last executing test programs: 8.579787091s ago: executing program 4 (id=1198): setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59) r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2842, 0x0) read$FUSE(r0, &(0x7f0000002380)={0x2020}, 0x2020) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0x0, r0}, 0x68) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000d80)=ANY=[@ANYBLOB="f80000001a00010000000000fddbdf25ac1414aa0000000000000000000000000000000000000000000000000000000040000000000300030000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ffffffff0000000000000000000000000000000033000000ff020000000000000000000000000001000000000000000000000000000000000000000000000000010400000000000000000000000000000000000000000000040000000000000000000000000000000000606ff3b3d06d8b400000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000100000000000000000008002300190d0000"], 0xf8}}, 0x20000000) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(0xffffffffffffffff, 0x2219, 0x7721, 0x16, 0x0, 0x0) 8.446040312s ago: executing program 4 (id=1200): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="130100002add1e20ef050a023691010203010902240001000000000904000002ea1998000905a6a70000000000090507"], 0x0) syz_usb_control_io$rtl8150(r0, &(0x7f0000000380)={0x14, &(0x7f0000000100)={0x20, 0xf, 0xc2, {0xc2, 0x9, "ad1f214c46062f295b75c49478d05b8ab747ef80c0aaf24cdaeaf8e62069782928d81378795b3d7c9b1181b20163f4d0117e80c34d2c1903dfc0009f31e7aeb529f5426859d1bbd3e68559675a349199e623334a72eaac503e04f04bf679101a7316c1230a08b84e6fea3fa88e86559d5388c581181d2e7c55a4708ceeca63c11ecd9d5b5c753220178f0989b68408e094e8acc0c7980c95eeb67d05fe041d1755b7505575f04d06acc0262bc7b11a78d5287b10415269e7c9eb05e163e8f19e"}}, &(0x7f0000000000)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x416}}}, &(0x7f0000000500)={0x2c, &(0x7f00000005c0)={0x40, 0x30, 0xf1, "f97f244206ae00a813a3b9d0c57ff840a59c38869cca5de759e0bc715d27f63a647d892ad949cd279afdf88740e98b5780b955ec852f7d4cf246d7b63d38bda8ae2a33b0099959c4ee81d8889f1b1c95c31296b3abde399adc16b60e25456eadc4408cfcca839582f286b0ae3c78d20f38d3d1d2367efff1218ba7da2e4f07018164bc1047a46a672e79f08b2a6042cef29b2dcbef910a38d36ead359242753007a5a314270d9e91e0d7545c54fa3956d2463df7f07b53127784274b58479c17ec46cd5022e479ec05b9cee86964db37480b6d492122f956bc6521e2d018bed8c8c7a2d3bd9be7a8102bc3cc7e393011d6"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x2}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x5}, &(0x7f0000000440)={0xc0, 0x5, 0x2, "8665"}, &(0x7f00000004c0)={0x40, 0x5, 0x2, 'y%'}}) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@acquire={0x174, 0x17, 0x1, 0x0, 0x0, {{@in6=@private0}, @in6=@remote, {@in6=@private0, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, {{@in6=@mcast1, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xee00}}}, [@XFRMA_IF_ID={0x8}, @tmpl={0x44, 0x1c, [{{@in6=@private2}, 0x0, @in=@multicast2}]}]}, 0x174}}, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000580)={0x1c, &(0x7f0000000480)={0x40, 0x18, 0x2, 'M6'}, 0x0, 0x0}) 7.734535665s ago: executing program 2 (id=1205): unshare(0x22020400) syz_open_dev$loop(&(0x7f0000000040), 0x40000000008d, 0x20001) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000240), 0xad82, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) socket$unix(0x1, 0x1, 0x0) landlock_add_rule$LANDLOCK_RULE_NET_PORT(r2, 0x2, &(0x7f0000000640), 0x0) 7.414259284s ago: executing program 0 (id=1206): r0 = inotify_init() r1 = mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x1000002, 0x4018831, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x80001) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3000002, 0x9132, 0xffffffffffffffff, 0x2e3dc000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) memfd_secret(0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, 0x0, 0x0) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) madvise(&(0x7f0000130000/0xd000)=nil, 0xd000, 0x66) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$KVM_CAP_X86_DISABLE_EXITS(0xffffffffffffffff, 0x4068aea3, &(0x7f00000002c0)={0x8f, 0x0, 0x1}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0100000005001000050000000500"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{r5}, &(0x7f0000000380), &(0x7f00000003c0)}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r5, 0x0, &(0x7f0000000480)=""/187}, 0x20) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000240)={{&(0x7f0000ffa000/0x3000)=nil, 0x3000}, 0x1}) syz_memcpy_off$KVM_EXIT_MMIO(r1, 0x20, &(0x7f0000000100)="64be365de974de7ab149b947a8218d12625b0c29c0496e90", 0x0, 0x18) ioctl$UFFDIO_ZEROPAGE(r2, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000ce7000/0x1000)=nil, 0x1000}, 0x1}) close_range(r0, 0xffffffffffffffff, 0x0) syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000200000010ac053002400001020301090224000101030000090400040103010206092105000701221e03090581a64fda353a324edbc4bd0121f4b0764308653a1381e40d1c5186536956c8b775f390ba56159bd3b4ec4cc279b665ea855b15f1572746db826697122a85844f73867ea188e8ffffffff226274947b3a61fc4d9c18f98624c0b239204129"], &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0}) syz_io_uring_setup(0x63c0, &(0x7f0000000140)={0x0, 0xed77, 0x10, 0x2, 0x45}, &(0x7f00000001c0), &(0x7f0000000200)) kexec_load(0x0, 0x4, &(0x7f00000003c0)=[{&(0x7f0000000080)="28ac96005005f09b70409a0106d28e1edacb777de32d3dc1fccc15aa2b33f43152f05add533adb05710cec022f093c99f6b312711a2d84b2e11363b1557410629beded5edf", 0x45, 0x8, 0x2}, {&(0x7f0000000240)="ad25c62deb152355e456e0c63cf613979ffe5c1451f560c15b578e5549626a66dd348bc403ea2db1f7d96ab333290e9d29534fcbf82b277e7a676fc7913c607363", 0x41, 0x8, 0x400}, {&(0x7f00000002c0)="42e449c2397392375833473c93f59ddcc9602a81363a036cecbd46af9cefdd584b874f8caa75986618037a38ed2a9004b8ddc335b29f2fb3eb851c5bab9a04d2a5fb9cd5e1c2850c99ba5151c750eb5410e7ab2a000d18d63b66da39a8530ef6b87d38", 0x63, 0x36, 0x2}, {&(0x7f00000001c0)="7f33d1f51f949244d24d86d833f07ada50974f07de72348d844799ff74355f5bd333b3fadfd8e95cb08d0530f0f8e41ec7dcdf23dd35aa89", 0x38, 0x9, 0x3}], 0x140000) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r6, 0x6, 0x6d6, 0x0, &(0x7f0000000040)) 7.247556821s ago: executing program 2 (id=1207): syz_usb_connect$uac1(0x5, 0x72, &(0x7f00000004c0)=ANY=[@ANYBLOB="1a015002000000406d04ae084000010203010902600003010030040904000000010100000a2401ff06000000010200040804b410069cd08df6d947002402060002050106000b000024030300030206090904017b862f20060f905472be2ee50000010215000904010101010200000905010f00020303290725010403080009040200000102000009040201010102000009058209200081fd050725010c0000003424e51b3462b4da8bac8f5592"], &(0x7f0000000300)={0x8, 0x0, 0x0, 0x0, 0x0, [{0x0, &(0x7f0000000000)=@lang_id={0x0, 0x3, 0x415}}, {0x0, &(0x7f0000000040)=@string={0x0, 0x3, "b441129a518db681e4ded636c52bd98271c959881e6b870b04efb9f551e314f0e3ff21eaa9020fd4ff2805c673a84c5bdd4aa61dfaa855207aa3f259d0cfdbefbf5580e9fca471cd6f0d89952c"}}, {0x0, &(0x7f0000000140)=@string={0x0, 0x3, "15c30918341d08fc6f6dea978487e1da48e39a4545cabdb50c924b4a18276e9bf749b3858ddb64da6acbd7f0ea16c3a52b91b25bbe4b29369d12962927a47b7c126a3d54d97241ce3f925bcef1bfffb8e18b09a3c51b0e361b24f2ff5f347033cea96c84fe798e57d84a5a17fc946db08c739d6a502666a38a178d71d3364d092bccf8c1fb057ee4cce47c6fdb87c32298955b719218b036f493ac6fbd79f2e160d31dd484a30ca6142c7b7860aeda64066b7b313a521bdd50ca397fb69908e7db8c89d506f73295ebc09340529a4187e5d3f78d39034e425b4f12"}}, {0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00033cb842f0fac4ec3f9086eba35f403859df7d347a4ee3cb246d204f139714a7f3c99ed5158ed931b4c5f51cd71e765f1bcb9ef249e204ed29c49a42b1c7ccfd28b195207165cd9cea001955dd11543d32aedf4aaa569c873778c134afc7e73ddc85c587aa817b30f5e15c6e9c29903c83898bf0e251bfcfdedd9fb4cb09624f389ccd771a62a8bd7e069c988942a4c1b25b32fe8a1a1cf51469c6621144676b648849b84984f15200"/191]}]}) pipe2$watch_queue(&(0x7f0000000100), 0x80) setsockopt$inet_mreq(0xffffffffffffffff, 0x0, 0x20, &(0x7f00000000c0)={@dev={0xac, 0x14, 0x14, 0xe}, @multicast1}, 0x8) 6.679360135s ago: executing program 1 (id=1209): r0 = socket(0x8000000010, 0x2, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = userfaultfd(0x801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x5d419fb19aaad77c}) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000008c000000090a010400000000000000000700000008000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d48001280140001800c000100636f756e7465720004000280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008000001800b6fcf1a22796e736574000008000340000001"], 0xd4}, 0x1, 0x0, 0x0, 0x24004041}, 0x0) getsockname$inet(r0, &(0x7f0000000180)={0x2, 0x0, @loopback}, &(0x7f00000001c0)=0x10) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000000)={0x0, 0x1000}, &(0x7f0000000040)=0x8) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000002240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$binderfs_ctrl(0xffffffffffffff9c, 0x0, 0x1000, 0x0) r5 = syz_io_uring_setup(0x9f7, &(0x7f0000000180)={0x0, 0x992a, 0x10, 0x4, 0x1a6}, &(0x7f0000000040)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) socket$inet_sctp(0x2, 0x1, 0x84) syz_io_uring_submit(r6, r7, 0x0) io_uring_enter(r5, 0x3517, 0x9141, 0x52, 0x0, 0xa) openat$binfmt_register(0xffffffffffffff9c, 0x0, 0x1, 0x0) unshare(0x6a040000) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c0000086800e97800000000000000000000008cf96d3d79a439b3f9be421603722dd330dd2d434659b12790202d8d9a22a57b48b23caba8dab7f4c33bf9c1e6a40000000000000000000000120093cd7efa0000006860bd8b7ada305714381115e96de0d68a36066cc32b2f53509d87c3d522c5d23c2d49ef7d5cb9e43c24e8a547d25142f77d6cbf6628bfc3b26784e6ce90ac5df5eefde8f3e3362489785c7ce62d4ab46ed0b7a9cf90e8b8aa6bc43268934e3f797172a19193972d3ed349a3c5376a640acf43d70ab20d9ca3aa0f83380f27c9dac52810e6e1975939f9c09de4d7f534be2a3c1a9bae37037e1e2bce40e2ceaed9d26044b1a96ed477dbc5cc4af879364c0869e66f78ed74f63b87e5fd61b77427581595844dd43507b80098ea82f3485444e6bb0867bb36d643caf10abdd6155876e6e760a6d473f3b793ba7bbcfad3d80a140b21262199e90015a30b7322506f0c91ff0d107a21550f7065efbd4d12cd65252f10deb48ec89d6bcdbd11ceea7dbb212d38b3265a6e32b1251dbda0cec602000000000000005eb389ac676285732a2b6a678a87cc6b4a4b2cc499eba3850f755ee6e240c0e3604447b4032df03e4db3577ce9ddbba9e8cff7f99f3a94a9a5062d74964ab94d0e2f3ea161c35fc7f781219796edd06a8db561c8ecce43b2454e1c9ce6dcb68d1a768ca275c8b6cdd1"], 0x1c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r9 = socket$inet6(0xa, 0x3, 0x4) sendmsg$AUDIT_SET_FEATURE(0xffffffffffffffff, &(0x7f0000001140)={0x0, 0x100000058, &(0x7f0000000080)={&(0x7f0000000040)={0x33fe0}, 0x33fe0}}, 0x0) sendmsg$AUDIT_SET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x3c, 0x3e9, 0x200, 0x70bd2c}, 0x75}}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r9, 0x29, 0x23, &(0x7f00000012c0)={{{@in=@broadcast, @in=@multicast2, 0x0, 0x0, 0x4e20, 0xfffe, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000}, {0x0, 0x5, 0x204}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2}, {{@in=@empty, 0x0, 0x32}, 0x2, @in=@broadcast, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4}}, 0xe8) 6.483130214s ago: executing program 2 (id=1210): r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$DCCPDIAG_GETSOCK(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4c00000012000101000000000000000000010000000000000000000000000000000000000000000200000000000000000900000000000000", @ANYRES32=0x0, @ANYBLOB="00020040000000000004000000000000"], 0x4c}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r3 = io_uring_setup(0x3454, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x2e9}) io_uring_register$IORING_REGISTER_BUFFERS(r3, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$FIBMAP(r4, 0x1, &(0x7f0000000140)=0x4) 6.217079296s ago: executing program 0 (id=1211): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000040)=0x56c, 0x4) prctl$PR_SET_NAME(0xf, &(0x7f0000000000)='/dev/audio\x00') r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000101e040031000022000001090224000100000000090400000103000000092100000001220500090581030002"], 0x0) syz_usb_control_io(r3, 0x0, 0x0) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r4, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r1, 0x4058587a, &(0x7f0000000440)={{r1, &(0x7f0000000140)=']\x00', 0x48081, &(0x7f0000000180)={@_ha_fsid={[0x5, 0x1]}, {0x2, 0x7fff, 0x5, 0x2}}, 0x2, &(0x7f0000000200)={@_ha_fsid}, &(0x7f0000000240)=0x4}, {[0xeb, 0x0, 0x0, 0x7]}, 0x7, 0x64, &(0x7f0000000280)=""/100}) ioctl$SG_GET_ACCESS_COUNT(r5, 0x2289, &(0x7f00000004c0)) r6 = syz_io_uring_setup(0x313f, &(0x7f0000000080)={0x0, 0x2, 0x10100, 0x2, 0x171}, &(0x7f0000000380)=0x0, &(0x7f0000000340)=0x0) syz_io_uring_submit(r7, r8, &(0x7f0000000000)=@IORING_OP_WRITEV={0x2, 0x40, 0x0, @fd_index=0x3, 0x0, 0x0}) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) r9 = userfaultfd(0x80001) ioctl$UFFDIO_API(r9, 0xc018aa3f, &(0x7f0000000100)) ioctl$UFFDIO_REGISTER(r9, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) ioctl$UFFDIO_CONTINUE(r9, 0xc020aa08, &(0x7f00000000c0)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) io_uring_enter(r6, 0x4d10, 0x2, 0x2, 0x0, 0x0) r10 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100009f187620ef170372362e010203010902240001000010000904bc00029e8833000905020200020200000905820220"], 0x0) syz_usb_control_io$rtl8150(r10, 0x0, 0x0) syz_usb_control_io$rtl8150(r10, 0x0, &(0x7f00000029c0)={0x2c, &(0x7f0000000080)=ANY=[@ANYBLOB="200302"], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r10, 0x0, &(0x7f0000002640)={0x44, &(0x7f0000000500)=ANY=[@ANYRESDEC=r2], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r10, 0x0, &(0x7f0000000a80)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000840)={0x40, 0xb, 0x2, "31fb"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r10, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000140)=ANY=[@ANYBLOB="001602"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r3, &(0x7f00000003c0)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB="000008000000080482"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_ep_write(r3, 0x81, 0x6, &(0x7f0000000400)="0000230b13fe") syz_usb_disconnect(r3) sendto$packet(r0, &(0x7f0000000080)="09000000e700140000007e7bfbf788a83baa9900d6f18f8e950088a800dd8600", 0x20, 0x24040011, &(0x7f0000000300)={0x11, 0x8100, r2, 0x1, 0xc, 0x6, @remote}, 0x14) 5.912382593s ago: executing program 3 (id=1212): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) quotactl_fd$Q_GETNEXTQUOTA(r1, 0xffffffff00001207, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0x8}, {0xffff, 0xffff}, {0x1, 0x10}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_BUCKETS_LOG={0x8, 0x8, 0x20}, @TCA_FQ_PLIMIT={0x8, 0x1, 0x8}]}}]}, 0x40}}, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000e40), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000000c0)=ANY=[@ANYRESOCT=r4, @ANYRES64=r1, @ANYBLOB="010000000000fedbdf25030000005800018044000400200001000a000000000000040000000000000000000000000000000104800000200002000a0000000000000000000000000000000000000000000000010000000d0001007564703a73797a30000000004603a3d0cdde3359b6211746e8e882f9bee530b6c878b41397cd32e7a9f80a8776"], 0x6c}}, 0x0) 5.782642431s ago: executing program 3 (id=1213): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) setsockopt(0xffffffffffffffff, 0x65, 0x1, 0x0, 0x0) 5.77011772s ago: executing program 1 (id=1214): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x40080) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[], 0x100}, 0x1, 0x0, 0x0, 0x8000}, 0x0) 5.690712958s ago: executing program 3 (id=1215): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x0) clock_adjtime(0x0, &(0x7f0000000e00)={0xe62b, 0x80000000000000, 0x309, 0x0, 0x8000, 0x9f69, 0x0, 0x200000000002000, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x30, 0x80000001, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0xffffffffffffffff}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0xe73a, 0x3, &(0x7f00000001c0)) r0 = socket(0xa, 0x5, 0x0) syz_open_dev$usbfs(&(0x7f0000000180), 0x1, 0x2040) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0xe4, 0x6, &(0x7f0000000200)=0x1) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in6={0xa, 0x4e24, 0xf1, @loopback, 0x19f49a9}], 0x1c) sendmsg$inet_sctp(r0, &(0x7f00000000c0)={&(0x7f0000000000)=@in6={0xa, 0x4e24, 0xff, @loopback, 0x5}, 0x1c, &(0x7f0000000040)=[{&(0x7f0000000100)="e6", 0x1}], 0x1, &(0x7f0000000140)=ANY=[@ANYBLOB="18000000000000008400000007000000ac1414aa0000000020", @ANYRES8=r0, @ANYRES16=r0], 0x38, 0x8d4d28b695d5ab3b}, 0x24000052) 5.665226285s ago: executing program 1 (id=1216): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$sock_int(r0, 0x1, 0x52, &(0x7f0000000040)=0x92c, 0x4) recvmmsg(r0, &(0x7f0000000000)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=""/156, 0x9c}, 0x8000008}], 0x1, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x40000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = gettid() setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r4 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r7, 0x0, 0x0) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r8 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r6, &(0x7f0000000100)={0x20000014}) epoll_wait(r8, &(0x7f0000000340)=[{}], 0x1, 0x80000000) (fail_nth: 1) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r4, &(0x7f0000000000)={0xa0000001}) unshare(0x42000000) timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)=0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(0xffffffffffffffff, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x8000, 0x103) timer_gettime(r9, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000440)={{{@in=@local, @in=@multicast2}}, {{@in6=@private0}, 0x0, @in6=@empty}}, &(0x7f0000000300)=0xe8) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) 5.407369873s ago: executing program 4 (id=1217): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=@getchain={0x17, 0x11, 0x839, 0x70bd2c, 0x100003, {0x0, 0x0, 0x0, 0x0, {0xb, 0xfff3}, {0x2, 0xa}, {0xf, 0xfff1}}}, 0x24}}, 0x0) getsockopt$IP_VS_SO_GET_DESTS(0xffffffffffffffff, 0x0, 0x484, &(0x7f00000000c0)=""/24, &(0x7f00000005c0)=0x18) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x24040084) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r1, 0x4048587b, &(0x7f0000000d40)={{r0, &(0x7f0000000300)='skcipher\x00', 0x0, &(0x7f0000000340)={@_ha_fsid={[0x8, 0x7fffffff]}, {0x2, 0x8, 0xd, 0x6}}, 0x3, &(0x7f0000000540)={@_ha_fsid}, 0x0}, 0x7, &(0x7f0000000e00)=[{0x1, 0x4caa, &(0x7f0000000700)='connmark\x00', &(0x7f0000000740)="01978c1c2cc4b9004d8c4deb4fcffe21aead3de21ade811d2298738aebec76650ec01a668da31d90352fe6a28d60887f03f6cc990debd7581deb98e1ee8d1ebd9fb1664d704ccb614f3a729491d05ec6e2d470e01b64bea7660359aa3b7bcea3be8eb0ba2ee737a7", 0x68, 0x10}, {0x3, 0xe, &(0x7f0000000840)='connmark\x00', &(0x7f0000000880)="3ac464101d90ab5cddcb8c9dc5e1dc21b6565b646537e5a114870a9c8f754c80752823f9ca14accc54f101f0a4c409ed41a469ff8a786510b49d05bd2ed9af612a362e04e137fd89750a55303f30c9505122d3673e4baf03ca8eb6", 0x5b, 0x16}, {0x1, 0x4, &(0x7f0000000900)='connmark\x00', &(0x7f0000000940)="ef95e112ba061e6e66d16a", 0xb, 0x2}, {0x1, 0x3, &(0x7f0000000980)='\x00', &(0x7f00000009c0)="9515dde9a164bbe50de6f6d046c5f49efba9c621e80713bc2651c3ff043bdce51ea5f97c8a0488a59b00383f454e54a5c034a99082d54b10ae81624eb2f3bd23892ae9533b61cc6d5be0fad39f7d2ca574d26418ea4d537e1ac251177144ebfe2beb51f9510b95ee8837704bb908b7d9a526d1d2cacb7455e11cd6a694e0fd7d70aa7c9972293343fb", 0x89, 0x20}, {0x1, 0xf000000, &(0x7f0000000a80)=',&)\x00', &(0x7f0000000ac0)="88886b5361134fdedb16b5fed00e7f8d33b43d80a0ef0475884de5ba63f03122236bf35b7873bccbdb42a540fc65df92ab6d7d4c6a6d866aee54763076f1b9bd91477188b15db518401f7b83a01b8e9e725c9e03e42dbd75278c15a79b544999bb747b4420a855f764", 0x69, 0x20}, {0x2, 0x0, &(0x7f0000000b40)=',^^\xd9&&\x00', &(0x7f0000000b80)="04259e439e7a36b5d608631e376f97100b26723336d45c44fd927ae6e950a716363751b014753aad831b9e71ff402ce54d6eab607518bc7e57283d6fa33ed0acc262d06ce5e71a6a5b643aeaf409cee14b", 0x51, 0x32}, {0x1, 0x80000001, &(0x7f0000000c00)=']\x00', &(0x7f0000000c40)="63602c4d881e675a0ad3e49e5044e8dc7dba90124e2ec2dc19478c8788a3d8fc8cfbc6676ab7f1c1728d038c75822918bf5e875b92187f1db89522bc1cbfd69866fbbad56ff82be5ca52bca254949b8d5a3813a667bddff8ed771d00fac02a47ea360b4fb9c4f11766880413321bcf2a2e2418a5b5557fd49a10122132756a56f1ce0c5a3f18606e4020d7a32998da87d1d07a07a54054e1f6506fb948b48128d9b35820573bc4492c1e666856d01a112ee09b7d2c04a5370d3b13a71a711337ceb96fb73788a3430dff796c", 0xcc, 0xa}]}) sendmsg$MPTCP_PM_CMD_REMOVE(r2, &(0x7f0000001000)={&(0x7f0000000f00)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={0x0}, 0x1, 0x0, 0x0, 0x810}, 0x1) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x25, 0x0, @void}, 0x10) sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40081c4}, 0x44000) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0x2, 0x3, 0x0, 0xad7}, 0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x481d5) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000840)=@newsa={0x158, 0x10, 0x713, 0x0, 0x0, {{@in6=@private2={0xfc, 0x2, '\x00', 0x1}, @in6=@local}, {@in=@dev={0xac, 0x14, 0x14, 0x17}, 0x4d5, 0x33}, @in=@multicast1, {0x3}, {}, {0x0, 0x22}, 0x0, 0x0, 0x2}, [@algo_auth_trunc={0x5c, 0x14, {{'cmac(aes)\x00'}, 0x80, 0x0, "3509fe8fd57fd44aa5074c50bc700e53"}}, @offload={0xc, 0x1c, {0x0, 0x2}}]}, 0x158}}, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46", 0xb5}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r6, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r7, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 4.639035733s ago: executing program 4 (id=1218): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = msgget(0x1, 0x200) msgrcv(r1, 0x0, 0x0, 0x3, 0x2000) msgsnd(r1, &(0x7f00000023c0)={0x2}, 0x8, 0x800) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000040)={0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x8}, 0xe) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000440)=0x10) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f00000000c0)={r2, 0x8000, 0x8000}, 0x8) 4.575159493s ago: executing program 4 (id=1219): syz_usb_connect(0x0, 0x4a, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000780)={'pim6reg0\x00', 0x400}) openat$udambuf(0xffffffffffffff9c, 0x0, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) openat$drirender128(0xffffffffffffff9c, &(0x7f00000003c0), 0x101000, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$VIDIOC_UNSUBSCRIBE_EVENT(0xffffffffffffffff, 0x80085665, &(0x7f00000000c0)={0x3, 0x1ff, 0x2}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$video4linux(0x0, 0x3, 0x3cf281) syz_open_dev$dri(&(0x7f0000000100), 0x100000000, 0x1) r3 