last executing test programs: 24.10015547s ago: executing program 3 (id=3341): r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x8) fchdir(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) mknodat$loop(r2, &(0x7f0000000000)='./file1\x00', 0x2000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./bus\x00', 0x4d) rename(&(0x7f0000000180)='./bus\x00', &(0x7f00000001c0)='./file0\x00') 17.073109923s ago: executing program 1 (id=3357): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_io_uring_setup(0x10d, &(0x7f0000000140), &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x48, 0x0, @fd, 0x3, {}, 0xa6, 0x3}) io_uring_enter(r3, 0x47f9, 0x0, 0x0, 0x0, 0x0) r6 = socket(0x10, 0x3, 0xa) sendfile(r6, 0xffffffffffffffff, 0x0, 0x7fffffffffffffff) 13.52292467s ago: executing program 1 (id=3358): socket$packet(0x11, 0x2, 0x300) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) syz_emit_ethernet(0x5a, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd6008120000242b0000000000000000000000ffffac1414bbfe8000000000000000000000000000aa3a020201"], 0x0) 13.16147042s ago: executing program 3 (id=3361): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000100)=ANY=[@ANYBLOB="e4050000160001000000000000000000e0000001000000000006000000000000fe88000000000000000000000000000100000100"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000010000000033000000fc02000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000025bd70000000000002"], 0x5e4}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=@allocspi={0xf8, 0x16, 0x1, 0x0, 0x0, {{{@in6=@ipv4={'\x00', '\xff\xff', @local}, @in=@broadcast}, {@in6=@dev={0xfe, 0x80, '\x00', 0x40}, 0x0, 0x6c}, @in6=@mcast2, {0x0, 0x0, 0x4, 0x0, 0x1}, {0xffffffff}}, 0x4, 0x7fff}}, 0xf8}}, 0x0) 12.85907638s ago: executing program 0 (id=3362): bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="07000000040000000001000004"], 0x50) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000030000000000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x20}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='mmap_lock_acquire_returned\x00', r0}, 0x18) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000040)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000004600)='map_files\x00') sendmmsg$unix(r1, &(0x7f0000002d80)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000080)=@abs={0x1, 0x30, 0x4e30}, 0x4, 0x0}}], 0x2, 0x40008004) 12.777542287s ago: executing program 0 (id=3363): syz_usb_connect(0x2, 0x2d, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x50) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_RATE_DEL(r3, &(0x7f0000000f00)={0x0, 0x0, 0x0}, 0x0) syz_io_uring_setup(0x1e7f, &(0x7f0000000140)={0x0, 0xac24, 0x2, 0x2, 0x361}, &(0x7f00000001c0), &(0x7f0000000000)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r4, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r4, 0x1, 0x4) r6 = openat$cgroup_subtree(r5, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r6, &(0x7f0000000180)={[{0x2b, 'cpuset'}]}, 0x8) 12.731329646s ago: executing program 3 (id=3364): fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x400000000003, 0x7ffff, &(0x7f0000006680)) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080), 0x48c00, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, 0x0) socket(0x25, 0x1, 0x0) creat(&(0x7f00000002c0)='./file0\x00', 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r2 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) r3 = open$dir(&(0x7f0000000080)='./file0\x00', 0xc402, 0x80) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r3, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000003bc0)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000}, 0x94) write$P9_RVERSION(r2, &(0x7f0000000c40)=ANY=[], 0x13) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={r4, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000280)='./file0\x00', &(0x7f0000000300)=[0x5], &(0x7f0000000180)=[0x2], 0x0, 0x1, 0x1}}, 0x40) mmap$xdp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x12, r1, 0x0) 12.727035657s ago: executing program 1 (id=3365): r0 = add_key$user(&(0x7f0000000040), &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffb) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000ddffffff850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000300)='sched_switch\x00', r4}, 0x10) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$PPPIOCSPASS(0xffffffffffffffff, 0x40107447, &(0x7f0000000080)={0x1, &(0x7f0000000000)=[{0x4e}]}) bind$bt_hci(r5, 0x0, 0x0) write$bt_hci(r5, &(0x7f0000000000)=ANY=[], 0x6) pipe2$watch_queue(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r7, 0x5760, 0x1f) keyctl$KEYCTL_WATCH_KEY(0x20, r0, r7, 0x100000000000f7) read$watch_queue(r6, &(0x7f0000000000)=""/1, 0x1) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r8 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r8, &(0x7f0000000200)=0x1, 0x12) rmdir(&(0x7f00000001c0)='./cgroup/../file0\x00') keyctl$revoke(0x3, r0) 10.271305935s ago: executing program 1 (id=3367): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x1ff, 0x1, 0x0, 0x1000, &(0x7f0000001000/0x1000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r4, 0x4008ae93, &(0x7f0000000040)=0x4) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_SET_LAPIC(r4, 0x4400ae8f, &(0x7f0000000440)={"db4c1421593cb4d3f8fe6094dc821bbbe06520701fc6de7b0349f34b0f8c556a9e9aff1355aab8d6da26d74608530f150f127f9e3f0a2f1fff0be9774c95d6c007c91903f78616596487bf50017c56b15385ab264cba5b168c62d971e67e6f3e73d60b5a8adbaaf2af8610c6a91c0a116f619adce4aa91d5a68faf8ee98693d32d8d8244381b5720ef596600e39491d216c22d0725904bab7d90fa8afb8fa04b707410aa300ef098609b4fa6dd77b1b7c321b1fc6356564ce3f90826be3a9a5be186ffc48eb13824e9dae77ed212a0f802074ff4f1725c4ad88cf5bbd36e3406bc59d96e82047631d8be9462ee7e54e5b2897c3fff38eabf67e1e160c2b5e18be06457844d89c9a606b7d25fbde713f4759da0bee1fabe3f71dcca63540f113a2b5edc4b327d1f9610377b97265d4aa875b4bc3c44bf8110d5df1beb1fe54794a0aa52dfc80df1caf7d812b4f1cdba1a6836b45ea2180d08439d411ce8e0755868cc839eaeac73e5d28f9f1990584038cf5fa6bee0c4095a27cc8c7b59519bf2a9bf1fedf54cc2dc6aea6c42c32de40c291e5f422f5c7792a08926af160fb379576dd81bac746232fb246817fc3248097914b75e83cc5eb518ce8fb643b34ca69c3b61f0d94e7db62dd480198d41e0862f1ec4429ab637569884a5ba446a0b09edfd986a2b3e15ee35bbd18610dad6271681ed240b0ffab9199b541013c0aadc36484da57511896c14776a41602aa1426edfbb828897d9c218b7936a0572840ebbc796e888a439b24e640324b511deb6ed0b2ce2f7567447826944b4f34101e492e8d20a2deda950e96e78f86d6d4c976f0c99041c94944309e6ce08d84a7c96677d570d9a57ec0506a4321d9e049b55be883ca3648c27772fc5dbaea5e6c2ded2ce72fb68989ae381fe1394cf6966ab04285d5ff8256bc2e85462b8d89aeeebd5432157c945b5dc1960d9282c6cc007fe029325d6078aef94d4954f956c71bcdf846f41392ebe0d3b289438d24ec4bc073617459a6b232445dd636a9f21140e14b162fd5ef1d626b0ff84884fd63d22cc1b05befb77ea937f3045cc15b125479b262c1e32fca75a5468423288c5776efee744b1fccb5e6d661d9d287cfa8582c96ea34a33c1bbc29c0035657da66a87150bbb885be5ee123e431fd793ea179a0fc77aaee66d874c0616cb32324826b36d0e27d14217ad1131cace3bae4ef82dfbc790e78de53a9bfbdb468bf0eb3ff134073b380858965de2d108862daf3fc6b49ad46f20832238aeaa5d010cf08e37938f0bb7bbeaa970c39ce9327a16fe07565708266ce9ef639bfa08538693b456228aa1c370d64ef9795b7cc208a2c528d381a042d149ed5c7f34ed26a7d5a4401b86434f054389e5dac7a4ee896e406d7b27240d925d478e0eb2202797832d3e2c74f4925ad58377b0d6ae9b97034f94"}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 8.96367055s ago: executing program 2 (id=3368): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_io_uring_setup(0x10d, &(0x7f0000000140), &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x48, 0x0, @fd, 0x3, {}, 0xa6, 0x3}) io_uring_enter(r3, 0x47f9, 0x0, 0x0, 0x0, 0x0) r6 = socket(0x10, 0x3, 0xa) sendfile(r6, 0xffffffffffffffff, 0x0, 0x7fffffffffffffff) 8.633635549s ago: executing program 0 (id=3370): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000480)=0x7) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) writev(0xffffffffffffffff, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000", 0x36}], 0x1) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r3, 0x40000000af01, 0x0) ioctl$BTRFS_IOC_TREE_SEARCH_V2(r3, 0x4004af07, 0x0) 7.707028791s ago: executing program 2 (id=3372): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000012c0)={&(0x7f0000000040)='kfree\x00', r1}, 0x10) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0x1, 0x8, 0x2, 0x4}, 0x48) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={0x0, &(0x7f0000000480)=""/122, 0x0, 0x7a, 0x1, 0x6}, 0x28) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r3) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r4, 0x8943, &(0x7f0000000100)={'syzkaller0\x00'}) ioctl$SIOCSIFHWADDR(r3, 0x8943, &(0x7f0000002280)={'syzkaller0\x00', @random="110000000002"}) 6.654324458s ago: executing program 3 (id=3374): socket(0xa, 0x3, 0x3a) socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000300), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000640)=0x1800, 0x4) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602000000000e000a00100000000280", 0x2a}, {&(0x7f0000000400)="6a6f8e5e", 0x4}], 0x2}, 0x0) 6.435246754s ago: executing program 4 (id=3375): socket$packet(0x11, 0x2, 0x300) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) syz_emit_ethernet(0x5a, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd6008120000242b0000000000000000000000ffffac1414bbfe8000000000000000000000000000aa3a020201"], 0x0) 6.312361728s ago: executing program 3 (id=3376): socket$inet6_mptcp(0xa, 0x1, 0x106) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$key(0xf, 0x3, 0x2) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$key(r2, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r3, &(0x7f0000000200)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x3}, {}, 0x0, 0x0, 0x1}, {{@in=@empty, 0x0, 0x33}, 0x0, @in6=@ipv4={'\x00', '\xff\xff', @empty}, 0x0, 0x0, 0x0, 0xb7, 0xffffffff}}, 0xe8) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) 6.035497643s ago: executing program 4 (id=3377): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000000)=0x400000001, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000240)={0xa, 0x4e23, 0xa4e4, @remote, 0x3}, 0x1c) sendmmsg(r0, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4010) 4.597054706s ago: executing program 2 (id=3378): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000240)={[0x5836, 0x8, 0x7, 0x4000000000000e51, 0xfffffffffffffffe, 0x5479, 0x1035, 0x200000000006, 0x0, 0x401, 0xfffffffffffffffe, 0xffffffff, 0xbf4, 0xfff, 0x8000000000005, 0x800000068], 0x2000, 0x80cd4}) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x12, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000ba00000018010000"], 0x0, 0x4, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) ioctl$KVM_RUN(r2, 0xae80, 0x0) 4.579358602s ago: executing program 4 (id=3379): socket$inet6_tcp(0xa, 0x1, 0x0) rseq(0x0, 0x0, 0x0, 0x0) syz_clone3(0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r0 = socket$inet6(0xa, 0x802, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0x3, &(0x7f0000000240)=@framed, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SET_MM(0x23, 0x6, &(0x7f0000ffc000/0x4000)=nil) prctl$PR_SET_MM(0x23, 0x7, &(0x7f0000ffc000/0x4000)=nil) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2172, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r0, &(0x7f0000002940), 0x62, 0x4890) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, 0x0, 0x90) 3.89150739s ago: executing program 1 (id=3380): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000500)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0x10}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000002c0)=@newtfilter={0x38, 0x2c, 0xd2d, 0x70bd25, 0x4007ffe, {0x0, 0x0, 0x0, r3, {0x0, 0xffe0}, {}, {0xffff}}, [@filter_kind_options=@f_u32={{0x8}, {0xc, 0x2, [@TCA_U32_DIVISOR={0x8, 0x4, 0x2}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000081}, 0x20004000) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x400c0) 3.429856143s ago: executing program 4 (id=3381): socket$packet(0x11, 0x2, 0x300) symlinkat(&(0x7f0000001040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00') futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc)=0x1, 0xb, 0x1, &(0x7f0000000200), &(0x7f0000048000), 0x0) 3.429261068s ago: executing program 0 (id=3382): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_io_uring_setup(0x10d, &(0x7f0000000140), &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x48, 0x0, @fd, 0x3, {}, 0xa6, 0x3}) io_uring_enter(r3, 0x47f9, 0x0, 0x0, 0x0, 0x0) r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendfile(0xffffffffffffffff, r6, 0x0, 0x7fffffffffffffff) 3.427643426s ago: executing program 2 (id=3383): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/igmp6\x00') lseek(r4, 0xfffd, 0x0) 2.197371375s ago: executing program 0 (id=3384): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000840), 0x81, r0}, 0x38) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00'}, 0x10) r1 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r1, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x34004811) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000200)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000000100000024000180060005004e230000060001000200000008000300ac1414aa0800060001"], 0x38}, 0x1, 0x0, 0x0, 0x4000011}, 0x4c080) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000c00)=ANY=[@ANYBLOB="14000000", @ANYRES16=r3, @ANYBLOB="010028bd7000fcdbdf2504"], 0x14}}, 0x0) 1.378872385s ago: executing program 2 (id=3385): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) close(0x3) openat$cgroup_subtree(r2, &(0x7f0000000200), 0x2, 0x0) rmdir(&(0x7f0000000080)='./cgroup/../file0\x00') r3 = syz_io_uring_setup(0x49a, &(0x7f00000000c0)={0x0, 0x79af, 0x3180, 0x8000, 0x40024e}, &(0x7f0000000340)=0x0, &(0x7f0000000480)=0x0) syz_io_uring_submit(r4, r5, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x4007, @fd_index=0x3, 0x6, &(0x7f0000000380)=""/217, 0xd9, 0x2, 0x1}) io_uring_enter(r3, 0x74d1, 0x4c3, 0x43, 0x0, 0xfffffffffffffd1d) 1.342384941s ago: executing program 4 (id=3386): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = syz_io_uring_setup(0x126b, &(0x7f00000006c0)={0x0, 0x72de}, &(0x7f0000000140), &(0x7f0000000780)) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r4, 0x2, &(0x7f0000002d40)={0x0, 0x0, 0x0, 0x0}, 0x20) 1.224616086s ago: executing program 1 (id=3387): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4}, 0xe) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000003c0)='GPL\x00'}, 0x94) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000200), 0x4049a0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000140)='contention_end\x00', r1}, 0x10) r3 = syz_open_dev$video4linux(&(0x7f0000000180), 0x0, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) dup3(r0, r0, 0x80000) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x200, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_GET_NESTED_STATE(r7, 0xc080aebe, &(0x7f000000a100)={{0x0, 0x0, 0xfffffffffffffcfd}}) ioctl$VIDIOC_SUBSCRIBE_EVENT(r3, 0x4020565a, &(0x7f00000000c0)={0x3, 0xfffffffb}) capset(&(0x7f00000020c0)={0x19980330}, &(0x7f00000001c0)) r8 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r8, 0x29, 0x20, &(0x7f0000000280)={@mcast1, 0x800, 0x0, 0x103, 0x9}, 0x20) ioctl$SNDRV_PCM_IOCTL_USER_PVERSION(r2, 0x40044104, &(0x7f0000000240)=0x3) setsockopt$inet6_int(r8, 0x29, 0x1000000000021, &(0x7f0000000040)=0x5, 0x4) sendmsg$inet6(r8, &(0x7f00000000c0)={&(0x7f00000001c0)={0xa, 0x4e21, 0x80000, @dev={0xfe, 0x80, '\x00', 0x19}}, 0x1c, 0x0}, 0xc4) 154.373312ms ago: executing program 4 (id=3388): socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() socket$nl_route(0x10, 0x3, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeeb, 0x8031, 0xffffffffffffffff, 0xcdc26000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$MAP_CREATE(0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001c40), 0x0, 0x0, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuseblk(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x2010002, &(0x7f0000000300)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x8000}}) 153.059346ms ago: executing program 0 (id=3389): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000000)=0x400000001, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000240)={0xa, 0x4e23, 0xa4e4, @remote, 0x3}, 0x1c) sendmmsg(r0, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4010) 47.030407ms ago: executing program 3 (id=3390): r0 = socket$inet(0x2, 0x3, 0x6) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x4) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000001040)={'gre0\x00', &(0x7f0000000380)={'syztnl2\x00', 0x0, 0x2100, 0x700, 0x10000, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x60, 0x0, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @remote}}}}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2}, 0x10) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014"], 0xfc}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a01020000000000100000020000000900020073797a310000000008000440000000000900010073797a3000000000080003400000000a14000000110001"], 0x64}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000140)={0x0, 0x35, &(0x7f0000000480)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a34000000140affffffff00000000000002000009080003400000000a0900010073797a30000000000c000640000000000000000214000000020a010100000000000000000000000a14000000110001"], 0x70}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x40ead000) madvise(&(0x7f0000130000/0xd000)=nil, 0xd000, 0x66) 0s ago: executing