last executing test programs: 11.273801315s ago: executing program 0 (id=2362): socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x800020, 0x0, 0xffffffffffffffc0, 0x9, 0x8, 0x0, 0x3}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) setresuid(0x0, 0xee00, 0x0) pipe2$watch_queue(&(0x7f00000002c0), 0x80) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000700)=ANY=[@ANYBLOB="4c00000002060108000034e40000000000000000050001000600000005000400000000000900020073797a3100000000050005000a00000012000300686173683a6e65742c706f7274"], 0x4c}}, 0x2) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x8001, 0x0) ioctl$DRM_IOCTL_AGP_ENABLE(r3, 0x40086432, &(0x7f0000000040)) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r4, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r5, &(0x7f0000000080)={0x10, 0x0, 0x0, 0xfffffffffffffffd}, 0xc) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="02030609100000000000004c9e0000000200130002000000da16c167d803f1f805000600200000000a00060000000000fffffffffe00000000001ffeff0001000003f1dc7f7c6e7c0200010000000000004000020000000005000500000000000a"], 0x80}}, 0x0) sendmmsg(r6, &(0x7f0000000180), 0x400008a, 0x0) 7.9965306s ago: executing program 1 (id=2371): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r1, 0x29, 0x19, &(0x7f00000000c0)=0x94a, 0x4) syz_emit_ethernet(0x6e, &(0x7f0000000340)={@multicast, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "02adf7", 0x38, 0x3a, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, {[], @time_exceed={0x2, 0x0, 0x0, 0x0, '\x00', {0x0, 0x6, "fd9063", 0x0, 0x3a, 0x0, @mcast1, @loopback={0x0, 0xffffac1414aa}, [], "1e520b4c951ee12e"}}}}}}}, 0x0) recvmmsg(r1, &(0x7f0000004b40)=[{{0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x1000}], 0x1, 0x40012040, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) sendmsg(r3, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000015c0)=[{0x10, 0x29, 0x3}, {0x10, 0x84, 0x1ff}], 0x20}, 0x1) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@getqdisc={0x3c, 0x26, 0x800, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, r4, {0xb, 0xfff2}, {0x2619d580a42e8270, 0xfff1}, {0x7, 0x4}}, [{0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}]}, 0x3c}}, 0x0) 7.809778267s ago: executing program 1 (id=2374): dup(0xffffffffffffffff) syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100)=0xc6, 0x4) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f0000000040)=0x2, 0x4) bind$inet6(r0, &(0x7f0000000200)={0xa, 0xe22, 0x0, @empty}, 0x1c) syz_emit_ethernet(0xd2, &(0x7f0000000080)=ANY=[@ANYBLOB="ffffffffbfff00000000000086dd600489f1009c1100fc010000000000000025030000000000ff02000000000000000300000000000100000e22"], 0x0) 7.744510047s ago: executing program 0 (id=2375): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r0, &(0x7f00000003c0)={0x24, &(0x7f0000000cc0)=ANY=[@ANYBLOB="00000c000000070001", @ANYBLOB="d3"], 0x0, 0x0, 0x0}, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) (async) syz_usb_control_io$hid(r0, &(0x7f00000003c0)={0x24, &(0x7f0000000cc0)=ANY=[@ANYBLOB="00000c000000070001", @ANYBLOB="d3"], 0x0, 0x0, 0x0}, 0x0) (async) sendmsg(0xffffffffffffffff, 0x0, 0x0) (async) socket$can_bcm(0x1d, 0x2, 0x2) (async) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) (async) 7.510885567s ago: executing program 1 (id=2376): r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(0xffffffffffffffff, 0xc05c6104, &(0x7f00000001c0)={'Wc9\t', 0x0, 0x6, 0x3, 0x0, 0x0, "09000000e3ff00", "000200", "00ff0200", "798a202d", ["c2fffedbff00ffdfffffffff", "ffff08000000000000042371", "070500110800c1024b00", "38a70ed483c99b9f1600d333"]}) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x204000000000000, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900000000000000000000000000001800", [0x0, 0x2000000000001]}}) 7.196530114s ago: executing program 1 (id=2378): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000010000000000006000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008ef0540000000020900020073797a310000000008000a40fffffffc580000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000002c0003800c0000800800034000000002100000800c000180060001"], 0xbc}}, 0x40) 6.873141015s ago: executing program 1 (id=2379): openat$uhid(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETOBJ(r0, 0x0, 0x90) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) socket$inet6_sctp(0xa, 0x1, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x100}, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x6080, 0x0) io_setup(0x1, 0x0) io_submit(0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) writev(0xffffffffffffffff, &(0x7f0000000300), 0x0) syz_usb_connect$uac1(0x5, 0x7a, &(0x7f0000000d00)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x40, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x68, 0x3, 0x1, 0x2, 0x80, 0x8, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x525, 0x4}, [@output_terminal={0x9, 0x24, 0x3, 0x2, 0x304, 0x5, 0x4, 0x6}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0xe, 0xf, 0x7, {0x7, 0x25, 0x1, 0x80, 0x10}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0xd4, 0x8, 0x1, {0x7, 0x25, 0x1, 0x82, 0x6, 0x7}}}}}}}]}}, &(0x7f0000001140)={0x0, 0x0, 0x0, 0x0}) socket$inet_tcp(0x2, 0x1, 0x0) r3 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x2000000f5, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r3, 0xc008561c, &(0x7f0000000400)={0xf0f071, 0x19}) r4 = syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) tkill(r4, 0x13) waitid(0x0, r4, &(0x7f0000000380), 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x1, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000007000000000000000000c700000000000000950000"], &(0x7f0000000040)='GPL\x00'}, 0x94) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) 6.216675894s ago: executing program 0 (id=2380): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x3}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = dup3(r1, r0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) close(0x4) r3 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x6c90, 0x40000) r4 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io$printer(r4, 0x0, &(0x7f00000003c0)={0x34, &(0x7f0000000480)=ANY=[@ANYBLOB="0300000000482725c2231479ac825c40f16340d78364f8acd323c7dfeac2e220004b4aef39079f82a802d48bffd61471a2b353e437b506133ab6b5ee0229fe5e9272a3afcadd17a196515a0343cf35d3ba4a6af2868100"/97], 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$SCSI_IOCTL_DOORUNLOCK(r3, 0x5381) sendmsg$nl_route(r3, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000300)={&(0x7f0000000500)=ANY=[@ANYBLOB="2c00000009001000280b000000dbdf2500080003004f97bfb570ef3d233e32f8c6c357f8419913b814930dfd362465857a51a7", @ANYRES32=r3, @ANYRESDEC=r3, @ANYRES32=r2, @ANYBLOB="4ebf61306ce2f654cefe0a"], 0x2c}, 0x1, 0x0, 0x0, 0x2c048010}, 0x20000000) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mbind(&(0x7f0000a71000/0x4000)=nil, 0x4000, 0x1, 0x0, 0x4, 0x0) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/50, 0x714000, 0x800, 0x3, 0x3}, 0xfffffffffffffde0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) shmctl$SHM_INFO(0x0, 0xe, &(0x7f0000000280)=""/67) ioctl$KVM_SET_TSC_KHZ_cpu(0xffffffffffffffff, 0xaea2, 0x7ff) r6 = syz_open_dev$sndpcmp(&(0x7f0000000300), 0x0, 0x28002) ioctl$SNDRV_PCM_IOCTL_HW_FREE(r6, 0x4112, 0x0) ioctl$KVM_SET_DEVICE_ATTR(0xffffffffffffffff, 0x4018aee1, &(0x7f0000000140)=@attr_arm64={0x0, 0x0, 0x0, 0x0}) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000a0000004200000040"], 0x50) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000001c0)={r7, 0x0, 0x0}, 0x20) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4}, 0x4000000) openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x42, 0x0) 4.745475509s ago: executing program 2 (id=2383): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@updpolicy={0x13c, 0x19, 0x1, 0x0, 0x25dfdbff, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0xfffffffffffffffe}, {0x7d}}, [@tmpl={0x84, 0x5, [{{@in=@local, 0x4d6, 0x33}, 0x0, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44}, {{@in6=@remote, 0x4, 0x3c}, 0xa, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000}]}]}, 0x13c}, 0x1, 0x0, 0x0, 0x1}, 0x0) 4.394734376s ago: executing program 2 (id=2387): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000070000840900010073797a30000000004c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000000d08000640ffffff000800034000000038540000000c0a01010000000000000000070000000900020073797a31000000000900010073797a3000000000280003802400008004000180040002800c00044000000000000000090c0005"], 0xe8}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) 4.284548329s ago: executing program 3 (id=2388): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x1800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x4c, 0x0, &(0x7f0000000540)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000340)={@fda={0x66646185, 0x2, 0x0, 0x3b}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x1001}}, &(0x7f0000000200)={0x0, 0x20, 0x38}}}], 0x0, 0xfffffff0, 0x0}) 4.167830779s ago: executing program 3 (id=2390): dup(0xffffffffffffffff) syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100)=0xc6, 0x4) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f0000000040)=0x2, 0x4) bind$inet6(r0, &(0x7f0000000200)={0xa, 0xe22, 0x0, @empty}, 0x1c) syz_emit_ethernet(0xd2, &(0x7f0000000080)=ANY=[@ANYBLOB="ffffffffbfff00000000000086dd600489f1009c1100fc010000000000000025030000000000ff02000000000000000800000000000100000e22"], 0x0) 3.964246428s ago: executing program 3 (id=2391): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r0, &(0x7f0000000c00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="380000000000000029000700390000001d04020400000000fc0000000000000000000000000000f3000000000001200000000000000029000500370000"], 0x70, 0x241}}], 0x1, 0x4000021) 3.951295953s ago: executing program 2 (id=2392): syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000680)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, 0x0, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) unshare(0x2040600) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_EDITDEST(r0, 0x0, 0x489, &(0x7f0000000380)={{0x84, @multicast1, 0x4e20, 0x3, 'sh\x00', 0x0, 0x60000000, 0xc}, {@rand_addr=0x64010102, 0x4e26, 0x3, 0x0, 0x8001, 0x1}}, 0x44) 3.884338441s ago: executing program 3 (id=2393): ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x4) ioctl$KDSETLED(0xffffffffffffffff, 0x4b32, 0x8001) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$rxrpc(0x21, 0x2, 0xa) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) r2 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) r3 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r3, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r4, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r4, 0x0, 0x30, &(0x7f00000006c0)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000008800000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000002", @ANYRES64=r2], 0x110) 3.596316747s ago: executing program 3 (id=2394): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xe, 0x4008031, 0xffffffffffffffff, 0x5b76f000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f0000000100)='freezer.parent_freezing\x00', 0x0, 0x0) preadv(r2, &(0x7f0000000140)=[{&(0x7f0000000280)=""/241, 0xf1}], 0x1, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000f80)={'wlan1\x00', &(0x7f0000000f40)=@ethtool_stats}) 3.068234872s ago: executing program 2 (id=2396): r0 = syz_usb_connect(0x5, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x92, 0xec, 0xc6, 0x20, 0x5ac, 0x77c2, 0xeb3a, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, [{{0x9, 0x4, 0xc4, 0x1, 0x2, 0xff, 0xfd, 0x1, 0x80, [], [{{0x9, 0x5, 0x2, 0x2, 0x210, 0x2}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000940)={{0x14, 0x10, 0x4}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x7, 0x0, 0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x25}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x301, 0x0, 0x0, {0x7, 0x0, 0x8}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0x4}]}]}]}, @NFT_MSG_DELRULE={0xc8, 0x8, 0xa, 0x801, 0x0, 0x0, {0x7, 0x0, 0xa}, [@NFTA_RULE_USERDATA={0xb1, 0x7, 0x1, 0x0, "59a9c59f597116ad85ac3640a221fee4ba847047e4ad252b38311a1741a8480aeceda3595869e5a05837f65bbb4268852af80596a214005e1129acaa5606c03ec9abe376ac25af31868ae5ea9b8cc1000878313a2a112576050472318d9ef5c420a29eee74e0e7aff92ae4166a6dc0a7d48c873b99f496f660ad2f6549da482b1b160d90af16397726b8ee45622fde156918cd758c72436b42eeda96447de6c6dcbfcd928ace24d9d4c71b94d7"}]}, @NFT_MSG_DELCHAIN={0x198, 0x5, 0xa, 0x0, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}, @NFTA_CHAIN_COUNTERS={0x1c, 0x8, 0x0, 0x1, [@NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x8000}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0xfffffffffffffffc}]}, @NFTA_CHAIN_HOOK={0x28, 0x4, 0x0, 0x1, [@NFTA_HOOK_DEV={0x14, 0x3, 'nr0\x00'}, @NFTA_HOOK_HOOKNUM={0x8}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x48a8bae2}]}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x4}, @NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}, @NFTA_CHAIN_USERDATA={0x102, 0xc, "fd658a33f86c3a3c9b29f79f32a1ecc9cc44701e64a57b0e9003cbfe2ee78c443dca7aba9eae5018f19410c1260c780a649307015159b815a3c80072e5698221b90511c20d97ca6998bc5b39bde31f8c4008648e071065655e838f137079d45006e1ea600c7a9678409af7861201b89d11ab887454b27c8e8c5930ff784e37b2b71fd98dbabcbfff8da27d4da920edbc4faedf775677dd42b6889b03126ee4949f480b08421bea215bde87084bc86a6a51aaae86d40fd9732174a0159c4d5bb2b66ebae4405ae5bda592788a4436136f512a52c436575d65069d1c00e134622247f50e8686f6a3660de9f5e72e4efb6bb36f21ef3f217648eb464569794c"}, @NFTA_CHAIN_HOOK={0x1c, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x11e5699f}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0xeeb7def}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x324}}, 0x0) (async) r2 = userfaultfd(0x80001) unshare(0x22020600) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) (async) write$tun(r3, &(0x7f0000000280)={@val={0x1c, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x3d}, @mpls={[], @ipv4=@tcp={{0x6, 0x4, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x2, 0xb, 0x0, 0x300, 0x0, 0x1c, {[@window={0xe, 0x3}, @timestamp={0x5, 0x2, 0x7ffffff, 0x700}, @generic={0x0, 0x2, "d58838068b91"}]}}}}}}, 0x4e) (async) r5 = socket$rds(0x15, 0x5, 0x0) (async) r6 = syz_clone(0x81000000, 0x0, 0x0, 0x0, 0x0, 0x0) r7 = syz_pidfd_open(r6, 0x0) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000000)={0x200000, 0x200000, 0x8001, 0x0, 0xfffffc00}) (async) pidfd_getfd(r7, 0xffffffffffffffff, 0x0) (async) bind$rds(r5, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) (async) sendmsg$rds(r5, &(0x7f0000001d00)={&(0x7f00000017c0)={0x2, 0x0, @private=0xa010101}, 0x10, 0x0, 0x0, &(0x7f0000003380)=[@rdma_args={0x48, 0x114, 0x1, {{0x4002}, {&(0x7f0000001a00)=""/116, 0x74}, &(0x7f0000000080)=[{&(0x7f0000001a80)=""/79, 0x4f}], 0x1}}, @rdma_args={0x48, 0x114, 0x1, {{0x1000, 0x800}, {0x0}, 0x0, 0x0, 0x1}}], 0x90}, 0x0) (async) ioctl$UFFDIO_REGISTER(r2, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x0, 0x2}) (async) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) (async) syz_usbip_server_init(0x4) (async) r8 = syz_io_uring_setup(0x6d9, &(0x7f0000000100)={0x0, 0x7fee, 0x80, 0x0, 0x70}, &(0x7f0000000180), &(0x7f00000001c0)) r9 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r9, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0xfffe}], 0x1) io_uring_register$IORING_REGISTER_FILES(r8, 0x23, &(0x7f00000000c0)=[0xffffffffffffffff], 0x1) (async) syz_usb_control_io$hid(r0, &(0x7f0000000140)={0x24, &(0x7f0000000000)={0x20, 0x30, 0x30, {0x30, 0xb, "fbfad245e7a879ca1f44e39efd50c04a24e422a7f6c2813a6186d00227c3ec47bc5c54baf1a0fd902745eb9275a7"}}, &(0x7f0000000040)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x40c}}, &(0x7f00000003c0)=ANY=[@ANYBLOB="002214000000ab6c085d80072950d074abfa3032a7b34b99c930575e425cc287ba407f830b3798bb494473a3ea20a71b00b4e19ec5017058824da160e2d1bc9466a7f29c51e98db345c20d0a6a533fdf52aca33e0468b3a317de7a"], &(0x7f0000000100)={0x0, 0x21, 0x9, {0x9, 0x21, 0xc984, 0x1, 0x1, {0x22, 0xb1b}}}}, &(0x7f0000000380)={0x2c, &(0x7f0000000180)={0x0, 0x18, 0xb5, "23722fab3cb1704fd589d0da61187ff0f1b03300983f294119d84915b5f75f221cfd3130fae5acfca6ca1af1c91cf2adcd8b9fd2d9ab633ba519d0d61efac24721ae54dd7cc376590615a1247548313a02f633362e8ba6c52add83b0c65a02dc5769fc3ede9ba0c29c50bc7c37cebaa813a20dc09affc4923e025f32ae4f77e895d3c27771405483ef410ff40cdc36edb28ea717bca03af7c3bb9108c5fad7e97ba8ad79bdbeffe5354f49c8ea747ab5db8bbf6e39"}, &(0x7f0000000240)={0x0, 0xa, 0x1, 0x7f}, &(0x7f0000000280)={0x0, 0x8, 0x1}, &(0x7f00000005c0)=ANY=[@ANYBLOB="200141000009a8038036f6fb7d9f381fe575d80958ff11965dda03495237aab1ebfd8b00d77a95c3de15010ad51d04284ccc038f7add36fdb2e09be4c3e0e73a77a9dc3fa8a3e106cd4aea3f55e3a0d877e1f5367621f952b09d1042d4da8f1011634a22b2b706084dab710f4a7984589a50875904d7504735362ca9314d30ba3bc669145c2bf4209dda218cff51014e8ede9c631da166b07e844d0f4c09ce16184f04579947"], &(0x7f0000000340)={0x20, 0x3, 0x1, 0x3}}) 2.796153276s ago: executing program 4 (id=2397): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000340)={'wlan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000e40)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="2508007a0000000000000700000008000300", @ANYRES32=r2, @ANYBLOB="1400060064756d6d7930000000000000004000001400040076657468315f746f5f626f016400000005005300010000000800050004"], 0x54}}, 0x0) 2.659785171s ago: executing program 4 (id=2398): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="4c00000010000104000000000000000000fe8000", @ANYRES32=0x0, @ANYBLOB="03000000000000001c0012800b0001006970766c616e00000c000280060001000200000008000500", @ANYRES32=r2, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r2], 0x4c}}, 0x0) 2.358799204s ago: executing program 1 (id=2399): socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x101882, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$KVM_GET_IRQCHIP(r3, 0xc208ae62, &(0x7f0000000540)={0x3, 0x0, @ioapic={0x0, 0x3, 0x2, 0x11, 0x0, [{0xaa, 0x8, 0xf8}, {0x3, 0x6, 0xe, '\x00', 0x4}, {0x7, 0xb, 0x0, '\x00', 0x78}, {0x7e, 0xa, 0x0, '\x00', 0x1}, {0xa7, 0x81, 0x9}, {0x2, 0x5, 0x3, '\x00', 0xde}, {0xcf, 0x9b, 0xd, '\x00', 0x8}, {0x6, 0x5a, 0x5, '\x00', 0x89}, {0xc, 0x5, 0x0, '\x00', 0x9}, {0x4, 0x5, 0xe, '\x00', 0xb}, {0x6, 0x0, 0x7, '\x00', 0x4}, {0x17, 0x2, 0x5, '\x00', 0x6}, {0x8, 0x9, 0xb8, '\x00', 0x6e}, {0x0, 0xf6, 0x1, '\x00', 0xfa}, {0x4, 0x3, 0x2, '\x00', 0xe}, {0x2, 0xff, 0xa6, '\x00', 0x6}, {0x3, 0x7, 0x1, '\x00', 0x6}, {0x6, 0x3, 0xa, '\x00', 0x3b}, {0xb, 0x8, 0x8, '\x00', 0xff}, {0x6, 0xfd, 0x5, '\x00', 0x2}, {0x9, 0x4, 0x5, '\x00', 0x3}, {0x6, 0x7, 0x3, '\x00', 0x8}, {0x8, 0x5a, 0x8, '\x00', 0x8}, {0x10, 0x1, 0x1, '\x00', 0x5}]}}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000100)={'netdevsim0\x00', &(0x7f0000000140)=@ethtool_link_settings={0x4c, 0x5, 0x3b, 0x0, 0x3, 0xf, 0x3, 0x47, 0x5, 0x20, [0xd21, 0x80000, 0x3, 0x7, 0x8, 0x4, 0x8000, 0x1], [0x5]}}) prctl$PR_SET_KEEPCAPS(0x8, 0x1) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x800) fcntl$lock(r4, 0x24, &(0x7f00000000c0)={0x1, 0x3, 0x3, 0xfffffffffffffffa, 0xffffffffffffffff}) syz_io_uring_setup(0x706f, &(0x7f00000003c0)={0x0, 0x8002, 0x100, 0x0, 0x3cc}, &(0x7f00000001c0)=0x0, &(0x7f0000000300)=0x0) r8 = syz_open_procfs(0x0, 0x0) getdents64(r8, &(0x7f0000000fc0)=""/224, 0xe0) syz_io_uring_submit(r6, r7, &(0x7f0000000180)=@IORING_OP_UNLINKAT={0x24, 0x2, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000380)='./file0\x00'}) io_uring_enter(r8, 0x567, 0x87e8, 0x32, 0x0, 0x0) sendfile(0xffffffffffffffff, r5, 0x0, 0x201f00) socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x23, 0x6, 0x2007a30) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) socket$nl_generic(0x10, 