last executing test programs: 3m24.420533353s ago: executing program 4 (id=3290): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r4) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_DEL_KEY(r5, &(0x7f00000003c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x44, 0x0, 0x20, 0x70bd2b, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x4, 0x6}}}}, [@NL80211_ATTR_KEY_TYPE={0x8}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0x10, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "435a65dbf8"}]}, 0x44}, 0x1, 0x0, 0x0, 0x4088}, 0x4c801) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newqdisc={0x84, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x8000000, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xc}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x54, 0x2, {{0x100, 0x6, 0x6361, 0x5, 0xfffffffd, 0x6}, [@TCA_NETEM_LATENCY64={0xc, 0xa, 0x5}, @TCA_NETEM_SLOT={0x2c, 0xc, {0x1, 0x0, 0xb2, 0x9, 0x8, 0x7c}}]}}}]}, 0x84}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 3m23.353609498s ago: executing program 4 (id=3297): syz_open_dev$ttys(0xc, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x7f, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000200), 0x4000, 0x0) 3m22.6347832s ago: executing program 4 (id=3298): syz_usb_connect$uac1(0x0, 0x9c, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000406b1d010140000102030109028a000301ffa0060904000000010100000a240100000202010207240504062e7d0904010000000000000000010101010200000c2402ec79030420be11d1d109050109758b0620010725010006efff0904020000010200000904020101"], 0x0) 3m19.277765592s ago: executing program 4 (id=3303): syz_mount_image$reiserfs(&(0x7f0000001100), &(0x7f00000002c0)='./file0\x00', 0x98, &(0x7f0000001180), 0x1, 0x10f6, &(0x7f00000022c0)="$eJzs2LFqFEEYB/D/7J6C1cmkXwJaKEhIOF8ghcI1FtZ2h5WdVyn3OD6OpLIPeYAUAXtlb10NIki4JQfH7wfL7vyZb76dciYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQmyUPkxw1SR2zJklJuu5ieZWkG/PHX9smJW/fL9evPi5er4dp6bMmpa/ajuvZk1oXdVHP6suj86d1/enzh/ZWy5Iulzeb1aM315Nupe/dTroiAAAAHIYfO5vvuT8AAADwP5NdJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMoI4fTZKSdN3F8ipJt9/fAgAAAHZU0uTd/F/5cA3wx4t8m5dtPvpe+jmn+TLUP7979wd3LwEAAIADVW6dx59l9vtc3mfHmeXkZBj/euX6PGmTnP61zuXNZrV9jjercp8bAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB+sgPHAgAAAADC/K3T6NgAAAAAAAAAAAAAAACAqQIAAP//I7HRJg==") r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, 0x0, 0x0) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$USBDEVFS_CONNECTINFO(r0, 0x40085511, &(0x7f0000000040)) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioprio_get$pid(0x1, r1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000000c0)='geneve1\x00', 0x10) socket$alg(0x26, 0x5, 0x0) ftruncate(r0, 0xf88) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.swap.current\x00', 0x275a, 0x0) write$cgroup_pid(r4, &(0x7f00000003c0), 0x12) 3m17.054843248s ago: executing program 4 (id=3309): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f00000002c0)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='illinois', 0x8) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @sack_perm, @window={0x3, 0x3, 0x401}, @window], 0x5) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x12, 0x0, 0x12) recvfrom$inet(r0, &(0x7f0000000100)=""/24, 0xfffffffffffffd5b, 0xc9100120, 0x0, 0xfffffffffffffd25) 3m15.295471182s ago: executing program 4 (id=3315): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r0}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) pipe(0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r1, &(0x7f0000000440)='X', 0x1, 0x0, &(0x7f0000000480)={0xa, 0x0, 0x0, @private0}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000100)={0x66, 0xfe, 0x4, 0x7, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x9}, 0xe) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000000)=0x6, 0x4) shutdown(r1, 0x1) socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) recvmmsg(r1, &(0x7f0000005000)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/19, 0x1}, 0x3}], 0x4000169, 0x40000142, 0x0) 2m59.702170997s ago: executing program 32 (id=3315): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r0}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) pipe(0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r1, &(0x7f0000000440)='X', 0x1, 0x0, &(0x7f0000000480)={0xa, 0x0, 0x0, @private0}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000100)={0x66, 0xfe, 0x4, 0x7, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x9}, 0xe) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000000)=0x6, 0x4) shutdown(r1, 0x1) socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) recvmmsg(r1, &(0x7f0000005000)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/19, 0x1}, 0x3}], 0x4000169, 0x40000142, 0x0) 4.441575911s ago: executing program 3 (id=3934): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(0x0, r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r4) r5 = socket$unix(0x1, 0x5, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newqdisc={0x84, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x8000000, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xc}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x54, 0x2, {{0x100, 0x6, 0x6361, 0x5, 0xfffffffd, 0x6}, [@TCA_NETEM_LATENCY64={0xc, 0xa, 0x5}, @TCA_NETEM_SLOT={0x2c, 0xc, {0x1, 0x0, 0xb2, 0x9, 0x8, 0x7c}}]}}}]}, 0x84}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 3.973897941s ago: executing program 3 (id=3936): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) pipe(&(0x7f0000019480)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r1}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x40000000000, 0x3, 0x4, 0x0, 0x0, 0x800003}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) close(0x4) 3.438728224s ago: executing program 1 (id=3941): r0 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r0, &(0x7f0000000140)=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x4e21, @broadcast}}, 0x24) sendmmsg(r0, &(0x7f0000005c00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000001001"], 0x18}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18, 0x7000000}, 0xf401}], 0x1, 0x0) 3.354756827s ago: executing program 2 (id=3942): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000480), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x44, r1, 0x207, 0x0, 0x0, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x4}, @NLBL_CIPSOV4_A_TAGLST={0x24, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x1}, {0x5}, {0x5}, {0x5, 0x3, 0x1}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}]}, 0x44}}, 0x800) 3.29850174s ago: executing program 3 (id=3943): mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) 3.283888441s ago: executing program 1 (id=3944): r0 = syz_usb_connect(0x3, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100009ac0b620110f211066865578ac0109029c000100000400090400bf"], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x10000) write$char_usb(r1, &(0x7f0000001300)='7', 0x1) syz_open_dev$char_usb(0xc, 0xb4, 0x1c0000000000) syz_usb_disconnect(r0) 3.134059837s ago: executing program 2 (id=3945): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x6, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r0}, 0x18) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x50, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x10}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x81}]}]}, @NFT_MSG_NEWSETELEM={0x34, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x3}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}, @NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x5, 0x0, 0x0, {0xa, 0x0, 0x4}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xc0}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 3.05906224s ago: executing program 2 (id=3946): r0 = socket(0x2a, 0x2, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@newqdisc={0x58, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x3ff, 0x1, 0xfffffff8, 0x0, 0x7, 0x7f, 0x8, 0x5, 0x1}}}}]}, 0x58}}, 0x44884) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000025c0)=@newtfilter={0x520, 0x2c, 0xd27, 0x70bd2d, 0x25dfdffd, {0x0, 0x0, 0x0, r1, {0x6}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_basic={{0xa}, {0x4f0, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0x2, 0xc}}, @TCA_BASIC_CLASSID={0x8, 0x1, {0xf, 0xc}}, @TCA_BASIC_EMATCHES={0x4}, @TCA_BASIC_ACT={0x4d8, 0x3, [@m_bpf={0x110, 0x20, 0x0, 0x0, {{0x8}, {0x8c, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x6, 0x3, 0xffffffffffffffff, 0x102b, 0x3}}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x80, 0x5, 0x0, 0x4, 0x8}}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x1}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x9ad, 0xf1, 0x2, 0x10000, 0x101}}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0xa}, @TCA_ACT_BPF_FD={0x8, 0x5, r0}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}]}, {0x5d, 0x6, "e34dddbd29e127d2258cc3fe083180c78d354a50eb489fe35aabec255cbb8604c6b69cbb4a4749274ea6616d43ef209244b4024c42e3a4b1f5a730c2a2851f2cc9588c086e48cb788c5fb894844050842ff57c0ac7b4a30ea0"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_mpls={0x70, 0x17, 0x0, 0x0, {{0x9}, {0xc, 0x2, 0x0, 0x1, [@TCA_MPLS_TTL={0x5, 0x7, 0x8}]}, {0x3a, 0x6, "c2fcd4e8b992df7b121e86f9e226f6428fc608d968615c1233bd73caa8289891dcd8180567f1f5968d37f49822928ca3a44e0fc93fac"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x1}}}}, @m_skbmod={0x168, 0x1c, 0x0, 0x0, {{0xb}, {0xbc, 0x2, 0x0, 0x1, [@TCA_SKBMOD_PARMS={0x24, 0x2, {{0x4, 0x6, 0xd, 0x6, 0x14f1}, 0x3}}, @TCA_SKBMOD_ETYPE={0x6, 0x5, 0x9}, @TCA_SKBMOD_SMAC={0xa, 0x4, @broadcast}, @TCA_SKBMOD_DMAC={0xa}, @TCA_SKBMOD_DMAC={0xa, 0x3, @link_local}, @TCA_SKBMOD_DMAC={0xa, 0x3, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3e}}, @TCA_SKBMOD_PARMS={0x24, 0x2, {{0x4, 0x820, 0xffffffffffffffff, 0x1, 0x8}, 0xe}}, @TCA_SKBMOD_PARMS={0x24, 0x2, {{0x8, 0x4, 0xffffffffffffffff, 0xf, 0x2}, 0x3}}, @TCA_SKBMOD_SMAC={0xa}, @TCA_SKBMOD_ETYPE={0x6, 0x5, 0xf52}]}, {0x82, 0x6, "b1410e51abd91c19df03678c0a734d81f15d12da897bdfda147129939b701982f88ef1530658e77269b94e9578c525f6af9d0b09060f41d335cfe49f87770ed7cfae2bc46bad866cfe2e63954f12060e1e9773ec9687cf75bb8147cd5d44ff0e6670baf0986aa2415bf20da788e368e8b2ad7bf23e33e00571e6cadc2f42"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}, @m_nat={0x9c, 0x16, 0x0, 0x0, {{0x8}, {0x54, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x6, 0x1, 0x10000000, 0x80000001, 0x6}, @empty, @empty, 0x0, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x8, 0x1, 0xfffffffffffffff8, 0x6, 0xfffffffe}, @private=0xa010101, @multicast2, 0xff000000, 0x1}}]}, {0x24, 0x6, "9d61a804491d93f3a318b13472c4c13c4a2ed17605e0276b2e69695fc6c745a8"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}, @m_ct={0x150, 0x6, 0x0, 0x0, {{0x7}, {0x4c, 0x2, 0x0, 0x1, [@TCA_CT_ACTION={0x6, 0x3, 0x1}, @TCA_CT_NAT_IPV6_MAX={0x14, 0xc, @remote}, @TCA_CT_NAT_IPV6_MIN={0x14, 0xb, @private1={0xfc, 0x1, '\x00', 0x1}}, @TCA_CT_MARK={0x8, 0x5, 0x7}, @TCA_CT_NAT_PORT_MAX={0x6, 0xe, 0x4e20}, @TCA_CT_MARK={0x8, 0x5, 0x8}]}, {0xdd, 0x6, "312feec9711d469aa9e09a47cb4ac7c821f6bbf7f8ede91cefa9514b34992034195a415f193d4bc02077d3c161c98c5c3f8b0a295aac7398c1dde1e03c3b8f9394e5e992ae65aadd44e8224144b3182b648787b711161405176528d797e5527a9f3ae11e84ada47772eade600db074b6d06490dac5292fbb3c18ea2a645e79039d8356b8dc8aeef1edf6b6734a4273ac83466de3bdfe7120500b77accd616acbc031a5923303ee6ccd7939b00a77d36e8aacf8541778ac2eb523656711efe838f558b78558e364942ecd41f46bc6af1fe865686306ed594958"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0x520}}, 0x2000c800) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) 2.980750653s ago: executing program 2 (id=3947): socket$inet6_sctp(0xa, 0x5, 0x84) socket$nl_rdma(0x10, 0x3, 0x14) socketpair$unix(0x1, 0x5, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000ac0)={0x0, 0x0}, 0x10) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, 0x0, 0x20004000) 2.83054026s ago: executing program 2 (id=3948): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000600)={{0x12, 