last executing test programs: 13m51.2663821s ago: executing program 0 (id=224): userfaultfd(0x1) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)=[@rights={{0x10}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x70}, 0x40000180) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) openat$sw_sync(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, 0x0, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe700, 0x800, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x2, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x89a0, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 13m49.447945668s ago: executing program 0 (id=226): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x5) r1 = getpgid(r0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000100)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000140), 0x0, 0x0) read$msr(r4, &(0x7f0000000180)=""/102392, 0x18ff8) sched_setaffinity(r3, 0x47, &(0x7f0000019180)=0x7) r5 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_inet_SIOCSIFADDR(r5, 0x8916, &(0x7f0000000040)={'sit0\x00', {0x2, 0x4e22, @empty}}) ioctl$sock_SIOCSPGRP(r5, 0x8902, &(0x7f00000192c0)=r1) r6 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r6, 0x84, 0x7b, &(0x7f0000019280)={0x0, 0x1}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r6, 0x84, 0x7c, &(0x7f00000193c0)={0x0, 0x0, 0x4}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r6, 0x84, 0x7c, &(0x7f0000019400), 0x8) 13m46.201039583s ago: executing program 0 (id=230): r0 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000480)={0xa, 0x4e20, 0x400, @loopback, 0x7}, 0x1c) listen(r0, 0xb) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f00000005c0)={0xa, 0x4e20, 0x9, @loopback, 0x106}, 0x1c) r2 = fcntl$dupfd(r1, 0x406, r1) setsockopt$inet6_buf(r1, 0x29, 0x39, &(0x7f0000000640)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) write$binfmt_elf64(r2, &(0x7f0000000680)=ANY=[], 0xfffffdcf) close(0x3) write$FUSE_ENTRY(0xffffffffffffffff, 0x0, 0x0) 13m45.55383568s ago: executing program 0 (id=232): prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0x800001000089}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x4, &(0x7f0000000400)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3ffd, 0x0, 0x0, 0x0, 0x3}, [@call={0x85, 0x0, 0x0, 0x2f}]}, &(0x7f0000000440)='syzkaller\x00', 0x6, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback=0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000480)=r0, 0x4) sendmsg$NFT_MSG_GETCHAIN(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)={0x14, 0x4, 0xa, 0x5, 0x0, 0x0, {0xa, 0x0, 0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x20000080}, 0x4000) sched_setaffinity(0x0, 0x8, &(0x7f0000000640)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, &(0x7f0000000080), 0x10) sendmsg$can_bcm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={0x0, 0x48}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) syz_clone(0x80008100, 0x0, 0xff28, 0x0, 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000006c0), 0x0, 0x0) read$msr(r3, &(0x7f0000000700)=""/102392, 0x18ff8) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) sched_setscheduler(0x0, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, &(0x7f0000019700), 0x200, 0x0) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000019740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000019780)={&(0x7f00000197c0)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x28) r6 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000019980)=@bpf_tracing={0x1a, 0xf, &(0x7f0000019a40)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000000b703000000000000a500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000010000008500000084000000b70000000000000095"], &(0x7f0000019ac0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x18, r5, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1}, 0x94) bpf$OBJ_PIN_PROG(0x11, &(0x7f0000019b00)=@generic={0x0, r6}, 0x18) 13m40.377923515s ago: executing program 0 (id=239): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) rseq(0x0, 0x0, 0x0, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) unshare(0x28000600) 13m39.220327834s ago: executing program 0 (id=242): r0 = syz_open_dev$sndctrl(0x0, 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0xc0045543, &(0x7f0000000100)=0xfdfdfffd) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f00000001c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r4, &(0x7f0000000280)=""/102392, 0x18ff8) mkdirat(0xffffffffffffff9c, &(0x7f00000192c0)='./tracefs_dir\x00', 0xbf) mount(0x0, &(0x7f0000019300)='./tracefs_dir\x00', &(0x7f0000019340)='tracefs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000019380)='./tracefs_dir/buffer_size_kb\x00', 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000193c0)={0x0, 0x0, &(0x7f0000019400)={&(0x7f0000019440)=@deltaction={0x60, 0x18, 0x1, 0x70bd2c, 0x25dfdc00, {0xa}, [@TCA_ACT_TAB={0x4c, 0x1, [{0xc, 0x8d, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}, {0x14, 0x5, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}, {0x28, 0x9, 0x0, 0x0, @TCA_ACT_INDEX={0x24, 0x3, 0x6}}, {0x10, 0x16, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0xc, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'xt\x00'}}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x44000}, 0x20040844) readv(r5, &(0x7f00000194c0)=[{&(0x7f0000019500)=""/4096, 0x1000}], 0x1) r6 = openat$comedi(0xffffffffffffff9c, &(0x7f000001a500)='/dev/comedi2\x00', 0x1, 0x0) ioctl$COMEDI_DEVCONFIG(r6, 0x40946400, 0x0) listen(0xffffffffffffffff, 0x5) ftruncate(0xffffffffffffffff, 0x8008976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, 0xffffffffffffffff, 0x0) ioctl$F2FS_IOC_DEFRAGMENT(0xffffffffffffffff, 0xc010f508, &(0x7f000001a680)={0x2, 0xb0}) 13m23.368851051s ago: executing program 32 (id=242): r0 = syz_open_dev$sndctrl(0x0, 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0xc0045543, &(0x7f0000000100)=0xfdfdfffd) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f00000001c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r4, &(0x7f0000000280)=""/102392, 0x18ff8) mkdirat(0xffffffffffffff9c, &(0x7f00000192c0)='./tracefs_dir\x00', 0xbf) mount(0x0, &(0x7f0000019300)='./tracefs_dir\x00', &(0x7f0000019340)='tracefs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000019380)='./tracefs_dir/buffer_size_kb\x00', 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000193c0)={0x0, 0x0, &(0x7f0000019400)={&(0x7f0000019440)=@deltaction={0x60, 0x18, 0x1, 0x70bd2c, 0x25dfdc00, {0xa}, [@TCA_ACT_TAB={0x4c, 0x1, [{0xc, 0x8d, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}, {0x14, 0x5, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}, {0x28, 0x9, 0x0, 0x0, @TCA_ACT_INDEX={0x24, 0x3, 0x6}}, {0x10, 0x16, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0xc, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'xt\x00'}}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x44000}, 0x20040844) readv(r5, &(0x7f00000194c0)=[{&(0x7f0000019500)=""/4096, 0x1000}], 0x1) r6 = openat$comedi(0xffffffffffffff9c, &(0x7f000001a500)='/dev/comedi2\x00', 0x1, 0x0) ioctl$COMEDI_DEVCONFIG(r6, 0x40946400, 0x0) listen(0xffffffffffffffff, 0x5) ftruncate(0xffffffffffffffff, 0x8008976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, 0xffffffffffffffff, 0x0) ioctl$F2FS_IOC_DEFRAGMENT(0xffffffffffffffff, 0xc010f508, &(0x7f000001a680)={0x2, 0xb0}) 23.093928478s ago: executing program 1 (id=1294): socket$nl_netfilter(0x10, 0x3, 0xc) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x5) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000280)={r1}, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0xc, &(0x7f00000004c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000600)={r2}, 0xc) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f0000000100), 0x2, 0x141102) writev(r3, &(0x7f0000000140)=[{&(0x7f0000000180)="94", 0xf000}, {0x0}], 0x2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f00000001c0)=[@in={0x2, 0x4e20, @empty}], 0x10) syz_open_dev$usbmon(0x0, 0x80000001, 0x28100) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000300)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000340)=[{&(0x7f0000000380)='a', 0x1}], 0x1, 0x0, 0x0, 0x44}], 0x1, 0x0) setsockopt$inet_sctp_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, &(0x7f00000003c0)={0x0, 0x20, 0x8f, 0x2, 0x0, 0x0, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x4, 0x1}, 0xe) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x20, 0x0) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl(r4, 0x890b, 0x0) 16.378157371s ago: executing program 2 (id=1303): r0 = socket$pppoe(0x18, 0x1, 0x0) write(r0, &(0x7f0000000300)=',X', 0x2) 16.262655413s ago: executing program 1 (id=1304): setns(0xc9, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$UBLK_U_CMD_END_USER_RECOVERY(0xffffffffffffffff, 0xc0207511, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000400)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000440)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000480)=0x5) socket$key(0xf, 0x3, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000019880)={0x0, 0x0, &(0x7f00000198c0)={&(0x7f0000019900)=ANY=[@ANYBLOB="a802000010000500010004000000000000000000000000000000000000000001ff02000000000000000000000000000100000000000000040a00808084000000", @ANYRES32=0x0, @ANYRES32=0x80, @ANYBLOB="00000000000000000000000000000000000012343300000000000000000000000000000000000001ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000007000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000080000000000000004a000100686d6163287368613129000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000001000020001700010000000000000000000000000000000000000020000000000000002c001700040000002bbd700029bd70002cbd700026bd7000040000000d000000000000000000000081000000080029009609000008000b00040000000800290006000000e7000800e30008000008db002fb1751002e875c1b14228c22f0a22739f1dbff0840b44209bdb63662f38951113f461899001dff15112741efca7583e0a4c26e864aafee1055b6739a588246fad5e005438c0af597c8412984398734ddf59026038c8c06902a13eae8923cbe93da4b49acea5f30128088649d446832662885be58f985158693ff4d4a6b1bd8a2553981915d87789a30194eeabc391a00cfb517880aef0b0af090bcfe5b6d5ebbc1dbb7ba78baa361514cb97b06a66b6f6c08bf05140dafbfe66fd2ee655d54aad8f1aa50d2cd62a04b680cd6137f6ad2984824bcf6472e7706244000c001c00", @ANYRES32=0x0], 0x2a8}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f00000004c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f0000000500), 0x0, 0x0) read$msr(r5, &(0x7f0000000540)=""/102392, 0x18ff8) sched_setaffinity(r4, 0x8, &(0x7f0000019540)=0x7) openat(0xffffffffffffff9c, &(0x7f0000019580)='./file1\x00', 0x42, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000195c0)={0xffffffffffffffff}) socket$inet_udp(0x2, 0x2, 0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000019600)=@pppol2tpin6={0x18, 0x1, {0xe4, r7, 0x4, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x32) close_range(r6, 0xffffffffffffffff, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f0000019640)={0x0, 0x0, &(0x7f0000019680)={&(0x7f00000196c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(r8, &(0x7f0000019740)={0x0, 0x0, &(0x7f0000019780)={&(0x7f00000197c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x80, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x54, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @payload={{0xc}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_DREG={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_PAYLOAD_OFFSET={0x8, 0x3, 0x1, 0x0, 0x4f}, @NFTA_PAYLOAD_LEN={0x8, 0x4, 0x1, 0x0, 0x37}, @NFTA_PAYLOAD_BASE={0x8, 0x2, 0x1, 0x0, 0x2}]}}}, {0x1c, 0x1, 0x0, 0x1, @masq={{0x9}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_MASQ_REG_PROTO_MIN={0x8, 0x2, 0x1, 0x0, 0x15}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0xa8}, 0x1, 0x0, 0x0, 0x40}, 0x24000840) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0xe, 0x4, 0x370, 0xffffffff, 0x0, 0x100, 0x1d0, 0xffffffff, 0xffffffff, 0x100, 0x1d0, 0x2a0, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@empty, @empty}, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@frag={{0x30}, {[0x0, 0x3f3], 0x2}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x3d0) 16.187470151s ago: executing program 3 (id=1305): r0 = fsopen(&(0x7f0000000140)='debugfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0xb) ioctl$VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000000)={0x40, 0x9, 0x20, "39aa4f48faf018624a1d17c3080100c6154d8c6e5f2174e61569980d00"}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x7, 0x3000003, 0x401d031, 0xffffffffffffffff, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f0000000100), 0x2, 0x141102) writev(r2, &(0x7f0000000180)=[{&(0x7f00000001c0)="94", 0xf000}, {0x0}], 0x2) socket$kcm(0x10, 0x2, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./config\x00', &(0x7f0000000280)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1f7) mkdirat(r1, 0x0, 0xc4) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/configs/c.1/uac2.usb0\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r3, &(0x7f0000000440)='usbip-vudc.0', 0xc) write(r3, &(0x7f0000000480)='\n', 0x1) socket$packet(0x11, 0x2, 0x300) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f00000004c0), 0x4) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=ANY=[], 0x28}}, 0x0) write$cgroup_int(r3, &(0x7f0000000600), 0x12) lstat(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000580)) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffff000) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x700000000000000, 0x0) 15.165567286s ago: executing program 3 (id=1306): prlimit64(0x0, 0xe, &(0x7f00000002c0)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000003c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000400)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000440)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000900), 0x0, 0x0) read$msr(r3, &(0x7f0000000940)=""/102392, 0x18ff8) r4 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r4, 0x0, 0x0) 12.523275049s ago: executing program 3 (id=1307): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_MCAST_LEAVE_GROUP(r0, 0x29, 0x2d, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="02000000040000001fe2295b8f08000000010000", @ANYRES32, @ANYBLOB="02000000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000500)=0x7) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x100040d3}, 0x22000010) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000580)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f00000005c0)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) set_mempolicy(0x1, 0x0, 0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f0000000600), 0x0, 0x0) read$msr(r5, &(0x7f0000003e00)=""/102392, 0x18ff8) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f000001ce00)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./mnt\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000180)='ext4\x00', 0x8410, 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./mnt/fillfile\x00', 0x42, 0x1ff) 11.611600982s ago: executing program 4 (id=1309): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) openat$cgroup_pressure(0xffffffffffffffff, 0x0, 0x2, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x404, &(0x7f0000000740)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',grou', @ANYRESDEC=0x0]) fgetxattr(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x42) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x1c00000, 0x200000f, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x40080c0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = syz_ublk_setup_io_uring(0xd, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x154}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000300)=0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x4, 0xa22, 0x0, 0x0, 0x1000, 0x2, 0x0, 0x0, 0xe0}}}, &(0x7f0000000480)=0x0) syz_ublk_setup_queues(0xffffffffffffffff, r6, &(0x7f0000000180)={0x0, 0x3e80, 0x800, 0x1, 0x32c, 0x0, r2}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x1006, 0x200015a, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7d, 0x40, 0x10001, 0x2a5, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88de, 0x10000, 0x7, 0xffffffff}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0xbe, 0x0, r2}}], 0x1, &(0x7f0000000340)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0x4, 0x5c0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, 0x0, 0x0, 0x0, 0xffffffffffffff4f, 0x0, 0x0, 0x7}, 0x94) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x39, &(0x7f0000000000)=@fragment={0x3b, 0x0, 0x1, 0x0, 0x0, 0x6, 0x68}, 0x8) ioctl$SNDCTL_DSP_SETFMT(0xffffffffffffffff, 0xc0045005, 0x0) umount2(0x0, 0x3) 11.588520325s ago: executing program 1 (id=1310): prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0x800001000089}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x4, &(0x7f0000000400)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3ffd, 0x0, 0x0, 0x0, 0x3}, [@call={0x85, 0x0, 0x0, 0x2f}]}, &(0x7f0000000440)='syzkaller\x00', 0x6, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback=0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000480)=r0, 0x4) sendmsg$NFT_MSG_GETCHAIN(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)={0x14, 0x4, 0xa, 0x5, 0x0, 0x0, {0xa, 0x0, 0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x20000080}, 0x4000) sched_setaffinity(0x0, 0x8, &(0x7f0000000640)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000680)=0x6) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, &(0x7f0000000080), 0x10) sendmsg$can_bcm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={0x0, 0x48}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) syz_clone(0x80008100, 0x0, 0xff28, 0x0, 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000006c0), 0x0, 0x0) read$msr(r3, &(0x7f0000000700)=""/102392, 0x18ff8) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) sched_setscheduler(0x0, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, &(0x7f0000019700), 0x200, 0x0) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000019740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000019780)={&(0x7f00000197c0)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x28) r6 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000019980)=@bpf_tracing={0x1a, 0xf, &(0x7f0000019a40)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000000b703000000000000a500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000010000008500000084000000b70000000000000095"], &(0x7f0000019ac0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x18, r5, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1}, 0x94) bpf$OBJ_PIN_PROG(0x11, &(0x7f0000019b00)=@generic={0x0, r6}, 0x18) 11.231013532s ago: executing program 4 (id=1311): openat$vimc2(0xffffffffffffff9c, &(0x7f0000001140), 0x2, 0x0) syz_emit_ethernet(0x6e, &(0x7f0000000580)=ANY=[@ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="e4000000907800081312345f8cf949a01b515682f44c"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) r0 = socket(0x400000000010, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev\x00', 0x1ff) getsockopt$inet_sctp_SCTP_EVENT(r0, 0x84, 0x7f, &(0x7f0000000340)={0x1, 