program 2 (id=3391): socket$inet6_tcp(0xa, 0x1, 0x0) rseq(0x0, 0x0, 0x0, 0x0) syz_clone3(0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r0 = socket$inet6(0xa, 0x802, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0x3, &(0x7f0000000240)=@framed, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SET_MM(0x23, 0x6, &(0x7f0000ffc000/0x4000)=nil) prctl$PR_SET_MM(0x23, 0x7, &(0x7f0000ffc000/0x4000)=nil) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2172, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r0, &(0x7f0000002940), 0x62, 0x4890) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, 0x0, 0x90) kernel console output (not intermixed with test programs): e: IR keymap rc-pinnacle-pctv-hd not found [ 1018.214282][ T5892] Registered IR keymap rc-empty [ 1018.219648][ T5892] rc rc0: PCTV tripleStick (292e) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 1018.221778][ T5892] input: PCTV tripleStick (292e) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input49 [ 1018.269188][ T5892] em28xx 2-1:0.0: Input extension successfully initialized [ 1018.269247][T11018] em28xx 2-1:0.0: Closing input extension [ 1018.654301][T11018] em28xx 2-1:0.0: Freeing device [ 1018.797517][T10215] usb 5-1: USB disconnect, device number 60 [ 1019.900414][T13973] netlink: 76 bytes leftover after parsing attributes in process `syz.2.2007'. [ 1020.712605][T10215] usb 5-1: new low-speed USB device number 61 using dummy_hcd [ 1021.755142][T10215] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 1021.755170][T10215] usb 5-1: config 0 has no interface number 0 [ 1021.755204][T10215] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1021.755219][T10215] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 1021.755243][T10215] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1021.755255][T10215] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1021.759347][T10215] usb 5-1: config 0 descriptor?? [ 1021.762803][T13980] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1021.770385][T10215] iowarrior 5-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1021.944607][ T5873] usb 1-1: new low-speed USB device number 60 using dummy_hcd [ 1022.003443][T13497] usb 5-1: USB disconnect, device number 61 [ 1022.372094][ T5873] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 1022.372121][ T5873] usb 1-1: config 0 has no interface number 0 [ 1022.372168][ T5873] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1022.372196][ T5873] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 1022.372239][ T5873] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1022.372262][ T5873] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1022.381506][ T5873] usb 1-1: config 0 descriptor?? [ 1022.457826][T13986] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 1023.077070][ T5873] iowarrior 1-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1023.096791][ T5873] usb 1-1: USB disconnect, device number 60 [ 1023.721438][T14012] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2016'. [ 1023.811931][T14014] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2016'. [ 1024.652576][T13497] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 1024.802606][T13497] usb 4-1: Using ep0 maxpacket: 8 [ 1024.804105][T13497] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 1024.804141][T13497] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1024.804153][T13497] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1024.804167][T13497] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1024.804179][T13497] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1024.804203][T13497] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1024.804215][T13497] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1025.203232][T14027] netlink: 76 bytes leftover after parsing attributes in process `syz.4.2022'. [ 1025.225378][T14028] netlink: 'syz.2.2021': attribute type 1 has an invalid length. [ 1025.650587][T14029] bond6: entered promiscuous mode [ 1025.650619][T14029] bond6: entered allmulticast mode [ 1025.651317][T14029] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1025.818265][T14030] bridge8: entered promiscuous mode [ 1025.818376][T14030] bridge8: entered allmulticast mode [ 1025.818802][T14030] bond6: (slave bridge8): Enslaving as a backup interface with an up link [ 1025.864445][T13245] bond6: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 1025.982603][T13245] bond6: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 1027.828064][ T5892] usb 4-1: USB disconnect, device number 44 [ 1028.487263][T14074] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2035'. [ 1028.528042][T14072] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1028.832998][ T5892] usb 5-1: new full-speed USB device number 62 using dummy_hcd [ 1029.132101][ T5892] usb 5-1: config 0 has an invalid interface number: 113 but max is 0 [ 1029.142207][ T5892] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1029.142234][ T5892] usb 5-1: config 0 has no interface number 0 [ 1029.162583][ T5892] usb 5-1: config 0 interface 113 altsetting 2 has an endpoint descriptor with address 0x14, changing to 0x4 [ 1029.276302][ T5892] usb 5-1: config 0 interface 113 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1029.282481][ T5892] usb 5-1: config 0 interface 113 has no altsetting 0 [ 1029.368345][ T5892] usb 5-1: New USB device found, idVendor=054c, idProduct=02e1, bcdDevice=e2.c8 [ 1029.368377][ T5892] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1029.368399][ T5892] usb 5-1: Product: syz [ 1029.368416][ T5892] usb 5-1: Manufacturer: syz [ 1029.368438][ T5892] usb 5-1: SerialNumber: syz [ 1029.375915][ T5892] usb 5-1: config 0 descriptor?? [ 1029.396483][ T5892] pn533_usb 5-1:0.113: NFC: Could not find bulk-in or bulk-out endpoint [ 1031.184764][T14104] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 1031.312892][ T10] usb 5-1: USB disconnect, device number 62 [ 1031.459930][ T5786] usb 4-1: new full-speed USB device number 45 using dummy_hcd [ 1031.667026][ T5786] usb 4-1: config 0 has an invalid interface number: 113 but max is 0 [ 1031.667055][ T5786] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1031.667074][ T5786] usb 4-1: config 0 has no interface number 0 [ 1031.667105][ T5786] usb 4-1: config 0 interface 113 altsetting 2 has an endpoint descriptor with address 0x14, changing to 0x4 [ 1031.667123][ T5786] usb 4-1: config 0 interface 113 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1031.667138][ T5786] usb 4-1: config 0 interface 113 has no altsetting 0 [ 1031.742083][ T5786] usb 4-1: New USB device found, idVendor=054c, idProduct=02e1, bcdDevice=e2.c8 [ 1031.742102][ T5786] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1031.742113][ T5786] usb 4-1: Product: syz [ 1031.742120][ T5786] usb 4-1: Manufacturer: syz [ 1031.742128][ T5786] usb 4-1: SerialNumber: syz [ 1031.758058][ T5786] usb 4-1: config 0 descriptor?? [ 1031.764869][ T5786] pn533_usb 4-1:0.113: NFC: Could not find bulk-in or bulk-out endpoint [ 1031.959024][T14107] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1032.285539][T14115] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2047'. [ 1032.383846][T14119] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2047'. [ 1033.254228][T14134] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2052'. [ 1034.777019][ T10] usb 4-1: USB disconnect, device number 45 [ 1037.312560][ T5786] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 1037.462574][ T5786] usb 2-1: Using ep0 maxpacket: 8 [ 1037.465644][ T5786] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 1037.465716][ T5786] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1037.465730][ T5786] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1037.465747][ T5786] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1037.465760][ T5786] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1037.465785][ T5786] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1037.465797][ T5786] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1039.434781][T14190] netlink: 'syz.3.2067': attribute type 1 has an invalid length. [ 1039.556472][T14193] bond5: entered promiscuous mode [ 1039.556502][T14193] bond5: entered allmulticast mode [ 1039.557114][T14193] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1039.607699][T14190] bridge7: entered promiscuous mode [ 1039.607899][T14190] bridge7: entered allmulticast mode [ 1039.608784][T14190] bond5: (slave bridge7): Enslaving as a backup interface with an up link [ 1039.632055][ T1396] bond5: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 1039.742579][ T5892] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 1039.865066][ T1396] bond5: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 1040.077177][ T5892] usb 3-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c [ 1040.077209][ T5892] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1040.088418][ T5892] usb 3-1: config 0 descriptor?? [ 1040.306702][ T5786] usb 2-1: USB disconnect, device number 46 [ 1040.843440][T14197] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2069'. [ 1041.981207][ T5892] pegasus 3-1:0.0: probe with driver pegasus failed with error -110 [ 1042.714029][T14204] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2072'. [ 1043.206900][T14202] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1043.324629][T13846] usb 3-1: USB disconnect, device number 58 [ 1043.796254][T14224] netlink: 'syz.4.2081': attribute type 8 has an invalid length. [ 1043.863963][T14232] netlink: 'syz.3.2078': attribute type 1 has an invalid length. [ 1044.027612][T14240] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2081'. [ 1044.039233][T14237] bond6: entered promiscuous mode [ 1044.039272][T14237] bond6: entered allmulticast mode [ 1044.040280][T14237] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1044.871231][T14228] bridge8: entered promiscuous mode [ 1044.871418][T14228] bridge8: entered allmulticast mode [ 1044.872176][T14228] bond6: (slave bridge8): Enslaving as a backup interface with an up link [ 1044.910487][ T43] bond6: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 1045.015144][ T1010] bond6: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 1047.404974][T14262] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2087'. [ 1048.727051][T14272] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1049.596163][T14291] netlink: 'syz.4.2096': attribute type 8 has an invalid length. [ 1049.835722][T14294] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2096'. [ 1050.048837][T14301] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2097'. [ 1050.158403][T14303] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2097'. [ 1050.657869][T14307] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2098'. [ 1050.657903][T14307] netlink: 'syz.2.2098': attribute type 6 has an invalid length. [ 1050.657918][T14307] netlink: 140 bytes leftover after parsing attributes in process `syz.2.2098'. [ 1052.747586][T14325] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2103'. [ 1054.538860][ T1319] ieee802154 phy0 wpan0: encryption failed: -22 [ 1054.538932][ T1319] ieee802154 phy1 wpan1: encryption failed: -22 [ 1054.632609][ T5892] usb 1-1: new high-speed USB device number 61 using dummy_hcd [ 1054.794938][ T5892] usb 1-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c [ 1054.794971][ T5892] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1054.827473][ T5892] usb 1-1: config 0 descriptor?? [ 1054.881932][T14350] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2112'. [ 1056.053830][T14363] syz.1.2115 (14363) used greatest stack depth: 17880 bytes left [ 1056.381536][T14368] netlink: 'syz.3.2116': attribute type 8 has an invalid length. [ 1056.735777][T14368] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2116'. [ 1056.957794][ T5892] pegasus 1-1:0.0: probe with driver pegasus failed with error -110 [ 1057.682713][T13497] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 1057.834311][T11018] usb 1-1: USB disconnect, device number 61 [ 1057.862541][T13497] usb 2-1: Using ep0 maxpacket: 8 [ 1057.871440][T13497] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 1057.871502][T13497] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1057.871525][T13497] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1057.871550][T13497] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1057.871575][T13497] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1057.871618][T13497] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1057.871640][T13497] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1058.222274][T14394] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2122'. [ 1058.368360][T14397] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2122'. [ 1058.533297][T14399] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1058.892600][T13497] usb 1-1: new full-speed USB device number 62 using dummy_hcd [ 1059.063024][T13497] usb 1-1: config 0 has an invalid interface number: 113 but max is 0 [ 1059.063046][T13497] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1059.063066][T13497] usb 1-1: config 0 has no interface number 0 [ 1059.063101][T13497] usb 1-1: config 0 interface 113 altsetting 2 has an endpoint descriptor with address 0x14, changing to 0x4 [ 1059.063116][T13497] usb 1-1: config 0 interface 113 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1059.063131][T13497] usb 1-1: config 0 interface 113 has no altsetting 0 [ 1059.094367][T13497] usb 1-1: New USB device found, idVendor=054c, idProduct=02e1, bcdDevice=e2.c8 [ 1059.094398][T13497] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1059.094418][T13497] usb 1-1: Product: syz [ 1059.094432][T13497] usb 1-1: Manufacturer: syz [ 1059.094445][T13497] usb 1-1: SerialNumber: syz [ 1059.100164][T13497] usb 1-1: config 0 descriptor?? [ 1059.140731][T13497] pn533_usb 1-1:0.113: NFC: Could not find bulk-in or bulk-out endpoint [ 1059.495823][T14402] netlink: 'syz.3.2126': attribute type 1 has an invalid length. [ 1059.674162][T14405] bond7: entered promiscuous mode [ 1059.674194][T14405] bond7: entered allmulticast mode [ 1059.674695][T14405] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1059.796437][T14402] bridge10: entered promiscuous mode [ 1059.796533][T14402] bridge10: entered allmulticast mode [ 1059.796939][T14402] bond7: (slave bridge10): Enslaving as a backup interface with an up link [ 1059.894555][ T43] bond7: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 1060.012730][ T43] bond7: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 1060.170057][T14413] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 1060.170057][T14413] The task syz.3.2128 (14413) triggered the difference, watch for misbehavior. [ 1060.352293][T14415] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 1060.459703][T13497] usb 2-1: USB disconnect, device number 47 [ 1060.622693][ T5892] usb 3-1: new full-speed USB device number 59 using dummy_hcd [ 1060.877618][ T5892] usb 3-1: config 0 has an invalid interface number: 113 but max is 0 [ 1060.877645][ T5892] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1060.877663][ T5892] usb 3-1: config 0 has no interface number 0 [ 1060.877706][ T5892] usb 3-1: config 0 interface 113 altsetting 2 has an endpoint descriptor with address 0x14, changing to 0x4 [ 1060.877732][ T5892] usb 3-1: config 0 interface 113 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1060.877756][ T5892] usb 3-1: config 0 interface 113 has no altsetting 0 [ 1061.077958][ T5892] usb 3-1: New USB device found, idVendor=054c, idProduct=02e1, bcdDevice=e2.c8 [ 1061.077977][ T5892] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1061.077988][ T5892] usb 3-1: Product: syz [ 1061.077996][ T5892] usb 3-1: Manufacturer: syz [ 1061.078054][ T5892] usb 3-1: SerialNumber: syz [ 1061.116609][ T5892] usb 3-1: config 0 descriptor?? [ 1061.300072][ T5892] pn533_usb 3-1:0.113: NFC: Could not find bulk-in or bulk-out endpoint [ 1062.101756][T14425] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2133'. [ 1062.256494][T14421] iommufd_mock iommufd_mock2: Adding to iommu group 2 [ 1062.288708][T13497] usb 1-1: USB disconnect, device number 62 [ 1063.513165][ T5892] usb 3-1: USB disconnect, device number 59 [ 1063.982639][ T5892] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 1064.152772][ T5892] usb 3-1: Using ep0 maxpacket: 8 [ 1064.185638][ T5892] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 1064.185696][ T5892] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1064.185718][ T5892] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1064.185742][ T5892] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1064.185765][ T5892] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1064.185807][ T5892] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1064.185829][ T5892] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1065.583328][T14465] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2145'. [ 1066.773305][T11018] usb 3-1: USB disconnect, device number 60 [ 1068.705592][T14502] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1068.982642][ T5873] usb 5-1: new full-speed USB device number 63 using dummy_hcd [ 1069.142627][ T5873] usb 5-1: config 0 has an invalid interface number: 113 but max is 0 [ 1069.142654][ T5873] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1069.142673][ T5873] usb 5-1: config 0 has no interface number 0 [ 1069.142721][ T5873] usb 5-1: config 0 interface 113 altsetting 2 has an endpoint descriptor with address 0x14, changing to 0x4 [ 1069.142748][ T5873] usb 5-1: config 0 interface 113 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1069.142775][ T5873] usb 5-1: config 0 interface 113 has no altsetting 0 [ 1069.155119][ T5873] usb 5-1: New USB device found, idVendor=054c, idProduct=02e1, bcdDevice=e2.c8 [ 1069.155152][ T5873] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1069.155173][ T5873] usb 5-1: Product: syz [ 1069.155187][ T5873] usb 5-1: Manufacturer: syz [ 1069.155202][ T5873] usb 5-1: SerialNumber: syz [ 1069.166031][ T5873] usb 5-1: config 0 descriptor?? [ 1069.169749][ T5873] pn533_usb 5-1:0.113: NFC: Could not find bulk-in or bulk-out endpoint [ 1072.683042][T13497] usb 5-1: USB disconnect, device number 63 [ 1073.707343][T14555] netlink: 'syz.2.2175': attribute type 1 has an invalid length. [ 1073.776801][T14558] bond7: entered promiscuous mode [ 1073.776819][T14558] bond7: entered allmulticast mode [ 1073.777097][T14558] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1073.964641][T14558] bridge9: entered promiscuous mode [ 1073.964821][T14558] bridge9: entered allmulticast mode [ 1073.965471][T14558] bond7: (slave bridge9): Enslaving as an active interface with an up link [ 1073.968231][T14557] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2174'. [ 1074.009157][T14557] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2174'. [ 1074.528917][ T10] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 1074.795623][ T10] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1075.185116][ T10] usb 3-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1075.185152][ T10] usb 3-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1075.185175][ T10] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1075.185221][ T10] usb 3-1: New USB device found, idVendor=0458, idProduct=5015, bcdDevice= 0.00 [ 1075.185244][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1075.471122][ T10] usb 3-1: config 0 descriptor?? [ 1075.917156][ T10] usbhid 3-1:0.0: can't add hid device: -71 [ 1075.917682][ T10] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1075.970142][ T10] usb 3-1: USB disconnect, device number 61 [ 1076.778329][T14599] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2187'. [ 1077.982628][T14599] bond5: (slave bridge0): Removing an active aggregator [ 1077.983513][T14599] bond5: (slave bridge0): Releasing backup interface [ 1078.674516][T14599] bridge0 (unregistering): left promiscuous mode [ 1078.674562][T14599] bridge0 (unregistering): left allmulticast mode [ 1079.878648][T14619] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2191'. [ 1080.020797][T14620] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2191'. [ 1081.930514][T14650] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2200'. [ 1082.002959][T14652] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2200'. [ 1083.052514][T13497] usb 4-1: new low-speed USB device number 46 using dummy_hcd [ 1083.226655][T13497] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 1083.226673][T13497] usb 4-1: config 0 has no interface number 0 [ 1083.226708][T13497] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1083.226723][T13497] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 1083.226746][T13497] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1083.226759][T13497] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1083.229816][T13497] usb 4-1: config 0 descriptor?? [ 1083.429652][T14659] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1083.460036][T13497] iowarrior 4-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1083.772625][ T5892] usb 4-1: USB disconnect, device number 46 [ 1087.023910][T14689] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2211'. [ 1088.005260][T14709] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2216'. [ 1088.081589][T14712] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2216'. [ 1089.874388][T14737] fuse: Unknown parameter 'use00000000000000000000' [ 1092.063356][T14761] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2234'. [ 1092.240523][T14766] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2234'. [ 1093.604941][ T5892] usb 5-1: new low-speed USB device number 64 using dummy_hcd [ 1093.713984][T14785] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2238'. [ 1093.809383][ T5892] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 1093.809401][ T5892] usb 5-1: config 0 has no interface number 0 [ 1093.809432][ T5892] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1093.809447][ T5892] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 1093.809566][ T5892] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1093.809584][ T5892] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1093.813876][ T5892] usb 5-1: config 0 descriptor?? [ 1093.815127][T14774] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1093.828195][ T5892] iowarrior 5-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1094.077908][ T5786] usb 5-1: USB disconnect, device number 64 [ 1096.172654][ T5786] usb 1-1: new high-speed USB device number 63 using dummy_hcd [ 1096.339234][ T5786] usb 1-1: Using ep0 maxpacket: 16 [ 1096.369502][ T5786] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 1096.406035][ T5786] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1096.406066][ T5786] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1096.406086][ T5786] usb 1-1: Product: syz [ 1096.406101][ T5786] usb 1-1: Manufacturer: syz [ 1096.406116][ T5786] usb 1-1: SerialNumber: syz [ 1096.516179][ T5786] usb 1-1: config 0 descriptor?? [ 1096.549231][ T5786] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1096.549253][ T5786] em28xx 1-1:0.0: DVB interface 0 found: bulk [ 1096.643215][ T5892] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 1096.706175][T14816] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2249'. [ 1096.831535][ T5892] usb 3-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c [ 1096.831566][ T5892] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1096.841692][ T5892] usb 3-1: config 0 descriptor?? [ 1097.134578][ T5786] em28xx 1-1:0.0: chip ID is em2765 [ 1097.776325][ T5786] em28xx 1-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 1097.777233][ T5786] em28xx 1-1:0.0: board has no eeprom [ 1098.182736][ T5786] em28xx 1-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 1098.182897][ T5786] em28xx 1-1:0.0: dvb set to bulk mode. [ 1098.189217][T13846] em28xx 1-1:0.0: Binding DVB extension [ 1098.440979][T13846] em28xx 1-1:0.0: Registering input extension [ 1098.460813][ T5786] usb 1-1: USB disconnect, device number 63 [ 1098.465791][ T5786] em28xx 1-1:0.0: Disconnecting em28xx [ 1098.465873][ T5786] em28xx 1-1:0.0: Closing input extension [ 1098.612533][T13497] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 1098.613092][ T5892] pegasus 3-1:0.0: probe with driver pegasus failed with error -110 [ 1098.789367][T13497] usb 2-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c [ 1098.789397][T13497] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1098.901889][T13497] usb 2-1: config 0 descriptor?? [ 1098.922331][ T5786] em28xx 1-1:0.0: Freeing device [ 1100.783242][T13497] pegasus 2-1:0.0: probe with driver pegasus failed with error -110 [ 1101.045741][T14838] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1102.043761][ T10] usb 3-1: USB disconnect, device number 62 [ 1102.240003][T13846] usb 2-1: USB disconnect, device number 48 [ 1102.358966][T14865] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2262'. [ 1102.464546][T14871] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2263'. [ 1103.282653][ T5892] usb 1-1: new high-speed USB device number 64 using dummy_hcd [ 1103.312629][T14888] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2270'. [ 1103.475344][ T5892] usb 1-1: Using ep0 maxpacket: 8 [ 1103.499736][ T5892] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 1103.499774][ T5892] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1103.499787][ T5892] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1103.499800][ T5892] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1103.499812][ T5892] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1103.499838][ T5892] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1103.499850][ T5892] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1103.897525][ T5892] usb 1-1: usb_control_msg returned -32 [ 1103.897572][ T5892] usbtmc 1-1:16.0: can't read capabilities [ 1104.037860][ T5892] usb 1-1: USB disconnect, device number 64 [ 1106.516080][T14938] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2285'. [ 1106.641058][T14942] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2285'. [ 1107.483644][T14955] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2293'. [ 1107.843775][T14960] netlink: 72 bytes leftover after parsing attributes in process `syz.0.2296'. [ 1108.632332][T14966] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2298'. [ 1110.352052][T14995] snd_dummy snd_dummy.0: control 0:57412:0:syz0:0 is already present [ 1111.044352][T15002] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2309'. [ 1112.202879][T15026] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1114.573905][ T5892] usb 4-1: new low-speed USB device number 47 using dummy_hcd [ 1114.961346][T15062] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2328'. [ 1115.046027][ T5892] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 1115.046043][ T5892] usb 4-1: config 0 has no interface number 0 [ 1115.046075][ T5892] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1115.046089][ T5892] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 1115.046114][ T5892] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1115.046126][ T5892] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1115.050150][ T5892] usb 4-1: config 0 descriptor?? [ 1115.125275][T15055] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1115.133893][ T5892] iowarrior 4-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1115.387658][T13497] usb 4-1: USB disconnect, device number 47 [ 1116.073956][ T1319] ieee802154 phy0 wpan0: encryption failed: -22 [ 1116.074001][ T1319] ieee802154 phy1 wpan1: encryption failed: -22 [ 1117.449518][T15079] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2334'. [ 1118.185695][T15094] netlink: 'syz.3.2338': attribute type 1 has an invalid length. [ 1118.380918][T15094] bond8: entered promiscuous mode [ 1118.380949][T15094] bond8: entered allmulticast mode [ 1118.381459][T15094] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1118.560911][T15094] bridge0: entered promiscuous mode [ 1118.561084][T15094] bridge0: entered allmulticast mode [ 1118.561840][T15094] bond8: (slave bridge0): Enslaving as a backup interface with an up link [ 1118.642701][T13245] bond8: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 1118.752791][T13245] bond8: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 1119.779402][ T5892] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 1119.932070][ T5892] usb 3-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c [ 1119.932101][ T5892] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1119.937338][ T5892] usb 3-1: config 0 descriptor?? [ 1120.642836][T15137] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2354'. [ 1120.688862][T15138] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2355'. [ 1120.856415][T15140] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2354'. [ 1121.737420][ T5892] pegasus 3-1:0.0: probe with driver pegasus failed with error -110 [ 1123.424327][ T5786] usb 3-1: USB disconnect, device number 63 [ 1124.476913][T15180] loop9: detected capacity change from 0 to 7 [ 1124.481551][T15180] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 1124.481586][T15180] loop9: partition table partially beyond EOD, truncated [ 1124.489903][T15180] loop9: p1 size 2437361653 extends beyond EOD, truncated [ 1126.086137][ C1] vkms_vblank_simulate: vblank timer overrun [ 1126.817701][T15205] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2376'. [ 1128.122533][T10215] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 1128.274644][T10215] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1128.274663][T10215] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1128.274675][T10215] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1128.277446][T10215] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 1128.277464][T10215] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 1128.277475][T10215] usb 3-1: Product: syz [ 1128.277483][T10215] usb 3-1: Manufacturer: syz [ 1128.277491][T10215] usb 3-1: SerialNumber: syz [ 1128.627854][T15237] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.2384'. [ 1128.760825][T10215] usblp 3-1:1.0: usblp0: USB Unidirectional printer dev 64 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 1129.454662][ C1] vkms_vblank_simulate: vblank timer overrun [ 1129.953250][T15252] 9pnet_fd: Insufficient options for proto=fd [ 1130.660792][T15268] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2400'. [ 1130.665721][T15269] netlink: 'syz.0.2399': attribute type 8 has an invalid length. [ 1131.441409][ T10] usb 3-1: USB disconnect, device number 64 [ 1131.448331][ T10] usblp0: removed [ 1131.613684][T15277] fuse: Bad value for 'fd' [ 1131.919384][T15284] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1133.150367][ T5786] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 1133.180809][T15293] 9pnet_fd: Insufficient options for proto=fd [ 1133.272601][ T5786] usb 5-1: device descriptor read/64, error -71 [ 1133.632545][ T5786] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 1133.782604][ T5786] usb 5-1: device descriptor read/64, error -71 [ 1134.042599][ T5786] usb usb5-port1: attempt power cycle [ 1134.053924][T15316] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2413'. [ 1134.072516][ T992] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 1134.119706][T15318] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2413'. [ 1134.272548][ T992] usb 2-1: Using ep0 maxpacket: 32 [ 1134.279863][ T992] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1134.282199][ T992] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 32 [ 1134.283697][ T992] usb 2-1: language id specifier not provided by device, defaulting to English [ 1134.292834][ T992] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1134.292859][ T992] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1134.292870][ T992] usb 2-1: Product: syz [ 1134.292878][ T992] usb 2-1: SerialNumber: syz [ 1134.382643][ T5786] usb 5-1: new high-speed USB device number 67 using dummy_hcd [ 1134.403790][ T5786] usb 5-1: device descriptor read/8, error -71 [ 1134.652592][ T5786] usb 5-1: new high-speed USB device number 68 using dummy_hcd [ 1134.730895][ T5786] usb 5-1: device descriptor read/8, error -71 [ 1134.838208][ T5786] usb usb5-port1: unable to enumerate USB device [ 1135.907815][T15332] fuse: Bad value for 'fd' [ 1138.146208][T15355] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1138.899744][ T992] cdc_ncm 2-1:1.0: bind() failure [ 1138.906581][ T992] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 1138.906630][ T992] cdc_ncm 2-1:1.1: bind() failure [ 1138.945028][ T992] usb 2-1: USB disconnect, device number 49 [ 1139.558085][T15372] fuse: Bad value for 'fd' [ 1140.520544][T15387] 9pnet_fd: Insufficient options for proto=fd [ 1140.829591][T15392] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2442'. [ 1140.900407][ C0] vkms_vblank_simulate: vblank timer overrun [ 1141.157294][T15403] netlink: 208 bytes leftover after parsing attributes in process `syz.1.2445'. [ 1141.218464][T15406] netlink: 72 bytes leftover after parsing attributes in process `syz.3.2443'. [ 1141.252151][T15405] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2441'. [ 1141.421937][T15409] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2441'. [ 1141.422934][T15409] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2441'. [ 1142.077140][T15424] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2450'. [ 1142.910895][ T992] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 1143.191977][ T992] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1143.192006][ T992] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1143.192036][ T992] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1143.232022][ T992] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 1143.232054][ T992] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 1143.232073][ T992] usb 2-1: Product: syz [ 1143.232081][ T992] usb 2-1: Manufacturer: syz [ 1143.232088][ T992] usb 2-1: SerialNumber: syz [ 1143.696826][T15449] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.2455'. [ 1144.066574][ T992] usblp 2-1:1.0: usblp0: USB Unidirectional printer dev 50 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 1147.056810][T13497] usb 2-1: USB disconnect, device number 50 [ 1147.069545][T13497] usblp0: removed [ 1149.640693][T15531] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2484'. [ 1149.642843][T15531] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2484'. [ 1149.643434][T15531] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2484'. [ 1150.023199][T15531] bond8: (slave bridge0): Removing an active aggregator [ 1150.028999][T15531] bond8: (slave bridge0): Releasing backup interface [ 1150.118017][T15531] bridge0 (unregistering): left promiscuous mode [ 1150.118049][T15531] bridge0 (unregistering): left allmulticast mode [ 1153.893669][ T10] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 1154.284863][ T10] usb 4-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c [ 1154.284902][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1154.334328][ T10] usb 4-1: config 0 descriptor?? [ 1156.213135][ T10] pegasus 4-1:0.0: probe with driver pegasus failed with error -110 [ 1158.032756][T15653] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2531'. [ 1158.119364][T15655] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2531'. [ 1158.119729][T15655] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2531'. [ 1158.191049][T13846] usb 4-1: USB disconnect, device number 48 [ 1161.925207][T15712] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2552'. [ 1161.925240][T15712] netlink: 168 bytes leftover after parsing attributes in process `syz.0.2552'. [ 1162.219661][T15716] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1164.241685][T15748] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2563'. [ 1164.241706][T15748] netlink: 168 bytes leftover after parsing attributes in process `syz.0.2563'. [ 1166.385848][T15789] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2577'. [ 1166.385869][T15789] netlink: 152 bytes leftover after parsing attributes in process `syz.0.2577'. [ 1167.166312][T15812] netlink: 'syz.0.2585': attribute type 8 has an invalid length. [ 1167.366846][T15817] 9pnet_fd: Insufficient options for proto=fd [ 1169.010928][T15850] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2595'. [ 1169.104064][T15852] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2595'. [ 1169.262488][T13497] usb 3-1: new low-speed USB device number 65 using dummy_hcd [ 1169.424722][T13497] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 1169.424758][T13497] usb 3-1: config 0 has no interface number 0 [ 1169.424790][T13497] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1169.424811][T13497] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 1169.424838][T13497] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1169.424851][T13497] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1169.498519][T13497] usb 3-1: config 0 descriptor?? [ 1169.499651][T15848] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1169.539639][T13497] iowarrior 3-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1169.722803][T13846] usb 3-1: USB disconnect, device number 65 [ 1169.860838][T15856] netlink: 'syz.3.2600': attribute type 8 has an invalid length. [ 1170.085185][T15858] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2600'. [ 1172.298907][ T5808] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1172.322756][ T5808] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1172.327421][ T5808] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1172.328581][ T5808] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1172.379788][ T5808] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1172.468020][ T5805] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1172.468275][ T5805] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1172.468505][ T5805] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1172.469147][ T5805] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1172.469967][ T5805] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1173.104855][T15872] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2602'. [ 1173.285123][T15875] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1173.285150][T15875] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 1174.302094][ T69] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1174.800343][T15891] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2609'. [ 1174.800362][T15891] netlink: 152 bytes leftover after parsing attributes in process `syz.4.2609'. [ 1175.409784][ T69] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1175.453029][T15896] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1175.840196][T13497] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 1175.972695][T13497] usb 4-1: device descriptor read/64, error -71 [ 1175.973471][ T10] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 1176.242691][T13497] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 1176.315318][ T69] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1176.485912][T13497] usb 4-1: device descriptor read/64, error -71 [ 1176.519286][ T10] usb 2-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c [ 1176.519305][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1176.572133][ T10] usb 2-1: config 0 descriptor?? [ 1176.623288][T13497] usb usb4-port1: attempt power cycle [ 1176.745938][T15911] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1177.163135][T13497] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 1177.184589][T13497] usb 4-1: device descriptor read/8, error -71 [ 1177.423422][T13497] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 1177.427277][ T1319] ieee802154 phy0 wpan0: encryption failed: -22 [ 1177.427351][ T1319] ieee802154 phy1 wpan1: encryption failed: -22 [ 1177.443656][T13497] usb 4-1: device descriptor read/8, error -71 [ 1177.446083][T15918] netlink: 'syz.4.2616': attribute type 8 has an invalid length. [ 1177.564047][T13497] usb usb4-port1: unable to enumerate USB device [ 1177.592140][ T69] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1177.718454][T15921] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2616'. [ 1178.535008][ T10] pegasus 2-1:0.0: probe with driver pegasus failed with error -110 [ 1179.098921][T15866] chnl_net:caif_netlink_parms(): no params data found [ 1179.238015][T13497] usb 2-1: USB disconnect, device number 51 [ 1179.957467][T15945] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2622'. [ 1180.043097][T15866] bridge0: port 1(bridge_slave_0) entered blocking state [ 1180.043261][T15866] bridge0: port 1(bridge_slave_0) entered disabled state [ 1180.043437][T15866] bridge_slave_0: entered allmulticast mode [ 1180.045689][T15866] bridge_slave_0: entered promiscuous mode [ 1180.451537][T15866] bridge0: port 2(bridge_slave_1) entered blocking state [ 1180.451696][T15866] bridge0: port 2(bridge_slave_1) entered disabled state [ 1180.451934][T15866] bridge_slave_1: entered allmulticast mode [ 1180.461127][T15866] bridge_slave_1: entered promiscuous mode [ 1181.292530][ T992] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 1181.422576][ T992] usb 2-1: device descriptor read/64, error -71 [ 1181.662671][ T992] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 1181.792536][ T992] usb 2-1: device descriptor read/64, error -71 [ 1182.156418][ T992] usb usb2-port1: attempt power cycle [ 1182.492666][ T992] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 1182.513271][ T992] usb 2-1: device descriptor read/8, error -71 [ 1182.862482][ T992] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 1182.913448][ T992] usb 2-1: device descriptor read/8, error -71 [ 1183.006014][T15969] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1183.022941][ T992] usb usb2-port1: unable to enumerate USB device [ 1183.253125][T15975] netlink: 'syz.2.2632': attribute type 8 has an invalid length. [ 1183.454465][T15978] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2632'. [ 1185.015340][ T69] bond3 (unregistering): (slave bridge6): Removing an active aggregator [ 1185.020021][ T69] bond3 (unregistering): (slave bridge6): Releasing backup interface [ 1185.040000][ T69] bridge6 (unregistering): left promiscuous mode [ 1185.040030][ T69] bridge6 (unregistering): left allmulticast mode [ 1188.183308][ T69] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1188.243784][ T69] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1188.306815][T16025] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1188.321291][ T69] bond0 (unregistering): (slave macvlan0): Releasing backup interface [ 1188.354920][ T69] veth1_vlan: left allmulticast mode [ 1188.375887][ T69] bond0 (unregistering): Released all slaves [ 1189.876001][ T69] bond1 (unregistering): Released all slaves [ 1191.092517][ T5786] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 1191.270327][ T5786] usb 2-1: Using ep0 maxpacket: 8 [ 1191.274985][ T5786] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 1191.275011][ T5786] usb 2-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1191.275062][ T5786] usb 2-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 1191.275104][ T5786] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1191.275127][ T5786] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1191.337665][ T5786] usbtmc 2-1:16.0: bulk endpoints not found [ 1191.474914][ T69] bond2 (unregistering): Released all slaves [ 1192.225773][ T69] bond3 (unregistering): Released all slaves [ 1192.238398][ T69] bond4 (unregistering): Released all slaves [ 1192.546309][T15866] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1192.567759][T15866] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1192.683005][T16062] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2660'. [ 1192.683035][T16062] netlink: 140 bytes leftover after parsing attributes in process `syz.4.2660'. [ 1193.394433][T16073] syz.2.2663 (16073) used greatest stack depth: 16656 bytes left [ 1193.619672][T15866] team0: Port device team_slave_0 added [ 1193.712959][T13497] usb 2-1: USB disconnect, device number 56 [ 1193.716085][T15866] team0: Port device team_slave_1 added [ 1194.466652][T15866] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1194.466671][T15866] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1194.466698][T15866] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1194.652644][ T69] hsr_slave_0: left promiscuous mode [ 1194.692769][ T69] hsr_slave_1: left promiscuous mode [ 1194.697593][ T69] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1194.697721][ T69] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1194.741913][ T69] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1194.741943][ T69] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1195.032824][T16098] netlink: 'syz.1.2671': attribute type 8 has an invalid length. [ 1195.067605][ T69] veth1_macvtap: left promiscuous mode [ 1195.067807][ T69] veth0_macvtap: left promiscuous mode [ 1195.068482][ T69] veth1_vlan: left promiscuous mode [ 1195.100994][ T69] veth0_vlan: left promiscuous mode [ 1195.166844][T16102] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2673'. [ 1195.166874][T16102] netlink: 140 bytes leftover after parsing attributes in process `syz.3.2673'. [ 1195.272242][T16103] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2671'. [ 1197.612699][ T5786] usb 5-1: new high-speed USB device number 69 using dummy_hcd [ 1197.772540][ T5786] usb 5-1: Using ep0 maxpacket: 8 [ 1197.774836][ T5786] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 1197.774853][ T5786] usb 5-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1197.774883][ T5786] usb 5-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 1197.774907][ T5786] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1197.774919][ T5786] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1197.858134][ T5786] usbtmc 5-1:16.0: bulk endpoints not found [ 1198.781677][ T10] usb 5-1: USB disconnect, device number 69 [ 1198.973453][ T69] team0 (unregistering): Port device team_slave_1 removed [ 1199.295444][ T69] team0 (unregistering): Port device team_slave_0 removed [ 1202.837246][T15866] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1202.837263][T15866] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1202.837289][T15866] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1203.495495][T16178] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2693'. [ 1203.578922][T15866] hsr_slave_0: entered promiscuous mode [ 1203.580384][T15866] hsr_slave_1: entered promiscuous mode [ 1203.581290][T15866] debugfs: 'hsr0' already exists in 'hsr' [ 1203.581313][T15866] Cannot create hsr debugfs directory [ 1206.309936][ T69] IPVS: stop unused estimator thread 0... [ 1206.847944][T16216] netlink: 'syz.3.2702': attribute type 8 has an invalid length. [ 1207.178799][T16216] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2702'. [ 1208.589557][ C1] vkms_vblank_simulate: vblank timer overrun [ 1209.233557][T15866] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1209.348230][T16245] fuse: Bad value for 'fd' [ 1209.348317][T15866] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1209.401826][T15866] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1209.512511][T15866] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1210.018605][T15866] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1210.270584][T15866] 8021q: adding VLAN 0 to HW filter on device team0 [ 1210.319073][ T58] bridge0: port 1(bridge_slave_0) entered blocking state [ 1210.320144][ T58] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1210.539991][T13245] bridge0: port 2(bridge_slave_1) entered blocking state [ 1210.540145][T13245] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1211.868301][T16290] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1212.529533][T15866] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1212.741980][T15866] veth0_vlan: entered promiscuous mode [ 1212.772602][T15866] veth1_vlan: entered promiscuous mode [ 1212.887675][T15866] veth0_macvtap: entered promiscuous mode [ 1212.932997][T15866] veth1_macvtap: entered promiscuous mode [ 1213.186139][T15866] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1213.234813][T15866] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1213.302721][ T69] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1213.302994][ T69] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1213.303278][ T69] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1213.303553][ T69] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1213.966836][T16316] netlink: 'syz.3.2718': attribute type 8 has an invalid length. [ 1214.138538][T16321] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2718'. [ 1214.174615][ T43] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1214.174636][ T43] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1214.411713][T11205] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1214.411735][T11205] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1215.383765][T16336] fuse: Bad value for 'fd' [ 1216.568507][T16354] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1218.533667][T16372] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2726'. [ 1219.772658][ T992] usb 5-1: new high-speed USB device number 70 using dummy_hcd [ 1219.892545][ T5887] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 1219.922835][ T992] usb 5-1: Using ep0 maxpacket: 32 [ 1219.926851][ T992] usb 5-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 1219.926914][ T992] usb 5-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 1219.926943][ T992] usb 5-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1219.926969][ T992] usb 5-1: config 155 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1219.926991][ T992] usb 5-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 1220.019380][ T992] usb 5-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 1220.019410][ T992] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1220.019430][ T992] usb 5-1: Product: syz [ 1220.019444][ T992] usb 5-1: Manufacturer: syz [ 1220.019459][ T992] usb 5-1: SerialNumber: syz [ 1220.064077][ T5887] usb 2-1: Using ep0 maxpacket: 8 [ 1220.067590][ T992] imon:imon_init_intf0: usb_submit_urb failed for intf0 (-90) [ 1220.067673][ T992] imon 5-1:155.0: unable to initialize intf0, err -90 [ 1220.067686][ T992] imon:imon_probe: failed to initialize context! [ 1220.067697][ T992] imon 5-1:155.0: unable to register, err -19 [ 1220.071268][ T5887] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 1220.071304][ T5887] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1220.071316][ T5887] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1220.071329][ T5887] usb 2-1: config 16 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1220.071343][ T5887] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1220.071368][ T5887] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1220.071381][ T5887] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1220.083426][ T5887] usbtmc 2-1:16.0: bulk endpoints not found [ 1220.381295][T16393] fuse: Bad value for 'fd' [ 1221.650434][ T5786] usb 5-1: USB disconnect, device number 70 [ 1221.701919][T16405] netlink: 'syz.0.2736': attribute type 8 has an invalid length. [ 1221.909985][T16409] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2736'. [ 1222.666473][T11018] usb 2-1: USB disconnect, device number 57 [ 1223.446312][T16438] netlink: 72 bytes leftover after parsing attributes in process `syz.3.2746'. [ 1225.378218][T16313] usb 5-1: new high-speed USB device number 71 using dummy_hcd [ 1225.552476][T16313] usb 5-1: Using ep0 maxpacket: 8 [ 1225.554378][T16313] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 1225.554416][T16313] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1225.554429][T16313] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1225.554442][T16313] usb 5-1: config 16 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1225.554453][T16313] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1225.554477][T16313] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1225.554489][T16313] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1225.560327][T16313] usbtmc 5-1:16.0: bulk endpoints not found [ 1226.535545][ T5887] usb 5-1: USB disconnect, device number 71 [ 1226.972472][T16313] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 1227.322906][T16313] usb 4-1: Using ep0 maxpacket: 32 [ 