] RBP: ffffc9000f88fe68 R08: 0000000000000003 R09: 0000000000000004 [ 182.594027][ T8314] R10: dffffc0000000000 R11: fffff52001f11fae R12: 1ffff92001f11fa4 [ 182.594041][ T8314] R13: 0000200000000180 R14: ffffc9000f88fd70 R15: 0000200000000180 [ 182.594068][ T8314] _copy_from_user+0x7a/0xb0 [ 182.594092][ T8314] do_sock_getsockopt+0x200/0x7e0 [ 182.594122][ T8314] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 182.594163][ T8314] ? __fget_files+0x3a8/0x420 [ 182.594182][ T8314] ? __fget_files+0x2a/0x420 [ 182.594208][ T8314] __x64_sys_getsockopt+0x1aa/0x250 [ 182.594238][ T8314] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 182.594257][ T8314] do_syscall_64+0x174/0x580 [ 182.594280][ T8314] ? trace_irq_disable+0x3b/0x140 [ 182.594309][ T8314] ? clear_bhb_loop+0x40/0x90 [ 182.594337][ T8314] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 182.594359][ T8314] RIP: 0033:0x7efe2cdfce59 [ 182.594379][ T8314] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 182.594398][ T8314] RSP: 002b:00007efe2b04e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 182.594421][ T8314] RAX: ffffffffffffffda RBX: 00007efe2d075fa0 RCX: 00007efe2cdfce59 [ 182.594437][ T8314] RDX: 0000000000000001 RSI: 000000000000011b RDI: 0000000000000003 [ 182.594451][ T8314] RBP: 00007efe2b04e090 R08: 0000200000000180 R09: 0000000000000000 [ 182.594466][ T8314] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 182.594479][ T8314] R13: 00007efe2d076038 R14: 00007efe2d075fa0 R15: 00007ffdbbb93ab8 [ 182.594514][ T8314] [ 182.719947][ T8317] FAULT_INJECTION: forcing a failure. [ 182.719947][ T8317] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 182.720028][ T8317] CPU: 1 UID: 0 PID: 8317 Comm: syz.1.1105 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 182.720101][ T8317] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 182.720134][ T8317] Call Trace: [ 182.720164][ T8317] [ 182.720193][ T8317] dump_stack_lvl+0xe8/0x150 [ 182.720302][ T8317] should_fail_ex+0x467/0x600 [ 182.720390][ T8317] _copy_from_user+0x2d/0xb0 [ 182.720450][ T8317] vmci_host_unlocked_ioctl+0x9d3/0x2850 [ 182.720531][ T8317] ? __pfx_vmci_host_unlocked_ioctl+0x10/0x10 [ 182.720675][ T8317] ? tomoyo_path_number_perm+0x219/0x5f0 [ 182.720736][ T8317] ? tomoyo_path_number_perm+0x219/0x5f0 [ 182.720807][ T8317] ? do_vfs_ioctl+0x1184/0x1550 [ 182.720879][ T8317] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 182.720974][ T8317] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 182.721032][ T8317] ? hook_file_ioctl+0x1f3/0x600 [ 182.721095][ T8317] ? lockdep_hardirqs_on+0x7a/0x110 [ 182.721187][ T8317] ? __fget_files+0x2a/0x420 [ 182.721248][ T8317] ? __fget_files+0x2a/0x420 [ 182.721301][ T8317] ? __fget_files+0x3a8/0x420 [ 182.721349][ T8317] ? __fget_files+0x2a/0x420 [ 182.721410][ T8317] ? bpf_lsm_file_ioctl+0x9/0x20 [ 182.721471][ T8317] ? __pfx_vmci_host_unlocked_ioctl+0x10/0x10 [ 182.721566][ T8317] __se_sys_ioctl+0xff/0x170 [ 182.721634][ T8317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 182.721687][ T8317] do_syscall_64+0x174/0x580 [ 182.721748][ T8317] ? trace_irq_disable+0x3b/0x140 [ 182.721813][ T8317] ? clear_bhb_loop+0x40/0x90 [ 182.721868][ T8317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 182.721919][ T8317] RIP: 0033:0x7f9c282bce59 [ 182.721965][ T8317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 182.722003][ T8317] RSP: 002b:00007f9c2650e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 182.722051][ T8317] RAX: ffffffffffffffda RBX: 00007f9c28535fa0 RCX: 00007f9c282bce59 [ 182.722086][ T8317] RDX: 0000200000001c00 RSI: 00000000000007b2 RDI: 0000000000000003 [ 182.722120][ T8317] RBP: 00007f9c2650e090 R08: 0000000000000000 R09: 0000000000000000 [ 182.722151][ T8317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 182.722163][ T8317] R13: 00007f9c28536038 R14: 00007f9c28535fa0 R15: 00007ffc76a552d8 [ 182.722215][ T8317] [ 182.756127][ T5620] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 183.017583][ T5620] usb 3-1: device descriptor read/64, error -71 [ 183.139724][ T5620] usb usb3-port1: attempt power cycle [ 183.526124][ T5620] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 183.546865][ T5620] usb 3-1: device descriptor read/8, error -71 [ 183.631079][ T8334] Invalid logical block size (19) [ 183.786164][ T5620] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 183.808274][ T5620] usb 3-1: device descriptor read/8, error -71 [ 183.917584][ T5620] usb usb3-port1: unable to enumerate USB device [ 183.946141][ T11] usb 4-1: new full-speed USB device number 37 using dummy_hcd [ 184.100230][ T5610] Bluetooth: hci3: Malformed LE Event: 0x0d [ 184.102009][ T11] usb 4-1: unable to get BOS descriptor or descriptor too short [ 184.103772][ T11] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 184.103804][ T11] usb 4-1: can't read configurations, error -71 [ 184.426255][ T8371] FAULT_INJECTION: forcing a failure. [ 184.426255][ T8371] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 184.426289][ T8371] CPU: 0 UID: 0 PID: 8371 Comm: syz.0.1127 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 184.426310][ T8371] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 184.426321][ T8371] Call Trace: [ 184.426328][ T8371] [ 184.426336][ T8371] dump_stack_lvl+0xe8/0x150 [ 184.426362][ T8371] should_fail_ex+0x467/0x600 [ 184.426397][ T8371] _copy_to_user+0x31/0xb0 [ 184.426422][ T8371] simple_read_from_buffer+0xe1/0x170 [ 184.426449][ T8371] proc_fail_nth_read+0x1be/0x230 [ 184.426473][ T8371] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 184.426497][ T8371] ? rw_verify_area+0x250/0x4d0 [ 184.426523][ T8371] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 184.426543][ T8371] vfs_read+0x219/0xa90 [ 184.426578][ T8371] ? __pfx_vfs_read+0x10/0x10 [ 184.426603][ T8371] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 184.426628][ T8371] ? lockdep_hardirqs_on+0x7a/0x110 [ 184.426652][ T8371] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 184.426675][ T8371] ? mutex_lock_nested+0x152/0x1d0 [ 184.426705][ T8371] ? fdget_pos+0x252/0x320 [ 184.426742][ T8371] ksys_read+0x156/0x270 [ 184.426768][ T8371] ? __pfx_ksys_read+0x10/0x10 [ 184.426800][ T8371] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 184.426820][ T8371] do_syscall_64+0x174/0x580 [ 184.426852][ T8371] ? trace_irq_disable+0x3b/0x140 [ 184.426875][ T8371] ? clear_bhb_loop+0x40/0x90 [ 184.426899][ T8371] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 184.426918][ T8371] RIP: 0033:0x7efe2cdbd68e [ 184.426935][ T8371] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 184.426952][ T8371] RSP: 002b:00007efe2b04dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 184.426972][ T8371] RAX: ffffffffffffffda RBX: 00007efe2b04e6c0 RCX: 00007efe2cdbd68e [ 184.426986][ T8371] RDX: 000000000000000f RSI: 00007efe2b04e0a0 RDI: 0000000000000003 [ 184.426998][ T8371] RBP: 00007efe2b04e090 R08: 0000000000000000 R09: 0000000000000000 [ 184.427009][ T8371] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 184.427021][ T8371] R13: 00007efe2d076038 R14: 00007efe2d075fa0 R15: 00007ffdbbb93ab8 [ 184.427051][ T8371] [ 184.810159][ T8383] FAULT_INJECTION: forcing a failure. [ 184.810159][ T8383] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 184.810187][ T8383] CPU: 1 UID: 0 PID: 8383 Comm: syz.1.1132 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 184.810205][ T8383] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 184.810214][ T8383] Call Trace: [ 184.810220][ T8383] [ 184.810227][ T8383] dump_stack_lvl+0xe8/0x150 [ 184.810250][ T8383] should_fail_ex+0x467/0x600 [ 184.810278][ T8383] _copy_to_user+0x31/0xb0 [ 184.810297][ T8383] simple_read_from_buffer+0xe1/0x170 [ 184.810317][ T8383] proc_fail_nth_read+0x1be/0x230 [ 184.810336][ T8383] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 184.810357][ T8383] ? rw_verify_area+0x250/0x4d0 [ 184.810378][ T8383] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 184.810395][ T8383] vfs_read+0x219/0xa90 [ 184.810420][ T8383] ? __pfx_vfs_read+0x10/0x10 [ 184.810441][ T8383] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 184.810462][ T8383] ? lockdep_hardirqs_on+0x7a/0x110 [ 184.810484][ T8383] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 184.810508][ T8383] ? mutex_lock_nested+0x152/0x1d0 [ 184.810536][ T8383] ? fdget_pos+0x252/0x320 [ 184.810565][ T8383] ksys_read+0x156/0x270 [ 184.810592][ T8383] ? __pfx_ksys_read+0x10/0x10 [ 184.810624][ T8383] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 184.810644][ T8383] do_syscall_64+0x174/0x580 [ 184.810667][ T8383] ? trace_irq_disable+0x3b/0x140 [ 184.810691][ T8383] ? clear_bhb_loop+0x40/0x90 [ 184.810714][ T8383] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 184.810732][ T8383] RIP: 0033:0x7f9c2827d68e [ 184.810750][ T8383] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 184.810767][ T8383] RSP: 002b:00007f9c2650dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 184.810786][ T8383] RAX: ffffffffffffffda RBX: 00007f9c2650e6c0 RCX: 00007f9c2827d68e [ 184.810800][ T8383] RDX: 000000000000000f RSI: 00007f9c2650e0a0 RDI: 0000000000000004 [ 184.810812][ T8383] RBP: 00007f9c2650e090 R08: 0000000000000000 R09: 0000000000000000 [ 184.810823][ T8383] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 184.810833][ T8383] R13: 00007f9c28536038 R14: 00007f9c28535fa0 R15: 00007ffc76a552d8 [ 184.810873][ T8383] [ 185.339124][ T822] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 185.366122][ T11] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 185.486084][ T822] usb 2-1: Using ep0 maxpacket: 8 [ 185.488042][ T822] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 185.488071][ T822] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 185.488094][ T822] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 185.488116][ T822] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 185.488153][ T822] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 185.488174][ T822] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 185.516627][ T11] usb 4-1: Using ep0 maxpacket: 16 [ 185.532156][ T11] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 185.532312][ T11] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 185.532374][ T11] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 185.532422][ T11] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 185.532481][ T11] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 185.552987][ T11] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 185.553026][ T11] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 185.553073][ T11] usb 4-1: Manufacturer: syz [ 185.670545][ T11] usb 4-1: config 0 descriptor?? [ 185.884961][ T822] usb 2-1: GET_CAPABILITIES returned 0 [ 185.885016][ T822] usbtmc 2-1:16.0: can't read capabilities [ 185.996109][ T11] rc_core: IR keymap rc-hauppauge not found [ 185.996135][ T11] Registered IR keymap rc-empty [ 185.996595][ T11] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 186.016469][ T11] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 186.062717][ T11] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 186.107727][ T11] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input12 [ 186.113304][ T11] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 186.145190][ T11] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 186.156200][ T11] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 186.176302][ T11] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 186.197065][ T11] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 186.198626][ T8437] comedi comedi1: fl512: I/O base address not correctly aligned [ 186.218276][ T11] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 186.236284][ T11] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 186.262951][ T11] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 186.310414][ T11] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 186.327963][ T11] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 186.353688][ T5620] usb 2-1: USB disconnect, device number 44 [ 186.455581][ T11] mceusb 4-1:0.0: Registered with mce emulator interface version 1 [ 186.455602][ T11] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 186.491822][ T11] usb 4-1: USB disconnect, device number 39 [ 186.514438][ T8449] FAULT_INJECTION: forcing a failure. [ 186.514438][ T8449] name failslab, interval 1, probability 0, space 0, times 0 [ 186.514473][ T8449] CPU: 1 UID: 0 PID: 8449 Comm: syz.0.1161 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 186.514498][ T8449] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 186.514512][ T8449] Call Trace: [ 186.514521][ T8449] [ 186.514529][ T8449] dump_stack_lvl+0xe8/0x150 [ 186.514558][ T8449] should_fail_ex+0x467/0x600 [ 186.514597][ T8449] should_failslab+0xa8/0x100 [ 186.514626][ T8449] __kvmalloc_node_noprof+0x176/0x880 [ 186.514663][ T8449] ? hash_netport_create+0x38f/0xfa0 [ 186.514698][ T8449] ? hash_netport_create+0x38f/0xfa0 [ 186.514742][ T8449] hash_netport_create+0x38f/0xfa0 [ 186.514789][ T8449] ? __pfx_hash_netport_create+0x10/0x10 [ 186.514826][ T8449] ip_set_create+0xae4/0x1a40 [ 186.514853][ T8449] ? ip_set_create+0x4f1/0x1a40 [ 186.514889][ T8449] ? __pfx_ip_set_create+0x10/0x10 [ 186.514934][ T8449] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 186.514966][ T8449] ? lockdep_hardirqs_on+0x7a/0x110 [ 186.514995][ T8449] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 186.515030][ T8449] nfnetlink_rcv_msg+0xcd6/0x12c0 [ 186.515061][ T8449] ? nfnetlink_rcv_msg+0x22e/0x12c0 [ 186.515110][ T8449] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 186.515173][ T8449] ? __lock_acquire+0x683/0x2ce0 [ 186.515211][ T8449] ? __lock_acquire+0x683/0x2ce0 [ 186.515238][ T8449] ? sock_sendmsg_nosec+0x13a/0x180 [ 186.515268][ T8449] netlink_rcv_skb+0x226/0x4a0 [ 186.515298][ T8449] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 186.515330][ T8449] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 186.515373][ T8449] ? bpf_lsm_capable+0x9/0x20 [ 186.515401][ T8449] ? security_capable+0x7e/0x2c0 [ 186.515439][ T8449] nfnetlink_rcv+0x2b9/0x28d0 [ 186.515471][ T8449] ? sock_sendmsg_nosec+0x13a/0x180 [ 186.515493][ T8449] ? __pfx_snprintf+0x10/0x10 [ 186.515518][ T8449] ? unwind_get_return_address+0x4d/0x90 [ 186.515550][ T8449] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 186.515586][ T8449] ? trim_netdev_trace+0x791/0x820 [ 186.515622][ T8449] ? __pfx_trim_netdev_trace+0x10/0x10 [ 186.515672][ T8449] ? stack_trace_save+0xa9/0x100 [ 186.515703][ T8449] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 186.515733][ T8449] ? save_netdev_trace_buffer+0x18f/0x5e0 [ 186.515770][ T8449] ? save_netdev_trace_buffer+0x4c3/0x5e0 [ 186.515814][ T8449] ? __pfx_save_netdev_trace_buffer+0x10/0x10 [ 186.515858][ T8449] ? ref_tracker_free+0x668/0x820 [ 186.515876][ T8449] ? __netlink_deliver_tap+0x600/0x880 [ 186.515902][ T8449] ? netlink_deliver_tap+0x19c/0x1b0 [ 186.515929][ T8449] ? netlink_unicast+0x7b8/0x990 [ 186.515951][ T8449] ? netlink_sendmsg+0x813/0xb40 [ 186.515980][ T8449] ? sock_sendmsg_nosec+0x13a/0x180 [ 186.516000][ T8449] ? ____sys_sendmsg+0x565/0x870 [ 186.516027][ T8449] ? ___sys_sendmsg+0x2a5/0x360 [ 186.516054][ T8449] ? __x64_sys_sendmsg+0x1b7/0x290 [ 186.516080][ T8449] ? do_syscall_64+0x174/0x580 [ 186.516105][ T8449] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 186.516134][ T8449] ? __skb_clone+0x449/0x6c0 [ 186.516176][ T8449] ? skb_clone+0x246/0x3a0 [ 186.516208][ T8449] ? __netlink_deliver_tap+0x838/0x880 [ 186.516236][ T8449] ? netlink_deliver_tap+0x2e/0x1b0 [ 186.516272][ T8449] ? netlink_deliver_tap+0x2e/0x1b0 [ 186.516301][ T8449] ? netlink_deliver_tap+0x2e/0x1b0 [ 186.516337][ T8449] netlink_unicast+0x7f5/0x990 [ 186.516375][ T8449] netlink_sendmsg+0x813/0xb40 [ 186.516416][ T8449] ? __pfx_netlink_sendmsg+0x10/0x10 [ 186.516449][ T8449] ? aa_sock_msg_perm+0x122/0x200 [ 186.516485][ T8449] ? __pfx_netlink_sendmsg+0x10/0x10 [ 186.516513][ T8449] sock_sendmsg_nosec+0x13a/0x180 [ 186.516536][ T8449] ____sys_sendmsg+0x565/0x870 [ 186.516564][ T8449] ? __might_fault+0xaf/0x130 [ 186.516594][ T8449] ? __pfx_____sys_sendmsg+0x10/0x10 [ 186.516631][ T8449] ? import_iovec+0x73/0xa0 [ 186.516661][ T8449] ___sys_sendmsg+0x2a5/0x360 [ 186.516689][ T8449] ? __lock_acquire+0x683/0x2ce0 [ 186.516722][ T8449] ? __pfx____sys_sendmsg+0x10/0x10 [ 186.516789][ T8449] ? __fget_files+0x2a/0x420 [ 186.516812][ T8449] ? __fget_files+0x3a8/0x420 [ 186.516854][ T8449] __x64_sys_sendmsg+0x1b7/0x290 [ 186.516882][ T8449] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 186.516924][ T8449] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 186.516943][ T8449] do_syscall_64+0x174/0x580 [ 186.516968][ T8449] ? trace_irq_disable+0x3b/0x140 [ 186.516993][ T8449] ? clear_bhb_loop+0x40/0x90 [ 186.517016][ T8449] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 186.517034][ T8449] RIP: 0033:0x7efe2cdfce59 [ 186.517052][ T8449] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 186.517068][ T8449] RSP: 002b:00007efe2b04e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 186.517087][ T8449] RAX: ffffffffffffffda RBX: 00007efe2d075fa0 RCX: 00007efe2cdfce59 [ 186.517101][ T8449] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 186.517112][ T8449] RBP: 00007efe2b04e090 R08: 0000000000000000 R09: 0000000000000000 [ 186.517124][ T8449] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 186.517135][ T8449] R13: 00007efe2d076038 R14: 00007efe2d075fa0 R15: 00007ffdbbb93ab8 [ 186.517170][ T8449] [ 187.130956][ T8453] FAULT_INJECTION: forcing a failure. [ 187.130956][ T8453] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 187.130989][ T8453] CPU: 0 UID: 0 PID: 8453 Comm: syz.0.1163 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 187.131010][ T8453] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 187.131022][ T8453] Call Trace: [ 187.131030][ T8453] [ 187.131037][ T8453] dump_stack_lvl+0xe8/0x150 [ 187.131064][ T8453] should_fail_ex+0x467/0x600 [ 187.131099][ T8453] _copy_to_user+0x31/0xb0 [ 187.131122][ T8453] simple_read_from_buffer+0xe1/0x170 [ 187.131149][ T8453] proc_fail_nth_read+0x1be/0x230 [ 187.131174][ T8453] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 187.131197][ T8453] ? rw_verify_area+0x250/0x4d0 [ 187.131224][ T8453] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 187.131243][ T8453] vfs_read+0x219/0xa90 [ 187.131272][ T8453] ? __pfx_vfs_read+0x10/0x10 [ 187.131298][ T8453] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 187.131325][ T8453] ? lockdep_hardirqs_on+0x7a/0x110 [ 187.131348][ T8453] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 187.131372][ T8453] ? mutex_lock_nested+0x152/0x1d0 [ 187.131401][ T8453] ? fdget_pos+0x252/0x320 [ 187.131430][ T8453] ksys_read+0x156/0x270 [ 187.131457][ T8453] ? __pfx_ksys_read+0x10/0x10 [ 187.131488][ T8453] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 187.131508][ T8453] do_syscall_64+0x174/0x580 [ 187.131531][ T8453] ? trace_irq_disable+0x3b/0x140 [ 187.131557][ T8453] ? clear_bhb_loop+0x40/0x90 [ 187.131580][ T8453] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 187.131599][ T8453] RIP: 0033:0x7efe2cdbd68e [ 187.131617][ T8453] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 187.131645][ T8453] RSP: 002b:00007efe2b04dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 187.131665][ T8453] RAX: ffffffffffffffda RBX: 00007efe2b04e6c0 RCX: 00007efe2cdbd68e [ 187.131679][ T8453] RDX: 000000000000000f RSI: 00007efe2b04e0a0 RDI: 0000000000000004 [ 187.131691][ T8453] RBP: 00007efe2b04e090 R08: 0000000000000000 R09: 0000000000000000 [ 187.131703][ T8453] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 187.131714][ T8453] R13: 00007efe2d076038 R14: 00007efe2d075fa0 R15: 00007ffdbbb93ab8 [ 187.131744][ T8453] [ 187.672154][ T8474] sg_write: data in/out 270400/132 bytes for SCSI command 0x34-- guessing data in; [ 187.672154][ T8474] program syz.3.1174 not setting count and/or reply_len properly [ 187.843515][ T8475] FAULT_INJECTION: forcing a failure. [ 187.843515][ T8475] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 187.843546][ T8475] CPU: 0 UID: 0 PID: 8475 Comm: syz.2.1173 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 187.843567][ T8475] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 187.843578][ T8475] Call Trace: [ 187.843586][ T8475] [ 187.843594][ T8475] dump_stack_lvl+0xe8/0x150 [ 187.843620][ T8475] should_fail_ex+0x467/0x600 [ 187.843655][ T8475] _copy_from_user+0x2d/0xb0 [ 187.843678][ T8475] copy_folio_from_user+0x1e3/0x320 [ 187.843705][ T8475] hugetlb_mfill_atomic_pte+0xe90/0x1780 [ 187.843766][ T8475] mfill_atomic_copy+0xcd6/0x1540 [ 187.843820][ T8475] ? __pfx_mfill_atomic_copy+0x10/0x10 [ 187.843872][ T8475] userfaultfd_ioctl+0x2582/0x8640 [ 187.843905][ T8475] ? stack_depot_save_flags+0x33/0x800 [ 187.843932][ T8475] ? __lock_acquire+0x683/0x2ce0 [ 187.843960][ T8475] ? kasan_save_track+0x4f/0x80 [ 187.843977][ T8475] ? kasan_save_track+0x3e/0x80 [ 187.843994][ T8475] ? kasan_save_free_info+0x40/0x50 [ 187.844018][ T8475] ? __kasan_slab_free+0x5c/0x80 [ 187.844036][ T8475] ? kfree+0x1c5/0x6c0 [ 187.844050][ T8475] ? tomoyo_path_number_perm+0x4ba/0x5f0 [ 187.844073][ T8475] ? security_file_ioctl+0xc3/0x2a0 [ 187.844102][ T8475] ? __se_sys_ioctl+0x47/0x170 [ 187.844126][ T8475] ? do_syscall_64+0x174/0x580 [ 187.844150][ T8475] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 187.844173][ T8475] ? __pfx_userfaultfd_ioctl+0x10/0x10 [ 187.844230][ T8475] ? kasan_quarantine_put+0xbb/0x1f0 [ 187.844255][ T8475] ? tomoyo_path_number_perm+0x219/0x5f0 [ 187.844285][ T8475] ? do_vfs_ioctl+0x1184/0x1550 [ 187.844312][ T8475] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 187.844348][ T8475] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 187.844370][ T8475] ? hook_file_ioctl+0x1f3/0x600 [ 187.844394][ T8475] ? lockdep_hardirqs_on+0x7a/0x110 [ 187.844432][ T8475] ? __fget_files+0x2a/0x420 [ 187.844454][ T8475] ? __fget_files+0x2a/0x420 [ 187.844473][ T8475] ? __fget_files+0x3a8/0x420 [ 187.844491][ T8475] ? __fget_files+0x2a/0x420 [ 187.844513][ T8475] ? bpf_lsm_file_ioctl+0x9/0x20 [ 187.844535][ T8475] ? __pfx_userfaultfd_ioctl+0x10/0x10 [ 187.844559][ T8475] __se_sys_ioctl+0xff/0x170 [ 187.844585][ T8475] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 187.844605][ T8475] do_syscall_64+0x174/0x580 [ 187.844627][ T8475] ? trace_irq_disable+0x3b/0x140 [ 187.844650][ T8475] ? clear_bhb_loop+0x40/0x90 [ 187.844672][ T8475] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 187.844690][ T8475] RIP: 0033:0x7f84f44dce59 [ 187.844706][ T8475] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 187.844722][ T8475] RSP: 002b:00007f84f272e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 187.844741][ T8475] RAX: ffffffffffffffda RBX: 00007f84f4755fa0 RCX: 00007f84f44dce59 [ 187.844754][ T8475] RDX: 0000200000000000 RSI: 00000000c028aa03 RDI: 0000000000000003 [ 187.844766][ T8475] RBP: 00007f84f272e090 R08: 0000000000000000 R09: 0000000000000000 [ 187.844778][ T8475] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 187.844788][ T8475] R13: 00007f84f4756038 R14: 00007f84f4755fa0 R15: 00007ffde0169118 [ 187.844816][ T8475] [ 188.414383][ T8493] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1180'. [ 188.976230][ T5696] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 189.126076][ T5696] usb 4-1: Using ep0 maxpacket: 8 [ 189.128554][ T5696] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 189.128661][ T5696] usb 4-1: config 179 has an invalid descriptor of length 0, skipping remainder of the config [ 189.128680][ T5696] usb 4-1: config 179 has no interface number 0 [ 189.128721][ T5696] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 189.128745][ T5696] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 189.128770][ T5696] usb 4-1: config 179 interface 65 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 23 [ 189.128807][ T5696] usb 4-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 189.128828][ T5696] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 189.387359][ T8507] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 189.597997][ T5696] usb 4-1: USB disconnect, device number 40 [ 189.743410][ T8554] FAULT_INJECTION: forcing a failure. [ 189.743410][ T8554] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 189.743443][ T8554] CPU: 1 UID: 0 PID: 8554 Comm: syz.0.1206 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 189.743467][ T8554] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 189.743480][ T8554] Call Trace: [ 189.743488][ T8554] [ 189.743497][ T8554] dump_stack_lvl+0xe8/0x150 [ 189.743525][ T8554] should_fail_ex+0x467/0x600 [ 189.743563][ T8554] _copy_to_user+0x31/0xb0 [ 189.743590][ T8554] simple_read_from_buffer+0xe1/0x170 [ 189.743619][ T8554] proc_fail_nth_read+0x1be/0x230 [ 189.743645][ T8554] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 189.743671][ T8554] ? rw_verify_area+0x250/0x4d0 [ 189.743698][ T8554] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 189.743721][ T8554] vfs_read+0x219/0xa90 [ 189.743756][ T8554] ? __pfx_vfs_read+0x10/0x10 [ 189.743784][ T8554] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 189.743812][ T8554] ? lockdep_hardirqs_on+0x7a/0x110 [ 189.743858][ T8554] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 189.743894][ T8554] ? mutex_lock_nested+0x152/0x1d0 [ 189.743928][ T8554] ? fdget_pos+0x252/0x320 [ 189.743963][ T8554] ksys_read+0x156/0x270 [ 189.743993][ T8554] ? __pfx_ksys_read+0x10/0x10 [ 189.744019][ T8554] ? fput+0xa0/0xd0 [ 189.744049][ T8554] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 189.744074][ T8554] do_syscall_64+0x174/0x580 [ 189.744102][ T8554] ? trace_irq_disable+0x3b/0x140 [ 189.744131][ T8554] ? clear_bhb_loop+0x40/0x90 [ 189.744159][ T8554] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 189.744182][ T8554] RIP: 0033:0x7efe2cdbd68e [ 189.744202][ T8554] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 189.744222][ T8554] RSP: 002b:00007efe2b04dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 189.744249][ T8554] RAX: ffffffffffffffda RBX: 00007efe2b04e6c0 RCX: 00007efe2cdbd68e [ 189.744265][ T8554] RDX: 000000000000000f RSI: 00007efe2b04e0a0 RDI: 0000000000000006 [ 189.744279][ T8554] RBP: 00007efe2b04e090 R08: 0000000000000000 R09: 0000000000000000 [ 189.744293][ T8554] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 189.744307][ T8554] R13: 00007efe2d076038 R14: 00007efe2d075fa0 R15: 00007ffdbbb93ab8 [ 189.744342][ T8554] [ 190.496236][ T5696] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 190.523954][ T8576] 9p: Unknown Cache mode or invalid value f [ 190.556491][ T5620] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 190.627225][ T8586] tmpfs: Bad value for 'mpol' [ 190.646083][ T5696] usb 4-1: Using ep0 maxpacket: 32 [ 190.648688][ T5696] usb 4-1: config 0 has an invalid interface number: 35 but max is 0 [ 190.648712][ T5696] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 190.648732][ T5696] usb 4-1: config 0 has no interface number 0 [ 190.648773][ T5696] usb 4-1: config 0 interface 35 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 190.651317][ T5696] usb 4-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.ad [ 190.651345][ T5696] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 190.651364][ T5696] usb 4-1: Product: syz [ 190.651379][ T5696] usb 4-1: Manufacturer: syz [ 190.651393][ T5696] usb 4-1: SerialNumber: syz [ 190.714582][ T5620] usb 2-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 190.714665][ T5620] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 190.761868][ T5696] usb 4-1: config 0 descriptor?? [ 190.764100][ T5620] usb 2-1: config 0 descriptor?? [ 190.782720][ T5696] radio-si470x 4-1:0.35: could not find interrupt in endpoint [ 190.782801][ T5696] radio-si470x 4-1:0.35: probe with driver radio-si470x failed with error -5 [ 191.085536][ T8597] tmpfs: Unknown parameter '00000000000000000000005' [ 