last executing test programs: 10.15108126s ago: executing program 1 (id=3183): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002600)=@delchain={0x16c, 0x65, 0x2, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x0, 0x1}, {0x0, 0xb}}, [@TCA_CHAIN={0x8, 0xb, 0x6}, @TCA_CHAIN={0x8, 0xb, 0x6}, @filter_kind_options=@f_bpf={{0x8}, {0x3c, 0x2, [@TCA_BPF_FD={0x8}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_FLAGS_GEN={0x8, 0x9, 0x3}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_FD={0x8}, @TCA_BPF_FLAGS={0x8, 0x8, 0x1}]}}, @TCA_RATE={0x6, 0x5, {0x6, 0x2}}, @filter_kind_options=@f_route={{0xa}, {0xe0, 0x2, [@TCA_ROUTE4_TO={0x8, 0x2, 0xca}, @TCA_ROUTE4_IIF={0x8}, @TCA_ROUTE4_ACT={0xcc, 0x6, [@m_mirred={0x58, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x29, 0x6, "b9e6cb743efb5818279b291a7d56a99d728d0d3c5750442cdd89714a7135052ff6aa167b6d"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x1}}}}, @m_mirred={0x70, 0x9, 0x0, 0x0, {{0xb}, {0x4}, {0x44, 0x6, "216194e50e7faa7649d1c06839be3b59a7f1bb6c7fbd0e7344b4e9b561d4b406f4a7a0c7e6ebe935ccd4c10fd3ff9357cc52da0d5a0f390e738e2309dae089a4"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2}}}}]}]}}]}, 0x16c}, 0x1, 0x0, 0x0, 0x81}, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x64}, {&(0x7f0000000280)=""/85, 0x55}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/106, 0x6a}, {0x0}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x9a}, {&(0x7f00000001c0)=""/17, 0x11}], 0x8, &(0x7f0000000600)=""/191, 0xbf}}], 0x1, 0x2040000, &(0x7f0000003700)={0x77359400}) 9.974400792s ago: executing program 1 (id=3185): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000000000040de28421100000000000109022400010000000009040000010300000009"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000001c0)={0x2c, &(0x7f0000000000)=ANY=[@ANYBLOB="00000500"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x9300) setsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, 0x0, 0x0) ioctl$HIDIOCGFEATURE(r1, 0xc0404807, 0x0) 7.00198616s ago: executing program 3 (id=3205): r0 = syz_io_uring_setup(0x1b7e, &(0x7f0000000080)={0x0, 0xfcc3, 0x1000, 0x3, 0xf5}, &(0x7f0000000000), &(0x7f0000000180)) io_uring_setup(0x3c8f, &(0x7f0000000100)={0x0, 0xeca2, 0x20, 0x2, 0x13, 0x0, r0}) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001480), 0x42002, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/timer_list\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x20000023896) socket$kcm(0x10, 0x2, 0x0) epoll_create1(0x80000) r3 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f00000002c0)={{{@in=@empty, @in=@local, 0x0, 0x8, 0x0, 0x0, 0xa, 0x50, 0x180, 0x2b}, {0x0, 0x0, 0x0, 0x0, 0x7, 0x80000}, {0xfffffffffffffffc, 0x3}, 0x0, 0x0, 0x1, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x42}, 0x0, 0x6c}, 0x0, @in6=@remote, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffe}}, 0xe8) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x12d142, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x12, r4, 0xfffff000) fcntl$getownex(r4, 0x10, &(0x7f0000000080)) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$uinput_user_dev(r5, &(0x7f0000000240)={'syz0\x00', {0x508, 0x7, 0x7, 0x1}, 0x4a, [0x5f11bec3, 0x3, 0x5, 0x40, 0x0, 0x3, 0x0, 0x7d, 0x80013, 0x5, 0x0, 0x6, 0xfffffffe, 0x0, 0x4000000, 0x2, 0x1a4, 0xfffff605, 0x3, 0x0, 0x80, 0x7ff, 0xe2e, 0x7, 0x681c1eb5, 0x11e, 0x0, 0x2, 0x0, 0xe9, 0x0, 0xffff, 0x9, 0x4, 0x0, 0x3, 0x0, 0x0, 0x5de82a4e, 0x100, 0x0, 0x20000, 0x4, 0xfffffffe, 0x1, 0x0, 0x8000, 0x7, 0x0, 0xe0, 0x3fd, 0x5, 0xfffffff7, 0x0, 0xf685, 0x0, 0x1ab9, 0x0, 0x2, 0xffff, 0xfffffffb, 0x1c15d73a, 0x2], [0x0, 0x0, 0x0, 0x0, 0x4, 0x1, 0x8, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x5, 0x0, 0x61c5fb46, 0x10000, 0x80, 0x4, 0x10001, 0x75, 0x0, 0x4, 0x0, 0xd, 0x80000000, 0x0, 0x61c4, 0x9, 0x0, 0x9, 0x2, 0xff, 0x2, 0x10001, 0x3, 0x0, 0x7, 0xfffffffb, 0xffffff00, 0xfffffffe, 0x10, 0x0, 0x0, 0x0, 0x1, 0xffff, 0x9, 0x441238ca, 0x0, 0x0, 0x0, 0xfffffff9, 0x2, 0x7fffffff, 0x6, 0x2], [0x0, 0xc50, 0x3, 0x9f5, 0x0, 0xa02, 0x1c75, 0xf51, 0x6, 0x40, 0x0, 0x21, 0x20000, 0x0, 0x6, 0x0, 0x0, 0x0, 0x205, 0x5, 0xfffffffd, 0xc, 0x0, 0x200, 0xcc0, 0x401, 0x6, 0x6, 0x0, 0x0, 0xffffff7f, 0xe, 0x921, 0x2f, 0x0, 0x0, 0x0, 0x0, 0x15960318, 0x0, 0x0, 0x0, 0xfffffffc, 0x9, 0x5, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0xfffffffe, 0x4, 0x0, 0x6574, 0xb, 0x0, 0xcd55, 0xfb], [0x0, 0x6, 0x0, 0x2, 0x1, 0xffffffff, 0x2000005, 0x200, 0xffffffff, 0xd63, 0x6, 0x0, 0x0, 0x0, 0xfffffffa, 0xfa3, 0x3ff, 0x8, 0x4, 0x0, 0xffffffff, 0x1, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x194e, 0x0, 0xe793, 0x4ad, 0x4, 0x0, 0x80000001, 0x3, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x40, 0x8000010, 0x8, 0x5, 0x400, 0x0, 0x7ff7, 0x6, 0x800, 0x5, 0xd, 0x0, 0x40000000, 0x0, 0x4, 0x45d, 0x4, 0x0, 0xfff, 0xb2, 0xa, 0xb]}, 0x45c) r6 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) pwritev(r6, &(0x7f0000000580)=[{&(0x7f0000000240)}, {&(0x7f0000000280)="f697079a161cfb7702711e629acda76933ddd0c20574eb4d4d28f9", 0x1b}, {&(0x7f00000002c0)="c27d037369597e0a4e", 0x9}], 0x3, 0xfffffffe, 0x0) r7 = socket$inet_sctp(0x2, 0x5, 0x84) socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r7, 0x84, 0xa, 0x0, &(0x7f0000000180)) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x8, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="8500000055000000009500000000000000"], &(0x7f0000000040)='syzkaller\x00', 0x4, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffed8, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x3f) prctl$PR_SCHED_CORE(0x3e, 0x8000000000001, 0x0, 0x2, 0x0) r8 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r9 = dup(r8) write$6lowpan_enable(r9, &(0x7f0000000000)='0', 0xfffffd2c) syz_io_uring_setup(0x4e1, 0x0, 0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r10, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {}, 0x1}) r11 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x42) ioctl$SCSI_IOCTL_SEND_COMMAND(r11, 0x1, &(0x7f00000006c0)=ANY=[@ANYBLOB="0000000008000000bf003ff7"]) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0) 6.602710782s ago: executing program 4 (id=3206): r0 = socket$packet(0x11, 0x3, 0x300) r1 = dup(r0) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r2, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000340)) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f00000001c0)=0x304008000) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f00000002c0)={0x0, r1}) ioctl$VHOST_RESET_OWNER(r2, 0xaf02, 0x0) 6.485712718s ago: executing program 1 (id=3207): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000080)={'syz0\x00', {}, 0x0, [0x0, 0x3, 0x3ff, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x10000000, 0x99, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3, 0x400, 0x0, 0x0, 0x9], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xedc0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa0000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff8, 0x2, 0x0, 0x2000079, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xc0000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0xffffffff], [0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x6, 0x2, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x4, 0x2, 0x0, 0x1], [0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x800, 0x0, 0x0, 0x6, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x8000000, 0x4, 0x0, 0x0, 0x0, 0x100000]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f326635004000000f300f20e06635800000000f22e0f30fa6c8", 0x50}], 0x1, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f00000004c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0}, 0x10) ioctl$KVM_RUN(r3, 0xae80, 0x0) 6.035375521s ago: executing program 4 (id=3208): r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000000)=0x1, 0x4) (async) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e21, 0x9, @private0={0xfc, 0x0, '\x00', 0x1}, 0xff}, 0x1c) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="050000000b0000000a0000000900000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00$'], 0x48) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000001600)={0x0, 0x0, &(0x7f0000000000), &(0x7f0000001680), 0x8000, r1}, 0x38) (async) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) (async, rerun: 64) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x0, &(0x7f0000000180)=0x2, 0x4) (rerun: 64) bpf$MAP_UPDATE_BATCH(0x19, &(0x7f0000001600)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x4}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x8, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="960001000000c29bc2a91e9008a149e2f1d100007732420d9d2a9500"/42], &(0x7f0000000600)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) (async) syz_emit_ethernet(0x8e, &(0x7f0000000380)={@multicast, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f4adf7", 0x58, 0x2c, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast2, {[@hopopts={0x3a}], @pkt_toobig={0x2, 0x0, 0x0, 0x4, {0x8, 0x6, "cd85b5", 0x7, 0x84, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @remote, [], "aad25a7f302d4579b298392ccf95e1e48f10658b1a1c7edc1ffd13d9ccbf356d"}}}}}}}, 0x0) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) (async, rerun: 32) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) (rerun: 32) ioctl$SNDCTL_DSP_SETFMT(r2, 0xc0045005, &(0x7f0000001180)=0x2000000) mmap$dsp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x3, 0x12, r2, 0x0) (async, rerun: 32) ioctl$SNDCTL_DSP_SETTRIGGER(r2, 0x40045010, &(0x7f0000000040)=0x9) (async, rerun: 32) ioctl$SNDCTL_DSP_SETTRIGGER(r2, 0x40045010, &(0x7f0000000080)=0x7) r3 = shmget$private(0x0, 0x13000, 0x1, &(0x7f0000feb000/0x13000)=nil) r4 = shmat(r3, &(0x7f0000ff6000/0x4000)=nil, 0x400c) (async) mremap(&(0x7f0000fec000/0x4000)=nil, 0x4000, 0x3000, 0x3, &(0x7f0000ff9000/0x3000)=nil) mremap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2000, 0x3, &(0x7f0000ff7000/0x2000)=nil) shmdt(r4) (async) r5 = syz_io_uring_setup(0xd6, &(0x7f0000000480)={0x0, 0x0, 0x800, 0x3, 0xfffffffd}, &(0x7f0000000040)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) (async, rerun: 64) syz_io_uring_submit(r6, r7, &(0x7f0000000200)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) (rerun: 64) io_uring_enter(r5, 0x47ba, 0x0, 0x0, 0x0, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000000)) (async) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000240)={0x53, 0xfffffffffffffffc, 0x6, 0x8c, @scatter={0x3, 0x0, &(0x7f0000000140)=[{&(0x7f0000000040)=""/188, 0xbc}, {&(0x7f00000008c0)=""/4096, 0x1000}, {&(0x7f00000018c0)=""/4096, 0x1000}]}, &(0x7f0000000880)="2a6b0f51025c", 0x0, 0x90f, 0x12, 0x0, 0x0}) 5.885525439s ago: executing program 3 (id=3209): r0 = socket(0x40000000015, 0x5, 0x0) recvmmsg(r0, 0x0, 0x0, 0x8d95bf3456059e12, 0x0) syz_io_uring_setup(0x3ad5, 0x0, &(0x7f0000000100), 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r1) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r2, 0x0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) syz_emit_ethernet(0x46, &(0x7f0000000080)={@local, @link_local, @val={@void, {0x8100, 0x0, 0x0, 0x4}}, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0xfffc, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x8, 0x2, 0x0, 0x0, 0x0, {[@mptcp=@syn={0x1e, 0xc, 0x2, 0x1, 0x0, 0xff, 0x3}]}}}}}}}, 0x0) (fail_nth: 1) 5.715418738s ago: executing program 1 (id=3212): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002600)=@delchain={0x16c, 0x65, 0x2, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x0, 0x1}, {0x0, 0xb}}, [@TCA_CHAIN={0x8, 0xb, 0x6}, @TCA_CHAIN={0x8, 0xb, 0x6}, @filter_kind_options=@f_bpf={{0x8}, {0x3c, 0x2, [@TCA_BPF_FD={0x8}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_FLAGS_GEN={0x8, 0x9, 0x3}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_FD={0x8}, @TCA_BPF_FLAGS={0x8, 0x8, 0x1}]}}, @TCA_RATE={0x6, 0x5, {0x6, 0x2}}, @filter_kind_options=@f_route={{0xa}, {0xe0, 0x2, [@TCA_ROUTE4_TO={0x8, 0x2, 0xca}, @TCA_ROUTE4_IIF={0x8}, @TCA_ROUTE4_ACT={0xcc, 0x6, [@m_mirred={0x58, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x29, 0x6, "b9e6cb743efb5818279b291a7d56a99d728d0d3c5750442cdd89714a7135052ff6aa167b6d"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x1}}}}, @m_mirred={0x70, 0x9, 0x0, 0x0, {{0xb}, {0x4}, {0x44, 0x6, "216194e50e7faa7649d1c06839be3b59a7f1bb6c7fbd0e7344b4e9b561d4b406f4a7a0c7e6ebe935ccd4c10fd3ff9357cc52da0d5a0f390e738e2309dae089a4"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2}}}}]}]}}]}, 0x16c}, 0x1, 0x0, 0x0, 0x81}, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x64}, {&(0x7f0000000280)=""/85, 0x55}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f0000000980)=""/73, 0x49}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x9a}, {&(0x7f00000001c0)=""/17, 0x11}], 0x7, &(0x7f0000000600)=""/191, 0xbf}}], 0x1, 0x2040000, &(0x7f0000003700)={0x77359400}) 5.621524913s ago: executing program 3 (id=3213): bpf$BPF_PROG_DETACH(0x9, &(0x7f00000002c0)=ANY=[@ANYRES32, @ANYBLOB="addaced30a01a7"], 0x20) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={0x0, 0x6f4}}, 0x0) 5.425729695s ago: executing program 3 (id=3215): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) gettid() read$FUSE(0xffffffffffffffff, 0x0, 0x0) openat$cgroup(0xffffffffffffffff, 0x0, 0x200002, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe5000/0x18000)=nil, &(0x7f00000001c0)=[@text64={0x40, 0x0}], 0x1, 0x4e, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, &(0x7f0000000000)="0f080fae04a200400f01c426660f3a15e6160fc76bdbf08666350f2170260fed9c000066b9230b00000f32", 0x2b}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = syz_usb_connect(0x0, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d0102030109021200"], 0x0) syz_usb_control_io$cdc_ecm(r4, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r4, 0x0, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x4, 0x8, 0x3, 0x0, 0x0, {0x7, 0x0, 0x9}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x1) 5.425318168s ago: executing program 1 (id=3216): socket$packet(0x11, 0x3, 0x300) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0x14, 0x30, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x804}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e) r1 = socket$inet6(0xa, 0x1, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="020300090a0000000000000004000000030006000000000002000000ac1414000000000000000000020001000000000000000002fffffffb030005000000000002"], 0x50}}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000180)={{{@in=@private, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@local, 0x0, 0x6c}, 0x0, @in6=@loopback, 0x0, 0x0, 0x0, 0x4}}, 0xe8) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) 5.167736314s ago: executing program 4 (id=3218): r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip6_mr_vif\x00') lseek(r0, 0x37, 0x1) syz_emit_vhci(&(0x7f00000001c0)=ANY=[@ANYBLOB="043c07aaaaaaaaaa1001166109c0de1fe5d70787e8e4938316a36f9badf6117aef245b0f9030af410427b896e721bd273ca53ed3f365e253909cdecaa8fb39d1a613628d410e33b82fa3b38c8c52e815569c4278629e22c8"], 0xa) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000040)=[@timestamp, @window={0x3, 0x8, 0x1}, @timestamp, @timestamp, @mss={0x2, 0x6}], 0x5) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'sha224-avx\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="d529f28981dc56d34e626ec70afef5ac85cccd3d5b5ad8d0375a3737f4d551faf0a67e16de35a73020042c87332d38b46e9a004c0bb7b645796845f3b133dcb3649407130478d319045927f892f48c69e1ed970cc8922bf91373ffcf73ec1d9f80b6967a617794e089effba2f8b19398ddf3138a66bb9d574d8f4bce9c4b7f21a6e4ee47f935c76cf05dbd4fb7e6e0864781baaae864a11ff1e719afd4014155f61987eb350b4d7ac791f4", 0xab}, {&(0x7f0000007000)="5824e9e1de71619e3571eed8033a4d7c370f40e706", 0x15}], 0x2}}], 0x1, 0x0) 5.050750891s ago: executing program 2 (id=3219): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000340)=[{0x20, 0x0, 0x0, 0xf7fff00c}, {0x6, 0x0, 0x0, 0x2}]}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newtaction={0x14, 0x30, 0x1}, 0x14}}, 0x8000) (fail_nth: 1) 4.913560647s ago: executing program 4 (id=3220): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002600)=@delchain={0x1f0, 0x65, 0x2, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x0, 0x1}, {0x0, 0xb}}, [@TCA_CHAIN={0x8, 0xb, 0x6}, @TCA_CHAIN={0x8, 0xb, 0x6}, @filter_kind_options=@f_bpf={{0x8}, {0x40, 0x2, [@TCA_BPF_FD={0x8}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_ACT={0x4}, @TCA_BPF_FLAGS_GEN={0x8, 0x9, 0x3}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_FD={0x8}, @TCA_BPF_FLAGS={0x8, 0x8, 0x1}]}}, @TCA_RATE={0x6, 0x5, {0x6, 0x2}}, @filter_kind_options=@f_route={{0xa}, {0x160, 0x2, [@TCA_ROUTE4_TO={0x8, 0x2, 0xca}, @TCA_ROUTE4_IIF={0x8}, @TCA_ROUTE4_ACT={0x14c, 0x6, [@m_mirred={0x58, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x29, 0x6, "b9e6cb743efb5818279b291a7d56a99d728d0d3c5750442cdd89714a7135052ff6aa167b6d"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x1}}}}, @m_mirred={0xf0, 0x9, 0x0, 0x0, {{0xb}, {0x84, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x7, 0x5, 0x10000000, 0xae, 0x2}, 0x3}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x9, 0x3, 0x10000000, 0x8, 0x8}, 0x4}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x1336e5ff, 0x9, 0x6, 0x0, 0x1}, 0x7}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x100, 0x6, 0x7, 0x1f31, 0xfffffff5}, 0x4}}]}, {0x41, 0x6, "216194e50e7faa7649d1c06839be3b59a7f1bb6c7fbd0e7344b4e9b561d4b406f4a7a0c7e6ebe935ccd4c10fd3ff9357cc52da0d5a0f390e738e2309da"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2}}}}]}]}}]}, 0x1f0}, 0x1, 0x0, 0x0, 0x81}, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x64}, {&(0x7f0000000280)=""/85, 0x55}, {&(0x7f0000000400)=""/106, 0x6a}, {&(0x7f0000000980)=""/73, 0x49}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x9a}, {&(0x7f00000001c0)=""/17, 0x11}], 0x7, &(0x7f0000000600)=""/191, 0xbf}}], 0x1, 0x2040000, &(0x7f0000003700)={0x77359400}) 4.407764032s ago: executing program 2 (id=3221): openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x200002, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fd7000/0x18000)=nil, &(0x7f0000005700)=[@text32={0x20, 0x0}], 0x1, 0xc, 0x0, 0x0) keyctl$instantiate(0xc, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="6e6577206465666175747409757365723a73797a20303030303039b10ec129ac015d720f3a3030301ac7e79ebc8084a901d3da76"], 0x2a, 0x0) r3 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) r4 = add_key$keyring(&(0x7f00000002c0), &(0x7f0000000300)={'syz', 0x3}, 0x0, 0x0, r3) keyctl$search(0xa, r3, &(0x7f00000000c0)='cifs.spnego\x00', &(0x7f0000000200)={'syz', 0x3}, r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) r6 = inotify_init1(0x0) inotify_add_watch(r6, &(0x7f0000000040)='./file1\x00', 0x775) write$binfmt_elf64(r5, &(0x7f0000000180)=ANY=[], 0xe6) sendfile(r5, r5, &(0x7f0000000000)=0x9, 0xeb) keyctl$read(0xb, r3, &(0x7f0000000240)=""/112, 0x349b7f55) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000040)="640f7927660f3880b0c9d300002e454f01b60018000066460f3acfc8aa410f01cab9850800000f322e470f01cb3e0f01d1c4e20129100f20c035000001000f22c0", 0x41}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r7 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r7, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000340)=[{0x20, 0x0, 0x0, 0xf7fff00c}, {0x6, 0x0, 0x0, 0x1ffffe}]}, 0x10) r8 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) syz_usb_control_io(r8, 0x0, &(0x7f00000010c0)={0x44, &(0x7f0000000080)=ANY=[@ANYBLOB="00000100000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r8, 0x0, 0x0) syz_usb_control_io$printer(r8, 0x0, &(0x7f0000000b80)={0x34, &(0x7f0000000c40)=ANY=[@ANYBLOB="0000790000004149e841fd71f203a219733566f1ecb5f35de6401fe9d74634bafaf59cfb2212a8058844b679660d82a07a1a616ff42b589ef770e43234bd2e034cbefb6f9b2d635daf56"], 0x0, 0x0, 0x0, 0x0, 0x0}) r9 = socket$netlink(0x10, 0x3, 0x1d) socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newtaction={0x14, 0x30, 