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2982, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f00006e3000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r4 = io_uring_setup(0x7fa, &(0x7f0000000040)={0x0, 0xc8de, 0xfc00, 0x800000a, 0x20002f7}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[], 0x28}}, 0x0) io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0) close(r3) 4.035180151s ago: executing program 2 (id=1220): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x840}, 0x0) 3.802713429s ago: executing program 2 (id=1221): r0 = inotify_init() r1 = mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x1000002, 0x4018831, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x80001) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3000002, 0x9132, 0xffffffffffffffff, 0x2e3dc000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) memfd_secret(0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, 0x0, 0x0) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) madvise(&(0x7f0000130000/0xd000)=nil, 0xd000, 0x66) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$KVM_CAP_X86_DISABLE_EXITS(0xffffffffffffffff, 0x4068aea3, &(0x7f00000002c0)={0x8f, 0x0, 0x1}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0100000005001000050000000500"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{r5}, &(0x7f0000000380), &(0x7f00000003c0)}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r5, 0x0, &(0x7f0000000480)=""/187}, 0x20) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000240)={{&(0x7f0000ffa000/0x3000)=nil, 0x3000}, 0x1}) syz_memcpy_off$KVM_EXIT_MMIO(r1, 0x20, &(0x7f0000000100)="64be365de974de7ab149b947a8218d12625b0c29c0496e90", 0x0, 0x18) ioctl$UFFDIO_ZEROPAGE(r2, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000ce7000/0x1000)=nil, 0x1000}, 0x1}) close_range(r0, 0xffffffffffffffff, 0x0) syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000200000010ac053002400001020301090224000101030000090400040103010206092105000701221e03090581a64fda353a324edbc4bd0121f4b0764308653a1381e40d1c5186536956c8b775f390ba56159bd3b4ec4cc279b665ea855b15f1572746db826697122a85844f73867ea188e8ffffffff226274947b3a61fc4d9c18f98624c0b239204129"], &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0}) syz_io_uring_setup(0x63c0, &(0x7f0000000140)={0x0, 0xed77, 0x10, 0x2, 0x45}, &(0x7f00000001c0), &(0x7f0000000200)) kexec_load(0x0, 0x4, &(0x7f00000003c0)=[{&(0x7f0000000080)="28ac96005005f09b70409a0106d28e1edacb777de32d3dc1fccc15aa2b33f43152f05add533adb05710cec022f093c99f6b312711a2d84b2e11363b1557410629beded5edf", 0x45, 0x8, 0x2}, {&(0x7f0000000240)="ad25c62deb152355e456e0c63cf613979ffe5c1451f560c15b578e5549626a66dd348bc403ea2db1f7d96ab333290e9d29534fcbf82b277e7a676fc7913c607363", 0x41, 0x8, 0x400}, {&(0x7f00000002c0)="42e449c2397392375833473c93f59ddcc9602a81363a036cecbd46af9cefdd584b874f8caa75986618037a38ed2a9004b8ddc335b29f2fb3eb851c5bab9a04d2a5fb9cd5e1c2850c99ba5151c750eb5410e7ab2a000d18d63b66da39a8530ef6b87d38", 0x63, 0x36, 0x2}, {&(0x7f00000001c0)="7f33d1f51f949244d24d86d833f07ada50974f07de72348d844799ff74355f5bd333b3fadfd8e95cb08d0530f0f8e41ec7dcdf23dd35aa89", 0x38, 0x9, 0x3}], 0x140000) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r6, 0x6, 0x6d6, 0x0, &(0x7f0000000040)) 3.645958635s ago: executing program 1 (id=1222): r0 = socket$tipc(0x1e, 0x2, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1a, &(0x7f0000000140)=""/62, &(0x7f00000001c0)=0x3e) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(0xffffffffffffffff, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0xc, 0x8001, 0x0, 0x9, 0x4f, 0x8, 0xfa11, 0x1}, 0x0) fcntl$getownex(r1, 0x10, 0x0) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) fchdir(r3) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket(0x400000000010, 0x3, 0x0) syz_open_dev$sndmidi(&(0x7f0000000180), 0x6, 0x6000) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$RDMA_NLDEV_CMD_SYS_SET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x27, &(0x7f0000000280)={@multicast2, @local, @remote}, 0xc) setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x29, &(0x7f00000000c0)=ANY=[@ANYBLOB="e0000002ac1414aa0000000003"], 0x1c) syz_emit_ethernet(0x36, &(0x7f0000001800)={@link_local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x64, 0x0, 0x4, 0x2, 0x0, @empty, @multicast2}, @timestamp_reply={0x11, 0x0, 0x0, 0xe000, 0x2, 0x10001}}}}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) 2.990247591s ago: executing program 0 (id=1223): r0 = openat$sysfs(0xffffff9c, &(0x7f0000000080)='/sys/power/pm_test', 0x0, 0x0) r1 = syz_usb_connect$hid(0x5, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="12011001000000406104724e00000000000109022d0001000000830904000001030001000921fcff0001220b0009058103"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000300)={0x2c, &(0x7f0000000140)={0x0, 0x9, 0x14, {0x14, 0x31, "fb3a8d621fe05ceaf373f1c32f5604f67ae2"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) close_range(r0, 0xffffffffffffffff, 0x2) syz_clone3(&(0x7f00000000c0)={0x385000080, 0x0, 0x0, 0x0, {0x33}, 0x0, 0x0, 0x0, 0x0, 0x0, {r0}}, 0x58) 2.691936886s ago: executing program 2 (id=1224): socketpair$unix(0x1, 0x1, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)}, 0x4) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x2a, &(0x7f0000000100), 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_raw(0x1d, 0x3, 0x1) r2 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$VIDIOC_S_SELECTION(r2, 0xc040565f, &(0x7f0000000000)={0xb, 0x100, 0x1, {0x6, 0x1000, 0x2, 0x86b}}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x38, 0x0, 0x4, 0x8001, 0x0, 0xb49, 0x200000000002, 0x7, 0x8, 0x5}, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000000)={0x58, 0x2, 0x6, 0x201, 0x0, 0x0, {0x7, 0x0, 0xfffd}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'bitmap:ip,mac\x00'}]}, 0x58}}, 0x0) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000180)={0x2, 0x0, [{0x8, 0x5, 0x0, 0x0, @irqchip={0x81c, 0x4}}, {0xfffffffb, 0x3, 0x1, 0x0, @irqchip={0x6, 0x7f}}]}) mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x11, r3, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x1000007, 0x2172, 0xffffffffffffffff, 0x0) r4 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) r5 = io_uring_setup(0x31b9, &(0x7f0000000200)={0x0, 0x8276, 0x200, 0x1, 0x2f}) io_uring_register$IORING_REGISTER_BUFFERS2(r5, 0xf, &(0x7f0000002a40)={0xa, 0x1, 0x0, &(0x7f0000002940)=[{&(0x7f0000000280)}, {&(0x7f00000012c0)=""/231, 0xe7}, {&(0x7f00000013c0)=""/107, 0x6b}, {&(0x7f0000001440)=""/115, 0x73}, {&(0x7f00000014c0)=""/252, 0xfc}, {&(0x7f00000015c0)=""/233, 0xe9}, {&(0x7f00000016c0)=""/4096, 0x1000}, {&(0x7f00000026c0)=""/80, 0x50}, {&(0x7f0000002740)=""/253, 0xfd}, {&(0x7f0000002840)=""/201, 0xc9}], &(0x7f0000002a00)=[0xc46, 0xe, 0x3d]}, 0x20) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0xc) r6 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000000340)=ANY=[@ANYBLOB="bf16000000000000b7070000000100004870000000000000280000000000000095000000000000002ba728041598fbd30cb599e83d24a3aa81d36bb3019c13bd23212fb56fa54f2641d8b02c3815e79c1414eb07eae6f0711e6bd917487960717142da7646c4fe02996b60cf81ebcd50fa9ea4308123f602000000000000de89e661168c1886d0d4d94f204e345c652fbc1626e3a2a2ad358061d0ae0209e62f51ee988e6ea604ce974a22a550d6f97080980400003e05df3ceb9f1feae5737ecaa80a666963c474c2a100c788b277beee1cbf9b0a4d3881dcc7b1b85f3c3d44aeaccd3641110bec4e90a6341965c39e4b3431abe802f5ab3e89cf6c662ed4048d3b3e22278d00ce00000000d3a02762011052eac2951257b85802189d74005d2a1bcf9436e192e23fd275985bf31b714f000bcab6fcd610f25f5888000000003f11afc9bd08c6ebfbb89432fb465bc52f49129b9b6150e320c9901de2ebb9000000018e3095c4c5c7a156cec33a667dc8aff950ca1e5efdd4c968dacf81baa3a509b1041d06f6b0097c430481824a3f4fddd3c643f630ba175d876defd3541772f26e27c44cfdb2d85d6d29983e830a9cdd79837b3468e8c67a571d0a017c100344c52a6f387a1340a1c8889464f90cc4cd1f570dd39877dfb2ff1ae66e1ce917474b2e650ae630afd014a337ac5d58bcb5e51723257c872c5255f20100000000000000f041b665ab21372c8d8b7bac5b5c784d20a4a24d8dbd75062e1daef9dead619cc6e7baa72707157791c3d2a286ffb8d35452bb5d36c2a8682bf7ecbd53f950ef4709ec01e230d2f53594ef4839c6130c4c13a0cca84b9935f771fd49e4b9ec7a410ec42315255be1ed66d9051f22614d1f62734d679039a97d2b74f9e8e997ccd314000f747f4e8e7025123e783df8b8a17e3aa9fe1f662aef87a065b03cfb65b4dfe4f1b56e1f23128d743753a1de172d683d5892ce9414a1d98ea93e3d35dbb6c23b90cf36e83b8a434a97d09343d7f83079ccb02e69d384146056d125cfa788237874dd42dae334bda042819a2aa24dba1c25be2794448b4f63483026b5e34d44705b76ef29241adab0dd7d68bf975e02069f6f2425e1bc97a3d588085f16bef63a06578d4f5de7bfb6aaa75f16996d536256c02284cb1d3a6fb8cae87691fae365a70c3fc69e1565bba8dd8a8ca049f798ab20000000bebd69413afc9d8a5edd7aaa000000000000001e6c2f2a287c5278a218dbfaffffff00a14db5cfa6819eb1d39c48cfdc80d2000000000000000819363154cca4e2f89800d18c89d7f46f679df6c9e2952ae1ebfd0ca88368ee6ce139e8b5822c22cf2e9dde943d34c432e1001171792c65986146666a5490928441f47e0fe5eac41824ca1fd0eb71aa243c88d5480e5aee9c9e5f2e5a56a6d920335c8e8726fd8329d9a728995b1531bd20360d33d8f9ffffff5f912ac4e34bf6ea8a86da707b03bddb491ba0cc98f6be92c55969a2b50025419d1476c73132ca7ca26ce8a7e3ffb700f09e157f9b844051f1a642aca9ff98c9036471ccff0522903e7bcf62e18f7696bbc280b95e8e0d6fd5644b0ebde3a95b06548862de809d3dae3cccf109f7c78e8479a345e800000000000000000000009455bf417627ce723a5d9103706aba84279500bb82f6b5a3ddc0bd9856712945b70c75ce5b722578820820d010d7a3cffc99fc647d0b82ef26ab708c0b19ed144be51c3b398f0e6bb7a30006000000cba12953d58cff0f0378740fe6662f377b97d8e7cdb047050d7296cd3856476a60a49ad127ba6570bafc2bbcf9ee721fd9cb467ff071e5603a9d801300000000007d932d7a64de4c4aa433fc0840aff7c47da3a4c6966d0000000000000000f6bfbae29e8a6e2a889f6ef6869d82d6bd73eb76b65c7a35a54a4a6b8ad4600e3a972a0bb5971a5f16590b0a03dafa3fd1118765cc8ab9fccf3b51c41a339f200f2fa33006910a679a9ae0187b4d750c4bd244cb0cbfd23b265f4d4da448a7a0d19c5e43eae50a31609dfa2dde267551467eb6475293dd7012cc449009981f22820e57a0eff234ccfe21d7a2302e000669753d3c3432cc14ee1abe724adb6b5431befedd3e22971118f0e21aed03a6fe7860b3e13c3173a60a1823cb7dde8212a8531bd9060000006a370e9eb56b3d790b98f2bd0db1e5de6a146597b2cbb7103040d2a39d7965d34df524b760ab92efcce7dd1574052c735935bf6a752c015c7f5ffee9ff66e5dd2866b15b6e0d17618cb1f5c1ee4b05ebf1445ea110f499f840a5c965443d535556351ee25fe09f69494b053678dcadcf02e063dff2fa4bef1ac3bbbebe6c74d71ec3b23e29895eff1d1017024fe3e8cc759b05785adc346b7ffd05963f92c1d0d7d90ba878ad89e490f3e29ac51d30632869a534418f916bf6fe8167827a8e6c8f8b391c822805cb0adf1b8bd6947ff208753eb0d208ce14f7b206b2e02c21e963abc5ceb735c1b3c46b0a843de52a0000000000000001ee9c2b2705c1a81d9d3b9656b219c8cd99c9cafcd0d0540884d97aecb19983fc6af29ab44a82aff9cba921192c665b877af6539bdb1b567f481ba0790ee0d112f99e59ba82e7ad758f4e1eac69e7e88a63960975f490e161e371ec8534791e3b61c685d900a9c0839208356b53750e76fcc3c2d1bddcbd83897921414d0c02e8188f3df79ea2a5c5444004830e6cb227ca1bdafb977c00000000003a417193b8c5d793687335a930867094fd6a78218218e04b705ec62f1608cb569b81914e68f175b392af6bc4fd2121d7fd276af2c97a441b56e7a0687d98b8e76d8d0d231e4fe00be1de76bd19cc12e2bd938eb681ed6bc951c1b4f7c51af59eea4d40c6000000000200778a677b72786311153271a3313da02645e11761699e4d04ac86dd14ff7b9a10d3fa74696fe3953a5b7706bf5d1faba4b18808d9cb0e9db696dec4e0820ee4028d7225a2c9c427cf64cbde6fba056b2006b7a37c1181d530fb865e235cd302f3b4071ee52303da186b9e5e3144bf479f277f10656ad3744037ccc9c63685a6f1109d2ea73773d3635f61497f1fa1ea4a16f601800bf3e59141fbf05a96113320c44500f8ffff970d5254727e804fbd99ccefb7c09269dd2c5c25e56e169ac15980f3f85f7ca36dd5950ef5b64fd46f123311829534a82940994199b3cf7a8f09c1946e55289f668c423fcbb31ae91864c882313151741a67538c9689dc8ecc9903c7041e5c1b04e2fa55a756487517a7445cbd9e3f5175e41c00000000000000000000000000bf98efd587fffe326f474b0b089c017b16c0062cbce96f5adebec52a79f9363909842f79c50a1520be46d87003137e4c5031f00123e812a5e37cd52c9eb7336281cb8c6ce9934b157d7875a70eaf103cb3138e2361c51cd1eab8a26b232acf6bf0ab829c26dab637538b2eb1420d812d2b80c777710ba0f18e4661681aa218d9ba54023ab4305977eb15611ae2545835e9d30e9f6d4fb43a291c69545a1eea0f87204311327c18380fedf3d3dad8549f99bf6c5cb060fc37d2449f72de0cbea4bc1dc89c136cdbc504f849d5502d77a95c7bfff4cd9c03058d0d4d07ea64824f1acf2b39289f675f39d01719cdbab3f1ce1060f3e6806e774a5f079c8d7b3e37cb99b41da5e485a441b6a103549f55ab09dc98767763d1f2fafd45bb7d2b40050d1f8292f4d9ec6d0000000000003932062290f4996fdd55b06023437e9e2072daf7f5d82f6f1b5b89a41134f4dc2e65bb11272fdf8c8141f41d6160b3d8b6ecd16d14267f61b4881adee7f07f3d6af5ae794286b6c3e1f5a76b85ed6e1f0000c608b8262c807dd755e22b801162381aa9d1af2bbc9cfd497585337eac408b8475b47a392a10cae349160f128e5f873a58064eb400c36a90624f6aed398a215e9ce64522ab249f67c38a656d32ecff5cdb2b039c4abf349d2c0f88a42e9189bbfa7f5cf35b6e7ef8f9d33163b7ea87550fb1ba334c83e3aec4714c9c4ca3ecb04f2720237615a28bf310b58ffa2a103216fdcc8c2d8f5d55e5e7ebf147105272aaae56e86d856b3cf79a3f7306436762dd07cebc7892ec6f9f696da38feed3dc0001500e34adae1ba89a32bad2af9030f840f1ba4664f35547cdadd5cbacc59352c290f55d971b65953533668c25f21d8d62d849e9058eaa97c63491568887548f668cdbca2abf01a361a0b64d8b523e669da350e3ec7445dfbf366b0b3bc5e76824a1951393352bc756f3fcaad2c1c399a3e43eaaeca70db90f2fa395964434476719334482eb5424c81814079a24fe3681ad9ac361f71ac279a688f10a12105edebc5e3b8dad4c8305ab129ca2dfb9b7c5e9d097bd01b495cccefddce569117f7f5d6a6270ff0f0f4c371029ca8489571b55841bf3dd003bc81460eee57ceb3c33f4e9300b0144fe040cf5fcfcbb616c2070237881afdb314cecd1623f3e55ab8b7627fa1be349145a8d6313cbc790eefe2020138e82fbdd351be4ddcbcc9bc048dd3db5828d16baec6e07a007f0030f34ea3cfd524d6fa1d45da5641d6c94e1d3ae7fba1c85035d2a60ef1696e0d96aa1c60019f73ae0aa6113cd66ef26b5777337c26e1461405d86fdf091edd526f25cada439bb3609ed5c35ab60a539ade786bd6004d0ea3edbd6c4da0d8e8be8c771c8c8a0b07d9859e04adb18964dcce9bce546074c26dffbc2dff78ce9308c845d4257000000000000000000000000000000000000f29657697d9c2b132b2dc2f5ea5122836582a7e85fe2bc166f17aefd9d861de0191f5277d4a3b5afb6f200000000000000000089de7f8485d9507164a187220b36ddc7fa645d4bd0c1414c30a416f80ba17d21d53961471b2d2d459e4bb23230d676ca49633b25e26a322024beb7c3427da59f7daa70a5d44a0eb895f29245df6401295d3da939954e126a3be932f47fe61ef1bfe83086651af7e23c2a8fa702b9aaa65aa3edaaa6b3f5a0c7cdfd008c898d73bb97168ca390ef539800000000000077a5ad1e683aeff92bb0b66b33ed878df1e344b99450086c819bf174578705c049d2fb25a91ba04643cde1a3c391d8646e5249dbf28b13b1c4d5127f685ee0c0576bf74e17cd3b4df4eb7095e504e361689572b0f93ff1dc6f52e8728a03e5a4df80a32c6055df8f4f4152c0bf4d793b20ac2cfa907b5af80716118f82027d3e4cb096fe86de545008b85cb9b637bca30d765b0c3ad489db32955454dcfe000000002830e5e125322d2f5829040a91405bf2fe5bf14833fd7b1e72c775f267bc45"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffe89}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r7, 0x0, 0xe, 0x0, &(0x7f0000000040)="2b1c52ac82e71ea05b0c5e43ede4", 0x0, 0xb20c, 0x0, 0x0, 0xc0, 0x0, &(0x7f0000001200)="4c4228369f88e91870041ef4c8baa41449dc6ad5553764e898ddee1dfbb587ef4e6854a6bea12aecd99ac5dd4e39745d195df155a8628b7483b791d4de8609a893ccfbe9dc5c2ed555df193d92968b81da97fe3f0f220dd48b29c98152d9ecb2bb68cbf0bfe454a10e0adf453bd021ba3b502665c757d209f1fa9daa8979aa1fc22684d52bba1cd3c5946a6ea16b40f3bf8cc0134fb55a63817f6bac437682ed4c30147c2d86997f970ba094a19b0de4904bf83ff6fc3f0e46aba38692387ce1", 0x4}, 0x4c) syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12011900000000406a0563000000000000010902"], 0x0) write$sysctl(r6, &(0x7f00000000c0)='2\x00', 0x2) 2.571105491s ago: executing program 3 (id=1225): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) setsockopt(0xffffffffffffffff, 0x65, 0x1, 0x0, 0x0) 1.975102202s ago: executing program 0 (id=1226): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x3, 0x3, 0x3}, 0x10) sendmsg$tipc(r1, &(0x7f00000000c0)={&(0x7f0000000200)=@name={0x1e, 0x2, 0x1, {{0x1, 0x3}, 0x1}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0xc084}, 0x4040082) socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) r2 = socket$tipc(0x1e, 0x5, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x300, 0x3, 0x3}, 0x10) sendmsg$tipc(r2, 0x0, 0x0) 1.803398955s ago: executing program 0 (id=1227): r0 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCGSTAMPNS(r0, 0x8907, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) symlink(&(0x7f0000002040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', &(0x7f00000001c0)='./file0\x00') rename(&(0x7f0000000580)='./file0\x00', &(0x7f0000000780)='./file2\x00') sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) setsockopt$MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f00000002c0)={{0xa, 0x4e24, 0x0, @mcast2, 0x6a3}, {0xa, 0x4e21, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x6}, 0x1, {[0x5, 0xa526, 0x4, 0x3, 0xfffffff1, 0x98, 0x3b, 0x4]}}, 0x5c) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) r5 = dup3(r4, 0xffffffffffffffff, 0x0) openat$vicodec0(0xffffffffffffff9c, &(0x7f0000003600), 0x2, 0x0) openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VIDIOC_S_CTRL(0xffffffffffffffff, 0xc008561c, &(0x7f0000000080)={0xf0f041}) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0x4}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, 0x0) r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) read$FUSE(r7, &(0x7f00000034c0)={0x2020}, 0xcac) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) 1.431745338s ago: executing program 4 (id=1228): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r1, 0x29, 0x2, &(0x7f0000034780)=""/102391, &(0x7f0000000180)=0x18ff7) setsockopt$ALG_SET_AEAD_AUTHSIZE(r0, 0x117, 0x5, 0x0, 0x5) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$kcm(0x11, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) close(r4) socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=@newtfilter={0x5c, 0x2c, 0xd3f, 0x30bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, r7, {0x8, 0x10}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x2c, 0x2, [@TCA_BASIC_EMATCHES={0x28, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x1c, 0x2, 0x0, 0x1, [@TCF_EM_CMP={0x18, 0x1, 0x0, 0x0, {{0xf04, 0x1, 0xff00}, {0x200, 0x8c5a, 0xcc3f, 0x1, 0x2, 0x2, 0x25d2db1085198a40}}}]}]}]}}]}, 0x5c}}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @broadcast}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r3, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r8, 0x3e}, 0x80, &(0x7f0000000280)=[{&(0x7f0000000200)="95", 0x1}], 0x1}, 0x0) keyctl$clear(0x3, 0xfffffffffffffffd) r9 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) ioctl$SNDCTL_DSP_SETFMT(r9, 0xc0045005, &(0x7f0000000000)=0x1000) ioctl$SNDCTL_DSP_SETFRAGMENT(r9, 0xc004500a, &(0x7f0000000540)=0x4) read$eventfd(r9, &(0x7f0000000100), 0x8) 794.459181ms ago: executing program 3 (id=1229): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000540)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @payload={{0xc}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_DREG={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_PAYLOAD_OFFSET={0x8, 0x3, 0x1, 0x0, 0x4f}, @NFTA_PAYLOAD_LEN={0x8, 0x4, 0x1, 0x0, 0x58}, @NFTA_PAYLOAD_BASE={0x8, 0x2, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x8c}, 0x1, 0x0, 0x0, 0x40}, 0x24000800) (fail_nth: 8) 726.450631ms ago: executing program 1 (id=1230): r0 = socket$packet(0x11, 0x2, 0x300) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_GET_PIT(r2, 0xc048ae65, &(0x7f00000001c0)) sendmmsg(r0, &(0x7f000000b3c0)=[{{&(0x7f0000001900)=@qipcrtr={0x2a, 0x0, 0x3fff}, 0x80, &(0x7f0000002a00)=[{&(0x7f0000001980)="d4f505cdc5cffac6943b5ef4e89a217886cee4f4773f14ee20bc3a088abf2ce497b91e6e0d20811c67e3149a53bfacab5d965a46b12b3178c9823dde8d2edd6fbe622edaaa0af6dfc5f9acf7d04dbf9574ed7ca9d2591257b22572563abe2c367039821f5435ad42436c7c532236e9aa4eb510424d46ef832e6d733771d2f878bfb874fedbd52b33d5cde5e1eb3921eed4a52276ce108ade79d71f024d33a926c04b65def732bf53ec696daf9a9d55244b5fe0df194820a244e7f5cf02e4a3b112ce82c517b291251bc5f102b9e3e5009760bd790179749fab6175292f9f479e894b5ca1fda2d4430fcec16344feeb57034c89ac8015f5ba8a3caee741e0682b2ec235e862f0fac82ab820e84181f2425bd457efce2dae78d4012ec744eb815e46c0eae422bdee5a24e0c787d1302b78ce628b71187986b26eb0f53687bd6a9b65eb75411e69a5792c25e341f776889ea575094b798b93a33c6f8fa2848184dc4460eef8554e189dd2849866605e74ea8ea8c79c0102c75cea6a62348e8243e4497e023fd9f5d78ae17989211c4575cb4eccafbdd8db0239cbdc8eccbac226aff2325d936e6b51825e1fcc96d2f6179b5ca6e906ad1392ac34e4cbe1aacafefc8b564c12ab9bb7838addf9bc0ba04430fcbf833651b2088486bad85d02a696418280d6eefefab149318c1d2696e0f78785918a183caa2b05f893b0cd25f979e4af5ffa96a8b5647cff428df74a2365616a58270d135323096cbe96aee0ef51780891ca9a41a2b2a73b66f65cbd72c4528f8c8e03c486dae06dc811fdcbaeada0214545503c0a690a07aad4bd0121e89a4ef392e82ffd7e175e7472f6218a095d93aa42ce1b735128df9a63773ca5f90bab295466376a3c395a0c8c22268d430ca3ad17d5bd831e2e3ffe05b5f33a2da17ba4c5b36a0a6da00c1e57174ffab4332e7ca65ac8cfbbc73278d45f1979579a9c6fdc30ed81c204a7d1760754ff2c88d5dec63e3c5a55d619b037ed1894754cb19b9899589a1fe5f1fe146a8e041803e971bd5f0b7de6de516c9bc49724946be6a4f6a5ff89d82b21518e6a594006b8d2ea6f824bfbfd186e66424a6b7b1dc4438f3f13dfc958a963f51290dceed57730ed1e3fc0a4793fce5dc14f92c5f0e9d8c50bcc14b5415d08b19025fc04114d9eec2e8ba698cae9af2e2c56fcb605b0ecabf2c66632c4f446b691159d6a4c175d84dcf4d92ac5a9cf7e5db47814cc6432ea9910fcc9eb25290d62a863bd043fcb960d772326c5611921945d535205116e2f1e304e43358ddf35358d735ed6938cf0e5e41c10839ac6f05f4e8ed8985aa837c81fe55c72f736c11a58e09d569cfb8b67317e051e94884037d665c9e9bb319d7bc74003b740417be5c5705b78bfcbb3da728e3024005f7b1f31b003cf66d0982e963b0eb6b2bbe0385586bed3879d44386510500b364aede8616071dc635ebbf11c95dea832fd3a48ec156978a81a90a2eaae974de2865cb11e30201fd137b3246ff2c82800f9a7bbc4f529077269afb40ac6c5fe73ea25d72706f48b96df29056a36d29dc37c5ffc524f759bb410e7419b7bcbaec437d3aedc3903cbb76f8492ef48fd333268652d3da3ca8cd5f6fc85dbb2ae71278c206a1f1b281094cc5a9ad2fdfe06322a2a1f600b00f22657b37f5b3ab74d3d37b3f237ae5cf924861ed914e19b27e20e39e781d997362c04eb06e393378452929a3956fed9a802c54ff19e9bbb3e78a115635e63a8d58d684972384a5e32f73e4731d8009dfcf3639167457dfbd0311eb6926f2b6436fde376f3f665f6d5e92a8f3f52cede5970f67a7425e6d355b307c0f43d608dfab14124f92d77ebb5c1e2352860808ab62944b329fb84ce7d3ee19bc73f2248240842f41330ecd8a77a6c956b52e88a94ee176054b3939ff020c4799031670dac5d814fab516533eb0c29beaa67cd6d39df444ffa2164d47412b949638aca0e7bfca48dc45293c13c028f29b5c00393b3659a01c89990f40b79d91c4666232d76ae80fae6406ac7e7b56156811b1611b1dfd14a79e58dffac93f4c9c990a1fb7356a96313b23fa744f6616bed6095a6fb68179efc02ad7f5dae5ff4439d1403197498d3c615c5601c579a3672b6b069ba44bc867ac07b80eb112c74d4a537d63189e449758455019697217e052048c4bedf35ac96d852d8ee0cab44e820ef257a54fb5dabf22b0468ddf43f9759064a482b4fbcec3a302e2cf73dc8fb98bcf94981dd1f25b82ba9cedcba00cc7742f2aff4a0718b4e3ea38b625ba5eaf210bb1232324fc565049fd63b0daddaf1a243700a19726b412f0e66e84771abbfd04616546fe639a9b8b1b7fb6f6a6893abeae0b2afc9fdb61bbcc136a94aedaae90a061d144f0c8f5f8f67f69fb1434c5aafc356d785641c12088a64155da8d190b2c6c1c613e5f5b03cc3e367