0x3, 0x10) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) 2.014699662s ago: executing program 4 (id=2400): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000009006000000000000000000000a44000000090a0000000000fa82a3fa211411fa0008000a40000000000900020073797a3100000000090001"], 0x6c}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400000010000100000000000000040000fc000a20000000000a03000000000000000000070000000900010073797a30000000004c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000001c08000640ffffff000800034000000028580000000c0a01010000000000000000070000000900020073797a31000000000900010073797a30000000002c0003802800008008000340"], 0xec}}, 0x0) 1.684341116s ago: executing program 3 (id=2401): seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x1, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000180)=[{0x6, 0x0, 0xfe, 0x7fff0000}]}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0) close(r2) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0x32) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r3 = socket(0x10, 0x2, 0x0) write(r3, &(0x7f0000000040), 0x0) recvmmsg(r3, &(0x7f0000002ec0), 0x0, 0x2, 0x0) preadv2(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000001200)=""/4080, 0xff0}], 0x1, 0x0, 0x0, 0x0) dup(r3) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000240), 0xfdef) read$FUSE(0xffffffffffffffff, &(0x7f0000002540)={0x2020}, 0xfdef) syz_mount_image$fuse(&(0x7f00000002c0), &(0x7f0000000300)='./file1\x00', 0x40, &(0x7f00000003c0)=ANY=[@ANYBLOB="66643de3dbd6a4f3fe431f0186e6f6356b303091c69957eeb92a6ebfe4d3ee02580e76844fbd67e13c24bd25e0a32e50923d2d530ccc51622c1acd303ec9cbb6c0617537100e41d0ce", @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000120000,user_id=', @ANYRESDEC, @ANYBLOB=',grou', @ANYRESDEC=0x0, @ANYBLOB=',max_read=0x0000000000000006,allow_other,blksize=0x0000000000000c'], 0x1, 0x0, 0x0) r4 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) r5 = fcntl$dupfd(r4, 0x0, r4) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffc, 0x6, 0x0, @buffer={0x2, 0x41001, &(0x7f00000000c0)=""/81}, &(0x7f0000000380)="259374c96ee3", 0x0, 0x0, 0x0, 0x0, 0x0}) setitimer(0x2, &(0x7f0000000000)={{0x77359400}, {0x77359400}}, 0x0) getitimer(0x2, &(0x7f0000000400)) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84042, 0x0) r7 = syz_open_dev$loop(&(0x7f0000000080), 0x47ffffa, 0x122c42) ioctl$LOOP_CONFIGURE(r7, 0x4c0a, &(0x7f0000001ac0)={r6, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1c, "ff9f020bbe82b398b1c4369d03740250ceaac594b1b3d741dd17c1ac0d38ef2a565ef1e8336300", "a9103939c787a16c1ca43f80026d1f3c4da06963dd89d130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b7e7772fd29f35239d2", "24431a1e77a68e174f000000000000000010e200", [0xfffffffffffffffe]}}) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1b, &(0x7f0000002140)={0x1, &(0x7f0000000200)=[{0x6}]}) 1.450506537s ago: executing program 2 (id=2402): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="fff586dd0500560008005400000060ec970001983a00fe800000000000000000000000000700ff02000000000500000000000000000180"], 0xfdef) 1.131589426s ago: executing program 4 (id=2403): ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xffffffffffffffff}}, './file0\x00'}) (async, rerun: 32) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000040)=0x0) (rerun: 32) write$P9_RGETLOCK(r1, &(0x7f0000000080)={0x22, 0x37, 0x0, {0x2, 0x1, 0x3, r2, 0x4, '$^\\#'}}, 0x22) ioctl$KVM_RUN(r1, 0xae80, 0x0) (async) pipe2$9p(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSETATTR(r3, &(0x7f0000000100)={0x7, 0x1b, 0x2}, 0x7) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000140), 0x235, 0x4}}, 0x20) (async, rerun: 32) r4 = getpid() (rerun: 32) sched_setattr(r4, &(0x7f00000001c0)={0x38, 0x0, 0x10000004, 0x7, 0x3, 0x9, 0xfffffffffffffff9, 0x1, 0x4, 0xfffffffe}, 0x0) (async) ioctl$DRM_IOCTL_GET_STATS(r1, 0x80f86406, &(0x7f0000000200)=""/39) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000340)={&(0x7f0000000240)=[0x0], &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000002c0)=[0x0, 0x0, 0x0], &(0x7f0000000300)=[0x0, 0x0], 0x1, 0x7, 0x3, 0x2}) (async) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000480)={&(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000003c0)=[0x0], &(0x7f0000000400)=[0x0, 0x0, 0x0], &(0x7f0000000440)=[0x0, 0x0, 0x0], 0x5, 0x1, 0x3, 0x3}) (async) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f00000005c0)={&(0x7f00000004c0)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000500)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000540)=[0x0], &(0x7f0000000580)=[0x0, 0x0, 0x0], 0x5, 0x7, 0x1, 0x3}) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000700)={&(0x7f0000000600)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000640)=[0x0, 0x0, 0x0], &(0x7f0000000680)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000006c0)=[0x0], 0x4, 0x3, 0x6, 0x1}) (rerun: 32) ioctl$DRM_IOCTL_MODE_GET_LEASE(r0, 0xc01064c8, &(0x7f00000007c0)={0x6, 0x0, &(0x7f0000000780)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) (async) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000800)=[0x0]}) ioctl$DRM_IOCTL_MODE_SETCRTC(r1, 0xc06864a2, &(0x7f0000000880)={&(0x7f0000000740)=[r6, r9, r11, 0x0, 0x0, r15], 0x6, r19, r22, 0x101, 0x8, 0x9, 0x9, {0xffffffff, 0x100, 0x5, 0x2, 0x4, 0x200, 0x9, 0x40, 0xfc9, 0x401, 0x0, 0x3ff, 0x80, 0x62, "dbdf8592a88ba5debaca4fc0d24b2ef34da6670e53e2acb3efbdf2d924a7e011"}}) (async) ioctl$DRM_IOCTL_MODE_GETENCODER(r1, 0xc01464a6, &(0x7f0000000900)={r18, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r1, 0xc02064b9, &(0x7f0000000a80)={&(0x7f00000009c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000a00)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xa, r16}) (async) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r1, 0xc02064b9, &(0x7f0000000b40)={&(0x7f0000000ac0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000b00)=[0x0], 0x6, r12, 0xb0b0b0b0}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000c00)={0x300, 0x5, &(0x7f0000000940)=[r10, r23, r14, r13, r5], &(0x7f0000000980)=[0xff, 0x6, 0x3, 0x93ee9dc7, 0x1, 0x8, 0x2, 0x9], &(0x7f0000000b80)=[r25, r20, r17, r29, r17, r20, r17, r7, r21], &(0x7f0000000bc0)=[0x8, 0x7, 0x2], 0x0, 0x2}) (async) ioctl$DRM_IOCTL_GET_CLIENT(r1, 0xc0286405, &(0x7f0000000c80)={0xfffffc01, 0x80, {r4}, {0xee01}, 0x7f, 0x924d}) sendmsg$DEVLINK_CMD_RELOAD(0xffffffffffffffff, &(0x7f0000000d40)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000d00)={&(0x7f0000000cc0)={0x38, 0x0, 0x200, 0x70bd2a, 0x25dfdbfb, {}, [{@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r30}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8000}, 0x10008000) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000e80)={0x0, 0x1, &(0x7f0000000d80)=[r8], &(0x7f0000000dc0)=[0xfffffff8, 0x5, 0xd], &(0x7f0000000e00)=[r24, r26, r19, r27, r24, r28, 0x0, r18, r20], &(0x7f0000000e40)=[0x80000001, 0xffff, 0xc], 0x0, 0x4}) socket$unix(0x1, 0x2, 0x0) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000f00)={0x7, &(0x7f0000000ec0)=[{0x0, 0x3, 0x9, 0xfffffffc}, {0x8, 0x16, 0x4, 0x1ff}, {0x7, 0x10, 0x4, 0x5}, {0x2, 0x7f, 0x0, 0x8}, {0x1, 0x6, 0x90, 0x4}, {0x2, 0x3, 0x4, 0x4}, {0x8, 0x2, 0x2, 0x8}]}) (async) socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000f40)=0x4) (async, rerun: 64) r31 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) (rerun: 64) ioctl$INCFS_IOC_READ_FILE_SIGNATURE(r31, 0x8010671f, &(0x7f0000001040)={&(0x7f0000000f80)=""/179, 0xb3}) 1.06351196s ago: executing program 0 (id=2404): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@updpolicy={0x1fc, 0x19, 0x1, 0x0, 0x25dfdbfb, {{@in=@multicast1, @in=@remote, 0x4e22, 0xb, 0xffff, 0x0, 0xa, 0x80, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0xc}, {0x6, 0x0, 0x80}}, [@tmpl={0x144, 0x5, [{{@in=@multicast2, 0x0, 0x3c}, 0x0, @in=@broadcast, 0x34ff, 0x0, 0x2, 0x0, 0x548, 0x0, 0x6000000}, {{@in=@local, 0x0, 0x3c}, 0xa, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x2, 0x0, 0x0, 0x0, 0x800, 0x800, 0xfffffffc}, {{@in6=@empty, 0x0, 0x32}, 0x0, @in=@loopback, 0x3503, 0x3, 0x0, 0x0, 0x4, 0x200}, {{@in6=@dev={0xfe, 0x80, '\x00', 0x2f}, 0x0, 0x33}, 0x0, @in=@empty, 0x3504, 0x0, 0x0, 0x1, 0x0, 0xabf, 0x1000000}, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x20000, 0x33}, 0x0, @in6=@dev={0xfe, 0x80, '\x00', 0xf}, 0x0, 0x4, 0x2, 0x0, 0x1}]}]}, 0x1fc}}, 0x0) 692.435322ms ago: executing program 4 (id=2405): dup(0xffffffffffffffff) syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100)=0xc6, 0x4) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f0000000040)=0x2, 0x4) bind$inet6(r0, &(0x7f0000000200)={0xa, 0xe22, 0x0, @empty}, 0x1c) syz_emit_ethernet(0xd2, &(0x7f0000000080)=ANY=[@ANYBLOB="ffffffffbfff00000000000086dd600489f1009c1100fc010000000000000025030000000000ff02000000000000002000000000000100000e22"], 0x0) 687.411813ms ago: executing program 0 (id=2406): syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000680)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, 0x0, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) unshare(0x2040600) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_EDITDEST(r0, 0x0, 0x489, &(0x7f0000000380)={{0x84, @multicast1, 0x4e20, 0x3, 'sh\x00', 0x0, 0x60000000, 0xc}, {@rand_addr=0x64010102, 0x4e26, 0x3, 0x0, 0x8001, 0x1}}, 0x44) 495.875428ms ago: executing program 2 (id=2407): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8) sendto$inet6(r0, 0x0, 0x0, 0x4c881, &(0x7f0000000540)={0xa, 0x4e24, 0x10, @mcast2}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000001480)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000580)='B', 0x1}], 0x1}}], 0x1, 0x400c404) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x5, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(r1, 0x0, 0x0, 0x13, 0x3) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x1}, 0x2) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) socket(0x2b, 0x80801, 0x1) r3 = syz_io_uring_setup(0x49a, &(0x7f0000000400)={0x0, 0x79af, 0x3180, 0x8000, 0x40024e}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000002c00)=@IORING_OP_TIMEOUT={0xb, 0x11, 0x0, 0x0, 0x7, &(0x7f0000000100), 0x1, 0x40, 0x1}) io_uring_enter(r3, 0x627, 0xc1040000, 0x43, 0x0, 0x0) 420.505219ms ago: executing program 4 (id=2408): ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x38100, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x2, 0xfffffdffffffffff, 0xfa11, 0xffffffff}, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r2 = io_uring_setup(0x2d29, 0x0) io_uring_register$IORING_REGISTER_FILES2(r2, 0xd, 0x0, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, 0x0) read$eventfd(r3, &(0x7f0000000080), 0x8) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x800000, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000000140), 0x8, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = getpgid(0x0) sched_setattr(r7, &(0x7f0000000280)={0x38, 0x3, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa0d, 0x7fff}, 0x0) r8 = syz_open_dev$vim2m(&(0x7f0000000000), 0x1, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r8, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) 0s ago: executing program 0 (id=2409): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b40500000000010271107900000000001e000000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000080), 0xfffffffffffffffb}, 0x48) kernel console output (not intermixed with test programs): an invalid bInterval 52, changing to 9 [ 607.478663][ T9] cdc_wdm 4-1:1.0: skipping garbage [ 607.504061][T10907] plantronics 0003:047F:FFFF.0018: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 607.530137][ T9] cdc_wdm 4-1:1.0: skipping garbage [ 607.535509][ T24] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 607.572937][ T9] cdc_wdm 4-1:1.0: cdc-wdm1: USB WDM device [ 607.589211][ T9] cdc_wdm 4-1:1.0: Unknown control protocol [ 607.601971][ T24] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 607.620073][ T24] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 607.680671][ T24] usb 3-1: Product: syz [ 607.697056][ T9] usb 1-1: USB disconnect, device number 53 [ 607.699623][ T24] usb 3-1: Manufacturer: syz [ 607.719371][T12501] capability: warning: `syz.4.1823' uses deprecated v2 capabilities in a way that may be insecure [ 607.743062][ T24] cdc_wdm 3-1:1.0: skipping garbage [ 607.748341][ T24] cdc_wdm 3-1:1.0: skipping garbage [ 607.757662][T12499] fido_id[12499]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/1-1/report_descriptor': No such file or directory [ 607.769434][ T24] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 607.812980][ T24] cdc_wdm 3-1:1.0: Unknown control protocol [ 608.086223][T12512] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1820'. [ 609.032722][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 609.039390][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 609.045695][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 609.052316][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 609.059083][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 609.065700][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 609.072296][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 609.078941][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 609.086136][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 609.092795][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 609.099171][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 609.105882][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 609.112275][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 609.118878][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 609.125149][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 609.131757][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 609.138115][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 609.144741][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 609.151071][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 609.157687][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 609.164096][ T5903] usb 3-1: USB disconnect, device number 56 [ 609.170270][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 609.291911][ T24] usb 1-1: new high-speed USB device number 54 using dummy_hcd [ 609.456910][ T24] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 609.475394][T12521] FAULT_INJECTION: forcing a failure. [ 609.475394][T12521] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 609.499423][ T24] usb 1-1: config 0 has no interface number 0 [ 609.515967][T12521] CPU: 0 UID: 0 PID: 12521 Comm: syz.1.1828 Not tainted syzkaller #0 PREEMPT(full) [ 609.515999][T12521] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 609.516012][T12521] Call Trace: [ 609.516022][T12521] [ 609.516032][T12521] dump_stack_lvl+0x189/0x250 [ 609.516063][T12521] ? __pfx____ratelimit+0x10/0x10 [ 609.516089][T12521] ? __pfx_dump_stack_lvl+0x10/0x10 [ 609.516116][T12521] ? __pfx__printk+0x10/0x10 [ 609.516162][T12521] should_fail_ex+0x414/0x560 [ 609.516199][T12521] _copy_to_user+0x31/0xb0 [ 609.516229][T12521] simple_read_from_buffer+0xe1/0x170 [ 609.516269][T12521] proc_fail_nth_read+0x1b3/0x220 [ 609.516311][T12521] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 609.516343][T12521] ? rw_verify_area+0x2a6/0x4d0 [ 609.516373][T12521] ? __lock_acquire+0xab9/0xd20 [ 609.516396][T12521] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 609.516426][T12521] vfs_read+0x1fd/0xa30 [ 609.516457][T12521] ? fdget_pos+0x247/0x320 [ 609.516483][T12521] ? __pfx___mutex_lock+0x10/0x10 [ 609.516512][T12521] ? __pfx_vfs_read+0x10/0x10 [ 609.516545][T12521] ? __fget_files+0x2a/0x420 [ 609.516571][T12521] ? __fget_files+0x3a0/0x420 [ 609.516592][T12521] ? __fget_files+0x2a/0x420 [ 609.516623][T12521] ksys_read+0x145/0x250 [ 609.516658][T12521] ? __pfx_ksys_read+0x10/0x10 [ 609.516686][T12521] ? rcu_is_watching+0x15/0xb0 [ 609.516720][T12521] ? do_syscall_64+0xbe/0x3b0 [ 609.516752][T12521] do_syscall_64+0xfa/0x3b0 [ 609.516778][T12521] ? lockdep_hardirqs_on+0x9c/0x150 [ 609.516804][T12521] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 609.516826][T12521] ? clear_bhb_loop+0x60/0xb0 [ 609.516852][T12521] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 609.516873][T12521] RIP: 0033:0x7fefb138d8dc [ 609.516892][T12521] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 609.516912][T12521] RSP: 002b:00007fefb2255030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 609.516935][T12521] RAX: ffffffffffffffda RBX: 00007fefb15e5fa0 RCX: 00007fefb138d8dc [ 609.516951][T12521] RDX: 000000000000000f RSI: 00007fefb22550a0 RDI: 0000000000000005 [ 609.516965][T12521] RBP: 00007fefb2255090 R08: 0000000000000000 R09: 0000000000000000 [ 609.516979][T12521] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 609.516992][T12521] R13: 00007fefb15e6038 R14: 00007fefb15e5fa0 R15: 00007fefb170fa28 [ 609.517028][T12521] [ 609.534491][ T24] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 609.844249][ T24] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 609.846145][ T5903] usb 4-1: USB disconnect, device number 53 [ 609.854657][ T24] usb 1-1: New USB device found, idVendor=04d9, idProduct=a055, bcdDevice= 0.18 [ 609.869722][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 609.975050][ T24] usb 1-1: config 0 descriptor?? [ 610.025960][T12527] loop2: detected capacity change from 0 to 7 [ 610.064757][T12527] Dev loop2: unable to read RDB block 7 [ 610.070881][T12527] loop2: AHDI p2 p3 [ 610.078357][T12527] loop2: partition table partially beyond EOD, truncated [ 610.146695][T12527] loop2: p2 start 13841266 is beyond EOD, truncated [ 610.187343][T12532] netlink: 'syz.1.1830': attribute type 1 has an invalid length. [ 610.336130][T12533] bond7: (slave vxcan3): The slave device specified does not support setting the MAC address [ 610.351231][T12533] bond7: (slave vxcan3): Error -95 calling set_mac_address [ 610.556775][T12535] macvlan2: entered promiscuous mode [ 610.562787][T12535] macvlan2: entered allmulticast mode [ 610.580679][T12535] bond7: entered promiscuous mode [ 610.587411][T12535] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 610.665106][T12519] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 610.680452][T12519] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 610.698779][ T24] usbhid 1-1:0.1: can't add hid device: -71 [ 610.739662][ T24] usbhid 1-1:0.1: probe with driver usbhid failed with error -71 [ 610.786648][ T24] usb 1-1: USB disconnect, device number 54 [ 610.840267][T12535] bond7: left promiscuous mode [ 611.920154][ T5924] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 612.084817][ T5924] usb 4-1: Using ep0 maxpacket: 8 [ 612.098074][ T5924] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 612.113377][ T5924] usb 4-1: New USB device found, idVendor=2833, idProduct=0201, bcdDevice=2a.d5 [ 612.131538][ T5924] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 612.202241][ T5924] usb 4-1: config 0 descriptor?? [ 612.212931][ T5924] uvcvideo 4-1:0.0: probe with driver uvcvideo failed with error -22 [ 612.416113][ T5924] usb 4-1: USB disconnect, device number 54 [ 613.138586][T12574] netlink: 132 bytes leftover after parsing attributes in process `syz.4.1846'. [ 613.370395][T12580] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1845'. [ 613.434578][T12580] netlink: 'syz.0.1845': attribute type 30 has an invalid length. [ 613.473683][ T6038] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 613.500150][ T6038] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 613.519815][ T6038] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 613.540625][ T1027] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 613.738373][T12586] netlink: 'syz.1.1849': attribute type 1 has an invalid length. [ 