1227.402921][T16313] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1227.425567][T16313] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 32 [ 1227.428343][T16313] usb 4-1: language id specifier not provided by device, defaulting to English [ 1227.448997][T16313] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1227.449030][T16313] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1227.449051][T16313] usb 4-1: Product: syz [ 1227.449066][T16313] usb 4-1: SerialNumber: syz [ 1228.595115][T16511] loop9: detected capacity change from 0 to 7 [ 1228.600367][T16511] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 1228.600446][T16511] loop9: partition table partially beyond EOD, truncated [ 1228.600829][T16511] loop9: p1 size 2437361653 extends beyond EOD, truncated [ 1229.497670][T16510] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1229.928232][T16174] udevd[16174]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 1232.596586][T16313] cdc_ncm 4-1:1.0: bind() failure [ 1232.602124][T16313] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 1232.602153][T16313] cdc_ncm 4-1:1.1: bind() failure [ 1232.645137][T16313] usb 4-1: USB disconnect, device number 53 [ 1234.041378][T16549] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1237.099332][T16585] netlink: 72 bytes leftover after parsing attributes in process `syz.3.2789'. [ 1238.867447][ T1319] ieee802154 phy0 wpan0: encryption failed: -22 [ 1238.867520][ T1319] ieee802154 phy1 wpan1: encryption failed: -22 [ 1239.815131][T16617] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1244.632587][T11018] usb 5-1: new high-speed USB device number 72 using dummy_hcd [ 1244.786876][T11018] usb 5-1: Using ep0 maxpacket: 32 [ 1244.793495][T11018] usb 5-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 1244.793565][T11018] usb 5-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 1244.793592][T11018] usb 5-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1244.793618][T11018] usb 5-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 1244.796642][T11018] usb 5-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 1244.796670][T11018] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1244.796690][T11018] usb 5-1: Product: syz [ 1244.796704][T11018] usb 5-1: Manufacturer: syz [ 1244.796718][T11018] usb 5-1: SerialNumber: syz [ 1244.919933][ C1] imon 5-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 1244.940405][T11018] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/input/input51 [ 1245.142523][T11018] imon 5-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 1245.142546][T11018] (id 0x00) [ 1245.518575][T11018] rc_core: IR keymap rc-imon-pad not found [ 1245.518597][T11018] Registered IR keymap rc-empty [ 1245.520488][T11018] imon 5-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 1245.520503][T11018] imon 5-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 1245.569470][T11018] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/rc/rc0 [ 1245.616665][T11018] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/rc/rc0/input52 [ 1245.637825][T11018] imon 5-1:155.0: iMON device (15c2:ffdc, intf0) on usb<5:72> initialized [ 1246.084595][T16662] imon:vfd_write: invalid payload size [ 1247.366338][ T5969] usb 5-1: USB disconnect, device number 72 [ 1247.651802][T16710] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2828'. [ 1247.872509][ T5887] usb 1-1: new low-speed USB device number 65 using dummy_hcd [ 1248.070494][ T5887] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 1248.070538][ T5887] usb 1-1: config 0 has no interface number 0 [ 1248.070587][ T5887] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1248.070615][ T5887] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 1248.070657][ T5887] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1248.070681][ T5887] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1248.092703][ T5887] usb 1-1: config 0 descriptor?? [ 1248.093879][T16702] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1248.156971][ T5887] iowarrior 1-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior1 [ 1248.807712][ T5786] usb 1-1: USB disconnect, device number 65 [ 1251.935553][T16749] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1254.756141][T16777] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2849'. [ 1257.941619][T16812] netlink: 208 bytes leftover after parsing attributes in process `syz.2.2862'. [ 1258.756365][T16825] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1259.783157][T16838] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2868'. [ 1261.617908][ T992] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 1261.782550][ T992] usb 4-1: Using ep0 maxpacket: 32 [ 1261.798573][ T992] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1261.804952][ T992] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 32 [ 1261.807788][ T992] usb 4-1: language id specifier not provided by device, defaulting to English [ 1261.834178][ T992] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1261.834211][ T992] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1261.834232][ T992] usb 4-1: Product: syz [ 1261.834257][ T992] usb 4-1: SerialNumber: syz [ 1263.659690][T16864] netlink: 208 bytes leftover after parsing attributes in process `syz.2.2875'. [ 1264.122775][ T5786] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 1264.272483][ T5786] usb 3-1: Using ep0 maxpacket: 8 [ 1264.277040][ T5786] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 1264.277076][ T5786] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1264.277089][ T5786] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1264.277102][ T5786] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1264.277115][ T5786] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1264.277176][ T5786] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1264.277189][ T5786] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1264.585113][ T5786] usb 3-1: usb_control_msg returned -32 [ 1264.588030][ T5786] usbtmc 3-1:16.0: can't read capabilities [ 1265.967592][T16880] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1266.246009][ T992] cdc_ncm 4-1:1.0: bind() failure [ 1266.297887][ T992] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 1266.297937][ T992] cdc_ncm 4-1:1.1: bind() failure [ 1266.328284][ T992] usb 4-1: USB disconnect, device number 54 [ 1266.915370][ T992] usb 3-1: USB disconnect, device number 66 [ 1267.295872][T16900] netlink: 208 bytes leftover after parsing attributes in process `syz.4.2887'. [ 1268.405195][T16914] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2890'. [ 1271.314673][T13846] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 1271.509751][T13846] usb 5-1: Using ep0 maxpacket: 8 [ 1271.512248][T13846] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 1271.512492][T13846] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1271.512517][T13846] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1271.512541][T13846] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1271.512566][T13846] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1271.512610][T13846] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1271.512633][T13846] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1271.799954][T13846] usb 5-1: usb_control_msg returned -32 [ 1271.799984][T13846] usbtmc 5-1:16.0: can't read capabilities [ 1271.874320][T16937] netlink: 208 bytes leftover after parsing attributes in process `syz.1.2898'. [ 1274.021498][T13846] usb 5-1: USB disconnect, device number 73 [ 1274.921734][T16976] netlink: 208 bytes leftover after parsing attributes in process `syz.1.2911'. [ 1275.520046][T16986] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2912'. [ 1277.564919][ T5887] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 1277.722498][ T5887] usb 4-1: Using ep0 maxpacket: 8 [ 1277.725133][ T5887] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 1277.725300][ T5887] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1277.725326][ T5887] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1277.725350][ T5887] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1277.725376][ T5887] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1277.725419][ T5887] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1277.725443][ T5887] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1277.986999][ T5887] usb 4-1: usb_control_msg returned -32 [ 1277.987050][ T5887] usbtmc 4-1:16.0: can't read capabilities [ 1278.922028][T17013] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1280.443116][T11018] usb 4-1: USB disconnect, device number 55 [ 1280.685314][T17021] netlink: 208 bytes leftover after parsing attributes in process `syz.3.2924'. [ 1281.707269][T17050] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2932'. [ 1282.712474][ C0] vkms_vblank_simulate: vblank timer overrun [ 1283.222731][T17064] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1284.723971][T17071] netlink: 208 bytes leftover after parsing attributes in process `syz.4.2939'. [ 1285.621199][T17088] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2945'. [ 1285.690579][T17090] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2945'. [ 1286.759404][T17108] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1287.074908][T17113] netlink: 208 bytes leftover after parsing attributes in process `syz.1.2951'. [ 1290.141920][T17144] netlink: 208 bytes leftover after parsing attributes in process `syz.0.2964'. [ 1290.559754][T17148] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1290.760445][T17160] netlink: 'syz.2.2970': attribute type 1 has an invalid length. [ 1291.334193][T17159] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1291.550830][T17184] netlink: 208 bytes leftover after parsing attributes in process `syz.2.2976'. [ 1291.642496][T16313] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 1291.802410][T16313] usb 4-1: Using ep0 maxpacket: 32 [ 1291.805077][T16313] usb 4-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 1291.805147][T16313] usb 4-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 1291.805176][T16313] usb 4-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1291.805212][T16313] usb 4-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 1291.808195][T16313] usb 4-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 1291.808229][T16313] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1291.808250][T16313] usb 4-1: Product: syz [ 1291.808265][T16313] usb 4-1: Manufacturer: syz [ 1291.808280][T16313] usb 4-1: SerialNumber: syz [ 1291.918646][ C0] imon 4-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 1291.947530][T16313] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:155.0/input/input53 [ 1292.124986][T16313] imon 4-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 1292.125008][T16313] (id 0x00) [ 1292.202448][T16313] rc_core: IR keymap rc-imon-pad not found [ 1292.202469][T16313] Registered IR keymap rc-empty [ 1292.202549][T16313] imon 4-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 1292.202567][T16313] imon 4-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 1292.324117][T16313] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:155.0/rc/rc0 [ 1292.327445][T16313] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:155.0/rc/rc0/input54 [ 1292.360247][T16313] imon 4-1:155.0: iMON device (15c2:ffdc, intf0) on usb<4:56> initialized [ 1292.652516][T11018] usb 1-1: new high-speed USB device number 66 using dummy_hcd [ 1293.274425][T11018] usb 1-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c [ 1293.274457][T11018] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1293.285350][T11018] usb 1-1: config 0 descriptor?? [ 1294.593127][ T5887] usb 4-1: USB disconnect, device number 56 [ 1294.625468][T11018] pegasus 1-1:0.0: probe with driver pegasus failed with error -32 [ 1295.588763][T13846] usb 1-1: USB disconnect, device number 66 [ 1296.672521][T13846] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 1296.832548][T13846] usb 5-1: Using ep0 maxpacket: 32 [ 1296.835024][T13846] usb 5-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 1296.835080][T13846] usb 5-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 1296.835107][T13846] usb 5-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1296.835134][T13846] usb 5-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 1296.838750][T13846] usb 5-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 1296.838779][T13846] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1296.838800][T13846] usb 5-1: Product: syz [ 1296.838814][T13846] usb 5-1: Manufacturer: syz [ 1296.838835][T13846] usb 5-1: SerialNumber: syz [ 1296.918259][ C1] imon 5-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 1297.020558][T13846] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/input/input55 [ 1297.242540][T13846] imon 5-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 1297.242554][T13846] (id 0x00) [ 1297.459742][ T5808] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1297.470725][ T5808] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1297.475656][ T5808] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1297.483419][ T5808] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1297.486099][ T5808] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1297.535327][T13846] rc_core: IR keymap rc-imon-pad not found [ 1297.535347][T13846] Registered IR keymap rc-empty [ 1297.536621][T13846] imon 5-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 1297.536642][T13846] imon 5-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 1297.569127][T13846] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/rc/rc0 [ 1297.578761][T13846] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/rc/rc0/input56 [ 1297.595453][ T5887] usb 1-1: new high-speed USB device number 67 using dummy_hcd [ 1297.613700][T13846] imon 5-1:155.0: iMON device (15c2:ffdc, intf0) on usb<5:74> initialized [ 1297.695036][T17233] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1297.802393][ T5887] usb 1-1: Using ep0 maxpacket: 32 [ 1297.805001][ T5887] usb 1-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 1297.805056][ T5887] usb 1-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 1297.805084][ T5887] usb 1-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1297.805111][ T5887] usb 1-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 1297.808283][ T5887] usb 1-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 1297.808325][ T5887] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1297.808347][ T5887] usb 1-1: Product: syz [ 1297.808362][ T5887] usb 1-1: Manufacturer: syz [ 1297.808377][ T5887] usb 1-1: SerialNumber: syz [ 1298.046295][ C0] imon 1-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 1298.049856][ T5887] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:155.0/input/input57 [ 1298.142421][ T5887] imon 1-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 1298.142442][ T5887] (id 0x00) [ 1298.232553][ T5887] rc_core: IR keymap rc-imon-pad not found [ 1298.232574][ T5887] Registered IR keymap rc-empty [ 1298.232732][ T5887] imon 1-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 1298.232753][ T5887] imon 1-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 1298.362025][ T5887] rc rc1: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:155.0/rc/rc1 [ 1298.443658][ T5887] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:155.0/rc/rc1/input58 [ 1298.458793][ T5887] imon 1-1:155.0: iMON device (15c2:ffdc, intf0) on usb<1:67> initialized [ 1298.486037][T17249] imon:vfd_write: invalid payload size [ 1298.537625][T13846] usb 5-1: USB disconnect, device number 74 [ 1299.572956][ T5808] Bluetooth: hci4: command tx timeout [ 1299.846038][ T58] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1299.846075][ T58] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1299.901396][ T5969] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 1300.062467][ T5969] usb 5-1: Using ep0 maxpacket: 8 [ 1300.065334][ T5969] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 1300.065393][ T5969] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1300.065418][ T5969] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1300.065443][ T5969] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1300.065467][ T5969] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1300.065510][ T5969] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1300.065534][ T5969] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1300.300724][ T1319] ieee802154 phy0 wpan0: encryption failed: -22 [ 1300.300789][ T1319] ieee802154 phy1 wpan1: encryption failed: -22 [ 1300.337737][ T5969] usb 5-1: usb_control_msg returned -32 [ 1300.337766][ T5969] usbtmc 5-1:16.0: can't read capabilities [ 1300.583529][ T5887] usb 1-1: USB disconnect, device number 67 [ 1301.338363][ T58] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1301.338399][ T58] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1301.652563][ T5808] Bluetooth: hci4: command tx timeout [ 1301.726832][ T58] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1301.726868][ T58] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1302.157558][ T58] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1302.157592][ T58] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1302.270195][T17289] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3004'. [ 1302.323250][T17286] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3004'. [ 1302.325842][T17289] bridge_slave_1: left allmulticast mode [ 1302.325870][T17289] bridge_slave_1: left promiscuous mode [ 1302.326131][T17289] bridge0: port 2(bridge_slave_1) entered disabled state [ 1302.434553][T11018] usb 5-1: USB disconnect, device number 75 [ 1302.675756][T17289] bridge_slave_0: left allmulticast mode [ 1302.675787][T17289] bridge_slave_0: left promiscuous mode [ 1302.676761][T17289] bridge0: port 1(bridge_slave_0) entered disabled state [ 1303.749684][ T5808] Bluetooth: hci4: command tx timeout [ 1305.162444][ T5887] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 1305.322548][ T5887] usb 5-1: Using ep0 maxpacket: 8 [ 1305.324206][ T5887] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 1305.324250][ T5887] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1305.324262][ T5887] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1305.324275][ T5887] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1305.324295][ T5887] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1305.324318][ T5887] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1305.324331][ T5887] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1305.565712][ T5887] usb 5-1: GET_CAPABILITIES returned 0 [ 1305.565761][ T5887] usbtmc 5-1:16.0: can't read capabilities [ 1305.823316][ T5808] Bluetooth: hci4: command tx timeout [ 1306.551808][ C0] vkms_vblank_simulate: vblank timer overrun [ 1307.961444][T11018] usb 5-1: USB disconnect, device number 76 [ 1308.231266][ C0] vkms_vblank_simulate: vblank timer overrun [ 1309.305272][ C0] vkms_vblank_simulate: vblank timer overrun [ 1309.961567][ C0] vkms_vblank_simulate: vblank timer overrun [ 1311.872894][ T5892] usb 5-1: new high-speed USB device number 77 using dummy_hcd [ 1311.906739][T17393] loop9: detected capacity change from 0 to 7 [ 1312.085264][ T5892] usb 5-1: Using ep0 maxpacket: 8 [ 1312.087077][ T5892] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 1312.087112][ T5892] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1312.087125][ T5892] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1312.087139][ T5892] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1312.087152][ T5892] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1312.087187][ T5892] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1312.087199][ T5892] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1312.249946][T17393] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 1312.250700][T17393] loop9: partition table partially beyond EOD, truncated [ 1312.300962][ T5892] usb 5-1: GET_CAPABILITIES returned 0 [ 1312.300994][ T5892] usbtmc 5-1:16.0: can't read capabilities [ 1312.348711][T17393] loop9: p1 size 2437361653 extends beyond EOD, truncated [ 1312.893792][ T58] bond2 (unregistering): (slave bridge1): Removing an active aggregator [ 1312.894667][ T58] bond2 (unregistering): (slave bridge1): Releasing backup interface [ 1312.943070][ T58] bridge1 (unregistering): left promiscuous mode [ 1312.943102][ T58] bridge1 (unregistering): left allmulticast mode [ 1313.257700][ T58] bond3 (unregistering): (slave bridge2): Releasing backup interface [ 1313.464192][ T58] bond4 (unregistering): (slave bridge3): Removing an active aggregator [ 1313.464750][ T58] bond4 (unregistering): (slave bridge3): Releasing backup interface [ 1313.513387][ T58] bridge3 (unregistering): left promiscuous mode [ 1313.513408][ T58] bridge3 (unregistering): left allmulticast mode [ 1314.162617][ T58] bond5 (unregistering): (slave bridge7): Removing an active aggregator [ 1314.168506][ T58] bond5 (unregistering): (slave bridge7): Releasing backup interface [ 1314.247542][ T58] bridge7 (unregistering): left promiscuous mode [ 1314.247581][ T58] bridge7 (unregistering): left allmulticast mode [ 1314.371733][ C0] vkms_vblank_simulate: vblank timer overrun [ 1314.559468][ T10] usb 5-1: USB disconnect, device number 77 [ 1314.634639][ C0] vkms_vblank_simulate: vblank timer overrun [ 1315.295644][ C0] vkms_vblank_simulate: vblank timer overrun [ 1315.320349][ T58] bond6 (unregistering): (slave bridge8): Removing an active aggregator [ 1315.321069][ T58] bond6 (unregistering): (slave bridge8): Releasing backup interface [ 1315.383944][ T58] bridge8 (unregistering): left promiscuous mode [ 1315.383973][ T58] bridge8 (unregistering): left allmulticast mode [ 1315.790393][T17420] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3039'. [ 1315.852592][ T58] bond7 (unregistering): (slave bridge10): Removing an active aggregator [ 1315.853131][ T58] bond7 (unregistering): (slave bridge10): Releasing backup interface [ 1315.902937][ T58] bridge10 (unregistering): left promiscuous mode [ 1315.902958][ T58] bridge10 (unregistering): left allmulticast mode [ 1316.382668][ C0] vkms_vblank_simulate: vblank timer overrun [ 1316.488059][ C0] vkms_vblank_simulate: vblank timer overrun [ 1316.549560][ C0] vkms_vblank_simulate: vblank timer overrun [ 1316.701627][ C0] vkms_vblank_simulate: vblank timer overrun [ 1317.000510][ C0] vkms_vblank_simulate: vblank timer overrun [ 1317.085718][ C0] vkms_vblank_simulate: vblank timer overrun [ 1317.180970][ C0] vkms_vblank_simulate: vblank timer overrun [ 1317.304388][ C0] vkms_vblank_simulate: vblank timer overrun [ 1317.402470][ C0] vkms_vblank_simulate: vblank timer overrun [ 1317.469854][ C0] vkms_vblank_simulate: vblank timer overrun [ 1317.853683][ T58] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1317.903690][ T58] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1317.964629][ T58] bond0 (unregistering): (slave macvlan0): Releasing backup interface [ 1317.983386][ T58] veth1_vlan: left allmulticast mode [ 1318.024142][ T58] bond0 (unregistering): Released all slaves [ 1318.057162][ C0] vkms_vblank_simulate: vblank timer overrun [ 1318.321699][ C0] vkms_vblank_simulate: vblank timer overrun [ 1318.369314][ C0] vkms_vblank_simulate: vblank timer overrun [ 1318.419720][ C0] vkms_vblank_simulate: vblank timer overrun [ 1318.495920][ C0] vkms_vblank_simulate: vblank timer overrun [ 1318.650043][ C0] vkms_vblank_simulate: vblank timer overrun [ 1318.739326][ C0] vkms_vblank_simulate: vblank timer overrun [ 1318.904661][ T58] bond1 (unregistering): Released all slaves [ 1319.725274][ T58] bond2 (unregistering): Released all slaves [ 1319.740925][ T58] bond3 (unregistering): Released all slaves [ 1320.565999][ T58] bond4 (unregistering): Released all slaves [ 1321.418033][ T58] bond5 (unregistering): Released all slaves [ 1322.215162][ T58] bond6 (unregistering): Released all slaves [ 1323.067963][ T58] bond7 (unregistering): Released all slaves [ 1323.906760][ T58] bond8 (unregistering): Released all slaves [ 1323.972535][T17418] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3039'. [ 1324.291606][ T58] rxrpc: Call ffff88804ae24ec0 still in use (1,Complete,1489,0)! [ 1324.424662][T17238] chnl_net:caif_netlink_parms(): no params data found [ 1325.812574][ T10] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 1325.982521][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 1325.985097][ T10] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 1325.985174][ T10] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1325.985201][ T10] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1325.985227][ T10] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1325.985252][ T10] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1325.985298][ T10] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1325.985324][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1326.238760][T17238] bridge0: port 1(bridge_slave_0) entered blocking state [ 1326.239401][T17238] bridge0: port 1(bridge_slave_0) entered disabled state [ 1326.240167][T17238] bridge_slave_0: entered allmulticast mode [ 1326.272018][T17238] bridge_slave_0: entered promiscuous mode [ 1326.292169][ T10] usb 5-1: GET_CAPABILITIES returned 0 [ 1326.292216][ T10] usbtmc 5-1:16.0: can't read capabilities [ 1326.334123][T17238] bridge0: port 2(bridge_slave_1) entered blocking state [ 1326.334248][T17238] bridge0: port 2(bridge_slave_1) entered disabled state [ 1326.334481][T17238] bridge_slave_1: entered allmulticast mode [ 1326.337288][T17238] bridge_slave_1: entered promiscuous mode [ 1326.698652][T17238] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1326.723498][T17238] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1327.292090][T17238] team0: Port device team_slave_0 added [ 1327.339259][T17238] team0: Port device team_slave_1 added [ 1327.494616][T17489] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3054'. [ 1327.730430][T17238] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1327.730447][T17238] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1327.730471][T17238] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1327.885350][T17238] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1327.885362][T17238] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1327.885377][T17238] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1328.549933][T11018] usb 5-1: USB disconnect, device number 78 [ 1328.647331][T17238] hsr_slave_0: entered promiscuous mode [ 1328.650860][T17238] hsr_slave_1: entered promiscuous mode [ 1328.665140][T17238] debugfs: 'hsr0' already exists in 'hsr' [ 1328.665170][T17238] Cannot create hsr debugfs directory [ 1329.823320][T17513] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1332.362436][ T5892] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 1332.532496][ T5892] usb 2-1: Using ep0 maxpacket: 8 [ 1332.535291][ T5892] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 1332.535352][ T5892] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1332.535375][ T5892] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1332.535400][ T5892] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1332.535424][ T5892] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1332.535467][ T5892] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1332.535490][ T5892] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1332.782409][ T5892] usb 2-1: GET_CAPABILITIES returned 0 [ 1332.782456][ T5892] usbtmc 2-1:16.0: can't read capabilities [ 1333.240458][T17552] loop9: detected capacity change from 0 to 7 [ 1333.248908][T17552] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 1333.248952][T17552] loop9: partition table partially beyond EOD, truncated [ 1333.249217][T17552] loop9: p1 size 2437361653 extends beyond EOD, truncated [ 1334.844876][T17238] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1334.917736][T17238] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1335.031682][T17238] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1335.057849][T11018] usb 2-1: USB disconnect, device number 58 [ 1335.229107][T17238] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1335.825008][T17238] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1335.861018][T17238] 8021q: adding VLAN 0 to HW filter on device team0 [ 1336.020105][T17601] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3073'. [ 1337.454595][ T1409] bridge0: port 1(bridge_slave_0) entered blocking state [ 1337.454745][ T1409] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1337.595829][ T7948] bridge0: port 2(bridge_slave_1) entered blocking state [ 1337.595992][ T7948] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1339.496554][T17238] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1339.792185][T17238] veth0_vlan: entered promiscuous mode [ 1339.947710][T17238] veth1_vlan: entered promiscuous mode [ 1340.281586][T17238] veth0_macvtap: entered promiscuous mode [ 1340.318597][T17238] veth1_macvtap: entered promiscuous mode [ 1340.363937][T17238] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1340.396131][T17238] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1340.455224][ T1409] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1340.455464][ T1409] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1340.455515][ T1409] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1340.455549][ T1409] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1341.055298][ T1396] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1341.055321][ T1396] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1341.266475][T17656] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1341.312454][ T10] usb 2-1: new high-speed USB device number 59 using dummy_hcd [ 1341.451313][ T7948] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1341.451335][ T7948] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1341.476964][ T10] usb 2-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c [ 1341.476984][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1341.480120][ T10] usb 2-1: config 0 descriptor?? [ 1343.173595][ T10] pegasus 2-1:0.0: probe with driver pegasus failed with error -110 [ 1344.284557][T17689] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3087'. [ 1344.408237][T17692] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3087'. [ 1346.465394][T11018] usb 2-1: USB disconnect, device number 59 [ 1346.529492][ T5805] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1346.543293][ T5805] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1346.546020][ T5805] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1346.562656][ T5805] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1346.575467][ T5805] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1347.000682][T17720] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3092'. [ 1348.692478][T11018] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 1348.698224][ T5805] Bluetooth: hci0: command tx timeout [ 1348.846253][T11018] usb 4-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c [ 1348.846284][T11018] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1348.893064][T11018] usb 4-1: config 0 descriptor?? [ 1349.646802][T17710] chnl_net:caif_netlink_parms(): no params data found [ 1350.782550][ T5805] Bluetooth: hci0: command tx timeout [ 1350.783127][T11018] pegasus 4-1:0.0: probe with driver pegasus failed with error -110 [ 1351.168075][T17710] bridge0: port 1(bridge_slave_0) entered blocking state [ 1351.168291][T17710] bridge0: port 1(bridge_slave_0) entered disabled state [ 1351.168509][T17710] bridge_slave_0: entered allmulticast mode [ 1351.211844][T17710] bridge_slave_0: entered promiscuous mode [ 1351.226220][T17710] bridge0: port 2(bridge_slave_1) entered blocking state [ 1351.251342][T17710] bridge0: port 2(bridge_slave_1) entered disabled state [ 1351.251605][T17710] bridge_slave_1: entered allmulticast mode [ 1351.415190][T17710] bridge_slave_1: entered promiscuous mode [ 1352.080285][T17710] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1352.104909][T17710] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1352.222891][T17723] usb 4-1: USB disconnect, device number 57 [ 1352.352424][ T10] usb 1-1: new low-speed USB device number 68 using dummy_hcd [ 1352.565114][ T10] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 1352.565141][ T10] usb 1-1: config 0 has no interface number 0 [ 1352.565195][ T10] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1352.565224][ T10] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 1352.565268][ T10] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1352.565292][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1352.591296][ T10] usb 1-1: config 0 descriptor?? [ 1352.596163][T17764] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 1352.630385][ T10] iowarrior 1-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1352.686853][T17710] team0: Port device team_slave_0 added [ 1352.691287][T17710] team0: Port device team_slave_1 added [ 1352.898318][ T5805] Bluetooth: hci0: command tx timeout [ 1353.830455][T10215] usb 1-1: USB disconnect, device number 68 [ 1354.239725][T17792] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3109'. [ 1354.241670][T17710] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1354.241681][T17710] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1354.241696][T17710] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1354.258013][T17710] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1354.258029][T17710] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1354.258055][T17710] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1354.933605][ T5805] Bluetooth: hci0: command tx timeout [ 1355.667399][T17710] hsr_slave_0: entered promiscuous mode [ 1355.670972][T17710] hsr_slave_1: entered promiscuous mode [ 1355.673509][T17710] debugfs: 'hsr0' already exists in 'hsr' [ 1355.673535][T17710] Cannot create hsr debugfs directory [ 1356.253390][T17810] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3117'. [ 1356.363633][T17811] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3117'. [ 1357.136464][T17811] bridge_slave_1: left allmulticast mode [ 1357.136495][T17811] bridge_slave_1: left promiscuous mode [ 1357.137275][T17811] bridge0: port 2(bridge_slave_1) entered disabled state [ 1358.223557][T17811] bridge_slave_0: left allmulticast mode [ 1358.223577][T17811] bridge_slave_0: left promiscuous mode [ 1358.223735][T17811] bridge0: port 1(bridge_slave_0) entered disabled state [ 1359.273449][T17839] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3123'. [ 1359.290197][T17838] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1359.362070][T17831] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3123'. [ 1361.408185][T17710] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1361.588901][T17846] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1361.750411][ T1319] ieee802154 phy0 wpan0: encryption failed: -22 [ 1361.750468][ T1319] ieee802154 phy1 wpan1: encryption failed: -22 [ 