last executing test programs: 6.383507029s ago: executing program 1 (id=1658): socket$nl_route(0x10, 0x3, 0x0) set_mempolicy(0x2, &(0x7f0000000140)=0x8001, 0x2) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0xf0) 6.213127664s ago: executing program 1 (id=1660): socket$nl_sock_diag(0x10, 0x3, 0x4) r0 = socket$inet(0x2, 0x2, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4024587b, &(0x7f0000000cc0)={{r0, &(0x7f00000003c0)='})#%\x00', 0x802, &(0x7f0000000440)={@align=0x8c29a7f, {0x7, 0x0, 0xe, 0x4}}, 0x5, &(0x7f0000000480), &(0x7f00000004c0)=0x1}, 0x8, &(0x7f0000000c00)=[{0x1, 0x9, &(0x7f0000000500)='ip6tnl0\x00', &(0x7f0000000540)="9933ee449b290a9e20a21b854e477cfd78fabb425e395ba49db25e47a1b5e49e9e22f4e460cf197eeeaca80e13c56d354f545320c2c3008bdd675790df432ba8c00937828ca8797ac2e680514b6ebca7fce61385d4292b6017eaac3ac70388a29c2d59f514b905510e98594e7e91cf", 0x6f, 0x2}, {0x1, 0x7f, &(0x7f00000005c0)='\x00', &(0x7f0000000600)="f63c105cf092f1c4e50bb3423a251ad4267e597bb62c90cc652535280ddf6221d45e590b09dbd535", 0x28, 0x30}, {0x1, 0x1ff, &(0x7f0000000640)='cake\x00', &(0x7f0000000680)="e72b8ebd4d168d6de597e17f03bda84b6616b854e4fff6759859e528067366ea2199de8d0f8d7ab83f68d467912627fda6fd489851227acadfa851167b45acecd3c91a1a0ff1ea1f8d2b4f4d848c449832abcf14fa61a46dbe5a80eaab791659bfc3ef5ac69e35f86e415d9aeed288ec69614e7b9deaa7fb4d9c7f5e0340f2edc4a540b646aa9e5a20ec83c166516d93386be537bd28473af321b3a03aec37d4e76a2590588629eb4f9096c7b38bb674466ae6f352fd861b", 0xb8, 0x8}, {0x0, 0x5, &(0x7f00000007c0)='\x00', &(0x7f0000000800)="00bef01ab1baad2a07f50b6bff540c693a8ccfa543fb52144708d51e720d3c4aa7773cf27859dc9e6e127b4e71a7a3fb733e6ea7e4055a51a01b9c90931a733c994d793c9f538803", 0x48, 0x32}, {0x3, 0x56, &(0x7f0000000880)='cake\x00', &(0x7f00000008c0)="03d94bcd1a257601b44a06acbefa7c0685e60e38ef1c139ceda5d46bbd073c6dea3d101bc6c95578f7ed1aed9a04a5438a606fdc6fb602", 0x37, 0x28}, {0x1, 0x6, &(0x7f0000000900)='{-,%-,-@]\')@%!\x00', &(0x7f0000000940)="979605c9fd1e92bfd6", 0x9, 0x10}, {0x3, 0x9, &(0x7f0000000980)='cake\x00', &(0x7f00000009c0)="4e7974d2474e4ae2dcca47cb4d83611cc6902210a48071c767ae83effda4039f85e3d98a1ee0b7a5c657950cd7ba289a57b4586655a02f6cf09f0c98ce2d8b0b596a8bddd6875e6ea6aaae25a81bd8584e4694b438bbd8f8384f16a3916740d7f77c7e40ace3c4bb9398e30311e1f643c196fb1b9b4b7d412d74a10a1fb345e23b6ca2797f810a8f203cc9dc0ad376bec82d810836d63228b9518e2b944133c6f5f7475587a38e855aff847b83a80033acd5f3270be669d926999e9d04c7a0a45229848f2597dccd62131c13ba4306b233201a", 0xd3, 0xa}, {0x0, 0xfffffeff, &(0x7f0000000ac0)='wlan0\x00', &(0x7f0000000b00)="8611266be90ac041e253bef103f93b7288589f7d6a4fab780ccadcc11f706e5f082fb51fcebca3c0b8dac24de538f2de2a66c62a51c4540a8a3662c6eb2b1022889b06b063f67133be4fbec2dc08ffdfba7848ad11a65f6f3f1f7df6ae275857402fa25f81b9417fa0d471d12884e58ac938294f4255c001e4292ea5aed718bf8050d594ab18fa842184744b17e319c8fdd370d2b624f296d5dd04f0b9be8a7d781c1846122b9fbfdadab5f5cdf2b2331cb0074ab1b87c1919ce9da5c66a4c9bf5eadca4d0e1874ff993cd29b0456284525e2338a14fc2084816c3ee1f8411150a8429d507a0eb726d4efa", 0xeb, 0x10}]}) ioctl$UFFDIO_CONTINUE(r2, 0xc020aa07, &(0x7f0000000d00)={{&(0x7f0000214000/0x4000)=nil, 0x4000}}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={0xffffffffffffffff, 0x0, 0x5, 0x0, &(0x7f00000002c0)="5c2053a401", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x4c) syz_80211_join_ibss(&(0x7f0000000040)='wlan0\x00', &(0x7f0000000080)=@default_ibss_ssid, 0x6, 0x0) syz_80211_inject_frame(&(0x7f00000000c0), &(0x7f0000000100)=@mgmt_frame=@beacon={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) syz_io_uring_setup(0x54d, &(0x7f0000000040)={0x0, 0x735a, 0x100, 0x805, 0x350}, &(0x7f0000000100)=0x0, &(0x7f00000001c0)) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000740)=@newqdisc={0x48, 0x24, 0xf0b, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0x10}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x18, 0x2, [@TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x3}, @TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x40000001}]}}]}, 0x48}}, 0x0) sendmsg$TCPDIAG_GETSOCK(r1, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000300)={0x6c, 0x12, 0x8, 0x70bd2b, 0x25dfdbff, {0x5, 0x7, 0x8, 0x0, {0x4e23, 0x4e20, [0xb, 0x1000, 0x4b, 0x1], [0x67e5, 0x8, 0x8, 0x7], r6, [0x0, 0x2]}, 0x5, 0xe70}, [@INET_DIAG_REQ_BYTECODE={0x20, 0x1, "f4669ec7253e2150978d95216e80d18376d18538291c2a0baf9a8dab"}]}, 0x6c}, 0x1, 0x0, 0x0, 0x840}, 0x20004084) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x2e, 0x0, 0x0, 0x5}]}, 0x10) r7 = userfaultfd(0x801) ioctl$UFFDIO_API(r7, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x1c}) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$UFFDIO_REGISTER(r7, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r8, 0xffffffffffffffff, 0x0) 6.196174682s ago: executing program 0 (id=1661): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$uinput(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$UI_BEGIN_FF_ERASE(r1, 0xc00c55ca, &(0x7f0000000040)={0x10, 0xf335, 0xf}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=@newlink={0x40, 0x10, 0x1, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x1181}, [@IFLA_IFNAME={0x14, 0x3, 'bridge_slave_0\x00'}, @IFLA_VFINFO_LIST={0xc, 0x16, 0x0, 0x1, [{0x8, 0x1, 0x0, 0x1, [@IFLA_VF_VLAN_LIST={0x4}]}]}]}, 0x40}}, 0x0) 6.081302211s ago: executing program 0 (id=1663): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000003, 0x4031, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000d78000/0x2000)=nil, 0x2000, 0x4, 0x0, 0x0, 0x3) r0 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x25, 0x5, @val=@netkit}, 0x1c) bpf$ITER_CREATE(0x21, &(0x7f0000000040)={r0}, 0x8) get_mempolicy(0x0, 0x0, 0x206, &(0x7f000068e000/0x3000)=nil, 0x3) (async) get_mempolicy(0x0, 0x0, 0x206, &(0x7f000068e000/0x3000)=nil, 0x3) 5.963928594s ago: executing program 0 (id=1665): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) msgctl$MSG_STAT(0x0, 0xb, 0x0) sendmmsg$unix(r1, &(0x7f0000001300)=[{{&(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000000500)=[{&(0x7f0000000080)}, {&(0x7f0000000340)="f6cc3e76e7e7e6", 0x7}, {&(0x7f00000003c0)="01f3807dcd5b56ea20a4c5d8e53987bc7706c419fb5bae24501118973e9f490e63d302c84cc19e5c8c74fc179a22666c0c4723987dcb7c7fb4ef092027d17682d9d0c2c8b5f332f110015305d1bab8f404ecbecbb5307b7daa7562397e4963ad5ee9c789c780d95f5336659fd2c36a7cdb51297380dcef0d3e27513ecf7f8faeb3c9e9b0f784aa09d9bfa1466e86c0215f80a7a99b3e88d380103705be", 0x9d}, {&(0x7f0000000480)="2dab5768e900b61065d8159c4deccf014947b69decdf816c126bcbcc00f2ac6faa42d64679f654a5b4c956ff33a22edaefdbd89f39cb7575102b679967bfb368c38c290de28bba50ee87fa539b0963c6f90ce404c12fe1490ae080da96aeefc3a969eabfa5db1d945956eae2f125278b5e1568bd49e8abe0122552c57d2a0c", 0x7f}], 0x4, &(0x7f0000000bc0)=ANY=[@ANYBLOB="2cb300000100000001000000", @ANYRES32=r1, @ANYRES32=r1, @ANYRES32, @ANYRES32, @ANYRES32=r1, @ANYRES32=r1, @ANYRES32, @ANYRES32=r0, @ANYBLOB="100000000100000001000000", @ANYRES32=r0, @ANYBLOB="180000000100000002000000", @ANYRES32, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="180000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="180000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="180000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="180000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="180000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0], 0xcc, 0x8040}}, {{&(0x7f0000000cc0)=@abs={0x1, 0x0, 0x4e20}, 0x6e, &(0x7f0000001200)=[{&(0x7f0000000d40)="3c7e88660a7c6e182b8d6650cd00d67aec431665542407c773469004817aa333d3578e45867598b6c03976f20263ab3906ee60f3e050a92d5778ac6ab6c49f41c63de17539cf8405d4e82cc926a1cade476170a6f1b6351b7ee28aea56913e2d39fc662656259b20f86965404803649c68e27a796afd7806d7defb8e8a796a25593f0517cacae30acb8afc02ac0712508cad9f166a63fabe4ae1e873977d0f781c0ec6a287449d387da58a657282b1c0bb54e377001b74251561286d39321eeafb6c4317dbb5223aa1805a14d4a1afce25004e2424fe38321b3cf68d9c7636241c4af56a", 0xe4}, {&(0x7f0000000e40)="fce2400c54b8057196786b141820076e39b3be142c79ec4d7d224a3f843f6a43e5e890a1f3a62a67d95d560720c50685eee088d83cd9f1dca1e71cc5909d8624d9f917f3db7ecf5c0ed10e0540623f772014a6835d95819c21069b77acd689bec83f57b38452ca400e08a858e47c6a87f590a59d9f92f00dc0e78f57b935eb6ad8fe06d46ee438f0d60559ee574f33d6fe0a5f49bb6fef8e8878db3ae219f259cb0f940b30fd455f74dd5994e1546cade511e918626392a7eaba9c38726a5660ef093dca61589578da4579726c02cafc1e0966195057279d2d6c1e284bccbf5c0896e7", 0xe3}, {&(0x7f0000000f40)="b33cc2208df194d12eea9017db13e9b8e55c3d1710358a319d07870e1f71b17475a821c879f1329413a5816c6f8840bd739d62428378c2870e21f3a7bbab0754b777e4904902c6b25af740d5237be5e031d74563c4a17ee77fcf492385ab3bca870af728e72c3f3eedde359a38cc1df5f49a4f8ce0b9c38dcaf0109b20c43b46a1e43500b5ab40b86cabe7040d652c59deae7d8c900f6260eb83b283f7f56aa0696bf904", 0xa4}, {&(0x7f00000063c0)="de3db3dd1f8f0a56e8886bc42d949e75cde8e9973881514c1e1a289477d9cf1b32c320b044bcffc2f49d8725b1bfcfcdb0d97282cd3eb23f032e71ef4b2b432928a071dfd1942820f297c2b1d7ac9fc8929debf5886ea66253bbc3060fe797924945c534e79275d8b60ed9960225a5bc5fb438b51b14dec0f0ca36e8eab626a0ed2b5c5169f693082e84eec5308f1c7876314b2326f7d5fbc26e3459b625fa78ddfb333754cf29e53972a17351d360dd7bd49598c130374f878f00fc45b1e8c67c1fb2ea85191247b201ab26421e513f6122e9c076a78c8523678b12bba1f8dacbfc03a3ceaf4c3e27941e077f3f3aebabfc519377a6000c57c1b70cd394b0d468e6d9643b5c33ce5c7d0a5216c98e93320216adf5126b892645963dd233d401b44408fd3dbbdfe7ceba3c2e2fee86a5a4f08c5f07f740518c34ab8fce09a34c3837cf02276bde453011ef597fa3e47915937870e5a6030c59e26ec70bc503effb699cf654d12a1551e2443ce24ac9b185a210d5c8f2c2731e1682b6ef9707fa280c9a4a9e3376425298b4f085232991f64e1a668f3357ec9ea65f333ea2fb1f43734f558940472d22609ba077df71c6373a04ca1fa20ccd987635c2014268310c6564ac74d519ef35e3cc170c7b3c196383a7c009f7ca87bd5b2274a03350e55206a35630ffe749f8c0c9cd9533637fe8edefaa5f79b7a0f69f78ae508205ec45a33d27b6f28ce03d2e061ad075129854372ffce9e697fd566675323a4209cc801037b1e5c230607ec095231e8cf662cba455a31e02f62588b3ef3ce4db2f3f124fd7916d6c249a303bb13720de6c0437bbea52f91dd67eae9b0af357754fc2b6c97198fff0fcec94c5a79c5ba93bd0d7e500d577a61e482f7976bc15b165fc74a5525491c7b4b610a63b3475bf65b8d49a8f678950737a70c488001bc94d5231672decfbb8544984605736e0de6a8ebd2f68d7c32fa29be9e667ab870f72ba0bfd6eeb5c957bc3dc710c38e8a6ffc7e6451b7fc052950ab96bcbb7ce331b2945c0d511b69d00f90bab205203bdacc7179e29ca4d06faaab82c1980f28fac417b1c24437a885ff0139812c982b16081c0db3cff58ed42136f3d2b4cccb93b8fb70622b516fc2e4aff018db7518b826aef6ad1ad58724753c809d350c51666c25ecf4823536a411eb9a7ba6f7c1ec6db3b64e34f376d797b5be74885cbd1b2d5ea111f26ae2cec32fcb8ee21bde60882c4cc7666ab6b7922312b0279cf30abf015e0e33e90568dec026ca8a5ab9b570aec01055a4bd21941eabb360a3e190b9df0a39db6d36896a38b5f1e07a3004263e5aad71393fec5ad2cf22862fce3ce65f75925bda9ed45f47d2d2249f551c0f75c1cd237de1e089ad95f28fccfefa127d48090b9b33794e8a36e5b51dbf7c41278602765450e899e9f6adf5ff4ffdcf03a66f3b30b95331d0b54cd915f6356e37c80e644e68656f767495a130bebe26ce62587b1d472dd77f63c5537c808d39f135fc62bace084eba521762eeba171d57192c001ac40bc3f1491d6688429964faf4d7aa89d0a0b37bd31550af1820a0c7f798c9941c34eb6a9620219fade69070d1a0e090d462a429871eb2864c6b38993fc7e5b28dbcbf8e3c64f2106c59277956a840140877c169ff2a88d80dbdb6a5ac49272c7706c497d9cf256e8aa1e4359dbf596d4a9e6443f9553757cf2c3f82c5642d70390ea5972d48e830c37b4a64bf72e9d63c736756ef3ea38fb5a4d359daf7064ff93d4184015939ebc34a775c263e81a0a26b105ac2b6e771a2849f679a64c221e9a580dfef7a1bf3e5f8e9a1fa33eb7e2ad311c0372ff55a0d11d62e0eb6b43d962493269748143ba0ab2c9b102a54803697d96e3c2f4236be432185fe8717dc9acda8f97c67479eb976988739b5d0e08a7ea746c2d12c9f8306b126cd491f431fcfb1fcfd0fad8bb5103cbe7bb79e48784d7bef4d5afcfd2356d210d2fcf24063b90294426283cb4e630a2f364a9d7ce6f2e9401b61715386d88f147dd8ed86c82a635bd596224ac46b617ce3d13c9df40ebc831c521be289b7f09547801a4c3c0dbe2fc2db7105c857587c5a2bded427db31c85754d5db4b827ca872e35bff4f1b339e1169995d452653a36a209bc3619d5bfd3761fd1b7c7d19718601abb82a1ca3c65ca3311775d8b2fa051b9e021e34885ff265a9da30dc585f34560e8a527a1ae4a26bcf4a760c97a7eb3224961e1fc2392927050335b32874a41bc587f985120043f14cf1b2ff6aa78874eb68c534b79fa76256979c887a3ef674e68a33bc4f5c93abf722c4e14e7925318787b87f462682ae306c39ebdeaf06f6d4d5764fccefa490d78d8a6d48081d45b7c058a27364bba5513de25bba235b46656178aaf4226d71f9b3ecfbc373fc1862be378ba6366136453a6b75236905bd7558d2ef7952a34df1c9c91a28c2362820eeaee037454e8561bd60f0e088444fee5c90e7596e3d59754234730bc340b2f76477007532b89a41970afbdbfffc914d02ca362525cc6cd077cd60a2b730ef7ef6569e509d2b840b0043b56b886e328bd700c3cba598eaa67d457b3107d22e2c3afdc9c10a2345eb84ff4966629ee1722dd36fa3c3825302c84dbd0f5eb335bc67f309efe4c72b62ff864257050c5a96c51e46049719b3664c80762a6462e1f3116d457c768c88f60434ab0f4d2fe96f2dac5ba5ed6ea6d9d1176686fec95b770b7d4fbdf91ef6d785c0abe3469f2512429df19befcc03440aa47ae2f3e92c26efd02ff1b7038a017cca9e1290bd0b6b728de978a3461ec1fa4aa823af209405eda64eceb6ada03b25109b3b0bbf386884a7b18479b7c240a0107b2026d2d1bcc54f8a2774dfaeacfc1ab38779ac3e49cf9eda6c5ad8dae506027c68bfc1293f410186b94187e85f5a3fbdf5ea474b2bbaf404ce23789c89d3579c21c5a43d06b3b2428c230a7eb5f20fb213a3eb2e2d7b563157d263cc9330bb42fcc0933ab4d3bb2f6ceb357f7e8f45673e95505eede67496c03c97f842e8c8494c6c10aa5ca4f99696070cb38d9718d8d56eca716c559b883a1ee25bc37c00dc52ea7f548f8d3d6e84cf0473aa0f844feb2b1a8ed370909f5001ea5be88a853b437bbb7a9dd7774591435222aae0932eb9e978cfb66a9c1f8c85630aacd66e090747c2349313f1d4100b41767b0be629472a95f5797c3d633e7357752dc58268a348416708c1272b16402f0900330bda9e7b6d3843357043bc84e6c96289e7ee2783920efc714b3510cd911e15507b35d57e6d368202207ae96c9f79a2187468803c126839da9b3b5a0ca8da49fac4481476059289a79b1bb0b97c7fb0ea650b856466e292948bdb74007cb563ae2c8732e961d03d7f19e045395805f73beff82e6f84df553474d523ebb0a2f8869e33c1aa9eac816d68c53c2ef1a330d31249e0a79ce6ac6a1f5c826d64dde0c2b5774ee1dbe17252ece1320722174bf7cc93ae9e60d6f6d68a7074173d5d4b6edcec305fd6524fac2d8becab06c86f3b56bd932ccb6bd113b01896191e690ee1717d56373121523f6fa7b18ea22b5792727d1800761d00f6cbfb6c4d6a3f0afe6175af327d63b996b2c31ad2536313b4adfece77a794281355620ac00ef8462d280a7ee49f0d817a5ab3d856ec53186ff89ed4f61273242850ef31870cda9ec2b3af644f648afce18c2fb501cef98a6a65f46ee747b257d921b2808068297bcbadfc852192a0a2216ee8264ceb51cb661a9547041291214f05c331dd11a76036f9d5e265aab08a494932f8ac884a765022cff975d7a55033bff4f8469da795309525fddbc5ba62029b673ef639f80e9c05b247d21c80c53d7259cc6786a096916efb390efd4ebd6b6d4aad1c1f704613a8194840fa33073932b392e96e945f78042c2c5d9e27c17cabfa377864d1d51fbdc467c58bb0ae9f9df466b5f25c3aebd25da8328f598d91861bfd569942c98029b4f16abd0b4b20ec44166d04fe43a6d357d837476e0ec432d1f76dcabbcea4362f5231192211734e7acf29cd675efe893fc97afb8bef619b8f52990c3a90212b66f7a5b66d4c240ca27fd40acf2c9635047fdc2f9ae7c81cde477759caa353a9c57027308f11ed567fb5b75af0b246abe003b43a94a341b9ef3fc156c3cfd49f8a01f4cde48b2584933fa176d2354a983735ff08514ceb5f60be74c65e920a3c1a9a64be585eedde0f77bbab9d963b13489ba9b25a0fdf1dc783147d7dec76898d5abdde4283224091366dbf1806e44779c3e6fd7b90700e7ee2849c9f6761b1f4c3b9444a81d0c92e679c4645a49a870cb633b70e039b80cffb98dd4e53f77f80fc0909762008120a233ab3e4b1966c5a04c7ccfcb768acc8ff1d256429aa646674a3a32881cedcd8eb05c6c99d40118c6683627b51811b0ff9614524f9c17ba1303f87fc82ab5cf7dcccc80728f196ca9975096003fef71784c3372e73da85037c176047be4d3a179e566f9ff7db6e18ba1f24b2097ca13ed6921a6360aae570e616276eccf430fb763c9bf5867383f3c9768fcac617453994feab013cab3f072e8db1603a7eadeff1169e421a3ff6c14c3d156089bdd6045c631d76f3b0c05a4cbe3ad39905a25f94a4cbdda4e65c7bf2f56e589bdc55493dceb8256829b430ef9b8c4dbf5064f6c5802c21dffc97bfc09973a64d2d480824919454e1aa4cceeed2c48c4b75e55d37723963dfc2e2a88fe957b6e19d52cf1642bb0a0869bfa4ab0efac435ea2c3fa25da184dc3dd690c412db64952db914415fe79be95b147941f234011aff7581c5fbcd8000dc2f13d3bf99159e18c75a5e760f818752b6883556704480e0430d7489c18ad557326d3ac3857f0be11f217569023e442dfab059c331363557e7605894096961e9eaaefbe1a206c05883838482772c16a1ea8b998fe3cbeec2c9c50dafcdd79771afaed35e289928474ce5574ae141a5c40576e87ccc375de03d8bbba763cfbdaf90d40e8742de2552f4d210eb688bb244606e60b0e9f97e106f84fab490fd6ff060fa3fe7fcd9290eb1236b9bdece3c1c1722248ef1c2941b3cbfb3d02f3a8ff4e2e868a12cc45b594d7861a4f025ea69503d565e3bdad9223e992cd55ac1ee5fd3738b988a9b4444690ec43efd18f69e22aa4a085d6d456e5c20a097a58c366067cabd08f037acabbf712a933a1177805d1b1ced35b91da012fa85025ac127f3bcbb5ff25337bd3da9322aa9edfb3549bdb710edec073de8ca0a274c32af7e65aa6133bc4e82c74057d0d1adc8f33add9b1aee73de24b22d5060505c89a02dbd7c83f0a2efe7cae5da4e9844de31a22c752bc64395d6e6626eeb4bc6ead91d03dcbf860d2ec5a40f1f042dd61ac47a931086ea35e61fd2565e6b1eacd0ef0f363839e4f08ba000c35a047395c5dda8aef79f87e1482757d6fea249f9dde90e32dd535f39ef7b807a1f8912c14722eb505f2f96a384c5d9fda8d21d2d72a50c36d54332c4b6d7a72e6b7c57e4fab2eba290b31f17e639ebb94b2e8ee060cd058e4de333cdbeaa9a8d6670b244fc8726733f46ad71853bbd91f8e6e363f719e46a28ed0464941756706f393d400c632ad79867ca4ac68911d97d5b9fdc3eba290bda71c9ec527134f6fd0b6a0ee81c0a92eefc5377cd69824cd21ddcaf3dc9df59f17eda77896c4d8977bed65fde10f2d445b1da70f760d80df35ed869dfa398e499bfef4bb2a1c80583e4445e053f0717c43682c743542d9b7f77a8274f7cae55321c689", 0x1000}, {&(0x7f0000001000)="865e9d2ed85d8f790e9c1d1b9c8bc7a62da9867b4416d6d4f484ddaeda08a707e94cc45fd2b4b73bd13a9c5c01b614d6bbdf5db207690f4c28c246da6e971aa28dedfc9cd85b934e97c9546041cbe24f816a36630e8e26ab35c9cc0ab0bf11f489cdca6ba5db", 0x66}, {&(0x7f0000001080)="cb06262358052c5c73d2a40e17f7c8c195b97e7da45e094fb0a6a9be389d18334a78f3b404f6d3985099c0e8801fab30e5b240044d60add8ad8319a9ce525585ba6248a274997ef8117ada30f8b1e8c625d9c0553bf6a1531be0ca116c0a54a3c751e5c0030a71c60740cc13120f614bf9f95a42da8b4ae81401e08b65504ed469baaaddb42e08a820fbb2086fd8394b1790", 0x92}, {&(0x7f0000001140)="a0aa4756c5125612a7a5a4970108046c0fed3c8c63", 0x15}], 0x7, &(0x7f0000001280)=[@cred={{0x18}}, @cred={{0x18}}, @cred={{0x18}}, @cred={{0x18, 0x1, 0x2, {0x0, 0x0, 0xffffffffffffffff}}}], 0x60, 0x2040004}}], 0x2, 0x0) recvmmsg(r1, &(0x7f00000083c0)=[{{&(0x7f0000000540)=@nfc, 0x80, &(0x7f00000007c0)=[{&(0x7f0000000080)=""/16, 0x10}, {&(0x7f0000000600)=""/80, 0x50}, {&(0x7f0000000680)=""/187, 0xbb}, {&(0x7f0000001940)=""/4096, 0x1000}, {&(0x7f0000002940)=""/4096, 0x1000}, {&(0x7f0000000740)=""/127, 0x7f}], 0x6, &(0x7f0000000800)=""/202, 0xca}, 0x7}, {{&(0x7f0000000900)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80, &(0x7f0000001180), 0x0, &(0x7f00000015c0)=""/168, 0xa8}, 0x1}, {{&(0x7f0000001680)=@un=@abs, 0x80, &(0x7f0000001800)=[{&(0x7f0000001240)}, {&(0x7f0000001700)=""/204, 0xcc}], 0x2, &(0x7f0000005940)=""/186, 0xba}, 0x1}, {{&(0x7f0000001840)=@llc, 0x80, &(0x7f0000005b40)=[{&(0x7f0000005a00)=""/218, 0xda}, {&(0x7f00000073c0)=""/4096, 0x1000}, {&(0x7f0000005b00)=""/7, 0x7}], 0x3}, 0x8}, {{0x0, 0x0, &(0x7f0000005e40)=[{&(0x7f0000005b80)=""/52, 0x34}, {&(0x7f0000005bc0)=""/127, 0x7f}, {&(0x7f0000005c40)=""/234, 0xea}, {&(0x7f0000005d40)=""/135, 0x87}, {&(0x7f0000005e00)=""/38, 0x26}], 0x5, &(0x7f0000005e80)=""/222, 0xde}, 0xf65}, {{&(0x7f0000005f80)=@pppoe, 0x80, &(0x7f0000006280)=[{&(0x7f0000006000)=""/61, 0x3d}, {&(0x7f0000006040)=""/74, 0x4a}, {&(0x7f00000060c0)=""/84, 0x54}, {&(0x7f0000006140)=""/174, 0xae}, {&(0x7f0000006200)=""/108, 0x6c}], 0x5, &(0x7f00000062c0)=""/223, 0xdf}, 0x9}], 0x6, 0x40000102, 0x0) sched_setattr(0x0, 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000240), 0xd21, 0x4000) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmsg$ETHTOOL_MSG_DEBUG_SET(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000229bd7000ffdbdf2599030000100002c261627b800800018004000300"], 0x24}}, 0x14004000) r2 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000200)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="7c0000001000010400"/20, @ANYRES32=r4, @ANYBLOB="00000000000000005c001280110001006272696467655f736c617665000000004400058005000500000000000500200001000000050008000000000006"], 0x7c}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmmsg(r2, &(0x7f0000000000), 0x400000000000235, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, 0x0, 0x20004040) syz_clone(0x100011, 0x0, 0x0, 0x0, 0x0, 0x0) mknod(&(0x7f0000000040)='./file0\x00', 0x1000, 0x1) r6 = open$dir(&(0x7f0000000180)='./file0\x00', 0x7e, 0x0) r7 = inotify_init() fcntl$setstatus(r6, 0x4, 0x6400) inotify_add_watch(r7, &(0x7f00000000c0)='./file0\x00', 0xe400000e) vmsplice(r6, &(0x7f0000000380)=[{&(0x7f0000000000)="9b", 0x1}], 0x1, 0x7) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1, 0x2, &(0x7f0000000140)=ANY=[@ANYBLOB="711008000b0000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x9, 0x0, 0x0, 0x41000, 0x0, '\x00', r4, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) 5.897670034s ago: executing program 2 (id=1667): r0 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) readv(r0, &(0x7f00000001c0)=[{&(0x7f0000001240)=""/4079, 0xfef}, {&(0x7f0000001200)=""/25, 0x19}], 0x2) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000000)=0xffff0018) ioctl$SNDCTL_DSP_GETOPTR(r1, 0x800c5012, &(0x7f0000000100)) 5.766307071s ago: executing program 2 (id=1669): socket$nl_route(0x10, 0x3, 0x0) set_mempolicy(0x2, &(0x7f0000000140)=0x8001, 0x2) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3) 5.624180863s ago: executing program 2 (id=1670): r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f00000001c0)={'batadv_slave_0\x00', 0x0}) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000, 0x0, 0x2}, 0x1c) setsockopt$XDP_UMEM_COMPLETION_RING(r3, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) setsockopt$XDP_RX_RING(r3, 0x11b, 0x2, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'batadv_slave_0\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000380), 0x4) bind$xdp(r3, &(0x7f0000000100)={0x2c, 0x0, r4}, 0x10) bind$xdp(r0, &(0x7f0000000240)={0x2c, 0x1, r2, 0x0, r3}, 0x60) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newlink={0x58, 0x10, 0x1, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x14318}, [@IFLA_IFNAME={0x14, 0x3, 'xfrm0\x00'}, @IFLA_AF_SPEC={0x24, 0x1a, 0x0, 0x1, [@AF_INET6={0x20, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @dev={0xfe, 0x80, '\x00', 0x2c}}, @IFLA_INET6_ADDR_GEN_MODE={0x5, 0x8, 0x2}]}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000884}, 0x0) ioctl$sock_SIOCDELRT(r5, 0x890c, &(0x7f00000003c0)={0x0, @l2={0x1f, 0x3, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0xf}, @tipc=@name={0x1e, 0x2, 0x2, {{0x40, 0x4}}}, @generic={0x11, "6f3a1054d434d65d4e72eae57c6c"}, 0x8000, 0x0, 0x0, 0x0, 0xfc35, 0x0, 0x6, 0x800, 0xffeb}) r7 = mq_open(&(0x7f0000000200)='eth0\x00#~\x02\x00\x00\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfd\x05\x00\x00\x00\x00\x00\x80\x00\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94uu_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18A\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x05\x00\x00\x000\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xce\x00\x00\x00\xe8\vq+\xbb\xc7\xaf\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x1, &(0x7f0000006680)) mq_timedsend(r7, 0x0, 0x0, 0x6, 0x0) mq_timedreceive(r7, &(0x7f000001d600)=""/102376, 0x18fe8, 0x0, 0x0) ioctl$sock_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) r8 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r8, &(0x7f0000000240)={0x24, &(0x7f00000002c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r8, 0x0, &(0x7f0000000180)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB=' '], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r8, 0x0, 0x0) syz_usb_control_io(r8, 0x0, &(0x7f0000001200)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000040)={0x20, 0x0, 0x4, {0x1}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r8, 0x0, 0x0) syz_usb_control_io$hid(r8, 0x0, 0x0) 5.475511998s ago: executing program 1 (id=1671): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0xd9, 0x72, 0xa4, 0x40, 0x20b7, 0x1540, 0xb75a, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xff}}]}}]}}, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000240)={0x1c, &(0x7f0000000180)={0x0, 0x16, 0x1, 'G'}, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000d80)={0x44, 0x0, &(0x7f00000009c0)={0x0, 0xa, 0x1, 0x47}, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x4, {0x1e0, 0x40}}, &(0x7f0000000ac0)={0x40, 0x7, 0x2, 0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000d40)={0x40, 0x21, 0x1, 0x4}}) syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f00000001c0)={0x1c, &(0x7f0000000380)={0x0, 0x0, 0x1, "a5"}, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f0000000280)=ANY=[@ANYBLOB="400cf20000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) rename(&(0x7f0000000100)='./file0/../file0/file0\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0/../file0/file0\x00', 0x5432c2, 0x136) 5.039732234s ago: executing program 0 (id=1672): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x42042, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='numa_maps\x00') ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0x5452, &(0x7f0000000400)) ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000000040)={0x8}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x29f, 0x0, 0x4}]}) syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYRESOCT=r1], 0x0) 3.922211139s ago: executing program 3 (id=1678): setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) recvmmsg(0xffffffffffffffff, &(0x7f0000000480)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=""/11, 0x17}}], 0x400000000000179, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) 3.824910503s ago: executing program 3 (id=1679): r0 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) readv(r0, &(0x7f00000001c0)=[{&(0x7f0000001240)=""/4079, 0xfef}, {&(0x7f0000001200)=""/25, 0x19}], 0x2) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000000)=0xffff0018) ioctl$SNDCTL_DSP_GETOPTR(r1, 0x800c5012, &(0x7f0000000100)) 3.788687563s ago: executing program 3 (id=1680): inotify_init() r0 = openat$vcsu(0xffffff9c, &(0x7f00000001c0), 0x800, 0x0) ioctl$USBDEVFS_RESET(r0, 0x5514) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) listen(r0, 0x3) connect$unix(0xffffffffffffffff, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) syz_open_dev$tty1(0xc, 0x4, 0x1) dup(0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000004c0)=[{{&(0x7f0000000140)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000240)=""/114, 0x72}, {&(0x7f00000002c0)=""/1, 0x1}, {&(0x7f0000000540)=""/48, 0x30}, {&(0x7f0000000340)=""/10, 0xa}], 0x4, &(0x7f0000000400)=""/178, 0xb2}, 0x7}], 0x1, 0x40010020, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x2, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x4, 0xfff, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x111, 0x5}}, 0xffffffffffffff5a) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, 0x0, 0x0) r4 = openat$nullb(0xffffffffffffff9c, 0x0, 0x1c3902, 0x0) sendfile(r4, r4, 0x0, 0x200000) recvmmsg(0xffffffffffffffff, &(0x7f0000006940)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000003c0)=""/6, 0x6}], 0x1}, 0x3}], 0x1, 0x2, 0x0) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB="b4050000000000006110180000000000760000000000000095000000000000005cb6bf6ef64107127b04c78e7ef363b6bc33ecc11b13e83ecbd1f61e39904a778741f77f5c50716f883347bfe9aa70f5b090554da8a3cd69fdba7290e29636e083dc70e863408d34da4443b7e18e4b21cc2e5046d4254b2aef141728315b2e313c35079350146dc5de546ef2fe7e9a7a4df5430a"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x366, 0x10, &(0x7f0000000000), 0x2b2}, 0x48) ioctl$vim2m_VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f0000000100)={0x3, 0x2, 0x1}) r6 = dup(r5) mmap(&(0x7f0000fed000/0x12000)=nil, 0x12000, 0x2, 0x11, r6, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r5, 0xc0585609, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000080)) 3.204255238s ago: executing program 1 (id=1682): socket$nl_generic(0x10, 0x3, 0x10) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket(0xa, 0x5, 0x0) setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000000a00)=0xb5, 0x46) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000040)=0x9, 0x4) getsockopt$XDP_STATISTICS(0xffffffffffffffff, 0x11b, 0x7, &(0x7f0000000000), &(0x7f0000000040)=0x30) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x0) fremovexattr(r3, &(0x7f0000000000)=@known='user.incfs.size\x00') connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x2, 0x7, 0xfffffe0001000001, 0xfa11, 0xffffffff}, 0x0) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f00000000c0)={0xc}) r5 = socket$netlink(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r5, 0x0, 0x8000) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r4, 0x3ba0, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x40, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r7, 0x4068aea3, &(0x7f0000000100)={0xc4, 0x0, 0x800000}) sendmmsg$inet(r0, &(0x7f0000007fc0)=[{{&(0x7f00000000c0)={0x2, 0x4e21, @private=0xa010102}, 0x10, &(0x7f0000000240)=[{&(0x7f0000000140)='O', 0x1}], 0x1}}], 0x1, 0x0) listen(r0, 0x2000002) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) 2.533046494s ago: executing program 2 (id=1684): r0 = socket$packet(0x11, 0x3, 0x300) recvmmsg(r0, &(0x7f0000000480), 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0xb083, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x3, 0x32, 0xffffffffffffffff, 0x0) 2.085537525s ago: executing program 2 (id=1685): unshare(0x66000080) syz_usb_connect(0x5, 0x24, &(0x7f0000000680)={{0x12, 0x1, 0x250, 0x88, 0xcd, 0x9d, 0x8, 0x2100, 0x9e55, 0xe1a8, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x6, 0x8f, 0x60, 0x5, [{{0x9, 0x4, 0x50, 0x5, 0x0, 0x7e, 0x3c, 0x7b, 0x3f}}]}}]}}, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x21}, 0x94) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x801a01, 0x0) ioctl$EVIOCGPROP(r1, 0x40047438, &(0x7f0000000180)=""/246) writev(r1, &(0x7f0000000100)=[{&(0x7f0000000480)="c096f97ea9e74878df8b55be4f3db9db546ca59c825acdae26a1bbc7da79c313a461fa", 0x23}], 0x1) 2.004038766s ago: executing program 1 (id=1686): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) (async) getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="48000084bc00"/20, @ANYRES32=r2, @ANYBLOB="0118020003110000280012800b00010065727370616e0000180002800400120005001700000000000500160002000000"], 0x48}, 0x1, 0x0, 0x0, 0x410c0}, 0x4000020) (async) socket$netlink(0x10, 0x3, 0x0) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1c0000003c00010326bd7000fedbdf250c0000000800030014"], 0x1c}}, 0x800) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f00000000c0)='syzkaller0\x00', 0x10) r5 = syz_usb_connect(0x0, 0x24, &(0x7f0000000680)=ANY=[@ANYBLOB="12010000cf8bed20d90f21004029000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r5, 0x0, &(0x7f0000000580)={0x44, &(0x7f0000000380)=ANY=[@ANYBLOB="201101"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r6, 0x707, &(0x7f0000000200)={&(0x7f00000000c0)=[{0xa, 0x1000, 0x0, 0x0}], 0x1}) syz_usb_control_io$printer(r5, 0x0, 0x0) (async) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r7, 0x0) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000002ac0)=[@in6={0xa, 0x4e24, 0xa, @local, 0x9}]}, &(0x7f0000000080)=0x10) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x18, 0xc, &(0x7f0000000980)=ANY=[@ANYBLOB="180000002000000080c4b66d87e90da2660a708e61bc00000000", @ANYRES32=0x1, @ANYBLOB="0000000000000000b7080000837d00007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000820000009500000000000000"], &(0x7f0000000240)='GPL\x00', 0x7ff, 0x0, 0x0, 0x40f00, 0x7b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000340)={0x7, 0x2}, 0x8, 0x10, &(0x7f0000000400)={0x5, 0xa, 0x657, 0xff}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000440)=[0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x1}, 0x94) (async) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x12, r8, 0x0) r9 = userfaultfd(0x1) ioctl$UFFDIO_API(r9, 0xc018aa3f, &(0x7f0000000080)) (async) ioctl$UFFDIO_REGISTER(r9, 0xc020aa00, &(0x7f0000000340)={{&(0x7f0000ffa000/0x4000)=nil, 0x4000}, 0x1}) write$UHID_CREATE2(r8, &(0x7f0000000340)=ANY=[], 0x118) ioctl$UFFDIO_ZEROPAGE(r9, 0xc020aa07, &(0x7f0000000280)={{&(0x7f0000ffc000/0x2000)=nil, 0x2000}}) (async) pipe(0x0) (async) socket$inet_udp(0x2, 0x2, 0x0) 1.896996139s ago: executing program 3 (id=1687): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e999000000000000000000000000000000000000000000000000ac1e0001821501f63ed02a170000000000000000000000000a"], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001400e9990000000000000000fc"], 0xb8}}, 0x20040000) (fail_nth: 8) 1.877777248s ago: executing program 0 (id=1688): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, 0x0, &(0x7f00000007c0)='{\xe0e%m\"\x92\xb5\xcb\x00\x01\x0e!5\xd8\xf2\x92\x97\x86\xf9\xa8\xe7;\xdff3\x83\xb1a\xf2j\x90\x10@\x1chOK\x98\xae\xd6>\xbaN\x1d_N\xcbdIP2$\xbc\xc9\x89\xb5\n\x90-i%\xe2\x94\fH\xf1\xed\r\b\x1c\x81>\t\xc30-\xe2\xb3\xb00x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x111, 0x6}}, 0x20) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000080)={0xffffffffffffffff}, 0x111, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r2, &(0x7f0000000380)={0x3, 0x40, 0xfa00, {{0xa, 0x4e20, 0xb, @empty, 0x1}, {0xa, 0x4e22, 0x2, @remote, 0x80000000}, r3, 0xfffffe4d}}, 0x48) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0x4}}, 0x10) write$RDMA_USER_CM_CMD_RESOLVE_IP(r4, &(0x7f0000000180)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0xe, @empty, 0x2}, {0xa, 0x4e23, 0x7, @remote, 0x3}, r5, 0x7}}, 0x48) r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000001400), 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000840)=ANY=[@ANYBLOB="240000001000010700000000000000000a000000060001001300000008000a0005000000bd"], 0x24}}, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000300)={0xffffffffffffffff}, 0x111, 0x3}}, 0x20) socket$netlink(0x10, 0x3, 0xe) write$RDMA_USER_CM_CMD_RESOLVE_IP(r6, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0xfffc, 0xd4, @empty, 0xa09c}, {0xa, 0x2, 0xfffffffe, @dev={0xfe, 0x80, '\x00', 0x3a}}, r8, 0x40099d}}, 0x48) writev(r6, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x7, &(0x7f0000000100)=0xc, 0x4) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r9, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) 1.448430414s ago: executing program 4 (id=1690): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000000)=0xffff0018) ioctl$SNDCTL_DSP_GETOPTR(r0, 0x800c5012, &(0x7f0000000100)) 1.410264495s ago: executing program 4 (id=1691): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$cec(0x0, 0x0, 0x416400) r2 = socket(0x15, 0x5, 0x0) getsockopt(r2, 0x200000000114, 0x271b, &(0x7f0000000580)=""/102393, &(0x7f0000000040)=0x18ff9) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0cc5605, 0x0) (async) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0cc5605, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) timerfd_create(0x0, 0x0) shutdown(0xffffffffffffffff, 0x0) (async) shutdown(0xffffffffffffffff, 0x0) chdir(&(0x7f0000000540)='./cgroup\x00') (async) chdir(&(0x7f0000000540)='./cgroup\x00') fchmodat(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup/file0\x00', 0xfffffe92) mkdir(&(0x7f00000003c0)='./file0\x00', 0xffe9) (async) mkdir(&(0x7f00000003c0)='./file0\x00', 0xffe9) pread64(0xffffffffffffffff, &(0x7f0000000340)=""/251, 0xfb, 0xacab) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x0) (async) r4 = socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) (async) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r6, {0x0, 0x1}, {0xffff, 0xffff}, {0xffff, 0x9}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xe0000000, 0x5, 0xb7, 0x2, 0x1, 0x1, 0x4, 0x3, 0x1}}}}]}, 0x58}}, 0x4000) r7 = socket(0x10, 0x803, 0x0) r8 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newtfilter={0xa0, 0x2c, 0xd2b, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {0xb, 0x3}, {0x0, 0x7}, {0x1, 0x9}}, [@filter_kind_options=@f_u32={{0x8}, {0x74, 0x2, [@TCA_U32_SEL={0x14, 0x5, {0x7, 0x6, 0x0, 0x9, 0x401, 0x1000, 0x8a0, 0xd5}}, @TCA_U32_ACT={0x5c, 0x7, [@m_skbmod={0x58, 0x1, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SKBMOD_ETYPE={0x6, 0x5, 0x2}, @TCA_SKBMOD_PARMS={0x20, 0x2, {{0x4cc0, 0x3, 0x4, 0x7, 0x400000}, 0xc}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x2}}}}]}]}}]}, 0xa0}, 0x1, 0x0, 0x0, 0x81}, 0x800) ioctl$RTC_UIE_ON(0xffffffffffffffff, 0x7003) 980.128551ms ago: executing program 4 (id=1692): creat(&(0x7f0000000000)='./file0\x00', 0x62b266a4c604c0ba) r0 = inotify_init() inotify_add_watch(r0, &(0x7f00000002c0)='./file0\x00', 0x4000021d) r1 = creat(&(0x7f0000000080)='./file0\x00', 0x68) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000680)}], 0x1) r2 = open(&(0x7f00000003c0)='./file0\x00', 0x48040, 0x0) read$FUSE(r2, &(0x7f00000025c0)={0x2020}, 0x2020) 928.581758ms ago: executing program 4 (id=1693): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) 867.923272ms ago: executing program 4 (id=1694): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x8800) r2 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r2, &(0x7f0000000200)=@id={0x1e, 0x3, 0x2, {0x4e22, 0x1}}, 0x10) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) ioctl$VIDIOC_DBG_G_CHIP_INFO(0xffffffffffffffff, 0xc0c85666, &(0x7f00000005c0)={{0x1, @addr=0x1}, "522ec2c4dfdea0e049be106158e4f5aa2e9a2a24b978bb029b829364f1d8fecd", 0x3}) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) symlink(0x0, &(0x7f0000000080)='./file0\x00') rename(&(0x7f0000000580)='./file0\x00', &(0x7f0000000780)='./file2\x00') prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000080)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) setresgid(0x0, 0x0, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1, 0x2}) r3 = epoll_create1(0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000180)={0x2d8}, 0x10) write(0xffffffffffffffff, &(0x7f0000000000)="240000001a005f0400f9f407000904018020200000000008000100"/36, 0x24) r4 = syz_open_dev$media(&(0x7f00000000c0), 0x103, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r4, 0x80047c05, &(0x7f0000000080)=0xffffffffffffffff) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r5, &(0x7f0000000040)={0x2}) epoll_ctl$EPOLL_CTL_MOD(r3, 0x3, r5, &(0x7f0000000100)={0x4}) syz_io_uring_setup(0x492b, &(0x7f00000001c0)={0x0, 0x32a2, 0x2000, 0x1, 0x1fe}, &(0x7f0000000040), &(0x7f0000000140)) 791.801827ms ago: executing program 2 (id=1695): r0 = socket$packet(0x11, 0x3, 0x300) recvmmsg(r0, &(0x7f0000000480)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0xb083, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x3, 0x32, 0xffffffffffffffff, 0x0) 724.157908ms ago: executing program 1 (id=1696): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private1, 0x9}]}, &(0x7f00000002c0)=0x10) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000000)={r2, 0x7}, &(0x7f0000000040)=0x8) 93.914993ms ago: executing program 3 (id=1697): prctl$PR_SET_MM_AUXV(0x23, 0xc, &(0x7f0000000000)="7fd48ddd59", 0x5) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) socket(0x2000000015, 0x80005, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r1, 0x0, 0x22, 0x0, 0x0) arch_prctl$ARCH_SET_CPUID(0x1012, 0x0) pivot_root(0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendto$unix(r0, &(0x7f0000000340)="4d58cec38a329c112e5834dc478b8fb94ca2764c006551f5a8d03ed3707ed7a42b66bc0370479a72dbb1c767fb7e513db78f8d4c2c1f243f7a91fb73855f43aa193874a2b3959cdf78982e1158a9add60f7b88a4c2352965350543ac42f78dc2cb29a580e4e0d4d7d70784a66d0a5f69147bb1321c33efae0be4a85253094b80dcb3430411ec8b87ebf3c7198e4b88d03f10", 0x92, 0x4000011, &(0x7f0000000400)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newlink={0x40, 0x10, 0x1, 0x70bd2c, 0x20, {0x0, 0x0, 0x0, 0x0, 0xdf15003157970113, 0x20c0}, [@IFLA_IFNAME={0x14, 0x3, 'netdevsim0\x00'}, @IFLA_LINKMODE={0x5, 0x11, 0x4}, @IFLA_VFINFO_LIST={0x4}]}, 0x40}, 0x1, 0x0, 0x0, 0x200080c5}, 0x20000010) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000480)={'vcan0\x00', 0x0}) ioctl$VIDIOC_CREATE_BUFS(0xffffffffffffffff, 0xc0f8565c, &(0x7f0000000240)={0x3ff, 0x800, 0x6, {0xc, @raw_data="7c364c9fc4e8996ddd761f14c275da168f649edd3edb7a1619f4012610c4f3b1bb1136ef2f8009c9f5df451b42131e1572fc1ccbb4f9ca73c45db2ed6e02d797083f6cda0e36ad213942d5298d36dfc37d86fd1c1c701499a4ba9fd8b79a88221f3c8338d24ee1d0e2fb22280c63dd974ff656df9765b872df3c7645310f5d8383ea66f410debaa25fef4b8322f1c636dab906215547b22dddd39af430538f786b54193ae556eb8ca016587fa767a314e8cb46b834d59dca11e5f93158fe6ef99bd93e511250b37e"}, 0x4}) r5 = open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0xa2) fcntl$setsig(r5, 0xa, 0x13) fcntl$setlease(r5, 0x400, 0x0) timer_create(0x7, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000000280)=0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = getpid() syz_clone(0x648e7000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone3(&(0x7f0000000680)={0x40004000, 0x0, 0x0, 0x0, {0x21}, 0x0, 0x0, 0x0, 0x0}, 0x58) fcntl$setownex(r7, 0xf, &(0x7f0000000100)={0x2, r8}) ioctl$sock_FIOGETOWN(r7, 0x8903, &(0x7f00000001c0)=0x0) fcntl$setown(r5, 0x8, r9) timer_settime(r6, 0x0, &(0x7f0000000200)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) truncate(&(0x7f0000000040)='./file0\x00', 0x0) bind$can_j1939(r3, &(0x7f0000000100)={0x1d, r4, 0x0, {0x1, 0x1, 0x4}, 0x1}, 0x18) sendmsg$can_j1939(r3, &(0x7f0000000200)={&(0x7f0000000000)={0x1d, r4, 0x0, {0x0, 0x0, 0x4}, 0x1}, 0x18, &(0x7f00000001c0)={&(0x7f0000000140)="5ab37158946b88213a", 0x9}, 0x1, 0x0, 0x0, 0x20008840}, 0x4000000) 3.625643ms ago: executing program 4 (id=1698): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x202, 0x1, 0xcccd2000, 0x1000, &(0x7f0000009000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000001c0)={0x1fd, 0x2, 0x58000, 0x2000, &(0x7f000002f000/0x2000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x4, 0x3, 0xf000, 0x1000, &(0x7f000002f000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x200, 0x0, 0xffff1000, 0x1000, &(0x7f0000ffb000/0x1000)=nil}) syz_clone3(&(0x7f0000000540)={0x21000020, 0x0, 0x0, 0x0, {0x40}, 0x0, 0x0, 0x0, 0x0}, 0x58) 0s ago: executing program 0 (id=1699): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) socket$nl_netfilter(0x10, 0x3, 0xc) openat$fuse(0xffffffffffffff9c, &(0x7f0000002040), 0x2, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r2, 0x0, 0xc8, &(0x7f0000003d40), 0x4) r3 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$IP_VS_SO_GET_DESTS(r3, 0x0, 0x484, &(0x7f0000001e00)=""/218, &(0x7f0000001f00)=0xda) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, &(0x7f0000003d80)={0x1, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) setsockopt$inet_mreq(r1, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x2a, &(0x7f0000000080)={@local, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @address_request}}}}, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) r4 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_FLUSH(r4, 0x0, 0xd4, &(0x7f0000000040)=0x9, 0x4) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r6 = dup3(r5, r0, 0x0) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001340)={&(0x7f00000000c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x2, [@int]}}, 0x0, 0x2a}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r7, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x0, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f0000000580)="b3185d7b"}) r8 = syz_open_dev$media(&(0x7f0000000240), 0x4, 0x4044fb17ab959b08) ioctl$XFS_IOC_RTGROUP_GEOMETRY(r8, 0xc0805841, &(0x7f0000000380)={0x9, 0x5, 0x4, 0x7f, 0x8}) kernel console output (not intermixed with test programs): -16 [ 361.946650][ T47] usb 2-1: new high-speed USB device number 79 using dummy_hcd [ 362.002498][T10526] delete_channel: no stack [ 362.013046][ T796] hid-generic 0011:0000:0000.0024: unknown main item tag 0x0 [ 362.029264][ T47] usb 2-1: device descriptor read/8, error -71 [ 362.052956][ T796] hid-generic 0011:0000:0000.0024: unknown main item tag 0x0 [ 362.073266][ T796] hid-generic 0011:0000:0000.0024: unknown main item tag 0x0 [ 362.099124][ T796] hid-generic 0011:0000:0000.0024: unknown main item tag 0x0 [ 362.127449][ T796] hid-generic 0011:0000:0000.0024: unknown main item tag 0x0 [ 362.154044][ T796] hid-generic 0011:0000:0000.0024: unknown main item tag 0x0 [ 362.175213][ T796] hid-generic 0011:0000:0000.0024: unknown main item tag 0x0 [ 362.193002][ T796] hid-generic 0011:0000:0000.0024: unknown main item tag 0x0 [ 362.209544][ T5820] dvb_usb_m920x 3-1:0.0: probe with driver dvb_usb_m920x failed with error -71 [ 362.238100][ T796] hid-generic 0011:0000:0000.0024: unknown main item tag 0x0 [ 362.261075][ T796] hid-generic 0011:0000:0000.0024: unknown main item tag 0x0 [ 362.271145][ T5820] usb 3-1: USB disconnect, device number 74 [ 362.356347][ T47] usb 2-1: new high-speed USB device number 80 using dummy_hcd [ 362.392479][ T796] hid-generic 0011:0000:0000.0024: hidraw0: HID v0.00 Device [syz1] on syz1 [ 362.414585][ T47] usb 2-1: device descriptor read/8, error -71 [ 362.577437][ T47] usb usb2-port1: unable to enumerate USB device [ 363.241351][ T35] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 363.276708][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 363.297214][ T35] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 363.384811][T10584] syzkaller0: entered promiscuous mode [ 363.404949][T10584] syzkaller0: entered allmulticast mode [ 363.422725][ T35] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 363.447930][ T35] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 363.499720][ T796] usb 3-1: new full-speed USB device number 75 using dummy_hcd [ 363.676118][ T796] usb 3-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 363.694600][ T796] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x93, changing to 0x83 [ 363.710822][ T796] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid maxpacket 10350, setting to 64 [ 363.725247][ T796] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 363.750131][ T796] usb 3-1: New USB device found, idVendor=15c2, idProduct=003b, bcdDevice=66.3e [ 363.766616][ T796] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 363.799815][ T796] usb 3-1: Product: syz [ 363.808652][ T796] usb 3-1: Manufacturer: syz [ 363.822139][ T796] usb 3-1: SerialNumber: syz [ 363.846030][ T796] usb 3-1: config 0 descriptor?? [ 363.852779][ T5904] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 363.885394][T10587] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 363.910214][ C0] imon 3-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 363.951891][ T796] input: iMON Panel, Knob and Mouse(15c2:003b) as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input140 [ 364.016331][ T5904] usb 4-1: Using ep0 maxpacket: 8 [ 364.033930][ T5904] usb 4-1: too many endpoints for config 0 interface 0 altsetting 233: 153, using maximum allowed: 30 [ 364.063717][ T5904] usb 4-1: config 0 interface 0 altsetting 233 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 364.075330][ T5904] usb 4-1: config 0 interface 0 altsetting 233 endpoint 0x81 has invalid wMaxPacketSize 0 [ 364.090667][ T5904] usb 4-1: config 0 interface 0 altsetting 233 has 1 endpoint descriptor, different from the interface descriptor's value: 153 [ 364.111231][ T796] imon:send_packet: packet tx failed (-71) [ 364.117634][ T5904] usb 4-1: config 0 interface 0 has no altsetting 0 [ 364.126039][ T5904] usb 4-1: New USB device found, idVendor=1e71, idProduct=170e, bcdDevice= 0.00 [ 364.136716][ T796] imon 3-1:0.0: panel buttons/knobs setup failed [ 364.151395][ T5904] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 364.178749][ T5904] usb 4-1: config 0 descriptor?? [ 364.238209][ T796] rc_core: IR keymap rc-imon-pad not found [ 364.244064][ T796] Registered IR keymap rc-empty [ 364.289550][ T796] imon 3-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 364.331722][ T796] imon 3-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 364.359519][ T796] imon:send_packet: packet tx failed (-71) [ 364.397429][ T796] imon 3-1:0.0: remote input dev register failed [ 364.434913][ T796] imon 3-1:0.0: imon_init_intf0: rc device setup failed [ 364.491319][ T796] imon 3-1:0.0: unable to initialize intf0, err 0 [ 364.519712][ T796] imon:imon_probe: failed to initialize context! [ 364.545251][ T796] imon 3-1:0.0: unable to register, err -19 [ 364.560013][ T796] usb 3-1: USB disconnect, device number 75 [ 364.963786][T10610] delete_channel: no stack [ 365.036403][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 365.226513][ T796] usb 1-1: new full-speed USB device number 86 using dummy_hcd [ 365.420735][ T796] usb 1-1: config 0 interface 0 altsetting 13 endpoint 0x81 has invalid wMaxPacketSize 0 [ 365.456009][ T796] usb 1-1: config 0 interface 0 has no altsetting 0 [ 365.487113][ T796] usb 1-1: New USB device found, idVendor=046d, idProduct=c534, bcdDevice= 0.00 [ 365.538134][ T796] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 365.589664][ T796] usb 1-1: config 0 descriptor?? [ 366.429313][T10648] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1392'. [ 366.441566][T10648] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1392'. [ 366.488719][ T5895] usb 1-1: USB disconnect, device number 86 [ 366.654377][ T47] usb 4-1: USB disconnect, device number 73 [ 367.087936][T10677] program syz.0.1396 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 367.157777][ T47] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 367.361495][ T47] usb 4-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 367.380997][ T796] usb 3-1: new high-speed USB device number 76 using dummy_hcd [ 367.414510][ T47] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 367.472661][ T47] usb 4-1: Product: syz [ 367.506282][ T47] usb 4-1: Manufacturer: syz [ 367.539008][ T47] usb 4-1: SerialNumber: syz [ 367.572413][ T796] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 367.594224][ T47] usb 4-1: config 0 descriptor?? [ 367.608689][ T796] usb 3-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 367.650434][ T796] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 7 [ 367.722831][ T796] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 367.780021][T10654] delete_channel: no stack [ 367.796709][ T796] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 367.829233][ T796] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 367.863973][ T796] usb 3-1: Product: syz [ 367.889002][ T796] usb 3-1: Manufacturer: syz [ 367.922242][ T796] usb 3-1: SerialNumber: syz [ 368.048220][ T796] usb 3-1: config 0 descriptor?? [ 368.089520][ T796] garmin_gps 3-1:0.0: Garmin GPS usb/tty converter detected [ 368.133819][ T796] garmin_gps ttyUSB0: garmin_write_bulk - usb_submit_urb(write bulk) failed with status = -8 [ 368.199037][ T796] garmin_gps ttyUSB0: probe with driver garmin_gps failed with error -8 [ 368.381220][ T796] usb 3-1: USB disconnect, device number 76 [ 368.401654][ T796] garmin_gps 3-1:0.0: device disconnected [ 368.670719][ T47] usb 4-1: non-Atmel transceiver xxxx0447 [ 368.746591][ T5895] usb 5-1: new full-speed USB device number 79 using dummy_hcd [ 368.879200][ T47] usb 4-1: Firmware version (0.0) predates our first public release. [ 368.908297][ T47] usb 4-1: Please update to version 0.2 or newer [ 368.923498][ T5895] usb 5-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 368.940741][ T47] usb 4-1: atusb_probe: initialization failed, error = -19 [ 368.959300][ T5895] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x93, changing to 0x83 [ 368.985138][ T47] usb 4-1: USB disconnect, device number 74 [ 369.015894][ T5895] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid maxpacket 10350, setting to 64 [ 369.049646][ T5895] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 369.091922][ T5895] usb 5-1: New USB device found, idVendor=15c2, idProduct=003b, bcdDevice=66.3e [ 369.124383][ T5895] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 369.150271][ T5895] usb 5-1: Product: syz [ 369.164856][ T5895] usb 5-1: Manufacturer: syz [ 369.179103][ T5895] usb 5-1: SerialNumber: syz [ 369.206220][ T5895] usb 5-1: config 0 descriptor?? [ 369.229535][T10699] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 369.248190][ C1] imon 5-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 369.257698][ T5895] input: iMON Panel, Knob and Mouse(15c2:003b) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input142 [ 369.454286][ T5895] imon:send_packet: packet tx failed (-71) [ 369.479722][T10700] delete_channel: no stack [ 369.506931][ T5895] imon 5-1:0.0: panel buttons/knobs setup failed [ 369.526381][ T5904] usb 3-1: new high-speed USB device number 77 using dummy_hcd [ 369.638153][ T5895] rc_core: IR keymap rc-imon-pad not found [ 369.653870][ T5895] Registered IR keymap rc-empty [ 369.665078][ T5895] imon 5-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 369.680198][ T5895] imon 5-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 369.690356][ T5895] imon:send_packet: packet tx failed (-71) [ 369.713418][T10716] netlink: 'syz.0.1407': attribute type 1 has an invalid length. [ 369.721310][ T5895] imon 5-1:0.0: remote input dev register failed [ 369.728578][ T5895] imon 5-1:0.0: imon_init_intf0: rc device setup failed [ 369.730588][ T5904] usb 3-1: New USB device found, idVendor=04d8, idProduct=f372, bcdDevice= 0.00 [ 369.755768][ T5904] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 369.772827][ T5904] usb 3-1: config 0 descriptor?? [ 369.821206][T10716] 8021q: adding VLAN 0 to HW filter on device bond7 [ 369.846605][ T5895] imon 5-1:0.0: unable to initialize intf0, err 0 [ 369.854396][ T5895] imon:imon_probe: failed to initialize context! [ 369.873157][T10718] ip6erspan0: entered promiscuous mode [ 369.880189][ T5895] imon 5-1:0.0: unable to register, err -19 [ 369.898472][T10718] bond7: (slave ip6erspan0): making interface the new active one [ 369.906541][ T796] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 369.907105][ T5895] usb 5-1: USB disconnect, device number 79 [ 369.935921][T10718] bond7: (slave ip6erspan0): Enslaving as an active interface with an up link [ 370.001362][T10709] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 370.031234][T10709] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 370.111628][ T796] usb 4-1: unable to get BOS descriptor or descriptor too short [ 370.122888][ T796] usb 4-1: config 6 has too many interfaces: 255, using maximum allowed: 32 [ 370.142003][ T796] usb 4-1: config 6 has 1 interface, different from the descriptor's value: 255 [ 370.154069][ T796] usb 4-1: config 6 has no interface number 0 [ 370.161812][ T796] usb 4-1: config 6 interface 158 has no altsetting 0 [ 370.178464][ T796] usb 4-1: string descriptor 0 read error: -22 [ 370.185780][ T796] usb 4-1: New USB device found, idVendor=0bda, idProduct=0140, bcdDevice=da.29 [ 370.205482][ T796] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 370.246640][ T5932] usb 2-1: new high-speed USB device number 81 using dummy_hcd [ 370.308421][ T5904] usbhid 3-1:0.0: can't add hid device: -71 [ 370.314434][ T5904] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 370.346377][ T5904] usb 3-1: USB disconnect, device number 77 [ 370.417750][ T5932] usb 2-1: Using ep0 maxpacket: 32 [ 370.425889][ T5932] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 370.443269][T10714] netlink: 'syz.3.1406': attribute type 1 has an invalid length. [ 370.452627][ T5932] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 370.462474][T10714] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1406'. [ 370.475967][ T796] rtsx_usb 4-1:6.158: probe with driver rtsx_usb failed with error -71 [ 370.484395][ T5932] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 370.499104][ T5932] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 370.510154][ T796] usb 4-1: USB disconnect, device number 75 [ 370.521496][ T5932] usb 2-1: config 0 descriptor?? [ 370.548361][ T5932] hub 2-1:0.0: USB hub found [ 371.166376][ T5895] usb 3-1: new high-speed USB device number 78 using dummy_hcd [ 371.182892][T10746] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1416'. [ 371.361685][ T5895] usb 3-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 371.379616][ T5895] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 371.398856][ T5895] usb 3-1: Product: syz [ 371.403218][ T5895] usb 3-1: Manufacturer: syz [ 371.408380][ T5895] usb 3-1: SerialNumber: syz [ 371.419395][ T5895] usb 3-1: config 0 descriptor?? [ 371.688843][ T5820] usb 1-1: new full-speed USB device number 87 using dummy_hcd [ 371.860356][ T5820] usb 1-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 371.871349][ T5820] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x93, changing to 0x83 [ 371.883192][ T5820] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid maxpacket 10350, setting to 64 [ 371.895578][ T5820] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 371.914466][ T5820] usb 1-1: New USB device found, idVendor=15c2, idProduct=003b, bcdDevice=66.3e [ 371.923848][ T5820] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 371.932292][ T5820] usb 1-1: Product: syz [ 371.938022][ T5820] usb 1-1: Manufacturer: syz [ 371.942733][ T5820] usb 1-1: SerialNumber: syz [ 371.957298][ T5820] usb 1-1: config 0 descriptor?? [ 371.969890][T10754] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 371.981916][ C1] imon 1-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 371.993031][ T5820] input: iMON Panel, Knob and Mouse(15c2:003b) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input144 [ 372.076436][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 372.179886][ T5820] imon:send_packet: packet tx failed (-71) [ 372.196361][ T5820] imon 1-1:0.0: panel buttons/knobs setup failed [ 372.296299][ T5820] rc_core: IR keymap rc-imon-pad not found [ 372.302179][ T5820] Registered IR keymap rc-empty [ 372.310019][ T5820] imon 1-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 372.321746][ T5820] imon 1-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 372.331645][ T5820] imon:send_packet: packet tx failed (-71) [ 372.356544][ T5820] imon 1-1:0.0: remote input dev register failed [ 372.363348][ T5820] imon 1-1:0.0: imon_init_intf0: rc device setup failed [ 372.377322][ T5888] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 372.405931][ T5820] imon 1-1:0.0: unable to initialize intf0, err 0 [ 372.414566][ T5820] imon:imon_probe: failed to initialize context! [ 372.430905][ T5820] imon 1-1:0.0: unable to register, err -19 [ 372.457068][ T5820] usb 1-1: USB disconnect, device number 87 [ 372.463745][ T5895] usb 3-1: non-Atmel transceiver xxxx0447 [ 372.546674][ T5888] usb 5-1: Using ep0 maxpacket: 8 [ 372.556401][ T5888] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 372.569632][ T5888] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 372.588302][ T5888] usb 5-1: New USB device found, idVendor=16d0, idProduct=10a9, bcdDevice=30.52 [ 372.608582][ T5888] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 372.627490][ T5888] usb 5-1: Product: syz [ 372.639860][ T5888] usb 5-1: Manufacturer: syz [ 372.650905][ T5888] usb 5-1: SerialNumber: syz [ 372.667384][ T5888] usb 5-1: config 0 descriptor?? [ 372.769303][ T5895] usb 3-1: Firmware version (0.0) predates our first public release. [ 372.793950][ T5895] usb 3-1: Please update to version 0.2 or newer [ 372.809575][ T5895] usb 3-1: atusb_probe: initialization failed, error = -19 [ 372.839389][ T5895] usb 3-1: USB disconnect, device number 78 [ 372.951928][ T5932] hub 2-1:0.0: config failed, can't read hub descriptor (err -22) [ 373.002897][ T5932] usbhid 2-1:0.0: can't add hid device: -71 [ 373.029340][ T5932] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 373.056193][T10771] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1424'. [ 373.068244][ T5932] usb 2-1: USB disconnect, device number 81 [ 373.089042][T10770] raw_sendmsg: syz.0.1423 forgot to set AF_INET. Fix it! [ 373.120060][ T796] usb 5-1: USB disconnect, device number 80 [ 373.128578][T10771] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1424'. [ 373.591514][T10763] delete_channel: no stack [ 374.146394][ T5888] usb 3-1: new high-speed USB device number 79 using dummy_hcd [ 374.339385][ T29] audit: type=1326 audit(1772100350.432:749): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10805 comm="syz.1.1436" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aef6c code=0x7ffc0000 [ 374.414624][ T5888] usb 3-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 374.426630][ T29] audit: type=1326 audit(1772100350.462:750): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10805 comm="syz.1.1436" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aef6c code=0x7ffc0000 [ 374.451569][ T5888] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 374.460510][ T5888] usb 3-1: Product: syz [ 374.464691][ T5888] usb 3-1: Manufacturer: syz [ 374.470046][ T5888] usb 3-1: SerialNumber: syz [ 374.476737][ T29] audit: type=1326 audit(1772100350.462:751): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10805 comm="syz.1.1436" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf70aef6c code=0x7ffc0000 [ 374.500751][ T5888] usb 3-1: config 0 descriptor?? [ 374.510194][ T29] audit: type=1326 audit(1772100350.462:752): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10805 comm="syz.1.1436" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aef6c code=0x7ffc0000 [ 374.532652][ T29] audit: type=1326 audit(1772100350.462:753): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10805 comm="syz.1.1436" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aef6c code=0x7ffc0000 [ 374.555268][ T29] audit: type=1326 audit(1772100350.462:754): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10805 comm="syz.1.1436" exe="/root/syz-executor" sig=0 arch=40000003 syscall=351 compat=1 ip=0xf70aef6c code=0x7ffc0000 [ 374.617826][ T5888] hub 3-1:0.0: bad descriptor, ignoring hub [ 374.634084][ T5888] hub 3-1:0.0: probe with driver hub failed with error -5 [ 374.670382][ T29] audit: type=1326 audit(1772100350.462:755): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10805 comm="syz.1.1436" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aef6c code=0x7ffc0000 [ 374.716328][ T796] usb 2-1: new high-speed USB device number 82 using dummy_hcd [ 374.746642][ T29] audit: type=1326 audit(1772100350.462:756): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10805 comm="syz.1.1436" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aef6c code=0x7ffc0000 [ 374.777296][T10812] veth1_to_hsr: entered promiscuous mode [ 374.777313][T10812] veth1_to_hsr: entered allmulticast mode [ 374.786988][ T29] audit: type=1326 audit(1772100350.462:757): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10805 comm="syz.1.1436" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf70aef6c code=0x7ffc0000 [ 374.787038][ T29] audit: type=1326 audit(1772100350.462:758): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10805 comm="syz.1.1436" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aef6c code=0x7ffc0000 [ 374.841881][ T5888] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 374.843907][ T5888] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 374.844426][ T5888] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 374.844458][ T5888] usb 3-1: media controller created [ 374.870056][ T5888] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 374.936359][ T796] usb 2-1: Using ep0 maxpacket: 32 [ 374.937725][ T796] usb 2-1: too many configurations: 9, using maximum allowed: 8 [ 374.940531][ T796] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 374.940561][ T796] usb 2-1: can't read configurations, error -61 [ 374.993625][ T5888] DVB: Unable to find symbol dib7000p_attach() [ 374.993641][ T5888] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 375.072256][ T5888] rc_core: IR keymap rc-dib0700-rc5 not found [ 375.072272][ T5888] Registered IR keymap rc-empty [ 375.072438][ T5888] dvb-usb: could not initialize remote control. [ 375.072444][ T5888] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 375.086420][ T796] usb 2-1: new high-speed USB device number 83 using dummy_hcd [ 375.618207][ T796] usb 2-1: Using ep0 maxpacket: 32 [ 375.654758][ T796] usb 2-1: too many configurations: 9, using maximum allowed: 8 [ 375.704248][ T796] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 375.744277][ T796] usb 2-1: can't read configurations, error -61 [ 375.777266][ T796] usb usb2-port1: attempt power cycle [ 376.036773][T10837] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1443'. [ 376.153252][ T796] usb 2-1: new high-speed USB device number 84 using dummy_hcd [ 376.206642][ T796] usb 2-1: Using ep0 maxpacket: 32 [ 376.280409][ T796] usb 2-1: too many configurations: 9, using maximum allowed: 8 [ 376.293316][ T796] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 376.301155][ T796] usb 2-1: can't read configurations, error -61 [ 376.436370][ T796] usb 2-1: new high-speed USB device number 85 using dummy_hcd [ 376.457119][ T796] usb 2-1: Using ep0 maxpacket: 32 [ 376.463241][ T796] usb 2-1: too many configurations: 9, using maximum allowed: 8 [ 376.473976][ T796] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 376.482405][ T796] usb 2-1: can't read configurations, error -61 [ 376.490137][ T796] usb usb2-port1: unable to enumerate USB device [ 376.578746][ T5820] usb 3-1: USB disconnect, device number 79 [ 376.611218][ T5820] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully deinitialized and disconnected. [ 377.047554][ T796] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 377.106392][ T5932] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 377.189284][T10851] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1449'. [ 377.216435][ T796] usb 4-1: Using ep0 maxpacket: 32 [ 377.230208][ T796] usb 4-1: config 0 has an invalid interface number: 89 but max is 0 [ 377.257182][ T5932] usb 3-1: device descriptor read/64, error -71 [ 377.265399][ T796] usb 4-1: config 0 has no interface number 0 [ 377.302260][ T796] usb 4-1: config 0 interface 89 has no altsetting 0 [ 377.340999][ T796] usb 4-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 377.354575][ T796] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 377.371584][ T796] usb 4-1: Product: syz [ 377.384923][ T796] usb 4-1: Manufacturer: syz [ 377.407658][ T796] usb 4-1: SerialNumber: syz [ 377.430360][ T796] usb 4-1: config 0 descriptor?? [ 377.449828][ T796] em28xx 4-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 377.479284][ T796] em28xx 4-1:0.89: Video interface 89 found: bulk [ 377.526530][ T5932] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 377.690110][ T5932] usb 3-1: device descriptor read/64, error -71 [ 377.818182][ T5932] usb usb3-port1: attempt power cycle [ 378.055714][ T796] em28xx 4-1:0.89: unknown em28xx chip ID (0) [ 378.196646][ T5932] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 378.227864][ T5932] usb 3-1: device descriptor read/8, error -71 [ 378.479265][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.485630][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.486380][ T5932] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 378.517047][ T5932] usb 3-1: device descriptor read/8, error -71 [ 378.628044][ T5932] usb usb3-port1: unable to enumerate USB device [ 378.778004][T10866] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1453'. [ 378.789992][T10866] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1453'. [ 378.906123][ T796] em28xx 4-1:0.89: writing to i2c device at 0xa0 failed (error=-5) [ 378.918105][ T796] em28xx 4-1:0.89: failed to read eeprom (err=-5) [ 378.924635][ T796] em28xx 4-1:0.89: em28xx_i2c_register: em28xx_i2_eeprom failed! retval [-5] [ 378.986365][ T796] em28xx 4-1:0.89: Identified as Terratec Grabby (card=67) [ 378.993711][ T796] em28xx 4-1:0.89: analog set to bulk mode. [ 379.000917][ T5904] em28xx 4-1:0.89: Registering V4L2 extension [ 379.016708][ T796] usb 4-1: USB disconnect, device number 76 [ 379.026439][ T5932] usb 5-1: new high-speed USB device number 81 using dummy_hcd [ 379.044736][ T796] em28xx 4-1:0.89: Disconnecting em28xx [ 379.095631][ T5904] em28xx 4-1:0.89: Config register raw data: 0xffffffed [ 379.116486][ T5904] em28xx 4-1:0.89: AC97 chip type couldn't be determined [ 379.136388][ T5904] em28xx 4-1:0.89: No AC97 audio processor [ 379.145305][ T5904] usb 4-1: Decoder not found [ 379.146167][T10871] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 379.159909][ T5904] em28xx 4-1:0.89: failed to create media graph [ 379.168547][ T5904] em28xx 4-1:0.89: V4L2 device video103 deregistered [ 379.180381][ T5904] em28xx 4-1:0.89: Registering snapshot button... [ 379.188426][ T5932] usb 5-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 379.202053][ T5904] input: em28xx snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.89/input/input147 [ 379.213329][ T5932] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 379.226774][ T5932] usb 5-1: config 0 descriptor?? [ 379.232520][ T5904] em28xx 4-1:0.89: Remote control support is not available for this card. [ 379.243429][ T796] em28xx 4-1:0.89: Closing input extension [ 379.251262][ T5932] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 379.260279][ T796] em28xx 4-1:0.89: Deregistering snapshot button [ 379.275162][ T796] em28xx 4-1:0.89: Freeing device [ 379.471482][T10875] syzkaller0: entered promiscuous mode [ 379.477106][T10875] syzkaller0: entered allmulticast mode [ 379.836327][ T5932] usb 5-1: USB disconnect, device number 81 [ 380.116660][ T796] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 380.315551][T10901] tipc: Enabled bearer , priority 0 [ 380.327431][T10901] syzkaller0: entered promiscuous mode [ 380.332987][T10901] syzkaller0: entered allmulticast mode [ 380.362434][T10901] tipc: Resetting bearer [ 380.370528][ T796] usb 4-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 380.398995][ T796] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 380.407341][T10900] tipc: Resetting bearer [ 380.429842][ T796] usb 4-1: Product: syz [ 380.448354][ T796] usb 4-1: Manufacturer: syz [ 380.463265][ T796] usb 4-1: SerialNumber: syz [ 380.483881][ T796] usb 4-1: config 0 descriptor?? [ 380.504760][ T796] hub 4-1:0.0: bad descriptor, ignoring hub [ 380.511609][ T796] hub 4-1:0.0: probe with driver hub failed with error -5 [ 380.511714][T10900] tipc: Disabling bearer [ 380.709597][ T796] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 380.730188][T10910] rtc_cmos 00:00: Alarms can be up to one day in the future [ 380.741414][ T796] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 380.763672][ T796] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 380.823174][T10912] fuse: Bad value for 'group_id' [ 380.830459][ T796] usb 4-1: media controller created [ 380.861206][ T796] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 380.917595][ T796] DVB: Unable to find symbol dib7000p_attach() [ 380.934291][ T796] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 380.997323][T10912] fuse: Bad value for 'group_id' [ 381.024728][ T796] rc_core: IR keymap rc-dib0700-rc5 not found [ 381.044616][ T796] Registered IR keymap rc-empty [ 381.065783][ T796] dvb-usb: could not initialize remote control. [ 381.085935][ T796] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 381.346744][ T796] usb 5-1: new high-speed USB device number 82 using dummy_hcd [ 381.348748][T10929] QAT: failed to copy from user cfg_data. [ 381.498334][ T796] usb 5-1: Using ep0 maxpacket: 8 [ 381.525680][ T796] usb 5-1: unable to get BOS descriptor or descriptor too short [ 381.549773][ T796] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 381.598167][ T796] usb 5-1: can't read configurations, error -71 [ 381.850898][ T5932] usb 1-1: new high-speed USB device number 88 using dummy_hcd [ 382.016388][ T5932] usb 1-1: Using ep0 maxpacket: 8 [ 382.034229][ T5932] usb 1-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 382.076153][ T5932] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 382.129849][ T5932] usb 1-1: Product: syz [ 382.136599][ T5932] usb 1-1: Manufacturer: syz [ 382.150015][ T5932] usb 1-1: SerialNumber: syz [ 382.168061][ T5932] usb 1-1: config 0 descriptor?? [ 382.202331][ T5932] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 382.384641][T10944] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 382.412230][T10947] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 382.432958][T10947] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 382.656426][ T5820] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 382.702575][ T29] kauditd_printk_skb: 122 callbacks suppressed [ 382.702613][ T29] audit: type=1326 audit(1772100358.792:881): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10948 comm="syz.1.1479" exe="/root/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf70aef6c code=0x0 [ 382.836363][ T5820] usb 3-1: Using ep0 maxpacket: 8 [ 382.848757][ T5820] usb 3-1: config index 0 descriptor too short (expected 9, got 0) [ 382.866288][ T5820] usb 3-1: can't read configurations, error -22 [ 382.891183][T10933] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2142054965 (4284109930 ns) > initial count (2850433972 ns). Using initial count to start timer. [ 382.956734][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 383.006331][ T5820] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 383.156323][ T5820] usb 3-1: Using ep0 maxpacket: 8 [ 383.174168][ T5820] usb 3-1: config index 0 descriptor too short (expected 9, got 0) [ 383.197995][ T5820] usb 3-1: can't read configurations, error -22 [ 383.211116][ T5820] usb usb3-port1: attempt power cycle [ 383.226458][ T5888] usb 4-1: USB disconnect, device number 77 [ 383.318186][ T5888] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully deinitialized and disconnected. [ 383.402212][ T5932] gspca_sonixj: reg_w1 err -71 [ 383.456635][ T5932] sonixj 1-1:0.0: probe with driver sonixj failed with error -71 [ 383.495115][ T5932] usb 1-1: USB disconnect, device number 88 [ 383.586471][ T5820] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 383.647538][ T5820] usb 3-1: Using ep0 maxpacket: 8 [ 383.677637][ T5820] usb 3-1: config index 0 descriptor too short (expected 9, got 0) [ 383.710753][ T5820] usb 3-1: can't read configurations, error -22 [ 383.866741][T10965] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3480241289 (13920965156 ns) > initial count (268 ns). Using initial count to start timer. [ 383.898699][ T5820] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 383.937385][ T5820] usb 3-1: Using ep0 maxpacket: 8 [ 383.964342][ T5820] usb 3-1: config index 0 descriptor too short (expected 9, got 0) [ 383.985309][ T5820] usb 3-1: can't read configurations, error -22 [ 384.004152][ T5820] usb usb3-port1: unable to enumerate USB device [ 384.376509][T10975] tipc: Started in network mode [ 384.386000][T10975] tipc: Node identity 320c68e95cb4, cluster identity 4711 [ 384.404909][T10975] tipc: Enabled bearer , priority 0 [ 384.437248][T10977] syzkaller0: entered promiscuous mode [ 384.442755][T10977] syzkaller0: entered allmulticast mode [ 384.508567][T10975] tipc: Resetting bearer [ 384.540958][T10974] tipc: Resetting bearer [ 384.576329][ T5932] usb 1-1: new high-speed USB device number 89 using dummy_hcd [ 384.576647][T10974] tipc: Disabling bearer [ 384.747047][ T5932] usb 1-1: Using ep0 maxpacket: 8 [ 384.793110][T10981] tipc: Started in network mode [ 384.816353][T10981] tipc: Node identity 7a4c8ccfa77e, cluster identity 4711 [ 384.839221][T10981] tipc: Enabled bearer , priority 0 [ 384.855715][ T5932] usb 1-1: unable to get BOS descriptor or descriptor too short [ 384.871568][T10984] syzkaller0: entered promiscuous mode [ 384.886679][ T5932] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 384.899423][T10984] syzkaller0: entered allmulticast mode [ 384.906300][ T5932] usb 1-1: can't read configurations, error -71 [ 384.931966][T10981] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1488'. [ 384.974227][T10981] tipc: Resetting bearer [ 384.992246][T10980] tipc: Resetting bearer [ 385.016984][T10980] tipc: Disabling bearer [ 385.458301][ T797] usb 5-1: new high-speed USB device number 84 using dummy_hcd [ 385.500131][T11000] FAULT_INJECTION: forcing a failure. [ 385.500131][T11000] name failslab, interval 1, probability 0, space 0, times 0 [ 385.554429][T11000] CPU: 1 UID: 0 PID: 11000 Comm: syz.0.1494 Tainted: G L syzkaller #0 PREEMPT(full) [ 385.554459][T11000] Tainted: [L]=SOFTLOCKUP [ 385.554466][T11000] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 385.554481][T11000] Call Trace: [ 385.554488][T11000] [ 385.554497][T11000] dump_stack_lvl+0xe8/0x150 [ 385.554528][T11000] should_fail_ex+0x412/0x560 [ 385.554556][T11000] should_failslab+0xa8/0x100 [ 385.554579][T11000] ? prepare_creds+0x30/0x820 [ 385.554599][T11000] kmem_cache_alloc_noprof+0x87/0x650 [ 385.554633][T11000] prepare_creds+0x30/0x820 [ 385.554657][T11000] copy_creds+0x10e/0xa30 [ 385.554682][T11000] copy_process+0x904/0x3cf0 [ 385.554719][T11000] ? kstrtouint+0x6e/0xe0 [ 385.554752][T11000] ? get_pid_task+0x20/0x1f0 [ 385.554772][T11000] ? __pfx_copy_process+0x10/0x10 [ 385.554797][T11000] ? get_pid_task+0x20/0x1f0 [ 385.554822][T11000] kernel_clone+0x248/0x8e0 [ 385.554853][T11000] ? __pfx_kernel_clone+0x10/0x10 [ 385.554895][T11000] __ia32_compat_sys_ia32_clone+0x1b4/0x230 [ 385.554925][T11000] ? __pfx___ia32_compat_sys_ia32_clone+0x10/0x10 [ 385.554962][T11000] ? ksys_write+0x242/0x270 [ 385.554991][T11000] __do_fast_syscall_32+0x20d/0x640 [ 385.555012][T11000] ? do_fast_syscall_32+0x33/0x70 [ 385.555029][T11000] ? asm_int80_emulation+0x1a/0x20 [ 385.555047][T11000] ? do_int80_emulation+0x274/0x4d0 [ 385.555065][T11000] ? trace_irq_disable+0x3b/0x150 [ 385.555093][T11000] do_fast_syscall_32+0x33/0x70 [ 385.555112][T11000] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 385.555140][T11000] RIP: 0023:0xf7fc7f6c [ 385.555158][T11000] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 58 b8 77 00 00 00 cd 80 0f 0b 90 90 90 90 90 90 b8 ad [ 385.555175][T11000] RSP: 002b:00000000f54864bc EFLAGS: 00000206 ORIG_RAX: 0000000000000078 [ 385.555195][T11000] RAX: ffffffffffffffda RBX: 0000000000005400 RCX: 0000000000000000 [ 385.555209][T11000] RDX: 0000000080001d40 RSI: 0000000000000000 RDI: 0000000000000000 [ 385.555222][T11000] RBP: 00000000f7484f80 R08: 0000000000000000 R09: 0000000000000000 [ 385.555234][T11000] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 385.555245][T11000] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 385.555270][T11000] [ 386.130189][ T797] usb 5-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 386.191396][ T797] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 386.206549][ T797] usb 5-1: Product: syz [ 386.210754][ T797] usb 5-1: Manufacturer: syz [ 386.225353][ T797] usb 5-1: SerialNumber: syz [ 386.243312][ T797] usb 5-1: config 0 descriptor?? [ 386.256314][ T5932] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 386.270940][ T797] hub 5-1:0.0: bad descriptor, ignoring hub [ 386.332145][ T797] hub 5-1:0.0: probe with driver hub failed with error -5 [ 386.419121][ T5932] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 386.446519][ T5888] usb 2-1: new full-speed USB device number 86 using dummy_hcd [ 386.455316][ T5932] usb 3-1: config 0 interface 0 has no altsetting 0 [ 386.477676][T11018] netlink: 'syz.3.1501': attribute type 12 has an invalid length. [ 386.492999][ T5932] usb 3-1: New USB device found, idVendor=10fd, idProduct=1513, bcdDevice=7e.ce [ 386.516000][ T797] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 386.543014][ T5932] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 386.572642][ T797] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 386.586487][ T5932] usb 3-1: Product: syz [ 386.607207][ T5932] usb 3-1: Manufacturer: syz [ 386.611815][ T5932] usb 3-1: SerialNumber: syz [ 386.616730][ T797] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 386.661633][ T797] usb 5-1: media controller created [ 386.679354][ T5888] usb 2-1: config 0 interface 0 altsetting 13 endpoint 0x81 has invalid wMaxPacketSize 0 [ 386.698153][ T5932] usb 3-1: config 0 descriptor?? [ 386.714604][ T5888] usb 2-1: config 0 interface 0 has no altsetting 0 [ 386.734801][ T797] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 386.748735][ T5888] usb 2-1: New USB device found, idVendor=046d, idProduct=c534, bcdDevice= 0.00 [ 386.773682][ T5932] dvb-usb: found a 'MSI DIGI VOX mini II DVB-T USB2.0' in warm state. [ 386.782762][ T5888] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 386.808128][ T5932] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 386.840749][ T5888] usb 2-1: config 0 descriptor?? [ 386.862888][ T5932] dvbdev: DVB: registering new adapter (MSI DIGI VOX mini II DVB-T USB2.0) [ 386.919001][ T5932] usb 3-1: media controller created [ 386.987790][ T5932] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 386.988905][ T797] DVB: Unable to find symbol dib7000p_attach() [ 387.080797][ T797] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 387.163881][ T5932] DVB: Unable to find symbol tda10046_attach() [ 387.190283][ T5932] dvb-usb: no frontend was attached by 'MSI DIGI VOX mini II DVB-T USB2.0' [ 387.226030][ T5932] dvb-usb: MSI DIGI VOX mini II DVB-T USB2.0 successfully initialized and connected. [ 387.266912][ T797] rc_core: IR keymap rc-dib0700-rc5 not found [ 387.294837][ T5888] hid_parser_main: 10 callbacks suppressed [ 387.294860][ T5888] logitech-djreceiver 0003:046D:C534.0026: unknown main item tag 0x0 [ 387.309252][ T797] Registered IR keymap rc-empty [ 387.320345][ T797] dvb-usb: could not initialize remote control. [ 387.337452][ T797] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 387.353350][ T5888] logitech-djreceiver 0003:046D:C534.0026: unknown main item tag 0x0 [ 387.393042][ T5888] logitech-djreceiver 0003:046D:C534.0026: unknown main item tag 0x0 [ 387.416370][ T5888] logitech-djreceiver 0003:046D:C534.0026: unknown main item tag 0x0 [ 387.431172][T11007] delete_channel: no stack [ 387.474801][ T5888] logitech-djreceiver 0003:046D:C534.0026: unknown main item tag 0x0 [ 387.687874][ T796] usb 2-1: USB disconnect, device number 86 [ 387.725557][T11027] FAULT_INJECTION: forcing a failure. [ 387.725557][T11027] name failslab, interval 1, probability 0, space 0, times 0 [ 387.754183][T11006] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 387.763443][T11027] CPU: 0 UID: 0 PID: 11027 Comm: syz.3.1502 Tainted: G L syzkaller #0 PREEMPT(full) [ 387.763473][T11027] Tainted: [L]=SOFTLOCKUP [ 387.763480][T11027] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 387.763490][T11027] Call Trace: [ 387.763498][T11027] [ 387.763505][T11027] dump_stack_lvl+0xe8/0x150 [ 387.763536][T11027] should_fail_ex+0x412/0x560 [ 387.763560][T11027] should_failslab+0xa8/0x100 [ 387.763583][T11027] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 387.763612][T11027] ? __alloc_skb+0x186/0x7d0 [ 387.763632][T11027] ? __alloc_skb+0x1d0/0x7d0 [ 387.763650][T11027] ? __local_bh_enable_ip+0xd0/0x130 [ 387.763675][T11027] __alloc_skb+0x1d0/0x7d0 [ 387.763700][T11027] alloc_skb_with_frags+0xca/0x890 [ 387.763727][T11027] ? __fget_files+0x2a/0x420 [ 387.763755][T11027] sock_alloc_send_pskb+0x878/0x990 [ 387.763795][T11027] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 387.763824][T11027] ? __pfx___scm_send+0x10/0x10 [ 387.763843][T11027] ? tomoyo_check_unix_address+0x60f/0x7f0 [ 387.763867][T11027] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 387.763889][T11027] unix_dgram_sendmsg+0x460/0x18e0 [ 387.763911][T11027] ? __pfx_tomoyo_check_unix_address+0x10/0x10 [ 387.763942][T11027] ? cmsghdr_from_user_compat_to_kern+0x707/0x810 [ 387.763971][T11027] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 387.763991][T11027] ? tomoyo_socket_sendmsg_permission+0x1d9/0x300 [ 387.764022][T11027] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 387.764040][T11027] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 387.764060][T11027] ____sys_sendmsg+0xa68/0xad0 [ 387.764093][T11027] ? __pfx_____sys_sendmsg+0x10/0x10 [ 387.764129][T11027] ___sys_sendmsg+0x2a5/0x360 [ 387.764158][T11027] ? __pfx____sys_sendmsg+0x10/0x10 [ 387.764185][T11027] ? kstrtoull+0x12f/0x1d0 [ 387.764228][T11027] ? __fget_files+0x2a/0x420 [ 387.764251][T11027] ? __fget_files+0x3a0/0x420 [ 387.764282][T11027] __sys_sendmmsg+0x2e7/0x4e0 [ 387.764313][T11027] ? __pfx___sys_sendmmsg+0x10/0x10 [ 387.764363][T11027] ? fput+0xa0/0xd0 [ 387.764387][T11027] ? ksys_write+0x242/0x270 [ 387.764419][T11027] __ia32_compat_sys_sendmmsg+0xa2/0xc0 [ 387.764446][T11027] __do_fast_syscall_32+0x20d/0x640 [ 387.764467][T11027] ? do_fast_syscall_32+0x33/0x70 [ 387.764483][T11027] ? asm_int80_emulation+0x1a/0x20 [ 387.764500][T11027] ? do_int80_emulation+0x274/0x4d0 [ 387.764521][T11027] do_fast_syscall_32+0x33/0x70 [ 387.764539][T11027] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 387.764561][T11027] RIP: 0023:0xf705ef6c [ 387.764578][T11027] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 58 b8 77 00 00 00 cd 80 0f 0b 90 90 90 90 90 90 b8 ad [ 387.764594][T11027] RSP: 002b:00000000f544d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000159 [ 387.764614][T11027] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080006800 [ 387.764627][T11027] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 387.764638][T11027] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 387.764649][T11027] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 387.764660][T11027] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 387.764687][T11027] [ 387.766145][T11006] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 388.160601][T11029] tipc: Enabled bearer , priority 0 [ 388.169562][T11029] syzkaller0: entered promiscuous mode [ 388.175057][T11029] syzkaller0: entered allmulticast mode [ 388.187622][T11029] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1503'. [ 388.253928][T11029] tipc: Resetting bearer [ 388.262310][T11028] tipc: Resetting bearer [ 388.276466][T11028] tipc: Disabling bearer [ 388.446574][ T5888] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 388.549585][ T5932] dvb_usb_m920x 3-1:0.0: probe with driver dvb_usb_m920x failed with error -71 [ 388.563230][ T5932] usb 3-1: USB disconnect, device number 88 [ 388.596727][ T5888] usb 4-1: Using ep0 maxpacket: 8 [ 388.606950][ T797] usb 1-1: new high-speed USB device number 91 using dummy_hcd [ 388.646998][ T5888] usb 4-1: unable to get BOS descriptor or descriptor too short [ 388.656459][ T5820] usb 2-1: new high-speed USB device number 87 using dummy_hcd [ 388.681680][ T5888] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 388.690725][ T5888] usb 4-1: can't read configurations, error -71 [ 388.705863][ T796] usb 5-1: USB disconnect, device number 84 [ 388.772264][ T797] usb 1-1: New USB device found, idVendor=04d8, idProduct=f372, bcdDevice= 0.00 [ 388.778060][ T796] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully deinitialized and disconnected. [ 388.784599][ T797] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 388.817228][ T797] usb 1-1: config 0 descriptor?? [ 388.829701][ T5820] usb 2-1: device descriptor read/64, error -71 [ 389.048293][T11036] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 389.057106][T11036] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 389.087403][ T5820] usb 2-1: new high-speed USB device number 88 using dummy_hcd [ 389.106406][ T796] usb 5-1: new full-speed USB device number 85 using dummy_hcd [ 389.222186][ T29] audit: type=1326 audit(1772100365.312:882): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11044 comm="syz.3.1509" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705ef6c code=0x7ffc0000 [ 389.223897][ T5820] usb 2-1: device descriptor read/64, error -71 [ 389.256135][ T29] audit: type=1326 audit(1772100365.342:883): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11044 comm="syz.3.1509" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705ef6c code=0x7ffc0000 [ 389.280088][ T29] audit: type=1326 audit(1772100365.352:884): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11044 comm="syz.3.1509" exe="/root/syz-executor" sig=0 arch=40000003 syscall=224 compat=1 ip=0xf705ef6c code=0x7ffc0000 [ 389.280278][ T796] usb 5-1: config 0 interface 0 altsetting 13 endpoint 0x81 has invalid wMaxPacketSize 0 [ 389.302739][ T29] audit: type=1326 audit(1772100365.352:885): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11044 comm="syz.3.1509" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705ef6c code=0x7ffc0000 [ 389.314497][ T796] usb 5-1: config 0 interface 0 has no altsetting 0 [ 389.338707][ T29] audit: type=1326 audit(1772100365.352:886): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11044 comm="syz.3.1509" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705ef6c code=0x7ffc0000 [ 389.363129][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 389.374140][ T796] usb 5-1: New USB device found, idVendor=046d, idProduct=c534, bcdDevice= 0.00 [ 389.374234][ T5820] usb usb2-port1: attempt power cycle [ 389.408667][ T29] audit: type=1326 audit(1772100365.352:887): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11044 comm="syz.3.1509" exe="/root/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf705ef6c code=0x7ffc0000 [ 389.430876][ T796] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 389.441170][ T796] usb 5-1: config 0 descriptor?? [ 389.443392][ T29] audit: type=1326 audit(1772100365.352:888): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11044 comm="syz.3.1509" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705ef6c code=0x7ffc0000 [ 389.468226][ T29] audit: type=1326 audit(1772100365.352:889): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11044 comm="syz.3.1509" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705ef6c