last executing test programs: 9m29.697803889s ago: executing program 2 (id=2204): socket$netlink(0x10, 0x3, 0xc) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="540000000206010200000000000000000500000005000100060000000d000300686173683a6e6574000000000900020073797a31000000000c00078008000640000000400500050002000000050004"], 0x54}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10040047}, 0x240008c4) 9m17.558484158s ago: executing program 2 (id=2248): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000080)={{}, 0x0, 0x0}, 0x20) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sendmsg$IPSET_CMD_SWAP(0xffffffffffffffff, 0x0, 0x400c841) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) fcntl$notify(r3, 0x402, 0x8000001c) r4 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) fcntl$notify(r4, 0x402, 0x1a) r5 = open(&(0x7f0000000100)='./file1\x00', 0x141242, 0x1b4) write$tcp_mem(r5, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'lo\x00'}) r6 = syz_open_dev$evdev(&(0x7f0000000000), 0x2, 0x0) ioctl$EVIOCGPHYS(r6, 0x80404507, &(0x7f0000000040)) socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'bridge0\x00'}) socket$inet(0x2, 0x2, 0x1) 9m14.055098427s ago: executing program 2 (id=2261): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4050000000000007911c00000000000850000009000000095000000f8000000"], &(0x7f00000002c0)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x94) syz_open_dev$ttys(0xc, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) bind$packet(r1, &(0x7f0000000180)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @multicast}, 0x14) getsockname$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000700)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="38000000540001000000000000c400000700", @ANYRES32=r3, @ANYBLOB="20000100", @ANYRES32=r4, @ANYBLOB="00000000e000030000000000000000000000000008"], 0x38}}, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 9m13.491656294s ago: executing program 2 (id=2264): r0 = socket$inet6(0xa, 0x3, 0x8000000003c) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) move_mount(r2, 0x0, r1, 0x0, 0x46) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @empty, 0xc7ec}, 0x1c) r3 = socket$igmp6(0xa, 0x3, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) prctl$PR_SET_SECCOMP(0x41, 0x1, 0x0) r5 = dup(r4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r5, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x9511, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0xffd8}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) 9m12.967131495s ago: executing program 2 (id=2267): unshare(0x2c020400) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) 9m12.704261055s ago: executing program 2 (id=2269): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) bind$inet6(r0, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x3, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000080)='cubic\x00', 0x6) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x2}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0x400000}}}}]}, 0x4c}}, 0x0) shutdown(r0, 0x2) 9m12.107849555s ago: executing program 32 (id=2269): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) bind$inet6(r0, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x3, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000080)='cubic\x00', 0x6) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x2}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0x400000}}}}]}, 0x4c}}, 0x0) shutdown(r0, 0x2) 8m34.904009593s ago: executing program 4 (id=2406): prlimit64(0x0, 0xe, 0x0, 0x0) syz_open_dev$sndmidi(0x0, 0x2, 0x141102) socketpair$unix(0x1, 0x5, 0x0, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, 0x0, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000300)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='batadv_slave_1\x00', 0x10) r3 = socket$inet(0x2, 0x801, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r3, 0x0, 0xffffffffffffffb5, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) 8m34.762098359s ago: executing program 4 (id=2407): r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x0, 0x0}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, 0x0) r3 = syz_io_uring_setup(0x235, &(0x7f0000000380)={0x0, 0xf691, 0x10100, 0x3, 0x2b4}, &(0x7f0000000200)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r4, r5, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r3, 0x708, 0x41e3, 0x0, 0x0, 0x0) r6 = userfaultfd(0x801) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000440)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x0, &(0x7f0000000100), 0xc06620, 0x4) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) 8m33.462794864s ago: executing program 4 (id=2413): unshare(0x22020400) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0xfff0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet(r0, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000140)=0x1, 0x4) sendmmsg$inet(r0, &(0x7f0000003800)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000002440)="bb", 0x1}], 0x1}}], 0x1, 0x4004441) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x7, 0x4, 0x6, 0xfffa}, 0x2b, [0x8000, 0xc95a, 0xffffdff3, 0x1, 0x80, 0x6, 0x3, 0x7f, 0x6, 0x4d, 0x39cc191a, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x3, 0x800, 0x5, 0x4, 0x7, 0x4, 0x3c5b, 0x1, 0x24, 0x9, 0x1, 0x1f461e2c, 0x2, 0xe661, 0x4, 0x7, 0x3, 0x7fff, 0x4c74, 0x80000000, 0x242, 0xc, 0xe, 0x0, 0x71, 0x7, 0x7, 0x3, 0x2, 0x8005, 0x3f, 0x8f, 0x6, 0x6, 0x0, 0x5, 0x4, 0x3, 0x0, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0xffff, 0x12f, 0x8000, 0x10, 0xfffffff3, 0x129432e6, 0xcb, 0xf9, 0xd, 0x2bf, 0x6c9, 0x9, 0xfffffffc, 0x3, 0x0, 0x7, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x9, 0x3, 0x3, 0x8000, 0x9, 0x400, 0x401, 0x6, 0x1, 0x8, 0x5, 0x10005, 0x5f31, 0x4, 0x0, 0x2, 0x2, 0x9, 0x4, 0x9, 0x8, 0x9, 0x6, 0x7, 0x28, 0x1, 0xfe000000, 0xffff, 0x2, 0x7, 0x9, 0x3ff, 0x3, 0x9, 0x1, 0x7, 0x3, 0x9, 0x48c93690, 0x12000000, 0x2], [0x100007, 0x4, 0x7, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0x2, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x8, 0x8, 0x86, 0x10000003, 0x1000, 0x3e7, 0x9, 0x5, 0x2, 0x2, 0x5, 0x8, 0x4, 0x6d01, 0x5, 0x38, 0x800003, 0x200, 0x80, 0x83, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0x53cf697b, 0x5, 0x6, 0x2ac8, 0xbf, 0x2, 0x3, 0x7ff, 0xfffffff9, 0x0, 0x1, 0xffff, 0x0, 0x4, 0x1c, 0x120000, 0x3, 0x6, 0xaaed, 0x4, 0x25], [0x9, 0x6, 0x3, 0xb, 0x5, 0x934, 0x6, 0xa, 0x0, 0xbdfe, 0xce7, 0x1ff, 0xfffffffe, 0x7, 0x5, 0x3, 0x101, 0x10000, 0x6, 0x8003, 0xffff, 0x81, 0xff, 0x5, 0x1, 0xfffffffe, 0x14c, 0x60a7, 0xa71d, 0x6, 0xffffffff, 0x80000000, 0x5, 0x8, 0xc8, 0xee1, 0xfffff000, 0xffff, 0x3, 0x7f, 0x3ff, 0x9602, 0x2, 0x2, 0x7, 0x6, 0x1, 0x10080, 0x5, 0x8, 0x30b1d693, 0xa23, 0xc, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0x2, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 8m33.287493872s ago: executing program 4 (id=2415): mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r0 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000000)=0x1, 0x4) 8m32.849776072s ago: executing program 4 (id=2416): bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x0, @local, 0x20000040}, 0x1c) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e24, 0x1, @private0={0xfc, 0x0, '\x00', 0x1}, 0xb}, 0x1c) 8m32.356206409s ago: executing program 4 (id=2418): socket$netlink(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="540000000206010200000000000000000500000005000100060000000d000300686173683a6e6574000000000900020073797a31000000000c00078008000640000000400500050002000000050004"], 0x54}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10040047}, 0x240008c4) 8m17.178724987s ago: executing program 33 (id=2418): socket$netlink(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="540000000206010200000000000000000500000005000100060000000d000300686173683a6e6574000000000900020073797a31000000000c00078008000640000000400500050002000000050004"], 0x54}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10040047}, 0x240008c4) 11.823707929s ago: executing program 5 (id=4257): madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) 11.595918951s ago: executing program 5 (id=4258): socket$key(0xf, 0x3, 0x2) socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0x3, 0x0, 0x0, 0x1, 0x7}, 0x4000080) write$sequencer(0xffffffffffffffff, &(0x7f0000000400)=ANY=[], 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x40}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0xfffffffffffffc33, &(0x7f0000000280)=0x2) ptrace(0x10, 0x1) r2 = inotify_init1(0x0) inotify_add_watch(r2, &(0x7f0000000200)='.\x00', 0x400) inotify_add_watch(r2, &(0x7f0000000280)='.\x00', 0x850003f3) shmget$private(0x0, 0x4000, 0x0, &(0x7f0000ffa000/0x4000)=nil) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000000)={0x0, 0x80000, 0xffffffffffffffff}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r4, 0xc01864c6, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}) r6 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r6, 0xc04064a0, &(0x7f0000000040)={0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0xfffffd52, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR2(r5, 0xc02464bb, &(0x7f0000000040)={0x3, r7, 0x5, 0x6576, 0x8, 0xff, 0x6, 0x67, 0x10001}) ioctl$DRM_IOCTL_MODE_SETGAMMA(r3, 0xc02064a5, &(0x7f00000001c0)={r7, 0x1, &(0x7f0000000080)=[0x100], 0x0, &(0x7f0000000180)=[0x7, 0x6, 0x5]}) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) 9.294759131s ago: executing program 5 (id=4273): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000002c0), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd8073a46b08b94214d816f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb4147000001000000008f2b9000f22425e4097ed62cbc891061017cfa6f6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835"], 0x0, 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB='\x00'/10, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000014000000000004040000000000000000"], 0x50) close(r2) r3 = userfaultfd(0x80001) mkdir(&(0x7f0000000340)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, 0x0, 0x0) r5 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet6(r5, &(0x7f0000001600)=[{{&(0x7f0000000080)={0xa, 0x4e22, 0x9, @mcast2, 0x80000000}, 0x1c, 0x0, 0x0, &(0x7f0000000280)=[@rthdr={{0x28, 0x29, 0x39, {0x2c, 0x2, 0x2, 0x1, 0x0, [@private2]}}}], 0x28}}], 0x1, 0x20000000) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\b\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYBLOB="01000000040000000200"/21], 0x50) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000140)) r6 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000000)='source', &(0x7f00000000c0)='c::=/\x10\xcd\xb7@\x88\xedP9\xf5,\xef\x87\xc9G\xeb\xd9\xf9\xcd\xb1\xac!\xa7\x9c\x8f\xc98\xcb-\t\xcf-\xdd\xc4\xafK\x8d\xb1R8m\xc1[A\x99g\x9d\x8a\"\x98:\xc1I<\xdf;\x11t\xd3\xd2\x19\x964\xff\x03\xbc\x7fo\xe8\x89\x01:\x8b-\xab[X\x10\x18\x8d\xbf\xe1\x88\x16', 0x0) close(r6) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r7, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x6, 0x400, 0x0, 0x30}, 0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r7, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x8a}, 0x9c) bind$inet6(r7, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r7, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) mlockall(0x7) shutdown(r7, 0x2) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) socket$xdp(0x2c, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x12) 8.291555271s ago: executing program 3 (id=4283): socket$key(0xf, 0x3, 0x2) socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0x3, 0x0, 0x0, 0x1, 0x7}, 0x4000080) write$sequencer(0xffffffffffffffff, &(0x7f0000000400)=ANY=[], 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x40}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0xfffffffffffffc33, &(0x7f0000000280)=0x2) ptrace(0x10, 0x1) r2 = inotify_init1(0x0) inotify_add_watch(r2, &(0x7f0000000200)='.\x00', 0x400) inotify_add_watch(r2, &(0x7f0000000280)='.\x00', 0x850003f3) shmget$private(0x0, 0x4000, 0x0, &(0x7f0000ffa000/0x4000)=nil) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000000)={0x0, 0x80000, 0xffffffffffffffff}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r4, 0xc01864c6, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}) r6 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r6, 0xc04064a0, &(0x7f0000000040)={0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0xfffffd52, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR2(r5, 0xc02464bb, &(0x7f0000000040)={0x3, r7, 0x5, 0x6576, 0x8, 0xff, 0x6, 0x67, 0x10001}) ioctl$DRM_IOCTL_MODE_SETGAMMA(r3, 0xc02064a5, &(0x7f00000001c0)={r7, 0x1, &(0x7f0000000080)=[0x100], 0x0, &(0x7f0000000180)=[0x7, 0x6, 0x5]}) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) 8.19049347s ago: executing program 5 (id=4285): userfaultfd(0x80001) socket$nl_generic(0x10, 0x3, 0x10) socket$tipc(0x1e, 0x2, 0x0) r0 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000400), 0x20280, 0x0) ioctl$IMADDTIMER(r0, 0x80044940, 0x0) unshare(0x62040200) r1 = epoll_create(0x5a8) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f00000001c0)={0x2004}) socket$tipc(0x1e, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) mkdirat$cgroup(r2, &(0x7f0000000080)='syz0\x00', 0x1ff) r3 = openat$cgroup(r2, &(0x7f0000000040)='syz0\x00', 0x200002, 0x0) r4 = openat$cgroup_procs(r3, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000c40), 0x12) socket$inet6_mptcp(0xa, 0x1, 0x106) r5 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r5, 0xc1205531, &(0x7f0000000340)={0x0, 0x4, 0x0, 0x8002, '\x00', '\x00', '\x00', 0x4, 0xfffffffe, 0x100, 0x0, "abd206a1ebd7cedfd17ebd65400ed41b"}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r7 = dup(r6) write$6lowpan_enable(r7, &(0x7f0000000000)='0', 0xfffffd2c) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000600)={0x11, 0xfffffffffffffffc, 0x2, 0x0, 0xfffffffffffffffe, 0x0, 0x4, 0x8}, 0x0, &(0x7f0000000680)={0x7fc, 0x2, 0x800000, 0x0, 0x0, 0xc3ad}, 0x0, 0x0) 7.492283326s ago: executing program 0 (id=4290): r0 = landlock_create_ruleset(&(0x7f00000002c0)={0x2001}, 0x18, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) r1 = openat$vim2m(0xffffffffffffff9c, 0x0, 0x2, 0x0) writev(r1, &(0x7f0000004900), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000193c0)='net/protocols\x00') socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000019080)=ANY=[@ANYBLOB="050000000100000040000000400000000000", @ANYRES32, @ANYBLOB, @ANYBLOB='\x00'/11], 0x48) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000140)={r3, &(0x7f0000000080), &(0x7f00000000c0)=""/65}, 0x20) pread64(r2, &(0x7f0000000080)=""/102356, 0x18fd4, 0xc2a) socket(0x10, 0x3, 0x0) 6.99216886s ago: executing program 5 (id=4293): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) bind$vsock_stream(r1, &(0x7f0000000000)={0x10}, 0x10) r2 = socket$netlink(0x10, 0x3, 0x10) r3 = socket$tipc(0x1e, 0x2, 0x0) sendmsg$tipc(r3, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20044094}, 0x0) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000300), 0x4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYRES32=0x0, @ANYBLOB], 0x3c}, 0x1, 0xffffa888}, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r2, 0x10e, 0x4, &(0x7f0000000640)=0x1800, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r2) socket$inet_udplite(0x2, 0x2, 0x88) sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000001b00)={0x1c, 0x2d, 0x1, 0x70bd26, 0x25dfdbfc, {0x4}, [@typed={0x8, 0xc, 0x0, 0x0, @fd=r0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) 6.591189621s ago: executing program 5 (id=4295): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) socket$nl_audit(0x10, 0x3, 0x9) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x24, &(0x7f0000000080)=0x1, 0x4) shutdown(r2, 0x0) recvmmsg(r2, &(0x7f0000001980)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=""/26, 0x11}}, {{0x0, 0x0, &(0x7f0000001300)=[{&(0x7f00000000c0)=""/47}, {&(0x7f0000000100)=""/224}, {&(0x7f0000000200)=""/4096}, {&(0x7f0000001200)=""/124}, {&(0x7f0000001280)=""/60}]}}, {{&(0x7f0000001380)=@pppoe={0x18, 0x0, {0x0, @local}}, 0x0, &(0x7f0000001840)=[{&(0x7f0000001400)=""/149}, {&(0x7f0000001b00)=""/118}, {&(0x7f0000001540)=""/188}, {&(0x7f0000001600)=""/57}, {&(0x7f0000001640)=""/135}, {&(0x7f00000014c0)=""/101}, {&(0x7f0000001780)=""/171}], 0x0, &(0x7f00000018c0)=""/176}}], 0x15cbc1ab4c0933f, 0x0, 0x0) 5.037361357s ago: executing program 3 (id=4298): r0 = socket$inet6(0xa, 0x80002, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e27, 0xffffffff, @mcast2, 0x5}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000003cc0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4001c00) 4.937439552s ago: executing program 0 (id=4299): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f00000063c0)=[{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000100)="cbcad215ed370ab2b079783a703926e4", 0x10}], 0x1, &(0x7f00000003c0)=[@op={0x10, 0x117, 0x3, 0x1}], 0x10, 0x14}], 0x1, 0x800) recvmsg(r1, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x40000000) 4.427615689s ago: executing program 6 (id=4301): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='loginuid\x00') write$6lowpan_enable(r0, 0x0, 0x0) 4.409679424s ago: executing program 3 (id=4302): socket$qrtr(0x2a, 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) open(&(0x7f0000000300)='.