613.982662][T12586] bond8: (slave geneve2): making interface the new active one [ 613.987910][T12596] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1852'. [ 613.999787][T12596] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1852'. [ 614.119628][T12600] hub 9-0:1.0: USB hub found [ 614.125444][T12600] hub 9-0:1.0: 1 port detected [ 614.161098][T12586] bond8: (slave geneve2): Enslaving as an active interface with an up link [ 614.170906][T12599] loop2: detected capacity change from 0 to 7 [ 614.182630][T12599] Dev loop2: unable to read RDB block 7 [ 614.189808][ T1027] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 614.202384][ T1027] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 614.212101][ T1027] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 614.225744][T12599] loop2: AHDI p2 p3 [ 614.242738][T12598] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 614.259006][T12598] team0: Port device batadv2 added [ 614.286005][T12599] loop2: partition table partially beyond EOD, truncated [ 614.313888][T12599] loop2: p2 start 13841266 is beyond EOD, truncated [ 615.089007][ T5924] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 615.160256][ T5903] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 615.262780][ T5924] usb 3-1: Using ep0 maxpacket: 16 [ 615.270438][ T5924] usb 3-1: config 0 has an invalid interface number: 68 but max is 0 [ 615.281277][ T5924] usb 3-1: config 0 has no interface number 0 [ 615.335798][ T5924] usb 3-1: config 0 interface 68 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 615.348189][ T5903] usb 2-1: Using ep0 maxpacket: 32 [ 615.367375][ T5924] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=dc.c4 [ 615.378392][ T5924] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 615.387687][ T5924] usb 3-1: Product: syz [ 615.403823][ T5903] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 615.414260][ T5924] usb 3-1: Manufacturer: syz [ 615.424807][ T5903] usb 2-1: config 0 has no interface number 0 [ 615.431240][ T5924] usb 3-1: SerialNumber: syz [ 615.445528][ T5903] usb 2-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 615.455814][ T5924] usb 3-1: config 0 descriptor?? [ 615.541348][ T5924] usb 3-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 615.551959][ T5903] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 615.560418][ T5903] usb 2-1: Product: syz [ 615.578844][ T5903] usb 2-1: Manufacturer: syz [ 615.596234][ T5903] usb 2-1: SerialNumber: syz [ 615.615285][ T5903] usb 2-1: config 0 descriptor?? [ 615.635396][ T5903] usb 2-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 615.658484][ T5903] usb 2-1: selecting invalid altsetting 1 [ 615.686540][ T67] usb 3-1: Failed to submit usb control message: -71 [ 615.687887][ T5924] usb 3-1: USB disconnect, device number 57 [ 615.711683][ T5903] usb 2-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 615.780520][ T67] usb 3-1: unable to send the bmi data to the device: -71 [ 615.788053][ T67] usb 3-1: unable to get target info from device [ 615.789555][ T5903] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 615.810549][ T67] usb 3-1: could not get target info (-71) [ 615.817532][ T5903] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 615.843881][ T67] usb 3-1: could not probe fw (-71) [ 615.890591][ T5903] usb 2-1: media controller created [ 615.915317][T12623] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 615.935514][T12623] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 615.986382][ T5903] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 616.035831][T12626] binder: 12625:12626 ioctl c0306201 200000000300 returned -14 [ 616.748367][T12642] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 616.884361][T12652] netlink: 'syz.1.1868': attribute type 1 has an invalid length. [ 617.234262][T12647] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 617.272304][ T5903] usb 2-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 617.298006][ T5903] zl10353_read_register: readreg error (reg=127, ret==-110) [ 617.404595][T12648] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 617.809278][T12655] bond9: (slave vxcan3): The slave device specified does not support setting the MAC address [ 617.833337][T12655] bond9: (slave vxcan3): Error -95 calling set_mac_address [ 618.177309][T12654] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 618.210906][T12661] macvlan2: entered promiscuous mode [ 618.216264][T12661] macvlan2: entered allmulticast mode [ 618.223938][T12661] bond9: entered promiscuous mode [ 618.230546][T12661] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 618.382418][T12661] bond9: left promiscuous mode [ 619.449776][T12680] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 619.568940][T12681] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 619.717025][T12683] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1876'. [ 619.787066][T12683] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1876'. [ 620.610522][ T1778] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 620.960961][T12702] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1881'. [ 620.969993][ T1778] usb 4-1: Using ep0 maxpacket: 8 [ 620.982219][ T1778] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 620.998165][ T1778] usb 4-1: config 179 has an invalid descriptor of length 253, skipping remainder of the config [ 621.034469][ T1778] usb 4-1: config 179 has no interface number 0 [ 621.065372][ T1778] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 621.123728][ T1778] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 621.149408][ T1778] usb 4-1: config 179 interface 65 altsetting 12 has 1 endpoint descriptor, different from the interface descriptor's value: 7 [ 621.257092][ T1778] usb 4-1: config 179 interface 65 has no altsetting 0 [ 621.281659][ T1778] usb 4-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 621.388236][ T1778] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 621.525787][ T9] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 621.693279][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 621.704988][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 621.717117][ T9] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 621.770284][ T24] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 621.781037][ T9] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 621.802142][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 621.840593][ T9] usb 1-1: config 0 descriptor?? [ 621.868586][T10907] usb 4-1: USB disconnect, device number 55 [ 621.954318][ T24] usb 3-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 621.970384][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 622.005176][ T24] usb 3-1: Product: syz [ 622.009405][ T24] usb 3-1: Manufacturer: syz [ 622.020123][ T24] usb 3-1: SerialNumber: syz [ 622.277700][ T9] plantronics 0003:047F:FFFF.0019: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 622.449718][ T24] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 622.497932][ T24] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 622.513277][ T9] usb 1-1: USB disconnect, device number 55 [ 622.541230][ T24] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 622.611425][ T24] lan78xx 3-1:1.0: probe with driver lan78xx failed with error -71 [ 622.682971][ T24] usb 3-1: USB disconnect, device number 58 [ 622.962781][T12734] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1889'. [ 623.223615][ T9] usb 5-1: new low-speed USB device number 52 using dummy_hcd [ 623.318048][T12743] bridge_slave_1: left allmulticast mode [ 623.323951][T12743] bridge_slave_1: left promiscuous mode [ 623.330336][T12743] bridge0: port 2(bridge_slave_1) entered disabled state [ 623.480594][ T9] usb 5-1: Invalid ep0 maxpacket: 16 [ 623.488238][T12743] bond0: (slave bond_slave_0): Releasing backup interface [ 623.555897][T12743] bond0: (slave bond_slave_1): Releasing backup interface [ 623.600733][T12746] fuse: Bad value for 'fd' [ 623.642283][T12746] loop6: detected capacity change from 0 to 524288000 [ 623.758848][T12743] team0: Port device team_slave_0 removed [ 623.795989][ T9] usb 5-1: new low-speed USB device number 53 using dummy_hcd [ 623.914731][T12743] team0: Port device team_slave_1 removed [ 623.929649][T12743] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 623.947521][T12743] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 623.963153][T12743] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 623.971934][T12743] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 624.020025][ T9] usb 5-1: Invalid ep0 maxpacket: 16 [ 624.028173][T12743] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 624.044634][ T9] usb usb5-port1: attempt power cycle [ 624.410168][ T9] usb 5-1: new low-speed USB device number 54 using dummy_hcd [ 624.494491][ T9] usb 5-1: Invalid ep0 maxpacket: 16 [ 624.594654][T12750] fuse: Bad value for 'fd' [ 624.730415][ T9] usb 5-1: new low-speed USB device number 55 using dummy_hcd [ 624.812944][ T9] usb 5-1: Invalid ep0 maxpacket: 16 [ 624.883477][ T9] usb usb5-port1: unable to enumerate USB device [ 625.292015][T12756] fuse: Bad value for 'fd' [ 625.325363][T12756] loop6: detected capacity change from 0 to 524288000 [ 625.481095][T12759] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1896'. [ 625.540121][T12759] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1896'. [ 625.761565][T12766] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1898'. [ 626.015465][T12768] tipc: Enabled bearer , priority 0 [ 626.415995][T12775] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1901'. [ 627.148772][T10907] tipc: Node number set to 2681383616 [ 627.349458][ T30] kauditd_printk_skb: 8 callbacks suppressed [ 627.349477][ T30] audit: type=1326 audit(1759831600.674:266): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12788 comm="syz.2.1905" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f015118eec9 code=0x7ffc0000 [ 627.447655][T12791] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1904'. [ 627.610010][ T30] audit: type=1326 audit(1759831600.674:267): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12788 comm="syz.2.1905" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7f015118eec9 code=0x7ffc0000 [ 627.665870][ T30] audit: type=1326 audit(1759831600.674:268): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12788 comm="syz.2.1905" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f015118eec9 code=0x7ffc0000 [ 627.842854][ T30] audit: type=1326 audit(1759831600.674:269): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12788 comm="syz.2.1905" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f015118eec9 code=0x7ffc0000 [ 627.917829][ T30] audit: type=1326 audit(1759831600.674:270): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12788 comm="syz.2.1905" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f015118eec9 code=0x7ffc0000 [ 628.430116][ T30] audit: type=1326 audit(1759831600.674:271): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12788 comm="syz.2.1905" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f015118eec9 code=0x7ffc0000 [ 628.572825][ T30] audit: type=1326 audit(1759831600.674:272): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12788 comm="syz.2.1905" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f015118eec9 code=0x7ffc0000 [ 628.650094][ T30] audit: type=1326 audit(1759831600.674:273): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12788 comm="syz.2.1905" exe="/root/syz-executor" sig=0 arch=c000003e syscall=190 compat=0 ip=0x7f015118eec9 code=0x7ffc0000 [ 628.672921][ T30] audit: type=1326 audit(1759831600.674:274): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12788 comm="syz.2.1905" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f015118eec9 code=0x7ffc0000 [ 628.700027][ T30] audit: type=1326 audit(1759831600.674:275): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12788 comm="syz.2.1905" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f015118eec9 code=0x7ffc0000 [ 629.832883][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 629.840072][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 630.099611][T12826] warning: `syz.4.1914' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 630.117981][T12826] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1914'. [ 630.176106][ T9] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 630.240208][ T1778] usb 1-1: new high-speed USB device number 56 using dummy_hcd [ 630.389988][ T9] usb 3-1: Using ep0 maxpacket: 8 [ 630.398451][ T1778] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 630.409048][ T9] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 630.423743][ T1778] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 630.454368][ T9] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 630.465501][T12828] netlink: 'syz.1.1915': attribute type 29 has an invalid length. [ 630.486825][T12828] netlink: 'syz.1.1915': attribute type 29 has an invalid length. [ 630.494971][ T1778] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 630.495038][ T1778] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 630.495069][ T1778] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 630.495246][ T9] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 61728, setting to 1024 [ 630.647934][T12828] netlink: 500 bytes leftover after parsing attributes in process `syz.1.1915'. [ 630.670071][ T1778] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 630.679345][ T1778] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 630.703437][ T1778] usb 1-1: Product: syz [ 630.719953][ T1778] usb 1-1: Manufacturer: syz [ 630.815914][ T1778] cdc_wdm 1-1:1.0: skipping garbage [ 630.821302][ T9] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 630.840265][ T1778] cdc_wdm 1-1:1.0: skipping garbage [ 630.847359][ T1778] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 630.856265][ T9] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 630.869794][ T1778] cdc_wdm 1-1:1.0: Unknown control protocol [ 630.878413][ T9] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 630.890760][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 631.649035][T12841] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 631.697411][T12841] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 632.158201][T12846] netlink: 'syz.4.1920': attribute type 1 has an invalid length. [ 632.334333][T12849] bond5: (slave vxcan3): The slave device specified does not support setting the MAC address [ 632.350336][T12849] bond5: (slave vxcan3): Error -95 calling set_mac_address [ 633.370401][ T9] usb 3-1: usb_control_msg returned -71 [ 633.410186][ T9] usbtmc 3-1:16.0: can't read capabilities [ 633.477361][T12846] macvlan2: entered promiscuous mode [ 633.483095][T12846] macvlan2: entered allmulticast mode [ 633.491307][T12846] bond5: entered promiscuous mode [ 633.498694][T12846] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 633.555061][T12846] bond5: left promiscuous mode [ 633.578236][ T9] usb 3-1: USB disconnect, device number 59 [ 633.600046][T10907] usb 1-1: USB disconnect, device number 56 [ 633.773663][T12857] netlink: 'syz.0.1921': attribute type 11 has an invalid length. [ 634.174059][T12862] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1923'. [ 634.786019][T12879] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 634.940590][T12881] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 635.091221][T12882] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1928'. [ 635.158967][T12885] bond0: Removing last ns target with arp_interval on [ 636.990045][ T9] usb 5-1: new high-speed USB device number 56 using dummy_hcd [ 637.150141][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 637.195184][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 637.228488][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 637.238685][ T9] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 637.288747][ T9] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 637.343671][T12921] tipc: Resetting bearer [ 637.457836][T12921] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 637.474002][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 637.485395][ T9] usb 5-1: config 0 descriptor?? [ 638.530555][ T9] input: HID 045e:07da as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:045E:07DA.001A/input/input37 [ 638.585043][ T9] microsoft 0003:045E:07DA.001A: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.4-1/input0 [ 638.862081][T12949] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1948'. [ 640.564358][T12972] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 640.615341][T12972] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 641.409524][ T9] usb 5-1: USB disconnect, device number 56 [ 641.681033][T12996] netlink: 'syz.4.1965': attribute type 11 has an invalid length. [ 641.745848][ T1778] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 641.927468][ T1778] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 641.949369][ T1778] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 641.997461][ T1778] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 642.029480][ T1778] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 642.041620][ T1778] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 642.055769][ T1778] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 642.077623][ T1778] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 642.095165][ T1778] usb 3-1: Product: syz [ 642.100388][ T1778] usb 3-1: Manufacturer: syz [ 642.112597][ T1778] cdc_wdm 3-1:1.0: skipping garbage [ 642.117860][ T1778] cdc_wdm 3-1:1.0: skipping garbage [ 642.125817][ T1778] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 642.132802][ T1778] cdc_wdm 3-1:1.0: Unknown control protocol [ 642.190076][ T5824] usb 1-1: new high-speed USB device number 57 using dummy_hcd [ 642.362505][ T5824] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 642.426872][ T5824] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 642.486752][ T5824] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 642.527807][ T5824] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 642.580152][ T24] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 642.594866][ T5824] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 642.651319][ T5824] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 642.702462][T13017] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 642.720068][ T5824] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 642.725000][T13017] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 642.736387][ T5824] usb 1-1: Product: syz [ 642.751158][ T5824] usb 1-1: Manufacturer: syz [ 642.776929][ T5824] cdc_wdm 1-1:1.0: skipping garbage [ 642.798903][ T5824] cdc_wdm 1-1:1.0: skipping garbage [ 642.821815][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 642.833000][ T5824] cdc_wdm 1-1:1.0: cdc-wdm1: USB WDM device [ 642.838987][ T5824] cdc_wdm 1-1:1.0: Unknown control protocol [ 642.846880][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 642.878372][ T24] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 642.892079][ T24] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 642.901667][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 642.958450][ T24] usb 4-1: config 0 descriptor?? [ 643.330322][ T9] usb 5-1: new high-speed USB device number 57 using dummy_hcd [ 643.401216][ T24] plantronics 0003:047F:FFFF.001B: hiddev2,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 643.502106][ T9] usb 5-1: no configurations [ 643.511561][ T9] usb 5-1: can't read configurations, error -22 [ 643.645511][ T1778] usb 4-1: USB disconnect, device number 56 [ 643.657613][ T9] usb 5-1: new high-speed USB device number 58 using dummy_hcd [ 643.821579][ T9] usb 5-1: no configurations [ 643.826265][ T9] usb 5-1: can't