code=0x7ffc0000 [ 389.492931][ T29] audit: type=1326 audit(1772100365.352:890): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11044 comm="syz.3.1509" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf705ef6c code=0x7ffc0000 [ 389.515053][ T29] audit: type=1326 audit(1772100365.352:891): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11044 comm="syz.3.1509" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705ef6c code=0x7ffc0000 [ 389.569546][ T797] usbhid 1-1:0.0: can't add hid device: -71 [ 389.575580][ T797] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 389.588442][ T797] usb 1-1: USB disconnect, device number 91 [ 389.659686][T11050] FAULT_INJECTION: forcing a failure. [ 389.659686][T11050] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 389.672801][T11050] CPU: 1 UID: 0 PID: 11050 Comm: syz.3.1511 Tainted: G L syzkaller #0 PREEMPT(full) [ 389.672830][T11050] Tainted: [L]=SOFTLOCKUP [ 389.672837][T11050] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 389.672848][T11050] Call Trace: [ 389.672857][T11050] [ 389.672865][T11050] dump_stack_lvl+0xe8/0x150 [ 389.672892][T11050] should_fail_ex+0x412/0x560 [ 389.672918][T11050] _copy_to_user+0x31/0xb0 [ 389.672947][T11050] simple_read_from_buffer+0xe1/0x170 [ 389.672974][T11050] proc_fail_nth_read+0x1bb/0x230 [ 389.672990][T11050] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 389.673005][T11050] ? rw_verify_area+0x2a6/0x4d0 [ 389.673019][T11050] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 389.673034][T11050] vfs_read+0x20c/0xa70 [ 389.673050][T11050] ? fdget_pos+0x246/0x320 [ 389.673079][T11050] ? __pfx___mutex_lock+0x10/0x10 [ 389.673099][T11050] ? __pfx_vfs_read+0x10/0x10 [ 389.673118][T11050] ? __fget_files+0x2a/0x420 [ 389.673135][T11050] ? __fget_files+0x3a0/0x420 [ 389.673147][T11050] ? __fget_files+0x2a/0x420 [ 389.673164][T11050] ksys_read+0x150/0x270 [ 389.673175][T11050] ? __pfx_ksys_read+0x10/0x10 [ 389.673193][T11050] ? asm_int80_emulation+0x1a/0x20 [ 389.673217][T11050] do_int80_emulation+0x173/0x4d0 [ 389.673234][T11050] ? trace_irq_disable+0x3b/0x150 [ 389.673265][T11050] ? asm_int80_emulation+0x1a/0x20 [ 389.673276][T11050] ? clear_bhb_loop+0x40/0x90 [ 389.673286][T11050] ? clear_bhb_loop+0x40/0x90 [ 389.673297][T11050] asm_int80_emulation+0x1a/0x20 [ 389.673307][T11050] RIP: 0023:0xf7195b6b [ 389.673317][T11050] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 389.673326][T11050] RSP: 002b:00000000f544d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 389.673344][T11050] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000f544d5d0 [ 389.673357][T11050] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 389.673368][T11050] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 389.673378][T11050] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 389.673389][T11050] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 389.673416][T11050] [ 389.901145][ T5820] usb 2-1: new high-speed USB device number 89 using dummy_hcd [ 389.927106][ T5820] usb 2-1: device descriptor read/8, error -71 [ 390.120530][ T796] logitech-djreceiver 0003:046D:C534.0027: unknown main item tag 0x0 [ 390.132442][ T796] logitech-djreceiver 0003:046D:C534.0027: unknown main item tag 0x0 [ 390.143660][ T796] logitech-djreceiver 0003:046D:C534.0027: unknown main item tag 0x0 [ 390.154754][ T796] logitech-djreceiver 0003:046D:C534.0027: unknown main item tag 0x0 [ 390.167223][ T5820] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 390.175123][ T796] logitech-djreceiver 0003:046D:C534.0027: unknown main item tag 0x0 [ 390.226677][ T5820] usb 2-1: device descriptor read/8, error -71 [ 390.239858][ T797] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 390.376748][ T5820] usb usb2-port1: unable to enumerate USB device [ 390.416867][ T797] usb 4-1: Using ep0 maxpacket: 8 [ 390.435883][ T797] usb 4-1: New USB device found, idVendor=fda1, idProduct=2103, bcdDevice=66.7e [ 390.461779][ T797] usb 4-1: New USB device strings: Mfr=238, Product=78, SerialNumber=3 [ 390.485659][ T797] usb 4-1: Product: syz [ 390.499369][ T797] usb 4-1: Manufacturer: syz [ 390.508206][ T797] usb 4-1: SerialNumber: syz [ 390.547378][ T797] usb 4-1: config 0 descriptor?? [ 390.747888][ T796] usb 5-1: USB disconnect, device number 85 [ 390.906974][T11070] IPVS: length: 218 != 24 [ 390.954188][T11070] syz_tun: entered allmulticast mode [ 390.983315][T11052] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1513'. [ 391.006360][T11069] syz_tun: left allmulticast mode [ 391.276823][ T796] usb 5-1: new high-speed USB device number 86 using dummy_hcd [ 391.383345][T11083] netlink: 179596 bytes leftover after parsing attributes in process `syz.2.1521'. [ 391.446996][ T796] usb 5-1: Using ep0 maxpacket: 8 [ 391.488858][ T796] usb 5-1: unable to get BOS descriptor or descriptor too short [ 391.508552][ T796] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 391.524157][ T796] usb 5-1: can't read configurations, error -71 [ 391.616420][ T5820] usb 1-1: new high-speed USB device number 92 using dummy_hcd [ 391.746316][ T5820] usb 1-1: device descriptor read/64, error -71 [ 391.987164][ T5820] usb 1-1: new high-speed USB device number 93 using dummy_hcd [ 392.127304][ T5820] usb 1-1: device descriptor read/64, error -71 [ 392.268206][ T5820] usb usb1-port1: attempt power cycle [ 392.446456][ T5932] usb 3-1: new high-speed USB device number 89 using dummy_hcd [ 392.596307][ T5932] usb 3-1: Using ep0 maxpacket: 32 [ 392.603211][ T5932] usb 3-1: config 0 has an invalid interface number: 89 but max is 0 [ 392.606341][ T5820] usb 1-1: new high-speed USB device number 94 using dummy_hcd [ 392.619295][ T5932] usb 3-1: config 0 has no interface number 0 [ 392.625594][ T5932] usb 3-1: config 0 interface 89 has no altsetting 0 [ 392.634674][ T5932] usb 3-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 392.637320][ T5820] usb 1-1: device descriptor read/8, error -71 [ 392.644268][ T5932] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 392.658727][ T5932] usb 3-1: Product: syz [ 392.662922][ T5932] usb 3-1: Manufacturer: syz [ 392.667593][ T5932] usb 3-1: SerialNumber: syz [ 392.675644][ T5932] usb 3-1: config 0 descriptor?? [ 392.687029][ T5932] em28xx 3-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 392.696920][ T5932] em28xx 3-1:0.89: Video interface 89 found: bulk [ 392.897727][ T5820] usb 1-1: new high-speed USB device number 95 using dummy_hcd [ 392.934409][ T5820] usb 1-1: device descriptor read/8, error -71 [ 393.008661][ T797] usb 4-1: USB disconnect, device number 80 [ 393.073609][ T5820] usb usb1-port1: unable to enumerate USB device [ 393.290061][ T5932] em28xx 3-1:0.89: unknown em28xx chip ID (0) [ 393.426378][ T5820] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 393.586310][ T5820] usb 5-1: Using ep0 maxpacket: 8 [ 393.593286][ T5820] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xEE, changing to 0x8E [ 393.605107][ T5820] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 393.614921][ T5820] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 393.626932][ T5820] usb 5-1: New USB device found, idVendor=187f, idProduct=0200, bcdDevice=6b.ad [ 393.636101][ T5820] usb 5-1: New USB device strings: Mfr=55, Product=237, SerialNumber=3 [ 393.644401][ T5820] usb 5-1: Product: syz [ 393.648680][ T5820] usb 5-1: Manufacturer: syz [ 393.653287][ T5820] usb 5-1: SerialNumber: syz [ 393.661217][ T5820] usb 5-1: config 0 descriptor?? [ 393.669325][ T5820] smsusb:smsusb_probe: board id=2, interface number 0 [ 393.676891][ T5820] smsusb:smsusb_probe: Device initialized with return code -19 [ 393.873365][ T796] usb 5-1: USB disconnect, device number 88 [ 393.915452][ T5932] em28xx 3-1:0.89: failed to get i2c transfer status from bridge register (error=-5) [ 393.928890][ T5932] em28xx 3-1:0.89: board has no eeprom [ 393.988981][ T5932] em28xx 3-1:0.89: Identified as Terratec Grabby (card=67) [ 393.996513][ T5932] em28xx 3-1:0.89: analog set to bulk mode. [ 394.002618][ T5935] em28xx 3-1:0.89: Registering V4L2 extension [ 394.028264][ T5932] usb 3-1: USB disconnect, device number 89 [ 394.047127][ T5932] em28xx 3-1:0.89: Disconnecting em28xx [ 394.073837][ T5935] em28xx 3-1:0.89: Config register raw data: 0xffffffed [ 394.082450][ T5935] em28xx 3-1:0.89: AC97 chip type couldn't be determined [ 394.090308][ T5935] em28xx 3-1:0.89: No AC97 audio processor [ 394.097596][ T5935] usb 3-1: Decoder not found [ 394.102198][ T5935] em28xx 3-1:0.89: failed to create media graph [ 394.108751][ T5935] em28xx 3-1:0.89: V4L2 device video103 deregistered [ 394.118120][ T5935] em28xx 3-1:0.89: Registering snapshot button... [ 394.125733][ T5935] input: em28xx snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.89/input/input154 [ 394.146405][ T5935] em28xx 3-1:0.89: Remote control support is not available for this card. [ 394.166420][ T5932] em28xx 3-1:0.89: Closing input extension [ 394.172252][ T5932] em28xx 3-1:0.89: Deregistering snapshot button [ 394.203490][ T5932] em28xx 3-1:0.89: Freeing device [ 394.546446][ T5820] usb 4-1: new high-speed USB device number 81 using dummy_hcd [ 394.578093][T11140] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1537'. [ 394.704464][T11140] 8021q: adding VLAN 0 to HW filter on device bond8 [ 394.731983][T11144] bond0: (slave syz_tun): Releasing backup interface [ 394.760125][T11144] bond8: (slave syz_tun): Enslaving as an active interface with an up link [ 394.786446][ T5820] usb 4-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 394.797311][ T797] usb 5-1: new high-speed USB device number 89 using dummy_hcd [ 394.813796][T11146] bond8 (unregistering): (slave syz_tun): Releasing backup interface [ 394.826579][ T5820] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 394.837196][T11146] bond8 (unregistering): Released all slaves [ 394.845107][ T5820] usb 4-1: Product: syz [ 394.851795][ T5820] usb 4-1: Manufacturer: syz [ 394.867852][ T5820] usb 4-1: SerialNumber: syz [ 394.889113][ T5820] usb 4-1: config 0 descriptor?? [ 394.911250][ T5820] hub 4-1:0.0: bad descriptor, ignoring hub [ 394.921801][ T5820] hub 4-1:0.0: probe with driver hub failed with error -5 [ 394.976406][ T797] usb 5-1: Using ep0 maxpacket: 8 [ 395.054755][ T797] usb 5-1: unable to get BOS descriptor or descriptor too short [ 395.070969][ T797] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 395.086385][ T797] usb 5-1: can't read configurations, error -71 [ 395.201810][ T5820] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 395.228782][ T5820] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 395.244111][ T5820] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 395.253609][ T5820] usb 4-1: media controller created [ 395.285409][ T5820] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 395.411610][ T5820] DVB: Unable to find symbol dib7000p_attach() [ 395.433568][ T5820] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 395.496335][ T5888] usb 1-1: new full-speed USB device number 96 using dummy_hcd [ 395.588986][ T5820] rc_core: IR keymap rc-dib0700-rc5 not found [ 395.626414][ T5820] Registered IR keymap rc-empty [ 395.647740][ T5820] dvb-usb: could not initialize remote control. [ 395.675588][ T5820] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 395.703840][ T5888] usb 1-1: config index 0 descriptor too short (expected 539, got 27) [ 395.740026][ T5888] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 10 [ 395.806072][ T5888] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 395.902458][ T5888] usb 1-1: New USB device found, idVendor=14c8, idProduct=0003, bcdDevice= 5.6c [ 395.942527][ T5888] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 395.971133][ T5888] usb 1-1: Product: syz [ 395.987717][ T5888] usb 1-1: Manufacturer: syz [ 396.006691][ T5888] usb 1-1: SerialNumber: syz [ 396.065299][ T5888] usb 1-1: config 0 descriptor?? [ 396.104956][ T5888] hub 1-1:0.0: bad descriptor, ignoring hub [ 396.148853][ T5888] hub 1-1:0.0: probe with driver hub failed with error -5 [ 396.185892][ T5888] input: syz syz as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input156 [ 396.196386][ T796] usb 3-1: new high-speed USB device number 90 using dummy_hcd [ 396.242264][ T5888] usbtouchscreen 1-1:0.0: usbtouch_probe - usb_submit_urb failed with result: -90 [ 396.289010][ T5888] usbtouchscreen 1-1:0.0: probe with driver usbtouchscreen failed with error -90 [ 396.371540][ T796] usb 3-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 396.428333][ T796] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 396.465875][ T796] usb 3-1: Product: syz [ 396.492097][T11153] delete_channel: no stack [ 396.497491][ T796] usb 3-1: Manufacturer: syz [ 396.515495][ T796] usb 3-1: SerialNumber: syz [ 396.533589][ T5932] usb 1-1: USB disconnect, device number 96 [ 396.547397][ T796] usb 3-1: config 0 descriptor?? [ 396.863362][T11164] delete_channel: no stack [ 397.576869][ T796] usb 3-1: non-Atmel transceiver xxxx0447 [ 397.618315][ T5935] usb 4-1: USB disconnect, device number 81 [ 397.643947][ T5935] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully deinitialized and disconnected. [ 397.696644][ T5932] usb 5-1: new high-speed USB device number 91 using dummy_hcd [ 397.781503][ T796] usb 3-1: Firmware version (0.0) predates our first public release. [ 397.797676][ T796] usb 3-1: Please update to version 0.2 or newer [ 397.821552][ T796] usb 3-1: atusb_probe: initialization failed, error = -19 [ 397.860438][ T796] usb 3-1: USB disconnect, device number 90 [ 397.870825][ T5932] usb 5-1: Using ep0 maxpacket: 32 [ 397.880503][ T5932] usb 5-1: config 0 has an invalid interface number: 89 but max is 0 [ 397.901347][ T5932] usb 5-1: config 0 has no interface number 0 [ 397.909039][ T5932] usb 5-1: config 0 interface 89 has no altsetting 0 [ 397.920522][ T5932] usb 5-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 397.930672][ T5932] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 397.939799][ T5932] usb 5-1: Product: syz [ 397.944060][ T5932] usb 5-1: Manufacturer: syz [ 397.948791][ T5932] usb 5-1: SerialNumber: syz [ 397.955194][ T5932] usb 5-1: config 0 descriptor?? [ 397.963942][ T5932] em28xx 5-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 397.974110][ T5932] em28xx 5-1:0.89: Video interface 89 found: bulk [ 398.159682][T11199] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1551'. [ 398.168926][T11199] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1551'. [ 398.575692][ T5932] em28xx 5-1:0.89: unknown em28xx chip ID (0) [ 398.756358][ T796] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 398.871093][T11213] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1555'. [ 398.906464][T11213] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1555'. [ 398.910682][T11216] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1556'. [ 398.966388][ T796] usb 3-1: Using ep0 maxpacket: 8 [ 398.978149][T11218] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1556'. [ 399.029586][T11216] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1556'. [ 399.064244][ T796] usb 3-1: unable to get BOS descriptor or descriptor too short [ 399.081441][T11216] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1556'. [ 399.099961][ T796] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 399.117294][T11216] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1556'. [ 399.126427][ T796] usb 3-1: can't read configurations, error -71 [ 399.140669][T11216] FAULT_INJECTION: forcing a failure. [ 399.140669][T11216] name failslab, interval 1, probability 0, space 0, times 0 [ 399.183680][T11216] CPU: 0 UID: 0 PID: 11216 Comm: syz.0.1556 Tainted: G L syzkaller #0 PREEMPT(full) [ 399.183702][T11216] Tainted: [L]=SOFTLOCKUP [ 399.183706][T11216] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 399.183712][T11216] Call Trace: [ 399.183717][T11216] [ 399.183722][T11216] dump_stack_lvl+0xe8/0x150 [ 399.183744][T11216] should_fail_ex+0x412/0x560 [ 399.183760][T11216] should_failslab+0xa8/0x100 [ 399.183774][T11216] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 399.183792][T11216] ? __alloc_skb+0x1d0/0x7d0 [ 399.183804][T11216] ? __local_bh_enable_ip+0xd0/0x130 [ 399.183819][T11216] __alloc_skb+0x1d0/0x7d0 [ 399.183834][T11216] xfrm_send_policy_notify+0x297/0x1bf0 [ 399.183846][T11216] ? irqentry_exit+0x59e/0x620 [ 399.183861][T11216] ? lockdep_hardirqs_on+0x7a/0x110 [ 399.183875][T11216] ? irqentry_exit+0x59e/0x620 [ 399.183889][T11216] ? __pfx_xfrm_send_policy_notify+0x10/0x10 [ 399.183903][T11216] ? km_policy_notify+0x28/0x200 [ 399.183914][T11216] ? km_policy_notify+0x6c/0x200 [ 399.183925][T11216] ? __pfx_xfrm_send_policy_notify+0x10/0x10 [ 399.183935][T11216] km_policy_notify+0x121/0x200 [ 399.183951][T11216] ? km_policy_notify+0x28/0x200 [ 399.183970][T11216] xfrm_add_policy+0x4ef/0x820 [ 399.183994][T11216] ? __pfx_xfrm_add_policy+0x10/0x10 [ 399.184018][T11216] ? __nla_parse+0x40/0x60 [ 399.184043][T11216] xfrm_user_rcv_msg+0x746/0xb20 [ 399.184058][T11216] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 399.184085][T11216] ? __pfx___mutex_trylock_common+0x10/0x10 [ 399.184110][T11216] ? rcu_is_watching+0x15/0xb0 [ 399.184135][T11216] ? trace_contention_end+0x3d/0x150 [ 399.184170][T11216] ? __mutex_lock+0x319/0x1300 [ 399.184194][T11216] netlink_rcv_skb+0x232/0x4b0 [ 399.184217][T11216] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 399.184235][T11216] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 399.184254][T11216] ? netlink_deliver_tap+0x2e/0x1b0 [ 399.184266][T11216] ? netlink_deliver_tap+0x2e/0x1b0 [ 399.184278][T11216] xfrm_netlink_rcv+0x79/0x90 [ 399.184289][T11216] netlink_unicast+0x80f/0x9b0 [ 399.184304][T11216] ? __pfx_netlink_unicast+0x10/0x10 [ 399.184316][T11216] ? netlink_sendmsg+0x650/0xb40 [ 399.184326][T11216] ? skb_put+0x11b/0x210 [ 399.184341][T11216] netlink_sendmsg+0x813/0xb40 [ 399.184357][T11216] ? __pfx_netlink_sendmsg+0x10/0x10 [ 399.184371][T11216] ? aa_sock_msg_perm+0xf1/0x1b0 [ 399.184384][T11216] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 399.184398][T11216] ? __pfx_netlink_sendmsg+0x10/0x10 [ 399.184410][T11216] ____sys_sendmsg+0xa68/0xad0 [ 399.184429][T11216] ? __pfx_____sys_sendmsg+0x10/0x10 [ 399.184445][T11216] ? kstrtoull+0x12f/0x1d0 [ 399.184460][T11216] ___sys_sendmsg+0x2a5/0x360 [ 399.184477][T11216] ? __pfx____sys_sendmsg+0x10/0x10 [ 399.184492][T11216] ? get_pid_task+0x20/0x1f0 [ 399.184501][T11216] ? get_pid_task+0x20/0x1f0 [ 399.184509][T11216] ? get_pid_task+0x20/0x1f0 [ 399.184532][T11216] ? __fget_files+0x2a/0x420 [ 399.184545][T11216] ? __fget_files+0x3a0/0x420 [ 399.184563][T11216] __sys_sendmsg+0x183/0x260 [ 399.184578][T11216] ? __pfx___sys_sendmsg+0x10/0x10 [ 399.184603][T11216] __do_fast_syscall_32+0x20d/0x640 [ 399.184614][T11216] ? do_fast_syscall_32+0x33/0x70 [ 399.184622][T11216] ? asm_int80_emulation+0x1a/0x20 [ 399.184632][T11216] ? do_int80_emulation+0x274/0x4d0 [ 399.184640][T11216] ? trace_irq_disable+0x3b/0x150 [ 399.184657][T11216] do_fast_syscall_32+0x33/0x70 [ 399.184666][T11216] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 399.184678][T11216] RIP: 0023:0xf7fc7f6c [ 399.184689][T11216] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 58 b8 77 00 00 00 cd 80 0f 0b 90 90 90 90 90 90 b8 ad [ 399.184698][T11216] RSP: 002b:00000000f548650c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 399.184709][T11216] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000440 [ 399.184716][T11216] RDX: 0000000000004000 RSI: 0000000000000000 RDI: 0000000000000000 [ 399.184722][T11216] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 399.184728][T11216] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 399.184734][T11216] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 399.184748][T11216] [ 400.041815][ T5932] em28xx 5-1:0.89: failed to get i2c transfer status from bridge register (error=-5) [ 400.051633][ T5932] em28xx 5-1:0.89: board has no eeprom [ 400.146870][ T5932] em28xx 5-1:0.89: Identified as Terratec Grabby (card=67) [ 400.178432][ T5932] em28xx 5-1:0.89: analog set to bulk mode. [ 400.184423][ T5935] em28xx 5-1:0.89: Registering V4L2 extension [ 400.214336][T11225] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1560'. [ 400.245583][ T5932] usb 5-1: USB disconnect, device number 91 [ 400.281262][ T5932] em28xx 5-1:0.89: Disconnecting em28xx [ 400.326626][ T5935] em28xx 5-1:0.89: Config register raw data: 0xffffffed [ 400.337696][ T5820] usb 1-1: new full-speed USB device number 97 using dummy_hcd [ 400.355560][ T5935] em28xx 5-1:0.89: AC97 chip type couldn't be determined [ 400.377630][ T5935] em28xx 5-1:0.89: No AC97 audio processor [ 400.443080][ T5935] usb 5-1: Decoder not found [ 400.457943][ T5935] em28xx 5-1:0.89: failed to create media graph [ 400.476736][ T5935] em28xx 5-1:0.89: V4L2 device video103 deregistered [ 400.504227][ T5935] em28xx 5-1:0.89: Registering snapshot button... [ 400.507114][ T29] kauditd_printk_skb: 11 callbacks suppressed [ 400.507131][ T29] audit: type=1326 audit(1772100376.582:903): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11227 comm="syz.1.1559" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aef6c code=0x7ffc0000 [ 400.528760][ T5935] input: em28xx snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.89/input/input157 [ 400.553709][ T29] audit: type=1326 audit(1772100376.582:904): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11227 comm="syz.1.1559" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aef6c code=0x7ffc0000 [ 400.576560][ T5820] usb 1-1: config 0 interface 0 altsetting 13 endpoint 0x81 has invalid wMaxPacketSize 0 [ 400.590513][ T5820] usb 1-1: config 0 interface 0 has no altsetting 0 [ 400.608339][ T5820] usb 1-1: New USB device found, idVendor=046d, idProduct=c534, bcdDevice= 0.00 [ 400.634289][ T5820] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 400.686828][ T5935] em28xx 5-1:0.89: Remote control support is not available for this card. [ 400.698351][ T5932] em28xx 5-1:0.89: Closing input extension [ 400.699233][ T5820] usb 1-1: config 0 descriptor?? [ 400.716333][ T5932] em28xx 5-1:0.89: Deregistering snapshot button [ 400.728528][ T29] audit: type=1326 audit(1772100376.592:905): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11227 comm="syz.1.1559" exe="/root/syz-executor" sig=0 arch=40000003 syscall=170 compat=1 ip=0xf70aef6c code=0x7ffc0000 [ 400.789330][ T5932] em28xx 