1362.079170][T17710] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1362.484392][T17710] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1362.514134][T17874] netlink: 'syz.3.3138': attribute type 1 has an invalid length. [ 1362.533943][T17874] veth1_vlan: entered allmulticast mode [ 1364.752033][T17710] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1365.061625][T17905] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1365.942880][ T37] audit: type=1326 audit(1763000745.078:1098): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=17915 comm="syz.3.3154" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7ff39e95f6c9 code=0x0 [ 1366.438506][T17710] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1366.473977][T17710] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1366.646250][T17710] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1366.871390][T17710] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1367.743777][T17710] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1367.879466][T17710] 8021q: adding VLAN 0 to HW filter on device team0 [ 1367.918755][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 1367.918994][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1367.965733][T17204] bridge0: port 2(bridge_slave_1) entered blocking state [ 1368.031913][T17204] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1370.015394][T17710] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1371.701091][T17710] veth0_vlan: entered promiscuous mode [ 1371.709827][T17710] veth1_vlan: entered promiscuous mode [ 1371.948269][T17710] veth0_macvtap: entered promiscuous mode [ 1371.966063][T17710] veth1_macvtap: entered promiscuous mode [ 1372.107533][T17710] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1372.121115][T17710] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1372.136815][ T1396] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1372.137034][ T1396] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1372.139137][ T1396] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1372.183986][ T1396] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1372.914090][ T43] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1372.914110][ T43] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1373.203398][T11018] Process accounting resumed [ 1373.243420][ T1010] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1373.243441][ T1010] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1375.381303][ T37] audit: type=1326 audit(1763000754.508:1099): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=18022 comm="syz.4.3181" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f2bb4f1f6c9 code=0x0 [ 1376.138434][ T5808] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1376.159153][ T5808] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1376.160520][ T5808] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1376.180243][ T5808] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1376.181183][ T5808] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1378.373907][ T5808] Bluetooth: hci3: command tx timeout [ 1378.388597][T18028] chnl_net:caif_netlink_parms(): no params data found [ 1379.823808][T18028] bridge0: port 1(bridge_slave_0) entered blocking state [ 1379.826486][T18028] bridge0: port 1(bridge_slave_0) entered disabled state [ 1379.826759][T18028] bridge_slave_0: entered allmulticast mode [ 1379.847608][T18028] bridge_slave_0: entered promiscuous mode [ 1379.866837][T18028] bridge0: port 2(bridge_slave_1) entered blocking state [ 1379.867051][T18028] bridge0: port 2(bridge_slave_1) entered disabled state [ 1379.867210][T18028] bridge_slave_1: entered allmulticast mode [ 1379.870054][T18028] bridge_slave_1: entered promiscuous mode [ 1380.300550][T18028] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1380.383235][T18028] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1380.454445][ T5808] Bluetooth: hci3: command tx timeout [ 1381.262486][T10215] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 1381.270068][T18028] team0: Port device team_slave_0 added [ 1381.273236][T18028] team0: Port device team_slave_1 added [ 1381.412992][T10215] usb 4-1: Using ep0 maxpacket: 32 [ 1381.430577][T10215] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1381.435614][T10215] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 32 [ 1381.436710][T10215] usb 4-1: language id specifier not provided by device, defaulting to English [ 1381.447270][T10215] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1381.447299][T10215] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1381.447320][T10215] usb 4-1: Product: syz [ 1381.447334][T10215] usb 4-1: SerialNumber: syz [ 1381.662854][T18028] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1381.662871][T18028] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1381.662896][T18028] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1381.673121][T18028] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1381.673138][T18028] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1381.673165][T18028] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1382.421896][T18028] hsr_slave_0: entered promiscuous mode [ 1382.445061][T18028] hsr_slave_1: entered promiscuous mode [ 1382.446302][T18028] debugfs: 'hsr0' already exists in 'hsr' [ 1382.446323][T18028] Cannot create hsr debugfs directory [ 1382.538184][ T5808] Bluetooth: hci3: command tx timeout [ 1384.612497][ T5808] Bluetooth: hci3: command tx timeout [ 1385.557929][T18028] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1385.573039][T16313] usb 1-1: new high-speed USB device number 69 using dummy_hcd [ 1385.722435][T16313] usb 1-1: Using ep0 maxpacket: 32 [ 1385.725066][T16313] usb 1-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 1385.725100][T16313] usb 1-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 1385.725115][T16313] usb 1-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1385.725130][T16313] usb 1-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 1385.839530][T16313] usb 1-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 1385.841705][T16313] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1385.845545][T16313] usb 1-1: Product: syz [ 1385.845561][T16313] usb 1-1: Manufacturer: syz [ 1385.845573][T16313] usb 1-1: SerialNumber: syz [ 1385.923673][ C0] imon 1-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 1385.929578][T16313] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:155.0/input/input59 [ 1386.142424][T16313] imon 1-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 1386.142444][T16313] (id 0x00) [ 1386.274647][T16313] rc_core: IR keymap rc-imon-pad not found [ 1386.274669][T16313] Registered IR keymap rc-empty [ 1386.275731][T16313] imon 1-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 1386.275788][T16313] imon 1-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 1386.348195][T16313] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:155.0/rc/rc0 [ 1386.391126][T16313] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:155.0/rc/rc0/input60 [ 1386.423814][T16313] imon 1-1:155.0: iMON device (15c2:ffdc, intf0) on usb<1:69> initialized [ 1386.511826][T18117] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3204'. [ 1386.535770][T10215] cdc_ncm 4-1:1.0: bind() failure [ 1386.540380][T10215] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 1386.540408][T10215] cdc_ncm 4-1:1.1: bind() failure [ 1386.543204][T17723] usb 1-1: USB disconnect, device number 69 [ 1386.574568][T18028] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1386.677608][T18114] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3204'. [ 1387.025037][T18028] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1387.276872][T17723] usb 4-1: USB disconnect, device number 58 [ 1388.378006][T18028] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1389.218910][T18131] loop9: detected capacity change from 0 to 7 [ 1389.224729][T18131] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 1389.224835][T18131] loop9: partition table partially beyond EOD, truncated [ 1389.225119][T18131] loop9: p1 size 2437361653 extends beyond EOD, truncated [ 1389.873852][T17444] udevd[17444]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 1390.857802][T18028] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1390.991997][T18028] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1391.138779][T18028] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1391.226879][T18028] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1391.629339][T18161] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3214'. [ 1392.850102][T18028] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1392.958473][T18028] 8021q: adding VLAN 0 to HW filter on device team0 [ 1392.989791][T11205] bridge0: port 1(bridge_slave_0) entered blocking state [ 1392.989945][T11205] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1393.039021][T17204] bridge0: port 2(bridge_slave_1) entered blocking state [ 1393.039265][T17204] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1394.573045][T18028] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1394.798592][T18028] veth0_vlan: entered promiscuous mode [ 1394.847266][T18028] veth1_vlan: entered promiscuous mode [ 1395.946102][T18028] veth0_macvtap: entered promiscuous mode [ 1396.094587][T18028] veth1_macvtap: entered promiscuous mode [ 1396.207548][T18028] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1396.313694][T18028] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1396.636094][T18098] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1396.672293][T18098] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1396.673993][T13245] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1397.485076][T10215] usb 1-1: new high-speed USB device number 70 using dummy_hcd [ 1397.527022][T13245] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1397.797239][T10215] usb 1-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c [ 1397.797269][T10215] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1397.868340][T10215] usb 1-1: config 0 descriptor?? [ 1398.571618][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1398.571633][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1399.134900][T11205] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1399.134916][T11205] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1400.053990][T10215] pegasus 1-1:0.0: probe with driver pegasus failed with error -110 [ 1400.626232][T18236] loop9: detected capacity change from 0 to 7 [ 1401.729371][T18236] loop9: [CUMANA/ADFS] p1 [ADFS] p1 [ 1401.729487][T18236] loop9: partition table partially beyond EOD, truncated [ 1403.161368][ T5786] usb 1-1: USB disconnect, device number 70 [ 1403.403560][T18236] loop9: p1 size 2437361653 extends beyond EOD, truncated [ 1403.466122][ T5805] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1403.485118][ T5805] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1403.489282][ T5805] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1403.512148][ T5805] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1403.519931][ T5805] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1404.018108][T18202] udevd[18202]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 1405.193745][T18289] comedi comedi3: 8255: I/O port conflict (0x7,4) [ 1405.193782][T18289] comedi comedi3: 8255: I/O port conflict (0x4,4) [ 1405.255246][T18258] chnl_net:caif_netlink_parms(): no params data found [ 1405.733457][ T5808] Bluetooth: hci5: command tx timeout [ 1408.058583][ T5808] Bluetooth: hci5: command tx timeout [ 1408.186459][T18258] bridge0: port 1(bridge_slave_0) entered blocking state [ 1408.200432][T18258] bridge0: port 1(bridge_slave_0) entered disabled state [ 1408.200718][T18258] bridge_slave_0: entered allmulticast mode [ 1408.244490][T18258] bridge_slave_0: entered promiscuous mode [ 1408.280544][T18258] bridge0: port 2(bridge_slave_1) entered blocking state [ 1408.280625][T18258] bridge0: port 2(bridge_slave_1) entered disabled state [ 1408.299386][T18258] bridge_slave_1: entered allmulticast mode [ 1408.312399][T18311] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3252'. [ 1408.346384][T18301] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 1408.346478][T18301] block device autoloading is deprecated and will be removed. [ 1408.356045][T18258] bridge_slave_1: entered promiscuous mode [ 1409.246379][T18258] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1409.249029][T18258] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1410.136058][ T5808] Bluetooth: hci5: command tx timeout [ 1410.731922][ T37] audit: type=1326 audit(1763000789.858:1100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=18334 comm="syz.0.3259" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4d896ff6c9 code=0x7ffc0000 [ 1410.741058][ T37] audit: type=1326 audit(1763000789.858:1101): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=18334 comm="syz.0.3259" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4d896ff6c9 code=0x7ffc0000 [ 1410.785985][ T37] audit: type=1326 audit(1763000789.918:1102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=18334 comm="syz.0.3259" exe="/root/syz-executor" sig=0 arch=c000003e syscall=13 compat=0 ip=0x7f4d896ff6c9 code=0x7ffc0000 [ 1410.792641][ T37] audit: type=1326 audit(1763000789.918:1103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=18334 comm="syz.0.3259" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4d896ff6c9 code=0x7ffc0000 [ 1410.792912][ T37] audit: type=1326 audit(1763000789.928:1104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=18334 comm="syz.0.3259" exe="/root/syz-executor" sig=0 arch=c000003e syscall=7 compat=0 ip=0x7f4d896ff6c9 code=0x7ffc0000 [ 1410.800458][ T37] audit: type=1326 audit(1763000789.928:1105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=18334 comm="syz.0.3259" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4d896ff6c9 code=0x7ffc0000 [ 1410.800926][ T37] audit: type=1326 audit(1763000789.928:1106): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=18334 comm="syz.0.3259" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4d896ff6c9 code=0x7ffc0000 [ 1410.803077][ T37] audit: type=1326 audit(1763000789.928:1107): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=18334 comm="syz.0.3259" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f4d896ff6c9 code=0x7ffc0000 [ 1410.803659][ T37] audit: type=1326 audit(1763000789.938:1108): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=18334 comm="syz.0.3259" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4d896ff6c9 code=0x7ffc0000 [ 1410.804234][ T37] audit: type=1326 audit(1763000789.938:1109): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=18334 comm="syz.0.3259" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4d896ff6c9 code=0x7ffc0000 [ 1411.166222][T18258] team0: Port device team_slave_0 added [ 1411.171630][T18258] team0: Port device team_slave_1 added [ 1412.274691][ T5808] Bluetooth: hci5: command tx timeout [ 1412.900995][T18258] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1412.901105][T18258] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1412.901164][T18258] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1413.105627][T18258] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1413.105639][T18258] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1413.105653][T18258] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1413.225611][T18350] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3262'. [ 1413.225642][T18350] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3262'. [ 1414.691755][T18362] pim6reg: entered allmulticast mode [ 1414.711509][T18258] hsr_slave_0: entered promiscuous mode [ 1414.720460][T18258] hsr_slave_1: entered promiscuous mode [ 1414.728461][T18258] debugfs: 'hsr0' already exists in 'hsr' [ 1414.728488][T18258] Cannot create hsr debugfs directory [ 1418.729835][T18258] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1420.135604][ T5805] Bluetooth: hci4: command 0x0406 tx timeout [ 1420.239147][T18258] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1420.448484][T18419] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3281'. [ 1421.868757][T18258] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1422.312384][T10215] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 1423.187807][ T1319] ieee802154 phy0 wpan0: encryption failed: -22 [ 1423.187880][ T1319] ieee802154 phy1 wpan1: encryption failed: -22 [ 1423.362378][T10215] usb 4-1: Using ep0 maxpacket: 8 [ 1423.364748][T10215] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1423.364783][T10215] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1423.364810][T10215] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1423.364835][T10215] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1423.364879][T10215] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1423.364903][T10215] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1424.111013][T10215] usb 4-1: GET_CAPABILITIES returned 0 [ 1424.111060][T10215] usbtmc 4-1:16.0: can't read capabilities [ 1424.127848][T18258] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1424.679747][T11018] usb 4-1: USB disconnect, device number 59 [ 1426.993886][T18471] Bluetooth: received HCILL_WAKE_UP_IND in state 2 [ 1427.402473][ T13] Bluetooth: hci2: Frame reassembly failed (-84) [ 1427.722633][ T5887] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 1427.945182][ T5887] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 1427.945206][ T5887] usb 5-1: config 0 has no interface