last executing test programs: 37.845997782s ago: executing program 3 (id=515): connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x0, 0x8, 0x8001, 0x0, 0xaf, 0x0, 0xfffffe0000000001, 0x7, 0xffffffff}, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040301, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000500)={0x0, 0xfffffffffffffd83, 0xfa00, {0x1000000000000, 0x0}}, 0xfdbc) openat$sndseq(0xffffffffffffff9c, 0x0, 0x1afa41) ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0) 37.142115742s ago: executing program 3 (id=516): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000cc0)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000d00)='./sec\x00', &(0x7f0000000d40)='securityfs\x00', 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000f80)={0x7, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000fc0)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000001000)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001040)={0xffffffffffffffff}) connect$unix(r2, &(0x7f0000001080)=@abs, 0x6e) recvmmsg(r2, &(0x7f0000001140), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000001180)=0x6) timer_create(0x3, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000011c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000001240)=ANY=[@ANYBLOB="2c00000026000506"], 0x2c}}, 0x800) recvmmsg(r3, &(0x7f0000001280), 0x318, 0xfc0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="050000000100000004000000080000", @ANYRES32, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) write(0xffffffffffffffff, 0x0, 0x0) ptrace(0x4206, r0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r4, &(0x7f0000000d80)={0xa, 0x4e23, 0x0, @loopback, 0x3}, 0x7e) sendto$inet6(r4, &(0x7f0000000dc0)='X', 0x34000, 0xe0, &(0x7f0000000e00)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000e40)={0x0, @in6={{0xa, 0x4e23, 0x7fff, @loopback, 0x7ffffffd}}, 0x2, 0x0, 0xe457, 0x0, 0xa, 0x6}, 0x9c) tkill(r0, 0x12) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x4, 0xe, &(0x7f00000000c0)=ANY=[], &(0x7f0000000b40)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000b80), 0x8, 0x10, &(0x7f0000000bc0), 0x10}, 0x94) 36.589402416s ago: executing program 0 (id=520): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) openat$tun(0xffffffffffffff9c, 0x0, 0xa000, 0x0) r0 = getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) symlink(0x0, &(0x7f0000000240)='./file0\x00') connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_TSINFO_GET(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x50}, 0x40) recvmmsg(0xffffffffffffffff, &(0x7f0000002f00)=[{{0x0, 0x0, 0x0}, 0xff}], 0x1, 0x100, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) r4 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) keyctl$dh_compute(0x17, &(0x7f00000003c0), &(0x7f0000000480)=""/133, 0x85, &(0x7f0000000640)={0x0, &(0x7f0000000580)="17e0fbfa1cd0113367a30dc17913a6baa401add72c6476e9fa079fa52bb65d180f077f7eecdccb4727dfd20578aad9f306ea71b3203a9a691bdeda9149024ca4af6da29f18ecaa1bd99639a25f914583293891bc8d4bf383942854f25d1bc952a06f575f45eaf843984940ff20d3b0987a16ff81d16e3bc94f032333aba00aaf99537847d31af9ffc897acb0ef3942f496aa0c8c5cc7ba157bbcf744ccf78f5ecdb254c5a3c4ab1dca2b1ee2195ea26e6a2229", 0xb3}) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x4, 0x0, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_GET_EVENT(r4, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x3, 0xc41, 0x0, 0x0, 0x1000, 0x7, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) r8 = shmget$private(0x0, 0x4000, 0x20, &(0x7f0000409000/0x4000)=nil) shmat(r8, &(0x7f0000ff9000/0x1000)=nil, 0x4000) shmdt(0x0) syz_ublk_setup_queues(r7, r5, 0x0, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x53b2, 0x8, 0x1000000, 0x2033f, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffffff, 0x2000, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9b59, 0x2000, 0x100}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6d1f, 0x8000, 0x5, 0xdfffffff}}], 0x1, 0x0, 0x0) 36.078523067s ago: executing program 3 (id=524): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000001c0)={'netdevsim0\x00', 0x0}) 35.636302714s ago: executing program 3 (id=527): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x1c, 0x1e, 0x21, 0x0, 0x0, {0x7}, [@typed={0x8, 0x5, 0x0, 0x0, @ipv4=@broadcast}]}, 0x1c}}, 0x0) 35.317130809s ago: executing program 3 (id=528): r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='coredump_filter\x00') write$cgroup_int(r0, &(0x7f0000000100)=0xffff, 0x12) 35.029252701s ago: executing program 3 (id=532): r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000480), 0x801, 0x0) write$rfkill(r0, &(0x7f00000004c0)={0x0, 0x1, 0x3, 0x3, 0xfd}, 0x8) write$rfkill(r0, &(0x7f0000000580)={0x6, 0x0, 0x3, 0x0, 0x1}, 0x8) 32.527622384s ago: executing program 0 (id=541): futex(0x0, 0x80000000000b, 0x1, 0x0, 0x0, 0x0) r0 = socket(0x2, 0x2, 0x1) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r0, 0x8983, &(0x7f0000000000)={0x1, 'vlan1\x00', {}, 0x5832}) syz_emit_ethernet(0x66, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) r1 = memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x3) execveat(r1, 0x0, 0x0, 0x0, 0x1000) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) socket$inet(0x2, 0x2, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x2, 0x0, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$BTRFS_IOC_BALANCE(r0, 0x5000940c, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x40}}, 0x10) connect$inet(r3, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) syz_usb_connect(0x2, 0xb3, &(0x7f00000002c0)=ANY=[@ANYBLOB="12010002ef0201406d0425080001000000010902a1000201008032080100020e03000009040000000e0100000d240100012700006cdc020101112402010102", @ANYRES16=r2], 0x0) sendmmsg$inet(r3, &(0x7f0000004d00)=[{{0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x400000000000284, 0xf00) 30.527975371s ago: executing program 1 (id=546): mount(0x0, &(0x7f00000005c0)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/devices/system/clocksource/clocksource0/available_clocksource\x00', 0x0, 0x0) read(r0, &(0x7f00000006c0)=""/256, 0x100) 30.444390435s ago: executing program 4 (id=547): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000480)='./sys\x00', &(0x7f00000004c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/rtc/rtc0/wakealarm\x00', 0x2, 0x0) write(r0, &(0x7f0000000540)='+5', 0x2) 29.949172355s ago: executing program 1 (id=548): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000840)={0x54, 0x9, 0x6, 0x3, 0x0, 0x0, {0xa}, [@IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x5064}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x810}, 0x20004000) 29.781014495s ago: executing program 4 (id=549): mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0x100) mount$9p_virtio(&(0x7f00000004c0), &(0x7f0000000500)='./file0\x00', &(0x7f0000000540), 0x0, 0x0) chdir(&(0x7f0000000580)='./file0\x00') r0 = creat(&(0x7f00000005c0)='./file1\x00', 0x0) io_setup(0x200, &(0x7f0000000600)=0x0) io_submit(r1, 0x1, &(0x7f0000000640)=[&(0x7f0000000680)={0x25, 0x0, 0x2, 0x1, 0x0, r0, 0x0}]) 29.040746184s ago: executing program 1 (id=550): r0 = socket$rxrpc(0x21, 0x2, 0x2) socket(0x10, 0x3, 0x0) creat(&(0x7f0000000080)='./file1\x00', 0x31) creat(&(0x7f0000000100)='./bus\x00', 0x0) setsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000540)={{{@in=@local, @in6=@ipv4={'\x00', '\xff\xff', @broadcast}, 0x4e20, 0x0, 0x4e24, 0x80, 0x2, 0xa0, 0xa0, 0x29}, {0x104, 0x5, 0x3, 0x9, 0x0, 0x2000002, 0x9, 0x4}, {0x401, 0x5, 0x6, 0x2}, 0x0, 0xfffffffe, 0x2, 0x0, 0x2, 0x3}, {{@in6=@remote, 0x4d4, 0x32}, 0x2, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x3505, 0x0, 0x1, 0x9, 0x8, 0x0, 0x6}}, 0xe8) r1 = syz_io_uring_setup(0x2d64, &(0x7f0000000640)={0x0, 0x8210, 0x2, 0x0, 0x42}, 0x0, &(0x7f0000000700), &(0x7f0000000740)) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r1, 0x6, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000800), 0x0}, 0x20) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000140)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3000002, 0x204031, 0xffffffffffffffff, 0xe60d3000) r3 = socket$igmp6(0xa, 0x3, 0x2) getsockopt$MRT6(r3, 0x29, 0xce, 0x0, 0x0) bind$rxrpc(r0, &(0x7f0000000000)=@in4={0x21, 0x1234, 0x2, 0x10, {0x2, 0x5678, @empty}}, 0x62) listen(r0, 0x1) recvmsg(r0, &(0x7f0000000900)={0x0, 0x0, 0x0}, 0x0) 28.62477632s ago: executing program 2 (id=551): socket$nl_xfrm(0x10, 0x3, 0x6) socket$netlink(0x10, 0x3, 0x8000000004) r0 = request_key(&(0x7f0000000180)='encrypted\x00', &(0x7f00000001c0)={'syz', 0x3}, &(0x7f0000000340)='-*.\x00', 0x0) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000040)={r0}, &(0x7f00000003c0)=ANY=[@ANYBLOB="656e633d72617720686173683d7374726565626f673235362d67656e6572696300000000000000000000000000000000000000000000000000377ba3fbb522a4ce00c900"/87], 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)={0x50, 0x9, 0x6, 0x201, 0x0, 0x0, {0x15}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_ETHER={0xa, 0x11, @random="000300"}, @IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @loopback}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x3004c047}, 0x4000050) 28.480768176s ago: executing program 4 (id=552): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000040000000f"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0x14, &(0x7f0000000ac0)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r1 = syz_open_dev$radio(&(0x7f0000000c00), 0x2, 0x2) ioctl$VIDIOC_S_CTRL(r1, 0xc008561c, &(0x7f0000000c40)={0xf0f041}) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='clear_refs\x00') syz_io_uring_setup(0xefe, 0x0, 0x0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000940)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x958dac72f643fe2c, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) writev(r2, &(0x7f0000000080), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000700)='./proc\x00', &(0x7f0000000740)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f00000007c0)='27', 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r2, 0x89f0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000340)={0x0, 0x0}, 0x8) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1a, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1a, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r3, 0x4}, 0x94) 27.884363796s ago: executing program 2 (id=553): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f00000000c0)=0x9, 0x4) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x2006}, 0x1c) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4e22, 0x6, @ipv4={'\x00', '\xff\xff', @empty}, 0x4c}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='vlan0\x00', 0x10) sendmmsg$inet(r0, &(0x7f0000000200)=[{{0x0, 0x0, &(0x7f00000002c0)=[{0x0}], 0x1}}, {{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000380)="fa", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000400)="f69b20a3ba24bb315845da543a79f646fd8b8d808e30f8eb84b21b5624586fa4479c011b38c5ec1763292dd6f4ef83193e1c619d5dc6bdffa8863cfc3a0e5fb5f5343697a045037183a7a456c256528a961c79eeeb2339543cfd97c02e3fd7f83cff950e1b14860bb5d7446744445a7a3d8d959f77042a8a4c911b63903d14595bb9af5c2989cb5675358e0f6e24b47635ac66cab06afc94c546d5d2ed06bee5d90ebee6ac91266e3b7b5c6721bd0205cf854d1692ecc90e768acfed251d43d11ca26b5b6b73b5cf20b2a398153fbb892f1ccb6b75f6546cf896fc65ef692096171c92266b12ad6f027df68332a3b32cfb23af44a45134b7135725c99e1a4441b53bc6af616ccace666d6ceb27e93d6e859dec250f865c32fa52f3fe147549eb0620d8fe71acc91ba85821fb0333b5b5667d4311bde3a191f663d2ee7505f3b29f0dcb11618deb15ef7ef7176831b6653a419631e08833efacb649c0b58a753c70feb02cf0ca4277e7f565583ec7b0d5a0e5a8ad2aa668009ae199034544dac1fc963fff1d3587eecddafaa4ab85433abcdb43fa2f94515749a2f059a579576c2bef375c87e98bd3fad249ff7cd2c0b438ce676945579bc22829a7cee09f009f8d7579d445f86cd0d54f77f419438489eac40f2ec93892f43208e40b129c13086b79c909adcddac6425fe20a6b17f44953afcd02d0371c1b6677f141e7b969c0e12fb235713ae5c6f64073b3e96b28dd1a1ad3926c605e51562aecc2c48a550469acf705bd7ea5119da3eda5d1228eabc09bae6b1da2700edf46b9b7dfe9d05834a17dbfd5e3738c6b53a075f8d20c8074f8e2555c1db8e5f97c2188c48e19ac005be450559bba8c35870b8339abd072c8fd7e3f5ce8b5c72a024b8ab0ae6cf772a200e07216becc2ac8b78ef2c85d19dd5e349dc5db3430750ad735b30b3a396ef372e3403206d4feedf9b2b0f703ee88a5de2380c03ec7d09292773f53cafdb4cedd837ecc63509a6c90eb133b1a3e2c2215f1d96f83b861f0b307312d9ddf439a2139b8948f0729c0175230c71349b4d1437a74a9629f0d1731cf102afdcd5811967a93f7a55796c2df12ffeabe39462e4544213b495b50c62d98d02d3c457f86763f06222f7f04f9c202027f13852134176cfc12eb9da79a09dd0ff2b9a6c753c2197dca12728bd5c9ec5a9215cb7ce3e522100a9b86e4911d3f903c13c1bc3ba844c127ec1f526568497102fd9f4aed80f4d6b2cdb4df288620f98297d693a0fcefec26045e1f4bfe4fbd6663d275b5b4bec414a7b42ffcb62d94e67bfd27a96f952ab1f024ae6c2140666970757a0424536c7422b28b47adae3c253473ec39d1cfedc23726bc36ead13fef296be35c7b072ae6cdfd323470d630edfc17d46c213226605e51935c945e8d75685aba869550ce09ebd8aa1a1abdcc88333e39ec2ecb63ff7d5c715617ada1d1de369cbf7bdcd12fb9cd803d91bfb100894bafbf038a3c8d0b1eabc8ba46db54b7270a8fb43f7798166287e805d59f16877effea3ec43ad7d92efc89a474f5033b0c559555925099e578ea7c17b1a5c353f6fa2e18575cf5d092c6574407aab91a2edc8fcd14a41f7842493e282cd3c706664b41f33e727bc36b57ccce5742872d5772410c19925c34e3a4d902de388ebf9873f3758aa237a01308d071ae00a067f0f509feccb3e396e9a1d0f4e6cf801670d15e557aee2600573a96cbe7590d97fd716a782eb7a389612908c09b7fabe79b0ee43ded1ee8b2f7c5eac2629f8d07da750809e70d5b90d35b6a914769c8aed64d2d6ad683d4deeac5a3cdcab5cf76bce4170fae8ba2c74eef04cd56016ccf93047a43f9a83480533a1129a4fbcc3eb56ec4b1dcfac0466d0e5ed0ec747934fac12bc96dd407a040239e3b359cb25f3c4f4364b26e9d76e6452e58b49ef2d1941eec0fe88af6f07c3bc98f169b64fd992540733a92a6512158f3f01434e7fe9ab452ced437d39f7c3c0c412aace64d289b62aef0515e196a0561aade49fc2ef5aa345a89e3a4cfc0b86ec55c714d593b7c59158694", 0x5b5}], 0x1}}], 0x3, 0x119e75c40673edef) 27.670055917s ago: executing program 1 (id=554): r0 = openat$ttynull(0xffffffffffffff9c, &(0x7f00000000c0), 0x88002, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0xd) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu\x00', 0x275a, 0x0) fcntl$lock(r1, 0x6, &(0x7f0000000000)={0x0, 0x0, 0x8}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x2da, &(0x7f00000005c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3d}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8001, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000080)={0x2, 0x0, [{0x10, 0x0, 0x4}, {0x10, 0x0, 0x8}]}) sched_setscheduler(0x0, 0x5, &(0x7f0000000080)=0x7) bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) socket$inet_udp(0x2, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getsockopt$SO_TIMESTAMP(0xffffffffffffffff, 0x1, 0x40, 0x0, &(0x7f0000000140)) r6 = socket(0x21, 0x2, 0x10000000000002) sendmmsg(r6, &(0x7f0000000180)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="100000001001000001"], 0x10, 0xe000}, 0x5}], 0x1, 0x0) r7 = open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x80) ftruncate(r7, 0x2007ffb) sendfile(r0, r7, 0x0, 0x1000000201002) 27.245202982s ago: executing program 2 (id=555): mkdir(&(0x7f0000000080)='mnt\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='mnt\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) syz_usb_connect(0x2, 0x39, &(0x7f0000000140)=ANY=[], &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f00000001c0)='mnt/ttyUSB0\x00', 0x44002, 0x0) 27.241666749s ago: executing program 4 (id=556): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/ttyS0\x00', 0x2, 0x30) ioctl$TCSETAW(r0, 0x5453, 0x0) 24.269422559s ago: executing program 0 (id=557): syz_emit_ethernet(0x3e, &(0x7f0000000ac0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd606410a6000800fffc020000000000000000000000000000ff020000000000"], 0x0) 24.097132787s ago: executing program 4 (id=558): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x40040}, 0x4000000) r2 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800c0001006d6163766c616e000400028008000500", @ANYRES32=r3, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r6], 0x44}}, 0x0) r7 = socket$kcm(0x10, 0x2, 0x0) r8 = socket(0x1, 0x803, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="540000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800e0001006970366772657461700000001800028014000700ff01000000000000000000000000000108000a00", @ANYRES32=r10], 0x54}}, 0x0) sendmsg$kcm(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0) 23.959248813s ago: executing program 0 (id=559): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000480)='./sys\x00', &(0x7f00000004c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/rtc/rtc0/wakealarm\x00', 0x2, 0x0) write(r0, &(0x7f0000000540)='+5', 0x2) 23.831647777s ago: executing program 2 (id=560): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000240)=@bpf_lsm={0x18, 0x7, &(0x7f0000000100)=ANY=[], 0x0}, 0x94) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, 0x0, 0x20000004) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) write$nbd(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, 0x0, 0x0) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x0, &(0x7f0000000040)}) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, &(0x7f0000000680)={{{@in=@empty, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x4, 0xffff, 0x100, 0x2}, {0x1, 0x0, 0x400000000}, 0x0, 0x0, 0x1, 0x0, 0x3, 0x3}, {{@in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x0, 0x32}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0x39}, 0x0, 0x0, 0x0, 0xb7, 0x2, 0xfffffffe}}, 0xe8) 23.810694948s ago: executing program 1 (id=561): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) syz_io_uring_setup(0xf00, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x40082, 0x17) write(r0, &(0x7f0000000000)='3', 0x4e) setns(0xc9, 0x0) r1 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000040)={'nat\x00', 0x0, [0x9, 0xb, 0x81000000, 0xf, 0x5]}, &(0x7f00000000c0)=0x54) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) 23.606054133s ago: executing program 1 (id=562): r0 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'ipvlan0\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc, 0x1], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r2, {0x0, 0xd}, {0xffff, 0xffff}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x1c, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x8001}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x7}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40005}, 0x8010) 23.502867801s ago: executing program 0 (id=563): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000240)='vegas', 0x5) r1 = syz_usb_connect(0x5, 0x58, &(0x7f00000000c0)={{0x12, 0x1, 0x310, 0x8e, 0x3a, 0xc6, 0x20, 0x694, 0x1, 0x7813, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x46, 0x2, 0xe, 0x6, 0x10, 0x3, "", [{{0x9, 0x4, 0x39, 0xd8, 0x1, 0x1a, 0xda, 0xa8, 0x8, [], [{{0x9, 0x5, 0x8, 0x10, 0x20, 0x7, 0x9, 0x80}}]}}, {{0x9, 0x4, 0xe4, 0x5, 0x3, 0xb9, 0x56, 0xda, 0x2, [], [{{0x9, 0x5, 0x8, 0x0, 0x400, 0x1, 0x12, 0xfc}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x7, 0x3, 0x9a, [@generic={0x7, 0x5, "d15b89f26d"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x40, 0x7a, 0xa, 0x84}}]}}]}}]}}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r1, &(0x7f0000000180)={0x24, 0x0, &(0x7f00000001c0)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000200)={0x24, 0x0, &(0x7f00000002c0)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000300)={0x24, 0x0, &(0x7f0000000340)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x44a}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000380)={0x18, &(0x7f00000003c0)={0x0, 0x3, 0x1e, "003cb3a4aa50323f48203694279a9b744e88ca1b75aede7dbdec988c7a9c"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000400)={0x44, &(0x7f0000000500)=ANY=[@ANYBLOB="2003040000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) 23.142143812s ago: executing program 4 (id=564): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000680)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f00000006c0), 0x0) 17.444814226s ago: executing program 32 (id=532): r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000480), 