0x1, 0xffffffff}, 0x14}, 0x1, 0x0, 0x0, 0x4044}, 0x5880) 4.285338718s ago: executing program 4 (id=3222): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0) lstat(0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) syz_usb_connect(0x0, 0x0, 0x0, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000180)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002cbd7000000000000200000008000300", @ANYRES32=r3, @ANYBLOB="08001501b60100000800260080090000"], 0x2c}, 0x1, 0x0, 0x0, 0x8001}, 0x4040000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000007c0)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f00000002c0)={'wlan0\x00', &(0x7f0000000280)=@ethtool_rxfh={0x46, 0x2, 0x9, 0xe8e4, 0x8, "050180", 0x102}}) syz_clone(0x60000000, &(0x7f0000000380)="c02920d7ed92ad768184b6084ed18a2d55e7ae0e2d13c042487f08968debba7c4b3b4b9ab3067f3c9d76f891ec6a289395ef4fa3b0aba3bd859e60f3e7d509af34055e2fd82bb36f42328b7cc3801e3bf895f8d7b80a60869e4fcc403d37fbcea788c01d10bd92109fd4b58ff60ec52b4c2321deeeb6bdc9b041ed2fce97a3c5421a96e1e154e1d2b91d3feacdaf7e05ac48b1", 0x93, &(0x7f00000000c0), &(0x7f0000000140), &(0x7f0000000440)="29718c93943ccdc0123fc37558c1a1a45156cf90696893fa96b5818859f40229132ea21b9300bc2d44ec8c84f97501fbd97932757ad925318da36fc36e63054fe6a894089628cc60ff8539bf34e0b4894223dbc91795a589fb0e03498209e6696ce63fbc23903a78fae5da1545cf80de7b550731e17b2f1a92d405a40f89724bcbdd3d746893398c858f818881a1bea2cff5fdcade") syz_pidfd_open(0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) ioctl$VHOST_SET_LOG_FD(0xffffffffffffffff, 0x4004af07, &(0x7f0000000340)) setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3}) gettid() openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000240), 0x80140, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000200)={0x0, &(0x7f0000000100)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_DESTROYPROPBLOB(0xffffffffffffffff, 0xc00464be, &(0x7f0000000300)) unshare(0x42040200) ioctl$SOUND_MIXER_READ_VOLUME(0xffffffffffffffff, 0x80044d12, &(0x7f00000001c0)) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(0xffffffffffffffff, 0xc01064bd, 0x0) 2.444641855s ago: executing program 1 (id=3223): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000007, 0x38011, r1, 0x2c9ab000) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() (fail_nth: 1) 2.361828027s ago: executing program 0 (id=3224): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e22, @empty}, 0x67) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) syz_emit_ethernet(0x36, &(0x7f0000000180)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) syz_emit_ethernet(0x76, &(0x7f0000000640)={@local, @local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x68, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x15, 0x10, 0x0, 0x0, 0x0, {[@mptcp=@capable={0x1e, 0xc}, @mptcp=@syn={0x1e, 0xc}, @sack={0x5, 0x16, [0x0, 0x0, 0x0, 0x0, 0x0]}, @md5sig={0x13, 0x12, "a4bcbcee95c6179191d2675112a6689b"}]}}}}}}}, 0x0) 1.868287516s ago: executing program 0 (id=3225): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e22, @empty}, 0x67) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) syz_emit_ethernet(0x36, &(0x7f0000000180)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) syz_emit_ethernet(0x76, &(0x7f0000000640)={@local, @local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x68, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x15, 0x10, 0x0, 0x0, 0x0, {[@mptcp=@capable={0x1e, 0xc}, @mptcp=@syn={0x1e, 0xc}, @sack={0x5, 0x16, [0x0, 0x0, 0x0, 0x0, 0x0]}, @md5sig={0x13, 0x12, "a4bcbcee95c6179191d2675112a6689b"}]}}}}}}}, 0x0) (fail_nth: 1) 1.341995036s ago: executing program 0 (id=3226): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) quotactl$Q_SYNC(0xffffffff80000102, 0x0, 0x0, 0x0) quotactl$Q_SYNC(0xffffffff80000102, 0x0, 0x0, 0x0) 1.115528148s ago: executing program 2 (id=3227): bpf$BPF_PROG_DETACH(0x9, &(0x7f00000002c0)=ANY=[@ANYRES32, @ANYBLOB="addaced30a01a7"], 0x20) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c", 0x8) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, 0x0, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r4, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r5, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 934.192081ms ago: executing program 4 (id=3228): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.numa_stat\x00', 0x26e1, 0x0) r0 = socket$kcm(0xa, 0x2, 0x88) sendmsg$kcm(r0, 0x0, 0x200ce0c0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r1, 0xfffffffc) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x10) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x40004) socket$nl_generic(0x10, 0x3, 0x10) sendto$inet6(r1, 0x0, 0x0, 0x20004011, 0x0, 0x0) 923.349598ms ago: executing program 0 (id=3229): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.numa_stat\x00', 0x26e1, 0x0) r0 = socket$kcm(0xa, 0x2, 0x88) sendmsg$kcm(r0, 0x0, 0x200ce0c0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r1, 0xfffffffc) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000100)='1', 0x1) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="f104c12da587b7934516df8285d851416c22bd48fcbd8c9037124c004816f75209f04071de8006ba803aaf7513e82493dc916474d9772f4d8da5c4957bd26ea66dfa045258b2f0c225e46410ebc5f80ab48fb4c409de8fc352a004e46e68f5c0b809ad2b3da2dd4890317965918ccf12d1b0176978a25654d52e0519e9d92ee3ae3603457cd18efcbc588fcacd973f0f9a17b742c5bf7816ec74d9bcbd4c5e2b7778d22a28155d0d", @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='\x00', 0x88901) r4 = open_tree(0xffffffffffffff9c, &(0x7f00000002c0)='./file0/../file0\x00', 0x89901) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/kexec_crash_loaded', 0x40000, 0x41) read$watch_queue(r6, &(0x7f0000000240)=""/39, 0x88) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r8, 0xc01864c6, &(0x7f0000000100)={0x0, 0x0, 0x800}) ioctl$DRM_IOCTL_SET_MASTER(r4, 0x641e) sendmsg$NFT_BATCH(r7, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x10) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x40004) socket$nl_generic(0x10, 0x3, 0x10) 908.861013ms ago: executing program 3 (id=3230): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000a40), 0x40400, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, r1, 0x0) syz_clone3(&(0x7f0000002740)={0x40100, 0x0, 0x0, 0x0, {0x5}, 0x0, 0x0, 0x0, 0x0}, 0x58) 745.536284ms ago: executing program 2 (id=3231): r0 = syz_open_procfs(0x0, &(0x7f0000000800)='net/arp\x00') close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) sendmsg$NL80211_CMD_DEL_PMKSA(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000700)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="01002dbd7000fcdbdf253500000008000300", @ANYRES32=0x0, @ANYBLOB="9c05faf66a5d8d071b9053fb4461687c868636b2281bfec59a3c6d5c788fdd0527a853401c7824f45d9e3dbb2c48604ab61bbef5feee729ef33ad66af9529fd86ba4d05eec8b0a88d5f4396b90577cecd88466fe09adfd9659a53eacac5c00a6fab3f3744bf447b941592e5602ea7e6b57f9758ba3256da071528fa8b6b5b7ce3e3aff1cb6768530dc7509ca98bd2d2c38a68314f95774af1d214f1ee1736233d166cbe19d8ffcee3961dca6682fdba389d4c881d068e9e9108e8e483099ea681810eae6e1ca94c605c8b7bb84f185a556e0e8cdff"], 0x1c}, 0x1, 0x0, 0x0, 0x24000005}, 0x20040000) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x2200, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f00000004c0)=ANY=[@ANYBLOB="010000000015000072000040"]) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000380)={0x2, 0x4e22, @empty}, 0x10) setsockopt$sock_int(r5, 0x1, 0x800000000f, &(0x7f0000000080)=0x7, 0x4) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r6, 0x29, 0x1a, &(0x7f0000000100)=0x401, 0x4) setsockopt$sock_int(r6, 0x1, 0x1e, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r6, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty, 0xffffffff}, 0x1c) listen(r5, 0x0) listen(r6, 0x100003) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x670, 0xd0, 0xd0, 0x428, 0xd0, 0xd0, 0x5a0, 0x5a0, 0x5a0, 0x5a0, 0x5a0, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x5}}}, {{@ipv6={@mcast1, @local, [], [], 'macvtap0\x00', 'ip6tnl0\x00', {}, {}, 0x6, 0x0, 0x0, 0x4a}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@broadcast}}}, {{@ipv6={@mcast2, @loopback, [], [], 'veth0_to_team\x00', 'syzkaller0\x00'}, 0x0, 0x100, 0x128, 0x0, {}, [@common=@unspec=@connmark={{0x30}}, @common=@inet=@socket1={{0x28, 'socket\x00', 0x2}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}, {{@uncond, 0x0, 0x120, 0x148, 0x0, {}, [@common=@frag={{0x30}}, @common=@hbh={{0x48}}]}, @inet=@DSCP={0x28}}, {{@uncond, 0x0, 0x138, 0x178, 0x0, {}, [@common=@dst={{0x48}}, @common=@dst={{0x48}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@dev}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x6d0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup\x00', 0x610480, 0x0) open_by_handle_at(r7, 0x0, 0x12000) r8 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xd, &(0x7f0000000940)=ANY=[@ANYRES16=0x0, @ANYBLOB="8df33cfefb1d35983b0985f271473ada12e1684bbde43e40592ca19c2200156416ea6d28196ecf2f5a0564b4a849a7c4761579312be8b3cb284ae6091951cc15f60e6c60c5c4ce20fc9d3c62c35fc2b177b78c7a6566f283917da0e2deb3165c96505efd980a27edf20be4259d8d1b3b8ed3d95a713f5495ffa1356b06254fd20708356042a6424f65dda5961d9e2565db948164b9597ff090fd1e4affddc8489b16bd0e7f88b0e79f098f7a43fa4b3a8743cb07c0f80b7bc702b7a6ffddac4d359ce094a988456f9780022afef883cced3e154e9b79fdfdfc0c8be1a17ff92c507192193be342e2009ec87cb11bd17f751200562c6ba0ea5d42652e601b1669efb2e4cff8bf64a0c2806073e801b2c6d5f0d27919e2ef2614e10ad606bc91a5f9cab8a9ca56b9c129ecb35dd005c35b62b7", @ANYBLOB="000000070000000000000060662d741700000000696c0000ec5d00007b8af8ff00000000bfa200f8ffffffb703000008000000b7040000000400008500000001000000000000000000", @ANYBLOB="47dc9a696e0febfa4e6dc7eb979ae82216771c105fbfda1fa601dcf025feab98e988c8753ab8483423a0c5a6ded9a57ea3b9cde74b7fe1f91e", @ANYRES8=r8, @ANYRES64=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r8, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r9}) process_vm_readv(0x0, &(0x7f0000008400)=[{&(0x7f0000000300)=""/43, 0x7ffff000}, {&(0x7f0000000480)=""/165, 0x98}], 0x2, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x7ffff000}], 0x2aa, 0x0) getsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, &(0x7f0000000840)={{{@in=@dev, @in6=@ipv4={""/10, ""/2, @multicast2}}}, {{@in6=@ipv4}, 0x0, @in=@local}}, &(0x7f0000000ec0)=0xe8) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000f00)={0x0, 0x0, 0x0}, &(0x7f0000000f40)=0xc) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r0, 0xc018937b, &(0x7f0000000f80)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {r10, r11}}, './cgroup\x00'}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000fc0)=ANY=[@ANYBLOB="0200000004000000080000b84c907281bb114500", @ANYRES32=0x1, @ANYBLOB="ab0f00"/20, @ANYRES32=0x0, @ANYRES32=r7, @ANYBLOB="02000000000000000300"/28], 0x50) 584.670574ms ago: executing program 0 (id=3232): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/mdstat\x00', 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r1, &(0x7f0000000e40)=[{{&(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, 0x1c, &(0x7f0000000580)=[{&(0x7f0000000040), 0xff7a}], 0x1}}], 0x8000000000000df, 0x40080c1) syz_usb_connect(0x0, 0x63, &(0x7f0000000000)=ANY=[@ANYBLOB="120100005e05b14021040203e8450000000109025100010000000009040900000202ff00052406000105240000000d24b8fe3f9ea3a0e8ca0800ff06241a05002a052401010305240600"], 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r2 = socket(0x10, 0x803, 0x40000008) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$VIDIOC_S_PARM(0xffffffffffffffff, 0xc0cc5616, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) ioctl$sock_inet_tcp_SIOCOUTQ(r2, 0x5411, 0x0) r5 = syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000003680)={0x0, 0x0, &(0x7f0000003640)={&(0x7f0000000100)={0x30, r5, 0x1, 0x70bd2d, 0x25dfdbff, {{}, {}, {0x14, 0x14, 'broadcast-link\x00'}}}, 0x30}, 0x1, 0x0, 0x0, 0x4000040}, 0x20000004) stat(0x0, &(0x7f0000000140)) openat$fuse(0xffffff9c, &(0x7f00000000c0), 0x2, 0x0) r6 = syz_io_uring_setup(0x7b1, &(0x7f0000000200)={0x0, 0x200086f7, 0x80, 0x0, 0x3b6, 0x0, r0}, &(0x7f0000002000)=0x0, &(0x7f0000000000)=0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000940)={@cgroup, 0xffffffffffffffff, 0x5, 0x2020, 0xffffffffffffffff, @void, @void, @value}, 0x20) syz_usb_connect(0x0, 0x24, &(0x7f0000000500)=ANY=[@ANYBLOB="0a01000005af9e08d2106528c9a40000000109021200010000000009"], 0x0) syz_io_uring_submit(r7, r8, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x23}) r9 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="1400000016000b63d25a80648c2594f91524fc60", 0x14}], 0x1}, 0x0) io_uring_enter(r6, 0x48e9, 0x0, 0x3, 0x0, 0x0) 533.964628ms ago: executing program 3 (id=3233): socket$packet(0x11, 0x3, 0x300) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0x14, 0x30, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x804}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e) r1 = socket$inet6(0xa, 0x1, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="020300090a0000000000000004000000030006000000000002000000ac1414000000000000000000020001000000000000000002fffffffb030005000000000002"], 0x50}}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000180)={{{@in=@private, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@local, 0x0, 0x6c}, 0x0, @in6=@loopback, 0x0, 0x0, 0x0, 0x4}}, 0xe8) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) 321.650974ms ago: executing program 2 (id=3234): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002600)=@delchain={0x5f8, 0x65, 0x2, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x0, 0x1}, {0x0, 0xb}}, [@TCA_CHAIN={0x8, 0xb, 0x6}, @TCA_CHAIN={0x8, 0xb, 0x6}, @filter_kind_options=@f_bpf={{0x8}, {0x4c4, 0x2, [@TCA_BPF_FD={0x8}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_ACT={0x488, 0x1, [@m_simple={0x240, 0x1e, 0x0, 0x0, {{0xb}, {0x1ac, 0x2, 0x0, 0x1, [@TCA_DEF_DATA={0x140, 0x3, '\xd5\xe9Ji\'\xc9\xb2\xcfE\xcdRO\xbd\xfd\xc8\xbd\x9f\xbb\'q}qqx\xdf\xf8\x82\xfd\x1c(\xafU\n\xeaP\xa1\xf3\x92\xa9\x16)\xb4i\xcf\x81\xb4\x0e\x8a\xa0Ou:\x18z\xad\xb8\x97\x038\xbd\x12lw\xcb\xea\xed\xad\x14E-\x91U\xa5R-\xb5\xb6\x0ehba\ar\xb0N\x9ek\xff}\x00\v\x86\xb9op\xe8\xd7\xd9\xf4\x1a\a\xb3\xce\x1d\xe3fI\x1f\xdc\xab0G\xc5b\xa3gF\xd5\x9f\xde\t\xcc\xaf*\x90\xea\a\f3l\xf2g?\x9b\x96\xb2\x9b\r\x98\x83\'T\xc4\x810]\xbf4\x8a\x10\x92I\x19\xa5\xa4\x90\xe9u\xc2\xf7\xed\x15\xf9\n6\x98\x85\'\xfb\x00\x00\x00\x00\x00\xe8\xa54*\v&\n\xbb-\x81\xa9\x91E\x94\t\xdew1^hZ\xe5{\x1f\xcb\vzG&\xf1xj\x10\x020\\\xde\\\xdc:\x8aL\xd1\x0e\xbd\xf7F\xce\x88\xd9\xd9\x1a\xc7\vD.\xf9);j}\x8fRY\xae\x01\xeb\xbduw~\xf9\xd1\xd1\x85\xa0\x16%\xb1\x97f\xca\xf2=\'\xb57\x94\xff\x92u\xb8\xa8\xect0\x1d\xb8\xd1\xa6F4\x934M\xe2\x9d\x94I\vf}U\x9f\xbcq\x92\xe8\xd3\xfe\xa3\xd7\xb1\xe3gi<\x00\x98\xaf7,\xec\xca\xfcU\x9f\x83\xb7\xec\'\xde'}, @TCA_DEF_DATA={0x6, 0x3, '-\x00'}, @TCA_DEF_PARMS={0x18, 0x2, {0x40, 0x3, 0x20000000, 0x7f7, 0x2}}, @TCA_DEF_DATA={0x5, 0x3, '\x00'}, @TCA_DEF_PARMS={0x18, 0x2, {0x8, 0x2, 0x20000000, 0x8, 0x5}}, @TCA_DEF_DATA={0x7, 0x3, '#/\x00'}, @TCA_DEF_DATA={0x5, 0x3, '\x00'}, @TCA_DEF_PARMS={0x18, 0x2, {0x0, 0x1, 0x20000000, 0x2, 0x10}}]}, {0x69, 0x6, "5719917cb8105b22946505febf0e0aa3a6a3c936bc58c12ca05b5b72f14eca9f4839c0a627a1ee3e7c02d3627befa20be28fae39b4e5923ee1f2eaaa556383b018f71019599cb045e5c24c8d18f72a313727dd4becc4896b5eda9f91778d4f49d8c3b96412"}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_simple={0xac, 0x19, 0x0, 0x0, {{0xb}, {0x1c, 0x2, 0x0, 0x1, [@TCA_DEF_PARMS={0x18, 0x2, {0x80000001, 0x80, 0x5, 0x6, 0x3}}]}, {0x65, 0x6, "9787c29d6ac649e7ec160dfef7c4cea330102e688fe12213d2bf7dae04880a34e7bf775010128401ec7b2a9ceab9c40c5f9bd00ceff17d69ca7a27324ef7a1ad28d4b3c6a826826e9c291c16ab3d13e1f337751959e47bf0fe515b70ea5a3584d9"}, {0xc, 0x7, {0x0, 0x79d0f023c2b305dd}}, {0xc, 0x8, {0x3, 0x2}}}}, @m_gact={0x100, 0x2, 0x0, 0x0, {{0x9}, {0x94, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0xaa6, 0x7}}, @TCA_GACT_PARMS={0x18, 0x2, {0x6, 0x2, 0x1, 0x3, 0x1}}, @TCA_GACT_PROB={0xc, 0x3, {0x1, 0x1032, 0x5}}, @TCA_GACT_PARMS={0x18, 0x2, {0xef7, 0x4, 0x2, 0x5, 0x9}}, @TCA_GACT_PARMS={0x18, 0x2, {0x400, 0xb8, 0x4, 0x5, 0xb}}, @TCA_GACT_PARMS={0x18, 0x2, {0x0, 0x3, 0x4, 0x6, 0xdf9}}, @TCA_GACT_PARMS={0x18, 0x2, {0x7, 0x61ca, 0x1, 0x1, 0xd1a}}]}, {0x41, 0x6, "65043db23614b2c5fe6d4d2637153bef7fcb38ba2040f5376fbbf34046602d42485015244ee993e7d633adcdf4954d21ec98f6d52e84490da7b9bcfe6b"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}, @m_connmark={0x98, 0x13, 0x0, 0x0, {{0xd}, {0x4}, {0x65, 0x6, "726786f34dc39a3b098ea66afe225634df06865f963558e69516e656d1b4d3ec4c23aaeded7fbb0c799f243d3827c1ff7060f9d56b77b6373212745232c734d9b45311b3eceeeb16cae2bfd77942d880d60c94991d896d67e1bf08b6ace5ba70ca"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}]}, @TCA_BPF_FLAGS_GEN={0x8, 0x9, 0x3}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_FD={0x8}, @TCA_BPF_FLAGS={0x8, 0x8, 0x1}]}}, @TCA_RATE={0x6, 0x5, {0x6, 0x2}}, @filter_kind_options=@f_route={{0xa}, {0xe4, 0x2, [@TCA_ROUTE4_TO={0x8, 0x2, 0xca}, @TCA_ROUTE4_IIF={0x8}, @TCA_ROUTE4_ACT={0xd0, 0x6, [@m_mirred={0x58, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x29, 0x6, "b9e6cb743efb5818279b291a7d56a99d728d0d3c5750442cdd89714a7135052ff6aa167b6d"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x1}}}}, @m_mirred={0x74, 0x9, 0x0, 0x0, {{0xb}, {0x4}, {0x45, 0x6, "216194e50e7faa7649d1c06839be3b59a7f1bb6c7fbd0e7344b4e9b561d4b406f4a7a0c7e6ebe935ccd4c10fd3ff9357cc52da0d5a0f390e738e2309dae089a4a0"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2}}}}]}]}}]}, 0x5f8}, 0x1, 0x0, 0x0, 0x81}, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) 34.51521ms ago: executing program 2 (id=3235): mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5393, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) 0s ago: executing program 0 (id=3236): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x200042, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) syz_open_dev$vbi(0x0, 0x0, 0x2) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000a8f4dd086d04b1082a6d000000040902120001000000000904"], 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r3, &(0x7f0000000000)={0x10, 0x0, 0x2ddfdbff, 0x2ffffffff}, 0xc) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r4) socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r4, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) r5 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') execveat$binfmt(0xffffffffffffff9c, r5, &(0x7f0000000080), 0x0, 0x0) openat$binfmt(0xffffffffffffff9c, r5, 0x42, 0x1ff) close(r0) execveat$binfmt(0xffffffffffffff9c, r5, &(0x7f0000000100), &(0x7f0000000300)={[&(0x7f00000002c0)='\x00']}, 0x0) r6 = openat$binfmt(0xffffffffffffff9c, r5, 0x2, 0x0) write(r6, &(0x7f0000000180)="0101", 0x2) close(r6) execveat$binfmt(0xffffffffffffff9c, r5, &(0x7f00000001c0), &(0x7f0000000200), 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x42, 0x0) execveat$binfmt(0xffffffffffffff9c, r5, &(0x7f0000000280), 0x0, 0x0) fchmodat(0xffffffffffffff9c, 0x0, 0x1ff) kernel console output (not intermixed with test programs): nt descriptor, different from the interface descriptor's value: 9 [ 868.841349][ T52] gspca_vc032x: I2c Bus Busy Wait 00 [ 868.846737][ T52] gspca_vc032x: I2c Bus Busy Wait 00 [ 868.851938][ T5832] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 868.852432][ T7646] usb 3-1: new high-speed USB device number 121 using dummy_hcd [ 868.874297][ T5832] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 868.914509][ T5832] usb 5-1: config 0 descriptor?? [ 868.957500][ T52] gspca_vc032x: I2c Bus Busy Wait 00 [ 868.962846][ T52] gspca_vc032x: I2c Bus Busy Wait 00 [ 868.968377][ T52] gspca_vc032x: I2c Bus Busy Wait 00 [ 868.973761][ T52] gspca_vc032x: I2c Bus Busy Wait 00 [ 868.984323][ T52] gspca_vc032x: I2c Bus Busy Wait 00 [ 868.994090][ T52] gspca_vc032x: I2c Bus Busy Wait 00 [ 869.000064][ T52] gspca_vc032x: I2c Bus Busy Wait 00 [ 869.007275][ T52] gspca_vc032x: I2c Bus Busy Wait 00 [ 869.014066][ T52] gspca_vc032x: I2c Bus Busy Wait 00 [ 869.020519][ T52] gspca_vc032x: I2c Bus Busy Wait 00 [ 869.025855][ T52] gspca_vc032x: I2c Bus Busy Wait 00 [ 869.036016][ T52] gspca_vc032x: I2c Bus Busy Wait 00 [ 869.041546][ T52] gspca_vc032x: I2c Bus Busy Wait 00 [ 869.046865][ T52] gspca_vc032x: Unknown sensor... [ 869.052600][ T52] vc032x 4-1:0.0: probe with driver vc032x failed with error -22 [ 869.063172][ T52] usb 4-1: USB disconnect, device number 9 [ 869.197999][ T7646] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 869.303200][ T7646] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 869.343386][T15304] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 869.407885][T15304] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 869.418263][ T7646] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 869.500155][ T5832] microsoft 0003:045E:07DA.001F: unknown main item tag 0x0 [ 869.514234][ T5832] microsoft 0003:045E:07DA.001F: unknown main item tag 0x0 [ 869.527609][ T7646] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 869.546369][ T5832] microsoft 0003:045E:07DA.001F: unknown main item tag 0x0 [ 869.567973][ T7646] usb 3-1: SerialNumber: syz [ 869.582771][ T5911] usb 2-1: USB disconnect, device number 124 [ 869.607264][ T5832] microsoft 0003:045E:07DA.001F: unknown main item tag 0x0 [ 869.635703][ T5832] microsoft 0003:045E:07DA.001F: unknown main item tag 0x0 [ 869.667562][ T5890] usb 1-1: new high-speed USB device number 115 using dummy_hcd [ 869.712145][ T5832] HID 045e:07da: Invalid code 65791 type 1 [ 869.792648][ T5832] input: HID 045e:07da as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:045E:07DA.001F/input/input75 [ 869.831655][ T5890] usb 1-1: Using ep0 maxpacket: 8 [ 869.838254][ T5890] usb 1-1: no configurations [ 869.843313][ T5890] usb 1-1: can't read configurations, error -22 [ 869.871149][ T5832] microsoft 0003:045E:07DA.001F: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.4-1/input0 [ 869.916388][ T5832] usb 5-1: USB disconnect, device number 14 [ 869.977573][ T5890] usb 1-1: new high-speed USB device number 116 using dummy_hcd [ 870.263888][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.270603][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.290779][ T5890] usb 1-1: Using ep0 maxpacket: 8 [ 870.305741][ T5890] usb 1-1: no configurations [ 870.316189][T15329] fido_id[15329]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 870.336669][ T5890] usb 1-1: can't read configurations, error -22 [ 870.357031][ T5890] usb usb1-port1: attempt power cycle [ 871.287410][ T5890] usb 1-1: new high-speed USB device number 117 using dummy_hcd [ 871.308774][ T5890] usb 1-1: Using ep0 maxpacket: 8 [ 871.314776][ T5890] usb 1-1: no configurations [ 871.334121][ T5890] usb 1-1: can't read configurations, error -22 [ 871.508786][ T5890] usb 1-1: new high-speed USB device number 118 using dummy_hcd [ 871.610370][ T5890] usb 1-1: Using ep0 maxpacket: 8 [ 872.108311][ T5890] usb 1-1: no configurations [ 872.112979][ T5890] usb 1-1: can't read configurations, error -22 [ 872.127905][ T5890] usb usb1-port1: unable to enumerate USB device [ 872.368447][ T5911] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 872.827955][ T5911] usb 5-1: Using ep0 maxpacket: 8 [ 873.001562][ T5911] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 873.030271][ T7646] usb 3-1: 0:2 : does not exist [ 873.073815][ T5911] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 873.139141][ T5911] usb 5-1: Product: syz [ 873.143494][ T5911] usb 5-1: Manufacturer: syz [ 873.183307][ T5911] usb 5-1: SerialNumber: syz [ 873.217762][ T5890] usb 1-1: new high-speed USB device number 119 using dummy_hcd [ 873.229199][ T5911] usb 5-1: config 0 descriptor?? [ 873.294202][ T7646] usb 3-1: USB disconnect, device number 121 [ 873.527072][ T5911] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 873.542553][ T5890] usb 1-1: Using ep0 maxpacket: 16 [ 873.560679][ T5890] usb 1-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 873.569628][ T5890] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 873.586638][ T5890] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 873.602576][ T5890] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 873.614366][ T5890] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 873.627598][ T5890] usb 1-1: Product: syz [ 873.631831][ T5890] usb 1-1: Manufacturer: syz [ 873.636617][ T5890] usb 1-1: SerialNumber: syz [ 873.671507][ T5849] udevd[5849]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 873.967939][ T7646] usb 3-1: new high-speed USB device number 122 using dummy_hcd [ 873.981681][T15358] ALSA: mixer_oss: invalid OSS volume 'T' [ 873.994454][T15358] netlink: 'syz.1.2911': attribute type 11 has an invalid length. [ 874.117418][ T7646] usb 3-1: Using ep0 maxpacket: 8 [ 874.128297][ T7646] usb 3-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 874.137659][ T7646] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 874.143732][ T5890] usb 1-1: 0:2 : does not exist [ 874.145757][ T7646] usb 3-1: Product: syz [ 874.145777][ T7646] usb 3-1: Manufacturer: syz [ 874.145794][ T7646] usb 3-1: SerialNumber: syz [ 874.149587][ T7646] usb 3-1: config 0 descriptor?? [ 874.157626][ T5832] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 874.189300][ T5890] usb 1-1: 1:0: failed to get current value for ch 0 (-22) [ 874.232867][ T5890] usb 1-1: USB disconnect, device number 119 [ 874.262235][ T7173] udevd[7173]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 874.337755][ T5832] usb 4-1: Using ep0 maxpacket: 16 [ 874.347701][ T5832] usb 4-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 874.356943][ T5832] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 874.384003][ T5832] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 874.404041][ T7646] usb 3-1: dvb_usb_v2: found a 'Terratec H7' in warm state [ 874.406726][ T5832] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 874.426244][ T5832] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 874.434898][ T5832] usb 4-1: Product: syz [ 874.439396][ T5832] usb 4-1: Manufacturer: syz [ 874.444106][ T5832] usb 4-1: SerialNumber: syz [ 874.865166][ T5832] usb 4-1: 0:2 : does not exist [ 874.943976][ T5911] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -110 [ 875.136362][ T52] usb 5-1: USB disconnect, device number 15 [ 875.312890][ T5832] usb 4-1: USB disconnect, device number 10 [ 875.346935][ T5833] udevd[5833]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 875.363215][ T5911] usb 1-1: new high-speed USB device number 120 using dummy_hcd [ 876.207441][ T5911] usb 1-1: Using ep0 maxpacket: 8 [ 876.352210][ T5911] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 876.363296][ T7646] usb write operation failed. (-71) [ 876.394686][ T5911] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 876.432301][ T5890] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 876.445664][ T7646] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 876.481479][ T5911] usb 1-1: Product: syz [ 876.489702][ T7646] dvbdev: DVB: registering new adapter (Terratec H7) [ 876.500899][ T5911] usb 1-1: Manufacturer: syz [ 876.516747][ T5911] usb 1-1: SerialNumber: syz [ 876.534659][ T5911] usb 1-1: config 0 descriptor?? [ 876.553975][ T7646] usb 3-1: media controller created [ 876.599167][ T7646] usb read operation failed. (-71) [ 876.658034][ T7646] usb write operation failed. (-71) [ 876.735850][ T7646] dvb_usb_az6007 3-1:0.0: probe with driver dvb_usb_az6007 failed with error -5 [ 876.752543][ T5890] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 876.765629][ T5890] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 876.771655][ T7646] usb 3-1: USB disconnect, device number 122 [ 876.786087][ T5890] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 876.795390][ T5890] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 876.803644][ T5890] usb 5-1: SerialNumber: syz [ 876.936501][ T5911] usb 1-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 876.945404][T15250] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 877.127935][T15250] usb 4-1: Using ep0 maxpacket: 8 [ 877.157833][T15250] usb 4-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 877.213768][T15250] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 877.273605][T15250] usb 4-1: Product: syz [ 877.285882][T15250] usb 4-1: Manufacturer: syz [ 877.301105][T15250] usb 4-1: SerialNumber: syz [ 877.321385][T15250] usb 4-1: config 0 descriptor?? [ 877.563131][T15250] usb 4-1: dvb_usb_v2: found a 'Terratec H7' in warm state [ 878.264413][ T5911] dvb_usb_rtl28xxu 1-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -110 [ 878.373198][ T5892] usb 3-1: new high-speed USB device number 123 using dummy_hcd [ 878.585766][ T5892] usb 3-1: Using ep0 maxpacket: 16 [ 878.597906][ T5892] usb 3-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 878.609622][ T5892] usb 3-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 878.626196][ T5892] usb 3-1: string descriptor 0 read error: -22 [ 878.632712][ T5892] usb 3-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.40 [ 878.642843][ T5892] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 878.780925][ T7646] usb 1-1: USB disconnect, device number 120 [ 879.040788][T15250] usb write operation failed. (-71) [ 879.048481][T15250] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 879.073715][T15250] dvbdev: DVB: registering new adapter (Terratec H7) [ 879.103021][T15250] usb 4-1: media controller created [ 879.116780][T15250] usb read operation failed. (-71) [ 879.132248][T15250] usb write operation failed. (-71) [ 879.153539][T15250] dvb_usb_az6007 4-1:0.0: probe with driver dvb_usb_az6007 failed with error -5 [ 879.394005][T15250] usb 4-1: USB disconnect, device number 11 [ 879.536737][ T5890] usb 5-1: 0:2 : does not exist [ 879.579059][ T5890] usb 5-1: USB disconnect, device number 16 [ 879.697482][ T7646] usb 2-1: new high-speed USB device number 125 using dummy_hcd [ 879.780944][ T5849] udevd[5849]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 879.904789][ T7646] usb 2-1: config 0 has no interfaces? [ 879.920720][ T7646] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 879.942402][ T7646] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 879.972952][ T7646] usb 2-1: Product: syz [ 879.987480][ T7646] usb 2-1: Manufacturer: syz [ 880.002536][ T7646] usb 2-1: SerialNumber: syz [ 880.020919][ T7646] usb 2-1: config 0 descriptor?? [ 880.148793][T15409] ALSA: mixer_oss: invalid OSS volume 'T' [ 880.179987][T15409] netlink: 'syz.0.2929': attribute type 11 has an invalid length. [ 880.228825][T15411] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2930'. [ 880.272181][T15395] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 880.282699][T15395] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 881.667417][ T7645] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 881.746851][ T7646] usb 3-1: USB disconnect, device number 123 [ 881.818354][ T7645] usb 4-1: Using ep0 maxpacket: 16 [ 881.854364][ T7645] usb 4-1: config 0 has an invalid interface number: 41 but max is 0 [ 881.866395][ T7645] usb 4-1: config 0 has no interface number 0 [ 881.886927][ T7645] usb 4-1: config 0 interface 41 has no altsetting 0 [ 881.905799][ T7645] usb 4-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 881.916005][ T7645] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 881.925808][ T7645] usb 4-1: Product: syz [ 881.930161][ T7645] usb 4-1: Manufacturer: syz [ 881.934939][ T7645] usb 4-1: SerialNumber: syz [ 881.942872][ T7645] usb 4-1: config 0 descriptor?? [ 881.953353][ T7645] CoreChips 4-1:0.41: probe with driver CoreChips failed with error -22 [ 882.168096][T15419] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 882.177376][T15419] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 882.255457][ T7646] usb 4-1: USB disconnect, device number 12 [ 882.577597][ T7645] usb 3-1: new high-speed USB device number 124 using dummy_hcd [ 882.683902][ T7646] usb 2-1: USB disconnect, device number 125 [ 882.737516][ T7645] usb 3-1: Using ep0 maxpacket: 16 [ 882.744841][ T7645] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 882.780090][ T7645] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 882.790640][ T7645] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 882.804572][ T7645] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 882.818454][ T7645] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 882.837747][ T7645] usb 3-1: config 0 descriptor?? [ 883.098612][T15437] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 883.128957][T15437] program syz.3.2937 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 883.998563][T15431] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 884.077888][T15431] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 884.244344][ T7645] microsoft 0003:045E:07DA.0020: unknown main item tag 0x0 [ 884.279185][ T7645] microsoft 0003:045E:07DA.0020: unknown main item tag 0x0 [ 884.328044][ T7645] microsoft 0003:045E:07DA.0020: unknown main item tag 0x0 [ 884.335834][ T7645] microsoft 0003:045E:07DA.0020: unknown main item tag 0x0 [ 884.375695][ T7645] microsoft 0003:045E:07DA.0020: unknown main item tag 0x0 [ 884.397038][ T7645] HID 045e:07da: Invalid code 65791 type 1 [ 884.430221][ T7645] input: HID 045e:07da as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:045E:07DA.0020/input/input76 [ 884.528898][ T7645] microsoft 0003:045E:07DA.0020: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.2-1/input0 [ 884.598609][ T7645] usb 3-1: USB disconnect, device number 124 [ 884.638846][T15455] netlink: 156 bytes leftover after parsing attributes in process `syz.3.2944'. [ 884.807023][T15457] fido_id[15457]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 884.837920][ T7646] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 884.998424][ T7646] usb 5-1: Using ep0 maxpacket: 16 [ 885.024836][ T7646] usb 5-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 885.040740][ T7646] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 885.052292][ T7646] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 886.143828][ T7646] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 886.152998][ T7646] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 886.177898][ T7646] usb 5-1: Product: syz [ 886.182486][ T7646] usb 5-1: Manufacturer: syz [ 886.197615][ T7646] usb 5-1: SerialNumber: syz [ 886.603706][T15475] ALSA: mixer_oss: invalid OSS volume 'T' [ 886.617438][T15475] netlink: 'syz.2.2949': attribute type 11 has an invalid length. [ 886.634151][ T7646] usb 5-1: 0:2 : does not exist [ 886.657433][ T7645] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 886.827758][ T7645] usb 4-1: Using ep0 maxpacket: 16 [ 886.836255][ T7645] usb 4-1: config 0 has an invalid interface number: 41 but max is 0 [ 886.846725][ T7645] usb 4-1: config 0 has no interface number 0 [ 886.853110][ T7645] usb 4-1: config 0 interface 41 has no altsetting 0 [ 886.868182][ T7645] usb 4-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 886.883299][ T7645] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 886.891681][ T7645] usb 4-1: Product: syz [ 886.897258][ T7645] usb 4-1: Manufacturer: syz [ 886.906870][ T7645] usb 4-1: SerialNumber: syz [ 886.915975][ T7645] usb 4-1: config 0 descriptor?? [ 886.928142][ T7645] CoreChips 4-1:0.41: probe with driver CoreChips failed with error -22 [ 887.071804][ T7646] usb 5-1: USB disconnect, device number 17 [ 887.109785][ T5849] udevd[5849]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 887.136690][T15469] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 887.154358][T15469] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 887.174022][ T5890] usb 4-1: USB disconnect, device number 13 [ 887.997827][T15496] netlink: 156 bytes leftover after parsing attributes in process `syz.3.2957'. [ 888.067113][ T30] audit: type=1326 audit(1746835896.655:82): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15491 comm="syz.1.2955" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fa714d8e969 code=0x0 [ 888.091503][ T30] audit: type=1326 audit(1746835896.685:83): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15491 comm="syz.1.2955" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fa714d8e969 code=0x0 [ 888.113244][ C1] vkms_vblank_simulate: vblank timer overrun [ 888.397406][ T5892] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 888.427659][ T7645] usb 1-1: new high-speed USB device number 121 using dummy_hcd [ 888.557597][ T5892] usb 4-1: Using ep0 maxpacket: 32 [ 888.578475][ T5892] usb 4-1: unable to get BOS descriptor or descriptor too short [ 888.587441][ T7645] usb 1-1: Using ep0 maxpacket: 16 [ 888.599678][ T7645] usb 1-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 888.600457][ T5892] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 888.609402][ T7645] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 888.648929][ T5892] usb 4-1: can't read configurations, error -71 [ 888.659767][ T7645] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 888.681023][ T7645] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 888.694360][ T7645] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 888.702631][ T7645] usb 1-1: Product: syz [ 888.706912][ T7645] usb 1-1: Manufacturer: syz [ 888.713375][ T7645] usb 1-1: SerialNumber: syz [ 889.077606][ T7646] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 889.143108][ T7645] usb 1-1: 0:2 : does not exist [ 889.227548][ T7646] usb 5-1: Using ep0 maxpacket: 32 [ 889.238033][ T7646] usb 5-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 889.247146][ T7646] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 889.259367][ T7646] usb 5-1: config 0 descriptor?? [ 889.472690][ T7646] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 889.494918][ T7646] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 889.498362][ T5892] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 889.515307][ T7646] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 889.527481][ T7646] usb 5-1: media controller created [ 889.553764][ C1] raw-gadget.1 gadget.0: ignoring, device is not running [ 889.599846][ T7646] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 889.615144][ T7645] usb 1-1: USB disconnect, device number 121 [ 889.669242][ T5892] usb 4-1: Using ep0 maxpacket: 16 [ 889.680596][ T5849] udevd[5849]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 889.720427][ T5892] usb 4-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 889.729954][ T5892] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 889.757395][ T5892] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 889.781129][ T5892] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 889.794427][ T5892] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 889.803806][ T5892] usb 4-1: Product: syz [ 889.808501][ T5892] usb 4-1: Manufacturer: syz [ 889.813143][ T5892] usb 4-1: SerialNumber: syz [ 890.088641][ T5890] usb 3-1: new high-speed USB device number 125 using dummy_hcd [ 890.230168][ T5892] usb 4-1: 0:2 : does not exist [ 890.260166][ T5890] usb 3-1: Using ep0 maxpacket: 16 [ 890.269424][ T5890] usb 3-1: config 0 has an invalid interface number: 41 but max is 0 [ 890.281029][ T5890] usb 3-1: config 0 has no interface number 0 [ 890.287226][ T5890] usb 3-1: config 0 interface 41 has no altsetting 0 [ 890.289011][ T7646] az6027: usb out operation failed. (-71) [ 890.311207][ T5890] usb 3-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 890.348175][ T7646] stb0899_attach: Driver disabled by Kconfig [ 890.354223][ T7646] az6027: no front-end attached [ 890.354223][ T7646] [ 890.363092][ T7646] az6027: usb out operation failed. (-71) [ 890.369151][ T5890] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 890.369507][ T7646] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 890.395262][ T7646] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input77 [ 890.405041][ T5890] usb 3-1: Product: syz [ 