191.337822][ T5696] radio-raremono 4-1:0.35: this is not Thanko's Raremono. [ 191.338679][ T5696] usbhid 4-1:0.35: couldn't find an input interrupt endpoint [ 191.553003][ T5620] udl 2-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 191.553466][ T5620] [drm:udl_init] *ERROR* Selecting channel failed [ 191.836301][ T5620] [drm] Initialized udl 0.0.1 for 2-1:0.0 on minor 2 [ 191.836329][ T5620] [drm] Initialized udl on minor 2 [ 191.904355][ T5620] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 192.034219][ T5620] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 192.075473][ T5620] usb 2-1: USB disconnect, device number 45 [ 192.140419][ T11] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 192.289054][ T8564] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 192.309878][ T8564] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 192.428727][ T8644] FAULT_INJECTION: forcing a failure. [ 192.428727][ T8644] name failslab, interval 1, probability 0, space 0, times 0 [ 192.428753][ T8644] CPU: 1 UID: 0 PID: 8644 Comm: syz.0.1248 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 192.428770][ T8644] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 192.428779][ T8644] Call Trace: [ 192.428785][ T8644] [ 192.428791][ T8644] dump_stack_lvl+0xe8/0x150 [ 192.428812][ T8644] should_fail_ex+0x467/0x600 [ 192.428841][ T8644] should_failslab+0xa8/0x100 [ 192.428863][ T8644] __kvmalloc_node_noprof+0x176/0x880 [ 192.428883][ T8644] ? rt_spin_unlock+0x157/0x200 [ 192.428898][ T8644] ? proc_sys_call_handler+0x3d1/0x830 [ 192.428916][ T8644] ? proc_sys_call_handler+0x3d1/0x830 [ 192.428939][ T8644] proc_sys_call_handler+0x3d1/0x830 [ 192.428962][ T8644] ? __pfx_proc_sys_call_handler+0x10/0x10 [ 192.428982][ T8644] ? __asan_memset+0x22/0x50 [ 192.429018][ T8644] iter_file_splice_write+0xa36/0x1240 [ 192.429077][ T8644] ? __pfx_iter_file_splice_write+0x10/0x10 [ 192.429113][ T8644] ? __pfx_iter_file_splice_write+0x10/0x10 [ 192.429136][ T8644] direct_splice_actor+0x104/0x160 [ 192.429161][ T8644] splice_direct_to_actor+0x586/0xcc0 [ 192.429204][ T8644] ? __pfx_direct_splice_actor+0x10/0x10 [ 192.429227][ T8644] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 192.429258][ T8644] do_splice_direct+0x19b/0x2a0 [ 192.429282][ T8644] ? __pfx_do_splice_direct+0x10/0x10 [ 192.429304][ T8644] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 192.429332][ T8644] ? rw_verify_area+0x209/0x4d0 [ 192.429362][ T8644] do_sendfile+0x540/0x7e0 [ 192.429387][ T8644] ? __pfx_do_sendfile+0x10/0x10 [ 192.429414][ T8644] __se_sys_sendfile64+0xdf/0x1a0 [ 192.429443][ T8644] ? __pfx___se_sys_sendfile64+0x10/0x10 [ 192.429477][ T8644] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 192.429496][ T8644] do_syscall_64+0x174/0x580 [ 192.429519][ T8644] ? trace_irq_disable+0x3b/0x140 [ 192.429543][ T8644] ? clear_bhb_loop+0x40/0x90 [ 192.429565][ T8644] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 192.429584][ T8644] RIP: 0033:0x7efe2cdfce59 [ 192.429602][ T8644] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 192.429619][ T8644] RSP: 002b:00007efe2b04e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 192.429637][ T8644] RAX: ffffffffffffffda RBX: 00007efe2d075fa0 RCX: 00007efe2cdfce59 [ 192.429651][ T8644] RDX: 00002000000000c0 RSI: 0000000000000003 RDI: 0000000000000004 [ 192.429672][ T8644] RBP: 00007efe2b04e090 R08: 0000000000000000 R09: 0000000000000000 [ 192.429684][ T8644] R10: 000000000000000a R11: 0000000000000246 R12: 0000000000000002 [ 192.429694][ T8644] R13: 00007efe2d076038 R14: 00007efe2d075fa0 R15: 00007ffdbbb93ab8 [ 192.429721][ T8644] [ 192.722461][ T8597] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 192.728444][ T8597] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 192.874171][ T8652] FAULT_INJECTION: forcing a failure. [ 192.874171][ T8652] name failslab, interval 1, probability 0, space 0, times 0 [ 192.874199][ T8652] CPU: 0 UID: 0 PID: 8652 Comm: syz.2.1251 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 192.874222][ T8652] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 192.874232][ T8652] Call Trace: [ 192.874237][ T8652] [ 192.874244][ T8652] dump_stack_lvl+0xe8/0x150 [ 192.874265][ T8652] should_fail_ex+0x467/0x600 [ 192.874293][ T8652] should_failslab+0xa8/0x100 [ 192.874314][ T8652] kmem_cache_alloc_node_noprof+0xac/0x660 [ 192.874332][ T8652] ? __alloc_skb+0x1d7/0x7a0 [ 192.874349][ T8652] ? __alloc_skb+0x1d7/0x7a0 [ 192.874371][ T8652] __alloc_skb+0x1d7/0x7a0 [ 192.874392][ T8652] pfkey_send_acquire+0x60e/0x2d70 [ 192.874423][ T8652] ? km_query+0x2e/0x210 [ 192.874445][ T8652] km_query+0x11c/0x210 [ 192.874467][ T8652] ? km_query+0x2e/0x210 [ 192.874490][ T8652] xfrm_state_find+0x3f58/0x5fd0 [ 192.874525][ T8652] ? xfrm_state_find+0x306/0x5fd0 [ 192.874548][ T8652] ? add_lock_to_list+0xc7/0x100 [ 192.874577][ T8652] ? __pfx_xfrm_state_find+0x10/0x10 [ 192.874612][ T8652] xfrm_resolve_and_create_bundle+0x7f3/0x3090 [ 192.874660][ T8652] ? xfrm_policy_lookup_inexact_addr+0x273/0x280 [ 192.874681][ T8652] ? __pfx_xfrm_resolve_and_create_bundle+0x10/0x10 [ 192.874710][ T8652] ? xfrm_policy_lookup_bytype+0x147/0x1870 [ 192.874730][ T8652] ? xfrm_policy_lookup_bytype+0x17fe/0x1870 [ 192.874752][ T8652] ? xfrm_policy_lookup_bytype+0x147/0x1870 [ 192.874779][ T8652] ? __pfx_xfrm_policy_lookup_bytype+0x10/0x10 [ 192.874801][ T8652] ? xfrm_expand_policies+0x48f/0x740 [ 192.874832][ T8652] xfrm_lookup_with_ifid+0x57c/0x1b80 [ 192.874887][ T8652] ? __pfx_xfrm_lookup_with_ifid+0x10/0x10 [ 192.874939][ T8652] xfrm_lookup_route+0x3c/0x1c0 [ 192.874980][ T8652] ? ip6_datagram_dst_update+0x4f7/0xcd0 [ 192.875001][ T8652] ip6_datagram_dst_update+0x729/0xcd0 [ 192.875027][ T8652] __ip6_datagram_connect+0xb82/0x10e0 [ 192.875055][ T8652] ? __pfx___ip6_datagram_connect+0x10/0x10 [ 192.875093][ T8652] ? lockdep_hardirqs_on+0x7a/0x110 [ 192.875129][ T8652] udpv6_connect+0x33/0x230 [ 192.875152][ T8652] __sys_connect+0x336/0x470 [ 192.875172][ T8652] ? __pfx___sys_connect+0x10/0x10 [ 192.875199][ T8652] ? __pfx_ksys_write+0x10/0x10 [ 192.875224][ T8652] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 192.875240][ T8652] __x64_sys_connect+0x7a/0x90 [ 192.875260][ T8652] do_syscall_64+0x174/0x580 [ 192.875279][ T8652] ? trace_irq_disable+0x3b/0x140 [ 192.875299][ T8652] ? clear_bhb_loop+0x40/0x90 [ 192.875318][ T8652] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 192.875334][ T8652] RIP: 0033:0x7f84f44dce59 [ 192.875359][ T8652] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 192.875371][ T8652] RSP: 002b:00007f84f272e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 192.875386][ T8652] RAX: ffffffffffffffda RBX: 00007f84f4755fa0 RCX: 00007f84f44dce59 [ 192.875396][ T8652] RDX: 000000000000001c RSI: 0000200000000040 RDI: 0000000000000005 [ 192.875405][ T8652] RBP: 00007f84f272e090 R08: 0000000000000000 R09: 0000000000000000 [ 192.875413][ T8652] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 192.875421][ T8652] R13: 00007f84f4756038 R14: 00007f84f4755fa0 R15: 00007ffde0169118 [ 192.875443][ T8652] [ 193.040373][ T5620] usb 2-1: new full-speed USB device number 46 using dummy_hcd [ 193.205292][ T5620] usb 2-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 193.205323][ T5620] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 193.205336][ T5620] usb 2-1: Product: syz [ 193.205345][ T5620] usb 2-1: Manufacturer: syz [ 193.205354][ T5620] usb 2-1: SerialNumber: syz [ 193.247911][ T5620] usb 2-1: config 0 descriptor?? [ 193.291155][ T5620] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 193.562057][ T8669] FAULT_INJECTION: forcing a failure. [ 193.562057][ T8669] name failslab, interval 1, probability 0, space 0, times 0 [ 193.562092][ T8669] CPU: 1 UID: 0 PID: 8669 Comm: syz.2.1259 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 193.562121][ T8669] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 193.562133][ T8669] Call Trace: [ 193.562140][ T8669] [ 193.562148][ T8669] dump_stack_lvl+0xe8/0x150 [ 193.562174][ T8669] should_fail_ex+0x467/0x600 [ 193.562239][ T8669] should_failslab+0xa8/0x100 [ 193.562272][ T8669] __kmalloc_noprof+0xfb/0x790 [ 193.562294][ T8669] ? __vb2_queue_alloc+0x2a0/0x1660 [ 193.562323][ T8669] ? __vb2_queue_alloc+0x2a0/0x1660 [ 193.562360][ T8669] __vb2_queue_alloc+0x2a0/0x1660 [ 193.562422][ T8669] vb2_core_reqbufs+0xc3f/0x1470 [ 193.562470][ T8669] ? __pfx_vb2_core_reqbufs+0x10/0x10 [ 193.562513][ T8669] ? vb2_verify_memory_type+0x1fc/0x570 [ 193.562548][ T8669] vb2_ioctl_reqbufs+0x4be/0x850 [ 193.562604][ T8669] __video_do_ioctl+0x8b2/0xc70 [ 193.562636][ T8669] ? __pfx___video_do_ioctl+0x10/0x10 [ 193.562673][ T8669] video_usercopy+0x860/0x1430 [ 193.562704][ T8669] ? __pfx___video_do_ioctl+0x10/0x10 [ 193.562728][ T8669] ? __pfx_video_usercopy+0x10/0x10 [ 193.562763][ T8669] ? __fget_files+0x2a/0x420 [ 193.562791][ T8669] ? __fget_files+0x2a/0x420 [ 193.562814][ T8669] ? __fget_files+0x3a8/0x420 [ 193.562842][ T8669] v4l2_ioctl+0x190/0x1e0 [ 193.562877][ T8669] ? __pfx_v4l2_ioctl+0x10/0x10 [ 193.562910][ T8669] __se_sys_ioctl+0xff/0x170 [ 193.562941][ T8669] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 193.562965][ T8669] do_syscall_64+0x174/0x580 [ 193.562993][ T8669] ? trace_irq_disable+0x3b/0x140 [ 193.563022][ T8669] ? clear_bhb_loop+0x40/0x90 [ 193.563051][ T8669] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 193.563074][ T8669] RIP: 0033:0x7f84f44dce59 [ 193.563095][ T8669] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 193.563114][ T8669] RSP: 002b:00007f84f272e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 193.563138][ T8669] RAX: ffffffffffffffda RBX: 00007f84f4755fa0 RCX: 00007f84f44dce59 [ 193.563155][ T8669] RDX: 00002000000001c0 RSI: 00000000c0145608 RDI: 0000000000000003 [ 193.563170][ T8669] RBP: 00007f84f272e090 R08: 0000000000000000 R09: 0000000000000000 [ 193.563184][ T8669] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 193.563197][ T8669] R13: 00007f84f4756038 R14: 00007f84f4755fa0 R15: 00007ffde0169118 [ 193.563233][ T8669] [ 194.102643][ T9] usb 4-1: USB disconnect, device number 41 [ 194.221705][ T1337] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.238685][ T1337] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.619842][ T8708] overlayfs: failed to resolve './bus': -2 [ 194.776362][ T5696] usb 4-1: new full-speed USB device number 42 using dummy_hcd [ 194.957941][ T5696] usb 4-1: unable to get BOS descriptor or descriptor too short [ 194.962138][ T5696] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 194.962176][ T5696] usb 4-1: can't read configurations, error -71 [ 195.035427][ T8728] FAULT_INJECTION: forcing a failure. [ 195.035427][ T8728] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 195.035464][ T8728] CPU: 0 UID: 0 PID: 8728 Comm: syz.0.1288 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 195.035486][ T8728] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 195.035501][ T8728] Call Trace: [ 195.035508][ T8728] [ 195.035515][ T8728] dump_stack_lvl+0xe8/0x150 [ 195.035540][ T8728] should_fail_ex+0x467/0x600 [ 195.035572][ T8728] _copy_from_iter+0x1d3/0x1660 [ 195.035598][ T8728] ? trace_kmem_cache_alloc+0x29/0xe0 [ 195.035620][ T8728] ? __pfx__copy_from_iter+0x10/0x10 [ 195.035639][ T8728] ? __alloc_skb+0x276/0x7a0 [ 195.035659][ T8728] ? __alloc_skb+0x276/0x7a0 [ 195.035686][ T8728] ? netlink_sendmsg+0x650/0xb40 [ 195.035712][ T8728] ? skb_put+0x112/0x210 [ 195.035737][ T8728] netlink_sendmsg+0x6c0/0xb40 [ 195.035771][ T8728] ? __pfx_netlink_sendmsg+0x10/0x10 [ 195.035801][ T8728] ? aa_sock_msg_perm+0x122/0x200 [ 195.035833][ T8728] ? __pfx_netlink_sendmsg+0x10/0x10 [ 195.035860][ T8728] sock_sendmsg_nosec+0x13a/0x180 [ 195.035881][ T8728] ____sys_sendmsg+0x565/0x870 [ 195.035906][ T8728] ? __might_fault+0xaf/0x130 [ 195.035930][ T8728] ? __pfx_____sys_sendmsg+0x10/0x10 [ 195.035964][ T8728] ? import_iovec+0x73/0xa0 [ 195.035990][ T8728] ___sys_sendmsg+0x2a5/0x360 [ 195.036014][ T8728] ? __lock_acquire+0x683/0x2ce0 [ 195.036042][ T8728] ? __pfx____sys_sendmsg+0x10/0x10 [ 195.036098][ T8728] ? __fget_files+0x2a/0x420 [ 195.036119][ T8728] ? __fget_files+0x3a8/0x420 [ 195.036148][ T8728] __x64_sys_sendmsg+0x1b7/0x290 [ 195.036176][ T8728] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 195.036219][ T8728] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 195.036239][ T8728] do_syscall_64+0x174/0x580 [ 195.036262][ T8728] ? trace_irq_disable+0x3b/0x140 [ 195.036287][ T8728] ? clear_bhb_loop+0x40/0x90 [ 195.036309][ T8728] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 195.036328][ T8728] RIP: 0033:0x7efe2cdfce59 [ 195.036345][ T8728] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 195.036362][ T8728] RSP: 002b:00007efe2b04e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 195.036382][ T8728] RAX: ffffffffffffffda RBX: 00007efe2d075fa0 RCX: 00007efe2cdfce59 [ 195.036397][ T8728] RDX: 0000000000000800 RSI: 0000200000002c40 RDI: 0000000000000003 [ 195.036409][ T8728] RBP: 00007efe2b04e090 R08: 0000000000000000 R09: 0000000000000000 [ 195.036421][ T8728] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 195.036482][ T8728] R13: 00007efe2d076038 R14: 00007efe2d075fa0 R15: 00007ffdbbb93ab8 [ 195.036515][ T8728] [ 196.113518][ T8768] netlink: 'syz.0.1303': attribute type 2 has an invalid length. [ 196.113659][ T8762] netlink: 'syz.0.1303': attribute type 2 has an invalid length. [ 196.373118][ T5620] gspca_stk1135: reg_w 0x352 err -71 [ 196.374168][ T5620] gspca_stk1135: serial bus timeout: status=0x00 [ 196.374185][ T5620] gspca_stk1135: Sensor write failed [ 196.374225][ T5620] gspca_stk1135: serial bus timeout: status=0x00 [ 196.374236][ T5620] gspca_stk1135: Sensor write failed [ 196.374272][ T5620] gspca_stk1135: serial bus timeout: status=0x00 [ 196.374284][ T5620] gspca_stk1135: Sensor read failed [ 196.374317][ T5620] gspca_stk1135: serial bus timeout: status=0x00 [ 196.374328][ T5620] gspca_stk1135: Sensor read failed [ 196.374336][ T5620] gspca_stk1135: Detected sensor type unknown (0x0) [ 196.374375][ T5620] gspca_stk1135: serial bus timeout: status=0x00 [ 196.374386][ T5620] gspca_stk1135: Sensor read failed [ 196.374422][ T5620] gspca_stk1135: serial bus timeout: status=0x00 [ 196.374433][ T5620] gspca_stk1135: Sensor read failed [ 196.374468][ T5620] gspca_stk1135: serial bus timeout: status=0x00 [ 196.374478][ T5620] gspca_stk1135: Sensor write failed [ 196.374512][ T5620] gspca_stk1135: serial bus timeout: status=0x00 [ 196.374522][ T5620] gspca_stk1135: Sensor write failed [ 196.374610][ T5620] stk1135 2-1:0.0: probe with driver stk1135 failed with error -71 [ 196.465338][ T5620] usb 2-1: USB disconnect, device number 46 [ 196.607139][ T11] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 196.685858][ T8790] FAULT_INJECTION: forcing a failure. [ 196.685858][ T8790] name failslab, interval 1, probability 0, space 0, times 0 [ 196.685890][ T8790] CPU: 0 UID: 0 PID: 8790 Comm: syz.0.1312 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 196.685930][ T8790] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 196.685942][ T8790] Call Trace: [ 196.685949][ T8790] [ 196.685958][ T8790] dump_stack_lvl+0xe8/0x150 [ 196.686007][ T8790] should_fail_ex+0x467/0x600 [ 196.686046][ T8790] should_failslab+0xa8/0x100 [ 196.686072][ T8790] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 196.686099][ T8790] kmem_cache_alloc_noprof+0x9e/0x680 [ 196.686122][ T8790] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 196.686156][ T8790] __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 196.686195][ T8790] mmu_topup_memory_caches+0x21/0x170 [ 196.686227][ T8790] kvm_mmu_load+0x9d/0x22b0 [ 196.686256][ T8790] ? kvm_msr_allowed+0x9a/0x490 [ 196.686284][ T8790] ? kvm_msr_allowed+0x9a/0x490 [ 196.686312][ T8790] ? kvm_msr_allowed+0x9a/0x490 [ 196.686339][ T8790] ? kvm_msr_allowed+0x3f4/0x490 [ 196.686366][ T8790] ? kvm_msr_allowed+0x9a/0x490 [ 196.686392][ T8790] ? kvm_apic_has_interrupt+0x740/0x770 [ 196.686427][ T8790] vcpu_run+0x4c13/0x73e0 [ 196.686499][ T8790] ? __lock_acquire+0x683/0x2ce0 [ 196.686551][ T8790] ? __pfx_vcpu_run+0x10/0x10 [ 196.686577][ T8790] ? kvm_arch_vcpu_ioctl_run+0x1f8/0x1960 [ 196.686605][ T8790] ? kvm_arch_vcpu_ioctl_run+0x1f8/0x1960 [ 196.686647][ T8790] kvm_arch_vcpu_ioctl_run+0xe51/0x1960 [ 196.686679][ T8790] ? kvm_arch_vcpu_ioctl_run+0x1f8/0x1960 [ 196.686715][ T8790] kvm_vcpu_ioctl+0xa64/0xfe0 [ 196.686751][ T8790] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 196.686778][ T8790] ? hook_file_ioctl+0x1f3/0x600 [ 196.686814][ T8790] ? lockdep_hardirqs_on+0x7a/0x110 [ 196.686860][ T8790] ? __fget_files+0x2a/0x420 [ 196.686886][ T8790] ? __fget_files+0x2a/0x420 [ 196.686909][ T8790] ? __fget_files+0x3a8/0x420 [ 196.686931][ T8790] ? __fget_files+0x2a/0x420 [ 196.686959][ T8790] ? bpf_lsm_file_ioctl+0x9/0x20 [ 196.686984][ T8790] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 196.687012][ T8790] __se_sys_ioctl+0xff/0x170 [ 196.687041][ T8790] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 196.687064][ T8790] do_syscall_64+0x174/0x580 [ 196.687089][ T8790] ? trace_irq_disable+0x3b/0x140 [ 196.687117][ T8790] ? clear_bhb_loop+0x40/0x90 [ 196.687143][ T8790] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 196.687164][ T8790] RIP: 0033:0x7efe2cdfce59 [ 196.687184][ T8790] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 196.687201][ T8790] RSP: 002b:00007efe2b02d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 196.687223][ T8790] RAX: ffffffffffffffda RBX: 00007efe2d076090 RCX: 00007efe2cdfce59 [ 196.687239][ T8790] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000008 [ 196.687252][ T8790] RBP: 00007efe2b02d090 R08: 0000000000000000 R09: 0000000000000000 [ 196.687265][ T8790] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 196.687277][ T8790] R13: 00007efe2d076128 R14: 00007efe2d076090 R15: 00007ffdbbb93ab8 [ 196.687330][ T8790] [ 196.756188][ T11] usb 4-1: Using ep0 maxpacket: 16 [ 196.878888][ T11] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 196.879024][ T11] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 196.879087][ T11] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 196.879146][ T11] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 196.879205][ T11] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 196.929463][ T11] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 196.929528][ T11] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 196.929573][ T11] usb 4-1: Manufacturer: syz [ 197.074268][ T11] usb 4-1: config 0 descriptor?? [ 197.368834][ T11] rc_core: IR keymap rc-hauppauge not found [ 197.368853][ T11] Registered IR keymap rc-empty [ 197.368997][ T11] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 197.386582][ T11] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 197.425460][ T11] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 197.448576][ T11] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input13 [ 197.477799][ T11] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 197.498995][ T11] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 197.516341][ T11] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 197.536220][ T11] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 197.556604][ T11] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 197.577008][ T11] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 197.596154][ T11] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 197.616162][ T11] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 197.636577][ T11] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 197.660172][ T11] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 197.726805][ T11] mceusb 4-1:0.0: Registered with mce emulator interface version 1 [ 197.726826][ T11] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 197.796184][ T11] usb 4-1: USB disconnect, device number 44 [ 197.818944][ T38] audit: type=1326 audit(1782859699.284:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8811 comm="syz.1.1325" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f9c282bce59 code=0x0 [ 198.373072][ T60] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 198.418864][ T60] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 198.422649][ T60] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 198.443423][ T60] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 198.453945][ T60] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 198.947091][ T822] usb 4-1: new full-speed USB device number 45 using dummy_hcd [ 199.145536][ T822] usb 4-1: unable to get BOS descriptor or descriptor too short [ 199.147390][ T822] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 199.147421][ T822] usb 4-1: can't read configurations, error -71 [ 199.352696][ T8860] FAULT_INJECTION: forcing a failure. [ 199.352696][ T8860] name failslab, interval 1, probability 0, space 0, times 0 [ 199.352722][ T8860] CPU: 0 UID: 0 PID: 8860 Comm: syz.2.1342 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 199.352751][ T8860] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 199.352759][ T8860] Call Trace: [ 199.352765][ T8860] [ 199.352770][ T8860] dump_stack_lvl+0xe8/0x150 [ 199.352789][ T8860] should_fail_ex+0x467/0x600 [ 199.352813][ T8860] should_failslab+0xa8/0x100 [ 199.352831][ T8860] __kmalloc_cache_noprof+0xa1/0x670 [ 199.352847][ T8860] ? __do_once_done+0x7c/0x1f0 [ 199.352862][ T8860] ? __do_once_done+0x7c/0x1f0 [ 199.352880][ T8860] __do_once_done+0x7c/0x1f0 [ 199.352897][ T8860] __rds_conn_create+0x2219/0x2260 [ 199.352928][ T8860] ? __pfx___rds_conn_create+0x10/0x10 [ 199.352946][ T8860] ? rcu_is_watching+0x15/0xb0 [ 199.352968][ T8860] ? trace_kmalloc+0x2a/0xf0 [ 199.352985][ T8860] ? __rt_spin_lock_init+0x3e/0x50 [ 199.353001][ T8860] rds_conn_create_outgoing+0x43/0x60 [ 199.353024][ T8860] rds_sendmsg+0xfca/0x20e0 [ 199.353049][ T8860] ? __pfx_rds_sendmsg+0x10/0x10 [ 199.353063][ T8860] ? aa_sk_perm+0x703/0x950 [ 199.353085][ T8860] ? __might_fault+0xaf/0x130 [ 199.353098][ T8860] ? __pfx_aa_sk_perm+0x10/0x10 [ 199.353120][ T8860] ? aa_sock_msg_perm+0x122/0x200 [ 199.353143][ T8860] ? __pfx_rds_sendmsg+0x10/0x10 [ 199.353157][ T8860] sock_sendmsg_nosec+0x13a/0x180 [ 199.353173][ T8860] ____sys_sendmsg+0x565/0x870 [ 199.353196][ T8860] ? __pfx_____sys_sendmsg+0x10/0x10 [ 199.353220][ T8860] ? import_iovec+0x73/0xa0 [ 199.353238][ T8860] ___sys_sendmsg+0x2a5/0x360 [ 199.353255][ T8860] ? __lock_acquire+0x683/0x2ce0 [ 199.353276][ T8860] ? __pfx____sys_sendmsg+0x10/0x10 [ 199.353316][ T8860] ? __fget_files+0x2a/0x420 [ 199.353330][ T8860] ? __fget_files+0x3a8/0x420 [ 199.353350][ T8860] __x64_sys_sendmsg+0x1b7/0x290 [ 199.353371][ T8860] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 199.353400][ T8860] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 199.353415][ T8860] do_syscall_64+0x174/0x580 [ 199.353432][ T8860] ? trace_irq_disable+0x3b/0x140 [ 199.353450][ T8860] ? clear_bhb_loop+0x40/0x90 [ 199.353466][ T8860] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 199.353479][ T8860] RIP: 0033:0x7f84f44dce59 [ 199.353491][ T8860] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 199.353503][ T8860] RSP: 002b:00007f84f272e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 199.353517][ T8860] RAX: ffffffffffffffda RBX: 00007f84f4755fa0 RCX: 00007f84f44dce59 [ 199.353527][ T8860] RDX: 0000000000000000 RSI: 0000200000001600 RDI: 0000000000000003 [ 199.353536][ T8860] RBP: 00007f84f272e090 R08: 0000000000000000 R09: 0000000000000000 [ 199.353544][ T8860] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 199.353553][ T8860] R13: 00007f84f4756038 R14: 00007f84f4755fa0 R15: 00007ffde0169118 [ 199.353573][ T8860] [ 199.636704][ T5620] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 199.816120][ T5620] usb 2-1: Using ep0 maxpacket: 16 [ 199.818031][ T5620] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 199.818078][ T5620] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 199.818104][ T5620] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 199.818124][ T5620] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 199.818145][ T5620] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 199.819199][ T5620] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 199.819224][ T5620] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 199.819243][ T5620] usb 2-1: Manufacturer: syz [ 199.926814][ T5620] usb 2-1: config 0 descriptor?? [ 200.000968][ T2176] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 200.237580][ T5620] rc_core: IR keymap rc-hauppauge not found [ 200.237599][ T5620] Registered IR keymap rc-empty [ 200.237730][ T5620] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 200.263769][ T5620] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 200.280911][ T5620] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 200.284557][ T5620] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input14 [ 200.308460][ T5620] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 200.327976][ T5620] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 200.348893][ T5620] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 200.366991][ T5620] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 200.386295][ T5620] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 200.407170][ T5620] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 200.428681][ T5620] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 200.446205][ T5620] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 200.467511][ T5620] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 200.488420][ T5620] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 200.545272][ T2176] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 200.565860][ T5620] mceusb 2-1:0.0: Registered with mce emulator interface version 1 [ 200.565881][ T5620] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 200.598801][ T5610] Bluetooth: hci4: command tx timeout [ 200.626300][ T5620] usb 2-1: USB disconnect, device number 47 [ 200.988972][ T2176] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 201.114486][ T8907] FAULT_INJECTION: forcing a failure. [ 201.114486][ T8907] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 201.114516][ T8907] CPU: 1 UID: 0 PID: 8907 Comm: syz.2.1361 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 201.114536][ T8907] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 201.114547][ T8907] Call Trace: [ 201.114554][ T8907] [ 201.114561][ T8907] dump_stack_lvl+0xe8/0x150 [ 201.114586][ T8907] should_fail_ex+0x467/0x600 [ 201.114621][ T8907] _copy_to_user+0x31/0xb0 [ 201.114646][ T8907] simple_read_from_buffer+0xe1/0x170 [ 201.114670][ T8907] proc_fail_nth_read+0x1be/0x230 [ 201.114692][ T8907] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 201.114714][ T8907] ? rw_verify_area+0x250/0x4d0 [ 201.114738][ T8907] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 201.114756][ T8907] vfs_read+0x219/0xa90 [ 201.114786][ T8907] ? __pfx_vfs_read+0x10/0x10 [ 201.114811][ T8907] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 201.114835][ T8907] ? lockdep_hardirqs_on+0x7a/0x110 [ 201.114858][ T8907] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 201.114880][ T8907] ? mutex_lock_nested+0x152/0x1d0 [ 201.114909][ T8907] ? fdget_pos+0x252/0x320 [ 201.114966][ T8907] ksys_read+0x156/0x270 [ 201.115002][ T8907] ? __pfx_ksys_read+0x10/0x10 [ 201.115027][ T8907] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 201.115044][ T8907] do_syscall_64+0x174/0x580 [ 201.115063][ T8907] ? trace_irq_disable+0x3b/0x140 [ 201.115083][ T8907] ? clear_bhb_loop+0x40/0x90 [ 201.115101][ T8907] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 201.115118][ T8907] RIP: 0033:0x7f84f449d68e [ 201.115136][ T8907] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 201.115153][ T8907] RSP: 002b:00007f84f272dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 201.115173][ T8907] RAX: ffffffffffffffda RBX: 00007f84f272e6c0 RCX: 