0x801, 0x0) write$rfkill(r0, &(0x7f00000004c0)={0x0, 0x1, 0x3, 0x3, 0xfd}, 0x8) write$rfkill(r0, &(0x7f0000000580)={0x6, 0x0, 0x3, 0x0, 0x1}, 0x8) 17.30994525s ago: executing program 0 (id=566): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000040000000f"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0x14, &(0x7f0000000ac0)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r1 = syz_open_dev$radio(&(0x7f0000000c00), 0x2, 0x2) ioctl$VIDIOC_S_CTRL(r1, 0xc008561c, &(0x7f0000000c40)={0xf0f041}) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='clear_refs\x00') syz_io_uring_setup(0xefe, 0x0, 0x0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000940)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x958dac72f643fe2c, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) writev(r2, &(0x7f0000000080), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000700)='./proc\x00', &(0x7f0000000740)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f00000007c0)='27', 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r2, 0x89f0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000340)={0x0, 0x0}, 0x8) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1a, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1a, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r3, 0x4}, 0x94) 17.068388236s ago: executing program 2 (id=567): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f00000005c0)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/devices/system/clocksource/clocksource0/available_clocksource\x00', 0x0, 0x0) read(r0, &(0x7f00000006c0)=""/256, 0x100) 16.003590488s ago: executing program 2 (id=568): syz_usb_connect(0x5, 0x4e, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040cd06350100010000000109023c0001010080320904"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000003c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000640)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x28, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000040)={0x84, @multicast2, 0x15, 0x2001, 'sh\x00', 0x1, 0x5, 0x6d}, 0x2c) setsockopt$IP_VS_SO_SET_FLUSH(r3, 0x0, 0x485, 0x0, 0x0) r4 = socket$kcm(0x2b, 0x1, 0x0) shutdown(r4, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./trace/events/sched/sched_switch/trigger\x00', 0x2, 0x0) read$FUSE(r5, &(0x7f0000002140)={0x2020}, 0x2020) socket$unix(0x1, 0x1, 0x0) syz_emit_ethernet(0x1f4, &(0x7f0000000780)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "00cd04", 0x1be, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x5a, 0x1, 0x0, 0x0, [{0x5, 0xa, "a78c000005dc8080a2030003004003493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34060600000000000000dac15084dbaf736b41e5af0502"}, {0x0, 0x1, "000005000000000026000400"}, {0x3, 0xc, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d"}, {0x0, 0x1d, "06aa85616177c61bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee4df24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d000000000000"}]}}}}}}, 0x0) 7.99825421s ago: executing program 33 (id=562): r0 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'ipvlan0\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc, 0x1], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r2, {0x0, 0xd}, {0xffff, 0xffff}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x1c, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x8001}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x7}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40005}, 0x8010) 7.239468446s ago: executing program 34 (id=564): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000680)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f00000006c0), 0x0) 479.198554ms ago: executing program 35 (id=566): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000040000000f"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0x14, &(0x7f0000000ac0)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r1 = syz_open_dev$radio(&(0x7f0000000c00), 0x2, 0x2) ioctl$VIDIOC_S_CTRL(r1, 0xc008561c, &(0x7f0000000c40)={0xf0f041}) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='clear_refs\x00') syz_io_uring_setup(0xefe, 0x0, 0x0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000940)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x958dac72f643fe2c, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) writev(r2, &(0x7f0000000080), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000700)='./proc\x00', &(0x7f0000000740)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f00000007c0)='27', 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r2, 0x89f0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000340)={0x0, 0x0}, 0x8) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1a, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1a, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r3, 0x4}, 0x94) 0s ago: executing program 36 (id=568): syz_usb_connect(0x5, 0x4e, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040cd06350100010000000109023c0001010080320904"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000003c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000640)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x28, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000040)={0x84, @multicast2, 0x15, 0x2001, 'sh\x00', 0x1, 0x5, 0x6d}, 0x2c) setsockopt$IP_VS_SO_SET_FLUSH(r3, 0x0, 0x485, 0x0, 0x0) r4 = socket$kcm(0x2b, 0x1, 0x0) shutdown(r4, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./trace/events/sched/sched_switch/trigger\x00', 0x2, 0x0) read$FUSE(r5, &(0x7f0000002140)={0x2020}, 0x2020) socket$unix(0x1, 0x1, 0x0) syz_emit_ethernet(0x1f4, &(0x7f0000000780)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "00cd04", 0x1be, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x5a, 0x1, 0x0, 0x0, [{0x5, 0xa, "a78c000005dc8080a2030003004003493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34060600000000000000dac15084dbaf736b41e5af0502"}, {0x0, 0x1, "000005000000000026000400"}, {0x3, 0xc, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d"}, {0x0, 0x1d, "06aa85616177c61bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee4df24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d000000000000"}]}}}}}}, 0x0) kernel console output (not intermixed with test programs): 5.356177][ T5724] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 185.367068][ T5721] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 185.390897][ T5694] oti6858 3-1:1.0: oti6858 converter detected [ 185.416568][ T5694] usb 3-1: oti6858 converter now attached to ttyUSB0 [ 185.506197][ T5724] usb 5-1: Using ep0 maxpacket: 8 [ 185.506933][ T5724] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 185.508355][ T5724] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 185.508384][ T5724] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 185.508408][ T5724] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 185.508430][ T5724] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 185.508469][ T5724] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 185.547435][ T5721] usb 2-1: Using ep0 maxpacket: 8 [ 185.626372][ T5721] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 185.665874][ T5721] usb 2-1: config 0 has no interfaces? [ 185.665898][ T5721] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 185.727546][ T5721] usb 2-1: config 0 descriptor?? [ 185.769120][ T5724] usb 5-1: usb_control_msg returned -32 [ 185.769163][ T5724] usbtmc 5-1:16.0: can't read capabilities [ 185.921221][ T10] usb 5-1: USB disconnect, device number 13 [ 186.073373][ T6539] oti6858 ttyUSB0: oti6858_open(): usb_submit_urb() failed with error -90 [ 186.082641][ T5319] usb 3-1: USB disconnect, device number 11 [ 186.214689][ T5319] oti6858 ttyUSB0: oti6858 converter now disconnected from ttyUSB0 [ 186.215684][ T5319] oti6858 3-1:1.0: device disconnected [ 187.071124][ T6560] FAULT_INJECTION: forcing a failure. [ 187.071124][ T6560] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 187.071161][ T6560] CPU: 0 UID: 0 PID: 6560 Comm: syz.2.236 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 187.071185][ T6560] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 187.071198][ T6560] Call Trace: [ 187.071207][ T6560] [ 187.071216][ T6560] dump_stack_lvl+0xe8/0x150 [ 187.071255][ T6560] should_fail_ex+0x46b/0x600 [ 187.071295][ T6560] prepare_alloc_pages+0x223/0x650 [ 187.071324][ T6560] __alloc_frozen_pages_noprof+0x1a1/0x5c0 [ 187.071351][ T6560] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 187.071392][ T6560] __alloc_pages_noprof+0x10/0x100 [ 187.071415][ T6560] alloc_pages_bulk_noprof+0x683/0x890 [ 187.071474][ T6560] ? copy_splice_read+0x16f/0xab0 [ 187.071499][ T6560] ? copy_splice_read+0x16f/0xab0 [ 187.071530][ T6560] copy_splice_read+0x19f/0xab0 [ 187.071562][ T6560] ? __pfx_iter_file_splice_write+0x10/0x10 [ 187.071592][ T6560] ? __pfx_copy_splice_read+0x10/0x10 [ 187.071625][ T6560] ? __pfx_iter_file_splice_write+0x10/0x10 [ 187.071655][ T6560] ? file_end_write+0x158/0x220 [ 187.071682][ T6560] ? direct_splice_actor+0x10f/0x160 [ 187.071710][ T6560] ? __pfx_shmem_file_splice_read+0x10/0x10 [ 187.071732][ T6560] splice_direct_to_actor+0x4c1/0xcc0 [ 187.071776][ T6560] ? __pfx_direct_splice_actor+0x10/0x10 [ 187.071803][ T6560] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 187.071839][ T6560] do_splice_direct+0x19b/0x2a0 [ 187.071869][ T6560] ? __pfx_do_splice_direct+0x10/0x10 [ 187.071896][ T6560] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 187.071930][ T6560] ? rw_verify_area+0x209/0x4d0 [ 187.071961][ T6560] do_sendfile+0x540/0x7e0 [ 187.071993][ T6560] ? __pfx_do_sendfile+0x10/0x10 [ 187.072020][ T6560] ? __se_sys_futex+0x3a8/0x450 [ 187.072046][ T6560] __se_sys_sendfile64+0x144/0x1a0 [ 187.072080][ T6560] ? __pfx___se_sys_sendfile64+0x10/0x10 [ 187.072124][ T6560] do_syscall_64+0x166/0x520 [ 187.072153][ T6560] ? trace_irq_disable+0x3b/0x140 [ 187.072180][ T6560] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 187.072201][ T6560] ? clear_bhb_loop+0x70/0xc0 [ 187.072226][ T6560] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 187.072246][ T6560] RIP: 0033:0x7f5f171ee2d9 [ 187.072265][ T6560] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 187.072282][ T6560] RSP: 002b:00007f5f15446028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 187.072304][ T6560] RAX: ffffffffffffffda RBX: 00007f5f17475fa0 RCX: 00007f5f171ee2d9 [ 187.072319][ T6560] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000005 [ 187.072330][ T6560] RBP: 00007f5f17285888 R08: 0000000000000000 R09: 0000000000000000 [ 187.072343][ T6560] R10: 000000000e3aa6ea R11: 0000000000000246 R12: 0000000000000000 [ 187.072356][ T6560] R13: 00007f5f17476038 R14: 00007f5f17475fa0 R15: 00007fff2ef84468 [ 187.072387][ T6560] [ 188.326531][ T5724] usb 4-1: new full-speed USB device number 14 using dummy_hcd [ 188.456262][ T5724] usb 4-1: device descriptor read/64, error -71 [ 188.586255][ T5721] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 188.736560][ T5724] usb 4-1: new full-speed USB device number 15 using dummy_hcd [ 188.756170][ T5721] usb 5-1: Using ep0 maxpacket: 32 [ 188.758447][ T5721] usb 5-1: unable to get BOS descriptor or descriptor too short [ 188.758509][ T5721] usb 5-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 188.759607][ T5721] usb 5-1: config 14 has an invalid interface number: 57 but max is 1 [ 188.759629][ T5721] usb 5-1: config 14 has an invalid interface number: 228 but max is 1 [ 188.759649][ T5721] usb 5-1: config 14 has no interface number 0 [ 188.759663][ T5721] usb 5-1: config 14 has no interface number 1 [ 188.759719][ T5721] usb 5-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 188.759734][ T5721] usb 5-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 188.759751][ T5721] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 188.759768][ T5721] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 188.759785][ T5721] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 188.759802][ T5721] usb 5-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 188.759819][ T5721] usb 5-1: config 14 interface 57 has no altsetting 0 [ 188.759832][ T5721] usb 5-1: config 14 interface 228 has no altsetting 0 [ 188.762110][ T5721] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 188.762134][ T5721] usb 5-1: Product: syz [ 188.762148][ T5721] usb 5-1: Manufacturer: syz [ 188.762161][ T5721] usb 5-1: SerialNumber: syz [ 188.933474][ T5724] usb 4-1: device descriptor read/64, error -71 [ 188.952468][ T5319] usb 2-1: USB disconnect, device number 14 [ 189.044559][ T5724] usb usb4-port1: attempt power cycle [ 189.183146][ T5721] legousbtower 5-1:14.57: interrupt endpoints not found [ 189.228267][ T31] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 189.396184][ T5724] usb 4-1: new full-speed USB device number 16 using dummy_hcd [ 189.403298][ T5721] legousbtower 5-1:14.228: get version request failed: -71 [ 189.403500][ T5721] legousbtower 5-1:14.228: probe with driver legousbtower failed with error -71 [ 189.543071][ T5721] usb 5-1: USB disconnect, device number 14 [ 189.544860][ T31] usb 3-1: Using ep0 maxpacket: 8 [ 189.558577][ T5724] usb 4-1: device descriptor read/8, error -71 [ 189.558696][ T31] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 189.559943][ T31] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 189.559977][ T31] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 189.560005][ T31] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 189.560049][ T31] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 189.560094][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 189.836337][ T5724] usb 4-1: new full-speed USB device number 17 using dummy_hcd [ 189.857000][ T5724] usb 4-1: device descriptor read/8, error -71 [ 189.859069][ T31] usb 3-1: usb_control_msg returned -32 [ 189.859120][ T31] usbtmc 3-1:16.0: can't read capabilities [ 189.905772][ T31] usb 3-1: USB disconnect, device number 12 [ 189.941864][ T10] usb 1-1: new full-speed USB device number 9 using dummy_hcd [ 189.967110][ T5724] usb usb4-port1: unable to enumerate USB device [ 190.118966][ T10] usb 1-1: not running at top speed; connect to a high speed hub [ 190.119006][ T10] usb 1-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 190.120373][ T10] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 190.120402][ T10] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 190.122786][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 190.122808][ T10] usb 1-1: Product: syz [ 190.122822][ T10] usb 1-1: Manufacturer: syz [ 190.122836][ T10] usb 1-1: SerialNumber: syz [ 190.140121][ T10] oti6858 1-1:1.0: oti6858 converter detected [ 190.144716][ T10] usb 1-1: oti6858 converter now attached to ttyUSB0 [ 190.343861][ T10] usb 1-1: USB disconnect, device number 9 [ 190.403811][ T10] oti6858 ttyUSB0: oti6858 converter now disconnected from ttyUSB0 [ 190.422179][ T10] oti6858 1-1:1.0: device disconnected [ 191.545877][ T6597] ALSA: mixer_oss: invalid OSS volume 'PHlâ6žžqÓ†ØÈÌONEOUT' [ 191.556914][ T6597] ALSA: mixer_oss: invalid index 137438 [ 191.719641][ T6606] dyndbg: bad flag-op f, at start of fi [ 191.719654][ T6606] dyndbg: flags parse failed [ 192.686264][ T10] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 192.929014][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 192.939681][ T10] usb 1-1: unable to get BOS descriptor or descriptor too short [ 192.939794][ T10] usb 1-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 192.958097][ T10] usb 1-1: config 14 has an invalid interface number: 57 but max is 1 [ 192.958120][ T10] usb 1-1: config 14 has an invalid interface number: 228 but max is 1 [ 192.958139][ T10] usb 1-1: config 14 has no interface number 0 [ 192.958155][ T10] usb 1-1: config 14 has no interface number 1 [ 192.958219][ T10] usb 1-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 192.958242][ T10] usb 1-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 192.958265][ T10] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 192.958289][ T10] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 192.958315][ T10] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 192.958340][ T10] usb 1-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 192.958364][ T10] usb 1-1: config 14 interface 57 has no altsetting 0 [ 192.958382][ T10] usb 1-1: config 14 interface 228 has no altsetting 0 [ 192.975476][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 192.975535][ T10] usb 1-1: Product: syz [ 192.975562][ T10] usb 1-1: Manufacturer: syz [ 192.975602][ T10] usb 1-1: SerialNumber: syz [ 194.239522][ T10] legousbtower 1-1:14.57: interrupt endpoints not found [ 194.616689][ T1330] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.623782][ T1330] ieee802154 phy1 wpan1: encryption failed: -22 [ 195.199707][ T10] legousbtower 1-1:14.228: get version request failed: -71 [ 195.199880][ T10] legousbtower 1-1:14.228: probe with driver legousbtower failed with error -71 [ 195.261208][ T10] usb 1-1: USB disconnect, device number 10 [ 195.509884][ T5319] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 196.347428][ T5319] usb 2-1: Using ep0 maxpacket: 8 [ 196.350249][ T5319] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 196.354388][ T5319] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 196.354427][ T5319] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 196.354446][ T5319] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 196.354464][ T5319] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 196.354496][ T5319] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 196.655518][ T5319] usb 2-1: usb_control_msg returned -32 [ 196.655564][ T5319] usbtmc 2-1:16.0: can't read capabilities [ 196.736129][ T5724] usb 1-1: new full-speed USB device number 11 using dummy_hcd [ 196.769146][ T5319] usb 2-1: USB disconnect, device number 15 [ 196.867915][ T5724] usb 1-1: device descriptor read/64, error -71 [ 196.891421][ T6655] No source specified [ 196.894801][ T6655] netlink: 32 bytes leftover after parsing attributes in process `syz.4.265'. [ 197.106151][ T5724] usb 1-1: new full-speed USB device number 12 using dummy_hcd [ 197.246169][ T5721] usb 3-1: new full-speed USB device number 13 using dummy_hcd [ 197.246553][ T5724] usb 1-1: device descriptor read/64, error -71 [ 197.358476][ T5724] usb usb1-port1: attempt power cycle [ 197.397525][ T5721] usb 3-1: not running at top speed; connect to a high speed hub [ 197.397562][ T5721] usb 3-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 197.425616][ T5721] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 197.425637][ T5721] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 197.457341][ T5721] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 197.457358][ T5721] usb 3-1: Product: syz [ 197.457368][ T5721] usb 3-1: Manufacturer: syz [ 197.457377][ T5721] usb 3-1: SerialNumber: syz [ 197.508690][ T5721] oti6858 3-1:1.0: oti6858 converter detected [ 197.531128][ T5721] usb 3-1: oti6858 converter now attached to ttyUSB0 [ 197.798357][ T5724] usb 1-1: new full-speed USB device number 13 using dummy_hcd [ 197.816874][ T5721] usb 3-1: USB disconnect, device number 13 [ 197.820261][ T5724] usb 1-1: device descriptor read/8, error -71 [ 197.871584][ T5721] oti6858 ttyUSB0: oti6858 converter now disconnected from ttyUSB0 [ 197.872485][ T5721] oti6858 3-1:1.0: device disconnected [ 197.956235][ T10] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 198.058248][ T5724] usb 1-1: new full-speed USB device number 14 using dummy_hcd [ 198.081744][ T5724] usb 1-1: device descriptor read/8, error -71 [ 198.137600][ T10] usb 2-1: Using ep0 maxpacket: 8 [ 198.186389][ T5724] usb usb1-port1: unable to enumerate USB device [ 201.496184][ T5708] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 201.586214][ T10] usb 2-1: unable to get BOS descriptor or descriptor too short [ 201.586259][ T10] usb 2-1: New USB device found, idVendor=2b73, idProduct=0013, bcdDevice= 1.40 [ 201.591486][ T10] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 201.591528][ T10] usb 2-1: can't read configurations, error -71 [ 201.656126][ T5708] usb 1-1: Using ep0 maxpacket: 32 [ 201.678425][ T5708] usb 1-1: unable to get BOS descriptor or descriptor too short [ 201.678475][ T5708] usb 1-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 201.691644][ T5708] usb 1-1: config 14 has an invalid interface number: 57 but max is 1 [ 201.691709][ T5708] usb 1-1: config 14 has an invalid interface number: 228 but max is 1 [ 201.691761][ T5708] usb 1-1: config 14 has no interface number 0 [ 201.691847][ T5708] usb 1-1: config 14 has no interface number 1 [ 201.692008][ T5708] usb 1-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 201.692074][ T5708] usb 1-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 201.692136][ T5708] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 201.692204][ T5708] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 201.692264][ T5708] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 201.692324][ T5708] usb 1-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 201.692371][ T5708] usb 1-1: config 14 interface 57 has no altsetting 0 [ 201.692411][ T5708] usb 1-1: config 14 interface 228 has no altsetting 0 [ 201.769345][ T5708] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 201.769418][ T5708] usb 1-1: Product: syz [ 201.769460][ T5708] usb 1-1: Manufacturer: syz [ 201.769505][ T5708] usb 1-1: SerialNumber: syz [ 201.946829][ T5869] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 202.096146][ T5869] usb 3-1: Using ep0 maxpacket: 8 [ 202.097062][ T5869] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 202.160669][ T6696] ip6erspan0: entered allmulticast mode [ 202.161145][ T5869] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 202.161176][ T5869] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 202.161201][ T5869] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 202.161224][ T5869] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 202.161331][ T5869] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 202.293608][ T5708] legousbtower 1-1:14.57: interrupt endpoints not found [ 202.620150][ T5869] usb 3-1: GET_CAPABILITIES returned 0 [ 202.622301][ T5869] usbtmc 3-1:16.0: can't read capabilities [ 202.856183][ T5708] legousbtower 1-1:14.228: LEGO USB Tower firmware version is 170.80 build 16178 [ 202.867511][ T5708] legousbtower 1-1:14.228: LEGO USB Tower #-159 now attached to major 180 minor 1 [ 202.968019][ T5721] usb 3-1: USB disconnect, device number 14 [ 203.678343][ T6702] bridge0: port 2(bridge_slave_1) entered disabled state [ 203.778268][ T6702] bridge0: port 1(bridge_slave_0) entered disabled state [ 204.026806][ T5721] usb 3-1: new full-speed USB device number 15 using dummy_hcd [ 204.166754][ T5721] usb 3-1: device descriptor read/64, error -71 [ 204.416128][ T5721] usb 3-1: new full-speed USB device number 16 using dummy_hcd [ 204.536837][ T5724] usb 1-1: USB disconnect, device number 15 [ 204.560724][ T5721] usb 3-1: device descriptor read/64, error -71 [ 204.593629][ T5724] legousbtower 1-1:14.228: LEGO USB Tower #-159 now disconnected [ 204.790417][ T5721] usb usb3-port1: attempt power cycle [ 205.486877][ T5721] usb 3-1: new full-speed USB device number 17 using dummy_hcd [ 205.517884][ T5721] usb 3-1: device descriptor read/8, error -71 [ 205.733770][ T6702] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 205.766144][ T5721] usb 3-1: new full-speed USB device number 18 using dummy_hcd [ 205.786798][ T5721] usb 3-1: device descriptor read/8, error -71 [ 205.815875][ T6702] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 205.896609][ T5721] usb usb3-port1: unable to enumerate USB device [ 206.878560][ T6738] netlink: 4 bytes leftover after parsing attributes in process `syz.2.294'. [ 207.206150][ T6736] lo: entered allmulticast mode [ 207.206942][ T6736] tunl0: entered allmulticast mode [ 207.208537][ T6736] gre0: entered allmulticast mode [ 207.209496][ T6736] gretap0: entered allmulticast mode [ 207.210501][ T6736] erspan0: entered allmulticast mode [ 207.211165][ T6736] ip_vti0: entered allmulticast mode [ 207.211919][ T6736] ip6_vti0: entered allmulticast mode [ 207.212581][ T6736] sit0: entered allmulticast mode [ 207.213352][ T6736] ip6tnl0: entered allmulticast mode [ 207.214120][ T6736] ip6gre0: entered allmulticast mode [ 207.214856][ T6736] syz_tun: entered allmulticast mode [ 207.215575][ T6736] ip6gretap0: entered allmulticast mode [ 207.283261][ T6736] bridge0: entered allmulticast mode [ 207.284193][ T6736] vcan0: entered allmulticast mode [ 207.285060][ T6736] team0: entered allmulticast mode [ 207.285077][ T6736] team_slave_0: entered allmulticast mode [ 207.285100][ T6736] team_slave_1: entered allmulticast mode [ 207.297884][ T6736] dummy0: entered allmulticast mode [ 207.331101][ T6736] nlmon0: entered allmulticast mode [ 207.331862][ T6736] batadv0: entered allmulticast mode [ 207.332968][ T6736] vxcan0: entered allmulticast mode [ 207.333730][ T6736] vxcan1: entered allmulticast mode [ 207.334528][ T6736] veth0: entered allmulticast mode [ 207.335281][ T6736] veth1: entered allmulticast mode [ 207.369989][ T6736] wg0: entered allmulticast mode [ 207.373376][ T6736] wg1: entered allmulticast mode [ 207.374269][ T6736] wg2: entered allmulticast mode [ 207.375019][ T6736] veth0_to_bridge: entered allmulticast mode [ 207.398681][ T6736] bridge_slave_0: left promiscuous mode [ 207.399002][ T6736] bridge0: port 1(bridge_slave_0) entered disabled state [ 207.588596][ T6736] veth1_to_bridge: entered allmulticast mode [ 207.589978][ T6736] bridge_slave_1: left promiscuous mode [ 207.590144][ T6736] bridge0: port 2(bridge_slave_1) entered disabled state [ 207.727711][ T6736] veth0_to_bond: entered allmulticast mode [ 207.728455][ T6736] bond_slave_0: entered allmulticast mode [ 207.729236][ T6736] veth1_to_bond: entered allmulticast mode [ 207.729806][ T6736] bond_slave_1: entered allmulticast mode [ 207.730528][ T6736] veth0_to_team: entered allmulticast mode [ 207.822735][ T6736] team0: Port device team_slave_0 removed [ 207.823195][ T6736] veth1_to_team: entered allmulticast mode [ 207.874451][ T6736] team0: Port device team_slave_1 removed [ 207.874914][ T6736] veth0_to_batadv: entered allmulticast mode [ 207.875538][ T6736] batadv_slave_0: entered allmulticast mode [ 207.897485][ T6736] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 207.897504][ T6736] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 207.927791][ T6736] veth1_to_batadv: entered allmulticast mode [ 207.928394][ T6736] batadv_slave_1: entered allmulticast mode [ 207.928645][ T6736] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 207.928659][ T6736] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 208.087524][ T6736] xfrm0: entered allmulticast mode [ 208.088465][ T6736] veth0_to_hsr: entered allmulticast mode [ 208.089335][ T6736] hsr_slave_0: entered allmulticast mode [ 208.090123][ T6736] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 208.113039][ T6737] ip6erspan0: entered allmulticast mode [ 208.163063][ T6744] vivid-004: disconnect [ 208.203766][ T6744] FAULT_INJECTION: forcing a failure. [ 208.203766][ T6744] name failslab, interval 1, probability 0, space 0, times 0 [ 208.203805][ T6744] CPU: 0 UID: 0 PID: 6744 Comm: syz.4.297 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 208.203832][ T6744] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 208.203846][ T6744] Call Trace: [ 208.203855][ T6744] [ 208.203866][ T6744] dump_stack_lvl+0xe8/0x150 [ 208.203910][ T6744] should_fail_ex+0x46b/0x600 [ 208.203955][ T6744] should_failslab+0xa8/0x100 [ 208.203985][ T6744] __kmalloc_cache_noprof+0xa1/0x680 [ 208.204023][ T6744] ? bpf_prog_alloc_no_stats+0xd8/0x560 [ 208.204046][ T6744] ? bpf_prog_alloc_no_stats+0xd8/0x560 [ 208.204078][ T6744] bpf_prog_alloc_no_stats+0xd8/0x560 [ 208.204100][ T6744] ? bpf_prog_alloc+0x2a/0x1a0 [ 208.204135][ T6744] bpf_prog_alloc+0x3c/0x1a0 [ 208.204161][ T6744] bpf_prog_load+0x7f8/0x1c20 [ 208.204199][ T6744] ? __pfx_bpf_prog_load+0x10/0x10 [ 208.204256][ T6744] __sys_bpf+0xd0d/0xd90 [ 208.204304][ T6744] ? __pfx___sys_bpf+0x10/0x10 [ 208.204345][ T6744] ? do_futex+0x3e7/0x4e0 [ 208.204403][ T6744] ? rcu_is_watching+0x16/0xb0 [ 208.204435][ T6744] __x64_sys_bpf+0xba/0xd0 [ 208.204473][ T6744] do_syscall_64+0x166/0x520 [ 208.204507][ T6744] ? trace_irq_disable+0x3b/0x140 [ 208.204540][ T6744] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 208.204565][ T6744] ? clear_bhb_loop+0x70/0xc0 [ 208.204594][ T6744] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 208.204628][ T6744] RIP: 0033:0x7f82aadce2d9 [ 208.204647][ T6744] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 208.204665][ T6744] RSP: 002b:00007f82a9026028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 208.204687][ T6744] RAX: ffffffffffffffda RBX: 00007f82ab055fa0 RCX: 00007f82aadce2d9 [ 208.204702][ T6744] RDX: 0000000000000094 RSI: 00002000000003c0 RDI: 0000000000000005 [ 208.204716][ T6744] RBP: 00007f82aae65888 R08: 0000000000000000 R09: 0000000000000000 [ 208.204729][ T6744] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 208.204742][ T6744] R13: 00007f82ab056038 R14: 00007f82ab055fa0 R15: 00007ffeabc0fd18 [ 208.204775][ T6744] [ 208.238061][ T6743] vivid-004: reconnect [ 209.131283][ T6757] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 210.126490][ T10] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 210.312900][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 210.346398][ T10] usb 4-1: unable to get BOS descriptor or descriptor too short [ 210.346982][ T10] usb 4-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 210.352300][ T10] usb 4-1: config 14 has an invalid interface number: 57 but max is 1 [ 210.352417][ T10] usb 4-1: config 14 has an invalid interface number: 228 but max is 1 [ 210.352439][ T10] usb 4-1: config 14 has no interface number 0 [ 210.352485][ T10] usb 4-1: config 14 has no interface number 1 [ 210.352667][ T10] usb 4-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 210.352693][ T10] usb 4-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 210.352750][ T10] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 210.352814][ T10] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 210.352870][ T10] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 210.352959][ T10] usb 4-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 210.352985][ T10] usb 4-1: config 14 interface 57 has no altsetting 0 [ 210.353003][ T10] usb 4-1: config 14 interface 228 has no altsetting 0 [ 210.578142][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 210.578260][ T10] usb 4-1: Product: syz [ 210.578381][ T10] usb 4-1: Manufacturer: syz [ 210.578459][ T10] usb 4-1: SerialNumber: syz [ 211.112648][ T6293] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 211.113160][ T13] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 211.113232][ T13] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 211.113278][ T13] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 211.589629][ T10] legousbtower 4-1:14.57: interrupt endpoints not found [ 211.852350][ T10] legousbtower 4-1:14.228: LEGO USB Tower firmware version is 170.80 build 16178 [ 211.867727][ T10] legousbtower 4-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 213.786152][ T5724] usb 2-1: new full-speed USB device number 18 using dummy_hcd [ 214.668041][ T5319] usb 4-1: USB disconnect, device number 18 [ 214.774374][ T5724] usb 2-1: device descriptor read/64, error -71 [ 214.876547][ T5319] legousbtower 4-1:14.228: LEGO USB Tower #-160 now disconnected [ 216.059331][ T5724] usb 2-1: new full-speed USB device number 19 using dummy_hcd [ 216.196214][ T5724] usb 2-1: device descriptor read/64, error -71 [ 216.317526][ T5724] usb usb2-port1: attempt power cycle [ 216.900593][ T5724] usb 2-1: new full-speed USB device number 20 using dummy_hcd [ 217.578389][ T5724] usb 2-1: device descriptor read/8, error -71 [ 217.617135][ T6793] nvme nvme0: failed to connect socket: -512 [ 217.831757][ T5591] Bluetooth: hci1: link tx timeout [ 217.831795][ T5591] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 217.851513][ T5591] Bluetooth: hci1: link tx timeout [ 217.851531][ T5591] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 217.851647][ T5591] Bluetooth: hci1: link tx timeout [ 217.851659][ T5591] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 217.851770][ T5591] Bluetooth: hci1: link tx timeout [ 217.851782][ T5591] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 217.851891][ T5591] Bluetooth: hci1: link tx timeout [ 217.851902][ T5591] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 217.852012][ T5591] Bluetooth: hci1: link tx timeout [ 217.852024][ T5591] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 217.852133][ T5591] Bluetooth: hci1: link tx timeout [ 217.852144][ T5591] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 217.852256][ T5591] Bluetooth: hci1: link tx timeout [ 217.852268][ T5591] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 217.852395][ T5591] Bluetooth: hci1: link tx timeout [ 217.852406][ T5591] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 217.852539][ T5591] Bluetooth: hci1: link tx timeout [ 217.852551][ T5591] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 217.852668][ T5591] Bluetooth: hci1: link tx timeout [ 217.852679][ T5591] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 217.852802][ T5591] Bluetooth: hci1: link tx timeout [ 217.852813][ T5591] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 217.852923][ T5591] Bluetooth: hci1: link tx timeout [ 217.852934][ T5591] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 217.853048][ T5591] Bluetooth: hci1: link tx timeout [ 217.853059][ T5591] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 217.853174][ T5591] Bluetooth: hci1: link tx timeout [ 217.853186][ T5591] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 217.853302][ T5591] Bluetooth: hci1: link tx timeout [ 217.853314][ T5591] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 217.853465][ T5591] Bluetooth: hci1: link tx timeout [ 217.853480][ T5591] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 217.853616][ T5591] Bluetooth: hci1: link tx timeout [ 217.853630][ T5591] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 217.853760][ T5591] Bluetooth: hci1: link tx timeout [ 217.853774][ T5591] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 217.853932][ T5591] Bluetooth: hci1: link tx timeout [ 217.853945][ T5591] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 217.854083][ T5591] Bluetooth: hci1: link tx timeout [ 217.854097][ T5591] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 217.854233][ T5591] Bluetooth: hci1: link tx timeout [ 217.854247][ T5591] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 217.854382][ T5591] Bluetooth: hci1: link tx timeout [ 217.854396][ T5591] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 217.854545][ T5591] Bluetooth: hci1: link tx timeout [ 217.854559][ T5591] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 217.854710][ T5591] Bluetooth: hci1: link tx timeout [ 217.854722][ T5591] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 217.854833][ T5591] Bluetooth: hci1: link tx timeout [ 217.854844][ T5591] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 217.854954][ T5591] Bluetooth: hci1: link tx timeout [ 217.854966][ T5591] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 217.855076][ T5591] Bluetooth: hci1: link tx timeout [ 217.855087][ T5591] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 217.855198][ T5591] Bluetooth: hci1: link tx timeout [ 217.855209][ T5591] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 217.917223][ T5869] usb 3-1: new full-speed USB device number 19 using dummy_hcd [ 218.118456][ T5869] usb 3-1: not running at top speed; connect to a high speed hub [ 218.118992][ T5869] usb 3-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 218.146102][ T5885] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 218.264053][ T5869] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 218.264092][ T5869] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 218.287843][ T5869] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 218.287873][ T5869] usb 3-1: Product: syz [ 218.287884][ T5869] usb 3-1: Manufacturer: syz [ 218.287896][ T5869] usb 3-1: SerialNumber: syz [ 218.340878][ T5869] oti6858 3-1:1.0: oti6858 converter detected [ 218.353587][ T5885] usb 1-1: Using ep0 maxpacket: 32 [ 218.365898][ T5885] usb 1-1: unable to get BOS descriptor or descriptor too short [ 218.365948][ T5885] usb 1-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 218.391794][ T5885] usb 1-1: config 14 has an invalid interface number: 57 but max is 1 [ 218.391820][ T5885] usb 1-1: config 14 has an invalid interface number: 228 but max is 1 [ 218.391840][ T5885] usb 1-1: config 14 has no interface number 0 [ 218.391856][ T5885] usb 1-1: config 14 has no interface number 1 [ 218.391920][ T5885] usb 1-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 218.391944][ T5885] usb 1-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 218.391969][ T5885] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 218.391994][ T5885] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 218.392021][ T5885] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 218.392046][ T5885] usb 1-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 218.392071][ T5885] usb 1-1: config 14 interface 57 has no altsetting 0 [ 218.392089][ T5885] usb 1-1: config 14 interface 228 has no altsetting 0 [ 218.468916][ T5869] usb 3-1: oti6858 converter now attached to ttyUSB0 [ 218.485407][ T5885] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 218.485434][ T5885] usb 1-1: Product: syz [ 218.485448][ T5885] usb 1-1: Manufacturer: syz [ 218.485462][ T5885] usb 1-1: SerialNumber: syz [ 218.684558][ T5869] usb 3-1: USB disconnect, device number 19 [ 218.757692][ T5869] oti6858 ttyUSB0: oti6858 converter now disconnected from ttyUSB0 [ 218.855011][ T5869] oti6858 3-1:1.0: device disconnected [ 219.253627][ T5885] legousbtower 1-1:14.57: interrupt endpoints not found [ 219.541471][ T6831] netlink: 20 bytes leftover after parsing attributes in process `syz.2.325'. [ 219.543504][ T6831] netlink: 20 bytes leftover after parsing attributes in process `syz.2.325'. [ 219.543902][ T6831] netlink: 20 bytes leftover after parsing attributes in process `syz.2.325'. [ 220.326073][ T5588] Bluetooth: hci1: command 0x0405 tx timeout [ 220.786738][ T5885] legousbtower 1-1:14.228: LEGO USB Tower firmware version is 170.80 build 16178 [ 220.789678][ T5885] legousbtower 1-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 221.066169][ T5721] usb 3-1: new full-speed USB device number 20 using dummy_hcd [ 221.216122][ T5721] usb 3-1: device descriptor read/64, error -71 [ 221.544821][ T5319] usb 1-1: USB disconnect, device number 16 [ 221.578093][ T5319] legousbtower 1-1:14.228: LEGO USB Tower #-160 now disconnected [ 221.606149][ T5721] usb 3-1: new full-speed USB device number 21 using dummy_hcd [ 221.737793][ T5721] usb 3-1: device descriptor read/64, error -71 [ 221.853868][ T5721] usb usb3-port1: attempt power cycle [ 222.214611][ T6855] netlink: 8 bytes leftover after parsing attributes in process `syz.0.334'. [ 222.226151][ T5721] usb 3-1: new full-speed USB device number 22 using dummy_hcd [ 222.246167][ T5319] usb 4-1: new low-speed USB device number 19 using dummy_hcd [ 222.246873][ T5721] usb 3-1: device descriptor read/8, error -71 [ 222.398609][ T5319] usb 4-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 222.400059][ T5319] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 222.400087][ T5319] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 222.400138][ T5319] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 222.400170][ T5319] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 222.424669][ T60] Bluetooth: hci0: command 0x2016 tx timeout [ 222.424671][ T5598] Bluetooth: hci2: command 0x0406 tx timeout [ 222.527076][ T5869] usb 2-1: new full-speed USB device number 22 using dummy_hcd [ 222.546275][ T5319] hub 4-1:1.0: bad descriptor, ignoring hub [ 222.546317][ T5319] hub 4-1:1.0: probe with driver hub failed with error -5 [ 222.547399][ T5319] cdc_wdm 4-1:1.0: skipping garbage [ 222.547438][ T5319] cdc_wdm 4-1:1.0: probe with driver cdc_wdm failed with error -22 [ 222.581377][ T5721] usb 3-1: new full-speed USB device number 23 using dummy_hcd [ 222.596964][ T5721] usb 3-1: device descriptor read/8, error -71 [ 222.709885][ T5869] usb 2-1: not running at top speed; connect to a high speed hub [ 222.709930][ T5869] usb 2-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 222.711578][ T5869] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 222.711614][ T5869] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 222.716669][ T5721] usb usb3-port1: unable to enumerate USB device [ 222.795229][ T5869] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 222.795262][ T5869] usb 2-1: Product: syz [ 222.795279][ T5869] usb 2-1: Manufacturer: syz [ 222.795296][ T5869] usb 2-1: SerialNumber: syz [ 222.813473][ T5592] Bluetooth: hci4: command 0x0406 tx timeout [ 222.813515][ T5592] Bluetooth: hci3: command 0x0406 tx timeout [ 222.882248][ T6867] netlink: 14 bytes leftover after parsing attributes in process `syz.0.337'. [ 222.936671][ T6859] bond2: entered allmulticast mode [ 222.938076][ T6859] 8021q: adding VLAN 0 to HW filter on device bond2 [ 223.072997][ T5869] oti6858 2-1:1.0: oti6858 converter detected [ 223.087724][ T5869] usb 2-1: oti6858 converter now attached to ttyUSB0 [ 223.186664][ T31] usb 2-1: USB disconnect, device number 22 [ 223.242336][ T31] oti6858 ttyUSB0: oti6858 converter now disconnected from ttyUSB0 [ 223.244986][ T31] oti6858 2-1:1.0: device disconnected [ 223.385832][ T5721] usb 4-1: USB disconnect, device number 19 [ 225.007335][ T6887] FAULT_INJECTION: forcing a failure. [ 225.007335][ T6887] name failslab, interval 1, probability 0, space 0, times 0 [ 225.007364][ T6887] CPU: 0 UID: 0 PID: 6887 Comm: syz.0.343 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 225.007384][ T6887] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 225.007395][ T6887] Call Trace: [ 225.007401][ T6887] [ 225.007435][ T6887] dump_stack_lvl+0xe8/0x150 [ 225.007483][ T6887] should_fail_ex+0x46b/0x600 [ 225.007514][ T6887] should_failslab+0xa8/0x100 [ 225.007534][ T6887] __kmalloc_noprof+0xfb/0x790 [ 225.007563][ T6887] ? vb2_core_reqbufs+0x931/0x1470 [ 225.007587][ T6887] ? vb2_core_reqbufs+0x931/0x1470 [ 225.007612][ T6887] ? vb2_core_reqbufs+0x8c4/0x1470 [ 225.007639][ T6887] vb2_core_reqbufs+0x931/0x1470 [ 225.007675][ T6887] ? __pfx_vb2_core_reqbufs+0x10/0x10 [ 225.007711][ T6887] ? vb2_verify_memory_type+0x1fc/0x570 [ 225.007758][ T6887] ? vb2_reqbufs+0x399/0x630 [ 225.007790][ T6887] v4l2_m2m_ioctl_reqbufs+0x110/0x200 [ 225.007814][ T6887] __video_do_ioctl+0x8b2/0xc70 [ 225.007838][ T6887] ? __pfx___video_do_ioctl+0x10/0x10 [ 225.007866][ T6887] video_usercopy+0x860/0x1430 [ 225.007888][ T6887] ? __pfx___video_do_ioctl+0x10/0x10 [ 225.007906][ T6887] ? __pfx_video_usercopy+0x10/0x10 [ 225.007921][ T6887] ? smack_file_ioctl+0x2c4/0x370 [ 225.007958][ T6887] ? __fget_files+0x2a/0x420 [ 225.007978][ T6887] ? __fget_files+0x3a8/0x420 [ 225.008001][ T6887] v4l2_ioctl+0x190/0x1e0 [ 225.008028][ T6887] ? __pfx_v4l2_ioctl+0x10/0x10 [ 225.008061][ T6887] __se_sys_ioctl+0xff/0x170 [ 225.008090][ T6887] do_syscall_64+0x166/0x520 [ 225.008115][ T6887] ? trace_irq_disable+0x3b/0x140 [ 225.008140][ T6887] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 225.008158][ T6887] ? clear_bhb_loop+0x70/0xc0 [ 225.008179][ T6887] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 225.008196][ T6887] RIP: 0033:0x7fd6bf42e2d9 [ 225.008212][ T6887] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 225.008246][ T6887] RSP: 002b:00007fd6bd686028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 225.008273][ T6887] RAX: ffffffffffffffda RBX: 00007fd6bf6b5fa0 RCX: 00007fd6bf42e2d9 [ 225.008291][ T6887] RDX: 0000200000000540 RSI: 00000000c0145608 RDI: 0000000000000004 [ 225.008307][ T6887] RBP: 00007fd6bf4c5888 R08: 0000000000000000 R09: 0000000000000000 [ 225.008322][ T6887] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 225.008337][ T6887] R13: 00007fd6bf6b6038 R14: 00007fd6bf6b5fa0 R15: 00007ffc5cee7758 [ 225.008379][ T6887] [ 225.726273][ T31] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 225.916169][ T31] usb 3-1: Using ep0 maxpacket: 32 [ 225.922532][ T31] usb 3-1: unable to get BOS descriptor or descriptor too short [ 225.922592][ T31] usb 3-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 225.924169][ T31] usb 3-1: config 14 has an invalid interface number: 57 but max is 1 [ 225.924199][ T31] usb 3-1: config 14 has an invalid interface number: 228 but max is 1 [ 225.924223][ T31] usb 3-1: config 14 has no interface number 0 [ 225.924242][ T31] usb 3-1: config 14 has no interface number 1 [ 225.924319][ T31] usb 3-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 225.924346][ T31] usb 3-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 225.924376][ T31] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 225.924406][ T31] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 225.924437][ T31] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 225.924467][ T31] usb 3-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 225.924496][ T31] usb 3-1: config 14 interface 57 has no altsetting 0 [ 225.924516][ T31] usb 3-1: config 14 interface 228 has no altsetting 0 [ 226.039825][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 226.039917][ T31] usb 3-1: Product: syz [ 226.039961][ T31] usb 3-1: Manufacturer: syz [ 226.040019][ T31] usb 3-1: SerialNumber: syz [ 226.573125][ T6915] bond3: entered allmulticast mode [ 226.584655][ T6915] 8021q: adding VLAN 0 to HW filter on device bond3 [ 226.625455][ T31] legousbtower 3-1:14.57: interrupt endpoints not found [ 226.787031][ T6918] netlink: 14 bytes leftover after parsing attributes in process `syz.0.349'. [ 227.031636][ T31] legousbtower 3-1:14.228: LEGO USB Tower firmware version is 170.80 build 16178 [ 227.100926][ T6926] faux_driver vgem: [drm] Unknown color mode 9; guessing buffer size. [ 227.165179][ T31] legousbtower 3-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 227.496720][ T5319] usb 4-1: new full-speed USB device number 20 using dummy_hcd [ 227.649599][ T5319] usb 4-1: not running at top speed; connect to a high speed hub [ 227.649641][ T5319] usb 4-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 227.675535][ T5319] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 227.675574][ T5319] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 228.006938][ T6938] FAULT_INJECTION: forcing a failure. [ 228.006938][ T6938] name failslab, interval 1, probability 0, space 0, times 0 [ 228.007031][ T6938] CPU: 1 UID: 0 PID: 6938 Comm: syz.4.353 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 228.007060][ T6938] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 228.007076][ T6938] Call Trace: [ 228.007086][ T6938] [ 228.007097][ T6938] dump_stack_lvl+0xe8/0x150 [ 228.007141][ T6938] should_fail_ex+0x46b/0x600 [ 228.007186][ T6938] should_failslab+0xa8/0x100 [ 228.007213][ T6938] ? __kernfs_new_node+0xe7/0xa70 [ 228.007249][ T6938] kmem_cache_alloc_noprof+0x9e/0x690 [ 228.007286][ T6938] ? __kernfs_new_node+0xe7/0xa70 [ 228.007331][ T6938] __kernfs_new_node+0xe7/0xa70 [ 228.007366][ T6938] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 228.007410][ T6938] ? __pfx___kernfs_new_node+0x10/0x10 [ 228.007447][ T6938] ? kernfs_root+0x1c/0x230 [ 228.007488][ T6938] ? kernfs_root+0x1c/0x230 [ 228.007537][ T6938] ? kernfs_root+0x1c/0x230 [ 228.007568][ T6938] ? kernfs_root+0x1c/0x230 [ 228.007608][ T6938] kernfs_new_node+0xea/0x140 [ 228.007650][ T6938] __kernfs_create_file+0x4b/0x2e0 [ 228.007680][ T6938] sysfs_add_file_mode_ns+0x237/0x300 [ 228.007720][ T6938] internal_create_group+0x679/0x1180 [ 228.007772][ T6938] ? __pfx_internal_create_group+0x10/0x10 [ 228.007820][ T6938] ? kernfs_put_active+0xb1/0x100 [ 228.007859][ T6938] sysfs_create_groups+0x59/0x120 [ 228.007897][ T6938] device_add_attrs+0x1b1/0x600 [ 228.007927][ T6938] ? __pfx_device_add_attrs+0x10/0x10 [ 228.007959][ T6938] ? device_add_class_symlinks+0x222/0x240 [ 228.007990][ T6938] device_add+0x488/0xb80 [ 228.008020][ T6938] netdev_register_kobject+0x197/0x350 [ 228.008051][ T6938] register_netdevice+0x1455/0x1ed0 [ 228.008106][ T6938] ? __pfx_register_netdevice+0x10/0x10 [ 228.008141][ T6938] ? __hw_addr_insert+0x1f8/0x220 [ 228.008172][ T6938] ? dev_addr_mod+0x174/0x350 [ 228.008210][ T6938] ? dev_addr_mod+0x1ba/0x350 [ 228.008249][ T6938] ip6gre_newlink_common+0x403/0x5b0 [ 228.008285][ T6938] ? __pfx_ip6gre_newlink_common+0x10/0x10 [ 228.008336][ T6938] ip6erspan_newlink+0x472/0x870 [ 228.008371][ T6938] ? __pfx_ip6erspan_newlink+0x10/0x10 [ 228.008408][ T6938] rtnl_newlink_create+0x305/0x7b0 [ 228.008448][ T6938] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 228.008495][ T6938] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 228.008533][ T6938] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 228.008574][ T6938] rtnl_newlink+0x166d/0x1c30 [ 228.008622][ T6938] ? __pfx_rtnl_newlink+0x10/0x10 [ 228.008650][ T6938] ? finish_task_switch+0x40e/0xc60 [ 228.008692][ T6938] ? lockdep_hardirqs_on+0x7b/0x110 [ 228.008728][ T6938] ? rcu_is_watching+0x16/0xb0 [ 228.008751][ T6938] ? trace_sched_exit_tp+0x3a/0x130 [ 228.008782][ T6938] ? __schedule+0x16ef/0x5700 [ 228.008828][ T6938] ? __lock_acquire+0x747/0x2de0 [ 228.008864][ T6938] ? __lock_acquire+0x747/0x2de0 [ 228.008908][ T6938] ? __pfx___schedule+0x10/0x10 [ 228.008942][ T6938] ? kvm_sched_clock_read+0x11/0x20 [ 228.008980][ T6938] ? __lock_acquire+0x747/0x2de0 [ 228.009041][ T6938] ? lock_acquire+0x115/0x350 [ 228.009090][ T6938] ? __pfx_rtnl_newlink+0x10/0x10 [ 228.009118][ T6938] rtnetlink_rcv_msg+0x802/0xc00 [ 228.009151][ T6938] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 228.009178][ T6938] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 228.009208][ T6938] ? __lock_acquire+0x747/0x2de0 [ 228.009255][ T6938] netlink_rcv_skb+0x226/0x4a0 [ 228.009292][ T6938] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 228.009324][ T6938] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 228.009393][ T6938] ? netlink_deliver_tap+0x2e/0x1b0 [ 228.009428][ T6938] ? netlink_deliver_tap+0x2e/0x1b0 [ 228.009471][ T6938] netlink_unicast+0x7f5/0x990 [ 228.009517][ T6938] netlink_sendmsg+0x813/0xb40 [ 228.009566][ T6938] ? __pfx_netlink_sendmsg+0x10/0x10 [ 228.009605][ T6938] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 228.009637][ T6938] ? irqentry_exit+0x218/0x920 [ 228.009676][ T6938] ? __pfx_netlink_sendmsg+0x10/0x10 [ 228.009714][ T6938] sock_sendmsg_nosec+0x13a/0x180 [ 228.009743][ T6938] ____sys_sendmsg+0x565/0x870 [ 228.009794][ T6938] ? __pfx_____sys_sendmsg+0x10/0x10 [ 228.009839][ T6938] ? import_iovec+0x73/0xa0 [ 228.009870][ T6938] ___sys_sendmsg+0x2a5/0x360 [ 228.009902][ T6938] ? __lock_acquire+0x747/0x2de0 [ 228.009941][ T6938] ? __pfx____sys_sendmsg+0x10/0x10 [ 228.009979][ T6938] ? futex_wait+0x2a2/0x390 [ 228.010045][ T6938] ? __fget_files+0x2a/0x420 [ 228.010073][ T6938] ? __fget_files+0x3a8/0x420 [ 228.010116][ T6938] __x64_sys_sendmsg+0x1b7/0x290 [ 228.010153][ T6938] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 228.010212][ T6938] do_syscall_64+0x166/0x520 [ 228.010247][ T6938] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 228.010272][ T6938] ? clear_bhb_loop+0x70/0xc0 [ 228.010303][ T6938] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 228.010328][ T6938] RIP: 0033:0x7f82aadce2d9 [ 228.010352][ T6938] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 228.010373][ T6938] RSP: 002b:00007f82a8fe4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 228.010400][ T6938] RAX: ffffffffffffffda RBX: 00007f82ab056180 RCX: 00007f82aadce2d9 [ 228.010419][ T6938] RDX: 000000002800804c RSI: 0000200000000540 RDI: 0000000000000008 [ 228.010436][ T6938] RBP: 00007f82aae65888 R08: 0000000000000000 R09: 0000000000000000 [ 228.010452][ T6938] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 228.010467][ T6938] R13: 00007f82ab056218 R14: 00007f82ab056180 R15: 00007ffeabc0fd18 [ 228.010506][ T6938] [ 228.887625][ T5319] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 228.887658][ T5319] usb 4-1: Product: syz [ 228.887676][ T5319] usb 4-1: Manufacturer: syz [ 228.887692][ T5319] usb 4-1: SerialNumber: syz [ 229.273320][ T5319] oti6858 4-1:1.0: oti6858 converter detected [ 229.293411][ T5319] usb 4-1: oti6858 converter now attached to ttyUSB0 [ 229.333159][ T5319] usb 3-1: USB disconnect, device number 24 [ 229.362365][ T5319] legousbtower 3-1:14.228: LEGO USB Tower #-160 now disconnected [ 229.487010][ T5869] usb 4-1: USB disconnect, device number 20 [ 229.528645][ T5869] oti6858 ttyUSB0: oti6858 converter now disconnected from ttyUSB0 [ 229.532063][ T5869] oti6858 4-1:1.0: device disconnected [ 229.926910][ T31] usb 5-1: new full-speed USB device number 15 using dummy_hcd [ 230.075399][ T31] usb 5-1: device descriptor read/64, error -71 [ 230.586161][ T31] usb 5-1: new full-speed USB device number 16 using dummy_hcd [ 230.718035][ T31] usb 5-1: device descriptor read/64, error -71 [ 230.846205][ T5319] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 230.850663][ T31] usb usb5-port1: attempt power cycle [ 231.041301][ T5319] usb 4-1: Using ep0 maxpacket: 32 [ 231.046196][ T5319] usb 4-1: unable to get BOS descriptor or descriptor too short [ 231.046249][ T5319] usb 4-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 231.077878][ T5319] usb 4-1: config 14 has an invalid interface number: 57 but max is 1 [ 231.077910][ T5319] usb 4-1: config 14 has an invalid interface number: 228 but max is 1 [ 231.077944][ T5319] usb 4-1: config 14 has no interface number 0 [ 231.077962][ T5319] usb 4-1: config 14 has no interface number 1 [ 231.078037][ T5319] usb 4-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 231.078073][ T5319] usb 4-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 231.078100][ T5319] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 231.078129][ T5319] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 231.078160][ T5319] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 231.078189][ T5319] usb 4-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 231.078218][ T5319] usb 4-1: config 14 interface 57 has no altsetting 0 [ 231.078238][ T5319] usb 4-1: config 14 interface 228 has no altsetting 0 [ 231.081398][ T5319] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 231.081428][ T5319] usb 4-1: Product: syz [ 231.081445][ T5319] usb 4-1: Manufacturer: syz [ 231.081462][ T5319] usb 4-1: SerialNumber: syz [ 231.396264][ T31] usb 5-1: new full-speed USB device number 17 using dummy_hcd [ 231.427138][ T31] usb 5-1: device descriptor read/8, error -71 [ 231.640186][ T5724] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 231.872554][ T5319] legousbtower 4-1:14.57: interrupt endpoints not found [ 232.077049][ T5319] legousbtower 4-1:14.228: get version request failed: -71 [ 232.077246][ T5319] legousbtower 4-1:14.228: probe with driver legousbtower failed with error -71 [ 232.159979][ T5319] usb 4-1: USB disconnect, device number 21 [ 232.176145][ T31] usb 5-1: new full-speed USB device number 18 using dummy_hcd [ 232.217377][ T31] usb 5-1: device descriptor read/8, error -71 [ 232.236502][ T5724] usb 1-1: Using ep0 maxpacket: 32 [ 232.272427][ T5724] usb 1-1: unable to get BOS descriptor or descriptor too short [ 232.272497][ T5724] usb 1-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 232.275319][ T5724] usb 1-1: config 14 has an invalid interface number: 57 but max is 1 [ 232.275348][ T5724] usb 1-1: config 14 has an invalid interface number: 228 but max is 1 [ 232.275371][ T5724] usb 1-1: config 14 has no interface number 0 [ 232.275390][ T5724] usb 1-1: config 14 has no interface number 1 [ 232.275466][ T5724] usb 1-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 232.275503][ T5724] usb 1-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 232.275529][ T5724] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 232.275557][ T5724] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 232.275586][ T5724] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 232.275614][ T5724] usb 1-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 232.275642][ T5724] usb 1-1: config 14 interface 57 has no altsetting 0 [ 232.275663][ T5724] usb 1-1: config 14 interface 228 has no altsetting 0 [ 232.313815][ T5724] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 232.313847][ T5724] usb 1-1: Product: syz [ 232.313864][ T5724] usb 1-1: Manufacturer: syz [ 232.313880][ T5724] usb 1-1: SerialNumber: syz [ 232.336800][ T31] usb usb5-port1: unable to enumerate USB device [ 232.935919][ T5724] legousbtower 1-1:14.57: interrupt endpoints not found [ 233.106866][ T7010] netlink: 14 bytes leftover after parsing attributes in process `syz.2.367'. [ 233.144583][ T6999] bond2: entered allmulticast mode [ 233.145472][ T6999] 8021q: adding VLAN 0 to HW filter on device bond2 [ 233.350409][ T5724] legousbtower 1-1:14.228: LEGO USB Tower firmware version is 170.80 build 16178 [ 233.374831][ T5724] legousbtower 1-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 233.409332][ T5721] usb 5-1: new full-speed USB device number 19 using dummy_hcd [ 233.569160][ T5721] usb 5-1: not running at top speed; connect to a high speed hub [ 233.569205][ T5721] usb 5-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 233.570498][ T5721] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 233.570530][ T5721] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 233.573185][ T5721] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 233.573213][ T5721] usb 5-1: Product: syz [ 233.573229][ T5721] usb 5-1: Manufacturer: syz [ 233.573244][ T5721] usb 5-1: SerialNumber: syz [ 233.691654][ T5721] oti6858 5-1:1.0: oti6858 converter detected [ 233.723229][ T5721] usb 5-1: oti6858 converter now attached to ttyUSB0 [ 233.948854][ T5708] usb 5-1: USB disconnect, device number 19 [ 234.033309][ T7018] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(3) [ 234.033367][ T7018] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 234.125314][ T5708] oti6858 ttyUSB0: oti6858 converter now disconnected from ttyUSB0 [ 234.157248][ T5708] oti6858 5-1:1.0: device disconnected [ 234.171575][ C1] usb 1-1: tower_interrupt_in_callback: usb_submit_urb failed (-1) [ 234.280667][ T10] usb 1-1: USB disconnect, device number 17 [ 234.305563][ T7018] vhci_hcd vhci_hcd.0: Device attached [ 234.350711][ T10] legousbtower 1-1:14.228: LEGO USB Tower #-160 now disconnected [ 234.385957][ T7020] vhci_hcd: connection closed [ 234.474632][ T13] vhci_hcd vhci_hcd.2: stop threads [ 234.475565][ T13] vhci_hcd vhci_hcd.2: release socket [ 234.563217][ T13] vhci_hcd vhci_hcd.2: disconnect device [ 235.956435][ T1238] usb 1-1: new full-speed USB device number 18 using dummy_hcd [ 236.121325][ T1238] usb 1-1: not running at top speed; connect to a high speed hub [ 236.121378][ T1238] usb 1-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 236.122681][ T1238] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 236.122707][ T1238] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 236.191211][ T1238] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 236.191245][ T1238] usb 1-1: Product: syz [ 236.191262][ T1238] usb 1-1: Manufacturer: syz [ 236.191278][ T1238] usb 1-1: SerialNumber: syz [ 236.418131][ T10] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 236.458485][ T5319] usb 1-1: USB disconnect, device number 18 [ 236.566177][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 236.568819][ T10] usb 5-1: unable to get BOS descriptor or descriptor too short [ 236.568876][ T10] usb 5-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 236.591351][ T10] usb 5-1: config 14 has an invalid interface number: 57 but max is 1 [ 236.591439][ T10] usb 5-1: config 14 has an invalid