\x02\x00', 0x14927e, 0x44) socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6(0xa, 0x2, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x16927e, 0x10) socket$alg(0x26, 0x5, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x4) socket$packet(0x11, 0x2, 0x300) socket$kcm(0x10, 0x2, 0x4) socket$inet6_mptcp(0xa, 0x1, 0x106) socket$inet_tcp(0x2, 0x1, 0x0) socket$kcm(0x10, 0x3, 0x10) r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c0002211c0000001f000000060001000000000008000500", @ANYRES32=r0, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="0a000100000070"], 0x64}}, 0x0) 4.344029748s ago: executing program 0 (id=4303): socket(0x10, 0x803, 0x0) write(0xffffffffffffffff, &(0x7f0000000080), 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)={0x44, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @dev}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_NAT_SRC={0xc, 0x6, 0x0, 0x1, [@CTA_NAT_V4_MAXIP={0x8, 0x2, @dev}]}]}, 0x44}}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYBLOB="340000003e0007010000000000000000017c00000400fc800c000180060006006558000008000280040011"], 0x34}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) lseek(0xffffffffffffffff, 0x80000000004, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1f, 0x0, 0x0, 0x1000, 0x0, 0xffffffffffffffff, 0x4000000}, 0x50) mmap(&(0x7f00005e8000/0x1000)=nil, 0x1000, 0x2000003, 0x28011, r2, 0xffff8000) sendto$inet6(0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x8910, 0x0, 0x0) syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000100)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x98f90b, 0x8000, '\x00', @p_u16=&(0x7f00000000c0)=0xfffe}}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000001080)={0x0, 0x1c02, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="6c00000002060104db406e3e0004000200000000100003006269746d61703a706f72740005000400000000000900020073797a32000000000500050000006c00050001000600000024000780080008400000137906000440fffff000060005400000000008000640"], 0x6c}}, 0x0) sendmsg$IPSET_CMD_DESTROY(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000600)=ANY=[@ANYBLOB="28000000030601020000000200fdffffffffff0205000100070000000900020073797a32"], 0x28}, 0x1, 0x0, 0x0, 0x4c814}, 0x40814) 4.160772983s ago: executing program 6 (id=4304): syz_open_dev$ptys(0xc, 0x3, 0x0) syz_open_dev$sg(0x0, 0x0, 0x8002) openat$vcsu(0xffffffffffffff9c, 0x0, 0x80000, 0x0) ioctl$BTRFS_IOC_TREE_SEARCH_V2(0xffffffffffffffff, 0xc0709411, &(0x7f0000000200)={{0x0, 0x3, 0x6c8de66b, 0x479, 0x6, 0x0, 0x9, 0x60000, 0x691c4a54, 0x1, 0x2, 0x8, 0x7, 0xac5, 0x10001}, 0x8, [0x0]}) ioctl$sock_SIOCBRDELBR(0xffffffffffffffff, 0x89a2, &(0x7f0000000000)='bridge0\x00') r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x44b, 0x0, 0x0, {0x7a, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_VLAN_FILTERING={0x5, 0x7, 0x7}]}}}]}, 0x3c}}, 0x0) syz_emit_ethernet(0x3a, &(0x7f0000000080)={@empty, @random="6a2ddcf6177a", @val={@void, {0x8100, 0x1, 0x1, 0x1}}, {@ipv4={0x8864, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x57, 0x0, 0x6, 0x0, @private=0xa010100, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x5, 0x5}}}}}}, 0x0) 3.780228682s ago: executing program 3 (id=4306): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r0, 0x0, 0x0) 3.617933079s ago: executing program 1 (id=4307): openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="180000000000000000000000000000008500000050000000181100", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'geneve0\x00', 0x0}) sendto$packet(0xffffffffffffffff, &(0x7f0000000180)="0b036800e0ff64000200475400f6a13bb10000000800894f4820", 0x100a6, 0x0, &(0x7f0000000140)={0x11, 0x0, r2}, 0x14) 3.44834538s ago: executing program 6 (id=4308): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$tipc(0xffffffffffffffff, 0x0, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000600)=ANY=[@ANYBLOB="3feaa5cf7601ebe554e1afd0489374a2a3710726b9484f179d547b27791ee291b5d526e821228eaa45910672fb0134baa34b143570bb00f1bda828678af2fcf8862d929f7bb1662218d1c0703129b0c9ff03ab4da7ea6375654249c4f0fbf5fab8753eb6e39359347d567fcc2368afc19bbbbc7034dd35db79e90af7cd86c08f2b4c7e9ab90baa0831873621bf0d636e38301c57bb0533ace37802790115cca06ff47315f9e0c071f337eadbea6e2817fce53955449ee67a8f157af73be7"], 0x0) r2 = openat$sndtimer(0xffffffffffffff9c, 0x0, 0x101040) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, &(0x7f0000000300)={{0x3, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r2, 0x40505412, 0x0) r3 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) ioctl$EVIOCSFF(r3, 0x40304580, &(0x7f00000001c0)={0x51, 0x3, 0x560c, {0x803, 0x5d5}, {0xfffa, 0x2}, @cond=[{0xfff8, 0xe, 0xc1b, 0x7, 0x400, 0x40}, {0x89b6, 0x1, 0x8000, 0xc78, 0xff, 0x8}]}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r2, 0x54a2) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000200)={0x8000, 0x101, 0x4}) r6 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r6, 0xc04064a0, &(0x7f0000000040)={0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0xfffffd52, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR(r5, 0xc01c64a3, &(0x7f0000000280)={0x1, r7, 0x1, 0x1, 0xa, 0x1ff, 0x1}) close_range(r4, 0xffffffffffffffff, 0x0) 3.192222921s ago: executing program 1 (id=4309): r0 = landlock_create_ruleset(&(0x7f00000002c0)={0x2001}, 0x18, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) r1 = openat$vim2m(0xffffffffffffff9c, 0x0, 0x2, 0x0) writev(r1, &(0x7f0000004900), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000193c0)='net/protocols\x00') socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000019080)=ANY=[@ANYBLOB="050000000100000040000000400000000000", @ANYRES32, @ANYBLOB, @ANYBLOB='\x00'/11], 0x48) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000140)={r3, &(0x7f0000000080), &(0x7f00000000c0)=""/65}, 0x20) pread64(r2, &(0x7f0000000080)=""/102356, 0x18fd4, 0xc2a) socket(0x10, 0x3, 0x0) 2.79207381s ago: executing program 3 (id=4310): socket$key(0xf, 0x3, 0x2) socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0x3, 0x0, 0x0, 0x1, 0x7}, 0x4000080) write$sequencer(0xffffffffffffffff, &(0x7f0000000400)=ANY=[], 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x40}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0xfffffffffffffc33, &(0x7f0000000280)=0x2) ptrace(0x10, 0x1) r2 = inotify_init1(0x0) inotify_add_watch(r2, &(0x7f0000000200)='.\x00', 0x400) inotify_add_watch(r2, &(0x7f0000000280)='.\x00', 0x850003f3) shmget$private(0x0, 0x4000, 0x0, &(0x7f0000ffa000/0x4000)=nil) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000000)={0x0, 0x80000, 0xffffffffffffffff}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r4, 0xc01864c6, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}) r6 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r6, 0xc04064a0, &(0x7f0000000040)={0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0xfffffd52, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR2(r5, 0xc02464bb, &(0x7f0000000040)={0x3, r7, 0x5, 0x6576, 0x8, 0xff, 0x6, 0x67, 0x10001}) ioctl$DRM_IOCTL_MODE_SETGAMMA(r3, 0xc02064a5, &(0x7f00000001c0)={r7, 0x1, &(0x7f0000000080)=[0x100], 0x0, &(0x7f0000000180)=[0x7, 0x6, 0x5]}) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) 2.189415264s ago: executing program 0 (id=4311): openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file1\x00', &(0x7f0000000140), 0x2, &(0x7f0000002400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) fchdir(r1) close(r1) landlock_restrict_self(0xffffffffffffffff, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1cd042, 0x0) 2.04487887s ago: executing program 1 (id=4312): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000002c0), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd8073a46b08b94214d816f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb4147000001000000008f2b9000f22425e4097ed62cbc891061017cfa6f6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835"], 0x0, 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB='\x00'/15, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000014000000000004040000000000000000"], 0x50) close(r2) r3 = userfaultfd(0x80001) mkdir(&(0x7f0000000340)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, 0x0, 0x0) r5 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet6(r5, &(0x7f0000001600)=[{{&(0x7f0000000080)={0xa, 0x4e22, 0x9, @mcast2, 0x80000000}, 0x1c, 0x0, 0x0, &(0x7f0000000280)=[@rthdr={{0x28, 0x29, 0x39, {0x2c, 0x2, 0x2, 0x1, 0x0, [@private2]}}}], 0x28}}], 0x1, 0x20000000) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\b\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYBLOB="01000000040000000200"/21], 0x50) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000140)) r6 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000000)='source', &(0x7f00000000c0)='c::=/\x10\xcd\xb7@\x88\xedP9\xf5,\xef\x87\xc9G\xeb\xd9\xf9\xcd\xb1\xac!\xa7\x9c\x8f\xc98\xcb-\t\xcf-\xdd\xc4\xafK\x8d\xb1R8m\xc1[A\x99g\x9d\x8a\"\x98:\xc1I<\xdf;\x11t\xd3\xd2\x19\x964\xff\x03\xbc\x7fo\xe8\x89\x01:\x8b-\xab[X\x10\x18\x8d\xbf\xe1\x88\x16', 0x0) close(r6) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r7, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x6, 0x400, 0x0, 0x30}, 0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r7, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x8a}, 0x9c) bind$inet6(r7, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r7, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) mlockall(0x7) shutdown(r7, 0x2) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) socket$xdp(0x2c, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x12) 1.303432166s ago: executing program 6 (id=4313): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f00000063c0)=[{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000100)="cbcad215ed370ab2b079783a703926e4", 0x10}], 0x1, &(0x7f00000003c0)=[@op={0x10, 0x117, 0x3, 0x1}], 0x10, 0x14}], 0x1, 0x800) recvmsg(r1, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x40000000) 1.140092664s ago: executing program 6 (id=4314): socket$alg(0x26, 0x5, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/tcp6\x00') socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_sctp(0x2, 0x5, 0x84) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f00000001c0)={0x0, 0x3, 0x30}, &(0x7f00000002c0)=0x18) getsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000300)={r4, 0x7c7b912c}, &(0x7f0000000340)=0x8) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x89f0, 0x0) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x20000000, '\x00', 0x0, 0x0}, 0x50) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x98}}, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x8, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r6}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x8, 0x3}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x7, 0x1, 0xb, 0x7, 0x8}, {0x7, 0x0, 0x0, 0x7}, {}, {}, {}, {0x18, 0x8, 0x2, 0x0, r5}, {}, {0x46, 0x0, 0x0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x5, 0x0, 0xb, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000680)={r8, 0xe0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000001200)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x13, 0x8, 0x0, 0x0}}, 0x10) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r9 = add_key(&(0x7f0000000080)='big_key\x00', &(0x7f00000005c0)={'syz', 0x1}, &(0x7f0000000980)="475a251bdb1e4c438649cdf2494dde32cd76aeabc8ca949257819f25159c532504978ed33d145658cce40a3dd867df925cbedfbd01f157cae933c958c5dfdc1e0132e03f60e3418410fe17f95bdb8090c4adb3636ea342fb8589cf4944e42579da1d2aa919fa78d9e27565fc30d2513293f3cc7d6c7d2d1fb756b0d7b352efd07bd38bedcabb8d856610db17155de5bb0409e3713b2c73464055345b98fe30949e7ee8cddc663f3d5d50881520df8da5115d6d8d81bc62e8dde2460f128365ca184efc5e1b14ff3f4ad1c1f7bad98a9435c0d757ddb9dcd577f5ae33ef675676ba7b44be538aeec0e6ec4973865dc2bb0f0847ded0a131f3b01ac48e070783564cd9031b3b9fcbeafb69dd253e8cbc2c12307f03154573a27f6f00073aae7c4c1701a3f745744c254ddd3b43988c7bbdec9c1e158fda3cdffc887206b78fb1fc943810dc473894738286878513d06aa7f074a11983261f5be648b4b76893a5f733bdafcf42427743534de2bfcf27f014923488c6476dd417344045c747c68c69e3eb5357e69d97a2cfafa44e2547aa21548dfc0739e49321684120c8bdb64448689a3412eebaca2e4b2a2ecf96690f9fec7d569087bc8561cff6012cf5cb14775230226b95a9ded9cccfedafe61c550376adf0b1b59abf9f92da6247e1061afe2eaa9d8f5a28d63db50fca875020da59426501eab6602beb74de33df143ccb60c70f950f5f53f1d5aca6371dfc8dd68cbe7ccfbe0f52e1ff238105dd93d8a3a72da45ce79824d6b091d9c91509cb290afd01f1945b118f2c1c58f17c0b59fbd872412d7d291dcecad019af039375aeee7ddcf36ede82914f64bb41281962c9b10216907c37d06aa5a5b33afe0547c6726ee169779ad6d5cfc5f373f75b234df4ac2007c6db9dc6a0fc3e7e1d2f2658e928c2a854483e6780d69908692d0166ab5334cd5ceb7a69a420803b7ca33e4609f61cfda3b631b54fb81a7473b4bbe2eabc17276f8a009668d634f332fe47fda76a1fae8fe9c3c8962f7ca7a102d5ecd1d6029abb6c422026af6ef277a4c6c21f07121cd8bcce6f1792ea6a628580b478d72b32dd50f59e893bfcf353bea1e2ddbd349c16ccc23bceb8f3b64aa16257eedabadaead30f912bd0e579c0b71e6cd86804fc39a074f94da63f0db97c5f41e38541bf441f49d2751966cc78dacd150ae0b91ffe1f5a117fe494a8b60a17ccfbc780f82f0ea96d8db842e07fb4d68edbe28119a6c2ab72ea15a5ba75ac8193dd7411d9aeece6fc23ac00370c84d7e03990ca3697a0187cc3286e4536ace023ec21389ff08cddb1e9075d1e1b3a98a95720f44e50830ad54fecd437a40f483579c7a5eb40e52e75099d9ada449ba4d0751e44de6edd5e17caa91cfb3bf88bb1e093bd76952c80669845d3cbcde8acf7415ed30ad3a0ff648968d036af2de90f2ab93b250b9386fcba42c1ba01cc951fa1f62ebbb99ad6576d803d29e81ed319350ee0a032bfab9b079ea5a29c66f665ce9ccb6b908593ae2406332c5ac7d11c9b830593576177b2af5d70c65dda56b98448862b75a54b3447534d45e0b5a52edc1a76c97f511030bd261bb1a443e1a38a78973f0781efa9910ebe207457587dbc803e68b2cb985c03c4dfbac440d58c90de66a634c07b13197b9e7d42657fb0537abe475fb56fe24cdcd771d9ac5bcea1c915a77d731d2d16a54885387e034aab6db1718521eeb07b0326d23decd5bba45b311d8617bbfd3afc10923567e8987c95260ab90ba3ff1309273a2a615174d9a33c11bfd393013c314d3df8cf4e584b752c30f54e09a38409a34cdaee74f30547b7dfdb3c48d6b4d5b7346ebcaf7fdbb91d9d45ba303e2ea2736f28301c7b8354bc6f89f58841cb844646a57153c83cd03687d8d3a6b95e93f8abd1218af123ada0de5025d18e4599c8d34cdd8ecf91af7a647c6b43d4704446a104829783ec10b68d95418ddfe8b0dc6552069bd07e4452821317131b7a76887fd792c431e6c07d770926c4e60243d198372482b911d29daac57d", 0x5a5, 0xfffffffffffffffb) keyctl$update(0x2, r9, &(0x7f0000000000)="11868a0fceae284c00000001000000", 0xf) ioctl$TIOCGPKT(0xffffffffffffffff, 0x40045431, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x4004) mremap(&(0x7f0000000000/0x9000)=nil, 0x600000, 0x600000, 0x3, &(0x7f0000a00000/0x600000)=nil) socket$inet6_sctp(0xa, 0x1, 0x84) 928.24888ms ago: executing program 0 (id=4315): syz_emit_ethernet(0x86, &(0x7f00000002c0)={@random="5b1a033f2511", @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x2, 0x78, 0x0, 0x0, 0x0, 0x11, 0x0, @empty=0xe000, @multicast1}, {0x0, 0x4e20, 0x64, 0x0, @wg=@response={0x2, 0x0, 0x0, "fdcdaea5a7a296872a8a5290e48e30acf8afc7e67d70a62c979cefa10a0028bd", "ae0000000000000000e400", {"35f3c07eeca4a20a9858ac1500", "63081fe8fe001a08ed082ad7121d696f"}}}}}}}, 0x0) 924.938127ms ago: executing program 1 (id=4316): r0 = socket$inet6(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000c80)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000000)=@ipv4_newaddr={0x18, 0x14, 0x509, 0x0, 0x25dfdbfd, {0x2, 0x20, 0x0, 0xcb, r3}}, 0x18}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00'}) sendto$inet6(r0, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) 583.744439ms ago: executing program 0 (id=4317): syz_open_dev$dri(0x0, 0x2, 0x98240) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) keyctl$instantiate_iov(0x14, 0x0, 0x0, 0x0, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x7, 0x0, 0x3}, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) rseq(0x0, 0x0, 0x0, 0x0) r2 = gettid() rt_sigtimedwait(&(0x7f0000000100)={[0x3ff]}, 0x0, 0x0, 0x8) tkill(r2, 0x7) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x4}, 0x8) sendto$inet6(0xffffffffffffffff, &(0x7f0000000040)="aa", 0x1, 0xc800, 0x0, 0x0) 552.380974ms ago: executing program 1 (id=4318): socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000004c0)) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x402, 0x0) socket$kcm(0x2, 0xa, 0x2) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) writev(r0, 0x0, 0x0) 49.163862ms ago: executing program 3 (id=4319): socket$inet_icmp_raw(0x2, 0x3, 0x1) socket(0x1d, 0x2, 0x6) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb4c, 0x9, 0x6, 0x0, 0x3}, 0x0) add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) syz_usb_connect(0x0, 0x24, 0x0, 0x0) syz_pidfd_open(0x0, 0x0) ioctl$USBDEVFS_CLAIM_PORT(0xffffffffffffffff, 0x80045518, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000019c0)="06bb", 0x2}], 0x1}, 0x0) 48.413143ms ago: executing program 6 (id=4320): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$netlink(0x10, 0x3, 0x10) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000000)={0x0, @aes256, 0x0, @desc4}) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) syz_usb_connect(0x0, 0x3d, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000bdce4208110f80106afc0000000109022b00010000000009043700022ee5cd0009058010ff037f790209050e0320000980070705ab0b78"], 0x0) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)) bind$tipc(r1, 0x0, 0xfffffffffffffe05) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) writev(r3, 0x0, 0x0) r5 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000380)={'vcan0\x00', 0x0}) r8 = socket$can_j1939(0x1d, 0x2, 0x7) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x14, 0x0, 0x0) bind$can_j1939(r8, &(0x7f0000000080)={0x1d, r7, 0x0, {0x0, 0x0, 0x4}, 0xfe}, 0x18) sendmsg$can_j1939(r8, &(0x7f00000001c0)={&(0x7f0000000040), 0x18, &(0x7f0000000180)={&(0x7f00000000c0)="92", 0x1a000}}, 0xee) sendmsg$can_j1939(r8, &(0x7f0000000300)={&(0x7f00000002c0)={0x1d, r7, 0x0, {0x2, 0xf0, 0x4}, 0xfd}, 0x18, &(0x7f0000000340)={0x0}, 0x1, 0x0, 0x0, 0x2404c040}, 0x4000080) socket$inet6_sctp(0xa, 0x5, 0x84) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000240)={r5}, &(0x7f0000000280)=ANY=[], 0x0, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) 0s ago: executing program 1 (id=4321): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/249, 0xf9}], 0x1}, 0x0) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x810100, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1, 0x0, 0x0, 0x3}, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x1c}}, 0x0) syz_open_dev$vim2m(0x0, 0x4, 0x2) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000380), 0x101040) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, &(0x7f0000000300)={{0x3, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r2, 0x40505412, &(0x7f00000000c0)={0x2, 0x0, 0x40, 0x0, 0x8}) syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r2, 0x54a2) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000200)={0x8000, 0x101, 0x4}) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r5, 0xc04064a0, &(0x7f0000000040)={0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0xfffffd52, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR(r4, 0xc01c64a3, &(0x7f0000000280)={0x1, r6, 0x1, 0x1, 0xa, 0x1ff, 0x1}) close_range(r3, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): tl_callback: urb status -71 [ 892.600974][ C0] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 892.609096][ C0] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 892.616538][ C0] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 892.631095][ C0] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 892.639109][ C0] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 892.648996][ C0] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 892.696431][T13687] usb 4-1: USB disconnect, device number 63 [ 892.702489][ C0] cm109 4-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 892.711406][T14777] usb 2-1: Using ep0 maxpacket: 32 [ 892.735445][T14777] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 102, changing to 10 [ 892.756882][T13687] cm109 4-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 892.791387][T14777] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 24624, setting to 1024 [ 892.817187][T14777] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 892.834150][ T5853] Bluetooth: hci4: command 0x0406 tx timeout [ 892.853914][T14777] usb 2-1: New USB device found, idVendor=05ac, idProduct=020f, bcdDevice= 0.22 [ 892.868011][T14777] usb 2-1: New USB device strings: Mfr=1, Product=130, SerialNumber=131 [ 892.876686][T14777] usb 2-1: Product: syz [ 892.881146][T14777] usb 2-1: Manufacturer: syz [ 892.885784][T14777] usb 2-1: SerialNumber: syz [ 892.934412][T14777] input: appletouch as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/input/input128 [ 893.146729][T14777] usb 2-1: USB disconnect, device number 55 [ 893.152914][ C1] appletouch 2-1:1.0: atp_complete: usb_submit_urb failed with result -19 [ 893.332700][T14777] appletouch 2-1:1.0: input: appletouch disconnected [ 893.583882][T16610] delete_channel: no stack [ 894.193687][T16616] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3270'. [ 894.203172][T16616] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3270'. [ 894.215244][T16616] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3270'. [ 895.181738][T13275] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 895.354619][T13275] usb 2-1: Using ep0 maxpacket: 8 [ 895.379534][T13275] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 895.442436][T13275] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 895.495259][T13275] usb 2-1: config 16 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 895.568287][T13275] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 895.601360][T13275] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 895.610493][T13275] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 895.649866][T13275] usbtmc 2-1:16.0: bulk endpoints not found [ 896.550496][T16643] input: syz0 as /devices/virtual/input/input129 [ 896.580521][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805beecc00: rx timeout, send abort [ 896.591116][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88805beecc00: 0x3ff00: (3) A timeout occurred and this is the connection abort to close the session. [ 897.616938][T16657] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3281'. [ 898.007885][ T7692] usb 2-1: USB disconnect, device number 56 [ 898.576383][T16669] openvswitch: netlink: Duplicate or invalid key (type 0). [ 898.711636][T16669] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 898.882070][T16673] syz_tun: entered allmulticast mode [ 898.907197][T16672] syz_tun: left allmulticast mode [ 899.825955][T16691] PKCS7: Unknown OID: [5] (bad) [ 899.834896][T16691] PKCS7: Only support pkcs7_signedData type [ 900.051107][ T5966] usb 7-1: new high-speed USB device number 23 using dummy_hcd [ 900.205292][ T5966] usb 7-1: Using ep0 maxpacket: 8 [ 900.224462][ T5966] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 900.236359][T13275] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 900.285322][ T5966] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 900.369189][ T5966] usb 7-1: config 16 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 900.397482][ T5966] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 900.418408][ T5966] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 900.446406][ T5966] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 900.461734][T13275] usb 1-1: Using ep0 maxpacket: 16 [ 900.471877][T13275] usb 1-1: config 0 has an invalid interface number: 161 but max is 0 [ 900.480526][T13275] usb 1-1: config 0 has no interface number 0 [ 900.494987][T13275] usb 1-1: config 0 interface 161 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 64 [ 900.532862][ T5966] usbtmc 7-1:16.0: bulk endpoints not found [ 900.555676][T13275] usb 1-1: New USB device found, idVendor=0bfd, idProduct=0102, bcdDevice=9a.fd [ 900.565704][T13275] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 900.578565][T13275] usb 1-1: Product: syz [ 900.669952][T13275] usb 1-1: Manufacturer: syz [ 900.677361][T13275] usb 1-1: SerialNumber: syz [ 900.714046][T13275] usb 1-1: config 0 descriptor?? [ 900.765197][T16691] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 900.834976][T13275] kvaser_usb 1-1:0.161: error -ENODEV: Cannot get usb endpoint(s) [ 902.078515][T13275] usb 1-1: USB disconnect, device number 51 [ 902.530591][T16722] netlink: 'syz.0.3301': attribute type 1 has an invalid length. [ 902.603612][T16722] 8021q: adding VLAN 0 to HW filter on device bond2 [ 902.774285][T16724] bond2: (slave veth5): Enslaving as an active interface with a down link [ 902.833525][T16722] bond2: (slave veth0_to_bond): making interface the new active one [ 902.969453][ T5966] usb 7-1: USB disconnect, device number 23 [ 902.992436][T16722] veth0_to_bond: entered promiscuous mode [ 903.274330][T16722] bond2: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 903.716580][T16736] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3305'. [ 906.271669][T16764] PKCS7: Unknown OID: [5] (bad) [ 906.276694][T16764] PKCS7: Only support pkcs7_signedData type [ 906.496081][T16771] binder: 16770:16771 ioctl c0306201 0 returned -14 [ 906.541270][T13275] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 906.712212][T13275] usb 4-1: Using ep0 maxpacket: 16 [ 906.729839][T13275] usb 4-1: config 0 has an invalid interface number: 161 but max is 0 [ 906.739678][T13275] usb 4-1: config 0 has no interface number 0 [ 906.749946][T13275] usb 4-1: config 0 interface 161 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 64 [ 906.775570][T13275] usb 4-1: New USB device found, idVendor=0bfd, idProduct=0102, bcdDevice=9a.fd [ 906.785411][T13275] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 906.794724][T13275] usb 4-1: Product: syz [ 906.799159][T13275] usb 4-1: Manufacturer: syz [ 906.804289][T13275] usb 4-1: SerialNumber: syz [ 906.849085][T13275] usb 4-1: config 0 descriptor?? [ 906.870723][T16764] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 906.882205][T13275] kvaser_usb 4-1:0.161: error -ENODEV: Cannot get usb endpoint(s) [ 907.495834][T16781] pim6reg: entered allmulticast mode [ 907.508253][T16781] pim6reg: left allmulticast mode [ 907.833379][T16784] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3318'. [ 909.031408][ T7692] usb 4-1: USB disconnect, device number 64 [ 909.778304][T16812] netlink: 'syz.6.3327': attribute type 10 has an invalid length. [ 909.825697][T16812] openvswitch: netlink: Flow actions attr not present in new flow. [ 910.145641][T16815] netlink: 20 bytes leftover after parsing attributes in process `syz.6.3329'. [ 910.755036][T16820] delete_channel: no stack [ 911.531156][T13275] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 911.697435][T16832] openvswitch: netlink: Duplicate or invalid key (type 0). [ 911.891112][T13275] usb 6-1: Using ep0 maxpacket: 8 [ 911.898075][T13275] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 911.930426][T13275] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 911.939889][T16832] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 911.958529][T13275] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 912.011211][T13275] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 912.039960][T13275] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 912.073566][T13275] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 912.113219][T13275] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 912.160387][T13275] usbtmc 6-1:16.0: probe with driver usbtmc failed with error -22 [ 912.177946][ T30] audit: type=1326 audit(1752279527.220:1176): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16833 comm="syz.0.3335" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf70fe539 code=0x0 [ 912.317273][T16838] syz_tun: entered allmulticast mode [ 912.332633][T16837] syz_tun: left allmulticast mode [ 912.795002][T16844] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3337'. [ 912.986806][T16854] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3340'. [ 912.996071][T16854] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3340'. [ 913.011616][T16854] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3340'. [ 914.484109][ T24] usb 6-1: USB disconnect, device number 27 [ 914.810215][T16869] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3345'. [ 915.239861][T16870] batadv0: entered promiscuous mode [ 915.281836][T16870] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 915.427863][T16878] syz_tun: entered allmulticast mode [ 915.496712][T16876] syz_tun: left allmulticast mode [ 916.644645][ T49] veth0_to_bond: left promiscuous mode [ 917.171195][T13687] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 917.361040][T13687] usb 4-1: Using ep0 maxpacket: 8 [ 917.441221][T13687] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 917.510395][T13687] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 917.634371][T13687] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 917.671112][T13687] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 917.707987][T13687] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 917.868958][T13687] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 917.891075][T13687] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 917.916018][T13687] usbtmc 4-1:16.0: probe with driver usbtmc failed with error -22 [ 918.801839][ T7692] usb 6-1: new full-speed USB device number 28 using dummy_hcd [ 919.481119][ T7692] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 919.558827][ T7692] usb 6-1: config 0 has no interfaces? [ 919.571832][ T7692] usb 6-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 919.584708][ T7692] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 919.601229][ T7692] usb 6-1: Product: syz [ 919.606657][ T7692] usb 6-1: Manufacturer: syz [ 919.680456][ T7692] usb 6-1: SerialNumber: syz [ 919.700213][ T7692] usb 6-1: config 0 descriptor?? [ 919.752027][T16923] batadv0: entered promiscuous mode [ 919.766765][T16923] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 919.815421][ T7692] usb 4-1: USB disconnect, device number 65 [ 919.900210][T16925] syz_tun: entered allmulticast mode [ 920.017066][T16924] syz_tun: left allmulticast mode [ 920.706317][T16942] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3364'. [ 922.865548][ T7692] usb 6-1: USB disconnect, device number 28 [ 923.089622][T16963] binder: BINDER_SET_CONTEXT_MGR already set [ 923.173717][T16963] binder: 16962:16963 ioctl 4018620d 80000040 returned -16 [ 923.429013][T16966] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3372'. [ 923.544762][ T5853] Bluetooth: hci2: command 0x0406 tx timeout [ 924.545021][T16974] delete_channel: no stack [ 924.897230][T16977] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3376'. [ 925.458669][T16984] netlink: 'syz.3.3377': attribute type 1 has an invalid length. [ 925.586801][T16984] 8021q: adding VLAN 0 to HW filter on device bond1 [ 925.616984][T16990] syz_tun: entered allmulticast mode [ 925.796830][T16989] bond1: (slave veth3): Enslaving as an active interface with a down link [ 925.903364][T16984] bond1: (slave veth0_to_bond): making interface the new active one [ 925.940243][T16984] veth0_to_bond: entered promiscuous mode [ 925.947349][T16984] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 926.065585][T16994] vlan0: entered allmulticast mode [ 926.075081][T16994] veth1: entered allmulticast mode [ 926.091663][T16994] veth1: entered promiscuous mode [ 926.108954][T16994] veth1: left promiscuous mode [ 926.128363][T16994] bond1: (slave vlan0): Enslaving as an active interface with an up link [ 926.572577][T17003] openvswitch: netlink: Duplicate or invalid key (type 0). [ 926.630791][T17003] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 927.241732][T17011] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3387'. [ 927.612815][ T30] audit: type=1326 audit(1752279542.670:1177): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17014 comm="syz.0.3389" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf70fe539 code=0x0 [ 927.744353][T17020] binder: BINDER_SET_CONTEXT_MGR already set [ 927.755252][T17020] binder: 17016:17020 ioctl 4018620d 80000040 returned -16 [ 927.778336][T17020] binder: 17016:17020 ioctl c0306201 0 returned -14 [ 928.085695][T17023] syz_tun (unregistering): left allmulticast mode [ 928.140875][T17026] openvswitch: netlink: Message has 20 unknown bytes. [ 928.148204][T17026] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 928.249107][T17029] delete_channel: no stack [ 928.687002][T17034] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3396'. [ 929.237690][T17049] binder: 17047:17049 ioctl c0306201 0 returned -14 [ 929.561036][ T7693] usb 7-1: new high-speed USB device number 24 using dummy_hcd [ 929.606442][T17059] netlink: 'syz.3.3406': attribute type 1 has an invalid length. [ 929.627655][ T30] audit: type=1326 audit(1752279544.660:1178): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17060 comm="syz.1.3407" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf70fe539 code=0x0 [ 929.695771][T17059] 8021q: adding VLAN 0 to HW filter on device bond2 [ 929.781202][ T7693] usb 7-1: Using ep0 maxpacket: 8 [ 929.797219][T17059] bond2: (slave veth5): Enslaving as an active interface with a down link [ 929.827395][ T7693] usb 7-1: config 0 has an invalid interface number: 55 but max is 0 [ 929.843699][T17065] bond1: (slave veth0_to_bond): Releasing active interface [ 929.852642][T17065] veth0_to_bond: left promiscuous mode [ 929.859915][T17065] bond1: (slave vlan0): making interface the new active one [ 929.873265][T17065] veth1: entered promiscuous mode [ 929.879317][T17065] vlan0: entered promiscuous mode [ 929.896786][T17065] bond2: (slave veth0_to_bond): making interface the new active one [ 929.909393][ T7693] usb 7-1: config 0 has no interface number 0 [ 929.914503][T17065] veth0_to_bond: entered promiscuous mode [ 929.919393][ T7693] usb 7-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 929.933609][ T7693] usb 7-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 929.934381][T17065] bond2: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 929.958906][ T7693] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 929.976112][ T7693] usb 7-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 930.010352][ T7693] usb 7-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 930.045753][ T7693] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 930.067804][ T7693] usb 7-1: config 0 descriptor?? [ 930.088397][ T7693] ldusb 7-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 930.762975][ T24] usb 7-1: USB disconnect, device number 24 [ 930.825153][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805a808000: rx timeout, send abort [ 930.834721][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff88805a808000: 0x3ff00: (3) A timeout occurred and this is the connection abort to close the session. [ 930.866737][ T24] ldusb 7-1:0.55: LD USB Device #0 now disconnected [ 931.521394][T17079] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3410'. [ 931.717763][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.724471][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 932.030761][T17086] binder: BINDER_SET_CONTEXT_MGR already set [ 932.038855][T17086] binder: 17084:17086 ioctl 4018620d 80000040 returned -16 [ 932.067292][T17086] binder: 17084:17086 ioctl c0306201 0 returned -14 [ 933.028419][T17103] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3419'. [ 933.067558][T17103] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3419'. [ 933.090825][T17103] netlink: 20 bytes leftover after parsing attributes in process `syz.6.3419'. [ 933.392305][T17108] openvswitch: netlink: Duplicate or invalid key (type 0). [ 933.402545][T17108] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 934.201457][ T7693] usb 4-1: new high-speed USB device number 66 using dummy_hcd [ 934.402328][ T7693] usb 4-1: Using ep0 maxpacket: 8 [ 934.444702][ T7693] usb 4-1: config 0 has an invalid interface number: 55 but max is 0 [ 934.473782][ T7693] usb 4-1: config 0 has no interface number 0 [ 934.479966][ T7693] usb 4-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 934.551311][ T7693] usb 4-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 934.621024][ T7693] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 934.663351][ T7693] usb 4-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 934.708016][ T7693] usb 4-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 934.731079][ T7693] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 934.769715][ T7693] usb 4-1: config 0 descriptor?? [ 934.826769][ T7693] ldusb 4-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 934.933922][T17124] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3429'. [ 935.070269][ T7693] usb 4-1: USB disconnect, device number 66 [ 935.109374][ T7693] ldusb 4-1:0.55: LD USB Device #0 now disconnected [ 935.221028][T17132] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3430'. [ 936.052629][T17140] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3433'. [ 936.063265][T17140] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3433'. [ 936.073459][T17140] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3433'. [ 936.398755][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805ace9400: rx timeout, send abort [ 936.408939][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff88805ace9400: 0x3ff00: (3) A timeout occurred and this is the connection abort to close the session. [ 939.273779][T13275] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 939.462187][T13275] usb 6-1: Using ep0 maxpacket: 32 [ 939.535334][T13275] usb 6-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 939.609066][T13275] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 939.699491][T13275] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 939.807219][T13275] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 939.908984][T13275] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 940.028914][T17194] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3451'. [ 940.038300][T17194] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3451'. [ 940.051219][T17194] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3451'. [ 940.147151][T13275] usb 6-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 940.191102][T13275] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 940.199209][T13275] usb 6-1: Product: syz [ 940.220437][T13275] usb 6-1: Manufacturer: syz [ 940.236644][T13275] usb 6-1: SerialNumber: syz [ 940.323297][T13275] usb 6-1: config 0 descriptor?? [ 941.457969][T17203] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3455'. [ 942.135503][T17212] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3456'. [ 942.225572][T17216] netlink: 'syz.6.3457': attribute type 1 has an invalid length. [ 942.290972][T17216] 8021q: adding VLAN 0 to HW filter on device bond2 [ 942.372738][T17220] bond0: entered promiscuous mode [ 942.916862][T13275] usb 6-1: USB disconnect, device number 29 [ 943.136537][T17216] bond2: (slave veth5): Enslaving as an active interface with a down link [ 943.256591][T17222] bond1: (slave veth0_to_bond): Releasing active interface [ 943.327373][T17222] bond2: (slave veth0_to_bond): making interface the new active one [ 943.337722][T17222] veth0_to_bond: entered promiscuous mode [ 943.344148][T17222] bond2: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 943.480510][ T3020] vlan0: left promiscuous mode [ 943.641795][ T4514] veth0_to_bond: left promiscuous mode [ 945.650400][T17245] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3464'. [ 945.749407][T17245] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3464'. [ 945.789299][T17245] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3464'. [ 945.825113][T17249] vivid-007: disconnect [ 945.999779][T17250] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3467'. [ 946.068106][T17250] netlink: 'syz.6.3467': attribute type 10 has an invalid length. [ 946.077843][T17250] bond0: left promiscuous mode [ 946.083001][T17250] bond_slave_0: left promiscuous mode [ 946.094870][T17250] bond_slave_1: left promiscuous mode [ 946.131987][T17252] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3467'. [ 946.399332][T17250] 8021q: adding VLAN 0 to HW filter on device bond0 [ 946.527685][T17256] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3468'. [ 946.611121][T17250] team0: Port device bond0 added [ 947.568665][T17267] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3469'. [ 947.618384][T17267] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3469'. [ 947.673348][T17267] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3469'. [ 947.962759][T17252] team0 (unregistering): Port device team_slave_0 removed [ 948.011959][T17252] team0 (unregistering): Port device team_slave_1 removed [ 948.070735][T17252] team0 (unregistering): Port device bond0 removed [ 949.073225][T17248] vivid-007: reconnect [ 949.167214][T17280] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3474'. [ 952.087616][ T30] audit: type=1326 audit(1752279567.150:1179): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17317 comm="syz.1.3487" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf70fe539 code=0x0 [ 954.264036][ T5853] Bluetooth: hci3: command 0x0406 tx timeout [ 954.515300][T17341] binder_alloc: 17340: pid 17340 spamming oneway? 1 buffers allocated for a total size of 4096 [ 954.562238][T17341] binder: 17340:17341 ioctl c0306201 0 returned -14 [ 954.858529][T17345] batadv0: entered promiscuous mode [ 954.881355][T17345] vlan1: entered promiscuous mode [ 954.971203][T13275] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 955.145527][T13275] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 955.369927][T13275] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 955.380780][T13275] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 955.396923][T13275] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 955.406421][T13275] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 955.414962][T13275] usb 2-1: Product: syz [ 955.419255][T13275] usb 2-1: Manufacturer: syz [ 955.424334][T13275] usb 2-1: SerialNumber: syz [ 955.459473][T13275] hub 2-1:1.0: bad descriptor, ignoring hub [ 955.581701][T13275] hub 2-1:1.0: probe with driver hub failed with error -5 [ 955.642936][ T30] audit: type=1326 audit(1752279570.710:1180): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17360 comm="syz.6.3500" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7fe8539 code=0x0 [ 955.681428][T13275] usblp 2-1:1.0: usblp0: USB Unidirectional printer dev 57 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 956.983633][T17372] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3502'. [ 957.202776][T13742] usb 2-1: USB disconnect, device number 57 [ 957.250486][T13742] usblp0: removed [ 957.879450][T14066] veth0_to_bond: left promiscuous mode [ 958.578363][T17392] binder_alloc: 17391: pid 17391 spamming oneway? 1 buffers allocated for a total size of 4096 [ 958.631849][T17393] binder: 17391:17393 ioctl c0306201 0 returned -14 [ 960.161800][T17416] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3512'. [ 960.171136][T17416] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3512'. [ 960.185280][T17416] netlink: 20 bytes leftover after parsing attributes in process `syz.6.3512'. [ 960.620351][T17428] binder_alloc: 17427: pid 17427 spamming oneway? 