00007f84f449d68e [ 201.115186][ T8907] RDX: 000000000000000f RSI: 00007f84f272e0a0 RDI: 0000000000000005 [ 201.115195][ T8907] RBP: 00007f84f272e090 R08: 0000000000000000 R09: 0000000000000000 [ 201.115203][ T8907] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 201.115212][ T8907] R13: 00007f84f4756038 R14: 00007f84f4755fa0 R15: 00007ffde0169118 [ 201.115234][ T8907] [ 201.276685][ T5595] usb 4-1: new full-speed USB device number 47 using dummy_hcd [ 201.440320][ T5595] usb 4-1: unable to get BOS descriptor or descriptor too short [ 201.452915][ T5595] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 201.452995][ T5595] usb 4-1: can't read configurations, error -71 [ 201.515701][ T2176] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 202.143212][ T8821] bridge0: port 1(bridge_slave_0) entered blocking state [ 202.143648][ T8821] bridge0: port 1(bridge_slave_0) entered disabled state [ 202.144577][ T8933] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 202.145079][ T8933] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 202.184581][ T8821] bridge_slave_0: entered allmulticast mode [ 202.194696][ T8821] bridge_slave_0: entered promiscuous mode [ 202.266175][ T8821] bridge0: port 2(bridge_slave_1) entered blocking state [ 202.266439][ T8821] bridge0: port 2(bridge_slave_1) entered disabled state [ 202.266636][ T8821] bridge_slave_1: entered allmulticast mode [ 202.270672][ T8821] bridge_slave_1: entered promiscuous mode [ 202.373647][ T8821] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 202.377112][ T5620] usb 3-1: new full-speed USB device number 24 using dummy_hcd [ 202.383173][ T8821] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 202.506504][ T5595] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 202.534981][ T5620] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 202.535045][ T5620] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 202.535062][ T5620] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 202.535086][ T5620] usb 3-1: New USB device found, idVendor=04d8, idProduct=f002, bcdDevice= 0.00 [ 202.535100][ T5620] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 202.599324][ T5620] usb 3-1: config 0 descriptor?? [ 202.656093][ T5595] usb 4-1: Using ep0 maxpacket: 16 [ 202.675413][ T5595] usb 4-1: config 0 has an invalid descriptor of length 93, skipping remainder of the config [ 202.675460][ T5595] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 202.675624][ T5595] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 202.675696][ T5595] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 202.675718][ T5595] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 202.685378][ T5610] Bluetooth: hci4: command tx timeout [ 202.744051][ T5595] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 202.744080][ T5595] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 202.744162][ T5595] usb 4-1: Manufacturer: syz [ 202.783576][ T5595] usb 4-1: config 0 descriptor?? [ 202.846194][ T5620] usbhid 3-1:0.0: can't add hid device: -71 [ 202.846345][ T5620] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 202.869138][ T5620] usb 3-1: USB disconnect, device number 24 [ 203.019118][ T8821] team0: Port device team_slave_0 added [ 203.037381][ T8821] team0: Port device team_slave_1 added [ 203.172989][ T5595] rc_core: IR keymap rc-hauppauge not found [ 203.173112][ T5595] Registered IR keymap rc-empty [ 203.173267][ T5595] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 203.196489][ T5595] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 203.197155][ T2176] bridge_slave_1: left allmulticast mode [ 203.197274][ T2176] bridge_slave_1: left promiscuous mode [ 203.236600][ T5595] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 203.238595][ T2176] bridge0: port 2(bridge_slave_1) entered disabled state [ 203.245409][ T5595] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input15 [ 203.317328][ T5595] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 203.336213][ T5595] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 203.364949][ T5595] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 203.378883][ T5595] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 203.396140][ T5595] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 203.416104][ T5595] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 203.437539][ T5595] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 203.456154][ T5595] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 203.476607][ T5595] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 203.496118][ T5595] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 203.564335][ T5595] mceusb 4-1:0.0: Registered with mce emulator interface version 1 [ 203.564361][ T5595] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 203.611821][ T2176] bridge_slave_0: left allmulticast mode [ 203.611855][ T2176] bridge_slave_0: left promiscuous mode [ 203.612127][ T2176] bridge0: port 1(bridge_slave_0) entered disabled state [ 203.637805][ T5595] usb 4-1: USB disconnect, device number 48 [ 204.098683][ T8967] random: crng reseeded on system resumption [ 204.576276][ T5594] usb 4-1: new full-speed USB device number 49 using dummy_hcd [ 204.732026][ T5594] usb 4-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 204.732053][ T5594] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 204.732072][ T5594] usb 4-1: Product: syz [ 204.732085][ T5594] usb 4-1: Manufacturer: syz [ 204.732098][ T5594] usb 4-1: SerialNumber: syz [ 204.762417][ T60] Bluetooth: hci4: command tx timeout [ 204.784765][ T5594] usb 4-1: config 0 descriptor?? [ 204.799456][ T5594] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 205.453302][ T2176] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 205.548217][ T2176] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 205.594767][ T2176] bond0 (unregistering): Released all slaves [ 205.825512][ T5267] 8021q: adding VLAN 0 to HW filter on device eth1 [ 205.899280][ T8821] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 205.899295][ T8821] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 205.899320][ T8821] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 205.902466][ T8821] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 205.902479][ T8821] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 205.902506][ T8821] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 206.517411][ T60] Bluetooth: hci3: command 0x0406 tx timeout [ 206.517507][ T5610] Bluetooth: hci0: command 0x0406 tx timeout [ 206.608893][ T5610] Bluetooth: hci2: command 0x0406 tx timeout [ 206.846048][ T5612] Bluetooth: hci4: command tx timeout [ 207.665725][ T5594] gspca_stk1135: reg_w 0x351 err -71 [ 207.671817][ T5594] gspca_stk1135: serial bus timeout: status=0x00 [ 207.671830][ T5594] gspca_stk1135: Sensor write failed [ 207.671864][ T5594] gspca_stk1135: serial bus timeout: status=0x00 [ 207.671874][ T5594] gspca_stk1135: Sensor write failed [ 207.671906][ T5594] gspca_stk1135: serial bus timeout: status=0x00 [ 207.671915][ T5594] gspca_stk1135: Sensor read failed [ 207.671946][ T5594] gspca_stk1135: serial bus timeout: status=0x00 [ 207.671955][ T5594] gspca_stk1135: Sensor read failed [ 207.671973][ T5594] gspca_stk1135: Detected sensor type unknown (0x0) [ 207.672006][ T5594] gspca_stk1135: serial bus timeout: status=0x00 [ 207.672015][ T5594] gspca_stk1135: Sensor read failed [ 207.672045][ T5594] gspca_stk1135: serial bus timeout: status=0x00 [ 207.672052][ T5594] gspca_stk1135: Sensor read failed [ 207.672081][ T5594] gspca_stk1135: serial bus timeout: status=0x00 [ 207.672090][ T5594] gspca_stk1135: Sensor write failed [ 207.672120][ T5594] gspca_stk1135: serial bus timeout: status=0x00 [ 207.672129][ T5594] gspca_stk1135: Sensor write failed [ 207.672211][ T5594] stk1135 4-1:0.0: probe with driver stk1135 failed with error -71 [ 207.790840][ T5594] usb 4-1: USB disconnect, device number 49 [ 207.961179][ T8821] hsr_slave_0: entered promiscuous mode [ 207.963093][ T8821] hsr_slave_1: entered promiscuous mode [ 207.964847][ T8821] debugfs: 'hsr0' already exists in 'hsr' [ 207.964872][ T8821] Cannot create hsr debugfs directory [ 207.990889][ T5267] 8021q: adding VLAN 0 to HW filter on device eth2 [ 208.597205][ T32] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 208.752875][ T32] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 208.752906][ T32] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 208.752930][ T32] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 208.752951][ T32] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 208.752988][ T32] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 208.753009][ T32] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 208.823534][ T32] usb 4-1: config 0 descriptor?? [ 209.433320][ T9132] fuse: Bad value for 'user_id' [ 209.433338][ T9132] fuse: Bad value for 'user_id' [ 209.447146][ T38] audit: type=1326 audit(1782859710.944:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9091 comm="syz.3.1423" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f03799cce59 code=0x0 [ 209.509299][ T9128] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(8) [ 209.509324][ T9128] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 209.646415][ T9128] vhci_hcd vhci_hcd.0: Device attached [ 209.897246][ T5594] usb 36-1: SetAddress Request (2) to port 0 [ 209.897322][ T5594] usb 36-1: new SuperSpeed USB device number 2 using vhci_hcd [ 210.146106][ T2176] hsr_slave_0: left promiscuous mode [ 210.188579][ T2176] hsr_slave_1: left promiscuous mode [ 210.225530][ T2176] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 210.250900][ T2176] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 210.399559][ T2176] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 210.399586][ T2176] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 210.967356][ T2176] veth1_macvtap: left promiscuous mode [ 210.985078][ T2176] veth0_macvtap: left promiscuous mode [ 211.043382][ T2176] veth1_vlan: left promiscuous mode [ 211.077438][ T2176] veth0_vlan: left promiscuous mode [ 211.770360][ T32] usbhid 4-1:0.0: can't add hid device: -71 [ 211.770469][ T32] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 211.812247][ T32] usb 4-1: USB disconnect, device number 50 [ 211.943402][ T9172] tipc: Can't bind to reserved service type 2 [ 212.476417][ T32] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 212.638811][ T32] usb 4-1: no configurations [ 212.638827][ T32] usb 4-1: can't read configurations, error -22 [ 212.767497][ T32] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 212.824009][ T9133] vhci_hcd: connection reset by peer [ 212.865849][ T12] vhci_hcd vhci_hcd.1: stop threads [ 212.868553][ T12] vhci_hcd vhci_hcd.1: release socket [ 212.910931][ T12] vhci_hcd vhci_hcd.1: disconnect device [ 212.932929][ T32] usb 4-1: no configurations [ 212.932944][ T32] usb 4-1: can't read configurations, error -22 [ 212.933226][ T32] usb usb4-port1: attempt power cycle [ 213.237232][ T2176] team0 (unregistering): Port device team_slave_1 removed [ 213.287139][ T32] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 213.322199][ T32] usb 4-1: no configurations [ 213.322214][ T32] usb 4-1: can't read configurations, error -22 [ 213.324901][ T2176] team0 (unregistering): Port device team_slave_0 removed [ 213.477941][ T32] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 213.507411][ T32] usb 4-1: no configurations [ 213.507427][ T32] usb 4-1: can't read configurations, error -22 [ 213.507738][ T32] usb usb4-port1: unable to enumerate USB device [ 213.641952][ T9199] FAULT_INJECTION: forcing a failure. [ 213.641952][ T9199] name failslab, interval 1, probability 0, space 0, times 0 [ 213.641982][ T9199] CPU: 1 UID: 0 PID: 9199 Comm: syz.2.1458 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 213.642004][ T9199] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 213.642016][ T9199] Call Trace: [ 213.642023][ T9199] [ 213.642031][ T9199] dump_stack_lvl+0xe8/0x150 [ 213.642057][ T9199] should_fail_ex+0x467/0x600 [ 213.642090][ T9199] should_failslab+0xa8/0x100 [ 213.642114][ T9199] __kmalloc_noprof+0xfb/0x790 [ 213.642135][ T9199] ? tomoyo_realpath_from_path+0xef/0x640 [ 213.642164][ T9199] ? tomoyo_realpath_from_path+0xef/0x640 [ 213.642199][ T9199] tomoyo_realpath_from_path+0xef/0x640 [ 213.642236][ T9199] ? tomoyo_path_number_perm+0x219/0x5f0 [ 213.642261][ T9199] tomoyo_path_number_perm+0x246/0x5f0 [ 213.642288][ T9199] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 213.642310][ T9199] ? __lock_acquire+0x683/0x2ce0 [ 213.642349][ T9199] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 213.642372][ T9199] ? hook_file_ioctl+0x1f3/0x600 [ 213.642397][ T9199] ? lockdep_hardirqs_on+0x7a/0x110 [ 213.642436][ T9199] ? __fget_files+0x2a/0x420 [ 213.642460][ T9199] ? __fget_files+0x2a/0x420 [ 213.642478][ T9199] ? __fget_files+0x3a8/0x420 [ 213.642498][ T9199] ? __fget_files+0x2a/0x420 [ 213.642523][ T9199] security_file_ioctl+0xc3/0x2a0 [ 213.642548][ T9199] __se_sys_ioctl+0x47/0x170 [ 213.642573][ T9199] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 213.642595][ T9199] do_syscall_64+0x174/0x580 [ 213.642618][ T9199] ? trace_irq_disable+0x3b/0x140 [ 213.642642][ T9199] ? clear_bhb_loop+0x40/0x90 [ 213.642667][ T9199] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 213.642684][ T9199] RIP: 0033:0x7f84f44dce59 [ 213.642702][ T9199] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 213.642718][ T9199] RSP: 002b:00007f84f272e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 213.642738][ T9199] RAX: ffffffffffffffda RBX: 00007f84f4755fa0 RCX: 00007f84f44dce59 [ 213.642753][ T9199] RDX: 0000200000000100 RSI: 000000004020aed2 RDI: 0000000000000004 [ 213.642765][ T9199] RBP: 00007f84f272e090 R08: 0000000000000000 R09: 0000000000000000 [ 213.642777][ T9199] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 213.642788][ T9199] R13: 00007f84f4756038 R14: 00007f84f4755fa0 R15: 00007ffde0169118 [ 