890.417007][ T5890] usb 3-1: Manufacturer: syz [ 890.427183][ T5890] usb 3-1: SerialNumber: syz [ 890.445460][ T7646] dvb-usb: schedule remote query interval to 400 msecs. [ 890.447377][ T5890] usb 3-1: config 0 descriptor?? [ 890.463715][ T7646] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 890.484286][ T7646] usb 5-1: USB disconnect, device number 18 [ 890.516105][ T5890] CoreChips 3-1:0.41: probe with driver CoreChips failed with error -22 [ 890.617488][ T7645] usb 1-1: new high-speed USB device number 122 using dummy_hcd [ 890.636486][ C0] raw-gadget.2 gadget.3: ignoring, device is not running [ 890.640137][ T7646] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 890.648164][ C0] raw-gadget.2 gadget.3: ignoring, device is not running [ 890.659808][ C0] raw-gadget.2 gadget.3: ignoring, device is not running [ 890.696695][ T5892] usb 4-1: USB disconnect, device number 15 [ 890.762582][T15518] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 890.777839][T15518] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 890.798276][ T5849] udevd[5849]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 890.829614][ T5890] usb 3-1: USB disconnect, device number 125 [ 890.836981][ T7645] usb 1-1: config 0 has no interfaces? [ 890.860702][ T7645] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 890.895330][ T7645] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 890.938851][ T7645] usb 1-1: Product: syz [ 890.948659][ T7645] usb 1-1: Manufacturer: syz [ 890.960316][ T7645] usb 1-1: SerialNumber: syz [ 890.981082][ T7645] usb 1-1: config 0 descriptor?? [ 891.011050][T15527] netlink: 156 bytes leftover after parsing attributes in process `syz.4.2969'. [ 891.371300][T15525] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2968'. [ 891.707624][ T7646] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 891.937041][ T7646] usb 5-1: config 0 has no interfaces? [ 891.949864][ T7646] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 891.959134][ T7646] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 891.967488][T15544] ALSA: mixer_oss: invalid OSS volume 'T' [ 891.976446][T15544] netlink: 'syz.2.2975': attribute type 11 has an invalid length. [ 891.992511][ T7646] usb 5-1: Product: syz [ 891.996966][ T7646] usb 5-1: Manufacturer: syz [ 892.002624][ T7646] usb 5-1: SerialNumber: syz [ 892.141249][ T7646] usb 5-1: config 0 descriptor?? [ 892.449009][T15537] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2971'. [ 893.523976][ T5890] usb 1-1: USB disconnect, device number 122 [ 893.661360][T15563] netlink: 156 bytes leftover after parsing attributes in process `syz.0.2981'. [ 893.913748][ T30] audit: type=1326 audit(1746835902.505:84): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15560 comm="syz.3.2980" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fbf3078e969 code=0x0 [ 893.967474][ T30] audit: type=1326 audit(1746835902.555:85): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15560 comm="syz.3.2980" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fbf3078e969 code=0x0 [ 893.989256][ C0] vkms_vblank_simulate: vblank timer overrun [ 894.067487][ T5890] usb 2-1: new high-speed USB device number 126 using dummy_hcd [ 894.217602][ T5890] usb 2-1: Using ep0 maxpacket: 8 [ 894.230082][ T5890] usb 2-1: config 252 has an invalid interface number: 255 but max is 0 [ 894.306420][ T5890] usb 2-1: config 252 has no interface number 0 [ 894.308200][ T7645] usb 5-1: USB disconnect, device number 19 [ 894.330641][ T5890] usb 2-1: too many endpoints for config 252 interface 255 altsetting 255: 255, using maximum allowed: 30 [ 894.381150][ T5890] usb 2-1: config 252 interface 255 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 894.445582][ T5890] usb 2-1: config 252 interface 255 has no altsetting 0 [ 894.605622][ T5890] usb 2-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 895.018492][ T7646] usb 1-1: new high-speed USB device number 123 using dummy_hcd [ 895.561435][ T5890] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 895.603561][ T5890] pvrusb2: Hardware description: Terratec Grabster AV400 [ 895.617413][ T5890] pvrusb2: ********** [ 895.621443][ T5890] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 895.697646][ T5890] pvrusb2: Important functionality might not be entirely working. [ 895.717569][ T7646] usb 1-1: Using ep0 maxpacket: 8 [ 895.719026][ T5890] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 895.746316][ T7646] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 895.749597][ T5890] pvrusb2: ********** [ 895.786087][ T5890] usb 2-1: selecting invalid altsetting 0 [ 895.802007][ T2344] pvrusb2: Invalid write control endpoint [ 895.806309][ T7646] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 895.816021][ T7646] usb 1-1: Product: syz [ 895.867520][ T7646] usb 1-1: Manufacturer: syz [ 896.043484][ T7646] usb 1-1: SerialNumber: syz [ 896.085230][ T7646] usb 1-1: config 0 descriptor?? [ 896.239696][ T2344] pvrusb2: Invalid write control endpoint [ 896.251353][ T2344] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 896.289067][ T2344] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 896.305767][ T2344] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 896.510709][ T2344] pvrusb2: Device being rendered inoperable [ 896.542382][T15583] pvrusb2: Attempted to execute control transfer when device not ok [ 896.635019][ T2344] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 896.636133][ T5847] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 896.667572][ T2344] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_c) [ 896.698414][ T5847] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 896.729486][ T5847] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 896.747983][ T2344] pvrusb2: Attached sub-driver cx25840 [ 896.753515][ T2344] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 896.767478][ T2344] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 896.784734][ T5847] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 896.806376][ T5847] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 896.872166][ T7646] usb 1-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 897.317525][ T7645] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 897.469655][ T7645] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 897.478754][ T7645] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 897.497840][ T7645] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 897.507632][ T7645] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 897.518967][ T7645] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 897.536985][ T7645] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 897.547351][ T7645] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 897.555409][ T7645] usb 4-1: Product: syz [ 897.560333][ T7645] usb 4-1: Manufacturer: syz [ 897.577501][ T7645] cdc_wdm 4-1:1.0: skipping garbage [ 897.594340][ T7645] cdc_wdm 4-1:1.0: skipping garbage [ 897.620649][ T7645] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 897.627026][ T7645] cdc_wdm 4-1:1.0: Unknown control protocol [ 897.825091][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 897.924060][T15588] chnl_net:caif_netlink_parms(): no params data found [ 898.098467][ T7646] dvb_usb_rtl28xxu 1-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -110 [ 898.307399][ T5894] usb 3-1: new high-speed USB device number 126 using dummy_hcd [ 898.315238][ T5890] usb 1-1: USB disconnect, device number 123 [ 898.615953][ T5894] usb 3-1: config 0 has no interfaces? [ 898.657060][ T5894] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 898.667990][ T5894] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 898.676377][ T5894] usb 3-1: Product: syz [ 898.683416][ T5894] usb 3-1: Manufacturer: syz [ 898.691404][ T5894] usb 3-1: SerialNumber: syz [ 898.721837][ T5894] usb 3-1: config 0 descriptor?? [ 898.897978][ T5848] Bluetooth: hci5: command tx timeout [ 899.621775][ T13] bond0 (unregistering): Released all slaves [ 899.874900][ T13] bond1 (unregistering): Released all slaves [ 900.013294][ T7645] usb 2-1: USB disconnect, device number 126 [ 900.052966][T15600] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2990'. [ 900.185471][T15627] netlink: 156 bytes leftover after parsing attributes in process `syz.1.2993'. [ 900.477808][ T5911] usb 1-1: new high-speed USB device number 124 using dummy_hcd [ 900.548003][T15588] bridge0: port 1(bridge_slave_0) entered blocking state [ 900.555232][T15588] bridge0: port 1(bridge_slave_0) entered disabled state [ 900.639565][T15588] bridge_slave_0: entered allmulticast mode [ 900.657702][ T5911] usb 1-1: Using ep0 maxpacket: 32 [ 900.686260][T15588] bridge_slave_0: entered promiscuous mode [ 900.695521][ T5911] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 900.718099][ T5911] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 900.733389][T15588] bridge0: port 2(bridge_slave_1) entered blocking state [ 900.743526][T15588] bridge0: port 2(bridge_slave_1) entered disabled state [ 900.754450][ T5911] usb 1-1: config 0 descriptor?? [ 900.770075][T15588] bridge_slave_1: entered allmulticast mode [ 900.793630][T15588] bridge_slave_1: entered promiscuous mode [ 900.961628][T15588] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 900.977829][ T5848] Bluetooth: hci5: command tx timeout [ 900.987215][ T5911] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 901.015778][T15588] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 901.027522][ T5894] usb 2-1: new high-speed USB device number 127 using dummy_hcd [ 901.028112][ T5911] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 901.050211][ T5911] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 901.068779][ T5911] usb 1-1: media controller created [ 901.075350][ T13] hsr_slave_0: left promiscuous mode [ 901.086444][ T13] hsr_slave_1: left promiscuous mode [ 901.126675][ T5911] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 901.227524][ T5894] usb 2-1: Using ep0 maxpacket: 8 [ 901.246719][ T5894] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 901.265568][ T5894] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 901.276253][ T5894] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 901.291580][ T5894] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 901.321179][ T5894] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 901.353202][ T5894] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 901.495589][ T13] net veth1_virt_wifi virt_wifi0 (unregistering): left allmulticast mode [ 901.614237][ T5894] usb 2-1: usb_control_msg returned -32 [ 901.635648][ T5894] usbtmc 2-1:16.0: can't read capabilities [ 901.689867][ T5894] usb 2-1: USB disconnect, device number 127 [ 901.824447][ T5911] az6027: usb out operation failed. (-71) [ 901.848310][ T5892] usb 3-1: USB disconnect, device number 126 [ 901.864738][ T5911] stb0899_attach: Driver disabled by Kconfig [ 901.876394][ T5911] az6027: no front-end attached [ 901.876394][ T5911] [ 901.907163][ T5911] az6027: usb out operation failed. (-71) [ 901.914238][ T5911] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 901.938880][ T5911] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input78 [ 901.984464][ T5911] dvb-usb: schedule remote query interval to 400 msecs. [ 902.009801][ T5911] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 902.052707][ T5911] usb 1-1: USB disconnect, device number 124 [ 902.188631][ T5911] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 902.378822][T15653] ALSA: mixer_oss: invalid OSS volume 'T' [ 902.396572][T15653] netlink: 'syz.1.2996': attribute type 11 has an invalid length. [ 902.688179][ T30] audit: type=1326 audit(1746835911.285:86): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15655 comm="syz.0.2997" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f4e2c18e969 code=0x0 [ 902.739988][ T30] audit: type=1326 audit(1746835911.335:87): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15655 comm="syz.0.2997" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f4e2c18e969 code=0x0 [ 902.941665][ T5911] usb 4-1: USB disconnect, device number 16 [ 903.044531][T15588] team0: Port device team_slave_0 added [ 903.057726][ T5848] Bluetooth: hci5: command tx timeout [ 903.072789][T15588] team0: Port device team_slave_1 added [ 903.171538][T15588] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 903.180126][T15588] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 903.214513][T15588] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 903.411274][T15588] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 903.429719][T15588] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 903.470136][ T5911] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 903.498136][T15588] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 903.675655][ T5911] usb 4-1: Using ep0 maxpacket: 8 [ 903.714939][ T5911] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 903.732380][T15588] hsr_slave_0: entered promiscuous mode [ 903.740049][ T5911] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 903.750811][T15588] hsr_slave_1: entered promiscuous mode [ 903.757036][T15588] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 903.765718][T15588] Cannot create hsr debugfs directory [ 903.768532][ T5911] usb 4-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 903.810186][ T5911] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 903.894313][ T5911] usb 4-1: Product: syz [ 903.932714][ T5911] usb 4-1: Manufacturer: syz [ 903.954298][ T5911] usb 4-1: SerialNumber: syz [ 904.026810][ T5911] usb 4-1: config 0 descriptor?? [ 905.022215][T15588] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 905.037495][ T5911] usb 3-1: new high-speed USB device number 127 using dummy_hcd [ 905.065485][T15588] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 905.087233][T15588] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 905.115461][T15588] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 905.137869][ T5848] Bluetooth: hci5: command tx timeout [ 905.211160][ T5911] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 905.221917][ T5911] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 905.244028][ T5911] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 905.253456][ T5911] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 905.262899][ T5911] usb 3-1: SerialNumber: syz [ 905.392406][T15588] 8021q: adding VLAN 0 to HW filter on device bond0 [ 905.476183][T15588] 8021q: adding VLAN 0 to HW filter on device team0 [ 905.554414][ T3573] bridge0: port 1(bridge_slave_0) entered blocking state [ 905.561654][ T3573] bridge0: port 1(bridge_slave_0) entered forwarding state [ 905.602507][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 905.609767][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 906.039659][T15696] netlink: 156 bytes leftover after parsing attributes in process `syz.1.3003'. [ 906.085501][T15588] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 906.167997][ T5894] usb 4-1: USB disconnect, device number 17 [ 906.439995][T15588] veth0_vlan: entered promiscuous mode [ 906.529241][T15588] veth1_vlan: entered promiscuous mode [ 906.778858][T15701] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3005'. [ 906.874539][T15701] binder: 15699:15701 ioctl c0306201 0 returned -14 [ 906.901638][T15588] veth0_macvtap: entered promiscuous mode [ 906.970710][T15588] veth1_macvtap: entered promiscuous mode [ 907.400338][T15588] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 907.429467][T15588] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 907.451039][T15588] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 907.480568][T15588] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 907.522556][T15588] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 907.602835][T15588] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 907.655260][T15588] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 907.679871][T15588] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 907.718218][T15588] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 907.748518][T15588] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 907.791034][T15588] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 907.800781][T15588] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 907.836602][T15588] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 907.855719][T15588] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 907.887687][ T7646] usb 1-1: new high-speed USB device number 125 using dummy_hcd [ 908.057787][ T7646] usb 1-1: Using ep0 maxpacket: 16 [ 908.087170][ T7646] usb 1-1: config 0 has an invalid interface number: 105 but max is 0 [ 908.102923][ T7646] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 908.115237][ T7646] usb 1-1: config 0 has no interface number 0 [ 908.145046][ T7646] usb 1-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 908.155897][ T7646] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 908.175866][ T7646] usb 1-1: Product: syz [ 908.184498][ T7646] usb 1-1: Manufacturer: syz [ 908.191325][ T7646] usb 1-1: SerialNumber: syz [ 908.220952][T14566] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 908.240222][ T7646] usb 1-1: config 0 descriptor?? [ 908.269854][ T7646] usb 1-1: Found UVC 0.00 device syz (046d:08f3) [ 908.285913][T14566] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 908.306018][ T7646] usb 1-1: No valid video chain found. [ 908.476220][ T53] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 908.492465][ T53] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 908.517155][ T5911] usb 3-1: 0:2 : does not exist [ 908.590591][ T5890] usb 1-1: USB disconnect, device number 125 [ 908.649030][ T5911] usb 3-1: USB disconnect, device number 127 [ 908.752657][ T5849] udevd[5849]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 908.808275][T15732] ALSA: mixer_oss: invalid OSS volume 'T' [ 908.870846][T15732] netlink: 'syz.2.3011': attribute type 11 has an invalid length. [ 909.293779][T15746] netlink: 156 bytes leftover after parsing attributes in process `syz.0.3015'. [ 910.143390][T15760] ALSA: mixer_oss: invalid OSS volume 'T' [ 910.298650][T15762] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3020'. [ 910.319347][T15760] netlink: 'syz.1.3019': attribute type 11 has an invalid length. [ 911.557504][ T7646] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 911.722962][ T7646] usb 4-1: config 0 has no interfaces? [ 911.759340][ T7646] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 911.768829][ T7646] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 911.786272][ T7646] usb 4-1: Product: syz [ 911.801868][ T7646] usb 4-1: Manufacturer: syz [ 911.812799][ T7646] usb 4-1: SerialNumber: syz [ 911.833321][ T7646] usb 4-1: config 0 descriptor?? [ 912.195398][ T7646] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 912.379948][ T7646] usb 3-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 912.391152][ T7646] usb 3-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 912.454311][ T7646] usb 3-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 912.471373][ T7646] usb 3-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 912.492293][ T7646] usb 3-1: Product: syz [ 912.512429][T15791] netlink: 156 bytes leftover after parsing attributes in process `syz.4.3026'. [ 912.559751][ T7646] usb 3-1: Manufacturer: syz [ 912.720857][ T7646] hub 3-1:4.0: USB hub found [ 912.911649][T15783] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 912.944442][T15783] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 912.973146][ T7646] hub 3-1:4.0: 6 ports detected [ 912.979714][ T7646] hub 3-1:4.0: insufficient power available to use all downstream ports [ 913.198720][ T7646] hub 3-1:4.0: hub_hub_status failed (err = -71) [ 913.238275][ T7646] hub 3-1:4.0: config failed, can't get hub status (err -71) [ 913.305151][ T7646] usb 3-1: USB disconnect, device number 2 [ 913.344999][T15807] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3029'. [ 