1 buffers allocated for a total size of 4096 [ 961.561078][ T7693] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 961.813734][ T7693] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 961.832509][ T7693] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 961.935577][ T7693] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 962.038909][ T7693] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 962.068497][ T7693] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 962.110980][ T7693] usb 1-1: Product: syz [ 962.128271][ T7693] usb 1-1: Manufacturer: syz [ 962.146102][ T7693] usb 1-1: SerialNumber: syz [ 962.188867][ T7693] hub 1-1:1.0: bad descriptor, ignoring hub [ 962.219579][ T7693] hub 1-1:1.0: probe with driver hub failed with error -5 [ 962.398399][ T7693] usblp 1-1:1.0: usblp0: USB Unidirectional printer dev 52 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 962.433493][T17456] IPVS: sed: UDP 224.0.0.2:0 - no destination available [ 962.447681][T13742] IPVS: starting estimator thread 0... [ 962.456705][T17458] binder_alloc: 17457: pid 17457 spamming oneway? 1 buffers allocated for a total size of 4096 [ 962.561108][T17460] IPVS: using max 29 ests per chain, 69600 per kthread [ 962.919779][T17470] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3531'. [ 962.929137][T17470] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3531'. [ 962.938413][T17470] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3531'. [ 963.931476][ T7693] usb 1-1: USB disconnect, device number 52 [ 964.026120][ T7693] usblp0: removed [ 964.624636][T17500] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3543'. [ 967.047953][T17539] syzkaller1: entered promiscuous mode [ 967.057885][T17539] syzkaller1: entered allmulticast mode [ 968.203397][ T24] usb 7-1: new high-speed USB device number 25 using dummy_hcd [ 968.404511][ T24] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 968.444428][ T24] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 968.471102][ T5966] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 968.555182][ T24] usb 7-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 968.715140][ T24] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 968.724370][ T24] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 968.747833][ T24] usb 7-1: Product: syz [ 968.795563][ T5966] usb 2-1: Using ep0 maxpacket: 8 [ 968.801520][ T24] usb 7-1: Manufacturer: syz [ 968.806183][ T24] usb 7-1: SerialNumber: syz [ 968.858452][ T5966] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 968.867771][ T5966] usb 2-1: config 0 has no interface number 0 [ 968.877519][ T5966] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 968.907401][ T5966] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 968.946587][ T24] hub 7-1:1.0: bad descriptor, ignoring hub [ 968.986111][ T5966] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 969.028729][ T24] hub 7-1:1.0: probe with driver hub failed with error -5 [ 969.060600][ T5966] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 969.101979][ T5966] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 969.223902][ T5966] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 969.319144][ T24] usblp 7-1:1.0: usblp0: USB Unidirectional printer dev 25 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 969.337718][ T5966] usb 2-1: config 0 descriptor?? [ 969.407507][ T5966] ldusb 2-1:0.55: LD USB Device #1 now attached to major 180 minor 1 [ 969.702352][ T5966] usb 2-1: USB disconnect, device number 58 [ 969.729919][ T5966] ldusb 2-1:0.55: LD USB Device #1 now disconnected [ 969.979723][T17570] 8021q: VLANs not supported on gre0 [ 970.641546][ T7693] usb 7-1: USB disconnect, device number 25 [ 970.653490][ T7693] usblp0: removed [ 971.331081][T13742] usb 7-1: new high-speed USB device number 26 using dummy_hcd [ 971.521377][T13742] usb 7-1: Using ep0 maxpacket: 32 [ 971.531716][T13742] usb 7-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 971.545944][T13742] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 971.594818][T13742] usb 7-1: config 0 descriptor?? [ 971.807613][T13742] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 971.826345][T13742] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 971.894016][T13742] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 971.921156][T13742] usb 7-1: media controller created [ 972.125910][T13742] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 972.698865][T13742] az6027: usb out operation failed. (-71) [ 972.708154][T13742] az6027: usb out operation failed. (-71) [ 972.714749][T13742] stb0899_attach: Driver disabled by Kconfig [ 972.720901][T13742] az6027: no front-end attached [ 972.720901][T13742] [ 972.735822][T13742] az6027: usb out operation failed. (-71) [ 972.747265][T13742] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 972.791878][T13742] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.6/usb7/7-1/input/input130 [ 972.832595][T13742] dvb-usb: schedule remote query interval to 400 msecs. [ 972.858355][T13742] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 972.875213][T13742] usb 7-1: USB disconnect, device number 26 [ 973.023964][T13742] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 975.024417][ T7693] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 975.201119][ T7693] usb 4-1: Using ep0 maxpacket: 8 [ 975.209470][ T7693] usb 4-1: config 0 has an invalid interface number: 55 but max is 0 [ 975.247068][ T7693] usb 4-1: config 0 has no interface number 0 [ 975.258297][ T7693] usb 4-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 975.284943][ T7693] usb 4-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 975.327987][ T7693] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 975.389140][ T7693] usb 4-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 975.409119][ T7693] usb 4-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 975.421902][ T7693] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 975.464890][ T7693] usb 4-1: config 0 descriptor?? [ 975.486563][ T7693] ldusb 4-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 975.557970][T17635] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 1340 [ 975.568542][T13742] usb 2-1: new high-speed USB device number 59 using dummy_hcd [ 975.743532][T13742] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 975.783813][T13742] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 975.829626][T13742] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 975.917406][T13742] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 975.952746][T13742] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 975.990665][T13742] usb 2-1: Product: syz [ 976.004354][T13742] usb 2-1: Manufacturer: syz [ 976.034106][T13742] usb 2-1: SerialNumber: syz [ 976.077815][T13742] hub 2-1:1.0: bad descriptor, ignoring hub [ 976.111327][T13742] hub 2-1:1.0: probe with driver hub failed with error -5 [ 976.316641][T13742] usblp 2-1:1.0: usblp1: USB Unidirectional printer dev 59 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 976.941171][T13742] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 977.012270][T17641] delete_channel: no stack [ 977.181061][T13742] usb 6-1: Using ep0 maxpacket: 32 [ 977.189401][T13742] usb 6-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 977.354063][T13742] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 977.363344][ C0] ldusb 4-1:0.55: usb_submit_urb failed (-19) [ 977.369766][T13687] usb 4-1: USB disconnect, device number 67 [ 977.389101][T13687] ldusb 4-1:0.55: LD USB Device #0 now disconnected [ 977.408622][T13742] usb 6-1: config 0 descriptor?? [ 978.275523][T13742] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 978.290471][T13742] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 978.312423][T13742] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 978.319808][T13742] usb 6-1: media controller created [ 978.543705][ T5966] usb 2-1: USB disconnect, device number 59 [ 978.584478][T13742] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 978.604803][ T5966] usblp1: removed [ 979.167070][T17675] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3594'. [ 979.203033][T17673] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3592'. [ 979.348060][T13742] az6027: usb out operation failed. (-71) [ 979.366117][T13742] az6027: usb out operation failed. (-71) [ 979.387215][T13742] stb0899_attach: Driver disabled by Kconfig [ 979.401937][T13742] az6027: no front-end attached [ 979.401937][T13742] [ 979.473818][T13742] az6027: usb out operation failed. (-71) [ 979.479847][T13742] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 979.497441][T13742] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.5/usb6/6-1/input/input131 [ 979.536515][T13742] dvb-usb: schedule remote query interval to 400 msecs. [ 979.625159][T13742] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 979.644010][T13742] usb 6-1: USB disconnect, device number 30 [ 979.789804][T13742] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 980.814753][T17691] ======================================================= [ 980.814753][T17691] WARNING: The mand mount option has been deprecated and [ 980.814753][T17691] and is ignored by this kernel. Remove the mand [ 980.814753][T17691] option from the mount to silence this warning. [ 980.814753][T17691] ======================================================= [ 981.561500][T13742] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 981.711413][T13742] usb 1-1: Using ep0 maxpacket: 8 [ 981.730396][T13742] usb 1-1: config 0 has an invalid interface number: 55 but max is 0 [ 981.739085][T13742] usb 1-1: config 0 has no interface number 0 [ 981.757163][T13742] usb 1-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 981.918518][T13742] usb 1-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 981.931384][ T43] usb 7-1: new high-speed USB device number 27 using dummy_hcd [ 981.996392][T13742] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 982.128957][ T43] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 982.146337][T13742] usb 1-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 982.179511][ T43] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 982.187826][T13742] usb 1-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 982.207147][ T43] usb 7-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 982.218861][T13742] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 982.366418][T13742] usb 1-1: config 0 descriptor?? [ 982.408334][ T43] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 982.436873][ T43] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 982.447053][T13742] ldusb 1-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 982.461046][T13687] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 982.477159][ T43] usb 7-1: Product: syz [ 982.490516][ T43] usb 7-1: Manufacturer: syz [ 982.516841][ T43] usb 7-1: SerialNumber: syz [ 982.640250][ T43] hub 7-1:1.0: bad descriptor, ignoring hub [ 982.651289][T13687] usb 6-1: Using ep0 maxpacket: 8 [ 982.663257][T13687] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 982.669307][ T43] hub 7-1:1.0: probe with driver hub failed with error -5 [ 982.746858][T13687] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 982.769734][T13687] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 982.782910][T13687] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 982.851907][ T43] usblp 7-1:1.0: usblp1: USB Unidirectional printer dev 27 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 982.949648][T13687] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 983.010540][T13687] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 983.275372][T13687] usb 6-1: GET_CAPABILITIES returned 0 [ 983.284952][T13687] usbtmc 6-1:16.0: can't read capabilities [ 983.827122][ T7693] usb 1-1: USB disconnect, device number 53 [ 983.827294][ C1] ldusb 1-1:0.55: usb_submit_urb failed (-19) [ 983.866302][T17712] ld_usb_open - error, can't find device for minor 0 [ 983.884477][ T7693] ldusb 1-1:0.55: LD USB Device #0 now disconnected [ 983.928031][T13687] usb 6-1: USB disconnect, device number 31 [ 984.027845][T17720] bridge0: port 3(syz_tun) entered blocking state [ 984.045442][T17720] bridge0: port 3(syz_tun) entered disabled state [ 984.065810][T17720] syz_tun: entered allmulticast mode [ 984.113862][T17720] syz_tun: entered promiscuous mode [ 984.139018][T17720] bridge0: port 3(syz_tun) entered blocking state [ 984.147654][T17720] bridge0: port 3(syz_tun) entered forwarding state [ 984.257980][T17723] binder_alloc: 17722: pid 17722 spamming oneway? 1 buffers allocated for a total size of 4096 [ 984.297494][T17723] binder_alloc: 17722: pid 17722 spamming oneway? 2 buffers allocated for a total size of 5120 [ 984.313052][T17723] binder: 17722:17723 ioctl c0306201 0 returned -14 [ 984.564478][T17731] syz_tun: entered allmulticast mode [ 984.632579][T17730] syz_tun: left allmulticast mode [ 984.730470][T17736] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3609'. [ 985.028086][ T30] audit: type=1326 audit(1752279600.090:1181): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17740 comm="syz.6.3615" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7fe8539 code=0x0 [ 985.051416][T13687] usb 7-1: USB disconnect, device number 27 [ 985.060833][T13687] usblp1: removed [ 987.481555][T17769] binder_alloc: 17768: pid 17768 spamming oneway? 1 buffers allocated for a total size of 4096 [ 987.531897][T17769] binder_alloc: 17768: pid 17768 spamming oneway? 2 buffers allocated for a total size of 5120 [ 987.791074][T13687] usb 2-1: new high-speed USB device number 60 using dummy_hcd [ 987.965768][T13687] usb 2-1: Using ep0 maxpacket: 8 [ 987.987408][T13687] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 988.037596][T13687] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 988.100079][T13687] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 988.146038][T13687] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 988.197518][T13687] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 988.269579][T13687] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 988.535175][T13687] usb 2-1: GET_CAPABILITIES returned 0 [ 988.540755][T13687] usbtmc 2-1:16.0: can't read capabilities [ 988.741312][ T7693] usb 7-1: new high-speed USB device number 28 using dummy_hcd [ 988.797911][T13687] usb 2-1: USB disconnect, device number 60 [ 988.914320][ T7693] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 988.927897][ T7693] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 988.953076][ T7693] usb 7-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 988.968822][ T7693] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 988.978262][ T7693] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 989.001952][ T7693] usb 7-1: Product: syz [ 989.014625][ T7693] usb 7-1: Manufacturer: syz [ 989.035295][ T7693] usb 7-1: SerialNumber: syz [ 989.141971][ T7693] hub 7-1:1.0: bad descriptor, ignoring hub [ 989.170571][ T7693] hub 7-1:1.0: probe with driver hub failed with error -5 [ 989.323114][ T7693] usblp 7-1:1.0: usblp0: USB Unidirectional printer dev 28 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 989.657945][T17804] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3633'. [ 989.918395][T17807] binder_alloc: 17806: pid 17806 spamming oneway? 1 buffers allocated for a total size of 4096 [ 989.977113][T17808] binder_alloc: 17806: pid 17806 spamming oneway? 2 buffers allocated for a total size of 5120 [ 990.882007][ T43] usb 7-1: USB disconnect, device number 28 [ 990.895422][ T43] usblp0: removed [ 991.611601][T17825] 8021q: VLANs not supported on caif0 [ 991.668731][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805acdb000: rx timeout, send abort [ 991.677174][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff88805acdb000: 0x3ff00: (3) A timeout occurred and this is the connection abort to close the session. [ 993.151989][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 993.158609][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 994.112905][T17858] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3652'. [ 994.271186][T13687] usb 1-1: new high-speed USB device number 54 using dummy_hcd [ 994.463217][T13687] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 994.491056][T13687] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 994.526957][T13687] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 994.588695][T13687] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 994.611363][T13687] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 994.644586][T13687] usb 1-1: Product: syz [ 994.648916][T13687] usb 1-1: Manufacturer: syz [ 994.671364][T13687] usb 1-1: SerialNumber: syz [ 994.697423][T13687] hub 1-1:1.0: bad descriptor, ignoring hub [ 994.700651][T17866] binder_alloc: 17865: pid 17865 spamming oneway? 1 buffers allocated for a total size of 4096 [ 994.747414][T13687] hub 1-1:1.0: probe with driver hub failed with error -5 [ 994.750848][T17866] binder_alloc: 17865: pid 17865 spamming oneway? 2 buffers allocated for a total size of 5120 [ 994.898768][T13687] usblp 1-1:1.0: usblp0: USB Unidirectional printer dev 54 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 995.246640][T17879] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3659'. [ 995.319118][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805a780800: rx timeout, send abort [ 995.327806][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88805a780800: 0x3ff00: (3) A timeout occurred and this is the connection abort to close the session. [ 995.791171][ T5966] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 995.951047][ T5966] usb 6-1: device descriptor read/64, error -71 [ 996.030655][T17887] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3663'. [ 996.047135][T17887] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3663'. [ 996.281560][ T7693] usb 1-1: USB disconnect, device number 54 [ 996.301641][ T7693] usblp0: removed [ 996.305565][ T5966] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 996.931250][ T5966] usb 6-1: device descriptor read/64, error -71 [ 997.041268][ T5966] usb usb6-port1: attempt power cycle [ 997.181046][T14777] usb 4-1: new high-speed USB device number 68 using dummy_hcd [ 997.195183][T17896] openvswitch: netlink: Message has 8 unknown bytes. [ 997.202258][T17896] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 997.331029][T14777] usb 4-1: Using ep0 maxpacket: 32 [ 997.340077][T14777] usb 4-1: config 0 has an invalid interface number: 12 but max is 0 [ 997.350794][T14777] usb 4-1: config 0 has no interface number 0 [ 997.371182][T14777] usb 4-1: config 0 interface 12 has no altsetting 0 [ 997.395154][T14777] usb 4-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 997.420980][T14777] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 997.461330][ T5966] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 997.512555][T14777] usb 4-1: Product: syz [ 997.527759][T14777] usb 4-1: Manufacturer: syz [ 997.562444][ T5966] usb 6-1: device descriptor read/8, error -71 [ 997.605534][T14777] usb 4-1: SerialNumber: syz [ 997.664458][T14777] usb 4-1: config 0 descriptor?? [ 997.861128][ T5966] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 997.887538][ T5966] usb 6-1: device descriptor read/8, error -71 [ 997.911952][T14777] f81534 4-1:0.12: f81534_set_register: reg: 1002 data: 3 failed: -71 [ 997.929310][T14777] f81534 4-1:0.12: f81534_find_config_idx: read failed: -71 [ 997.950068][T14777] f81534 4-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 998.006491][T14777] f81534 4-1:0.12: probe with driver f81534 failed with error -71 [ 998.014968][ T5966] usb usb6-port1: unable to enumerate USB device [ 998.059459][T14777] usb 4-1: USB disconnect, device number 68 [ 998.841731][T17915] netlink: 'syz.1.3671': attribute type 10 has an invalid length. [ 998.850479][T17915] hsr0: entered promiscuous mode [ 998.859943][T17915] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 998.870583][T17915] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 998.883453][T17915] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 999.476275][T17918] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3674'. [ 999.548601][T17918] dummy0: entered promiscuous mode [ 999.562845][T17918] macvtap1: entered promiscuous mode [ 999.613917][T17918] macvtap1: entered