0x1, 0x0, 0x35, 0xff, 0xaa, 0x20, 0xccd, 0x10af, 0x384e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x59, 0x2, 0x1, 0x9b, 0x1e, 0x2a, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000007c0)={0x84, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000240)={0x1c, &(0x7f0000000480)={0x0, 0x1}, 0x0, 0x0}) 2.691889966s ago: executing program 3 (id=3949): r0 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x9) socket$unix(0x1, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000480)=0x7) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, 0x0, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) fsopen(&(0x7f0000000000)='rpc_pipefs\x00', 0x0) r4 = syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f0000000180)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r4, 0xc06864a1, &(0x7f00000001c0)={0x0, 0x0, r5, 0x0}) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r4, 0xc01864b0, &(0x7f0000000000)={r5, r6, 0x1, 0x0, 0x3}) socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000400000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a32000000002c0003800800014000000000180003801400010076657468315f746f5f626f6e6400000008000240000000005c000000160a0101000b000000000000010000000900020073797a32000000000900010073797a3000000000300003802c0003801400010067656e657665300000000000000000001400010076657468315f746f5f626f6e64000000140000001000010000000000000000000000000a"], 0xfc}}, 0x0) 1.856658891s ago: executing program 5 (id=3958): socket$inet6_sctp(0xa, 0x5, 0x84) socket$nl_rdma(0x10, 0x3, 0x14) socketpair$unix(0x1, 0x5, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000ac0)={0x0, 0x0}, 0x10) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, 0x0, 0x20004000) 1.758223926s ago: executing program 5 (id=3959): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc0}, 0x40010) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x1}, @NFTA_EXTHDR_TYPE={0x5}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x7c}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r3, &(0x7f0000000640)={0x0, 0x0, 0x0}, 0x0) r4 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) ioctl$SIOCAX25OPTRT(r4, 0x89e7, &(0x7f00000000c0)={@default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x2, 0x56}) r5 = socket(0x10, 0x803, 0x0) sendto(r5, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r5, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r5, 0x0, 0x61, &(0x7f0000000100)={'filter\x00', 0x4}, 0x68) r6 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000003b40), r1) r7 = socket$phonet_pipe(0x23, 0x5, 0x2) r8 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r7, 0x8933, &(0x7f0000000340)={'team0\x00', 0x0}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000000)='GPL\x00', 0x40, 0x0, 0x0, 0x0, 0x1, '\x00', r9, 0x2, r8, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000000}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000006c0)={'veth0_to_hsr\x00'}) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r11, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000300)={'virt_wifi0\x00', 0x0}) setsockopt$inet6_mreq(r11, 0x29, 0x1b, &(0x7f0000000000)={@remote, r12}, 0x14) sendmsg$nl_route_sched(r10, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)=@newtfilter={0x24, 0x11, 0x1, 0x70bd27, 0x2000, {0x0, 0x0, 0x74, r12, {0xfffd, 0xfff0}, {0xffe0, 0xfff1}, {0xfff2, 0xd}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x30004804}, 0x200088c0) getsockname$packet(r5, &(0x7f0000000700)={0x11, 0x0, 0x0}, &(0x7f0000000780)=0x14) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000000a40)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a00)={&(0x7f00000008c0)={0x88, 0x0, 0x400, 0x70bd27, 0x25dfdbfd, {}, [@ETHTOOL_A_LINKINFO_HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_batadv\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x40}, @ETHTOOL_A_LINKINFO_HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r13}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macsec0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @ETHTOOL_A_LINKINFO_TP_MDIX_CTRL={0x5, 0x5, 0x1}]}, 0x88}, 0x1, 0x0, 0x0, 0x3375cb7aa35f5ba3}, 0xc000) sendmsg$NLBL_CIPSOV4_C_LISTALL(r1, &(0x7f0000003c40)={0x0, 0x0, &(0x7f0000003c00)={&(0x7f0000003b80)={0x14, r6, 0x309, 0x70bd26, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x81}, 0x4040000) 1.66417464s ago: executing program 3 (id=3960): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="14000049a3779f1b70975700000000000200000a14000000000a010100000000000000000100000334000000030a010400000000000000000100ffff0900010073797a3100000000ad596f841cf5c222acf10900030073797a31000000000800054000000000140000001100010000000000000000000100000ac875a88c3bc87f342349a573ace72a79b7a60070ead6c5d2f45a32cc7194b1b5e0b71b6652225a053f768ee7cfac05c940f5ed5bd2b2b3e24804d979ddf65d16f7b3c6b7b1642ec3c2bcb24a7b3efaca0700000000000000563cf573a269adae2711"], 0x70}}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r2, 0x0, 0x4008800) sendmsg$NL80211_CMD_GET_MPATH(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000080) syz_genetlink_get_family_id$net_dm(&(0x7f00000000c0), 0xffffffffffffffff) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r3}, 0x18) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) epoll_create1(0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[], 0x48) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="58000000020601080000000000000000000000040900020073797a3100000000050004000000000011000300686173683a6e65742c6e6574000000000c00078008001240000000020500050002000000050001000600"], 0x58}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000580)=ANY=[@ANYBLOB="500000000906010200000000000000e1020000000900020073797a31000000000500010007000000280007800c00018008000140ffffffff0c00148008000140ac1414bb0c00028008"], 0x50}, 0x1, 0x0, 0x0, 0xd24f4d5778621d46}, 0x4) sendmsg$NET_DM_CMD_START(r1, 0x0, 0x800) 1.461749848s ago: executing program 0 (id=3962): r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000001f40)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_subtree(r1, &(0x7f0000000200), 0x2, 0x0) r2 = openat$cgroup_int(r0, &(0x7f0000000180)='cpu.weight\x00', 0x2, 0x0) pwritev(r2, &(0x7f0000000440)=[{&(0x7f0000000240)="d4382ed01904a1a847c50ae100f70e5e71ae3ded3cb6bdc02a5de9d439c491616d754846c701ebfd3456793571c6128a68d93214ff7856ca680b74e1141f7115840d1ee71d7159714ad5c6a2f532eadc195d4a54ca0e6d0488f6aacdc0ac74bad4aa82eabe01746313a12b595d7ea86d8f06d4fd141c8edf83f005a1178825768f", 0x1}], 0x5f, 0x100, 0x0) 1.460923449s ago: executing program 1 (id=3963): r0 = socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="0007000042009103"], 0xfe33) recvmsg(r0, &(0x7f0000000080), 0x102) 1.391275011s ago: executing program 3 (id=3964): r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000480)={0xaa, 0x600}) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f00000002c0)="390000fa461aa0fba8ab80679467df91c09e8a722e34d7e484893ffa560200130011186809fc071200000f0023ff3f210000001770faf047145bc79e0b9971bcbedac0eead3374b1f10b97acf10fcb34894d37f5d3f6c760a735be8b7297778664a552281b96d5a7d7f3875f05e487baf067da3f28852a08c19ab0bbea9c89c1a4ecff2194f01dab19545076990660e40558de7765bd5386c904cbbd59b553c15f5b105fd50ea81dcbff0b8d878a594fa1b2a1871aadda6cc9cd763c81442faedbe6e1b26e659ced10a58fc3f363190465eeed7392458f3775ddb3f9033d1ba24bdb340a1bc413db7ff723ee10048611edaa12944375e73d7c9f4034c0956e0934a327161888cd4e8dfbbbea8b83943dea1cdb835a22000001004e0aa120d4ad892e80e6458e5b711f9e88f4a199", 0x12e}], 0x1) r1 = syz_open_dev$sg(0x0, 0x0, 0x22c43) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f00000000c0)=ANY=[@ANYRES64=r1]) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/59, 0x304000, 0x800, 0x0, 0x3}, 0x20) ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000100)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000013000/0x4000)=nil, 0x3000, 0x3}) r3 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000000000010d804dd00000000000001090224000100000001090400eb010300000009210500000122050009058103"], 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000240)={0x24, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00220500000083"], 0x0}, 0x0) r4 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x2000) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r4, 0xc0505510, 0x0) r5 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_SMBUS(r5, 0x720, &(0x7f0000000180)={0x0, 0x9, 0x5, &(0x7f0000000080)={0xb, "c6c1f7b51030c4a4c54bf28fac01000000117b5452b3b94bce47509d0000000013"}}) 1.304031945s ago: executing program 1 (id=3965): r0 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r0, &(0x7f0000000140)=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x4e21, @broadcast}}, 0x24) sendmmsg(r0, &(0x7f0000005c00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000001001"], 0x18}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18, 0x7000000}, 0xf401}], 0x1, 0x0) 1.303285475s ago: executing program 5 (id=3966): socket$packet(0x11, 0x2, 0x300) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) r0 = socket$packet(0x11, 0x2, 0x300) bind$packet(r0, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, 0x14) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000240)={'syz_tun\x00', 0x0}) bind$packet(r1, &(0x7f00000005c0)={0x11, 0x0, r2}, 0x14) syz_emit_ethernet(0x2a, &(0x7f0000000340)={@empty, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x3e, 0x1c, 0x0, 0xe000, 0x2, 0x11, 0x0, @empty, @empty}, {0x0, 0x0, 0x8}}}}}, 0x0) 1.234458988s ago: executing program 0 (id=3967): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000480), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x44, r1, 0x207, 0x0, 0x0, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x4}, @NLBL_CIPSOV4_A_TAGLST={0x24, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x1}, {0x5}, {0x5}, {0x5, 0x3, 0x1}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}]}, 0x44}}, 0x800) 1.18434512s ago: executing program 1 (id=3968): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r1 = dup3(0xffffffffffffffff, r0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x98, 0x0, &(0x7f0000000bc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x0, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, 0x0}}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 1.164948941s ago: executing program 5 (id=3969): socket$inet6_sctp(0xa, 0x5, 0x84) socket$nl_rdma(0x10, 0x3, 0x14) socketpair$unix(0x1, 0x5, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000ac0)={0x0, 0x0}, 0x10) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x810}, 0x20004000) 1.139514342s ago: executing program 0 (id=3970): r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r0, 0x0, 0x0) 1.026488687s ago: executing program 0 (id=3971): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) pipe(&(0x7f0000019480)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r2}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x40000000000, 0x3, 0x4, 0x0, 0x0, 0x800003}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) close(0x4) 973.741179ms ago: executing program 5 (id=3972): r0 = socket(0x10, 0x803, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0xffffffffffffff34, &(0x7f0000000080)={0x0, 0xb8}}, 0x0) getsockname$packet(r0, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) r1 = socket(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r2) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r1, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x5820a61ca228651, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x6}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=@newtfilter={0x3c, 0x28, 0xd27, 0x2, 0x0, {0x0, 0x0, 0x0, r3, {0x7}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}, @TCA_RATE={0x6, 0x5, {0x1}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) 968.777969ms ago: executing program 1 (id=3973): r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000080)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000640)={0x2c, &(0x7f0000000540)={0x20, 0x16, 0x1, 'i'}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000001c0)={0x1c, &(0x7f0000000000)=ANY=[], 