read configurations, error -22 [ 643.833687][ T9] usb usb5-port1: attempt power cycle [ 644.200186][ T9] usb 5-1: new high-speed USB device number 59 using dummy_hcd [ 644.322036][ T9] usb 5-1: no configurations [ 644.327030][ T9] usb 5-1: can't read configurations, error -22 [ 644.460059][ T9] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 644.525292][ T9] usb 5-1: no configurations [ 644.530769][ T9] usb 5-1: can't read configurations, error -22 [ 644.539284][ T9] usb usb5-port1: unable to enumerate USB device [ 644.709986][ T1778] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 644.751338][ C1] wdm_int_callback: 1 callbacks suppressed [ 644.751364][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 644.751981][ T9] usb 3-1: USB disconnect, device number 60 [ 644.757235][ C1] wdm_int_callback: 1 callbacks suppressed [ 644.757255][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 644.781628][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 644.870063][ T1778] usb 4-1: Using ep0 maxpacket: 8 [ 644.897460][ T1778] usb 4-1: config 132 has an invalid interface number: 61 but max is 2 [ 644.916476][ T1778] usb 4-1: config 132 has an invalid interface number: 227 but max is 2 [ 644.952249][ T1778] usb 4-1: config 132 has an invalid interface number: 18 but max is 2 [ 644.968636][ T5824] usb 1-1: USB disconnect, device number 57 [ 644.993265][ T1778] usb 4-1: config 132 contains an unexpected descriptor of type 0x2, skipping [ 645.010176][ T1778] usb 4-1: config 132 has an invalid interface number: 212 but max is 2 [ 645.051363][ T1778] usb 4-1: config 132 has 4 interfaces, different from the descriptor's value: 3 [ 645.110161][ T1778] usb 4-1: config 132 has no interface number 0 [ 645.135835][ T1778] usb 4-1: config 132 has no interface number 1 [ 645.168610][ T1778] usb 4-1: config 132 has no interface number 2 [ 645.234346][ T1778] usb 4-1: config 132 has no interface number 3 [ 645.262601][ T1778] usb 4-1: config 132 interface 61 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 645.291417][T13044] loop2: detected capacity change from 0 to 7 [ 645.297744][ T1778] usb 4-1: too many endpoints for config 132 interface 227 altsetting 101: 253, using maximum allowed: 30 [ 645.311567][T13044] Dev loop2: unable to read RDB block 7 [ 645.317327][T13044] loop2: AHDI p2 p3 [ 645.323664][ T1778] usb 4-1: config 132 interface 227 altsetting 101 endpoint 0xB has invalid maxpacket 512, setting to 64 [ 645.354121][T13044] loop2: partition table partially beyond EOD, truncated [ 645.373922][T13044] loop2: p2 start 13841266 is beyond EOD, truncated [ 645.375959][ T1778] usb 4-1: config 132 interface 227 altsetting 101 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 645.415764][T13046] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1981'. [ 645.483401][ T1778] usb 4-1: config 132 interface 18 altsetting 68 endpoint 0x7 has invalid maxpacket 512, setting to 64 [ 645.496102][ T1778] usb 4-1: config 132 interface 18 altsetting 68 has a duplicate endpoint with address 0x7, skipping [ 645.514251][ T1778] usb 4-1: config 132 interface 18 altsetting 68 endpoint 0x1 has invalid maxpacket 1023, setting to 64 [ 645.525954][ T1778] usb 4-1: config 132 interface 18 altsetting 68 has a duplicate endpoint with address 0xC, skipping [ 645.742513][ T1778] usb 4-1: config 132 interface 18 altsetting 68 has an invalid descriptor for endpoint zero, skipping [ 645.784471][ T1778] usb 4-1: config 132 interface 61 has no altsetting 0 [ 645.833744][ T1778] usb 4-1: config 132 interface 227 has no altsetting 0 [ 645.871163][ T1778] usb 4-1: config 132 interface 18 has no altsetting 0 [ 645.914541][ T1778] usb 4-1: config 132 interface 212 has no altsetting 0 [ 645.952319][ T1778] usb 4-1: New USB device found, idVendor=03eb, idProduct=7603, bcdDevice=c4.c9 [ 645.964684][ T1778] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 646.013426][ T1778] usb 4-1: Product: Є [ 646.024588][ T1778] usb 4-1: Manufacturer: ॕ쟿 [ 646.040315][ T1778] usb 4-1: SerialNumber: syz [ 646.490810][T13034] syz.3.1978 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 646.503594][T13034] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1978'. [ 646.512885][T13034] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1978'. [ 647.290532][ T1778] hub 4-1:132.61: Invalid hub with more than one config or interface [ 647.329470][ T1778] hub 4-1:132.61: probe with driver hub failed with error -22 [ 647.468450][T13067] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1989'. [ 647.529684][ T1778] usb 4-1: USB disconnect, device number 57 [ 647.560060][ T5824] usb 5-1: new high-speed USB device number 61 using dummy_hcd [ 647.739991][ T5824] usb 5-1: Using ep0 maxpacket: 16 [ 647.766680][ T5824] usb 5-1: config 8 has an invalid interface number: 206 but max is 0 [ 647.780755][ T5824] usb 5-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 647.826227][ T5824] usb 5-1: config 8 has no interface number 0 [ 647.859021][ T5824] usb 5-1: config 8 interface 206 altsetting 1 has an endpoint descriptor with address 0xF7, changing to 0x87 [ 647.895492][ T5824] usb 5-1: config 8 interface 206 altsetting 1 endpoint 0x87 has invalid maxpacket 33058, setting to 1024 [ 647.943135][ T5824] usb 5-1: config 8 interface 206 altsetting 1 endpoint 0xC has invalid wMaxPacketSize 0 [ 647.993533][ T5824] usb 5-1: config 8 interface 206 altsetting 1 bulk endpoint 0xC has invalid maxpacket 0 [ 648.065624][ T5824] usb 5-1: config 8 interface 206 has no altsetting 0 [ 648.088879][T13073] binder: 13071:13073 ioctl c0306201 200000000300 returned -14 [ 648.108862][ T5824] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=35.bb [ 648.136259][ T5824] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 648.154735][ T5824] usb 5-1: Product: syz [ 648.164674][ T5824] usb 5-1: Manufacturer: syz [ 648.178456][ T5824] usb 5-1: SerialNumber: syz [ 648.511232][ T5824] garmin_gps 5-1:8.206: Garmin GPS usb/tty converter detected [ 648.530705][T13084] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1995'. [ 648.576751][ T5824] garmin_gps ttyUSB0: garmin_write_bulk - usb_submit_urb(write bulk) failed with status = -90 [ 648.601092][ T5824] garmin_gps ttyUSB0: probe with driver garmin_gps failed with error -90 [ 648.630254][ T5824] usb 5-1: USB disconnect, device number 61 [ 648.681787][ T5824] garmin_gps 5-1:8.206: device disconnected [ 648.774100][T13087] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 649.532091][T13096] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1997'. [ 652.190089][ T5958] usb 5-1: new high-speed USB device number 62 using dummy_hcd [ 653.510777][ T5824] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 653.659978][ T5824] usb 4-1: Using ep0 maxpacket: 32 [ 653.702823][ T5824] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 653.723881][ T5824] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 653.736806][ T5824] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 653.781740][ T5824] usb 4-1: Product: syz [ 653.786072][ T5824] usb 4-1: Manufacturer: syz [ 653.791886][ T5824] usb 4-1: SerialNumber: syz [ 653.811951][ T5824] usb 4-1: config 0 descriptor?? [ 653.820613][T13128] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 653.834563][ T5824] hub 4-1:0.0: bad descriptor, ignoring hub [ 653.843199][ T5824] hub 4-1:0.0: probe with driver hub failed with error -5 [ 655.077786][ T1778] raw-gadget.2 gadget.3: failed to queue suspend event [ 655.217283][T13128] raw-gadget.2 gadget.3: failed to queue resume event [ 655.289160][ T5924] raw-gadget.2 gadget.3: failed to queue suspend event [ 655.360031][T10907] usb 5-1: new high-speed USB device number 63 using dummy_hcd [ 655.370259][T13128] raw-gadget.2 gadget.3: failed to queue resume event [ 655.391301][ T5924] raw-gadget.2 gadget.3: failed to queue suspend event [ 655.404169][T13168] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 655.418878][T13168] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 655.490172][T13128] raw-gadget.2 gadget.3: failed to queue resume event [ 655.580708][T10907] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 655.590154][T10907] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 655.601189][T10907] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 655.611309][T10907] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 655.611336][ T5924] raw-gadget.2 gadget.3: failed to queue suspend event [ 655.653776][T10907] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 655.691320][T10907] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 655.700828][T10907] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 655.709029][T10907] usb 5-1: Product: syz [ 655.710413][T13128] raw-gadget.2 gadget.3: failed to queue resume event [ 655.714236][T10907] usb 5-1: Manufacturer: syz [ 655.739783][T10907] cdc_wdm 5-1:1.0: skipping garbage [ 655.745847][ T1778] raw-gadget.2 gadget.3: failed to queue suspend event [ 655.750257][T10907] cdc_wdm 5-1:1.0: skipping garbage [ 655.766553][T10907] cdc_wdm 5-1:1.0: cdc-wdm1: USB WDM device [ 655.777177][T10907] cdc_wdm 5-1:1.0: Unknown control protocol [ 655.830089][T13128] raw-gadget.2 gadget.3: failed to queue resume event [ 655.851066][ T1778] raw-gadget.2 gadget.3: failed to queue suspend event [ 655.920969][T13128] raw-gadget.2 gadget.3: failed to queue resume event [ 655.976319][ T1778] raw-gadget.2 gadget.3: failed to queue suspend event [ 656.060266][T13128] raw-gadget.2 gadget.3: failed to queue resume event [ 656.082319][ T5924] raw-gadget.2 gadget.3: failed to queue suspend event [ 656.160394][T13128] raw-gadget.2 gadget.3: failed to queue resume event [ 656.202586][ T24] raw-gadget.2 gadget.3: failed to queue suspend event [ 656.270186][T13128] raw-gadget.2 gadget.3: failed to queue resume event [ 656.304123][ T5924] raw-gadget.2 gadget.3: failed to queue suspend event [ 656.383961][T13128] raw-gadget.2 gadget.3: failed to queue disconnect event [ 656.442097][T13178] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2021'. [ 656.500418][ T24] usb 4-1: USB disconnect, device number 58 [ 656.521665][ T30] kauditd_printk_skb: 19 callbacks suppressed [ 656.521680][ T30] audit: type=1326 audit(1759831629.844:295): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13175 comm="syz.0.2020" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb4c898eec9 code=0x7ffc0000 [ 656.572689][ T30] audit: type=1326 audit(1759831629.844:296): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13175 comm="syz.0.2020" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb4c898eec9 code=0x7ffc0000 [ 656.633514][ T30] audit: type=1326 audit(1759831629.844:297): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13175 comm="syz.0.2020" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7fb4c898eec9 code=0x7ffc0000 [ 656.659056][ T30] audit: type=1326 audit(1759831629.844:298): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13175 comm="syz.0.2020" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb4c898eec9 code=0x7ffc0000 [ 656.688721][ T30] audit: type=1326 audit(1759831629.844:299): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13175 comm="syz.0.2020" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb4c898eec9 code=0x7ffc0000 [ 656.727816][T13182] input: syz1 as /devices/virtual/input/input39 [ 656.875997][ T30] audit: type=1326 audit(1759831629.844:300): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13175 comm="syz.0.2020" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7fb4c898eec9 code=0x7ffc0000 [ 656.914255][ T30] audit: type=1326 audit(1759831629.844:301): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13175 comm="syz.0.2020" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb4c898eec9 code=0x7ffc0000 [ 656.937701][ T30] audit: type=1326 audit(1759831629.844:302): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13175 comm="syz.0.2020" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb4c898eec9 code=0x7ffc0000 [ 656.961620][ T30] audit: type=1326 audit(1759831629.844:303): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13175 comm="syz.0.2020" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7fb4c898eec9 code=0x7ffc0000 [ 656.985712][ T30] audit: type=1326 audit(1759831629.844:304): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13175 comm="syz.0.2020" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb4c898eec9 code=0x7ffc0000 [ 657.025519][T13193] fuse: Unknown parameter '<¹g>ƒìzõ~¶Ì^fd' [ 657.554741][T13204] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 657.841348][ T1778] usb 1-1: new high-speed USB device number 58 using dummy_hcd [ 657.937246][T13208] bond0: Removing last ns target with arp_interval on [ 658.001979][ T1778] usb 1-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 658.020004][ T1778] usb 1-1: config 27 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 658.121803][ T24] usb 5-1: USB disconnect, device number 63 [ 658.178191][T13210] loop2: detected capacity change from 0 to 7 [ 658.217589][ T1778] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 658.331014][T13210] Dev loop2: unable to read RDB block 7 [ 658.346781][T13210] loop2: AHDI p2 p3 [ 658.357901][T13213] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2031'. [ 658.372657][ T1778] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 658.393464][T13210] loop2: partition table partially beyond EOD, truncated [ 658.425717][T13213] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2031'. [ 658.426060][T13214] macvlan2: entered promiscuous mode [ 658.460416][T13210] loop2: p2 start 13841266 is beyond EOD, truncated [ 658.503632][ T1778] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 658.516372][T13214] macvlan2: entered allmulticast mode [ 658.577327][ T1778] snd-usb-audio 1-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 658.730048][T13203] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 658.741291][T13203] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 659.058105][T13223] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 659.082083][T13223] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 660.890999][ T1778] usb 1-1: USB disconnect, device number 58 [ 660.942403][T13202] delete_channel: no stack [ 661.240925][T13247] fuse: Bad value for 'fd' [ 661.384701][T13247] loop6: detected capacity change from 0 to 524288000 [ 661.845698][T13252] ipvlan2: entered promiscuous mode [ 661.862254][T13252] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 661.871245][T13252] team0: Device ipvlan2 is already an upper device of the team interface [ 663.963862][T13282] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 664.043302][T13285] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2050'. [ 664.136428][T13285] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2050'. [ 664.305864][T13285] macsec1: entered allmulticast mode [ 664.521373][T13285] macvlan0: entered allmulticast mode [ 664.526930][T13285] veth1_vlan: entered allmulticast mode [ 664.813639][T13297] netlink: 'syz.0.2053': attribute type 1 has an invalid length. [ 665.094280][T13299] bond5: (slave vxcan3): The slave device specified does not support setting the MAC address [ 665.106958][T13299] bond5: (slave vxcan3): Error -95 calling set_mac_address [ 665.287369][T13300] macvlan2: entered promiscuous mode [ 665.292995][T13300] macvlan2: entered allmulticast mode [ 665.321081][T13300] bond5: entered promiscuous mode [ 665.337264][T13300] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 665.360104][T13304] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 665.369066][T13304] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 665.398217][T13300] bond5: left promiscuous mode [ 666.589497][T13308] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 666.750053][T10907] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 667.063606][T10907] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 667.084497][T10907] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 667.118209][T10907] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 667.151436][T10907] usb 4-1: config 0 descriptor?? [ 667.173991][T10907] pwc: Askey VC010 type 2 USB webcam detected. [ 667.580181][T10907] pwc: recv_control_msg error -32 req 02 val 2b00 [ 667.742870][T10907] pwc: recv_control_msg error -71 req 02 val 2700 [ 667.780126][T10907] pwc: recv_control_msg error -71 req 02 val 2c00 [ 668.019757][T10907] pwc: recv_control_msg error -71 req 04 val 1000 [ 668.064690][T10907] pwc: recv_control_msg error -71 req 04 val 1300 [ 668.344500][T10907] pwc: recv_control_msg error -71 req 04 val 1400 [ 668.700775][T10907] pwc: recv_control_msg error -71 req 02 val 2000 [ 668.733182][T10907] pwc: recv_control_msg error -71 req 02 val 2100 [ 668.887396][T10907] pwc: recv_control_msg error -71 req 04 val 1500 [ 668.940211][T10907] pwc: recv_control_msg error -71 req 02 val 2500 [ 668.987491][T10907] pwc: recv_control_msg error -71 req 02 val 2400 [ 669.081049][T10907] pwc: recv_control_msg error -71 req 02 val 2600 [ 669.139403][T10907] pwc: recv_control_msg error -71 req 02 val 2900 [ 669.150444][T10907] pwc: recv_control_msg error -71 req 02 val 2800 [ 669.157446][T10907] pwc: recv_control_msg error -71 req 04 val 1100 [ 669.165006][T10907] pwc: recv_control_msg error -71 req 04 val 1200 [ 669.183876][T10907] pwc: Registered as video103. [ 669.194695][T10907] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input40 [ 669.227894][T10907] usb 4-1: USB disconnect, device number 59 [ 669.793779][T13359] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2070'. [ 669.913073][T13360] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 670.280167][T10907] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 670.471092][T10907] usb 4-1: too many configurations: 9, using maximum allowed: 8 [ 670.480599][T10907] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 670.490568][T10907] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 670.519389][T10907] usb 4-1: config 0 interface 0 has no altsetting 0 [ 670.545655][T10907] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 670.558629][T10907] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 670.609757][T10907] usb 4-1: config 0 interface 0 has no altsetting 0 [ 670.642444][T10907] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 670.652469][T10907] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 670.666542][T10907] usb 4-1: config 0 interface 0 has no altsetting 0 [ 670.710806][T10907] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 670.722137][T10907] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 670.740794][T10907] usb 4-1: config 0 interface 0 has no altsetting 0 [ 670.759669][T10907] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 670.831557][T10907] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 670.841822][T10907] usb 4-1: config 0 interface 0 has no altsetting 0 [ 670.850042][T10907] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 670.863715][T10907] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 670.873798][T10907] usb 4-1: config 0 interface 0 has no altsetting 0 [ 670.887595][T10907] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 670.896944][T10907] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 670.907297][T10907] usb 4-1: config 0 interface 0 has no altsetting 0 [ 670.916485][T10907] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 670.931124][T10907] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 670.951332][T10907] usb 4-1: config 0 interface 0 has no altsetting 0 [ 670.961187][T10907] usb 4-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 670.971574][T10907] usb 4-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 670.981505][T10907] usb 4-1: Product: syz [ 670.985885][T10907] usb 4-1: Manufacturer: syz [ 