0x800c, 0x1}, &(0x7f0000000380)=0x8) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000280)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f00000002c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000300), 0x0, 0x0) read$msr(r4, &(0x7f0000001180)=""/102392, 0x18ff8) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) add_key(&(0x7f0000000000)='rxrpc\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x2903, 0x0) ioctl$TIOCGSERIAL(r5, 0x541e, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r6 = socket$inet6(0xa, 0x1, 0x0) getsockopt$inet6_buf(r6, 0x29, 0x3d, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) ioctl$BLKGETNRZONES(0xffffffffffffffff, 0x80041285, &(0x7f00000003c0)=0x5b7a) r7 = fanotify_init(0x0, 0x40000) write(r7, 0x0, 0x0) 11.1552296s ago: executing program 2 (id=1312): socket$nl_netfilter(0x10, 0x3, 0xc) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x5) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000280)={r0}, 0x4) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0x10, &(0x7f00000004c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}}]}, &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000600)={r1}, 0xc) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f0000000100), 0x2, 0x141102) writev(r2, &(0x7f0000000140)=[{&(0x7f0000000180)="94", 0xf000}, {0x0}], 0x2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f00000001c0)=[@in={0x2, 0x4e20, @empty}], 0x10) syz_open_dev$usbmon(0x0, 0x80000001, 0x28100) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000300)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000340)=[{&(0x7f0000000380)='a', 0x1}], 0x1, 0x0, 0x0, 0x44}], 0x1, 0x0) setsockopt$inet_sctp_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, &(0x7f00000003c0)={0x0, 0x20, 0x8f, 0x2, 0x0, 0x0, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x4, 0x1}, 0xe) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x20, 0x0) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl(r3, 0x890b, 0x0) 9.901967069s ago: executing program 4 (id=1313): mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000440)='./dev\x00', &(0x7f0000000480)='devtmpfs\x00', 0x0, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000540)='./mnt\x00', &(0x7f0000000580)='ext4\x00', 0x8410, 0x0) chdir(&(0x7f00000005c0)='./mnt\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./file2\x00', 0x18d042, 0x15) pwrite64(r1, &(0x7f0000000640)="ff", 0x58200, 0xfb2200) 8.518638222s ago: executing program 3 (id=1314): r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./nfsd/threads\x00', 0x2, 0x0) write(r0, 0x0, 0x0) 8.298711104s ago: executing program 2 (id=1315): prlimit64(0x0, 0xe, &(0x7f00000002c0)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000003c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000400)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000440)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000900), 0x0, 0x0) read$msr(r3, &(0x7f0000000940)=""/102392, 0x18ff8) r4 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r4, 0x0, 0x0) 6.895454049s ago: executing program 2 (id=1316): sched_setscheduler(0x0, 0x2, &(0x7f0000000700)=0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) pipe2$9p(&(0x7f0000000040), 0x0) mount$9p_fd(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0), 0x2004000, 0x0) 5.272495097s ago: executing program 1 (id=1317): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = openat$sndtimer(0xffffffffffffff9c, 0x0, 0x0) close_range(r4, 0xffffffffffffffff, 0x400000000000000) 5.230860031s ago: executing program 3 (id=1318): prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000140)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000780)=@abs, 0x6e) ptrace$ARCH_FORCE_TAGGED_SVA(0x1e, r0, 0x0, 0x4004) sendmmsg$unix(r2, &(0x7f0000000800), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000880)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f00000008c0)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000900)='./sec\x00', &(0x7f0000000940)='securityfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000980)='./sec/integrity/ima/binary_runtime_measurements\x00', 0x0, 0x0) 3.59529428s ago: executing program 1 (id=1319): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) openat$cgroup_pressure(0xffffffffffffffff, 0x0, 0x2, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x404, &(0x7f0000000740)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',grou', @ANYRESDEC=0x0]) fgetxattr(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x42) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x1c00000, 0x200000f, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x40080c0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = syz_ublk_setup_io_uring(0xd, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x154}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000300)=0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x4, 0xa22, 0x0, 0x0, 0x1000, 0x2, 0x0, 0x0, 0xe0}}}, &(0x7f0000000480)=0x0) syz_ublk_setup_queues(0xffffffffffffffff, r6, &(0x7f0000000180)={0x0, 0x3e80, 0x800, 0x1, 0x32c, 0x0, r2}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x1006, 0x200015a, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7d, 0x40, 0x10001, 0x2a5, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88de, 0x10000, 0x7, 0xffffffff}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0xbe, 0x0, r2}}], 0x1, &(0x7f0000000340)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0x4, 0x5c0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, 0x0, 0x0, 0x0, 0xffffffffffffff4f, 0x0, 0x0, 0x7}, 0x94) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x39, &(0x7f0000000000)=@fragment={0x3b, 0x0, 0x1, 0x0, 0x0, 0x6, 0x68}, 0x8) ioctl$SNDCTL_DSP_SETFMT(0xffffffffffffffff, 0xc0045005, 0x0) umount2(0x0, 0x3) 3.349508085s ago: executing program 4 (id=1320): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000001c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) write$cgroup_subtree(r0, &(0x7f00000002c0)=ANY=[@ANYBLOB="7bedcb5d07081196f37538e486dd6372ce22667f2b00dbf6e97158cf474fec87891f6d76745b686158bbcfe8875afdef00010000000029"], 0x66) 3.10950681s ago: executing program 4 (id=1321): openat$vimc2(0xffffffffffffff9c, &(0x7f0000001140), 0x2, 0x0) syz_emit_ethernet(0x6e, &(0x7f0000000580)=ANY=[@ANYBLOB, @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="e4000000907800081312345f8cf949a01b515682f44c"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) r0 = socket(0x400000000010, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev\x00', 0x1ff) getsockopt$inet_sctp_SCTP_EVENT(r0, 0x84, 0x7f, &(0x7f0000000340)={0x1, 0x800c, 0x1}, &(0x7f0000000380)=0x8) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000280)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f00000002c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000300), 0x0, 0x0) read$msr(r4, &(0x7f0000001180)=""/102392, 0x18ff8) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) add_key(&(0x7f0000000000)='rxrpc\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x2903, 0x0) ioctl$TIOCGSERIAL(r5, 0x541e, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r6 = socket$inet6(0xa, 0x1, 0x0) getsockopt$inet6_buf(r6, 0x29, 0x3d, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) ioctl$BLKGETNRZONES(0xffffffffffffffff, 0x80041285, &(0x7f00000003c0)=0x5b7a) r7 = fanotify_init(0x0, 0x40000) write(r7, 0x0, 0x0) 3.080205673s ago: executing program 2 (id=1322): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_MCAST_LEAVE_GROUP(r0, 0x29, 0x2d, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="02000000040000001fe2295b8f08000000010000", @ANYRES32, @ANYBLOB="02000000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000500)=0x7) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x100040d3}, 0x22000010) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000580)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f00000005c0)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) set_mempolicy(0x1, 0x0, 0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f0000000600), 0x0, 0x0) read$msr(r5, &(0x7f0000003e00)=""/102392, 0x18ff8) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f000001ce00)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./mnt\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000180)='ext4\x00', 0x8410, 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./mnt/fillfile\x00', 0x42, 0x1ff) 1.771902688s ago: executing program 4 (id=1323): socket$nl_netfilter(0x10, 0x3, 0xc) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x5) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000280)={r0}, 0x4) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0x10, &(0x7f00000004c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}}]}, &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000600)={r1}, 0xc) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f0000000100), 0x2, 0x141102) writev(r2, &(0x7f0000000140)=[{&(0x7f0000000180)="94", 0xf000}, {0x0}], 0x2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f00000001c0)=[@in={0x2, 0x4e20, @empty}], 0x10) syz_open_dev$usbmon(0x0, 0x80000001, 0x28100) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000300)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000340)=[{&(0x7f0000000380)='a', 0x1}], 0x1, 0x0, 0x0, 0x44}], 0x1, 0x0) setsockopt$inet_sctp_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, &(0x7f00000003c0)={0x0, 0x20, 0x8f, 0x2, 0x0, 0x0, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x4, 0x1}, 0xe) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x20, 0x0) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl(r3, 0x890b, 0x0) 1.738511651s ago: executing program 3 (id=1324): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$MPTCP_PM_CMD_DEL_ADDR(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x1c, 0x0, 0x1, 0x70bd27, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x40000000}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x400c814) sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=ANY=[@ANYBLOB="60000000100005040100000000000000000000000003000000000000000000000a00030076657468300000003400128009000100766574680000000024000280200001"], 0x60}}, 0x0) mkdir(&(0x7f0000000080)='my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000280)='my_sys\x00', &(0x7f00000002c0)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='my_sys/bus/pci/devices/0000:00:03.0/resource0\x00', 0x2, 0x0) write$binfmt_format(r1, &(0x7f0000000340)='1\x00', 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x0) syz_usb_connect(0x3, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002e80c1e10e80401a148040102031109021200011c0780fe0904"], 0xfffffffffffffffe) syz_emit_vhci(&(0x7f0000000240)=ANY=[@ANYRESOCT=0x0], 0x22) syz_open_dev$tty1(0xc, 0x4, 0x1) socket$nl_generic(0x10, 0x3, 0x10) mount(0x0, &(0x7f00000000c0)='./cfg\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./cfg/usb_gadget/g1/functions/eem.usb0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cfg/usb_gadget/g1/functions/eem.usb0/ifname\x00', 0x1, 0x0) write$char_usb(r2, &(0x7f0000000140)='\x00', 0x1) 380.687762ms ago: executing program 2 (id=1325): prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0x800001000089}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000480), 0x4) sendmsg$NFT_MSG_GETCHAIN(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)={0x14, 0x4, 0xa, 0x5, 0x0, 0x0, {0xa, 0x0, 0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x20000080}, 0x4000) sched_setaffinity(0x0, 0x8, &(0x7f0000000640)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000680)=0x6) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, &(0x7f0000000080), 0x10) sendmsg$can_bcm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={0x0, 0x48}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) syz_clone(0x80008100, 0x0, 0xff28, 0x0, 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000006c0), 0x0, 0x0) read$msr(r3, &(0x7f0000000700)=""/102392, 0x18ff8) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) sched_setscheduler(0x0, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, &(0x7f0000019700), 0x200, 0x0) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000019740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000019780)={&(0x7f00000197c0)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x28) r6 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000019980)=@bpf_tracing={0x1a, 0xf, &(0x7f0000019a40)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000000b703000000000000a500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000010000008500000084000000b70000000000000095"], &(0x7f0000019ac0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x18, r5, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1}, 0x94) bpf$OBJ_PIN_PROG(0x11, &(0x7f0000019b00)=@generic={0x0, r6}, 0x18) 0s ago: executing program 1 (id=1326): setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1cd) mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000340)='tcp 2', 0x5) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./nfsd/threads\x00', 0x2, 0x0) write(r1, 0x0, 0x0) kernel console output (not intermixed with test programs): .442532][ T5788] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.452690][ T5788] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 83.464255][ T5788] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.476496][ T5788] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 83.612541][ T5788] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 83.623251][ T5788] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.633302][ T5788] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 83.637247][ T5791] Bluetooth: hci3: command tx timeout [ 84.377388][ T5800] Bluetooth: hci2: command tx timeout [ 84.382858][ T5800] Bluetooth: hci1: command tx timeout [ 84.389128][ T5792] Bluetooth: hci0: command tx timeout [ 84.417485][ T5788] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.432727][ T5788] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 84.445583][ T5788] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.458442][ T5788] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 84.499260][ T5788] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.519833][ T5788] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.530006][ T5788] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.539032][ T5788] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.560625][ T1004] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.568519][ T1004] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.751797][ T1147] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.788103][ T5907] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1'. [ 84.812138][ T5907] syz.0.1: attempt to access beyond end of device [ 84.812138][ T5907] nbd0: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 84.826179][ T5907] gfs2: error 10 reading superblock [ 84.852441][ T1147] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.094969][ T5905] syz_tun: entered promiscuous mode [ 85.131258][ T5905] syz_tun: entered allmulticast mode [ 85.524035][ T5909] vlan1: entered promiscuous mode [ 85.579858][ T5909] vlan1: entered allmulticast mode [ 85.595374][ T5909] veth0_vlan: entered allmulticast mode [ 85.647347][ T2973] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.655187][ T2973] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.744967][ T2996] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.788754][ T2996] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.341914][ T5917] IPv6: NLM_F_CREATE should be specified when creating new route [ 86.350874][ T5917] netlink: 'syz.3.10': attribute type 1 has an invalid length. [ 87.267150][ T5791] Bluetooth: hci3: command tx timeout [ 87.267194][ T5099] Bluetooth: hci0: command tx timeout [ 87.272555][ T5791] Bluetooth: hci2: command tx timeout [ 87.292210][ T5800] Bluetooth: hci1: command tx timeout [ 87.299365][ T3073] cfg80211: failed to load regulatory.db [ 87.658189][ T5927] syz.0.12[5927]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 90.461942][ T5943] netlink: 4 bytes leftover after parsing attributes in process `syz.0.16'. [ 90.481942][ T5943] syz.0.16: attempt to access beyond end of device [ 90.481942][ T5943] nbd0: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 90.495108][ T5943] gfs2: error 10 reading superblock [ 92.230243][ T5951] comedi comedi1: reset error (fatal) [ 92.377446][ T5891] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 92.595476][ T5891] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 92.610547][ T5891] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 92.623605][ T5891] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 92.636074][ T5891] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 92.657574][ T5891] usb 4-1: New USB device found, idVendor=9710, idProduct=7810, bcdDevice= 1.00 [ 92.666813][ T5891] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 92.691591][ T5891] usb 4-1: Product: syz [ 92.691633][ T5891] usb 4-1: Manufacturer: syz [ 92.714791][ T5891] mos7840 4-1:1.0: required endpoints missing [ 95.495303][ T176] usb 4-1: USB disconnect, device number 2 [ 95.698239][ T5990] tipc: Started in network mode [ 95.703800][ T5990] tipc: Node identity 4, cluster identity 4711 [ 95.710235][ T5990] tipc: Node number set to 4 [ 96.800590][ T5873] rxe_eth0 speed is unknown, defaulting to 1000 [ 96.985408][ T6002] netlink: 4 bytes leftover after parsing attributes in process `syz.3.27'. [ 97.548925][ T6002] syz.3.27: attempt to access beyond end of device [ 97.548925][ T6002] nbd3: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 97.579723][ T6002] gfs2: error 10 reading superblock [ 101.973260][ T6031] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 101.993490][ T6032] netlink: 36 bytes leftover after parsing attributes in process `syz.0.34'. [ 103.257085][ T0] NOHZ tick-stop error: local softirq work is pending, handler #c2!!! [ 105.476941][ C1] sched: RT throttling activated [ 105.771219][ T6058] netlink: 4 bytes leftover after parsing attributes in process `syz.1.38'. [ 107.152021][ T6058] syz.1.38: attempt to access beyond end of device [ 107.152021][ T6058] nbd1: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 107.176809][ T6058] gfs2: error 10 reading superblock [ 109.757176][ T5873] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 110.018180][ T5873] usb 2-1: config index 0 descriptor too short (expected 23569, got 27) [ 110.018815][ T5873] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 110.021072][ T5873] usb 2-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 110.049376][ T5873] usb 2-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 110.058026][ T5873] usb 2-1: Manufacturer: syz [ 110.088024][ T5873] usb 2-1: config 0 descriptor?? [ 110.639866][ T5873] rc_core: IR keymap rc-hauppauge not found [ 110.649003][ T5873] Registered IR keymap rc-empty [ 110.674734][ T5873] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 110.714559][ T5873] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input5 [ 110.767570][ C1] igorplugusb 2-1:0.0: Error: urb status = -32 [ 