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f0000000940)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000080)={0x34, &(0x7f0000000680)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000340)={0x2c, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000280)={0x34, &(0x7f0000000100)={0x0, 0xe}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 802.374736ms ago: executing program 5 (id=3974): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0xc, 0x0, &(0x7f00000001c0)='GPL\x00'}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) sched_setscheduler(r0, 0x2, &(0x7f0000000080)=0x9) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000180)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x24000840}, 0x4800) 520.545138ms ago: executing program 0 (id=3975): r0 = socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="0007000042009103"], 0xfe33) recvmsg(r0, &(0x7f0000000080), 0x102) 348.811576ms ago: executing program 0 (id=3976): r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000080)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000640)={0x2c, &(0x7f0000000540)={0x20, 0x16, 0x1, 'i'}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f0000000940)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000080)={0x34, &(0x7f0000000680)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000340)={0x2c, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000280)={0x34, &(0x7f0000000100)={0x0, 0xe}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 0s ago: executing program 2 (id=3977): socket$packet(0x11, 0x2, 0x300) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'syz_tun\x00', 0x0}) bind$packet(r0, &(0x7f0000000300)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @remote}, 0x14) syz_emit_ethernet(0x2a, &(0x7f0000000340)={@empty, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x3e, 0x1c, 0x0, 0xe000, 0x2, 0x11, 0x0, @empty, @empty}, {0x0, 0x0, 0x8}}}}}, 0x0) kernel console output (not intermixed with test programs): netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1432.182595][T18817] bridge0: port 3(team0) entered blocking state [ 1432.190710][T18817] bridge0: port 3(team0) entered disabled state [ 1432.209926][T18817] device team0 entered promiscuous mode [ 1432.215711][T18817] device team_slave_0 entered promiscuous mode [ 1432.222091][T18817] device team_slave_1 entered promiscuous mode [ 1432.228559][T18817] device bridge1 entered promiscuous mode [ 1432.238398][T18817] bridge0: port 3(team0) entered blocking state [ 1432.244756][T18817] bridge0: port 3(team0) entered forwarding state [ 1432.282896][T11837] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1432.556222][ T4283] Bluetooth: hci5: command 0x040f tx timeout [ 1432.674573][T18759] chnl_net:caif_netlink_parms(): no params data found [ 1432.824091][T11837] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1433.379884][T18759] bridge0: port 1(bridge_slave_0) entered blocking state [ 1433.389900][T18759] bridge0: port 1(bridge_slave_0) entered disabled state [ 1433.398829][T18759] device bridge_slave_0 entered promiscuous mode [ 1433.423757][T18838] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1433.478403][T18759] bridge0: port 2(bridge_slave_1) entered blocking state [ 1433.493565][T18759] bridge0: port 2(bridge_slave_1) entered disabled state [ 1433.523818][T18759] device bridge_slave_1 entered promiscuous mode [ 1433.573210][T18838] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1433.794333][T18838] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1433.873472][T18759] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1433.933166][T18759] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1434.003599][T18838] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1434.045102][T11837] tipc: Left network mode [ 1434.071161][T18845] device syzkaller0 entered promiscuous mode [ 1434.143164][T18759] team0: Port device team_slave_0 added [ 1434.260427][T18759] team0: Port device team_slave_1 added [ 1434.275794][T18849] device syzkaller0 entered promiscuous mode [ 1434.364484][T18838] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1434.433877][T18856] device syzkaller0 entered promiscuous mode [ 1434.489588][T18838] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1434.526534][T18759] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1434.535426][T18759] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1434.561846][T18759] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1434.646833][T15955] Bluetooth: hci5: command 0x0419 tx timeout [ 1434.667007][T18867] tipc: Started in network mode [ 1434.682164][T18867] tipc: Node identity 9abc683b0097, cluster identity 4711 [ 1434.692588][T18867] tipc: Enabled bearer , priority 0 [ 1434.700844][T18759] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1434.708976][T18759] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1434.737105][T18759] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1434.756909][T18863] device syzkaller0 entered promiscuous mode [ 1434.763288][T18863] IPv6: ADDRCONF(NETDEV_CHANGE): syzkaller0: link becomes ready [ 1434.828039][T18838] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1434.859960][T18862] tipc: Resetting bearer [ 1434.913131][T18862] tipc: Disabling bearer [ 1434.942725][T18838] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1435.139568][T18759] device hsr_slave_0 entered promiscuous mode [ 1435.167373][T18875] loop3: detected capacity change from 0 to 8192 [ 1435.204688][T18759] device hsr_slave_1 entered promiscuous mode [ 1435.260123][T18875] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 1435.275733][T15955] Bluetooth: hci2: command 0x0406 tx timeout [ 1435.294111][T18759] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1435.310664][T18875] REISERFS (device loop3): found reiserfs format "3.6" with non-standard journal [ 1435.320584][T18875] REISERFS (device loop3): using ordered data mode [ 1435.327235][T18875] reiserfs: using flush barriers [ 1435.333350][T18875] REISERFS (device loop3): journal params: device loop3, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 1435.349948][T18759] Cannot create hsr debugfs directory [ 1435.356428][T18875] REISERFS (device loop3): checking transaction log (loop3) [ 1435.557137][T18875] REISERFS (device loop3): Using tea hash to sort names [ 1435.570066][T18875] REISERFS warning (device loop3): vs-13060 reiserfs_update_sd_size: stat data of object [1 2 0x0 SD] (nlink == 4) not found (pos 2) [ 1435.622621][T18875] REISERFS (device loop3): Created .reiserfs_priv - reserved for xattr storage. [ 1435.917669][T18888] device syzkaller0 entered promiscuous mode [ 1437.658464][T11837] device hsr_slave_0 left promiscuous mode [ 1437.695495][T11837] device hsr_slave_1 left promiscuous mode [ 1437.715341][T11837] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1437.745817][T11837] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1437.756822][T11837] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1437.765935][T11837] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1437.826496][T11837] device bridge_slave_1 left promiscuous mode [ 1437.836508][T11837] bridge0: port 2(bridge_slave_1) entered disabled state [ 1437.869388][T11837] device bridge_slave_0 left promiscuous mode [ 1437.885862][T11837] bridge0: port 1(bridge_slave_0) entered disabled state [ 1437.997541][T11837] device veth1_macvtap left promiscuous mode [ 1438.013246][T11837] device veth0_macvtap left promiscuous mode [ 1438.024197][T11837] device veth1_vlan left promiscuous mode [ 1438.038766][T11837] device veth0_vlan left promiscuous mode [ 1438.991431][T11837] team0 (unregistering): Port device team_slave_1 removed [ 1439.038552][T11837] team0 (unregistering): Port device team_slave_0 removed [ 1439.087207][T11837] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1439.096745][T11837] device bond_slave_1 left promiscuous mode [ 1439.143982][T11837] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1439.153716][T11837] device bond_slave_0 left promiscuous mode [ 1439.693648][T11837] bond0 (unregistering): Released all slaves [ 1439.774539][T18759] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1439.868898][T18924] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1439.907608][T18759] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1439.919312][T18759] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1439.957974][T18759] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1440.041665][T18924] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1440.082278][T18953] tipc: Enabled bearer , priority 0 [ 1440.128637][T18954] device syzkaller0 entered promiscuous mode [ 1440.181726][T18957] loop3: detected capacity change from 0 to 8192 [ 1440.224839][T18957] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 1440.251220][T18924] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1440.256361][T18957] REISERFS (device loop3): found reiserfs format "3.6" with non-standard journal [ 1440.283741][T18957] REISERFS (device loop3): using ordered data mode [ 1440.290851][T18957] reiserfs: using flush barriers [ 1440.297194][T18957] REISERFS (device loop3): journal params: device loop3, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 1440.323416][T18957] REISERFS (device loop3): checking transaction log (loop3) [ 1440.387885][T18953] tipc: Resetting bearer [ 1440.489493][T18924] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1440.545930][T18952] tipc: Resetting bearer [ 1440.556006][T18957] REISERFS (device loop3): Using tea hash to sort names [ 1440.576008][T18957] REISERFS warning (device loop3): vs-13060 reiserfs_update_sd_size: stat data of object [1 2 0x0 SD] (nlink == 4) not found (pos 2) [ 1440.616423][T18952] tipc: Disabling bearer [ 1440.624176][T18957] REISERFS (device loop3): Created .reiserfs_priv - reserved for xattr storage. [ 1440.821646][T18924] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1440.903384][T18924] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1440.970844][T18924] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1441.031907][T18924] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1441.092112][T18759] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1441.195890][T18344] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1441.204081][T18344] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1441.307689][T18759] 8021q: adding VLAN 0 to HW filter on device team0 [ 1441.326443][ T7740] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1441.341601][ T7740] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1441.385329][ T7740] bridge0: port 1(bridge_slave_0) entered blocking state [ 1441.392531][ T7740] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1441.550964][ T7740] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1441.744048][T11837] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1441.787407][T11837] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1441.828187][T11837] bridge0: port 2(bridge_slave_1) entered blocking state [ 1441.835355][T11837] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1442.072084][ T4747] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1442.117412][ T4747] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1442.127966][ T4747] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1442.158305][ T4747] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1442.190616][ T4747] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1442.257592][ T4747] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1442.283934][ T4747] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1442.323660][T18997] tipc: Enabled bearer , priority 0 [ 1442.335195][ T4900] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1442.380417][ T4900] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1442.402672][T18996] tipc: Resetting bearer [ 1442.414342][T18344] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1442.427072][T18344] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1442.467417][T18994] tipc: Disabling bearer [ 1442.494374][T18759] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1443.419952][T19022] device syzkaller0 entered promiscuous mode [ 1443.540512][ T4900] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1443.598294][ T4900] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1443.650096][T19028] tipc: Enabled bearer , priority 0 [ 1443.748101][T18759] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1443.755435][T19025] device syzkaller0 entered promiscuous mode [ 1443.796138][T19025] tipc: Resetting bearer [ 1443.831893][T19024] tipc: Resetting bearer [ 1443.949079][T19024] tipc: Disabling bearer [ 1444.030289][T19038] tipc: Enabled bearer , priority 0 [ 1444.077076][T19038] tipc: Resetting bearer [ 1444.270167][T19035] tipc: Disabling bearer [ 1445.072787][T19049] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1445.219641][T19049] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1445.475191][T19049] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1445.538546][ T4846] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1445.554125][ T4846] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1445.650366][T19049] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1445.714867][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1445.744690][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1445.760588][T18759] device veth0_vlan entered promiscuous mode [ 1445.780654][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1445.796010][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1445.831748][T18759] device veth1_vlan entered promiscuous mode [ 1445.928051][ T4846] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 1445.946558][ T4846] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 1445.988041][ T4846] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1446.007033][ T4846] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1446.037684][T18759] device veth0_macvtap entered promiscuous mode [ 1446.068553][T19049] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1446.121394][T18759] device veth1_macvtap entered promiscuous mode [ 1446.144733][T19049] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1446.187727][ T4747] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1446.206550][ T4747] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 1446.244496][T18759] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1446.280069][T18759] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1446.300277][T18759] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1446.321034][T18759] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1446.343038][T18759] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1446.363833][T18759] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1446.396208][T18759] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1446.418852][T18759] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1446.439866][T18759] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1446.462956][T18759] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1446.482324][T18759] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1446.505071][T18759] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1446.526140][T18759] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1446.549210][T18759] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1446.570237][T18759] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1446.582434][T18759] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1446.594475][T18759] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1446.623531][T19049] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1446.654547][ T4846] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1446.674136][ T4846] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1446.732557][T19049] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1446.780086][T18759] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1446.798854][T18759] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1446.808868][T18759] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1446.819497][T18759] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1446.829549][T18759] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1446.840152][T18759] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1446.850301][T18759] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1446.861303][T18759] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1446.874195][T18759] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1446.896220][T18759] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1446.906352][T18759] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1446.916918][T18759] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1446.926878][T18759] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1446.937492][T18759] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1446.947394][T18759] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1446.958089][T18759] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1446.980295][T18759] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1446.994248][ T4846] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1447.026972][ T4846] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1447.057837][T18759] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1447.107811][T18759] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1447.135505][T18759] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1447.145719][T18759] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1448.578666][ T6444] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1448.614848][ T5155] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1448.635124][ T6444] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1448.657162][ T5155] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1448.701695][T17148] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1448.723112][T17148] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 1450.354708][T19132] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1450.498568][T19135] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1450.552228][T19132] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1450.738278][T19135] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1450.764267][T19132] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1450.889990][T19135] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1450.926767][T19132] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1451.037100][T19135] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1451.189417][T19132] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1451.293240][T19132] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1451.323259][T19132] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1451.381530][T19135] netdevsim netdevsim5 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1451.413650][T19135] netdevsim netdevsim5 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1451.461584][T19132] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1451.510199][T19135] netdevsim netdevsim5 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1451.552477][T19151] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1451.590344][T19135] netdevsim netdevsim5 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1451.654180][T19151] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1452.584033][T19151] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1452.683361][T19151] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1454.273388][T19192] netlink: 96 bytes leftover after parsing attributes in process `syz.5.3451'. [ 1454.605574][T19200] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1454.683031][T19200] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1454.753827][T19151] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1454.782802][T19200] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1454.870129][T19151] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1454.980858][T19151] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1455.009183][T19205] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1455.073604][T19200] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1455.117537][T19151] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1455.138869][T19205] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1455.249323][T19205] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1455.349308][T19200] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1455.378588][T19205] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1455.424218][T19200] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1455.500955][T19200] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1455.595235][T19200] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1459.723079][T19267] tipc: Enabling of bearer rejected, failed to enable media [ 1459.830934][T19205] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1459.874826][T19205] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1459.938228][T19205] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1460.005453][T19205] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1460.875805][T15955] Bluetooth: hci1: command 0x0406 tx timeout [ 1466.648371][T19372] device syzkaller0 entered promiscuous mode [ 1468.689076][T19409] device syzkaller0 entered promiscuous mode [ 1469.301441][T19425] device syzkaller0 entered promiscuous mode [ 1469.669400][T19312] Set syz1 is full, maxelem 65536 reached [ 1469.828604][T19431] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1470.910244][T19431] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1471.060947][T19431] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1472.056532][T19431] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1472.392322][T19431] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1472.464642][T19431] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1472.521334][T19431] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1472.567832][T19431] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1474.726589][T19517] tipc: Enabled bearer , priority 0 [ 1474.768551][T19517] tipc: Resetting bearer [ 1474.819594][T19515] tipc: Disabling bearer [ 1475.172072][T19537] netdevsim netdevsim5 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1475.272470][T19537] netdevsim netdevsim5 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1475.373456][T19537] netdevsim netdevsim5 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1475.455053][T19537] netdevsim netdevsim5 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1475.599781][T19537] netdevsim netdevsim5 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1475.642102][T19537] netdevsim netdevsim5 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1475.680107][T19537] netdevsim netdevsim5 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1475.700889][T19537] netdevsim netdevsim5 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1478.137875][T19586] tipc: Enabled bearer , priority 0 [ 1478.176647][T19586] device syzkaller0 entered promiscuous mode [ 1478.260941][T19583] tipc: Resetting bearer [ 1478.360874][T19583] tipc: Disabling bearer [ 1478.633137][T19603] device syzkaller0 entered promiscuous mode [ 1481.445591][ T4283] Bluetooth: hci0: command 0x0406 tx timeout [ 1481.748605][T19646] loop3: detected capacity change from 0 to 8192 [ 1481.776588][T19646] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 1481.789841][T19646] REISERFS (device loop3): found reiserfs format "3.6" with non-standard journal [ 1481.799524][T19646] REISERFS (device loop3): using ordered data mode [ 1481.807393][T19646] reiserfs: using flush barriers [ 1481.813518][T19646] REISERFS (device loop3): journal params: device loop3, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 1481.842642][T19646] REISERFS (device loop3): checking transaction log (loop3) [ 1481.942579][T19646] REISERFS (device loop3): Using