allmulticast mode [ 999.637447][T17918] dummy0: entered allmulticast mode [ 999.941070][ T43] usb 4-1: new high-speed USB device number 69 using dummy_hcd [ 1000.080395][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805b50f000: rx timeout, send abort [ 1000.088985][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88805b50f000: 0x3ff00: (3) A timeout occurred and this is the connection abort to close the session. [ 1000.121052][ T43] usb 4-1: Using ep0 maxpacket: 16 [ 1000.128201][ T43] usb 4-1: config index 0 descriptor too short (expected 42, got 18) [ 1000.141126][ T43] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1000.151938][ T43] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1000.173221][ T43] usb 4-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice= 7.06 [ 1000.189432][ T43] usb 4-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 1000.209384][ T43] usb 4-1: Product: syz [ 1000.221979][ T43] usb 4-1: SerialNumber: syz [ 1000.239548][ T43] r8152-cfgselector 4-1: Unknown version 0x0000 [ 1000.248754][ T43] r8152-cfgselector 4-1: config 0 descriptor?? [ 1000.694285][ T43] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 1000.881108][ T43] usb 6-1: Using ep0 maxpacket: 32 [ 1000.892777][ T43] usb 6-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 1000.966028][ T43] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1001.051313][ T43] usb 6-1: config 0 descriptor?? [ 1001.285473][ T43] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 1001.319372][ T43] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1001.353309][ T43] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 1001.360548][ T43] usb 6-1: media controller created [ 1001.371434][T13742] usb 7-1: new high-speed USB device number 29 using dummy_hcd [ 1001.561384][T13742] usb 7-1: Using ep0 maxpacket: 16 [ 1001.591353][ T43] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1001.611940][T13742] usb 7-1: unable to read config index 0 descriptor/start: -61 [ 1001.624310][T17953] netlink: 'syz.0.3683': attribute type 10 has an invalid length. [ 1001.741085][T13742] usb 7-1: can't read configurations, error -61 [ 1001.881074][T13742] usb 7-1: new high-speed USB device number 30 using dummy_hcd [ 1001.889929][T17953] hsr0: entered promiscuous mode [ 1001.915868][T17953] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 1001.927595][T17953] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 1001.947878][T17953] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 1001.999362][ T5966] r8152-cfgselector 4-1: USB disconnect, device number 69 [ 1002.041165][T13742] usb 7-1: Using ep0 maxpacket: 16 [ 1002.094138][T13742] usb 7-1: unable to read config index 0 descriptor/start: -61 [ 1002.111566][T13742] usb 7-1: can't read configurations, error -61 [ 1002.139971][T13742] usb usb7-port1: attempt power cycle [ 1002.611230][T13742] usb 7-1: new high-speed USB device number 31 using dummy_hcd [ 1002.651942][T13742] usb 7-1: Using ep0 maxpacket: 16 [ 1002.673129][T13742] usb 7-1: unable to read config index 0 descriptor/start: -61 [ 1002.691492][T13742] usb 7-1: can't read configurations, error -61 [ 1002.799437][ T43] az6027: usb out operation failed. (-71) [ 1002.818222][ T43] az6027: usb out operation failed. (-71) [ 1002.826029][ T43] stb0899_attach: Driver disabled by Kconfig [ 1002.833513][ T43] az6027: no front-end attached [ 1002.833513][ T43] [ 1002.841471][ T43] az6027: usb out operation failed. (-71) [ 1002.841915][T13742] usb 7-1: new high-speed USB device number 32 using dummy_hcd [ 1002.859671][ T43] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 1002.888705][ T43] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.5/usb6/6-1/input/input132 [ 1002.924772][T13742] usb 7-1: Using ep0 maxpacket: 16 [ 1002.929090][ T43] dvb-usb: schedule remote query interval to 400 msecs. [ 1002.944042][T13742] usb 7-1: unable to read config index 0 descriptor/start: -61 [ 1002.947841][ T43] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 1002.971194][ T7692] usb 2-1: new high-speed USB device number 61 using dummy_hcd [ 1002.997961][T13742] usb 7-1: can't read configurations, error -61 [ 1003.000681][ T43] usb 6-1: USB disconnect, device number 36 [ 1003.037378][T13742] usb usb7-port1: unable to enumerate USB device [ 1003.132322][ T43] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 1003.171123][ T7692] usb 2-1: Using ep0 maxpacket: 8 [ 1003.192460][ T7692] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1003.208091][ T7692] usb 2-1: config 4 interface 0 has no altsetting 0 [ 1003.225803][ T7692] usb 2-1: string descriptor 0 read error: -22 [ 1003.236116][ T7692] usb 2-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 1003.247290][ T7692] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1003.274409][ T7692] usb 2-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 1003.306090][ T7692] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1003.333881][ T7692] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 1003.357109][ T7692] usb 2-1: media controller created [ 1003.447589][ T7692] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1003.494078][T17962] usb 2-1: dvb_usb_au6610: wlen=0, aborting [ 1003.690986][T17962] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1003.722801][T17962] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1003.953844][T17982] 8021q: VLANs not supported on caif0 [ 1004.581476][ T7692] zl10353_read_register: readreg error (reg=127, ret==0) [ 1004.921388][T17997] openvswitch: netlink: Message has 20 unknown bytes. [ 1005.010454][T17997] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1005.052202][T13687] usb 7-1: new high-speed USB device number 33 using dummy_hcd [ 1005.155099][T18003] netlink: 'syz.0.3701': attribute type 1 has an invalid length. [ 1005.360264][T18003] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1005.497099][T13687] usb 7-1: config 0 has no interfaces? [ 1005.541442][T13687] usb 7-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1005.566230][T13687] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1005.603875][T13687] usb 7-1: Product: syz [ 1005.624923][T13687] usb 7-1: Manufacturer: syz [ 1005.651162][T13687] usb 7-1: SerialNumber: syz [ 1005.880218][T13687] usb 7-1: config 0 descriptor?? [ 1005.911088][ T43] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 1005.938528][T18005] bond3: (slave veth7): Enslaving as an active interface with a down link [ 1006.069298][T18007] bond2: (slave veth0_to_bond): Releasing active interface [ 1006.071238][ T43] usb 6-1: Using ep0 maxpacket: 32 [ 1006.143722][ T43] usb 6-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 1006.164860][ T43] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1006.177373][T18007] bond3: (slave veth0_to_bond): making interface the new active one [ 1006.193687][ T43] usb 6-1: config 0 descriptor?? [ 1006.259734][T18007] veth0_to_bond: entered promiscuous mode [ 1006.620346][ T43] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 1006.651356][T18007] bond3: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 1006.688719][ T43] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1006.732768][ T43] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 1006.760744][ T43] usb 6-1: media controller created [ 1007.018937][ T43] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1008.656711][ T43] az6027: usb out operation failed. (-71) [ 1008.706368][ T43] az6027: usb out operation failed. (-71) [ 1008.769245][ T43] stb0899_attach: Driver disabled by Kconfig [ 1008.786535][ T43] az6027: no front-end attached [ 1008.786535][ T43] [ 1008.805583][ T43] az6027: usb out operation failed. (-71) [ 1008.828646][ T43] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 1008.879458][ T43] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.5/usb6/6-1/input/input133 [ 1008.978884][T13742] usb 7-1: USB disconnect, device number 33 [ 1008.979986][ T43] dvb-usb: schedule remote query interval to 400 msecs. [ 1009.035318][ T43] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 1009.079938][ T43] usb 6-1: USB disconnect, device number 37 [ 1009.111751][T18034] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3710'. [ 1009.330833][ T43] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 1009.479770][T18042] netlink: 'syz.0.3713': attribute type 10 has an invalid length. [ 1009.498645][T18042] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 1009.575699][T18042] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 1009.620796][T18042] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 1010.494720][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805a783400: rx timeout, send abort [ 1010.503731][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88805a783400: 0x3ff00: (3) A timeout occurred and this is the connection abort to close the session. [ 1011.801485][ T43] usb 6-1: new high-speed USB device number 38 using dummy_hcd [ 1011.978662][ T43] usb 6-1: config 0 has no interfaces? [ 1011.996568][ T43] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1012.010006][ T43] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1012.085366][ T43] usb 6-1: Product: syz [ 1012.103605][ T43] usb 6-1: Manufacturer: syz [ 1012.112627][ T43] usb 6-1: SerialNumber: syz [ 1012.128095][ T43] usb 6-1: config 0 descriptor?? [ 1013.642404][ T24] usb 7-1: new high-speed USB device number 34 using dummy_hcd [ 1013.795410][T18099] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1013.821099][ T24] usb 7-1: Using ep0 maxpacket: 16 [ 1013.840802][ T24] usb 7-1: unable to read config index 0 descriptor/start: -61 [ 1013.877095][ T24] usb 7-1: can't read configurations, error -61 [ 1014.070889][T18099] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1014.121400][ T24] usb 7-1: new high-speed USB device number 35 using dummy_hcd [ 1014.331075][ T24] usb 7-1: Using ep0 maxpacket: 16 [ 1014.350987][ T24] usb 7-1: unable to read config index 0 descriptor/start: -61 [ 1014.358691][ T24] usb 7-1: can't read configurations, error -61 [ 1014.365210][ T5966] usb 6-1: USB disconnect, device number 38 [ 1014.381528][ T24] usb usb7-port1: attempt power cycle [ 1014.766218][ T24] usb 7-1: new high-speed USB device number 36 using dummy_hcd [ 1014.791750][ T24] usb 7-1: Using ep0 maxpacket: 16 [ 1014.800084][ T24] usb 7-1: unable to read config index 0 descriptor/start: -61 [ 1014.808959][ T24] usb 7-1: can't read configurations, error -61 [ 1014.968674][ T24] usb 7-1: new high-speed USB device number 37 using dummy_hcd [ 1015.012267][ T24] usb 7-1: Using ep0 maxpacket: 16 [ 1015.023777][ T24] usb 7-1: unable to read config index 0 descriptor/start: -61 [ 1015.031726][ T24] usb 7-1: can't read configurations, error -61 [ 1015.040773][ T24] usb usb7-port1: unable to enumerate USB device [ 1015.152989][T18116] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3731'. [ 1015.163085][T18116] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3731'. [ 1015.173643][T18116] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3731'. [ 1015.533413][T18122] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3735'. [ 1015.728369][T18129] 8021q: VLANs not supported on caif0 [ 1016.651074][T13687] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 1016.833321][T13687] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1016.862421][T13687] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1016.884731][T13687] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1016.939251][T13687] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 1016.955511][T13687] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1016.986165][T13687] usb 1-1: Product: syz [ 1016.990424][T13687] usb 1-1: Manufacturer: syz [ 1017.009647][T13687] usb 1-1: SerialNumber: syz [ 1017.092035][T13687] hub 1-1:1.0: bad descriptor, ignoring hub [ 1017.100018][T13687] hub 1-1:1.0: probe with driver hub failed with error -5 [ 1017.200573][T18157] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3742'. [ 1017.343953][T13687] usblp 1-1:1.0: usblp0: USB Unidirectional printer dev 55 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 1018.221372][T18161] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3745'. [ 1018.237792][T18161] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3745'. [ 1018.259477][ C0] vcan0: j1939_tp_rxtimer: 0xffff888059c60c00: rx timeout, send abort [ 1018.268129][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff888059c60c00: 0x3ff00: (3) A timeout occurred and this is the connection abort to close the session. [ 1019.190668][T18168] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3749'. [ 1019.498121][T18177] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3748'. [ 1020.219606][T18177] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3748'. [ 1020.318088][ T3020] veth0_to_bond: left promiscuous mode [ 1020.450984][T14777] usb 1-1: USB disconnect, device number 55 [ 1020.487839][T18177] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3748'. [ 1020.556040][T14777] usblp0: removed [ 1021.161266][T18199] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(3) [ 1021.167894][T18199] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1021.237209][T18206] vhci_hcd vhci_hcd.0: pdev(0) rhport(1) sockfd(6) [ 1021.243816][T18206] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 1021.294225][T18199] vhci_hcd vhci_hcd.0: Device attached [ 1021.314151][T18206] vhci_hcd vhci_hcd.0: Device attached [ 1021.551763][T14777] usb 33-1: new low-speed USB device number 2 using vhci_hcd [ 1022.104117][T18217] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1022.149122][T18217] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1023.381983][T13687] usb 7-1: new high-speed USB device number 38 using dummy_hcd [ 1023.559027][T13687] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1023.622066][T13687] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1023.651674][T13687] usb 7-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1023.707399][T13687] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 1023.718575][T13687] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1023.730549][T13687] usb 7-1: Product: syz [ 1023.740820][T13687] usb 7-1: Manufacturer: syz [ 1023.762935][T13687] usb 7-1: SerialNumber: syz [ 1023.817714][T13687] hub 7-1:1.0: bad descriptor, ignoring hub [ 1023.823995][T13687] hub 7-1:1.0: probe with driver hub failed with error -5 [ 1024.021555][T13687] usblp 7-1:1.0: usblp0: USB Unidirectional printer dev 38 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 1024.235722][T18249] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3766'. [ 1024.246384][T18249] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3766'. [ 1024.259277][T18249] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3766'. [ 1025.042168][T18257] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1025.061497][T18257] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1025.471462][ T7691] usb 7-1: USB disconnect, device number 38 [ 1025.505935][ T7691] usblp0: removed [ 1025.743704][T18207] vhci_hcd: connection closed [ 1025.747761][ T1085] vhci_hcd: stop threads [ 1025.772645][T18200] vhci_hcd: connection reset by peer [ 1025.786300][ T1085] vhci_hcd: release socket [ 1025.798191][ T1085] vhci_hcd: disconnect device [ 1025.823487][ T1085] vhci_hcd: stop threads [ 1025.844144][ T1085] vhci_hcd: release socket [ 1025.868279][ T1085] vhci_hcd: disconnect device [ 1025.921899][T18272] syzkaller1: entered promiscuous mode [ 1025.929584][T18272] syzkaller1: entered allmulticast mode [ 1026.282394][T18278] 8021q: VLANs not supported on caif0 [ 1026.651264][T14777] vhci_hcd: vhci_device speed not set [ 1027.006373][T18289] netlink: 'syz.6.3779': attribute type 1 has an invalid length. [ 1027.144368][T18289] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1027.245661][T18297] bond2: (slave veth0_to_bond): Releasing active interface [ 1027.411499][T18297] bond3: (slave veth0_to_bond): making interface the new active one [ 1027.442554][T18297] bond3: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 1027.691006][ T24] usb 4-1: new high-speed USB device number 70 using dummy_hcd [ 1027.856072][T18296] bond3: (slave veth7): Enslaving as an active interface with a down link [ 1027.871516][ T24] usb 4-1: Using ep0 maxpacket: 32 [ 1027.886046][ T24] usb 4-1: config index 0 descriptor too short (expected 29220, got 36) [ 1027.897346][ T24] usb 4-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1028.002063][ T24] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1028.011618][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1028.036713][ T24] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1028.051596][ T24] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1028.123252][ T24] usb 4-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1028.132705][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1028.266950][ T24] usb 4-1: config 0 descriptor?? [ 1028.932901][T18305] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1028.947615][T18305] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1029.037958][ T24] usblp 4-1:0.0: usblp0: USB Bidirectional printer dev 70 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 1029.108159][ T24] usb 4-1: USB disconnect, device number 70 [ 1029.144848][ T24] usblp0: removed [ 1029.301395][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805d2f8000: rx timeout, send abort [ 1029.310371][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88805d2f8000: 0x3ff00: (3) A timeout occurred and this is the connection abort to close the session. [ 1029.378605][T18320] batadv_slave_1: entered promiscuous mode [ 1029.641056][ T24] usb 4-1: new high-speed USB device number 71 using dummy_hcd [ 1029.810425][ T24] usb 4-1: Using ep0 maxpacket: 32 [ 1029.844237][ T24] usb 4-1: config index 0 descriptor too short (expected 29220, got 36) [ 1029.869731][ T24] usb 4-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1029.918533][ T24] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1029.958781][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1029.995857][ T24] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1030.051313][ T24] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1030.064661][ T24] usb 4-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1030.234958][T18317] batadv_slave_1: left promiscuous mode [ 1030.261126][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1030.298224][ T24] usb 4-1: config 0 descriptor?? [ 1030.487850][ T24] usblp 4-1:0.0: usblp0: USB Bidirectional printer dev 71 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 1030.590702][ T24] usb 4-1: USB disconnect, device number 71 [ 1030.637394][ T24] usblp0: removed [ 1031.141756][T18339] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3790'. [ 1031.667028][T18343] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3792'. [ 1032.126626][T18351] netlink: 'syz.1.3795': attribute type 1 has an invalid length. [ 1032.565661][T18351] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1032.853223][T18361] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3798'. [ 1032.997461][T18356] bond1: (slave veth5): Enslaving as an active interface with a down link [ 1033.023214][T18357] bond1: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 1034.270230][T18380] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3805'. [ 1035.671404][ T7693] usb 6-1: new full-speed USB device number 39 using dummy_hcd [ 1035.844395][ T7693] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1035.906139][ T7693] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 2 [ 1035.992634][T18409] netlink: 'syz.1.3813': attribute type 1 has an invalid length. [ 1036.183619][ T7693] usb 6-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1036.214004][ T7693] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1036.314445][ T7693] usb 6-1: config 0 descriptor?? [ 1036.960781][T18409] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1037.263880][T18411] bond2: (slave veth7): Enslaving as an active interface with a down link [ 1037.362698][T18412] bond1: (slave veth0_to_bond): Releasing active interface [ 1037.377035][T18412] bond2: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 1037.509351][T18423] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3818'. [ 