213.642818][ T9199] [ 213.643587][ T9199] ERROR: Out of memory at tomoyo_realpath_from_path. [ 213.971180][ T5267] 8021q: adding VLAN 0 to HW filter on device eth3 [ 214.996265][ T5594] usb 36-1: device descriptor read/8, error -110 [ 215.390486][ T5594] usb usb36-port1: attempt power cycle [ 215.976109][ T32] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 216.009454][ T5594] usb usb36-port1: unable to enumerate USB device [ 216.133800][ T32] usb 2-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 216.133849][ T32] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 216.133870][ T32] usb 2-1: Product: syz [ 216.133885][ T32] usb 2-1: Manufacturer: syz [ 216.133900][ T32] usb 2-1: SerialNumber: syz [ 216.199195][ T9299] FAULT_INJECTION: forcing a failure. [ 216.199195][ T9299] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 216.199227][ T9299] CPU: 0 UID: 0 PID: 9299 Comm: syz.2.1490 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 216.199248][ T9299] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 216.199260][ T9299] Call Trace: [ 216.199268][ T9299] [ 216.199275][ T9299] dump_stack_lvl+0xe8/0x150 [ 216.199301][ T9299] should_fail_ex+0x467/0x600 [ 216.199335][ T9299] fpu__restore_sig+0x209/0x11f0 [ 216.199365][ T9299] ? __pfx_fpu__restore_sig+0x10/0x10 [ 216.199410][ T9299] __ia32_sys_rt_sigreturn+0x756/0x8c0 [ 216.199433][ T9299] ? __lock_acquire+0x683/0x2ce0 [ 216.199463][ T9299] ? __pfx___ia32_sys_rt_sigreturn+0x10/0x10 [ 216.199509][ T9299] ? __task_pid_nr_ns+0x28/0x470 [ 216.199538][ T9299] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 216.199558][ T9299] do_syscall_64+0x174/0x580 [ 216.199581][ T9299] ? trace_irq_disable+0x3b/0x140 [ 216.199606][ T9299] ? clear_bhb_loop+0x40/0x90 [ 216.199630][ T9299] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 216.199649][ T9299] RIP: 0033:0x7f84f44dce57 [ 216.199666][ T9299] Code: 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 <0f> 05 48 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 [ 216.199682][ T9299] RSP: 002b:00007f84f272e028 EFLAGS: 00000246 [ 216.199699][ T9299] RAX: 0000000000000113 RBX: 00007f84f4755fa0 RCX: 00007f84f44dce59 [ 216.199712][ T9299] RDX: 0000000000000004 RSI: 0000000000000000 RDI: 0000000000000005 [ 216.199723][ T9299] RBP: 00007f84f272e090 R08: 0000010000008ebc R09: 0000000000000000 [ 216.199736][ T9299] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 216.199747][ T9299] R13: 00007f84f4756038 R14: 00007f84f4755fa0 R15: 00007ffde0169118 [ 216.199775][ T9299] [ 216.676965][ T9308] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 216.738169][ T9308] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 216.942901][ T32] rtl8150 2-1:1.0: couldn't reset the device [ 216.943228][ T32] rtl8150 2-1:1.0: probe with driver rtl8150 failed with error -5 [ 216.973469][ T32] usb 2-1: USB disconnect, device number 48 [ 217.070572][ T9325] FAULT_INJECTION: forcing a failure. [ 217.070572][ T9325] name failslab, interval 1, probability 0, space 0, times 0 [ 217.070603][ T9325] CPU: 1 UID: 0 PID: 9325 Comm: syz.2.1497 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 217.070624][ T9325] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 217.070636][ T9325] Call Trace: [ 217.070642][ T9325] [ 217.070651][ T9325] dump_stack_lvl+0xe8/0x150 [ 217.070676][ T9325] should_fail_ex+0x467/0x600 [ 217.070711][ T9325] should_failslab+0xa8/0x100 [ 217.070736][ T9325] __kmalloc_noprof+0xfb/0x790 [ 217.070756][ T9325] ? tomoyo_realpath_from_path+0xef/0x640 [ 217.070784][ T9325] ? tomoyo_realpath_from_path+0xef/0x640 [ 217.070821][ T9325] tomoyo_realpath_from_path+0xef/0x640 [ 217.070864][ T9325] tomoyo_path_perm+0x283/0x560 [ 217.070887][ T9325] ? tomoyo_path_perm+0x251/0x560 [ 217.070911][ T9325] ? __pfx_tomoyo_path_perm+0x10/0x10 [ 217.070943][ T9325] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 217.070988][ T9325] ? __pfx_current_check_access_path+0x10/0x10 [ 217.071027][ T9325] ? __d_lookup+0x66/0x790 [ 217.071056][ T9325] ? __d_lookup+0x6f3/0x790 [ 217.071083][ T9325] tomoyo_path_rmdir+0xaa/0xf0 [ 217.071102][ T9325] ? __pfx_tomoyo_path_rmdir+0x10/0x10 [ 217.071128][ T9325] ? d_lookup+0xa0/0xc0 [ 217.071153][ T9325] security_path_rmdir+0x15f/0x330 [ 217.071186][ T9325] filename_rmdir+0x20d/0x520 [ 217.071219][ T9325] ? __pfx_filename_rmdir+0x10/0x10 [ 217.071251][ T9325] ? do_getname+0x151/0x250 [ 217.071270][ T9325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 217.071291][ T9325] __se_sys_rmdir+0x2e/0x140 [ 217.071318][ T9325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 217.071345][ T9325] do_syscall_64+0x174/0x580 [ 217.071368][ T9325] ? trace_irq_disable+0x3b/0x140 [ 217.071393][ T9325] ? clear_bhb_loop+0x40/0x90 [ 217.071417][ T9325] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 217.071435][ T9325] RIP: 0033:0x7f84f44dce59 [ 217.071453][ T9325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 217.071469][ T9325] RSP: 002b:00007f84f272e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 217.071490][ T9325] RAX: ffffffffffffffda RBX: 00007f84f4755fa0 RCX: 00007f84f44dce59 [ 217.071503][ T9325] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000140 [ 217.071515][ T9325] RBP: 00007f84f272e090 R08: 0000000000000000 R09: 0000000000000000 [ 217.071526][ T9325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 217.071538][ T9325] R13: 00007f84f4756038 R14: 00007f84f4755fa0 R15: 00007ffde0169118 [ 217.071568][ T9325] [ 217.071597][ T9325] ERROR: Out of memory at tomoyo_realpath_from_path. [ 218.164487][ T5698] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 218.290972][ T8821] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 218.316118][ T5698] usb 4-1: Using ep0 maxpacket: 16 [ 218.318363][ T5698] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 218.318384][ T5698] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 218.321340][ T5698] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 218.321364][ T5698] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 218.321382][ T5698] usb 4-1: Product: syz [ 218.321394][ T5698] usb 4-1: Manufacturer: syz [ 218.321407][ T5698] usb 4-1: SerialNumber: syz [ 218.397459][ T8821] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 218.399728][ T8821] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 218.491106][ T5698] usb 4-1: 0:2 : does not exist [ 218.570162][ T8821] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 218.571914][ T8821] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 218.614474][ T8821] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 218.646131][ T8821] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 218.648175][ T5698] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 218.721237][ T8821] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 218.953241][ T5698] usb 4-1: USB disconnect, device number 55 [ 219.043628][ T8821] 8021q: adding VLAN 0 to HW filter on device bond0 [ 219.111909][ T9395] FAULT_INJECTION: forcing a failure. [ 219.111909][ T9395] name failslab, interval 1, probability 0, space 0, times 0 [ 219.111941][ T9395] CPU: 1 UID: 0 PID: 9395 Comm: syz.2.1518 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 219.111963][ T9395] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 219.111974][ T9395] Call Trace: [ 219.111982][ T9395] [ 219.111990][ T9395] dump_stack_lvl+0xe8/0x150 [ 219.112015][ T9395] should_fail_ex+0x467/0x600 [ 219.112048][ T9395] should_failslab+0xa8/0x100 [ 219.112073][ T9395] __kvmalloc_node_noprof+0x176/0x880 [ 219.112099][ T9395] ? __rhashtable_init_noprof+0x54d/0xaf0 [ 219.112117][ T9395] ? __rhashtable_init_noprof+0x54d/0xaf0 [ 219.112143][ T9395] __rhashtable_init_noprof+0x54d/0xaf0 [ 219.112167][ T9395] __rhltable_init_noprof+0x26/0x70 [ 219.112189][ T9395] nf_tables_newtable+0x6a7/0x1950 [ 219.112228][ T9395] nfnetlink_rcv+0x1291/0x28d0 [ 219.112282][ T9395] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 219.112321][ T9395] ? __pfx_save_netdev_trace_buffer+0x10/0x10 [ 219.112349][ T9395] ? ref_tracker_free+0x668/0x820 [ 219.112401][ T9395] ? skb_clone+0x246/0x3a0 [ 219.112430][ T9395] ? __netlink_deliver_tap+0x838/0x880 [ 219.112463][ T9395] ? netlink_deliver_tap+0x2e/0x1b0 [ 219.112489][ T9395] ? netlink_deliver_tap+0x2e/0x1b0 [ 219.112521][ T9395] netlink_unicast+0x7f5/0x990 [ 219.112555][ T9395] netlink_sendmsg+0x813/0xb40 [ 219.112589][ T9395] ? __pfx_netlink_sendmsg+0x10/0x10 [ 219.112620][ T9395] ? aa_sock_msg_perm+0x122/0x200 [ 219.112653][ T9395] ? __pfx_netlink_sendmsg+0x10/0x10 [ 219.112679][ T9395] sock_sendmsg_nosec+0x13a/0x180 [ 219.112701][ T9395] ____sys_sendmsg+0x565/0x870 [ 219.112728][ T9395] ? __might_fault+0xaf/0x130 [ 219.112754][ T9395] ? __pfx_____sys_sendmsg+0x10/0x10 [ 219.112788][ T9395] ? import_iovec+0x73/0xa0 [ 219.112814][ T9395] ___sys_sendmsg+0x2a5/0x360 [ 219.112839][ T9395] ? __lock_acquire+0x683/0x2ce0 [ 219.112883][ T9395] ? __pfx____sys_sendmsg+0x10/0x10 [ 219.112938][ T9395] ? __fget_files+0x2a/0x420 [ 219.112957][ T9395] ? __fget_files+0x3a8/0x420 [ 219.112987][ T9395] __x64_sys_sendmsg+0x1b7/0x290 [ 219.113015][ T9395] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 219.113057][ T9395] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 219.113077][ T9395] do_syscall_64+0x174/0x580 [ 219.113101][ T9395] ? trace_irq_disable+0x3b/0x140 [ 219.113138][ T9395] ? clear_bhb_loop+0x40/0x90 [ 219.113160][ T9395] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 219.113179][ T9395] RIP: 0033:0x7f84f44dce59 [ 219.113197][ T9395] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 219.113213][ T9395] RSP: 002b:00007f84f272e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 219.113233][ T9395] RAX: ffffffffffffffda RBX: 00007f84f4755fa0 RCX: 00007f84f44dce59 [ 219.113247][ T9395] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000003 [ 219.113259][ T9395] RBP: 00007f84f272e090 R08: 0000000000000000 R09: 0000000000000000 [ 219.113270][ T9395] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 219.113281][ T9395] R13: 00007f84f4756038 R14: 00007f84f4755fa0 R15: 00007ffde0169118 [ 219.113311][ T9395] [ 219.457928][ T8821] 8021q: adding VLAN 0 to HW filter on device team0 [ 219.480102][ T2176] bridge0: port 1(bridge_slave_0) entered blocking state [ 219.480255][ T2176] bridge0: port 1(bridge_slave_0) entered forwarding state [ 219.574510][ T1035] bridge0: port 2(bridge_slave_1) entered blocking state [ 219.574677][ T1035] bridge0: port 2(bridge_slave_1) entered forwarding state [ 219.750098][ T6220] udevd[6220]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 220.026645][ T5698] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 220.176070][ T5698] usb 4-1: Using ep0 maxpacket: 16 [ 220.181756][ T5698] usb 4-1: config 0 has an invalid descriptor of length 196, skipping remainder of the config [ 220.181802][ T5698] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 220.181829][ T5698] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 220.181850][ T5698] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 220.181871][ T5698] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 220.185581][ T5698] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 220.185606][ T5698] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 220.185625][ T5698] usb 4-1: Manufacturer: syz [ 220.261610][ T5698] usb 4-1: config 0 descriptor?? [ 220.686078][ T5698] rc_core: IR keymap rc-hauppauge not found [ 220.686099][ T5698] Registered IR keymap rc-empty [ 220.686229][ T5698] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 220.707617][ T5698] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 220.743295][ T5698] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 220.786676][ T5698] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input16 [ 220.814885][ T9445] binder: 9443:9445 ioctl c018620c 200000000000 returned -22 [ 220.838160][ T5698] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 220.859866][ T5698] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 220.876492][ T5698] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 220.898691][ T5698] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 220.925235][ T5698] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 220.939173][ T5698] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 220.965264][ T5698] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 220.976094][ T5698] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 220.997301][ T5698] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 221.028138][ T5698] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 221.093786][ T5698] mceusb 4-1:0.0: Registered with mce emulator interface version 1 [ 221.093804][ T5698] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 221.180006][ T5698] usb 4-1: USB disconnect, device number 56 [ 221.226067][ T5620] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 221.356427][ T5620] usb 2-1: device descriptor read/64, error -71 [ 221.499389][ T8821] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 221.596059][ T5620] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 221.728525][ T5620] usb 2-1: device descriptor read/64, error -71 [ 221.813506][ T8821] veth0_vlan: entered promiscuous mode [ 221.839425][ T5620] usb usb2-port1: attempt power cycle [ 221.852165][ T8821] veth1_vlan: entered promiscuous mode [ 222.110384][ T8821] veth0_macvtap: entered promiscuous mode [ 222.121933][ T8821] veth1_macvtap: entered promiscuous mode [ 222.162376][ T8821] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 222.179299][ T8821] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 222.187836][ T5620] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 222.208194][ T5620] usb 2-1: device descriptor read/8, error -71 [ 222.213853][ T154] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.215059][ T154] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.215121][ T154] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.215155][ T154] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.336148][ T5594] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 222.451830][ T5620] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 222.473322][ T5620] usb 2-1: device descriptor read/8, error -71 [ 222.487768][ T5594] usb 3-1: Using ep0 maxpacket: 32 [ 222.498871][ T5594] usb 3-1: config 0 has an invalid interface number: 12 but max is 0 [ 222.498932][ T5594] usb 3-1: config 0 has no interface number 0 [ 222.499034][ T5594] usb 3-1: config 0 interface 12 has no altsetting 0 [ 222.532935][ T5594] usb 3-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 222.532961][ T5594] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 222.532978][ T5594] usb 3-1: Product: syz [ 222.532991][ T5594] usb 3-1: Manufacturer: syz [ 222.533004][ T5594] usb 3-1: SerialNumber: syz [ 222.579678][ T5594] usb 3-1: config 0 descriptor?? [ 222.580367][ T5620] usb usb2-port1: unable to enumerate USB device [ 222.991015][ T5594] f81534 3-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 222.991059][ T5594] f81534 3-1:0.12: f81534_find_config_idx: read failed: -71 [ 222.991082][ T5594] f81534 3-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 222.991158][ T5594] f81534 3-1:0.12: probe with driver f81534 failed with error -71 [ 223.046140][ T5594] usb 3-1: USB disconnect, device number 25 [ 223.180416][ T1026] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 223.180435][ T1026] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 223.361593][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 223.361611][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 223.692186][ T9510] comedi comedi1: s526: I/O base address or length out of range [ 223.845872][ T5611] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 223.881617][ T5611] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 223.911729][ T5611] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 223.925679][ T5611] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 223.929456][ T5611] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 224.708529][ T5594] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 224.748802][ T9537] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1556'. [ 224.866106][ T5594] usb 4-1: Using ep0 maxpacket: 32 [ 224.868110][ T5594] usb 4-1: config 0 has an invalid interface number: 146 but max is 0 [ 224.868132][ T5594] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 224.868149][ T5594] usb 4-1: config 0 has no interface number 0 [ 224.868190][ T5594] usb 4-1: config 0 interface 146 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 224.870424][ T5594] usb 4-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 224.870450][ T5594] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 224.870467][ T5594] usb 4-1: Product: syz [ 224.870479][ T5594] usb 4-1: Manufacturer: syz [ 224.870491][ T5594] usb 4-1: SerialNumber: syz [ 224.873618][ T5594] usb 4-1: config 0 descriptor?? [ 224.888035][ T5594] usb 4-1: expecting 3 got 0 endpoints! Bailing out. [ 224.965612][ T9541] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1556'. [ 225.048676][ T199] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 225.082146][ T5620] usb 4-1: USB disconnect, device number 57 [ 225.176098][ T199] usb 1-1: device descriptor read/64, error -71 [ 225.418073][ T199] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 225.420816][ T1026] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 225.546211][ T199] usb 1-1: device descriptor read/64, error -71 [ 225.567056][ T9546] bond0: (slave bond_slave_1): Releasing backup interface [ 225.659147][ T199] usb usb1-port1: attempt power cycle [ 225.828867][ T9556] netlink: 100 bytes leftover after parsing attributes in process `syz.1.1560'. [ 225.906151][ T5698] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 225.965374][ T1026] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 226.016075][ T199] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 226.044436][ T199] usb 1-1: device descriptor read/8, error -71 [ 226.077051][ T5698] usb 4-1: Using ep0 maxpacket: 16 [ 226.081563][ T5698] usb 4-1: config 0 has an invalid descriptor of length 248, skipping remainder of the config [ 226.081614][ T5698] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 226.081632][ T5698] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 226.081645][ T5698] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 226.081660][ T5698] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 226.118089][ T5611] Bluetooth: hci1: command tx timeout [ 226.125480][ T5698] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 226.125505][ T5698] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 226.125524][ T5698] usb 4-1: Manufacturer: syz [ 226.180515][ T5698] usb 4-1: config 0 descriptor?? [ 226.316176][ T199] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 226.338855][ T199] usb 1-1: device descriptor read/8, error -71 [ 226.447723][ T199] usb usb1-port1: unable to enumerate USB device [ 226.555789][ T1026] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 226.566280][ T5698] rc_core: IR keymap rc-hauppauge not found [ 226.566298][ T5698] Registered IR keymap rc-empty [ 226.566439][ T5698] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 226.596236][ T5698] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 226.617001][ T5698] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 226.619438][ T5698] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input17 [ 226.622763][ T5698] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 226.675571][ T5698] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 226.686684][ T5698] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 226.706161][ T5698] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 226.726120][ T5698] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 226.746129][ T5698] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 226.766577][ T5698] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 226.796166][ T5698] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 226.816242][ T5698] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 226.846473][ T5698] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 226.873943][ T5698] mceusb 4-1:0.0: Registered with mce emulator interface version 1 [ 226.873999][ T5698] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 226.908672][ T5698] usb 4-1: USB disconnect, device number 58 [ 226.979525][ T1026] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 227.242252][ T9511] bridge0: port 1(bridge_slave_0) entered blocking state [ 227.242560][ T9511] bridge0: port 1(bridge_slave_0) entered disabled state [ 227.242733][ T9511] bridge_slave_0: entered allmulticast mode [ 227.245224][ T9511] bridge_slave_0: entered promiscuous mode [ 227.257304][ T9511] bridge0: port 2(bridge_slave_1) entered blocking state [ 227.258265][ T9511] bridge0: port 2(bridge_slave_1) entered disabled state [ 227.259801][ T9511] bridge_slave_1: entered allmulticast mode [ 227.279985][ T9511] bridge_slave_1: entered promiscuous mode [ 227.350887][ T9511] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 227.357726][ T9511] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 227.452258][ T9511] team0: Port device team_slave_0 added [ 227.638241][ T9511] team0: Port device team_slave_1 added [ 227.638328][ T9578] netlink: 'syz.1.1563': attribute type 29 has an invalid length. [ 227.638473][ T9580] batadv_slave_1: entered promiscuous mode [ 227.696483][ T9581] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1566'. [ 227.821038][ T9579] batadv_slave_1: left promiscuous mode [ 227.842049][ T9511] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 227.842063][ T9511] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 227.842089][ T9511] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 227.942628][ T9511] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 227.942643][ T9511] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 227.942669][ T9511] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 228.073074][ T9588] binder: 9587:9588 ioctl c0046209 0 returned -22 [ 228.176193][ T199] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 228.196138][ T5611] Bluetooth: hci1: command tx timeout [ 228.341042][ T199] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 228.341074][ T199] usb 1-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 228.341110][ T199] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 228.341131][ T199] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 228.345768][ T9585] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 228.399899][ T199] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 229.122468][ T9599] FAULT_INJECTION: forcing a failure. [ 229.122468][ T9599] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 229.122506][ T9599] CPU: 1 UID: 0 PID: 9599 Comm: syz.3.1572 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 229.122528][ T9599] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 229.122540][ T9599] Call Trace: [ 229.122548][ T9599] [ 229.122557][ T9599] dump_stack_lvl+0xe8/0x150 [ 229.122585][ T9599] should_fail_ex+0x467/0x600 [ 229.122620][ T9599] _copy_to_iter+0x404/0x1810 [ 229.122654][ T9599] ? __pfx__copy_to_iter+0x10/0x10 [ 229.122679][ T9599] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 229.122706][ T9599] ? lockdep_hardirqs_on+0x7a/0x110 [ 229.122730][ T9599] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 229.122758][ T9599] __skb_datagram_iter+0x419/0x980 [ 229.122789][ T9599] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 229.122826][ T9599] skb_copy_datagram_iter+0xb5/0x240 [ 229.122861][ T9599] unix_stream_read_actor+0x6c/0xb0 [ 229.122894][ T9599] unix_stream_read_generic+0xa60/0x2310 [ 229.122955][ T9599] ? __pfx_unix_stream_read_generic+0x10/0x10 [ 229.122986][ T9599] ? __pfx_autoremove_wake_function+0x10/0x10 [ 229.123018][ T9599] ? __lock_acquire+0x683/0x2ce0 [ 229.123061][ T9599] unix_stream_recvmsg+0x16b/0x1d0 [ 229.123084][ T9599] ? __pfx_unix_stream_recvmsg+0x10/0x10 [ 229.123103][ T9599] ? __pfx_unix_stream_read_actor+0x10/0x10 [ 229.123135][ T9599] ? __lock_acquire+0x683/0x2ce0 [ 229.123165][ T9599] ? aa_sock_msg_perm+0x107/0x200 [ 229.123193][ T9599] ? __pfx_unix_stream_recvmsg+0x10/0x10 [ 229.123214][ T9599] sock_recvmsg_nosec+0x130/0x170 [ 229.123239][ T9599] ____sys_recvmsg+0x242/0x4f0 [ 229.123275][ T9599] ? __pfx_____sys_recvmsg+0x10/0x10 [ 229.123316][ T9599] ? import_iovec+0x73/0xa0 [ 229.123340][ T9599] ___sys_recvmsg+0x213/0x5a0 [ 229.123375][ T9599] ? __pfx____sys_recvmsg+0x10/0x10 [ 229.123398][ T9599] ? __fget_files+0x2a/0x420 [ 229.123423][ T9599] ? __fget_files+0x3a8/0x420 [ 229.123444][ T9599] do_recvmmsg+0x320/0x7f0 [ 229.123469][ T9599] ? __pfx_do_recvmmsg+0x10/0x10 [ 229.123488][ T9599] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 229.123511][ T9599] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 229.123534][ T9599] __x64_sys_recvmmsg+0x198/0x250 [ 229.123556][ T9599] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 229.123606][ T9599] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 229.123625][ T9599] do_syscall_64+0x174/0x580 [ 229.123652][ T9599] ? trace_irq_disable+0x3b/0x140 [ 229.123670][ T9599] ? clear_bhb_loop+0x40/0x90 [ 229.123687][ T9599] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 229.123700][ T9599] RIP: 0033:0x7f03799cce59 [ 229.123712][ T9599] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 229.123724][ T9599] RSP: 002b:00007f0377c26028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 229.123738][ T9599] RAX: ffffffffffffffda RBX: 00007f0379c45fa0 RCX: 00007f03799cce59 [ 229.123748][ T9599] RDX: 040000000000013c RSI: 00002000000034c0 RDI: 0000000000000005 [ 229.123758][ T9599] RBP: 00007f0377c26090 R08: 0000000000000000 R09: 0000000000000000 [ 229.123769][ T9599] R10: 0000000000000700 R11: 0000000000000246 R12: 0000000000000002 [ 229.123777][ T9599] R13: 00007f0379c46038 R14: 00007f0379c45fa0 R15: 00007fff1dfec078 [ 229.123798][ T9599] [ 229.648449][ T1026] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 229.750274][ T1026] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 229.810685][ T1026] bond0 (unregistering): Released all slaves [ 230.002124][ T9594] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1571'. [ 230.101076][ T9511] hsr_slave_0: entered promiscuous mode [ 230.107699][ T9511] hsr_slave_1: entered promiscuous mode [ 230.276317][ T5611] Bluetooth: hci1: command tx timeout [ 230.376836][ T9608] faux_driver vgem: [drm] Unknown color mode 7; guessing buffer size. [ 230.852905][ T5594] usb 1-1: USB disconnect, device number 24 [ 231.159088][ T9619] ieee802154 phy0 wpan0: encryption failed: -22 [ 231.262404][ T9619] kvm [9617]: vcpu3, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010002) = 0xffffff [ 231.727092][ T5611] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 232.173048][ T5267] 8021q: adding VLAN 0 to HW filter on device eth1 [ 232.356382][ T5611] Bluetooth: hci1: command tx timeout [ 232.546127][ T822] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 232.655055][ T9669] FAULT_INJECTION: forcing a failure. [ 232.655055][ T9669] name failslab, interval 1, probability 0, space 0, times 0 [ 232.655080][ T9669] CPU: 0 UID: 0 PID: 9669 Comm: syz.1.1590 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 232.655097][ T9669] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 232.655106][ T9669] Call Trace: [ 232.655111][ T9669] [ 232.655117][ T9669] dump_stack_lvl+0xe8/0x150 [ 232.655137][ T9669] should_fail_ex+0x467/0x600 [ 232.655162][ T9669] ? alloc_slab_obj_exts+0xba/0x230 [ 232.655176][ T9669] should_failslab+0xa8/0x100 [ 232.655197][ T9669] ? alloc_slab_obj_exts+0xba/0x230 [ 232.655210][ T9669] __kmalloc_flags_noprof+0x11c/0x7f0 [ 232.655229][ T9669] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 232.655248][ T9669] ? alloc_slab_obj_exts+0xba/0x230 [ 232.655266][ T9669] alloc_slab_obj_exts+0xba/0x230 [ 232.655282][ T9669] __memcg_slab_post_alloc_hook+0x602/0xf60 [ 232.655310][ T9669] __kvmalloc_node_noprof+0x69d/0x880 [ 232.655329][ T9669] ? traverse+0xf1/0x620 [ 232.655349][ T9669] ? traverse+0xf1/0x620 [ 232.655374][ T9669] traverse+0xf1/0x620 [ 232.655396][ T9669] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 232.655441][ T9669] ? seq_lseek+0x55/0x260 [ 232.655472][ T9669] seq_lseek+0x137/0x260 [ 232.655505][ T9669] proc_reg_llseek+0x1c5/0x2a0 [ 232.655546][ T9669] __x64_sys_lseek+0x155/0x1f0 [ 232.655564][ T9669] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 232.655579][ T9669] do_syscall_64+0x174/0x580 [ 232.655596][ T9669] ? trace_irq_disable+0x3b/0x140 [ 232.655614][ T9669] ? clear_bhb_loop+0x40/0x90 [ 232.655632][ T9669] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 232.655645][ T9669] RIP: 0033:0x7f9c282bce59 [ 232.655657][ T9669] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 232.655668][ T9669] RSP: 002b:00007f9c2650e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000008 [ 232.655687][ T9669] RAX: ffffffffffffffda RBX: 00007f9c28535fa0 RCX: 00007f9c282bce59 [ 232.655697][ T9669] RDX: 0000000000000000 RSI: 0000000000000400 RDI: 0000000000000003 [ 232.655705][ T9669] RBP: 00007f9c2650e090 R08: 0000000000000000 R09: 0000000000000000 [ 232.655713][ T9669] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 232.655721][ T9669] R13: 00007f9c28536038 R14: 00007f9c28535fa0 R15: 00007ffc76a552d8 [ 232.655742][ T9669] [ 232.708767][ T822] usb 1-1: Using ep0 maxpacket: 8 [ 232.781679][ T822] usb 1-1: unable to get BOS descriptor or descriptor too short [ 232.894715][ T822] usb 1-1: config 0 has an invalid interface number: 88 but max is 0 [ 232.895034][ T822] usb 1-1: config 0 has no interface number 0 [ 232.895133][ T822] usb 1-1: config 0 interface 88 altsetting 8 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 232.895200][ T822] usb 1-1: config 0 interface 88 altsetting 8 endpoint 0x86 has invalid wMaxPacketSize 0 [ 232.895258][ T822] usb 1-1: config 0 interface 88 has no altsetting 0 [ 232.947461][ T822] usb 1-1: string descriptor 0 read error: -22 [ 232.948031][ T822] usb 1-1: New USB device found, idVendor=0460, idProduct=0004, bcdDevice=96.31 [ 232.948086][ T822] usb 1-1: New USB device strings: Mfr=1, Product=84, SerialNumber=3 [ 233.002749][ T822] usb 1-1: config 0 descriptor?? [ 233.038681][ T822] input: USB Acecad Flair Tablet 0460:0004 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.88/input/input18 [ 233.293482][ T5695] udevd[5695]: Error opening device "/dev/input/event4": Input/output error [ 233.293616][ T5695] udevd[5695]: Unable to EVIOCGABS device "/dev/input/event4" [ 233.293753][ T5695] udevd[5695]: Unable to EVIOCGABS device "/dev/input/event4" [ 233.556188][ T5611] Bluetooth: hci3: command 0x0406 tx timeout [ 233.778473][ T1026] hsr_slave_0: left promiscuous mode [ 233.796130][ T199] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 233.828611][ T1026] hsr_slave_1: left promiscuous mode [ 233.829541][ T1026] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 233.829565][ T1026] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 233.869140][ T1026] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 233.869162][ T1026] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 233.956260][ T199] usb 2-1: unable to get BOS descriptor or descriptor too short [ 233.984451][ T199] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 234.019045][ T199] usb 2-1: New USB device found, idVendor=041e, idProduct=323b, bcdDevice= 0.40 [ 234.019070][ T199] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 234.019089][ T199] usb 2-1: Product: syz [ 234.019102][ T199] usb 2-1: Manufacturer: syz [ 234.019116][ T199] usb 2-1: SerialNumber: syz [ 234.143059][ T1026] veth1_macvtap: left promiscuous mode [ 234.143167][ T1026] veth0_macvtap: left promiscuous mode [ 234.143432][ T1026] veth1_vlan: left promiscuous mode [ 234.155893][ T1026] veth0_vlan: left promiscuous mode [ 234.194900][ T9657] netlink: 'syz.0.1586': attribute type 10 has an invalid length. [ 234.301121][ T9671] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 234.310770][ T9671] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 234.467416][ T199] usb 2-1: USB disconnect, device number 53 [ 234.545857][ T6220] udevd[6220]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 235.180437][ T5826] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 235.220060][ T37] ================================================================== [ 235.220076][ T37] BUG: KASAN: slab-use-after-free in uea_upload_pre_firmware+0x8d/0x640 [ 235.220111][ T37] Read of size 8 at addr ffff88805ecfa0b8 by task kworker/1:1/37 [ 235.220127][ T37] [ 235.220138][ T37] CPU: 1 UID: 0 PID: 37 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 235.220160][ T37] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 235.220173][ T37] Workqueue: events request_firmware_work_func [ 235.220198][ T37] Call Trace: [ 235.220205][ T37] [ 235.220213][ T37] dump_stack_lvl+0xe8/0x150 [ 235.220237][ T37] print_address_description+0x55/0x1e0 [ 235.220262][ T37] ? uea_upload_pre_firmware+0x8d/0x640 [ 235.220286][ T37] print_report+0x58/0x70 [ 235.220305][ T37] kasan_report+0x117/0x150 [ 235.220323][ T37] ? _request_firmware+0x1322/0x1780 [ 235.220338][ T37] ? uea_upload_pre_firmware+0x8d/0x640 [ 235.220363][ T37] uea_upload_pre_firmware+0x8d/0x640 [ 235.220387][ T37] ? __pfx__request_firmware+0x10/0x10 [ 235.220403][ T37] ? __pfx_uea_upload_pre_firmware+0x10/0x10 [ 235.220424][ T37] ? process_one_work+0x8cd/0x12b0 [ 235.220448][ T37] ? process_one_work+0x8cd/0x12b0 [ 235.220472][ T37] ? __pfx_uea_upload_pre_firmware+0x10/0x10 [ 235.220495][ T37] request_firmware_work_func+0xf7/0x2d0 [ 235.220513][ T37] ? rcu_is_watching+0x15/0xb0 [ 235.220540][ T37] ? process_one_work+0x8cd/0x12b0 [ 235.220563][ T37] process_one_work+0x93a/0x12b0 [ 235.220593][ T37] ? __pfx_process_one_work+0x10/0x10 [ 235.220615][ T37] ? do_raw_spin_lock+0x12b/0x2f0 [ 235.220638][ T37] ? assign_work+0x3cf/0x5d0 [ 235.220676][ T37] worker_thread+0xb05/0x10d0 [ 235.220708][ T37] kthread+0x388/0x470 [ 235.220725][ T37] ? __pfx_worker_thread+0x10/0x10 [ 235.220746][ T37] ? __pfx_kthread+0x10/0x10 [ 235.220762][ T37] ret_from_fork+0x514/0xb70 [ 235.220788][ T37] ? __pfx_ret_from_fork+0x10/0x10 [ 235.220822][ T37] ? __switch_to+0xc89/0x1420 [ 235.220838][ T37] ? __pfx_kthread+0x10/0x10 [ 235.220856][ T37] ret_from_fork_asm+0x1a/0x30 [ 235.220883][ T37] [ 235.220888][ T37] [ 235.220892][ T37] Allocated by task 6220: [ 235.220901][ T37] kasan_save_track+0x3e/0x80 [ 235.220916][ T37] __kasan_kmalloc+0x93/0xb0 [ 235.220932][ T37] __kmalloc_noprof+0x415/0x790 [ 235.220949][ T37] tomoyo_realpath_from_path+0xef/0x640 [ 235.220988][ T37] tomoyo_check_open_permission+0x229/0x470 [ 235.221012][ T37] security_file_open+0xa9/0x240 [ 235.221034][ T37] do_dentry_open+0x4be/0x1420 [ 235.221051][ T37] vfs_open+0x3b/0x350 [ 235.221076][ T37] path_openat+0x2e60/0x3850 [ 235.221097][ T37] do_file_open+0x23e/0x4a0 [ 235.221118][ T37] do_sys_openat2+0x115/0x200 [ 235.221134][ T37] __x64_sys_openat+0x138/0x170 [ 235.221151][ T37] do_syscall_64+0x174/0x580 [ 235.221171][ T37] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 235.221188][ T37] [ 235.221193][ T37] Freed by task 6220: [ 235.221201][ T37] kasan_save_track+0x3e/0x80 [ 235.221216][ T37] kasan_save_free_info+0x40/0x50 [ 235.221239][ T37] __kasan_slab_free+0x5c/0x80 [ 235.221256][ T37] kfree+0x1c5/0x6c0 [ 235.221269][ T37] tomoyo_realpath_from_path+0x605/0x640 [ 235.221294][ T37] tomoyo_check_open_permission+0x229/0x470 [ 235.221316][ T37] security_file_open+0xa9/0x240 [ 235.221335][ T37] do_dentry_open+0x4be/0x1420 [ 235.221349][ T37] vfs_open+0x3b/0x350 [ 235.221363][ T37] path_openat+0x2e60/0x3850 [ 235.221384][ T37] do_file_open+0x23e/0x4a0 [ 235.221404][ T37] do_sys_openat2+0x115/0x200 [ 235.221417][ T37] __x64_sys_openat+0x138/0x170 [ 235.221433][ T37] do_syscall_64+0x174/0x580 [ 235.221455][ T37] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 235.221472][ T37] [ 235.221476][ T37] The buggy address belongs to the object at ffff88805ecfa000 [ 235.221476][ T37] which belongs to the cache kmalloc-4k of size 4096 [ 235.221492][ T37] The buggy address is located 184 bytes inside of [ 235.221492][ T37] freed 4096-byte region [ffff88805ecfa000, ffff88805ecfb000) [ 235.221511][ T37] [ 235.221516][ T37] The buggy address belongs to the physical page: [ 235.221526][ T37] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5ecf8 [ 235.221550][ T37] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 235.221565][ T37] flags: 0x80000000000040(head|node=0|zone=1) [ 235.221580][ T37] page_type: f5(slab) [ 235.221596][ T37] raw: 0080000000000040 ffff88813feaa140 dead000000000122 0000000000000000 [ 235.221611][ T37] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 235.221629][ T37] head: 0080000000000040 ffff88813feaa140 dead000000000122 0000000000000000 [ 235.221645][ T37] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 235.221661][ T37] head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 235.221677][ T37] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 [ 235.221687][ T37] page dumped because: kasan: bad access detected [ 235.221703][ T37] page_owner tracks the page as allocated [ 235.221709][ T37] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6220, tgid 6220 (udevd), ts 227002849393 [ 235.221738][ T37] post_alloc_hook+0x1f9/0x250 [ 235.221756][ T37] get_page_from_freelist+0x264c/0x26c0 [ 235.221776][ T37] __alloc_frozen_pages_noprof+0x1a6/0x390 [ 235.221792][ T37] allocate_slab+0x79/0x5e0 [ 235.221814][ T37] refill_objects+0x2d8/0x350 [ 235.221837][ T37] __pcs_replace_empty_main+0x330/0x690 [ 235.221859][ T37] __kmalloc_noprof+0x543/0x790 [ 235.221877][ T37] tomoyo_realpath_from_path+0xef/0x640 [ 235.221901][ T37] tomoyo_path2_perm+0x2c5/0x760 [ 235.221918][ T37] tomoyo_path_rename+0x14e/0x1b0 [ 235.221931][ T37] security_path_rename+0x248/0x460 [ 235.221956][ T37] filename_renameat2+0x4ba/0x9b0 [ 235.221979][ T37] __se_sys_rename+0x55/0x2c0 [ 235.221994][ T37] do_syscall_64+0x174/0x580 [ 235.222016][ T37] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 235.222032][ T37] page last free pid 6220 tgid 6220 ts 226961706476 stack trace: [ 235.222047][ T37] __free_frozen_pages+0x10de/0x11c0 [ 235.222063][ T37] __slab_free+0x252/0x2a0 [ 235.222081][ T37] qlist_free_all+0x99/0x100 [ 235.222119][ T37] kasan_quarantine_reduce+0x148/0x160 [ 235.222135][ T37] __kasan_slab_alloc+0x22/0x80 [ 235.222152][ T37] __kvmalloc_node_noprof+0x53c/0x880 [ 235.222172][ T37] evdev_open+0xeb/0x5f0 [ 235.222189][ T37] chrdev_open+0x4dc/0x600 [ 235.222230][ T37] do_dentry_open+0x849/0x1420 [ 235.222247][ T37] vfs_open+0x3b/0x350 [ 235.222261][ T37] path_openat+0x2e60/0x3850 [ 235.222283][ T37] do_file_open+0x23e/0x4a0 [ 235.222305][ T37] do_sys_openat2+0x115/0x200 [ 235.222322][ T37] __x64_sys_openat+0x138/0x170 [ 235.222339][ T37] do_syscall_64+0x174/0x580 [ 235.222360][ T37] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 235.222383][ T37] [ 235.222386][ T37] Memory state around the buggy address: [ 235.222393][ T37] ffff88805ecf9f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 235.222402][ T37] ffff88805ecfa000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 235.222412][ T37] >ffff88805ecfa080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 235.222419][ T37] ^ [ 235.222426][ T37] ffff88805ecfa100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 235.222434][ T37] ffff88805ecfa180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 235.222441][ T37] ================================================================== [ 235.223606][ T37] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 235.223619][ T37] CPU: 1 UID: 0 PID: 37 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 235.223635][ T37] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 235.223644][ T37] Workqueue: events request_firmware_work_func [ 235.223662][ T37] Call Trace: [ 235.223667][ T37] [ 235.223673][ T37] vpanic+0x56c/0xa60 [ 235.223695][ T37] ? __pfx_vpanic+0x10/0x10 [ 235.223718][ T37] panic+0xc5/0xd0 [ 235.223737][ T37] ? __pfx_panic+0x10/0x10 [ 235.223756][ T37] ? preempt_schedule_thunk+0x16/0x40 [ 235.223777][ T37] ? uea_upload_pre_firmware+0x8d/0x640 [ 235.223797][ T37] ? preempt_schedule_thunk+0x16/0x40 [ 235.223835][ T37] ? uea_upload_pre_firmware+0x8d/0x640 [ 235.223858][ T37] check_panic_on_warn+0x89/0xb0 [ 235.223879][ T37] ? uea_upload_pre_firmware+0x8d/0x640 [ 235.223901][ T37] end_report+0x73/0x170 [ 235.223920][ T37] ? uea_upload_pre_firmware+0x8d/0x640 [ 235.223942][ T37] kasan_report+0x128/0x150 [ 235.223960][ T37] ? _request_firmware+0x1322/0x1780 [ 235.223983][ T37] ? uea_upload_pre_firmware+0x8d/0x640 [ 235.224009][ T37] uea_upload_pre_firmware+0x8d/0x640 [ 235.224033][ T37] ? __pfx__request_firmware+0x10/0x10 [ 235.224049][ T37] ? __pfx_uea_upload_pre_firmware+0x10/0x10 [ 235.224072][ T37] ? process_one_work+0x8cd/0x12b0 [ 235.224095][ T37] ? process_one_work+0x8cd/0x12b0 [ 235.224119][ T37] ? __pfx_uea_upload_pre_firmware+0x10/0x10 [ 235.224142][ T37] request_firmware_work_func+0xf7/0x2d0 [ 235.224159][ T37] ? rcu_is_watching+0x15/0xb0 [ 235.224185][ T37] ? process_one_work+0x8cd/0x12b0 [ 235.224207][ T37] process_one_work+0x93a/0x12b0 [ 235.224237][ T37] ? __pfx_process_one_work+0x10/0x10 [ 235.224260][ T37] ? do_raw_spin_lock+0x12b/0x2f0 [ 235.224280][ T37] ? assign_work+0x3cf/0x5d0 [ 235.224304][ T37] worker_thread+0xb05/0x10d0 [ 235.224338][ T37] kthread+0x388/0x470 [ 235.224356][ T37] ? __pfx_worker_thread+0x10/0x10 [ 235.224406][ T37] ? __pfx_kthread+0x10/0x10 [ 235.224432][ T37] ret_from_fork+0x514/0xb70 [ 235.224460][ T37] ? __pfx_ret_from_fork+0x10/0x10 [ 235.224487][ T37] ? __switch_to+0xc89/0x1420 [ 235.224515][ T37] ? __pfx_kthread+0x10/0x10 [ 235.224533][ T37] ret_from_fork_asm+0x1a/0x30 [ 235.224557][ T37] [ 235.225158][ T37] Kernel Offset: disabled