last executing test programs: 12m54.698625615s ago: executing program 1 (id=183): openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) r1 = gettid() timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000000040)) write(r0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, 0x0) 12m51.146968175s ago: executing program 1 (id=187): ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'wlan0\x00'}) syz_clone(0x4100000, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) r0 = socket$netlink(0x10, 0x3, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000300), 0x4) mq_notify(0xffffffffffffffff, 0x0) timer_settime(0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, 0x0, &(0x7f0000000340)) socketpair$unix(0x1, 0x5, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/mapper/control\x00', 0x2, 0x0) openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) ioctl(r1, 0xc138fd03, &(0x7f0000000000)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000006d79706f6f6c") write(r1, &(0x7f0000000138)="0000000000000000008000000000000000000000000000007468696e2d706f6f6c00000000000000373a3020373a31203132382030", 0xfffffffffffffd9a) ioctl(r1, 0xc138fd09, &(0x7f0000000000)="0400000000000000000000006e01000038010000010000000000000000000000000000000000000000000000000000006d79706f") 12m48.665635739s ago: executing program 1 (id=192): socket(0x40000000015, 0x5, 0x0) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x11) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000100)={0x0, 'veth0_to_batadv\x00', {0x1}, 0x2a}) socket$inet6_sctp(0xa, 0x801, 0x84) r4 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, 0x0, 0x0) sendmsg$kcm(r4, &(0x7f00000001c0)={&(0x7f0000000100)=@phonet={0x23, 0x0, 0x3, 0x4}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000180)="27050200420014000300", 0xa}, {&(0x7f0000000040)='\x00\x00\x00\x00\x00\x00', 0x6}], 0x2}, 0x0) setxattr$security_capability(0x0, 0x0, 0x0, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, 0x15, 0x301, 0x0, 0x0, {0xb}}, 0x14}}, 0x0) ioctl$UI_DEV_CREATE(r0, 0x5501) syz_emit_ethernet(0x0, 0x0, 0x0) 12m46.057770216s ago: executing program 1 (id=195): openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) r1 = gettid() timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000000040)) write(r0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, 0x0) 12m43.509379451s ago: executing program 1 (id=197): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r0, &(0x7f00000000c0)={0x1d, r1}, 0x10) syz_open_dev$media(&(0x7f0000000040), 0x7fdffffe, 0x0) r2 = io_uring_setup(0x2f04, &(0x7f000000c480)={0x0, 0xe8e2, 0x800, 0x20001, 0x2d7}) write$FUSE_WRITE(0xffffffffffffffff, &(0x7f00000000c0)={0x18, 0x0, 0x0, {0x8010}}, 0xffffff20) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x1e, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x18, 0x7, &(0x7f0000000300)=@framed={{}, [@jmp={0x5, 0x0, 0xe, 0x0, 0x0, 0x3}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xffffffffffffffff, 0x10}, @ldst={0x2, 0x3, 0x3, 0xa, 0x0, 0xffffffffffffffc0, 0x10}]}, &(0x7f0000000140)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r3 = getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r5 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r5, 0x1, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) r7 = fsopen(&(0x7f0000000100)='nfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f0000000140)='source\x00', &(0x7f0000000180)='127.0.0.1:/export\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f00000001c0)='addr\x00', &(0x7f0000000200)='127.0.0.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f00000002c0)='vers\x00', &(0x7f0000000300)='4\x00', 0x0) ioctl$NILFS_IOCTL_GET_SUSTAT(r2, 0x80306e85, &(0x7f0000000080)) sendmsg$can_bcm(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="010000004c0800000600000000000000", @ANYRES64=0x0, @ANYRES64=r3, @ANYRES64=0x0], 0x80}, 0x1, 0x0, 0x0, 0x8004}, 0x0) 12m41.927327731s ago: executing program 1 (id=199): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r0, &(0x7f00000000c0)={0x1d, r1}, 0x10) r2 = syz_open_dev$media(&(0x7f0000000040), 0x7fdffffe, 0x0) r3 = io_uring_setup(0x2f04, &(0x7f000000c480)={0x0, 0xe8e2, 0x800, 0x20001, 0x2d7}) write$FUSE_WRITE(0xffffffffffffffff, &(0x7f00000000c0)={0x18, 0x0, 0x0, {0x8010}}, 0xffffff20) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x1e, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x18, 0x7, &(0x7f0000000300)=@framed={{}, [@jmp={0x5, 0x0, 0xe, 0x0, 0x0, 0x3}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xffffffffffffffff, 0x10}, @ldst={0x2, 0x3, 0x3, 0xa, 0x0, 0xffffffffffffffc0, 0x10}]}, &(0x7f0000000140)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r4 = getpgrp(0x0) sched_setaffinity(r4, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r6 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r6, 0x1, 0x0) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) r8 = fsopen(&(0x7f0000000100)='nfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r8, 0x1, &(0x7f0000000140)='source\x00', &(0x7f0000000180)='127.0.0.1:/export\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r8, 0x1, &(0x7f00000001c0)='addr\x00', &(0x7f0000000200)='127.0.0.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r8, 0x1, &(0x7f00000002c0)='vers\x00', &(0x7f0000000300)='4\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r8, 0x6, 0x0, 0x0, 0x0) ioctl$FS_IOC_GETVERSION(r2, 0x80087601, 0x0) ioctl$NILFS_IOCTL_GET_SUSTAT(r3, 0x80306e85, &(0x7f0000000080)) sendmsg$can_bcm(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x80}, 0x1, 0x0, 0x0, 0x8004}, 0x0) 12m26.255937912s ago: executing program 32 (id=199): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r0, &(0x7f00000000c0)={0x1d, r1}, 0x10) r2 = syz_open_dev$media(&(0x7f0000000040), 0x7fdffffe, 0x0) r3 = io_uring_setup(0x2f04, &(0x7f000000c480)={0x0, 0xe8e2, 0x800, 0x20001, 0x2d7}) write$FUSE_WRITE(0xffffffffffffffff, &(0x7f00000000c0)={0x18, 0x0, 0x0, {0x8010}}, 0xffffff20) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x1e, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x18, 0x7, &(0x7f0000000300)=@framed={{}, [@jmp={0x5, 0x0, 0xe, 0x0, 0x0, 0x3}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xffffffffffffffff, 0x10}, @ldst={0x2, 0x3, 0x3, 0xa, 0x0, 0xffffffffffffffc0, 0x10}]}, &(0x7f0000000140)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r4 = getpgrp(0x0) sched_setaffinity(r4, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r6 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r6, 0x1, 0x0) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) r8 = fsopen(&(0x7f0000000100)='nfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r8, 0x1, &(0x7f0000000140)='source\x00', &(0x7f0000000180)='127.0.0.1:/export\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r8, 0x1, &(0x7f00000001c0)='addr\x00', &(0x7f0000000200)='127.0.0.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r8, 0x1, &(0x7f00000002c0)='vers\x00', &(0x7f0000000300)='4\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r8, 0x6, 0x0, 0x0, 0x0) ioctl$FS_IOC_GETVERSION(r2, 0x80087601, 0x0) ioctl$NILFS_IOCTL_GET_SUSTAT(r3, 0x80306e85, &(0x7f0000000080)) sendmsg$can_bcm(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x80}, 0x1, 0x0, 0x0, 0x8004}, 0x0) 11m50.679169282s ago: executing program 4 (id=219): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8801}, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) io_submit(0x0, 0x0, &(0x7f0000001140)) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)=ANY=[@ANYBLOB="88020000", @ANYRES16=r1, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r2, @ANYBLOB="6102330050300100080211000001080211000000505050505050"], 0x288}, 0x1, 0x0, 0x0, 0x800}, 0x0) 11m50.135936526s ago: executing program 4 (id=266): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = syz_open_dev$cec(&(0x7f0000000200), 0xffffffffffffffff, 0x4ae60) openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) signalfd4(0xffffffffffffffff, &(0x7f00000000c0)={[0x5]}, 0x8, 0x0) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0xb04, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r9 = syz_open_dev$mtd(&(0x7f0000000000), 0x6b4, 0x2000) ioctl$MEMGETBADBLOCK(r9, 0x40084d0b, &(0x7f0000000440)=0x2) syz_ublk_setup_queues(0xffffffffffffffff, r8, &(0x7f0000000180)={0x0, 0xae0c, 0x800, 0x1, 0x253}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x2100, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1000, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x0, 0x1f0, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) ioctl$CEC_ADAP_S_LOG_ADDRS(r2, 0xc05c6104, &(0x7f0000000040)={'\be \x00', 0x0, 0x5, 0x2, 0x0, 0xc, "00000000020000000000002100", '\x00', "0052008f", '\x00', ["fdfeffbf84a438dfc5d5c010", "0000000000000400", "0000efffffffffffbfff00", "000003cefd70f14003556000"]}) mkdir(&(0x7f0000000040)='./myproc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./myproc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r10 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./myproc/scsi/device_info\x00', 0x40000, 0x0) read$FUSE(r10, &(0x7f0000000300)={0x2020}, 0x2020) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) 11m46.511096599s ago: executing program 4 (id=269): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, &(0x7f00000001c0)='\\', 0x1) ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(0xffffffffffffffff, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0) 11m46.103086029s ago: executing program 4 (id=272): r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='file0\x00', 0x42, 0x1ff) ftruncate(r0, 0xf4240) close(r0) mkdir(0x0, 0x1ff) mkdir(&(0x7f0000000180)='./config\x00', 0x1ff) mount(&(0x7f0000000000), &(0x7f00000001c0)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000240)='./config/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdir(&(0x7f00000002c0)='./config/usb_gadget/g1/functions/mass_storage.0\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/mass_storage.0/lun.0/cdrom\x00', 0x2, 0x0) write(r1, &(0x7f0000000340)='1', 0x1) r2 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r2, &(0x7f00000003c0)='file0', 0x5) close(r2) symlink(&(0x7f0000000400)='./config/usb_gadget/g1/functions/mass_storage.0\x00', &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/mass_storage.0\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) close(r3) nanosleep(&(0x7f0000000500)={0x0, 0x1dcd6500}, 0x0) r4 = syz_open_dev$sg(&(0x7f0000000540), 0x0, 0x0) ioctl$SG_IO(r4, 0x2285, &(0x7f0000000580)={0x53, 0xfffffffd, 0x0, 0x10, @buffer={0x0, 0x0, &(0x7f0000000600)}, &(0x7f0000000640), &(0x7f0000000680), 0x4e20, 0x0, 0x0, &(0x7f00000006c0)}) close(r4) 11m42.620375238s ago: executing program 4 (id=274): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8801}, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) io_submit(0x0, 0x0, &(0x7f0000001140)) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)=ANY=[@ANYBLOB="88020000", @ANYRES16=r1, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r2, @ANYBLOB="6102330050300100080211000001080211000000505050505050"], 0x288}, 0x1, 0x0, 0x0, 0x800}, 0x0) 11m42.082729222s ago: executing program 4 (id=276): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="180000000200"/15], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000580)={'veth0_to_team\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000003fae0c60700000000040017c00000400fc000c0001803e0006000000", @ANYRES32=0x0, @ANYBLOB="0c000280050023000000000008000700", @ANYRES32=r3, @ANYBLOB], 0x38}, 0x1, 0x0, 0x0, 0xc000}, 0x4040) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r4, &(0x7f0000032680)=""/102392, 0x18ff8) r5 = add_key(&(0x7f00000001c0)='big_key\x00', &(0x7f0000000200)={'syz', 0x1}, &(0x7f0000002240)="d7", 0x1, 0xfffffffffffffffe) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r5, r6, 0x26) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000004c0)={r0, r2, 0x25, 0x0, @void}, 0x10) r8 = socket(0x10, 0x803, 0x0) socket(0x2, 0xa, 0x300) ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f0000000140)={'veth0_to_team\x00', &(0x7f0000000280)=@ethtool_channels={0x3d, 0x0, 0x0, 0x0, 0x4, 0x2, 0x1}}) unshare(0x62040200) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r7, 0x40a85323, &(0x7f0000000300)={{0xb, 0x2}, 'port0\x00', 0x45, 0x4, 0x6, 0x8, 0x80, 0x8, 0x8, 0x0, 0x1, 0x3}) ioctl$sock_inet_SIOCSIFFLAGS(r8, 0x8914, &(0x7f0000000040)={'veth0_to_team\x00', 0x800}) fcntl$setpipe(r0, 0x407, 0xf9) 11m25.294305641s ago: executing program 33 (id=276): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="180000000200"/15], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000580)={'veth0_to_team\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000003fae0c60700000000040017c00000400fc000c0001803e0006000000", @ANYRES32=0x0, @ANYBLOB="0c000280050023000000000008000700", @ANYRES32=r3, @ANYBLOB], 0x38}, 0x1, 0x0, 0x0, 0xc000}, 0x4040) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r4, &(0x7f0000032680)=""/102392, 0x18ff8) r5 = add_key(&(0x7f00000001c0)='big_key\x00', &(0x7f0000000200)={'syz', 0x1}, &(0x7f0000002240)="d7", 0x1, 0xfffffffffffffffe) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r5, r6, 0x26) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000004c0)={r0, r2, 0x25, 0x0, @void}, 0x10) r8 = socket(0x10, 0x803, 0x0) socket(0x2, 0xa, 0x300) ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f0000000140)={'veth0_to_team\x00', &(0x7f0000000280)=@ethtool_channels={0x3d, 0x0, 0x0, 0x0, 0x4, 0x2, 0x1}}) unshare(0x62040200) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r7, 0x40a85323, &(0x7f0000000300)={{0xb, 0x2}, 'port0\x00', 0x45, 0x4, 0x6, 0x8, 0x80, 0x8, 0x8, 0x0, 0x1, 0x3}) ioctl$sock_inet_SIOCSIFFLAGS(r8, 0x8914, &(0x7f0000000040)={'veth0_to_team\x00', 0x800}) fcntl$setpipe(r0, 0x407, 0xf9) 14.597205279s ago: executing program 3 (id=2390): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) syz_emit_ethernet(0xad, &(0x7f0000000300)={@broadcast, @local, @void, {@ipv4={0x800, @tcp={{0x11, 0x4, 0x0, 0x1, 0x9f, 0x68, 0x0, 0xff, 0x6, 0x0, @multicast1, @empty, {[@generic={0x94, 0xa, "9b40f51983638a38"}, @ssrr={0x89, 0x17, 0x74, [@empty, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, @loopback, @multicast1]}, @lsrr={0x83, 0xf, 0x20, [@local, @loopback, @empty]}]}}, {{0x4e22, 0x4e23, 0x41424344, 0x41424344, 0x1, 0x0, 0xe, 0xa, 0x8, 0x0, 0x80, {[@mptcp=@synack={0x1e, 0x10, 0x3, 0x2, 0xc, 0x4, 0x80}, @sack_perm={0x4, 0x2}, @exp_smc={0xfe, 0x6}, @exp_smc={0xfe, 0x6}, @nop, @sack_perm={0x4, 0x2}]}}, {"3b2378b45fa666a7dcdf1525d366fb4b78fd6292b710a7a11bf055cd998f3f582303ca"}}}}}}, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) munmap(&(0x7f0000583000/0x4000)=nil, 0x4000) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000100)={0x0, 'erspan0\x00', {0x1}, 0x26}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xa, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000d00000000000000000000000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000007608000000c0000018000000000000000000000000000000950000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41100, 0xc}, 0x94) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MIF(r3, 0x29, 0xca, &(0x7f0000000240)={0x1, 0x0, 0x14}, 0xc) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mlock2(&(0x7f00001e7000/0x3000)=nil, 0x3000, 0x0) 12.536328571s ago: executing program 3 (id=2393): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe}}}]}, 0x38}}, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd25, 0xfffff000, {0x0, 0x0, 0x0, r7, {0xf000, 0xffff}, {}, {0x7, 0x9}}, [@filter_kind_options=@f_route={{0xa}, {0xc, 0x2, [@TCA_ROUTE4_CLASSID={0x8, 0x1, {0x0, 0xfff1}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) 10.456991034s ago: executing program 3 (id=2397): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1ff) write(r0, &(0x7f0000000080)='A\x00', 0x2) lseek(r0, 0xffffe, 0x0) write(r0, &(0x7f00000000c0)='B\x00', 0x2) close(r0) mkdir(&(0x7f0000000100)='./config\x00', 0x1ff) mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r1, &(0x7f0000000280)='0x1d6b\x00', 0x7) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r2, &(0x7f0000000300)='0x0104\x00', 0x7) close(r2) mkdir(0x0, 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='1234567890\x00', 0xb) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/strings/0x409/manufacturer\x00', 0x1, 0x0) write(r4, &(0x7f0000000440)='Manufacturer\x00', 0xd) r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/strings/0x409/product\x00', 0x1, 0x0) write(r5, &(0x7f00000004c0)='Prod', 0x4) close(r5) mkdir(&(0x7f0000000500)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdir(&(0x7f0000000540)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f00000005c0)='Conf 1\x00', 0x7) 10.138996292s ago: executing program 3 (id=2399): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x4b, 0x1, 0x0, 0x0, 0x0) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=ANY=[@ANYBLOB='8\x00 \x00', @ANYRES16=r0, @ANYBLOB="110a2abd7000ffdbdf252100000008000300", @ANYRES32=r2, @ANYBLOB="1c002d800a00000001010101010100000a0000000101010101010000"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x7f7) r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2002, 0x8) write(r5, &(0x7f0000000180)='10000', 0x5) r6 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) r7 = socket$inet(0x2, 0x1, 0x9) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x2b8, 0x0, 0xb, 0xd0e0011, 0x148, 0xc6, 0x220, 0x1d8, 0x190, 0x220, 0x1d8, 0x3, 0x0, {[{{@ip={@rand_addr, @broadcast, 0x0, 0x0, 'nr0\x00', '\x00', {}, {}, 0x1}, 0x0, 0xe0, 0x148, 0x2000000, {}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x8, 0x7, 0x3, {0x42}}}, @common=@unspec=@owner={{0x38}, {0x0, 0x0, 0x0, 0x0, 0x2, 0x5}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x2, 0x6, 0xb67f, 0x0, 'snmp_trap\x00', 'syz0\x00', {0x1e}}}}, {{@ip={@remote, @private=0xa010100, 0x0, 0x0, 'xfrm0\x00', 'virt_wifi0\x00'}, 0x0, 0x70, 0xd8}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x20, 0x0, 0x0, 0x20000, 'syz1\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x318) write(r6, &(0x7f0000000200)='1', 0x1) r8 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r8, &(0x7f0000000280)='0', 0x1) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) sendmsg$NFT_BATCH(r3, 0x0, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) 9.382802351s ago: executing program 3 (id=2401): r0 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd) r1 = add_key$user(&(0x7f0000006400), &(0x7f0000006c00)={'syz', 0x3}, &(0x7f0000000980)="3e12d23d346cfdeb1716f738274bc1c03bee4423fa20837e6e86b86592e9be8351aabbd6e24f37d5095f839fa4a3507df4f7526f2440e7988da94ccd868dd8741d1e2d7ae6a21d056c2c51a416a7", 0x4e, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f0000000100)={0x0, r0, r1}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'sha256\x00'}}) 9.133775607s ago: executing program 3 (id=2403): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config/usb_gadget/g_uac2\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g_uac2/idVendor\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='0x1234\n', 0x7) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g_uac2/idProduct\x00', 0x1, 0x0) write(r1, 0x0, 0x0) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g_uac2/functions/uac2.usb0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g_uac2/functions/uac2.usb0/c_chmask\x00', 0x1, 0x0) write(r2, &(0x7f0000000700)='0\n', 0x2) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g_uac2/functions/uac2.usb0/p_chmask\x00', 0x1, 0x0) write(r3, &(0x7f0000000900)='0\n', 0x2) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g_uac2/functions/uac2.usb0/c_mute_present\x00', 