a2a503946db2e3db3b525baf72d9ac5c8fa8912a227bf2659c79afb01ea6e9cfc9145fc62497e5ce33a5c413cb934682b9967eb7a38f11f73be1b478c9be23c51fab830131fbb7a7bd5e571f7ce3a4d008ffdeb77ff0c3cb3c902910d72a80a7e59be7f998273fa3ecfc47ae697d09f2579efa01dcd7b075c1f5369963256a3e6fa1fb36b9edad124564a2b3fcdbec934c70f8dc79ef936b9368f144148db5f29af8b9d06a2b08aca675ab385952ddfc01ea3b7e9cf5b12f13a0e32de5d0491d6fd22c4a876f5a0798e1be7735f0989637aa8adcd0f223a7c3f9ea8fc2372ecb159dd6357ef81d7d68029f2f50af2c6f30e2aa5a070d44a583d6ca50fd15b423bfc5763eca910a10c1344ac9254f7d2dca2d7011106957719f8de61cec7469d6114fac25dd8716f32e360aa3bc9880051530388c3cd317e0b473108bfb81f49c04d4ad906883615c71216fb4255db2ec8fb04d7e7587a41bbb6f9dff64734510be699584b3e70862c73e3ea86d868a75eb82afea120dc0136a02c1a8cac11740650e4e63bc209337ef8270b7847452de1315d8d26742d1f688c9baa44a93fd6b986db8bc9b58253f016cbbca332139fadbbbe7de4abe27665899a1b0a037461d935bf185c7c8446e1b4dd11159dd0d1118078e2594084d792d500d684512ab9963aeec7c8cc493943311388e1a2592d4b607ae9147b12b6d43ce073f058bbdd9492285eeca1227b711c406d9b6e65c26cf7e96bc541e00f14a6aedfc8021bee7955ed85af2c219206e56a8a3de231eb3c3bc39b62bfa9b6500be959a0bb2373148628ae85092aa9d44d186181660975245d5655f562a4a754167d2ac7708c454929244ba305863e06d171f0fd811d0d4b94f93b700a54da4dc76ef5c4f5655538a4a48d482f7dbf3b82e168d3c1144d0d7e3c5f1f3cd18cf18a3fb3a75a83a728a96160acd1fea8f54dfe93787ee63066a772537ad5f2361d02a7c92f4b4c81e95c2b480068a621462a0470a2daa2a9ebb8e5dcd5d773d066452e73437c41c7db2143d4813411b92ded004094332a5f8095b8b656c1f2f27fd24564d1bd0182dcc6fd718bd505ed2e3ef066091e387bfc385a022e47c413a58f4f2eca9ff04cbf8fbc91d2caf2699d308e122ed19b8f592203ba84c156add1959e66bda0cee335199f1b8af497804689fede64a37226814f3bc92f595372d740f21832eca835717bc132ff0613a0ba98c31f8fbf5368f8102a4542488ca036d54340b8442e7e1246574713e16997bdbe71aacf5cf5c6b83c2d785a799d79067c9ba110f31ae48a584732e75552a89f1885720972795c922d7148c92723aa5fff1de4daacdfe216f00fcd91fb5c1eba00ed2ea197f2ab3a144adc68dc69dcc16244812cc45eb8fac0af219edf1ae2c89d4096ba989a32f928be6a48ae537a45c98744e9c409d3d65c21827be925f3093b8ee896e54caf3e8b44d22d6e4b6b66b84a0a798d8001b1ab40a68ea29ea5d8829064bc9b7111dd287215d257a2953eae071273598b21ba47e9dc76ddfaa9dee52e700906ce0a43aff2b3969dab7bcd26fdff27108106b8a99e286a41c4c48f27be8d7698af052d5ad78684df15284759788b219badccbed5a5d96173ea8395a16f7122ea2f5ab9e5e1ba06cda7c9a397181255f2d01a5cd0eaa271851371c61ede2d072a783f31e0be4ca58bfca6bf1c334cf295b7c275c679245e5f552a8bd1e01b75e7aa1b77102b7fc7f6c5a9d618f6b21406ed2b4fee9182fbe69ba56fb2cb285231116c27372fce5e706c0c7d0840e7f14e3fb2dc5a995b4c374748b8445cffc3d004708b58bfac686e2f3305b104be33d37725fb69c3454ac38f91956b38fce52c277bca9788267df28304faf6f5d3d0fe534c43110cf349e410d0723eee9b459da90bc7730e409e79c07a7c2459f03d0a99aac141218e989c7ac9aacd9d070d5f9c7d4f02bbbc603e557a43de46792d76d56e94e9fcaa517738a258d57ba75cbd1b06fec2802aaab821bc2924081d11f1dd547458f16cbeae5dfe43a2757cc5c819515988aa0a0bd4f7fab2c8270109bf5fe9bb0323ad52b92ca74f822bb30c45feafe2a00bcb6cdaff9c0fcf12a85f9465cc61ce574f61319e835847c3c60f19dd95677d66fc0c996fa221fb53ec2b6d25abc47e7a0713b1190b15028a5a6a6a9ad1e04da352727fe1a737d63937ac93c21b608b164197c48cd943e2dfa646268eb14a46463c21b4a050f3e9fc65b133d5224c79b9270598e55b924b8db07c6b214c74f18b5591ad6e569a0973d85f5f617f67f9058a39c46cd9a60b0ce0d579b9c82606134eece3f7d181e4c816849d614e289fb93a6efee42e0ce43303049e98b297070fcf01f41c77405fe7fef0d7eed54ed89f0708a552009147a41123effc2104670c87fa6a1a1b1541919c9d46ded1faf7a1144bd0a987226145ada9a8c48d349289a88c67d17400b80d4d5eaa12bd8588796d4f576e853d7f3045928eff1fa243886e0d18fb322a606a19b8df242a76422fe871200b35b0f0186b0693ac578c72bb1f930067d817585f7cf0123d1098597201b1d7aa6d7927e1af2f56bf492b9c0ade386d6e62f24aa4f3bd3351ce9febd93222bd5a1003cf024ea6d2900c596c48179761956253e3338f0ebc2e0da71e5cd79ce8e6269af6f947b853dfecd817957df858f7628abac930c44cafa531f95b5e127c758d4ccad1ad32ac093bd5a0b6372ce203df2502c803f167eadbc393fa49a322d49ea63efb3d9c99e3a6585d292d70d91fde24fb47d11bbd8acd6225e5a5247523b4d8b2489efc29c42de4a6a41142a15afd5578ea73248f175967314ceb2fc50a3a598c5f59fa69a1017005b32425610387b9359c52376fe36368a3a0470c5b073ed49fdd2fe1d2308da3205c2bbd792acdfde801221a667d575aa0200dc8cfb7b75a330b5bc2eec21fb0a414dedca163ba2c9bc041439513110782db7c0fd6e0c6bac600b40d8ac8b93c06d7d5db825f7c1b57ab2dabcc7e647ac3735bc8a06cba64de3d9df9a98e0e5b5a70df477e902dfcc43ea5db7a7f3077ee693d3275323b556a510f6742fde9fb78257d02b2dd6977393092d117de45b58ec7bbc0123d961ab2c3347f22b46fdd5ee99bf711797e982a175a9cfe194b9f6dd752f1dda2c5d921dc1d4ad585b0d38564d2891c56b59990c8dd3c6d77ecbd9dd1131026df57d1887bff01bd31ae5066f04eef3c3c5a8a417b5031e94effea0f0cbbc98761a4df5d46b0423390e7da753baaa126762c80663c6a76c0a42b755434a7fc56f04", 0xff0}], 0x1}}], 0x1, 0x800) r3 = syz_open_dev$loop(&(0x7f0000000440), 0xf, 0x183043) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r3, 0x4c0a, &(0x7f00000005c0)={r4, 0x800, {0x2a00, 0x80010000, 0x0, 0x5, 0x0, 0x0, 0x0, 0x4, 0x1d, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd6447a4b4e00d9683dda1af1ea09d0200fb0a010000000000f5ffff0200", "2809e8dbe10859892d0000b420a9c81f40f05f819e0117020000f20020000000e903001000", "90be8b1c5512406c7f00", [0x4, 0x5]}}) read$FUSE(0xffffffffffffffff, &(0x7f0000002a40)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) fchownat(r4, &(0x7f0000000000)='./file0\x00', 0x0, r5, 0x800) r6 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r4, 0x84, 0x70, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e24, @multicast1}}, [0xffff, 0x4, 0x10000, 0x2, 0x3c1, 0xff, 0x4, 0x4, 0x800, 0xd2f, 0xee, 0x0, 0x4, 0x2, 0x2]}, &(0x7f0000000040)=0x100) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r6, 0x84, 0xa, &(0x7f0000000080)={0x4, 0x4, 0x4, 0x8, 0x7fff, 0x3, 0x394, 0x8001, r7}, 0x20) 344.27829ms ago: executing program 3 (id=1231): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000280)={@mcast1, 0x800, 0x0, 0x103, 0x1}, 0x20) socket$l2tp(0x2, 0x2, 0x73) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, 0x0, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000001240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="10797fcd6cd957d2b903c6bf46b4abf3", 0x10) r2 = accept4$alg(r1, 0x0, 0x0, 0x800) sendmmsg(r2, &(0x7f00000003c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x20004010) io_setup(0xff, &(0x7f0000000380)=0x0) io_submit(r3, 0x27f, &(0x7f0000001440)=[&(0x7f0000000200)={0x1000000, 0x0, 0x700000000000000, 0x0, 0x0, r2, &(0x7f0000000340), 0x41}]) r4 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) write$UHID_CREATE2(r4, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000540)=@newlink={0x30, 0x10, 0x437, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4048b}, [@IFLA_LINKINFO={0x10, 0x12, 0x0, 0x1, @vti={{0x8}, {0x4}}}]}, 0x30}}, 0x0) syz_usb_connect$cdc_ecm(0x5, 0x4d, &(0x7f00000011c0)=ANY=[@ANYBLOB="12010000020000402505a1a44000000001010902"], 0x0) r5 = syz_open_dev$hidraw(&(0x7f0000000000), 0x0, 0x81) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000002340), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f00000022c0)={{'fd', 0x3d, r6}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) read$FUSE(r6, &(0x7f0000000100)={0x2020}, 0x2020) syz_usb_connect$cdc_ncm(0x2, 0x75, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000020000082505a1a4400001020301090263000201000000090480000102090000052406000105240000000d240f0100000000000000000006341a000001072414"], 0x0) r7 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/hibernate_compression_threads', 0x60a02, 0x0) sendfile(r7, r7, 0x0, 0x3) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) syz_usb_connect$hid(0x4, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0xeef, 0x72aa, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x77, 0x20, 0x8, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x3, 0x1, 0x1, 0x47, {0x9, 0x21, 0x8, 0x6, 0x1, {0x22, 0xc90}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x9, 0x1, 0x27}}}}}]}}]}}, &(0x7f00000004c0)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x200, 0x3, 0x7f, 0x6, 0x10, 0x2}, 0x2e, &(0x7f00000000c0)={0x5, 0xf, 0x2e, 0x3, [@wireless={0xb, 0x10, 0x1, 0x4, 0x29, 0x3, 0x18, 0x5, 0x81}, @ss_container_id={0x14, 0x10, 0x4, 0x3, "d7e4e2384ef1bbf3130519ff1af67c87"}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0x81, 0x9, 0xcc60}]}, 0x8, [{0x4, &(0x7f0000000100)=@lang_id={0x4, 0x3, 0x2409}}, {0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0x80c}}, {0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x40f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x413}}, {0xc8, &(0x7f0000000580)=@string={0xc8, 0x3, "31216fefec4c8b35245cc1e3aacee3e5224f0554d1c7ed65a8059628b6ac91cdad0a4ad5a4e68454dd6ea7a040c1464b3990d8183aeda43c093df9d930854e76eb4920f8e6a0df639977d2852b2f07c1e5e8bb680415421863115e7cce7b13e09f5c278185a8494a04a24af1f009e8fb0e01d5d151de5c168366b7bf2dd33cc33d96772abf0b59b344358b5c8aad23b4c80357b614a393eaacf0a48d615db2e3c6e01b9e021dacd42a245f07a21af8ce066640efd453934445cd33fec9a878739803fa3ab7ce"}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x180a}}, {0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x404}}, {0x6c, &(0x7f0000000380)=@string={0x6c, 0x3, "e2199e5e66e125eec421a47ae5e5e0bac772f959f01a852e85a4ba1a601e131b4e2a81a548215a3ea35bdcc24ec4ee639253d1f3229fb6fd96573f45de9bb19b39841bcf4b1d3e64b1e5049cdadc035a05a8647e705d4454d28789cf652e0fc86a9280fad1505bc1cfd2"}}]}) ioctl$HIDIOCSFEATURE(r5, 0xc0404806, 0x0) 101.292611ms ago: executing program 0 (id=1232): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB, @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x503, 0x70bd2d, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bond={{0x9}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0xc0b0) 0s ago: executing program 1 (id=1233): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000000000404c05f20dafd60000000109022400010000000009040000010300010009210101000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x8040, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000001040)={0x0, 0xfffffffe, 0x8, 0x0, 0x8f, "ff00f7000000000000000020af88008300"}) r2 = syz_open_pts(r1, 0x141601) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000200)={0x9, 0x9, 0x2, 0x4, 0xb, "1b50a2bd9b76a88d622908bda7135000472720"}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, &(0x7f0000000300)={0x20, 0x1, 0x8, {0x8, 0xe, "30a561c11077"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) kernel console output (not intermixed with test programs): 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 250.444087][ T8425] RSP: 002b:00007f8404291b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 250.444107][ T8425] RAX: ffffffffffffffda RBX: 00007f84042926c0 RCX: 00007f840335cfce [ 250.444120][ T8425] RDX: 0000000000000081 RSI: 00007f8404291c00 RDI: ffffffffffffff9c [ 250.444132][ T8425] RBP: 00007f8404291c00 R08: 0000000000000000 R09: 0000000000000000 [ 250.444143][ T8425] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 250.444154][ T8425] R13: 00007f8403616128 R14: 00007f8403616090 R15: 00007f840373fa48 [ 250.444182][ T8425] [ 250.722237][ T5888] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 250.785955][ T8427] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 250.822382][ T8427] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 250.875418][ T5888] usb 5-1: Using ep0 maxpacket: 32 [ 250.882099][ T5888] usb 5-1: unable to get BOS descriptor or descriptor too short [ 250.892155][ T5888] usb 5-1: config 16 has an invalid interface number: 119 but max is 0 [ 250.916339][ T5888] usb 5-1: config 16 has no interface number 0 [ 250.930078][ T5888] usb 5-1: config 16 interface 119 has no altsetting 0 [ 250.966965][ T5888] usb 5-1: New USB device found, idVendor=12d1, idProduct=1c23, bcdDevice=2b.c7 [ 250.988801][ T5888] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 251.010044][ T5888] usb 5-1: Product: syz [ 251.014216][ T5888] usb 5-1: Manufacturer: syz [ 251.029303][ T5888] usb 5-1: SerialNumber: syz [ 251.070074][ T8427] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 251.080369][ T8427] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 251.254218][ T5888] usb 5-1: bad CDC descriptors [ 251.286989][ T5888] option 5-1:16.119: GSM modem (1-port) converter detected [ 251.307042][ T5888] usb 5-1: USB disconnect, device number 43 [ 251.320500][ T5888] option 5-1:16.119: device disconnected [ 251.485129][ T8429] netlink: 348 bytes leftover after parsing attributes in process `syz.1.700'. [ 251.656265][ T9] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 251.668632][ T8440] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.704'. [ 251.814644][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 251.828797][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 251.838470][ T9] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 251.850983][ T9] usb 4-1: New USB device found, idVendor=0e41, idProduct=4248, bcdDevice= 0.40 [ 251.863172][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 251.871555][ T9] usb 4-1: Product: syz [ 251.876080][ T9] usb 4-1: Manufacturer: syz [ 251.880765][ T9] usb 4-1: SerialNumber: syz [ 251.916494][ T5888] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 252.038735][ T8442] netlink: 348 bytes leftover after parsing attributes in process `syz.4.705'. [ 252.076545][ T5888] usb 2-1: Using ep0 maxpacket: 8 [ 252.084210][ T5888] usb 2-1: config 0 has an invalid interface number: 128 but max is 0 [ 252.096200][ T5888] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 252.097417][ T8435] x_tables: duplicate underflow at hook 3 [ 252.119889][ T5888] usb 2-1: config 0 has no interface number 0 [ 252.131386][ T5888] usb 2-1: config 0 interface 128 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 252.143986][ T9] usb 4-1: 1:1 : format type 0 is detected, processed as PCM [ 252.150226][ T5888] usb 2-1: New USB device found, idVendor=0af0, idProduct=6751, bcdDevice=75.8b [ 252.162510][ T9] usb 4-1: 1:1 : unsupported sample bitwidth 1 in 165 bytes [ 252.163639][ T5888] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 252.175777][ T9] usb 4-1: unit 8 not found! [ 252.198467][ T5888] usb 2-1: config 0 descriptor?? [ 252.282120][ T9] usb 4-1: USB disconnect, device number 39 [ 252.310496][ T5833] udevd[5833]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 252.421021][ T5888] usb 2-1: USB disconnect, device number 36 [ 252.655382][ T8454] fuse: Unknown parameter 'rootcontext' [ 253.369512][ T5943] usb 4-1: new full-speed USB device number 40 using dummy_hcd [ 253.730659][ T5943] usb 4-1: not running at top speed; connect to a high speed hub [ 253.747915][ T5943] usb 4-1: config 1 interface 0 altsetting 4 endpoint 0x81 has invalid maxpacket 55887, setting to 64 [ 253.852775][ T5943] usb 4-1: config 1 interface 0 has no altsetting 0 [ 253.873385][ T5943] usb 4-1: New USB device found, idVendor=05ac, idProduct=0230, bcdDevice= 0.40 [ 253.890508][ T5943] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 253.902895][ T5943] usb 4-1: Product: syz [ 253.910987][ T5943] usb 4-1: Manufacturer: syz [ 253.918801][ T5943] usb 4-1: SerialNumber: syz [ 253.961480][ T8458] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 254.266390][ T5943] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/input/input27 [ 254.286864][ T5943] usb 4-1: USB disconnect, device number 40 [ 254.293252][ T5181] bcm5974 4-1:1.0: could not read from device [ 254.395865][ T5811] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 254.555110][ T5811] usb 5-1: Using ep0 maxpacket: 32 [ 254.571990][ T5811] usb 5-1: config 0 has an invalid interface number: 170 but max is 1 [ 254.581750][ T5811] usb 5-1: config 0 has an invalid interface number: 242 but max is 1 [ 254.605324][ T5811] usb 5-1: config 0 has no interface number 0 [ 254.627513][ T5811] usb 5-1: config 0 has no interface number 1 [ 254.653961][ T5811] usb 5-1: config 0 interface 170 has no altsetting 0 [ 254.674164][ T5811] usb 5-1: config 0 interface 242 has no altsetting 0 [ 254.703496][ T5811] usb 5-1: New USB device found, idVendor=0bfd, idProduct=0114, bcdDevice=51.d5 [ 254.713883][ T5811] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 254.743239][ T5811] usb 5-1: Product: syz [ 254.758473][ T5811] usb 5-1: Manufacturer: syz [ 254.781571][ T5811] usb 5-1: SerialNumber: syz [ 254.801000][ T5811] usb 5-1: config 0 descriptor?? [ 254.904363][ T8481] program syz.3.718 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 255.059994][ T5811] kvaser_usb 5-1:0.170: error -ENODEV: Cannot get usb endpoint(s) [ 255.079450][ T5811] kvaser_usb 5-1:0.242: error -ENODEV: Cannot get usb endpoint(s) [ 255.119910][ T5811] usb 5-1: USB disconnect, device number 44 [ 255.139681][ T8477] netlink: 348 bytes leftover after parsing attributes in process `syz.0.716'. [ 255.357023][ T8497] netlink: 8 bytes leftover after parsing attributes in process `syz.2.721'. [ 255.367510][ T8497] netlink: 8 bytes leftover after parsing attributes in process `syz.2.721'. [ 255.517353][ T8497] netlink: 'syz.2.721': attribute type 4 has an invalid length. [ 255.686007][ T5943] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 255.941825][ T5811] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 255.987354][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.987907][ T5943] usb 4-1: Using ep0 maxpacket: 32 [ 255.993787][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.017738][ T5943] usb 4-1: unable to get BOS descriptor or descriptor too short [ 256.054703][ T5943] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 256.083760][ T5943] usb 4-1: config 0 has no interfaces? [ 256.105895][ T5811] usb 2-1: Using ep0 maxpacket: 8 [ 256.120096][ T5943] usb 4-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 256.128422][ T5811] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 256.152902][ T5811] usb 2-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 256.274570][ T5943] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 256.290441][ T5943] usb 4-1: Product: syz [ 256.298191][ T5811] usb 2-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 256.332022][ T5943] usb 4-1: Manufacturer: syz [ 256.336409][ T5811] usb 2-1: Product: syz [ 256.345497][ T5811] usb 2-1: Manufacturer: syz [ 256.370413][ T5811] usb 2-1: SerialNumber: syz [ 256.383686][ T5943] usb 4-1: SerialNumber: syz [ 256.421220][ T5943] usb 4-1: config 0 descriptor?? [ 256.633112][ T5811] usb 2-1: Handspring Visor / Palm OS: No valid connect info available [ 256.655414][ T5811] usb 2-1: Handspring Visor / Palm OS: port 0, is for HotSync use [ 256.683268][ T5811] usb 2-1: Handspring Visor / Palm OS: port 211, is for unknown use [ 256.760165][ T8516] netlink: 'syz.2.730': attribute type 13 has an invalid length. [ 256.769063][ T5811] usb 2-1: Handspring Visor / Palm OS: Number of ports: 2 [ 256.805908][ T5943] usb 5-1: new full-speed USB device number 45 using dummy_hcd [ 256.897001][ T8495] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 256.909851][ T5811] usb 2-1: palm_os_3_probe - error -71 getting bytes available request [ 256.930578][ T8495] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 256.974046][ T5811] visor 2-1:1.0: Handspring Visor / Palm OS converter detected [ 257.006790][ T5811] usb 2-1: Handspring Visor / Palm OS converter now attached to ttyUSB0 [ 257.008611][ T5943] usb 5-1: not running at top speed; connect to a high speed hub [ 257.050868][ T5943] usb 5-1: config 1 interface 0 altsetting 4 endpoint 0x81 has invalid maxpacket 55887, setting to 64 [ 257.062930][ T5943] usb 5-1: config 1 interface 0 has no altsetting 0 [ 257.080012][ T5811] usb 2-1: Handspring Visor / Palm OS converter now attached to ttyUSB1 [ 257.082821][ T5943] usb 5-1: New USB device found, idVendor=05ac, idProduct=0230, bcdDevice= 0.40 [ 257.100620][ T5943] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 257.121424][ T5943] usb 5-1: Product: syz [ 257.126050][ T5943] usb 5-1: Manufacturer: syz [ 257.203771][ T5943] usb 5-1: SerialNumber: syz [ 257.203832][ T5811] usb 2-1: USB disconnect, device number 37 [ 257.232234][ T8511] raw-gadget.4 gadget.4: fail, usb_ep_enable returned -22 [ 257.288158][ T5811] visor ttyUSB0: Handspring Visor / Palm OS converter now disconnected from ttyUSB0 [ 257.337917][ T5811] visor ttyUSB1: Handspring Visor / Palm OS converter now disconnected from ttyUSB1 [ 257.362276][ T5811] visor 2-1:1.0: device disconnected [ 257.462280][ T5943] input: bcm5974 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/input/input28 [ 257.494378][ T5181] bcm5974 5-1:1.0: could not read from device [ 257.501282][ T5943] usb 5-1: USB disconnect, device number 45 [ 257.670508][ T5181] bcm5974 5-1:1.0: could not read from device [ 257.850356][ T6031] bcm5974 5-1:1.0: could not read from device [ 257.880194][ T5181] bcm5974 5-1:1.0: could not read from device [ 258.035536][ T8536] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 258.059530][ T8536] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 258.081834][ T8537] tap0: tun_chr_ioctl cmd 1074025680 [ 258.159049][ T8539] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 258.169557][ T8539] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 258.304044][ T5896] usb 4-1: USB disconnect, device number 41 [ 258.326457][ T5811] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 258.559203][ T5811] usb 2-1: Using ep0 maxpacket: 32 [ 258.568007][ T5811] usb 2-1: unable to get BOS descriptor or descriptor too short [ 258.577728][ T5811] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 232, changing to 7 [ 258.591989][ T5811] usb 2-1: New USB device found, idVendor=041e, idProduct=323b, bcdDevice= 0.40 [ 258.608182][ T5811] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 258.618646][ T5811] usb 2-1: Product: syz [ 258.631937][ T5811] usb 2-1: Manufacturer: 潜㴆㞥㰞습ｦ叏琍憴쑂䴚㖛㹽섅냺໲嶕틏炒亐忯໦Ⴕ겥Ց헽䝣⻦䷣讌藜˱溸賃ヮ⨻麓귊㥄燫䯤뼹᪶䬜㠴獣靈⇑잮岊ᛝ劦䕯䛱탊線獌չ༲㤕௛䏳炼簊姙⛶㌅곘湑̄鯉鿏钅ᄽብம＜㲍兩ቈ쌚蘿죏轅뺞줔ῠꭶ䀮Ế兤䄖귲圤⦲껏锄쪬쏽ㅩ걁姜Ⲭቒ [ 258.672559][ T5811] usb 2-1: SerialNumber: syz [ 258.980136][ T8558] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 258.991327][ T8558] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 259.043699][ T8547] netlink: 68 bytes leftover after parsing attributes in process `syz.3.739'. [ 259.120507][ T8547] tipc: Failed to remove unknown binding: 66,1,1/0:3947665770/3947665772 [ 259.254328][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 261.251468][ T5811] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 261.373309][ T5811] usb 2-1: USB disconnect, device number 38 [ 261.454769][ T9] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 261.666811][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 261.681242][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 