1038.167233][ T7691] usb 6-1: USB disconnect, device number 39 [ 1041.345303][T18474] bond3: (slave veth0_to_bond): Releasing active interface [ 1041.358708][T18474] bond3: (slave veth0_to_bond): the permanent HWaddr of slave - aa:aa:aa:aa:aa:1d - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 1041.641102][T14777] usb 6-1: new high-speed USB device number 40 using dummy_hcd [ 1041.968419][T14777] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1042.669767][ T30] audit: type=1326 audit(1752279657.700:1182): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18483 comm="syz.1.3837" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70fe539 code=0x7ffc0000 [ 1042.728251][T14777] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 1042.741065][T14777] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1042.756338][T14777] usb 6-1: Product: syz [ 1042.794404][ T30] audit: type=1326 audit(1752279657.700:1183): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18483 comm="syz.1.3837" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70fe539 code=0x7ffc0000 [ 1042.824679][T14777] usb 6-1: Manufacturer: syz [ 1042.826956][ T30] audit: type=1326 audit(1752279657.730:1184): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18483 comm="syz.1.3837" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf70fe558 code=0x7ffc0000 [ 1042.862892][T14777] usb 6-1: SerialNumber: syz [ 1042.909623][ T30] audit: type=1326 audit(1752279657.730:1185): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18483 comm="syz.1.3837" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf70fe558 code=0x7ffc0000 [ 1043.019485][ T30] audit: type=1326 audit(1752279657.730:1186): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18483 comm="syz.1.3837" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf70fe558 code=0x7ffc0000 [ 1043.090885][ T30] audit: type=1326 audit(1752279657.730:1187): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18483 comm="syz.1.3837" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf70fe558 code=0x7ffc0000 [ 1043.142364][T14777] usblp 6-1:1.0: usblp0: USB Unidirectional printer dev 40 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 1043.156311][ T30] audit: type=1326 audit(1752279657.730:1188): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18483 comm="syz.1.3837" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf70fe558 code=0x7ffc0000 [ 1043.214508][ T30] audit: type=1326 audit(1752279657.730:1189): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18483 comm="syz.1.3837" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf70fe558 code=0x7ffc0000 [ 1043.267725][ T30] audit: type=1326 audit(1752279657.730:1190): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18483 comm="syz.1.3837" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf70fe558 code=0x7ffc0000 [ 1043.308901][ T30] audit: type=1326 audit(1752279657.730:1191): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18483 comm="syz.1.3837" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf70fe558 code=0x7ffc0000 [ 1043.338938][T13687] usb 6-1: USB disconnect, device number 40 [ 1043.370723][T13687] usblp0: removed [ 1043.858264][T18501] 8021q: VLANs not supported on caif0 [ 1044.245601][T18513] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3843'. [ 1044.311102][T18513] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3843'. [ 1044.391029][T18513] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3843'. [ 1045.387165][T18535] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3853'. [ 1045.635950][T18541] 8021q: VLANs not supported on caif0 [ 1046.750242][T18562] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3862'. [ 1046.759800][T18562] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3862'. [ 1046.769462][T18562] netlink: 20 bytes leftover after parsing attributes in process `syz.6.3862'. [ 1047.667542][T13687] usb 6-1: new high-speed USB device number 41 using dummy_hcd [ 1048.124271][T13687] usb 6-1: config 0 has no interfaces? [ 1048.133737][T13687] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1048.143191][T13687] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1048.239121][T13687] usb 6-1: Product: syz [ 1048.244190][T13687] usb 6-1: Manufacturer: syz [ 1048.248846][T13687] usb 6-1: SerialNumber: syz [ 1048.276870][T13687] usb 6-1: config 0 descriptor?? [ 1048.537659][T18567] program syz.5.3864 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1048.561326][T18567] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 1050.365708][ T7691] usb 6-1: USB disconnect, device number 41 [ 1050.394895][T18610] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3877'. [ 1050.441189][T18610] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3877'. [ 1050.458278][T18610] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3877'. [ 1050.961035][ T7691] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 1051.501546][ T7691] usb 6-1: config 0 has no interfaces? [ 1051.509098][T18625] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3882'. [ 1051.579642][ T7691] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1051.630672][ T7691] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1051.659477][ T7691] usb 6-1: Product: syz [ 1051.668742][ T7691] usb 6-1: Manufacturer: syz [ 1051.701778][ T7691] usb 6-1: SerialNumber: syz [ 1051.713365][ T7691] usb 6-1: config 0 descriptor?? [ 1053.188253][T18651] netlink: 51 bytes leftover after parsing attributes in process `syz.6.3892'. [ 1053.629493][T18658] netlink: 28 bytes leftover after parsing attributes in process `syz.6.3895'. [ 1053.817604][ T7691] usb 6-1: USB disconnect, device number 42 [ 1054.590841][T18677] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1054.601772][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 1054.608376][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 1054.637520][T18677] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1055.755001][T18691] fuse: Unknown parameter 'grou00000000000000000000' [ 1057.011439][T14777] usb 1-1: new high-speed USB device number 56 using dummy_hcd [ 1057.174530][T14777] usb 1-1: config 0 has no interfaces? [ 1057.184291][T14777] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1057.214645][T14777] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1057.262508][T14777] usb 1-1: Product: syz [ 1057.304224][T14777] usb 1-1: Manufacturer: syz [ 1057.308906][T14777] usb 1-1: SerialNumber: syz [ 1057.324368][T14777] usb 1-1: config 0 descriptor?? [ 1058.311217][T13687] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 1058.471024][T13687] usb 4-1: Using ep0 maxpacket: 16 [ 1058.479072][T13687] usb 4-1: config 0 has an invalid interface number: 8 but max is 0 [ 1058.488035][T13687] usb 4-1: config 0 has an invalid descriptor of length 143, skipping remainder of the config [ 1058.541836][T13687] usb 4-1: config 0 has no interface number 0 [ 1058.550392][T13687] usb 4-1: config 0 interface 8 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1058.572105][T13687] usb 4-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 1058.609677][T13687] usb 4-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 1058.638712][T13687] usb 4-1: Product: syz [ 1058.643523][T13687] usb 4-1: SerialNumber: syz [ 1058.676750][T13687] usb 4-1: config 0 descriptor?? [ 1058.756222][T13687] usbhid 4-1:0.8: couldn't find an input interrupt endpoint [ 1058.980839][T13687] usb 4-1: USB disconnect, device number 72 [ 1059.829926][T14777] usb 1-1: USB disconnect, device number 56 [ 1060.053717][T18736] 8021q: VLANs not supported on caif0 [ 1060.674865][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805a780000: rx timeout, send abort [ 1060.683408][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88805a780000: 0x3ff00: (3) A timeout occurred and this is the connection abort to close the session. [ 1061.271152][ T7693] usb 1-1: new high-speed USB device number 57 using dummy_hcd [ 1061.421233][ T7693] usb 1-1: Using ep0 maxpacket: 16 [ 1061.478755][ T7693] usb 1-1: config 0 has an invalid interface number: 8 but max is 0 [ 1061.495415][ T7693] usb 1-1: config 0 has no interface number 0 [ 1061.504581][ T7693] usb 1-1: config 0 interface 8 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1061.532463][T14777] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 1061.553941][ T7693] usb 1-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 1061.568030][ T7693] usb 1-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 1061.580695][ T7693] usb 1-1: Product: syz [ 1061.606892][ T7693] usb 1-1: SerialNumber: syz [ 1061.629733][ T7693] usb 1-1: config 0 descriptor?? [ 1061.644821][ T7693] usbhid 1-1:0.8: couldn't find an input interrupt endpoint [ 1061.712173][T14777] usb 4-1: Using ep0 maxpacket: 8 [ 1061.720527][T14777] usb 4-1: config 0 has an invalid interface number: 55 but max is 0 [ 1061.735646][T14777] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1061.754587][T14777] usb 4-1: config 0 has no interface number 0 [ 1061.831424][T14777] usb 4-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1061.847833][ T7693] usb 1-1: USB disconnect, device number 57 [ 1061.883152][T18771] netlink: 'syz.5.3931': attribute type 1 has an invalid length. [ 1062.001034][T14777] usb 4-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1062.010179][T14777] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1062.028270][T18771] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1062.067493][T14777] usb 4-1: config 0 descriptor?? [ 1062.078373][T18775] bond1: (slave veth0_to_bond): Releasing active interface [ 1062.095546][T18775] bond1: (slave vlan0): making interface the new active one [ 1062.107960][T18775] veth1: entered promiscuous mode [ 1062.114721][T14777] ldusb 4-1:0.55: Interrupt in endpoint not found [ 1062.125770][T18775] vlan0: entered promiscuous mode [ 1062.173424][T18775] bond2: (slave veth0_to_bond): making interface the new active one [ 1062.184275][T18775] bond2: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 1062.333161][T14777] usb 4-1: USB disconnect, device number 73 [ 1064.590975][ T7691] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 1064.791571][ T7691] usb 4-1: Using ep0 maxpacket: 16 [ 1064.861032][ T7691] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1064.960929][ T7691] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1064.995907][ T7691] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1065.203033][ T7691] usb 4-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 1065.248743][ T7691] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1065.268001][ T7691] usb 4-1: config 0 descriptor?? [ 1065.746553][T18812] random: crng reseeded on system resumption [ 1066.946572][T18846] fuse: Unknown parameter 'group_i00000000000000000000' [ 1067.061027][T14777] usb 1-1: new high-speed USB device number 58 using dummy_hcd [ 1067.222578][T14777] usb 1-1: Using ep0 maxpacket: 8 [ 1067.239310][T14777] usb 1-1: config 0 has an invalid interface number: 55 but max is 0 [ 1067.249176][T14777] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1067.296717][T14777] usb 1-1: config 0 has no interface number 0 [ 1067.316410][T14777] usb 1-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1067.351930][T14777] usb 1-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1067.383372][T14777] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1067.422314][T14777] usb 1-1: config 0 descriptor?? [ 1067.438185][T14777] ldusb 1-1:0.55: Interrupt in endpoint not found [ 1067.509174][ T7691] usbhid 4-1:0.0: can't add hid device: -71 [ 1067.515390][ T7691] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 1067.537865][ T7691] usb 4-1: USB disconnect, device number 74 [ 1067.648971][T13687] usb 1-1: USB disconnect, device number 58 [ 1067.917623][T18858] 8021q: VLANs not supported on caif0 [ 1068.872846][T18878] ptrace attach of "./syz-executor exec"[12806] was attempted by "./syz-executor exec"[18878] [ 1069.067096][T18882] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3962'. [ 1069.086824][T18882] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 1069.094710][T18882] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1069.771735][T18889] netlink: 76 bytes leftover after parsing attributes in process `syz.0.3966'. [ 1069.783981][T18889] misc userio: No port type given on /dev/userio [ 1069.792106][T18889] misc userio: The device must be registered before sending interrupts [ 1069.815931][T18889] netlink: 'syz.0.3966': attribute type 1 has an invalid length. [ 1070.027142][T18889] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1070.045429][T18891] bond4: (slave geneve2): making interface the new active one [ 1070.062885][T18891] bond4: (slave geneve2): Enslaving as an active interface with an up link [ 1070.384049][T18895] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3968'. [ 1070.588453][T18900] bridge0: port 4(syz_tun) entered blocking state [ 1070.651099][ T43] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 1070.732824][T18900] bridge0: port 4(syz_tun) entered disabled state [ 1070.761292][T18900] syz_tun: entered allmulticast mode [ 1070.793462][T18900] syz_tun: entered promiscuous mode [ 1070.856642][T18900] bridge0: port 4(syz_tun) entered blocking state [ 1070.863527][T18900] bridge0: port 4(syz_tun) entered forwarding state [ 1070.881200][ T43] usb 4-1: Using ep0 maxpacket: 32 [ 1070.906764][ T43] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 1070.931841][ T43] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1071.022202][ T43] usb 4-1: config 0 descriptor?? [ 1071.250154][ T43] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 1071.397504][ T43] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1071.448177][T18909] 8021q: VLANs not supported on caif0 [ 1071.481975][ T43] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 1071.497941][T18895] netlink: 16178 bytes leftover after parsing attributes in process `syz.3.3968'. [ 1071.543836][ T43] usb 4-1: media controller created [ 1071.642676][ T43] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1071.717107][ T43] az6027: usb out operation failed. (-71) [ 1071.765997][ T43] az6027: usb out operation failed. (-71) [ 1071.782991][ T43] stb0899_attach: Driver disabled by Kconfig [ 1071.799246][ T43] az6027: no front-end attached [ 1071.799246][ T43] [ 1071.817113][ T43] az6027: usb out operation failed. (-71) [ 1071.831799][ T43] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 1071.860349][ T43] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input135 [ 1071.925495][ T43] dvb-usb: schedule remote query interval to 400 msecs. [ 1071.951042][ T43] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 1072.025761][ T43] usb 4-1: USB disconnect, device number 75 [ 1072.245129][ T43] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 1072.403158][T18928] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3979'. [ 1072.444820][T18930] bridge0: port 3(syz_tun) entered blocking state [ 1072.556282][T18930] bridge0: port 3(syz_tun) entered disabled state [ 1072.605293][T18930] syz_tun: entered allmulticast mode [ 1072.615967][T18930] syz_tun: entered promiscuous mode [ 1072.634892][T18930] bridge0: port 3(syz_tun) entered blocking state [ 1072.641620][T18930] bridge0: port 3(syz_tun) entered forwarding state [ 1072.686501][T18937] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3980'. [ 1073.687349][T18948] netlink: 'syz.6.3983': attribute type 1 has an invalid length. [ 1073.949610][T18948] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1074.292909][T18955] bond4: (slave veth9): Enslaving as an active interface with a down link [ 1074.338282][T18948] bond4: (slave veth0_to_bond): making interface the new active one [ 1074.359320][T18948] veth0_to_bond: entered promiscuous mode [ 1074.375513][T18948] bond4: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 1074.877596][T18959] 8021q: VLANs not supported on caif0 [ 1075.513520][T18969] tmpfs: Unknown parameter 'f' [ 1075.588809][ T13] vlan0: left promiscuous mode [ 1076.139102][T18985] netlink: 'syz.5.3994': attribute type 12 has an invalid length. [ 1077.602853][T13687] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 1078.782299][T13687] usb 4-1: Using ep0 maxpacket: 8 [ 1078.822635][T13687] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1078.934178][T13687] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1079.060643][T13687] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1079.141095][T13687] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1079.204754][T13687] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1079.225164][T13687] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1079.444273][T13687] usb 4-1: GET_CAPABILITIES returned 0 [ 1079.470998][T13687] usbtmc 4-1:16.0: can't read capabilities [ 1079.724372][T13687] usb 4-1: USB disconnect, device number 76 [ 1080.703746][ T30] kauditd_printk_skb: 17 callbacks suppressed [ 1080.703768][ T30] audit: type=1326 audit(1752279695.760:1209): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19035 comm="syz.0.4010" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70fe539 code=0x7ffc0000 [ 1080.746869][T19045] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4010'. [ 1080.848678][ T30] audit: type=1326 audit(1752279695.760:1210): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19035 comm="syz.0.4010" exe="/root/syz-executor" sig=0 arch=40000003 syscall=430 compat=1 ip=0xf70fe539 code=0x7ffc0000 [ 1080.921018][ T30] audit: type=1326 audit(1752279695.760:1211): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19035 comm="syz.0.4010" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70fe539 code=0x7ffc0000 [ 1081.226457][ T30] audit: type=1326 audit(1752279695.760:1212): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19035 comm="syz.0.4010" exe="/root/syz-executor" sig=0 arch=40000003 syscall=220 compat=1 ip=0xf70fe539 code=0x7ffc0000 [ 1081.297797][ T30] audit: type=1326 audit(1752279695.760:1213): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19035 comm="syz.0.4010" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70fe539 code=0x7ffc0000 [ 1081.431230][ T30] audit: type=1326 audit(1752279695.760:1214): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19035 comm="syz.0.4010" exe="/root/syz-executor" sig=0 arch=40000003 syscall=357 compat=1 ip=0xf70fe539 code=0x7ffc0000 [ 1081.492025][ T30] audit: type=1326 audit(1752279695.760:1215): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19035 comm="syz.0.4010" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70fe539 code=0x7ffc0000 [ 1081.551256][ T30] audit: type=1326 audit(1752279695.760:1216): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19035 comm="syz.0.4010" exe="/root/syz-executor" sig=0 arch=40000003 syscall=102 compat=1 ip=0xf70fe539 code=0x7ffc0000 [ 1081.581064][ T30] audit: type=1326 audit(1752279695.760:1217): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19035 comm="syz.0.4010" exe="/root/syz-executor" sig=0 arch=40000003 syscall=102 compat=1 ip=0xf70fe539 code=0x7ffc0000 [ 1081.603924][ T30] audit: type=1326 audit(1752279695.760:1218): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19035 comm="syz.0.4010" exe="/root/syz-executor" sig=0 arch=40000003 syscall=102 compat=1 ip=0xf70fe539 code=0x7ffc0000 [ 1081.651545][T19057] 8021q: VLANs not supported on caif0 [ 1082.691837][T19074] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1082.721515][T19074] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1082.941690][T19083] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4022'. [ 1082.961050][T19083] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4022'. [ 1082.978146][T19083] netlink: 20 bytes leftover after parsing attributes in process `syz.5.4022'. [ 1083.235214][T19089] netlink: 'syz.3.4025': attribute type 1 has an invalid length. [ 1083.573857][T19089] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1083.921811][T19091] bond3: (slave veth7): Enslaving as an active interface with a down link [ 1084.056199][T19093] bond2: (slave veth0_to_bond): Releasing active interface [ 1084.096835][T19093] bond3: (slave veth0_to_bond): making interface the new active one [ 1084.123929][T19093] veth0_to_bond: entered promiscuous