interface number: 228 but max is 1 [ 236.591502][ T10] usb 5-1: config 14 has no interface number 0 [ 236.591527][ T10] usb 5-1: config 14 has no interface number 1 [ 236.591778][ T10] usb 5-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 236.591848][ T10] usb 5-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 236.591928][ T10] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 236.592006][ T10] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 236.592062][ T10] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 236.592137][ T10] usb 5-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 236.592213][ T10] usb 5-1: config 14 interface 57 has no altsetting 0 [ 236.592247][ T10] usb 5-1: config 14 interface 228 has no altsetting 0 [ 236.716530][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 236.716564][ T10] usb 5-1: Product: syz [ 236.716575][ T10] usb 5-1: Manufacturer: syz [ 236.716598][ T10] usb 5-1: SerialNumber: syz [ 236.761654][ T7046] netlink: 14 bytes leftover after parsing attributes in process `syz.2.382'. [ 237.191233][ T10] legousbtower 5-1:14.57: interrupt endpoints not found [ 237.657622][ T5869] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 237.806180][ T5869] usb 2-1: Using ep0 maxpacket: 32 [ 237.812217][ T5869] usb 2-1: unable to get BOS descriptor or descriptor too short [ 237.812345][ T5869] usb 2-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 237.814841][ T5869] usb 2-1: config 14 has an invalid interface number: 57 but max is 1 [ 237.814869][ T5869] usb 2-1: config 14 has an invalid interface number: 228 but max is 1 [ 237.815134][ T5869] usb 2-1: config 14 has no interface number 0 [ 237.815156][ T5869] usb 2-1: config 14 has no interface number 1 [ 237.815348][ T5869] usb 2-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 237.815378][ T5869] usb 2-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 237.815468][ T5869] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 237.815499][ T5869] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 237.815531][ T5869] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 237.815561][ T5869] usb 2-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 237.815650][ T5869] usb 2-1: config 14 interface 57 has no altsetting 0 [ 237.815673][ T5869] usb 2-1: config 14 interface 228 has no altsetting 0 [ 237.844229][ T5721] usb 1-1: new full-speed USB device number 19 using dummy_hcd [ 238.009565][ T5869] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 238.009674][ T5869] usb 2-1: Product: syz [ 238.009693][ T5869] usb 2-1: Manufacturer: syz [ 238.009709][ T5869] usb 2-1: SerialNumber: syz [ 238.098122][ T5721] usb 1-1: not running at top speed; connect to a high speed hub [ 238.098169][ T5721] usb 1-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 238.100026][ T5721] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 238.100063][ T5721] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 238.104579][ T5721] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 238.104608][ T5721] usb 1-1: Product: syz [ 238.104626][ T5721] usb 1-1: Manufacturer: syz [ 238.104642][ T5721] usb 1-1: SerialNumber: syz [ 238.163538][ T5721] oti6858 1-1:1.0: oti6858 converter detected [ 238.188096][ T5721] usb 1-1: oti6858 converter now attached to ttyUSB0 [ 238.360637][ T7068] FAULT_INJECTION: forcing a failure. [ 238.360637][ T7068] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 238.360682][ T7068] CPU: 1 UID: 0 PID: 7068 Comm: syz.3.392 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 238.360711][ T7068] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 238.360737][ T7068] Call Trace: [ 238.360747][ T7068] [ 238.360757][ T7068] dump_stack_lvl+0xe8/0x150 [ 238.360796][ T7068] should_fail_ex+0x46b/0x600 [ 238.360839][ T7068] prepare_alloc_pages+0x223/0x650 [ 238.360871][ T7068] __alloc_frozen_pages_noprof+0x1a1/0x5c0 [ 238.360902][ T7068] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 238.360931][ T7068] ? __pfx_policy_nodemask+0x10/0x10 [ 238.360968][ T7068] alloc_pages_mpol+0xd4/0x280 [ 238.360999][ T7068] alloc_pages_noprof+0xd2/0x2f0 [ 238.361030][ T7068] alloc_pages_exact_noprof+0x3b/0xc0 [ 238.361058][ T7068] snd_pcm_attach_substream+0x5c8/0xb20 [ 238.361097][ T7068] snd_pcm_open_substream+0xb9/0x24f0 [ 238.361129][ T7068] ? preempt_schedule_thunk+0x16/0x40 [ 238.361170][ T7068] ? preempt_schedule_common+0x7f/0xd0 [ 238.361204][ T7068] ? preempt_schedule_thunk+0x16/0x40 [ 238.361237][ T7068] ? __pfx_snd_pcm_open_substream+0x10/0x10 [ 238.361270][ T7068] ? _raw_spin_unlock_irqrestore+0x76/0x80 [ 238.361304][ T7068] ? mutex_lock_nested+0x152/0x1d0 [ 238.361329][ T7068] ? snd_pcm_open+0x17d/0x620 [ 238.361362][ T7068] snd_pcm_open+0x1d2/0x620 [ 238.361404][ T7068] ? __pfx_snd_pcm_open+0x10/0x10 [ 238.361431][ T7068] ? __pfx_default_wake_function+0x10/0x10 [ 238.361462][ T7068] ? snd_lookup_minor_data+0x11e/0x150 [ 238.361510][ T7068] snd_pcm_playback_open+0x5f/0xc0 [ 238.361546][ T7068] chrdev_open+0x4dc/0x600 [ 238.361571][ T7068] ? __pfx_chrdev_open+0x10/0x10 [ 238.361591][ T7068] ? fsnotify_open_perm_and_set_mode+0x13b/0x6c0 [ 238.361634][ T7068] ? __pfx_chrdev_open+0x10/0x10 [ 238.361656][ T7068] do_dentry_open+0x849/0x1420 [ 238.361693][ T7068] vfs_open+0x3b/0x350 [ 238.361715][ T7068] ? path_openat+0x142d/0x1d60 [ 238.361749][ T7068] path_openat+0x1448/0x1d60 [ 238.361802][ T7068] do_file_open+0x23e/0x4a0 [ 238.361843][ T7068] ? __pfx_do_file_open+0x10/0x10 [ 238.361900][ T7068] ? alloc_fd+0x654/0x6d0 [ 238.361939][ T7068] do_sys_openat2+0x115/0x200 [ 238.361968][ T7068] ? __pfx_do_sys_openat2+0x10/0x10 [ 238.361995][ T7068] ? exc_page_fault+0x6a/0xc0 [ 238.362031][ T7068] ? do_user_addr_fault+0xc4c/0x1340 [ 238.362060][ T7068] __x64_sys_openat+0x138/0x170 [ 238.362092][ T7068] do_syscall_64+0x166/0x520 [ 238.362146][ T7068] ? trace_irq_disable+0x3b/0x140 [ 238.362187][ T7068] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 238.362213][ T7068] ? clear_bhb_loop+0x70/0xc0 [ 238.362240][ T7068] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 238.362262][ T7068] RIP: 0033:0x7f395dfceb0e [ 238.362289][ T7068] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 238.362303][ T7068] RSP: 002b:00007f395c265b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 238.362342][ T7068] RAX: ffffffffffffffda RBX: 00007f395c2666c0 RCX: 00007f395dfceb0e [ 238.362360][ T7068] RDX: 0000000000000002 RSI: 00007f395c265c00 RDI: ffffffffffffff9c [ 238.362377][ T7068] RBP: 00007f395c265c00 R08: 0000000000000000 R09: 0000000000000000 [ 238.362393][ T7068] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 238.362407][ T7068] R13: 00007f395e296038 R14: 00007f395e295fa0 R15: 00007fffa16f9958 [ 238.362442][ T7068] [ 238.365040][ T5721] usb 1-1: USB disconnect, device number 19 [ 238.862319][ T5721] oti6858 ttyUSB0: oti6858 converter now disconnected from ttyUSB0 [ 238.867711][ T5721] oti6858 1-1:1.0: device disconnected [ 238.883214][ T5869] legousbtower 2-1:14.57: interrupt endpoints not found [ 239.154652][ T5869] legousbtower 2-1:14.228: LEGO USB Tower firmware version is 170.80 build 16178 [ 239.220809][ T5869] legousbtower 2-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 239.335121][ T10] legousbtower 5-1:14.228: get version request failed: -71 [ 239.335320][ T10] legousbtower 5-1:14.228: probe with driver legousbtower failed with error -71 [ 239.383180][ T10] usb 5-1: USB disconnect, device number 20 [ 239.386310][ T5721] usb 3-1: new full-speed USB device number 25 using dummy_hcd [ 239.557703][ T5721] usb 3-1: not running at top speed; connect to a high speed hub [ 239.557750][ T5721] usb 3-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 239.559290][ T5721] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 239.559320][ T5721] usb 3-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 239.562895][ T5721] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 239.562926][ T5721] usb 3-1: Product: syz [ 239.562943][ T5721] usb 3-1: Manufacturer: syz [ 239.562960][ T5721] usb 3-1: SerialNumber: syz [ 239.675019][ T7084] netlink: 14 bytes leftover after parsing attributes in process `syz.4.398'. [ 239.746166][ T5869] usb 1-1: new full-speed USB device number 20 using dummy_hcd [ 239.857628][ T7087] comedi comedi3: board detection failed [ 240.047453][ T7089] bridge0: port 3(netdevsim0) entered blocking state [ 240.099074][ T7090] netlink: 'syz.3.400': attribute type 10 has an invalid length. [ 240.102200][ T7089] bridge0: port 3(netdevsim0) entered disabled state [ 240.165228][ T7089] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 240.280445][ T5869] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 240.438050][ T7089] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 240.678177][ T7089] bridge0: port 3(netdevsim0) entered blocking state [ 240.681175][ T7089] bridge0: port 3(netdevsim0) entered forwarding state [ 240.780192][ T7090] bridge0: port 3(netdevsim0) entered disabled state [ 240.787712][ T7090] bridge0: port 2(bridge_slave_1) entered disabled state [ 240.807463][ T7090] bridge0: port 1(bridge_slave_0) entered disabled state [ 243.809646][ T10] usb 3-1: USB disconnect, device number 25 [ 244.236471][ T5319] usb 2-1: USB disconnect, device number 23 [ 244.492157][ T5869] usb 1-1: unable to read config index 0 descriptor/all [ 244.492200][ T5869] usb 1-1: can't read configurations, error -71 [ 244.505541][ T5319] legousbtower 2-1:14.228: LEGO USB Tower #-160 now disconnected [ 245.040923][ T7111] netlink: 4 bytes leftover after parsing attributes in process `syz.1.409'. [ 245.041034][ T7111] bridge_slave_1: left allmulticast mode [ 245.041067][ T7111] bridge_slave_1: left promiscuous mode [ 245.041900][ T7111] bridge0: port 2(bridge_slave_1) entered disabled state [ 245.267008][ T7111] bridge_slave_0: left allmulticast mode [ 245.267049][ T7111] bridge_slave_0: left promiscuous mode [ 245.288996][ T7111] bridge0: port 1(bridge_slave_0) entered disabled state [ 245.289978][ T7103] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 245.389614][ T6274] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 245.457254][ T10] usb 5-1: new full-speed USB device number 21 using dummy_hcd [ 245.536149][ T6274] usb 4-1: Using ep0 maxpacket: 32 [ 245.539316][ T6274] usb 4-1: unable to get BOS descriptor or descriptor too short [ 245.539376][ T6274] usb 4-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 245.541068][ T6274] usb 4-1: config 14 has an invalid interface number: 57 but max is 1 [ 245.541098][ T6274] usb 4-1: config 14 has an invalid interface number: 228 but max is 1 [ 245.541125][ T6274] usb 4-1: config 14 has no interface number 0 [ 245.541139][ T6274] usb 4-1: config 14 has no interface number 1 [ 245.541191][ T6274] usb 4-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 245.541210][ T6274] usb 4-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 245.541229][ T6274] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 245.541250][ T6274] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 245.541271][ T6274] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 245.541291][ T6274] usb 4-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 245.541311][ T6274] usb 4-1: config 14 interface 57 has no altsetting 0 [ 245.541326][ T6274] usb 4-1: config 14 interface 228 has no altsetting 0 [ 245.545284][ T6274] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 245.545315][ T6274] usb 4-1: Product: syz [ 245.545332][ T6274] usb 4-1: Manufacturer: syz [ 245.545348][ T6274] usb 4-1: SerialNumber: syz [ 245.805545][ T10] usb 5-1: not running at top speed; connect to a high speed hub [ 245.805590][ T10] usb 5-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 245.815960][ T10] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 245.816150][ T10] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 245.825513][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 245.825545][ T10] usb 5-1: Product: syz [ 245.825624][ T10] usb 5-1: Manufacturer: syz [ 245.825642][ T10] usb 5-1: SerialNumber: syz [ 245.920419][ T10] oti6858 5-1:1.0: oti6858 converter detected [ 245.961862][ T10] usb 5-1: oti6858 converter now attached to ttyUSB0 [ 246.138119][ T31] usb 5-1: USB disconnect, device number 21 [ 246.216953][ T6274] legousbtower 4-1:14.57: interrupt endpoints not found [ 246.235681][ T31] oti6858 ttyUSB0: oti6858 converter now disconnected from ttyUSB0 [ 246.239350][ T31] oti6858 5-1:1.0: device disconnected [ 246.432952][ T6274] legousbtower 4-1:14.228: get version request failed: -71 [ 246.433085][ T6274] legousbtower 4-1:14.228: probe with driver legousbtower failed with error -71 [ 246.497449][ T6274] usb 4-1: USB disconnect, device number 22 [ 246.776454][ T5694] usb 3-1: new full-speed USB device number 26 using dummy_hcd [ 246.808942][ T7131] netlink: 76 bytes leftover after parsing attributes in process `syz.0.415'. [ 246.927714][ T5694] usb 3-1: not running at top speed; connect to a high speed hub [ 246.927757][ T5694] usb 3-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 246.929308][ T5694] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 246.929336][ T5694] usb 3-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 246.932106][ T5694] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 246.932218][ T5694] usb 3-1: Product: syz [ 246.932235][ T5694] usb 3-1: Manufacturer: syz [ 246.932251][ T5694] usb 3-1: SerialNumber: syz [ 247.256924][ T5694] usb 3-1: USB disconnect, device number 26 [ 248.300022][ T7167] netlink: 96 bytes leftover after parsing attributes in process `syz.2.429'. [ 249.867362][ T7174] netdevsim netdevsim2: Direct firmware load for ./file0 failed with error -2 [ 249.867432][ T7174] netdevsim netdevsim2: Falling back to sysfs fallback for: ./file0 [ 250.061298][ T1495] IPVS: starting estimator thread 0... [ 250.688526][ T7178] IPVS: using max 7 ests per chain, 16800 per kthread [ 251.682843][ T7152] syz.1.423 (7152) used greatest stack depth: 18016 bytes left [ 252.426180][ T1238] usb 4-1: new full-speed USB device number 23 using dummy_hcd [ 252.654570][ T1238] usb 4-1: not running at top speed; connect to a high speed hub [ 252.654619][ T1238] usb 4-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 252.677595][ T1238] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 252.677652][ T1238] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 252.681819][ T1238] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 252.681849][ T1238] usb 4-1: Product: syz [ 252.681859][ T1238] usb 4-1: Manufacturer: syz [ 252.681870][ T1238] usb 4-1: SerialNumber: syz [ 252.844182][ T1238] oti6858 4-1:1.0: required endpoints missing [ 253.070396][ T200] usb 4-1: USB disconnect, device number 23 [ 254.081802][ T7215] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 255.712312][ T1330] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.718653][ T1330] ieee802154 phy1 wpan1: encryption failed: -22 [ 259.086148][ T200] usb 5-1: new full-speed USB device number 22 using dummy_hcd [ 259.239006][ T200] usb 5-1: not running at top speed; connect to a high speed hub [ 259.239053][ T200] usb 5-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 259.242133][ T200] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 259.242194][ T200] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 259.291413][ T200] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 259.291445][ T200] usb 5-1: Product: syz [ 259.291462][ T200] usb 5-1: Manufacturer: syz [ 259.291478][ T200] usb 5-1: SerialNumber: syz [ 259.354683][ T200] oti6858 5-1:1.0: required endpoints missing [ 259.696387][ T5721] usb 5-1: USB disconnect, device number 22 [ 260.066166][ T200] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 260.217401][ T200] usb 1-1: Using ep0 maxpacket: 8 [ 260.218673][ T200] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 260.220432][ T200] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 260.220494][ T200] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 260.220522][ T200] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 260.220551][ T200] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 260.220579][ T200] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 260.220625][ T200] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 260.528567][ T7303] vivid-002: disconnect [ 260.671195][ T7302] vivid-002: reconnect [ 261.017390][ T5319] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 261.166426][ T5319] usb 2-1: Using ep0 maxpacket: 8 [ 261.171597][ T5319] usb 2-1: unable to get BOS descriptor or descriptor too short [ 261.171718][ T5319] usb 2-1: New USB device found, idVendor=0e41, idProduct=4248, bcdDevice= 0.40 [ 261.174440][ T5319] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0xC has invalid maxpacket 512, setting to 64 [ 261.214703][ T5319] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 261.214735][ T5319] usb 2-1: Product: syz [ 261.214814][ T5319] usb 2-1: Manufacturer: syz [ 261.214831][ T5319] usb 2-1: SerialNumber: syz [ 261.329434][ T200] usb 1-1: usb_control_msg returned -71 [ 261.329511][ T200] usbtmc 1-1:16.0: can't read capabilities [ 261.407409][ T200] usb 1-1: USB disconnect, device number 22 [ 261.731221][ T5319] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 261.731294][ T5319] usb 2-1: MIDIStreaming interface descriptor not found [ 262.536107][ T1238] usb 3-1: new full-speed USB device number 27 using dummy_hcd [ 262.601562][ T5319] usb 2-1: USB disconnect, device number 24 [ 262.753906][ T1238] usb 3-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 262.756216][ T1238] usb 3-1: config 0 has an invalid interface number: 8 but max is 0 [ 262.756248][ T1238] usb 3-1: config 0 has no interface number 0 [ 262.756360][ T1238] usb 3-1: config 0 interface 8 altsetting 0 has an endpoint descriptor with address 0x9F, changing to 0x8F [ 262.756446][ T1238] usb 3-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 262.756577][ T1238] usb 3-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 262.818543][ T1238] usb 3-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 262.818578][ T1238] usb 3-1: Product: syz [ 262.818595][ T1238] usb 3-1: SerialNumber: syz [ 262.892984][ T7352] vivid-004: disconnect [ 262.895892][ T1238] usb 3-1: config 0 descriptor?? [ 262.962421][ T7348] vivid-004: reconnect [ 263.052115][ T1238] cm109 3-1:0.8: invalid payload size 0, expected 4 [ 263.174241][ T1238] input: CM109 USB driver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.8/input/input6 [ 263.244683][ T7360] udevd[7360]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 263.291296][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: usb_submit_urb (urb_irq) failed -90 [ 263.316114][ T5319] usb 2-1: new full-speed USB device number 25 using dummy_hcd [ 263.471041][ T5319] usb 2-1: not running at top speed; connect to a high speed hub [ 263.471089][ T5319] usb 2-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 263.472731][ T5319] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 263.472855][ T5319] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 263.529443][ T5319] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 263.529476][ T5319] usb 2-1: Product: syz [ 263.529493][ T5319] usb 2-1: Manufacturer: syz [ 263.529524][ T5319] usb 2-1: SerialNumber: syz [ 263.566353][ T5724] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 263.572605][ T5319] oti6858 2-1:1.0: required endpoints missing [ 263.743044][ T5724] usb 4-1: unable to get BOS descriptor or descriptor too short [ 263.743106][ T5724] usb 4-1: New USB device found, idVendor=0d8c, idProduct=0103, bcdDevice= 0.40 [ 263.744417][ T5724] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 263.744465][ T5724] usb 4-1: can't read configurations, error -71 [ 263.872846][ T5694] usb 2-1: USB disconnect, device number 25 [ 264.199258][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 264.203694][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 264.203982][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 264.204438][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 