261.698405][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 261.710127][ T9] usb 4-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 261.825964][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 261.866693][ T9] usb 4-1: config 0 descriptor?? [ 262.312786][ T9] ft260 0003:0403:6030.0019: unknown main item tag 0x0 [ 262.325249][ T9] ft260 0003:0403:6030.0019: unknown main item tag 0x0 [ 262.509752][ T9] ft260 0003:0403:6030.0019: chip code: 0000 0000 [ 262.707255][ T30] kauditd_printk_skb: 4 callbacks suppressed [ 262.707272][ T30] audit: type=1326 audit(1774321698.833:224): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8586 comm="syz.4.750" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a0c99c799 code=0x7ffc0000 [ 262.710331][ T9] ft260 0003:0403:6030.0019: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.3-1/input0 [ 262.759406][ T30] audit: type=1326 audit(1774321698.833:225): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8586 comm="syz.4.750" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a0c99c799 code=0x7ffc0000 [ 262.823897][ T30] audit: type=1326 audit(1774321698.913:226): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8586 comm="syz.4.750" exe="/root/syz-executor" sig=0 arch=c000003e syscall=186 compat=0 ip=0x7f7a0c99c799 code=0x7ffc0000 [ 262.910805][ T9] ft260 0003:0403:6030.0019: failed to retrieve status: -32, no wakeup [ 262.936939][ T30] audit: type=1326 audit(1774321698.913:227): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8586 comm="syz.4.750" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a0c99c799 code=0x7ffc0000 [ 262.989604][ T30] audit: type=1326 audit(1774321698.913:228): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8586 comm="syz.4.750" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a0c99c799 code=0x7ffc0000 [ 263.030393][ T30] audit: type=1326 audit(1774321698.913:229): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8586 comm="syz.4.750" exe="/root/syz-executor" sig=0 arch=c000003e syscall=288 compat=0 ip=0x7f7a0c99c799 code=0x7ffc0000 [ 263.061045][ T30] audit: type=1326 audit(1774321698.913:230): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8586 comm="syz.4.750" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a0c99c799 code=0x7ffc0000 [ 263.086592][ T30] audit: type=1326 audit(1774321698.913:231): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8586 comm="syz.4.750" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a0c99c799 code=0x7ffc0000 [ 263.113601][ T30] audit: type=1326 audit(1774321698.923:232): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8586 comm="syz.4.750" exe="/root/syz-executor" sig=0 arch=c000003e syscall=228 compat=0 ip=0x7f7a0c99c799 code=0x7ffc0000 [ 263.138371][ T5894] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 263.145874][ T8574] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 263.155646][ T8574] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 263.158835][ T30] audit: type=1326 audit(1774321698.923:233): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8586 comm="syz.4.750" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a0c99c799 code=0x7ffc0000 [ 263.166534][ T9] usb 4-1: USB disconnect, device number 42 [ 263.308118][ T5894] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 263.324433][ T5943] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 263.333050][ T5894] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 263.345516][ T5894] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 263.356587][ T5894] usb 5-1: Product: syz [ 263.360815][ T5894] usb 5-1: Manufacturer: syz [ 263.368041][ T5894] usb 5-1: SerialNumber: syz [ 263.490368][ T5943] usb 2-1: Using ep0 maxpacket: 32 [ 263.510118][ T5943] usb 2-1: config 0 has an invalid interface number: 170 but max is 1 [ 263.546563][ T5943] usb 2-1: config 0 has an invalid interface number: 242 but max is 1 [ 263.562644][ T5943] usb 2-1: config 0 has no interface number 0 [ 263.574068][ T5943] usb 2-1: config 0 has no interface number 1 [ 263.589567][ T5943] usb 2-1: config 0 interface 170 has no altsetting 0 [ 263.610353][ T5943] usb 2-1: config 0 interface 242 has no altsetting 0 [ 263.633290][ T5943] usb 2-1: New USB device found, idVendor=0bfd, idProduct=0114, bcdDevice=51.d5 [ 263.654336][ T5943] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 263.662430][ T5943] usb 2-1: Product: syz [ 263.671294][ T5943] usb 2-1: Manufacturer: syz [ 263.681402][ T5943] usb 2-1: SerialNumber: syz [ 263.699541][ T5943] usb 2-1: config 0 descriptor?? [ 263.853756][ T8587] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 263.867323][ T8587] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 263.937111][ T5943] kvaser_usb 2-1:0.170: error -ENODEV: Cannot get usb endpoint(s) [ 263.998892][ T5943] kvaser_usb 2-1:0.242: error -ENODEV: Cannot get usb endpoint(s) [ 264.050762][ T5943] usb 2-1: USB disconnect, device number 39 [ 264.168660][ T5894] cdc_ncm 5-1:1.0: failed GET_NTB_PARAMETERS [ 264.183915][ T5894] cdc_ncm 5-1:1.0: bind() failure [ 264.210706][ T5894] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 264.226968][ T5894] cdc_ncm 5-1:1.1: bind() failure [ 264.242121][ T5894] usb 5-1: USB disconnect, device number 46 [ 264.679015][ T8610] netdevsim netdevsim2: Direct firmware load for / [ 264.679015][ T8610] failed with error -2 [ 264.692319][ T8610] netdevsim netdevsim2: Falling back to sysfs fallback for: / [ 264.692319][ T8610] [ 264.974036][ T8613] netlink: 8 bytes leftover after parsing attributes in process `syz.1.757'. [ 265.151617][ T8612] netlink: 20 bytes leftover after parsing attributes in process `syz.1.757'. [ 265.259342][ T9] usb 5-1: new full-speed USB device number 47 using dummy_hcd [ 265.467185][ T9] usb 5-1: config 150 has an invalid interface number: 204 but max is 2 [ 265.495435][ T9] usb 5-1: config 150 has an invalid descriptor of length 0, skipping remainder of the config [ 265.538156][ T9] usb 5-1: config 150 has 1 interface, different from the descriptor's value: 3 [ 265.579256][ T9] usb 5-1: config 150 has no interface number 0 [ 265.596490][ T9] usb 5-1: config 150 interface 204 has no altsetting 0 [ 265.638072][ T9] usb 5-1: New USB device found, idVendor=04e2, idProduct=1424, bcdDevice=c7.eb [ 265.680524][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 265.704842][ T9] usb 5-1: Product: syz [ 265.710881][ T9] usb 5-1: Manufacturer: syz [ 265.725455][ T9] usb 5-1: SerialNumber: syz [ 266.010132][ T8616] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 266.047534][ T8616] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 266.187072][ T9] usb 5-1: USB disconnect, device number 47 [ 266.614416][ T9] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 266.724424][ T5936] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 266.824443][ T9] usb 5-1: Using ep0 maxpacket: 8 [ 266.832120][ T9] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 266.841463][ T9] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 266.868633][ T9] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 266.884437][ T5936] usb 4-1: Using ep0 maxpacket: 32 [ 266.901202][ T5936] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 266.944231][ T5936] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 266.965600][ T9] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 267.036559][ T5937] usb 2-1: new full-speed USB device number 40 using dummy_hcd [ 267.044238][ T5936] usb 4-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 267.082356][ T9] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 267.099342][ T5936] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 267.116963][ T9] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 267.128703][ T5936] usb 4-1: config 0 descriptor?? [ 267.134267][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 267.553022][ T5936] ft260 0003:0403:6030.001A: unknown main item tag 0x0 [ 267.560930][ T5936] ft260 0003:0403:6030.001A: unknown main item tag 0x0 [ 267.759196][ T5936] ft260 0003:0403:6030.001A: chip code: 0000 0000 [ 267.959165][ T5936] ft260 0003:0403:6030.001A: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.3-1/input0 [ 268.080810][ T980] usb 5-1: USB disconnect, device number 48 [ 268.159679][ T5936] ft260 0003:0403:6030.001A: failed to retrieve status: -32, no wakeup [ 268.382697][ T8635] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 268.402307][ T8635] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 268.547900][ T5811] usb 4-1: USB disconnect, device number 43 [ 269.474426][ T5936] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 269.635238][ T5936] usb 4-1: Using ep0 maxpacket: 16 [ 269.645727][ T5936] usb 4-1: too many endpoints for config 1 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 269.666187][ T8667] IPVS: sync thread started: state = MASTER, mcast_ifn = sit0, syncid = 4, id = 0 [ 269.670510][ T5936] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 269.779246][ T5936] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 59391, setting to 1024 [ 269.971595][ T8671] netdevsim netdevsim1: Direct firmware load for / [ 269.971595][ T8671] failed with error -2 [ 269.982416][ T5936] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 254 [ 269.983594][ T5936] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 269.983621][ T5936] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 269.983642][ T5936] usb 4-1: SerialNumber: syz [ 270.036427][ T8664] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 270.123482][ T8671] netdevsim netdevsim1: Falling back to sysfs fallback for: / [ 270.123482][ T8671] [ 270.319516][ T5936] usb 4-1: USB disconnect, device number 44 [ 271.296403][ T5894] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 271.495946][ T5894] usb 4-1: Using ep0 maxpacket: 32 [ 271.519643][ T5894] usb 4-1: config index 0 descriptor too short (expected 3659, got 75) [ 271.558573][ T5894] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 271.578509][ T5894] usb 4-1: New USB device found, idVendor=08ca, idProduct=2060, bcdDevice=c6.58 [ 271.589945][ T5894] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 271.600070][ T5894] usb 4-1: Product: syz [ 271.606877][ T5894] usb 4-1: Manufacturer: syz [ 271.616421][ T5894] usb 4-1: SerialNumber: syz [ 271.659988][ T8692] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 271.686843][ T5894] usb 4-1: config 0 descriptor?? [ 271.708014][ T5894] gspca_main: sunplus-2.14.0 probing 08ca:2060 [ 271.719572][ T8692] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 272.315442][ T5896] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 272.466344][ T5896] usb 2-1: Using ep0 maxpacket: 32 [ 272.551332][ T5896] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 272.588504][ T5896] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 272.792684][ T5896] usb 2-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 272.859452][ T5896] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 273.070938][ T5896] usb 2-1: config 0 descriptor?? [ 273.541335][ T5896] ft260 0003:0403:6030.001B: unknown main item tag 0x0 [ 273.549383][ T5896] ft260 0003:0403:6030.001B: unknown main item tag 0x0 [ 273.558289][ T5894] gspca_sunplus: reg_w_1 err -110 [ 273.563402][ T5894] sunplus 4-1:0.0: probe with driver sunplus failed with error -110 [ 273.713442][ T5896] ft260 0003:0403:6030.001B: chip code: 0000 0000 [ 273.914027][ T5896] ft260 0003:0403:6030.001B: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.1-1/input0 [ 273.952467][ T5888] usb 4-1: USB disconnect, device number 45 [ 274.117290][ T5896] ft260 0003:0403:6030.001B: failed to retrieve status: -32, no wakeup [ 274.211563][ T8722] FAULT_INJECTION: forcing a failure. [ 274.211563][ T8722] name failslab, interval 1, probability 0, space 0, times 0 [ 274.234525][ T8722] CPU: 0 UID: 0 PID: 8722 Comm: syz.3.787 Not tainted syzkaller #0 PREEMPT(full) [ 274.234549][ T8722] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 274.234560][ T8722] Call Trace: [ 274.234568][ T8722] [ 274.234576][ T8722] dump_stack_lvl+0xe8/0x150 [ 274.234606][ T8722] should_fail_ex+0x412/0x560 [ 274.234638][ T8722] should_failslab+0xa8/0x100 [ 274.234663][ T8722] __kmalloc_noprof+0xe8/0x760 [ 274.234684][ T8722] ? kernfs_fop_write_iter+0x158/0x540 [ 274.234711][ T8722] kernfs_fop_write_iter+0x158/0x540 [ 274.234746][ T8722] vfs_write+0x61d/0xb90 [ 274.234774][ T8722] ? __pfx_vfs_write+0x10/0x10 [ 274.234803][ T8722] ? __fget_files+0x2a/0x420 [ 274.234838][ T8722] ksys_write+0x150/0x270 [ 274.234860][ T8722] ? __pfx_ksys_write+0x10/0x10 [ 274.234892][ T8722] do_syscall_64+0x14d/0xf80 [ 274.234912][ T8722] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 274.234930][ T8722] ? clear_bhb_loop+0x40/0x90 [ 274.234953][ T8722] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 274.234971][ T8722] RIP: 0033:0x7f0670f9c799 [ 274.234987][ T8722] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 274.235002][ T8722] RSP: 002b:00007f0671dba028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 274.235022][ T8722] RAX: ffffffffffffffda RBX: 00007f0671216180 RCX: 00007f0670f9c799 [ 274.235035][ T8722] RDX: 0000000000000012 RSI: 0000200000000180 RDI: 0000000000000007 [ 274.235047][ T8722] RBP: 00007f0671dba090 R08: 0000000000000000 R09: 0000000000000000 [ 274.235058][ T8722] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 274.235069][ T8722] R13: 00007f0671216218 R14: 00007f0671216180 R15: 00007f067133fa48 [ 274.235099][ T8722] [ 274.606509][ T8698] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 274.628737][ T8698] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 275.504888][ T5936] usb 2-1: USB disconnect, device number 41 [ 275.506982][ T8740] netlink: 28 bytes leftover after parsing attributes in process `syz.3.792'. [ 275.876663][ T5888] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 276.026790][ T5888] usb 5-1: device descriptor read/64, error -71 [ 276.297207][ T5888] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 276.436406][ T5888] usb 5-1: device descriptor read/64, error -71 [ 276.537230][ T980] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 276.547024][ T5888] usb usb5-port1: attempt power cycle [ 276.998393][ T980] usb 4-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 277.008012][ T980] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 277.020862][ T980] usb 4-1: Product: syz [ 277.034326][ T980] usb 4-1: Manufacturer: syz [ 277.049270][ T980] usb 4-1: SerialNumber: syz [ 277.134018][ T980] usb 4-1: config 0 descriptor?? [ 277.254231][ T5888] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 277.277237][ T5888] usb 5-1: device descriptor read/8, error -71 [ 277.326616][ T8764] FAULT_INJECTION: forcing a failure. [ 277.326616][ T8764] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 277.474454][ T8764] CPU: 0 UID: 0 PID: 8764 Comm: syz.1.799 Not tainted syzkaller #0 PREEMPT(full) [ 277.474481][ T8764] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 277.474492][ T8764] Call Trace: [ 277.474500][ T8764] [ 277.474508][ T8764] dump_stack_lvl+0xe8/0x150 [ 277.474538][ T8764] should_fail_ex+0x412/0x560 [ 277.474569][ T8764] _copy_from_iter+0x1d3/0x1670 [ 277.474602][ T8764] ? sock_alloc_send_pskb+0x896/0x990 [ 277.474631][ T8764] ? __pfx__copy_from_iter+0x10/0x10 [ 277.474667][ T8764] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 277.474692][ T8764] skb_copy_datagram_from_iter+0xf5/0x710 [ 277.474720][ T8764] ? skb_put+0x11b/0x210 [ 277.474742][ T8764] tun_get_user+0xc38/0x3dd0 [ 277.474773][ T8764] ? aa_file_perm+0x192/0x15e0 [ 277.474794][ T8764] ? aa_file_perm+0x50e/0x15e0 [ 277.474810][ T8764] ? __pfx_tun_get_user+0x10/0x10 [ 277.474826][ T8764] ? aa_file_perm+0x192/0x15e0 [ 277.474848][ T8764] ? __lock_acquire+0x6b5/0x2cf0 [ 277.474880][ T8764] ? ref_tracker_alloc+0x35c/0x4c0 [ 277.474907][ T8764] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 277.474938][ T8764] ? tun_get+0x1c/0x2f0 [ 277.474961][ T8764] ? tun_get+0x1c/0x2f0 [ 277.474978][ T8764] ? tun_get+0x1c/0x2f0 [ 277.475000][ T8764] tun_chr_write_iter+0x113/0x200 [ 277.475021][ T8764] vfs_write+0x61d/0xb90 [ 277.475049][ T8764] ? __pfx_vfs_write+0x10/0x10 [ 277.475077][ T8764] ? __fget_files+0x2a/0x420 [ 277.475112][ T8764] ksys_write+0x150/0x270 [ 277.475133][ T8764] ? __pfx_ksys_write+0x10/0x10 [ 277.475163][ T8764] do_syscall_64+0x14d/0xf80 [ 277.475182][ T8764] ? trace_irq_disable+0x3b/0x150 [ 277.475207][ T8764] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 277.475226][ T8764] ? clear_bhb_loop+0x40/0x90 [ 277.475247][ T8764] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 277.475265][ T8764] RIP: 0033:0x7f071dd9c799 [ 277.475282][ T8764] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 277.475297][ T8764] RSP: 002b:00007f071eb9f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 277.475317][ T8764] RAX: ffffffffffffffda RBX: 00007f071e015fa0 RCX: 00007f071dd9c799 [ 277.475330][ T8764] RDX: 000000000000fdef RSI: 0000200000000080 RDI: 0000000000000004 [ 277.475341][ T8764] RBP: 00007f071eb9f090 R08: 0000000000000000 R09: 0000000000000000 [ 277.475352][ T8764] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 277.475363][ T8764] R13: 00007f071e016038 R14: 00007f071e015fa0 R15: 00007f071e13fa48 [ 277.475391][ T8764] [ 278.063651][ T8768] FAULT_INJECTION: forcing a failure. [ 278.063651][ T8768] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 278.078362][ T5888] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 278.084925][ T8768] CPU: 0 UID: 0 PID: 8768 Comm: syz.2.800 Not tainted syzkaller #0 PREEMPT(full) [ 278.084947][ T8768] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 278.084958][ T8768] Call Trace: [ 278.084965][ T8768] [ 278.084971][ T8768] dump_stack_lvl+0xe8/0x150 [ 278.085008][ T8768] should_fail_ex+0x412/0x560 [ 278.085037][ T8768] _copy_to_user+0x31/0xb0 [ 278.085059][ T8768] copy_siginfo_to_user+0x22/0xc0 [ 278.085082][ T8768] x64_setup_rt_frame+0x77b/0xcb0 [ 278.085121][ T8768] ? __pfx_x64_setup_rt_frame+0x10/0x10 [ 278.085150][ T8768] arch_do_signal_or_restart+0x424/0x830 [ 278.085172][ T8768] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 278.085198][ T8768] ? ksys_read+0x242/0x270 [ 278.085225][ T8768] exit_to_user_mode_loop+0x86/0x480 [ 278.085244][ T8768] ? rcu_is_watching+0x15/0xb0 [ 278.085271][ T8768] do_syscall_64+0x32d/0xf80 [ 278.085289][ T8768] ? trace_irq_disable+0x3b/0x150 [ 278.085313][ T8768] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 278.085331][ T8768] ? clear_bhb_loop+0x40/0x90 [ 278.085352][ T8768] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 278.085369][ T8768] RIP: 0033:0x7f840339c797 [ 278.085385][ T8768] Code: 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 <0f> 05 48 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 [ 278.085399][ T8768] RSP: 002b:00007f8404318028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 278.085419][ T8768] RAX: 0000000000000000 RBX: 00007f8403615fa0 RCX: 00007f840339c799 [ 278.085430][ T8768] RDX: 0000000000000008 RSI: 0000200000000000 RDI: 0000000000000004 [ 278.085441][ T8768] RBP: 00007f8404318090 R08: 0000000000000000 R09: 0000000000000000 [ 278.085452][ T8768] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 278.085461][ T8768] R13: 00007f8403616038 R14: 00007f8403615fa0 R15: 00007f840373fa48 [ 278.085488][ T8768] [ 278.317165][ T5888] usb 5-1: device descriptor read/8, error -71 [ 278.425656][ T5888] usb usb5-port1: unable to enumerate USB device [ 279.284409][ T980] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 279.484425][ T980] usb 5-1: Using ep0 maxpacket: 32 [ 279.500652][ T980] usb 5-1: config 0 has an invalid interface number: 170 but max is 1 [ 279.521640][ T980] usb 5-1: config 0 has an invalid interface number: 242 but max is 1 [ 279.574363][ T980] usb 5-1: config 0 has no interface number 0 [ 279.589271][ T980] usb 5-1: config 0 has no interface number 1 [ 279.601023][ T5937] usb 4-1: USB disconnect, device number 46 [ 279.630463][ T980] usb 5-1: config 0 interface 170 has no altsetting 0 [ 279.640549][ T980] usb 5-1: config 0 interface 242 has no altsetting 0 [ 279.656697][ T980] usb 5-1: New USB device found, idVendor=0bfd, idProduct=0114, bcdDevice=51.d5 [ 279.667231][ T980] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 279.678576][ T980] usb 5-1: Product: syz [ 279.701594][ T980] usb 5-1: Manufacturer: syz [ 279.807261][ T980] usb 5-1: SerialNumber: syz [ 279.823576][ T980] usb 5-1: config 0 descriptor?? [ 280.041411][ T980] kvaser_usb 5-1:0.170: error -ENODEV: Cannot get usb endpoint(s) [ 280.083704][ T980] kvaser_usb 5-1:0.242: error -ENODEV: Cannot get usb endpoint(s) [ 280.148333][ T980] usb 5-1: USB disconnect, device number 53 [ 280.156015][ T5937] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 280.324469][ T5937] usb 4-1: Using ep0 maxpacket: 16 [ 280.333341][ T8796] netlink: 28 bytes leftover after parsing attributes in process `syz.0.810'. [ 280.350733][ T5937] usb 4-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 280.359975][ T5937] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 280.382351][ T5937] usb 4-1: Product: syz [ 280.393675][ T5937] usb 4-1: Manufacturer: syz [ 280.404993][ T8796] bond1 (unregistering): Released all slaves [ 280.411005][ T5937] usb 4-1: SerialNumber: syz [ 280.425350][ T5937] usb 4-1: config 0 descriptor?? [ 280.666963][ T8801] batadv_slave_0: Caught tx_queue_len zero misconfig [ 280.713179][ T8806] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 280.729422][ T8806] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 280.886603][ T5937] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 280.912047][ T5937] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 280.920674][ T8809] netlink: 'syz.4.813': attribute type 4 has an invalid length. [ 280.930419][ T5937] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 280.946616][ T8809] netlink: 152 bytes leftover after parsing attributes in process `syz.4.813'. [ 280.957153][ T5937] usb 4-1: media controller created [ 280.979642][ T5937] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 281.111726][ T8809] .