670.995465][T10907] usb 4-1: SerialNumber: syz [ 671.162048][T10907] usb 4-1: config 0 descriptor?? [ 671.181377][T10907] yurex 4-1:0.0: Could not find endpoints [ 671.497936][T10907] usb 4-1: USB disconnect, device number 60 [ 672.435786][T13376] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2074'. [ 674.067658][T13404] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2080'. [ 674.194953][ T1778] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 674.538857][ T1778] usb 5-1: Using ep0 maxpacket: 32 [ 674.630638][ T1778] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 9 [ 674.671243][ T1778] usb 5-1: New USB device found, idVendor=14c8, idProduct=0003, bcdDevice= 5.6c [ 674.690270][ T1778] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 674.917475][ T1778] usb 5-1: Product: syz [ 674.931800][ T1778] usb 5-1: Manufacturer: syz [ 674.946747][ T1778] usb 5-1: SerialNumber: syz [ 674.970952][T13410] veth0: entered promiscuous mode [ 674.977953][ T1778] usb 5-1: config 0 descriptor?? [ 674.987460][T13402] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 675.366018][ T1778] input: syz syz as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input41 [ 676.107773][T13416] netlink: 96 bytes leftover after parsing attributes in process `syz.4.2081'. [ 676.152584][T13412] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2083'. [ 676.203251][T13413] netlink: 308 bytes leftover after parsing attributes in process `syz.1.2083'. [ 677.993084][T13425] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 678.081977][T13425] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 678.170149][ T5824] usb 5-1: USB disconnect, device number 64 [ 678.170213][ C0] usbtouchscreen 5-1:0.0: usbtouch_irq - usb_submit_urb failed with result: -19 [ 678.656837][T13431] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 679.318934][T13432] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 679.401343][T13439] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2089'. [ 680.044567][ T67] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 680.099911][ T67] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 680.367287][ T67] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 680.405654][ T67] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 680.573851][ T67] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 680.604691][ T67] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 680.776832][ T67] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 680.823386][ T67] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 680.920005][T13452] input: syz1 as /devices/virtual/input/input42 [ 681.393557][T13462] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 681.430264][T13462] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 681.473671][T13462] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 681.506008][T13462] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 681.515931][T13462] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 681.544721][ T52] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 681.550250][T13469] netlink: 'syz.2.2098': attribute type 11 has an invalid length. [ 681.561558][ T52] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 681.569023][ T52] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 681.592173][ T52] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 681.621807][ T52] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 682.490648][ T5924] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 682.749423][ T5924] usb 4-1: unable to get BOS descriptor or descriptor too short [ 682.760905][ T5924] usb 4-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 682.770410][ T5924] usb 4-1: config 1 has an invalid descriptor of length 6, skipping remainder of the config [ 682.782451][ T5924] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 682.813717][ T5924] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 682.823315][ T5924] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 682.844579][ T5924] usb 4-1: Product: syz [ 682.849398][ T5924] usb 4-1: Manufacturer: syz [ 682.855389][ T5924] usb 4-1: SerialNumber: syz [ 683.165096][ T67] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 683.179125][ T67] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 683.192541][ T67] bond0 (unregistering): Released all slaves [ 683.229266][ T67] bond1 (unregistering): Released all slaves [ 683.275592][ T67] bond2 (unregistering): Released all slaves [ 683.487234][ T67] bond3 (unregistering): Released all slaves [ 683.674575][ T67] bond4 (unregistering): Released all slaves [ 683.692693][ T67] bond5 (unregistering): Released all slaves [ 683.724657][T13462] Bluetooth: hci4: command tx timeout [ 683.874140][ T67] : left promiscuous mode [ 684.039773][T13494] mac80211_hwsim hwsim3 wlan1: entered allmulticast mode [ 684.069777][ T67] tipc: Left network mode [ 684.583017][T13499] tipc: Resetting bearer [ 684.627219][T13499] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 684.707961][ T5924] usb 4-1: 0:2 : does not exist [ 685.097021][T13514] sch_tbf: burst 19872 is lower than device lo mtu (11337746) ! [ 685.269076][T13516] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2107'. [ 685.300268][ T5924] usb 4-1: USB disconnect, device number 61 [ 685.800494][T13462] Bluetooth: hci4: command tx timeout [ 686.044710][ T67] hsr_slave_0: left promiscuous mode [ 686.051537][ T67] hsr_slave_1: left promiscuous mode [ 686.064228][ T67] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 686.088558][ T67] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 686.107940][ T67] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 686.164182][ T67] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 686.266999][ T67] macvlan0: left allmulticast mode [ 686.280062][ T67] veth1_vlan: left allmulticast mode [ 686.306025][ T67] veth0_macvtap: left promiscuous mode [ 686.479223][ T67] veth1_vlan: left promiscuous mode [ 686.560234][ T67] veth0_vlan: left promiscuous mode [ 687.214393][ T67] team0 (unregistering): Port device batadv2 removed [ 687.336010][T13543] netlink: 596 bytes leftover after parsing attributes in process `syz.0.2110'. [ 687.352832][ T67] team0 (unregistering): Port device batadv1 removed [ 687.880169][T13462] Bluetooth: hci4: command tx timeout [ 688.655639][ T67] team0 (unregistering): Port device team_slave_1 removed [ 688.728747][ T67] team0 (unregistering): Port device team_slave_0 removed [ 689.314145][T13539] netlink: 'syz.0.2110': attribute type 29 has an invalid length. [ 689.615374][T13563] netlink: 'syz.0.2115': attribute type 1 has an invalid length. [ 689.961538][T13462] Bluetooth: hci4: command tx timeout [ 689.988143][T13566] gretap1: entered promiscuous mode [ 690.008336][T13566] bond6: (slave gretap1): making interface the new active one [ 690.020388][T13566] bond6: (slave gretap1): Enslaving as an active interface with an up link [ 690.062384][T13569] macvlan2: entered promiscuous mode [ 690.067939][T13569] macvlan2: entered allmulticast mode [ 690.082531][T13569] bond6: entered promiscuous mode [ 690.089465][T13569] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 690.098089][T13569] bond6: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 690.115210][T13569] bond6: left promiscuous mode [ 690.202729][T13573] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2116'. [ 690.213147][T13573] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2116'. [ 690.383677][T13473] chnl_net:caif_netlink_parms(): no params data found [ 691.263255][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 691.280010][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 691.710317][T13473] bridge0: port 1(bridge_slave_0) entered blocking state [ 691.743731][ T5924] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 691.751714][ T9] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 691.768580][T13473] bridge0: port 1(bridge_slave_0) entered disabled state [ 691.800717][T13473] bridge_slave_0: entered allmulticast mode [ 691.856891][T13473] bridge_slave_0: entered promiscuous mode [ 691.911154][ T67] IPVS: stop unused estimator thread 0... [ 691.938931][ T5924] usb 4-1: Using ep0 maxpacket: 32 [ 691.945780][ T9] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 691.959141][T13473] bridge0: port 2(bridge_slave_1) entered blocking state [ 692.003808][T13473] bridge0: port 2(bridge_slave_1) entered disabled state [ 692.011686][ T5924] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC4, changing to 0x84 [ 692.024141][ T9] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 692.049256][T13473] bridge_slave_1: entered allmulticast mode [ 692.055560][ T5924] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 7 [ 692.072365][T13473] bridge_slave_1: entered promiscuous mode [ 692.078439][ T9] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 692.097111][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 692.108961][ T5924] usb 4-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=51.16 [ 692.138521][ T5924] usb 4-1: New USB device strings: Mfr=154, Product=2, SerialNumber=3 [ 692.168885][ T9] usb 3-1: SerialNumber: syz [ 692.204034][ T5924] usb 4-1: Product: syz [ 692.366721][ T5924] usb 4-1: Manufacturer: syz [ 692.392164][ T5924] usb 4-1: SerialNumber: syz [ 692.504177][ T9] usb 3-1: 0:2 : does not exist [ 692.538043][ T5924] usb 4-1: config 0 descriptor?? [ 692.590650][T13602] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2118'. [ 692.616368][ T9] usb 3-1: USB disconnect, device number 61 [ 692.623200][ T5924] usb 4-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 692.688545][T13473] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 692.719074][ T5981] udevd[5981]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 692.809327][T13473] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 693.128499][T13473] team0: Port device team_slave_0 added [ 693.140961][T13611] loop2: detected capacity change from 0 to 7 [ 693.152005][ T5852] Dev loop2: unable to read RDB block 7 [ 693.157934][ T5852] loop2: AHDI p2 p3 [ 693.164108][ T5852] loop2: partition table partially beyond EOD, truncated [ 693.168783][T13473] team0: Port device team_slave_1 added [ 693.213526][ T5852] loop2: p2 start 13841266 is beyond EOD, truncated [ 693.223685][T13611] Dev loop2: unable to read RDB block 7 [ 693.229333][T13611] loop2: AHDI p2 p3 [ 693.242276][T13611] loop2: partition table partially beyond EOD, truncated [ 693.255105][T13611] loop2: p2 start 13841266 is beyond EOD, truncated [ 693.416563][T13473] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 693.417095][T13614] loop2: detected capacity change from 0 to 7 [ 693.451577][T13473] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 693.484287][ T5981] Dev loop2: unable to read RDB block 7 [ 693.497269][ T5981] loop2: AHDI p2 p3 [ 693.508418][ T5981] loop2: partition table partially beyond EOD, truncated [ 693.527346][T13616] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2122'. [ 693.537124][ T5981] loop2: p2 start 13841266 is beyond EOD, truncated [ 693.553539][T13614] Dev loop2: unable to read RDB block 7 [ 693.559380][T13614] loop2: AHDI p2 p3 [ 693.579173][T13614] loop2: partition table partially beyond EOD, truncated [ 693.599276][T13473] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 693.617963][T13614] loop2: p2 start 13841266 is beyond EOD, truncated [ 693.641010][ T6038] usb 4-1: Failed to submit usb control message: -110 [ 693.657827][ T6038] usb 4-1: unable to send the bmi data to the device: -110 [ 693.682675][T13473] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 693.701179][ T6038] usb 4-1: unable to get target info from device [ 693.719911][T13473] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 693.757679][ T6038] usb 4-1: could not get target info (-110) [ 693.782609][ T6038] usb 4-1: could not probe fw (-110) [ 693.847562][T13473] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 693.926944][T13620] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2124'. [ 693.940835][ T9] usb 4-1: USB disconnect, device number 62 [ 694.244894][T13473] hsr_slave_0: entered promiscuous mode [ 694.265247][T13473] hsr_slave_1: entered promiscuous mode [ 694.285693][T13473] debugfs: 'hsr0' already exists in 'hsr' [ 694.298788][T13473] Cannot create hsr debugfs directory [ 694.961175][T13651] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2131'. [ 695.251345][T13657] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 695.294906][T13657] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 696.442544][T13676] program syz.3.2136 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 697.177116][T13473] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 697.214576][T13473] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 697.255138][T13473] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 697.272112][T13473] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 697.713666][T13473] 8021q: adding VLAN 0 to HW filter on device bond0 [ 697.726982][ T30] kauditd_printk_skb: 54 callbacks suppressed [ 697.727004][ T30] audit: type=1804 audit(1759831671.054:359): pid=13687 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.2138" name="/newroot/445/file1" dev="fuse" ino=1 res=1 errno=0 [ 697.863064][T13473] 8021q: adding VLAN 0 to HW filter on device team0 [ 697.934461][ T1327] bridge0: port 1(bridge_slave_0) entered blocking state [ 697.942026][ T1327] bridge0: port 1(bridge_slave_0) entered forwarding state [ 698.025621][T13696] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 698.032829][ T6038] bridge0: port 2(bridge_slave_1) entered blocking state [ 698.041373][ T6038] bridge0: port 2(bridge_slave_1) entered forwarding state [ 698.069465][T13696] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 698.250030][ T9] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 698.643035][T13473] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 698.838567][T13713] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2142'. [ 699.055535][T13473] veth0_vlan: entered promiscuous mode [ 699.105022][T13473] veth1_vlan: entered promiscuous mode [ 699.190374][T10907] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 699.288890][T13727] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2146'. [ 699.356144][T10907] usb 4-1: config 0 has an invalid interface number: 114 but max is 0 [ 699.376255][T10907] usb 4-1: config 0 has no interface number 0 [ 699.393295][T10907] usb 4-1: New USB device found, idVendor=0547, idProduct=2720, bcdDevice=13.67 [ 699.406234][T10907] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 699.466842][T13473] veth0_macvtap: entered promiscuous mode [ 699.485957][T10907] usb 4-1: Product: syz [ 699.504486][T13473] veth1_macvtap: entered promiscuous mode [ 699.510413][T10907] usb 4-1: Manufacturer: syz [ 699.540052][T10907] usb 4-1: SerialNumber: syz [ 699.572131][T10907] usb 4-1: config 0 descriptor?? [ 699.602871][T13473] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 699.625222][T13473] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 699.677534][ T1027] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 699.732303][ T1027] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 699.756843][ T1027] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 699.793419][ T1027] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 699.807005][T10907] cdc_subset 4-1:0.114: probe with driver cdc_subset failed with error -71 [ 699.857955][T10907] usb 4-1: USB disconnect, device number 63 [ 699.940307][ T24] usb 1-1: new full-speed USB device number 59 using dummy_hcd [ 699.990747][ T8777] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 700.003970][ T8777] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 700.112242][ T24] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 4 [ 700.200232][ T24] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 4 [ 700.334956][ T24] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 700.350724][ T1027] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 700.421432][ T1027] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 700.437363][ T24] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 700.470015][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 700.513900][ T24] usb 1-1: Product: syz [ 700.518134][ T24] usb 1-1: Manufacturer: syz [ 700.550259][ T24] usb 1-1: SerialNumber: syz [ 700.876455][ T24] usb 1-1: USB disconnect, device number 59 [ 701.002196][ T5981] udevd[5981]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 701.309249][T13757] vxcan2: entered allmulticast mode [ 701.672635][T13735] syz.2.2148 (13735): drop_caches: 2 [ 701.691709][T13768] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2151'. [ 701.942439][T13770] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2152'. [ 703.994810][T13799] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2157'. [ 704.017737][T13799] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2157'. [ 704.070732][T13799] macsec1: entered allmulticast mode [ 704.115800][T13799] macvlan0: entered allmulticast mode [ 704.160080][T13799] veth1_vlan: entered allmulticast mode [ 704.619383][T13817] netlink: 'syz.3.2160': attribute type 11 has an invalid length. [ 704.910089][ T9] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 705.100484][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 705.133808][ T9] usb 5-1: too many configurations: 123, using maximum allowed: 8 [ 705.161709][ T9] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 705.169355][ T9] usb 5-1: can't read configurations, error -61 [ 705.235110][ T5924] IPVS: starting estimator thread 0... [ 705.277946][T13844] IPVS: set_ctl: invalid protocol: 11612 172.20.20.11:21 [ 705.321137][ T9] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 705.370203][ T5824] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 705.370517][T13842] IPVS: using max 28 ests per chain, 67200 per kthread [ 705.562056][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 705.573373][ T9] usb 5-1: too many configurations: 123, using maximum allowed: 8 [ 705.574922][ T5824] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 705.595172][ T9] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 705.609925][ T5824] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 705.613473][ T9] usb 5-1: can't read configurations, error -61 [ 705.625698][ T5824] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 705.665786][ T9] usb usb5-port1: attempt power cycle [ 705.684711][ T5824] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 705.700309][ T5824] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 705.734811][ T5824] usb 3-1: config 0 descriptor?? [ 706.040025][ T9] usb 5-1: new high-speed USB device number 67 using dummy_hcd [ 706.080624][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 706.086637][ T9] usb 5-1: too many configurations: 123, using maximum allowed: 8 [ 706.102201][ T9] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 706.116740][ T9] usb 5-1: can't read configurations, error -61 [ 706.194265][ T5824] plantronics 0003:047F:FFFF.001C: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 706.280030][ T9] usb 5-1: new high-speed USB device number 68 using dummy_hcd [ 706.363131][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 706.382521][ T9] usb 5-1: too many configurations: 123, using maximum allowed: 8 [ 706.413098][ T9] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 706.442954][ T9] usb 5-1: can't read configurations, error -61 [ 706.470531][ T9] usb usb5-port1: unable to enumerate USB device [ 706.647689][ T5824] usb 3-1: USB disconnect, device number 63 [ 707.450470][T13884] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2177'. [ 707.620061][T13884] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2177'. [ 