number 0 [ 1427.949695][ T5887] usb 5-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 1427.949713][ T5887] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1427.949724][ T5887] usb 5-1: Product: syz [ 1427.949732][ T5887] usb 5-1: Manufacturer: syz [ 1427.949739][ T5887] usb 5-1: SerialNumber: syz [ 1427.959897][ T5887] usb 5-1: config 0 descriptor?? [ 1429.122512][ T5887] usb 5-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 1429.190679][ T5887] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1429.191321][ T5887] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 1429.191372][ T5887] usb 5-1: media controller created [ 1429.361947][ T5887] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1429.423402][ T5805] Bluetooth: hci2: command 0x1003 tx timeout [ 1429.423570][ T5808] Bluetooth: hci2: Opcode 0x1003 failed: -110 [ 1429.652790][ T5887] i2c i2c-1: ec100: i2c rd failed=-71 reg=33 [ 1429.850457][ T5887] usb 5-1: USB disconnect, device number 79 [ 1431.981562][T18258] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1432.018623][T18258] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1432.108695][T18258] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1432.193396][T18258] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1432.604713][T18258] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1433.975562][T18258] 8021q: adding VLAN 0 to HW filter on device team0 [ 1434.092808][ T1409] bridge0: port 1(bridge_slave_0) entered blocking state [ 1434.092957][ T1409] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1434.110326][ T1409] bridge0: port 2(bridge_slave_1) entered blocking state [ 1434.110463][ T1409] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1434.482436][ T992] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 1434.660458][ T992] usb 3-1: config index 0 descriptor too short (expected 28277, got 36) [ 1434.660476][ T992] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1434.660487][ T992] usb 3-1: config 0 has no interfaces? [ 1434.660504][ T992] usb 3-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 1434.660517][ T992] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1434.665990][ T992] usb 3-1: config 0 descriptor?? [ 1435.300087][ T5808] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 1435.300281][ T5808] Bluetooth: hci0: Injecting HCI hardware error event [ 1435.307178][ T5805] Bluetooth: hci0: hardware error 0x00 [ 1436.240819][T18258] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1436.443020][T10215] usb 3-1: USB disconnect, device number 67 [ 1436.464260][T18258] veth0_vlan: entered promiscuous mode [ 1436.596526][T18258] veth1_vlan: entered promiscuous mode [ 1436.797490][T18258] veth0_macvtap: entered promiscuous mode [ 1436.831635][T18258] veth1_macvtap: entered promiscuous mode [ 1436.896645][T18258] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1436.953626][T18258] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1436.988776][ T1409] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1436.990026][ T1409] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1436.991426][ T1409] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1436.991644][ T1409] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1437.894047][ T5805] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 1438.297481][ T7948] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1438.297502][ T7948] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1438.385943][T18556] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3313'. [ 1438.606913][ T1396] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1438.606934][ T1396] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1440.731841][T18575] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1440.945778][T18570] can: request_module (can-proto-3) failed. [ 1441.504705][T18583] Device name cannot be null; rc = [-22] [ 1442.706896][T18597] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1445.966922][ T5873] IPVS: starting estimator thread 0... [ 1446.052472][T18621] IPVS: using max 7 ests per chain, 16800 per kthread [ 1447.572485][ T5805] Bluetooth: hci2: Opcode 0x1003 failed: -110 [ 1447.665508][ T5805] Bluetooth: hci5: command 0x0405 tx timeout [ 1453.232400][ T992] usb 2-1: new high-speed USB device number 60 using dummy_hcd [ 1453.385067][ T992] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1453.385098][ T992] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1453.385116][ T992] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1453.385166][ T992] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1453.385192][ T992] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1453.387488][ T992] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1453.387517][ T992] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1453.387538][ T992] usb 2-1: Product: syz [ 1453.387552][ T992] usb 2-1: Manufacturer: syz [ 1453.843159][ T992] cdc_wdm 2-1:1.0: skipping garbage [ 1453.843180][ T992] cdc_wdm 2-1:1.0: skipping garbage [ 1453.847060][ T992] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 1453.847095][ T992] cdc_wdm 2-1:1.0: Unknown control protocol [ 1456.553547][ T10] usb 2-1: USB disconnect, device number 60 [ 1460.077899][ C0] vkms_vblank_simulate: vblank timer overrun [ 1460.103958][ C0] vkms_vblank_simulate: vblank timer overrun [ 1460.320056][ C0] vkms_vblank_simulate: vblank timer overrun [ 1460.611050][T18721] netlink: 1260 bytes leftover after parsing attributes in process `syz.3.3361'. [ 1462.480027][ C0] vkms_vblank_simulate: vblank timer overrun [ 1462.650008][ C0] vkms_vblank_simulate: vblank timer overrun [ 1463.043728][ T37] kauditd_printk_skb: 17 callbacks suppressed [ 1463.043779][ T37] audit: type=1804 audit(1763000842.168:1127): pid=18739 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.3.3364" name="/newroot/67/file0" dev="tmpfs" ino=363 res=1 errno=0 [ 1463.217938][T18739] ref_ctr increment failed for inode: 0x16b offset: 0x5 ref_ctr_offset: 0x2 of mm: 0xffff888028501700 [ 1463.635703][ C0] vkms_vblank_simulate: vblank timer overrun [ 1463.734489][ C0] vkms_vblank_simulate: vblank timer overrun [ 1463.951717][ C0] vkms_vblank_simulate: vblank timer overrun [ 1464.460137][ C0] vkms_vblank_simulate: vblank timer overrun [ 1464.518126][T18740] uprobe: syz.3.3364:18740 failed to unregister, leaking uprobe [ 1464.941286][ C0] vkms_vblank_simulate: vblank timer overrun [ 1467.006802][T18769] netlink: 'syz.3.3374': attribute type 10 has an invalid length. [ 1467.208955][T18769] team0: Failed to send port change of device netdevsim0 via netlink (err -105) [ 1467.209125][T18769] team0: Failed to send options change via netlink (err -105) [ 1467.209134][T18769] team0: Port device netdevsim0 added [ 1473.642483][T18857] capability: warning: `syz.1.3387' uses 32-bit capabilities (legacy support in use) [ 1473.733009][ T38] INFO: task kworker/u8:3:58 blocked for more than 143 seconds. [ 1473.733092][ T38] Not tainted syzkaller #0 [ 1473.733103][ T38] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1473.733165][ T38] task:kworker/u8:3 state:D stack:20520 pid:58 tgid:58 ppid:2 task_flags:0x4208160 flags:0x00080000 [ 1473.733369][ T38] Workqueue: netns cleanup_net SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1473.733441][ T38] Call Trace: [ 1473.733452][ T38] [ 1473.733466][ T38] __schedule+0x16f3/0x4c20 [ 1473.733579][ T38] ? __pfx___schedule+0x10/0x10 [ 1473.733694][ T38] ? schedule+0x91/0x360 [ 1473.733766][ T38] schedule+0x165/0x360 [ 1473.733851][ T38] rxrpc_destroy_all_calls+0x564/0x660 [ 1473.733889][ T38] ? __pfx_rxrpc_destroy_all_calls+0x10/0x10 [ 1473.733920][ T38] ? __pfx_var_wake_function+0x10/0x10 [ 1473.733984][ T38] ? rxrpc_net+0x23/0x240 [ 1473.734043][ T38] rxrpc_exit_net+0x6f/0xc0 [ 1473.734336][ T38] ops_undo_list+0x49a/0x990 [ 1473.734457][ T38] ? __pfx_ops_undo_list+0x10/0x10 [ 1473.734527][ T38] ? rt_spin_unlock+0x150/0x200 [ 1473.734593][ T38] ? rt_spin_unlock+0x161/0x200 [ 1473.734649][ T38] cleanup_net+0x4de/0x820 [ 1473.734746][ T38] ? __pfx_cleanup_net+0x10/0x10 [ 1473.734771][ T38] ? _raw_spin_unlock_irq+0x23/0x50 [ 1473.734795][ T38] ? process_scheduled_works+0x9ef/0x17b0 [ 1473.734818][ T38] ? process_scheduled_works+0x9ef/0x17b0 [ 1473.734885][ T38] process_scheduled_works+0xae1/0x17b0 [ 1473.735062][ T38] ? __pfx_process_scheduled_works+0x10/0x10 [ 1473.735185][ T38] worker_thread+0x8a0/0xda0 [ 1473.735323][ T38] kthread+0x711/0x8a0 [ 1473.735393][ T38] ? __pfx_worker_thread+0x10/0x10 [ 1473.735457][ T38] ? __pfx_kthread+0x10/0x10 [ 1473.735611][ T38] ? rt_spin_unlock+0x150/0x200 [ 1473.735676][ T38] ? rt_spin_unlock+0x161/0x200 [ 1473.735696][ T38] ? __pfx_kthread+0x10/0x10 [ 1473.735759][ T38] ret_from_fork+0x4bc/0x870 [ 1473.735829][ T38] ? __pfx_ret_from_fork+0x10/0x10 [ 1473.735862][ T38] ? __switch_to_asm+0x39/0x70 [ 1473.736045][ T38] ? __switch_to_asm+0x33/0x70 [ 1473.736103][ T38] ? __pfx_kthread+0x10/0x10 [ 1473.736131][ T38] ret_from_fork_asm+0x1a/0x30 [ 1473.736248][ T38] [ 1473.736949][ T38] [ 1473.736949][ T38] Showing all locks held in the system: [ 1473.736962][ T38] 4 locks held by kworker/u8:1/13: [ 1473.737014][ T38] #0: ffff88813ff69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 1473.737138][ T38] #1: ffffc90000127ba0 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 1473.737240][ T38] #2: ffff888055f708b8 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xc4/0x470 [ 1473.737332][ T38] #3: ffff8880b883faa8 (&s->lock_key#8){+.+.}-{3:3}, at: ___slab_alloc+0x12f/0x1400 [ 1473.737457][ T38] 4 locks held by rcuc/1/28: [ 1473.737469][ T38] 1 lock held by khungtaskd/38: [ 1473.737518][ T38] #0: ffffffff8d5aa840 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 1473.737640][ T38] 3 locks held by kworker/u8:3/58: [ 1473.737651][ T38] #0: ffff888019ad4938 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 1473.737756][ T38] #1: ffffc9000124fba0 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 1473.737802][ T38] #2: ffffffff8e8564e0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf7/0x820 [ 1473.738065][ T38] 2 locks held by kworker/u8:4/69: [ 1473.738109][ T38] #0: ffff88801cb8f938 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 1473.738199][ T38] #1: ffffc9000153fba0 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 1473.738317][ T38] 5 locks held by kworker/1:1H/105: [ 1473.738336][ T38] 7 locks held by kworker/u8:8/1396: [ 1473.738385][ T38] 4 locks held by kworker/u8:10/1433: [ 1473.738396][ T38] 4 locks held by kworker/u8:11/1459: [ 1473.738443][ T38] #0: ffff88813ff69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 1473.738663][ T38] #1: ffffc90005767ba0 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 1473.747768][ T38] #2: ffff8880281a08b8 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xc4/0x470 [ 1473.747819][ T38] #3: ffff8880b883faa8 (&s->lock_key#8){+.+.}-{3:3}, at: ___slab_alloc+0x12f/0x1400 [ 1473.748109][ T38] 2 locks held by getty/5552: [ 1473.748156][ T38] #0: ffff88823bf400a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 1473.748253][ T38] #1: ffffc90003e832e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x444/0x1400 [ 1473.748440][ T38] 4 locks held by syz-executor/17238: [ 1473.748455][ T38] 2 locks held by syz-executor/18028: [ 1473.748506][ T38] #0: ffffffff8d6ca9a8 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 1473.748630][ T38] #1: ffff8880b883fbe8 (&s->lock_key#20){+.+.}-{3:3}, at: put_cpu_partial+0x9d/0x210 [ 1473.748729][ T38] 2 locks held by kworker/u8:13/18098: [ 1473.748741][ T38] #0: ffff88801cb8f938 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 1473.748876][ T38] #1: ffffc90005287ba0 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 1473.748927][ T38] 4 locks held by kworker/u8:15/18808: [ 1473.748939][ T38] 5 locks held by kworker/u8:16/18811: [ 1473.748951][ T38] 2 locks held by syz.0.3389/18858: [ 1473.748962][ T38] 4 locks held by syz.4.3388/18853: [ 1473.749012][ T38] [ 1473.749017][ T38] ============================================= [ 1473.749017][ T38] [ 1473.749057][ T38] NMI backtrace for cpu 0 [ 1473.749088][ T38] CPU: 0 UID: 0 PID: 38 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1473.749109][ T38] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1473.749121][ T38] Call Trace: [ 1473.749133][ T38] [ 1473.749142][ T38] dump_stack_lvl+0x189/0x250 [ 1473.749172][ T38] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1473.749198][ T38] ? __pfx__printk+0x10/0x10 [ 1473.749232][ T38] nmi_cpu_backtrace+0x39e/0x3d0 [ 1473.749257][ T38] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 1473.749280][ T38] ? __pfx__printk+0x10/0x10 [ 1473.749307][ T38] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1473.749328][ T38] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 1473.749350][ T38] watchdog+0xf60/0xfa0 [ 1473.749379][ T38] ? watchdog+0x1e2/0xfa0 [ 1473.749407][ T38] kthread+0x711/0x8a0 [ 1473.749435][ T38] ? __pfx_watchdog+0x10/0x10 [ 1473.749455][ T38] ? __pfx_kthread+0x10/0x10 [ 1473.749476][ T38] ? rt_spin_unlock+0x150/0x200 [ 1473.749499][ T38] ? rt_spin_unlock+0x161/0x200 [ 1473.749517][ T38] ? __pfx_kthread+0x10/0x10 [ 1473.749543][ T38] ret_from_fork+0x4bc/0x870 [ 1473.749575][ T38] ? __pfx_ret_from_fork+0x10/0x10 [ 1473.749604][ T38] ? __switch_to_asm+0x39/0x70 [ 1473.749621][ T38] ? __switch_to_asm+0x33/0x70 [ 1473.749638][ T38] ? __pfx_kthread+0x10/0x10 [ 1473.749663][ T38] ret_from_fork_asm+0x1a/0x30 [ 1473.749698][ T38] [ 1473.749722][ T38] Sending NMI from CPU 0 to CPUs 1: [ 1473.749745][ C1] NMI backtrace for cpu 1 [ 1473.749765][ C1] CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1473.749784][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1473.749793][ C1] RIP: 0010:lock_is_held_type+0xd6/0x190 [ 1473.749823][ C1] Code: 49 ff c7 49 63 85 58 0b 00 00 48 83 c3 28 49 39 c7 7c d8 eb 11 48 c7 c7 70 ae 47 8d 4c 89 fe e8 70 53 f1 f9 eb cb 31 db eb 1c <83> fd ff 74 12 31 c0 f6 43 22 03 0f 95 c0 31 db 39 c5 0f 94 c3 eb [ 1473.749837][ C1] RSP: 0018:ffffc90000a3f4c0 EFLAGS: 00000002 [ 1473.749852][ C1] RAX: 0000000000000001 RBX: ffff88801beaa988 RCX: 2d1c723048217100 [ 1473.749864][ C1] RDX: 0000000000000100 RSI: ffffffff8d5aa840 RDI: ffff88801beaa988 [ 1473.749876][ C1] RBP: 00000000ffffffff R08: 0000000000000000 R09: 0000000000000100 [ 1473.749887][ C1] R10: dffffc0000000000 R11: ffffffff8643a130 R12: 0000000000000246 [ 1473.749899][ C1] R13: ffff88801bea9e00 R14: ffffffff8d5aa840 R15: 0000000000000001 [ 1473.749910][ C1] FS: 0000000000000000(0000) GS:ffff888126ef7000(0000) knlGS:0000000000000000 [ 1473.749925][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1473.749936][ C1] CR2: 0000200000001000 CR3: 00000000532d4000 CR4: 00000000003526f0 [ 1473.749951][ C1] DR0: 000000000000004b DR1: 0000000000000000 DR2: 0000000000000000 [ 1473.749961][ C1] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1473.749972][ C1] Call Trace: [ 1473.749978][ C1] [ 1473.749987][ C1] mac80211_hwsim_addr_iter+0x8a/0x1b0 [ 1473.750011][ C1] __iterate_interfaces+0x2ab/0x590 [ 1473.750027][ C1] ? __pfx_mac80211_hwsim_addr_iter+0x10/0x10 [ 1473.750047][ C1] ? ieee80211_iterate_active_interfaces_atomic+0x2a/0x180 [ 1473.750064][ C1] ? __pfx_mac80211_hwsim_addr_iter+0x10/0x10 [ 1473.750085][ C1] ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 [ 1473.750103][ C1] mac80211_hwsim_addr_match+0x118/0x180 [ 1473.750123][ C1] ? __pfx_mac80211_hwsim_addr_match+0x10/0x10 [ 1473.750148][ C1] mac80211_hwsim_tx_frame_no_nl+0xcf3/0x11c0 [ 1473.750173][ C1] ? ktime_get_with_offset+0x93/0x2a0 [ 1473.750192][ C1] ? __pfx_mac80211_hwsim_tx_frame_no_nl+0x10/0x10 [ 1473.750219][ C1] ? mac80211_hwsim_monitor_rx+0x1a3/0x820 [ 1473.750241][ C1] mac80211_hwsim_tx_frame+0x1b5/0x200 [ 1473.750264][ C1] mac80211_hwsim_beacon_tx+0x3f0/0x860 [ 1473.750286][ C1] ? ieee80211_iterate_active_interfaces_atomic+0x2a/0x180 [ 1473.750305][ C1] __iterate_interfaces+0x2ab/0x590 [ 1473.750320][ C1] ? __pfx_mac80211_hwsim_beacon_tx+0x10/0x10 [ 1473.750341][ C1] ? ieee80211_iterate_active_interfaces_atomic+0x2a/0x180 [ 1473.750358][ C1] ? __pfx_mac80211_hwsim_beacon_tx+0x10/0x10 [ 1473.750379][ C1] ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 [ 1473.750398][ C1] mac80211_hwsim_beacon+0xbb/0x180 [ 1473.750417][ C1] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 1473.750434][ C1] __hrtimer_run_queues+0x552/0xd40 [ 1473.750463][ C1] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 1473.750484][ C1] ? ktime_get_update_offsets_now+0x3b2/0x3d0 [ 1473.750507][ C1] hrtimer_run_softirq+0x1a3/0x2e0 [ 1473.750524][ C1] handle_softirqs+0x22f/0x710 [ 1473.750546][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 1473.750568][ C1] run_ktimerd+0xcf/0x190 [ 1473.750587][ C1] ? __pfx_run_ktimerd+0x10/0x10 [ 1473.750605][ C1] ? schedule+0x91/0x360 [ 1473.750627][ C1] ? smpboot_thread_fn+0x4d/0xa60 [ 1473.750644][ C1] smpboot_thread_fn+0x542/0xa60 [ 1473.750663][ C1] ? smpboot_thread_fn+0x4d/0xa60 [ 1473.750692][ C1] kthread+0x711/0x8a0 [ 1473.750713][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 1473.750731][ C1] ? __pfx_kthread+0x10/0x10 [ 1473.750750][ C1] ? rt_spin_unlock+0x150/0x200 [ 1473.750769][ C1] ? rt_spin_unlock+0x161/0x200 [ 1473.750784][ C1] ? __pfx_kthread+0x10/0x10 [ 1473.750805][ C1] ret_from_fork+0x4bc/0x870 [ 1473.750828][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 1473.750849][ C1] ? __switch_to_asm+0x39/0x70 [ 1473.750864][ C1] ? __switch_to_asm+0x33/0x70 [ 1473.750879][ C1] ? __pfx_kthread+0x10/0x10 [ 1473.750900][ C1] ret_from_fork_asm+0x1a/0x30 [ 1473.750922][ C1]