`: renamed from bond0 (while UP) [ 281.634689][ T5937] zl10353_read_register: readreg error (reg=127, ret==0) [ 281.641865][ T5937] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 281.840503][ T5937] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 281.893418][ T5937] usb 4-1: USB disconnect, device number 47 [ 282.297629][ T5937] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 283.534389][ T5937] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 283.659380][ T8849] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 283.676770][ T8849] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 283.704470][ T5937] usb 4-1: Using ep0 maxpacket: 16 [ 283.711668][ T5937] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 283.722177][ T5937] usb 4-1: config 0 has no interfaces? [ 283.730065][ T5937] usb 4-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 283.908656][ T5937] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 283.921245][ T5937] usb 4-1: Product: syz [ 283.928337][ T5937] usb 4-1: Manufacturer: syz [ 283.936709][ T5937] usb 4-1: SerialNumber: syz [ 283.958173][ T5937] usb 4-1: config 0 descriptor?? [ 286.117820][ T5896] usb 4-1: USB disconnect, device number 48 [ 286.563005][ T8879] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 286.587899][ T5896] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 286.597671][ T8876] netlink: 348 bytes leftover after parsing attributes in process `syz.4.833'. [ 286.678358][ T8879] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 286.758654][ T5896] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 286.778210][ T5896] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 286.928853][ T5896] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 286.939668][ T5896] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 287.094702][ T8874] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 287.113199][ T5896] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 287.206335][ T8889] netlink: 8 bytes leftover after parsing attributes in process `syz.1.836'. [ 287.244824][ T8889] netlink: 60 bytes leftover after parsing attributes in process `syz.1.836'. [ 287.318355][ T8874] netlink: 830 bytes leftover after parsing attributes in process `syz.3.832'. [ 287.429285][ T8893] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 287.469283][ T5896] usb 4-1: USB disconnect, device number 49 [ 287.610194][ T8893] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 288.160082][ T8905] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 288.200016][ T8905] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 288.267167][ T8907] FAULT_INJECTION: forcing a failure. [ 288.267167][ T8907] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 288.306450][ T8907] CPU: 0 UID: 0 PID: 8907 Comm: syz.0.843 Not tainted syzkaller #0 PREEMPT(full) [ 288.306475][ T8907] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 288.306485][ T8907] Call Trace: [ 288.306491][ T8907] [ 288.306498][ T8907] dump_stack_lvl+0xe8/0x150 [ 288.306526][ T8907] should_fail_ex+0x412/0x560 [ 288.306555][ T8907] _copy_from_user+0x2d/0xb0 [ 288.306573][ T8907] do_set_thread_area+0xad/0x6e0 [ 288.306603][ T8907] ? __pfx_do_set_thread_area+0x10/0x10 [ 288.306633][ T8907] arch_ptrace+0x26e/0x410 [ 288.306656][ T8907] __se_sys_ptrace+0x150/0x3b0 [ 288.306683][ T8907] ? __pfx___se_sys_ptrace+0x10/0x10 [ 288.306717][ T8907] do_syscall_64+0x14d/0xf80 [ 288.306737][ T8907] ? trace_irq_disable+0x3b/0x150 [ 288.306761][ T8907] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 288.306778][ T8907] ? clear_bhb_loop+0x40/0x90 [ 288.306799][ T8907] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 288.306816][ T8907] RIP: 0033:0x7f8aa099c799 [ 288.306833][ T8907] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 288.306847][ T8907] RSP: 002b:00007f8aa18fb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000065 [ 288.306866][ T8907] RAX: ffffffffffffffda RBX: 00007f8aa0c15fa0 RCX: 00007f8aa099c799 [ 288.306878][ T8907] RDX: 000000000000000c RSI: 0000000000000220 RDI: 000000000000001a [ 288.306888][ T8907] RBP: 00007f8aa18fb090 R08: 0000000000000000 R09: 0000000000000000 [ 288.306899][ T8907] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000001 [ 288.306910][ T8907] R13: 00007f8aa0c16038 R14: 00007f8aa0c15fa0 R15: 00007f8aa0d3fa48 [ 288.306937][ T8907] [ 288.921727][ T8919] netlink: 28 bytes leftover after parsing attributes in process `syz.2.847'. [ 288.963868][ T8919] bond2 (unregistering): Released all slaves [ 289.885149][ T5896] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 290.021051][ T5896] usb 2-1: device descriptor read/64, error -71 [ 290.156490][ T796] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 290.184368][ T5937] usb 5-1: new full-speed USB device number 54 using dummy_hcd [ 290.265622][ T5896] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 290.316134][ T796] usb 4-1: Using ep0 maxpacket: 32 [ 290.323281][ T796] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 290.337111][ T796] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 290.337901][ T5937] usb 5-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid wMaxPacketSize 0 [ 290.356930][ T796] usb 4-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 290.396588][ T5896] usb 2-1: device descriptor read/64, error -71 [ 290.433158][ T796] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 290.447558][ T5937] usb 5-1: config 0 interface 0 has no altsetting 0 [ 290.458312][ T5937] usb 5-1: New USB device found, idVendor=28de, idProduct=1102, bcdDevice= 0.00 [ 290.467083][ T796] usb 4-1: config 0 descriptor?? [ 290.469146][ T5937] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 290.498187][ T5937] usb 5-1: config 0 descriptor?? [ 290.538545][ T5896] usb usb2-port1: attempt power cycle [ 290.567766][ T5937] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 290.879578][ T8957] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 290.898651][ T8957] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 290.899808][ T796] ft260 0003:0403:6030.001C: unknown main item tag 0x0 [ 290.918906][ T796] ft260 0003:0403:6030.001C: unknown main item tag 0x0 [ 290.955529][ T5896] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 290.976386][ T5896] usb 2-1: device descriptor read/8, error -71 [ 291.092063][ T796] ft260 0003:0403:6030.001C: chip code: 0000 0000 [ 291.225473][ T5896] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 291.256399][ T5896] usb 2-1: device descriptor read/8, error -71 [ 291.300693][ T796] ft260 0003:0403:6030.001C: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.3-1/input0 [ 291.366132][ T5896] usb usb2-port1: unable to enumerate USB device [ 291.481975][ T8960] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 291.491684][ T8960] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 291.512981][ T796] ft260 0003:0403:6030.001C: failed to retrieve status: -32, no wakeup [ 291.746600][ T8946] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 291.756322][ T8946] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 291.767792][ T5937] usb 4-1: USB disconnect, device number 50 [ 292.748364][ T8982] netlink: 64 bytes leftover after parsing attributes in process `syz.3.867'. [ 292.923409][ T5894] usb 5-1: USB disconnect, device number 54 [ 293.536621][ T5937] usb 2-1: new full-speed USB device number 46 using dummy_hcd [ 293.707035][ T5936] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 293.805513][ T5937] usb 2-1: not running at top speed; connect to a high speed hub [ 293.877106][ T5936] usb 5-1: Using ep0 maxpacket: 16 [ 293.907386][ T5936] usb 5-1: too many endpoints for config 1 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 293.918929][ T5936] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 293.951848][ T5937] usb 2-1: config 1 interface 0 altsetting 4 endpoint 0x81 has invalid maxpacket 55887, setting to 64 [ 293.967037][ T5936] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 59391, setting to 1024 [ 293.978444][ T5937] usb 2-1: config 1 interface 0 has no altsetting 0 [ 293.989590][ T5937] usb 2-1: New USB device found, idVendor=05ac, idProduct=0230, bcdDevice= 0.40 [ 293.998836][ T5937] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 294.009706][ T5936] usb 5-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 254 [ 294.027409][ T5937] usb 2-1: Product: syz [ 294.031579][ T5937] usb 2-1: Manufacturer: syz [ 294.038907][ T5937] usb 2-1: SerialNumber: syz [ 294.047515][ T5936] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 294.063150][ T5936] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 294.085196][ T8996] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 294.104054][ T5936] usb 5-1: SerialNumber: syz [ 294.128009][ T8998] raw-gadget.3 gadget.4: fail, usb_ep_enable returned -22 [ 294.471783][ T5936] usb 5-1: USB disconnect, device number 55 [ 294.531676][ T5937] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/input/input29 [ 294.589745][ T5181] bcm5974 2-1:1.0: could not read from device [ 294.625228][ T5181] bcm5974 2-1:1.0: could not read from device [ 294.631626][ T5937] usb 2-1: USB disconnect, device number 46 [ 295.224384][ T5936] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 295.381385][ T5936] usb 4-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 295.392846][ T5936] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 295.414843][ T5936] usb 4-1: Product: syz [ 295.431119][ T5936] usb 4-1: Manufacturer: syz [ 295.441008][ T5936] usb 4-1: SerialNumber: syz [ 295.540070][ T5936] usb 4-1: config 0 descriptor?? [ 295.591814][ T9023] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 295.619162][ T9023] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 295.664553][ T5937] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 295.824455][ T5937] usb 2-1: Using ep0 maxpacket: 8 [ 295.832355][ T5937] usb 2-1: unable to get BOS descriptor or descriptor too short [ 295.852155][ T5937] usb 2-1: config 4 interface 0 has no altsetting 0 [ 295.870158][ T5937] usb 2-1: string descriptor 0 read error: -22 [ 295.879459][ T9029] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 295.891279][ T5937] usb 2-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 295.927402][ T5937] usb 2-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 295.970157][ T5937] usb 2-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 296.007698][ T5937] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 296.028367][ T5937] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 296.044456][ T5937] usb 2-1: media controller created [ 296.161295][ T5937] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 296.473545][ T5937] usb 2-1: USB disconnect, device number 47 [ 296.957754][ T9043] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 296.983042][ T9043] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 297.961609][ T5896] usb 4-1: USB disconnect, device number 51 [ 298.532824][ T9056] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 298.543581][ T5896] usb 4-1: new full-speed USB device number 52 using dummy_hcd [ 298.582742][ T9056] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 298.859746][ T5896] usb 4-1: not running at top speed; connect to a high speed hub [ 298.883089][ T5896] usb 4-1: config 1 interface 0 altsetting 4 endpoint 0x81 has invalid maxpacket 55887, setting to 64 [ 298.909101][ T5896] usb 4-1: config 1 interface 0 has no altsetting 0 [ 298.980754][ T9066] netlink: 16 bytes leftover after parsing attributes in process `syz.1.892'. [ 298.992360][ T9066] netlink: 4 bytes leftover after parsing attributes in process `syz.1.892'. [ 299.318919][ T5896] usb 4-1: New USB device found, idVendor=05ac, idProduct=0230, bcdDevice= 0.40 [ 299.375623][ T5896] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 299.390290][ T5896] usb 4-1: Product: syz [ 299.408984][ T5896] usb 4-1: Manufacturer: syz [ 299.462169][ T5896] usb 4-1: SerialNumber: syz [ 299.473801][ T9053] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 299.842372][ T9074] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 299.860430][ T9074] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 299.874372][ T5937] usb 5-1: new high-speed USB device number 56 using dummy_hcd [ 299.900081][ T5896] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/input/input30 [ 299.912810][ T5181] bcm5974 4-1:1.0: could not read from device [ 299.924482][ T5181] bcm5974 4-1:1.0: could not read from device [ 299.947254][ T5181] bcm5974 4-1:1.0: could not read from device [ 299.968140][ T5896] usb 4-1: USB disconnect, device number 52 [ 299.992026][ T6031] bcm5974 4-1:1.0: could not read from device [ 300.099889][ T5937] usb 5-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 300.109036][ T5937] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 300.117425][ T5937] usb 5-1: Product: syz [ 300.126835][ T5937] usb 5-1: Manufacturer: syz [ 300.132583][ T5937] usb 5-1: SerialNumber: syz [ 300.158312][ T5937] usb 5-1: config 0 descriptor?? [ 300.367613][ T5937] usb 5-1: USB disconnect, device number 56 [ 300.537268][ T9080] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 300.546086][ T9080] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 300.824956][ T9072] FAULT_INJECTION: forcing a failure. [ 300.824956][ T9072] name failslab, interval 1, probability 0, space 0, times 0 [ 300.877621][ T9072] CPU: 0 UID: 0 PID: 9072 Comm: syz.4.895 Not tainted syzkaller #0 PREEMPT(full) [ 300.877648][ T9072] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 300.877658][ T9072] Call Trace: [ 300.877665][ T9072] [ 300.877672][ T9072] dump_stack_lvl+0xe8/0x150 [ 300.877696][ T9072] should_fail_ex+0x412/0x560 [ 300.877713][ T9072] should_failslab+0xa8/0x100 [ 300.877726][ T9072] ? alloc_empty_file+0x55/0x1d0 [ 300.877739][ T9072] kmem_cache_alloc_noprof+0x87/0x650 [ 300.877754][ T9072] alloc_empty_file+0x55/0x1d0 [ 300.877767][ T9072] alloc_file_pseudo+0x155/0x240 [ 300.877782][ T9072] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 300.877795][ T9072] ? alloc_fd+0x64b/0x6c0 [ 300.877813][ T9072] anon_inode_getfd+0xc8/0x1f0 [ 300.877827][ T9072] __se_sys_fsopen+0x232/0x2c0 [ 300.877841][ T9072] do_syscall_64+0x14d/0xf80 [ 300.877852][ T9072] ? trace_irq_disable+0x3b/0x150 [ 300.877866][ T9072] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 300.877876][ T9072] ? clear_bhb_loop+0x40/0x90 [ 300.877888][ T9072] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 300.877897][ T9072] RIP: 0033:0x7f7a0c99c799 [ 300.877908][ T9072] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 300.877917][ T9072] RSP: 002b:00007f7a0d77b028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 300.877929][ T9072] RAX: ffffffffffffffda RBX: 00007f7a0cc15fa0 RCX: 00007f7a0c99c799 [ 300.877936][ T9072] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000080 [ 300.877942][ T9072] RBP: 00007f7a0d77b090 R08: 0000000000000000 R09: 0000000000000000 [ 300.877948][ T9072] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 300.877953][ T9072] R13: 00007f7a0cc16038 R14: 00007f7a0cc15fa0 R15: 00007f7a0cd3fa48 [ 300.877968][ T9072] [ 302.632125][ T9118] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 302.640988][ T9118] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 303.787441][ T9137] netlink: 'syz.2.913': attribute type 2 has an invalid length. [ 303.808695][ T9137] netlink: 5120 bytes leftover after parsing attributes in process `syz.2.913'. [ 304.156047][ T9151] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 304.167974][ T9151] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 304.427034][ T5937] usb 5-1: new high-speed USB device number 57 using dummy_hcd [ 304.776496][ T5937] usb 5-1: Invalid ep0 maxpacket: 9 [ 304.870068][ T9156] fuse: Invalid gid '00000000000000000001254' [ 304.983789][ T5937] usb 5-1: new high-speed USB device number 58 using dummy_hcd [ 305.192338][ T5937] usb 5-1: Invalid ep0 maxpacket: 9 [ 305.198932][ T5937] usb usb5-port1: attempt power cycle [ 305.554477][ T5937] usb 5-1: new high-speed USB device number 59 using dummy_hcd [ 305.587659][ T5937] usb 5-1: Invalid ep0 maxpacket: 9 [ 305.627211][ T796] usb 2-1: new full-speed USB device number 48 using dummy_hcd [ 305.715818][ T5937] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 305.734999][ T5937] usb 5-1: Invalid ep0 maxpacket: 9 [ 305.741595][ T5937] usb usb5-port1: unable to enumerate USB device [ 305.787105][ T796] usb 2-1: config 150 has an invalid interface number: 204 but max is 2 [ 306.047445][ T796] usb 2-1: config 150 has an invalid descriptor of length 0, skipping remainder of the config [ 306.091539][ T796] usb 2-1: config 150 has 1 interface, different from the descriptor's value: 3 [ 306.103260][ T796] usb 2-1: config 150 has no interface number 0 [ 306.118928][ T796] usb 2-1: config 150 interface 204 has no altsetting 0 [ 306.123503][ T9184] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 306.131141][ T796] usb 2-1: New USB device found, idVendor=04e2, idProduct=1424, bcdDevice=c7.eb [ 306.147778][ T796] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 306.173557][ T796] usb 2-1: Product: syz [ 306.193612][ T796] usb 2-1: Manufacturer: syz [ 306.208293][ T796] usb 2-1: SerialNumber: syz [ 306.499602][ T9187] QAT: Stopping all acceleration devices. [ 306.531465][ T980] usb 2-1: USB disconnect, device number 48 [ 306.707957][ T9190] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 306.720067][ T9190] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 306.756872][ T9190] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 306.773669][ T9190] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 306.791803][ T9190] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 306.837627][ T9190] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 306.907381][ T9197] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 306.926921][ T9197] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 307.017180][ T30] kauditd_printk_skb: 48 callbacks suppressed [ 307.017196][ T30] audit: type=1326 audit(1774321743.143:282): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9200 comm="syz.3.934" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f0670f9c799 code=0x0 [ 307.298748][ T9216] lo: Caught tx_queue_len zero misconfig [ 307.504376][ T5937] usb 5-1: new high-speed USB device number 61 using dummy_hcd [ 307.526365][ T9222] netlink: 8 bytes leftover after parsing attributes in process `syz.2.940'. [ 307.535321][ T9222] netlink: 8 bytes leftover after parsing attributes in process `syz.2.940'. [ 307.614431][ T9222] netlink: 'syz.2.940': attribute type 4 has an invalid length. [ 307.744788][ T9226] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 307.753690][ T9226] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 307.763732][ T9226] netlink: 28 bytes leftover after parsing attributes in process `syz.0.941'. [ 307.797273][ T5937] usb 5-1: Using ep0 maxpacket: 16 [ 307.808453][ T5937] usb 5-1: too many endpoints for config 1 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 307.822075][ T5937] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 307.841597][ T5937] usb 5-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 254 [ 307.920670][ T5937] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 307.930329][ T5937] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 307.980620][ T5937] usb 5-1: SerialNumber: syz [ 308.649786][ T5937] usb 5-1: USB disconnect, device number 61 [ 310.844187][ T9262] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 310.872370][ T9262] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 312.580444][ T9294] netlink: 'syz.2.961': attribute type 1 has an invalid length. [ 312.588345][ T5937] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 312.876852][ T5937] usb 2-1: Using ep0 maxpacket: 16 [ 312.887966][ T5937] usb 2-1: too many endpoints for config 1 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 312.907329][ T5937] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 312.917808][ T9297] FAULT_INJECTION: forcing a failure. [ 312.917808][ T9297] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 313.041739][ T5937] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 254 [ 313.058175][ T9297] CPU: 0 UID: 0 PID: 9297 Comm: syz.2.961 Not tainted syzkaller #0 PREEMPT(full) [ 313.058192][ T9297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 313.058199][ T9297] Call Trace: [ 313.058203][ T9297] [ 313.058208][ T9297] dump_stack_lvl+0xe8/0x150 [ 313.058226][ T9297] should_fail_ex+0x412/0x560 [ 313.058243][ T9297] _copy_from_user+0x2d/0xb0 [ 313.058256][ T9297] ___sys_sendmsg+0x1c6/0x360 [ 313.058270][ T9297] ? __pfx____sys_sendmsg+0x10/0x10 [ 313.058297][ T9297] ? __fget_files+0x2a/0x420 [ 313.058311][ T9297] ? __fget_files+0x3a0/0x420 [ 313.058329][ T9297] __x64_sys_sendmsg+0x1bd/0x2a0 [ 313.058341][ T9297] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 313.058357][ T9297] ? __pfx_ksys_write+0x10/0x10 [ 313.058373][ T9297] do_syscall_64+0x14d/0xf80 [ 313.058383][ T9297] ? trace_irq_disable+0x3b/0x150 [ 313.058397][ T9297] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 313.058407][ T9297] ? clear_bhb_loop+0x40/0x90 [ 313.058419][ T9297] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 313.058428][ T9297] RIP: 0033:0x7f840339c799 [ 313.058438][ T9297] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 313.058446][ T9297] RSP: 002b:00007f84042f7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 313.058458][ T9297] RAX: ffffffffffffffda RBX: 00007f8403616090 RCX: 00007f840339c799 [ 313.058465][ T9297] RDX: 0000000000004000 RSI: 00002000000012c0 RDI: 0000000000000004 [ 313.058472][ T9297] RBP: 00007f84042f7090 R08: 0000000000000000 R09: 0000000000000000 [ 313.058477][ T9297] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 313.058483][ T9297] R13: 00007f8403616128 R14: 00007f8403616090 R15: 00007f840373fa48 [ 313.058497][ T9297] [ 313.291855][ T5937] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 313.300976][ T5937] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 313.309065][ T5937] usb 2-1: SerialNumber: syz [ 313.349022][ T5888] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 313.467244][ T9299] bond0: entered promiscuous mode [ 313.472601][ T9299] 8021q: adding VLAN 0 to HW filter on device bond0 [ 313.533597][ T5937] usb 2-1: USB disconnect, device number 49 [ 313.611733][ T9306] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 313.647195][ T9306] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 313.671332][ T9300] 8021q: adding VLAN 0 to HW filter on device bond1 [ 313.691352][ T9300] bond1: entered promiscuous mode [ 313.699193][ T9300] bond0: (slave bond1): Enslaving as an active interface with an up link [ 313.717724][ T5888] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 313.731406][ T5888] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 313.743793][ T5888] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 313.761317][ T5888] usb 4-1: New USB device found, idVendor=1038, idProduct=1410, bcdDevice= 0.00 [ 313.790766][ T5888] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 313.803832][ T5888] usb 