707.706817][T13886] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 707.746836][T13886] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 707.960256][ T9] usb 5-1: new high-speed USB device number 69 using dummy_hcd [ 708.112080][ T9] usb 5-1: device descriptor read/64, error -71 [ 708.440037][ T9] usb 5-1: new high-speed USB device number 70 using dummy_hcd [ 708.623614][ T9] usb 5-1: device descriptor read/64, error -71 [ 708.740432][ T9] usb usb5-port1: attempt power cycle [ 709.089980][ T9] usb 5-1: new high-speed USB device number 71 using dummy_hcd [ 709.110762][ T9] usb 5-1: device descriptor read/8, error -71 [ 709.292215][T13908] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2182'. [ 709.349982][ T9] usb 5-1: new high-speed USB device number 72 using dummy_hcd [ 709.400948][ T9] usb 5-1: device descriptor read/8, error -71 [ 709.527667][ T9] usb usb5-port1: unable to enumerate USB device [ 709.949254][T13914] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 710.650075][ T24] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 710.813577][ T24] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 710.832196][ T24] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 710.966076][ T24] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 710.996894][ T24] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 711.007313][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 711.025150][ T24] usb 3-1: Product: syz [ 711.034134][ T24] usb 3-1: Manufacturer: syz [ 711.042376][ T24] usb 3-1: SerialNumber: syz [ 711.052776][ T24] cdc_ncm 3-1:1.0: CDC Union missing and no IAD found [ 711.059756][ T24] cdc_ncm 3-1:1.0: bind() failure [ 711.271092][T13919] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 711.319389][T13919] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 711.333073][ T24] usb 3-1: USB disconnect, device number 64 [ 712.196471][T13954] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2194'. [ 713.332768][T13972] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 713.603115][T13979] bridge_slave_0: left allmulticast mode [ 713.616359][T13979] bridge_slave_0: left promiscuous mode [ 713.624428][T13979] bridge0: port 1(bridge_slave_0) entered disabled state [ 713.697974][ T24] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 713.718504][T13979] bridge_slave_1: left allmulticast mode [ 713.764952][T13979] bridge_slave_1: left promiscuous mode [ 713.788180][T13979] bridge0: port 2(bridge_slave_1) entered disabled state [ 714.181100][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 714.200054][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 714.244205][T13979] bond0: (slave bond_slave_0): Releasing backup interface [ 714.260302][ T24] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 714.434380][ T24] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 714.523299][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 714.572323][ T24] usb 3-1: config 0 descriptor?? [ 714.731922][T13979] bond0: (slave bond_slave_1): Releasing backup interface [ 714.966956][T13979] team0: Port device team_slave_0 removed [ 715.044294][T13979] team0: Port device team_slave_1 removed [ 715.077745][T13979] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 715.123779][T13979] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 715.183017][T13979] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 715.191033][T13979] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 715.208803][T13979] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 715.803012][T13996] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2204'. [ 716.022103][ T24] usbhid 3-1:0.0: can't add hid device: -71 [ 716.030490][ T24] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 716.075322][ T24] usb 3-1: USB disconnect, device number 65 [ 716.323743][T14002] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2205'. [ 716.817270][T14006] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2206'. [ 716.828610][T14006] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2206'. [ 717.660062][ T5824] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 717.820466][ T5824] usb 5-1: Using ep0 maxpacket: 32 [ 717.843320][ T5824] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 9 [ 717.878556][ T5824] usb 5-1: New USB device found, idVendor=14c8, idProduct=0003, bcdDevice= 5.6c [ 717.899940][ T5824] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 717.908000][ T5824] usb 5-1: Product: syz [ 717.940040][ T5824] usb 5-1: Manufacturer: syz [ 717.967341][ T5824] usb 5-1: SerialNumber: syz [ 718.040703][ T5824] usb 5-1: config 0 descriptor?? [ 718.063464][T14012] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 718.080076][ T5824] input: syz syz as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input44 [ 718.353223][T14023] netlink: 'syz.0.2211': attribute type 1 has an invalid length. [ 718.963536][T14026] bond7: (slave vxcan3): The slave device specified does not support setting the MAC address [ 719.002083][T14026] bond7: (slave vxcan3): Error -95 calling set_mac_address [ 719.236177][T14029] macvlan2: entered promiscuous mode [ 719.243197][T14029] macvlan2: entered allmulticast mode [ 719.289492][T14029] bond7: entered promiscuous mode [ 719.304472][T14029] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 719.435975][T14029] bond7: left promiscuous mode [ 720.790108][ T9] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 720.958595][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 720.991435][ T5824] usb 5-1: USB disconnect, device number 73 [ 720.997703][ C1] usbtouchscreen 5-1:0.0: usbtouch_irq - usb_submit_urb failed with result: -19 [ 721.005850][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 721.056945][ T9] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 721.175258][ T9] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 721.211729][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 721.272169][ T9] usb 4-1: config 0 descriptor?? [ 721.600142][ T1778] usb 1-1: new high-speed USB device number 60 using dummy_hcd [ 721.855509][ T9] plantronics 0003:047F:FFFF.001D: collection stack underflow [ 721.882415][ T9] plantronics 0003:047F:FFFF.001D: item 0 4 0 12 parsing failed [ 721.924379][ T1778] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 721.945879][ T1327] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 721.960859][T14055] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 721.967240][ T9] plantronics 0003:047F:FFFF.001D: parse failed [ 722.050165][ T1778] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 722.076069][ T9] plantronics 0003:047F:FFFF.001D: probe with driver plantronics failed with error -22 [ 722.126292][ T1778] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 722.148299][ T1778] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 722.179394][ T1778] usb 1-1: SerialNumber: syz [ 722.296372][T14060] fuse: Bad value for 'fd' [ 722.309240][T14060] loop6: detected capacity change from 0 to 524288000 [ 722.383042][ T1327] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 722.508472][T14048] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 722.518529][T14048] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 722.703743][ T1327] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 723.234647][ T1327] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 724.116326][T14071] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2223'. [ 724.439718][ T9] usb 4-1: USB disconnect, device number 64 [ 725.190131][ T9] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 725.370823][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 725.421697][ T9] usb 4-1: config 0 has an invalid interface number: 68 but max is 0 [ 725.467706][T13462] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 725.478963][T13462] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 725.488227][T13462] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 725.497463][T13462] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 725.510224][ T9] usb 4-1: config 0 has no interface number 0 [ 725.517487][T13462] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 725.525321][ T9] usb 4-1: config 0 interface 68 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 725.540790][ T9] usb 4-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=dc.c4 [ 725.566412][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 725.574671][ T9] usb 4-1: Product: syz [ 725.578985][ T9] usb 4-1: Manufacturer: syz [ 725.584205][ T9] usb 4-1: SerialNumber: syz [ 725.670834][ T9] usb 4-1: config 0 descriptor?? [ 725.772446][ T9] usb 4-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 725.956295][ T67] usb 4-1: Failed to submit usb control message: -71 [ 725.963602][T10907] usb 4-1: USB disconnect, device number 65 [ 725.980269][T14092] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 725.990225][ T67] usb 4-1: unable to send the bmi data to the device: -71 [ 725.997465][ T67] usb 4-1: unable to get target info from device [ 726.038535][ T1778] usb 1-1: 0:2 : does not exist [ 726.042707][T14092] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 726.060687][ T67] usb 4-1: could not get target info (-71) [ 726.108878][ T67] usb 4-1: could not probe fw (-71) [ 726.218402][ T1778] usb 1-1: USB disconnect, device number 60 [ 726.295904][ T5981] udevd[5981]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 726.322926][T14097] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 726.349441][T14097] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 726.532244][ T1327] bond0 (unregistering): Released all slaves [ 726.737174][T14104] netlink: 'syz.2.2230': attribute type 11 has an invalid length. [ 726.764047][T14105] syz_tun: entered allmulticast mode [ 726.942872][T14115] loop2: detected capacity change from 0 to 7 [ 726.983427][T14115] Dev loop2: unable to read RDB block 7 [ 726.989065][T14115] loop2: AHDI p2 p3 [ 727.015460][T14105] syz_tun: left allmulticast mode [ 727.036710][T14118] netlink: 'syz.1.2233': attribute type 29 has an invalid length. [ 727.059999][T14115] loop2: partition table partially beyond EOD, truncated [ 727.065820][T14118] netlink: 'syz.1.2233': attribute type 29 has an invalid length. [ 727.082160][T14118] netlink: 500 bytes leftover after parsing attributes in process `syz.1.2233'. [ 727.092050][T14115] loop2: p2 start 13841266 is beyond EOD, truncated [ 727.476891][T14138] fuse: Bad value for 'fd' [ 727.489233][T14138] loop6: detected capacity change from 0 to 524288000 [ 727.612814][T14140] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2236'. [ 727.647621][ T52] Bluetooth: hci4: command tx timeout [ 727.672991][T14133] tipc: Resetting bearer [ 727.698700][T14133] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 728.884953][ T1327] hsr_slave_0: left promiscuous mode [ 728.946332][ T1327] hsr_slave_1: left promiscuous mode [ 728.981559][ T9] usb 4-1: new high-speed USB device number 66 using dummy_hcd [ 729.029311][ T1327] macvlan0: left allmulticast mode [ 729.051660][ T1327] veth1_vlan: left allmulticast mode [ 729.080330][ T1327] veth1_macvtap: left promiscuous mode [ 729.097871][ T1327] veth0_macvtap: left promiscuous mode [ 729.140226][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 729.150077][ T1327] veth1_vlan: left promiscuous mode [ 729.155576][ T1327] veth0_vlan: left promiscuous mode [ 729.215772][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 729.231555][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 729.274116][ T9] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 729.313428][ T9] usb 4-1: New USB device found, idVendor=1781, idProduct=0898, bcdDevice= 0.00 [ 729.346407][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 729.375469][ T9] usb 4-1: config 0 descriptor?? [ 729.417804][T14153] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2239'. [ 729.428576][ T9] input: PXRC Flight Controller Adapter as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input45 [ 729.454716][ T5196] pxrc 4-1:0.0: pxrc_open - usb_submit_urb failed, error: -90 [ 729.470421][T14153] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2239'. [ 729.510672][ T5196] pxrc 4-1:0.0: pxrc_open - usb_submit_urb failed, error: -90 [ 729.532301][ T5196] pxrc 4-1:0.0: pxrc_open - usb_submit_urb failed, error: -90 [ 729.605213][ T6000] pxrc 4-1:0.0: pxrc_open - usb_submit_urb failed, error: -90 [ 729.642726][ T5196] pxrc 4-1:0.0: pxrc_open - usb_submit_urb failed, error: -90 [ 729.681971][ T5196] pxrc 4-1:0.0: pxrc_open - usb_submit_urb failed, error: -90 [ 729.720009][ T52] Bluetooth: hci4: command tx timeout [ 729.737387][T14149] pxrc 4-1:0.0: pxrc_open - usb_submit_urb failed, error: -90 [ 729.799235][ T5196] pxrc 4-1:0.0: pxrc_open - usb_submit_urb failed, error: -90 [ 729.940397][T10907] usb 4-1: USB disconnect, device number 66 [ 730.210446][T14165] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2242'. [ 730.980259][T10907] usb 4-1: new full-speed USB device number 67 using dummy_hcd [ 731.159133][T10907] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 4 [ 731.217133][T10907] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 4 [ 731.259397][T10907] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 731.315655][T10907] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 731.332303][T10907] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 731.368624][T10907] usb 4-1: Product: syz [ 731.373381][T10907] usb 4-1: Manufacturer: syz [ 731.378042][T10907] usb 4-1: SerialNumber: syz [ 731.715654][T10907] usb 4-1: USB disconnect, device number 67 [ 731.786754][ T5981] udevd[5981]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 731.800121][ T52] Bluetooth: hci4: command tx timeout [ 731.864483][T14176] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2244'. [ 732.336939][T14085] chnl_net:caif_netlink_parms(): no params data found [ 732.501184][T14188] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 732.573799][T14183] tun0: tun_chr_ioctl cmd 1074025675 [ 732.591982][T14183] tun0: persist enabled [ 732.624330][T14189] tun0: tun_chr_ioctl cmd 1074025675 [ 732.640638][T14189] tun0: persist disabled [ 732.869942][ T1778] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 732.997141][T14085] bridge0: port 1(bridge_slave_0) entered blocking state [ 733.014371][T14085] bridge0: port 1(bridge_slave_0) entered disabled state [ 733.025359][T14085] bridge_slave_0: entered allmulticast mode [ 733.034699][T14085] bridge_slave_0: entered promiscuous mode [ 733.051218][T14085] bridge0: port 2(bridge_slave_1) entered blocking state [ 733.073111][ T1778] usb 3-1: unable to get BOS descriptor or descriptor too short [ 733.085834][T14085] bridge0: port 2(bridge_slave_1) entered disabled state [ 733.119257][ T1778] usb 3-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 733.161286][T14198] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2248'. [ 733.297953][ T1778] usb 3-1: config 1 has an invalid descriptor of length 6, skipping remainder of the config [ 733.367252][ T1778] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 733.378633][T14085] bridge_slave_1: entered allmulticast mode [ 733.397346][T14085] bridge_slave_1: entered promiscuous mode [ 733.419351][ T1778] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 733.429536][ T1778] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 733.455717][ T1778] usb 3-1: Product: syz [ 733.502219][ T1778] usb 3-1: Manufacturer: syz [ 733.517926][ T1778] usb 3-1: SerialNumber: syz [ 733.695641][T14085] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 733.773488][T14085] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 733.881396][ T52] Bluetooth: hci4: command tx timeout [ 734.121450][T14085] team0: Port device team_slave_0 added [ 734.243079][T14085] team0: Port device team_slave_1 added [ 734.596164][T14085] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 734.627830][T14085] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 734.684822][T14211] fuse: Bad value for 'fd' [ 734.698660][T14211] loop6: detected capacity change from 0 to 524288000 [ 734.877485][T14085] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 734.956956][T14085] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 734.985551][T14085] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 735.075545][T14085] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 735.553464][ T5824] usb 4-1: new high-speed USB device number 68 using dummy_hcd [ 735.713975][ T5824] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 33, using maximum allowed: 30 [ 735.730388][ T5824] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 253, changing to 11 [ 735.812318][T14085] hsr_slave_0: entered promiscuous mode [ 735.826946][T14085] hsr_slave_1: entered promiscuous mode [ 735.839898][ T5824] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 33 [ 735.872066][T14085] debugfs: 'hsr0' already exists in 'hsr' [ 735.893579][T14085] Cannot create hsr debugfs directory [ 735.893577][ T5824] usb 4-1: New USB device found, idVendor=09da, idProduct=001a, bcdDevice= 0.00 [ 735.893609][ T5824] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 736.091645][ T5824] usb 4-1: config 0 descriptor?? [ 736.349788][ T1778] usb 3-1: 0:2 : does not exist [ 736.471998][ T1778] usb 3-1: USB disconnect, device number 66 [ 736.631339][ T5824] a4tech 0003:09DA:001A.001E: unknown main item tag 0x0 [ 736.661065][T14229] FAULT_INJECTION: forcing a failure. [ 736.661065][T14229] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 736.710632][T14229] CPU: 0 UID: 0 PID: 14229 Comm: syz.2.2253 Not tainted syzkaller #0 PREEMPT(full) [ 736.710663][T14229] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 736.710677][T14229] Call Trace: [ 736.710685][T14229] [ 736.710696][T14229] dump_stack_lvl+0x189/0x250 [ 736.710728][T14229] ? __pfx____ratelimit+0x10/0x10 [ 736.710755][T14229] ? __pfx_dump_stack_lvl+0x10/0x10 [ 736.710783][T14229] ? __pfx__printk+0x10/0x10 [ 736.710830][T14229] should_fail_ex+0x414/0x560 [ 736.710869][T14229] _copy_to_user+0x31/0xb0 [ 736.710899][T14229] simple_read_from_buffer+0xe1/0x170 [ 736.710939][T14229] proc_fail_nth_read+0x1b3/0x220 [ 736.710973][T14229] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 736.711005][T14229] ? rw_verify_area+0x2a6/0x4d0 [ 736.711035][T14229] ? __lock_acquire+0xab9/0xd20 [ 736.711058][T14229] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 736.711089][T14229] vfs_read+0x1fd/0xa30 [ 736.711119][T14229] ? fdget_pos+0x247/0x320 [ 736.711146][T14229] ? __pfx___mutex_lock+0x10/0x10 [ 736.711175][T14229] ? __pfx_vfs_read+0x10/0x10 [ 736.711208][T14229] ? __fget_files+0x2a/0x420 [ 736.711234][T14229] ? __fget_files+0x3a0/0x420 [ 736.711255][T14229] ? __fget_files+0x2a/0x420 [ 736.711287][T14229] ksys_read+0x145/0x250 [ 736.711330][T14229] ? __pfx_ksys_read+0x10/0x10 [ 736.711363][T14229] ? __secure_computing+0xe2/0x2a0 [ 736.711400][T14229] do_syscall_64+0xfa/0x3b0 [ 736.711423][T14229] ? lockdep_hardirqs_on+0x9c/0x150 [ 736.711447][T14229] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 736.711470][T14229] ? clear_bhb_loop+0x60/0xb0 [ 736.711496][T14229] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 736.711518][T14229] RIP: 0033:0x7f015118d8dc [ 736.711538][T14229] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 736.711557][T14229] RSP: 002b:00007f0152102030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 736.711586][T14229] RAX: ffffffffffffffda RBX: 00007f01513e5fa0 RCX: 00007f015118d8dc [ 736.711603][T14229] RDX: 000000000000000f RSI: 00007f01521020a0 RDI: 0000000000000007 [ 736.711617][T14229] RBP: 00007f0152102090 R08: 0000000000000000 R09: 0000000000000000 [ 736.711631][T14229] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000001 [ 736.711645][T14229] R13: 