264.204683][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 264.204935][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 264.205193][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 264.205437][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 264.205678][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 264.205914][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 264.508494][ T1238] usb 3-1: USB disconnect, device number 27 [ 264.508586][ C1] cm109 3-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 264.772275][ T7386] FAULT_INJECTION: forcing a failure. [ 264.772275][ T7386] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 264.772316][ T7386] CPU: 0 UID: 0 PID: 7386 Comm: syz.0.496 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 264.772344][ T7386] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 264.772359][ T7386] Call Trace: [ 264.772369][ T7386] [ 264.772380][ T7386] dump_stack_lvl+0xe8/0x150 [ 264.772424][ T7386] should_fail_ex+0x46b/0x600 [ 264.772467][ T7386] _copy_to_iter+0x1e4/0x1810 [ 264.772512][ T7386] ? __pfx__copy_to_iter+0x10/0x10 [ 264.772546][ T7386] ? _copy_to_iter+0x255/0x1810 [ 264.772581][ T7386] ? rt_mutex_slowunlock+0x4ee/0xa30 [ 264.772615][ T7386] __skb_datagram_iter+0xf8/0x980 [ 264.772650][ T7386] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 264.772684][ T7386] ? rt_spin_unlock+0x159/0x200 [ 264.772713][ T7386] skb_copy_datagram_iter+0xb5/0x240 [ 264.772768][ T7386] tun_do_read+0x1b42/0x28b0 [ 264.772816][ T7386] ? __pfx_tun_do_read+0x10/0x10 [ 264.772844][ T7386] ? lock_acquire+0x115/0x350 [ 264.772889][ T7386] ? tun_get+0x1c/0x2f0 [ 264.772912][ T7386] ? __pfx_default_wake_function+0x10/0x10 [ 264.772946][ T7386] ? tun_get+0x1c/0x2f0 [ 264.772969][ T7386] ? tun_get+0x1c/0x2f0 [ 264.772995][ T7386] tun_chr_read_iter+0x141/0x260 [ 264.773020][ T7386] do_iter_readv_writev+0x624/0x8d0 [ 264.773056][ T7386] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 264.773093][ T7386] ? bpf_lsm_file_permission+0x9/0x20 [ 264.773121][ T7386] ? security_file_permission+0x75/0x260 [ 264.773158][ T7386] ? rw_verify_area+0x250/0x4d0 [ 264.773191][ T7386] vfs_readv+0x293/0x850 [ 264.773214][ T7386] ? __pfx_futex_wake+0x10/0x10 [ 264.773251][ T7386] ? __pfx_vfs_readv+0x10/0x10 [ 264.773290][ T7386] ? __fget_files+0x2a/0x420 [ 264.773321][ T7386] ? __fget_files+0x3a8/0x420 [ 264.773346][ T7386] ? __fget_files+0x2a/0x420 [ 264.773384][ T7386] __x64_sys_preadv+0x19f/0x2c0 [ 264.773423][ T7386] ? __pfx___x64_sys_preadv+0x10/0x10 [ 264.773468][ T7386] do_syscall_64+0x166/0x520 [ 264.773500][ T7386] ? trace_irq_disable+0x3b/0x140 [ 264.773533][ T7386] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 264.773558][ T7386] ? clear_bhb_loop+0x70/0xc0 [ 264.773588][ T7386] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 264.773611][ T7386] RIP: 0033:0x7fd6bf42e2d9 [ 264.773632][ T7386] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 264.773653][ T7386] RSP: 002b:00007fd6bd686028 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 264.773679][ T7386] RAX: ffffffffffffffda RBX: 00007fd6bf6b5fa0 RCX: 00007fd6bf42e2d9 [ 264.773696][ T7386] RDX: 0000000000000001 RSI: 0000200000000080 RDI: 0000000000000003 [ 264.773710][ T7386] RBP: 00007fd6bf4c5888 R08: 0000000000000006 R09: 0000000000000000 [ 264.773726][ T7386] R10: 0000000040000006 R11: 0000000000000246 R12: 0000000000000000 [ 264.773743][ T7386] R13: 00007fd6bf6b6038 R14: 00007fd6bf6b5fa0 R15: 00007ffc5cee7758 [ 264.773775][ T7386] [ 265.204532][ T7393] vivid-004: disconnect [ 265.329326][ T7392] vivid-004: reconnect [ 265.382975][ T1238] cm109 3-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 265.592649][ T7402] Bluetooth: MGMT ver 1.23 [ 265.846200][ T5721] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 265.997156][ T5721] usb 2-1: New USB device found, idVendor=0525, idProduct=1080, bcdDevice= 1.00 [ 265.998530][ T5721] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 266.696218][ T5869] usb 5-1: new full-speed USB device number 23 using dummy_hcd [ 266.850153][ T5869] usb 5-1: not running at top speed; connect to a high speed hub [ 266.850199][ T5869] usb 5-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 266.851703][ T5869] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 266.851762][ T5869] usb 5-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 266.854637][ T5869] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 266.854663][ T5869] usb 5-1: Product: syz [ 266.854676][ T5869] usb 5-1: Manufacturer: syz [ 266.854691][ T5869] usb 5-1: SerialNumber: syz [ 266.901129][ T7426] vivid-002: disconnect [ 266.956844][ T5869] oti6858 5-1:1.0: required endpoints missing [ 266.976113][ T5319] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 267.019959][ T7425] vivid-002: reconnect [ 267.039576][ T5721] net1080 2-1:1.0 usb0: register 'net1080' at usb-dummy_hcd.1-1, NetChip TurboCONNECT, 96:a0:70:15:df:a2 [ 267.126294][ T5319] usb 3-1: Using ep0 maxpacket: 32 [ 267.132730][ T5319] usb 3-1: unable to get BOS descriptor or descriptor too short [ 267.132790][ T5319] usb 3-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 267.135797][ T5319] usb 3-1: config 14 has an invalid interface number: 57 but max is 1 [ 267.171231][ T5319] usb 3-1: config 14 has an invalid interface number: 228 but max is 1 [ 267.171262][ T5319] usb 3-1: config 14 has no interface number 0 [ 267.171281][ T5319] usb 3-1: config 14 has no interface number 1 [ 267.171369][ T5319] usb 3-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 267.171398][ T5319] usb 3-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 267.171427][ T5319] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 267.171458][ T5319] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 267.171490][ T5319] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 267.171520][ T5319] usb 3-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 267.171550][ T5319] usb 3-1: config 14 interface 57 has no altsetting 0 [ 267.171571][ T5319] usb 3-1: config 14 interface 228 has no altsetting 0 [ 267.212526][ T5319] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 267.212555][ T5319] usb 3-1: Product: syz [ 267.212570][ T5319] usb 3-1: Manufacturer: syz [ 267.212584][ T5319] usb 3-1: SerialNumber: syz [ 267.231549][ T5721] usb 2-1: USB disconnect, device number 26 [ 267.334478][ T1238] usb 5-1: USB disconnect, device number 23 [ 267.404475][ T5721] net1080 2-1:1.0 usb0: unregister 'net1080' usb-dummy_hcd.1-1, NetChip TurboCONNECT [ 267.946617][ T5319] legousbtower 3-1:14.57: interrupt endpoints not found [ 268.426363][ T7447] netlink: 8 bytes leftover after parsing attributes in process `syz.3.516'. [ 268.427712][ T7447] netlink: 8 bytes leftover after parsing attributes in process `syz.3.516'. [ 268.428053][ T7447] netlink: 8 bytes leftover after parsing attributes in process `syz.3.516'. [ 268.430090][ T7447] netlink: 8 bytes leftover after parsing attributes in process `syz.3.516'. [ 268.430910][ T5319] legousbtower 3-1:14.228: LEGO USB Tower firmware version is 170.80 build 16178 [ 268.509020][ T5319] legousbtower 3-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 269.251783][ T1238] usb 3-1: USB disconnect, device number 28 [ 269.308149][ T1238] legousbtower 3-1:14.228: LEGO USB Tower #-160 now disconnected [ 269.541160][ T7480] vivid-004: disconnect [ 269.621828][ T7477] vivid-004: reconnect [ 271.601300][ T7522] netlink: 24 bytes leftover after parsing attributes in process `syz.2.539'. [ 272.284994][ T7528] vivid-000: disconnect [ 272.437531][ T7527] vivid-000: reconnect [ 273.176257][ T1238] usb 1-1: new full-speed USB device number 23 using dummy_hcd [ 273.326171][ T6274] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 273.556233][ T6274] usb 3-1: Using ep0 maxpacket: 32 [ 273.563656][ T6274] usb 3-1: unable to get BOS descriptor or descriptor too short [ 273.563719][ T6274] usb 3-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 273.565426][ T6274] usb 3-1: config 14 has an invalid interface number: 57 but max is 1 [ 273.565456][ T6274] usb 3-1: config 14 has an invalid interface number: 228 but max is 1 [ 273.565479][ T6274] usb 3-1: config 14 has no interface number 0 [ 273.565498][ T6274] usb 3-1: config 14 has no interface number 1 [ 273.565572][ T6274] usb 3-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 273.565599][ T6274] usb 3-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 273.565628][ T6274] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 273.565658][ T6274] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 273.565689][ T6274] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 273.565717][ T6274] usb 3-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 273.565747][ T6274] usb 3-1: config 14 interface 57 has no altsetting 0 [ 273.565768][ T6274] usb 3-1: config 14 interface 228 has no altsetting 0 [ 273.732878][ T6274] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 273.732911][ T6274] usb 3-1: Product: syz [ 273.732928][ T6274] usb 3-1: Manufacturer: syz [ 273.732944][ T6274] usb 3-1: SerialNumber: syz [ 274.287459][ T6274] legousbtower 3-1:14.57: interrupt endpoints not found [ 274.678069][ T6274] legousbtower 3-1:14.228: LEGO USB Tower firmware version is 170.80 build 16178 [ 274.709863][ T6274] legousbtower 3-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 275.471780][ T31] usb 3-1: USB disconnect, device number 29 [ 275.643284][ T7558] 9pnet_virtio: no channels available for device syz [ 275.729649][ T31] legousbtower 3-1:14.228: LEGO USB Tower #-160 now disconnected [ 277.089201][ T7573] vivid-004: disconnect [ 277.427861][ T7570] vivid-004: reconnect [ 278.437507][ T1238] usb 1-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 278.438938][ T1238] usb 1-1: unable to read config index 0 descriptor/start: -32 [ 278.438966][ T1238] usb 1-1: chopping to 0 config(s) [ 278.438994][ T1238] usb 1-1: can't read configurations, error -32 [ 278.566127][ T1238] usb 1-1: new full-speed USB device number 24 using dummy_hcd [ 278.656165][ T31] usb 3-1: new full-speed USB device number 30 using dummy_hcd [ 278.786226][ T31] usb 3-1: device descriptor read/64, error -71 [ 279.035133][ T31] usb 3-1: new full-speed USB device number 31 using dummy_hcd [ 279.166530][ T31] usb 3-1: device descriptor read/64, error -71 [ 279.353000][ T31] usb usb3-port1: attempt power cycle [ 279.956641][ T31] usb 3-1: new full-speed USB device number 32 using dummy_hcd [ 280.002486][ T31] usb 3-1: device descriptor read/8, error -71 [ 280.286235][ T31] usb 3-1: new full-speed USB device number 33 using dummy_hcd [ 280.308784][ T31] usb 3-1: device descriptor read/8, error -71 [ 280.417547][ T31] usb usb3-port1: unable to enumerate USB device [ 281.638851][ T7605] netlink: 14 bytes leftover after parsing attributes in process `syz.4.558'. [ 281.926116][ T6274] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 282.126248][ T6274] usb 1-1: Using ep0 maxpacket: 32 [ 282.129952][ T6274] usb 1-1: unable to get BOS descriptor or descriptor too short [ 282.130013][ T6274] usb 1-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 282.131496][ T6274] usb 1-1: config 14 has an invalid interface number: 57 but max is 1 [ 282.131522][ T6274] usb 1-1: config 14 has an invalid interface number: 228 but max is 1 [ 282.131546][ T6274] usb 1-1: config 14 has no interface number 0 [ 282.131565][ T6274] usb 1-1: config 14 has no interface number 1 [ 282.131639][ T6274] usb 1-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 282.131666][ T6274] usb 1-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 282.131695][ T6274] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 282.131733][ T6274] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 282.131764][ T6274] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 282.131794][ T6274] usb 1-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 282.131824][ T6274] usb 1-1: config 14 interface 57 has no altsetting 0 [ 282.131845][ T6274] usb 1-1: config 14 interface 228 has no altsetting 0 [ 284.566800][ T6274] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 284.566834][ T6274] usb 1-1: Product: syz [ 284.566851][ T6274] usb 1-1: Manufacturer: syz [ 284.566868][ T6274] usb 1-1: SerialNumber: syz [ 286.340975][ T6274] usb 1-1: can't set config #14, error -71 [ 286.478707][ T6274] usb 1-1: USB disconnect, device number 25 [ 288.275082][ T7616] vivid-001: disconnect [ 288.400349][ T7615] vivid-001: reconnect [ 289.649186][ T5319] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 289.922359][ T5319] usb 3-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 289.949815][ T5319] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 289.949884][ T5319] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 290.571579][ T5319] keyspan 3-1:1.0: Keyspan 2 port adapter converter detected [ 290.584349][ T5319] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 81 [ 290.584438][ T5319] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 1 [ 290.610654][ T5319] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 84 [ 290.610762][ T5319] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 2 [ 290.733401][ T5319] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 290.783941][ T5319] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 88 [ 290.784044][ T5319] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 6 [ 290.847774][ T5319] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 317.157762][ T1330] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.157846][ T1330] ieee802154 phy1 wpan1: encryption failed: -22 [ 326.053548][ T5591] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 326.145389][ T5591] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 326.194793][ T5591] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 326.207707][ T5591] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 326.209548][ T5591] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 326.211078][ T5591] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 326.249711][ T5591] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 326.265438][ T5591] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 326.284859][ T5591] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 326.287323][ T5591] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 326.471868][ T5591] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 326.513533][ T5591] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 326.542467][ T5591] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 326.543909][ T5591] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 326.632087][ T5591] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 326.851186][ T5591] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 326.932493][ T5591] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 326.934994][ T5591] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 326.957274][ T5591] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 326.959638][ T5591] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 327.223185][ T5591] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 327.332539][ T5591] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 327.353291][ T5591] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 327.411675][ T5591] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 327.429512][ T5591] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 328.396273][ T4901] Bluetooth: hci6: command tx timeout [ 328.483076][ T4901] Bluetooth: hci5: command tx timeout [ 328.796277][ T4901] Bluetooth: hci7: command tx timeout [ 329.036345][ T4901] Bluetooth: hci8: command tx timeout [ 329.597272][ T4901] Bluetooth: hci9: command tx timeout [ 330.509926][ T4901] Bluetooth: hci6: command tx timeout [ 330.560440][ T4901] Bluetooth: hci5: command tx timeout [ 330.878578][ T4901] Bluetooth: hci7: command tx timeout [ 331.116160][ T4901] Bluetooth: hci8: command tx timeout [ 331.696102][ T4901] Bluetooth: hci9: command tx timeout [ 332.556309][ T4901] Bluetooth: hci6: command tx timeout [ 332.636200][ T4901] Bluetooth: hci5: command tx timeout [ 332.956181][ T4901] Bluetooth: hci7: command tx timeout [ 333.196122][ T4901] Bluetooth: hci8: command tx timeout [ 333.757236][ T4901] Bluetooth: hci9: command tx timeout [ 334.636287][ T4901] Bluetooth: hci6: command tx timeout [ 334.716687][ T4901] Bluetooth: hci5: command tx timeout [ 335.036262][ T4901] Bluetooth: hci7: command tx timeout [ 335.276199][ T4901] Bluetooth: hci8: command tx timeout [ 335.837370][ T4901] Bluetooth: hci9: command tx timeout [ 341.206008][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 341.316000][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 341.336000][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 341.455999][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 341.566006][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 341.606004][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 341.615997][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 341.786003][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 341.896001][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 342.296000][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 353.219455][ T92] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 354.210843][ T5591] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 354.319472][ T5591] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 354.407360][ T5591] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 354.472465][ T5591] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 354.509203][ T5591] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 358.085891][ T4901] Bluetooth: hci0: command tx timeout [ 360.156076][ T4901] Bluetooth: hci0: command tx timeout [ 362.238337][ T4901] Bluetooth: hci0: command tx timeout [ 363.994386][ T5591] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 364.146425][ T5591] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 364.149440][ T5591] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 364.174854][ T5591] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 364.192251][ T5591] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 364.316190][ T5588] Bluetooth: hci0: command tx timeout [ 364.930104][ T5591] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 365.110856][ T5591] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 365.112350][ T5591] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 365.243916][ T5591] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 365.245319][ T5591] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 366.404302][ T4901] Bluetooth: hci1: command tx timeout [ 367.838399][ T4901] Bluetooth: hci2: command tx timeout [ 368.478177][ T4901] Bluetooth: hci1: command tx timeout [ 369.916257][ T5591] Bluetooth: hci2: command tx timeout [ 370.071690][ T5591] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 370.140658][ T5591] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 370.557097][ T5591] Bluetooth: hci1: command tx timeout [ 370.756416][ T5591] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 370.760619][ T5591] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 370.763056][ T5591] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 371.996637][ T4901] Bluetooth: hci2: command tx timeout [ 372.352195][ T5591] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 372.391360][ T5591] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 372.395767][ T5591] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 372.433305][ T5591] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 372.455344][ T5591] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 372.636186][ T5591] Bluetooth: hci1: command tx timeout [ 373.038740][ T5591] Bluetooth: hci3: command tx timeout [ 373.455266][ T92] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 374.076530][ T5591] Bluetooth: hci2: command tx timeout [ 375.116369][ T5591] Bluetooth: hci3: command tx timeout [ 377.196440][ T5591] Bluetooth: hci3: command tx timeout [ 377.855088][ T4901] Bluetooth: hci10: command tx timeout [ 378.583770][ T1330] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.583969][ T1330] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.276325][ T4901] Bluetooth: hci3: command tx timeout [ 379.916523][ T4901] Bluetooth: hci10: command tx timeout [ 381.733230][ T92] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 381.996221][ T4901] Bluetooth: hci10: command tx timeout [ 384.077611][ T4901] Bluetooth: hci10: command tx timeout [ 384.734965][ T92] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 385.891520][ T7734] bridge0: port 1(bridge_slave_0) entered blocking state [ 385.891798][ T7734] bridge0: port 1(bridge_slave_0) entered disabled state [ 385.892430][ T7734] bridge_slave_0: entered allmulticast mode [ 385.895883][ T7734] bridge_slave_0: entered promiscuous mode [ 386.014138][ T7734] bridge0: port 2(bridge_slave_1) entered blocking state [ 386.014565][ T7734] bridge0: port 2(bridge_slave_1) entered disabled state [ 386.015177][ T7734] bridge_slave_1: entered allmulticast mode [ 386.045365][ T7734] bridge_slave_1: entered promiscuous mode [ 386.195408][ T7756] bridge0: port 1(bridge_slave_0) entered blocking state [ 386.195547][ T7756] bridge0: port 1(bridge_slave_0) entered disabled state [ 386.196389][ T7756] bridge_slave_0: entered allmulticast mode [ 386.220687][ T7756] bridge_slave_0: entered promiscuous mode [ 386.343270][ T7756] bridge0: port 2(bridge_slave_1) entered blocking state [ 386.343549][ T7756] bridge0: port 2(bridge_slave_1) entered disabled state [ 386.343760][ T7756] bridge_slave_1: entered allmulticast mode [ 386.376081][ T7756] bridge_slave_1: entered promiscuous mode [ 386.378733][ T7766] bridge0: port 1(bridge_slave_0) entered blocking state [ 386.378900][ T7766] bridge0: port 1(bridge_slave_0) entered disabled state [ 386.379101][ T7766] bridge_slave_0: entered allmulticast mode [ 386.382318][ T7766] bridge_slave_0: entered promiscuous mode [ 386.427124][ T7755] bridge0: port 1(bridge_slave_0) entered blocking state [ 386.427271][ T7755] bridge0: port 1(bridge_slave_0) entered disabled state [ 386.427492][ T7755] bridge_slave_0: entered allmulticast mode [ 386.459376][ T7755] bridge_slave_0: entered promiscuous mode [ 386.549614][ T7734] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 386.652707][ T7766] bridge0: port 2(bridge_slave_1) entered blocking state [ 386.652884][ T7766] bridge0: port 2(bridge_slave_1) entered disabled state [ 386.653099][ T7766] bridge_slave_1: entered allmulticast mode [ 386.677844][ T7766] bridge_slave_1: entered promiscuous mode [ 386.697873][ T7755] bridge0: port 2(bridge_slave_1) entered blocking state [ 386.698027][ T7755] bridge0: port 2(bridge_slave_1) entered disabled state [ 386.698263][ T7755] bridge_slave_1: entered allmulticast mode [ 386.701581][ T7755] bridge_slave_1: entered promiscuous mode [ 386.752824][ T7734] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 386.753394][ T7770] bridge0: port 1(bridge_slave_0) entered blocking state [ 386.753536][ T7770] bridge0: port 1(bridge_slave_0) entered disabled state [ 386.753756][ T7770] bridge_slave_0: entered allmulticast mode [ 386.788074][ T7770] bridge_slave_0: entered promiscuous mode [ 386.908680][ T7770] bridge0: port 2(bridge_slave_1) entered blocking state [ 386.909149][ T7770] bridge0: port 2(bridge_slave_1) entered disabled state [ 386.909376][ T7770] bridge_slave_1: entered allmulticast mode [ 386.912584][ T7770] bridge_slave_1: entered promiscuous mode [ 386.987125][ T7756] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 387.115527][ T7756] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 387.143905][ T7766] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 387.189860][ T7755] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 387.214249][ T7734] team0: Port device team_slave_0 added [ 387.294415][ T7766] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 387.309116][ T7755] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 387.312744][ T7734] team0: Port device team_slave_1 added [ 387.349986][ T7770] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 387.497433][ T7770] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 388.609412][ T7756] team0: Port device team_slave_0 added [ 388.752297][ T7756] team0: Port device team_slave_1 added [ 388.755371][ T7766] team0: Port device team_slave_0 added [ 388.772173][ T7755] team0: Port device team_slave_0 added [ 388.774598][ T7734] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 388.774618][ T7734] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 388.774650][ T7734] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 388.928477][ T7766] team0: Port device team_slave_1 added [ 388.931637][ T7755] team0: Port device team_slave_1 added [ 388.932654][ T7734] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 388.932670][ T7734] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 388.932702][ T7734] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 389.001568][ T7770] team0: Port device team_slave_0 added [ 389.098086][ T7770] team0: Port device team_slave_1 added [ 389.099387][ T7756] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 389.099417][ T7756] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 389.099447][ T7756] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 389.246353][ T7756] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 389.246380][ T7756] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 389.246416][ T7756] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 389.255554][ T7766] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 389.255578][ T7766] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 389.255612][ T7766] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 389.267060][ T7755] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 389.267081][ T7755] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 389.267113][ T7755] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 389.501525][ T7766] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 389.501548][ T7766] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 389.501579][ T7766] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 389.504532][ T7755] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 389.504551][ T7755] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 389.504584][ T7755] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 389.624601][ T7770] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 389.624629][ T7770] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 389.624663][ T7770] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 389.762709][ T7770] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 389.762733][ T7770] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 389.762767][ T7770] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 389.828957][ T7734] hsr_slave_0: entered promiscuous mode [ 389.830941][ T7734] hsr_slave_1: entered promiscuous mode [ 389.832207][ T7734] debugfs: 'hsr0' already exists in 'hsr' [ 389.832239][ T7734] Cannot create hsr debugfs directory [ 390.251485][ T7756] hsr_slave_0: entered promiscuous mode [ 390.253141][ T7756] hsr_slave_1: entered promiscuous mode [ 390.254373][ T7756] debugfs: 'hsr0' already exists in 'hsr' [ 390.254405][ T7756] Cannot create hsr debugfs directory [ 390.665473][ T7766] hsr_slave_0: entered promiscuous mode [ 390.673962][ T7766] hsr_slave_1: entered promiscuous mode [ 390.675194][ T7766] debugfs: 'hsr0' already exists in 'hsr' [ 390.675225][ T7766] Cannot create hsr debugfs directory [ 390.708425][ T7755] hsr_slave_0: entered promiscuous mode [ 390.710128][ T7755] hsr_slave_1: entered promiscuous mode [ 390.711328][ T7755] debugfs: 'hsr0' already exists in 'hsr' [ 390.711360][ T7755] Cannot create hsr debugfs directory [ 390.850758][ T7770] hsr_slave_0: entered promiscuous mode [ 390.852470][ T7770] hsr_slave_1: entered promiscuous mode [ 390.853674][ T7770] debugfs: 'hsr0' already exists in 'hsr' [ 390.853707][ T7770] Cannot create hsr debugfs directory [ 396.614640][ T92] bridge_slave_1: left allmulticast mode [ 396.614882][ T92] bridge_slave_1: left promiscuous mode [ 396.658468][ T92] bridge0: port 2(bridge_slave_1) entered disabled state [ 397.114710][ T92] bridge_slave_0: left allmulticast mode [ 397.114757][ T92] bridge_slave_0: left promiscuous mode [ 397.145211][ T92] bridge0: port 1(bridge_slave_0) entered disabled state [ 402.707863][ T92] bond1 (unregistering): Released all slaves [ 402.744986][ T92] bond0 (unregistering): Released all slaves [ 402.778377][ T92] bond2 (unregistering): Released all slaves [ 402.821099][ T92] bond3 (unregistering): Released all slaves [ 403.679888][ T7734] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 405.177472][ T7734] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 405.244468][ T5246] 8021q: adding VLAN 0 to HW filter on device eth1 [ 405.245309][ T7734] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 405.475417][ T7734] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 405.505409][ T7734] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 405.810250][ T7734] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 405.954316][ T7734] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 408.473885][ T7734] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 410.531501][ T5591] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 410.707871][ T5591] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 410.712888][ T5591] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 410.714448][ T5591] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 410.715292][ T5591] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 413.238958][ T7756] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 413.518321][ T4901] Bluetooth: hci5: command tx timeout [ 414.201419][ T7756] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 414.369934][ T5246] 8021q: adding VLAN 0 to HW filter on device eth2 [ 414.389829][ T7756] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 415.596499][ T4901] Bluetooth: hci5: command tx timeout [ 416.949447][ T7756] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 417.676291][ T4901] Bluetooth: hci5: command tx timeout [ 419.085053][ T5591] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 419.135038][ T5591] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 419.150423][ T5591] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 419.152110][ T5591] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 419.154647][ T5591] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 419.756230][ T4901] Bluetooth: hci5: command tx timeout [ 420.085648][ T5588] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 420.151479][ T5588] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 420.169472][ T5588] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 420.171331][ T5588] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 420.172321][ T5588] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 423.036261][ T5591] Bluetooth: hci4: command tx timeout [ 423.041360][ T5588] Bluetooth: hci6: command tx timeout [ 425.116228][ T5588] Bluetooth: hci6: command tx timeout [ 425.116266][ T5588] Bluetooth: hci4: command tx timeout [ 426.753320][ T5588] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 426.823874][ T5588] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 426.839851][ T5588] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 426.877368][ T5588] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 426.878800][ T5588] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 427.357383][ T5588] Bluetooth: hci6: command tx timeout [ 427.357506][ T5591] Bluetooth: hci4: command tx timeout [ 427.779417][ T5588] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 427.846965][ T5588] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 427.849890][ T5588] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 427.900580][ T5588] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 427.941682][ T5588] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 429.004038][ T5588] Bluetooth: hci0: command tx timeout [ 429.437079][ T5588] Bluetooth: hci4: command tx timeout [ 429.437138][ T5588] Bluetooth: hci6: command tx timeout [ 430.076295][ T5591] Bluetooth: hci7: command tx timeout [ 431.036413][ T5591] Bluetooth: hci0: command tx timeout [ 432.157735][ T5591] Bluetooth: hci7: command tx timeout [ 433.116204][ T5591] Bluetooth: hci0: command tx timeout [ 434.236290][ T5591] Bluetooth: hci7: command tx timeout [ 435.196336][ T5591] Bluetooth: hci0: command tx timeout [ 436.316283][ T5591] Bluetooth: hci7: command tx timeout [ 440.012033][ T1330] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.012116][ T1330] ieee802154 phy1 wpan1: encryption failed: -22 [ 470.131754][ T5588] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 470.177314][ T5588] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 470.180231][ T5588] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 470.202002][ T5588] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 470.242533][ T5588] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 472.316346][ T5591] Bluetooth: hci8: command tx timeout [ 474.396102][ T5591] Bluetooth: hci8: command tx timeout [ 476.476084][ T5591] Bluetooth: hci8: command tx timeout [ 478.556254][ T5591] Bluetooth: hci8: command tx timeout [ 479.602215][ T5588] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 479.654771][ T5588] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 479.666429][ T5588] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 479.719030][ T5588] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 479.719940][ T5588] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 480.589128][ T5588] Bluetooth: hci11: unexpected cc 0x0c03 length: 249 > 1 [ 480.640479][ T5588] Bluetooth: hci11: unexpected cc 0x1003 length: 249 > 9 [ 480.682083][ T5588] Bluetooth: hci11: unexpected cc 0x1001 length: 249 > 9 [ 480.702458][ T5588] Bluetooth: hci11: unexpected cc 0x0c23 length: 249 > 4 [ 480.718917][ T5588] Bluetooth: hci11: unexpected cc 0x0c38 length: 249 > 2 [ 481.836271][ T5591] Bluetooth: hci9: command tx timeout [ 482.876517][ T5591] Bluetooth: hci11: command tx timeout [ 483.916325][ T5591] Bluetooth: hci9: command tx timeout [ 484.956188][ T5591] Bluetooth: hci11: command tx timeout [ 485.996127][ T5591] Bluetooth: hci9: command tx timeout [ 487.036088][ T5591] Bluetooth: hci11: command tx timeout [ 487.194493][ T5588] Bluetooth: hci12: unexpected cc 0x0c03 length: 249 > 1 [ 487.253097][ T5588] Bluetooth: hci12: unexpected cc 0x1003 length: 249 > 9 [ 487.283431][ T5588] Bluetooth: hci12: unexpected cc 0x1001 length: 249 > 9 [ 487.321621][ T5588] Bluetooth: hci12: unexpected cc 0x0c23 length: 249 > 4 [ 487.323603][ T5588] Bluetooth: hci12: unexpected cc 0x0c38 length: 249 > 2 [ 488.080676][ T5588] Bluetooth: hci9: command tx timeout [ 488.109496][ T5588] Bluetooth: hci13: unexpected cc 0x0c03 length: 249 > 1 [ 488.161662][ T5588] Bluetooth: hci2: command 0x0406 tx timeout [ 488.161712][ T5588] Bluetooth: hci1: command 0x0406 tx timeout [ 488.188861][ T5598] Bluetooth: hci13: unexpected cc 0x1003 length: 249 > 9 [ 488.211425][ T5598] Bluetooth: hci13: unexpected cc 0x1001 length: 249 > 9 [ 488.251088][ T5598] Bluetooth: hci13: unexpected cc 0x0c23 length: 249 > 4 [ 488.255503][ T5598] Bluetooth: hci13: unexpected cc 0x0c38 length: 249 > 2 [ 489.116147][ T5592] Bluetooth: hci11: command tx timeout [ 489.436202][ T5592] Bluetooth: hci12: command tx timeout [ 490.716556][ T5592] Bluetooth: hci13: command tx timeout [ 491.516208][ T5592] Bluetooth: hci12: command tx timeout [ 492.796330][ T5592] Bluetooth: hci13: command tx timeout [ 493.291650][ T5592] Bluetooth: hci3: command 0x0406 tx timeout [ 493.596246][ T4901] Bluetooth: hci12: command tx timeout [ 494.876427][ T4901] Bluetooth: hci13: command tx timeout [ 495.676184][ T4901] Bluetooth: hci12: command tx timeout [ 496.956486][ T4901] Bluetooth: hci13: command tx timeout [ 498.556349][ T4901] Bluetooth: hci10: command 0x0406 tx timeout [ 501.442512][ T1330] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.442591][ T1330] ieee802154 phy1 wpan1: encryption failed: -22 [ 531.125119][ T4901] Bluetooth: hci14: unexpected cc 0x0c03 length: 249 > 1 [ 531.229220][ T4901] Bluetooth: hci14: unexpected cc 0x1003 length: 249 > 9 [ 531.265505][ T4901] Bluetooth: hci14: unexpected cc 0x1001 length: 249 > 9 [ 531.286407][ T4901] Bluetooth: hci14: unexpected cc 0x0c23 length: 249 > 4 [ 531.293483][ T4901] Bluetooth: hci14: unexpected cc 0x0c38 length: 249 > 2 [ 533.516244][ T4901] Bluetooth: hci14: command tx timeout [ 534.249610][ T4901] Bluetooth: hci5: command 0x0406 tx timeout [ 535.596296][ T5592] Bluetooth: hci14: command tx timeout [ 537.676356][ T5592] Bluetooth: hci14: command tx timeout [ 539.041862][ T7756] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 539.223410][ T7756] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 539.756067][ T5592] Bluetooth: hci14: command tx timeout [ 540.723328][ T4901] Bluetooth: hci15: unexpected cc 0x0c03 length: 249 > 1 [ 540.812268][ T4901] Bluetooth: hci15: unexpected cc 0x1003 length: 249 > 9 [ 540.815659][ T4901] Bluetooth: hci15: unexpected cc 0x1001 length: 249 > 9 [ 540.844060][ T4901] Bluetooth: hci15: unexpected cc 0x0c23 length: 249 > 4 [ 540.854830][ T4901] Bluetooth: hci15: unexpected cc 0x0c38 length: 249 > 2 [ 541.065288][ T1238] usb 3-1: USB disconnect, device number 34 [ 541.494813][ T4901] Bluetooth: hci16: unexpected cc 0x0c03 length: 249 > 1 [ 541.571253][ T4901] Bluetooth: hci16: unexpected cc 0x1003 length: 249 > 9 [ 541.574025][ T4901] Bluetooth: hci16: unexpected cc 0x1001 length: 249 > 9 [ 541.575669][ T4901] Bluetooth: hci16: unexpected cc 0x0c23 length: 249 > 4 [ 541.605616][ T4901] Bluetooth: hci16: unexpected cc 0x0c38 length: 249 > 2 [ 543.036106][ T4901] Bluetooth: hci15: command tx timeout [ 545.119505][ T4901] Bluetooth: hci15: command tx timeout [ 546.876975][ T4901] Bluetooth: hci16: command tx timeout [ 547.196077][ T4901] Bluetooth: hci15: command tx timeout [ 548.305169][ T5592] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 548.381948][ T5592] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 548.383836][ T5592] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 548.446468][ T5592] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 548.484962][ T5592] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 548.957749][ T5592] Bluetooth: hci16: command tx timeout [ 549.052972][ T5591] Bluetooth: hci17: unexpected cc 0x0c03 length: 249 > 1 [ 549.156613][ T5591] Bluetooth: hci17: unexpected cc 0x1003 length: 249 > 9 [ 549.158913][ T5591] Bluetooth: hci17: unexpected cc 0x1001 length: 249 > 9 [ 549.188386][ T5591] Bluetooth: hci17: unexpected cc 0x0c23 length: 249 > 4 [ 549.189378][ T5591] Bluetooth: hci17: unexpected cc 0x0c38 length: 249 > 2 [ 549.277687][ T5591] Bluetooth: hci15: command tx timeout [ 550.556653][ T5592] Bluetooth: hci2: command tx timeout [ 551.036106][ T5592] Bluetooth: hci16: command tx timeout [ 551.276218][ T5592] Bluetooth: hci17: command tx timeout [ 552.636874][ T4901] Bluetooth: hci2: command tx timeout [ 553.117687][ T5592] Bluetooth: hci16: command tx timeout [ 553.356195][ T5592] Bluetooth: hci17: command tx timeout [ 554.752499][ T5592] Bluetooth: hci2: command tx timeout [ 555.459039][ T5592] Bluetooth: hci17: command tx timeout [ 556.148588][ T1238] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 556.170974][ T1238] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 556.172083][ T1238] keyspan 3-1:1.0: device disconnected [ 556.796553][ T5592] Bluetooth: hci2: command tx timeout [ 557.516171][ T5592] Bluetooth: hci17: command tx timeout [ 560.956986][ T38] INFO: task syz-executor:7755 blocked for more than 143 seconds. [ 560.957016][ T38] Not tainted syzkaller #0 [ 560.957030][ T38] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 560.957042][ T38] task:syz-executor state:D stack:22504 pid:7755 