4-1: config 0 descriptor?? [ 314.095404][ T796] usb 5-1: new low-speed USB device number 62 using dummy_hcd [ 314.250899][ T9312] binder: 9311:9312 ioctl c0306201 200000000180 returned -22 [ 314.258470][ T796] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 314.258497][ T796] usb 5-1: config 0 has no interface number 0 [ 314.258535][ T796] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 314.287465][ T796] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 314.476486][ T796] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 314.499207][ T796] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 314.511975][ T796] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 314.525682][ T796] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 314.558575][ T796] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 314.608567][ T796] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 314.648326][ T796] usb 5-1: config 0 descriptor?? [ 314.656220][ T9308] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 314.663569][ T9317] netlink: 8 bytes leftover after parsing attributes in process `syz.0.969'. [ 314.673777][ T9317] netlink: 60 bytes leftover after parsing attributes in process `syz.0.969'. [ 314.688019][ T9308] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 314.756513][ T796] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 314.813271][ T9322] netlink: 'syz.2.970': attribute type 1 has an invalid length. [ 314.948570][ T796] usb 5-1: USB disconnect, device number 62 [ 314.961465][ T796] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 314.971500][ T9324] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address [ 315.008613][ T9324] bond2: (slave vxcan3): Error -95 calling set_mac_address [ 315.124353][ T5937] usb 2-1: new full-speed USB device number 50 using dummy_hcd [ 315.276239][ T5937] usb 2-1: not running at top speed; connect to a high speed hub [ 315.289653][ T5937] usb 2-1: config 1 interface 0 altsetting 4 endpoint 0x81 has invalid maxpacket 55887, setting to 64 [ 315.344297][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 315.358155][ T5937] usb 2-1: config 1 interface 0 has no altsetting 0 [ 315.401345][ T5937] usb 2-1: New USB device found, idVendor=05ac, idProduct=0230, bcdDevice= 0.40 [ 315.418528][ T5937] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 315.431119][ T5937] usb 2-1: Product: syz [ 315.438583][ T5937] usb 2-1: Manufacturer: syz [ 315.449999][ T5937] usb 2-1: SerialNumber: syz [ 315.512583][ T9310] raw-gadget.4 gadget.1: fail, usb_ep_enable returned -22 [ 315.696749][ T5888] usbhid 4-1:0.0: can't add hid device: -71 [ 315.710161][ T5888] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 315.747069][ T5888] usb 4-1: USB disconnect, device number 53 [ 315.871130][ T5937] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/input/input31 [ 315.881768][ T5181] bcm5974 2-1:1.0: could not read from device [ 315.936053][ T9340] FAULT_INJECTION: forcing a failure. [ 315.936053][ T9340] name failslab, interval 1, probability 0, space 0, times 0 [ 316.083467][ T9340] CPU: 0 UID: 0 PID: 9340 Comm: syz.3.976 Not tainted syzkaller #0 PREEMPT(full) [ 316.083489][ T9340] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 316.083499][ T9340] Call Trace: [ 316.083506][ T9340] [ 316.083518][ T9340] dump_stack_lvl+0xe8/0x150 [ 316.083547][ T9340] should_fail_ex+0x412/0x560 [ 316.083577][ T9340] should_failslab+0xa8/0x100 [ 316.083600][ T9340] __kmalloc_noprof+0xe8/0x760 [ 316.083621][ T9340] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 316.083654][ T9340] tomoyo_realpath_from_path+0xe3/0x5d0 [ 316.083690][ T9340] ? tomoyo_path_number_perm+0x219/0x630 [ 316.083712][ T9340] tomoyo_path_number_perm+0x246/0x630 [ 316.083735][ T9340] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 316.083758][ T9340] ? __lock_acquire+0x6b5/0x2cf0 [ 316.083783][ T9340] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 316.083813][ T9340] ? __fget_files+0x2a/0x420 [ 316.083835][ T9340] ? __fget_files+0x2a/0x420 [ 316.083852][ T9340] ? __fget_files+0x3a0/0x420 [ 316.083870][ T9340] ? __fget_files+0x2a/0x420 [ 316.083892][ T9340] security_file_ioctl+0xc3/0x2a0 [ 316.083910][ T9340] __se_sys_ioctl+0x47/0x170 [ 316.083927][ T9340] do_syscall_64+0x14d/0xf80 [ 316.083941][ T9340] ? trace_irq_disable+0x3b/0x150 [ 316.083961][ T9340] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 316.083974][ T9340] ? clear_bhb_loop+0x40/0x90 [ 316.083991][ T9340] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 316.084004][ T9340] RIP: 0033:0x7f0670f9c799 [ 316.084016][ T9340] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 316.084029][ T9340] RSP: 002b:00007f0671dba028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 316.084044][ T9340] RAX: ffffffffffffffda RBX: 00007f0671216180 RCX: 00007f0670f9c799 [ 316.084054][ T9340] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000009 [ 316.084062][ T9340] RBP: 00007f0671dba090 R08: 0000000000000000 R09: 0000000000000000 [ 316.084071][ T9340] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 316.084079][ T9340] R13: 00007f0671216218 R14: 00007f0671216180 R15: 00007f067133fa48 [ 316.084100][ T9340] [ 316.299105][ T5181] bcm5974 2-1:1.0: could not read from device [ 316.310424][ T9343] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 316.319010][ T9343] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 316.328199][ T9340] ERROR: Out of memory at tomoyo_realpath_from_path. [ 316.661541][ T5181] bcm5974 2-1:1.0: could not read from device [ 316.669694][ T5181] bcm5974 2-1:1.0: could not read from device [ 316.699764][ T5937] usb 2-1: USB disconnect, device number 50 [ 317.321057][ T9352] xt_recent: Unsupported userspace flags (000000de) [ 317.395022][ T0] NOHZ tick-stop error: local softirq work is pending, handler #282!!! [ 317.422485][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.430132][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.670618][ T9357] netlink: 8 bytes leftover after parsing attributes in process `syz.1.981'. [ 317.816518][ T9357] netlink: 60 bytes leftover after parsing attributes in process `syz.1.981'. [ 317.931780][ T9364] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3089888063 (3089888063 ns) > initial count (2126324423 ns). Using initial count to start timer. [ 318.119291][ T9368] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 318.215549][ T9355] netlink: 348 bytes leftover after parsing attributes in process `syz.2.980'. [ 318.255658][ T5894] usb 4-1: new low-speed USB device number 54 using dummy_hcd [ 318.428826][ T5894] usb 4-1: config 0 has an invalid interface number: 55 but max is 0 [ 318.452954][ T9377] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 318.473427][ T9375] bond3: entered promiscuous mode [ 318.481657][ T5894] usb 4-1: config 0 has no interface number 0 [ 318.487460][ T9377] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 318.516340][ T5894] usb 4-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 318.529959][ T9375] 8021q: adding VLAN 0 to HW filter on device bond3 [ 318.548241][ T5894] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 318.566918][ T5894] usb 4-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 318.590702][ T5894] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 318.606551][ T5894] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 318.620368][ T5894] usb 4-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 318.636683][ T5894] usb 4-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 318.649304][ T5894] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 318.712580][ T5894] usb 4-1: config 0 descriptor?? [ 318.721553][ T9365] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 318.731012][ T9365] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 318.811017][ T5894] ldusb 4-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 318.842743][ T9381] 8021q: adding VLAN 0 to HW filter on device bond4 [ 318.888084][ T9381] bond4: entered promiscuous mode [ 318.893853][ T9381] bond3: (slave bond4): Enslaving as an active interface with an up link [ 318.953945][ T5894] usb 4-1: USB disconnect, device number 54 [ 318.970723][ T5894] ldusb 4-1:0.55: LD USB Device #0 now disconnected [ 319.004583][ T5937] usb 2-1: new full-speed USB device number 51 using dummy_hcd [ 319.172352][ T9395] netlink: 8 bytes leftover after parsing attributes in process `syz.0.995'. [ 319.182481][ T5937] usb 2-1: not running at top speed; connect to a high speed hub [ 319.193177][ T9395] netlink: 60 bytes leftover after parsing attributes in process `syz.0.995'. [ 319.204363][ T5937] usb 2-1: config 1 interface 0 altsetting 4 endpoint 0x81 has invalid maxpacket 55887, setting to 64 [ 319.215521][ T5936] usb 5-1: new high-speed USB device number 63 using dummy_hcd [ 319.226487][ T5937] usb 2-1: config 1 interface 0 has no altsetting 0 [ 319.258963][ T5937] usb 2-1: New USB device found, idVendor=05ac, idProduct=0230, bcdDevice= 0.40 [ 319.277477][ T5937] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 319.289701][ T5937] usb 2-1: Product: syz [ 319.298515][ T5937] usb 2-1: Manufacturer: syz [ 319.303544][ T5937] usb 2-1: SerialNumber: syz [ 319.330076][ T9387] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 319.389383][ T5936] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 319.400589][ T5936] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 319.418930][ T5936] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 319.441419][ T5936] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 319.477600][ T5936] usb 5-1: config 0 descriptor?? [ 319.948969][ T5936] usbhid 5-1:0.0: can't add hid device: -71 [ 319.964195][ T5936] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 320.148111][ T5937] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/input/input33 [ 320.385811][ T5936] usb 5-1: USB disconnect, device number 63 [ 320.427443][ T5181] bcm5974 2-1:1.0: could not read from device [ 320.446263][ T5181] bcm5974 2-1:1.0: could not read from device [ 320.524748][ T5937] usb 2-1: USB disconnect, device number 51 [ 320.581773][ T5181] bcm5974 2-1:1.0: could not read from device [ 320.814385][ T5936] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 321.025897][ T5936] usb 5-1: Using ep0 maxpacket: 16 [ 321.052853][ T5936] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 321.088429][ T5936] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 321.098979][ T5936] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.40 [ 321.108569][ T5936] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 321.157916][ T5936] usb 5-1: config 0 descriptor?? [ 321.213467][ T9411] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 321.262263][ T9417] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 321.278065][ T9417] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 321.279343][ T9418] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1002'. [ 321.574228][ T5936] mcp2221 0003:04D8:00DD.001D: item fetching failed at offset 0/1 [ 321.578178][ T9409] netlink: 348 bytes leftover after parsing attributes in process `syz.2.1000'. [ 321.601407][ T5936] mcp2221 0003:04D8:00DD.001D: can't parse reports [ 321.614425][ T5936] mcp2221 0003:04D8:00DD.001D: probe with driver mcp2221 failed with error -22 [ 321.775048][ T5936] usb 5-1: USB disconnect, device number 64 [ 321.788008][ T9421] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 322.114794][ T9433] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 322.139186][ T9433] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 322.334359][ T5936] usb 2-1: new full-speed USB device number 52 using dummy_hcd [ 322.405283][ T9437] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 322.414416][ T9437] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 322.549324][ T9439] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1009'. [ 322.559868][ T9439] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1009'. [ 322.644090][ T5936] usb 2-1: config index 0 descriptor too short (expected 8192, got 36) [ 322.709447][ T5936] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 322.773364][ T5936] usb 2-1: config 0 has no interfaces? [ 322.793104][ T5936] usb 2-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 322.957859][ T5936] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 322.992437][ T5936] usb 2-1: config 0 descriptor?? [ 323.037994][ T796] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 323.198423][ T796] usb 4-1: unable to get BOS descriptor or descriptor too short [ 323.210407][ T796] usb 4-1: New USB device found, idVendor=200c, idProduct=100b, bcdDevice= 0.40 [ 323.222327][ T796] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 323.231852][ T796] usb 4-1: Product: syz [ 323.237800][ T796] usb 4-1: Manufacturer: syz [ 323.243407][ T796] usb 4-1: SerialNumber: syz [ 323.550492][ T9443] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 323.587561][ T9443] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 324.620517][ T9443] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 324.667558][ T9443] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 324.738270][ T5936] usb 2-1: USB disconnect, device number 52 [ 325.211053][ T796] usb 4-1: USB disconnect, device number 55 [ 325.396433][ T5894] usb 2-1: new full-speed USB device number 53 using dummy_hcd [ 325.510296][ T9475] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1021'. [ 325.557147][ T5894] usb 2-1: config 150 has an invalid interface number: 204 but max is 2 [ 325.587959][ T5894] usb 2-1: config 150 has an invalid descriptor of length 0, skipping remainder of the config [ 325.588566][ T9475] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1021'. [ 325.621231][ T5894] usb 2-1: config 150 has 1 interface, different from the descriptor's value: 3 [ 325.642712][ T5894] usb 2-1: config 150 has no interface number 0 [ 325.657899][ T5894] usb 2-1: config 150 interface 204 has no altsetting 0 [ 325.672695][ T5894] usb 2-1: New USB device found, idVendor=04e2, idProduct=1424, bcdDevice=c7.eb [ 325.685441][ T5894] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 325.693425][ T5894] usb 2-1: Product: syz [ 325.707352][ T5894] usb 2-1: Manufacturer: syz [ 325.712196][ T5894] usb 2-1: SerialNumber: syz [ 325.850025][ T9483] syzkaller0: entered promiscuous mode [ 325.855601][ T9483] syzkaller0: entered allmulticast mode [ 325.864539][ T5937] usb 4-1: new low-speed USB device number 56 using dummy_hcd [ 325.974003][ T5894] usb 2-1: USB disconnect, device number 53 [ 326.027999][ T5937] usb 4-1: config 0 has an invalid interface number: 55 but max is 0 [ 326.045362][ T5937] usb 4-1: config 0 has no interface number 0 [ 326.068917][ T5937] usb 4-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 326.082132][ T5937] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 326.093204][ T5937] usb 4-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 326.119927][ T5937] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 326.132534][ T5937] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 326.146174][ T5937] usb 4-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 326.181604][ T5937] usb 4-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 326.192727][ T5937] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 326.372211][ T5937] usb 4-1: config 0 descriptor?? [ 326.378645][ T9478] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 326.398035][ T9496] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 326.406749][ T9478] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 326.554230][ T5937] ldusb 4-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 326.562471][ T9496] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 326.621364][ T5937] usb 4-1: USB disconnect, device number 56 [ 326.648850][ T5937] ldusb 4-1:0.55: LD USB Device #0 now disconnected [ 329.412638][ T9518] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 329.448717][ T9518] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 329.817944][ T9529] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 329.830418][ T9529] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 329.891644][ T9532] FAULT_INJECTION: forcing a failure. [ 329.891644][ T9532] name failslab, interval 1, probability 0, space 0, times 0 [ 329.896521][ T9529] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 329.909467][ T9532] CPU: 1 UID: 0 PID: 9532 Comm: syz.1.1040 Not tainted syzkaller #0 PREEMPT(full) [ 329.909491][ T9532] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 329.909502][ T9532] Call Trace: [ 329.909509][ T9532] [ 329.909516][ T9532] dump_stack_lvl+0xe8/0x150 [ 329.909547][ T9532] should_fail_ex+0x412/0x560 [ 329.909576][ T9532] should_failslab+0xa8/0x100 [ 329.909600][ T9532] __kmalloc_cache_noprof+0x88/0x660 [ 329.909620][ T9532] ? call_usermodehelper_setup+0x8e/0x270 [ 329.909648][ T9532] call_usermodehelper_setup+0x8e/0x270 [ 329.909668][ T9532] ? __pfx_free_modprobe_argv+0x10/0x10 [ 329.909695][ T9532] __request_module+0x3ba/0x660 [ 329.909724][ T9532] ? __pfx___request_module+0x10/0x10 [ 329.909756][ T9532] ? netlink_unicast+0x80f/0x9b0 [ 329.909778][ T9532] ? netlink_sendmsg+0x813/0xb40 [ 329.909793][ T9532] ? ____sys_sendmsg+0x972/0x9f0 [ 329.909816][ T9532] ? xt_find_target+0x1fa/0x240 [ 329.909839][ T9532] xt_request_find_target+0xc1/0x130 [ 329.909860][ T9532] nft_target_select_ops+0x155/0x5d0 [ 329.909888][ T9532] nf_tables_expr_parse+0x72c/0xa80 [ 329.909910][ T9532] ? nf_tables_expr_parse+0x168/0xa80 [ 329.909934][ T9532] ? __pfx_nf_tables_expr_parse+0x10/0x10 [ 329.909952][ T9532] ? do_raw_spin_lock+0x12b/0x2f0 [ 329.909981][ T9532] nft_set_elem_expr_alloc+0xe9/0x5f0 [ 329.910009][ T9532] ? __pfx_nft_set_elem_expr_alloc+0x10/0x10 [ 329.910047][ T9532] ? nft_rhash_init+0x2c0/0x3b0 [ 329.910074][ T9532] ? __pfx_nft_rhash_init+0x10/0x10 [ 329.910097][ T9532] ? kasan_quarantine_put+0xbb/0x1f0 [ 329.910116][ T9532] ? __pfx_nft_rhash_key+0x10/0x10 [ 329.910131][ T9532] ? __pfx_nft_rhash_obj+0x10/0x10 [ 329.910147][ T9532] ? __pfx_nft_rhash_cmp+0x10/0x10 [ 329.910167][ T9532] nft_set_expr_alloc+0x68/0x760 [ 329.910190][ T9532] ? nf_tables_newset+0x13bf/0x2580 [ 329.910215][ T9532] nf_tables_newset+0x1c6b/0x2580 [ 329.910247][ T9532] ? __pfx_nf_tables_newset+0x10/0x10 [ 329.910286][ T9532] ? __nla_parse+0x40/0x60 [ 329.910308][ T9532] nfnetlink_rcv+0x1240/0x27b0 [ 329.910361][ T9532] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 329.910402][ T9532] ? ref_tracker_free+0x693/0x840 [ 329.910457][ T9532] ? __netlink_deliver_tap+0x807/0x850 [ 329.910481][ T9532] ? netlink_deliver_tap+0x2e/0x1b0 [ 329.910522][ T9532] netlink_unicast+0x80f/0x9b0 [ 329.910552][ T9532] ? __pfx_netlink_unicast+0x10/0x10 [ 329.910577][ T9532] ? netlink_sendmsg+0x650/0xb40 [ 329.910592][ T9532] ? skb_put+0x11b/0x210 [ 329.910613][ T9532] netlink_sendmsg+0x813/0xb40 [ 329.910638][ T9532] ? __pfx_netlink_sendmsg+0x10/0x10 [ 329.910657][ T9532] ? aa_sock_msg_perm+0xf1/0x1b0 [ 329.910684][ T9532] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 329.910707][ T9532] ____sys_sendmsg+0x972/0x9f0 [ 329.910735][ T9532] ? __pfx_____sys_sendmsg+0x10/0x10 [ 329.910763][ T9532] ? import_iovec+0x73/0xa0 [ 329.910785][ T9532] ___sys_sendmsg+0x2a5/0x360 [ 329.910810][ T9532] ? __pfx____sys_sendmsg+0x10/0x10 [ 329.910862][ T9532] ? __fget_files+0x2a/0x420 [ 329.910886][ T9532] ? __fget_files+0x3a0/0x420 [ 329.910919][ T9532] __x64_sys_sendmsg+0x1bd/0x2a0 [ 329.910942][ T9532] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 329.910970][ T9532] ? __pfx_ksys_write+0x10/0x10 [ 329.911000][ T9532] do_syscall_64+0x14d/0xf80 [ 329.911020][ T9532] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 329.911037][ T9532] ? clear_bhb_loop+0x40/0x90 [ 329.911058][ T9532] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 329.911075][ T9532] RIP: 0033:0x7f071dd9c799 [ 329.911091][ T9532] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 329.911106][ T9532] RSP: 002b:00007f071eb9f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 329.911125][ T9532] RAX: ffffffffffffffda RBX: 00007f071e015fa0 RCX: 00007f071dd9c799 [ 329.911138][ T9532] RDX: 0000000020000800 RSI: 00002000000000c0 RDI: 0000000000000003 [ 329.911149][ T9532] RBP: 00007f071eb9f090 R08: 0000000000000000 R09: 0000000000000000 [ 329.911159][ T9532] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 329.911170][ T9532] R13: 00007f071e016038 R14: 00007f071e015fa0 R15: 00007f071e13fa48 [ 329.911198][ T9532] [ 330.434730][ T9529] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 330.646520][ T5894] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 330.892807][ T5894] usb 5-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 330.907437][ T5894] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 330.919893][ T5894] usb 5-1: Product: syz [ 330.924142][ T5894] usb 5-1: Manufacturer: syz [ 330.967720][ T5894] usb 5-1: SerialNumber: syz [ 330.993855][ T5894] usb 5-1: config 0 descriptor?? [ 331.698255][ T9560] fuse: Bad value for 'fd' [ 332.812940][ T9567] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 332.823034][ T9567] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 333.440951][ T9572] netlink: 'syz.2.1053': attribute type 1 has an invalid length. [ 333.449847][ T5936] usb 5-1: USB disconnect, device number 65 [ 333.585322][ T9572] bond5: entered promiscuous mode [ 333.600987][ T9572] 8021q: adding VLAN 0 to HW filter on device bond5 [ 333.702367][ T9574] 8021q: adding VLAN 0 to HW filter on device bond6 [ 333.722807][ T9574] bond6: entered promiscuous mode [ 333.741339][ T9574] bond5: (slave bond6): Enslaving as an active interface with an up link [ 334.164535][ T5936] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 334.357052][ T796] usb 5-1: new low-speed USB device number 66 using dummy_hcd [ 334.364577][ T5936] usb 4-1: Using ep0 maxpacket: 16 [ 334.366480][ T5936] usb 4-1: config 0 has an invalid interface number: 8 but max is 0 [ 334.366506][ T5936] usb 4-1: config 0 has no interface number 0 [ 334.366545][ T5936] usb 4-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 334.366571][ T5936] usb 4-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 334.367990][ T5936] usb 4-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 334.415771][ T5937] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 334.438076][ T5936] usb 4-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 334.450416][ T5936] usb 4-1: Product: syz [ 334.458025][ T5936] usb 4-1: SerialNumber: syz [ 334.474439][ T5936] usb 4-1: config 0 descriptor?? [ 334.485532][ T5936] cm109 4-1:0.8: invalid payload size 0, expected 4 [ 334.496745][ T5936] input: CM109 USB driver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.8/input/input34 [ 334.518915][ T796] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 334.529827][ T796] usb 5-1: config 0 has no interface number 0 [ 334.538710][ T796] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 334.589394][ T5937] usb 2-1: Using ep0 maxpacket: 32 [ 334.614116][ T5937] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 334.625895][ T5937] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 334.653951][ T5937] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 334.666251][ T796] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 334.679476][ T5937] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 334.690844][ T796] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 334.723996][ C0] cm109_urb_ctl_callback: 197 callbacks suppressed [ 334.724019][ C0] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 334.727265][ T5896] usb 4-1: USB disconnect, device number 57 [ 334.730548][ C0] cm109 4-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 334.733042][ T5937] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 334.788706][ T5896] cm109 4-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 334.800652][ T796] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 334.893407][ T5937] usb 2-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 334.903115][ T5937] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 334.911229][ T5937] usb 2-1: Product: syz [ 334.917147][ T5937] usb 2-1: Manufacturer: syz [ 334.922007][ T5937] usb 2-1: SerialNumber: syz [ 334.941743][ T796] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 334.977862][ T5937] usb 2-1: config 0 descriptor?? [ 335.017239][ T796] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 335.073611][ T796] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 335.136206][ T796] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 335.209155][ T796] usb 5-1: config 0 descriptor?? [ 335.228246][ T9598] raw-gadget.3 gadget.4: fail, usb_ep_enable returned -22 [ 335.253278][ T9598] raw-gadget.3 gadget.4: fail, usb_ep_enable returned -22 [ 335.352202][ T796] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 335.618010][ T5937] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 335.624806][ T5937] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 335.630999][ T9598] ldusb 5-1:0.55: Write buffer overflow, 162 bytes dropped [ 335.631695][ T5937] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 335.651914][ T5888] usb 5-1: USB disconnect, device number 66 [ 335.663593][ T5937] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 335.663964][ T5888] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 335.674692][ T5937] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 335.687170][ T796] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 335.701174][ T5937] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 335.728627][ T5937] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 335.747288][ T9606] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 335.756192][ T9606] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 335.772105][ T5937] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 335.778521][ T5937] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 335.785240][ T5937] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 335.791509][ T5937] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 335.797889][ T5937] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 335.804165][ T5937] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 335.822219][ T9608] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1066'. [ 335.831160][ T5937] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 335.831588][ T5937] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 335.831995][ T5937] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 335.832399][ T5937] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 335.832792][ T5937] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 335.832849][ T5937] input input35: Timeout waiting for response from device. [ 335.848469][ T5937] usb 2-1: USB disconnect, device number 54 [ 335.909867][ T796] usb 4-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 335.922082][ T796] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 335.933943][ T796] usb 4-1: Product: syz [ 335.940462][ T796] usb 4-1: Manufacturer: syz [ 335.947064][ T796] usb 4-1: SerialNumber: syz [ 335.957981][ T796] usb 4-1: config 0 descriptor?? [ 336.757251][ T5896] IPVS: starting estimator thread 0... [ 336.842494][ T9632] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1073'. [ 336.853091][ T9632] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1073'. [ 336.863323][ T9629] IPVS: using max 56 ests per chain, 134400 per kthread [ 338.447636][ T5937] usb 4-1: USB disconnect, device number 58 [ 338.677088][ T9653] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 338.782390][ T9655] netlink: 112 bytes leftover after parsing attributes in process `syz.3.1081'. [ 338.832210][ T9653] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 339.018290][ T9660] binder_alloc: binder_alloc_mmap_handler: 9657 200000ffd000-200001000000 already mapped failed -16 [ 339.054372][ T5937] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 339.238884][ T5937] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 339.276579][ T5937] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 339.334144][ T5937] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 339.390461][ T5937] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 339.442540][ T5937] usb 4-1: New USB device found, idVendor=0bfd, idProduct=010c, bcdDevice=2d.16 [ 339.467434][ T5937] usb 4-1: New USB device strings: Mfr=28, Product=2, SerialNumber=3 [ 339.486876][ T5937] usb 4-1: Product: syz [ 339.497611][ T5937] usb 4-1: Manufacturer: syz [ 339.502259][ T5937] usb 4-1: SerialNumber: syz [ 339.577776][ T5937] usb 4-1: config 0 descriptor?? [ 339.601619][ T9671] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 339.653427][ T5937] kvaser_usb 4-1:0.0: CMD_MAP_CHANNEL_REQ failed for CAN0 [ 339.666591][ T9671] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 339.683988][ T9673] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 339.705707][ T5937] kvaser_usb 4-1:0.0: error -EMSGSIZE: Failed to initialize card [ 339.710803][ T9673] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 339.714559][ T5937] kvaser_usb 4-1:0.0: probe with driver kvaser_usb failed with error -90 [ 339.844006][ T5936] usb 5-1: new high-speed USB device number 67 using dummy_hcd [ 339.933403][ T9674] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 340.011885][ T9674] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 340.036349][ T5936] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 340.050588][ T5936] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 340.125571][ T5936] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 340.231104][ T5936] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 340.326409][ T5936] usb 5-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 340.360527][ T5936] usb 5-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 340.369160][ T5936] usb 5-1: Manufacturer: syz [ 340.377800][ T5936] usb 5-1: config 0 descriptor?? [ 340.726344][ T9688] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1090'. [ 340.989173][ T9694] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 341.001631][ T9694] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 341.021722][ T5936] appleir 0003:05AC:8243.001E: unknown main item tag 0x0 [ 341.054885][ T5936] appleir 0003:05AC:8243.001E: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.4-1/input0 [ 341.056954][ T9688] fuse: Bad value for 'user_id' [ 341.162368][ T30] audit: type=1326 audit(1774321777.253:283): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9679 comm="syz.1.1088" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f071dd9c799 code=0x0 [ 341.303959][ T9688] fuse: Bad value for 'user_id' [ 342.492546][ T5896] usb 4-1: USB disconnect, device number 59 [ 342.684349][ T5936] usb 5-1: reset high-speed USB device number 67 using dummy_hcd [ 342.844719][ T5936] usb 5-1: device descriptor read/64, error -32 [ 343.006478][ T5896] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 343.104371][ T5936] usb 5-1: reset high-speed USB device number 67 using dummy_hcd [ 343.179181][ T5896] usb 4-1: unable to get BOS descriptor or descriptor too short [ 343.199268][ T5896] usb 4-1: New USB device found, idVendor=200c, idProduct=100b, bcdDevice= 0.40 [ 343.209792][ T5896] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 343.227038][ T5896] usb 4-1: Product: syz [ 343.232385][ T5896] usb 4-1: Manufacturer: syz [ 343.246358][ T5936] usb 5-1: device descriptor read/64, error -32 [ 343.286761][ T5896] usb 4-1: SerialNumber: syz [ 343.484437][ T5936] usb 5-1: reset high-speed USB device number 67 using dummy_hcd [ 343.696239][ T5936] usb 5-1: device descriptor read/8, error -32 [ 343.771262][ T9708] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 343.791612][ T9708] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 344.094294][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 344.507505][ T980] usb 5-1: USB disconnect, device number 67 [ 344.750690][ T980] usb 5-1: new full-speed USB device number 68 using dummy_hcd [ 344.890092][ T9708] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 344.898851][ T9708] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 344.914294][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 344.916301][ T980] usb 5-1: unable to get BOS descriptor or descriptor too short [ 345.178292][ T980] usb 5-1: not running at top speed; connect to a high speed hub [ 345.218149][ T980] usb 5-1: too many configurations: 180, using maximum allowed: 8 [ 345.231425][ T980] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 345.241226][ T980] usb 5-1: can't read configurations, error -61 [ 345.291616][ T5896] usb 4-1: USB disconnect, device number 60 [ 345.529141][ T9732] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 345.532843][ T5822] udevd[5822]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 345.540859][ T9732] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 345.599316][ T980] usb 5-1: new full-speed USB device number 69 using dummy_hcd [ 345.839844][ T980] usb 5-1: unable to get BOS descriptor or descriptor too short [ 345.870157][ T980] usb 5-1: not running at top speed; connect to a high speed hub [ 345.897629][ T980] usb 5-1: too many configurations: 180, using maximum allowed: 8 [ 345.941678][ T980] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 345.963579][ T980] usb 5-1: can't read configurations, error -61 [ 345.984722][ T980] usb usb5-port1: attempt power cycle [ 346.023355][ T9744] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1103'. [ 347.264357][ T980] usb 5-1: new full-speed USB device number 70 using dummy_hcd [ 348.151678][ T980] usb 5-1: device descriptor read/8, error -71 [ 348.290661][ T30] audit: type=1326 audit(1774321784.403:284): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9764 comm="syz.2.1107" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f840339c799 code=0x0 [ 348.351780][ T9766] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 348.409354][ T9766] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 348.652671][ T9779] xt_recent: Unsupported userspace flags (000000de) [ 348.927718][ T5936] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 349.108594][ T5936] usb 2-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 349.117912][ T5936] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 349.129107][ T5936] usb 2-1: Product: syz [ 349.133330][ T5936] usb 2-1: Manufacturer: syz [ 349.139449][ T5936] usb 2-1: SerialNumber: syz [ 349.164405][ T5936] usb 2-1: config 0 descriptor?? [ 352.963467][ T796] usb 2-1: USB disconnect, device number 55 [ 353.046346][ T5896] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 353.058750][ T9818] netlink: 'syz.2.1121': attribute type 1 has an invalid length. [ 353.205488][ T5896] usb 4-1: Using ep0 maxpacket: 32 [ 353.217137][ T5896] usb 4-1: config index 0 descriptor too short (expected 14544, got 27) [ 353.246448][ T9818] bond7: entered promiscuous mode [ 353.261006][ T5896] usb 4-1: config 255 has too many interfaces: 231, using maximum allowed: 32 [ 353.276544][ T9818] 8021q: adding VLAN 0 to HW filter on device bond7 [ 353.303063][ T5896] usb 4-1: config 255 has an invalid descriptor of length 83, skipping remainder of the config [ 353.350159][ T5896] usb 4-1: config 255 has 0 interfaces, different from the descriptor's value: 231 [ 353.369374][ T5896] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 353.382169][ T5896] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 353.384589][ T9824] 8021q: adding VLAN 0 to HW filter on device bond8 [ 353.398888][ T9824] bond8: entered promiscuous mode [ 353.398982][ T5896] usb 4-1: Product: syz [ 353.404757][ T9824] bond7: (slave bond8): Enslaving as an active interface with an up link [ 353.410795][ T5896] usb 4-1: Manufacturer: syz [ 353.547346][ T5896] usb 4-1: SerialNumber: syz [ 353.814000][ T5896] usb 4-1: USB disconnect, device number 61 [ 354.498060][ T9850] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 354.513988][ T9851] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 354.528083][ T9850] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 354.539978][ T9851] team0: Port device batadv1 added [ 356.044371][ T5936] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 356.208780][ T5936] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 356.239290][ T5936] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 356.293580][ T5936] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 356.445972][ T5936] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 356.497011][ T5936] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 356.599682][ T5936] usb 2-1: config 0 descriptor?? [ 357.111818][ T5936] plantronics 0003:047F:FFFF.001F: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 357.418427][ T49] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 357.427356][ T49] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 357.452201][ T49] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 357.480526][ T49] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 357.558363][ T5937] usb 2-1: USB disconnect, device number 56 [ 358.164377][ T5937] usb 2-1: new full-speed USB device number 57 using dummy_hcd [ 358.215845][ T5936] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 358.401230][ T5937] usb 2-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 358.412642][ T5937] usb 2-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid wMaxPacketSize 0 [ 358.422529][ T5936] usb 4-1: unable to get BOS descriptor or descriptor too short [ 358.431450][ T5937] usb 2-1: config 0 interface 0 has no altsetting 0 [ 358.440018][ T5936] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 358.452909][ T5936] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 358.464381][ T5937] usb 2-1: New USB device found, idVendor=28de, idProduct=1102, bcdDevice= 0.00 [ 358.481282][ T5936] usb 4-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 358.492158][ T5937] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 358.500965][ T5936] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 358.514292][ T5936] usb 4-1: Product: syz [ 358.574991][ T5937] usb 2-1: config 0 descriptor?? [ 358.580141][ T5936] usb 4-1: Manufacturer: syz [ 358.586245][ T5936] usb 4-1: SerialNumber: syz [ 358.833212][ T9906] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 358.846415][ T9906] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 359.006946][ T5937] hid-steam 0003:28DE:1102.0020: unknown main item tag 0x0 [ 359.066461][ T5937] hid-steam 0003:28DE:1102.0020: unknown main item tag 0x0 [ 359.076485][ T5937] hid-steam 0003:28DE:1102.0020: unknown main item tag 0x0 [ 359.083790][ T5937] hid-steam 0003:28DE:1102.0020: unknown main item tag 0x0 [ 359.128384][ T5937] hid-steam 0003:28DE:1102.0020: unknown main item tag 0x0 [ 359.278237][ T5937] hid-steam 0003:28DE:1102.0020: hidraw0: USB HID v0.01 Device [HID 28de:1102] on usb-dummy_hcd.1-1/input0 [ 359.385046][ T5937] usb 2-1: USB disconnect, device number 57 [ 359.431072][ T9934] fido_id[9934]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 359.864032][ T9943] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 359.889954][ T9943] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 359.969563][ T9945] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 360.093636][ T9945] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 360.683361][ T9955] bond1 (unregistering): Released all slaves [ 360.941774][ T9961] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1165'. [ 361.160451][ T9963] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1165'. [ 361.175795][ T9961] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 361.334071][ T9961] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 361.486143][ T9963] netlink: 'syz.2.1165': attribute type 2 has an invalid length. [ 361.503641][ T9963] : entered promiscuous mode [ 361.510689][ T9969] netlink: 'syz.2.1165': attribute type 2 has an invalid length. [ 361.520735][ T9969] : left promiscuous mode [ 361.520763][ T9963] netlink: 'syz.2.1165': attribute type 2 has an invalid length. [ 362.080228][ T9978] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 362.110671][ T9978] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 362.372117][ T9976] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1168'. [ 362.838176][ T9989] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 362.917642][ T9989] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 362.968503][ T9989] dmxdev: DVB (dvb_dmxdev_filter_start): could not set feed [ 363.019932][ T9989] dvb_demux: dvb_demux_feed_del: feed not in list (type=1 state=0 pid=ffff) [ 363.046895][ T5896] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 363.108879][ T9989] io-wq is not configured for unbound workers [ 363.227043][ T5896] usb 2-1: Using ep0 maxpacket: 32 [ 363.252867][ T5896] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 363.276176][ T5896] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 363.290621][ T5896] usb 2-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 363.316664][ T9999] faux_driver vkms: [drm] Unknown color mode 6; guessing buffer size. [ 363.384152][ T5896] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 363.510892][ T5896] usb 2-1: config 0 descriptor?? [ 363.996346][ T5896] ft260 0003:0403:6030.0021: unknown main item tag 0x0 [ 364.013160][ T5896] ft260 0003:0403:6030.0021: unknown main item tag 0x0 [ 364.180741][ T5896] ft260 0003:0403:6030.0021: chip code: 0000 0000 [ 364.485913][ T5896] ft260 0003:0403:6030.0021: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.1-1/input0 [ 364.588308][T10021] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 364.638936][T10021] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 364.695635][ T5896] ft260 0003:0403:6030.0021: failed to retrieve status: -32, no wakeup [ 364.919374][ T5937] usb 2-1: USB disconnect, device number 58 [ 365.900391][T10039] netlink: 7276 bytes leftover after parsing attributes in process `syz.0.1188'. [ 365.987992][T10041] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 365.999742][T10041] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 367.137519][T10059] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 367.160665][T10059] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 367.900496][T10063] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 367.909762][T10063] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 368.260292][T10070] FAULT_INJECTION: forcing a failure. [ 368.260292][T10070] name failslab, interval 1, probability 0, space 0, times 0 [ 368.277002][ T5894] usb 2-1: new high-speed USB device number 59 using dummy_hcd [ 368.337376][T10070] CPU: 0 UID: 0 PID: 10070 Comm: syz.3.1196 Tainted: G L syzkaller #0 PREEMPT(full) [ 368.337405][T10070] Tainted: [L]=SOFTLOCKUP [ 368.337411][T10070] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 368.337425][T10070] Call Trace: [ 368.337489][T10070] [ 368.337521][T10070] dump_stack_lvl+0xe8/0x150 [ 368.337615][T10070] should_fail_ex+0x412/0x560 [ 368.337681][T10070] ? alloc_inode+0x6a/0x1b0 [ 368.337737][T10070] should_failslab+0xa8/0x100 [ 368.337757][T10070] kmem_cache_alloc_lru_noprof+0x87/0x640 [ 368.337771][T10070] ? simple_start_creating+0xcc/0x110 [ 368.337790][T10070] ? __pfx_debugfs_alloc_inode+0x10/0x10 [ 368.337813][T10070] alloc_inode+0x6a/0x1b0 [ 368.337826][T10070] new_inode+0x22/0x170 [ 368.337842][T10070] __debugfs_create_file+0xb8/0x400 [ 368.337855][T10070] debugfs_create_file_full+0x3f/0x60 [ 368.337867][T10070] ref_tracker_dir_debugfs+0x197/0x360 [ 368.337905][T10070] ? __pfx_ref_tracker_dir_debugfs+0x10/0x10 [ 368.337933][T10070] ? __kvmalloc_node_noprof+0x545/0x8a0 [ 368.337945][T10070] ? alloc_netdev_mqs+0xa6/0x11b0 [ 368.338010][T10070] ? __raw_spin_lock_init+0x45/0x100 [ 368.338038][T10070] alloc_netdev_mqs+0x272/0x11b0 [ 368.338050][T10070] ? __pfx_vti6_dev_setup+0x10/0x10 [ 368.338118][T10070] vti6_locate+0x5d4/0x780 [ 368.338133][T10070] ? __pfx_vti6_locate+0x10/0x10 [ 368.338143][T10070] ? vti6_siocdevprivate+0x575/0x7a0 [ 368.338160][T10070] vti6_siocdevprivate+0x5a3/0x7a0 [ 368.338176][T10070] ? __pfx_vti6_siocdevprivate+0x10/0x10 [ 368.338201][T10070] ? full_name_hash+0xb0/0xe0 [ 368.338219][T10070] dev_ifsioc+0xba6/0x1280 [ 368.338285][T10070] dev_ioctl+0x84c/0x1150 [ 368.338301][T10070] sock_ioctl+0x75f/0x7f0 [ 368.338342][T10070] ? __pfx_sock_ioctl+0x10/0x10 [ 368.338356][T10070] ? __fget_files+0x3a0/0x420 [ 368.338370][T10070] ? __fget_files+0x2a/0x420 [ 368.338385][T10070] ? bpf_lsm_file_ioctl+0x9/0x20 [ 368.338411][T10070] ? __pfx_sock_ioctl+0x10/0x10 [ 368.338423][T10070] __se_sys_ioctl+0xfc/0x170 [ 368.338436][T10070] do_syscall_64+0x14d/0xf80 [ 368.338506][T10070] ? trace_irq_disable+0x3b/0x150 [ 368.338527][T10070] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 368.338549][T10070] ? clear_bhb_loop+0x40/0x90 [ 368.338561][T10070] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 368.338573][T10070] RIP: 0033:0x7f0670f9c799 [ 368.338605][T10070] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 368.338613][T10070] RSP: 002b:00007f0671dfc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 368.338649][T10070] RAX: ffffffffffffffda RBX: 00007f0671215fa0 RCX: 