0x1, 0x0) write(r4, &(0x7f0000000b00)='0\n', 0x2) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g_uac2/functions/uac2.usb0/c_volume_present\x00', 0x1, 0x0) write(r5, &(0x7f0000000d00)='0\n', 0x2) close(r5) r6 = openat(0xffffffffffffff9c, &(0x7f0000000e00)='./config/usb_gadget/g_uac2/functions/uac2.usb0/p_mute_present\x00', 0x1, 0x0) write(r6, &(0x7f0000000f00)='0\n', 0x2) close(r6) r7 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./config/usb_gadget/g_uac2/functions/uac2.usb0/p_volume_present\x00', 0x1, 0x0) write(r7, &(0x7f0000001100)='0\n', 0x2) close(r7) mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/usb_gadget/g_uac2/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000001300)='./config/usb_gadget/g_uac2/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000001400)='./config/usb_gadget/g_uac2/configs/c.1/uac2.usb0\x00') r8 = openat(0xffffffffffffff9c, &(0x7f0000001500)='./config/usb_gadget/g_uac2/UDC\x00', 0x1, 0x0) write(r8, &(0x7f0000001600)='usbip-vudc.0\n', 0xd) close(r8) nanosleep(&(0x7f0000001700)={0x0, 0x5f5e100}, 0x0) 5.131988009s ago: executing program 0 (id=2412): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) socket$nl_route(0x10, 0x3, 0x0) mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb) 4.967753044s ago: executing program 5 (id=2413): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config/usb_gadget/g_uac2\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g_uac2/idVendor\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='0x1234\n', 0x7) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g_uac2/idProduct\x00', 0x1, 0x0) write(r1, 0x0, 0x0) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g_uac2/functions/uac2.usb0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g_uac2/functions/uac2.usb0/c_chmask\x00', 0x1, 0x0) write(r2, &(0x7f0000000700)='0\n', 0x2) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g_uac2/functions/uac2.usb0/p_chmask\x00', 0x1, 0x0) write(r3, &(0x7f0000000900)='0\n', 0x2) 4.933686204s ago: executing program 0 (id=2414): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config/usb_gadget/g_uac2\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g_uac2/idVendor\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='0x1234\n', 0x7) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g_uac2/idProduct\x00', 0x1, 0x0) write(r1, 0x0, 0x0) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g_uac2/functions/uac2.usb0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g_uac2/functions/uac2.usb0/c_chmask\x00', 0x1, 0x0) write(r2, &(0x7f0000000700)='0\n', 0x2) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g_uac2/functions/uac2.usb0/p_chmask\x00', 0x1, 0x0) write(r3, &(0x7f0000000900)='0\n', 0x2) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g_uac2/functions/uac2.usb0/c_mute_present\x00', 0x1, 0x0) write(r4, &(0x7f0000000b00)='0\n', 0x2) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g_uac2/functions/uac2.usb0/c_volume_present\x00', 0x1, 0x0) write(r5, &(0x7f0000000d00)='0\n', 0x2) close(r5) r6 = openat(0xffffffffffffff9c, &(0x7f0000000e00)='./config/usb_gadget/g_uac2/functions/uac2.usb0/p_mute_present\x00', 0x1, 0x0) write(r6, &(0x7f0000000f00)='0\n', 0x2) 4.728758389s ago: executing program 5 (id=2415): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) lsetxattr$trusted_overlay_nlink(0x0, &(0x7f0000000100), 0x0, 0x0, 0x1) r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x76, 0x10bb41) ioctl$USBDEVFS_DROP_PRIVILEGES(r0, 0x4004551e, &(0x7f0000000140)=0x2000003) ioctl$USBDEVFS_RESET(r0, 0x5514) 4.671483861s ago: executing program 0 (id=2417): socket$kcm(0x11, 0x200000000000002, 0x300) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c00000019000910001d0cf70400020000"], 0x1c}, 0x1, 0x0, 0x0, 0x4040880}, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000300)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042cbd7000ffdbdf25010000004c0002803c00018008000100040000000800010002000000080001000600000008000100070000000800010006000000080001000000000008000100080000000c00018008000100050000002d0002800c0001"], 0x70}, 0x1, 0x0, 0x0, 0x40005}, 0x40) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x1) ioctl$TCSETS(r1, 0x89f2, &(0x7f00000011c0)={0x6, 0xffff, 0x0, 0xd, 0x0, "5dee000000594000"}) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000340)=ANY=[@ANYBLOB="1801000030"], 0x118}], 0x1, 0x0, 0x0, 0x1}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0xf, 0x4, &(0x7f0000000380)=ANY=[], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) setsockopt$TIPC_CONN_TIMEOUT(r3, 0x10f, 0x82, &(0x7f0000000100)=0x8, 0x4) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@ipv4_newroute={0x1c, 0x18, 0x35f32a6dfa748ddd, 0x70bd2a, 0x0, {0x2, 0x0, 0x10, 0x0, 0xfe, 0x4, 0x0, 0x1, 0x20000020}}, 0x1c}}, 0x4810) r5 = socket$unix(0x1, 0x1, 0x0) bind$unix(r5, &(0x7f0000000180)=@file={0x1}, 0x6e) r6 = landlock_create_ruleset(&(0x7f00000002c0)={0x0, 0x0, 0x2}, 0x30, 0x0) landlock_restrict_self(r6, 0x0) listen(r5, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) connect$unix(r7, &(0x7f0000000080)=@file={0x1}, 0x6e) openat$nci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r8 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) connect$llc(r8, &(0x7f0000000240)={0x1a, 0x20, 0x0, 0x9, 0x2, 0x0, @random='\x00\x00\x00\x00\x00\a'}, 0x10) 4.055135667s ago: executing program 2 (id=2418): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000007c0)=ANY=[@ANYBLOB="40010000", @ANYRES16=r3, @ANYBLOB="01000000000004000000010000002400030000000000000000000000000000000000000000000000000000000000000000001400020077673100000000000000000000000000f4000880"], 0x140}, 0x1, 0x0, 0x0, 0x8000}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config\x00', 0x1c0) mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.usb0/control/extensions/xu1\x00', 0x1c0) openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.usb0/control/extensions/xu1/bmControls\x00', 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000580)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002dbd7000fcdbdf2501000000140002007767310000000000000000000000000024000300a05ca84f6c9c8e3853e2fd7a70ae0fb20fa152600cb00845174f08076f8d7843719f50574c9349d36b4e724d7632c26955b9999d822d6e7f0dd5af67469e3b1138f1b8cc4e9a0fd8d9b12d4b1cc8a309a202fd413fc7de2c65b84dd64bd778177a1d2eabaea7f7"], 0x4c}, 0x1, 0x0, 0x0, 0x40090}, 0x44000) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000000300)={'wg0\x00'}) setsockopt$inet_mreqsrc(r1, 0x0, 0x26, &(0x7f0000000380)={@multicast1, @initdev={0xac, 0x1e, 0x1, 0x0}, @remote}, 0xc) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000005000000000000008000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7020000010000008500000086fbffff17010000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000050000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a800000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x11}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f0000001400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000013c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="2e00000099f8941fe980963dca9813da7ec92536434d9d841148d6d96d8263a846696bb39d4ab904562c48f432182855febbfc04ea724b6651b1b0a61b49c6372b49a3badf530e0e33c5a2", @ANYRES16=r3, @ANYBLOB="04002abd7000fbdbdf2501000000"], 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0x11) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000480)={0x0, 0x5, 0x10}, 0xc) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x1}, 0x1c, &(0x7f0000000180)=[{&(0x7f00000000c0)='v', 0x1}], 0x1}, 0x4048043) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) ioctl$USBDEVFS_CONTROL(0xffffffffffffffff, 0xc0185500, &(0x7f0000000040)={0x23, 0x9, 0x14, 0xec, 0x0, 0x5, 0x0}) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e21, @empty}}, 0x5, 0x3, 0xf06, 0x4, 0x94, 0xfffffffd, 0x5}, 0x9c) socket$inet6(0x10, 0x3, 0x3) sendmmsg$inet6(r0, &(0x7f0000000340)=[{{0x0, 0x0, &(0x7f0000000900)}}], 0x1, 0x0) 3.847575762s ago: executing program 0 (id=2419): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) socket$nl_route(0x10, 0x3, 0x0) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb) 3.52305335s ago: executing program 0 (id=2420): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x4b, 0x1, 0x0, 0x0, 0x0) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=ANY=[@ANYBLOB='8\x00 \x00', @ANYRES16=r0, @ANYBLOB="110a2abd7000ffdbdf252100000008000300", @ANYRES32=r2, @ANYBLOB="1c002d800a00000001010101010100000a0000000101010101010000"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x7f7) r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2002, 0x8) write(r5, &(0x7f0000000180)='10000', 0x5) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) r6 = socket$inet(0x2, 0x1, 0x9) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x2b8, 0x0, 0xb, 0xd0e0011, 0x148, 0xc6, 0x220, 0x1d8, 0x190, 0x220, 0x1d8, 0x3, 0x0, {[{{@ip={@rand_addr, @broadcast, 0x0, 0x0, 'nr0\x00', '\x00', {}, {}, 0x1}, 0x0, 0xe0, 0x148, 0x2000000, {}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x8, 0x7, 0x3, {0x42}}}, @common=@unspec=@owner={{0x38}, {0x0, 0x0, 0x0, 0x0, 0x2, 0x5}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x2, 0x6, 0xb67f, 0x0, 'snmp_trap\x00', 'syz0\x00', {0x1e}}}}, {{@ip={@remote, @private=0xa010100, 0x0, 0x0, 'xfrm0\x00', 'virt_wifi0\x00'}, 0x0, 0x70, 0xd8}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x20, 0x0, 0x0, 0x20000, 'syz1\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x318) setsockopt$inet_sctp_SCTP_CONTEXT(r5, 0x84, 0x11, 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r7, &(0x7f0000000280)='0', 0x1) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) sendmsg$NFT_BATCH(r3, 0x0, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) 3.059959532s ago: executing program 5 (id=2421): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) r2 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f0000000240)=r2) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f0000000040)={0x1, r2}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/70, 0x100000}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000680)) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000000)=0x1) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), 0xffffffffffffffff) r3 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) ioctl$SNDCTL_DSP_SETFMT(r3, 0xc0045005, &(0x7f0000000140)=0x2000) ppoll(&(0x7f0000000040)=[{r3, 0x20}, {r3, 0x13}], 0x2, 0x0, 0x0, 0x0) mmap$dsp(&(0x7f0000ff9000/0x2000)=nil, 0x2000, 0x100000f, 0x11, r3, 0x0) ioctl$SNDCTL_DSP_SETFMT(r3, 0xc0045005, &(0x7f0000000000)=0x4000) r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000001800)=ANY=[@ANYBLOB="e8000000ff03000004000000098ee42621b50c2d4e95a4197b1d2056ed75faebaa86ecdfb92ebb6294a50f54fc8c513af4a0167e3317f4e2f4fc06cdd0a6be076804fce6437048fe87ed07bf22e52ca776cc4d4be3bdb24ad6947fd85072c1d6cb16b253f915296055e9a06a59a4f81566cc1c1d32d493a60d41a98655f4811f0dbebcea0398a4b98a72e516f5e84b9cc471f8297d786188e402910817db84412b578acd08287f8bdfa2551d5529e46cccc2f940b0c5b6f68a507f978762fef76eb672a018d5cc2e0e9ea60111e80ec8a9080a96a60804503c5a4d739ee553796d333859d3a5e1eaaf9f02eafaf0d58ee66e45ce1a1f38b2692a06cfc8fcc6d29abc88104d5e130984ab922b3df5d4351431bd1b9d82e856a7692e1f92622533a1dfd607a69a35a9b5e5da561dbe10c0966f9ed1149312b8117f8ef80273ce838d81b0ef7a77f5b86cd236a9901e9b29d763dd61e5f230074dbd52dd157dce9b792653629a6309a1e99fad82381a9357d5c27968a8f9ab8be716222cfa72571539fb3d61ff04d16a0285e398286f330b2e2d34701059e6123efbdeb4575eaa72299c844669f739dc984b283ffda5f0deab3901d7909adef2cd12853a989cbd7957386865054781d3b7a5641f719d1e8b8c659ba993238b3cb0e628321f10fc0cdacfa8e5c4b0550a69ed28b663ce72678cefcfabdfe971400b2c2d07e9f796c58a308e8eae2ae28a460b83237e012a30318944ce1ecf368f1c3d476846e7954ca9025f2a05c9a474a3fe10a41701938c033576183460b6d439ea5800df41b5d3fa80447eaba92834dfcc849106138c945ba50fa3c854cf796cb1cb5be8fa6610846eca4d11c73a8e78a2e2d2a8bee86cbe34e600b536124e554caae6448b3f47c6ae2be0fe6afaf5ea15602aa721b1"]) r5 = syz_open_dev$vim2m(&(0x7f0000000500), 0x0, 0x2) ioctl$vim2m_VIDIOC_CREATE_BUFS(r5, 0xc0f8565c, &(0x7f0000000000)={0x0, 0x1000, 0x2, {0x2, @sliced={0x0, [0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffe, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1001]}}}) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r6, 0x4008ae90, &(0x7f0000000100)={0x1, 0x0, [{0x1, 0x0, 0x0, 0x0, 0x0, 0x1200002}]}) ioctl$KVM_GET_MSRS_cpu(r6, 0xc008ae88, &(0x7f0000000300)={0x1, 0x0, [{0x839}]}) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0xae642, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000007, 0x13, r7, 0x0) preadv2(r7, &(0x7f0000000080)=[{&(0x7f0000000800)=""/4096, 0x1000}], 0x1, 0x1, 0x0, 0x1f) 2.599091924s ago: executing program 2 (id=2422): r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g_uac2/functions/uac2.usb0/p_chmask\x00', 0x1, 0x0) write(r0, &(0x7f0000000900)='0\n', 0x2) 2.37112782s ago: executing program 2 (id=2423): r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd25, 0xfffff000, {0x0, 0x0, 0x0, r2, {0xf000, 0xffff}, {}, {0x7, 0x9}}, [@filter_kind_options=@f_route={{0xa}, {0xc, 0x2, [@TCA_ROUTE4_CLASSID={0x8, 0x1, {0x0, 0xfff1}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) 2.34203694s ago: executing program 5 (id=2424): r0 = openat(0xffffffffffffff9c, &(0x7f0000000e00)='./config/usb_gadget/g_uac2/functions/uac2.usb0/p_mute_present\x00', 0x1, 0x0) write(r0, &(0x7f0000000f00)='0\n', 0x2) 2.146395525s ago: executing program 5 (id=2425): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000002100)=ANY=[], 0x48) close(r0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="10000000040000000800000005"], 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1a00000007"], 0x50) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) writev(0xffffffffffffffff, &(0x7f00000005c0)=[{&(0x7f0000000000)='U', 0x1}], 0x1) write$binfmt_misc(r2, &(0x7f0000000000), 0xd) mkdir(&(0x7f0000000140)='./file1\x00', 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) sendmsg$TIPC_NL_MON_PEER_GET(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4841}, 0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x7, 0x0, 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c00000037000701f3fffffffedbd72501"], 0x1c}, 0x1, 0x0, 0x0, 0x4040011}, 0x8050) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f0000000040)="94", 0x1}, {0x0}], 0x2) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$RTC_WKALM_RD(0xffffffffffffffff, 0x80287010, &(0x7f00000001c0)) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000340)={'netdevsim0\x00', &(0x7f0000000700)=@ethtool_flash={0x33, 0xea6, '.\x00'}}) r5 = fsopen(&(0x7f0000000100)='hugetlbfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0xc) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_buf(r6, 0x6, 0x21, &(0x7f0000000280)="dc8daf8d760c0b8caa98fa19c6a35a18883775d272c579ff33a6effc0c49320f", 0x20) 1.937153841s ago: executing program 2 (id=2426): socket$inet(0x2, 0x4, 0x6) socket(0x15, 0x5, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r1, 0x8946, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, 0x0, 0x2404c080) syz_emit_vhci(&(0x7f0000000740)=ANY=[@ANYBLOB="0404"], 0xd) 1.55708006s ago: executing program 2 (id=2427): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='dummy_udc.0', 0xb) 1.298383637s ago: executing program 2 (id=2428): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) r1 = socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000840)=@newtfilter={0x50, 0x2c, 0xd27, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xfff3, 0x7}, {}, {0xfff3, 0xfff2}}, [@filter_kind_options=@f_cgroup={{0xb}, {0xffffffffffffff07, 0x2, [@TCA_CGROUP_EMATCHES={0x1c, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x6}}, @TCA_EMATCH_TREE_LIST={0x10, 0x2, 0x0, 0x1, [@TCF_EM_IPT={0xc, 0x1, 0x0, 0x0, {{0xe37, 0x9, 0x4}}}]}]}]}}]}, 0x50}}, 0x40010) 428.881839ms ago: executing program 0 (id=2429): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000800)=@can_newroute={0x2c, 0x18, 0x1, 0x70bd2c, 0x25dfdbfe, {0x1d, 0x1, 0x4}, [@CGW_MOD_SET={0x15, 0x4, {{{0x3}, 0x7, 0x1, 0x0, 0x0, "766fd846e9a2cd66"}, 0x1}}]}, 0x2c}}, 0x4c8c8) 0s ago: executing program 5 (id=2430): mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000480), 0x76, 0x160341) ioctl$USBDEVFS_GETDRIVER(r0, 0x41045508, 0x0) kernel console output (not intermixed with test programs): xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 420.601593][ T9019] xpad 6-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 420.698712][ T5124] xpad 6-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 420.740007][ T5124] xpad 6-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 420.776969][ T9046] netlink: 8 bytes leftover after parsing attributes in process `syz.0.884'. [ 420.793840][ T7520] xpad 6-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 420.814480][ T9046] netlink: 24 bytes leftover after parsing attributes in process `syz.0.884'. [ 420.856624][ T5124] xpad 6-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 420.920727][ T5124] xpad 6-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 421.229729][ T5837] hid-generic 0000:0000:0000.0009: unknown main item tag 0x0 [ 421.299346][ T5837] hid-generic 0000:0000:0000.0009: hidraw0: HID v0.00 Device [syz1] on syz0 [ 421.384021][ T5837] usb 6-1: USB disconnect, device number 5 [ 421.640098][ T9063] netlink: 112 bytes leftover after parsing attributes in process `syz.5.889'. [ 423.711689][ T5837] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 423.758698][ T9092] netlink: 8 bytes leftover after parsing attributes in process `syz.3.898'. [ 423.820870][ T9092] netlink: 24 bytes leftover after parsing attributes in process `syz.3.898'. [ 424.476542][ T9100] bond_slave_0: entered promiscuous mode [ 424.482306][ T9100] bond_slave_1: entered promiscuous mode [ 424.557202][ T9100] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 424.608500][ T9100] bond2: (slave macvlan2): Enslaving as an active interface with an up link [ 424.682603][ T8] hid-generic 0000:0000:0000.000A: unknown main item tag 0x0 [ 424.743136][ T8] hid-generic 0000:0000:0000.000A: hidraw0: HID v0.00 Device [syz1] on syz0 [ 425.499952][ T5790] Bluetooth: hci1: unexpected event for opcode 0x2977 [ 425.927679][ T9126] fuse: Unknown parameter 'group_id00000000000000000000' [ 427.012126][ T9152] bond4: option mode: unable to set because the bond device has slaves [ 427.069655][ T9152] bond4: (slave macvlan3): Error -98 calling set_mac_address [ 427.082215][ T9155] fuse: Unknown parameter 'group_id00000000000000000000' [ 427.412191][ T5837] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 427.463580][ T5863] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 427.512195][ T5863] hid-generic 0000:0000:0000.000B: hidraw0: HID v0.00 Device [syz1] on syz0 [ 427.611392][ T5837] usb 3-1: Using ep0 maxpacket: 16 [ 427.658642][ T5837] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 427.719560][ T5837] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 429.077176][ T5837] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 429.098062][ T9177] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 429.715472][ T5837] usb 3-1: config 0 descriptor?? [ 429.840112][ T9177] CIFS: Attempting to mount //127.0.0.1/share [ 429.928940][ T9177] CIFS: VFS: Error connecting to socket. Aborting operation. [ 429.986366][ T9177] CIFS: VFS: cifs_mount failed w/return code = -111 [ 430.051368][ T5837] usb 3-1: USB disconnect, device number 12 [ 430.302282][ T9184] fuse: Bad value for 'user_id' [ 431.492871][ T5790] Bluetooth: hci0: unexpected event for opcode 0x950c [ 435.935900][ T5790] Bluetooth: hci1: unexpected event for opcode 0x100c [ 436.059777][ T8] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 436.124226][ T8] hid-generic 0000:0000:0000.000C: hidraw0: HID v0.00 Device [syz1] on syz0 [ 439.615710][ T9259] netlink: 8 bytes leftover after parsing attributes in process `syz.5.953'. [ 441.647949][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 441.654364][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 441.943254][ T5837] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 442.008530][ T5837] hid-generic 0000:0000:0000.000D: hidraw0: HID v0.00 Device [syz1] on syz0 [ 443.663393][ T5790] Bluetooth: hci3: ACL packet for unknown connection handle 2825 [ 446.139556][ T9332] netlink: 8 bytes leftover after parsing attributes in process `syz.5.976'. [ 446.481910][ T5837] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 446.536374][ T5837] hid-generic 0000:0000:0000.000E: hidraw0: HID v0.00 Device [syz1] on syz0 [ 447.022798][ T9353] binder: 9352:9353 ioctl 4018620d 0 returned -22 [ 450.051377][ T8] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 450.271364][ T8] usb 4-1: Using ep0 maxpacket: 32 [ 450.294951][ T8] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x89 has an invalid bInterval 128, changing to 11 [ 451.168984][ T5777] ffs_data_put(): freeing [ 452.207071][ T8] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 452.277155][ T8] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 452.328688][ T8] usb 4-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 452.366763][ T8] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 452.411441][ T8] usb 4-1: Product: syz [ 452.415651][ T8] usb 4-1: Manufacturer: syz [ 452.450721][ T8] usb 4-1: SerialNumber: syz [ 452.487436][ T8] usb 4-1: config 0 descriptor?? [ 452.523169][ T8] input: Generic X-Box pad as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input41 [ 452.572588][ T5124] xpad 4-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 452.599428][ T9386] binder: 9385:9386 ioctl 4018620d 0 returned -22 [ 454.550847][ T5124] xpad 4-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 454.563559][ T8] usb 4-1: USB disconnect, device number 15 [ 454.569639][ C0] xpad 4-1:0.0: xpad_irq_in - usb_submit_urb failed with result -19 [ 456.905716][ T9421] 9pnet_virtio: no channels available for device syz [ 457.026749][ T9421] netlink: 'syz.5.1010': attribute type 39 has an invalid length. [ 460.019880][ T9446] bridge0: port 2(bridge_slave_1) entered disabled state [ 460.027869][ T9446] bridge0: port 1(bridge_slave_0) entered disabled state [ 460.190517][ T9446] tipc: Resetting bearer [ 460.471591][ T9463] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1023'. [ 461.203119][ T9446] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 461.260238][ T9446] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 462.241098][ T9446] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 462.263117][ T9446] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 462.279462][ T9446] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 462.299175][ T9446] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 462.762917][ T5084] Bluetooth: hci0: command 0x0406 tx timeout [ 465.766511][ T9517] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1042'. [ 466.677763][ T5774] ffs_data_put(): freeing [ 469.563452][ T9560] input: syz0 as /devices/virtual/input/input43 [ 470.176632][ T5777] ffs_data_put(): freeing [ 470.302895][ T5837] usb 4-1: new full-speed USB device number 16 using dummy_hcd [ 470.505401][ T5837] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 470.536177][ T5837] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 470.562330][ T9] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 470.588343][ T5837] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 470.654989][ T5837] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 470.691067][ T5837] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 470.715734][ T5837] usb 4-1: Product: syz [ 470.730451][ T5837] usb 4-1: Manufacturer: syz [ 470.740558][ T5837] usb 4-1: SerialNumber: syz [ 470.764654][ T5837] cdc_mbim 4-1:1.0: skipping garbage [ 470.782129][ T5837] cdc_mbim 4-1:1.0: CDC Union missing and no IAD found [ 470.789064][ T5837] cdc_mbim 4-1:1.0: bind() failure [ 470.795746][ T9] usb 6-1: Using ep0 maxpacket: 16 [ 470.824433][ T9] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 470.858020][ T9] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 470.907598][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 470.939881][ T9] usb 6-1: config 0 descriptor?? [ 471.002288][ T5837] usb 4-1: USB disconnect, device number 16 [ 471.194060][ T5863] usb 6-1: USB disconnect, device number 6 [ 471.413857][ T9589] syz.2.1061 (9589) used greatest stack depth: 19224 bytes left [ 472.166614][ T6854] ffs_data_put(): freeing [ 473.619060][ T9641] input: syz0 as /devices/virtual/input/input44 [ 473.883146][ T5790] Bluetooth: hci0: command 0x0406 tx timeout [ 474.265462][ T9652] input: syz1 as /devices/virtual/input/input45 [ 474.532306][ T5863] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 474.751550][ T5863] usb 6-1: Using ep0 maxpacket: 32 [ 474.780247][ T5863] usb 6-1: unable to get BOS descriptor or descriptor too short [ 474.825880][ T5863] usb 6-1: New USB device found, idVendor=0644, idProduct=800e, bcdDevice= 0.40 [ 474.845572][ T9667] configfs-gadget.g1 gadget.0: HOST MAC 56:e6:3d:52:a2:2b [ 474.873210][ T5863] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 474.905181][ T9667] configfs-gadget.g1 gadget.0: MAC ca:8c:e3:f6:16:b0 [ 474.931663][ T5863] usb 6-1: Product: syz [ 474.965914][ T5863] usb 6-1: Manufacturer: syz [ 475.014824][ T5863] usb 6-1: SerialNumber: syz [ 475.224343][ T5837] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 475.373736][ T5863] usb 6-1: Quirk or no altest; falling back to MIDI 1.0 [ 475.415701][ T5863] usb 6-1: MIDIStreaming interface descriptor not found [ 475.484396][ T5837] usb 1-1: Dual-Role OTG device on HNP port [ 475.531739][ T9684] input: syz0 as /devices/virtual/input/input46 [ 475.552304][ T5837] usb 1-1: New USB device found, idVendor=0000, idProduct=0104, bcdDevice= 6.06 [ 475.628688][ T5837] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 475.628727][ T5837] usb 1-1: Product: Product [ 475.628738][ T5837] usb 1-1: SerialNumber: 1234567890 [ 475.629869][ T5863] usb 6-1: USB disconnect, device number 7 [ 475.723562][ T5837] usb-storage 1-1:1.0: USB Mass Storage device detected [ 475.774365][ T5837] scsi host1: usb-storage 1-1:1.0 [ 475.982069][ T5837] cdc_eem 1-1:1.1 usb1: register 'cdc_eem' at usb-dummy_hcd.0-1, CDC EEM Device, 8e:75:d7:cf:56:d4 [ 476.081235][ T9697] udevd[9697]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 476.877566][ T4339] scsi 1:0:0:0: CD-ROM Linux File-CD Gadget 0606 PQ: 0 ANSI: 2 [ 476.934562][ T9694] sr 1:0:0:0: Power-on or device reset occurred [ 476.950596][ T4339] sr 1:0:0:0: [sr0] scsi-1 drive [ 476.959048][ T4339] cdrom: Uniform CD-ROM driver Revision: 3.20 [ 477.238495][ T4339] sr 1:0:0:0: Attached scsi generic sg1 type 5 [ 477.328524][ T9713] 9pnet_virtio: no channels available for device syz [ 477.433695][ T9713] netlink: 'syz.5.1096': attribute type 39 has an invalid length. [ 477.672775][ T9723] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1099'. [ 477.739404][ T9723] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1099'. [ 481.310249][ T5775] ffs_data_put(): freeing [ 481.947000][ T9752] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1109'. [ 482.035518][ T9752] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1109'. [ 482.502353][ T9768] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 482.562239][ T9768] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 483.652173][ T6854] ffs_data_put(): freeing [ 483.932883][ T9790] overlayfs: failed to resolve './file2': -2 [ 484.281461][ T5837] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 484.501608][ T5837] usb 4-1: Using ep0 maxpacket: 32 [ 484.546074][ T5837] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x89 has an invalid bInterval 128, changing to 11 [ 484.621475][ T5837] usb 4-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 484.728639][ T5837] usb 4-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 484.779651][ T5837] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 484.847713][ T5837] usb 4-1: Product: syz [ 484.875166][ T5837] usb 4-1: Manufacturer: syz [ 484.925029][ T5837] usb 4-1: SerialNumber: syz [ 484.975923][ T5837] usb 4-1: config 0 descriptor?? [ 485.213649][ T5837] usb 4-1: USB disconnect, device number 17 [ 485.635175][ T9814] input: syz1 as /devices/virtual/input/input47 [ 486.047913][ T5777] ffs_data_put(): freeing [ 486.321987][ T9829] overlayfs: failed to resolve './file2': -2 [ 486.769202][ T9843] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1133'. [ 487.692780][ T9856] random: crng reseeded on system resumption [ 487.829961][ T9858] Illegal XDP return value 3457 on prog (id 39) dev syz_tun, expect packet loss! [ 488.681504][ T5084] Bluetooth: hci0: command 0x0406 tx timeout [ 489.159768][ T9877] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1140'. [ 489.220917][ T9877] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1140'. [ 489.381442][ T5863] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 489.795641][ T5863] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 489.857907][ T5863] usb 6-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 489.950953][ T5863] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 253 [ 489.973884][ T9886] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1143'. [ 490.037631][ T5863] usb 6-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 490.110469][ T5863] usb 6-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 490.144130][ T9892] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 490.210804][ T5863] usb 6-1: Manufacturer: syz [ 490.264649][ T5863] usb 6-1: config 0 descriptor?? [ 490.328827][ T5863] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 490.792976][ T8] usb 6-1: USB disconnect, device number 8 [ 491.899012][ T9914] input: syz0 as /devices/virtual/input/input48 [ 493.921857][ T8] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 493.942016][ T9939] 9pnet_virtio: no channels available for device syz [ 493.988547][ T9926] null_blk: disk nullb1 created [ 494.019417][ T9939] netlink: 'syz.0.1156': attribute type 39 has an invalid length. [ 494.158618][ T8] usb 4-1: config 0 has no interfaces? [ 494.169411][ T8] usb 4-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 494.214516][ T8] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 494.255472][ T9942] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 494.285821][ T8] usb 4-1: config 0 descriptor?? [ 494.305057][ T9942] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 494.368234][ T9942] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 494.415504][ T9942] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 495.049294][ T5837] usb 4-1: USB disconnect, device number 18 [ 495.501907][ T5837] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 496.202602][ T5837] usb 6-1: Using ep0 maxpacket: 32 [ 496.402586][ T5837] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x89 has an invalid bInterval 128, changing to 11 [ 496.488429][ T5837] usb 6-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 496.585815][ T5837] usb 6-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 496.626721][ T5837] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 496.678675][ T5837] usb 6-1: Product: syz [ 496.697717][ T5837] usb 6-1: Manufacturer: syz [ 496.722438][ T5837] usb 6-1: SerialNumber: syz [ 496.776381][ T5837] usb 6-1: config 0 descriptor?? [ 497.076527][ T5837] usb 6-1: USB disconnect, device number 9 [ 498.671737][T10008] 9pnet_virtio: no channels available for device syz [ 498.816090][T10011] netlink: 'syz.2.1176': attribute type 39 has an invalid length. [ 499.294603][T10023] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 499.372079][T10023] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 499.961997][ T5837] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 500.172037][ T5837] usb 3-1: Using ep0 maxpacket: 32 [ 500.205812][ T5837] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x89 has an invalid bInterval 128, changing to 11 [ 500.283817][ T5837] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 500.379685][ T5837] usb 3-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 500.456959][ T5837] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 500.514751][ T5837] usb 3-1: Product: syz [ 500.541615][ T5837] usb 3-1: Manufacturer: syz [ 500.546434][ T5837] usb 3-1: SerialNumber: syz [ 500.609576][ T5837] usb 3-1: config 0 descriptor?? [ 500.889885][ T5837] usb 3-1: USB disconnect, device number 13 [ 501.442330][T10051] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 501.486955][T10051] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 501.570738][T10051] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 501.600284][T10051] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 501.641737][T10051] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 501.666780][T10051] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 501.713796][T10051] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 501.755225][T10051] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 501.806943][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.813810][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.022572][T10075] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1191'. [ 502.041576][ T5837] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 502.224485][ T5837] usb 3-1: device descriptor read/64, error -71 [ 502.366494][T10079] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 502.413118][T10079] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 502.501470][ T5837] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 502.691465][ T5837] usb 3-1: device descriptor read/64, error -71 [ 502.832939][ T5837] usb usb3-port1: attempt power cycle [ 502.893246][T10089] bond4: option mode: unable to set because the bond device has slaves [ 502.921966][ T5084] Bluetooth: hci1: command 0x0406 tx timeout [ 503.423196][ T5837] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 503.506155][ T5837] usb 3-1: device descriptor read/8, error -71 [ 503.642502][ T5084] Bluetooth: hci2: command 0x0406 tx timeout [ 503.648679][ T5084] Bluetooth: hci3: command 0x0406 tx timeout [ 503.721455][ T5084] Bluetooth: hci0: command 0x0406 tx timeout [ 503.821673][ T5837] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 503.921068][ T5837] usb 3-1: device descriptor read/8, error -71 [ 504.071806][ T5837] usb usb3-port1: unable to enumerate USB device [ 505.006952][ T5084] Bluetooth: hci1: command 0x0406 tx timeout [ 505.032427][T10121] 9pnet_virtio: no channels available for device syz [ 505.157231][T10121] netlink: 'syz.2.1205': attribute type 39 has an invalid length. [ 505.460700][T10098] netlink: 'syz.0.1199': attribute type 1 has an invalid length. [ 505.721652][ T5084] Bluetooth: hci3: command 0x0406 tx timeout [ 505.728729][ T5782] Bluetooth: hci2: command 0x0406 tx timeout [ 505.765539][T10098] input: syz1 as /devices/virtual/input/input51 [ 505.801643][ T5084] Bluetooth: hci0: command 0x0406 tx timeout [ 505.813771][ T8] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 506.260802][ T8] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 506.411757][ T8] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 506.506001][ T8] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 506.593027][ T8] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 506.698956][ T8] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 506.794763][ T8] usb 3-1: config 0 descriptor?? [ 507.426992][ T8] usbhid 3-1:0.0: can't add hid device: -71 [ 507.487318][ T8] usbhid: probe of 3-1:0.0 failed with error -71 [ 507.541463][ T5779] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 507.553765][ T8] usb 3-1: USB disconnect, device number 18 [ 507.742041][ T5779] usb 6-1: device descriptor read/64, error -71 [ 508.029847][T10167] bond2: option mode: unable to set because the bond device has slaves [ 508.061624][ T5779] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 508.261529][ T5779] usb 6-1: device descriptor read/64, error -71 [ 508.413429][ T5779] usb usb6-port1: attempt power cycle [ 508.852684][ T5779] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 509.185197][ T5779] usb 6-1: device descriptor read/8, error -71 [ 509.513069][ T5779] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 509.617940][ T5779] usb 6-1: device descriptor read/8, error -71 [ 509.791702][ T5779] usb usb6-port1: unable to enumerate USB device [ 510.381597][ T5837] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 510.609754][T10212] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1227'. [ 510.631207][T10211] 9pnet_fd: Insufficient options for proto=fd [ 510.659831][ T5837] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 510.743794][ T5837] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 510.823196][ T5837] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 510.895541][ T5837] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 510.954156][ T5837] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 510.981664][ T8] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 510.993846][T10218] random: crng reseeded on system resumption [ 511.013350][ T5837] usb 4-1: config 0 descriptor?? [ 511.229397][ T8] usb 6-1: config 1 has an invalid interface descriptor of length 4, skipping [ 511.284835][ T8] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 511.717848][ T8] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 511.800298][ T5837] usbhid 4-1:0.0: can't add hid device: -71 [ 511.815507][ T8] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 4416, setting to 1024 [ 511.867741][ T5837] usbhid: probe of 4-1:0.0 failed with error -71 [ 511.931446][ T8] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 511.972974][ T5837] usb 4-1: USB disconnect, device number 19 [ 512.017878][ T8] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 512.125038][ T8] usb 6-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 514.163537][ T8] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 514.276422][ T8] usb 6-1: can't set config #1, error -71 [ 514.392326][ T8] usb 6-1: USB disconnect, device number 14 [ 514.827278][T10237] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 514.931897][T10237] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 517.443001][T10278] input: syz0 as /devices/virtual/input/input52 [ 517.601993][T10280] 9pnet_virtio: no channels available for device syz [ 517.741086][T10280] netlink: 'syz.3.1246': attribute type 39 has an invalid length. [ 518.073805][T10285] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 518.125983][T10285] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 518.611524][ T5837] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 518.971386][ T5782] Bluetooth: hci0: command 0x0406 tx timeout [ 519.131629][ T5837] usb 6-1: device descriptor read/64, error -71 [ 519.451417][ T5837] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 519.652662][ T5837] usb 6-1: device descriptor read/64, error -71 [ 519.731443][ T5779] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 519.783001][ T5837] usb usb6-port1: attempt power cycle [ 519.911532][ T5779] usb 4-1: device descriptor