mode [ 1084.134255][T19093] bond3: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 1084.697121][T19111] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4031'. [ 1084.959750][T19118] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4030'. [ 1084.968833][T19118] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4030'. [ 1085.763894][T13687] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 1086.021539][T13687] usb 4-1: Using ep0 maxpacket: 8 [ 1086.148795][T13687] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1086.277628][T13687] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1086.304336][T13687] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1086.329415][T13687] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1086.536062][T13687] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1086.548149][T13687] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1086.807168][T19140] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1086.817432][T13687] usb 4-1: GET_CAPABILITIES returned 0 [ 1086.831662][T13687] usbtmc 4-1:16.0: can't read capabilities [ 1086.852109][T19140] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1086.967407][T19145] netlink: 'syz.6.4039': attribute type 1 has an invalid length. [ 1087.061068][T13687] usb 4-1: USB disconnect, device number 77 [ 1087.155166][T19145] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1087.164108][T19139] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1087.182714][T19139] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1087.525317][T19149] bond5: (slave veth11): Enslaving as an active interface with a down link [ 1087.566359][T19151] bond4: (slave veth0_to_bond): Releasing active interface [ 1087.601770][T19151] veth0_to_bond: left promiscuous mode [ 1087.745482][T19151] bond5: (slave veth0_to_bond): making interface the new active one [ 1087.767125][T19162] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4041'. [ 1087.779052][T19162] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4041'. [ 1087.788444][T19162] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4041'. [ 1087.807259][T13275] usb 6-1: new high-speed USB device number 43 using dummy_hcd [ 1087.881870][T19151] veth0_to_bond: entered promiscuous mode [ 1087.944976][T19151] bond5: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 1088.030807][T19165] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4043'. [ 1088.161220][T13275] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1088.179868][T13275] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1088.255263][T13275] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1088.361657][T13275] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 1088.447386][T13275] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1088.472919][T13275] usb 6-1: Product: syz [ 1088.487762][T13275] usb 6-1: Manufacturer: syz [ 1088.508134][T13275] usb 6-1: SerialNumber: syz [ 1088.593726][T13275] hub 6-1:1.0: bad descriptor, ignoring hub [ 1088.609861][T13275] hub 6-1:1.0: probe with driver hub failed with error -5 [ 1088.833956][T13275] usblp 6-1:1.0: usblp0: USB Unidirectional printer dev 43 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 1090.404024][T19195] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4055'. [ 1090.501086][ T7691] usb 1-1: new high-speed USB device number 59 using dummy_hcd [ 1090.692727][T19203] ptrace attach of "./syz-executor exec"[13647] was attempted by "./syz-executor exec"[19203] [ 1090.791042][ T7691] usb 1-1: Using ep0 maxpacket: 8 [ 1090.811821][ T24] usb 6-1: USB disconnect, device number 43 [ 1090.830004][ T7691] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1090.840100][ T24] usblp0: removed [ 1090.990261][ T7691] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1091.219297][ T7691] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1091.282904][ T7691] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1091.370283][ T7691] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1091.410024][ T7691] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1092.190596][ T7691] usb 1-1: GET_CAPABILITIES returned 0 [ 1092.237237][ T7691] usbtmc 1-1:16.0: can't read capabilities [ 1092.352672][T19223] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4058'. [ 1092.363056][T19223] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4058'. [ 1092.374543][T19223] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4058'. [ 1092.400822][T19220] netlink: 'syz.5.4059': attribute type 10 has an invalid length. [ 1092.409641][T19220] hsr0: entered promiscuous mode [ 1092.417176][T19220] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 1092.444326][ T43] usb 1-1: USB disconnect, device number 59 [ 1092.499049][T19220] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 1092.581889][T19220] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 1093.351771][T19236] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1093.360772][T19236] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1093.426469][T19239] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4062'. [ 1093.438263][T19239] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4062'. [ 1093.447577][T19239] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4062'. [ 1093.922903][T19249] netlink: 51 bytes leftover after parsing attributes in process `syz.6.4066'. [ 1094.660036][T19266] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4070'. [ 1094.877405][T19267] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4071'. [ 1094.886885][T19267] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4071'. [ 1094.901205][T19267] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4071'. [ 1095.715297][ T43] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 1095.872427][ T43] usb 4-1: Using ep0 maxpacket: 8 [ 1096.151401][ T43] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1096.207941][ T43] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1096.229027][ T43] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1096.293172][ T43] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1096.335519][ T43] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1096.345350][ T43] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1096.836694][ T43] usb 4-1: GET_CAPABILITIES returned 0 [ 1096.879354][ T43] usbtmc 4-1:16.0: can't read capabilities [ 1097.090080][T13742] usb 4-1: USB disconnect, device number 78 [ 1097.163029][ T4514] veth0_to_bond: left promiscuous mode [ 1098.082779][T19309] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4083'. [ 1098.092053][T19309] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4083'. [ 1099.161110][T14777] usb 1-1: new high-speed USB device number 60 using dummy_hcd [ 1099.241106][T13687] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 1099.311507][T14777] usb 1-1: Using ep0 maxpacket: 8 [ 1099.319343][T14777] usb 1-1: config 0 has an invalid interface number: 55 but max is 0 [ 1099.330796][T14777] usb 1-1: config 0 has no interface number 0 [ 1099.337135][T14777] usb 1-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1099.402371][T13687] usb 4-1: Using ep0 maxpacket: 8 [ 1099.413447][T13687] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1099.431241][T13687] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1099.445493][T13687] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1099.459546][T13687] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1099.480315][T14777] usb 1-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1099.496065][T14777] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1099.496336][T13687] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1099.535845][T13687] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1099.604052][T14777] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 1099.633867][T14777] usb 1-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1099.645061][T19337] __nla_validate_parse: 2 callbacks suppressed [ 1099.645086][T19337] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4093'. [ 1099.684604][T14777] usb 1-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1099.712617][T14777] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1099.766387][T14777] usb 1-1: config 0 descriptor?? [ 1099.834537][T14777] ldusb 1-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1100.007086][T19315] ldusb 1-1:0.55: Couldn't submit interrupt_in_urb -90 [ 1100.035000][T13275] usb 1-1: USB disconnect, device number 60 [ 1100.080721][T13275] ldusb 1-1:0.55: LD USB Device #0 now disconnected [ 1100.297533][T13687] usb 4-1: GET_CAPABILITIES returned 0 [ 1100.449109][T13687] usbtmc 4-1:16.0: can't read capabilities [ 1100.461700][T13687] usb 4-1: USB disconnect, device number 79 [ 1100.686955][ T49] veth0_to_bond: left promiscuous mode [ 1101.597337][T19369] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4100'. [ 1101.606560][T19369] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4100'. [ 1101.615646][T19369] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4100'. [ 1101.664144][T19365] PKCS7: Unknown OID: [5] (bad) [ 1101.670378][T19365] PKCS7: Only support pkcs7_signedData type [ 1101.912449][T13275] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 1101.948601][T19373] 8021q: VLANs not supported on caif0 [ 1102.070974][T13275] usb 4-1: Using ep0 maxpacket: 16 [ 1102.135459][T13275] usb 4-1: config 0 has an invalid interface number: 161 but max is 0 [ 1102.145685][T13275] usb 4-1: config 0 has no interface number 0 [ 1102.166411][T13275] usb 4-1: config 0 interface 161 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 64 [ 1102.186243][T13275] usb 4-1: New USB device found, idVendor=0bfd, idProduct=0102, bcdDevice=9a.fd [ 1102.196938][T13275] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1102.207027][T13275] usb 4-1: Product: syz [ 1102.212577][T13275] usb 4-1: Manufacturer: syz [ 1102.217299][T13275] usb 4-1: SerialNumber: syz [ 1102.226132][T13275] usb 4-1: config 0 descriptor?? [ 1102.239574][T19368] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 1102.253379][T13275] kvaser_usb 4-1:0.161: error -ENODEV: Cannot get usb endpoint(s) [ 1104.804993][T19406] raw_sendmsg: syz.0.4112 forgot to set AF_INET. Fix it! [ 1104.871259][T13742] usb 4-1: USB disconnect, device number 80 [ 1104.913753][T19408] 8021q: VLANs not supported on caif0 [ 1105.337679][T19421] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4114'. [ 1105.821706][T19428] netlink: 51 bytes leftover after parsing attributes in process `syz.1.4117'. [ 1110.959290][T19489] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4132'. [ 1112.162631][T19514] PKCS7: Unknown OID: [5] (bad) [ 1112.176263][T19514] PKCS7: Only support pkcs7_signedData type [ 1112.663195][T13742] usb 1-1: new high-speed USB device number 61 using dummy_hcd [ 1112.977199][T13742] usb 1-1: Using ep0 maxpacket: 16 [ 1113.016808][T13742] usb 1-1: config 0 has an invalid interface number: 161 but max is 0 [ 1113.040978][T13742] usb 1-1: config 0 has no interface number 0 [ 1113.111051][T13742] usb 1-1: config 0 interface 161 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 64 [ 1113.222768][T13742] usb 1-1: New USB device found, idVendor=0bfd, idProduct=0102, bcdDevice=9a.fd [ 1113.236072][T19526] 8021q: VLANs not supported on caif0 [ 1113.250984][T13742] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1113.269424][T13742] usb 1-1: Product: syz [ 1113.279535][T13742] usb 1-1: Manufacturer: syz [ 1113.291317][T13742] usb 1-1: SerialNumber: syz [ 1113.310304][T13742] usb 1-1: config 0 descriptor?? [ 1113.343020][T19514] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 1113.354844][T13742] kvaser_usb 1-1:0.161: error -ENODEV: Cannot get usb endpoint(s) [ 1114.842258][T19548] netlink: 72 bytes leftover after parsing attributes in process `syz.5.4153'. [ 1115.578892][ T43] usb 1-1: USB disconnect, device number 61 [ 1115.617588][T19569] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4157'. [ 1115.831026][ T24] usb 6-1: new high-speed USB device number 44 using dummy_hcd [ 1116.039065][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 1116.045481][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 1116.328120][ T24] usb 6-1: Using ep0 maxpacket: 32 [ 1116.414209][ T24] usb 6-1: config index 0 descriptor too short (expected 29220, got 36) [ 1116.446850][ T24] usb 6-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1116.490248][ T24] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1116.545823][ T24] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1116.572479][ T24] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1116.587172][ T24] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1116.610022][ T24] usb 6-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1116.620025][ T24] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1116.691735][ T24] usb 6-1: config 0 descriptor?? [ 1116.922337][ T24] usblp 6-1:0.0: usblp0: USB Bidirectional printer dev 44 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 1117.038995][ T24] usb 6-1: USB disconnect, device number 44 [ 1117.109053][ T24] usblp0: removed [ 1117.513638][ T24] usb 6-1: new high-speed USB device number 45 using dummy_hcd [ 1117.735147][ T24] usb 6-1: Using ep0 maxpacket: 32 [ 1117.744256][ T24] usb 6-1: config index 0 descriptor too short (expected 29220, got 36) [ 1117.756140][ T24] usb 6-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1117.771107][T19597] netlink: 'syz.6.4168': attribute type 1 has an invalid length. [ 1117.792551][ T24] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1117.810944][ T24] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1117.836287][ T24] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1117.857454][ T24] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1117.950810][ T24] usb 6-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1118.006996][T19597] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1118.007079][ T24] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1118.070792][ T24] usb 6-1: config 0 descriptor?? [ 1118.118878][T19598] bond6: (slave veth13): Enslaving as an active interface with a down link [ 1118.177472][T19600] bond5: (slave veth0_to_bond): Releasing active interface [ 1118.199540][T19600] bond6: (slave veth0_to_bond): making interface the new active one [ 1118.244962][T19600] veth0_to_bond: entered promiscuous mode [ 1118.257518][T19600] bond6: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 1118.304492][ T24] usblp 6-1:0.0: usblp0: USB Bidirectional printer dev 45 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 1118.529094][ T24] usb 6-1: USB disconnect, device number 45 [ 1118.546750][ T24] usblp0: removed [ 1118.787513][T19614] nvme_fabrics: unknown parameter or missing value '+cpuacct ' in ctrl creation request [ 1121.600978][ T7691] usb 1-1: new high-speed USB device number 62 using dummy_hcd [ 1121.652009][ T24] usb 4-1: new high-speed USB device number 81 using dummy_hcd [ 1121.843678][ T24] usb 4-1: Using ep0 maxpacket: 8 [ 1121.855778][ T24] usb 4-1: config 0 has an invalid interface number: 55 but max is 0 [ 1121.867879][ T24] usb 4-1: config 0 has no interface number 0 [ 1121.874875][ T24] usb 4-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1121.881043][ T7691] usb 1-1: Using ep0 maxpacket: 32 [ 1121.960944][ T24] usb 4-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1122.014325][ T24] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1122.017074][ T7691] usb 1-1: config index 0 descriptor too short (expected 29220, got 36) [ 1122.045581][ T7691] usb 1-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1122.072724][ T24] usb 4-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1122.072913][ T7691] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1122.118674][ T7691] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1122.140921][ T7691] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1122.153218][ T24] usb 4-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1122.172176][ T7691] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1122.187472][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1122.213150][ T7691] usb 1-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1122.230694][ T7691] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1122.287156][ T24] usb 4-1: config 0 descriptor?? [ 1122.294580][ T7691] usb 1-1: config 0 descriptor?? [ 1122.322428][ T24] ldusb 4-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1122.511024][ T7691] usblp 1-1:0.0: usblp1: USB Bidirectional printer dev 62 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 1122.571576][ T7691] usb 1-1: USB disconnect, device number 62 [ 1122.587387][ T7691] usblp1: removed [ 1123.056059][ T7691] usb 1-1: new high-speed USB device number 63 using dummy_hcd [ 1123.300936][ T7691] usb 1-1: Using ep0 maxpacket: 32 [ 1123.505783][ T7691] usb 1-1: config index 0 descriptor too short (expected 29220, got 36) [ 1123.519849][ T7691] usb 1-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1123.537216][ T7691] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1123.553906][ T7691] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1123.570994][ T7691] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1123.659393][ T7691] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1123.828661][ T7691] usb 1-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1123.842124][ T7691] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1123.884033][ T7691] usb 1-1: config 0 descriptor?? [ 1123.947862][ C1] ldusb 4-1:0.55: usb_submit_urb failed (-1) [ 1123.957177][T13687] usb 4-1: USB disconnect, device number 81 [ 1123.988507][T13687] ldusb 4-1:0.55: LD USB Device #0 now disconnected [ 1124.127310][ T7691] usblp 1-1:0.0: usblp0: USB Bidirectional printer dev 63 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 1124.321917][ T7691] usb 1-1: USB disconnect, device number 63 [ 1124.330411][ T7691] usblp0: removed [ 1124.807051][T19691] netlink: 44 bytes leftover after parsing attributes in process `syz.5.4199'. [ 1124.857304][T19691] netlink: 4388 bytes leftover after parsing attributes in process `syz.5.4199'. [ 1125.511048][T13275] usb 6-1: new high-speed USB device number 46 using dummy_hcd [ 1125.671378][T13275] usb 6-1: Using ep0 maxpacket: 32 [ 1125.725255][T13275] usb 6-1: config index 0 descriptor too short (expected 29220, got 36) [ 1125.739616][T13275] usb 6-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1125.750378][T13275] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1125.766028][T13275] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1125.777937][T13275] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1125.793374][T13275] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1125.808379][T13275] usb 6-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1125.819943][T13275] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1125.840723][T13275] usb 6-1: config 0 descriptor?? [ 1126.066539][T13275] usblp 6-1:0.0: usblp0: USB Bidirectional printer dev 46 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 1126.133383][T13275] usb 6-1: USB disconnect, device number 46 [ 1126.185941][T13275] usblp0: removed [ 1126.251419][ T24] usb 1-1: new high-speed USB device number 64 using dummy_hcd [ 1126.798588][ T24] usb 1-1: Using ep0 maxpacket: 8 [ 1126.814943][ T24] usb 1-1: config 0 has an invalid interface number: 55 but max is 0 [ 1126.823806][ T24] usb 1-1: config 0 has no interface number 0 [ 1126.829927][ T24] usb 1-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1126.858716][ T24] usb 1-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1126.909869][ T24] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1126.936507][ T24] usb 1-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1126.976068][ T24] usb 1-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1127.004188][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1127.021059][T13275] usb 6-1: new high-speed USB device number 47 using dummy_hcd [ 1127.038142][ T24] usb 1-1: config 0 descriptor?? [ 1127.067899][ T24] ldusb 1-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1127.191114][T13275] usb 6-1: Using ep0 maxpacket: 32 [ 1127.198251][T13275] usb 6-1: config index 0 descriptor too short (expected 29220, got 36) [ 