5-1:0.89: Freeing device [ 400.832915][ T29] audit: type=1326 audit(1772100376.592:906): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11227 comm="syz.1.1559" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aef6c code=0x7ffc0000 [ 400.970011][ T29] audit: type=1326 audit(1772100376.592:907): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11227 comm="syz.1.1559" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aef6c code=0x7ffc0000 [ 401.026353][ T796] usb 3-1: new high-speed USB device number 92 using dummy_hcd [ 401.046338][ T29] audit: type=1326 audit(1772100376.692:908): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11227 comm="syz.1.1559" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf70aef6c code=0x7ffc0000 [ 401.161356][ T29] audit: type=1326 audit(1772100376.692:909): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11227 comm="syz.1.1559" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aef6c code=0x7ffc0000 [ 401.219283][ T5820] logitech-djreceiver 0003:046D:C534.0028: unknown main item tag 0x0 [ 401.234226][ T29] audit: type=1326 audit(1772100376.692:910): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11227 comm="syz.1.1559" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aef6c code=0x7ffc0000 [ 401.236341][ T796] usb 3-1: Using ep0 maxpacket: 16 [ 401.258847][ T5820] logitech-djreceiver 0003:046D:C534.0028: unknown main item tag 0x0 [ 401.263722][ T796] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 401.269846][ T5820] logitech-djreceiver 0003:046D:C534.0028: unknown main item tag 0x0 [ 401.283004][ T796] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 401.305415][ T5820] logitech-djreceiver 0003:046D:C534.0028: unknown main item tag 0x0 [ 401.305811][ T796] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 401.322918][ T5820] logitech-djreceiver 0003:046D:C534.0028: unknown main item tag 0x0 [ 401.323528][ T796] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 401.340156][ T796] usb 3-1: Product: syz [ 401.346104][ T796] usb 3-1: Manufacturer: syz [ 401.355083][ T796] usb 3-1: SerialNumber: syz [ 401.364137][ T796] usb 3-1: config 0 descriptor?? [ 401.372845][ T796] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 401.382210][ T796] em28xx 3-1:0.0: Audio interface 0 found (Vendor Class) [ 401.396355][ T5935] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 401.526382][ T5935] usb 4-1: device descriptor read/64, error -71 [ 401.554870][ T5820] usb 1-1: USB disconnect, device number 97 [ 401.776350][ T5935] usb 4-1: new high-speed USB device number 83 using dummy_hcd [ 401.916357][ T5935] usb 4-1: device descriptor read/64, error -71 [ 401.974167][ T796] em28xx 3-1:0.0: chip ID is em2882/3 [ 402.027333][ T5935] usb usb4-port1: attempt power cycle [ 402.182017][ T796] em28xx 3-1:0.0: Config register raw data: 0xfffffffb [ 402.193831][ T796] em28xx 3-1:0.0: AC97 chip type couldn't be determined [ 402.201647][ T796] em28xx 3-1:0.0: No AC97 audio processor [ 402.233777][ T796] usb 3-1: USB disconnect, device number 92 [ 402.240815][ T796] em28xx 3-1:0.0: Disconnecting em28xx [ 402.250970][ T796] em28xx 3-1:0.0: Freeing device [ 402.378156][ T5935] usb 4-1: new high-speed USB device number 84 using dummy_hcd [ 402.417933][ T5935] usb 4-1: device descriptor read/8, error -71 [ 402.676633][ T5935] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 402.717120][ T5935] usb 4-1: device descriptor read/8, error -71 [ 402.876677][ T5935] usb usb4-port1: unable to enumerate USB device [ 403.083419][ T5820] usb 3-1: new high-speed USB device number 93 using dummy_hcd [ 403.266485][ T5820] usb 3-1: Using ep0 maxpacket: 32 [ 403.274273][ T5820] usb 3-1: config 0 has an invalid interface number: 89 but max is 0 [ 403.284046][ T5820] usb 3-1: config 0 has no interface number 0 [ 403.293669][ T5820] usb 3-1: config 0 interface 89 has no altsetting 0 [ 403.308948][ T5820] usb 3-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 403.320354][ T5820] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 403.332783][ T5820] usb 3-1: Product: syz [ 403.356904][ T5820] usb 3-1: Manufacturer: syz [ 403.361505][ T5820] usb 3-1: SerialNumber: syz [ 403.376928][ T5820] usb 3-1: config 0 descriptor?? [ 403.427950][ T5820] em28xx 3-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 403.438060][ T5820] em28xx 3-1:0.89: Video interface 89 found: bulk [ 403.782234][ T29] audit: type=1326 audit(1772100379.872:911): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11287 comm="syz.0.1575" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc7f6c code=0x7ffc0000 [ 403.879180][ T29] audit: type=1326 audit(1772100379.902:912): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11287 comm="syz.0.1575" exe="/root/syz-executor" sig=0 arch=40000003 syscall=170 compat=1 ip=0xf7fc7f6c code=0x7ffc0000 [ 403.958506][T11296] vlan3: entered promiscuous mode [ 403.974206][T11295] __nla_validate_parse: 8 callbacks suppressed [ 403.974225][T11295] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1576'. [ 403.990034][T11296] bridge0: entered promiscuous mode [ 404.011778][T11295] bridge_slave_1: left allmulticast mode [ 404.017662][T11295] bridge_slave_1: left promiscuous mode [ 404.030663][T11295] bridge0: port 2(bridge_slave_1) entered disabled state [ 404.054013][ T5820] em28xx 3-1:0.89: unknown em28xx chip ID (0) [ 404.092309][T11295] bridge_slave_0: left promiscuous mode [ 404.098312][T11295] bridge0: port 1(bridge_slave_0) entered disabled state [ 404.536337][ T796] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 404.672541][ T5820] em28xx 3-1:0.89: failed to get i2c transfer status from bridge register (error=-5) [ 404.688121][ T5820] em28xx 3-1:0.89: board has no eeprom [ 404.710843][ T796] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 404.725430][ T796] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 404.751879][ T796] usb 4-1: Product: syz [ 404.766345][ T796] usb 4-1: Manufacturer: syz [ 404.773564][ T5820] em28xx 3-1:0.89: Identified as Terratec Grabby (card=67) [ 404.781790][ T796] usb 4-1: SerialNumber: syz [ 404.801053][ T5820] em28xx 3-1:0.89: analog set to bulk mode. [ 404.820086][ T796] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 404.840553][ T47] em28xx 3-1:0.89: Registering V4L2 extension [ 404.867170][ T5820] usb 3-1: USB disconnect, device number 93 [ 404.873378][ T5932] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 404.914096][ T5820] em28xx 3-1:0.89: Disconnecting em28xx [ 405.037959][ T47] em28xx 3-1:0.89: Config register raw data: 0xffffffed [ 405.047168][ T47] em28xx 3-1:0.89: AC97 chip type couldn't be determined [ 405.054276][ T47] em28xx 3-1:0.89: No AC97 audio processor [ 405.067650][ T47] usb 3-1: Decoder not found [ 405.073027][ T47] em28xx 3-1:0.89: failed to create media graph [ 405.079865][ T47] em28xx 3-1:0.89: V4L2 device video103 deregistered [ 405.090221][T11303] netlink: 236 bytes leftover after parsing attributes in process `syz.4.1579'. [ 405.101649][ T47] em28xx 3-1:0.89: Registering snapshot button... [ 405.111581][ T47] input: em28xx snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.89/input/input158 [ 405.128913][ T47] em28xx 3-1:0.89: Remote control support is not available for this card. [ 405.137956][ T5820] em28xx 3-1:0.89: Closing input extension [ 405.144511][ T5820] em28xx 3-1:0.89: Deregistering snapshot button [ 405.169932][ T5820] em28xx 3-1:0.89: Freeing device [ 405.191564][ T5935] usb 4-1: USB disconnect, device number 86 [ 405.267391][ T796] usb 1-1: new full-speed USB device number 98 using dummy_hcd [ 405.448094][ T796] usb 1-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 405.469336][ T796] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x93, changing to 0x83 [ 405.500480][ T796] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid maxpacket 10350, setting to 64 [ 405.537851][ T796] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 405.577069][ T796] usb 1-1: New USB device found, idVendor=15c2, idProduct=003b, bcdDevice=66.3e [ 405.596600][ T796] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 405.620816][ T796] usb 1-1: Product: syz [ 405.635990][ T796] usb 1-1: Manufacturer: syz [ 405.649855][ T796] usb 1-1: SerialNumber: syz [ 405.673831][ T796] usb 1-1: config 0 descriptor?? [ 405.681966][T11312] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 405.704929][ C0] imon 1-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 405.715265][ T796] input: iMON Panel, Knob and Mouse(15c2:003b) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input159 [ 405.907059][ T796] imon:send_packet: packet tx failed (-71) [ 405.946292][ T796] imon 1-1:0.0: panel buttons/knobs setup failed [ 405.998460][ T5932] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 406.012103][T11326] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1584'. [ 406.022382][ T5932] ath9k_htc: Failed to initialize the device [ 406.028659][T11326] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1584'. [ 406.040839][ T5935] usb 4-1: ath9k_htc: USB layer deinitialized [ 406.058645][ T796] rc_core: IR keymap rc-imon-pad not found [ 406.086172][ T796] Registered IR keymap rc-empty [ 406.093486][ T796] imon 1-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 406.120758][ T796] imon 1-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 406.144427][ T796] imon:send_packet: packet tx failed (-71) [ 406.176433][ T796] imon 1-1:0.0: remote input dev register failed [ 406.194599][ T796] imon 1-1:0.0: imon_init_intf0: rc device setup failed [ 406.243435][ T796] imon 1-1:0.0: unable to initialize intf0, err 0 [ 406.272824][ T796] imon:imon_probe: failed to initialize context! [ 406.293169][ T796] imon 1-1:0.0: unable to register, err -19 [ 406.332128][ T796] usb 1-1: USB disconnect, device number 98 [ 406.376313][ T5935] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 406.526720][ T5935] usb 4-1: device descriptor read/64, error -71 [ 406.558093][T11334] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 406.783955][ T5935] usb 4-1: new high-speed USB device number 88 using dummy_hcd [ 406.826715][ T9] usb 1-1: new high-speed USB device number 99 using dummy_hcd [ 406.926434][ T5935] usb 4-1: device descriptor read/64, error -71 [ 406.986306][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 407.005152][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short [ 407.014880][ T9] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 407.022546][ T9] usb 1-1: can't read configurations, error -71 [ 407.036482][ T5820] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 407.036909][ T5935] usb usb4-port1: attempt power cycle [ 407.106315][ T796] usb 5-1: new high-speed USB device number 92 using dummy_hcd [ 407.186425][ T5820] usb 2-1: device descriptor read/64, error -71 [ 407.256306][ T796] usb 5-1: Using ep0 maxpacket: 32 [ 407.270787][ T796] usb 5-1: New USB device found, idVendor=041e, idProduct=400b, bcdDevice=3e.e7 [ 407.286981][ T796] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 407.310338][ T796] usb 5-1: config 0 descriptor?? [ 407.319172][ T796] gspca_main: sunplus-2.14.0 probing 041e:400b [ 407.397553][T11352] binfmt_misc: register: failed to install interpreter file ./file0 [ 407.428383][ T5820] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 407.592396][ T29] kauditd_printk_skb: 21 callbacks suppressed [ 407.592415][ T29] audit: type=1326 audit(1772100383.682:934): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11342 comm="syz.2.1590" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700ef6c code=0x7ffc0000 [ 407.626515][ T5820] usb 2-1: device descriptor read/64, error -71 [ 407.683323][ T29] audit: type=1326 audit(1772100383.682:935): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11342 comm="syz.2.1590" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700ef6c code=0x7ffc0000 [ 407.736717][ T5820] usb usb2-port1: attempt power cycle [ 407.747425][T11341] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 407.792996][T11341] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 408.116491][ T5820] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 408.157399][ T5820] usb 2-1: device descriptor read/8, error -71 [ 408.216386][ T9] usb 1-1: new high-speed USB device number 101 using dummy_hcd [ 408.239152][ T796] gspca_sunplus: reg_w_riv err -71 [ 408.244372][ T796] sunplus 5-1:0.0: probe with driver sunplus failed with error -71 [ 408.262428][T11369] netlink: 168 bytes leftover after parsing attributes in process `syz.3.1597'. [ 408.268928][ T796] usb 5-1: USB disconnect, device number 92 [ 408.400926][ T9] usb 1-1: New USB device found, idVendor=04d8, idProduct=f372, bcdDevice= 0.00 [ 408.416519][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 408.416690][ T5820] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 408.443221][ T9] usb 1-1: config 0 descriptor?? [ 408.473473][T11375] fuse: Bad value for 'fd' [ 408.487194][ T5820] usb 2-1: device descriptor read/8, error -71 [ 408.597598][ T5820] usb usb2-port1: unable to enumerate USB device [ 408.661846][T11364] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 408.682840][T11364] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 408.958899][T11382] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 409.139975][ T9] usbhid 1-1:0.0: can't add hid device: -71 [ 409.146068][ T9] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 409.160561][ T9] usb 1-1: USB disconnect, device number 101 [ 409.272709][T11387] FAULT_INJECTION: forcing a failure. [ 409.272709][T11387] name failslab, interval 1, probability 0, space 0, times 0 [ 409.286142][T11387] CPU: 0 UID: 0 PID: 11387 Comm: syz.3.1602 Tainted: G L syzkaller #0 PREEMPT(full) [ 409.286171][T11387] Tainted: [L]=SOFTLOCKUP [ 409.286178][T11387] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 409.286188][T11387] Call Trace: [ 409.286195][T11387] [ 409.286203][T11387] dump_stack_lvl+0xe8/0x150 [ 409.286238][T11387] should_fail_ex+0x412/0x560 [ 409.286260][T11387] ? __d_alloc+0x37/0x6f0 [ 409.286287][T11387] should_failslab+0xa8/0x100 [ 409.286308][T11387] kmem_cache_alloc_lru_noprof+0x87/0x640 [ 409.286346][T11387] __d_alloc+0x37/0x6f0 [ 409.286375][T11387] d_alloc+0x4b/0x190 [ 409.286389][T11387] ? lookup_one_qstr_excl+0xc8/0x360 [ 409.286405][T11387] lookup_one_qstr_excl+0xdc/0x360 [ 409.286423][T11387] ? lookup_noperm_common+0x245/0x430 [ 409.286439][T11387] start_dirop+0x5c/0x90 [ 409.286453][T11387] simple_start_creating+0xcc/0x110 [ 409.286468][T11387] ? __pfx_simple_start_creating+0x10/0x10 [ 409.286487][T11387] ? do_raw_spin_unlock+0xf5/0x210 [ 409.286498][T11387] ? mntput+0x65/0xc0 [ 409.286512][T11387] debugfs_start_creating+0xdb/0x1a0 [ 409.286527][T11387] __debugfs_create_file+0x6f/0x400 [ 409.286543][T11387] debugfs_create_file_full+0x3f/0x60 [ 409.286557][T11387] ref_tracker_dir_debugfs+0x197/0x360 [ 409.286571][T11387] ? __pfx_ref_tracker_dir_debugfs+0x10/0x10 [ 409.286596][T11387] ? __kvmalloc_node_noprof+0x545/0x8a0 [ 409.286607][T11387] ? alloc_netdev_mqs+0xa6/0x11b0 [ 409.286620][T11387] ? __raw_spin_lock_init+0x45/0x100 [ 409.286632][T11387] alloc_netdev_mqs+0x272/0x11b0 [ 409.286641][T11387] ? __pfx_macvtap_setup+0x10/0x10 [ 409.286658][T11387] rtnl_create_link+0x31f/0xd70 [ 409.286672][T11387] rtnl_newlink_create+0x277/0xb70 [ 409.286686][T11387] ? __pfx___nla_validate_parse+0x10/0x10 [ 409.286704][T11387] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 409.286720][T11387] ? __pfx___mutex_lock+0x10/0x10 [ 409.286735][T11387] ? ns_capable+0x89/0xe0 [ 409.286750][T11387] rtnl_newlink+0x1666/0x1be0 [ 409.286770][T11387] ? __pfx_rtnl_newlink+0x10/0x10 [ 409.286781][T11387] ? do_fast_syscall_32+0x33/0x70 [ 409.286790][T11387] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 409.286821][T11387] ? kasan_quarantine_put+0xbb/0x1f0 [ 409.286831][T11387] ? lockdep_hardirqs_on+0x7a/0x110 [ 409.286848][T11387] ? kmem_cache_free+0x187/0x630 [ 409.286857][T11387] ? nlmon_xmit+0xb0/0x100 [ 409.286878][T11387] ? __lock_acquire+0x6b5/0x2cf0 [ 409.286893][T11387] ? __local_bh_enable_ip+0xd0/0x130 [ 409.286906][T11387] ? lockdep_hardirqs_on+0x7a/0x110 [ 409.286919][T11387] ? __dev_queue_xmit+0x274/0x38a0 [ 409.286928][T11387] ? __local_bh_enable_ip+0xd0/0x130 [ 409.286939][T11387] ? __dev_queue_xmit+0x274/0x38a0 [ 409.286960][T11387] ? __pfx_rtnl_newlink+0x10/0x10 [ 409.286972][T11387] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 409.286986][T11387] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 409.286998][T11387] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 409.287009][T11387] ? ref_tracker_free+0x693/0x840 [ 409.287020][T11387] ? __copy_skb_header+0xa3/0x4a0 [ 409.287034][T11387] ? __pfx_ref_tracker_free+0x10/0x10 [ 409.287045][T11387] ? __skb_clone+0x63/0x7a0 [ 409.287063][T11387] netlink_rcv_skb+0x232/0x4b0 [ 409.287077][T11387] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 409.287091][T11387] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 409.287108][T11387] ? netlink_deliver_tap+0x2e/0x1b0 [ 409.287124][T11387] netlink_unicast+0x80f/0x9b0 [ 409.287138][T11387] ? __pfx_netlink_unicast+0x10/0x10 [ 409.287150][T11387] ? netlink_sendmsg+0x650/0xb40 [ 409.287160][T11387] ? skb_put+0x11b/0x210 [ 409.287175][T11387] netlink_sendmsg+0x813/0xb40 [ 409.287191][T11387] ? __pfx_netlink_sendmsg+0x10/0x10 [ 409.287205][T11387] ? aa_sock_msg_perm+0xf1/0x1b0 [ 409.287218][T11387] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 409.287231][T11387] ? __pfx_netlink_sendmsg+0x10/0x10 [ 409.287242][T11387] ____sys_sendmsg+0xa68/0xad0 [ 409.287261][T11387] ? __pfx_____sys_sendmsg+0x10/0x10 [ 409.287277][T11387] ? kstrtoull+0x12f/0x1d0 [ 409.287293][T11387] ___sys_sendmsg+0x2a5/0x360 [ 409.287309][T11387] ? __pfx____sys_sendmsg+0x10/0x10 [ 409.287324][T11387] ? get_pid_task+0x20/0x1f0 [ 409.287334][T11387] ? get_pid_task+0x20/0x1f0 [ 409.287342][T11387] ? get_pid_task+0x20/0x1f0 [ 409.287364][T11387] ? __fget_files+0x2a/0x420 [ 409.287377][T11387] ? __fget_files+0x3a0/0x420 [ 409.287395][T11387] __sys_sendmsg+0x183/0x260 [ 409.287411][T11387] ? __pfx___sys_sendmsg+0x10/0x10 [ 409.287441][T11387] __do_fast_syscall_32+0x20d/0x640 [ 409.287452][T11387] ? do_fast_syscall_32+0x33/0x70 [ 409.287461][T11387] ? asm_int80_emulation+0x1a/0x20 [ 409.287470][T11387] ? do_int80_emulation+0x274/0x4d0 [ 409.287479][T11387] ? trace_irq_disable+0x3b/0x150 [ 409.287495][T11387] do_fast_syscall_32+0x33/0x70 [ 409.287505][T11387] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 409.287517][T11387] RIP: 0023:0xf705ef6c [ 409.287527][T11387] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 58 b8 77 00 00 00 cd 80 0f 0b 90 90 90 90 90 90 b8 ad [ 409.287536][T11387] RSP: 002b:00000000f544d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 409.287548][T11387] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000280 [ 409.287555][T11387] RDX: 0000000000000810 RSI: 0000000000000000 RDI: 0000000000000000 [ 409.287561][T11387] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 409.287567][T11387] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 409.287573][T11387] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 409.287588][T11387] [ 409.446623][ T5820] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 409.928260][T11395] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 409.935935][T11395] IPv6: NLM_F_CREATE should be set when creating new route [ 409.943258][T11395] IPv6: NLM_F_CREATE should be set when creating new route [ 410.116376][ T5820] usb 3-1: Using ep0 maxpacket: 8 [ 410.117453][ T9] usb 1-1: new high-speed USB device number 102 using dummy_hcd [ 410.123282][ T5820] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 410.181735][ T5820] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 410.183513][ T29] audit: type=1326 audit(1772100386.272:936): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11396 comm="syz.1.1606" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aef6c code=0x7ffc0000 [ 410.250936][ T5820] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 410.286328][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 410.292752][ T5820] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 410.370337][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short [ 410.384606][ T29] audit: type=1326 audit(1772100386.472:937): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11396 comm="syz.1.1606" exe="/root/syz-executor" sig=0 arch=40000003 syscall=170 compat=1 ip=0xf70aef6c code=0x7ffc0000 [ 410.426315][ T5820] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 410.427714][ T9] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 410.435393][ T5820] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 410.485871][ T9] usb 1-1: can't read configurations, error -71 [ 410.721025][ T5820] usb 3-1: GET_CAPABILITIES returned 0 [ 410.737066][T11407] kvm: requested 7542 ns i8254 timer period limited to 200000 ns [ 410.741696][ T5820] usbtmc 3-1:16.0: can't read capabilities [ 410.750270][T11407] 0: reclassify loop, rule prio 0, protocol 700 [ 411.042190][T11414] xt_cgroup: xt_cgroup: no path or classid specified [ 411.100269][T11416] syz_tun: entered allmulticast mode [ 411.192914][ T5820] usb 3-1: USB disconnect, device number 94 [ 411.209119][T11422] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 411.444707][ T29] audit: type=1326 audit(1772100387.532:938): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11415 comm="syz.3.1611" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705ef6c code=0x7ffc0000 [ 411.498583][ T29] audit: type=1326 audit(1772100387.532:939): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11415 comm="syz.3.1611" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705ef6c code=0x7ffc0000 [ 411.550116][ T29] audit: type=1326 audit(1772100387.562:940): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11415 comm="syz.3.1611" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705ef6c code=0x7ffc0000 [ 411.599994][T11416] vcan0: entered allmulticast mode [ 411.606341][ T5820] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 411.615238][ T29] audit: type=1326 audit(1772100387.562:941): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11415 comm="syz.3.1611" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705ef6c code=0x7ffc0000 [ 411.639054][ T29] audit: type=1326 audit(1772100387.562:942): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11415 