00007f0670f9c799 [ 368.338656][T10070] RDX: 00002000000002c0 RSI: 00000000000089f1 RDI: 0000000000000003 [ 368.338663][T10070] RBP: 00007f0671dfc090 R08: 0000000000000000 R09: 0000000000000000 [ 368.338668][T10070] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 368.338675][T10070] R13: 00007f0671216038 R14: 00007f0671215fa0 R15: 00007f067133fa48 [ 368.338690][T10070] [ 368.338695][T10070] debugfs: out of free dentries, can not create file 'netdev@ffff88807c34c620' [ 368.676895][ T5894] usb 2-1: Using ep0 maxpacket: 16 [ 368.709568][ T5894] usb 2-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 368.728653][ T5894] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 368.740465][ T5894] usb 2-1: Product: syz [ 368.747576][ T5894] usb 2-1: Manufacturer: syz [ 368.752328][ T5894] usb 2-1: SerialNumber: syz [ 368.807350][ T5894] usb 2-1: config 0 descriptor?? [ 369.159305][T10089] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 369.169761][T10089] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 369.177562][ T5937] usb 5-1: new high-speed USB device number 72 using dummy_hcd [ 369.361521][ T5894] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 369.378863][ T5937] usb 5-1: Using ep0 maxpacket: 32 [ 369.391678][ T5894] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 369.400701][ T5937] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 369.406357][ T30] audit: type=1326 audit(1774321805.513:285): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10091 comm="syz.2.1204" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f840339c799 code=0x7ffc0000 [ 369.422781][ T5937] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 369.437505][ T30] audit: type=1326 audit(1774321805.513:286): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10091 comm="syz.2.1204" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f840339c799 code=0x7ffc0000 [ 369.471897][ T5894] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 369.481741][ T5894] usb 2-1: media controller created [ 369.526476][ T5894] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 369.532218][ T5937] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 369.565097][ T5937] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 369.598271][ T5937] usb 5-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 369.598441][ T5894] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 369.618749][ T5894] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 369.633220][ T5937] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 369.633254][ T30] audit: type=1326 audit(1774321805.513:287): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10091 comm="syz.2.1204" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f840339c799 code=0x7ffc0000 [ 369.718142][ T30] audit: type=1326 audit(1774321805.513:288): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10091 comm="syz.2.1204" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f840339c799 code=0x7ffc0000 [ 369.735055][ T5937] usb 5-1: Product: syz [ 369.766614][ T30] audit: type=1326 audit(1774321805.513:289): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10091 comm="syz.2.1204" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f840339c799 code=0x7ffc0000 [ 369.782191][ T5937] usb 5-1: Manufacturer: syz [ 369.801629][ T5937] usb 5-1: SerialNumber: syz [ 369.890310][ T5937] usb 5-1: config 0 descriptor?? [ 369.905645][ T30] audit: type=1326 audit(1774321805.513:290): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10091 comm="syz.2.1204" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f840339c799 code=0x7ffc0000 [ 369.908831][ T5894] usb 2-1: USB disconnect, device number 59 [ 369.928800][ T30] audit: type=1326 audit(1774321805.513:291): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10091 comm="syz.2.1204" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f840339c799 code=0x7ffc0000 [ 369.949033][ T30] audit: type=1326 audit(1774321805.513:292): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10091 comm="syz.2.1204" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f840339c799 code=0x7ffc0000 [ 370.032404][ T5894] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 370.097969][T10099] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 370.111012][T10099] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 370.139326][ T30] audit: type=1326 audit(1774321805.513:293): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10091 comm="syz.2.1204" exe="/root/syz-executor" sig=0 arch=c000003e syscall=326 compat=0 ip=0x7f840339c799 code=0x7ffc0000 [ 370.202032][ T30] audit: type=1326 audit(1774321805.513:294): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10091 comm="syz.2.1204" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f840339c799 code=0x7ffc0000 [ 370.334149][T10102] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 370.352574][T10102] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 371.082844][T10120] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 371.093754][T10120] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 371.226455][T10121] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 371.291089][T10121] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 371.412444][T10123] tunl0: Caught tx_queue_len zero misconfig [ 371.847583][ T980] usb 5-1: USB disconnect, device number 72 [ 371.970431][T10135] FAULT_INJECTION: forcing a failure. [ 371.970431][T10135] name fail_futex, interval 1, probability 0, space 0, times 1 [ 371.983458][T10135] CPU: 0 UID: 0 PID: 10135 Comm: syz.1.1216 Tainted: G L syzkaller #0 PREEMPT(full) [ 371.983488][T10135] Tainted: [L]=SOFTLOCKUP [ 371.983495][T10135] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 371.983506][T10135] Call Trace: [ 371.983515][T10135] [ 371.983523][T10135] dump_stack_lvl+0xe8/0x150 [ 371.983554][T10135] should_fail_ex+0x412/0x560 [ 371.983585][T10135] get_futex_key+0x1ac/0x1690 [ 371.983644][T10135] ? __pfx_get_futex_key+0x10/0x10 [ 371.983665][T10135] ? __lock_acquire+0x6b5/0x2cf0 [ 371.983697][T10135] futex_wake+0x114/0x580 [ 371.983721][T10135] ? __lock_acquire+0x6b5/0x2cf0 [ 371.983744][T10135] ? __pfx_futex_wake+0x10/0x10 [ 371.983771][T10135] ? exit_mm_release+0x1a/0x30 [ 371.983808][T10135] do_futex+0x395/0x420 [ 371.983829][T10135] ? __pfx_do_futex+0x10/0x10 [ 371.983848][T10135] ? __might_fault+0xaf/0x130 [ 371.983868][T10135] mm_release+0x103/0x290 [ 371.983887][T10135] exit_mm+0x51/0x220 [ 371.983900][T10135] ? unwind_deferred_task_exit+0x67/0xa0 [ 371.983920][T10135] do_exit+0x6a2/0x23c0 [ 371.983945][T10135] ? __pfx_do_exit+0x10/0x10 [ 371.983959][T10135] ? cgroup1_freezing+0x20/0x350 [ 371.983976][T10135] ? cgroup1_freezing+0x20/0x350 [ 371.983999][T10135] do_group_exit+0x21b/0x2d0 [ 371.984013][T10135] ? _raw_spin_unlock_irq+0x23/0x50 [ 371.984085][T10135] get_signal+0x1284/0x1330 [ 371.984121][T10135] arch_do_signal_or_restart+0xbc/0x830 [ 371.984149][T10135] ? __fget_files+0x3a0/0x420 [ 371.984173][T10135] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 371.984202][T10135] exit_to_user_mode_loop+0x86/0x480 [ 371.984218][T10135] ? rcu_is_watching+0x15/0xb0 [ 371.984240][T10135] do_syscall_64+0x32d/0xf80 [ 371.984260][T10135] ? trace_irq_disable+0x3b/0x150 [ 371.984283][T10135] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 371.984300][T10135] ? clear_bhb_loop+0x40/0x90 [ 371.984322][T10135] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 371.984340][T10135] RIP: 0033:0x7f071dd9c799 [ 371.984357][T10135] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 371.984372][T10135] RSP: 002b:00007f071bff6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000e8 [ 371.984392][T10135] RAX: fffffffffffffffc RBX: 00007f071e016180 RCX: 00007f071dd9c799 [ 371.984404][T10135] RDX: 0000000000000001 RSI: 0000200000000340 RDI: 000000000000000a [ 371.984415][T10135] RBP: 00007f071bff6090 R08: 0000000000000000 R09: 0000000000000000 [ 371.984425][T10135] R10: 0000000080000000 R11: 0000000000000246 R12: 0000000000000001 [ 371.984436][T10135] R13: 00007f071e016218 R14: 00007f071e016180 R15: 00007f071e13fa48 [ 371.984465][T10135] [ 373.785716][T10151] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 373.794626][T10151] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 374.297330][T10157] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 374.307486][T10157] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 375.171390][T10161] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 375.182820][T10161] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 375.910271][T10171] syzkaller0: entered promiscuous mode [ 375.932928][T10171] syzkaller0: entered allmulticast mode [ 376.494358][T10176] FAULT_INJECTION: forcing a failure. [ 376.494358][T10176] name failslab, interval 1, probability 0, space 0, times 0 [ 376.548915][T10176] CPU: 0 UID: 0 PID: 10176 Comm: syz.3.1229 Tainted: G L syzkaller #0 PREEMPT(full) [ 376.548952][T10176] Tainted: [L]=SOFTLOCKUP [ 376.548959][T10176] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 376.548969][T10176] Call Trace: [ 376.548976][T10176] [ 376.548984][T10176] dump_stack_lvl+0xe8/0x150 [ 376.549015][T10176] should_fail_ex+0x412/0x560 [ 376.549045][T10176] should_failslab+0xa8/0x100 [ 376.549070][T10176] __kmalloc_cache_noprof+0x88/0x660 [ 376.549091][T10176] ? nfnetlink_rcv+0xfe1/0x27b0 [ 376.549216][T10176] nfnetlink_rcv+0xfe1/0x27b0 [ 376.549272][T10176] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 376.549309][T10176] ? ref_tracker_free+0x693/0x840 [ 376.549357][T10176] ? __netlink_deliver_tap+0x807/0x850 [ 376.549451][T10176] ? netlink_deliver_tap+0x2e/0x1b0 [ 376.549493][T10176] netlink_unicast+0x80f/0x9b0 [ 376.549526][T10176] ? __pfx_netlink_unicast+0x10/0x10 [ 376.549551][T10176] ? netlink_sendmsg+0x650/0xb40 [ 376.549566][T10176] ? skb_put+0x11b/0x210 [ 376.549619][T10176] netlink_sendmsg+0x813/0xb40 [ 376.549646][T10176] ? __pfx_netlink_sendmsg+0x10/0x10 [ 376.549665][T10176] ? aa_sock_msg_perm+0xf1/0x1b0 [ 376.549767][T10176] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 376.549791][T10176] ____sys_sendmsg+0x972/0x9f0 [ 376.549820][T10176] ? __pfx_____sys_sendmsg+0x10/0x10 [ 376.549849][T10176] ? import_iovec+0x73/0xa0 [ 376.549898][T10176] ___sys_sendmsg+0x2a5/0x360 [ 376.549925][T10176] ? __pfx____sys_sendmsg+0x10/0x10 [ 376.549986][T10176] ? __fget_files+0x2a/0x420 [ 376.550009][T10176] ? __fget_files+0x3a0/0x420 [ 376.550044][T10176] __x64_sys_sendmsg+0x1bd/0x2a0 [ 376.550068][T10176] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 376.550096][T10176] ? __pfx_ksys_write+0x10/0x10 [ 376.550135][T10176] do_syscall_64+0x14d/0xf80 [ 376.550155][T10176] ? trace_irq_disable+0x3b/0x150 [ 376.550178][T10176] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 376.550195][T10176] ? clear_bhb_loop+0x40/0x90 [ 376.550216][T10176] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 376.550233][T10176] RIP: 0033:0x7f0670f9c799 [ 376.550249][T10176] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 376.550263][T10176] RSP: 002b:00007f0671dfc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 376.550281][T10176] RAX: ffffffffffffffda RBX: 00007f0671215fa0 RCX: 00007f0670f9c799 [ 376.550292][T10176] RDX: 0000000024000800 RSI: 0000200000009b40 RDI: 0000000000000003 [ 376.550304][T10176] RBP: 00007f0671dfc090 R08: 0000000000000000 R09: 0000000000000000 [ 376.550314][T10176] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 376.550324][T10176] R13: 00007f0671216038 R14: 00007f0671215fa0 R15: 00007f067133fa48 [ 376.550352][T10176] [ 376.970689][ T796] hid-generic 0000:0000:0000.0022: unknown main item tag 0x0 [ 376.999669][ T796] hid-generic 0000:0000:0000.0022: hidraw0: HID v0.00 Device [syz1] on syz0 [ 377.011870][T10180] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 377.091050][T10180] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 377.237542][T10184] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 377.255694][T10184] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 377.525049][ T980] usb 2-1: new high-speed USB device number 60 using dummy_hcd [ 377.686685][ T980] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 377.705075][ T980] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 377.721390][ T980] usb 2-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 377.741372][ T980] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 377.764684][ T980] usb 2-1: config 0 descriptor?? [ 378.203162][ T980] playstation 0003:054C:0DF2.0023: item fetching failed at offset 4/5 [ 378.216663][ T31] INFO: task kworker/1:1:29 blocked for more than 143 seconds. [ 378.224238][ T31] Tainted: G L syzkaller #0 [ 378.230819][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 378.240553][ T980] playstation 0003:054C:0DF2.0023: Parse failed [ 378.246896][ T31] task:kworker/1:1 state:D stack:20680 pid:29 tgid:29 ppid:2 task_flags:0x4288060 flags:0x00080000 [ 378.259509][ T980] playstation 0003:054C:0DF2.0023: probe with driver playstation failed with error -22 [ 378.271887][ T31] Workqueue: usb_hub_wq hub_event [ 378.277184][ T31] Call Trace: [ 378.280471][ T31] [ 378.283409][ T31] __schedule+0x15dd/0x52d0 [ 378.288016][ T31] ? __lock_acquire+0x6b5/0x2cf0 [ 378.292966][ T31] ? __lock_acquire+0x6b5/0x2cf0 [ 378.298028][ T31] ? __bfs+0x153/0x290 [ 378.302113][ T31] ? check_path+0x21/0x40 [ 378.306626][ T31] ? check_noncircular+0xda/0x150 [ 378.311729][ T31] ? __pfx___schedule+0x10/0x10 [ 378.316636][ T31] ? schedule+0x90/0x360 [ 378.320894][ T31] schedule+0x164/0x360 [ 378.325105][ T31] schedule_timeout+0xc3/0x2c0 [ 378.329887][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 378.335315][ T31] ? do_raw_spin_lock+0x12b/0x2f0 [ 378.340350][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 378.345595][ T31] ? wait_for_completion+0x274/0x5e0 [ 378.350899][ T31] wait_for_completion+0x2cc/0x5e0 [ 378.356144][ T31] ? __pfx_wait_for_completion+0x10/0x10 [ 378.361979][ T31] i2c_del_adapter+0x5c0/0x790 [ 378.366884][ T31] ? __pfx_i2c_del_adapter+0x10/0x10 [ 378.372183][ T31] ? kernfs_put+0x40e/0x470 [ 378.377006][ T31] ? sysfs_remove_group+0x23d/0x2e0 [ 378.382226][ T31] ? __pfx_ft260_remove+0x10/0x10 [ 378.387370][ T31] ft260_remove+0x5d/0x80 [ 378.391706][ T31] hid_device_remove+0x228/0x370 [ 378.396760][ T31] ? __pfx_hid_device_remove+0x10/0x10 [ 378.402034][ T5896] usb 2-1: USB disconnect, device number 60 [ 378.402233][ T31] device_release_driver_internal+0x46f/0x870 [ 378.414590][ T31] bus_remove_device+0x455/0x570 [ 378.419755][ T31] ? __pfx_bus_remove_device+0x10/0x10 [ 378.425290][ T31] device_del+0x527/0x8f0 [ 378.429646][ T31] ? lockdep_hardirqs_on+0x7a/0x110 [ 378.435043][ T31] ? __pfx_device_del+0x10/0x10 [ 378.439908][ T31] ? do_raw_spin_lock+0x12b/0x2f0 [ 378.445075][ T31] hid_destroy_device+0x6b/0x1b0 [ 378.450033][ T31] usbhid_disconnect+0x9f/0xc0 [ 378.454992][ T31] usb_unbind_interface+0x26e/0x910 [ 378.460210][ T31] ? __pfx_usb_unbind_interface+0x10/0x10 [ 378.466125][ T31] device_release_driver_internal+0x4d9/0x870 [ 378.472217][ T31] bus_remove_device+0x455/0x570 [ 378.477384][ T31] ? __pfx_bus_remove_device+0x10/0x10 [ 378.482867][ T31] device_del+0x527/0x8f0 [ 378.487416][ T31] ? __pfx_device_del+0x10/0x10 [ 378.492287][ T31] ? kobject_put+0x51d/0x560 [ 378.497025][ T31] usb_disable_device+0x3d4/0x8d0 [ 378.502062][ T31] usb_disconnect+0x32f/0x990 [ 378.506799][ T31] hub_event+0x1cc9/0x4f30 [ 378.511234][ T31] ? __lock_acquire+0x6b5/0x2cf0 [ 378.516379][ T31] ? __pfx_hub_event+0x10/0x10 [ 378.521162][ T31] ? process_scheduled_works+0xa8d/0x18c0 [ 378.527045][ T31] ? process_scheduled_works+0xa8d/0x18c0 [ 378.532779][ T31] process_scheduled_works+0xb6e/0x18c0 [ 378.538829][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 378.544973][ T31] ? assign_work+0x3d5/0x5e0 [ 378.549617][ T31] worker_thread+0xa53/0xfc0 [ 378.554218][ T31] kthread+0x388/0x470 [ 378.558375][ T31] ? __pfx_worker_thread+0x10/0x10 [ 378.563494][ T31] ? __pfx_kthread+0x10/0x10 [ 378.568128][ T31] ret_from_fork+0x51e/0xb90 [ 378.572752][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 378.577894][ T31] ? __switch_to+0xc7d/0x1450 [ 378.582576][ T31] ? __pfx_kthread+0x10/0x10 [ 378.587186][ T31] ret_from_fork_asm+0x1a/0x30 [ 378.591980][ T31] [ 378.595362][ T31] [ 378.595362][ T31] Showing all locks held in the system: [ 378.603153][ T31] 6 locks held by kworker/1:1/29: [ 378.614760][ T31] #0: ffff8880212cb548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa52/0x18c0 [ 378.626514][ T31] #1: ffffc90000a57c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa8d/0x18c0 [ 378.638507][ T31] #2: ffff8880292481e0 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 [ 378.647437][ T31] #3: ffff888057a911e0 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0xf8/0x990 [ 378.656619][ T31] #4: ffff888057a951a8 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb6/0x870 [ 378.667203][ T31] #5: ffff88806bf9da68 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb6/0x870 [ 378.677823][ T31] 1 lock held by khungtaskd/31: [ 378.682664][ T31] #0: ffffffff8e75e5e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 378.692580][ T31] 3 locks held by kworker/u8:9/3472: [ 378.697887][ T31] #0: ffff88813fe4c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa52/0x18c0 [ 378.709555][ T31] #1: ffffc9000cf5fc40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0xa8d/0x18c0 [ 378.720591][ T31] #2: ffffffff8fbcea08 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 [ 378.729760][ T31] 2 locks held by getty/5582: [ 378.734464][ T31] #0: ffff888036cd20a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 378.744475][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 [ 378.754719][ T31] 2 locks held by syz.2.1224/10159: [ 378.759934][ T31] #0: ffff888054f53b88 (&sb->s_type->i_mutex_key#14){+.+.}-{4:4}, at: sock_close+0x9b/0x240 [ 378.770225][ T31] #1: ffffffff8fbcea08 (rtnl_mutex){+.+.}-{4:4}, at: raw_release+0x1bc/0xa10 [ 378.779255][ T31] 2 locks held by syz.4.1228/10170: [ 378.784604][ T31] #0: ffffffff8fbcea08 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 378.793663][ T31] #1: ffffffff8e764878 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2d0/0x770 [ 378.804755][ T31] 2 locks held by syz.0.1232/10183: [ 378.809951][ T31] #0: ffffffff9011ec80 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 [ 378.819458][ T31] #1: ffffffff8fbcea08 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a1/0x1be0 [ 378.834588][ T31] [ 378.836932][ T31] ============================================= [ 378.836932][ T31] [ 378.850264][ T31] NMI backtrace for cpu 0 [ 378.850283][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 378.850306][ T31] Tainted: [L]=SOFTLOCKUP [ 378.850312][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 378.850318][ T31] Call Trace: [ 378.850323][ T31] [ 378.850328][ T31] dump_stack_lvl+0xe8/0x150 [ 378.850347][ T31] nmi_cpu_backtrace+0x274/0x2d0 [ 378.850420][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 378.850435][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 378.850450][ T31] sys_info+0x135/0x170 [ 378.850462][ T31] watchdog+0xfd9/0x1030 [ 378.850484][ T31] ? watchdog+0x21a/0x1030 [ 378.850501][ T31] kthread+0x388/0x470 [ 378.850512][ T31] ? __pfx_watchdog+0x10/0x10 [ 378.850525][ T31] ? __pfx_kthread+0x10/0x10 [ 378.850534][ T31] ret_from_fork+0x51e/0xb90 [ 378.850548][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 378.850559][ T31] ? __switch_to+0xc7d/0x1450 [ 378.850572][ T31] ? __pfx_kthread+0x10/0x10 [ 378.850582][ T31] ret_from_fork_asm+0x1a/0x30 [ 378.850602][ T31] [ 378.850610][ T31] Sending NMI from CPU 0 to CPUs 1: [ 378.858837][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.858889][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.983431][ C1] NMI backtrace for cpu 1 [ 378.983451][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G L syzkaller #0 PREEMPT(full) [ 378.983470][ C1] Tainted: [L]=SOFTLOCKUP [ 378.983476][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 378.983485][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 378.983508][ C1] Code: 6e 6c 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d e3 b2 1a 00 fb f4 fc e9 02 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 [ 378.983521][ C1] RSP: 0018:ffffc90000197e20 EFLAGS: 00000246 [ 378.983535][ C1] RAX: 0000000000749cc5 RBX: ffffffff819a913a RCX: 0000000080000001 [ 378.983546][ C1] RDX: 0000000000000001 RSI: ffffffff8def8cb4 RDI: ffffffff8c27c900 [ 378.983556][ C1] RBP: ffffc90000197f10 R08: ffff8880b873399b R09: 1ffff110170e6733 [ 378.983566][ C1] R10: dffffc0000000000 R11: ffffed10170e6734 R12: 0000000000000001 [ 378.983576][ C1] R13: 1ffff11003ad8000 R14: 0000000000000001 R15: 1ffff11003ad8000 [ 378.983587][ C1] FS: 0000000000000000(0000) GS:ffff88812555d000(0000) knlGS:0000000000000000 [ 378.983598][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 378.983608][ C1] CR2: 000000110c3edb11 CR3: 00000000756ee000 CR4: 00000000003526f0 [ 378.983621][ C1] Call Trace: [ 378.983628][ C1] [ 378.983633][ C1] default_idle+0x9/0x20 [ 378.983652][ C1] default_idle_call+0x72/0xb0 [ 378.983671][ C1] do_idle+0x36a/0x5f0 [ 378.983690][ C1] ? asm_sysvec_call_function_single+0x1a/0x20 [ 378.983709][ C1] ? __pfx_do_idle+0x10/0x10 [ 378.983737][ C1] cpu_startup_entry+0x43/0x60 [ 378.983757][ C1] start_secondary+0x101/0x110 [ 378.983774][ C1] common_startup_64+0x13e/0x147 [ 378.983796][ C1] [ 378.985248][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 378.985271][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 378.985295][ T31] Tainted: [L]=SOFTLOCKUP [ 378.985302][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 378.985312][ T31] Call Trace: [ 378.985320][ T31] [ 378.985327][ T31] vpanic+0x56c/0xa60 [ 378.985355][ T31] ? __pfx___schedule+0x10/0x10 [ 378.985375][ T31] ? __pfx_vpanic+0x10/0x10 [ 378.985406][ T31] panic+0xc5/0xd0 [ 378.985429][ T31] ? __pfx_panic+0x10/0x10 [ 378.985454][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 378.985478][ T31] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 378.985507][ T31] watchdog+0x1023/0x1030 [ 378.985538][ T31] ? watchdog+0x21a/0x1030 [ 378.985570][ T31] kthread+0x388/0x470 [ 378.985591][ T31] ? __pfx_watchdog+0x10/0x10 [ 378.985615][ T31] ? __pfx_kthread+0x10/0x10 [ 378.985634][ T31] ret_from_fork+0x51e/0xb90 [ 378.985660][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 378.985682][ T31] ? __switch_to+0xc7d/0x1450 [ 378.985704][ T31] ? __pfx_kthread+0x10/0x10 [ 378.985722][ T31] ret_from_fork_asm+0x1a/0x30 [ 378.985761][ T31] [ 379.274149][ T31] Kernel Offset: disabled [ 379.278461][ T31] Rebooting in 86400 seconds..