tgid:7755 ppid:1 task_flags:0x400140 flags:0x00080002 [ 560.957123][ T38] Call Trace: [ 560.957133][ T38] [ 560.957149][ T38] __schedule+0x16d9/0x5700 [ 560.957223][ T38] ? __pfx___schedule+0x10/0x10 [ 560.957274][ T38] rt_mutex_schedule+0x76/0xf0 [ 560.957308][ T38] rt_mutex_slowlock_block+0x55e/0x690 [ 560.957371][ T38] rt_mutex_slowlock+0x2d4/0x780 [ 560.957404][ T38] ? rt_mutex_slowlock+0x1f2/0x780 [ 560.957433][ T38] ? __pfx_rt_mutex_slowlock+0x10/0x10 [ 560.957484][ T38] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 560.957532][ T38] ? new_device_store+0x13c/0x6d0 [ 560.957557][ T38] mutex_lock_nested+0x168/0x1d0 [ 560.957584][ T38] ? new_device_store+0x13c/0x6d0 [ 560.957614][ T38] new_device_store+0x13c/0x6d0 [ 560.957644][ T38] ? __pfx_new_device_store+0x10/0x10 [ 560.957669][ T38] ? sysfs_file_kobj+0x1a/0x230 [ 560.957702][ T38] ? sysfs_file_kobj+0x1e4/0x230 [ 560.957732][ T38] ? sysfs_kf_write+0x166/0x260 [ 560.957766][ T38] ? __pfx_sysfs_kf_write+0x10/0x10 [ 560.957794][ T38] kernfs_fop_write_iter+0x3a5/0x540 [ 560.957829][ T38] vfs_write+0x61e/0xbb0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 560.957872][ T38] ? __pfx_vfs_write+0x10/0x10 [ 560.957908][ T38] ? do_sys_openat2+0x14e/0x200 [ 560.957932][ T38] ? kmem_cache_free+0x187/0x6d0 [ 560.957975][ T38] ksys_write+0x156/0x270 [ 560.958011][ T38] ? __pfx_ksys_write+0x10/0x10 [ 560.958057][ T38] do_syscall_64+0x166/0x520 [ 560.958090][ T38] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 560.958114][ T38] ? clear_bhb_loop+0x70/0xc0 [ 560.958145][ T38] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 560.958176][ T38] RIP: 0033:0x7f2cd085eb0e [ 560.958198][ T38] RSP: 002b:00007ffd25a7c718 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 560.958224][ T38] RAX: ffffffffffffffda RBX: 000055555f735500 RCX: 00007f2cd085eb0e [ 560.958242][ T38] RDX: 0000000000000003 RSI: 00007ffd25a7c7a0 RDI: 0000000000000005 [ 560.958286][ T38] RBP: 00007f2cd093612f R08: 0000000000000000 R09: 0000000000000000 [ 560.958302][ T38] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 560.958318][ T38] R13: 00007ffd25a7c7a0 R14: 00007f2cd1654620 R15: 0000000000000003 [ 560.958356][ T38] [ 560.958367][ T38] INFO: task syz-executor:7770 blocked for more than 143 seconds. [ 560.958385][ T38] Not tainted syzkaller #0 [ 560.958397][ T38] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 560.958409][ T38] task:syz-executor state:D stack:22952 pid:7770 tgid:7770 ppid:1 task_flags:0x400140 flags:0x00080002 [ 560.958471][ T38] Call Trace: [ 560.958479][ T38] [ 560.958494][ T38] __schedule+0x16d9/0x5700 [ 560.958566][ T38] ? __pfx___schedule+0x10/0x10 [ 560.958615][ T38] rt_mutex_schedule+0x76/0xf0 [ 560.958647][ T38] rt_mutex_slowlock_block+0x55e/0x690 [ 560.958692][ T38] rt_mutex_slowlock+0x2d4/0x780 [ 560.958721][ T38] ? rt_mutex_slowlock+0x1f2/0x780 [ 560.958750][ T38] ? __pfx_rt_mutex_slowlock+0x10/0x10 [ 560.958801][ T38] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 560.958841][ T38] ? new_device_store+0x13c/0x6d0 [ 560.958864][ T38] mutex_lock_nested+0x168/0x1d0 [ 560.958890][ T38] ? new_device_store+0x13c/0x6d0 [ 560.958920][ T38] new_device_store+0x13c/0x6d0 [ 560.958948][ T38] ? __pfx_new_device_store+0x10/0x10 [ 560.958973][ T38] ? sysfs_file_kobj+0x1a/0x230 [ 560.959004][ T38] ? sysfs_file_kobj+0x1e4/0x230 [ 560.959035][ T38] ? sysfs_kf_write+0x166/0x260 [ 560.959070][ T38] ? __pfx_sysfs_kf_write+0x10/0x10 [ 560.959099][ T38] kernfs_fop_write_iter+0x3a5/0x540 [ 560.959133][ T38] vfs_write+0x61e/0xbb0 [ 560.959174][ T38] ? __pfx_vfs_write+0x10/0x10 [ 560.959211][ T38] ? do_sys_openat2+0x14e/0x200 [ 560.959235][ T38] ? kmem_cache_free+0x187/0x6d0 [ 560.959278][ T38] ksys_write+0x156/0x270 [ 560.959314][ T38] ? __pfx_ksys_write+0x10/0x10 [ 560.959361][ T38] do_syscall_64+0x166/0x520 [ 560.959393][ T38] ? trace_irq_disable+0x3b/0x140 [ 560.959427][ T38] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 560.959452][ T38] ? clear_bhb_loop+0x70/0xc0 [ 560.959483][ T38] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 560.959507][ T38] RIP: 0033:0x7fd8d3f5eb0e [ 560.959534][ T38] RSP: 002b:00007ffcaaececd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 560.959558][ T38] RAX: ffffffffffffffda RBX: 000055558166d500 RCX: 00007fd8d3f5eb0e [ 560.959577][ T38] RDX: 0000000000000003 RSI: 00007ffcaaeced60 RDI: 0000000000000005 [ 560.959592][ T38] RBP: 00007fd8d403612f R08: 0000000000000000 R09: 0000000000000000 [ 560.959607][ T38] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 560.959622][ T38] R13: 00007ffcaaeced60 R14: 00007fd8d4d54620 R15: 0000000000000003 [ 560.959660][ T38] [ 560.959700][ T38] [ 560.959700][ T38] Showing all locks held in the system: [ 560.959712][ T38] locks held by kworker/0:0/9: 2, on CPU#0: [ 560.959730][ T38] #0: ffff88801eae5d38 ((wq_completion)inet_frag_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 560.959801][ T38] #1: ffffc900000e7c40 ((work_completion)(&fqdir->destroy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 560.959876][ T38] locks held by rcuc/1/28: 2, last CPU#1: [ 560.959893][ T38] #0: ffffffff8f059580 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 [ 560.959960][ T38] #1: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 [ 560.960026][ T38] locks held by ktimers/1/29: 2, last CPU#1: [ 560.960043][ T38] #0: ffffffff8f059580 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 [ 560.960109][ T38] #1: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 [ 560.960176][ T38] locks held by khungtaskd/38: 1, last CPU#0: [ 560.960193][ T38] #0: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 560.960259][ T38] locks held by kworker/u8:4/67: 2, on CPU#0: [ 560.960276][ T38] #0: ffff88813ff64138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 560.960345][ T38] #1: ffffc9000152fc40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 560.960413][ T38] locks held by kworker/u8:5/92: 4, on CPU#0: [ 560.960431][ T38] #0: ffff88801beb0938 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 560.960498][ T38] #1: ffffc9000154fc40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 560.960572][ T38] #2: ffffffff905c8040 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf5/0x810 [ 560.960636][ T38] #3: ffffffff905d6878 (rtnl_mutex){+.+.}-{4:4}, at: default_device_exit_batch+0xd0/0x760 [ 560.960703][ T38] locks held by kworker/0:2/200: 3, on CPU#0: [ 560.960720][ T38] #0: ffff88813ff2b938 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 560.960788][ T38] #1: ffffc9000408fc40 ((fqdir_free_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 560.960855][ T38] #2: ffffffff8f1c9f70 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 [ 560.960918][ T38] locks held by kworker/u8:9/1019: 2, on CPU#0: [ 560.960935][ T38] #0: ffff88813ff64138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 560.961003][ T38] #1: ffffc900065b7c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 560.961074][ T38] locks held by kworker/1:2/1238: 4, last CPU#1: [ 560.961091][ T38] #0: ffff888021a90d38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 560.961159][ T38] #1: ffffc90006d57c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 560.961227][ T38] #2: ffff88802b23a210 (&dev->mutex){....}-{4:4}, at: hub_event+0x187/0x4cf0 [ 560.961289][ T38] #3: ffff88801b73a1d0 (&k->k_lock){+.+.}-{3:3}, at: klist_del+0x67/0x110 [ 560.961375][ T38] locks held by getty/5339: 2, on CPU#1: [ 560.961393][ T38] #0: ffff8880369d20a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 560.961460][ T38] #1: ffffc900044d32e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x460/0x1360 [ 560.961531][ T38] locks held by kworker/1:4/5694: 2, last CPU#1: [ 560.961549][ T38] #0: ffff88813ff2a538 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 560.961617][ T38] #1: ffffc9000607fc40 ((work_completion)(&(&gc_work->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 560.961688][ T38] locks held by kworker/1:7/5810: 4, last CPU#1: [ 560.961706][ T38] #0: ffff88813ff2a538 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 560.961790][ T38] #1: ffffc9000651fc40 ((gc_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 560.961856][ T38] #2: ffffffff8fd110b8 ("ratelimiter_table_lock"){+.+.}-{3:3}, at: wg_ratelimiter_gc_entries+0x5d/0x470 [ 560.961923][ T38] #3: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e2/0x400 [ 560.961983][ T38] locks held by kworker/0:8/5869: 2, on CPU#0: [ 560.962001][ T38] #0: ffff88813ff2b938 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 560.962068][ T38] #1: ffffc900067c7c40 (free_ipc_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 560.962136][ T38] locks held by kworker/1:8/5885: 10, last CPU#1: [ 560.962153][ T38] #0: ffff888060da7538 ((wq_completion)wg-crypt-wg0#4){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 560.962227][ T38] #1: ffffc90006737c40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 560.962295][ T38] #2: ffffffff8f059580 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 [ 560.962361][ T38] #3: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 [ 560.962427][ T38] #4: ffff88806308ecd8 (&peer->endpoint_lock){++..}-{3:3}, at: wg_socket_send_skb_to_peer+0x6e/0x200 [ 560.962489][ T38] #5: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: rt_read_lock+0x279/0x4b0 [ 560.962555][ T38] #6: ffffffff8f059580 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 [ 560.962620][ T38] #7: ffffffff8f1c3d60 (rcu_read_lock_bh){....}-{1:3}, at: send6+0x255/0x920 [ 560.962681][ T38] #8: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: ip6_output+0x11e/0x540 [ 560.962747][ T38] #9: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: ip6_mtu+0x7d/0x4a0 [ 560.962817][ T38] locks held by kworker/1:9/7613: 2, last CPU#1: [ 560.962835][ T38] #0: ffff888038e00d38 ((wq_completion)wg-crypt-wg0#3){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 560.962908][ T38] #1: ffffc9000f527c40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 560.962998][ T38] locks held by syz-executor/7755: 4, on CPU#0: [ 560.963015][ T38] #0: ffff8880372fc510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 [ 560.963085][ T38] #1: ffff88803cd32c78 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 [ 560.963145][ T38] #2: ffff88802ad370f8 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 [ 560.963212][ T38] #3: ffffffff8fe46bf8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: new_device_store+0x13c/0x6d0 [ 560.963271][ T38] locks held by syz-executor/7766: 7, on CPU#0: [ 560.963289][ T38] #0: ffff8880372fc510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 [ 560.963357][ T38] #1: ffff88806112dc78 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 [ 560.963417][ T38] #2: ffff88802ad370f8 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 [ 560.963483][ T38] #3: ffffffff8fe46bf8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: new_device_store+0x13c/0x6d0 [ 560.963549][ T38] #4: ffff88803b938160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 [ 560.963610][ T38] #5: ffff88803a032310 (&devlink->lock_key#8){+.+.}-{4:4}, at: nsim_drv_probe+0xfb/0xbc0 [ 560.963679][ T38] #6: ffffffff905d6878 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_dev_lock+0x257/0x2f0 [ 560.963740][ T38] locks held by syz-executor/7770: 4, on CPU#0: [ 560.963757][ T38] #0: ffff8880372fc510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 [ 560.963825][ T38] #1: ffff88803cd30c78 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 [ 560.963885][ T38] #2: ffff88802ad370f8 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 [ 560.963951][ T38] #3: ffffffff8fe46bf8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: new_device_store+0x13c/0x6d0 [ 560.964012][ T38] locks held by syz-executor/7862: 2, on CPU#0: [ 560.964030][ T38] #0: ffffffff905c8040 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x524/0x780 [ 560.964089][ T38] #1: ffffffff8f1c9f70 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 [ 560.964149][ T38] locks held by syz-executor/7931: 1, on CPU#0: [ 560.964166][ T38] #0: ffff888058b88f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x232/0x5c0 [ 560.964227][ T38] locks held by syz-executor/7939: 1, on CPU#0: [ 560.964243][ T38] #0: ffff888058b90f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x232/0x5c0 [ 560.964303][ T38] locks held by syz-executor/7946: 2, on CPU#0: [ 560.964320][ T38] #0: ffffffff905c8040 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x524/0x780 [ 560.964379][ T38] #1: ffffffff905d6878 (rtnl_mutex){+.+.}-{4:4}, at: register_nexthop_notifier+0x8b/0x290 [ 560.964445][ T38] locks held by syz-executor/7954: 4, last CPU#0: [ 560.964462][ T38] #0: ffffffff905c8040 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x524/0x780 [ 560.964528][ T38] #1: ffff8880b8443418 (&pcp->lock){+.+.}-{3:3}, at: get_page_from_freelist+0x85e/0x2600 [ 560.964588][ T38] #2: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: rt_spin_trylock+0x10c/0x2b0 [ 560.964648][ T38] #3: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e2/0x400 [ 560.964709][ T38] locks held by syz-executor/7961: 2, on CPU#0: [ 560.964726][ T38] #0: ffffffff905c8040 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x524/0x780 [ 560.964785][ T38] #1: ffffffff905d6878 (rtnl_mutex){+.+.}-{4:4}, at: register_nexthop_notifier+0x8b/0x290 [ 560.964851][ T38] locks held by modprobe/8009: 5, last CPU#0: [ 560.964868][ T38] #0: ffff88803cd01db8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 [ 560.964936][ T38] #1: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x200 [ 560.965001][ T38] #2: ffff888079791658 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 [ 560.965072][ T38] #3: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e2/0x400 [ 560.965130][ T38] #4: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: page_table_check_clear+0x124/0x500 [ 560.965189][ T38] locks held by modprobe/8010: 4, last CPU#0: [ 560.965206][ T38] #0: ffff88803cd010b8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 [ 560.965272][ T38] #1: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x200 [ 560.965338][ T38] #2: ffff888079791598 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 [ 560.965410][ T38] #3: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e2/0x400 [ 560.965470][ T38] locks held by sed/8012: 1, last CPU#0: [ 560.965486][ T38] #0: ffff8880342b2ab8 (&mm->mmap_lock){++++}-{4:4}, at: vm_mmap_pgoff+0x1e0/0x4e0 [ 560.965555][ T38] [ 560.965563][ T38] ============================================= [ 560.965563][ T38] [ 560.965581][ T38] NMI backtrace for cpu 0 [ 560.965622][ T38] CPU: 0 UID: 0 PID: 38 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 560.965649][ T38] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 560.965662][ T38] Call Trace: [ 560.965672][ T38] [ 560.965682][ T38] dump_stack_lvl+0xe8/0x150 [ 560.965719][ T38] nmi_cpu_backtrace+0x274/0x2d0 [ 560.965748][ T38] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 560.965776][ T38] nmi_trigger_cpumask_backtrace+0x17d/0x390 [ 560.965808][ T38] sys_info+0x135/0x170 [ 560.965835][ T38] watchdog+0xfd7/0x1030 [ 560.965875][ T38] ? watchdog+0x1c7/0x1030 [ 560.965915][ T38] kthread+0x38b/0x470 [ 560.965941][ T38] ? __pfx_watchdog+0x10/0x10 [ 560.965970][ T38] ? __pfx_kthread+0x10/0x10 [ 560.965996][ T38] ret_from_fork+0x514/0xb70 [ 560.966024][ T38] ? __pfx_ret_from_fork+0x10/0x10 [ 560.966049][ T38] ? __switch_to+0xc89/0x1420 [ 560.966087][ T38] ? __pfx_kthread+0x10/0x10 [ 560.966113][ T38] ret_from_fork_asm+0x1a/0x30 [ 560.966156][ T38] [ 560.966235][ T38] Sending NMI from CPU 0 to CPUs 1: [ 560.966271][ C1] NMI backtrace for cpu 1 [ 560.966288][ C1] CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 560.966309][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 560.966321][ C1] RIP: 0010:native_apic_msr_write+0x39/0x50 [ 560.966351][ C1] Code: 74 2a 83 ff 30 74 25 eb 10 81 ff d0 00 00 00 74 1b 81 ff e0 00 00 00 74 13 c1 ef 04 81 c7 00 08 00 00 89 f9 89 f0 31 d2 0f 30 <66> 90 e9 c0 cc e7 09 cc 89 f6 31 d2 e9 e6 e2 96 03 66 0f 1f 44 00 [ 560.966369][ C1] RSP: 0018:ffffc90000a3fa70 EFLAGS: 00000046 [ 560.966386][ C1] RAX: 000000000007f2ba RBX: ffff8880b8523c80 RCX: 0000000000000838 [ 560.966400][ C1] RDX: 0000000000000000 RSI: 000000000007f2ba RDI: 0000000000000838 [ 560.966412][ C1] RBP: ffffc90000a3fb30 R08: 0000000000000100 R09: 0000000000000100 [ 560.966426][ C1] R10: 0000000000000100 R11: ffffffff81755500 R12: 000000000007f2ba [ 560.966438][ C1] R13: dffffc0000000000 R14: 000000000fffd2b3 R15: 0000000000000020 [ 560.966452][ C1] FS: 0000000000000000(0000) GS:ffff888124abb000(0000) knlGS:0000000000000000 [ 560.966468][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 560.966481][ C1] CR2: 00007fd8d400c538 CR3: 000000000efb0000 CR4: 00000000003526f0 [ 560.966499][ C1] Call Trace: [ 560.966506][ C1] [ 560.966514][ C1] lapic_next_event+0x11/0x20 [ 560.966537][ C1] clockevents_program_event+0x385/0x630 [ 560.966562][ C1] ? __pfx_clockevents_program_event+0x10/0x10 [ 560.966583][ C1] ? lock_acquire+0x115/0x350 [ 560.966611][ C1] ? tick_program_event+0x8f/0x120 [ 560.966641][ C1] __hrtimer_rearm_deferred+0x37e/0x4d0 [ 560.966667][ C1] irqentry_exit+0x8d9/0x920 [ 560.966694][ C1] ? trace_irq_disable+0x3b/0x140 [ 560.966725][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 560.966746][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 [ 560.966775][ C1] Code: f7 e8 ed bf 44 f6 f7 c3 00 02 00 00 74 05 e8 c0 1e 71 f6 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 44 c6 36 f6 65 48 8b 05 ac 43 48 08 48 85 c0 74 18 5b 41 5e c3 [ 560.966790][ C1] RSP: 0018:ffffc90000a3fc80 EFLAGS: 00000206 [ 560.966806][ C1] RAX: 0000000000000006 RBX: 0000000000000246 RCX: 8000000000000001 [ 560.966819][ C1] RDX: 0000000000000002 RSI: ffffffff8d8c0002 RDI: 0000000000000001 [ 560.966832][ C1] RBP: ffff8880b85287e8 R08: ffffffff90b2397f R09: 1ffffffff216472f [ 560.966846][ C1] R10: dffffc0000000000 R11: fffffbfff2164730 R12: 7fffffffffffffff [ 560.966862][ C1] R13: 0000000000000246 R14: ffff8880b8528540 R15: dffffc0000000000 [ 560.966886][ C1] hrtimer_run_softirq+0x264/0x2e0 [ 560.966913][ C1] handle_softirqs+0x1da/0x6d0 [ 560.966947][ C1] ? smpboot_thread_fn+0x4e/0xa70 [ 560.966976][ C1] run_ktimerd+0x6a/0x100 [ 560.967005][ C1] smpboot_thread_fn+0x565/0xa70 [ 560.967043][ C1] ? smpboot_thread_fn+0x4e/0xa70 [ 560.967077][ C1] kthread+0x38b/0x470 [ 560.967097][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 560.967125][ C1] ? __pfx_kthread+0x10/0x10 [ 560.967145][ C1] ret_from_fork+0x514/0xb70 [ 560.967166][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 560.967185][ C1] ? __switch_to+0xc89/0x1420 [ 560.967214][ C1] ? __pfx_kthread+0x10/0x10 [ 560.967234][ C1] ret_from_fork_asm+0x1a/0x30 [ 560.967261][ C1] [ 561.773505][ T38] Kernel panic - not syncing: hung_task: blocked tasks [ 563.005376][ T38] CPU: 0 UID: 0 PID: 38 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 563.015055][ T38] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 563.025159][ T38] Call Trace: [ 563.028470][ T38] [ 563.031425][ T38] vpanic+0x56d/0xa60 [ 563.035444][ T38] ? __pfx___schedule+0x10/0x10 [ 563.040375][ T38] ? __pfx_vpanic+0x10/0x10 [ 563.044935][ T38] panic+0xc5/0xd0 [ 563.048693][ T38] ? __pfx_panic+0x10/0x10 [ 563.053146][ T38] ? preempt_schedule_common+0x7f/0xd0 [ 563.058670][ T38] ? preempt_schedule_thunk+0x16/0x40 [ 563.064097][ T38] ? nmi_trigger_cpumask_backtrace+0x31a/0x390 [ 563.070298][ T38] ? nmi_trigger_cpumask_backtrace+0x31f/0x390 [ 563.076496][ T38] watchdog+0x1030/0x1030 [ 563.080899][ T38] ? watchdog+0x1c7/0x1030 [ 563.085375][ T38] kthread+0x38b/0x470 [ 563.089496][ T38] ? __pfx_watchdog+0x10/0x10 [ 563.094217][ T38] ? __pfx_kthread+0x10/0x10 [ 563.098872][ T38] ret_from_fork+0x514/0xb70 [ 563.103508][ T38] ? __pfx_ret_from_fork+0x10/0x10 [ 563.108670][ T38] ? __switch_to+0xc89/0x1420 [ 563.113485][ T38] ? __pfx_kthread+0x10/0x10 [ 563.118113][ T38] ret_from_fork_asm+0x1a/0x30 [ 563.122933][ T38] [ 563.126607][ T38] Kernel Offset: disabled [ 563.130957][ T38] Rebooting in 86400 seconds..