tea hash to sort names [ 1481.955153][T19646] REISERFS warning (device loop3): vs-13060 reiserfs_update_sd_size: stat data of object [1 2 0x0 SD] (nlink == 4) not found (pos 2) [ 1481.977782][T19646] REISERFS (device loop3): Created .reiserfs_priv - reserved for xattr storage. [ 1484.403542][ T1272] ieee802154 phy0 wpan0: encryption failed: -22 [ 1484.421009][ T1272] ieee802154 phy1 wpan1: encryption failed: -22 [ 1484.895983][T19663] tipc: Enabling of bearer rejected, failed to enable media [ 1485.045402][T19676] device syzkaller0 entered promiscuous mode [ 1487.174732][T19725] netlink: 68 bytes leftover after parsing attributes in process `syz.2.3572'. [ 1487.211763][T19725] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3572'. [ 1490.284432][T19693] Set syz1 is full, maxelem 65536 reached [ 1491.702832][T19733] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1491.744780][T19743] tipc: Enabling of bearer rejected, failed to enable media [ 1491.816022][T19733] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1491.910328][T19733] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1492.060649][T19733] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1492.929340][T19733] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1493.007280][T19733] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1493.046766][T19733] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1493.097655][T19733] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1494.536074][T19812] netlink: 68 bytes leftover after parsing attributes in process `syz.5.3590'. [ 1494.575753][T19812] netlink: 40 bytes leftover after parsing attributes in process `syz.5.3590'. [ 1498.520210][T19870] netlink: 68 bytes leftover after parsing attributes in process `syz.3.3606'. [ 1498.545744][T19870] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3606'. [ 1498.637470][T19868] tipc: Enabled bearer , priority 0 [ 1498.648677][T19867] tipc: Resetting bearer [ 1499.625306][T19799] Set syz1 is full, maxelem 65536 reached [ 1503.307159][T19866] tipc: Disabling bearer [ 1503.368669][T19874] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1503.414366][T19913] netlink: 68 bytes leftover after parsing attributes in process `syz.5.3619'. [ 1503.424080][T19913] netlink: 40 bytes leftover after parsing attributes in process `syz.5.3619'. [ 1503.497815][T19874] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1503.580807][T19874] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1503.667773][T19874] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1504.354239][T19938] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1504.399811][T19929] device syzkaller0 entered promiscuous mode [ 1504.418356][T19929] IPv6: ADDRCONF(NETDEV_CHANGE): syzkaller0: link becomes ready [ 1504.596963][T19938] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1504.661901][T19938] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1504.763783][T19874] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1505.018369][T19874] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1505.275909][T19938] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1505.328305][T19874] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1505.411521][T19874] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1505.518253][T19938] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1505.581494][T19938] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1505.639126][T19938] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1505.685017][T19952] tipc: Enabled bearer , priority 0 [ 1505.721125][T19938] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1505.762631][T19952] tipc: Resetting bearer [ 1505.895945][T19951] tipc: Disabling bearer [ 1510.938962][T20035] netlink: 68 bytes leftover after parsing attributes in process `syz.3.3658'. [ 1511.062342][T20035] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3658'. [ 1518.311521][T20058] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 1518.329579][T20058] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1518.389318][T20058] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1518.548740][T20058] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 1518.631591][T20058] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1518.664303][T20058] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1518.916458][T20107] device syzkaller0 entered promiscuous mode [ 1519.362961][T20110] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 1519.411773][T20110] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1519.429019][T20110] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1519.466957][T20110] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 1519.759359][T20115] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3682'. [ 1519.836131][T20118] tipc: Started in network mode [ 1519.841046][T20118] tipc: Node identity 86a3d7be66c1, cluster identity 4711 [ 1519.869384][T20118] tipc: Enabled bearer , priority 0 [ 1519.962168][T20116] device syzkaller0 entered promiscuous mode [ 1519.997838][T20118] tipc: Resetting bearer [ 1520.975701][ T7] tipc: Node number set to 3764574142 [ 1524.449475][T20117] tipc: Disabling bearer [ 1524.476252][T20136] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3686'. [ 1524.655053][T20139] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1524.768625][T20139] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1524.900194][T20139] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1525.124548][ T4367] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 1525.458193][T20139] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1525.624913][T20139] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1525.636316][ T4367] usb 4-1: Using ep0 maxpacket: 32 [ 1525.645355][T20158] netlink: 68 bytes leftover after parsing attributes in process `syz.2.3694'. [ 1525.648845][ T4367] usb 4-1: config 0 has an invalid interface number: 89 but max is 0 [ 1525.674570][ T4367] usb 4-1: config 0 has no interface number 0 [ 1525.676812][T20139] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1525.682741][ T4367] usb 4-1: config 0 interface 89 has no altsetting 0 [ 1525.689615][T20158] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3694'. [ 1525.757596][ T4367] usb 4-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1525.775717][ T4367] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1525.784634][T20139] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1525.801103][T20139] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1525.857396][ T4367] usb 4-1: Product: syz [ 1525.866339][ T4367] usb 4-1: Manufacturer: syz [ 1525.871706][ T4367] usb 4-1: SerialNumber: syz [ 1525.927498][ T4367] usb 4-1: config 0 descriptor?? [ 1525.946913][ T4367] em28xx 4-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1525.996810][ T4367] em28xx 4-1:0.89: Video interface 89 found: bulk [ 1527.107772][ T4367] em28xx 4-1:0.89: unknown em28xx chip ID (0) [ 1527.436514][ T7] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 1527.645665][ T7] usb 6-1: Using ep0 maxpacket: 8 [ 1527.654553][ T7] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 1527.721369][ T7] usb 6-1: config 0 has no interface number 0 [ 1527.753189][ T7] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1527.841573][ T7] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1527.906819][ T7] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1528.016589][ T7] usb 6-1: config 0 descriptor?? [ 1528.157190][ T7] iowarrior 6-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1528.249562][ T4367] em28xx 4-1:0.89: failed to get i2c transfer status from bridge register (error=-5) [ 1528.295641][ T4367] em28xx 4-1:0.89: board has no eeprom [ 1528.313182][T16938] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 1528.414077][ T4367] em28xx 4-1:0.89: Identified as Terratec Grabby (card=67) [ 1528.421578][ T4367] em28xx 4-1:0.89: analog set to bulk mode. [ 1528.452564][ T4367] usb 4-1: USB disconnect, device number 13 [ 1528.459441][ T4367] em28xx 4-1:0.89: Disconnecting em28xx [ 1528.465982][T17896] em28xx 4-1:0.89: Registering V4L2 extension [ 1528.526240][T16938] usb 1-1: Using ep0 maxpacket: 32 [ 1528.567401][T16938] usb 1-1: config index 0 descriptor too short (expected 156, got 27) [ 1528.579247][T17896] em28xx 4-1:0.89: Config register raw data: 0xffffffed [ 1528.582720][T16938] usb 1-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 1528.586976][T17896] em28xx 4-1:0.89: AC97 chip type couldn't be determined [ 1528.599683][T16938] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 1528.623630][T17896] em28xx 4-1:0.89: No AC97 audio processor [ 1528.637065][T16938] usb 1-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 1528.658840][T16938] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1528.668783][T17896] usb 4-1: Decoder not found [ 1528.670262][T16938] usb 1-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 1528.679102][T17896] em28xx 4-1:0.89: failed to create media graph [ 1528.694945][T17896] em28xx 4-1:0.89: V4L2 device video103 deregistered [ 1528.701996][T16938] usb 1-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 1528.702111][T16938] usb 1-1: Product: syz [ 1528.702142][T16938] usb 1-1: Manufacturer: syz [ 1528.702170][T16938] usb 1-1: SerialNumber: syz [ 1528.724253][T16938] usb 1-1: config 0 descriptor?? [ 1528.737089][T16938] ldusb 1-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 1528.750349][T16938] ldusb 1-1:0.0: LD USB Device #1 now attached to major 180 minor 1 [ 1528.783171][T17896] em28xx 4-1:0.89: Registering snapshot button... [ 1528.927732][T17896] input: em28xx snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.89/input/input6 [ 1528.963292][T17896] em28xx 4-1:0.89: Remote control support is not available for this card. [ 1528.983896][ T4367] em28xx 4-1:0.89: Closing input extension [ 1529.002053][ T4367] em28xx 4-1:0.89: Deregistering snapshot button [ 1529.133874][ T4367] em28xx 4-1:0.89: Freeing device [ 1529.394400][ T4367] usb 6-1: USB disconnect, device number 2 [ 1529.436289][T18549] usb 1-1: USB disconnect, device number 15 [ 1529.493849][T18549] ldusb 1-1:0.0: LD USB Device #1 now disconnected [ 1534.568154][T20199] tipc: Enabled bearer , priority 0 [ 1534.588678][T20201] device syzkaller0 entered promiscuous mode [ 1534.626246][T20205] tipc: Resetting bearer [ 1534.633274][T20236] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1534.692387][T20195] tipc: Resetting bearer [ 1534.776640][T20195] tipc: Disabling bearer [ 1535.285754][ T4367] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 1535.485706][ T4367] usb 3-1: Using ep0 maxpacket: 32 [ 1535.500188][ T4367] usb 3-1: config index 0 descriptor too short (expected 156, got 27) [ 1535.543454][ T4367] usb 3-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 1536.065815][ T4367] usb 3-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 1536.078898][ T4367] usb 3-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 1536.094408][ T4367] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1536.123752][ T4367] usb 3-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 1536.165778][ T4367] usb 3-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 1536.178508][ T4367] usb 3-1: Product: syz [ 1536.183425][ T4367] usb 3-1: Manufacturer: syz [ 1536.197216][ T4367] usb 3-1: SerialNumber: syz [ 1536.214221][ T4367] usb 3-1: config 0 descriptor?? [ 1536.237617][ T4367] ldusb 3-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 1536.308986][ T4367] ldusb 3-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 1536.605682][ T7] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 1536.805762][ T7] usb 1-1: Using ep0 maxpacket: 32 [ 1536.813708][ T7] usb 1-1: config 0 has an invalid interface number: 89 but max is 0 [ 1536.850454][ T7] usb 1-1: config 0 has no interface number 0 [ 1536.878643][ T7] usb 1-1: config 0 interface 89 has no altsetting 0 [ 1536.907155][ T7] usb 1-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1536.941597][ T7] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1536.974306][ T7] usb 1-1: Product: syz [ 1536.990919][T20282] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3725'. [ 1536.992006][ T7] usb 1-1: Manufacturer: syz [ 1537.020851][ T7] usb 1-1: SerialNumber: syz [ 1537.036632][ T7] usb 1-1: config 0 descriptor?? [ 1537.047307][ T7] em28xx 1-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1537.059144][ T7] em28xx 1-1:0.89: Video interface 89 found: bulk [ 1537.300851][T20287] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 1537.332229][T20287] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1537.341723][T20287] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1537.372770][T20289] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3728'. [ 1537.385026][T20289] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3728'. [ 1537.653899][ T7] em28xx 1-1:0.89: unknown em28xx chip ID (0) [ 1537.908092][T16938] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 1538.081507][T20302] tipc: Enabled bearer , priority 0 [ 1538.091209][T20302] device syzkaller0 entered promiscuous mode [ 1538.097727][T16938] usb 6-1: Using ep0 maxpacket: 32 [ 1538.106054][T16938] usb 6-1: config index 0 descriptor too short (expected 156, got 27) [ 1538.118743][T20302] tipc: Resetting bearer [ 1538.119130][T16938] usb 6-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 1538.139463][T20301] tipc: Resetting bearer [ 1538.142674][T16938] usb 6-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 1538.159534][T16938] usb 6-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 1538.174114][T16938] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1538.188893][T16938] usb 6-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 1538.192234][ T22] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 1538.208309][T16938] usb 6-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 1538.218950][T20301] tipc: Disabling bearer [ 1538.221994][T16938] usb 6-1: Product: syz [ 1538.236572][T16938] usb 6-1: Manufacturer: syz [ 1538.241789][T16938] usb 6-1: SerialNumber: syz [ 1538.261733][T16938] usb 6-1: config 0 descriptor?? [ 1538.272230][T16938] ldusb 6-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 1538.284238][T16938] ldusb 6-1:0.0: LD USB Device #1 now attached to major 180 minor 1 [ 1538.396140][ T22] usb 2-1: Using ep0 maxpacket: 32 [ 1538.426983][ T22] usb 2-1: config index 0 descriptor too short (expected 156, got 27) [ 1538.438893][ T22] usb 2-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 1538.454318][ T22] usb 2-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 1538.467627][ T22] usb 2-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 1538.492981][ T22] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1538.513894][ T22] usb 2-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 1538.542912][ T22] usb 2-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 1538.557808][ T22] usb 2-1: Product: syz [ 1538.563445][ T22] usb 2-1: Manufacturer: syz [ 1538.569623][ T22] usb 2-1: SerialNumber: syz [ 1538.577637][ T22] usb 2-1: config 0 descriptor?? [ 1538.608023][ T22] ldusb 2-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 1538.690243][ T7] em28xx 1-1:0.89: failed to get i2c transfer status from bridge register (error=-5) [ 1538.705741][ T7] em28xx 1-1:0.89: board has no eeprom [ 1538.804094][ T7] em28xx 1-1:0.89: Identified as Terratec Grabby (card=67) [ 1538.811882][ T7] em28xx 1-1:0.89: analog set to bulk mode. [ 1538.826553][ T7] usb 1-1: USB disconnect, device number 16 [ 1538.834746][T16938] em28xx 1-1:0.89: Registering V4L2 extension [ 1538.842793][ T7] em28xx 1-1:0.89: Disconnecting em28xx [ 1538.989668][T16938] em28xx 1-1:0.89: Config register raw data: 0xffffffed [ 1538.997210][T16938] em28xx 1-1:0.89: AC97 chip type couldn't be determined [ 1539.007207][T16938] em28xx 1-1:0.89: No AC97 audio processor [ 1539.018184][T16938] usb 1-1: Decoder not found [ 1539.023134][T16938] em28xx 1-1:0.89: failed to create media graph [ 1539.030394][T16938] em28xx 1-1:0.89: V4L2 device video103 deregistered [ 1539.039096][T16938] em28xx 1-1:0.89: Registering snapshot button... [ 1539.049018][T16938] input: em28xx snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.89/input/input7 [ 1539.063556][T16938] em28xx 1-1:0.89: Remote control support is not available for this card. [ 1539.074527][ T7] em28xx 1-1:0.89: Closing input extension [ 1539.084545][ T7] em28xx 1-1:0.89: Deregistering snapshot button [ 1539.110300][ T7] em28xx 1-1:0.89: Freeing device [ 1539.265878][T17896] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 1539.475799][T17896] usb 4-1: Using ep0 maxpacket: 32 [ 1539.483347][T17896] usb 4-1: config index 0 descriptor too short (expected 156, got 27) [ 1539.493043][T17896] usb 4-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 1539.505226][T17896] usb 4-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 1539.517826][T17896] usb 4-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 1539.532208][T17896] usb 4-1: config 0 interface 0 has no altsetting 0 [ 1539.543057][T17896] usb 4-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 1539.553144][T17896] usb 4-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 1539.564036][T17896] usb 4-1: Product: syz [ 1539.577626][T17896] usb 4-1: Manufacturer: syz [ 1539.582508][T17896] usb 4-1: SerialNumber: syz [ 1539.602934][T17896] usb 4-1: config 0 descriptor?? [ 1539.628217][T17896] ldusb 4-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 1540.625357][ T22] ldusb 2-1:0.0: LD USB Device #2 now attached to major 180 minor 2 [ 1540.650727][ T22] usb 2-1: USB disconnect, device number 17 [ 1540.690520][ T7] usb 6-1: USB disconnect, device number 3 [ 1540.691438][T20326] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1540.767771][T20326] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1540.826614][T20326] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1540.913075][T20326] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1541.033951][T20326] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1541.052962][T20326] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1541.069557][T20335] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1541.089780][T20326] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1541.112321][T20326] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1541.130964][T20335] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1541.200085][T20335] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1541.262337][T20335] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1541.283268][T20338] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1541.336802][T20335] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1541.351634][T20335] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1541.369893][T20335] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1541.381265][T20338] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1541.401399][T20335] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1541.423699][T20338] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1541.477834][T20338] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1541.519489][T20254] ldusb 3-1:0.0: Couldn't submit HID_REQ_SET_REPORT -110 [ 1541.534476][T17896] ldusb 4-1:0.0: LD USB Device #3 now attached to major 180 minor 3 [ 1541.543121][ T22] ldusb 2-1:0.0: LD USB Device #2 now disconnected [ 1541.543149][ T7] ldusb 6-1:0.0: LD USB Device #1 now disconnected [ 1541.559300][T20341] IPv6: ADDRCONF(NETDEV_CHANGE): syz_tun: link becomes ready [ 1541.588770][T17896] usb 4-1: USB disconnect, device number 14 [ 1541.621204][T20341] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 1541.629953][T16938] usb 3-1: USB disconnect, device number 10 [ 1541.630093][T17896] ldusb 4-1:0.0: LD USB Device #3 now disconnected [ 1541.653820][T16938] ldusb 3-1:0.0: LD USB Device #0 now disconnected [ 1541.667888][T20341] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1541.680960][T20341] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1541.869855][T20347] tipc: Enabled bearer , priority 0 [ 1541.878732][T20347] device syzkaller0 entered promiscuous mode [ 1541.918813][T20347] tipc: Resetting bearer [ 1541.932227][T20346] tipc: Resetting bearer [ 1541.954374][T20346] tipc: Disabling bearer [ 1541.955884][ T7] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 1542.155853][ T7] usb 6-1: Using ep0 maxpacket: 32 [ 1542.166911][ T7] usb 6-1: config 0 has an invalid interface number: 89 but max is 0 [ 1542.175271][ T7] usb 6-1: config 0 has no interface number 0 [ 1542.182605][ T7] usb 6-1: config 0 interface 89 has no altsetting 0 [ 1542.199984][ T7] usb 6-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1542.209784][ T7] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1542.221235][ T7] usb 6-1: Product: syz [ 1542.229212][ T7] usb 6-1: Manufacturer: syz [ 1542.234479][ T7] usb 6-1: SerialNumber: syz [ 1542.246974][ T7] usb 6-1: config 0 descriptor?? [ 1542.263167][ T7] em28xx 6-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1542.273243][ T7] em28xx 6-1:0.89: Video interface 89 found: bulk [ 1542.865040][ T7] em28xx 6-1:0.89: unknown em28xx chip ID (0) [ 1542.895780][T15094] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 1543.098045][T15094] usb 3-1: New USB device found, idVendor=056a, idProduct=0003, bcdDevice= 0.00 [ 1543.107849][T15094] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1543.118780][T15094] usb 3-1: config 0 descriptor?? [ 1543.534811][T15094] usbhid 3-1:0.0: can't add hid device: -71 [ 1543.550045][T15094] usbhid: probe of 3-1:0.0 failed with error -71 [ 1543.571109][T15094] usb 3-1: USB disconnect, device number 11 [ 1543.975735][ T125] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 1544.094871][ T7] em28xx 6-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 1544.139371][ T7] em28xx 6-1:0.89: board has no eeprom [ 1544.167350][ T125] usb 4-1: Using ep0 maxpacket: 8 [ 1544.177436][ T125] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 1544.185910][ T125] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1544.196020][ T125] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1544.207924][ T125] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1544.218450][ T125] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1544.232215][ T7] em28xx 6-1:0.89: Identified as Terratec Grabby (card=67) [ 1544.239976][ T125] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1544.249367][ T7] em28xx 6-1:0.89: analog set to bulk mode. [ 1544.257711][ T125] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1544.283587][ T7] usb 6-1: USB disconnect, device number 4 [ 1544.298404][ T7] em28xx 6-1:0.89: Disconnecting em28xx [ 1544.311986][T16938] em28xx 6-1:0.89: Registering V4L2 extension [ 1544.405922][T16938] em28xx 6-1:0.89: Config register raw data: 0xffffffed [ 1544.421182][T16938] em28xx 6-1:0.89: AC97 chip type couldn't be determined [ 1544.437727][T16938] em28xx 6-1:0.89: No AC97 audio processor [ 1544.471247][T16938] usb 6-1: Decoder not found [ 1544.477084][T16938] em28xx 6-1:0.89: failed to create media graph [ 1544.490883][T16938] em28xx 6-1:0.89: V4L2 device video103 deregistered [ 1544.510401][T16938] em28xx 6-1:0.89: Registering snapshot button... [ 1544.517419][ T125] usb 4-1: GET_CAPABILITIES returned 0 [ 1544.523384][ T125] usbtmc 4-1:16.0: can't read capabilities [ 1544.554142][T16938] input: em28xx snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.89/input/input8 [ 1544.592183][T16938] em28xx 6-1:0.89: Remote control support is not available for this card. [ 1544.602209][ T7] em28xx 6-1:0.89: Closing input extension [ 1544.608437][ T7] em28xx 6-1:0.89: Deregistering snapshot button [ 1544.642412][ T7] em28xx 6-1:0.89: Freeing device [ 1544.847461][T20376] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1544.879910][T20376] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1545.255608][ T7] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 