914.514443][T15820] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3033'. [ 915.035508][ T7645] usb 4-1: USB disconnect, device number 18 [ 915.226267][T15832] ALSA: mixer_oss: invalid OSS volume 'T' [ 915.330979][T15832] netlink: 'syz.2.3035': attribute type 11 has an invalid length. [ 915.816086][T15853] netlink: 'syz.4.3043': attribute type 13 has an invalid length. [ 916.137445][ T7644] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 916.304278][ T7644] usb 4-1: config 0 has no interfaces? [ 916.322741][ T7644] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 916.332980][ T7644] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 916.341231][ T7644] usb 4-1: Product: syz [ 916.345650][ T7644] usb 4-1: Manufacturer: syz [ 916.350547][ T7644] usb 4-1: SerialNumber: syz [ 916.363300][ T7644] usb 4-1: config 0 descriptor?? [ 916.837956][T15853] bridge0: port 2(bridge_slave_1) entered disabled state [ 916.845814][T15853] bridge0: port 1(bridge_slave_0) entered disabled state [ 917.245486][T15853] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 917.259197][T15853] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 917.477663][ T5911] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 917.510213][T15853] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 917.521169][T15853] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 917.533413][T15853] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 917.542877][T15853] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 917.704692][T15854] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3042'. [ 917.744701][ T5911] usb 2-1: config 0 has no interfaces? [ 917.757242][ T5911] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 917.770017][ T5911] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 917.784949][ T5911] usb 2-1: Product: syz [ 917.800854][ T5911] usb 2-1: Manufacturer: syz [ 917.821189][ T5911] usb 2-1: SerialNumber: syz [ 917.846571][ T5911] usb 2-1: config 0 descriptor?? [ 919.117177][ T5889] usb 4-1: USB disconnect, device number 19 [ 919.267466][ T5911] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 919.587507][ T5911] usb 3-1: Using ep0 maxpacket: 8 [ 919.596479][ T5911] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 919.624509][ T5911] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 919.652545][ T5911] usb 3-1: Product: syz [ 919.839117][ T5911] usb 3-1: Manufacturer: syz [ 919.853289][ T5911] usb 3-1: SerialNumber: syz [ 919.880611][ T5911] usb 3-1: config 0 descriptor?? [ 920.226908][ T5911] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 920.798069][ T7646] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 921.152946][ T7646] usb 5-1: config 0 has no interfaces? [ 921.279427][ T7646] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 921.315008][ T7646] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 921.345530][ T7646] usb 5-1: Product: syz [ 921.350788][ T7646] usb 5-1: Manufacturer: syz [ 921.355422][ T7646] usb 5-1: SerialNumber: syz [ 921.379217][ T7646] usb 5-1: config 0 descriptor?? [ 921.421269][ T7646] usb 2-1: USB disconnect, device number 2 [ 921.458093][ T5911] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -110 [ 921.652564][T15909] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3054'. [ 921.761378][ T5889] usb 3-1: USB disconnect, device number 3 [ 921.931372][ T7646] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 921.987770][ T7645] usb 1-1: new high-speed USB device number 126 using dummy_hcd [ 922.058702][T15919] ALSA: mixer_oss: invalid OSS volume 'T' [ 922.073235][T15919] netlink: 'syz.2.3058': attribute type 11 has an invalid length. [ 922.120160][ T7646] usb 2-1: config 1 interface 0 has no altsetting 0 [ 922.129953][ T7646] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 922.140062][ T7645] usb 1-1: Using ep0 maxpacket: 16 [ 922.145236][ T7646] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 922.155774][ T7645] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 922.173106][ T7646] usb 2-1: Product: syz [ 922.185947][ T7645] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 922.195998][ T7646] usb 2-1: Manufacturer: syz [ 922.209099][ T7646] usb 2-1: SerialNumber: syz [ 922.215046][ T7645] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 922.265518][ T7645] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 922.311975][T15923] netlink: 'syz.3.3060': attribute type 13 has an invalid length. [ 922.317413][ T7645] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 922.358809][ T7645] usb 1-1: config 0 descriptor?? [ 922.790937][T15913] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 922.806374][T15913] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 922.835812][ T7645] microsoft 0003:045E:07DA.0021: unknown main item tag 0x0 [ 922.880056][ T7645] microsoft 0003:045E:07DA.0021: unknown main item tag 0x0 [ 922.903333][ T7645] microsoft 0003:045E:07DA.0021: unknown main item tag 0x0 [ 922.916908][ T7645] microsoft 0003:045E:07DA.0021: unknown main item tag 0x0 [ 922.945724][ T7645] microsoft 0003:045E:07DA.0021: unknown main item tag 0x0 [ 922.976232][ T7645] HID 045e:07da: Invalid code 65791 type 1 [ 923.009971][ T7645] input: HID 045e:07da as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:045E:07DA.0021/input/input79 [ 923.070608][ T7645] microsoft 0003:045E:07DA.0021: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.0-1/input0 [ 923.113290][ T7645] usb 1-1: USB disconnect, device number 126 [ 923.206296][T15928] fido_id[15928]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 923.967904][ T7645] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 924.128037][ T7645] usb 4-1: Using ep0 maxpacket: 8 [ 924.141574][ T7645] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 924.179256][ T7645] usb 4-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 924.202995][ T5911] usb 5-1: USB disconnect, device number 20 [ 924.221229][ T7645] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 924.262320][ T7645] usb 4-1: config 0 descriptor?? [ 924.304447][ T7645] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 924.371440][T15946] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 924.398567][T15946] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 924.407764][T15946] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 924.421307][T15946] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 924.432341][T15947] netlink: 156 bytes leftover after parsing attributes in process `syz.4.3067'. [ 924.442065][T15946] geneve2: entered promiscuous mode [ 924.902518][ T7646] usblp 2-1:1.0: usblp0: USB Unidirectional printer dev 3 if 0 alt 253 proto 1 vid 0x0525 pid 0xA4A8 [ 924.955950][ T7646] usb 2-1: USB disconnect, device number 3 [ 924.971847][ T7646] usblp0: removed [ 925.303280][ T7645] gspca_vc032x: reg_r err -32 [ 925.308197][ T7645] vc032x 4-1:0.0: probe with driver vc032x failed with error -32 [ 925.440996][ T7646] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 925.563138][T15957] netlink: 156 bytes leftover after parsing attributes in process `syz.0.3071'. [ 925.627488][ T7646] usb 2-1: Using ep0 maxpacket: 32 [ 925.645573][ T7646] usb 2-1: config 0 has no interfaces? [ 925.656372][ T7646] usb 2-1: New USB device found, idVendor=ae6f, idProduct=79f4, bcdDevice=8f.99 [ 925.676071][ T7646] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 925.705267][ T7646] usb 2-1: Product: syz [ 925.732861][ T7646] usb 2-1: Manufacturer: syz [ 925.738123][ T7646] usb 2-1: SerialNumber: syz [ 925.746448][ T7646] usb 2-1: config 0 descriptor?? [ 925.787398][ T5890] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 925.859887][ T5911] usb 4-1: USB disconnect, device number 20 [ 925.971224][ T5890] usb 5-1: config 0 has an invalid interface number: 9 but max is 0 [ 925.998684][ T5890] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 926.021188][ T5889] usb 2-1: USB disconnect, device number 4 [ 926.058424][ T5890] usb 5-1: config 0 has no interface number 0 [ 926.075362][ T5890] usb 5-1: New USB device found, idVendor=0421, idProduct=0302, bcdDevice=45.e8 [ 926.102796][ T5890] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 926.121831][ T5890] usb 5-1: config 0 descriptor?? [ 926.143781][ T5890] rndis_host 5-1:0.9: More than one union descriptor, skipping ... [ 926.177549][ T5890] usb 5-1: bad CDC descriptors [ 926.194968][ T5890] cdc_acm 5-1:0.9: More than one union descriptor, skipping ... [ 926.245900][T15970] netlink: 'syz.3.3077': attribute type 13 has an invalid length. [ 926.279851][T15972] netlink: 156 bytes leftover after parsing attributes in process `syz.2.3078'. [ 926.432455][T15955] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 926.443614][T15955] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 927.058150][ T7646] usb 1-1: new high-speed USB device number 127 using dummy_hcd [ 927.116641][ T5894] usb 5-1: USB disconnect, device number 21 [ 927.122918][ T7645] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 927.340529][ T7645] usb 3-1: config 0 has no interfaces? [ 927.543426][ T7645] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 927.556013][ T7645] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 927.566890][ T7645] usb 3-1: Product: syz [ 927.573191][ T7645] usb 3-1: Manufacturer: syz [ 927.580211][ T7645] usb 3-1: SerialNumber: syz [ 927.599609][ T7646] usb 1-1: config 0 has no interfaces? [ 927.608359][ T7646] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 927.618739][ T7646] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 927.626799][ T7646] usb 1-1: Product: syz [ 927.639974][ T7644] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 927.654855][ T7645] usb 3-1: config 0 descriptor?? [ 927.667437][ T7646] usb 1-1: Manufacturer: syz [ 927.702733][ T7646] usb 1-1: SerialNumber: syz [ 927.808280][ T7646] usb 1-1: config 0 descriptor?? [ 927.843577][ T7644] usb 2-1: config 0 has no interfaces? [ 927.886194][ T7644] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 927.923590][ T7644] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 928.017995][ T7644] usb 2-1: Product: syz [ 928.037926][T15985] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3080'. [ 928.076166][T15980] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 928.086289][T15980] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 928.203306][ T7644] usb 2-1: Manufacturer: syz [ 928.332615][ T7644] usb 2-1: SerialNumber: syz [ 928.357758][ T7644] usb 2-1: config 0 descriptor?? [ 928.447579][ T5890] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 928.477582][ T5911] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 928.575552][T15990] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3081'. [ 928.667566][ T5890] usb 4-1: Using ep0 maxpacket: 8 [ 928.689852][ T5890] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 928.700320][ T5890] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 928.727378][ T5911] usb 5-1: Using ep0 maxpacket: 16 [ 928.737115][ T5890] usb 4-1: Product: syz [ 928.747878][ T5911] usb 5-1: config 0 has an invalid interface number: 41 but max is 0 [ 928.761687][ T5890] usb 4-1: Manufacturer: syz [ 928.766949][ T5911] usb 5-1: config 0 has no interface number 0 [ 928.779742][ T5890] usb 4-1: SerialNumber: syz [ 928.787139][ T5911] usb 5-1: config 0 interface 41 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 928.799348][ T5890] usb 4-1: config 0 descriptor?? [ 928.814736][ T5911] usb 5-1: config 0 interface 41 has no altsetting 0 [ 928.832058][ T5911] usb 5-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 928.843079][ T5911] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 928.873692][ T5911] usb 5-1: Product: syz [ 928.884714][ T5911] usb 5-1: Manufacturer: syz [ 928.898233][ T5911] usb 5-1: SerialNumber: syz [ 928.919431][ T5911] usb 5-1: config 0 descriptor?? [ 928.939235][T15998] raw-gadget.5 gadget.4: fail, usb_ep_enable returned -22 [ 928.990709][ T5911] CoreChips 5-1:0.41: probe with driver CoreChips failed with error -22 [ 929.202443][T15998] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 929.238031][T15998] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 929.278423][ T5890] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 929.561370][T15250] usb 5-1: USB disconnect, device number 22 [ 929.697699][ T5890] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 929.732793][ T5890] usb 4-1: USB disconnect, device number 21 [ 929.745576][ T7644] usb 3-1: USB disconnect, device number 4 [ 929.863141][ T5911] usb 1-1: USB disconnect, device number 127 [ 930.322483][T16008] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3084'. [ 930.405821][T16005] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3085'. [ 930.951030][T16010] netlink: 'syz.4.3086': attribute type 13 has an invalid length. [ 931.002388][T16010] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 931.045537][T16010] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 931.065284][T16010] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 931.085530][T16010] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 931.334778][T15250] usb 2-1: USB disconnect, device number 5 [ 931.622636][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.629082][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 932.097488][T15250] usb 4-1: new full-speed USB device number 22 using dummy_hcd [ 932.278166][T16027] netlink: 156 bytes leftover after parsing attributes in process `syz.0.3090'. [ 932.319437][T15250] usb 4-1: New USB device found, idVendor=13d8, idProduct=0001, bcdDevice=30.62 [ 932.368893][T15250] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 932.381623][T15250] usb 4-1: Product: syz [ 932.385954][T15250] usb 4-1: Manufacturer: syz [ 932.393172][T15250] usb 4-1: SerialNumber: syz [ 932.407632][T15250] usb 4-1: config 0 descriptor?? [ 932.492234][T16030] program syz.0.3091 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 932.506575][T15250] usb 4-1: selecting invalid altsetting 3 [ 932.523281][T15250] comedi comedi0: could not set alternate setting 3 in high speed [ 932.581476][T15250] usbdux 4-1:0.0: driver 'usbdux' failed to auto-configure device. [ 932.653445][T15250] usbdux 4-1:0.0: probe with driver usbdux failed with error -22 [ 932.735294][T16022] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3088'. [ 932.962958][T16037] netlink: 'syz.2.3094': attribute type 13 has an invalid length. [ 933.017455][ T7645] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 933.167526][ T7645] usb 1-1: Using ep0 maxpacket: 8 [ 933.192092][ T7645] usb 1-1: config 252 has an invalid interface number: 255 but max is 0 [ 933.235200][ T7645] usb 1-1: config 252 has no interface number 0 [ 933.272650][ T7645] usb 1-1: too many endpoints for config 252 interface 255 altsetting 255: 255, using maximum allowed: 30 [ 933.297450][ T7645] usb 1-1: config 252 interface 255 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 933.503826][ T7645] usb 1-1: config 252 interface 255 has no altsetting 0 [ 933.552505][ T7645] usb 1-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 933.651027][ T7645] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 933.660052][T16037] bridge0: port 2(bridge_slave_1) entered disabled state [ 933.667842][T16037] bridge0: port 1(bridge_slave_0) entered disabled state [ 933.690355][ T7645] pvrusb2: Hardware description: Terratec Grabster AV400 [ 933.704573][ T7645] pvrusb2: ********** [ 933.713201][ T7645] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 933.727554][ T5911] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 933.777989][ T7645] pvrusb2: Important functionality might not be entirely working. [ 933.809778][ T7645] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 933.851712][ T7645] pvrusb2: ********** [ 933.885435][ T7645] usb 1-1: selecting invalid altsetting 0 [ 933.898063][ T5911] usb 5-1: Using ep0 maxpacket: 16 [ 934.004738][ T2344] pvrusb2: Invalid write control endpoint [ 934.201408][ T2344] pvrusb2: Invalid write control endpoint [ 934.288573][T16037] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 934.307767][T16037] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 934.332272][ T2344] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 934.363011][ T2344] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 934.378023][ T2344] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 934.503296][T16037] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 934.513893][T16037] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 934.533362][T16037] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 934.564914][ T2344] pvrusb2: Device being rendered inoperable [ 934.583722][T16047] pvrusb2: Attempted to execute control transfer when device not ok [ 934.584685][T16037] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 934.605940][ T2344] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 934.726470][ T2344] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_c) [ 934.756277][ T2344] pvrusb2: Attached sub-driver cx25840 [ 934.771424][ T2344] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 934.801730][ T2344] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 935.645168][ T5890] usb 4-1: USB disconnect, device number 22 [ 936.498860][T15250] usb 1-1: USB disconnect, device number 2 [ 936.565588][ T5911] usb 5-1: unable to get BOS descriptor or descriptor too short [ 936.590414][ T5911] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 936.635064][ T5911] usb 5-1: can't read configurations, error -71 [ 936.839694][T16069] netlink: 156 bytes leftover after parsing attributes in process `syz.0.3101'. [ 936.992791][T16072] ALSA: mixer_oss: invalid OSS volume 'T' [ 937.040794][T16072] netlink: 'syz.2.3103': attribute type 11 has an invalid length. [ 937.277655][ T5911] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 937.467814][T15250] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 937.490001][ T5911] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 937.501278][ T5911] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 937.519348][ T5911] usb 5-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 937.535199][ T5911] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 937.578435][ T5890] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 937.607853][ T5911] usb 5-1: config 0 descriptor?? [ 937.674708][T15250] usb 2-1: config 0 has an invalid interface number: 9 but max is 0 [ 937.683799][T15250] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 937.695357][T15250] usb 2-1: config 0 has no interface number 0 [ 937.703066][T15250] usb 2-1: New USB device found, idVendor=0421, idProduct=0302, bcdDevice=45.e8 [ 937.713365][T15250] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 937.749235][ T5890] usb 1-1: config 0 has no interfaces? [ 937.776570][T15250] usb 2-1: config 0 descriptor?? [ 937.788620][ T5847] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 937.805833][ T5847] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 937.809872][T15250] rndis_host 2-1:0.9: More than one union descriptor, skipping ... [ 937.825212][ T5847] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 937.848518][ T5890] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 937.861639][ T5847] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 937.873850][ T5847] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 937.928518][ T5890] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 937.936656][ T5890] usb 1-1: Product: syz [ 937.942586][T15250] usb 2-1: bad CDC descriptors [ 937.971183][ T5890] usb 1-1: Manufacturer: syz [ 937.979080][T15250] cdc_acm 2-1:0.9: More than one union descriptor, skipping ... [ 938.007254][ T5890] usb 1-1: SerialNumber: syz [ 938.062228][ T5911] hid-steam 0003:28DE:1142.0022: unknown main item tag 0x0 [ 938.080070][ T5890] usb 1-1: config 0 descriptor?? [ 938.111084][ T5911] hid-steam 0003:28DE:1142.0022: unknown main