1127.207726][T13275] usb 6-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1127.259758][T13275] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1127.323079][T13275] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1127.348655][T13275] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1127.363938][T13275] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1127.379646][T13275] usb 6-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1127.389857][T13275] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1127.405152][T13275] usb 6-1: config 0 descriptor?? [ 1127.619340][T13275] usblp 6-1:0.0: usblp1: USB Bidirectional printer dev 47 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 1128.637585][T19729] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1128.646882][T19729] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1128.672821][ T7691] usb 1-1: USB disconnect, device number 64 [ 1128.678825][ C0] ldusb 1-1:0.55: usb_submit_urb failed (-19) [ 1128.688137][T13742] usb 6-1: USB disconnect, device number 47 [ 1128.724010][T13742] usblp1: removed [ 1128.737956][ T7691] ldusb 1-1:0.55: LD USB Device #0 now disconnected [ 1128.873961][T19729] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1128.894354][T19729] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1130.096368][T19757] netlink: 'syz.3.4221': attribute type 1 has an invalid length. [ 1130.161065][T19730] usb 6-1: new high-speed USB device number 48 using dummy_hcd [ 1130.201422][T19757] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1130.379036][T19759] bond4: (slave veth9): Enslaving as an active interface with a down link [ 1130.556809][T19730] usb 6-1: config 0 has no interfaces? [ 1130.570408][T19757] bond3: (slave veth0_to_bond): Releasing active interface [ 1130.581256][T19730] usb 6-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 1130.602655][T19730] usb 6-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 1130.669501][T19730] usb 6-1: Manufacturer: syz [ 1130.680209][T19730] usb 6-1: config 0 descriptor?? [ 1130.712705][T19757] bond4: (slave veth0_to_bond): making interface the new active one [ 1130.754044][T19757] veth0_to_bond: entered promiscuous mode [ 1130.854434][T19757] bond4: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 1130.899094][T19774] PKCS7: Unknown OID: [5] (bad) [ 1130.904597][T19774] PKCS7: Only support pkcs7_signedData type [ 1131.064818][T13742] usb 6-1: USB disconnect, device number 48 [ 1131.105039][ T3020] veth0_to_bond: left promiscuous mode [ 1131.194993][T19730] usb 1-1: new high-speed USB device number 65 using dummy_hcd [ 1131.511146][T19730] usb 1-1: Using ep0 maxpacket: 16 [ 1131.539210][T19730] usb 1-1: config 0 has an invalid interface number: 161 but max is 0 [ 1131.548058][T19730] usb 1-1: config 0 has no interface number 0 [ 1131.568085][T19730] usb 1-1: config 0 interface 161 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 64 [ 1131.825900][T19730] usb 1-1: New USB device found, idVendor=0bfd, idProduct=0102, bcdDevice=9a.fd [ 1131.845143][T19781] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1131.854593][T19730] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1131.887521][T19781] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1131.891016][T19730] usb 1-1: Product: syz [ 1131.920500][T19730] usb 1-1: Manufacturer: syz [ 1131.938893][T19730] usb 1-1: SerialNumber: syz [ 1131.956968][T19730] usb 1-1: config 0 descriptor?? [ 1131.973373][T13275] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 1131.991807][T19774] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 1132.003592][T19730] kvaser_usb 1-1:0.161: error -ENODEV: Cannot get usb endpoint(s) [ 1132.132756][T13275] usb 4-1: Using ep0 maxpacket: 8 [ 1132.158293][T13275] usb 4-1: config 0 has an invalid interface number: 55 but max is 0 [ 1132.174726][T13275] usb 4-1: config 0 has no interface number 0 [ 1132.188514][T13275] usb 4-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1132.206991][T13275] usb 4-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1132.231025][T13275] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1132.244515][T19786] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4229'. [ 1132.291471][T13275] usb 4-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1132.338951][T13275] usb 4-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1132.373770][T13275] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1132.427763][T13275] usb 4-1: config 0 descriptor?? [ 1132.477007][T13275] ldusb 4-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1133.762985][T19803] netlink: 'syz.6.4235': attribute type 1 has an invalid length. [ 1133.892263][T19803] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1134.092832][T19806] bond7: (slave veth15): Enslaving as an active interface with a down link [ 1134.178754][T13275] usb 1-1: USB disconnect, device number 65 [ 1134.227389][T19803] bond6: (slave veth0_to_bond): Releasing active interface [ 1134.301498][ T5966] usb 4-1: USB disconnect, device number 82 [ 1134.383521][ T5966] ldusb 4-1:0.55: LD USB Device #0 now disconnected [ 1134.424232][T19803] bond7: (slave veth0_to_bond): making interface the new active one [ 1134.524788][T19803] veth0_to_bond: entered promiscuous mode [ 1134.539358][T19803] bond7: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 1135.604647][T19827] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4242'. [ 1135.709897][T19831] netlink: 84 bytes leftover after parsing attributes in process `syz.1.4241'. [ 1137.101164][T13742] usb 7-1: new high-speed USB device number 39 using dummy_hcd [ 1137.432314][T13742] usb 7-1: config 0 has no interfaces? [ 1137.452363][T13742] usb 7-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1137.482399][T13742] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1137.501110][T13742] usb 7-1: Product: syz [ 1137.505384][T13742] usb 7-1: Manufacturer: syz [ 1137.510028][T13742] usb 7-1: SerialNumber: syz [ 1137.573401][T13742] usb 7-1: config 0 descriptor?? [ 1139.693306][T19883] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.4259'. [ 1139.807575][T19886] netlink: 'syz.1.4260': attribute type 7 has an invalid length. [ 1139.821223][T19886] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4260'. [ 1139.903948][T19888] netlink: 'syz.1.4260': attribute type 10 has an invalid length. [ 1139.912066][T13275] usb 7-1: USB disconnect, device number 39 [ 1140.315525][T19901] ptrace attach of "./syz-executor exec"[12806] was attempted by "./syz-executor exec"[19901] [ 1140.715568][T19907] netlink: 'syz.1.4267': attribute type 10 has an invalid length. [ 1140.894361][T19907] 8021q: adding VLAN 0 to HW filter on device team0 [ 1141.739706][T19917] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1141.868560][T19917] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1142.865126][ T49] veth0_to_bond: left promiscuous mode [ 1143.580127][T19962] ptrace attach of "./syz-executor exec"[15024] was attempted by "./syz-executor exec"[19962] [ 1143.886533][T19966] 8021q: VLANs not supported on caif0 [ 1144.131056][T13275] usb 1-1: new high-speed USB device number 66 using dummy_hcd [ 1144.357412][T13275] usb 1-1: config 0 has no interfaces? [ 1144.368047][T13275] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1144.388562][T13275] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1144.424525][T13275] usb 1-1: Product: syz [ 1144.428776][T13275] usb 1-1: Manufacturer: syz [ 1144.520698][T13275] usb 1-1: SerialNumber: syz [ 1144.539884][T13275] usb 1-1: config 0 descriptor?? [ 1145.645087][T13275] usb 1-1: USB disconnect, device number 66 [ 1147.042484][T19998] 8021q: VLANs not supported on caif0 [ 1147.392742][ T49] veth0_to_bond: left promiscuous mode [ 1147.739260][T20007] syzkaller1: entered promiscuous mode [ 1147.761451][T20007] syzkaller1: entered allmulticast mode [ 1148.392037][T20019] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1148.451580][T20019] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1149.408137][T20030] ptrace attach of "./syz-executor exec"[15024] was attempted by "./syz-executor exec"[20030] [ 1150.411579][T20042] netlink: 91 bytes leftover after parsing attributes in process `syz.1.4316'. [ 1152.453286][ T5966] usb 7-1: new high-speed USB device number 40 using dummy_hcd [ 1152.549778][ T31] INFO: task kworker/0:8:7692 blocked for more than 143 seconds. [ 1152.562892][ T31] Not tainted 6.16.0-rc5-syzkaller-00193-g40f92e79b0aa #0 [ 1152.573290][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1152.621101][ T31] task:kworker/0:8 state:D stack:21336 pid:7692 tgid:7692 ppid:2 task_flags:0x4208060 flags:0x00004000 [ 1152.665871][ T31] Workqueue: usb_hub_wq hub_event [ 1152.711761][ T5966] usb 7-1: Using ep0 maxpacket: 8 [ 1152.718983][ T5966] usb 7-1: config 0 has an invalid interface number: 55 but max is 0 [ 1152.743498][ T5966] usb 7-1: config 0 has no interface number 0 [ 1152.757310][ T31] Call Trace: [ 1152.793819][ T31] [ 1152.843702][ T5966] usb 7-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1152.854776][ T31] __schedule+0x16f5/0x4d00 [ 1152.873288][ T31] ? schedule+0x165/0x360 [ 1152.890318][ T5966] usb 7-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1152.902206][ T31] ? __pfx___schedule+0x10/0x10 [ 1152.914861][ T31] ? schedule+0x91/0x360 [ 1152.926978][ T31] schedule+0x165/0x360 [ 1152.940313][ T5966] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1152.954084][ T31] schedule_timeout+0x9a/0x270 [ 1152.971024][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 1152.976653][ T5966] usb 7-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1152.991523][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1153.008987][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 1153.022708][ T31] ? wait_for_completion+0x267/0x5d0 [ 1153.031909][ T5966] usb 7-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1153.093403][ T31] wait_for_completion+0x2bf/0x5d0 [ 1153.105604][ T31] ? __pfx_wait_for_completion+0x10/0x10 [ 1153.113911][ T5966] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1153.152887][ T31] i2c_del_adapter+0x581/0x6e0 [ 1153.171735][ T5966] usb 7-1: config 0 descriptor?? [ 1153.185472][ T5966] ldusb 7-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1153.188899][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 1153.403801][ T5966] usb 7-1: USB disconnect, device number 40 [ 1153.433189][ T5966] ldusb 7-1:0.55: LD USB Device #0 now disconnected [ 1153.604236][ T31] ? __pfx_i2c_del_adapter+0x10/0x10 [ 1153.630213][ T31] ? dvb_usbv2_exit+0x85a/0x9e0 [ 1153.655729][ T31] dvb_usbv2_probe+0x4ae/0x41a0 [ 1153.740370][ T31] ? __pfx_dvb_usbv2_probe+0x10/0x10 [ 1153.806336][ T31] ? __pm_runtime_set_status+0x785/0xa50 [ 1153.814923][ T31] usb_probe_interface+0x641/0xbc0 [ 1153.820167][ T31] ? __pfx_usb_probe_interface+0x10/0x10 [ 1153.833539][ T31] really_probe+0x26a/0x9a0 [ 1153.838912][ T31] __driver_probe_device+0x18c/0x2f0 [ 1153.848424][ T31] driver_probe_device+0x4f/0x430 [ 1153.855271][ T31] __device_attach_driver+0x2ce/0x530 [ 1153.860966][ T31] bus_for_each_drv+0x251/0x2e0 [ 1153.866660][ T31] ? __pfx___device_attach_driver+0x10/0x10 [ 1153.872934][ T31] ? __pfx_bus_for_each_drv+0x10/0x10 [ 1153.878463][ T31] __device_attach+0x2b8/0x400 [ 1153.884320][ T31] ? __pfx___device_attach+0x10/0x10 [ 1153.890961][ T31] ? do_raw_spin_unlock+0x122/0x240 [ 1153.896450][ T31] bus_probe_device+0x185/0x260 [ 1153.901639][ T31] device_add+0x7b6/0xb50 [ 1153.907354][ T31] usb_set_configuration+0x1a87/0x20e0 [ 1153.913822][ T31] usb_generic_driver_probe+0x8d/0x150 [ 1153.920524][ T31] usb_probe_device+0x1c4/0x390 [ 1153.926384][ T31] ? __pfx_usb_probe_device+0x10/0x10 [ 1153.933052][ T31] really_probe+0x26a/0x9a0 [ 1153.943848][ T31] __driver_probe_device+0x18c/0x2f0 [ 1153.949375][ T31] driver_probe_device+0x4f/0x430 [ 1153.954706][ T31] __device_attach_driver+0x2ce/0x530 [ 1153.961595][ T31] bus_for_each_drv+0x251/0x2e0 [ 1153.966979][ T31] ? __pfx___device_attach_driver+0x10/0x10 [ 1153.973085][ T31] ? __pfx_bus_for_each_drv+0x10/0x10 [ 1153.978777][ T31] __device_attach+0x2b8/0x400 [ 1154.001937][ T31] ? __pfx___device_attach+0x10/0x10 [ 1154.019340][ T31] ? do_raw_spin_unlock+0x122/0x240 [ 1154.059598][ T31] bus_probe_device+0x185/0x260 [ 1154.077438][ T31] device_add+0x7b6/0xb50 [ 1154.093294][ T31] usb_new_device+0xa39/0x16c0 [ 1154.108424][ T31] ? __pfx_usb_new_device+0x10/0x10 [ 1154.124112][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1154.136499][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 1154.150180][ T31] hub_event+0x2941/0x4a00 [ 1154.167279][ T31] ? __pfx_hub_event+0x10/0x10 [ 1154.183928][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 1154.279414][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1154.302080][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 1154.308209][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 1154.316594][ T31] process_scheduled_works+0xae1/0x17b0 [ 1154.327709][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 1154.349425][ T31] worker_thread+0x8a0/0xda0 [ 1154.359881][ T31] kthread+0x70e/0x8a0 [ 1154.365361][ T31] ? __pfx_worker_thread+0x10/0x10 [ 1154.370671][ T31] ? __pfx_kthread+0x10/0x10 [ 1154.383024][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1154.388421][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 1154.397400][ T31] ? __pfx_kthread+0x10/0x10 [ 1154.402858][ T31] ret_from_fork+0x3fc/0x770 [ 1154.408629][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1154.414404][ T31] ? __switch_to_asm+0x39/0x70 [ 1154.419355][ T31] ? __switch_to_asm+0x33/0x70 [ 1154.424759][ T31] ? __pfx_kthread+0x10/0x10 [ 1154.429535][ T31] ret_from_fork_asm+0x1a/0x30 [ 1154.434740][ T31] [ 1154.438287][ T31] [ 1154.438287][ T31] Showing all locks held in the system: [ 1154.446886][ T31] 1 lock held by khungtaskd/31: [ 1154.452230][ T31] #0: ffffffff8e13f160 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 1154.462536][ T31] 2 locks held by getty/5611: [ 1154.467463][ T31] #0: ffff8880343c80a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 1154.477780][ T31] #1: ffffc9000333b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 1154.493650][ T31] 1 lock held by syz-executor/5835: [ 1154.499544][ T31] 5 locks held by kworker/0:8/7692: [ 1154.584416][ T31] #0: ffff8880206bb148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 1154.613936][ T31] #1: ffffc90003b4fbc0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 1154.674399][ T31] #2: ffff888028225198 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4a00 [ 1154.704773][ T31] #3: ffff888079536198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x400 [ 1154.726968][ T31] #4: ffff888058a43160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x400 [ 1154.741081][ T31] 2 locks held by syz.6.4320/20053: [ 1154.747609][ T31] 1 lock held by dhcpcd/20067: [ 1154.753121][ T31] #0: ffff88805985d608 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: sock_close+0x9b/0x240 [ 1154.766673][ T31] 2 locks held by dhcpcd/20070: [ 1154.783189][ T31] #0: ffff88804ba33808 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: sock_close+0x9b/0x240 [ 1154.806556][ T31] #1: ffffffff8e144c78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3b9/0x730 [ 1154.833586][ T31] [ 1154.853888][ T31] ============================================= [ 1154.853888][ T31] [ 1154.904605][ T31] NMI backtrace for cpu 0 [ 1154.904637][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc5-syzkaller-00193-g40f92e79b0aa #0 PREEMPT(full) [ 1154.904663][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1154.904677][ T31] Call Trace: [ 1154.904688][ T31] [ 1154.904698][ T31] dump_stack_lvl+0x189/0x250 [ 1154.904730][ T31] ? __wake_up_klogd+0xd9/0x110 [ 1154.904766][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1154.904792][ T31] ? __pfx__printk+0x10/0x10 [ 1154.904835][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 1154.904869][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 1154.904895][ T31] ? _printk+0xcf/0x120 [ 1154.904928][ T31] ? __pfx__printk+0x10/0x10 [ 1154.904960][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1154.904984][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 1154.905015][ T31] watchdog+0xfee/0x1030 [ 1154.905044][ T31] ? watchdog+0x1de/0x1030 [ 1154.905072][ T31] kthread+0x70e/0x8a0 [ 1154.905107][ T31] ? __pfx_watchdog+0x10/0x10 [ 1154.905126][ T31] ? __pfx_kthread+0x10/0x10 [ 1154.905158][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1154.905190][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 1154.905222][ T31] ? __pfx_kthread+0x10/0x10 [ 1154.905253][ T31] ret_from_fork+0x3fc/0x770 [ 1154.905279][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1154.905309][ T31] ? __switch_to_asm+0x39/0x70 [ 1154.905336][ T31] ? __switch_to_asm+0x33/0x70 [ 1154.905363][ T31] ? __pfx_kthread+0x10/0x10 [ 1154.905395][ T31] ret_from_fork_asm+0x1a/0x30 [ 1154.905439][ T31] [ 1154.905450][ T31] Sending NMI from CPU 0 to CPUs 1: [ 1155.063814][ C1] NMI backtrace for cpu 1 [ 1155.063835][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.16.0-rc5-syzkaller-00193-g40f92e79b0aa #0 PREEMPT(full) [ 1155.063857][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1155.063885][ C1] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 1155.063923][ C1] Code: cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 93 0d 19 00 f3 0f 1e fa fb f4 c8 dd 02 00 cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 [ 1155.063940][ C1] RSP: 0018:ffffc90000197de0 EFLAGS: 000002c6 [ 1155.063958][ C1] RAX: fb3f1775c428c300 RBX: ffffffff81976c78 RCX: fb3f1775c428c300 [ 1155.063973][ C1] RDX: 0000000000000001 RSI: ffffffff8d998a4b RDI: ffffffff8be29dc0 [ 1155.063986][ C1] RBP: ffffc90000197f20 R08: ffff8880b8732f5b R09: 1ffff110170e65eb [ 1155.064000][ C1] R10: dffffc0000000000 R11: ffffed10170e65ec R12: ffffffff8fa1f3f0 [ 1155.064014][ C1] R13: 0000000000000001 R14: 0000000000000001 R15: 1ffff11003ad8b40 [ 1155.064027][ C1] FS: 0000000000000000(0000) GS:ffff888125d1b000(0000) knlGS:0000000000000000 [ 1155.064042][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1155.064054][ C1] CR2: 0000000080ee6018 CR3: 000000000df38000 CR4: 00000000003526f0 [ 1155.064070][ C1] Call Trace: [ 1155.064079][ C1] [ 1155.064086][ C1] default_idle+0x13/0x20 [ 1155.064106][ C1] default_idle_call+0x74/0xb0 [ 1155.064128][ C1] do_idle+0x1e8/0x510 [ 1155.064153][ C1] ? __pfx_do_idle+0x10/0x10 [ 1155.064185][ C1] cpu_startup_entry+0x44/0x60 [ 1155.064207][ C1] start_secondary+0x101/0x110 [ 1155.064224][ C1] common_startup_64+0x13e/0x147 [ 1155.064260][ C1] [ 1155.233458][ C0] vkms_vblank_simulate: vblank timer overrun [ 1155.441589][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 1155.448493][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc5-syzkaller-00193-g40f92e79b0aa #0 PREEMPT(full) [ 1155.460417][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1155.470535][ T31] Call Trace: [ 1155.473842][ T31] [ 1155.476781][ T31] dump_stack_lvl+0x99/0x250 [ 1155.481381][ T31] ? __asan_memcpy+0x40/0x70 [ 1155.485998][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1155.491385][ T31] ? __pfx__printk+0x10/0x10 [ 1155.496013][ T31] panic+0x2db/0x790 [ 1155.499946][ T31] ? __pfx_panic+0x10/0x10 [ 1155.504386][ T31] ? nmi_backtrace_stall_check+0x433/0x440 [ 1155.510209][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 1155.515601][ T31] ? nmi_trigger_cpumask_backtrace+0x2b6/0x300 [ 1155.521785][ T31] watchdog+0x102d/0x1030 [ 1155.526216][ T31] ? watchdog+0x1de/0x1030 [ 1155.530648][ T31] kthread+0x70e/0x8a0 [ 1155.534741][ T31] ? __pfx_watchdog+0x10/0x10 [ 1155.539768][ T31] ? __pfx_kthread+0x10/0x10 [ 1155.544394][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1155.549652][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 1155.555003][ T31] ? __pfx_kthread+0x10/0x10 [ 1155.559659][ T31] ret_from_fork+0x3fc/0x770 [ 1155.564300][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1155.569450][ T31] ? __switch_to_asm+0x39/0x70 [ 1155.574226][ T31] ? __switch_to_asm+0x33/0x70 [ 1155.578998][ T31] ? __pfx_kthread+0x10/0x10 [ 1155.583605][ T31] ret_from_fork_asm+0x1a/0x30 [ 1155.588390][ T31] [ 1155.591784][ T31] Kernel Offset: disabled [ 1155.596127][ T31] Rebooting in 86400 seconds..