read/64, error -71 [ 520.205043][ T5779] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 520.225120][ T5837] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 520.294015][ T5837] usb 6-1: device descriptor read/8, error -71 [ 520.374676][T10316] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1258'. [ 520.401513][T10316] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1258'. [ 520.411962][ T5779] usb 4-1: device descriptor read/64, error -71 [ 520.531616][ T5779] usb usb4-port1: attempt power cycle [ 520.591465][ T5837] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 520.632186][ T5837] usb 6-1: device descriptor read/8, error -71 [ 520.771563][ T5837] usb usb6-port1: unable to enumerate USB device [ 520.878790][T10325] 9pnet_virtio: no channels available for device syz [ 520.922878][T10325] netlink: 'syz.0.1260': attribute type 39 has an invalid length. [ 520.951436][ T5779] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 521.005054][ T5779] usb 4-1: device descriptor read/8, error -71 [ 521.541437][ T5779] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 521.624046][ T5779] usb 4-1: device descriptor read/8, error -71 [ 521.756043][ T5779] usb usb4-port1: unable to enumerate USB device [ 521.831571][T10335] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 521.882871][T10335] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 522.601436][ T5084] Bluetooth: hci0: command 0x0406 tx timeout [ 523.318182][T10350] 9pnet_virtio: no channels available for device syz [ 523.399165][T10350] netlink: 'syz.3.1269': attribute type 39 has an invalid length. [ 523.464358][T10352] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 523.522152][T10352] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 524.501584][T10367] input: syz0 as /devices/virtual/input/input53 [ 525.097140][T10377] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1277'. [ 525.137689][T10377] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1277'. [ 525.276062][T10380] 9pnet_virtio: no channels available for device syz [ 525.373272][T10380] netlink: 'syz.3.1279': attribute type 39 has an invalid length. [ 527.465046][T10413] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 528.282768][ T5782] Bluetooth: hci0: command 0x0406 tx timeout [ 530.545758][T10450] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1302'. [ 531.941611][T10473] input: syz0 as /devices/virtual/input/input54 [ 532.804096][T10486] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1315'. [ 534.791402][T10512] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1326'. [ 535.272891][ T5779] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 535.639640][T10528] input: syz0 as /devices/virtual/input/input55 [ 536.055068][T10534] input: syz1 as /devices/virtual/input/input56 [ 537.534221][T10556] random: crng reseeded on system resumption [ 538.813944][T10576] input: syz1 as /devices/virtual/input/input57 [ 539.481391][ T5084] Bluetooth: hci0: command 0x0406 tx timeout [ 540.613443][T10602] input: syz0 as /devices/virtual/input/input58 [ 542.630312][ T5782] Bluetooth: hci0: command 0x0406 tx timeout [ 543.186279][ T5779] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 543.518080][ T5779] usb 4-1: device descriptor read/64, error -71 [ 543.627496][T10643] fuse: Unknown parameter 'grou00000000000000000000' [ 543.676790][T10645] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 543.821403][ T5779] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 544.011379][ T5779] usb 4-1: device descriptor read/64, error -71 [ 544.173447][ T5779] usb usb4-port1: attempt power cycle [ 544.630120][ T5779] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 544.723103][ T5779] usb 4-1: device descriptor read/8, error -71 [ 545.021555][ T5779] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 545.083695][ T5779] usb 4-1: device descriptor read/8, error -71 [ 545.380779][ T5779] usb usb4-port1: unable to enumerate USB device [ 547.733345][ T8] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 547.752802][T10690] input: syz1 as /devices/virtual/input/input59 [ 547.981326][ T8] usb 4-1: Using ep0 maxpacket: 32 [ 548.015232][ T8] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 548.044813][ T8] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 548.099698][ T8] usb 4-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 548.140399][ T8] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 548.174018][ T8] usb 4-1: Product: syz [ 548.193284][ T8] usb 4-1: Manufacturer: syz [ 548.214149][ T8] usb 4-1: SerialNumber: syz [ 548.243467][ T8] usb 4-1: config 0 descriptor?? [ 548.498147][ T8] usb 4-1: USB disconnect, device number 28 [ 551.103188][T10734] sctp: failed to load transform for md5: -2 [ 551.243388][ T5084] Bluetooth: hci0: command 0x0406 tx timeout [ 552.368009][T10699] netlink: 44 bytes leftover after parsing attributes in process `syz.5.1395'. [ 553.057270][T10757] netlink: 48 bytes leftover after parsing attributes in process `syz.5.1408'. [ 553.141752][ T5863] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 553.535723][ T5863] usb 3-1: Using ep0 maxpacket: 32 [ 553.558622][ T5863] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 553.578183][ T5863] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 553.614173][ T5863] usb 3-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 553.647115][ T5863] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 553.689674][ T5863] usb 3-1: Product: syz [ 553.697263][T10763] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 553.706989][ T5863] usb 3-1: Manufacturer: syz [ 553.719838][ T5863] usb 3-1: SerialNumber: syz [ 553.746814][ T5863] usb 3-1: config 0 descriptor?? [ 554.030659][ T5837] usb 3-1: USB disconnect, device number 20 [ 557.643308][T10770] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1413'. [ 558.742631][T10800] fuse: Unknown parameter 'group_id00000000000000000000' [ 559.028034][T10806] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1423'. [ 560.407033][T10830] fuse: Unknown parameter 'group_id00000000000000000000' [ 560.428860][T10831] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1433'. [ 561.569926][T10857] fuse: Bad value for 'user_id' [ 562.571978][T10870] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 563.247554][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.254483][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.782272][T10889] fuse: Bad value for 'user_id' [ 564.041381][ T5837] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 564.273558][ T5837] usb 3-1: Using ep0 maxpacket: 32 [ 564.350836][ T5837] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 564.411948][ T5837] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 564.562799][ T5837] usb 3-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 564.625976][ T5837] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 564.682494][ T5837] usb 3-1: Product: syz [ 564.700257][ T5837] usb 3-1: Manufacturer: syz [ 564.732491][ T5837] usb 3-1: SerialNumber: syz [ 564.772028][ T5837] usb 3-1: config 0 descriptor?? [ 564.994497][ T5837] usb 3-1: USB disconnect, device number 21 [ 566.046459][T10919] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1462'. [ 566.232078][T10926] fuse: Bad value for 'user_id' [ 567.268587][T10943] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 567.572553][ T5863] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 567.812152][ T5863] usb 6-1: Using ep0 maxpacket: 32 [ 567.862291][ T5863] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 567.925269][ T5863] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x89 has an invalid bInterval 128, changing to 11 [ 568.034343][ T5863] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 568.152664][ T5863] usb 6-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 568.205716][ T5863] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 568.263947][ T5863] usb 6-1: Product: syz [ 568.301810][ T5863] usb 6-1: Manufacturer: syz [ 568.326120][ T5863] usb 6-1: SerialNumber: syz [ 568.382650][ T5863] usb 6-1: config 0 descriptor?? [ 568.712020][ T5863] usb 6-1: USB disconnect, device number 19 [ 568.848791][T10955] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1472'. [ 569.125671][T10957] fuse: Bad value for 'fd' [ 570.143060][T10974] overlayfs: failed to resolve './file2': -2 [ 570.893094][T10980] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1481'. [ 571.296603][T10984] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 571.316807][T10986] fuse: Bad value for 'fd' [ 571.339614][T10984] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 572.823880][T11005] overlayfs: failed to resolve './file2': -2 [ 572.980572][T11010] fuse: Bad value for 'fd' [ 573.731474][ T5863] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 573.740703][T11027] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1501'. [ 573.787144][T11027] netdevsim netdevsim5: loading /lib/firmware/. failed with error -22 [ 573.796664][T11027] netdevsim netdevsim5: Direct firmware load for . failed with error -22 [ 573.806166][T11027] netdevsim netdevsim5: Falling back to sysfs fallback for: . [ 574.491484][ T5863] usb 3-1: Using ep0 maxpacket: 32 [ 574.524469][ T5863] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 574.591393][ T5863] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x89 has an invalid bInterval 128, changing to 11 [ 574.720997][ T5863] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 574.817626][T11035] random: crng reseeded on system resumption [ 574.854998][ T5863] usb 3-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 574.895715][ T5863] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 574.941292][ T5863] usb 3-1: Product: syz [ 574.972175][ T5863] usb 3-1: Manufacturer: syz [ 574.977306][ T5863] usb 3-1: SerialNumber: syz [ 574.983865][T11037] netlink: 'syz.0.1505': attribute type 39 has an invalid length. [ 575.029047][ T5863] usb 3-1: config 0 descriptor?? [ 575.298632][ T5863] usb 3-1: USB disconnect, device number 22 [ 575.881563][ T5863] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 575.890204][T11050] binder: 11049:11050 unknown command 1074553619 [ 575.920475][T11050] binder: 11049:11050 ioctl c0306201 200000004a40 returned -22 [ 576.113423][ T5863] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 576.181403][ T5863] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 576.250090][ T5863] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 253 [ 576.309184][ T5863] usb 4-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 576.349371][ T5863] usb 4-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 576.401583][ T5863] usb 4-1: Manufacturer: syz [ 576.444628][ T5863] usb 4-1: config 0 descriptor?? [ 576.497098][ T5863] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 576.733923][ T5863] usb 4-1: USB disconnect, device number 29 [ 577.221349][ T8] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 577.421433][ T8] usb 3-1: Using ep0 maxpacket: 32 [ 577.450547][ T8] usb 3-1: config 0 contains an unexpected descriptor of type 0x2, skipping [ 577.484700][ T8] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x89 has an invalid bInterval 128, changing to 11 [ 577.541175][ T8] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 577.655555][ T8] usb 3-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 577.701884][ T8] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 577.742817][ T8] usb 3-1: Product: syz [ 577.747713][ T8] usb 3-1: Manufacturer: syz [ 577.781342][ T8] usb 3-1: SerialNumber: syz [ 577.818642][ T8] usb 3-1: config 0 descriptor?? [ 577.895954][T11083] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 577.936720][T11083] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 578.050182][ T8] usb 3-1: USB disconnect, device number 23 [ 578.427558][T11098] random: crng reseeded on system resumption [ 578.743866][T11101] netlink: 'syz.3.1530': attribute type 39 has an invalid length. [ 579.212854][T11106] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 579.265448][T11106] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 579.561474][ T8] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 579.796040][ T8] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 579.853553][ T8] usb 6-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 579.938404][ T8] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 253 [ 580.055906][ T8] usb 6-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 580.128037][ T8] usb 6-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 580.187779][ T5777] ffs_data_put(): freeing [ 580.192889][ T8] usb 6-1: Manufacturer: syz [ 580.233614][ T8] usb 6-1: config 0 descriptor?? [ 580.295221][ T8] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 580.499314][ T5779] usb 6-1: USB disconnect, device number 20 [ 580.651144][ T5837] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 580.851596][ T5837] usb 4-1: Using ep0 maxpacket: 16 [ 580.875245][ T5837] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 580.903822][ T5837] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 580.962077][ T5837] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 580.993921][ T5837] usb 4-1: config 0 descriptor?? [ 581.253838][ T5779] usb 4-1: USB disconnect, device number 30 [ 582.816316][T11171] random: crng reseeded on system resumption [ 584.441348][ T5779] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 584.451595][T11192] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 584.501125][T11192] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 584.685584][ T5779] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 584.720161][ T5779] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 584.767480][ T5779] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 253 [ 584.835380][ T5779] usb 4-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 584.876078][ T5779] usb 4-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 584.914018][ T5779] usb 4-1: Manufacturer: syz [ 584.945394][ T5779] usb 4-1: config 0 descriptor?? [ 584.973967][ T5779] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 585.189169][ T5779] usb 4-1: USB disconnect, device number 31 [ 587.064828][T11225] netlink: 'syz.0.1578': attribute type 39 has an invalid length. [ 587.588409][T11238] input: syz1 as /devices/virtual/input/input60 [ 588.046469][T11245] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1587'. [ 592.823948][T11292] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 592.874296][T11292] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 593.077623][T11300] netlink: 'syz.2.1601': attribute type 39 has an invalid length. [ 594.192291][T11317] block device autoloading is deprecated and will be removed. [ 598.390285][T11333] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1610'. [ 599.502601][T11353] 9pnet_fd: Insufficient options for proto=fd [ 599.821502][ T5779] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 600.047514][ T5779] usb 3-1: config 1 has an invalid interface descriptor of length 4, skipping [ 600.712471][ T5779] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 600.797235][ T5779] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 600.901807][ T5779] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 4416, setting to 1024 [ 601.002618][ T5779] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 601.078622][ T5779] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 601.391839][ T5775] ffs_data_put(): freeing [ 601.396876][ T5779] usb 3-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 601.469418][ T5779] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 601.554404][T11353] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 601.609423][T11353] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 601.650329][T11377] 9pnet_fd: Insufficient options for proto=fd [ 601.690605][ T5779] keyspan 3-1:1.0: Keyspan 2 port adapter converter detected [ 601.766349][ T5779] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 84 [ 601.829849][ T5779] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 2 [ 601.895970][ T5779] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 601.970568][ T5779] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 88 [ 601.992120][ T5863] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 602.018715][ T5779] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 6 [ 602.071522][ T5779] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 602.213584][ T5863] usb 4-1: config 1 has an invalid interface descriptor of length 4, skipping [ 602.257482][ T5863] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 602.271334][ T5779] usb 3-1: USB disconnect, device number 24 [ 602.310327][ T5779] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 602.324622][ T5863] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 602.360837][ T5779] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 602.377187][ T5863] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 4416, setting to 1024 [ 602.425630][ T5863] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 602.442531][ T5779] keyspan 3-1:1.0: device disconnected [ 602.475605][ T5863] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 602.528339][ T5863] usb 4-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 602.553566][ T5863] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 602.591100][T11377] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 602.601160][T11377] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 602.634456][ T5863] keyspan 4-1:1.0: Keyspan 2 port adapter converter detected [ 602.682397][ T5863] keyspan 4-1:1.0: found no endpoint descriptor for endpoint 84 [ 602.712610][ T5863] keyspan 4-1:1.0: found no endpoint descriptor for endpoint 2 [ 602.772808][ T5863] usb 4-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 602.856193][ T5863] keyspan 4-1:1.0: found no endpoint descriptor for endpoint 88 [ 602.924604][T11381] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1628'. [ 602.936759][ T5863] keyspan 4-1:1.0: found no endpoint descriptor for endpoint 6 [ 603.001848][ T5863] usb 4-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 603.421806][ T5863] usb 4-1: USB disconnect, device number 32 [ 603.470252][ T5863] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 603.552928][ T5863] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 603.623500][ T5863] keyspan 4-1:1.0: device disconnected [ 606.041322][ T5084] Bluetooth: hci0: command 0x0406 tx timeout [ 607.175051][T11399] input: syz0 as /devices/virtual/input/input61 [ 607.503006][ T6854] ffs_data_put(): freeing [ 610.181795][ T5774] ffs_data_put(): freeing [ 612.042442][ T5782] Bluetooth: hci0: command 0x0406 tx timeout [ 612.575823][ T5775] ffs_data_put(): freeing [ 614.553428][T11479] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 615.055415][ T6854] ffs_data_put(): freeing [ 616.730983][ T5777] ffs_data_put(): freeing [ 616.989343][T11522] random: crng reseeded on system resumption [ 617.847680][T11530] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 618.351986][ T5779] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 618.568471][ T5779] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 618.600302][ T5779] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 618.651389][ T5779] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 253 [ 618.713035][ T5779] usb 4-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 618.743667][ T5779] usb 4-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 618.796473][ T5779] usb 4-1: Manufacturer: syz [ 618.818869][ T5779] usb 4-1: config 0 descriptor?? [ 