item tag 0x0 [ 938.168668][ T5911] hid-steam 0003:28DE:1142.0022: unknown main item tag 0x0 [ 938.214414][ T5911] hid-steam 0003:28DE:1142.0022: unknown main item tag 0x0 [ 938.239080][ T5911] hid-steam 0003:28DE:1142.0022: unknown main item tag 0x0 [ 938.271372][ T5911] hid-steam 0003:28DE:1142.0022: hidraw0: USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.4-1/input0 [ 938.312919][T16086] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 938.362450][ T5911] usb 5-1: USB disconnect, device number 24 [ 938.372207][T16086] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 938.397179][T16079] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3104'. [ 938.597918][T16085] fido_id[16085]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 939.378775][ T7645] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 939.551211][ T7645] usb 5-1: Using ep0 maxpacket: 16 [ 939.580338][ T7645] usb 5-1: config 0 has an invalid interface number: 41 but max is 0 [ 939.610362][ T7645] usb 5-1: config 0 has no interface number 0 [ 939.671640][ T7645] usb 5-1: config 0 interface 41 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 939.736480][ T7645] usb 5-1: config 0 interface 41 has no altsetting 0 [ 939.809405][ T7645] usb 5-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 939.833216][ T7645] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 939.857552][ T7645] usb 5-1: Product: syz [ 939.865634][ T7645] usb 5-1: Manufacturer: syz [ 939.915674][ T7645] usb 5-1: SerialNumber: syz [ 939.937936][ T5847] Bluetooth: hci0: command tx timeout [ 939.975950][ T7645] usb 5-1: config 0 descriptor?? [ 940.024677][T16094] raw-gadget.3 gadget.4: fail, usb_ep_enable returned -22 [ 940.086947][ T7645] CoreChips 5-1:0.41: probe with driver CoreChips failed with error -22 [ 940.278058][ T7645] usb 2-1: USB disconnect, device number 6 [ 940.315428][T16094] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 940.368225][T16094] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 940.491197][ T5911] usb 5-1: USB disconnect, device number 25 [ 940.527740][T15250] usb 1-1: USB disconnect, device number 3 [ 940.754189][ T7645] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 941.098553][ T7645] usb 2-1: config 0 has no interfaces? [ 941.124214][ T7645] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 941.153490][ T7645] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 941.190873][ T7645] usb 2-1: Product: syz [ 941.200392][ T7645] usb 2-1: Manufacturer: syz [ 941.205060][ T7645] usb 2-1: SerialNumber: syz [ 941.216300][T14566] bond0 (unregistering): Released all slaves [ 941.264782][ T7645] usb 2-1: config 0 descriptor?? [ 941.289690][T14566] bond1 (unregistering): Released all slaves [ 941.379028][T16123] netlink: 'syz.4.3111': attribute type 13 has an invalid length. [ 941.616957][T16082] chnl_net:caif_netlink_parms(): no params data found [ 941.694525][T16112] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3108'. [ 941.857013][T14566] tipc: Left network mode [ 942.017515][ T5847] Bluetooth: hci0: command tx timeout [ 942.077565][ T52] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 942.431767][ T52] usb 1-1: config 0 has no interfaces? [ 942.533985][T16082] bridge0: port 1(bridge_slave_0) entered blocking state [ 942.546620][ T52] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 942.574391][T16082] bridge0: port 1(bridge_slave_0) entered disabled state [ 942.597080][T16082] bridge_slave_0: entered allmulticast mode [ 942.603527][ T52] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 942.603558][ T52] usb 1-1: Product: syz [ 942.603575][ T52] usb 1-1: Manufacturer: syz [ 942.603591][ T52] usb 1-1: SerialNumber: syz [ 942.619028][ T52] usb 1-1: config 0 descriptor?? [ 942.716906][T16082] bridge_slave_0: entered promiscuous mode [ 942.851883][T14566] hsr_slave_0: left promiscuous mode [ 942.871634][T14566] hsr_slave_1: left promiscuous mode [ 943.374909][ T5911] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 943.396564][T15250] usb 2-1: USB disconnect, device number 7 [ 943.667526][ T5911] usb 3-1: Using ep0 maxpacket: 16 [ 943.673406][T16145] netlink: 'syz.1.3114': attribute type 13 has an invalid length. [ 944.097566][ T5847] Bluetooth: hci0: command tx timeout [ 944.220363][T14566] net veth1_virt_wifi virt_wifi0 (unregistering): left allmulticast mode [ 945.735465][T16082] bridge0: port 2(bridge_slave_1) entered blocking state [ 945.742929][T16082] bridge0: port 2(bridge_slave_1) entered disabled state [ 945.754034][T16082] bridge_slave_1: entered allmulticast mode [ 945.766185][T16082] bridge_slave_1: entered promiscuous mode [ 945.776911][T16129] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3112'. [ 945.909299][ T7644] usb 1-1: USB disconnect, device number 4 [ 946.167380][T16145] bridge0: port 2(bridge_slave_1) entered disabled state [ 946.176501][T16145] bridge0: port 1(bridge_slave_0) entered disabled state [ 946.186342][ T5847] Bluetooth: hci0: command tx timeout [ 946.194715][T16159] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3115'. [ 946.197490][ T30] audit: type=1326 audit(1746835954.765:88): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16158 comm="syz.0.3115" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e2c18e969 code=0x7ffc0000 [ 946.227560][ T30] audit: type=1326 audit(1746835954.785:89): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16158 comm="syz.0.3115" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e2c18e969 code=0x7ffc0000 [ 946.365312][T16145] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 946.383131][T16145] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 946.574048][T16145] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 946.596853][T16145] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 946.620358][T16145] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 946.643824][T16145] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 946.671005][ T5911] usb 3-1: unable to get BOS descriptor or descriptor too short [ 946.712039][ T5911] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 946.745611][ T5911] usb 3-1: can't read configurations, error -71 [ 946.852938][T16082] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 946.877075][T16082] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 947.226794][T16082] team0: Port device team_slave_0 added [ 947.277978][T16082] team0: Port device team_slave_1 added [ 947.515936][T16082] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 947.537504][T16082] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 947.634630][T16082] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 947.676382][T16082] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 947.712480][T16082] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 947.790488][T16082] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 948.070858][T16082] hsr_slave_0: entered promiscuous mode [ 948.087499][ T7645] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 948.116478][T16082] hsr_slave_1: entered promiscuous mode [ 948.266545][ T7645] usb 1-1: config 0 has an invalid interface number: 9 but max is 0 [ 948.287794][ T7645] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 948.299514][ T7645] usb 1-1: config 0 has no interface number 0 [ 948.305733][ T7645] usb 1-1: New USB device found, idVendor=0421, idProduct=0302, bcdDevice=45.e8 [ 948.325817][ T7645] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 948.373304][ T7645] usb 1-1: config 0 descriptor?? [ 948.384839][ T7645] rndis_host 1-1:0.9: More than one union descriptor, skipping ... [ 948.401281][ T7645] usb 1-1: bad CDC descriptors [ 948.422738][ T7645] cdc_acm 1-1:0.9: More than one union descriptor, skipping ... [ 948.876675][T16195] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 948.888052][T16195] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 950.025880][ T30] audit: type=1326 audit(1746835958.615:90): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16207 comm="syz.2.3126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f791658e969 code=0x7ffc0000 [ 950.115709][T16208] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3126'. [ 950.196624][ T30] audit: type=1326 audit(1746835958.615:91): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16207 comm="syz.2.3126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f791658e969 code=0x7ffc0000 [ 950.695355][T16082] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 950.775360][T16082] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 950.852533][T16082] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 951.046488][ T5890] usb 1-1: USB disconnect, device number 5 [ 951.059803][T16082] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 951.107525][ T5911] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 951.278553][ T5911] usb 3-1: Using ep0 maxpacket: 32 [ 951.312148][ T5911] usb 3-1: config 0 has an invalid interface number: 85 but max is 0 [ 951.327362][ T5911] usb 3-1: config 0 has no interface number 0 [ 951.398258][ T5911] usb 3-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 951.463871][T16082] 8021q: adding VLAN 0 to HW filter on device bond0 [ 951.488145][ T5911] usb 3-1: config 0 interface 85 has no altsetting 0 [ 951.514734][T16082] 8021q: adding VLAN 0 to HW filter on device team0 [ 951.569032][ T5911] usb 3-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 951.610283][ T5911] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 951.636471][ T5911] usb 3-1: Product: syz [ 951.696436][T15879] bridge0: port 1(bridge_slave_0) entered blocking state [ 951.703716][T15879] bridge0: port 1(bridge_slave_0) entered forwarding state [ 951.715640][ T5911] usb 3-1: Manufacturer: syz [ 951.722352][ T5911] usb 3-1: SerialNumber: syz [ 951.776920][ T5911] usb 3-1: config 0 descriptor?? [ 951.832898][ T5890] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 951.892155][T15879] bridge0: port 2(bridge_slave_1) entered blocking state [ 951.899436][T15879] bridge0: port 2(bridge_slave_1) entered forwarding state [ 952.119995][ T5890] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 952.165423][ T5890] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 952.211075][ T5890] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 952.234033][ T5890] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 952.322778][ T5911] appletouch 3-1:0.85: Geyser mode initialized. [ 952.329215][ T5890] usb 1-1: SerialNumber: syz [ 952.349026][ T5911] input: appletouch as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.85/input/input80 [ 952.381354][T16082] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 952.689945][ T7644] usb 3-1: USB disconnect, device number 7 [ 952.735764][T16082] veth0_vlan: entered promiscuous mode [ 952.765653][ T7644] appletouch 3-1:0.85: input: appletouch disconnected [ 952.921733][T16082] veth1_vlan: entered promiscuous mode [ 953.051914][T16082] veth0_macvtap: entered promiscuous mode [ 953.126300][T16082] veth1_macvtap: entered promiscuous mode [ 953.183363][T16082] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 953.356615][T16082] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 953.415072][T16082] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 953.453529][T16082] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 953.473189][T16082] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 953.499263][T16082] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 953.990607][ T3573] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 954.128689][ T3573] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 954.177524][ T5848] Bluetooth: hci4: command 0x0406 tx timeout [ 954.500143][T15250] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 954.539493][ T1078] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 954.559944][ T1078] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 954.687464][T15250] usb 2-1: Using ep0 maxpacket: 16 [ 954.697702][T15250] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 954.707189][T15250] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 954.734622][T15250] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 954.747480][ T52] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 954.760415][T15250] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 954.779813][T15250] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 954.790978][T15250] usb 2-1: Product: syz [ 954.795333][T15250] usb 2-1: Manufacturer: syz [ 954.797491][ T7644] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 954.802725][T15250] usb 2-1: SerialNumber: syz [ 955.019804][ T7644] usb 5-1: config 0 has no interfaces? [ 955.182595][ T52] usb 3-1: config 0 has no interfaces? [ 955.192341][ T7644] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 955.296103][T15250] usb 2-1: 0:2 : does not exist [ 955.304047][ T52] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 955.315478][ T7644] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 955.360643][ T7645] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 955.379851][ T52] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 955.388077][ T7644] usb 5-1: Product: syz [ 955.392306][ T7644] usb 5-1: Manufacturer: syz [ 955.597351][ T52] usb 3-1: Product: syz [ 955.601728][ T52] usb 3-1: Manufacturer: syz [ 955.610041][ T7644] usb 5-1: config 0 descriptor?? [ 955.661943][ T52] usb 3-1: SerialNumber: syz [ 955.731900][ T52] usb 3-1: config 0 descriptor?? [ 955.826916][ T7645] usb 4-1: config 0 has no interfaces? [ 955.842606][ T7645] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 955.857053][ T7645] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 955.959062][ T7645] usb 4-1: Product: syz [ 955.982556][ T7645] usb 4-1: Manufacturer: syz [ 955.983156][ T5890] usb 1-1: 0:2 : does not exist [ 956.000374][ T7645] usb 4-1: SerialNumber: syz [ 956.041764][T16260] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3136'. [ 956.117012][T15250] usb 2-1: USB disconnect, device number 8 [ 956.203431][ T7645] usb 4-1: config 0 descriptor?? [ 956.303840][ T5890] usb 1-1: USB disconnect, device number 6 [ 956.466394][T16274] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3100'. [ 956.492861][ T5849] udevd[5849]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 957.293440][ T5848] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 957.311831][ T5848] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 957.321411][ T5848] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 957.331398][ T5848] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 957.339878][ T5848] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 957.680534][ T5890] usb 5-1: USB disconnect, device number 26 [ 957.809633][T16297] fuse: Bad value for 'rootmode' [ 957.904314][ T7645] usb 3-1: USB disconnect, device number 8 [ 957.927517][T16303] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 958.873325][ T7645] usb 4-1: USB disconnect, device number 23 [ 959.377760][ T5848] Bluetooth: hci1: command tx timeout [ 959.472073][T16291] chnl_net:caif_netlink_parms(): no params data found [ 960.812441][ T30] audit: type=1326 audit(1746835969.395:92): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16337 comm="syz.1.3149" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fa714d8e969 code=0x0 [ 961.070051][ T5847] Bluetooth: hci0: command tx timeout [ 961.183939][T16363] netlink: 'syz.4.3152': attribute type 13 has an invalid length. [ 961.457506][ T5847] Bluetooth: hci1: command tx timeout [ 961.743260][T15879] bond0 (unregistering): Released all slaves [ 961.935560][T15879] tipc: Left network mode [ 961.949708][T16291] bridge0: port 1(bridge_slave_0) entered blocking state [ 962.006203][T16291] bridge0: port 1(bridge_slave_0) entered disabled state [ 962.031314][T16291] bridge_slave_0: entered allmulticast mode [ 962.075607][T16291] bridge_slave_0: entered promiscuous mode [ 962.317615][T16291] bridge0: port 2(bridge_slave_1) entered blocking state [ 962.364256][T16291] bridge0: port 2(bridge_slave_1) entered disabled state [ 962.381381][T16291] bridge_slave_1: entered allmulticast mode [ 962.486995][T16291] bridge_slave_1: entered promiscuous mode [ 962.813148][T16291] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 962.872582][T16291] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 962.947377][T15250] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 963.124016][T15250] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 963.134424][T15250] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 963.147772][T15250] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 963.157056][T15250] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 963.165295][T15250] usb 3-1: SerialNumber: syz [ 963.263744][T15879] hsr_slave_0: left promiscuous mode [ 963.275860][T15879] hsr_slave_1: left promiscuous mode [ 963.569458][ T5847] Bluetooth: hci1: command tx timeout [ 963.697730][ T52] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 964.087634][ T52] usb 4-1: config 0 has no interfaces? [ 964.098763][ T52] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 964.115863][ T52] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 964.116015][T15879] net veth1_virt_wifi virt_wifi0 (unregistering): left allmulticast mode [ 964.124689][ T52] usb 4-1: Product: syz [ 964.139584][ T52] usb 4-1: Manufacturer: syz [ 964.159531][ T52] usb 4-1: SerialNumber: syz [ 964.182875][ T52] usb 4-1: config 0 descriptor?? [ 965.618166][ T5847] Bluetooth: hci1: command tx timeout [ 965.679963][T15250] usb 3-1: 0:2 : does not exist [ 965.776656][T15250] usb 3-1: USB disconnect, device number 9 [ 965.856230][ T5849] udevd[5849]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 966.141492][T16291] team0: Port device team_slave_0 added [ 966.157428][T16398] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3156'. [ 966.182245][T16291] team0: Port device team_slave_1 added [ 966.282558][T16291] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 966.293397][T16291] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 966.333226][T16291] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 966.346792][T16291] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 966.366488][T16291] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 966.401888][T16291] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 966.628340][T16291] hsr_slave_0: entered promiscuous mode [ 966.639684][T16291] hsr_slave_1: entered promiscuous mode [ 966.646390][T16291] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 966.662356][T16291] Cannot create hsr debugfs directory [ 966.900604][ T5890] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 966.999163][T16420] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 967.007482][T16420] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 967.015800][T16420] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 967.078294][T16417] syz.2.3161 (16417): drop_caches: 2 [ 967.088039][ T5890] usb 2-1: Using ep0 maxpacket: 32 [ 967.116774][ T5890] usb 2-1: config 0 has an invalid interface number: 85 but max is 0 [ 967.146535][ T5890] usb 2-1: config 0 has no interface number 0 [ 967.178784][ T5890] usb 2-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 967.248012][ T5890] usb 2-1: config 0 interface 85 has no altsetting 0 [ 967.298295][ T5890] usb 2-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 967.318107][ T5890] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 967.326206][ T5890] usb 2-1: Product: syz [ 967.332610][ T5890] usb 2-1: Manufacturer: syz [ 967.337262][ T5890] usb 2-1: SerialNumber: syz [ 967.352755][ T5890] usb 2-1: config 0 descriptor?? [ 967.415382][ T7644] usb 4-1: USB disconnect, device number 24 [ 968.070639][T16426] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 968.083961][ T5890] appletouch 2-1:0.85: Geyser mode initialized. [ 968.093825][ T5890] input: appletouch as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.85/input/input81 [ 