00007f01513e6038 R14: 00007f01513e5fa0 R15: 00007f015150fa28 [ 736.711680][T14229] [ 736.713580][ T5824] a4tech 0003:09DA:001A.001E: unknown main item tag 0x0 [ 736.982484][T14231] tipc: Resetting bearer [ 737.034955][T14231] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 737.573814][T14245] netlink: 'syz.2.2254': attribute type 1 has an invalid length. [ 737.586230][T14244] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 737.624151][T14244] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 737.907703][T14246] bond3: (slave vxcan3): The slave device specified does not support setting the MAC address [ 737.950272][T14246] bond3: (slave vxcan3): Error -95 calling set_mac_address [ 738.017416][T14248] macvlan2: entered promiscuous mode [ 738.023751][T14248] macvlan2: entered allmulticast mode [ 738.035116][T14248] bond3: entered promiscuous mode [ 738.048979][T14248] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 738.070258][T14248] bond3: left promiscuous mode [ 738.123787][ T5824] a4tech 0003:09DA:001A.001E: unknown main item tag 0x0 [ 738.132996][ T5824] a4tech 0003:09DA:001A.001E: unknown main item tag 0x0 [ 738.140813][ T5824] a4tech 0003:09DA:001A.001E: unknown main item tag 0x0 [ 738.148313][ T5824] a4tech 0003:09DA:001A.001E: unknown main item tag 0x0 [ 738.157906][ T5824] a4tech 0003:09DA:001A.001E: unknown main item tag 0x0 [ 738.181451][ T5824] a4tech 0003:09DA:001A.001E: hidraw0: USB HID v80.04 Device [HID 09da:001a] on usb-dummy_hcd.3-1/input0 [ 738.644847][T14254] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 738.662731][T14254] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 738.818499][T14085] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 738.836782][T14085] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 738.923371][T14085] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 739.010418][ T1778] usb 4-1: USB disconnect, device number 68 [ 739.057577][T14085] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 740.063206][T14085] 8021q: adding VLAN 0 to HW filter on device bond0 [ 740.134438][T14085] 8021q: adding VLAN 0 to HW filter on device team0 [ 740.260241][ T1150] bridge0: port 1(bridge_slave_0) entered blocking state [ 740.267406][ T1150] bridge0: port 1(bridge_slave_0) entered forwarding state [ 740.292670][T14289] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2261'. [ 740.535881][T14085] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 740.618897][T14085] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 740.721799][ T1150] bridge0: port 2(bridge_slave_1) entered blocking state [ 740.729058][ T1150] bridge0: port 2(bridge_slave_1) entered forwarding state [ 741.025520][T14085] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 741.372023][T14085] veth0_vlan: entered promiscuous mode [ 741.472142][T14085] veth1_vlan: entered promiscuous mode [ 741.522916][T14313] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 741.531752][T14313] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 741.617649][T14085] veth0_macvtap: entered promiscuous mode [ 741.706392][T14085] veth1_macvtap: entered promiscuous mode [ 741.786698][T14085] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 741.858220][T14085] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 741.927249][ T67] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 741.941345][ T67] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 741.972790][ T67] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 741.988488][ T67] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 742.139403][T14330] fuse: Invalid rootmode [ 742.156302][T14333] fuse: Invalid rootmode [ 742.213919][T14330] macvlan0: entered promiscuous mode [ 742.232878][T14330] macvlan0: left promiscuous mode [ 742.316282][T14333] macvlan0: entered promiscuous mode [ 742.333361][ T5951] usb 1-1: new full-speed USB device number 61 using dummy_hcd [ 742.400271][T14333] macvlan0: left promiscuous mode [ 742.574964][ T5951] usb 1-1: config 252 has an invalid interface number: 107 but max is 0 [ 742.585497][ T5951] usb 1-1: config 252 has an invalid descriptor of length 46, skipping remainder of the config [ 742.666333][ T5951] usb 1-1: config 252 has no interface number 0 [ 742.693381][ T5951] usb 1-1: too many endpoints for config 252 interface 107 altsetting 0: 198, using maximum allowed: 30 [ 742.726338][ T5951] usb 1-1: config 252 interface 107 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 198 [ 742.825629][ T30] audit: type=1326 audit(1759831716.144:360): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14331 comm="syz.1.2272" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fefb138eec9 code=0x0 [ 742.842441][ T5951] usb 1-1: New USB device found, idVendor=10f0, idProduct=2002, bcdDevice=d7.67 [ 742.877932][ T5951] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 742.940111][ T5951] usb 1-1: Product: syz [ 742.954698][ T5951] usb 1-1: Manufacturer: syz [ 742.966889][ T1150] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 742.974987][ T1150] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 742.979689][ T5951] usb 1-1: SerialNumber: syz [ 743.129432][ T1150] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 743.160314][ T1150] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 743.271416][ T5951] usb 1-1: USB disconnect, device number 61 [ 743.548064][T14352] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 743.566173][T14354] bond0: Removing last ns target with arp_interval on [ 743.567958][ T1150] bond0: (slave bond_slave_0): interface is now down [ 743.610542][ T1150] bond0: (slave bond_slave_1): interface is now down [ 743.664267][ T1150] bond0: now running without any active interface! [ 744.518455][T14371] tipc: Resetting bearer [ 744.541230][T14371] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 745.050404][T10907] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 745.101311][ T5824] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 745.279957][ T5824] usb 3-1: Using ep0 maxpacket: 8 [ 745.285381][T10907] usb 5-1: Using ep0 maxpacket: 16 [ 745.294189][T10907] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 745.304553][ T5824] usb 3-1: unable to get BOS descriptor or descriptor too short [ 745.323502][ T5824] usb 3-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 745.340027][T10907] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 745.360144][ T5824] usb 3-1: config 8 interface 0 altsetting 7 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 745.373024][T10907] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 745.373355][T14385] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2281'. [ 745.418211][ T5824] usb 3-1: config 8 interface 0 altsetting 7 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 745.430718][T10907] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 745.440933][T14385] Unsupported xt match [ 745.440952][T14385] unable to load match [ 745.450315][ T5824] usb 3-1: config 8 interface 0 altsetting 7 endpoint 0x8F has invalid wMaxPacketSize 0 [ 745.460650][T10907] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 745.495175][ T5824] usb 3-1: config 8 interface 0 altsetting 7 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 745.530204][T10907] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 745.559653][T10907] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 745.569068][T14384] bond10: option arp_validate: invalid value (18446744073709551614) [ 745.581259][T14384] bond10 (unregistering): Released all slaves [ 745.583875][ T5824] usb 3-1: config 8 interface 0 has no altsetting 0 [ 745.622239][T10907] usb 5-1: Manufacturer: syz [ 745.649605][ T5824] usb 3-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=6a.e5 [ 745.701425][T10907] usb 5-1: config 0 descriptor?? [ 745.709944][ T5824] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 745.738916][ T5824] usb 3-1: Product: syz [ 745.754971][ T5824] usb 3-1: Manufacturer: syz [ 745.770338][ T5824] usb 3-1: SerialNumber: syz [ 745.967832][T14395] ipvlan2: entered promiscuous mode [ 745.974382][T14395] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 745.991106][ T5951] usb 4-1: new full-speed USB device number 69 using dummy_hcd [ 745.999206][T14395] team0: Device ipvlan2 is already an upper device of the team interface [ 746.093337][T10907] rc_core: IR keymap rc-hauppauge not found [ 746.116189][T10907] Registered IR keymap rc-empty [ 746.129514][T10907] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 746.151884][T10907] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 746.163107][ T5951] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 4 [ 746.184393][ T5951] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 4 [ 746.197964][T10907] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 746.224176][ T5951] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 746.244800][ T5824] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 746.249662][ T5951] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 746.283386][ T5951] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 746.291882][T10907] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input46 [ 746.298967][ T5951] usb 4-1: Product: syz [ 746.306182][ T5824] usb 3-1: selecting invalid altsetting 0 [ 746.322838][ T5951] usb 4-1: Manufacturer: syz [ 746.327552][ T5951] usb 4-1: SerialNumber: syz [ 746.373415][T10907] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 746.433082][T10907] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 746.470076][T10907] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 746.499475][ T5824] snd-usb-audio 3-1:8.0: probe with driver snd-usb-audio failed with error -12 [ 746.512504][T10907] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 746.545300][ T5824] usb 3-1: USB disconnect, device number 67 [ 746.551767][T10907] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 746.572058][T10907] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 746.610532][T10907] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 746.634001][T10907] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 746.647951][ T9920] udevd[9920]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:8.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 746.690361][ T5951] usb 4-1: USB disconnect, device number 69 [ 746.700570][T10907] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 746.741789][ T5979] udevd[5979]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 746.742139][T10907] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 746.793560][T10907] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 746.836301][T10907] mceusb 5-1:0.0: Registered with mce emulator interface version 1 [ 746.862693][T14413] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 746.876904][T10907] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 746.879925][T14413] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 746.940316][T10907] usb 5-1: USB disconnect, device number 74 [ 747.034972][T14418] loop2: detected capacity change from 0 to 7 [ 747.055247][T14418] Dev loop2: unable to read RDB block 7 [ 747.073110][T14418] loop2: AHDI p2 p3 [ 747.080021][T14418] loop2: partition table partially beyond EOD, truncated [ 747.107572][T14418] loop2: p2 start 13841266 is beyond EOD, truncated [ 747.129469][T14417] bond4: Unable to set up delay as MII monitoring is disabled [ 747.184260][T14417] bond4 (unregistering): Released all slaves [ 747.779978][ T5824] usb 4-1: new high-speed USB device number 70 using dummy_hcd [ 747.952049][T14447] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2293'. [ 747.975412][T14447] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2293'. [ 748.037874][ T5824] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 748.070139][ T5824] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 748.173516][T14460] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 748.204794][ T5824] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 748.270440][T14465] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2299'. [ 748.316214][ T5824] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 748.374018][ T5824] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 748.540623][ T5824] usb 4-1: config 0 descriptor?? [ 748.944594][ T5824] usbhid 4-1:0.0: can't add hid device: -71 [ 748.970374][ T5824] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 749.058741][ T5824] usb 4-1: USB disconnect, device number 70 [ 750.100081][ T1778] usb 4-1: new high-speed USB device number 71 using dummy_hcd [ 750.280081][ T1778] usb 4-1: Using ep0 maxpacket: 8 [ 750.366685][ T1778] usb 4-1: unable to get BOS descriptor or descriptor too short [ 750.459387][ T1778] usb 4-1: config 64 has an invalid interface number: 103 but max is 0 [ 750.499967][ T1778] usb 4-1: config 64 has no interface number 0 [ 750.640534][ T1778] usb 4-1: config 64 interface 103 has no altsetting 0 [ 750.807559][ T1778] usb 4-1: New USB device found, idVendor=17cc, idProduct=1000, bcdDevice=8d.88 [ 750.831841][ T1778] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 751.112166][ T1778] snd-usb-audio 4-1:64.103: probe with driver snd-usb-audio failed with error -71 [ 751.230297][ T1778] usb 4-1: USB disconnect, device number 71 [ 752.191338][T14517] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2313'. [ 752.218026][T14517] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2313'. [ 752.468158][T14521] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2316'. [ 752.691763][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 752.698301][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 752.861076][T14535] bridge_slave_0: left allmulticast mode [ 752.867186][T14535] bridge_slave_0: left promiscuous mode [ 752.873320][T14535] bridge0: port 1(bridge_slave_0) entered disabled state [ 753.059721][T14535] bridge_slave_1: left allmulticast mode [ 753.065802][T14535] bridge_slave_1: left promiscuous mode [ 753.072565][T14535] bridge0: port 2(bridge_slave_1) entered disabled state [ 753.290279][T14535] bond0: (slave bond_slave_0): Releasing backup interface [ 753.326552][T14535] bond0: (slave bond_slave_1): Releasing backup interface [ 753.378114][T14535] team0: Port device team_slave_0 removed [ 753.413392][T14535] team0: Port device team_slave_1 removed [ 753.421418][T14535] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 753.429063][T14535] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 753.484248][T14535] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 753.675471][T14550] fuse: Bad value for 'rootmode' [ 753.807151][T14535] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 753.826390][T14553] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 754.845960][T14535] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 756.640616][T14583] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2333'. [ 756.872804][T14588] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 756.899118][T14588] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 757.026789][T14592] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2335'. [ 757.036271][T14592] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2335'. [ 757.123215][T14596] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2336'. [ 757.191335][T14598] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 757.207837][T14598] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 757.379377][T14601] vim2m vim2m.0: vidioc_s_fmt queue busy [ 757.912537][T14603] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 758.044417][T14603] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 758.072466][T14603] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 758.809105][T14613] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 758.915695][T14613] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 759.520185][ T9] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 759.720172][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 759.727297][ T9] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 759.750760][ T9] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 759.771385][ T9] usb 4-1: config 0 interface 0 has no altsetting 0 [ 759.832968][ T9] usb 4-1: New USB device found, idVendor=060b, idProduct=500a, bcdDevice= 0.00 [ 759.889890][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 759.977376][ T9] usb 4-1: config 0 descriptor?? [ 760.130901][T14627] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 760.144258][T14627] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 760.248417][ T30] audit: type=1326 audit(1759831733.574:361): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14614 comm="syz.3.2341" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe7aa18eec9 code=0x0 [ 760.295660][ T9] usbhid 4-1:0.0: can't add hid device: -71 [ 760.303251][ T9] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 760.951806][ T9] usb 4-1: USB disconnect, device number 72 [ 761.286483][T14644] netlink: 'syz.4.2347': attribute type 1 has an invalid length. [ 761.355563][ T9] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 761.621866][ T9] usb 4-1: device descriptor read/64, error -71 [ 761.764742][T14648] netlink: 'syz.1.2348': attribute type 11 has an invalid length. [ 761.862785][ T9] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 762.040191][ T9] usb 4-1: device descriptor read/64, error -71 [ 762.150426][ T9] usb usb4-port1: attempt power cycle [ 762.524521][ T9] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 762.590390][ T9] usb 4-1: device descriptor read/8, error -71 [ 762.679675][T14655] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2351'. [ 762.750117][T14655] vlan2: entered promiscuous mode [ 762.829427][T14658] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 762.860056][ T9] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 762.871504][T14658] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 762.885767][ T9] usb 4-1: device descriptor read/8, error -71 [ 763.010225][ T9] usb usb4-port1: unable to enumerate USB device [ 763.886307][T14670] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 765.059311][T14685] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 765.130439][T14685] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 765.254320][T14691] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2361'. [ 765.683799][T14698] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2363'. [ 766.004476][T14700] netlink: 'syz.1.2364': attribute type 11 has an invalid length. [ 767.332061][T14707] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2366'. [ 767.384028][T14707] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2366'. [ 768.668558][T14729] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 768.968796][T14738] loop2: detected capacity change from 0 to 7 [ 769.001170][T14738] Dev loop2: unable to read RDB block 7 [ 769.008777][T14738] loop2: AHDI p2 p3 [ 769.014103][T14738] loop2: partition table partially beyond EOD, truncated [ 769.022211][ T1778] usb 1-1: new high-speed USB device number 62 using dummy_hcd [ 769.039561][T14738] loop2: p2 start 13841266 is beyond EOD, truncated [ 769.181109][ T1778] usb 1-1: Using ep0 maxpacket: 32 [ 769.189347][ T1778] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 769.204573][ T1778] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 769.217498][ T1778] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 769.249688][ T1778] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 769.314877][T14742] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2378'. [ 769.335280][ T1778] usb 1-1: config 0 descriptor?? [ 769.358169][ T1778] hub 1-1:0.0: USB hub found [ 769.554901][ T1778] hub 1-1:0.0: 1 port detected [ 769.757178][T14733] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 