618.865090][ T5779] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 619.012045][ T6854] ffs_data_put(): freeing [ 619.107209][ T5779] usb 4-1: USB disconnect, device number 33 [ 623.525851][ T6854] ffs_data_put(): freeing [ 624.029510][T11580] overlayfs: failed to resolve './file1': -2 [ 624.350369][T11591] random: crng reseeded on system resumption [ 624.696416][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.707751][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 625.009287][T11601] fuse: Bad value for 'fd' [ 625.341693][ T5774] ffs_data_put(): freeing [ 625.373778][ T5779] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 625.599726][ T5779] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 625.655845][ T5779] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 625.714314][ T5779] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 253 [ 625.739595][ T5084] Bluetooth: hci0: command 0x0406 tx timeout [ 625.813397][ T5779] usb 4-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 625.858022][ T5779] usb 4-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 625.912769][ T5779] usb 4-1: Manufacturer: syz [ 625.952049][ T5779] usb 4-1: config 0 descriptor?? [ 625.999252][ T5779] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 626.230753][ T5779] usb 4-1: USB disconnect, device number 34 [ 626.409533][T11630] overlayfs: missing 'workdir' [ 626.942401][ T5779] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 627.273968][T11641] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 627.381842][ T5779] usb 3-1: Using ep0 maxpacket: 16 [ 627.398750][ T5779] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 627.442099][ T5779] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 627.485907][ T5779] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 627.543077][ T5779] usb 3-1: config 0 descriptor?? [ 627.660902][T11645] fuse: Bad value for 'fd' [ 627.878865][ T5779] usb 3-1: USB disconnect, device number 25 [ 628.046471][T11653] input: syz1 as /devices/virtual/input/input62 [ 628.281871][ T5782] Bluetooth: hci0: command 0x0406 tx timeout [ 628.599376][T11665] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1723'. [ 628.632582][T11665] netdevsim netdevsim5: loading /lib/firmware/. failed with error -22 [ 628.641926][T11665] netdevsim netdevsim5: Direct firmware load for . failed with error -22 [ 628.651336][T11665] netdevsim netdevsim5: Falling back to sysfs fallback for: . [ 629.800429][T11693] input: syz1 as /devices/virtual/input/input63 [ 630.357673][T11702] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 630.431761][T11702] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 630.898136][T11713] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 632.761148][T11736] input: syz1 as /devices/virtual/input/input64 [ 636.752401][T11765] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 640.457975][T11785] input: syz1 as /devices/virtual/input/input65 [ 641.947340][ T4339] Bluetooth: Error in BCSP hdr checksum [ 642.192278][ T6801] Bluetooth: Error in BCSP hdr checksum [ 642.404777][T11816] netlink: 'syz.3.1764': attribute type 1 has an invalid length. [ 643.721409][T11819] Bluetooth: hci4: command 0x1003 tx timeout [ 643.728953][T11819] Bluetooth: hci0: command 0x0406 tx timeout [ 643.736430][ T5782] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 646.359220][T11834] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 646.577774][T11842] random: crng reseeded on system resumption [ 646.670256][T11845] binder: BINDER_SET_CONTEXT_MGR already set [ 646.706247][T11845] binder: 11841:11845 ioctl 4018620d 200000004a80 returned -16 [ 647.268313][T11854] 9pnet_fd: Insufficient options for proto=fd [ 647.584825][ T8] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 648.544593][ T8] usb 3-1: config 1 has an invalid interface descriptor of length 4, skipping [ 650.494186][ T8] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 650.603287][ T8] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 650.685965][T11867] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1778'. [ 650.702766][T11867] netdevsim netdevsim5: loading /lib/firmware/. failed with error -22 [ 650.711947][T11867] netdevsim netdevsim5: Direct firmware load for . failed with error -22 [ 650.722656][T11867] netdevsim netdevsim5: Falling back to sysfs fallback for: . [ 650.735613][ T8] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 4416, setting to 1024 [ 650.831402][ T8] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 650.890394][ T8] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 651.010584][ T8] usb 3-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 651.068834][ T8] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 651.120321][ T8] usb 3-1: can't set config #1, error -71 [ 653.703684][ T8] usb 3-1: USB disconnect, device number 26 [ 657.728036][T11894] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 661.398535][T11917] random: crng reseeded on system resumption [ 664.704972][T11931] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 664.745931][T11931] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 665.505188][T11943] 9pnet_fd: Insufficient options for proto=fd [ 665.543626][T11943] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 665.590065][T11943] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 666.723975][T11956] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 667.170971][T11962] 9pnet_fd: Insufficient options for proto=fd [ 667.345124][T11965] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1807'. [ 667.364137][T11949] bridge0: port 2(bridge_slave_1) entered disabled state [ 667.373118][T11949] bridge0: port 1(bridge_slave_0) entered disabled state [ 667.428327][T11949] bond_slave_0: left promiscuous mode [ 667.435091][T11949] bond_slave_1: left promiscuous mode [ 667.531603][ T5858] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 667.723904][ T5858] usb 4-1: config 1 has an invalid interface descriptor of length 4, skipping [ 667.737568][ T5858] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 667.765923][ T5858] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 667.804052][ T5858] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 4416, setting to 1024 [ 667.839977][ T5858] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 667.871926][ T5858] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 667.888700][T11825] Bluetooth: hci0: command 0x0406 tx timeout [ 667.924862][ T5858] usb 4-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 667.954416][ T5858] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 667.997564][T11962] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 668.020235][T11962] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 668.069048][ T5858] keyspan 4-1:1.0: Keyspan 2 port adapter converter detected [ 668.103112][ T5858] keyspan 4-1:1.0: found no endpoint descriptor for endpoint 84 [ 668.135028][ T5858] keyspan 4-1:1.0: found no endpoint descriptor for endpoint 2 [ 668.175299][ T5858] usb 4-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 668.236399][ T5858] keyspan 4-1:1.0: found no endpoint descriptor for endpoint 88 [ 668.290204][ T5858] keyspan 4-1:1.0: found no endpoint descriptor for endpoint 6 [ 668.332797][ T5858] usb 4-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 668.624738][ T5837] usb 4-1: USB disconnect, device number 35 [ 668.643209][ T5837] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 668.691031][ T5837] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 668.726879][ T5837] keyspan 4-1:1.0: device disconnected [ 669.375836][T11949] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 669.386006][T11949] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 669.397026][T11949] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 669.409163][T11949] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 669.608922][T11965] netdevsim netdevsim5: loading /lib/firmware/. failed with error -22 [ 669.618278][T11965] netdevsim netdevsim5: Direct firmware load for . failed with error -22 [ 669.627688][T11965] netdevsim netdevsim5: Falling back to sysfs fallback for: . [ 669.669802][T11968] netlink: 'syz.3.1808': attribute type 39 has an invalid length. [ 670.061598][T11976] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1811'. [ 670.723957][ T27] audit: type=1800 audit(1786993284.228:148): pid=12001 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.1818" name="bmControls" dev="configfs" ino=33592 res=0 errno=0 [ 670.806085][T12003] netlink: 'syz.5.1818': attribute type 1 has an invalid length. [ 671.368565][T11993] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 671.375866][T11993] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 671.383539][T11993] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 671.392917][T11993] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 672.601571][ T5084] Bluetooth: hci1: command 0x0406 tx timeout [ 673.401367][ T5084] Bluetooth: hci0: command 0x0406 tx timeout [ 673.408139][ T5084] Bluetooth: hci2: command 0x0406 tx timeout [ 673.415323][T11825] Bluetooth: hci3: command 0x0406 tx timeout [ 674.903549][T12031] overlayfs: missing 'workdir' [ 675.111512][ T5858] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 675.173530][ T27] audit: type=1800 audit(1786993288.668:149): pid=12036 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1828" name="bmControls" dev="configfs" ino=33823 res=0 errno=0 [ 675.240661][T12041] netlink: 'syz.0.1828': attribute type 1 has an invalid length. [ 675.337342][ T5858] usb 6-1: Using ep0 maxpacket: 16 [ 675.344583][ T5858] usb 6-1: no configurations [ 675.344597][ T5858] usb 6-1: can't read configurations, error -22 [ 675.491932][ T5858] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 675.691576][ T5858] usb 6-1: Using ep0 maxpacket: 16 [ 675.698604][ T5858] usb 6-1: no configurations [ 675.713747][ T5858] usb 6-1: can't read configurations, error -22 [ 675.742072][ T5858] usb usb6-port1: attempt power cycle [ 676.171349][ T5858] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 679.079740][ T5858] usb 6-1: device descriptor read/8, error -71 [ 679.553699][T12061] md: could not open device unknown-block(0,0). [ 679.600944][T12061] md: md_import_device returned -6 [ 679.649492][ T27] audit: type=1800 audit(1786993293.148:150): pid=12077 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1839" name="bmControls" dev="configfs" ino=33942 res=0 errno=0 [ 679.755702][T12082] netlink: 'syz.2.1839': attribute type 1 has an invalid length. [ 680.641560][ T5858] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 680.841955][ T5858] usb 4-1: Using ep0 maxpacket: 16 [ 680.848787][T12108] block device autoloading is deprecated and will be removed. [ 680.875891][ T5858] usb 4-1: no configurations [ 680.904314][ T5858] usb 4-1: can't read configurations, error -22 [ 681.081511][ T5858] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 684.233602][T12109] Process accounting resumed [ 684.406389][ T9] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 684.477551][ T9] hid-generic 0000:0000:0000.000F: hidraw0: HID v0.00 Device [syz0] on syz0 [ 684.549546][T12128] netlink: 'syz.0.1857': attribute type 39 has an invalid length. [ 684.790621][T12131] fido_id[12131]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 684.824035][ T27] audit: type=1800 audit(1786993298.318:151): pid=12133 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.1858" name="bmControls" dev="configfs" ino=34282 res=0 errno=0 [ 684.889425][T12138] netlink: 'syz.5.1858': attribute type 1 has an invalid length. [ 685.217805][T12143] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 685.305812][T12143] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 686.125755][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 686.132896][ T9] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 686.141833][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.850833][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 689.031510][ T9] usb 4-1: device descriptor read/all, error -71 [ 689.552552][T12157] Process accounting resumed [ 689.642198][T12172] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1870'. [ 689.664393][T12172] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 689.673899][T12172] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 689.683338][T12172] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 689.757626][T12174] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 689.796272][T12174] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 689.835071][ T27] audit: type=1800 audit(1786993303.338:152): pid=12179 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1873" name="bmControls" dev="configfs" ino=34547 res=0 errno=0 [ 689.916601][T12182] netlink: 'syz.3.1873': attribute type 1 has an invalid length. [ 691.051486][ T9] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 691.262706][T12212] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 691.281409][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 691.311005][ T9] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 691.332960][T12212] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 691.362294][ T9] usb 4-1: config 0 has no interfaces? [ 691.391892][ T9] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 691.441901][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 691.503482][ T9] usb 4-1: config 0 descriptor?? [ 691.620381][T12220] socket: no more sockets [ 691.710842][T12220] socket: no more sockets [ 691.716337][ T27] audit: type=1800 audit(1786993305.208:153): pid=12222 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1886" name="bmControls" dev="configfs" ino=34844 res=0 errno=0 [ 691.802476][T12225] netlink: 'syz.2.1886': attribute type 1 has an invalid length. [ 691.867665][ T9] usb 4-1: USB disconnect, device number 40 [ 692.070501][T12232] netlink: 'syz.5.1887': attribute type 1 has an invalid length. [ 692.719755][T12246] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1889'. [ 696.289609][T12272] netlink: 'syz.0.1896': attribute type 39 has an invalid length. [ 696.339249][ T27] audit: type=1800 audit(1786993309.838:154): pid=12275 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.1899" name="bmControls" dev="configfs" ino=35007 res=0 errno=0 [ 696.430703][T12278] netlink: 'syz.5.1899': attribute type 1 has an invalid length. [ 696.645132][T12287] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1901'. [ 696.943986][T12294] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 696.961391][ T5863] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 697.152588][ T5863] usb 4-1: Using ep0 maxpacket: 16 [ 697.160838][ T5863] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 697.172878][ T5863] usb 4-1: config 0 has no interfaces? [ 697.179036][ T5863] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 697.189838][ T5863] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 697.204203][ T5863] usb 4-1: config 0 descriptor?? [ 697.440697][ T5863] usb 4-1: USB disconnect, device number 41 [ 697.790951][T12303] socket: no more sockets [ 697.840819][T12303] socket: no more sockets [ 698.295626][ T27] audit: type=1800 audit(1786993311.798:155): pid=12318 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1911" name="bmControls" dev="configfs" ino=35273 res=0 errno=0 [ 698.376782][T12323] netlink: 'syz.0.1911': attribute type 1 has an invalid length. [ 698.900688][ T5774] ffs_data_put(): freeing [ 699.359081][T12337] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 699.685638][T12342] kAFS: No cell specified [ 700.281527][T11825] Bluetooth: hci0: command 0x0406 tx timeout [ 700.482277][T12346] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 700.537641][T12346] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 701.067152][T12352] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1920'. [ 701.377194][ T27] audit: type=1800 audit(1786993314.878:156): pid=12361 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1922" name="bmControls" dev="configfs" ino=35586 res=0 errno=0 [ 701.466867][T12363] netlink: 'syz.3.1922': attribute type 1 has an invalid length. [ 704.722597][T12378] netlink: 'syz.5.1924': attribute type 39 has an invalid length. [ 708.399623][ T27] audit: type=1800 audit(1786993321.898:157): pid=12401 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1934" name="bmControls" dev="configfs" ino=35786 res=0 errno=0 [ 708.499681][T12405] netlink: 'syz.2.1934': attribute type 1 has an invalid length. [ 708.935674][T12409] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 709.435817][ T27] audit: type=1800 audit(1786993322.928:158): pid=12415 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.1937" name="bmControls" dev="configfs" ino=35818 res=0 errno=0 [ 709.525390][T12419] netlink: 'syz.5.1937': attribute type 1 has an invalid length. [ 709.705457][T12423] netlink: 'syz.2.1938': attribute type 1 has an invalid length. [ 713.022014][T12436] 9pnet_fd: Insufficient options for proto=fd [ 713.351343][ T9] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 716.007422][T12441] smc: net device vlan1 applied user defined pnetid SYZ2 [ 716.083529][ T9] usb 6-1: device descriptor read/all, error -71 [ 716.534777][ T27] audit: type=1800 audit(1786993330.038:159): pid=12454 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1946" name="bmControls" dev="configfs" ino=36041 res=0 errno=0 [ 716.626951][T12460] netlink: 'syz.2.1946': attribute type 1 has an invalid length. [ 717.050809][T12467] binder_alloc: 12465: binder_alloc_buf, no vma [ 717.071780][T12469] netlink: 'syz.0.1949': attribute type 1 has an invalid length. [ 717.941422][ T5837] usb 4-1: new full-speed USB device number 42 using dummy_hcd [ 718.163600][ T5837] usb 4-1: config 0 interface 0 altsetting 255 has an invalid endpoint with address 0xFF, skipping [ 718.217016][ T5837] usb 4-1: config 0 interface 0 has no altsetting 0 [ 718.250023][ T5837] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 718.296371][ T5837] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 718.351399][ T5837] usb 4-1: Product: syz [ 718.356096][ T5837] usb 4-1: Manufacturer: syz [ 718.398873][ T5837] usb 4-1: SerialNumber: syz [ 718.433847][ T27] audit: type=1800 audit(1786993331.938:160): pid=12495 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.1959" name="bmControls" dev="configfs" ino=36217 res=0 errno=0 [ 718.473267][ T5837] usb 4-1: config 0 descriptor?? [ 718.520460][T12497] netlink: 'syz.5.1959': attribute type 1 has an invalid length. [ 718.835233][ T5837] snd-usb-audio: probe of 4-1:0.0 failed with error -22 [ 718.936473][ T5837] usb 4-1: USB disconnect, device number 42 [ 719.030052][T12507] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 719.115076][T12447] udevd[12447]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 719.588963][T12516] socket: no more sockets [ 719.977488][T12521] random: crng reseeded on system resumption [ 720.406753][T12528] 9pnet_fd: Insufficient options for proto=fd [ 721.021278][ T5837] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 721.211273][ T9] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 724.275137][ T27] audit: type=1800 audit(1786993337.778:161): pid=12548 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1974" name="bmControls" dev="configfs" ino=36539 res=0 errno=0 [ 724.332713][T12550] netlink: 'syz.0.1974': attribute type 1 has an invalid length. [ 724.514600][T12556] 9pnet_fd: Insufficient options for proto=fd [ 724.634994][T12560] socket: no more sockets [ 724.892166][ T9] usb 4-1: device descriptor read/64, error -71 [ 725.049652][ T27] audit: type=1800 audit(1786993338.548:162): pid=12567 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1978" name="bmControls" dev="configfs" ino=36589 res=0 errno=0 [ 725.139803][T12570] netlink: 'syz.0.1978': attribute type 1 has an invalid length. [ 725.191809][ T9] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 725.433716][ T9] usb 4-1: config 1 has an invalid interface descriptor of length 4, skipping [ 725.452582][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 725.487163][ T9] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 725.509043][ T9] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 4416, setting to 1024 [ 725.521816][ T9] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 725.534257][ T9] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 725.549081][ T9] usb 4-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 725.559727][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 725.577749][T12556] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 725.597294][T12556] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 725.617061][ T9] keyspan 4-1:1.0: Keyspan 2 port adapter converter detected [ 725.632259][ T9] keyspan 4-1:1.0: found no endpoint descriptor for endpoint 84 [ 725.641075][ T9] keyspan 4-1:1.0: found no endpoint descriptor for endpoint 2 [ 725.655386][ T9] usb 4-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 725.683471][ T9] keyspan 4-1:1.0: found no endpoint descriptor for endpoint 88 [ 725.708155][ T9] keyspan 4-1:1.0: found no endpoint descriptor for endpoint 6 [ 725.728075][ T9] usb 4-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 725.841405][ T9] usb 4-1: USB disconnect, device number 44 [ 725.855598][ T9] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 725.888342][ T9] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 725.907936][ T9] keyspan 4-1:1.0: device disconnected [ 726.112161][T12583] random: crng reseeded on system resumption [ 726.330996][T12586] 9pnet_fd: Insufficient options for proto=fd [ 726.864119][T12593] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 727.031309][ T5837] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 727.039829][ T9] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 727.533667][ T5837] usb 3-1: config 1 has an invalid interface descriptor of length 4, skipping [ 727.800293][ T9] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 729.954911][ T5837] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 729.987356][ T9] usb 6-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 730.088885][ T5837] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 730.134542][ T9] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 253 [ 730.223395][ T5837] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 4416, setting to 1024 [ 730.303425][ T9] usb 6-1: string descriptor 0 read error: -71 [ 730.310335][ T9] usb 6-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 730.371721][ T5837] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 730.440270][ T9] usb 6-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 730.453415][ T5837] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 730.550965][ T9] usb 6-1: config 0 descriptor?? [ 730.593549][ T5837] usb 3-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 730.616100][ T9] usb 6-1: can't set config #0, error -71 [ 730.673457][ T5837] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 730.684695][ T9] usb 6-1: USB disconnect, device number 28 [ 730.752397][ T5837] usb 3-1: can't set config #1, error -71 [ 730.812862][ T5837] usb 3-1: USB disconnect, device number 27 [ 731.004382][T12609] md: could not open device unknown-block(0,0). [ 731.018399][T12609] md: md_import_device returned -6 [ 731.356436][T12621] 9pnet_fd: Insufficient options for proto=fd [ 731.661391][ T5837] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 731.844447][T12630] 9pnet_fd: Insufficient options for proto=fd [ 731.873961][ T5837] usb 3-1: config 1 has an invalid interface descriptor of length 4, skipping [ 731.899855][ T5837] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 731.930875][ T5837] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 731.959134][ T5837] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 4416, setting to 1024 [ 731.978640][T12632] random: crng reseeded on system resumption [ 731.989196][ T5837] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 732.020104][ T5837] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 732.059617][ T5837] usb 3-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 732.087194][ T5837] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 732.119947][T12621] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 732.128093][ T9] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 732.152668][T12621] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 732.186703][ T5837] keyspan 3-1:1.0: Keyspan 2 port adapter converter detected [ 732.219213][ T5837] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 84 [ 732.244856][ T5837] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 2 [ 732.277165][ T5837] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 732.336418][ T9] usb 4-1: config 1 has an invalid interface descriptor of length 4, skipping [ 732.353099][ T5837] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 88 [ 732.396463][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 732.433310][ T5837] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 6 [ 732.473278][ T9] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 732.492071][ T5837] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 732.531531][ T9] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 4416, setting to 1024 [ 733.661790][ T5837] usb 3-1: USB disconnect, device number 28 [ 735.334465][ T9] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 735.365179][ T5837] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 735.454186][ T9] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 735.502665][ T5837] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 735.599968][ T9] usb 4-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 735.612927][ T5837] keyspan 3-1:1.0: device disconnected [ 735.698806][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 735.763855][ T9] usb 4-1: can't set config #1, error -71 [ 735.793690][ T9] usb 4-1: USB disconnect, device number 45 [ 736.935285][T12658] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 739.829251][T12674] fuse: Unknown parameter 'group_id00000000000000000000' [ 739.984022][ T5774] ffs_data_put(): freeing [ 740.208149][T12681] netdevsim netdevsim0: loading /lib/firmware/. failed with error -22 [ 740.217624][T12681] netdevsim netdevsim0: Direct firmware load for . failed with error -22 [ 740.227743][T12681] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 740.767628][T12690] random: crng reseeded on system resumption [ 741.353685][ T5837] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 741.418400][ T6854] ffs_data_put(): freeing [ 741.554255][ T5837] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 744.273264][ T5837] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 744.412133][ T5837] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 253 [ 744.545488][ T5837] usb 4-1: string descriptor 0 read error: -71 [ 744.590541][ T5837] usb 4-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 744.861954][ T5837] usb 4-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 744.950740][ T5837] usb 4-1: config 0 descriptor?? [ 744.967696][T12715] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 745.000711][ T5837] usb 4-1: can't set config #0, error -71 [ 745.080173][ T5837] usb 4-1: USB disconnect, device number 46 [ 745.102878][T12719] fuse: Unknown parameter 'group_id00000000000000000000' [ 745.400869][T12727] netdevsim netdevsim0: loading /lib/firmware/. failed with error -22 [ 745.410157][T12727] netdevsim netdevsim0: Direct firmware load for . failed with error -22 [ 745.419541][T12727] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 747.133718][T12741] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2034'. [ 747.423970][T12748] fuse: Unknown parameter 'group_id00000000000000000000' [ 747.568264][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.577220][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 748.200927][T12764] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 748.536304][T12766] netdevsim netdevsim5: loading /lib/firmware/. failed with error -22 [ 748.545767][T12766] netdevsim netdevsim5: Direct firmware load for . failed with error -22 [ 748.555199][T12766] netdevsim netdevsim5: Falling back to sysfs fallback for: . [ 748.674090][T12770] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2044'. [ 749.496117][T12785] fuse: Bad value for 'user_id' [ 750.380900][T12800] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2054'. [ 754.440660][T12812] fuse: Bad value for 'user_id' [ 754.649137][T12817] netdevsim netdevsim0: loading /lib/firmware/. failed with error -22 [ 754.659125][T12817] netdevsim netdevsim0: Direct firmware load for . failed with error -22 [ 754.668592][T12817] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 755.044902][T12826] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 755.598978][T12834] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2064'. [ 760.280390][T12862] fuse: Bad value for 'user_id' [ 760.762386][T12868] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2074'. [ 760.938644][T12872] 9pnet_fd: Insufficient options for proto=fd [ 761.245737][ T27] audit: type=1800 audit(1786993374.748:163): pid=12878 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2077" name="bmControls" dev="configfs" ino=38001 res=0 errno=0 [ 761.300540][ T5837] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 761.326518][T12880] netlink: 'syz.3.2077': attribute type 1 has an invalid length. [ 761.556835][ T5837] usb 3-1: config 1 has an invalid interface descriptor of length 4, skipping [ 761.608484][ T5837] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 764.414845][ T5837] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 764.515176][ T5837] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 4416, setting to 1024 [ 764.642329][ T5837] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 764.756639][ T5837] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 764.842230][ T5837] usb 3-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 764.894693][T12900] netdevsim netdevsim5: loading /lib/firmware/. failed with error -22 [ 764.905123][T12900] netdevsim netdevsim5: Direct firmware load for . failed with error -22 [ 764.914500][T12900] netdevsim netdevsim5: Falling back to sysfs fallback for: . [ 764.951871][ T5837] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 764.993948][ T5775] ffs_data_put(): freeing [ 765.014885][ T5837] usb 3-1: can't set config #1, error -71 [ 765.078978][ T5837] usb 3-1: USB disconnect, device number 29 [ 765.533502][T12911] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 766.775040][T12922] 9pnet_fd: Insufficient options for proto=fd [ 767.071382][ T5837] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 767.984181][ T5837] usb 3-1: config 1 has an invalid interface descriptor of length 4, skipping [ 769.889549][ T5837] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 770.006684][ T5837] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 770.085871][ T5837] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 4416, setting to 1024 [ 770.207125][ T5837] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 770.280086][ T5837] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 773.059462][ T27] audit: type=1800 audit(1786993386.558:164): pid=12938 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.2093" name="bmControls" dev="configfs" ino=38332 res=0 errno=0 [ 773.082691][ T5837] usb 3-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 773.131248][T12941] netlink: 'syz.0.2093': attribute type 1 has an invalid length. [ 773.141929][ T5777] ffs_data_put(): freeing [ 773.178310][ T5837] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 773.318435][ T5837] usb 3-1: can't set config #1, error -71 [ 773.410628][ T5837] usb 3-1: USB disconnect, device number 30 [ 773.726663][T12957] fuse: Bad value for 'fd' [ 773.994500][T12962] 9pnet_fd: Insufficient options for proto=fd [ 774.090420][T12964] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 774.281486][ T5837] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 774.504583][ T5837] usb 3-1: config 1 has an invalid interface descriptor of length 4, skipping [ 774.569560][ T5837] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 774.636272][ T5837] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 774.706527][ T5837] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 4416, setting to 1024 [ 774.758902][ T5837] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 774.808530][ T5837] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 774.864670][ T5837] usb 3-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 774.907804][ T5837] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 774.953794][T12962] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 774.979502][T12962] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 775.035433][ T5837] keyspan 3-1:1.0: Keyspan 2 port adapter converter detected [ 775.074857][ T5837] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 84 [ 775.116754][ T5837] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 2 [ 775.167383][ T5837] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 775.228803][ T5837] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 88 [ 775.287790][ T5837] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 6 [ 775.335270][ T5837] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 775.539658][ T5837] usb 3-1: USB disconnect, device number 31 [ 775.594066][ T5837] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 775.658129][ T5837] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 778.313448][ T5837] keyspan 3-1:1.0: device disconnected [ 781.532864][ T5777] ffs_data_put(): freeing [ 782.060513][T12995] fuse: Bad value for 'fd' [ 784.657849][T13010] 9pnet_fd: Insufficient options for proto=fd [ 784.681980][T13011] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2116'. [ 784.754953][T13011] netdevsim netdevsim0: loading /lib/firmware/. failed with error -22 [ 784.783344][T13011] netdevsim netdevsim0: Direct firmware load for . failed with error -22 [ 784.810015][T13011] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 784.971445][ T5858] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 785.751153][ C0] hrtimer: interrupt took 42333 ns [ 787.723560][ T5858] usb 6-1: device descriptor read/all, error -71 [ 788.237313][T13032] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 788.671205][ T5837] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 788.871317][ T5837] usb 4-1: Using ep0 maxpacket: 16 [ 788.895928][ T5837] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 788.936531][ T5837] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 788.995127][ T5837] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 789.036993][ T5837] usb 4-1: config 0 descriptor?? [ 789.306801][ T5837] usb 4-1: USB disconnect, device number 47 [ 789.450479][T13051] fuse: Bad value for 'fd' [ 789.612519][ T27] audit: type=1800 audit(1786993403.108:165): pid=13054 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.2126" name="bmControls" dev="configfs" ino=38904 res=0 errno=0 [ 789.695646][T13056] netlink: 'syz.0.2126': attribute type 1 has an invalid length. [ 790.119045][T13061] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2127'. [ 790.167882][T13061] netdevsim netdevsim0: loading /lib/firmware/. failed with error -22 [ 792.933755][T13061] netdevsim netdevsim0: Direct firmware load for . failed with error -22 [ 793.015315][T13061] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 793.116309][T13069] 9pnet_fd: Insufficient options for proto=fd [ 793.441456][ T5837] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 793.624626][ T5837] usb 3-1: config 1 has an invalid interface descriptor of length 4, skipping [ 793.634798][ T5837] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 793.651733][ T5837] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 793.663217][ T5837] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 4416, setting to 1024 [ 793.677046][ T5837] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 793.688582][ T5837] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 793.706987][ T5837] usb 3-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 793.718679][ T5837] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 793.735355][T13069] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 793.755515][T13069] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 793.771470][ T5837] keyspan 3-1:1.0: Keyspan 2 port adapter converter detected [ 793.784564][ T5837] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 84 [ 793.797189][ T5837] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 2 [ 793.821692][ T5837] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 793.851044][ T5837] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 88 [ 793.863346][ T5837] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 6 [ 793.887772][ T5837] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 794.115862][ T5837] usb 3-1: USB disconnect, device number 32 [ 794.138020][ T5837] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 794.167290][ T5837] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 794.189825][ T5837] keyspan 3-1:1.0: device disconnected [ 794.385420][ T27] audit: type=1800 audit(1786993407.888:166): pid=13085 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2135" name="bmControls" dev="configfs" ino=39019 res=0 errno=0 [ 794.470382][T13087] netlink: 'syz.3.2135': attribute type 1 has an invalid length. [ 795.513129][ T5837] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 797.832125][ T27] audit: type=1800 audit(1786993411.328:167): pid=13105 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2139" name="bmControls" dev="configfs" ino=39206 res=0 errno=0 [ 798.092548][ T5837] usb 6-1: device not accepting address 31, error -71 [ 798.263593][T13116] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 799.361802][T13127] 9pnet_fd: Insufficient options for proto=fd [ 799.671293][ T5837] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 804.841582][ T5837] usb 4-1: device descriptor read/all, error -71 [ 805.628690][T13155] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2152'. [ 806.261814][T13172] 9pnet_fd: Insufficient options for proto=fd [ 806.287693][T13172] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 806.322310][T13172] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 807.161867][ T5084] Bluetooth: hci0: command 0x0406 tx timeout [ 807.733870][T13192] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2163'. [ 807.760534][T13196] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 809.006295][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 809.013533][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 809.358108][T13214] 9pnet_fd: Insufficient options for proto=fd [ 809.661241][ T5837] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 809.876556][ T5837] usb 6-1: config 1 has an invalid interface descriptor of length 4, skipping [ 809.929579][ T5837] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 810.006467][ T5837] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 810.060862][ T5837] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 4416, setting to 1024 [ 810.111930][ T5837] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 810.155776][ T5837] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 810.214788][ T5837] usb 6-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 810.270580][ T5837] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 810.315402][T13214] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 810.342459][T13214] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 810.363136][T13235] No source specified [ 810.393317][ T5837] keyspan 6-1:1.0: Keyspan 2 port adapter converter detected [ 810.442253][ T5837] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 84 [ 810.484822][ T5837] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 2 [ 810.536509][ T5837] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 810.606639][ T5837] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 88 [ 810.665116][ T5837] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 6 [ 810.706756][ T5837] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 810.761441][T11825] Bluetooth: hci0: command 0x0406 tx timeout [ 810.841078][ T5837] usb 6-1: USB disconnect, device number 33 [ 810.876461][ T5837] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 810.909285][ T5837] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 810.927904][ T5837] keyspan 6-1:1.0: device disconnected [ 811.455597][T13248] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 813.182758][T13276] No source specified [ 813.801625][ T5084] Bluetooth: hci0: command 0x0406 tx timeout [ 814.016523][T13295] 9pnet_fd: Insufficient options for proto=fd [ 814.239661][T13301] No source specified [ 814.342503][ T5858] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 814.564011][ T5858] usb 4-1: config 1 has an invalid interface descriptor of length 4, skipping [ 814.608695][ T5858] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 814.677271][ T5858] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 814.957332][ T5858] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 4416, setting to 1024 [ 815.000359][ T5858] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 815.076058][T13317] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 815.092563][ T5858] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 815.192148][ T5858] usb 4-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 815.258398][ T5858] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 815.331315][T13295] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 815.376421][T13295] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 815.440419][ T5858] keyspan 4-1:1.0: Keyspan 2 port adapter converter detected [ 815.517261][ T5858] keyspan 4-1:1.0: found no endpoint descriptor for endpoint 84 [ 815.568487][ T5858] keyspan 4-1:1.0: found no endpoint descriptor for endpoint 2 [ 815.649328][ T5858] usb 4-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 815.757274][ T5858] keyspan 4-1:1.0: found no endpoint descriptor for endpoint 88 [ 815.852225][ T5858] keyspan 4-1:1.0: found no endpoint descriptor for endpoint 6 [ 815.944564][ T5858] usb 4-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 816.121446][T11825] Bluetooth: hci0: command 0x0406 tx timeout [ 816.386703][ T5858] usb 4-1: USB disconnect, device number 50 [ 816.418977][ T5858] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 816.473783][ T5858] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 816.510352][ T5858] keyspan 4-1:1.0: device disconnected [ 822.421611][T13389] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 822.681611][ T5084] Bluetooth: hci0: command 0x0406 tx timeout [ 826.723199][T13407] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2217'. [ 826.740043][T13407] netdevsim netdevsim5: loading /lib/firmware/. failed with error -22 [ 826.750149][T13407] netdevsim netdevsim5: Direct firmware load for . failed with error -22 [ 826.759556][T13407] netdevsim netdevsim5: Falling back to sysfs fallback for: . [ 828.841487][ T5084] Bluetooth: hci0: command 0x0406 tx timeout [ 830.390639][T13431] fuse: Unknown parameter 'user_i00000000000000000000' [ 834.778354][T13466] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2230'. [ 834.803652][T13466] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 834.813132][T13466] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 834.822831][T13466] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 835.119428][T13472] fuse: Unknown parameter 'user_id00000000000000000000' [ 835.993496][T13493] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 836.169203][T13496] 9pnet_fd: Insufficient options for proto=fd [ 836.194320][T13496] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 836.224562][T13496] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 837.161294][T11825] Bluetooth: hci0: command 0x0406 tx timeout [ 839.942224][T13511] fuse: Unknown parameter 'user_id00000000000000000000' [ 843.495475][ T27] audit: type=1800 audit(1786993456.998:168): pid=13530 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2249" name="bmControls" dev="configfs" ino=41200 res=0 errno=0 [ 847.990474][T13552] 9pnet_fd: Insufficient options for proto=fd [ 848.212156][ T5084] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 848.224696][ T5084] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 848.234451][ T5084] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 848.252016][ T5084] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 848.261961][ T5084] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 848.274429][ T5084] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 848.317514][ T5863] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 848.583434][ T5863] usb 6-1: config 1 has an invalid interface descriptor of length 4, skipping [ 848.629656][ T5863] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 848.704975][ T5863] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 848.757245][ T5863] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 4416, setting to 1024 [ 848.811254][ T5863] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 848.856659][ T5863] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 848.922081][ T5863] usb 6-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 848.961211][ T5863] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 849.014388][T13552] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 849.066049][T13552] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 849.115313][ T5863] keyspan 6-1:1.0: Keyspan 2 port adapter converter detected [ 849.156491][ T5863] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 84 [ 849.201619][ T5863] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 2 [ 849.243306][ T5863] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 849.310410][ T5863] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 88 [ 849.353074][ T5863] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 6 [ 849.385016][ T5863] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 849.517600][T13572] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 850.361487][ T5084] Bluetooth: hci1: command tx timeout [ 852.329306][ T5858] usb 6-1: USB disconnect, device number 34 [ 852.393391][ T5858] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 852.442292][ T5084] Bluetooth: hci1: command tx timeout [ 852.510874][ T5858] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 852.616063][ T5858] keyspan 6-1:1.0: device disconnected [ 852.746508][T13559] chnl_net:caif_netlink_parms(): no params data found [ 852.767483][T13585] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2259'. [ 852.819123][T13585] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 852.828610][T13585] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 852.837997][T13585] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 853.112188][T13559] bridge0: port 1(bridge_slave_0) entered blocking state [ 853.133720][T13559] bridge0: port 1(bridge_slave_0) entered disabled state [ 853.158491][T13559] bridge_slave_0: entered allmulticast mode [ 853.182478][T13559] bridge_slave_0: entered promiscuous mode [ 854.521182][ T5084] Bluetooth: hci1: command tx timeout [ 855.876205][T13559] bridge0: port 2(bridge_slave_1) entered blocking state [ 856.541720][T13559] bridge0: port 2(bridge_slave_1) entered disabled state [ 856.591689][T13559] bridge_slave_1: entered allmulticast mode [ 856.608900][ T5084] Bluetooth: hci1: command tx timeout [ 856.651358][T13559] bridge_slave_1: entered promiscuous mode [ 856.897360][T13606] 9pnet_fd: Insufficient options for proto=fd [ 856.907969][T13559] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 857.005736][T13559] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 857.160670][T13559] team0: Port device team_slave_0 added [ 857.214395][T13559] team0: Port device team_slave_1 added [ 857.222473][ T5858] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 857.595205][ T5858] usb 4-1: config 1 has an invalid interface descriptor of length 4, skipping [ 859.845544][ T5858] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 859.941959][ T5858] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 860.135640][ T5858] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 4416, setting to 1024 [ 860.196172][T13559] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 860.214068][ T5858] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 860.247329][T13559] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 860.290289][ T5858] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 862.728213][ T5858] usb 4-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 863.064320][T13559] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 863.077077][ T5858] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 863.138163][ T5858] usb 4-1: can't set config #1, error -71 [ 863.148129][T13559] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 863.194996][ T5858] usb 4-1: USB disconnect, device number 51 [ 863.213865][T13559] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 863.318914][T13559] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 863.613745][T13559] hsr_slave_0: entered promiscuous mode [ 863.645683][T13559] hsr_slave_1: entered promiscuous mode [ 863.676797][T13559] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 863.707107][T13635] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2272'. [ 863.731584][T13559] Cannot create hsr debugfs directory [ 863.751272][T13635] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 863.760380][T13635] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 863.769851][T13635] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 864.153965][T13640] binder: 13639:13640 ioctl c0306201 200000000180 returned -11 [ 866.531892][T13559] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 866.575772][T13559] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 866.650208][T13644] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2275'. [ 866.932329][T13559] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 866.976707][T13559] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 867.026949][T13647] sch_tbf: burst 19872 is lower than device lo mtu (65505) ! [ 867.270213][T13662] 9pnet_fd: Insufficient options for proto=fd [ 867.545743][T13559] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 867.577605][T13559] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 867.772270][ T5858] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 867.996808][ T5858] usb 6-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 868.027287][ T5858] usb 6-1: config 255 has 0 interfaces, different from the descriptor's value: 1 [ 868.046778][ T5858] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 868.066151][ T5858] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 868.706384][T13674] comedi comedi3: comedi_config --init_data is deprecated [ 869.970490][T13559] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 870.002558][T13559] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 870.050063][T13676] netlink: 'syz.3.2283': attribute type 4 has an invalid length. [ 870.125722][T13676] netlink: 'syz.3.2283': attribute type 4 has an invalid length. [ 870.241567][T13679] binder: 13678:13679 ioctl c0306201 200000000180 returned -11 [ 870.458439][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.466899][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.498521][T13559] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 870.526897][ T5863] usb 6-1: USB disconnect, device number 35 [ 870.823801][T13559] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 873.138591][T13559] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 873.196740][T13559] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 873.320349][T13691] device-mapper: ioctl: Invalid ioctl structure: name è, dev f801 [ 873.433837][T13694] 9pnet_fd: Insufficient options for proto=fd [ 873.761445][T13559] 8021q: adding VLAN 0 to HW filter on device bond0 [ 873.787433][ T27] audit: type=1800 audit(1786993486.281:169): pid=13700 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2292" name="bmControls" dev="configfs" ino=42068 res=0 errno=0 [ 873.886726][T13559] 8021q: adding VLAN 0 to HW filter on device team0 [ 873.956450][T13707] binder_alloc: 13705: binder_alloc_buf, no vma [ 873.976897][ T6688] bridge0: port 1(bridge_slave_0) entered blocking state [ 873.984774][ T6688] bridge0: port 1(bridge_slave_0) entered forwarding state [ 874.119990][ T6688] bridge0: port 2(bridge_slave_1) entered blocking state [ 874.128746][ T6688] bridge0: port 2(bridge_slave_1) entered forwarding state [ 874.677343][ T5084] Bluetooth: hci2: unexpected event for opcode 0x202f [ 875.332708][T13559] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 875.607374][T13559] veth0_vlan: entered promiscuous mode [ 875.706770][T13559] veth1_vlan: entered promiscuous mode [ 875.888685][T13559] veth0_macvtap: entered promiscuous mode [ 875.979259][T13559] veth1_macvtap: entered promiscuous mode [ 876.107426][T13559] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 876.219596][T13559] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 876.296138][T13559] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 876.365922][T13559] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 876.434025][T13559] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 876.501339][T13559] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 876.914812][T13734] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 876.983410][ T6790] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 877.059150][ T6790] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 877.247279][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 877.319249][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 878.101472][T13744] netlink: 'syz.3.2301': attribute type 4 has an invalid length. [ 878.624020][T13749] netlink: 'syz.3.2303': attribute type 39 has an invalid length. [ 878.717274][ T27] audit: type=1800 audit(1786993491.211:170): pid=13752 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2304" name="bmControls" dev="configfs" ino=43249 res=0 errno=0 [ 879.583672][T13767] batadv_slave_0: entered promiscuous mode [ 879.642408][T13767] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2306'. [ 880.382292][T13761] batadv_slave_0: left promiscuous mode [ 880.790122][ T27] audit: type=1800 audit(1786993493.281:171): pid=13792 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2315" name="bmControls" dev="configfs" ino=43546 res=0 errno=0 [ 881.789525][T13808] netlink: 'syz.0.2318': attribute type 39 has an invalid length. [ 882.228642][T13811] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 882.284971][T13811] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 884.884469][T13811] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 884.954715][T13828] binder: BINDER_SET_CONTEXT_MGR already set [ 884.987848][T13811] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 885.017306][T13828] binder: 13826:13828 ioctl 4018620d 200000004a80 returned -16 [ 885.896453][ T27] audit: type=1800 audit(1786993498.391:172): pid=13844 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2327" name="bmControls" dev="configfs" ino=43804 res=0 errno=0 [ 886.753442][T13868] binder: 13867:13868 ioctl c0306201 200000000180 returned -11 [ 886.781380][ T5084] Bluetooth: hci0: unexpected event for opcode 0x202f [ 886.976965][T13874] netlink: 'syz.5.2335': attribute type 4 has an invalid length. [ 887.641325][ T5084] Bluetooth: hci3: command 0x0406 tx timeout [ 891.420744][T13905] binder: 13903:13905 ioctl c0306201 200000000180 returned -11 [ 891.920600][ T27] audit: type=1800 audit(1786993504.401:173): pid=13917 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.2347" name="bmControls" dev="configfs" ino=44258 res=0 errno=0 [ 892.024127][T13921] netlink: 'syz.0.2347': attribute type 1 has an invalid length. [ 896.021265][ T5858] usb 1-1: USB disconnect, device number 15 [ 896.252424][T13954] syzkaller0: entered promiscuous mode [ 896.320852][T13954] syzkaller0: entered allmulticast mode [ 896.411824][T13959] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2352'. [ 896.487340][T13959] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2352'. [ 896.540291][ T5858] cdc_eem 1-1:1.1 usb1: unregister 'cdc_eem' usb-dummy_hcd.0-1, CDC EEM Device [ 896.593836][T13965] binder: 13964:13965 ioctl c0306201 200000000180 returned -11 [ 896.938962][ T27] audit: type=1800 audit(1786993509.431:174): pid=13979 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2357" name="bmControls" dev="configfs" ino=44507 res=0 errno=0 [ 899.212124][ T5858] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 899.354157][T14000] netlink: 'syz.3.2361': attribute type 4 has an invalid length. [ 899.506736][ T27] audit: type=1800 audit(1786993512.001:175): pid=14004 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.2362" name="bmControls" dev="configfs" ino=44558 res=0 errno=0 [ 899.572710][ T5858] usb 1-1: Dual-Role OTG device on HNP port [ 899.593567][T14007] netlink: 'syz.0.2362': attribute type 1 has an invalid length. [ 899.630193][ T5858] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 6.06 [ 899.705210][ T5858] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 899.764686][ T5858] usb 1-1: Product: Product [ 899.805108][ T5858] usb 1-1: SerialNumber: 1234567890 [ 899.908020][ T5858] usb-storage 1-1:1.0: USB Mass Storage device detected [ 900.061226][ T5858] scsi host1: usb-storage 1-1:1.0 [ 900.207346][ T5858] cdc_eem 1-1:1.1 usb1: register 'cdc_eem' at usb-dummy_hcd.0-1, CDC EEM Device, da:57:2b:14:18:ae [ 900.936914][T14042] futex_wake_op: syz.0.2370 tries to shift op by 144; fix this program [ 901.023346][T14044] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 901.167327][ T59] scsi 1:0:0:0: CD-ROM Linux File-CD Gadget 0606 PQ: 0 ANSI: 2 [ 901.268493][T14025] sr 1:0:0:0: Power-on or device reset occurred [ 901.325094][ T59] sr 1:0:0:0: [sr0] scsi-1 drive [ 901.563637][ T59] sr 1:0:0:0: Attached scsi generic sg1 type 5 [ 904.030025][T14063] netlink: 'syz.5.2372': attribute type 4 has an invalid length. [ 904.080284][T11825] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 904.098897][T11825] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 904.108902][T11825] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 904.118073][T11825] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 904.126599][T11825] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 904.136804][T11825] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 