111.396958][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 112.266984][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 112.276959][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 112.386966][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 112.496962][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 112.506948][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 112.592407][ T23] usb 2-1: USB disconnect, device number 2 [ 112.770358][ T6108] netlink: 4 bytes leftover after parsing attributes in process `syz.2.50'. [ 112.884763][ T6108] syz.2.50: attempt to access beyond end of device [ 112.884763][ T6108] nbd2: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 113.007258][ T6108] gfs2: error 10 reading superblock [ 116.458247][ T6135] netlink: 4 bytes leftover after parsing attributes in process `syz.2.61'. [ 116.494620][ T6135] syz.2.61: attempt to access beyond end of device [ 116.494620][ T6135] nbd2: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 116.661511][ T6135] gfs2: error 10 reading superblock [ 117.547343][ T5870] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 117.750355][ T5870] usb 1-1: config index 0 descriptor too short (expected 23569, got 27) [ 117.840551][ T5870] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 117.917932][ T5870] usb 1-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 117.953507][ T5870] usb 1-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 117.967141][ T5870] usb 1-1: Manufacturer: syz [ 117.991426][ T5870] usb 1-1: config 0 descriptor?? [ 119.027083][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 119.366989][ T5870] rc_core: IR keymap rc-hauppauge not found [ 119.396995][ T5870] Registered IR keymap rc-empty [ 119.423960][ T5870] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 119.458538][ T5870] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input6 [ 119.608722][ C1] igorplugusb 1-1:0.0: Error: urb status = -32 [ 119.898734][ T176] usb 1-1: USB disconnect, device number 2 [ 121.586956][ T0] NOHZ tick-stop error: local softirq work is pending, handler #c2!!! [ 122.856817][ T6168] netlink: 4 bytes leftover after parsing attributes in process `syz.0.71'. [ 124.147062][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 124.187879][ T6168] syz.0.71: attempt to access beyond end of device [ 124.187879][ T6168] nbd0: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 124.236904][ T6168] gfs2: error 10 reading superblock [ 129.952868][ T6211] netlink: 4 bytes leftover after parsing attributes in process `syz.2.84'. [ 130.023199][ T6212] syz.2.84: attempt to access beyond end of device [ 130.023199][ T6212] nbd2: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 130.112980][ T6212] gfs2: error 10 reading superblock [ 131.237793][ T6215] input: syz0 as /devices/virtual/input/input7 [ 131.246318][ T6215] input: failed to attach handler leds to device input7, error: -6 [ 133.048791][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.055892][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.077518][ T6224] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 135.990426][ T6242] netlink: 4 bytes leftover after parsing attributes in process `syz.1.93'. [ 136.008195][ T6242] syz.1.93: attempt to access beyond end of device [ 136.008195][ T6242] nbd1: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 136.021174][ T6242] gfs2: error 10 reading superblock [ 139.127128][ T5868] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 139.863466][ T6250] input: syz0 as /devices/virtual/input/input8 [ 139.903105][ T6250] input: failed to attach handler leds to device input8, error: -6 [ 139.917688][ T5868] usb 4-1: Using ep0 maxpacket: 8 [ 139.925377][ T5868] usb 4-1: unable to get BOS descriptor or descriptor too short [ 139.935786][ T5868] usb 4-1: config 243 has an invalid interface number: 8 but max is 0 [ 139.950567][ T5868] usb 4-1: config 243 has no interface number 0 [ 139.963370][ T5868] usb 4-1: config 243 interface 8 has no altsetting 0 [ 139.988072][ T5868] usb 4-1: New USB device found, idVendor=0d9f, idProduct=0002, bcdDevice=fe.96 [ 140.016286][ T5868] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 140.032942][ T5868] usb 4-1: Product: syz [ 140.047015][ T5868] usb 4-1: Manufacturer: syz [ 140.051647][ T5868] usb 4-1: SerialNumber: syz [ 143.386499][ T5868] cypress_m8 4-1:243.8: HID->COM RS232 Adapter converter detected [ 143.442412][ T5868] cyphidcom ttyUSB0: required endpoint is missing [ 143.498144][ T5868] usb 4-1: USB disconnect, device number 3 [ 143.540357][ T5868] cypress_m8 4-1:243.8: device disconnected [ 145.967562][ T6290] ======================================================= [ 145.967562][ T6290] WARNING: The mand mount option has been deprecated and [ 145.967562][ T6290] and is ignored by this kernel. Remove the mand [ 145.967562][ T6290] option from the mount to silence this warning. [ 145.967562][ T6290] ======================================================= [ 145.970583][ T6290] jffs2: notice: (6290) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 146.990031][ T6298] jffs2: notice: (6298) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 147.729757][ T6305] Need at least one configuration in g1. [ 147.736220][ T6305] udc usbip-vudc.0: failed to start g1: -22 [ 147.742398][ T6305] configfs-gadget.g1: probe of gadget.32 failed with error -22 [ 147.757466][ T6305] UDC core: g1: couldn't find an available UDC or it's busy [ 147.787543][ T6305] UDC core: g1: couldn't find an available UDC or it's busy [ 150.524397][ T6315] netlink: 'syz.0.110': attribute type 8 has an invalid length. [ 151.666424][ T6325] netlink: 4 bytes leftover after parsing attributes in process `syz.1.103'. [ 153.169873][ T6324] syz.1.103: attempt to access beyond end of device [ 153.169873][ T6324] nbd1: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 153.183054][ T6324] gfs2: error 10 reading superblock [ 154.606287][ T6333] jffs2: notice: (6333) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 159.499766][ T6362] Need at least one configuration in g1. [ 159.505870][ T6362] udc usbip-vudc.0: failed to start g1: -22 [ 159.511970][ T6362] configfs-gadget.g1: probe of gadget.32 failed with error -22 [ 159.522064][ T6362] UDC core: g1: couldn't find an available UDC or it's busy [ 159.540998][ T6362] UDC core: g1: couldn't find an available UDC or it's busy [ 160.302322][ T6372] jffs2: notice: (6372) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 160.782924][ T6378] netlink: 4 bytes leftover after parsing attributes in process `syz.1.125'. [ 160.838222][ T6378] syz.1.125: attempt to access beyond end of device [ 160.838222][ T6378] nbd1: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 161.937059][ T6378] gfs2: error 10 reading superblock [ 164.961514][ T6401] netdevsim netdevsim3: Direct firmware load for ./file0 failed with error -2 [ 164.971254][ T6401] netdevsim netdevsim3: Falling back to sysfs fallback for: ./file0 [ 166.075955][ T6415] Need at least one configuration in g1. [ 166.082240][ T6415] udc usbip-vudc.0: failed to start g1: -22 [ 166.088343][ T6415] configfs-gadget.g1: probe of gadget.32 failed with error -22 [ 166.099840][ T6415] UDC core: g1: couldn't find an available UDC or it's busy [ 166.121677][ T6415] UDC core: g1: couldn't find an available UDC or it's busy [ 166.467148][ T3073] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 166.782065][ T3073] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 166.946989][ T3073] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 166.984917][ T3073] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 167.017891][ T3073] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 167.528267][ T6422] Zero length message leads to an empty skb [ 168.339436][ T3073] usb 4-1: config 0 descriptor?? [ 168.786582][ T3073] pyra 0003:1E7D:2CF6.0001: unknown main item tag 0x2 [ 168.844358][ T3073] pyra 0003:1E7D:2CF6.0001: hidraw0: USB HID v0.00 Device [HID 1e7d:2cf6] on usb-dummy_hcd.3-1/input0 [ 168.974511][ T3073] pyra 0003:1E7D:2CF6.0001: couldn't init struct pyra_device [ 169.002669][ T3073] pyra 0003:1E7D:2CF6.0001: couldn't install mouse [ 169.051807][ T3073] pyra: probe of 0003:1E7D:2CF6.0001 failed with error -71 [ 169.106288][ T3073] usb 4-1: USB disconnect, device number 4 [ 169.805509][ T6439] fido_id[6439]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 171.425055][ T3073] kernel read not supported for file /swradio3 (pid: 3073 comm: kworker/1:2) [ 172.856809][ T6462] netdevsim netdevsim2: Direct firmware load for ./file0 failed with error -2 [ 172.866067][ T6462] netdevsim netdevsim2: Falling back to sysfs fallback for: ./file0 [ 173.670795][ T6466] netlink: 4 bytes leftover after parsing attributes in process `syz.0.136'. [ 173.681142][ T6466] syz.0.136: attempt to access beyond end of device [ 173.681142][ T6466] nbd0: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 173.694251][ T6466] gfs2: error 10 reading superblock [ 176.209364][ T6477] XFS (loop0): Cannot mount filesystem with identical rtdev and ddev/logdev. [ 183.688824][ T6538] syz.2.158 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 183.904386][ T6542] netdevsim netdevsim0: Direct firmware load for ./file0 failed with error -2 [ 183.913696][ T6542] netdevsim netdevsim0: Falling back to sysfs fallback for: ./file0 [ 186.932868][ T6556] netlink: 4 bytes leftover after parsing attributes in process `syz.3.155'. [ 186.943460][ T6556] syz.3.155: attempt to access beyond end of device [ 186.943460][ T6556] nbd3: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 186.956725][ T6556] gfs2: error 10 reading superblock [ 187.552722][ T6559] IPv6: NLM_F_CREATE should be specified when creating new route [ 187.561164][ T6559] netlink: 'syz.1.162': attribute type 1 has an invalid length. [ 194.063203][ T6589] netlink: 4 bytes leftover after parsing attributes in process `syz.2.172'. [ 194.073727][ T6589] syz.2.172: attempt to access beyond end of device [ 194.073727][ T6589] nbd2: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 194.087355][ T6589] gfs2: error 10 reading superblock [ 194.670641][ T6592] IPv6: NLM_F_CREATE should be specified when creating new route [ 194.679235][ T6592] netlink: 'syz.0.173': attribute type 1 has an invalid length. [ 195.396850][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 195.403226][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 202.316695][ T5793] Bluetooth: hci1: command 0x0406 tx timeout [ 202.316721][ T5792] Bluetooth: hci2: command 0x0406 tx timeout [ 202.322790][ T5793] Bluetooth: hci0: command 0x0406 tx timeout [ 202.964233][ T6627] netdevsim netdevsim1: Direct firmware load for ./file0 failed with error -2 [ 202.973952][ T6627] netdevsim netdevsim1: Falling back to sysfs fallback for: ./file0 [ 203.772430][ T6626] netlink: 4 bytes leftover after parsing attributes in process `syz.0.182'. [ 203.783054][ T6626] syz.0.182: attempt to access beyond end of device [ 203.783054][ T6626] nbd0: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 203.796198][ T6626] gfs2: error 10 reading superblock [ 205.209919][ T6636] jffs2: notice: (6636) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 208.640551][ T6651] jffs2: notice: (6651) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 210.508919][ T6662] netdevsim netdevsim3: Direct firmware load for ./file0 failed with error -2 [ 210.518145][ T6662] netdevsim netdevsim3: Falling back to sysfs fallback for: ./file0 [ 211.297597][ T6666] syz.0.193: attempt to access beyond end of device [ 211.297597][ T6666] nbd0: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 211.310664][ T6666] gfs2: error 10 reading superblock [ 216.100369][ T6689] jffs2: notice: (6689) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 221.367303][ T176] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 221.616547][ T176] usb 1-1: device descriptor read/all, error -71 [ 221.678333][ T6722] jffs2: notice: (6722) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 224.244320][ T6743] netdevsim netdevsim2: Direct firmware load for ./file0 failed with error -2 [ 224.253424][ T6743] netdevsim netdevsim2: Falling back to sysfs fallback for: ./file0 [ 228.031362][ T6765] jffs2: notice: (6765) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 236.328643][ T6805] netdevsim netdevsim2: Direct firmware load for ./file0 failed with error -2 [ 236.337669][ T6805] netdevsim netdevsim2: Falling back to sysfs fallback for: ./file0 [ 238.287099][ T5873] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 238.496593][ T5873] usb 3-1: config 0 has an invalid interface number: 51 but max is 0 [ 238.510890][ T5873] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 238.541279][ T5873] usb 3-1: config 0 has no interface number 0 [ 238.559798][ T5873] usb 3-1: New USB device found, idVendor=cc35, idProduct=693f, bcdDevice=e7.0f [ 238.573037][ T5873] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 238.596933][ T5873] usb 3-1: Product: syz [ 238.601169][ T5873] usb 3-1: Manufacturer: syz [ 238.607427][ T5873] usb 3-1: SerialNumber: syz [ 238.633236][ T5873] usb 3-1: config 0 descriptor?? [ 238.850664][ T176] usb 3-1: USB disconnect, device number 2 [ 243.011433][ T6850] netdevsim netdevsim3: Direct firmware load for ./file0 failed with error -2 [ 243.020710][ T6850] netdevsim netdevsim3: Falling back to sysfs fallback for: ./file0 [ 245.059824][ T6859] vivid-000: ================= START STATUS ================= [ 245.107041][ T6859] vivid-000: Test Pattern: 75% Colorbar [ 245.112999][ T6859] vivid-000: Fill Percentage of Frame: 100 [ 245.246984][ T6859] vivid-000: Horizontal Movement: No Movement [ 245.324292][ T6859] vivid-000: Vertical Movement: No Movement [ 245.435889][ T6864] Bluetooth: (null): Invalid header checksum [ 246.068662][ T6859] vivid-000: OSD Text Mode: All [ 246.092718][ T6859] vivid-000: Show Border: false [ 246.486933][ T6859] vivid-000: Show Square: false [ 246.519173][ T6859] vivid-000: Sensor Flipped Horizontally: false [ 246.644075][ T6859] vivid-000: Sensor Flipped Vertically: false [ 246.676956][ T6859] vivid-000: Insert SAV Code in Image: false [ 246.687086][ T6859] vivid-000: Insert EAV Code in Image: false [ 246.693134][ T6859] vivid-000: Insert Video Guard Band: false [ 246.817002][ T6859] vivid-000: Reduced Framerate: false [ 246.867004][ T6859] vivid-000: Enable Capture Cropping: true [ 246.872933][ T6859] vivid-000: Enable Capture Composing: true [ 246.944872][ T6859] vivid-000: Enable Capture Scaler: true [ 247.015469][ T6859] vivid-000: Timestamp Source: End of Frame [ 247.057047][ T6859] vivid-000: Colorspace: sRGB [ 247.093419][ T6859] vivid-000: Transfer Function: Default [ 247.143538][ T6859] vivid-000: Y'CbCr Encoding: Default [ 247.190023][ T6859] vivid-000: HSV Encoding: Hue 0-179 [ 247.244521][ T6859] vivid-000: Quantization: Default [ 247.288064][ T6859] vivid-000: Apply Alpha To Red Only: false [ 247.360504][ T6859] vivid-000: Standard Aspect Ratio: 4x3 [ 247.409721][ T6859] vivid-000: DV Timings Signal Mode: Current DV Timings inactive [ 247.456984][ T6859] vivid-000: DV Timings: 640x480p59 inactive [ 247.474271][ T6859] vivid-000: DV Timings Aspect Ratio: Source Width x Height [ 247.518140][ T6859] vivid-000: Maximum EDID Blocks: 2 [ 247.665190][ T6859] vivid-000: Limited RGB Range (16-235): false [ 247.685987][ T6859] vivid-000: Rx RGB Quantization Range: Automatic [ 247.709939][ T6859] vivid-000: Power Present: 0x00000001 [ 247.769207][ T6879] o2cb: This node has not been configured. [ 247.775283][ T6879] o2cb: Cluster check failed. Fix errors before retrying. [ 247.782571][ T6879] (syz.1.233,6879,1):user_dlm_register:674 ERROR: status = -22 [ 247.790237][ T6879] (syz.1.233,6879,1):dlmfs_mkdir:438 ERROR: Error -22 could not register domain "domain1" [ 248.569306][ T6859] tpg source WxH: 640x360 (Y'CbCr) [ 248.574476][ T6859] tpg field: 1 [ 248.646587][ T6859] tpg crop: 640x360@0x0 [ 248.717248][ T6859] tpg compose: 640x360@0x0 [ 248.721719][ T6859] tpg colorspace: 8 [ 248.725531][ T6859] tpg transfer function: 0/0 [ 248.773404][ T6859] tpg Y'CbCr encoding: 0/0 [ 248.778170][ T6859] tpg quantization: 0/0 [ 248.782351][ T6859] tpg RGB range: 0/2 [ 248.786252][ T6859] vivid-000: ================== END STATUS ================== [ 250.930477][ T6906] netdevsim netdevsim3: Direct firmware load for ./file0 failed with error -2 [ 250.939606][ T6906] netdevsim netdevsim3: Falling back to sysfs fallback for: ./file0 [ 254.568638][ T6920] tipc: Started in network mode [ 254.573653][ T6920] tipc: Node identity 4, cluster identity 4711 [ 254.580002][ T6920] tipc: Node number set to 4 [ 255.277949][ T6922] loop6: detected capacity change from 0 to 7 [ 255.382520][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 255.391881][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 255.416976][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 255.426181][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 255.450918][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 255.460121][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 255.649401][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 255.658589][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 255.687748][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 255.696939][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 255.727045][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 255.736203][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 255.758523][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 255.767691][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 255.777048][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 255.786193][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 255.796904][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 255.806048][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 255.819610][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 255.819626][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.828786][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 255.848479][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.857214][ T6922] ldm_validate_partition_table(): Disk read failed. [ 257.188540][ T6922] Dev loop6: unable to read RDB block 0 [ 257.367024][ T6922] loop6: unable to read partition table [ 257.402848][ T6922] loop6: partition table beyond EOD, truncated [ 257.431160][ T6922] loop_reread_partitions: partition scan of loop6 (úùƒå¡™‰ü¾CêjÌ–ã¢P=ý?