968.112708][T16426] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 968.499730][ T5890] usb 2-1: USB disconnect, device number 9 [ 968.499785][ C0] appletouch 2-1:0.85: atp_complete: usb_submit_urb failed with result -19 [ 968.575426][T16426] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 968.602399][ T5890] appletouch 2-1:0.85: input: appletouch disconnected [ 968.620435][T16426] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 968.660320][T16426] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 968.686614][T16426] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 968.698227][T16426] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 968.747913][T16426] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 968.774387][T16426] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 968.788877][T16426] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 968.834338][T16426] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 968.854706][T16426] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 968.866107][T16291] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 968.881173][T16291] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 968.892931][T16426] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 968.904772][T16291] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 968.920026][T16291] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 969.113949][T16291] 8021q: adding VLAN 0 to HW filter on device bond0 [ 969.144800][T16291] 8021q: adding VLAN 0 to HW filter on device team0 [ 969.165769][T15879] bridge0: port 1(bridge_slave_0) entered blocking state [ 969.173055][T15879] bridge0: port 1(bridge_slave_0) entered forwarding state [ 969.180528][ T5832] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 969.188856][ T5890] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 969.194841][T15879] bridge0: port 2(bridge_slave_1) entered blocking state [ 969.203606][T15879] bridge0: port 2(bridge_slave_1) entered forwarding state [ 969.343863][ T5890] usb 3-1: Using ep0 maxpacket: 8 [ 969.353892][ T5832] usb 4-1: config 0 has no interfaces? [ 969.363121][T16291] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 969.381554][ T5832] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 969.392432][ T5890] usb 3-1: config 1 interface 0 altsetting 72 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 969.417898][ T5832] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 969.446605][ T5890] usb 3-1: config 1 interface 0 has no altsetting 0 [ 969.453386][ T5832] usb 4-1: Product: syz [ 969.458672][ T5832] usb 4-1: Manufacturer: syz [ 969.463416][ T5832] usb 4-1: SerialNumber: syz [ 969.469951][T16291] veth0_vlan: entered promiscuous mode [ 969.483242][ T5890] usb 3-1: New USB device found, idVendor=0c16, idProduct=0002, bcdDevice= 0.40 [ 969.505164][ T5890] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 969.525696][ T5832] usb 4-1: config 0 descriptor?? [ 969.537000][T16291] veth1_vlan: entered promiscuous mode [ 969.544872][ T5890] usb 3-1: Product: ј [ 969.574219][ T5890] usb 3-1: Manufacturer: 䣹ꌋ箰挐祉萝얡知놣罱ɡ딊预쐊脣拨떹矿醑䋌ඍ悫鯡Ῠﶳ蓇់빘ꋼ㤖ꀋ刷繮嚷➌瓋巈ﭫ痩⼋ᆃ䄢ధⲻꗭ䞨ꩪ컓矋䕪୓ö겁ᮥ掍븶ָ䆬襩࿀㽭虳迦䖭ᙹޞ趑쉎त䝨솘侥ꃌ㥥䃟 [ 969.670379][ T5890] usb 3-1: SerialNumber: ည [ 969.679924][T16291] veth0_macvtap: entered promiscuous mode [ 969.725080][T16291] veth1_macvtap: entered promiscuous mode [ 969.796001][T16291] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 969.826312][T16291] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 969.870439][T16291] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 969.923430][T16434] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3163'. [ 969.943483][T16291] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 969.971228][T16291] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 969.983888][T16291] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 970.002770][T16463] binder: 16461:16463 ioctl c0306201 200000001a80 returned -14 [ 970.097498][ T5847] Bluetooth: hci4: command 0x0406 tx timeout [ 970.161822][T16291] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 970.193481][T16291] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 970.227569][T16291] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 970.272893][T16291] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 970.518651][T14566] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 970.543652][T14566] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 970.577595][ T5847] Bluetooth: hci3: command 0x0c1a tx timeout [ 970.634430][ T3573] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 970.648436][ T3573] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 970.737535][ T5847] Bluetooth: hci5: command 0x0c1a tx timeout [ 970.818972][ T5847] Bluetooth: hci0: command 0x0c1a tx timeout [ 970.897633][ T5847] Bluetooth: hci1: command 0x0c1a tx timeout [ 970.983890][ T5890] usbhid 3-1:1.0: can't add hid device: -71 [ 971.009119][ T5890] usbhid 3-1:1.0: probe with driver usbhid failed with error -71 [ 971.042513][ T5890] usb 3-1: USB disconnect, device number 10 [ 971.276924][ T5832] usb 4-1: USB disconnect, device number 25 [ 971.388092][ T5890] usb 3-1: new full-speed USB device number 11 using dummy_hcd [ 971.415812][T16486] xt_hashlimit: size too large, truncated to 1048576 [ 971.483675][T16488] geneve2: entered promiscuous mode [ 971.580358][ T5890] usb 3-1: config 0 has an invalid interface number: 128 but max is 0 [ 971.603712][ T5890] usb 3-1: config 0 has no interface number 0 [ 971.632210][ T5890] usb 3-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 971.673344][ T5890] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 971.687419][T16494] xt_hashlimit: size too large, truncated to 1048576 [ 971.696354][ T5890] usb 3-1: Product: syz [ 971.733951][ T5890] usb 3-1: Manufacturer: syz [ 971.742439][T16496] xt_hashlimit: size too large, truncated to 1048576 [ 971.753348][ T5890] usb 3-1: SerialNumber: syz [ 971.777021][ T5890] usb 3-1: config 0 descriptor?? [ 972.056506][T16503] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3179'. [ 972.188275][ T5847] Bluetooth: hci4: command 0x0406 tx timeout [ 972.558767][ T5890] usb 3-1: Firmware version (0.0) predates our first public release. [ 972.585139][ T5890] usb 3-1: Please update to version 0.2 or newer [ 972.674075][ T5847] Bluetooth: hci3: command 0x0c1a tx timeout [ 972.712577][ T5890] usb 3-1: USB disconnect, device number 11 [ 972.827581][ T5847] Bluetooth: hci5: command 0x0c1a tx timeout [ 972.897728][ T5847] Bluetooth: hci0: command 0x0c1a tx timeout [ 972.979729][ T5847] Bluetooth: hci1: command 0x0c1a tx timeout [ 973.055264][T16525] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 973.146713][T16525] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 973.167425][ T5889] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 973.233917][T16528] FAULT_INJECTION: forcing a failure. [ 973.233917][T16528] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 973.263223][T16528] CPU: 0 UID: 0 PID: 16528 Comm: syz.0.3187 Not tainted 6.15.0-rc5-syzkaller-00158-g3013c33dcbd9 #0 PREEMPT(full) [ 973.263258][T16528] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 973.263280][T16528] Call Trace: [ 973.263293][T16528] [ 973.263303][T16528] dump_stack_lvl+0x189/0x250 [ 973.263340][T16528] ? __lock_acquire+0xaac/0xd20 [ 973.263371][T16528] ? __pfx_dump_stack_lvl+0x10/0x10 [ 973.263401][T16528] ? __pfx__printk+0x10/0x10 [ 973.263421][T16528] ? __might_fault+0xb0/0x130 [ 973.263465][T16528] should_fail_ex+0x414/0x560 [ 973.263504][T16528] _copy_from_user+0x2d/0xb0 [ 973.263533][T16528] ___sys_sendmsg+0x158/0x2a0 [ 973.263571][T16528] ? __pfx____sys_sendmsg+0x10/0x10 [ 973.263634][T16528] ? __fget_files+0x2a/0x420 [ 973.263659][T16528] ? __fget_files+0x3a0/0x420 [ 973.263696][T16528] __x64_sys_sendmsg+0x19b/0x260 [ 973.263726][T16528] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 973.263769][T16528] ? do_syscall_64+0xba/0x210 [ 973.263799][T16528] do_syscall_64+0xf6/0x210 [ 973.263831][T16528] ? clear_bhb_loop+0x45/0xa0 [ 973.263856][T16528] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 973.263876][T16528] RIP: 0033:0x7fdab658e969 [ 973.263903][T16528] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 973.263921][T16528] RSP: 002b:00007fdab7335038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 973.263950][T16528] RAX: ffffffffffffffda RBX: 00007fdab67b5fa0 RCX: 00007fdab658e969 [ 973.263965][T16528] RDX: 0000000000000800 RSI: 0000200000006040 RDI: 0000000000000004 [ 973.263979][T16528] RBP: 00007fdab7335090 R08: 0000000000000000 R09: 0000000000000000 [ 973.263992][T16528] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 973.264004][T16528] R13: 0000000000000000 R14: 00007fdab67b5fa0 R15: 00007fdab68dfa28 [ 973.264034][T16528] [ 973.475790][ T5890] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 973.556496][T16534] FAULT_INJECTION: forcing a failure. [ 973.556496][T16534] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 973.594031][T16534] CPU: 0 UID: 0 PID: 16534 Comm: syz.4.3190 Not tainted 6.15.0-rc5-syzkaller-00158-g3013c33dcbd9 #0 PREEMPT(full) [ 973.594063][T16534] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 973.594076][T16534] Call Trace: [ 973.594085][T16534] [ 973.594093][T16534] dump_stack_lvl+0x189/0x250 [ 973.594128][T16534] ? __lock_acquire+0xaac/0xd20 [ 973.594159][T16534] ? __pfx_dump_stack_lvl+0x10/0x10 [ 973.594188][T16534] ? __pfx__printk+0x10/0x10 [ 973.594209][T16534] ? __might_fault+0xb0/0x130 [ 973.594244][T16534] should_fail_ex+0x414/0x560 [ 973.594282][T16534] _copy_from_user+0x2d/0xb0 [ 973.594312][T16534] __sys_connect+0x123/0x440 [ 973.594336][T16534] ? __fget_files+0x3a0/0x420 [ 973.594364][T16534] ? __pfx___sys_connect+0x10/0x10 [ 973.594409][T16534] __x64_sys_connect+0x7a/0x90 [ 973.594435][T16534] do_syscall_64+0xf6/0x210 [ 973.594462][T16534] ? clear_bhb_loop+0x45/0xa0 [ 973.594487][T16534] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 973.594507][T16534] RIP: 0033:0x7fc96538e969 [ 973.594525][T16534] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 973.594542][T16534] RSP: 002b:00007fc966286038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 973.594572][T16534] RAX: ffffffffffffffda RBX: 00007fc9655b5fa0 RCX: 00007fc96538e969 [ 973.594588][T16534] RDX: 000000000000001c RSI: 0000200000000000 RDI: 0000000000000003 [ 973.594602][T16534] RBP: 00007fc966286090 R08: 0000000000000000 R09: 0000000000000000 [ 973.594615][T16534] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 973.594627][T16534] R13: 0000000000000000 R14: 00007fc9655b5fa0 R15: 00007fc9656dfa28 [ 973.594660][T16534] [ 973.594853][ T5889] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 973.867769][ T5889] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 973.887677][ T5889] usb 2-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 973.898882][ T5890] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 973.907679][ T5890] usb 4-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 973.927758][ T5889] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 973.937448][ T5890] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 973.946510][ T5890] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 973.978590][ T5889] usb 2-1: config 0 descriptor?? [ 973.985861][ T5890] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 973.995544][ T5890] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 974.004129][ T5890] usb 4-1: Product: syz [ 974.013895][ T5889] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 974.027350][ T5890] usb 4-1: Manufacturer: syz [ 974.047563][ T7645] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 974.062611][ T5890] cdc_wdm 4-1:1.0: skipping garbage [ 974.077397][ T5890] cdc_wdm 4-1:1.0: probe with driver cdc_wdm failed with error -22 [ 974.197503][ T7645] usb 5-1: Using ep0 maxpacket: 32 [ 974.219361][ T7645] usb 5-1: unable to get BOS descriptor or descriptor too short [ 974.241186][ T7645] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 974.259015][ T7645] usb 5-1: can't read configurations, error -71 [ 974.275932][ T7644] usb 4-1: USB disconnect, device number 26 [ 974.747686][ T5847] Bluetooth: hci3: command 0x0c1a tx timeout [ 974.906014][ T5847] Bluetooth: hci5: command 0x0c1a tx timeout [ 975.067570][ T5847] Bluetooth: hci1: command 0x0c1a tx timeout [ 975.172058][T16579] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 975.180975][T16579] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 975.189693][T16579] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 975.234846][T16574] syz.3.3198 (16574): drop_caches: 2 [ 975.407508][ T5890] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 975.589224][ T5890] usb 3-1: config 0 interface 0 altsetting 253 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 975.613648][ T5890] usb 3-1: config 0 interface 0 has no altsetting 0 [ 975.626285][ T5890] usb 3-1: New USB device found, idVendor=1b96, idProduct=0009, bcdDevice= 0.00 [ 975.637004][ T5890] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 975.651378][ T5890] usb 3-1: config 0 descriptor?? [ 976.091981][T16594] program syz.3.3205 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 976.186994][ T5890] ntrig 0003:1B96:0009.0023: item fetching failed at offset 5/7 [ 976.251415][ T5890] ntrig 0003:1B96:0009.0023: parse failed [ 976.280932][ T5890] ntrig 0003:1B96:0009.0023: probe with driver ntrig failed with error -22 [ 976.337012][ T5832] usb 2-1: USB disconnect, device number 10 [ 976.477108][ T7645] usb 3-1: USB disconnect, device number 12 [ 976.735579][T16590] netlink: 'syz.0.3204': attribute type 7 has an invalid length. [ 976.879349][T16590] : entered promiscuous mode [ 977.141088][T16612] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3210'. [ 977.159251][T16612] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 977.168840][T16612] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 977.177663][T16612] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 977.186405][T16612] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 977.239608][T16612] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 977.248681][T16612] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 977.257681][T16612] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 977.266618][T16612] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 977.847491][ T5890] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 977.926708][T16634] FAULT_INJECTION: forcing a failure. [ 977.926708][T16634] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 977.983725][T16634] CPU: 0 UID: 0 PID: 16634 Comm: syz.2.3219 Not tainted 6.15.0-rc5-syzkaller-00158-g3013c33dcbd9 #0 PREEMPT(full) [ 977.983749][T16634] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 977.983759][T16634] Call Trace: [ 977.983765][T16634] [ 977.983772][T16634] dump_stack_lvl+0x189/0x250 [ 977.983797][T16634] ? __lock_acquire+0xaac/0xd20 [ 977.983820][T16634] ? __pfx_dump_stack_lvl+0x10/0x10 [ 977.983842][T16634] ? __pfx__printk+0x10/0x10 [ 977.983857][T16634] ? __might_fault+0xb0/0x130 [ 977.983883][T16634] should_fail_ex+0x414/0x560 [ 977.983911][T16634] _copy_from_user+0x2d/0xb0 [ 977.983932][T16634] ___sys_sendmsg+0x158/0x2a0 [ 977.983955][T16634] ? __pfx____sys_sendmsg+0x10/0x10 [ 977.983999][T16634] ? __fget_files+0x2a/0x420 [ 977.984017][T16634] ? __fget_files+0x3a0/0x420 [ 977.984042][T16634] __x64_sys_sendmsg+0x19b/0x260 [ 977.984063][T16634] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 977.984094][T16634] ? do_syscall_64+0xba/0x210 [ 977.984115][T16634] do_syscall_64+0xf6/0x210 [ 977.984139][T16634] ? clear_bhb_loop+0x45/0xa0 [ 977.984157][T16634] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 977.984171][T16634] RIP: 0033:0x7f791658e969 [ 977.984185][T16634] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 977.984198][T16634] RSP: 002b:00007f79173ee038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 977.984213][T16634] RAX: ffffffffffffffda RBX: 00007f79167b5fa0 RCX: 00007f791658e969 [ 977.984224][T16634] RDX: 0000000000008000 RSI: 00002000000001c0 RDI: 0000000000000004 [ 977.984234][T16634] RBP: 00007f79173ee090 R08: 0000000000000000 R09: 0000000000000000 [ 977.984243][T16634] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 977.984252][T16634] R13: 0000000000000000 R14: 00007f79167b5fa0 R15: 00007f79168dfa28 [ 977.984273][T16634] [ 978.407381][ T5890] usb 4-1: Using ep0 maxpacket: 8 [ 978.419608][ T5890] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 978.458384][ T5890] usb 4-1: config 0 has no interfaces? [ 978.532638][ T5890] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 978.571058][ T5890] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 978.612968][ T5890] usb 4-1: Product: syz [ 978.617214][ T5890] usb 4-1: Manufacturer: syz [ 978.637369][ T5890] usb 4-1: SerialNumber: syz [ 978.661710][ T5890] usb 4-1: config 0 descriptor?? [ 978.706737][T16639] trusted_key: encrypted_key: insufficient parameters specified [ 979.027656][ T5832] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 979.193849][ T5832] usb 3-1: config 0 has an invalid interface number: 65 but max is 0 [ 979.202386][ T5832] usb 3-1: config 0 has no interface number 0 [ 979.211363][ T5832] usb 3-1: config 0 interface 65 altsetting 15 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 979.437374][ T5832] usb 3-1: config 0 interface 65 has no altsetting 0 [ 979.477476][ T5832] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 979.507235][ T5832] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 979.520416][ T5832] usb 3-1: config 0 descriptor?? [ 980.490712][ T5832] usb 3-1: string descriptor 0 read error: -71 [ 980.498803][ T5832] cp210x 3-1:0.65: cp210x converter detected [ 980.527656][ T5832] cp210x 3-1:0.65: failed to get vendor val 0x370b size 1: -71 [ 980.547843][ T5832] cp210x 3-1:0.65: querying part number failed [ 980.591876][ T5832] usb 3-1: cp210x converter now attached to ttyUSB0 [ 980.621079][T16658] FAULT_INJECTION: forcing a failure. [ 980.621079][T16658] name failslab, interval 1, probability 0, space 0, times 1 [ 980.621287][ T5832] usb 3-1: USB disconnect, device number 13 [ 980.652954][T16658] CPU: 1 UID: 0 PID: 16658 Comm: syz.1.3223 Not tainted 6.15.0-rc5-syzkaller-00158-g3013c33dcbd9 #0 PREEMPT(full) [ 980.652993][T16658] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 980.653007][T16658] Call Trace: [ 980.653016][T16658] [ 980.653025][T16658] dump_stack_lvl+0x189/0x250 [ 980.653069][T16658] ? __pfx_dump_stack_lvl+0x10/0x10 [ 980.653098][T16658] ? __pfx__printk+0x10/0x10 [ 980.653123][T16658] ? __pfx___might_resched+0x10/0x10 [ 980.653148][T16658] should_fail_ex+0x414/0x560 [ 980.653186][T16658] should_failslab+0xa8/0x100 [ 980.653215][T16658] kmem_cache_alloc_noprof+0x73/0x3c0 [ 980.653238][T16658] ? mas_alloc_nodes+0x2e9/0x8e0 [ 980.653266][T16658] mas_alloc_nodes+0x2e9/0x8e0 [ 980.653297][T16658] mas_preallocate+0x542/0x8b0 [ 980.653322][T16658] ? __lock_acquire+0xaac/0xd20 [ 980.653350][T16658] ? __pfx_mas_preallocate+0x10/0x10 [ 980.653378][T16658] ? __asan_memset+0x22/0x50 [ 980.653406][T16658] commit_merge+0x1f1/0x6e0 [ 980.653427][T16658] ? __vma_enter_locked+0x1f4/0x380 [ 980.653461][T16658] ? __pfx_commit_merge+0x10/0x10 [ 980.653494][T16658] ? vma_merge_existing_range+0xb8f/0x15b0 [ 980.653525][T16658] vma_merge_existing_range+0x10b7/0x15b0 [ 980.653566][T16658] vma_modify+0x76/0x460 [ 980.653590][T16658] vma_modify_flags+0x1e8/0x230 [ 980.653615][T16658] ? __pfx_vma_modify_flags+0x10/0x10 [ 980.653660][T16658] mlock_fixup+0x22a/0x360 [ 980.653689][T16658] apply_mlockall_flags+0x2f0/0x3c0 [ 980.653716][T16658] ? __pfx_apply_mlockall_flags+0x10/0x10 [ 980.653747][T16658] ? __pfx_down_write_killable+0x10/0x10 [ 980.653774][T16658] ? ksys_write+0x1f0/0x250 [ 980.653795][T16658] ? rcu_is_watching+0x15/0xb0 [ 980.653836][T16658] __ia32_sys_munlockall+0x10a/0x220 [ 980.653865][T16658] do_syscall_64+0xf6/0x210 [ 980.653892][T16658] ? clear_bhb_loop+0x45/0xa0 [ 980.653917][T16658] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 980.653937][T16658] RIP: 0033:0x7fa714d8e969 [ 980.653955][T16658] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 980.653972][T16658] RSP: 002b:00007fa715c85038 EFLAGS: 00000246 ORIG_RAX: 0000000000000098 [ 980.653995][T16658] RAX: ffffffffffffffda RBX: 00007fa714fb6080 RCX: 00007fa714d8e969 [ 980.654010][T16658] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 980.654023][T16658] RBP: 00007fa715c85090 R08: 0000000000000000 R09: 0000000000000000 [ 980.654035][T16658] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 980.654046][T16658] R13: 0000000000000001 R14: 00007fa714fb6080 R15: 00007fa7150dfa28 [ 980.654083][T16658] [ 980.655351][T16658] vmg ffffc900037e7c40 dumped because: VM_WARN_ON_VMG(prev && start <= prev->vm_start) [ 980.674523][ T5832] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 980.955293][T16658] vmg ffffc900037e7c40 state: mm ffff88806b4c5000 pgoff 2c9ab [ 980.955293][T16658] vmi ffffc900037e7de0 [200000000000,200000800000) [ 980.955293][T16658] prev ffff88806defb640 middle ffff88806defb640 next 0000000000000000 target 0000000000000000 [ 980.955293][T16658] start 200000000000 end 200000800000 flags 480000ff [ 980.955293][T16658] file ffff88802f1d4a80 anon_vma 0000000000000000 policy 0000000000000000 [ 980.955293][T16658] uffd_ctx 0000000000000000 [ 980.955293][T16658] anon_name 0000000000000000 [ 980.955293][T16658] state 0 [ 980.955293][T16658] just_expand 0 [ 980.955293][T16658] __adjust_middle_start 0 __adjust_next_start 0 [ 980.955293][T16658] __remove_middle 0 __remove_next 0 [ 981.026335][T16658] vmg ffffc900037e7c40 mm: [ 981.031309][T16658] mm ffff88806b4c5000 task_size 140737488351232 [ 981.031309][T16658] mmap_base 140355601887232 mmap_legacy_base 47277193281536 [ 981.031309][T16658] pgd ffff888033ecc000 mm_users 3 mm_count 1 pgtables_bytes 126976 map_count 37 [ 981.031309][T16658] hiwater_rss 160e hiwater_vm 5fad total_vm 5fce locked_vm 800 [ 981.031309][T16658] pinned_vm 0 data_vm 18a4 exec_vm 1a4 stack_vm 21 [ 981.031309][T16658] start_code 7fa714c49000 end_code 7fa714deadd9 start_data 7fa714f90000 end_data 7fa714f90000 [ 981.031309][T16658] start_brk 555573d9b000 brk 555573dcf000 start_stack 7ffe831bbdd0 [ 981.031309][T16658] arg_start 7ffe831bcf6d arg_end 7ffe831bcf81 env_start 7ffe831bcf81 env_end 7ffe831bcfe9 [ 981.031309][T16658] binfmt ffffffff8e0b19c0 flags 800007fd [ 981.031309][T16658] ioctx_table 0000000000000000 [ 981.031309][T16658] owner ffff88806c898000 exe_file ffff888032680e00 [ 981.031309][T16658] notifier_subscriptions 0000000000000000 [ 981.031309][T16658] numa_next_scan 4295035265 numa_scan_offset 0 numa_scan_seq 0 [ 981.031309][T16658] tlb_flush_pending 0 [ 981.031309][T16658] def_flags: 0x0() [ 981.133025][T16658] vmg ffffc900037e7c40 prev: [ 981.139108][T16658] vma ffff88806defb640 start 0000200000000000 end 0000200000800000 mm ffff88806b4c5000 [ 981.139108][T16658] prot 25 anon_vma 0000000000000000 vm_ops ffffffff8b740540 [ 981.139108][T16658] pgoff 2c9ab file ffff88802f1d4a80 private_data 0000000000000000 [ 981.139108][T16658] refcnt 1 [ 981.139108][T16658] flags: 0x480020ff(read|write|exec|shared|mayread|maywrite|mayexec|mayshare|locked|softdirty|nohugepage) [ 981.180296][T16661] FAULT_INJECTION: forcing a failure. [ 981.180296][T16661] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 981.212621][ T5832] cp210x 3-1:0.65: device disconnected [ 981.224972][T16661] CPU: 1 UID: 0 PID: 16661 Comm: syz.0.3225 Not tainted 6.15.0-rc5-syzkaller-00158-g3013c33dcbd9 #0 PREEMPT(full) [ 981.225001][T16661] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 981.225014][T16661] Call Trace: [ 981.225022][T16661] [ 981.225031][T16661] dump_stack_lvl+0x189/0x250 [ 981.225063][T16661] ? __lock_acquire+0xaac/0xd20 [ 981.225094][T16661] ? __pfx_dump_stack_lvl+0x10/0x10 [ 981.225123][T16661] ? __pfx__printk+0x10/0x10 [ 981.225145][T16661] ? __might_fault+0xb0/0x130 [ 981.225181][T16661] should_fail_ex+0x414/0x560 [ 981.225219][T16661] _copy_from_iter+0x1db/0x15a0 [ 981.225253][T16661] ? __lock_acquire+0xaac/0xd20 [ 981.225280][T16661] ? __pfx__copy_from_iter+0x10/0x10 [ 981.225315][T16661] ? page_copy_sane+0x4e/0x280 [ 981.225341][T16661] copy_page_from_iter+0x7b/0x100 [ 981.225369][T16661] tun_get_user+0x1b13/0x3c20 [ 981.225402][T16661] ? tun_get_user+0x687/0x3c20 [ 981.225445][T16661] ? __pfx_tun_get_user+0x10/0x10 [ 981.225471][T16661] ? aa_file_perm+0x11f/0xed0 [ 981.225495][T16661] ? aa_file_perm+0x3e7/0xed0 [ 981.225530][T16661] ? ref_tracker_alloc+0x318/0x460 [ 981.225554][T16661] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 981.225580][T16661] ? tun_get+0x1c/0x2f0 [ 981.225613][T16661] ? tun_get+0x1c/0x2f0 [ 981.225640][T16661] ? tun_get+0x1c/0x2f0 [ 981.225672][T16661] tun_chr_write_iter+0x113/0x200 [ 981.225704][T16661] vfs_write+0x548/0xa90 [ 981.225733][T16661] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 981.225762][T16661] ? __pfx_vfs_write+0x10/0x10 [ 981.225794][T16661] ? __fget_files+0x2a/0x420 [ 981.225829][T16661] ksys_write+0x145/0x250 [ 981.225851][T16661] ? rcu_is_watching+0x15/0xb0 [ 981.225884][T16661] ? __pfx_ksys_write+0x10/0x10 [ 981.225910][T16661] ? do_syscall_64+0xba/0x210 [ 981.225948][T16661] do_syscall_64+0xf6/0x210 [ 981.225973][T16661] ? clear_bhb_loop+0x45/0xa0 [ 981.226003][T16661] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 981.226023][T16661] RIP: 0033:0x7fdab658d41f [ 981.226043][T16661] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 981.226061][T16661] RSP: 002b:00007fdab7335000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 981.226083][T16661] RAX: ffffffffffffffda RBX: 00007fdab67b5fa0 RCX: 00007fdab658d41f [ 981.226099][T16661] RDX: 0000000000000076 RSI: 0000200000000640 RDI: 00000000000000c8 [ 981.226112][T16661] RBP: 00007fdab7335090 R08: 0000000000000000 R09: 0000000000000000 [ 981.226126][T16661] R10: 0000000000000076 R11: 0000000000000293 R12: 0000000000000001 [ 981.226139][T16661] R13: 0000000000000000 R14: 00007fdab67b5fa0 R15: 00007fdab68dfa28 [ 981.226171][T16661] [ 981.247736][T16658] vmg ffffc900037e7c40 middle: [ 981.559194][T16658] vma ffff88806defb640 start 0000200000000000 end 0000200000800000 mm ffff88806b4c5000 [ 981.559194][T16658] prot 25 anon_vma 0000000000000000 vm_ops ffffffff8b740540 [ 981.559194][T16658] pgoff 2c9ab file ffff88802f1d4a80 private_data 0000000000000000 [ 981.559194][T16658] refcnt 1 [ 981.559194][T16658] flags: 0x480020ff(read|write|exec|shared|mayread|maywrite|mayexec|mayshare|locked|softdirty|nohugepage) [ 981.604386][T16658] vmg ffffc900037e7c40 next: (NULL) [ 981.611497][T16658] vmg ffffc900037e7c40 vmi: [ 981.616824][T16658] MAS: tree=ffff88806b4c5040 enode=ffff88802c5d120c [ 981.616869][T16658] (ma_active) [ 981.635094][ T5890] usb 4-1: USB disconnect, device number 27 [ 981.687464][T16658] Store Type: [ 981.687485][T16658] node_store [ 981.716800][T16658] [6/11] index=200000000000 last=2000007fffff [ 981.734763][T16658] min=0 max=555573dbcfff alloc=0000000000000000, depth=1, flags=0 [ 981.745240][T16658] maple_tree(ffff88806b4c5040) flags 30B, height 2 root ffff88802c5d081e [ 981.758385][T16658] 0-ffffffffffffffff: node ffff88802c5d0800 depth 0 type 3 parent ffff88806b4c5041 contents: 355572d9a000 2a519ee28000 a000 ffff80017ce43000 0 0 0 0 0 0 | 03 03| ffff88802c5d120c 555573DBCFFF ffff88806760a40c 7FA714BFFFFF ffff88802c5d140c 7FA715AEDFFF ffff88802c5d040c FFFFFFFFFFFFFFFF 0000000000000000 0 0000000000000000 0 0000000000000000 0 0000000000000000 0 0000000000000000 0 0000000000000000 [ 981.868728][T16658] 0-555573dbcfff: node ffff88802c5d1200 depth 1 type 1 parent ffff88802c5d0806 contents: 0000000000000000 110C22FFFF ffff88805900d3c0 110E22FFFF 0000000000000000 1B3341FFFF ffff88805900d140 1B3345FFFF 0000000000000000 1FFFFFFFEFFF ffff88805900d000 1FFFFFFFFFFF ffff88806defb640 2000007FFFFF ffff88806defb140 200000B35FFF ffff88806defb8c0 200000FFFFFF ffff88805900d640 200001000FFF 0000000000000000 555573D9AFFF ffff88805900fc80 555573DBCFFF 0000000000000000 0 0000000000000000 0 0000000000000000 0 000000000000000b [ 981.957519][T16658] 0-110c22ffff: 0000000000000000 [ 981.965946][T16658] 110c230000-110e22ffff: ffff88805900d3c0 [ 981.976038][T16658] 110e230000-1b3341ffff: 0000000000000000 [ 982.032502][T16658] 1b33420000-1b3345ffff: ffff88805900d140 [ 982.069024][T16658] 1b33460000-1fffffffefff: 0000000000000000 [ 982.075616][T16658] 1ffffffff000-1fffffffffff: ffff88805900d000 [ 982.092888][T16668] fuse: Unknown parameter '-E߂QAl"H7L' [ 982.129938][T16658] 200000000000-2000007fffff: ffff88806defb640 [ 982.136454][T16658] 200000800000-200000b35fff: ffff88806defb140 [ 982.196969][T16658] 200000b36000-200000ffffff: ffff88806defb8c0 [ 982.216807][T16673] xt_TPROXY: Can be used only with -p tcp or -p udp [ 982.239591][T16658] 200001000000-200001000fff: ffff88805900d640 [ 982.246144][T16658] 200001001000-555573d9afff: 0000000000000000 [ 982.270489][T16658] 555573d9b000-555573dbcfff: ffff88805900fc80 [ 982.283447][T16673] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 982.307248][T16658] 555573dbd000-7fa714bfffff: node ffff88806760a400 depth 1 type 1 parent ffff88802c5d080e contents: ffff88805900f140 555573DCEFFF 0000000000000000 7FA712BF6FFF ffff88805900fdc0 7FA712BF7FFF ffff88805900fa00 7FA7133F7FFF ffff88805900f8c0 7FA7133F8FFF ffff88805900f640 7FA713BF8FFF ffff88806f4de780 7FA713BFAFFF ffff88806f4de640 7FA713FFAFFF ffff88806f4de3c0 7FA713FFCFFF ffff88806f4de140 7FA7143FCFFF ffff88806f4de8c0 7FA7143FEFFF ffff88801ff58280 7FA7147FEFFF ffff88801ff58140 7FA7147FFFFF ffff888027b06780 7FA714BFFFFF 0000000000000000 0 000000000000000d [ 982.375338][T16658] 555573dbd000-555573dcefff: ffff88805900f140 [ 982.382020][T16658] 555573dcf000-7fa712bf6fff: 0000000000000000 [ 982.392303][T16658] 7fa712bf7000-7fa712bf7fff: ffff88805900fdc0 [ 982.399075][T16658] 7fa712bf8000-7fa7133f7fff: ffff88805900fa00 [ 982.405546][T16658] 7fa7133f8000-7fa7133f8fff: ffff88805900f8c0 [ 982.416907][T16658] 7fa7133f9000-7fa713bf8fff: ffff88805900f640 [ 982.456700][T16658] 7fa713bf9000-7fa713bfafff: ffff88806f4de780 [ 982.470309][T16658] 7fa713bfb000-7fa713ffafff: ffff88806f4de640 [ 982.481886][T16658] 7fa713ffb000-7fa713ffcfff: ffff88806f4de3c0 [ 982.489216][T16658] 7fa713ffd000-7fa7143fcfff: ffff88806f4de140 [ 982.495734][T16658] 7fa7143fd000-7fa7143fefff: ffff88806f4de8c0 [ 982.556189][T16658] 7fa7143ff000-7fa7147fefff: ffff88801ff58280 [ 982.569057][T16658] 7fa7147ff000-7fa7147fffff: ffff88801ff58140 [ 982.612328][T16658] 7fa714800000-7fa714bfffff: ffff888027b06780 [ 982.627395][T16658] 7fa714c00000-7fa715aedfff: node ffff88802c5d1400 depth 1 type 1 parent ffff88802c5d0816 contents: ffff888027b06280 7FA714C48FFF ffff888027b063c0 7FA714DEAFFF ffff888027b06640 7FA714E97FFF ffff888027b06c80 7FA714F7CFFF ffff888027b06500 7FA714F85FFF 0000000000000000 7FA714F8FFFF ffff888027b06000 7FA714FDFFFF ffff888027b06dc0 7FA714FE0FFF ffff888027b068c0 7FA715AEDFFF 0000000000000000 0 0000000000000000 0 0000000000000000 0 0000000000000000 0 0000000000000000 0 0000000000000000 0 0000000000000008 [ 982.673477][ C1] vkms_vblank_simulate: vblank timer overrun [ 982.718414][T16658] 7fa714c00000-7fa714c48fff: ffff888027b06280 [ 982.793617][T16658] 7fa714c49000-7fa714deafff: ffff888027b063c0 [ 982.829886][T16658] 7fa714deb000-7fa714e97fff: ffff888027b06640 [ 982.870660][T16658] 7fa714e98000-7fa714f7cfff: ffff888027b06c80 [ 982.897964][T16658] 7fa714f7d000-7fa714f85fff: ffff888027b06500 [ 982.924935][T16658] 7fa714f86000-7fa714f8ffff: 0000000000000000 [ 982.960120][T16685] process 'syz.2.3235' launched './file2' with NULL argv: empty string added [ 982.984678][T16658] 7fa714f90000-7fa714fdffff: ffff888027b06000 [ 983.019177][T16658] 7fa714fe0000-7fa714fe0fff: ffff888027b06dc0 [ 983.063832][T16658] 7fa714fe1000-7fa715aedfff: ffff888027b068c0 [ 983.126661][T16658] 7fa715aee000-ffffffffffffffff: node ffff88802c5d0400 depth 1 type 1 parent ffff88802c5d081e contents: 0000000000000000 7FA715C64FFF ffff88806defb000 7FA715C65FFF ffff8880673af140 7FA715C85FFF ffff88806defba00 7FA715C86FFF ffff8880673af500 7FA715CA6FFF ffff888027b06b40 7FA715CAAFFF ffff888070b2fdc0 7FA715CACFFF ffff8880673afdc0 7FA715CAEFFF 0000000000000000 7FFE8319BFFF ffff8880673afc80 7FFE831BCFFF 0000000000000000 FFFFFFFFFFFFFFFF 0000000000000000 0 0000000000000000 0 0000000000000000 0 0000000000000000 0 000000000000000a [ 983.187997][ C1] vkms_vblank_simulate: vblank timer overrun [ 983.228299][T16658] 7fa715aee000-7fa715c64fff: 0000000000000000 [ 983.287990][T16658] 7fa715c65000-7fa715c65fff: ffff88806defb000 [ 983.295085][ T53] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 983.308717][T16658] 7fa715c66000-7fa715c85fff: ffff8880673af140 [ 983.316585][T16658] 7fa715c86000-7fa715c86fff: ffff88806defba00 [ 983.344073][T16658] 7fa715c87000-7fa715ca6fff: ffff8880673af500 [ 983.365802][T16658] 7fa715ca7000-7fa715caafff: ffff888027b06b40 [ 983.414206][T16658] 7fa715cab000-7fa715cacfff: ffff888070b2fdc0 [ 983.432134][T16658] 7fa715cad000-7fa715caefff: ffff8880673afdc0 [ 983.441282][ T53] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 983.476423][T16658] 7fa715caf000-7ffe8319bfff: 0000000000000000 [ 983.494750][T16658] 7ffe8319c000-7ffe831bcfff: ffff8880673afc80 [ 983.505623][T16658] 7ffe831bd000-ffffffffffffffff: 0000000000000000 [ 983.512856][T16658] ------------[ cut here ]------------ [ 983.518575][T16658] WARNING: CPU: 1 PID: 16658 at mm/vma.c:768 vma_merge_existing_range+0x1257/0x15b0 [ 983.528155][T16658] Modules linked in: [ 983.532839][T16658] CPU: 1 UID: 0 PID: 16658 Comm: syz.1.3223 Not tainted 6.15.0-rc5-syzkaller-00158-g3013c33dcbd9 #0 PREEMPT(full) [ 983.545048][T16658] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 983.555213][T16658] RIP: 0010:vma_merge_existing_range+0x1257/0x15b0 [ 983.562085][T16658] Code: 0b 90 e9 52 f0 ff ff e8 d7 dd ab ff 90 0f 0b 90 e9 87 ef ff ff e8 c9 dd ab ff 48 89 df 48 c7 c6 a0 62 76 8b e8 ea ff f2 ff 90 <0f> 0b 90 e9 ff ef ff ff e8 ac dd ab ff e9 04 f1 ff ff e8 a2 dd ab [ 983.581760][ C1] vkms_vblank_simulate: vblank timer overrun [ 983.588423][T16658] RSP: 0018:ffffc900037e7af8 EFLAGS: 00010286 [ 983.594545][T16658] RAX: ffffffff8b4eb5fd RBX: ffffc900037e7c40 RCX: ffff88801dbeda00 [ 983.602682][T16658] RDX: 0000000000000000 RSI: ffffffffffffffff RDI: ffffffffffffffff [ 983.610778][T16658] RBP: 0000200000800000 R08: 0000000000000003 R09: 0000000000000004 [ 983.619302][T16658] R10: dffffc0000000000 R11: fffffbfff1bba4b4 R12: ffff88806defb640 [ 983.627390][T16658] R13: 1ffff920006fcf8c R14: 0000200000000000 R15: 0000200000000000 [ 983.635439][T16658] FS: 00007fa715c856c0(0000) GS:ffff8881261cc000(0000) knlGS:0000000000000000 [ 983.644518][T16658] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 983.651595][T16658] CR2: 000000110c298395 CR3: 0000000033ecc000 CR4: 00000000003526f0 [ 983.659929][T16658] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 983.668631][T16658] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 983.676658][T16658] Call Trace: [ 983.680272][T16658] [ 983.683265][T16658] vma_modify+0x76/0x460 [ 983.687683][T16658] vma_modify_flags+0x1e8/0x230 [ 983.692586][T16658] ? __pfx_vma_modify_flags+0x10/0x10 [ 983.698241][T16658] mlock_fixup+0x22a/0x360 [ 983.702970][T16658] apply_mlockall_flags+0x2f0/0x3c0 [ 983.708267][T16658] ? __pfx_apply_mlockall_flags+0x10/0x10 [ 983.714078][T16658] ? __pfx_down_write_killable+0x10/0x10 [ 983.719823][T16658] ? ksys_write+0x1f0/0x250 SYZFAIL: failed to send rpc fd=3 want=56 sent=0 n=-1 (errno 32: Broken pipe) [ 983.724383][T16658] ? rcu_is_watching+0x15/0xb0 [ 983.729329][T16658] __ia32_sys_munlockall+0x10a/0x220 [ 983.734669][T16658] do_syscall_64+0xf6/0x210 [ 983.739287][T16658] ? clear_bhb_loop+0x45/0xa0 [ 983.744013][T16658] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 983.750390][T16658] RIP: 0033:0x7fa714d8e969 [ 983.754856][T16658] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 983.774827][T16658] RSP: 002b:00007fa715c85038 EFLAGS: 00000246 ORIG_RAX: 0000000000000098 [ 983.783720][T16658] RAX: ffffffffffffffda RBX: 00007fa714fb6080 RCX: 00007fa714d8e969 [ 983.792564][T16658] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 983.800644][T16658] RBP: 00007fa715c85090 R08: 0000000000000000 R09: 0000000000000000 [ 983.808726][T16658] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 983.816779][T16658] R13: 0000000000000001 R14: 00007fa714fb6080 R15: 00007fa7150dfa28 [ 983.824898][T16658] [ 983.828029][T16658] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 983.835373][T16658] CPU: 1 UID: 0 PID: 16658 Comm: syz.1.3223 Not tainted 6.15.0-rc5-syzkaller-00158-g3013c33dcbd9 #0 PREEMPT(full) [ 983.847468][T16658] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 983.857554][T16658] Call Trace: [ 983.860844][T16658] [ 983.863782][T16658] dump_stack_lvl+0x99/0x250 [ 983.868500][T16658] ? __asan_memcpy+0x40/0x70 [ 983.873202][T16658] ? __pfx_dump_stack_lvl+0x10/0x10 [ 983.878419][T16658] ? __pfx__printk+0x10/0x10 [ 983.883037][T16658] panic+0x2db/0x790 [ 983.886953][T16658] ? __pfx_panic+0x10/0x10 [ 983.891425][T16658] __warn+0x31b/0x4b0 [ 983.895426][T16658] ? vma_merge_existing_range+0x1257/0x15b0 [ 983.901341][T16658] ? vma_merge_existing_range+0x1257/0x15b0 [ 983.907251][T16658] report_bug+0x2be/0x4f0 [ 983.911598][T16658] ? vma_merge_existing_range+0x1257/0x15b0 [ 983.917508][T16658] ? vma_merge_existing_range+0x1257/0x15b0 [ 983.923415][T16658] ? vma_merge_existing_range+0x1259/0x15b0 [ 983.929325][T16658] handle_bug+0x84/0x160 [ 983.933584][T16658] exc_invalid_op+0x1a/0x50 [ 983.938101][T16658] asm_exc_invalid_op+0x1a/0x20 [ 983.942961][T16658] RIP: 0010:vma_merge_existing_range+0x1257/0x15b0 [ 983.949482][T16658] Code: 0b 90 e9 52 f0 ff ff e8 d7 dd ab ff 90 0f 0b 90 e9 87 ef ff ff e8 c9 dd ab ff 48 89 df 48 c7 c6 a0 62 76 8b e8 ea ff f2 ff 90 <0f> 0b 90 e9 ff ef ff ff e8 ac dd ab ff e9 04 f1 ff ff e8 a2 dd ab [ 983.969099][T16658] RSP: 0018:ffffc900037e7af8 EFLAGS: 00010286 [ 983.975196][T16658] RAX: ffffffff8b4eb5fd RBX: ffffc900037e7c40 RCX: ffff88801dbeda00 [ 983.983184][T16658] RDX: 0000000000000000 RSI: ffffffffffffffff RDI: ffffffffffffffff [ 983.991165][T16658] RBP: 0000200000800000 R08: 0000000000000003 R09: 0000000000000004 [ 983.999148][T16658] R10: dffffc0000000000 R11: fffffbfff1bba4b4 R12: ffff88806defb640 [ 984.007129][T16658] R13: 1ffff920006fcf8c R14: 0000200000000000 R15: 0000200000000000 [ 984.015486][T16658] ? mt_dump_node+0x18cd/0x26b0 [ 984.020382][T16658] ? vma_merge_existing_range+0x1256/0x15b0 [ 984.026320][T16658] vma_modify+0x76/0x460 [ 984.030583][T16658] vma_modify_flags+0x1e8/0x230 [ 984.035451][T16658] ? __pfx_vma_modify_flags+0x10/0x10 [ 984.040856][T16658] mlock_fixup+0x22a/0x360 [ 984.045291][T16658] apply_mlockall_flags+0x2f0/0x3c0 [ 984.050506][T16658] ? __pfx_apply_mlockall_flags+0x10/0x10 [ 984.056243][T16658] ? __pfx_down_write_killable+0x10/0x10 [ 984.061894][T16658] ? ksys_write+0x1f0/0x250 [ 984.066426][T16658] ? rcu_is_watching+0x15/0xb0 [ 984.071215][T16658] __ia32_sys_munlockall+0x10a/0x220 [ 984.076529][T16658] do_syscall_64+0xf6/0x210 [ 984.081081][T16658] ? clear_bhb_loop+0x45/0xa0 [ 984.085785][T16658] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 984.091690][T16658] RIP: 0033:0x7fa714d8e969 [ 984.096116][T16658] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 984.115835][T16658] RSP: 002b:00007fa715c85038 EFLAGS: 00000246 ORIG_RAX: 0000000000000098 [ 984.124270][T16658] RAX: ffffffffffffffda RBX: 00007fa714fb6080 RCX: 00007fa714d8e969 [ 984.132263][T16658] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 984.140267][T16658] RBP: 00007fa715c85090 R08: 0000000000000000 R09: 0000000000000000 [ 984.148250][T16658] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 984.156231][T16658] R13: 0000000000000001 R14: 00007fa714fb6080 R15: 00007fa7150dfa28 [ 984.164225][T16658] [ 984.167405][T16658] Kernel Offset: disabled [ 984.171739][T16658] Rebooting in 86400 seconds..