comm="syz.3.1611" exe="/root/syz-executor" sig=0 arch=40000003 syscall=245 compat=1 ip=0xf705ef6c code=0x7ffc0000 [ 411.661769][ T29] audit: type=1326 audit(1772100387.562:943): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11415 comm="syz.3.1611" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705ef6c code=0x7ffc0000 [ 411.807369][ T5820] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD4, changing to 0x84 [ 411.835660][ T5820] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 51544, setting to 1024 [ 411.854513][ T5820] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 1024 [ 411.931285][T11415] syz_tun: left allmulticast mode [ 412.039790][ T5820] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 412.050735][T11436] bridge_slave_0: entered promiscuous mode [ 412.066728][T11436] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1618'. [ 412.075705][ T5820] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 412.097865][ T5820] usb 5-1: Product: syz [ 412.124519][ T5820] usb 5-1: Manufacturer: syz [ 412.129390][ T5820] usb 5-1: SerialNumber: syz [ 412.146340][ T5820] usb 5-1: config 0 descriptor?? [ 412.162777][T11427] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 412.234596][ T47] usb 3-1: new high-speed USB device number 95 using dummy_hcd [ 412.415375][ T47] usb 3-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 412.441959][ T47] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 412.464523][ T47] usb 3-1: Product: syz [ 412.473753][ T47] usb 3-1: Manufacturer: syz [ 412.478961][ T47] usb 3-1: SerialNumber: syz [ 412.514535][ T47] usb 3-1: config 0 descriptor?? [ 412.528263][T11448] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 412.592506][ T9] usb 1-1: new high-speed USB device number 104 using dummy_hcd [ 412.764657][ T29] kauditd_printk_skb: 176 callbacks suppressed [ 412.764676][ T29] audit: type=1326 audit(1772100388.852:1120): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11446 comm="syz.1.1622" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aef6c code=0x7ffc0000 [ 412.766363][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 412.838679][T11448] snd-usb-audio 5-1:0.0: Runtime PM usage count underflow! [ 412.852621][ T29] audit: type=1326 audit(1772100388.942:1121): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11446 comm="syz.1.1622" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf70aef6c code=0x7ffc0000 [ 412.925080][ T29] audit: type=1326 audit(1772100388.942:1122): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11446 comm="syz.1.1622" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aef6c code=0x7ffc0000 [ 413.019958][ T29] audit: type=1326 audit(1772100388.992:1123): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11446 comm="syz.1.1622" exe="/root/syz-executor" sig=0 arch=40000003 syscall=329 compat=1 ip=0xf70aef6c code=0x7ffc0000 [ 413.084628][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short [ 413.098267][ T9] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 413.105949][ T9] usb 1-1: can't read configurations, error -71 [ 413.176373][ T29] audit: type=1326 audit(1772100389.002:1124): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11446 comm="syz.1.1622" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aef6c code=0x7ffc0000 [ 413.278659][ T29] audit: type=1326 audit(1772100389.042:1125): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11446 comm="syz.1.1622" exe="/root/syz-executor" sig=0 arch=40000003 syscall=4 compat=1 ip=0xf70aef6c code=0x7ffc0000 [ 413.362506][ T29] audit: type=1326 audit(1772100389.092:1126): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11446 comm="syz.1.1622" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aef6c code=0x7ffc0000 [ 413.416704][ T29] audit: type=1326 audit(1772100389.112:1127): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11446 comm="syz.1.1622" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf71e5b6b code=0x7ffc0000 [ 413.613352][ T47] usb 3-1: non-Atmel transceiver xxxx0447 [ 413.636523][T11457] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1624'. [ 413.808328][T11461] bridge0: entered promiscuous mode [ 413.814679][ T47] usb 3-1: Firmware version (0.0) predates our first public release. [ 413.825264][T11461] bridge0: port 4(macvtap1) entered blocking state [ 413.842592][T11461] bridge0: port 4(macvtap1) entered disabled state [ 413.872003][T11461] macvtap1: entered allmulticast mode [ 413.877633][ T47] usb 3-1: Please update to version 0.2 or newer [ 413.886910][T11461] bridge0: entered allmulticast mode [ 413.912681][T11461] macvtap1: left allmulticast mode [ 413.926517][T11461] bridge0: left allmulticast mode [ 413.930972][ T47] usb 3-1: atusb_probe: initialization failed, error = -19 [ 413.944507][T11461] bridge0: left promiscuous mode [ 413.952740][ T47] usb 3-1: USB disconnect, device number 95 [ 413.953075][T11463] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1625'. [ 414.212729][ T5932] usb 4-1: new full-speed USB device number 90 using dummy_hcd [ 414.360173][T11472] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1628'. [ 414.390259][ T5932] usb 4-1: config 0 has no interfaces? [ 414.405007][T11472] FAULT_INJECTION: forcing a failure. [ 414.405007][T11472] name failslab, interval 1, probability 0, space 0, times 0 [ 414.435523][ T5932] usb 4-1: New USB device found, idVendor=12d1, idProduct=42f7, bcdDevice=aa.47 [ 414.468206][ T5932] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 414.482987][T11472] CPU: 0 UID: 0 PID: 11472 Comm: syz.0.1628 Tainted: G L syzkaller #0 PREEMPT(full) [ 414.483015][T11472] Tainted: [L]=SOFTLOCKUP [ 414.483022][T11472] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 414.483031][T11472] Call Trace: [ 414.483038][T11472] [ 414.483045][T11472] dump_stack_lvl+0xe8/0x150 [ 414.483075][T11472] should_fail_ex+0x412/0x560 [ 414.483097][T11472] should_failslab+0xa8/0x100 [ 414.483118][T11472] ? skb_clone+0x212/0x3a0 [ 414.483142][T11472] kmem_cache_alloc_noprof+0x87/0x650 [ 414.483175][T11472] skb_clone+0x212/0x3a0 [ 414.483204][T11472] __netlink_deliver_tap+0x404/0x850 [ 414.483235][T11472] ? netlink_deliver_tap+0x2e/0x1b0 [ 414.483256][T11472] netlink_deliver_tap+0x19c/0x1b0 [ 414.483278][T11472] netlink_sendskb+0x68/0x140 [ 414.483299][T11472] netlink_unicast+0x3a3/0x9b0 [ 414.483327][T11472] ? __pfx_netlink_unicast+0x10/0x10 [ 414.483355][T11472] netlink_rcv_skb+0x2b6/0x4b0 [ 414.483376][T11472] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 414.483398][T11472] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 414.483428][T11472] ? netlink_deliver_tap+0x2e/0x1b0 [ 414.483455][T11472] netlink_unicast+0x80f/0x9b0 [ 414.483476][T11472] ? __pfx_netlink_unicast+0x10/0x10 [ 414.483495][T11472] ? netlink_sendmsg+0x650/0xb40 [ 414.483513][T11472] ? skb_put+0x11b/0x210 [ 414.483539][T11472] netlink_sendmsg+0x813/0xb40 [ 414.483568][T11472] ? __pfx_netlink_sendmsg+0x10/0x10 [ 414.483590][T11472] ? aa_sock_msg_perm+0xf1/0x1b0 [ 414.483623][T11472] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 414.483643][T11472] ? __pfx_netlink_sendmsg+0x10/0x10 [ 414.483663][T11472] ____sys_sendmsg+0xa68/0xad0 [ 414.483695][T11472] ? __pfx_____sys_sendmsg+0x10/0x10 [ 414.483725][T11472] ? kstrtoull+0x12f/0x1d0 [ 414.483751][T11472] ___sys_sendmsg+0x2a5/0x360 [ 414.483781][T11472] ? __pfx____sys_sendmsg+0x10/0x10 [ 414.483808][T11472] ? get_pid_task+0x20/0x1f0 [ 414.483824][T11472] ? get_pid_task+0x20/0x1f0 [ 414.483839][T11472] ? get_pid_task+0x20/0x1f0 [ 414.483880][T11472] ? __fget_files+0x2a/0x420 [ 414.483903][T11472] ? __fget_files+0x3a0/0x420 [ 414.483936][T11472] __sys_sendmsg+0x183/0x260 [ 414.483964][T11472] ? __pfx___sys_sendmsg+0x10/0x10 [ 414.484011][T11472] __do_fast_syscall_32+0x20d/0x640 [ 414.484032][T11472] ? do_fast_syscall_32+0x33/0x70 [ 414.484048][T11472] ? asm_int80_emulation+0x1a/0x20 [ 414.484065][T11472] ? do_int80_emulation+0x274/0x4d0 [ 414.484081][T11472] ? trace_irq_disable+0x3b/0x150 [ 414.484110][T11472] do_fast_syscall_32+0x33/0x70 [ 414.484128][T11472] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 414.484149][T11472] RIP: 0023:0xf7fc7f6c [ 414.484166][T11472] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 58 b8 77 00 00 00 cd 80 0f 0b 90 90 90 90 90 90 b8 ad [ 414.484181][T11472] RSP: 002b:00000000f548650c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 414.484199][T11472] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000640 [ 414.484212][T11472] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 414.484223][T11472] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 414.484233][T11472] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 414.484243][T11472] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 414.484270][T11472] [ 414.863651][ T5932] usb 4-1: config 0 descriptor?? [ 414.880321][ T9] usb 5-1: USB disconnect, device number 93 [ 414.942017][T11476] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 415.236354][ T797] usb 1-1: new high-speed USB device number 106 using dummy_hcd [ 415.396446][ T797] usb 1-1: Using ep0 maxpacket: 8 [ 415.409904][ T797] usb 1-1: config 179 has an invalid interface number: 65 but max is 0 [ 415.434581][ T797] usb 1-1: config 179 has no interface number 0 [ 415.457221][ T797] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 415.482504][ T797] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 415.502776][ T797] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 415.554089][ T797] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 415.615505][ T797] usb 1-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 415.651199][ T797] usb 1-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 415.682050][ T797] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 415.719674][T11480] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 415.860543][T11492] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1634'. [ 415.988517][T11480] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 415.998435][T11480] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 416.116015][ T797] input: Generic X-Box pad as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:179.65/input/input162 [ 416.206749][ T9] usb 2-1: new high-speed USB device number 95 using dummy_hcd [ 416.396344][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 416.448463][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 416.461523][ T797] usb 1-1: USB disconnect, device number 106 [ 416.461580][ C1] xpad 1-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 416.475863][ C1] xpad 1-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 416.504282][ T9] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 416.515287][ T9] usb 2-1: can't read configurations, error -71 [ 416.651348][ T5820] usb 4-1: USB disconnect, device number 90 [ 416.957767][ T29] audit: type=1326 audit(1772100393.042:1128): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11504 comm="syz.2.1636" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700ef6c code=0x7ffc0000 [ 417.040035][ T29] audit: type=1326 audit(1772100393.052:1129): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11504 comm="syz.2.1636" exe="/root/syz-executor" sig=0 arch=40000003 syscall=170 compat=1 ip=0xf700ef6c code=0x7ffc0000 [ 417.449201][ T5932] usb 1-1: new high-speed USB device number 107 using dummy_hcd [ 417.587429][T11521] IPVS: sync thread started: state = MASTER, mcast_ifn = ip6gre0, syncid = 33554436, id = 0 [ 417.598179][T11518] IPVS: stopping master sync thread 11521 ... [ 417.611473][ T5820] IPVS: starting estimator thread 0... [ 417.706478][T11522] IPVS: using max 56 ests per chain, 134400 per kthread [ 417.726801][ T5932] usb 1-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 417.751868][ T5932] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 417.761928][ T5932] usb 1-1: Product: syz [ 417.766195][ T5932] usb 1-1: Manufacturer: syz [ 417.771803][ T5932] usb 1-1: SerialNumber: syz [ 417.782256][ T5932] usb 1-1: config 0 descriptor?? [ 417.842584][T11529] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 418.469003][T11546] IPVS: length: 218 != 24 [ 418.474061][T11546] syz_tun: entered allmulticast mode [ 418.488582][T11545] syz_tun: left allmulticast mode [ 418.576463][ T9] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 418.608424][ T797] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 418.663335][T11552] x_tables: duplicate underflow at hook 3 [ 418.706113][T11552] IPVS: set_ctl: invalid protocol: 0 127.0.0.1:20000 [ 418.756531][ T9] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 418.770157][ T9] usb 5-1: config 0 interface 0 has no altsetting 0 [ 418.777418][ T797] usb 2-1: Using ep0 maxpacket: 8 [ 418.786514][ T9] usb 5-1: New USB device found, idVendor=10fd, idProduct=1513, bcdDevice=7e.ce [ 418.796496][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 418.818375][ T5932] usb 1-1: non-Atmel transceiver xxxx0447 [ 418.824325][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 418.843605][ T9] usb 5-1: Product: syz [ 418.847874][ T797] usb 2-1: unable to get BOS descriptor or descriptor too short [ 418.848779][ T797] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 418.877781][ T9] usb 5-1: Manufacturer: syz [ 418.888049][ T9] usb 5-1: SerialNumber: syz [ 418.893196][ T797] usb 2-1: can't read configurations, error -71 [ 418.917627][ T9] usb 5-1: config 0 descriptor?? [ 418.936937][ T9] dvb-usb: found a 'MSI DIGI VOX mini II DVB-T USB2.0' in warm state. [ 418.975817][ T9] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 419.015435][ T5932] usb 1-1: Firmware version (0.0) predates our first public release. [ 419.026788][ T9] dvbdev: DVB: registering new adapter (MSI DIGI VOX mini II DVB-T USB2.0) [ 419.037813][ T5932] usb 1-1: Please update to version 0.2 or newer [ 419.044375][ T9] usb 5-1: media controller created [ 419.050924][ T5932] usb 1-1: atusb_probe: initialization failed, error = -19 [ 419.074410][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 419.101890][ T5932] usb 1-1: USB disconnect, device number 107 [ 419.106501][T11562] IPVS: sync thread started: state = MASTER, mcast_ifn = ip6gre0, syncid = 33554436, id = 0 [ 419.138749][T11558] IPVS: stopping master sync thread 11562 ... [ 419.198538][ T9] DVB: Unable to find symbol tda10046_attach() [ 419.226091][ T9] dvb-usb: no frontend was attached by 'MSI DIGI VOX mini II DVB-T USB2.0' [ 419.237884][ T9] dvb-usb: MSI DIGI VOX mini II DVB-T USB2.0 successfully initialized and connected. [ 419.583651][T11569] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 419.656374][T11571] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 420.024135][T11588] netlink: 'syz.0.1665': attribute type 1 has an invalid length. [ 420.032022][T11588] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1665'. [ 420.058076][T11588] bridge0: port 2(bridge_slave_1) entered blocking state [ 420.065294][T11588] bridge0: port 2(bridge_slave_1) entered forwarding state [ 420.239618][T11601] xfrm0: entered promiscuous mode [ 420.244697][T11601] xfrm0: entered allmulticast mode [ 420.273436][ T9] dvb_usb_m920x 5-1:0.0: probe with driver dvb_usb_m920x failed with error -71 [ 420.286694][ T797] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 420.299159][ T9] usb 5-1: USB disconnect, device number 94 [ 420.456336][ T797] usb 4-1: Using ep0 maxpacket: 8 [ 420.480090][ T797] usb 4-1: unable to get BOS descriptor or descriptor too short [ 420.488740][ T47] usb 3-1: new high-speed USB device number 96 using dummy_hcd [ 420.497317][ T797] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 420.505190][ T797] usb 4-1: can't read configurations, error -71 [ 420.606355][ T5888] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 420.646338][ T47] usb 3-1: Using ep0 maxpacket: 32 [ 420.653154][ T47] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 420.664369][ T47] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 420.675532][ T47] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 420.685484][ T47] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 420.707410][ T47] usb 3-1: config 0 descriptor?? [ 420.715752][ T47] hub 3-1:0.0: USB hub found [ 420.762523][ T5888] usb 2-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 420.772068][ T5888] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 420.780707][ T5888] usb 2-1: Product: syz [ 420.793377][ T5888] usb 2-1: Manufacturer: syz [ 420.807430][ T5888] usb 2-1: SerialNumber: syz [ 420.818570][ T5888] usb 2-1: config 0 descriptor?? [ 421.056175][T11612] netlink: 'syz.3.1675': attribute type 21 has an invalid length. [ 421.065681][T11612] fuse: Bad value for 'group_id' [ 421.070996][ T9] usb 1-1: new high-speed USB device number 108 using dummy_hcd [ 421.080622][T11612] fuse: Bad value for 'group_id' [ 421.090390][T11612] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1675'. [ 421.226301][ T9] usb 1-1: device descriptor read/64, error -71 [ 421.274107][T11618] IPVS: sync thread started: state = MASTER, mcast_ifn = ip6gre0, syncid = 33554436, id = 0 [ 421.274223][T11616] IPVS: stopping master sync thread 11618 ... [ 421.376412][ T5820] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 421.466319][ T9] usb 1-1: new high-speed USB device number 109 using dummy_hcd [ 421.536428][ T5820] usb 5-1: Using ep0 maxpacket: 16 [ 421.543180][ T5820] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xD has an invalid bInterval 182, changing to 11 [ 421.556914][ T5820] usb 5-1: New USB device found, idVendor=4752, idProduct=0011, bcdDevice=32.4f [ 421.566061][ T5820] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 421.574344][ T5820] usb 5-1: Product: syz [ 421.578780][ T5820] usb 5-1: Manufacturer: syz [ 421.583380][ T5820] usb 5-1: SerialNumber: syz [ 421.590486][ T5820] usb 5-1: config 0 descriptor?? [ 421.596505][ T9] usb 1-1: device descriptor read/64, error -71 [ 421.597786][ T5820] hub 5-1:0.0: bad descriptor, ignoring hub [ 421.608889][ T5820] hub 5-1:0.0: probe with driver hub failed with error -5 [ 421.618529][ T5820] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 421.711391][ T9] usb usb1-port1: attempt power cycle [ 421.841126][ T5888] usb 2-1: non-Atmel transceiver xxxx0447 [ 421.955926][ T796] usb 5-1: USB disconnect, device number 95 [ 422.043141][ T5888] usb 2-1: Firmware version (0.0) predates our first public release. [ 422.057443][ T5888] usb 2-1: Please update to version 0.2 or newer [ 422.057973][ T9] usb 1-1: new high-speed USB device number 110 using dummy_hcd [ 422.064829][ T5888] usb 2-1: atusb_probe: initialization failed, error = -19 [ 422.087323][ T5888] usb 2-1: USB disconnect, device number 99 [ 422.093777][ T9] usb 1-1: device descriptor read/8, error -71 [ 422.336507][ T9] usb 1-1: new high-speed USB device number 111 using dummy_hcd [ 422.356934][ T9] usb 1-1: device descriptor read/8, error -71 [ 422.476563][ T9] usb usb1-port1: unable to enumerate USB device [ 422.636453][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 422.757505][T11638] syzkaller1: entered promiscuous mode [ 422.763389][T11638] syzkaller1: entered allmulticast mode [ 423.254966][ T47] hub 3-1:0.0: config failed, can't read hub descriptor (err -22) [ 423.300432][ T47] usbhid 3-1:0.0: can't add hid device: -71 [ 423.322229][ T47] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 423.380121][ T47] usb 3-1: USB disconnect, device number 96 [ 423.956030][T11654] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1687'. [ 423.965871][T11654] netlink: 104 bytes leftover after parsing attributes in process `syz.3.1687'. [ 423.975035][T11654] netlink: 104 bytes leftover after parsing attributes in process `syz.3.1687'. [ 423.985695][T11654] FAULT_INJECTION: forcing a failure. [ 423.985695][T11654] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 424.008766][T11654] CPU: 0 UID: 0 PID: 11654 Comm: syz.3.1687 Tainted: G L syzkaller #0 PREEMPT(full) [ 424.008785][T11654] Tainted: [L]=SOFTLOCKUP [ 424.008789][T11654] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 424.008796][T11654] Call Trace: [ 424.008800][T11654] [ 424.008805][T11654] dump_stack_lvl+0xe8/0x150 [ 424.008824][T11654] should_fail_ex+0x412/0x560 [ 424.008839][T11654] _copy_to_user+0x31/0xb0 [ 424.008855][T11654] simple_read_from_buffer+0xe1/0x170 [ 424.008871][T11654] proc_fail_nth_read+0x1bb/0x230 [ 424.008886][T11654] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 424.008901][T11654] ? rw_verify_area+0x2a6/0x4d0 [ 424.008910][T11654] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 424.008924][T11654] vfs_read+0x20c/0xa70 [ 424.008932][T11654] ? fdget_pos+0x246/0x320 [ 424.008948][T11654] ? __pfx___mutex_lock+0x10/0x10 [ 424.008959][T11654] ? __pfx_vfs_read+0x10/0x10 [ 424.008970][T11654] ? __fget_files+0x2a/0x420 [ 424.008985][T11654] ? __fget_files+0x3a0/0x420 [ 424.008997][T11654] ? __fget_files+0x2a/0x420 [ 424.009014][T11654] ksys_read+0x150/0x270 [ 424.009025][T11654] ? __pfx_ksys_read+0x10/0x10 [ 424.009037][T11654] ? asm_int80_emulation+0x1a/0x20 [ 424.009049][T11654] do_int80_emulation+0x173/0x4d0 [ 424.009059][T11654] ? trace_irq_disable+0x3b/0x150 [ 424.009072][T11654] ? asm_int80_emulation+0x1a/0x20 [ 424.009081][T11654] ? clear_bhb_loop+0x40/0x90 [ 424.009091][T11654] ? clear_bhb_loop+0x40/0x90 [ 424.009103][T11654] asm_int80_emulation+0x1a/0x20 [ 424.009112][T11654] RIP: 0023:0xf7195b6b [ 424.009123][T11654] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 424.009132][T11654] RSP: 002b:00000000f544d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 424.009144][T11654] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f544d5d0 [ 424.009151][T11654] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 424.009157][T11654] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 424.009162][T11654] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 424.009168][T11654] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 424.009183][T11654] [ 424.076455][ T47] usb 3-1: new high-speed USB device number 97 using dummy_hcd [ 424.316345][ T5820] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 424.406373][ T47] usb 3-1: Using ep0 maxpacket: 8 [ 424.426915][ T47] usb 3-1: unable to get BOS descriptor or descriptor too short [ 424.437058][ T47] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 424.444641][ T47] usb 3-1: can't read configurations, error -71 [ 424.477201][ T5820] usb 2-1: Using ep0 maxpacket: 32 [ 424.493649][ T5820] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 424.504814][ T5820] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 424.516354][ T5888] usb 4-1: new full-speed USB device number 93 using dummy_hcd [ 424.525864][ T5820] usb 2-1: config 0 descriptor?? [ 424.527465][ T9] usb 1-1: new high-speed USB device number 112 using dummy_hcd [ 424.677967][ T5888] usb 4-1: config 0 interface 0 altsetting 13 endpoint 0x81 has invalid wMaxPacketSize 0 [ 424.688165][ T5888] usb 4-1: config 0 interface 0 has no altsetting 0 [ 424.694824][ T5888] usb 4-1: New USB device found, idVendor=046d, idProduct=c534, bcdDevice= 0.00 [ 424.704311][ T5888] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 424.716458][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 424.717656][ T5888] usb 4-1: config 0 descriptor?? [ 424.734707][ T5820] dvb-usb: found a 'Elgato EyeTV DTT' in cold state, will try to load a firmware [ 424.734767][ T9] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xEE, changing to 0x8E [ 424.772354][ T5820] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 424.778643][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 424.780592][ T5820] dib0700: firmware download failed at 7 with -22 [ 424.809980][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 424.825396][ T9] usb 1-1: New USB device found, idVendor=187f, idProduct=0200, bcdDevice=6b.ad [ 424.835058][ T9] usb 1-1: New USB device strings: Mfr=55, Product=237, SerialNumber=3 [ 424.844332][ T9] usb 1-1: Product: syz [ 424.848770][ T9] usb 1-1: Manufacturer: syz [ 424.853376][ T9] usb 1-1: SerialNumber: syz [ 424.865290][ T9] usb 1-1: config 0 descriptor?? [ 424.877603][ T9] smsusb:smsusb_probe: board id=2, interface number 0 [ 424.885361][ T9] smsusb:smsusb_probe: Device initialized with return code -19 [ 424.969289][ T5820] usb 2-1: USB disconnect, device number 100 [ 425.114900][ T9] usb 1-1: USB disconnect, device number 112 [ 425.167919][ T5888] logitech-djreceiver 0003:046D:C534.0029: unknown main item tag 0x0 [ 425.176067][ T5888] logitech-djreceiver 0003:046D:C534.0029: unknown main item tag 0x0 [ 425.237703][ T5888] logitech-djreceiver 0003:046D:C534.0029: unknown main item tag 0x0 [ 425.264152][ T5888] logitech-djreceiver 0003:046D:C534.0029: unknown main item tag 0x0 [ 425.272675][ T29] kauditd_printk_skb: 5 callbacks suppressed [ 425.272691][ T29] audit: type=1326 audit(1772100401.352:1135): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11672 comm="syz.4.1694" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 425.313527][ T5888] logitech-djreceiver 0003:046D:C534.0029: unknown main item tag 0x0 [ 425.350115][ T29] audit: type=1326 audit(1772100401.352:1136): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11672 comm="syz.4.1694" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 425.404244][T11658] syz_tun: tun_net_xmit 86 [ 425.422833][ T29] audit: type=1326 audit(1772100401.392:1137): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11672 comm="syz.4.1694" exe="/root/syz-executor" sig=0 arch=40000003 syscall=170 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 425.485648][ T29] audit: type=1326 audit(1772100401.392:1138): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11672 comm="syz.4.1694" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 425.571340][ T47] usb 4-1: USB disconnect, device number 93 [ 425.586343][ T29] audit: type=1326 audit(1772100401.392:1139): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11672 comm="syz.4.1694" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 425.652748][ T29] audit: type=1326 audit(1772100401.392:1140): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11672 comm="syz.4.1694" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 425.735599][ T29] audit: type=1326 audit(1772100401.392:1141): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11672 comm="syz.4.1694" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 425.826187][ T29] audit: type=1326 audit(1772100401.392:1142): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11672 comm="syz.4.1694" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 425.888106][T11689] IPVS: length: 218 != 24 [ 425.892655][ T29] audit: type=1326 audit(1772100401.392:1143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11672 comm="syz.4.1694" exe="/root/syz-executor" sig=0 arch=40000003 syscall=329 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 425.957050][T11689] syz_tun: entered allmulticast mode [ 425.969087][ T29] audit: type=1326 audit(1772100401.392:1144): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11672 comm="syz.4.1694" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 426.020056][T11692] [ 426.022417][T11692] ===================================================== [ 426.029349][T11692] WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected [ 426.036813][T11692] syzkaller #0 Tainted: G L [ 426.042779][T11692] ----------------------------------------------------- [ 426.049690][T11692] syz.3.1697/11692 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire: [ 426.057401][T11692] ffffffff8e40c058 (tasklist_lock){.+.+}-{3:3}, at: send_sigio+0x101/0x370 [ 426.066004][T11692] [ 426.066004][T11692] and this task is already holding: [ 426.073350][T11692] ffff88805a3a8d20 (&f_owner->lock){....}-{3:3}, at: send_sigio+0x38/0x370 [ 426.081951][T11692] which would create a new lock dependency: [ 426.087819][T11692] (&f_owner->lock){....}-{3:3} -> (tasklist_lock){.+.+}-{3:3} [ 426.095378][T11692] [ 426.095378][T11692] but this new dependency connects a SOFTIRQ-irq-safe lock: [ 426.104825][T11692] (&dev->event_lock#2){..-.}-{3:3} [ 426.104856][T11692] [ 426.104856][T11692] ... which became SOFTIRQ-irq-safe at: [ 426.117708][T11692] lock_acquire+0xf0/0x2e0 [ 426.122203][T11692] _raw_spin_lock_irqsave+0x40/0x60 [ 426.127477][T11692] input_inject_event+0xa5/0x340 [ 426.132503][T11692] led_trigger_event+0x138/0x210 [ 426.137601][T11692] kbd_bh+0x1f3/0x300 [ 426.141652][T11692] tasklet_action_common+0x2da/0x4b0 [ 426.147014][T11692] handle_softirqs+0x22a/0x870 [ 426.151852][T11692] run_ksoftirqd+0x36/0x60 [ 426.156342][T11692] smpboot_thread_fn+0x541/0xa50 [ 426.161356][T11692] kthread+0x388/0x470 [ 426.165497][T11692] ret_from_fork+0x51e/0xb90 [ 426.170161][T11692] ret_from_fork_asm+0x1a/0x30 [ 426.175002][T11692] [ 426.175002][T11692] to a SOFTIRQ-irq-unsafe lock: [ 426.181998][T11692] (tasklist_lock){.+.+}-{3:3} [ 426.182024][T11692] [ 426.182024][T11692] ... which became SOFTIRQ-irq-unsafe at: [ 426.194613][T11692] ... [ 426.194620][T11692] lock_acquire+0xf0/0x2e0 [ 426.201667][T11692] _raw_read_lock+0x36/0x50 [ 426.206251][T11692] __do_wait+0xde/0x740 [ 426.210477][T11692] do_wait+0x1e7/0x540 [ 426.214643][T11692] kernel_wait+0xd6/0x1c0 [ 426.219043][T11692] call_usermodehelper_exec_work+0xbe/0x230 [ 426.225014][T11692] process_scheduled_works+0xb02/0x1830 [ 426.230633][T11692] worker_thread+0xa50/0xfc0 [ 426.235294][T11692] kthread+0x388/0x470 [ 426.239434][T11692] ret_from_fork+0x51e/0xb90 [ 426.244099][T11692] ret_from_fork_asm+0x1a/0x30 [ 426.248938][T11692] [ 426.248938][T11692] other info that might help us debug this: [ 426.248938][T11692] [ 426.259143][T11692] Chain exists of: [ 426.259143][T11692] &dev->event_lock#2 --> &f_owner->lock --> tasklist_lock [ 426.259143][T11692] [ 426.272170][T11692] Possible interrupt unsafe locking scenario: [ 426.272170][T11692] [ 426.280467][T11692] CPU0 CPU1 [ 426.285814][T11692] ---- ---- [ 426.291158][T11692] lock(tasklist_lock); [ 426.295398][T11692] local_irq_disable(); [ 426.302132][T11692] lock(&dev->event_lock#2); [ 426.309324][T11692] lock(&f_owner->lock); [ 426.316155][T11692] [ 426.319588][T11692] lock(&dev->event_lock#2); [ 426.324427][T11692] [ 426.324427][T11692] *** DEADLOCK *** [ 426.324427][T11692] [ 426.332557][T11692] 6 locks held by syz.3.1697/11692: [ 426.337734][T11692] #0: ffff88802037e420 (sb_writers#5){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 426.346871][T11692] #1: ffffffff8e901c30 (file_rwsem){.+.+}-{0:0}, at: __break_lease+0x4de/0x1e80 [ 426.356003][T11692] #2: ffff888030d15c78 (&ctx->flc_lock){+.+.}-{3:3}, at: __break_lease+0x4e8/0x1e80 [ 426.365481][T11692] #3: ffffffff8e7602e0 (rcu_read_lock){....}-{1:3}, at: kill_fasync+0x53/0x4d0 [ 426.374520][T11692] #4: ffff88806b027210 (&new->fa_lock){....}-{3:3}, at: kill_fasync+0x199/0x4d0 [ 426.383639][T11692] #5: ffff88805a3a8d20 (&f_owner->lock){....}-{3:3}, at: send_sigio+0x38/0x370 [ 426.392672][T11692] [ 426.392672][T11692] the dependencies between SOFTIRQ-irq-safe lock and the holding lock: [ 426.403060][T11692] -> (&dev->event_lock#2){..-.}-{3:3} { [ 426.408869][T11692] IN-SOFTIRQ-W at: [ 426.413099][T11692] lock_acquire+0xf0/0x2e0 [ 426.419674][T11692] _raw_spin_lock_irqsave+0x40/0x60 [ 426.427034][T11692] input_inject_event+0xa5/0x340 [ 426.434131][T11692] led_trigger_event+0x138/0x210 [ 426.441229][T11692] kbd_bh+0x1f3/0x300 [ 426.447365][T11692] tasklet_action_common+0x2da/0x4b0 [ 426.454809][T11692] handle_softirqs+0x22a/0x870 [ 426.461731][T11692] run_ksoftirqd+0x36/0x60 [ 426.468305][T11692] smpboot_thread_fn+0x541/0xa50 [ 426.475402][T11692] kthread+0x388/0x470 [ 426.476430][ C1] syz_tun: tun_net_xmit 86 [ 426.481620][T11692] ret_from_fork+0x51e/0xb90 [ 426.492751][T11692] ret_from_fork_asm+0x1a/0x30 [ 426.499677][T11692] INITIAL USE at: [ 426.503815][T11692] lock_acquire+0xf0/0x2e0 [ 426.510300][T11692] _raw_spin_lock_irqsave+0x40/0x60 [ 426.517571][T11692] input_inject_event+0xa5/0x340 [ 426.524583][T11692] kbd_led_trigger_activate+0xbc/0x100 [ 426.532107][T11692] led_trigger_set+0x535/0x960 [ 426.538940][T11692] led_trigger_set_default+0x260/0x2a0 [ 426.546476][T11692] led_classdev_register_ext+0x787/0x9c0 [ 426.554177][T11692] input_leds_connect+0x517/0x790 [ 426.561358][T11692] input_register_device+0xd00/0x1160 [ 426.568807][T11692] atkbd_connect+0x731/0xa50 [ 426.575478][T11692] serio_driver_probe+0x82/0xd0 [ 426.582397][T11692] really_probe+0x267/0xaf0 [ 426.588965][T11692] __driver_probe_device+0x18c/0x320 [ 426.596317][T11692] driver_probe_device+0x4f/0x240 [ 426.603409][T11692] __driver_attach+0x3e7/0x710 [ 426.610256][T11692] bus_for_each_dev+0x23b/0x2c0 [ 426.617177][T11692] serio_handle_event+0x20a/0xdd0 [ 426.624269][T11692] process_scheduled_works+0xb02/0x1830 [ 426.631897][T11692] worker_thread+0xa50/0xfc0 [ 426.638576][T11692] kthread+0x388/0x470 [ 426.644719][T11692] ret_from_fork+0x51e/0xb90 [ 426.651392][T11692] ret_from_fork_asm+0x1a/0x30 [ 426.658241][T11692] } [ 426.660982][T11692] ... key at: [] input_allocate_device.__key.7+0x0/0x20 [ 426.670251][T11692] -> (&client->buffer_lock){....}-{3:3} { [ 426.676148][T11692] INITIAL USE at: [ 426.680195][T11692] lock_acquire+0xf0/0x2e0 [ 426.686513][T11692] _raw_spin_lock_irqsave+0x40/0x60 [ 426.693608][T11692] evdev_ioctl_handler+0x1a49/0x1fe0 [ 426.700790][T11692] __ia32_compat_sys_ioctl+0x5ea/0x950 [ 426.708143][T11692] __do_fast_syscall_32+0x20d/0x640 [ 426.715241][T11692] do_fast_syscall_32+0x33/0x70 [ 426.721983][T11692] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 426.730208][T11692] } [ 426.732863][T11692] ... key at: [] evdev_open.__key.27+0x0/0x20 [ 426.741171][T11692] ... acquired at: [ 426.745128][T11692] _raw_spin_lock+0x2e/0x40 [ 426.749792][T11692] evdev_pass_values+0xb9/0xbd0 [ 426.754802][T11692] evdev_events+0x1aa/0x340 [ 426.759462][T11692] input_pass_values+0x1c2/0x890 [ 426.764566][T11692] input_event_dispose+0x330/0x6b0 [ 426.769839][T11692] input_inject_event+0x1dd/0x340 [ 426.775024][T11692] evdev_write+0x325/0x4c0 [ 426.779599][T11692] vfs_write+0x29a/0xb90 [ 426.783994][T11692] ksys_write+0x150/0x270 [ 426.788476][T11692] __do_fast_syscall_32+0x20d/0x640 [ 426.793828][T11692] do_fast_syscall_32+0x33/0x70 [ 426.798836][T11692] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 426.805323][T11692] [ 426.807626][T11692] -> (&new->fa_lock){....}-{3:3} { [ 426.812827][T11692] INITIAL USE at: [ 426.816785][T11692] lock_acquire+0xf0/0x2e0 [ 426.822925][T11692] _raw_write_lock_irq+0x3d/0x50 [ 426.829586][T11692] fasync_remove_entry+0xf1/0x1c0 [ 426.836327][T11692] __fput+0x8a5/0xa70 [ 426.842031][T11692] task_work_run+0x1d9/0x270 [ 426.848339][T11692] do_exit+0x69b/0x2320 [ 426.854212][T11692] do_group_exit+0x21b/0x2d0 [ 426.860518][T11692] get_signal+0x1284/0x1330 [ 426.866744][T11692] arch_do_signal_or_restart+0xbc/0x830 [ 426.874011][T11692] exit_to_user_mode_loop+0x86/0x480 [ 426.881017][T11692] __do_fast_syscall_32+0x415/0x640 [ 426.887938][T11692] do_fast_syscall_32+0x33/0x70 [ 426.894506][T11692] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 426.902555][T11692] INITIAL READ USE at: [ 426.906953][T11692] lock_acquire+0xf0/0x2e0 [ 426.913529][T11692] _raw_read_lock_irqsave+0x48/0x60 [ 426.920885][T11692] kill_fasync+0x199/0x4d0 [ 426.927455][T11692] evdev_pass_values+0x627/0xbd0 [ 426.934550][T11692] evdev_events+0x1e6/0x340 [ 426.941206][T11692] input_pass_values+0x288/0x890 [ 426.948296][T11692] input_event_dispose+0x330/0x6b0 [ 426.955578][T11692] input_inject_event+0x1dd/0x340 [ 426.962765][T11692] evdev_write+0x325/0x4c0 [ 426.969344][T11692] vfs_write+0x29a/0xb90 [ 426.975738][T11692] ksys_write+0x150/0x270 [ 426.982219][T11692] __do_fast_syscall_32+0x20d/0x640 [ 426.989569][T11692] do_fast_syscall_32+0x33/0x70 [ 426.996574][T11692] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 427.005146][T11692] } [ 427.007724][T11692] ... key at: [] fasync_insert_entry.__key+0x0/0x20 [ 427.016476][T11692] ... acquired at: [ 427.020348][T11692] _raw_read_lock_irqsave+0x48/0x60 [ 427.025711][T11692] kill_fasync+0x199/0x4d0 [ 427.030285][T11692] evdev_pass_values+0x627/0xbd0 [ 427.035382][T11692] evdev_events+0x1e6/0x340 [ 427.040046][T11692] input_pass_values+0x288/0x890 [ 427.045140][T11692] input_event_dispose+0x330/0x6b0 [ 427.050413][T11692] input_inject_event+0x1dd/0x340 [ 427.055601][T11692] evdev_write+0x325/0x4c0 [ 427.060181][T11692] vfs_write+0x29a/0xb90 [ 427.064585][T11692] ksys_write+0x150/0x270 [ 427.069069][T11692] __do_fast_syscall_32+0x20d/0x640 [ 427.074422][T11692] do_fast_syscall_32+0x33/0x70 [ 427.079426][T11692] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 427.085914][T11692] [ 427.088217][T11692] -> (&f_owner->lock){....}-{3:3} { [ 427.093414][T11692] INITIAL USE at: [ 427.097290][T11692] lock_acquire+0xf0/0x2e0 [ 427.103264][T11692] _raw_write_lock_irq+0x3d/0x50 [ 427.109755][T11692] __f_setown+0x67/0x370 [ 427.115541][T11692] generic_setlease+0xacf/0xff0 [ 427.121947][T11692] do_fcntl_add_lease+0x35e/0x470 [ 427.128524][T11692] fcntl_setlease+0x123/0x180 [ 427.134752][T11692] do_fcntl+0x8b3/0x1a20 [ 427.140539][T11692] do_compat_fcntl64+0x51e/0x7e0 [ 427.147019][T11692] __do_fast_syscall_32+0x20d/0x640 [ 427.153766][T11692] do_fast_syscall_32+0x33/0x70 [ 427.160163][T11692] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 427.168039][T11692] INITIAL READ USE at: [ 427.172349][T11692] lock_acquire+0xf0/0x2e0 [ 427.178756][T11692] _raw_read_lock_irqsave+0x48/0x60 [ 427.185943][T11692] send_sigio+0x38/0x370 [ 427.192165][T11692] kill_fasync+0x24d/0x4d0 [ 427.198576][T11692] lease_break_callback+0x26/0x30 [ 427.205582][T11692] __break_lease+0x81c/0x1e80 [ 427.212267][T11692] do_dentry_open+0x1010/0x14e0 [ 427.219114][T11692] vfs_open+0x3b/0x340 [ 427.225191][T11692] path_openat+0x2e08/0x3860 [ 427.231781][T11692] do_file_open+0x23e/0x4a0 [ 427.238273][T11692] do_sys_openat2+0x113/0x200 [ 427.244954][T11692] __ia32_sys_creat+0x8f/0xc0 [ 427.251629][T11692] __do_fast_syscall_32+0x20d/0x640 [ 427.258826][T11692] do_fast_syscall_32+0x33/0x70 [ 427.265668][T11692] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 427.273988][T11692] } [ 427.276474][T11692] ... key at: [] file_f_owner_allocate.__key+0x0/0x20 [ 427.285315][T11692] ... acquired at: [ 427.289099][T11692] _raw_read_lock_irqsave+0x48/0x60 [ 427.294462][T11692] send_sigio+0x38/0x370 [ 427.298859][T11692] kill_fasync+0x24d/0x4d0 [ 427.303431][T11692] lease_break_callback+0x26/0x30 [ 427.308616][T11692] __break_lease+0x81c/0x1e80 [ 427.313456][T11692] do_dentry_open+0x1010/0x14e0 [ 427.318469][T11692] vfs_open+0x3b/0x340 [ 427.322700][T11692] path_openat+0x2e08/0x3860 [ 427.327445][T11692] do_file_open+0x23e/0x4a0 [ 427.332103][T11692] do_sys_openat2+0x113/0x200 [ 427.336940][T11692] __ia32_sys_creat+0x8f/0xc0 [ 427.341781][T11692] __do_fast_syscall_32+0x20d/0x640 [ 427.347135][T11692] do_fast_syscall_32+0x33/0x70 [ 427.352144][T11692] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 427.358639][T11692] [ 427.360943][T11692] [ 427.360943][T11692] the dependencies between the lock to be acquired [ 427.360952][T11692] and SOFTIRQ-irq-unsafe lock: [ 427.374427][T11692] -> (tasklist_lock){.+.+}-{3:3} { [ 427.379641][T11692] HARDIRQ-ON-R at: [ 427.383612][T11692] lock_acquire+0xf0/0x2e0 [ 427.389672][T11692] _raw_read_lock+0x36/0x50 [ 427.395813][T11692] __do_wait+0xde/0x740 [ 427.401603][T11692] do_wait+0x1e7/0x540 [ 427.407305][T11692] kernel_wait+0xd6/0x1c0 [ 427.413269][T11692] call_usermodehelper_exec_work+0xbe/0x230 [ 427.420800][T11692] process_scheduled_works+0xb02/0x1830 [ 427.427982][T11692] worker_thread+0xa50/0xfc0 [ 427.434208][T11692] kthread+0x388/0x470 [ 427.439906][T11692] ret_from_fork+0x51e/0xb90 [ 427.446132][T11692] ret_from_fork_asm+0x1a/0x30 [ 427.452533][T11692] SOFTIRQ-ON-R at: [ 427.456498][T11692] lock_acquire+0xf0/0x2e0 [ 427.462550][T11692] _raw_read_lock+0x36/0x50 [ 427.468689][T11692] __do_wait+0xde/0x740 [ 427.474477][T11692] do_wait+0x1e7/0x540 [ 427.480182][T11692] kernel_wait+0xd6/0x1c0 [ 427.486147][T11692] call_usermodehelper_exec_work+0xbe/0x230 [ 427.493675][T11692] process_scheduled_works+0xb02/0x1830 [ 427.500857][T11692] worker_thread+0xa50/0xfc0 [ 427.507085][T11692] kthread+0x388/0x470 [ 427.512787][T11692] ret_from_fork+0x51e/0xb90 [ 427.516401][ C1] syz_tun: tun_net_xmit 86 [ 427.519011][T11692] ret_from_fork_asm+0x1a/0x30 [ 427.529809][T11692] INITIAL USE at: [ 427.533689][T11692] lock_acquire+0xf0/0x2e0 [ 427.539660][T11692] _raw_write_lock_irq+0x3d/0x50 [ 427.546149][T11692] copy_process+0x247a/0x3cf0 [ 427.552387][T11692] kernel_clone+0x248/0x8e0 [ 427.558442][T11692] user_mode_thread+0x110/0x180 [ 427.564845][T11692] rest_init+0x23/0x300 [ 427.570547][T11692] start_kernel+0x385/0x3d0 [ 427.576601][T11692] x86_64_start_reservations+0x24/0x30 [ 427.583611][T11692] x86_64_start_kernel+0x143/0x1c0 [ 427.590284][T11692] common_startup_64+0x13e/0x147 [ 427.596790][T11692] INITIAL READ USE at: [ 427.601115][T11692] lock_acquire+0xf0/0x2e0 [ 427.607528][T11692] _raw_read_lock+0x36/0x50 [ 427.614020][T11692] __do_wait+0xde/0x740 [ 427.620158][T11692] do_wait+0x1e7/0x540 [ 427.626209][T11692] kernel_wait+0xd6/0x1c0 [ 427.632534][T11692] call_usermodehelper_exec_work+0xbe/0x230 [ 427.640418][T11692] process_scheduled_works+0xb02/0x1830 [ 427.647965][T11692] worker_thread+0xa50/0xfc0 [ 427.654555][T11692] kthread+0x388/0x470 [ 427.660628][T11692] ret_from_fork+0x51e/0xb90 [ 427.667214][T11692] ret_from_fork_asm+0x1a/0x30 [ 427.673974][T11692] } [ 427.676459][T11692] ... key at: [] tasklist_lock+0x18/0x40 [ 427.684174][T11692] ... acquired at: [ 427.687958][T11692] _raw_read_lock+0x36/0x50 [ 427.692625][T11692] send_sigio+0x101/0x370 [ 427.697109][T11692] kill_fasync+0x24d/0x4d0 [ 427.701681][T11692] lease_break_callback+0x26/0x30 [ 427.706863][T11692] __break_lease+0x81c/0x1e80 [ 427.711703][T11692] vfs_truncate+0x449/0x540 [ 427.716362][T11692] do_sys_truncate+0xf3/0x1c0 [ 427.721197][T11692] __ia32_compat_sys_truncate+0x5b/0x70 [ 427.726898][T11692] __do_fast_syscall_32+0x20d/0x640 [ 427.732251][T11692] do_fast_syscall_32+0x33/0x70 [ 427.737257][T11692] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 427.743743][T11692] [ 427.746067][T11692] [ 427.746067][T11692] stack backtrace: [ 427.751946][T11692] CPU: 0 UID: 0 PID: 11692 Comm: syz.3.1697 Tainted: G L syzkaller #0 PREEMPT(full) [ 427.751970][T11692] Tainted: [L]=SOFTLOCKUP [ 427.751977][T11692] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 427.751986][T11692] Call Trace: [ 427.751996][T11692] [ 427.752003][T11692] dump_stack_lvl+0xe8/0x150 [ 427.752026][T11692] __lock_acquire+0x2a94/0x2cf0 [ 427.752052][T11692] lock_acquire+0xf0/0x2e0 [ 427.752070][T11692] ? send_sigio+0x101/0x370 [ 427.752085][T11692] ? lock_acquire+0xf0/0x2e0 [ 427.752104][T11692] _raw_read_lock+0x36/0x50 [ 427.752124][T11692] ? send_sigio+0x101/0x370 [ 427.752137][T11692] send_sigio+0x101/0x370 [ 427.752152][T11692] kill_fasync+0x24d/0x4d0 [ 427.752167][T11692] ? kill_fasync+0x53/0x4d0 [ 427.752182][T11692] lease_break_callback+0x26/0x30 [ 427.752197][T11692] __break_lease+0x81c/0x1e80 [ 427.752223][T11692] ? __pfx___break_lease+0x10/0x10 [ 427.752244][T11692] ? mnt_get_write_access+0x66/0x280 [ 427.752260][T11692] ? mnt_get_write_access+0x213/0x280 [ 427.752276][T11692] ? break_lease+0xfd/0x150 [ 427.752291][T11692] vfs_truncate+0x449/0x540 [ 427.752307][T11692] ? __pfx_vfs_truncate+0x10/0x10 [ 427.752324][T11692] ? do_getname+0x151/0x250 [ 427.752343][T11692] do_sys_truncate+0xf3/0x1c0 [ 427.752359][T11692] ? __pfx_do_sys_truncate+0x10/0x10 [ 427.752374][T11692] ? rcu_is_watching+0x15/0xb0 [ 427.752396][T11692] __ia32_compat_sys_truncate+0x5b/0x70 [ 427.752413][T11692] __do_fast_syscall_32+0x20d/0x640 [ 427.752427][T11692] ? lockdep_hardirqs_on+0x7a/0x110 [ 427.752449][T11692] ? do_fast_syscall_32+0x33/0x70 [ 427.752463][T11692] ? irqentry_exit+0x10e/0x620 [ 427.752484][T11692] ? trace_irq_disable+0x3b/0x150 [ 427.752508][T11692] do_fast_syscall_32+0x33/0x70 [ 427.752522][T11692] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 427.752540][T11692] RIP: 0023:0xf705ef6c [ 427.752554][T11692] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 58 b8 77 00 00 00 cd 80 0f 0b 90 90 90 90 90 90 b8 ad [ 427.752573][T11692] RSP: 002b:00000000f540b50c EFLAGS: 00000206 ORIG_RAX: 000000000000005c [ 427.752591][T11692] RAX: ffffffffffffffda RBX: 0000000080000040 RCX: 0000000000000000 [ 427.752602][T11692] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 427.752611][T11692] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 427.752620][T11692] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 427.752629][T11692] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 427.752643][T11692] [ 428.089770][T11687] syz_tun: left allmulticast mode