769.790402][T14749] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 769.801214][T14733] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 769.809757][T14749] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 769.942773][T14751] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 770.126524][ T1778] hub 1-1:0.0: hub_hub_status failed (err = -71) [ 770.219860][ T1778] hub 1-1:0.0: config failed, can't get hub status (err -71) [ 770.279706][ T1778] usbhid 1-1:0.0: can't add hid device: -71 [ 770.379343][ T1778] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 770.920829][ T1778] usb 1-1: reset high-speed USB device number 62 using dummy_hcd [ 771.223250][ T1778] usb 1-1: device firmware changed [ 771.235882][ T1778] usb 1-1: USB disconnect, device number 62 [ 771.488235][T14761] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2381'. [ 771.570161][ T1778] usb 1-1: new high-speed USB device number 63 using dummy_hcd [ 771.719957][ T1778] usb 1-1: Using ep0 maxpacket: 32 [ 771.728150][ T1778] usb 1-1: config 0 has an invalid interface number: 132 but max is 0 [ 771.737232][ T1778] usb 1-1: config 0 has no interface number 0 [ 771.744040][ T1778] usb 1-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 771.767651][ T1778] usb 1-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 771.785086][ T1778] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 771.803831][ T1778] usb 1-1: Product: syz [ 771.816341][ T1778] usb 1-1: Manufacturer: syz [ 771.852767][ T1778] usb 1-1: SerialNumber: syz [ 771.887991][ T1778] usb 1-1: config 0 descriptor?? [ 771.940013][ T1778] em28xx 1-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 771.950332][ T1778] em28xx 1-1:0.132: Video interface 132 found: [ 772.348729][ T1778] em28xx 1-1:0.132: unknown em28xx chip ID (39) [ 773.624332][T14801] netlink: 'syz.4.2397': attribute type 11 has an invalid length. [ 773.690059][ T5824] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 773.741056][ T1778] em28xx 1-1:0.132: failed to trigger read from i2c address 0xa0 (error=-5) [ 773.758528][ T1778] em28xx 1-1:0.132: board has no eeprom [ 773.819904][ T1778] em28xx 1-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 773.827971][ T1778] em28xx 1-1:0.132: analog set to bulk mode. [ 773.838397][ T5951] em28xx 1-1:0.132: Registering V4L2 extension [ 773.890015][ T5824] usb 3-1: Using ep0 maxpacket: 32 [ 773.907942][ T5824] usb 3-1: config 0 has an invalid interface number: 196 but max is 0 [ 773.940106][ T5824] usb 3-1: config 0 has no interface number 0 [ 773.976238][ T5824] usb 3-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 774.018601][ T5824] usb 3-1: config 0 interface 196 has no altsetting 0 [ 774.047261][ T5824] usb 3-1: New USB device found, idVendor=05ac, idProduct=77c2, bcdDevice=eb.3a [ 774.077493][ T5824] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 774.092247][ T5951] em28xx 1-1:0.132: failed to trigger read from i2c address 0x4a (error=-5) [ 774.110428][ T5824] usb 3-1: Product: syz [ 774.115991][ T5824] usb 3-1: Manufacturer: syz [ 774.134813][ T5951] em28xx 1-1:0.132: failed to trigger read from i2c address 0x48 (error=-5) [ 774.135404][ T5824] usb 3-1: SerialNumber: syz [ 774.171544][ T5824] usb 3-1: config 0 descriptor?? [ 774.183218][T14798] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 774.185753][ T5951] em28xx 1-1:0.132: failed to trigger read from i2c address 0x42 (error=-5) [ 774.203918][ T5951] em28xx 1-1:0.132: failed to trigger read from i2c address 0x40 (error=-5) [ 774.485479][ T5951] em28xx 1-1:0.132: failed to trigger read from i2c address 0x84 (error=-5) [ 774.681321][ T5951] em28xx 1-1:0.132: failed to trigger read from i2c address 0x86 (error=-5) [ 774.803660][T14820] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2400'. [ 774.846427][ T5824] ipheth 3-1:0.196: ipheth_get_macaddr: usb_control_msg: -71 [ 774.856202][ T5951] em28xx 1-1:0.132: failed to trigger read from i2c address 0x94 (error=-5) [ 774.868910][T14821] fuse: Bad value for 'fd' [ 774.882183][T14821] loop6: detected capacity change from 0 to 524288000 [ 774.895087][T14820] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2400'. [ 774.910416][ T5824] ipheth 3-1:0.196: probe with driver ipheth failed with error -71 [ 774.939751][ T5951] em28xx 1-1:0.132: failed to trigger read from i2c address 0x96 (error=-5) [ 775.059733][ T5824] usb 3-1: USB disconnect, device number 68 [ 775.134955][ T24] usb 1-1: USB disconnect, device number 63 [ 775.167624][ T24] em28xx 1-1:0.132: Disconnecting em28xx [ 775.406285][ T5951] em28xx 1-1:0.132: Config register raw data: 0xffffffed [ 775.425472][ T5951] em28xx 1-1:0.132: AC97 chip type couldn't be determined [ 775.445173][ T5951] em28xx 1-1:0.132: No AC97 audio processor [ 775.638299][ T5951] usb 1-1: Decoder not found [ 775.674186][ T5951] em28xx 1-1:0.132: failed to create media graph [ 775.699997][ T5951] em28xx 1-1:0.132: V4L2 device video103 deregistered [ 775.711584][ T5951] em28xx 1-1:0.132: Remote control support is not available for this card. [ 775.740095][ T24] em28xx 1-1:0.132: Closing input extension [ 775.842571][ T24] em28xx 1-1:0.132: Freeing device [ 776.360474][ T31] INFO: task kworker/0:3:5903 blocked for more than 143 seconds. SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 776.515169][ T31] Not tainted syzkaller #0 [ 776.581485][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 776.642722][ T31] task:kworker/0:3 state:D stack:20856 pid:5903 tgid:5903 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 776.769888][ T31] Workqueue: usb_hub_wq hub_event [ 776.775030][ T31] Call Trace: [ 776.778331][ T31] [ 776.808603][ T31] __schedule+0x1798/0x4cc0 [ 776.818803][ T31] ? __pfx___schedule+0x10/0x10 [ 776.825600][ T31] ? schedule+0x91/0x360 [ 776.870030][ T31] schedule+0x165/0x360 [ 776.874375][ T31] schedule_timeout+0x9a/0x270 [ 776.879455][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 776.890674][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 776.895952][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 776.939902][ T31] ? wait_for_completion+0x267/0x5d0 [ 776.945371][ T31] wait_for_completion+0x2bf/0x5d0 [ 776.967301][ T31] ? __pfx_wait_for_completion+0x10/0x10 [ 776.990485][ T31] i2c_del_adapter+0x581/0x6e0 [ 777.003030][ T31] ? __pfx_i2c_del_adapter+0x10/0x10 [ 777.010041][ T31] ? dvb_usbv2_exit+0x85a/0x9e0 [ 777.015870][ T31] dvb_usbv2_probe+0x4ae/0x41a0 [ 777.021579][ T31] ? __pfx_dvb_usbv2_probe+0x10/0x10 [ 777.029964][ T31] ? __pm_runtime_set_status+0x785/0xa50 [ 777.049958][ T31] usb_probe_interface+0x668/0xc30 [ 777.055432][ T31] ? __pfx_usb_probe_interface+0x10/0x10 [ 777.063473][ T31] really_probe+0x26d/0x9e0 [ 777.068085][ T31] __driver_probe_device+0x18c/0x2f0 [ 777.073577][ T31] driver_probe_device+0x4f/0x430 [ 777.078676][ T31] __device_attach_driver+0x2ce/0x530 [ 777.101192][ T31] bus_for_each_drv+0x24e/0x2e0 [ 777.117862][ T31] ? __pfx___device_attach_driver+0x10/0x10 [ 777.130130][ T31] ? __pfx_bus_for_each_drv+0x10/0x10 [ 777.135623][ T31] __device_attach+0x2b8/0x400 [ 777.149884][ T31] ? __pfx___device_attach+0x10/0x10 [ 777.155258][ T31] ? do_raw_spin_unlock+0x122/0x240 [ 777.181778][ T31] bus_probe_device+0x185/0x260 [ 777.186762][ T31] device_add+0x7b6/0xb50 [ 777.218515][ T31] usb_set_configuration+0x1a87/0x20e0 [ 777.229990][ T31] usb_generic_driver_probe+0x8d/0x150 [ 777.235674][ T31] usb_probe_device+0x1c4/0x390 [ 777.259896][ T31] ? __pfx_usb_probe_device+0x10/0x10 [ 777.270145][ T31] really_probe+0x26d/0x9e0 [ 777.274710][ T31] __driver_probe_device+0x18c/0x2f0 [ 777.291326][ T31] driver_probe_device+0x4f/0x430 [ 777.296495][ T31] __device_attach_driver+0x2ce/0x530 [ 777.302067][ T31] bus_for_each_drv+0x24e/0x2e0 [ 777.312038][ T31] ? __pfx___device_attach_driver+0x10/0x10 [ 777.318032][ T31] ? __pfx_bus_for_each_drv+0x10/0x10 [ 777.330220][ T31] __device_attach+0x2b8/0x400 [ 777.335108][ T31] ? __pfx___device_attach+0x10/0x10 [ 777.340656][ T31] ? do_raw_spin_unlock+0x122/0x240 [ 777.350335][ T31] bus_probe_device+0x185/0x260 [ 777.355354][ T31] device_add+0x7b6/0xb50 [ 777.359729][ T31] usb_new_device+0xa39/0x16f0 [ 777.364673][ T31] ? __pfx_usb_new_device+0x10/0x10 [ 777.379985][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 777.385523][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 777.391042][ T31] hub_event+0x2958/0x4a20 [ 777.401348][ T31] ? __pfx_hub_event+0x10/0x10 [ 777.406243][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 777.412338][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 777.423308][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 777.429077][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 777.435279][ T31] process_scheduled_works+0xade/0x17b0 [ 777.441361][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 777.447407][ T31] worker_thread+0x8a0/0xda0 [ 777.452544][ T31] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 777.460000][ T31] ? __kthread_parkme+0x7b/0x200 [ 777.465013][ T31] kthread+0x70e/0x8a0 [ 777.469216][ T31] ? __pfx_worker_thread+0x10/0x10 [ 777.474739][ T31] ? __pfx_kthread+0x10/0x10 [ 777.480394][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 777.485660][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 777.499946][ T31] ? __pfx_kthread+0x10/0x10 [ 777.504604][ T31] ret_from_fork+0x436/0x7d0 [ 777.509248][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 777.516202][ T31] ? __switch_to_asm+0x39/0x70 [ 777.521111][ T31] ? __switch_to_asm+0x33/0x70 [ 777.526811][ T31] ? __pfx_kthread+0x10/0x10 [ 777.540554][ T31] ret_from_fork_asm+0x1a/0x30 [ 777.545582][ T31] [ 777.567302][ T31] [ 777.567302][ T31] Showing all locks held in the system: [ 777.590289][ T31] 1 lock held by khungtaskd/31: [ 777.595311][ T31] #0: ffffffff8dd3d220 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 777.759903][ T31] 2 locks held by getty/5599: [ 777.764697][ T31] #0: ffff88802f4320a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 777.900183][ T31] #1: ffffc9000332e2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 777.949906][ T31] 4 locks held by udevd/5890: [ 777.954655][ T31] #0: ffff888078ddc540 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xb7/0xe20 [ 778.019908][ T31] #1: ffff88802b67d888 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5c/0x420 [ 778.029529][ T31] #2: ffff888079c0d008 (kn->active#24){++++}-{0:0}, at: kernfs_seq_start+0xb2/0x420 [ 778.130050][ T31] #3: ffff888020abf198 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 [ 778.189897][ T31] 5 locks held by kworker/0:3/5903: [ 778.195167][ T31] #0: ffff888143e93d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 778.299980][ T31] #1: ffffc900045afbc0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 778.379949][ T31] #2: ffff88802742d198 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4a20 [ 778.388955][ T31] #3: ffff888020abf198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x400 [ 778.460067][ T31] #4: ffff888054e25160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x400 [ 778.469597][ T31] 2 locks held by kworker/0:6/5951: [ 778.485125][ T31] #0: ffff8880b883a018 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xad/0x140 [ 778.495545][ T31] #1: ffff8880b8824048 (psi_seq){-.-.}-{0:0}, at: psi_task_switch+0x53/0x880 [ 778.504683][ T31] 1 lock held by syz.0.1544/11541: [ 778.509909][ T31] #0: ffffffff8f0d0a48 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 778.519101][ T31] 2 locks held by syz.1.1858/12624: [ 778.524708][ T31] #0: ffffffff8f0d0a48 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 778.533848][ T31] #1: ffffffff8dd42cb8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3b9/0x730 [ 778.545038][ T31] 1 lock held by syz.1.2399/14808: [ 778.551227][ T31] #0: ffffffff8f0d0a48 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 778.560362][ T31] 1 lock held by syz.3.2401/14819: [ 778.565540][ T31] #0: ffffffff8f0d0a48 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 778.574644][ T31] 4 locks held by syz.4.2408/14851: [ 778.579916][ T31] #0: ffff88805706cdc8 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x510 [ 778.590260][ T31] #1: ffff88805706c0b8 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x66a/0x1330 [ 778.600135][ T31] #2: ffffffff8f235ac8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x230 [ 778.610350][ T31] #3: ffff88801c31eb38 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x70/0x680 [ 778.619853][ T31] 1 lock held by dhcpcd/14855: [ 778.625005][ T31] #0: ffff888077380258 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xcd0 [ 778.634949][ T31] [ 778.637322][ T31] ============================================= [ 778.637322][ T31] [ 778.670784][ T31] NMI backtrace for cpu 1 [ 778.670809][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 778.670835][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 778.670850][ T31] Call Trace: [ 778.670858][ T31] [ 778.670869][ T31] dump_stack_lvl+0x189/0x250 [ 778.670906][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 778.670934][ T31] ? __pfx__printk+0x10/0x10 [ 778.670982][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 778.671023][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 778.671062][ T31] ? __pfx__printk+0x10/0x10 [ 778.671174][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 778.671201][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 778.671241][ T31] watchdog+0xf60/0xfa0 [ 778.671272][ T31] ? watchdog+0x1e2/0xfa0 [ 778.671303][ T31] kthread+0x70e/0x8a0 [ 778.671356][ T31] ? __pfx_watchdog+0x10/0x10 [ 778.671384][ T31] ? __pfx_kthread+0x10/0x10 [ 778.671420][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 778.671444][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 778.671468][ T31] ? __pfx_kthread+0x10/0x10 [ 778.671503][ T31] ret_from_fork+0x436/0x7d0 [ 778.671533][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 778.671563][ T31] ? __switch_to_asm+0x39/0x70 [ 778.671591][ T31] ? __switch_to_asm+0x33/0x70 [ 778.671620][ T31] ? __pfx_kthread+0x10/0x10 [ 778.671654][ T31] ret_from_fork_asm+0x1a/0x30 [ 778.671701][ T31] [ 778.671710][ T31] Sending NMI from CPU 1 to CPUs 0: [ 778.824656][ C0] NMI backtrace for cpu 0 [ 778.824675][ C0] CPU: 0 UID: 0 PID: 1150 Comm: kworker/u8:6 Not tainted syzkaller #0 PREEMPT(full) [ 778.824697][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 778.824710][ C0] Workqueue: events_unbound toggle_allocation_gate [ 778.824736][ C0] RIP: 0010:__phys_addr+0xa3/0x180 [ 778.824772][ C0] Code: 69 35 5c 8f 48 c1 e8 03 42 0f b6 04 38 84 c0 0f 85 98 00 00 00 44 0f b6 35 33 99 e7 0d bf 40 00 00 00 44 89 f6 e8 fd 55 4a 00 <41> 83 fe 3f 0f 87 9c 00 00 00 e8 ee 52 4a 00 49 89 df 44 89 f1 49 [ 778.824788][ C0] RSP: 0018:ffffc90003f6f4e0 EFLAGS: 00000093 [ 778.824804][ C0] RAX: ffffffff81749c43 RBX: 000000001a016000 RCX: 0000000000000000 [ 778.824818][ C0] RDX: ffff88802650dac0 RSI: 000000000000002e RDI: 0000000000000040 [ 778.824831][ C0] RBP: ffffc90003f6f5d0 R08: ffff88801a020a07 R09: 1ffff11003404140 [ 778.824850][ C0] R10: dffffc0000000000 R11: ffffed1003404141 R12: 000000001a016000 [ 778.824864][ C0] R13: dffffc0000000000 R14: 000000000000002e R15: dffffc0000000000 [ 778.824878][ C0] FS: 0000000000000000(0000) GS:ffff888126372000(0000) knlGS:0000000000000000 [ 778.824897][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 778.824910][ C0] CR2: 0000200000404030 CR3: 000000001a016000 CR4: 00000000003526f0 [ 778.824931][ C0] DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000083 [ 778.824944][ C0] DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 778.824956][ C0] Call Trace: [ 778.824964][ C0] [ 778.824973][ C0] switch_mm_irqs_off+0xe2/0x7a0 [ 778.825036][ C0] ? __pfx_switch_mm_irqs_off+0x10/0x10 [ 778.825066][ C0] ? __pfx_switch_mm_irqs_off+0x10/0x10 [ 778.825095][ C0] ? do_raw_spin_lock+0x121/0x290 [ 778.825123][ C0] ? __pte_offset_map_lock+0x13e/0x210 [ 778.825161][ C0] unuse_temporary_mm+0x136/0x220 [ 778.825182][ C0] ? __pfx_unuse_temporary_mm+0x10/0x10 [ 778.825199][ C0] ? __text_poke+0x633/0xa10 [ 778.825227][ C0] ? kasan_check_range+0x2b0/0x2c0 [ 778.825245][ C0] ? __text_poke+0x633/0xa10 [ 778.825275][ C0] ? kmem_cache_alloc_lru_noprof+0x8c/0x6d0 [ 778.825302][ C0] __text_poke+0x6c8/0xa10 [ 778.825333][ C0] ? __pfx_text_poke_memcpy+0x10/0x10 [ 778.825362][ C0] ? kmem_cache_alloc_lru_noprof+0x8c/0x6d0 [ 778.825389][ C0] ? __pfx___text_poke+0x10/0x10 [ 778.825415][ C0] ? rcu_is_watching+0x15/0xb0 [ 778.825440][ C0] ? trace_contention_end+0x39/0x120 [ 778.825473][ C0] smp_text_poke_batch_finish+0x394/0x1130 [ 778.825504][ C0] ? arch_jump_label_transform_apply+0x17/0x30 [ 778.825527][ C0] ? __pfx___mutex_lock+0x10/0x10 [ 778.825552][ C0] ? __pfx_smp_text_poke_batch_finish+0x10/0x10 [ 778.825584][ C0] ? arch_jump_label_transform_queue+0x97/0x110 [ 778.825610][ C0] arch_jump_label_transform_apply+0x1c/0x30 [ 778.825629][ C0] static_key_disable_cpuslocked+0xc5/0x1b0 [ 778.825661][ C0] static_key_disable+0x1a/0x20 [ 778.825688][ C0] toggle_allocation_gate+0x1a1/0x240 [ 778.825707][ C0] ? __pfx_toggle_allocation_gate+0x10/0x10 [ 778.825726][ C0] ? __pfx_autoremove_wake_function+0x10/0x10 [ 778.825760][ C0] ? process_scheduled_works+0x9ef/0x17b0 [ 778.825783][ C0] ? process_scheduled_works+0x9ef/0x17b0 [ 778.825806][ C0] process_scheduled_works+0xade/0x17b0 [ 778.825844][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 778.825876][ C0] worker_thread+0x8a0/0xda0 [ 778.825902][ C0] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 778.825927][ C0] ? __kthread_parkme+0x7b/0x200 [ 778.825957][ C0] kthread+0x70e/0x8a0 [ 778.825986][ C0] ? __pfx_worker_thread+0x10/0x10 [ 778.826010][ C0] ? __pfx_kthread+0x10/0x10 [ 778.826043][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 778.826063][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 778.826088][ C0] ? __pfx_kthread+0x10/0x10 [ 778.826116][ C0] ret_from_fork+0x436/0x7d0 [ 778.826143][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 778.826168][ C0] ? __switch_to_asm+0x39/0x70 [ 778.826199][ C0] ? __switch_to_asm+0x33/0x70 [ 778.826224][ C0] ? __pfx_kthread+0x10/0x10 [ 778.826252][ C0] ret_from_fork_asm+0x1a/0x30 [ 778.826287][ C0] [ 779.338874][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 779.345822][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 779.354984][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 779.365211][ T31] Call Trace: [ 779.368521][ T31] [ 779.371517][ T31] dump_stack_lvl+0x99/0x250 [ 779.376146][ T31] ? __asan_memcpy+0x40/0x70 [ 779.380938][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 779.386156][ T31] ? __pfx__printk+0x10/0x10 [ 779.390775][ T31] vpanic+0x237/0x6d0 [ 779.394776][ T31] ? __pfx_vpanic+0x10/0x10 [ 779.399292][ T31] ? preempt_schedule_common+0x83/0xd0 [ 779.404762][ T31] panic+0xb9/0xc0 [ 779.408510][ T31] ? __pfx_panic+0x10/0x10 [ 779.412960][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 779.418528][ T31] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 779.425013][ T31] watchdog+0xf9f/0xfa0 [ 779.429255][ T31] ? watchdog+0x1e2/0xfa0 [ 779.433694][ T31] kthread+0x70e/0x8a0 [ 779.437900][ T31] ? __pfx_watchdog+0x10/0x10 [ 779.442599][ T31] ? __pfx_kthread+0x10/0x10 [ 779.447395][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 779.452693][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 779.457907][ T31] ? __pfx_kthread+0x10/0x10 [ 779.462545][ T31] ret_from_fork+0x436/0x7d0 [ 779.467328][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 779.472545][ T31] ? __switch_to_asm+0x39/0x70 [ 779.477329][ T31] ? __switch_to_asm+0x33/0x70 [ 779.482121][ T31] ? __pfx_kthread+0x10/0x10 [ 779.486759][ T31] ret_from_fork_asm+0x1a/0x30 [ 779.491597][ T31] [ 779.495005][ T31] Kernel Offset: disabled [ 779.499477][ T31] Rebooting in 86400 seconds..