906.201535][T11825] Bluetooth: hci4: command tx timeout [ 907.598946][T14064] chnl_net:caif_netlink_parms(): no params data found [ 908.128045][T14064] bridge0: port 1(bridge_slave_0) entered blocking state [ 908.162434][T14064] bridge0: port 1(bridge_slave_0) entered disabled state [ 908.195831][T14064] bridge_slave_0: entered allmulticast mode [ 908.239267][T14064] bridge_slave_0: entered promiscuous mode [ 908.281697][T11825] Bluetooth: hci4: command tx timeout [ 908.289608][T14064] bridge0: port 2(bridge_slave_1) entered blocking state [ 908.333224][T14064] bridge0: port 2(bridge_slave_1) entered disabled state [ 908.373897][T14064] bridge_slave_1: entered allmulticast mode [ 908.405825][T14064] bridge_slave_1: entered promiscuous mode [ 908.546675][T14064] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 908.606837][T14064] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 908.790123][T14064] team0: Port device team_slave_0 added [ 908.876114][T14064] team0: Port device team_slave_1 added [ 910.309527][T14064] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 910.361339][T11825] Bluetooth: hci4: command tx timeout [ 911.470050][T14064] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 911.631168][T14064] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 911.882213][T14064] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 911.913270][T14064] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 913.553524][T11825] Bluetooth: hci4: command tx timeout [ 913.682656][T14064] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 913.732191][T14167] netlink: 'syz.3.2381': attribute type 4 has an invalid length. [ 913.976970][T14064] hsr_slave_0: entered promiscuous mode [ 914.024683][T14064] hsr_slave_1: entered promiscuous mode [ 914.060733][T14064] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 914.098091][T14064] Cannot create hsr debugfs directory [ 914.940403][T14200] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 915.442686][T14064] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 915.483043][T14064] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 915.540461][T14064] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 915.593160][T14064] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 915.907151][T14064] 8021q: adding VLAN 0 to HW filter on device bond0 [ 916.005811][T14064] 8021q: adding VLAN 0 to HW filter on device team0 [ 916.049042][T14152] bridge0: port 1(bridge_slave_0) entered blocking state [ 916.056962][T14152] bridge0: port 1(bridge_slave_0) entered forwarding state [ 916.135085][T14152] bridge0: port 2(bridge_slave_1) entered blocking state [ 916.142995][T14152] bridge0: port 2(bridge_slave_1) entered forwarding state [ 916.956352][T14064] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 918.833025][T14241] netlink: 'syz.0.2391': attribute type 4 has an invalid length. [ 920.748145][T14064] veth0_vlan: entered promiscuous mode [ 920.932348][T14064] veth1_vlan: entered promiscuous mode [ 921.129118][T14064] veth0_macvtap: entered promiscuous mode [ 921.201024][T14064] veth1_macvtap: entered promiscuous mode [ 921.308372][T14064] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 921.382802][T14064] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 921.445479][T14064] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 921.510636][T14064] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 921.564217][T14064] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 921.614616][T14064] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 921.627221][ T27] audit: type=1800 audit(1786993533.131:176): pid=14280 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.2400" name="bmControls" dev="configfs" ino=45909 res=0 errno=0 [ 922.059605][ T6801] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 922.124745][ T6801] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 922.271884][T14152] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 922.280627][T14152] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 922.506406][T14298] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 922.626223][T14302] binder: 14300:14302 ioctl c0306201 200000000180 returned -11 [ 923.082316][T11825] Bluetooth: hci1: command tx timeout [ 924.006412][ T5863] usb 3-1: new full-speed USB device number 33 using dummy_hcd [ 924.194544][ T5084] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 924.208900][ T5084] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 924.218451][ T5084] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 924.233257][ T5084] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 924.242195][ T5084] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 924.250096][ T5084] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 924.276105][ T5863] usb 3-1: config 0 interface 0 altsetting 255 endpoint 0x4 has an invalid bInterval 0, changing to 10 [ 924.347444][ T5863] usb 3-1: config 0 interface 0 has no altsetting 0 [ 924.381204][ T5863] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 924.434558][ T5863] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 924.483049][ T5863] usb 3-1: Product: syz [ 924.509857][ T5863] usb 3-1: Manufacturer: syz [ 924.530302][ T5863] usb 3-1: SerialNumber: syz [ 924.566433][ T5863] usb 3-1: config 0 descriptor?? [ 924.618243][ T5863] usb 3-1: selecting invalid altsetting 0 [ 925.082627][ T5084] Bluetooth: hci4: command tx timeout [ 925.234014][ T27] audit: type=1800 audit(1786993536.731:177): pid=14349 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.2410" name="bmControls" dev="configfs" ino=46474 res=0 errno=0 [ 925.323678][ T3479] tipc: Disabling bearer [ 925.355066][ T3479] tipc: Left network mode [ 925.403281][T14331] chnl_net:caif_netlink_parms(): no params data found [ 926.044618][T14331] bridge0: port 1(bridge_slave_0) entered blocking state [ 926.075870][T14331] bridge0: port 1(bridge_slave_0) entered disabled state [ 926.106770][T14331] bridge_slave_0: entered allmulticast mode [ 926.137734][T14331] bridge_slave_0: entered promiscuous mode [ 926.210936][T14331] bridge0: port 2(bridge_slave_1) entered blocking state [ 926.247111][T14331] bridge0: port 2(bridge_slave_1) entered disabled state [ 926.282041][ T5084] Bluetooth: hci2: command tx timeout [ 926.290589][T14331] bridge_slave_1: entered allmulticast mode [ 926.330537][T14331] bridge_slave_1: entered promiscuous mode [ 926.588134][T14331] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 926.682965][T14331] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 926.763515][ T5863] usb 3-1: USB disconnect, device number 33 [ 927.280733][T14331] team0: Port device team_slave_0 added [ 927.334091][T14331] team0: Port device team_slave_1 added [ 927.653472][ T27] audit: type=1800 audit(1786993539.141:178): pid=14405 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2418" name="bmControls" dev="configfs" ino=46674 res=0 errno=0 [ 927.770098][T14331] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 927.817975][T14331] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 927.993914][T14331] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 928.079721][T14384] usb usb8: usbfs: interface 0 claimed by hub while 'syz.5.2415' resets device [ 928.362252][ T5084] Bluetooth: hci2: command tx timeout [ 928.642828][T14331] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 928.650525][T14331] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 928.750228][T14331] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 928.839776][ T3479] hsr_slave_0: left promiscuous mode [ 928.867742][ T3479] hsr_slave_1: left promiscuous mode [ 928.897865][ T3479] bridge_slave_1: left allmulticast mode [ 928.932071][ T3479] bridge_slave_1: left promiscuous mode [ 928.938390][ T3479] bridge0: port 2(bridge_slave_1) entered disabled state [ 929.008205][ T3479] bridge_slave_0: left allmulticast mode [ 929.040909][ T3479] bridge_slave_0: left promiscuous mode [ 929.072357][ T3479] bridge0: port 1(bridge_slave_0) entered disabled state [ 929.088250][ T5084] Bluetooth: hci4: command tx timeout [ 929.167129][ T3479] bond5 (unregistering): Released all slaves [ 929.243724][ T3479] bond4 (unregistering): Released all slaves [ 929.327718][ T3479] bond3 (unregistering): Released all slaves [ 929.414399][ T3479] bond2 (unregistering): Released all slaves [ 929.485419][T14446] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2425'. [ 929.525522][ T3479] bond1 (unregistering): Released all slaves [ 930.039751][ T8] usb 1-1: USB disconnect, device number 16 [ 930.288916][ T8] cdc_eem 1-1:1.1 usb1: unregister 'cdc_eem' usb-dummy_hcd.0-1, CDC EEM Device [ 930.394784][ T3479] team0 (unregistering): Port device vlan0 removed [ 930.452689][ T5084] Bluetooth: hci2: command tx timeout [ 930.464460][T14465] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2428'. [ 930.738350][ T3479] team0 (unregistering): Port device team_slave_1 removed [ 930.794118][ T3479] team0 (unregistering): Port device team_slave_0 removed [ 930.842989][ T3479] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 930.898013][ T3479] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 931.346812][ T3479] bond0 (unregistering): Released all slaves [ 931.433760][T14446] netdevsim netdevsim5: loading /lib/firmware/. failed with error -22 [ 931.444635][T14446] netdevsim netdevsim5: Direct firmware load for . failed with error -22 [ 931.454439][T14446] netdevsim netdevsim5: Falling back to sysfs fallback for: . [ 931.494109][ T4339] ================================================================== [ 931.503120][ T4339] BUG: KASAN: slab-use-after-free in strlen+0x57/0x70 [ 931.510722][ T4339] Read of size 1 at addr ffff888025d836c0 by task kworker/u4:9/4339 [ 931.519538][ T4339] [ 931.522171][ T4339] CPU: 0 PID: 4339 Comm: kworker/u4:9 Not tainted syzkaller #0 [ 931.530490][ T4339] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 931.541554][ T4339] Workqueue: events_unbound linkwatch_event [ 931.548115][ T4339] Call Trace: [ 931.551747][ T4339] [ 931.555017][ T4339] dump_stack_lvl+0x18c/0x250 [ 931.560213][ T4339] ? read_lock_is_recursive+0x20/0x20 [ 931.566208][ T4339] ? show_regs_print_info+0x20/0x20 [ 931.571923][ T4339] ? load_image+0x420/0x420 [ 931.576889][ T4339] ? _raw_spin_lock_irqsave+0xc0/0x100 [ 931.582937][ T4339] ? __virt_addr_valid+0x10c/0x380 [ 931.588589][ T4339] ? __virt_addr_valid+0x10c/0x380 [ 931.594213][ T4339] ? __virt_addr_valid+0x10c/0x380 [ 931.599850][ T4339] print_report+0xa8/0x210 [ 931.604702][ T4339] ? strlen+0x57/0x70 [ 931.609097][ T4339] kasan_report+0x117/0x150 [ 931.614079][ T4339] ? strlen+0x57/0x70 [ 931.618459][ T4339] strlen+0x57/0x70 [ 931.622649][ T4339] nla_put_string+0x19/0x30 [ 931.627606][ T4339] rtnl_fill_ifinfo+0x1ca8/0x1e50 [ 931.633131][ T4339] ? if_nlmsg_size+0x970/0x970 [ 931.638383][ T4339] ? __alloc_skb+0x138/0x2c0 [ 931.643440][ T4339] ? rcu_is_watching+0x15/0xb0 [ 931.648684][ T4339] ? __kmalloc_node_track_caller+0xe2/0x230 [ 931.655204][ T4339] ? __build_skb_around+0x245/0x3c0 [ 931.660938][ T4339] rtmsg_ifinfo_build_skb+0x18b/0x260 [ 931.666854][ T4339] rtmsg_ifinfo+0x8c/0x1a0 [ 931.671711][ T4339] netdev_state_change+0xfe/0x170 [ 931.677247][ T4339] ? netdev_features_change+0xd0/0xd0 [ 931.683165][ T4339] linkwatch_do_dev+0x10d/0x160 [ 931.688516][ T4339] __linkwatch_run_queue+0x417/0x670 [ 931.694328][ T4339] ? mutex_lock_nested+0x20/0x20 [ 931.699761][ T4339] ? linkwatch_run_queue+0x10/0x10 [ 931.705383][ T4339] ? _raw_spin_unlock_irq+0x23/0x50 [ 931.711107][ T4339] ? process_scheduled_works+0x975/0x1600 [ 931.717419][ T4339] ? process_scheduled_works+0x975/0x1600 [ 931.723703][ T4339] linkwatch_event+0x4c/0x60 [ 931.728744][ T4339] process_scheduled_works+0xa60/0x1600 [ 931.734852][ T4339] ? worker_attach_to_pool+0x370/0x370 [ 931.740856][ T4339] ? assign_work+0x3cc/0x5d0 [ 931.745907][ T4339] worker_thread+0xa5e/0xfe0 [ 931.750965][ T4339] kthread+0x2fa/0x390 [ 931.755432][ T4339] ? pr_cont_work+0x550/0x550 [ 931.760606][ T4339] ? kthread_blkcg+0xd0/0xd0 [ 931.765653][ T4339] ret_from_fork+0x48/0x80 [ 931.770511][ T4339] ? kthread_blkcg+0xd0/0xd0 [ 931.775581][ T4339] ret_from_fork_asm+0x11/0x20 [ 931.780843][ T4339] [ 931.784223][ T4339] [ 931.786791][ T4339] Allocated by task 13951: [ 931.791636][ T4339] kasan_set_track+0x4e/0x70 [ 931.796685][ T4339] __kasan_kmalloc+0x8f/0xa0 [ 931.801732][ T4339] __kmalloc_node_track_caller+0xb4/0x230 [ 931.808035][ T4339] kvasprintf+0xec/0x1a0 [ 931.812722][ T4339] kobject_set_name_vargs+0x61/0x110 [ 931.818532][ T4339] dev_set_name+0xe3/0x140 [ 931.823398][ T4339] usb_add_gadget+0x475/0x6f0 [ 931.828566][ T4339] usb_add_gadget_udc_release+0x19c/0x1f0 [ 931.834850][ T4339] dummy_udc_probe+0x68a/0x780 [ 931.840088][ T4339] platform_probe+0x13b/0x1c0 [ 931.845235][ T4339] really_probe+0x247/0xae0 [ 931.850181][ T4339] __driver_probe_device+0x1f5/0x390 [ 931.855993][ T4339] device_driver_attach+0xe0/0x1d0 [ 931.861628][ T4339] bind_store+0x1cc/0x210 [ 931.866398][ T4339] kernfs_fop_write_iter+0x3a4/0x520 [ 931.872229][ T4339] vfs_write+0x474/0x9a0 [ 931.877082][ T4339] ksys_write+0x151/0x260 [ 931.881844][ T4339] do_syscall_64+0x55/0xb0 [ 931.886744][ T4339] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 931.893263][ T4339] [ 931.895811][ T4339] Freed by task 14461: [ 931.900270][ T4339] kasan_set_track+0x4e/0x70 [ 931.905331][ T4339] kasan_save_free_info+0x28/0x40 [ 931.910876][ T4339] ____kasan_slab_free+0x126/0x1f0 [ 931.916501][ T4339] slab_free_freelist_hook+0x130/0x1a0 [ 931.922515][ T4339] __kmem_cache_free+0xba/0x1f0 [ 931.927849][ T4339] kobject_put+0x260/0x450 [ 931.932712][ T4339] platform_remove+0x6d/0xe0 [ 931.937771][ T4339] device_release_driver_internal+0x408/0x6f0 [ 931.944447][ T4339] unbind_store+0x1a1/0x1d0 [ 931.949413][ T4339] kernfs_fop_write_iter+0x3a4/0x520 [ 931.955223][ T4339] vfs_write+0x474/0x9a0 [ 931.959887][ T4339] ksys_write+0x151/0x260 [ 931.964648][ T4339] do_syscall_64+0x55/0xb0 [ 931.969512][ T4339] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 931.975992][ T4339] [ 931.978541][ T4339] The buggy address belongs to the object at ffff888025d836c0 [ 931.978541][ T4339] which belongs to the cache kmalloc-16 of size 16 [ 931.993800][ T4339] The buggy address is located 0 bytes inside of [ 931.993800][ T4339] freed 16-byte region [ffff888025d836c0, ffff888025d836d0) [ 932.008678][ T4339] [ 932.011248][ T4339] The buggy address belongs to the physical page: [ 932.018347][ T4339] page:ffffea00009760c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888025d83780 pfn:0x25d83 [ 932.030940][ T4339] flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff) [ 932.039227][ T4339] page_type: 0xffffffff() [ 932.043998][ T4339] raw: 00fff00000000800 ffff888017c413c0 ffffea0001775410 ffffea0000adcfd0 [ 932.053438][ T4339] raw: ffff888025d83780 0000000000800061 00000001ffffffff 0000000000000000 [ 932.062884][ T4339] page dumped because: kasan: bad access detected [ 932.069971][ T4339] page_owner tracks the page as allocated [ 932.076246][ T4339] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 15185484296, free_ts 0 [ 932.094683][ T4339] post_alloc_hook+0x1c1/0x200 [ 932.099924][ T4339] get_page_from_freelist+0x2181/0x22a0 [ 932.106021][ T4339] __alloc_pages+0x1f0/0x460 [ 932.111066][ T4339] alloc_page_interleave+0x24/0x1e0 [ 932.116786][ T4339] alloc_slab_page+0x5d/0x180 [ 932.121922][ T4339] new_slab+0x87/0x2d0 [ 932.126386][ T4339] ___slab_alloc+0xc5c/0x12f0 [ 932.131521][ T4339] __kmem_cache_alloc_node+0x11f/0x250 [ 932.137526][ T4339] __kmalloc_node_track_caller+0xa4/0x230 [ 932.143817][ T4339] kstrdup+0x3b/0x80 [ 932.148137][ T4339] __kernfs_new_node+0xaa/0x7f0 [ 932.153475][ T4339] kernfs_new_node+0x14c/0x260 [ 932.158710][ T4339] kernfs_create_link+0xa7/0x200 [ 932.164136][ T4339] sysfs_do_create_link_sd+0x83/0x110 [ 932.170036][ T4339] bus_add_device+0x3a4/0x820 [ 932.175204][ T4339] device_add+0x53b/0xc40 [ 932.179965][ T4339] page_owner free stack trace missing [ 932.185872][ T4339] [ 932.188424][ T4339] Memory state around the buggy address: [ 932.194618][ T4339] ffff888025d83580: 00 07 fc fc fb fb fc fc 00 03 fc fc 00 03 fc fc [ 932.203476][ T4339] ffff888025d83600: 00 03 fc fc 00 03 fc fc 00 01 fc fc 00 01 fc fc [ 932.212376][ T4339] >ffff888025d83680: 00 01 fc fc fb fb fc fc fa fb fc fc 00 00 fc fc [ 932.221229][ T4339] ^ [ 932.227985][ T4339] ffff888025d83700: fb fb fc fc 00 00 fc fc fb fb fc fc fb fb fc fc [ 932.236845][ T4339] ffff888025d83780: fb fb fc fc fa fb fc fc 00 06 fc fc 00 00 fc fc [ 932.245721][ T4339] ================================================================== SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 932.320638][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 932.333877][ T5084] Bluetooth: hci4: command tx timeout [ 932.343331][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 932.572111][ T5084] Bluetooth: hci2: command tx timeout [ 932.882996][ T4339] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 932.891046][ T4339] CPU: 0 PID: 4339 Comm: kworker/u4:9 Not tainted syzkaller #0 [ 932.899342][ T4339] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 932.910394][ T4339] Workqueue: events_unbound linkwatch_event [ 932.916881][ T4339] Call Trace: [ 932.920485][ T4339] [ 932.923710][ T4339] dump_stack_lvl+0x18c/0x250 [ 932.928865][ T4339] ? show_regs_print_info+0x20/0x20 [ 932.934583][ T4339] ? load_image+0x420/0x420 [ 932.939544][ T4339] panic+0x2ca/0x720 [ 932.943850][ T4339] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 932.950624][ T4339] ? bpf_jit_dump+0xd0/0xd0 [ 932.955598][ T4339] ? _raw_spin_unlock_irqrestore+0x111/0x120 [ 932.962177][ T4339] ? _raw_spin_unlock+0x40/0x40 [ 932.967525][ T4339] ? strlen+0x57/0x70 [ 932.971901][ T4339] check_panic_on_warn+0x84/0xa0 [ 932.977331][ T4339] ? strlen+0x57/0x70 [ 932.981710][ T4339] end_report+0x6f/0x130 [ 932.986384][ T4339] kasan_report+0x128/0x150 [ 932.991340][ T4339] ? strlen+0x57/0x70 [ 932.995722][ T4339] strlen+0x57/0x70 [ 932.999945][ T4339] nla_put_string+0x19/0x30 [ 933.004987][ T4339] rtnl_fill_ifinfo+0x1ca8/0x1e50 [ 933.010527][ T4339] ? if_nlmsg_size+0x970/0x970 [ 933.015798][ T4339] ? __alloc_skb+0x138/0x2c0 [ 933.020845][ T4339] ? rcu_is_watching+0x15/0xb0 [ 933.026103][ T4339] ? __kmalloc_node_track_caller+0xe2/0x230 [ 933.032612][ T4339] ? __build_skb_around+0x245/0x3c0 [ 933.038326][ T4339] rtmsg_ifinfo_build_skb+0x18b/0x260 [ 933.044231][ T4339] rtmsg_ifinfo+0x8c/0x1a0 [ 933.049088][ T4339] netdev_state_change+0xfe/0x170 [ 933.054612][ T4339] ? netdev_features_change+0xd0/0xd0 [ 933.060569][ T4339] linkwatch_do_dev+0x10d/0x160 [ 933.065906][ T4339] __linkwatch_run_queue+0x417/0x670 [ 933.071731][ T4339] ? mutex_lock_nested+0x20/0x20 [ 933.077166][ T4339] ? linkwatch_run_queue+0x10/0x10 [ 933.082785][ T4339] ? _raw_spin_unlock_irq+0x23/0x50 [ 933.088505][ T4339] ? process_scheduled_works+0x975/0x1600 [ 933.094794][ T4339] ? process_scheduled_works+0x975/0x1600 [ 933.101083][ T4339] linkwatch_event+0x4c/0x60 [ 933.106145][ T4339] process_scheduled_works+0xa60/0x1600 [ 933.112275][ T4339] ? worker_attach_to_pool+0x370/0x370 [ 933.118292][ T4339] ? assign_work+0x3cc/0x5d0 [ 933.123375][ T4339] worker_thread+0xa5e/0xfe0 [ 933.128437][ T4339] kthread+0x2fa/0x390 [ 933.132908][ T4339] ? pr_cont_work+0x550/0x550 [ 933.138064][ T4339] ? kthread_blkcg+0xd0/0xd0 [ 933.143106][ T4339] ret_from_fork+0x48/0x80 [ 933.147966][ T4339] ? kthread_blkcg+0xd0/0xd0 [ 933.153055][ T4339] ret_from_fork_asm+0x11/0x20 [ 933.158298][ T4339] [ 933.162057][ T4339] Kernel Offset: disabled [ 933.166809][ T4339] Rebooting in 86400 seconds..