ã}X‹ºÐ œëÜ%õ«`ÉæÖ€ù…ˆ{í©Ö˜Èµ4FLQkÝŠ) failed (rc=-5) [ 262.111381][ T5800] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 262.120553][ T5800] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 262.159529][ T5800] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 262.217863][ T5800] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 262.238161][ T5800] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 262.245548][ T5800] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 262.456199][ T6947] rxe_eth0 speed is unknown, defaulting to 1000 [ 264.356974][ T5099] Bluetooth: hci4: command tx timeout [ 264.583569][ T50] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 265.201089][ T50] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 265.547134][ T50] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 265.779665][ T6965] netdevsim netdevsim1: Direct firmware load for ./file0 failed with error -2 [ 265.788762][ T6965] netdevsim netdevsim1: Falling back to sysfs fallback for: ./file0 [ 266.046755][ T6947] chnl_net:caif_netlink_parms(): no params data found [ 266.369198][ T50] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 266.438325][ T5099] Bluetooth: hci4: command tx timeout [ 266.827041][ T6947] bridge0: port 1(bridge_slave_0) entered blocking state [ 266.844952][ T6947] bridge0: port 1(bridge_slave_0) entered disabled state [ 266.863353][ T6947] bridge_slave_0: entered allmulticast mode [ 266.899801][ T6947] bridge_slave_0: entered promiscuous mode [ 268.277557][ T6947] bridge0: port 2(bridge_slave_1) entered blocking state [ 268.284700][ T6947] bridge0: port 2(bridge_slave_1) entered disabled state [ 268.328515][ T6947] bridge_slave_1: entered allmulticast mode [ 268.336330][ T6947] bridge_slave_1: entered promiscuous mode [ 268.515996][ T6947] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 268.526832][ T5099] Bluetooth: hci4: command tx timeout [ 268.564256][ T6947] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 268.715145][ T6947] team0: Port device team_slave_0 added [ 268.751394][ T6947] team0: Port device team_slave_1 added [ 268.813771][ T6947] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 268.847756][ T6947] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 268.926963][ T6947] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 268.959068][ T6947] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 268.966048][ T6947] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 269.067462][ T6947] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 269.738754][ T6999] UDC core: g1: couldn't find an available UDC or it's busy [ 270.606941][ T5099] Bluetooth: hci4: command tx timeout [ 271.138065][ T7005] netdevsim netdevsim3: Direct firmware load for ./file0 failed with error -2 [ 271.162519][ T7005] netdevsim netdevsim3: Falling back to sysfs fallback for: ./file0 [ 272.513118][ T6947] hsr_slave_0: entered promiscuous mode [ 272.581552][ T6947] hsr_slave_1: entered promiscuous mode [ 272.642523][ T6947] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 272.662169][ T6947] Cannot create hsr debugfs directory [ 276.652496][ T6947] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 276.787351][ T6947] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 276.810190][ T6947] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 276.861508][ T6947] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 279.468079][ T6947] 8021q: adding VLAN 0 to HW filter on device bond0 [ 280.331794][ T7064] netdevsim netdevsim3: Direct firmware load for ./file0 failed with error -2 [ 280.360427][ T6947] 8021q: adding VLAN 0 to HW filter on device team0 [ 280.371410][ T7064] netdevsim netdevsim3: Falling back to sysfs fallback for: ./file0 [ 281.688563][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 281.695745][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 281.732057][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 281.739260][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 282.046968][ T5868] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 282.166980][ T50] hsr_slave_0: left promiscuous mode [ 282.219455][ T50] hsr_slave_1: left promiscuous mode [ 282.260335][ T50] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 282.275142][ T50] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 282.288617][ T5868] usb 2-1: config index 0 descriptor too short (expected 23569, got 27) [ 282.299394][ T50] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 282.306822][ T50] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 282.314180][ T5868] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 282.334746][ T5868] usb 2-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 282.344320][ T5868] usb 2-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 282.353299][ T50] bridge_slave_1: left allmulticast mode [ 282.366933][ T5868] usb 2-1: Manufacturer: syz [ 282.382204][ T50] bridge_slave_1: left promiscuous mode [ 282.393007][ T5868] usb 2-1: config 0 descriptor?? [ 282.408231][ T50] bridge0: port 2(bridge_slave_1) entered disabled state [ 282.458461][ T50] bridge_slave_0: left allmulticast mode [ 282.464161][ T50] bridge_slave_0: left promiscuous mode [ 282.497089][ T50] bridge0: port 1(bridge_slave_0) entered disabled state [ 282.577022][ T5868] rc_core: IR keymap rc-hauppauge not found [ 282.582974][ T5868] Registered IR keymap rc-empty [ 282.607971][ T5868] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 282.649137][ T5868] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input9 [ 282.696366][ T50] veth1_macvtap: left promiscuous mode [ 282.713125][ T50] veth0_macvtap: left promiscuous mode [ 282.734660][ T50] veth1_vlan: left promiscuous mode [ 282.757881][ T50] veth0_vlan: left promiscuous mode [ 282.927376][ C0] igorplugusb 2-1:0.0: receive overflow invalid: 15 [ 283.045169][ T7097] xt_TPROXY: Can be used only with -p tcp or -p udp [ 284.512533][ T176] usb 2-1: USB disconnect, device number 3 [ 286.244051][ T50] team0 (unregistering): Port device team_slave_1 removed [ 286.353038][ T50] team0 (unregistering): Port device team_slave_0 removed [ 286.493254][ T50] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 286.710243][ T50] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 288.014659][ T50] bond0 (unregistering): Released all slaves [ 288.027406][ T5873] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 288.262033][ T5873] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 288.308505][ T5873] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 288.352959][ T5873] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 288.403457][ T5873] usb 2-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 288.444874][ T5873] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 288.665840][ T5873] gspca_main: spca501-2.14.0 probing 0000:0000 [ 288.839180][ T7119] netdevsim netdevsim3: Direct firmware load for ./file0 failed with error -2 [ 289.035293][ T7119] netdevsim netdevsim3: Falling back to sysfs fallback for: ./file0 [ 289.391126][ T7131] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 290.929075][ T5873] gspca_spca501: reg write: error -110 [ 290.935491][ T5873] spca501 2-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 290.965785][ T5873] spca501: probe of 2-1:1.0 failed with error -22 [ 291.205964][ T6947] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 292.064097][ T6947] veth0_vlan: entered promiscuous mode [ 292.091903][ T6947] veth1_vlan: entered promiscuous mode [ 292.162409][ T6947] veth0_macvtap: entered promiscuous mode [ 292.220654][ T6947] veth1_macvtap: entered promiscuous mode [ 292.296173][ T6947] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 292.343075][ T6947] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 292.369005][ T6947] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 292.492566][ T6947] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 292.506396][ T6947] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 292.517060][ T6947] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 292.528546][ T6947] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 292.540809][ T6947] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 292.551525][ T6947] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 292.576538][ T5426] usb 2-1: USB disconnect, device number 4 [ 292.583477][ T6947] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 292.713689][ T6947] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 292.746827][ T6947] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 292.787166][ T6947] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 292.800602][ T6947] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 292.838949][ T6947] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 292.838974][ T6947] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 292.838989][ T6947] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 292.839003][ T6947] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 293.681221][ T7170] tty tty1: ldisc open failed (-12), clearing slot 0 [ 293.688989][ T7175] FAULT_INJECTION: forcing a failure. [ 293.688989][ T7175] name failslab, interval 1, probability 0, space 0, times 0 [ 293.740062][ T7175] CPU: 1 PID: 7175 Comm: syz.3.301 Not tainted syzkaller #0 [ 293.747404][ T7175] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 293.757478][ T7175] Call Trace: [ 293.760746][ T7175] [ 293.763661][ T7175] dump_stack_lvl+0x18c/0x250 [ 293.768339][ T7175] ? show_regs_print_info+0x20/0x20 [ 293.773522][ T7175] ? load_image+0x420/0x420 [ 293.778005][ T7175] ? __might_sleep+0xe0/0xe0 [ 293.782583][ T7175] ? __lock_acquire+0x7eb0/0x7eb0 [ 293.787593][ T7175] should_fail_ex+0x394/0x4c0 [ 293.792256][ T7175] should_failslab+0x9/0x20 [ 293.796739][ T7175] slab_pre_alloc_hook+0x59/0x300 [ 293.801747][ T7175] ? aa_path_link+0xf80/0xf80 [ 293.806409][ T7175] kmem_cache_alloc_node+0x5e/0x320 [ 293.811590][ T7175] ? __alloc_skb+0x103/0x2c0 [ 293.816164][ T7175] __alloc_skb+0x103/0x2c0 [ 293.820565][ T7175] vhci_write+0xc2/0x460 [ 293.824799][ T7175] vfs_write+0x474/0x9a0 [ 293.829031][ T7175] ? file_end_write+0x250/0x250 [ 293.833894][ T7175] ? __fget_files+0x3fc/0x460 [ 293.838575][ T7175] ? __fdget_pos+0x1d8/0x330 [ 293.843152][ T7175] ? ksys_write+0x74/0x260 [ 293.847567][ T7175] ksys_write+0x151/0x260 [ 293.851901][ T7175] ? __ia32_sys_read+0x90/0x90 [ 293.856659][ T7175] ? lockdep_hardirqs_on+0x98/0x150 [ 293.861849][ T7175] do_syscall_64+0x55/0xb0 [ 293.866252][ T7175] ? clear_bhb_loop+0x40/0x90 [ 293.870918][ T7175] ? clear_bhb_loop+0x40/0x90 [ 293.875590][ T7175] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 293.881481][ T7175] RIP: 0033:0x7f6779f5fd8e [ 293.885888][ T7175] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 293.905486][ T7175] RSP: 002b:00007f677aeeefb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 293.913885][ T7175] RAX: ffffffffffffffda RBX: 00007f677aeef6c0 RCX: 00007f6779f5fd8e [ 293.921841][ T7175] RDX: 000000000000000b RSI: 0000000000000000 RDI: 00000000000000ca [ 293.929797][ T7175] RBP: 00007f677a036b20 R08: 0000000000000000 R09: 0000000000000000 [ 293.937753][ T7175] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 293.945722][ T7175] R13: 00007f677a226038 R14: 00007f677a225fa0 R15: 00007ffd2c55fce8 [ 293.953690][ T7175] [ 293.997357][ T50] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 294.017069][ T50] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 294.112307][ T1147] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 294.132108][ T1147] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 295.629549][ T7244] netdevsim netdevsim3: Direct firmware load for ./file0 failed with error -2 [ 295.638660][ T7244] netdevsim netdevsim3: Falling back to sysfs fallback for: ./file0 [ 296.865698][ T7254] Need at least one configuration in g1. [ 296.871481][ T7254] udc usbip-vudc.0: failed to start g1: -22 [ 296.877562][ T7254] configfs-gadget.g1: probe of gadget.32 failed with error -22 [ 296.886059][ T7254] UDC core: g1: couldn't find an available UDC or it's busy [ 296.986979][ T7254] UDC core: g1: couldn't find an available UDC or it's busy [ 298.844391][ T5800] Bluetooth: hci3: command 0x0406 tx timeout [ 300.663274][ T7286] jffs2: notice: (7286) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 302.141754][ T7297] netdevsim netdevsim3: Direct firmware load for ./file0 failed with error -2 [ 302.150808][ T7297] netdevsim netdevsim3: Falling back to sysfs fallback for: ./file0 [ 306.681508][ T7334] jffs2: notice: (7334) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 308.933588][ T7350] netdevsim netdevsim4: Direct firmware load for ./file0 failed with error -2 [ 308.942992][ T7350] netdevsim netdevsim4: Falling back to sysfs fallback for: ./file0 [ 314.982379][ T7386] jffs2: notice: (7386) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 317.429361][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.435686][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.253355][ T7414] tipc: Started in network mode [ 318.258623][ T7414] tipc: Node identity 4, cluster identity 4711 [ 318.269149][ T7414] tipc: Node number set to 4 [ 323.057385][ T7443] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 323.177519][ T7448] netlink: 24 bytes leftover after parsing attributes in process `syz.1.337'. [ 323.278259][ T7447] jffs2: notice: (7447) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 330.343256][ T7496] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 330.536447][ T7499] netlink: 24 bytes leftover after parsing attributes in process `syz.4.352'. [ 333.033535][ T7515] jffs2: notice: (7515) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 335.038337][ T7528] netlink: 4 bytes leftover after parsing attributes in process `syz.4.357'. [ 335.055114][ T7528] syz.4.357: attempt to access beyond end of device [ 335.055114][ T7528] nbd4: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 335.068421][ T7528] gfs2: error 10 reading superblock [ 338.738037][ T7541] syzkaller0: entered promiscuous mode [ 338.743550][ T7541] syzkaller0: entered allmulticast mode [ 343.879534][ T7593] jffs2: notice: (7593) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 348.822293][ T7622] netlink: 4 bytes leftover after parsing attributes in process `syz.2.365'. [ 348.840232][ T7622] syz.2.365: attempt to access beyond end of device [ 348.840232][ T7622] nbd2: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 348.853679][ T7622] gfs2: error 10 reading superblock [ 356.776113][ T7671] o2cb: This node has not been configured. [ 356.782218][ T7671] o2cb: Cluster check failed. Fix errors before retrying. [ 356.789409][ T7671] (syz.4.381,7671,1):user_dlm_register:674 ERROR: status = -22 [ 356.797011][ T7671] (syz.4.381,7671,1):dlmfs_mkdir:438 ERROR: Error -22 could not register domain "domain1" [ 357.178830][ T7682] netdevsim netdevsim2: Direct firmware load for ./file0 failed with error -2 [ 357.187958][ T7682] netdevsim netdevsim2: Falling back to sysfs fallback for: ./file0 [ 359.853135][ T7704] jffs2: notice: (7704) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 360.179180][ T7701] tipc: Started in network mode [ 360.184111][ T7701] tipc: Node identity 4, cluster identity 4711 [ 360.190424][ T7701] tipc: Node number set to 4 [ 360.525935][ T7711] netlink: 4 bytes leftover after parsing attributes in process `syz.3.382'. [ 360.543477][ T7711] syz.3.382: attempt to access beyond end of device [ 360.543477][ T7711] nbd3: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 360.556960][ T7711] gfs2: error 10 reading superblock [ 361.467760][ T7715] syzkaller0: entered promiscuous mode [ 361.473291][ T7715] syzkaller0: entered allmulticast mode [ 365.229611][ T7746] netdevsim netdevsim4: Direct firmware load for ./file0 failed with error -2 [ 365.238998][ T7746] netdevsim netdevsim4: Falling back to sysfs fallback for: ./file0 [ 365.923058][ T7754] netlink: 24 bytes leftover after parsing attributes in process `syz.2.393'. [ 366.011259][ T7754] bridge0: port 2(bridge_slave_1) entered disabled state [ 367.399207][ T7754] bridge_slave_1 (unregistering): left allmulticast mode [ 367.434628][ T7754] bridge_slave_1 (unregistering): left promiscuous mode [ 367.470639][ T7754] bridge0: port 2(bridge_slave_1) entered disabled state [ 373.935927][ T7818] jffs2: notice: (7818) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 374.137093][ T5873] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 376.218979][ T5873] usb 4-1: config 4 has an invalid interface number: 44 but max is 0 [ 376.227505][ T5873] usb 4-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 376.241722][ T5873] usb 4-1: config 4 has no interface number 0 [ 376.248382][ T5873] usb 4-1: config 4 interface 44 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 376.264673][ T5873] usb 4-1: New USB device found, idVendor=1044, idProduct=7001, bcdDevice= 5.20 [ 376.274094][ T5873] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 376.299565][ T5873] usb 4-1: Product: syz [ 376.303770][ T5873] usb 4-1: Manufacturer: syz [ 376.309294][ T5873] usb 4-1: SerialNumber: syz [ 376.887511][ T7840] jffs2: notice: (7840) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 377.111324][ T5873] dvb-usb: found a 'Gigabyte U7000' in cold state, will try to load a firmware [ 377.191866][ T5873] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 377.227167][ T5873] dib0700: firmware download failed at 7 with -22 [ 377.292521][ T5873] usb 4-1: USB disconnect, device number 5 [ 378.046424][ T5873] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 378.683120][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.689491][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.760343][ T5873] usb 4-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 379.776977][ T5873] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 379.787392][ T5873] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 379.797035][ T5873] usb 4-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 379.806639][ T5873] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 380.605037][ T5873] usb 4-1: can't set config #1, error -71 [ 380.636982][ T5873] usb 4-1: USB disconnect, device number 6 [ 384.711977][ T7887] jffs2: notice: (7887) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 386.943954][ T5800] Bluetooth: hci4: command 0x0406 tx timeout [ 387.216990][ T7910] jffs2: notice: (7910) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 389.842970][ T7924] jffs2: notice: (7924) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 392.930805][ T7943] jffs2: notice: (7943) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 394.106448][ T7952] Bluetooth: (null): Invalid header checksum [ 395.152357][ T7958] Need at least one configuration in g1. [ 395.158175][ T7958] udc usbip-vudc.0: failed to start g1: -22 [ 395.164065][ T7958] configfs-gadget.g1: probe of gadget.32 failed with error -22 [ 395.172073][ T7958] UDC core: g1: couldn't find an available UDC or it's busy [ 395.183721][ T7958] UDC core: g1: couldn't find an available UDC or it's busy [ 400.439652][ T7986] jffs2: notice: (7986) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 403.476783][ T8002] Need at least one configuration in g1. [ 403.482762][ T8002] udc usbip-vudc.0: failed to start g1: -22 [ 403.488725][ T8002] configfs-gadget.g1: probe of gadget.32 failed with error -22 [ 403.497115][ T8002] UDC core: g1: couldn't find an available UDC or it's busy [ 403.516954][ T8002] UDC core: g1: couldn't find an available UDC or it's busy [ 406.860227][ T8021] jffs2: notice: (8021) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 410.475864][ T8038] input: syz0 as /devices/virtual/input/input10 [ 410.482937][ T8038] input: failed to attach handler leds to device input10, error: -6 [ 413.677482][ T8064] jffs2: notice: (8064) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 413.709455][ T176] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 414.231689][ T176] usb 2-1: Using ep0 maxpacket: 16 [ 414.553619][ T176] usb 2-1: config 3 has an invalid interface number: 88 but max is 0 [ 414.553646][ T176] usb 2-1: config 3 has no interface number 0 [ 414.553677][ T176] usb 2-1: config 3 interface 88 has no altsetting 0 [ 414.559786][ T176] usb 2-1: New USB device found, idVendor=0830, idProduct=0080, bcdDevice=5c.a8 [ 414.559813][ T176] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 414.559833][ T176] usb 2-1: Product: syz [ 414.559847][ T176] usb 2-1: Manufacturer: syz [ 414.559861][ T176] usb 2-1: SerialNumber: syz [ 414.797452][ T176] kl5kusb105 2-1:3.88: KL5KUSB105D / PalmConnect converter detected [ 414.814168][ T176] usb 2-1: KL5KUSB105D / PalmConnect converter now attached to ttyUSB0 [ 414.828480][ T176] usb 2-1: USB disconnect, device number 5 [ 414.833611][ T176] kl5kusb105d ttyUSB0: KL5KUSB105D / PalmConnect converter now disconnected from ttyUSB0 [ 414.845391][ T176] kl5kusb105 2-1:3.88: device disconnected [ 416.558089][ T8082] input: syz0 as /devices/virtual/input/input11 [ 416.558245][ T8082] input: failed to attach handler leds to device input11, error: -6 [ 418.580510][ T8090] netlink: 4 bytes leftover after parsing attributes in process `syz.1.468'. [ 418.989867][ T8092] Need at least one configuration in g1. [ 418.995603][ T8092] udc usbip-vudc.0: failed to start g1: -22 [ 419.001914][ T8092] configfs-gadget.g1: probe of gadget.32 failed with error -22 [ 419.009938][ T8092] UDC core: g1: couldn't find an available UDC or it's busy [ 419.068621][ T8092] UDC core: g1: couldn't find an available UDC or it's busy [ 419.264421][ T8096] jffs2: notice: (8096) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 420.706292][ T8102] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 423.685416][ T8126] Bluetooth: (null): Too short H5 packet [ 426.721409][ T8130] Need at least one configuration in g1. [ 426.727216][ T8130] udc usbip-vudc.0: failed to start g1: -22 [ 426.733098][ T8130] configfs-gadget.g1: probe of gadget.32 failed with error -22 [ 426.741333][ T8130] UDC core: g1: couldn't find an available UDC or it's busy [ 426.751512][ T8130] UDC core: g1: couldn't find an available UDC or it's busy [ 426.904593][ T8133] jffs2: notice: (8133) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 433.460807][ T8170] jffs2: notice: (8170) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 434.601106][ T8176] Bluetooth: (null): Too short H5 packet [ 435.995029][ T8185] jffs2: notice: (8185) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 437.848417][ T8195] netdevsim netdevsim4: Direct firmware load for ./file0 failed with error -2 [ 437.857353][ T8195] netdevsim netdevsim4: Falling back to sysfs fallback for: ./file0 [ 440.197487][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.203834][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 441.585298][ T8211] jffs2: notice: (8211) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 442.597015][ T8216] jffs2: notice: (8216) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 449.264576][ T8248] jffs2: notice: (8248) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 449.282746][ T8247] netdevsim netdevsim4: Direct firmware load for ./file0 failed with error -2 [ 449.291759][ T8247] netdevsim netdevsim4: Falling back to sysfs fallback for: ./file0 [ 454.758519][ T8286] jffs2: notice: (8286) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 457.173701][ T8298] netdevsim netdevsim1: Direct firmware load for ./file0 failed with error -2 [ 457.182726][ T8298] netdevsim netdevsim1: Falling back to sysfs fallback for: ./file0 [ 457.512752][ T8304] Bluetooth: (null): Too short H5 packet [ 459.927234][ T8310] tipc: Enabled bearer , priority 0 [ 459.961398][ T8310] syzkaller0: entered promiscuous mode [ 459.977172][ T8310] syzkaller0: entered allmulticast mode [ 460.017678][ T8310] tipc: Resetting bearer [ 460.033749][ T8305] tipc: Resetting bearer [ 460.101837][ T8305] tipc: Disabling bearer [ 464.639585][ T8340] Bluetooth: (null): Too short H5 packet [ 467.943284][ T8353] tipc: Enabled bearer , priority 0 [ 467.960580][ T8353] syzkaller0: entered promiscuous mode [ 467.966083][ T8353] syzkaller0: entered allmulticast mode [ 467.987645][ T8353] tipc: Resetting bearer [ 468.011217][ T8352] tipc: Resetting bearer [ 468.061997][ T8352] tipc: Disabling bearer [ 468.764245][ T8357] netdevsim netdevsim3: Direct firmware load for ./file0 failed with error -2 [ 468.773265][ T8357] netdevsim netdevsim3: Falling back to sysfs fallback for: ./file0 [ 469.337414][ T23] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 470.708329][ T23] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 470.828648][ T23] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 470.947173][ T23] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 471.052279][ T23] usb 3-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 471.152531][ T23] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 471.308060][ T23] gspca_main: spca501-2.14.0 probing 0000:0000 [ 472.827299][ T23] gspca_spca501: reg write: error -110 [ 472.843152][ T23] spca501 3-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 472.857403][ T23] spca501: probe of 3-1:1.0 failed with error -22 [ 472.994305][ T23] usb 3-1: USB disconnect, device number 3 [ 481.080676][ T8413] netlink: 'syz.2.548': attribute type 4 has an invalid length. [ 481.286049][ T8413] netlink: 'syz.2.548': attribute type 17 has an invalid length. [ 481.487692][ T5874] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 481.781034][ T5874] usb 5-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 481.880733][ T5874] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 482.004159][ T5874] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 482.130785][ T5874] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 482.245260][ T5874] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 482.471005][ T5874] gspca_main: spca501-2.14.0 probing 0000:0000 [ 482.899139][ T8421] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 483.223680][ T5874] gspca_spca501: reg write: error -110 [ 483.279350][ T5874] spca501 5-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 483.353911][ T5874] spca501: probe of 5-1:1.0 failed with error -22 [ 486.037457][ T9] usb 5-1: USB disconnect, device number 2 [ 486.535778][ T8430] tipc: Enabled bearer , priority 0 [ 486.575187][ T8430] syzkaller0: entered promiscuous mode [ 486.614352][ T8430] syzkaller0: entered allmulticast mode [ 486.697136][ T8430] tipc: Resetting bearer [ 486.726375][ T8429] tipc: Resetting bearer [ 487.835708][ T8429] tipc: Disabling bearer [ 491.927180][ T42] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 492.191232][ T42] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 492.285634][ T42] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 492.391264][ T42] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 492.506618][ T42] usb 3-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 492.628581][ T42] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 492.840427][ T42] gspca_main: spca501-2.14.0 probing 0000:0000 [ 494.868205][ T42] gspca_spca501: reg write: error -110 [ 494.873684][ T42] spca501 3-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 494.919424][ T42] spca501: probe of 3-1:1.0 failed with error -22 [ 495.113008][ T8] usb 3-1: USB disconnect, device number 4 [ 495.659965][ T8474] Bluetooth: (null): Too short H5 packet [ 496.163433][ T8479] tipc: Enabled bearer , priority 0 [ 496.191733][ T8479] syzkaller0: entered promiscuous mode [ 496.217789][ T8479] syzkaller0: entered allmulticast mode [ 496.264478][ T8479] tipc: Resetting bearer [ 496.293698][ T8478] tipc: Resetting bearer [ 496.441171][ T8478] tipc: Disabling bearer [ 497.431043][ T8488] futex_wake_op: syz.2.571 tries to shift op by 144; fix this program [ 497.533271][ T8492] jffs2: notice: (8492) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 500.466950][ T42] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 501.570092][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.673710][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.959981][ T8521] Invalid ELF header magic: != ELF [ 502.890001][ T8525] tipc: Enabled bearer , priority 0 [ 502.910523][ T8525] syzkaller0: entered promiscuous mode [ 502.916037][ T8525] syzkaller0: entered allmulticast mode [ 502.946893][ T8525] tipc: Resetting bearer [ 502.970607][ T8524] tipc: Resetting bearer [ 503.130162][ T8524] tipc: Disabling bearer [ 504.155353][ T8538] futex_wake_op: syz.1.582 tries to shift op by 144; fix this program [ 507.732248][ T8549] Bluetooth: (null): Too short H5 packet [ 511.802821][ T8564] futex_wake_op: syz.4.592 tries to shift op by 144; fix this program [ 515.243563][ T8578] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 516.172125][ T5923] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 518.625767][ T5923] usb 2-1: device descriptor read/all, error -71 [ 520.389924][ T8604] warning: `syz.1.601' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 524.025795][ T8616] Need at least one configuration in g1. [ 524.032020][ T8616] udc usbip-vudc.0: failed to start g1: -22 [ 524.038347][ T8616] configfs-gadget.g1: probe of gadget.32 failed with error -22 [ 524.048620][ T8616] UDC core: g1: couldn't find an available UDC or it's busy [ 524.069572][ T8616] UDC core: g1: couldn't find an available UDC or it's busy [ 527.820700][ T8634] futex_wake_op: syz.1.603 tries to shift op by 144; fix this program [ 529.367046][ T5923] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 529.644553][ T5923] usb 5-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 529.738349][ T5923] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 529.850523][ T5923] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 529.984315][ T5923] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 530.081825][ T5923] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 530.297675][ T5923] gspca_main: spca501-2.14.0 probing 0000:0000 [ 530.593037][ T8651] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 532.137173][ T5923] gspca_spca501: reg write: error -110 [ 532.246232][ T5923] spca501 5-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 532.253596][ T5923] spca501: probe of 5-1:1.0 failed with error -22 [ 532.459108][ T8659] Need at least one configuration in g1. [ 532.466274][ T8659] udc usbip-vudc.0: failed to start g1: -22 [ 532.472343][ T8659] configfs-gadget.g1: probe of gadget.32 failed with error -22 [ 532.484661][ T8659] UDC core: g1: couldn't find an available UDC or it's busy [ 532.507019][ T8659] UDC core: g1: couldn't find an available UDC or it's busy [ 533.348161][ T42] usb 5-1: USB disconnect, device number 3 [ 534.318824][ T8674] fuse: Bad value for 'fd' [ 534.467872][ T8671] netlink: 8 bytes leftover after parsing attributes in process `syz.4.619'. [ 534.477096][ T8671] syz.4.619 uses obsolete (PF_INET,SOCK_PACKET) [ 539.121595][ T8695] Need at least one configuration in g1. [ 539.127870][ T8695] udc usbip-vudc.0: failed to start g1: -22 [ 539.133902][ T8695] configfs-gadget.g1: probe of gadget.32 failed with error -22 [ 539.143657][ T8695] UDC core: g1: couldn't find an available UDC or it's busy [ 539.164513][ T8695] UDC core: g1: couldn't find an available UDC or it's busy [ 541.313930][ T8704] futex_wake_op: syz.1.620 tries to shift op by 144; fix this program [ 542.888031][ T8706] syz.2.625: attempt to access beyond end of device [ 542.888031][ T8706] nbd2: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 542.901133][ T8706] gfs2: error 10 reading superblock [ 543.198929][ T8716] fuse: Bad value for 'fd' [ 549.161837][ T8742] futex_wake_op: syz.3.638 tries to shift op by 144; fix this program [ 550.517832][ T8752] syz.3.639: attempt to access beyond end of device [ 550.517832][ T8752] nbd3: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 550.531718][ T8752] gfs2: error 10 reading superblock [ 551.243729][ T8754] netdevsim netdevsim2: Direct firmware load for ./file0 failed with error -2 [ 551.252675][ T8754] netdevsim netdevsim2: Falling back to sysfs fallback for: ./file0 [ 552.626988][ T42] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 554.040235][ T42] usb 5-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 554.080436][ T42] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 554.171804][ T42] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 555.656881][ T42] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 555.725552][ T42] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 555.784318][ T42] usb 5-1: can't set config #1, error -71 [ 555.799182][ T42] usb 5-1: USB disconnect, device number 4 [ 555.949031][ T8787] syz.3.649: attempt to access beyond end of device [ 555.949031][ T8787] nbd3: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 555.962608][ T8787] gfs2: error 10 reading superblock [ 556.811120][ T8791] netdevsim netdevsim3: Direct firmware load for ./file0 failed with error -2 [ 556.820076][ T8791] netdevsim netdevsim3: Falling back to sysfs fallback for: ./file0 [ 557.693408][ T8801] jffs2: notice: (8801) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 562.260562][ T8825] syz.1.661: attempt to access beyond end of device [ 562.260562][ T8825] nbd1: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 562.273932][ T8825] gfs2: error 10 reading superblock [ 563.002824][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.047413][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.397145][ T5426] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 563.747133][ T42] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 565.199228][ T8840] netdevsim netdevsim2: Direct firmware load for ./file0 failed with error -2 [ 565.208179][ T8840] netdevsim netdevsim2: Falling back to sysfs fallback for: ./file0 [ 565.247956][ T5426] usb 2-1: Using ep0 maxpacket: 32 [ 565.271461][ T5426] usb 2-1: config 0 has an invalid interface number: 12 but max is 0 [ 565.292160][ T5426] usb 2-1: config 0 has no interface number 0 [ 565.305477][ T5426] usb 2-1: config 0 interface 12 has no altsetting 0 [ 566.180448][ T42] usb 5-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 566.197015][ T42] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 566.227069][ T42] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 566.241140][ T42] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 566.251013][ T5426] usb 2-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 566.265136][ T42] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 566.282418][ T5426] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 566.294273][ T5426] usb 2-1: Product: syz [ 566.299027][ T5426] usb 2-1: Manufacturer: syz [ 566.311018][ T42] gspca_main: spca501-2.14.0 probing 0000:0000 [ 566.319595][ T5426] usb 2-1: config 0 descriptor?? [ 566.340547][ T5426] usb 2-1: can't set config #0, error -71 [ 566.367327][ T5426] usb 2-1: USB disconnect, device number 9 [ 566.847404][ T42] gspca_spca501: reg write: error -110 [ 567.195294][ T42] spca501 5-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 567.252903][ T42] spca501: probe of 5-1:1.0 failed with error -22 [ 567.316667][ T42] usb 5-1: USB disconnect, device number 5 [ 569.488667][ T8865] syz.2.671: attempt to access beyond end of device [ 569.488667][ T8865] nbd2: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 569.501848][ T8865] gfs2: error 10 reading superblock [ 570.384884][ T8873] Need at least one configuration in g1. [ 570.391099][ T8873] udc usbip-vudc.0: failed to start g1: -22 [ 570.404558][ T8873] configfs-gadget.g1: probe of gadget.32 failed with error -22 [ 570.415104][ T8873] UDC core: g1: couldn't find an available UDC or it's busy [ 570.438488][ T8873] UDC core: g1: couldn't find an available UDC or it's busy [ 571.108157][ T8876] netdevsim netdevsim1: Direct firmware load for ./file0 failed with error -2 [ 571.117204][ T8876] netdevsim netdevsim1: Falling back to sysfs fallback for: ./file0 [ 572.918495][ T8884] tipc: Enabled bearer , priority 0 [ 572.972533][ T8884] tipc: Resetting bearer [ 573.048470][ T8883] tipc: Disabling bearer [ 574.850603][ T8894] syz.1.682: attempt to access beyond end of device [ 574.850603][ T8894] nbd1: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 574.863790][ T8894] gfs2: error 10 reading superblock [ 577.335660][ T8914] netdevsim netdevsim1: Direct firmware load for ./file0 failed with error -2 [ 577.344584][ T8914] netdevsim netdevsim1: Falling back to sysfs fallback for: ./file0 [ 580.808852][ T8931] futex_wake_op: syz.2.689 tries to shift op by 144; fix this program [ 587.811024][ T8959] netdevsim netdevsim1: Direct firmware load for ./file0 failed with error -2 [ 587.820931][ T8959] netdevsim netdevsim1: Falling back to sysfs fallback for: ./file0 [ 588.022427][ T8966] syz.3.691: attempt to access beyond end of device [ 588.022427][ T8966] nbd3: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 588.035725][ T8966] gfs2: error 10 reading superblock [ 588.780879][ T8969] futex_wake_op: syz.1.702 tries to shift op by 144; fix this program [ 589.283160][ T8972] jffs2: notice: (8972) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 590.986950][ T5923] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 591.207366][ T5923] usb 4-1: Using ep0 maxpacket: 8 [ 591.374140][ T5923] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 591.387921][ T5923] usb 4-1: config 179 has no interface number 0 [ 591.394389][ T5923] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 591.457919][ T5923] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 591.469612][ T5923] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 52, changing to 9 [ 591.481209][ T5923] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid maxpacket 8241, setting to 1024 [ 591.492740][ T5923] usb 4-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 591.506983][ T5923] usb 4-1: config 179 interface 65 has no altsetting 0 [ 591.514005][ T5923] usb 4-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 591.540337][ T5923] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 592.803274][ T5923] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:179.65/input/input12 [ 592.887318][ T5138] input input12: unable to receive magic message: -110 [ 592.927545][ T5138] input input12: unable to receive magic message: -32 [ 592.996281][ T8465] usb 4-1: USB disconnect, device number 7 [ 592.999438][ C0] xpad 4-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 593.006951][ T5138] input input12: unable to receive magic message: -32 [ 593.013026][ C0] xpad 4-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 593.028927][ T8465] xpad 4-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 593.185153][ T8999] Need at least one configuration in g1. [ 593.193959][ T8999] udc usbip-vudc.0: failed to start g1: -22 [ 593.200340][ T8999] configfs-gadget.g1: probe of gadget.32 failed with error -22 [ 593.212512][ T8999] UDC core: g1: couldn't find an available UDC or it's busy [ 593.264259][ T8999] UDC core: g1: couldn't find an available UDC or it's busy [ 595.597972][ T9006] syz.3.711: attempt to access beyond end of device [ 595.597972][ T9006] nbd3: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 595.611253][ T9006] gfs2: error 10 reading superblock [ 598.468982][ T9023] netdevsim netdevsim1: Direct firmware load for ./file0 failed with error -2 [ 598.477929][ T9023] netdevsim netdevsim1: Falling back to sysfs fallback for: ./file0 [ 601.218199][ T9044] futex_wake_op: syz.4.712 tries to shift op by 144; fix this program [ 604.794592][ T27] audit: type=1807 audit(1793422070.038:2): action=appraise func=POLICY_CHECK res=1 [ 604.795236][ T9055] ima: policy update completed [ 606.037010][ T27] audit: type=1802 audit(1793422070.068:3): pid=9055 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=completed comm="syz.3.719" res=1 errno=0 [ 606.389101][ T9060] netdevsim netdevsim3: Direct firmware load for ./file0 failed with error -2 [ 606.398170][ T9060] netdevsim netdevsim3: Falling back to sysfs fallback for: ./file0 [ 610.650576][ T9084] futex_wake_op: syz.1.732 tries to shift op by 144; fix this program [ 611.757338][ T9087] tipc: Enabled bearer , priority 0 [ 611.768459][ T9087] syzkaller0: entered promiscuous mode [ 611.774077][ T9087] syzkaller0: entered allmulticast mode [ 611.799804][ T9087] tipc: Resetting bearer [ 611.821054][ T9086] tipc: Resetting bearer [ 611.871938][ T9086] tipc: Disabling bearer [ 613.318397][ T8465] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 614.326934][ T8465] usb 4-1: Using ep0 maxpacket: 8 [ 614.352533][ T8465] usb 4-1: New USB device found, idVendor=046d, idProduct=08b5, bcdDevice=3a.11 [ 614.382317][ T8465] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 614.402446][ T8465] usb 4-1: Product: syz [ 614.412675][ T8465] usb 4-1: Manufacturer: syz [ 614.449304][ T8465] usb 4-1: SerialNumber: syz [ 614.876588][ T8465] usb 4-1: config 0 descriptor?? [ 616.462899][ T8465] usb 4-1: can't set config #0, error -71 [ 616.483668][ T8465] usb 4-1: USB disconnect, device number 8 [ 619.142115][ C0] vcan0: j1939_tp_rxtimer: 0xffff888069554c00: rx timeout, send abort [ 619.156872][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff888069554c00: 0x40000: (3) A timeout occurred and this is the connection abort to close the session. [ 623.457091][ T8] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 623.666203][ T8] usb 5-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 623.769049][ T8] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 623.877244][ T8] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 623.978160][ T8] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 624.080290][ T8] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 624.467793][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 626.499517][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 626.633422][ T8] usb 5-1: can't set config #1, error -71 [ 626.659845][ T8] usb 5-1: USB disconnect, device number 6 [ 627.087140][ T176] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 627.266950][ T176] usb 2-1: Using ep0 maxpacket: 32 [ 627.274365][ T176] usb 2-1: config 0 has an invalid interface number: 12 but max is 0 [ 627.282911][ T176] usb 2-1: config 0 has no interface number 0 [ 627.303876][ T176] usb 2-1: config 0 interface 12 has no altsetting 0 [ 627.321829][ T176] usb 2-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 627.333902][ T176] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 627.374501][ T176] usb 2-1: Product: syz [ 627.396860][ T176] usb 2-1: Manufacturer: syz [ 627.410975][ T176] usb 2-1: SerialNumber: syz [ 627.444163][ T176] usb 2-1: config 0 descriptor?? [ 629.456214][ T176] f81534 2-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 629.487622][ T176] f81534 2-1:0.12: f81534_find_config_idx: read failed: -71 [ 629.517724][ T176] f81534 2-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 629.542246][ T176] f81534: probe of 2-1:0.12 failed with error -71 [ 629.676318][ T176] usb 2-1: USB disconnect, device number 10 [ 633.216921][ T9201] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 633.611677][ T9201] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 633.703832][ T9201] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 633.828556][ T9201] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 633.952301][ T9201] usb 2-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 634.057350][ T9201] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 634.414659][ T9201] gspca_main: spca501-2.14.0 probing 0000:0000 [ 634.730677][ T9204] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 635.234314][ T9201] gspca_spca501: reg write: error -110 [ 635.291483][ T9201] spca501 2-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 635.379654][ T9201] spca501: probe of 2-1:1.0 failed with error -22 [ 636.579755][ T42] usb 2-1: USB disconnect, device number 11 [ 639.144633][ T9216] Bluetooth: (null): Invalid header checksum [ 639.452502][ T9221] lo: entered allmulticast mode [ 639.464616][ T9219] lo: left allmulticast mode [ 641.846951][ T5868] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 642.254934][ T5868] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 642.389292][ T5868] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 642.512907][ T5868] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 642.635162][ T5868] usb 2-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 642.738335][ T5868] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 643.074703][ T5868] gspca_main: spca501-2.14.0 probing 0000:0000 [ 643.699993][ T9236] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 643.757541][ T5868] gspca_spca501: reg write: error -110 [ 643.835102][ T5868] spca501 2-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 643.914518][ T5868] spca501: probe of 2-1:1.0 failed with error -22 [ 646.997932][ T42] usb 2-1: USB disconnect, device number 12 [ 647.142539][ T9246] futex_wake_op: syz.1.774 tries to shift op by 144; fix this program [ 647.199222][ T9246] netlink: 12 bytes leftover after parsing attributes in process `syz.1.774'. [ 649.644142][ T9259] Bluetooth: (null): Invalid header checksum [ 656.286935][ T176] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 657.605003][ T176] usb 5-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 657.647596][ T176] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 657.669772][ T176] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 657.704792][ T176] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 657.721304][ T176] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 657.746549][ T176] gspca_main: spca501-2.14.0 probing 0000:0000 [ 658.737289][ T176] gspca_spca501: reg write: error -110 [ 658.742818][ T176] spca501 5-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 658.763214][ T176] spca501: probe of 5-1:1.0 failed with error -22 [ 658.848116][ T9295] futex_wake_op: syz.2.784 tries to shift op by 144; fix this program [ 658.875345][ T9277] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 658.895765][ T9295] netlink: 12 bytes leftover after parsing attributes in process `syz.2.784'. [ 662.452065][ T9305] Bluetooth: (null): Invalid header checksum [ 663.277252][ T5870] usb 5-1: USB disconnect, device number 7 [ 663.799939][ T9315] tipc: Enabled bearer , priority 0 [ 663.830642][ T9315] syzkaller0: entered promiscuous mode [ 663.836358][ T9315] syzkaller0: entered allmulticast mode [ 663.882101][ T9315] tipc: Resetting bearer [ 663.921529][ T9314] tipc: Resetting bearer [ 664.082137][ T9314] tipc: Disabling bearer [ 665.376411][ T9329] futex_wake_op: syz.4.795 tries to shift op by 144; fix this program [ 665.487352][ T9329] netlink: 12 bytes leftover after parsing attributes in process `syz.4.795'. [ 668.938667][ T9337] netlink: 'syz.3.796': attribute type 1 has an invalid length. [ 671.798412][ T9201] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 672.975751][ T9201] usb 3-1: device descriptor read/all, error -71 [ 673.190294][ T9353] netlink: 'syz.1.794': attribute type 4 has an invalid length. [ 673.338812][ T9353] netlink: 'syz.1.794': attribute type 17 has an invalid length. [ 673.499242][ T9356] netlink: 12 bytes leftover after parsing attributes in process `syz.2.802'. [ 673.578209][ T9357] syz.2.802: attempt to access beyond end of device [ 673.578209][ T9357] nbd2: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 673.591525][ T9357] gfs2: error 10 reading superblock [ 674.493010][ T9366] tipc: Enabled bearer , priority 0 [ 674.494201][ T9368] futex_wake_op: syz.4.805 tries to shift op by 144; fix this program [ 675.311731][ T9372] syzkaller0: entered promiscuous mode [ 675.332700][ T9372] syzkaller0: entered allmulticast mode [ 675.367673][ T9366] tipc: Resetting bearer [ 675.463658][ T9365] tipc: Resetting bearer [ 677.061005][ T9365] tipc: Disabling bearer [ 677.088639][ T9376] netdevsim netdevsim1: Direct firmware load for ./file0 failed with error -2 [ 677.115370][ T9376] netdevsim netdevsim1: Falling back to sysfs fallback for: ./file0 [ 677.680245][ T9381] IPv6: NLM_F_CREATE should be specified when creating new route [ 677.688952][ T9381] netlink: 'syz.4.807': attribute type 1 has an invalid length. [ 678.964599][ T9389] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 680.711946][ T9395] Bluetooth: (null): Invalid header checksum [ 681.286521][ T9398] netlink: 12 bytes leftover after parsing attributes in process `syz.1.811'. [ 681.357912][ T9398] syz.1.811: attempt to access beyond end of device [ 681.357912][ T9398] nbd1: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 681.373133][ T9398] gfs2: error 10 reading superblock [ 683.036867][ T8465] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 683.236971][ T8465] usb 4-1: Using ep0 maxpacket: 16 [ 683.249147][ T8465] usb 4-1: config 1 has an invalid interface number: 105 but max is 0 [ 683.266796][ T8465] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 683.304662][ T8465] usb 4-1: config 1 has no interface number 0 [ 683.314907][ T8465] usb 4-1: config 1 interface 105 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 683.422169][ T9414] Bluetooth: (null): Invalid header checksum [ 684.055850][ T8465] usb 4-1: config 1 interface 105 has no altsetting 0 [ 684.837383][ T9416] IPv6: NLM_F_CREATE should be specified when creating new route [ 684.846049][ T9416] netlink: 'syz.2.816': attribute type 1 has an invalid length. [ 685.764410][ T8465] usb 4-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 685.775187][ T8465] usb 4-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 685.784440][ T8465] usb 4-1: Product: syz [ 685.789327][ T8465] usb 4-1: Manufacturer: syz [ 685.794042][ T8465] usb 4-1: SerialNumber: syz [ 685.892161][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.900507][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.033051][ T8465] aqc111: probe of 4-1:1.105 failed with error -22 [ 686.067242][ T8465] usb 4-1: USB disconnect, device number 9 [ 686.183399][ T9426] netdevsim netdevsim4: Direct firmware load for ./file0 failed with error -2 [ 686.192488][ T9426] netdevsim netdevsim4: Falling back to sysfs fallback for: ./file0 [ 689.511361][ T9442] UDC core: g1: couldn't find an available UDC or it's busy [ 691.719485][ T9452] netlink: 'syz.1.825': attribute type 1 has an invalid length. [ 692.803789][ T9463] netdevsim netdevsim4: Direct firmware load for ./file0 failed with error -2 [ 692.813187][ T9463] netdevsim netdevsim4: Falling back to sysfs fallback for: ./file0 [ 693.121633][ T9467] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 695.789698][ T9471] syz.3.821: attempt to access beyond end of device [ 695.789698][ T9471] nbd3: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 695.803269][ T9471] gfs2: error 10 reading superblock [ 697.170897][ T9487] Bluetooth: (null): Invalid header checksum [ 699.804940][ T9491] netlink: 'syz.2.834': attribute type 1 has an invalid length. [ 701.122609][ T9501] netdevsim netdevsim1: Direct firmware load for ./file0 failed with error -2 [ 701.131734][ T9501] netdevsim netdevsim1: Falling back to sysfs fallback for: ./file0 [ 702.944639][ T9510] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 709.072491][ T9535] netlink: 'syz.3.844': attribute type 1 has an invalid length. [ 709.692860][ T9528] Bluetooth: (null): Invalid header checksum [ 710.095817][ T9540] netdevsim netdevsim2: Direct firmware load for ./file0 failed with error -2 [ 710.104932][ T9540] netdevsim netdevsim2: Falling back to sysfs fallback for: ./file0 [ 714.545890][ T9563] netlink: 'syz.1.853': attribute type 1 has an invalid length. [ 715.919034][ T9577] jffs2: notice: (9577) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 719.994940][ T9597] netdevsim netdevsim2: Direct firmware load for ./file0 failed with error -2 [ 720.004075][ T9597] netdevsim netdevsim2: Falling back to sysfs fallback for: ./file0 [ 728.058879][ T9639] jffs2: notice: (9639) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 728.613950][ T9650] futex_wake_op: syz.2.873 tries to shift op by 144; fix this program [ 729.647914][ T9652] netlink: 'syz.3.868': attribute type 1 has an invalid length. [ 729.813013][ T9657] netdevsim netdevsim1: Direct firmware load for ./file0 failed with error -2 [ 729.823251][ T9657] netdevsim netdevsim1: Falling back to sysfs fallback for: ./file0 [ 735.133256][ T9674] jffs2: notice: (9674) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 735.534452][ T9686] futex_wake_op: syz.3.882 tries to shift op by 144; fix this program [ 735.553078][ T9687] netdevsim netdevsim1: Direct firmware load for ./file0 failed with error -2 [ 735.562709][ T9687] netdevsim netdevsim1: Falling back to sysfs fallback for: ./file0 [ 740.677966][ T9715] netlink: 'syz.1.888': attribute type 1 has an invalid length. [ 742.130052][ T9722] jffs2: notice: (9722) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 742.703034][ T9727] netdevsim netdevsim2: Direct firmware load for ./file0 failed with error -2 [ 742.712094][ T9727] netdevsim netdevsim2: Falling back to sysfs fallback for: ./file0 [ 743.393239][ T9731] futex_wake_op: syz.1.893 tries to shift op by 144; fix this program [ 747.066760][ T9750] UDC core: g1: couldn't find an available UDC or it's busy [ 747.088369][ T9750] UDC core: g1: couldn't find an available UDC or it's busy [ 747.320742][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.464138][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 749.460408][ T9758] jffs2: notice: (9758) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 753.145748][ T9763] netlink: 'syz.1.901': attribute type 1 has an invalid length. [ 755.426941][ T9791] futex_wake_op: syz.2.904 tries to shift op by 144; fix this program [ 756.481344][ T9798] tipc: Enabled bearer , priority 0 [ 756.493907][ T9798] syzkaller0: entered promiscuous mode [ 756.500196][ T9798] syzkaller0: entered allmulticast mode [ 756.521094][ T9798] tipc: Resetting bearer [ 756.529610][ T9797] tipc: Resetting bearer [ 756.578061][ T9797] tipc: Disabling bearer [ 758.554639][ T9819] jffs2: notice: (9819) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 761.174916][ T9824] netlink: 'syz.2.915': attribute type 1 has an invalid length. [ 761.231981][ T9831] futex_wake_op: syz.3.918 tries to shift op by 144; fix this program [ 765.836938][ T8] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 767.435379][ T8] usb 5-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 767.457593][ T8] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 767.498283][ T8] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 767.539679][ T8] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 767.596395][ T8] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 767.676861][ T8] gspca_main: spca501-2.14.0 probing 0000:0000 [ 768.572093][ T8] gspca_spca501: reg write: error -110 [ 768.735664][ T8] spca501 5-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 768.837180][ T8] spca501: probe of 5-1:1.0 failed with error -22 [ 769.298982][ T9850] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 769.603360][ T9869] jffs2: notice: (9869) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 770.460657][ T5870] usb 5-1: USB disconnect, device number 8 [ 771.899608][ T9880] futex_wake_op: syz.2.931 tries to shift op by 144; fix this program [ 775.526776][ T9894] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 777.595112][ T9201] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 778.882778][ T9918] jffs2: notice: (9918) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 780.325978][ T9201] usb 3-1: device descriptor read/all, error -71 [ 780.597624][ T9925] futex_wake_op: syz.2.944 tries to shift op by 144; fix this program [ 782.031648][ T9932] Bluetooth: (null): Invalid header checksum [ 784.548241][ T9939] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 786.567026][ T9201] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 788.180300][ T9958] futex_wake_op: syz.4.954 tries to shift op by 144; fix this program [ 788.329454][ T9201] usb 4-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 788.372558][ T9201] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 789.023220][ T9201] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 789.056756][ T9201] usb 4-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 789.137371][ T9201] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 789.258440][ T9201] usb 4-1: can't set config #1, error -71 [ 789.285185][ T9201] usb 4-1: USB disconnect, device number 10 [ 789.487707][ T9973] No source specified [ 790.641433][ T9978] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 795.127063][ T176] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 795.429028][ T176] usb 4-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 795.545440][ T176] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 795.675925][ T176] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 795.818592][ T176] usb 4-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 795.919185][ T176] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 796.269513][ T176] gspca_main: spca501-2.14.0 probing 0000:0000 [ 796.763312][T10002] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 796.903336][ T176] gspca_spca501: reg write: error -110 [ 796.965760][ T176] spca501 4-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 798.330901][T10000] Bluetooth: (null): Invalid header checksum [ 798.642765][ T176] spca501: probe of 4-1:1.0 failed with error -22 [ 799.741332][ T42] usb 4-1: USB disconnect, device number 11 [ 800.215137][T10022] netdevsim netdevsim1: Direct firmware load for ./file0 failed with error -2 [ 800.224427][T10022] netdevsim netdevsim1: Falling back to sysfs fallback for: ./file0 [ 800.819958][T10028] netlink: 'syz.4.968': attribute type 1 has an invalid length. [ 804.284460][T10045] Bluetooth: (null): Invalid header checksum [ 805.542031][T10047] tipc: Enabled bearer , priority 0 [ 805.635889][T10047] syzkaller0: entered promiscuous mode [ 805.817312][ T176] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 805.998910][T10047] syzkaller0: entered allmulticast mode [ 806.062739][ T176] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 807.500047][ T176] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 807.500507][T10047] tipc: Resetting bearer [ 807.556294][ T176] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 807.598584][T10046] tipc: Resetting bearer [ 807.624785][ T176] usb 2-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 808.914354][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.920853][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 808.942886][ T176] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 808.953282][T10046] tipc: Disabling bearer [ 809.042006][ T176] usb 2-1: can't set config #1, error -71 [ 809.072369][ T176] usb 2-1: USB disconnect, device number 13 [ 811.184970][T10067] netlink: 'syz.4.979': attribute type 1 has an invalid length. [ 812.180232][T10085] Bluetooth: (null): Invalid header checksum [ 816.552814][T10094] netdevsim netdevsim1: Direct firmware load for ./file0 failed with error -2 [ 816.562251][T10094] netdevsim netdevsim1: Falling back to sysfs fallback for: ./file0 [ 821.591718][T10112] netlink: 'syz.3.991': attribute type 1 has an invalid length. [ 824.444973][T10132] Bluetooth: (null): Invalid header checksum [ 825.196957][ T5426] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 825.630943][ T5426] usb 5-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 825.739848][ T5426] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 825.950287][ T5426] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 826.168211][ T5426] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 826.267057][ T5426] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 826.525547][ T5426] gspca_main: spca501-2.14.0 probing 0000:0000 [ 826.942952][T10140] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 827.175932][ T5426] gspca_spca501: reg write: error -110 [ 827.242472][ T5426] spca501 5-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 827.323923][ T5426] spca501: probe of 5-1:1.0 failed with error -22 [ 827.471235][T10142] Bluetooth: MGMT ver 1.22 [ 829.107276][T10150] netdevsim netdevsim3: Direct firmware load for ./file0 failed with error -2 [ 829.116382][T10150] netdevsim netdevsim3: Falling back to sysfs fallback for: ./file0 [ 829.390384][ T8465] usb 5-1: USB disconnect, device number 9 [ 830.672012][T10168] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1002'. [ 831.546799][ T8465] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 831.787442][T10179] netlink: 'syz.4.1003': attribute type 1 has an invalid length. [ 832.199115][ T8465] usb 3-1: Using ep0 maxpacket: 16 [ 832.278232][ T8465] usb 3-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xF3, skipping [ 832.334253][ T8465] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 832.361983][ T8465] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 832.399349][ T8465] usb 3-1: Product: syz [ 832.421184][ T8465] usb 3-1: Manufacturer: syz [ 832.442003][ T8465] usb 3-1: SerialNumber: syz [ 832.497542][ T8465] usb 3-1: config 0 descriptor?? [ 833.667648][T10184] ima: signed policy file (specified as an absolute pathname) required [ 833.727674][T10186] ima: policy update failed [ 833.732752][ T27] audit: type=1802 audit(1793422298.978:4): pid=10184 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=signed policy required comm="syz.4.1005" res=0 errno=0 [ 833.780749][ T27] audit: type=1802 audit(1793422298.998:5): pid=10186 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.4.1005" res=0 errno=0 [ 833.976032][T10188] Bluetooth: (null): Invalid header checksum [ 834.447326][ T176] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 835.169347][ T176] usb 5-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 836.503599][ T176] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 836.730249][ T176] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 836.763191][ T5923] usb 3-1: USB disconnect, device number 9 [ 836.812518][ T176] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 836.882676][ T176] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 836.999654][ T176] gspca_main: spca501-2.14.0 probing 0000:0000 [ 837.163590][T10202] netdevsim netdevsim3: Direct firmware load for ./file0 failed with error -2 [ 837.173060][T10202] netdevsim netdevsim3: Falling back to sysfs fallback for: ./file0 [ 837.866807][ T176] gspca_spca501: reg write: error -110 [ 837.900105][ T176] spca501 5-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 838.006929][ T176] spca501: probe of 5-1:1.0 failed with error -22 [ 838.108734][ T5426] usb 5-1: USB disconnect, device number 10 [ 839.287990][T10210] netlink: 'syz.3.1013': attribute type 1 has an invalid length. [ 844.406098][T10239] netdevsim netdevsim4: Direct firmware load for ./file0 failed with error -2 [ 844.415311][T10239] netdevsim netdevsim4: Falling back to sysfs fallback for: ./file0 [ 846.094657][T10243] netlink: 'syz.1.1023': attribute type 1 has an invalid length. [ 848.483956][T10248] Bluetooth: (null): Invalid header checksum [ 850.154828][T10262] Bluetooth: (null): Invalid header checksum [ 855.222488][T10279] netlink: 'syz.2.1032': attribute type 1 has an invalid length. [ 855.696949][ T5426] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 855.927207][ T5426] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 855.977061][ T5426] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 856.039430][ T5426] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 856.102765][ T5426] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 856.137378][ T5426] usb 4-1: config 0 descriptor?? [ 858.085817][ T5426] usb 4-1: language id specifier not provided by device, defaulting to English [ 858.500893][ T5426] uclogic 0003:256C:006D.0002: interface is invalid, ignoring [ 859.030128][T10300] netdevsim netdevsim2: Direct firmware load for ./file0 failed with error -2 [ 859.039291][T10300] netdevsim netdevsim2: Falling back to sysfs fallback for: ./file0 [ 859.534785][T10309] process 'syz.1.1037' launched './file0' with NULL argv: empty string added [ 859.545027][T10309] Invalid argument reading file caps for ./file0 [ 860.478983][ T8465] usb 4-1: USB disconnect, device number 12 [ 860.520526][T10303] Bluetooth: (null): Invalid header checksum [ 861.713963][T10319] Need at least one configuration in g1. [ 861.720485][T10319] udc usbip-vudc.0: failed to start g1: -22 [ 862.003705][T10319] configfs-gadget.g1: probe of gadget.32 failed with error -22 [ 862.025631][T10319] UDC core: g1: couldn't find an available UDC or it's busy [ 862.060602][T10322] UDC core: g1: couldn't find an available UDC or it's busy [ 863.657281][T10324] netlink: 'syz.2.1041': attribute type 1 has an invalid length. [ 864.846079][T10337] netdevsim netdevsim3: Direct firmware load for ./file0 failed with error -2 [ 864.855242][T10337] netdevsim netdevsim3: Falling back to sysfs fallback for: ./file0 [ 867.070718][T10355] 9pnet_fd: Insufficient options for proto=fd [ 870.605162][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.611563][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.819716][T10376] netdevsim netdevsim3: Direct firmware load for ./file0 failed with error -2 [ 870.828859][T10376] netdevsim netdevsim3: Falling back to sysfs fallback for: ./file0 [ 872.269942][T10385] 9pnet_fd: Insufficient options for proto=fd [ 878.926154][T10416] Bluetooth: (null): Invalid header checksum [ 879.355144][T10421] 9pnet_fd: Insufficient options for proto=fd [ 883.728372][T10442] netdevsim netdevsim1: Direct firmware load for ./file0 failed with error -2 [ 883.741855][T10442] netdevsim netdevsim1: Falling back to sysfs fallback for: ./file0 [ 885.565265][ T5873] kworker/dying (5873) used greatest stack depth: 15864 bytes left [ 885.819642][T10459] Bluetooth: (null): Invalid header checksum [ 888.772555][T10466] Need at least one configuration in g1. [ 888.779106][T10466] udc usbip-vudc.0: failed to start g1: -22 [ 888.785321][T10466] configfs-gadget.g1: probe of gadget.32 failed with error -22 [ 888.795200][T10466] UDC core: g1: couldn't find an available UDC or it's busy [ 888.815865][T10466] UDC core: g1: couldn't find an available UDC or it's busy [ 894.906857][ T8465] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 895.158795][ T8465] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 895.187748][ T8465] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 32 [ 895.237642][ T8465] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 895.267107][ T8465] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 895.275157][ T8465] usb 2-1: Product: syz [ 895.286902][ T8465] usb 2-1: Manufacturer: syz [ 895.306759][ T8465] usb 2-1: SerialNumber: syz [ 895.633814][T10495] Bluetooth: (null): Invalid header checksum [ 895.657275][T10484] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 896.459070][T10484] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 896.703507][ T8465] cdc_ncm 2-1:1.0: failed to get mac address [ 896.711956][ T8465] cdc_ncm 2-1:1.0: bind() failure [ 896.726999][ T8465] cdc_ncm: probe of 2-1:1.1 failed with error -71 [ 896.759783][ T8465] cdc_mbim: probe of 2-1:1.1 failed with error -71 [ 896.806508][ T8465] usbtest: probe of 2-1:1.1 failed with error -71 [ 896.947370][T10505] Bluetooth: (null): Too short H5 packet [ 897.307140][ T8465] usb 2-1: USB disconnect, device number 14 [ 900.380330][T10515] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1093'. [ 900.766863][ T5870] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 900.953377][ T5870] usb 4-1: Using ep0 maxpacket: 16 [ 900.989981][ T5870] usb 4-1: too many configurations: 17, using maximum allowed: 8 [ 901.174823][ T5870] usb 4-1: string descriptor 0 read error: -71 [ 901.190807][ T5870] usb 4-1: New USB device found, idVendor=04e8, idProduct=a101, bcdDevice= 4.48 [ 901.253166][ T5870] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 901.296905][ T5870] r8152-cfgselector 4-1: rejected 8 configurations due to insufficient available bus power [ 901.345662][ T5870] r8152-cfgselector 4-1: no configuration chosen from 8 choices [ 901.366337][ T5870] r8152-cfgselector 4-1: Unknown version 0x0000 [ 901.407103][ T5870] r8152-cfgselector 4-1: USB disconnect, device number 13 [ 903.028525][T10537] Need at least one configuration in g1. [ 903.034780][T10537] udc usbip-vudc.0: failed to start g1: -22 [ 903.040873][T10537] configfs-gadget.g1: probe of gadget.32 failed with error -22 [ 903.051129][T10537] UDC core: g1: couldn't find an available UDC or it's busy [ 903.139753][T10537] UDC core: g1: couldn't find an available UDC or it's busy [ 905.089392][T10540] Bluetooth: (null): Invalid header checksum [ 910.105884][T10561] tmpfs: Bad value for 'mpol' [ 910.317712][T10558] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 913.050077][T10578] Bluetooth: (null): Invalid header checksum [ 914.416925][ T5923] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 914.697359][ T5923] usb 3-1: Using ep0 maxpacket: 8 [ 914.799679][ T5923] usb 3-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 914.944849][ T5923] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 915.266348][ T5923] pvrusb2: Hardware description: Terratec Grabster AV400 [ 915.381554][ T5923] pvrusb2: ********** [ 915.444865][ T5923] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 915.591506][ T5923] pvrusb2: Important functionality might not be entirely working. [ 915.711857][ T5923] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 915.838605][ T5923] pvrusb2: ********** [ 915.944437][ T2324] pvrusb2: Invalid write control endpoint [ 917.400168][ T2324] pvrusb2: Invalid write control endpoint [ 917.406201][ T2324] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 917.593495][ T2324] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 917.752823][ T2324] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 917.797834][ T2324] pvrusb2: Device being rendered inoperable [ 917.805727][ T2324] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 917.815313][ T2324] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 917.831820][ T2324] pvrusb2: Attached sub-driver cx25840 [ 917.837811][ T2324] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 917.851251][ T2324] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 917.906273][ T5426] usb 3-1: USB disconnect, device number 10 [ 921.059624][T10627] Bluetooth: (null): Invalid header checksum [ 925.149612][T10644] FAULT_INJECTION: forcing a failure. [ 925.149612][T10644] name failslab, interval 1, probability 0, space 0, times 0 [ 925.200981][T10644] CPU: 0 PID: 10644 Comm: syz.2.1127 Not tainted syzkaller #0 [ 925.208509][T10644] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 925.218592][T10644] Call Trace: [ 925.221976][T10644] [ 925.224997][T10644] dump_stack_lvl+0x18c/0x250 [ 925.229899][T10644] ? show_regs_print_info+0x20/0x20 [ 925.235191][T10644] ? load_image+0x420/0x420 [ 925.239770][T10644] ? __might_sleep+0xe0/0xe0 [ 925.244434][T10644] ? __lock_acquire+0x7eb0/0x7eb0 [ 925.249517][T10644] should_fail_ex+0x394/0x4c0 [ 925.254263][T10644] should_failslab+0x9/0x20 [ 925.258812][T10644] slab_pre_alloc_hook+0x59/0x300 [ 925.263896][T10644] ? tomoyo_encode+0x2ad/0x570 [ 925.268709][T10644] ? tomoyo_encode+0x2ad/0x570 [ 925.273508][T10644] __kmem_cache_alloc_node+0x53/0x260 [ 925.278907][T10644] ? tomoyo_encode+0x2ad/0x570 [ 925.283704][T10644] __kmalloc+0xa7/0x240 [ 925.287902][T10644] tomoyo_encode+0x2ad/0x570 [ 925.292531][T10644] tomoyo_realpath_from_path+0x57c/0x5c0 [ 925.298196][T10644] ? tomoyo_domain+0xd6/0x120 [ 925.302911][T10644] tomoyo_path_perm+0x282/0x560 [ 925.307907][T10644] ? tomoyo_path_perm+0x250/0x560 [ 925.312971][T10644] ? tomoyo_path_permission+0x3a0/0x3a0 [ 925.318606][T10644] security_inode_getattr+0xd3/0x120 [ 925.323924][T10644] __x64_sys_newfstat+0x12c/0x250 [ 925.328987][T10644] ? __ia32_sys_newfstatat+0x1f0/0x1f0 [ 925.334498][T10644] ? lockdep_hardirqs_on+0x98/0x150 [ 925.339832][T10644] do_syscall_64+0x55/0xb0 [ 925.344275][T10644] ? clear_bhb_loop+0x40/0x90 [ 925.349076][T10644] ? clear_bhb_loop+0x40/0x90 [ 925.353781][T10644] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 925.359711][T10644] RIP: 0033:0x7f2cb439f559 [ 925.364251][T10644] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 925.383952][T10644] RSP: 002b:00007f2cb522c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000005 [ 925.392410][T10644] RAX: ffffffffffffffda RBX: 00007f2cb4625fa0 RCX: 00007f2cb439f559 [ 925.400408][T10644] RDX: 0000000000000000 RSI: 00002000000003c0 RDI: 0000000000000003 [ 925.408410][T10644] RBP: 00007f2cb4436b20 R08: 0000000000000000 R09: 0000000000000000 [ 925.416439][T10644] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 925.424447][T10644] R13: 00007f2cb4626038 R14: 00007f2cb4625fa0 R15: 00007ffe3cc73398 [ 925.432466][T10644] [ 925.435518][ C0] vkms_vblank_simulate: vblank timer overrun [ 925.448713][T10644] ERROR: Out of memory at tomoyo_realpath_from_path. [ 927.396858][ T9201] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 927.467006][T10666] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 928.288949][ T9201] usb 5-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 928.309637][ T9201] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 928.346704][ T9201] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 928.355691][ T9201] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 928.381027][ T9201] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 928.403550][ T9201] gspca_main: spca501-2.14.0 probing 0000:0000 [ 929.465054][ T9201] gspca_spca501: reg write: error -110 [ 929.475021][ T9201] spca501 5-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 929.483005][ T9201] spca501: probe of 5-1:1.0 failed with error -22 [ 929.612611][T10682] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 930.767487][ T9201] usb 5-1: USB disconnect, device number 11 [ 931.297143][T10698] Bluetooth: MGMT ver 1.22 [ 931.641737][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.648215][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 932.279482][T10699] Unable to allocate crypto cipher with name [ecb(aes)]; rc = [-2] [ 932.288418][T10699] Error attempting to initialize key TFM cipher with name = [aes]; rc = [-2] [ 932.298554][T10699] Error attempting to initialize cipher with name = [aes] and key size = [16]; rc = [-2] [ 932.310018][T10699] Error parsing options; rc = [-22] [ 933.776047][T10717] Bluetooth: (null): Invalid header checksum [ 936.447050][ T8] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 936.639276][ T8] usb 4-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 936.667166][ T8] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 936.729898][ T8] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 936.819536][ T8] usb 4-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 936.828926][ T8] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 936.843791][ T8] gspca_main: spca501-2.14.0 probing 0000:0000 [ 937.179985][T10740] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 937.357210][ T8] gspca_spca501: reg write: error -110 [ 937.393254][ T8] spca501 4-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 937.418588][ T8] spca501: probe of 4-1:1.0 failed with error -22 [ 937.440608][T10732] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 939.758880][ T8] usb 4-1: USB disconnect, device number 14 [ 942.122763][T10769] syz.3.1160: attempt to access beyond end of device [ 942.122763][T10769] nbd3: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 942.136739][T10769] gfs2: error 10 reading superblock [ 947.685848][ T8465] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 947.986945][ T8465] usb 2-1: Using ep0 maxpacket: 8 [ 949.346025][ T8465] usb 2-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 949.386105][ T8465] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 949.465575][ T8465] pvrusb2: Hardware description: Terratec Grabster AV400 [ 949.525441][ T8465] pvrusb2: ********** [ 949.540314][ T8465] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 949.581406][ T8465] pvrusb2: Important functionality might not be entirely working. [ 949.601790][ T8465] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 949.624158][ T8465] pvrusb2: ********** [ 949.767343][ T2324] pvrusb2: Invalid write control endpoint [ 949.913333][ T2324] pvrusb2: Invalid write control endpoint [ 949.934144][ T2324] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 949.974380][ T2324] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 950.007428][ T176] usb 2-1: USB disconnect, device number 15 [ 950.022492][ T2324] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 950.081975][ T2324] pvrusb2: Device being rendered inoperable [ 950.110320][ T2324] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 950.152582][ T2324] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 950.189722][ T2324] pvrusb2: Attached sub-driver cx25840 [ 950.197794][ T2324] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 950.227788][ T2324] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 951.466684][ T8] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 951.740814][ T8] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 951.764285][ T8] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 951.774814][ T8] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 951.788645][ T8] usb 3-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 951.801012][ T8] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 951.838287][ T8] gspca_main: spca501-2.14.0 probing 0000:0000 [ 952.095349][T10811] syz.1.1169: attempt to access beyond end of device [ 952.095349][T10811] nbd1: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 952.108813][T10811] gfs2: error 10 reading superblock [ 953.888282][ T8] gspca_spca501: reg write: error -110 [ 953.963089][ T8] spca501 3-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 954.041468][ T8] spca501: probe of 3-1:1.0 failed with error -22 [ 954.123253][ T8] usb 3-1: USB disconnect, device number 11 [ 958.202172][T10832] Need at least one configuration in g1. [ 958.208477][T10832] udc usbip-vudc.0: failed to start g1: -22 [ 958.214558][T10832] configfs-gadget.g1: probe of gadget.32 failed with error -22 [ 958.224360][T10832] UDC core: g1: couldn't find an available UDC or it's busy [ 960.678060][T10844] syz.4.1178: attempt to access beyond end of device [ 960.678060][T10844] nbd4: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 960.691709][T10844] gfs2: error 10 reading superblock [ 962.536791][ T8465] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 963.567250][ T8465] usb 2-1: config 243 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 963.591815][ T8465] usb 2-1: config 243 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 963.610746][ T8465] usb 2-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 963.636676][ T8465] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 963.644725][ T8465] usb 2-1: Product: syz [ 963.656986][ T8465] usb 2-1: Manufacturer: syz [ 963.661627][ T8465] usb 2-1: SerialNumber: syz [ 963.687935][ T8465] ums-sddr09 2-1:243.0: USB Mass Storage device detected [ 963.713172][ T8465] ums-sddr09 2-1:243.0: This device (04e6,0005,0100 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 963.713172][ T8465] Please send a copy of this message to and [ 963.857041][ T8465] ums-sddr09: probe of 2-1:243.0 failed with error -22 [ 963.935250][ T8465] usb 2-1: USB disconnect, device number 16 [ 965.411536][ T5874] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 966.244529][ T5874] usb 4-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 966.276653][ T5874] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 966.294789][ T5874] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 966.327041][ T5874] usb 4-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 966.355562][ T5874] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 966.402114][ T5874] gspca_main: spca501-2.14.0 probing 0000:0000 [ 966.772442][T10881] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 966.955654][T10884] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1188'. [ 967.013364][T10885] syz.4.1188: attempt to access beyond end of device [ 967.013364][T10885] nbd4: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 967.026756][T10885] gfs2: error 10 reading superblock [ 967.654824][ T5874] gspca_spca501: reg write: error -110 [ 967.675106][ T5874] spca501 4-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 967.705181][ T5874] spca501: probe of 4-1:1.0 failed with error -22 [ 970.069201][ T176] usb 4-1: USB disconnect, device number 15 [ 971.038693][T10901] 9pnet_fd: Insufficient options for proto=fd [ 977.134678][T10931] ima: signed policy file (specified as an absolute pathname) required [ 977.144336][ T27] audit: type=1802 audit(1793422442.398:6): pid=10931 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=signed policy required comm="syz.1.1202" res=0 errno=0 [ 977.148372][T10931] ima: policy update failed [ 977.195949][ T27] audit: type=1802 audit(1793422442.438:7): pid=10931 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.1.1202" res=0 errno=0 [ 979.502207][T10942] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1205'. [ 979.561451][T10943] syz.1.1205: attempt to access beyond end of device [ 979.561451][T10943] nbd1: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 979.574869][T10943] gfs2: error 10 reading superblock [ 981.495532][T10947] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 983.606911][T10956] 9pnet_fd: Insufficient options for proto=fd [ 985.088432][T10967] ima: signed policy file (specified as an absolute pathname) required [ 985.097933][T10967] ima: policy update failed [ 985.106710][ T27] audit: type=1802 audit(1793422450.348:8): pid=10967 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=signed policy required comm="syz.4.1213" res=0 errno=0 [ 985.156930][ T27] audit: type=1802 audit(1793422450.348:9): pid=10967 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.4.1213" res=0 errno=0 [ 985.424782][T10971] Bluetooth: (null): Invalid header checksum [ 987.745790][T10977] Unable to allocate crypto cipher with name [ecb(aes)]; rc = [-2] [ 987.754612][T10977] Error attempting to initialize key TFM cipher with name = [aes]; rc = [-2] [ 987.780202][T10977] Error attempting to initialize cipher with name = [aes] and key size = [16]; rc = [-2] [ 987.989767][T10977] Error parsing options; rc = [-22] [ 993.091448][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 993.146951][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 993.597013][T11015] Unable to allocate crypto cipher with name [ecb(aes)]; rc = [-2] [ 993.604982][T11015] Error attempting to initialize key TFM cipher with name = [aes]; rc = [-2] [ 993.646849][T11015] Error attempting to initialize cipher with name = [aes] and key size = [16]; rc = [-2] [ 993.686922][T11015] Error parsing options; rc = [-22] [ 994.773535][T11032] Bluetooth: (null): Invalid header checksum [ 995.650341][T11035] ima: signed policy file (specified as an absolute pathname) required [ 995.742765][ T27] audit: type=1802 audit(1793422460.968:10): pid=11035 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=signed policy required comm="syz.2.1223" res=0 errno=0 [ 995.983620][T11037] ima: policy update failed [ 996.464352][ T27] audit: type=1802 audit(1793422461.278:11): pid=11037 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.2.1223" res=0 errno=0 [ 1001.097960][T11060] ima: signed policy file (specified as an absolute pathname) required [ 1001.148081][T11060] ima: policy update failed [ 1001.156646][ T27] audit: type=1802 audit(1793422466.398:12): pid=11060 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=signed policy required comm="syz.2.1238" res=0 errno=0 [ 1001.195631][ T27] audit: type=1802 audit(1793422466.398:13): pid=11060 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.2.1238" res=0 errno=0 [ 1006.976883][T11091] Unable to allocate crypto cipher with name [ecb(aes)]; rc = [-2] [ 1007.047661][T11091] Error attempting to initialize key TFM cipher with name = [aes]; rc = [-2] [ 1007.106718][T11091] Error attempting to initialize cipher with name = [aes] and key size = [16]; rc = [-2] [ 1007.146876][T11091] Error parsing options; rc = [-22] [ 1007.327714][T11098] ima: signed policy file (specified as an absolute pathname) required [ 1007.344907][ T27] audit: type=1802 audit(1793422472.578:14): pid=11098 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=signed policy required comm="syz.1.1247" res=0 errno=0 [ 1007.364585][T11098] ima: policy update failed [ 1007.416916][ T27] audit: type=1802 audit(1793422472.638:15): pid=11098 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.1.1247" res=0 errno=0 [ 1010.027573][T11118] Bluetooth: (null): Invalid header checksum [ 1013.928056][T11130] ima: signed policy file (specified as an absolute pathname) required [ 1013.950635][T11131] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1256'. [ 1013.960187][ T27] audit: type=1802 audit(1793422479.208:16): pid=11130 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=signed policy required comm="syz.1.1257" res=0 errno=0 [ 1013.960848][T11130] ima: policy update failed [ 1014.036884][ T27] audit: type=1802 audit(1793422479.258:17): pid=11130 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.1.1257" res=0 errno=0 [ 1015.494825][ T8465] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 1016.496790][ T8465] usb 4-1: Using ep0 maxpacket: 16 [ 1016.521844][ T8465] usb 4-1: too many configurations: 17, using maximum allowed: 8 [ 1016.577044][ T8465] usb 4-1: string descriptor 0 read error: -71 [ 1016.597047][ T8465] usb 4-1: New USB device found, idVendor=04e8, idProduct=a101, bcdDevice= 4.48 [ 1016.606268][ T8465] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1016.657777][ T8465] r8152-cfgselector 4-1: rejected 8 configurations due to insufficient available bus power [ 1016.696781][ T8465] r8152-cfgselector 4-1: no configuration chosen from 8 choices [ 1016.746982][ T8465] r8152-cfgselector 4-1: Unknown version 0x0000 [ 1016.755702][ T8465] r8152-cfgselector 4-1: USB disconnect, device number 16 [ 1018.161352][T11149] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 1019.568340][T11161] jffs2: notice: (11161) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1023.565606][T11185] syz.3.1265: attempt to access beyond end of device [ 1023.565606][T11185] nbd3: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 1023.578934][T11185] gfs2: error 10 reading superblock [ 1027.840680][T11210] Bluetooth: (null): Invalid header checksum [ 1028.580677][T11203] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 1033.417253][T11233] syz.1.1283: attempt to access beyond end of device [ 1033.417253][T11233] nbd1: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 1033.431089][T11233] gfs2: error 10 reading superblock [ 1034.936829][T11239] jffs2: notice: (11239) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1036.260124][T11254] Need at least one configuration in g1. [ 1036.266741][T11254] udc usbip-vudc.0: failed to start g1: -22 [ 1036.272899][T11254] configfs-gadget.g1: probe of gadget.32 failed with error -22 [ 1036.287212][T11254] UDC core: g1: couldn't find an available UDC or it's busy [ 1036.309094][T11254] UDC core: g1: couldn't find an available UDC or it's busy [ 1036.452918][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805ac5d400: rx timeout, send abort [ 1036.461926][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88805ac5d400: 0x40000: (3) A timeout occurred and this is the connection abort to close the session. [ 1038.117625][T11248] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 1042.175481][T11273] syz.3.1295: attempt to access beyond end of device [ 1042.175481][T11273] nbd3: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 1042.188865][T11273] gfs2: error 10 reading superblock [ 1048.011187][T11297] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1304'. [ 1048.215363][T11302] Need at least one configuration in g1. [ 1048.221664][T11302] udc usbip-vudc.0: failed to start g1: -22 [ 1048.227772][T11302] configfs-gadget.g1: probe of gadget.32 failed with error -22 [ 1048.245723][T11302] UDC core: g1: couldn't find an available UDC or it's busy [ 1048.270085][T11302] UDC core: g1: couldn't find an available UDC or it's busy [ 1049.795641][T11301] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1052.747490][T11317] fuse: Unknown parameter 'grou00000000000000000000' [ 1055.623409][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 1055.652080][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 1062.478625][T11364] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1324'. [ 1063.840283][T11371] fuse: Unknown parameter 'grou00000000000000000000' [ 1064.056813][ T5426] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 1064.267351][ T5426] usb 4-1: Using ep0 maxpacket: 16 [ 1064.281283][ T5426] usb 4-1: too many configurations: 17, using maximum allowed: 8 [ 1064.363132][ T5426] usb 4-1: string descriptor 0 read error: -71 [ 1064.370982][T11373] ------------[ cut here ]------------ [ 1064.377069][T11373] SVC: permsocks remain for nfsd [ 1064.387899][ T5426] usb 4-1: New USB device found, idVendor=04e8, idProduct=a101, bcdDevice= 4.48 [ 1064.407264][T11373] WARNING: CPU: 1 PID: 11373 at net/sunrpc/svc.c:645 svc_destroy+0x2ed/0x390 [ 1064.416274][T11373] Modules linked in: [ 1064.420318][T11373] CPU: 1 PID: 11373 Comm: syz.1.1326 Not tainted syzkaller #0 [ 1064.428254][T11373] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 1064.438676][T11373] RIP: 0010:svc_destroy+0x2ed/0x390 [ 1064.443920][T11373] Code: 24 49 83 c7 20 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 22 c3 2c f8 49 8b 37 48 c7 c7 20 12 fa 8b e8 13 5f 9d f7 <0f> 0b e9 78 fd ff ff e8 57 ba d3 f7 c6 05 7f 23 c4 05 01 4c 89 e0 [ 1064.464054][T11373] RSP: 0018:ffffc900033d7ae0 EFLAGS: 00010246 [ 1064.470251][T11373] RAX: 22037ab9770bf400 RBX: ffff88806b846050 RCX: 0000000000080000 [ 1064.478464][T11373] RDX: ffffc9000d23a000 RSI: 000000000002f416 RDI: 000000000002f417 [ 1064.487206][T11373] RBP: ffffc900033d7cb8 R08: ffff8880b8d28c53 R09: 1ffff110171a518a [ 1064.495432][T11373] R10: dffffc0000000000 R11: ffffed10171a518b R12: ffff88806b846000 [ 1064.503546][T11373] R13: dffffc0000000000 R14: ffff88806b846050 R15: ffffffff8e3e1d40 [ 1064.511639][T11373] FS: 00007f3e91ff66c0(0000) GS:ffff8880b8d00000(0000) knlGS:0000000000000000 [ 1064.520707][T11373] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1064.527606][T11373] CR2: 00007f6779fecc40 CR3: 0000000022851000 CR4: 00000000003506e0 [ 1064.535653][T11373] Call Trace: [ 1064.539062][T11373] [ 1064.542035][T11373] write_ports+0xb99/0xfa0 [ 1064.546634][T11373] ? write_versions+0xe00/0xe00 [ 1064.551534][T11373] ? __lock_acquire+0x7eb0/0x7eb0 [ 1064.556674][T11373] ? __virt_addr_valid+0x10c/0x380 [ 1064.561922][T11373] ? __virt_addr_valid+0x10c/0x380 [ 1064.567160][T11373] ? __might_fault+0xaa/0x120 [ 1064.571914][T11373] ? __might_fault+0xc6/0x120 [ 1064.576742][T11373] ? __might_fault+0xaa/0x120 [ 1064.581477][T11373] ? simple_transaction_get+0x11d/0x140 [ 1064.587164][T11373] nfsctl_transaction_write+0x10c/0x150 [ 1064.593597][T11373] ? nfsctl_transaction_read+0x1b0/0x1b0 [ 1064.599530][T11373] vfs_write+0x299/0x9a0 [ 1064.603967][T11373] ? file_end_write+0x250/0x250 [ 1064.608940][T11373] ? __fget_files+0x28/0x460 [ 1064.613570][T11373] ? __fget_files+0x3fc/0x460 [ 1064.618408][T11373] ? __fdget_pos+0x2a3/0x330 [ 1064.623054][T11373] ? ksys_write+0x74/0x260 [ 1064.627589][T11373] ksys_write+0x151/0x260 [ 1064.632140][T11373] ? __ia32_sys_read+0x90/0x90 [ 1064.637070][T11373] ? lockdep_hardirqs_on+0x98/0x150 [ 1064.642347][T11373] do_syscall_64+0x55/0xb0 [ 1064.646862][T11373] ? clear_bhb_loop+0x40/0x90 [ 1064.651583][T11373] ? clear_bhb_loop+0x40/0x90 [ 1064.656306][T11373] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1064.662337][T11373] RIP: 0033:0x7f3e93d9f559 [ 1064.666840][T11373] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1064.686642][T11373] RSP: 002b:00007f3e91ff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1064.695838][T11373] RAX: ffffffffffffffda RBX: 00007f3e94025fa0 RCX: 00007f3e93d9f559 [ 1064.704116][T11373] RDX: 0000000000000005 RSI: 0000200000000340 RDI: 0000000000000003 [ 1064.712256][T11373] RBP: 00007f3e93e36b20 R08: 0000000000000000 R09: 0000000000000000 [ 1064.720314][T11373] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1064.728439][T11373] R13: 00007f3e94026038 R14: 00007f3e94025fa0 R15: 00007ffe838127c8 [ 1064.736886][T11373] [ 1064.739936][T11373] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1064.747240][T11373] CPU: 1 PID: 11373 Comm: syz.1.1326 Not tainted syzkaller #0 [ 1064.754729][T11373] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 1064.764818][T11373] Call Trace: [ 1064.768124][T11373] [ 1064.771094][T11373] dump_stack_lvl+0x18c/0x250 [ 1064.775816][T11373] ? show_regs_print_info+0x20/0x20 [ 1064.781060][T11373] ? load_image+0x420/0x420 [ 1064.785614][T11373] panic+0x2ca/0x720 [ 1064.789545][T11373] ? bpf_jit_dump+0xd0/0xd0 [ 1064.794102][T11373] __warn+0x2e0/0x470 [ 1064.798112][T11373] ? svc_destroy+0x2ed/0x390 [ 1064.802735][T11373] ? svc_destroy+0x2ed/0x390 [ 1064.807344][T11373] report_bug+0x2be/0x4f0 [ 1064.811807][T11373] ? svc_destroy+0x2ed/0x390 [ 1064.816420][T11373] ? svc_destroy+0x2ed/0x390 [ 1064.821034][T11373] ? svc_destroy+0x2ef/0x390 [ 1064.825645][T11373] handle_bug+0xcf/0x120 [ 1064.829920][T11373] exc_invalid_op+0x1a/0x50 [ 1064.834458][T11373] asm_exc_invalid_op+0x1a/0x20 [ 1064.839335][T11373] RIP: 0010:svc_destroy+0x2ed/0x390 [ 1064.844558][T11373] Code: 24 49 83 c7 20 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 22 c3 2c f8 49 8b 37 48 c7 c7 20 12 fa 8b e8 13 5f 9d f7 <0f> 0b e9 78 fd ff ff e8 57 ba d3 f7 c6 05 7f 23 c4 05 01 4c 89 e0 [ 1064.864220][T11373] RSP: 0018:ffffc900033d7ae0 EFLAGS: 00010246 [ 1064.870317][T11373] RAX: 22037ab9770bf400 RBX: ffff88806b846050 RCX: 0000000000080000 [ 1064.878303][T11373] RDX: ffffc9000d23a000 RSI: 000000000002f416 RDI: 000000000002f417 [ 1064.886373][T11373] RBP: ffffc900033d7cb8 R08: ffff8880b8d28c53 R09: 1ffff110171a518a [ 1064.894346][T11373] R10: dffffc0000000000 R11: ffffed10171a518b R12: ffff88806b846000 [ 1064.902329][T11373] R13: dffffc0000000000 R14: ffff88806b846050 R15: ffffffff8e3e1d40 [ 1064.910330][T11373] write_ports+0xb99/0xfa0 [ 1064.914757][T11373] ? write_versions+0xe00/0xe00 [ 1064.919629][T11373] ? __lock_acquire+0x7eb0/0x7eb0 [ 1064.924677][T11373] ? __virt_addr_valid+0x10c/0x380 [ 1064.929795][T11373] ? __virt_addr_valid+0x10c/0x380 [ 1064.934910][T11373] ? __might_fault+0xaa/0x120 [ 1064.939590][T11373] ? __might_fault+0xc6/0x120 [ 1064.944265][T11373] ? __might_fault+0xaa/0x120 [ 1064.948956][T11373] ? simple_transaction_get+0x11d/0x140 [ 1064.954507][T11373] nfsctl_transaction_write+0x10c/0x150 [ 1064.960055][T11373] ? nfsctl_transaction_read+0x1b0/0x1b0 [ 1064.965698][T11373] vfs_write+0x299/0x9a0 [ 1064.970173][T11373] ? file_end_write+0x250/0x250 [ 1064.975071][T11373] ? __fget_files+0x28/0x460 [ 1064.979675][T11373] ? __fget_files+0x3fc/0x460 [ 1064.984366][T11373] ? __fdget_pos+0x2a3/0x330 [ 1064.988963][T11373] ? ksys_write+0x74/0x260 [ 1064.993391][T11373] ksys_write+0x151/0x260 [ 1064.997727][T11373] ? __ia32_sys_read+0x90/0x90 [ 1065.002505][T11373] ? lockdep_hardirqs_on+0x98/0x150 [ 1065.007746][T11373] do_syscall_64+0x55/0xb0 [ 1065.012169][T11373] ? clear_bhb_loop+0x40/0x90 [ 1065.016858][T11373] ? clear_bhb_loop+0x40/0x90 [ 1065.021545][T11373] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1065.027448][T11373] RIP: 0033:0x7f3e93d9f559 [ 1065.031884][T11373] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1065.051608][T11373] RSP: 002b:00007f3e91ff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1065.060033][T11373] RAX: ffffffffffffffda RBX: 00007f3e94025fa0 RCX: 00007f3e93d9f559 [ 1065.068009][T11373] RDX: 0000000000000005 RSI: 0000200000000340 RDI: 0000000000000003 [ 1065.075998][T11373] RBP: 00007f3e93e36b20 R08: 0000000000000000 R09: 0000000000000000 [ 1065.084019][T11373] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1065.092019][T11373] R13: 00007f3e94026038 R14: 00007f3e94025fa0 R15: 00007ffe838127c8 [ 1065.100031][T11373] [ 1065.103342][T11373] Kernel Offset: disabled [ 1065.107733][T11373] Rebooting in 86400 seconds..