1545.435657][ T7] usb 6-1: Using ep0 maxpacket: 32 [ 1545.448861][ T7] usb 6-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 1545.465661][ T7] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1545.473809][ T7] usb 6-1: Product: syz [ 1545.478204][ T7] usb 6-1: Manufacturer: syz [ 1545.483126][ T7] usb 6-1: SerialNumber: syz [ 1545.506440][ T7] usb 6-1: config 0 descriptor?? [ 1545.540355][ T7] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 1545.848795][ T1272] ieee802154 phy0 wpan0: encryption failed: -22 [ 1545.857807][ T1272] ieee802154 phy1 wpan1: encryption failed: -22 [ 1546.921191][T20338] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1546.942359][T20338] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1546.961515][T20338] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1546.979429][T20338] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1547.365730][ T22] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 1547.555753][ T22] usb 1-1: Using ep0 maxpacket: 8 [ 1547.565363][ T22] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 1547.574501][ T22] usb 1-1: config 0 has no interface number 0 [ 1547.581767][ T22] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1547.593645][ T22] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1547.615690][ T22] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1547.638324][ T22] usb 1-1: config 0 descriptor?? [ 1547.660513][ T22] iowarrior 1-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior1 [ 1547.914847][T20395] tipc: Enabled bearer , priority 0 [ 1547.932995][T20395] tipc: Resetting bearer [ 1547.940385][ T7] gspca_stk1135: reg_w 0x300 err -71 [ 1547.953831][ T7] gspca_stk1135: serial bus timeout: status=0x00 [ 1547.969243][ T7] gspca_stk1135: Sensor write failed [ 1547.983628][T20394] tipc: Disabling bearer [ 1547.994257][ T7] gspca_stk1135: serial bus timeout: status=0x00 [ 1548.009830][ T7] gspca_stk1135: Sensor write failed [ 1548.015479][ T7] gspca_stk1135: serial bus timeout: status=0x00 [ 1548.031215][ T7] gspca_stk1135: Sensor read failed [ 1548.045717][ T7] gspca_stk1135: serial bus timeout: status=0x00 [ 1548.052486][ T7] gspca_stk1135: Sensor read failed [ 1548.059304][ T7] gspca_stk1135: Detected sensor type unknown (0x0) [ 1548.085876][ T7] gspca_stk1135: serial bus timeout: status=0x00 [ 1548.111955][ T7] gspca_stk1135: Sensor read failed [ 1548.128036][ T7] gspca_stk1135: serial bus timeout: status=0x00 [ 1548.134688][ T7] gspca_stk1135: Sensor read failed [ 1548.153001][ T7] gspca_stk1135: serial bus timeout: status=0x00 [ 1548.172506][ T7] gspca_stk1135: Sensor write failed [ 1548.182003][ T7] gspca_stk1135: serial bus timeout: status=0x00 [ 1548.208391][ T7] gspca_stk1135: Sensor write failed [ 1548.214413][ T7] stk1135: probe of 6-1:0.0 failed with error -71 [ 1548.237552][ T7] usb 6-1: USB disconnect, device number 5 [ 1548.535796][T18549] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 1548.651264][T20411] device syzkaller0 entered promiscuous mode [ 1548.745668][T18549] usb 2-1: Using ep0 maxpacket: 32 [ 1548.754082][T18549] usb 2-1: config index 0 descriptor too short (expected 156, got 27) [ 1548.763562][T18549] usb 2-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 1548.782257][T18549] usb 2-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 1548.807538][T18549] usb 2-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 1548.830636][T18549] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1548.859965][T18549] usb 2-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 1548.885647][T18549] usb 2-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 1548.903672][T18549] usb 2-1: Product: syz [ 1548.910293][T18549] usb 2-1: Manufacturer: syz [ 1548.915029][T18549] usb 2-1: SerialNumber: syz [ 1548.932983][T18549] usb 2-1: config 0 descriptor?? [ 1548.945152][T18549] ldusb 2-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 1549.365941][ T4367] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 1549.436951][ T7] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 1549.555929][ T4367] usb 3-1: Using ep0 maxpacket: 32 [ 1549.563215][ T4367] usb 3-1: config index 0 descriptor too short (expected 156, got 27) [ 1549.572375][ T4367] usb 3-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 1549.584437][ T4367] usb 3-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 1549.597988][ T4367] usb 3-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 1549.611740][ T4367] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1549.620676][ T4367] usb 3-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 1549.630175][ T4367] usb 3-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 1549.635712][ T7] usb 6-1: Using ep0 maxpacket: 8 [ 1549.639189][ T4367] usb 3-1: Product: syz [ 1549.648600][ T4367] usb 3-1: Manufacturer: syz [ 1549.653339][ T4367] usb 3-1: SerialNumber: syz [ 1549.660495][ T7] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 1549.661621][ T4367] usb 3-1: config 0 descriptor?? [ 1549.679790][ T4367] ldusb 3-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 1549.679794][ T7] usb 6-1: config 0 has no interface number 0 [ 1549.679966][ T7] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1549.708785][ T7] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1549.719916][ T7] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1549.738961][ T7] usb 6-1: config 0 descriptor?? [ 1549.756356][T20366] usbtmc 4-1:16.0: usb_control_msg returned -110 [ 1549.770619][T18549] ldusb 2-1:0.0: LD USB Device #2 now attached to major 180 minor 2 [ 1549.771770][T15597] usb 1-1: USB disconnect, device number 17 [ 1549.788177][ T4367] ldusb 3-1:0.0: LD USB Device #3 now attached to major 180 minor 3 [ 1549.789129][ T7] iowarrior 6-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior4 [ 1549.836302][T18549] usb 2-1: USB disconnect, device number 18 [ 1549.844992][T18549] ldusb 2-1:0.0: LD USB Device #2 now disconnected [ 1549.900156][ T7] usb 4-1: USB disconnect, device number 15 [ 1550.048326][ T125] usb 3-1: USB disconnect, device number 12 [ 1550.063656][T20427] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3783'. [ 1550.078735][ T125] ldusb 3-1:0.0: LD USB Device #3 now disconnected [ 1550.161598][T20431] tipc: Enabling of bearer rejected, failed to enable media [ 1550.192401][T20431] device syzkaller0 entered promiscuous mode [ 1550.535686][ T7] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 1550.765692][ T7] usb 4-1: Using ep0 maxpacket: 8 [ 1550.787328][ T7] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 1550.813891][ T7] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1550.833159][ T7] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1550.843790][ T7] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1550.854731][ T7] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1550.890940][ T7] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1550.908071][ T7] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1550.928125][T20439] binder_alloc: 20438: binder_alloc_buf, no vma [ 1551.157180][ T7] usb 4-1: GET_CAPABILITIES returned 0 [ 1551.162750][ T7] usbtmc 4-1:16.0: can't read capabilities [ 1551.476349][ T125] usb 3-1: new full-speed USB device number 13 using dummy_hcd [ 1551.500839][T20447] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1551.511530][T20447] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1551.583684][ T7] usb 4-1: USB disconnect, device number 16 [ 1551.601806][T20429] usbtmc 4-1:16.0: usb_control_msg returned -71 [ 1551.632735][T20446] usbtmc 4-1:16.0: send_request_dev_dep_msg_in returned -19 [ 1551.685254][ T125] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1551.695255][ T125] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1551.704194][ T125] usb 3-1: Product: syz [ 1551.709395][ T125] usb 3-1: Manufacturer: syz [ 1551.714137][ T125] usb 3-1: SerialNumber: syz [ 1551.730522][ T125] usb 3-1: config 0 descriptor?? [ 1551.963026][ T125] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1552.204904][T15597] usb 6-1: USB disconnect, device number 6 [ 1552.711232][T15597] usb 6-1: new full-speed USB device number 7 using dummy_hcd [ 1552.909845][T15597] usb 6-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1552.919581][T15597] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1552.928136][T15597] usb 6-1: Product: syz [ 1552.932697][T15597] usb 6-1: Manufacturer: syz [ 1552.937722][T15597] usb 6-1: SerialNumber: syz [ 1552.953394][T15597] usb 6-1: config 0 descriptor?? [ 1553.041325][ T4283] Bluetooth: hci5: command 0x0406 tx timeout [ 1553.166481][T15597] usb 6-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1555.372212][ T125] dvb_usb_rtl28xxu: probe of 3-1:0.0 failed with error -71 [ 1555.382601][ T125] usb 3-1: USB disconnect, device number 13 [ 1556.095792][ T125] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 1556.255626][T17896] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 1556.285764][ T125] usb 2-1: Using ep0 maxpacket: 8 [ 1556.292947][ T125] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 1556.310707][ T125] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1556.322160][T15597] dvb_usb_rtl28xxu: probe of 6-1:0.0 failed with error -32 [ 1556.334500][ T125] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1556.355012][T15597] usb 6-1: USB disconnect, device number 7 [ 1556.355186][ T125] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1556.381444][ T125] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1556.405670][ T125] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1556.414985][ T125] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1556.467330][T17896] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1556.485574][T17896] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1556.495100][T17896] usb 3-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 1556.504627][T17896] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1556.521092][T17896] usb 3-1: config 0 descriptor?? [ 1556.663312][ T125] usb 2-1: GET_CAPABILITIES returned 0 [ 1556.669293][ T125] usbtmc 2-1:16.0: can't read capabilities [ 1556.805626][T20482] tipc: Enabling of bearer rejected, failed to enable media [ 1557.042296][T20493] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1557.066414][ T125] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 1557.076766][T20493] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1557.162887][T18549] usb 2-1: USB disconnect, device number 19 [ 1557.170522][T20471] usbtmc 2-1:16.0: usb_control_msg returned -71 [ 1557.188514][T20490] usbtmc 2-1:16.0: send_request_dev_dep_msg_in returned -19 [ 1557.265669][ T125] usb 4-1: Using ep0 maxpacket: 8 [ 1557.273661][ T125] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 1557.285752][ T7] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 1557.305659][ T125] usb 4-1: config 0 has no interface number 0 [ 1557.312149][ T125] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1557.332168][ T125] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1557.343649][ T125] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1557.370956][ T125] usb 4-1: config 0 descriptor?? [ 1557.394935][ T125] iowarrior 4-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1557.507752][ T7] usb 6-1: Using ep0 maxpacket: 32 [ 1557.517214][ T7] usb 6-1: config 0 has an invalid interface number: 89 but max is 0 [ 1557.526356][ T7] usb 6-1: config 0 has no interface number 0 [ 1557.532815][ T7] usb 6-1: config 0 interface 89 has no altsetting 0 [ 1557.561380][ T7] usb 6-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1557.571132][ T7] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1557.591214][ T7] usb 6-1: Product: syz [ 1557.600262][ T7] usb 6-1: Manufacturer: syz [ 1557.605453][ T7] usb 6-1: SerialNumber: syz [ 1557.624038][ T7] usb 6-1: config 0 descriptor?? [ 1557.641858][ T7] em28xx 6-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1557.666063][ T7] em28xx 6-1:0.89: Video interface 89 found: bulk [ 1558.249322][ T7] em28xx 6-1:0.89: unknown em28xx chip ID (0) [ 1558.455834][T11643] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 1558.642586][T18549] usb 4-1: USB disconnect, device number 17 [ 1558.658058][T11643] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1558.677131][T11643] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1558.688104][T11643] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1558.698550][T11643] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1558.712399][T11643] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1558.730103][T11643] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1558.739643][T11643] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1558.748164][T11643] usb 2-1: Product: syz [ 1558.752567][T11643] usb 2-1: Manufacturer: syz [ 1558.770097][T11643] cdc_wdm 2-1:1.0: skipping garbage [ 1558.775649][T11643] cdc_wdm 2-1:1.0: skipping garbage [ 1558.784969][T11643] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 1558.791678][T11643] cdc_wdm 2-1:1.0: Unknown control protocol [ 1559.018787][T18549] usb 3-1: USB disconnect, device number 14 [ 1559.064847][T20510] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1559.100192][T20510] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1559.125465][T20510] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1559.153333][T20510] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1559.489905][ T7] em28xx 6-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 1559.489986][ T7] em28xx 6-1:0.89: board has no eeprom [ 1559.565875][ T7] em28xx 6-1:0.89: Identified as Terratec Grabby (card=67) [ 1559.565905][ T7] em28xx 6-1:0.89: analog set to bulk mode. [ 1559.567380][T18549] em28xx 6-1:0.89: Registering V4L2 extension [ 1559.616296][ T7] usb 6-1: USB disconnect, device number 8 [ 1559.736102][ C1] cdc_wdm 2-1:1.0: Unexpected error -71 [ 1559.746824][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 1559.753946][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 1559.762109][ T7] em28xx 6-1:0.89: Disconnecting em28xx [ 1559.765466][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 1559.774791][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 1559.846483][T15094] usb 2-1: USB disconnect, device number 20 [ 1560.130561][T18549] em28xx 6-1:0.89: Config register raw data: 0xffffffed [ 1560.144159][T18549] em28xx 6-1:0.89: AC97 chip type couldn't be determined [ 1560.153367][T18549] em28xx 6-1:0.89: No AC97 audio processor [ 1560.193571][T18549] usb 6-1: Decoder not found [ 1560.199145][T18549] em28xx 6-1:0.89: failed to create media graph [ 1560.207514][T18549] em28xx 6-1:0.89: V4L2 device video103 deregistered [ 1560.218573][T18549] em28xx 6-1:0.89: Registering snapshot button... [ 1560.227146][T18549] input: em28xx snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.89/input/input9 [ 1560.252854][T18549] em28xx 6-1:0.89: Remote control support is not available for this card. [ 1560.264620][ T7] em28xx 6-1:0.89: Closing input extension [ 1560.271983][ T7] em28xx 6-1:0.89: Deregistering snapshot button [ 1560.298730][ T7] em28xx 6-1:0.89: Freeing device [ 1560.335709][ T125] usb 4-1: new full-speed USB device number 18 using dummy_hcd [ 1560.383903][T20530] tipc: Enabled bearer , priority 0 [ 1560.472153][T20530] device syzkaller0 entered promiscuous mode [ 1560.479400][T20530] tipc: Resetting bearer [ 1560.487661][T20533] tipc: Enabling of bearer rejected, failed to enable media [ 1560.522358][T20529] tipc: Resetting bearer [ 1560.553849][ T125] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1560.570163][ T125] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1560.592683][ T125] usb 4-1: Product: syz [ 1560.601339][ T125] usb 4-1: Manufacturer: syz [ 1560.612764][ T125] usb 4-1: SerialNumber: syz [ 1560.631386][ T125] usb 4-1: config 0 descriptor?? [ 1560.860398][ T125] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1561.018842][T11643] usb 2-1: new full-speed USB device number 21 using dummy_hcd [ 1561.220342][T11643] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1561.230616][T11643] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1561.239252][T11643] usb 2-1: Product: syz [ 1561.244020][T11643] usb 2-1: Manufacturer: syz [ 1561.250321][T11643] usb 2-1: SerialNumber: syz [ 1561.266215][T11643] usb 2-1: config 0 descriptor?? [ 1561.385704][ T7] tipc: Node number set to 2586535995 [ 1561.448218][T15597] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 1561.488799][T11643] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1561.695214][T15597] usb 3-1: Using ep0 maxpacket: 32 [ 1561.716863][T15597] usb 3-1: config 0 has an invalid interface number: 89 but max is 0 [ 1561.725321][T15597] usb 3-1: config 0 has no interface number 0 [ 1561.732194][T15597] usb 3-1: config 0 interface 89 has no altsetting 0 [ 1561.741619][T15597] usb 3-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1561.765938][T15597] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1561.774225][T15597] usb 3-1: Product: syz [ 1561.781366][T15597] usb 3-1: Manufacturer: syz [ 1561.786509][T15597] usb 3-1: SerialNumber: syz [ 1561.811164][T15597] usb 3-1: config 0 descriptor?? [ 1561.832588][T15597] em28xx 3-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1561.844908][T15597] em28xx 3-1:0.89: Video interface 89 found: bulk [ 1562.447972][T15597] em28xx 3-1:0.89: unknown em28xx chip ID (0) [ 1562.919053][T15597] em28xx 3-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 1562.943853][T15597] em28xx 3-1:0.89: board has no eeprom [ 1563.278564][T15597] em28xx 3-1:0.89: Identified as Terratec Grabby (card=67) [ 1563.286192][T15597] em28xx 3-1:0.89: analog set to bulk mode. [ 1563.314324][T15597] em28xx 3-1:0.89: Registering V4L2 extension [ 1563.411967][ T22] usb 3-1: USB disconnect, device number 15 [ 1563.420930][T15597] em28xx 3-1:0.89: reading from i2c device at 0x4a failed (error=-5) [ 1563.446638][ T22] em28xx 3-1:0.89: Disconnecting em28xx [ 1563.454122][T15597] em28xx 3-1:0.89: Config register raw data: 0xffffffed [ 1563.461668][T15597] em28xx 3-1:0.89: AC97 chip type couldn't be determined [ 1563.470081][T15597] em28xx 3-1:0.89: No AC97 audio processor [ 1563.497015][T15597] usb 3-1: Decoder not found [ 1563.508584][T15597] em28xx 3-1:0.89: failed to create media graph [ 1563.516322][T15597] em28xx 3-1:0.89: V4L2 device video103 deregistered [ 1563.527747][T15597] em28xx 3-1:0.89: Registering snapshot button... [ 1563.537663][T15597] input: em28xx snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.89/input/input10 [ 1563.565847][T15597] em28xx 3-1:0.89: Remote control support is not available for this card. [ 1563.574832][ T22] em28xx 3-1:0.89: Closing input extension [ 1563.581347][ T22] em28xx 3-1:0.89: Deregistering snapshot button [ 1563.619376][ T22] em28xx 3-1:0.89: Freeing device [ 1563.763096][ T125] dvb_usb_rtl28xxu: probe of 4-1:0.0 failed with error -71 [ 1563.783888][ T125] usb 4-1: USB disconnect, device number 18 [ 1564.635381][T11643] dvb_usb_rtl28xxu: probe of 2-1:0.0 failed with error -32 [ 1564.657582][T11643] usb 2-1: USB disconnect, device number 21 [ 1564.665960][ T7] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 1564.862983][ T7] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1564.880844][ T7] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1564.892388][ T7] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1564.902548][ T7] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1564.914050][ T7] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1564.939031][ T7] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1564.948706][ T7] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1564.957896][ T7] usb 4-1: Product: syz [ 1564.962094][ T7] usb 4-1: Manufacturer: syz [ 1564.993298][ T7] cdc_wdm 4-1:1.0: skipping garbage [ 1564.998708][ T7] cdc_wdm 4-1:1.0: skipping garbage [ 1565.022016][ T7] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 1565.028567][ T7] cdc_wdm 4-1:1.0: Unknown control protocol [ 1565.281927][T20562] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1565.297433][T20562] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1565.311935][T20562] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1565.323470][T20562] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1565.414339][T20529] tipc: Disabling bearer [ 1565.539898][T11643] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 1565.727232][ C1] cdc_wdm 4-1:1.0: Unexpected error -71 [ 1565.733737][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 1565.740464][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 1565.747326][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 1565.754191][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 1565.761876][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 1565.768700][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 1565.775263][ T22] usb 4-1: USB disconnect, device number 19 [ 1565.781836][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 1565.788736][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 1565.794820][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 1565.955705][T11643] usb 2-1: Using ep0 maxpacket: 32 [ 1565.975876][T11643] usb 2-1: config 0 has an invalid interface number: 89 but max is 0 [ 1566.032940][T11643] usb 2-1: config 0 has no interface number 0 [ 1566.063460][T11643] usb 2-1: config 0 interface 89 has no altsetting 0 [ 1566.104020][T11643] usb 2-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1566.542156][T11643] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1566.550552][T11643] usb 2-1: Product: syz [ 1566.556370][T11643] usb 2-1: Manufacturer: syz [ 1566.561797][T11643] usb 2-1: SerialNumber: syz [ 1566.568369][T11643] usb 2-1: config 0 descriptor?? [ 1566.578286][T11643] em28xx 2-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1566.588266][T11643] em28xx 2-1:0.89: Video interface 89 found: bulk [ 1567.324114][T11643] em28xx 2-1:0.89: unknown em28xx chip ID (0) [ 1567.523375][T15094] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 1567.717012][T15094] usb 6-1: Using ep0 maxpacket: 8 [ 1567.751514][T15094] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 1567.754253][T11643] em28xx 2-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 1567.768386][T15094] usb 6-1: config 0 has no interface number 0 [ 1567.774530][T15094] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1567.777573][T11643] em28xx 2-1:0.89: board has no eeprom [ 1567.805714][T15094] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1567.815058][T15094] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1567.844018][T15094] usb 6-1: config 0 descriptor?? [ 1567.872708][T15094] iowarrior 6-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1567.965984][T17896] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 1568.097639][T20598] tipc: Enabling of bearer rejected, failed to enable media [ 1568.107000][T11643] em28xx 2-1:0.89: Identified as Terratec Grabby (card=67) [ 1568.117923][T11643] em28xx 2-1:0.89: analog set to bulk mode. [ 1568.150087][T11643] em28xx 2-1:0.89: Registering V4L2 extension [ 1568.186162][T17896] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1568.226022][T17896] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1568.278360][T17896] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1568.324910][T17896] usb 3-1: config 0 descriptor?? [ 1568.342681][T15094] usb 6-1: USB disconnect, device number 9 [ 1568.347423][ T22] usb 2-1: USB disconnect, device number 22 [ 1568.387130][ T22] em28xx 2-1:0.89: Disconnecting em28xx [ 1568.424433][T11643] em28xx 2-1:0.89: Config register raw data: 0xffffffed [ 1568.435015][T11643] em28xx 2-1:0.89: AC97 chip type couldn't be determined [ 1568.465174][T11643] em28xx 2-1:0.89: No AC97 audio processor [ 1568.490273][T11643] usb 2-1: Decoder not found [ 1568.495213][T11643] em28xx 2-1:0.89: failed to create media graph [ 1568.560283][T17896] usbhid 3-1:0.0: can't add hid device: -71 [ 1568.575657][T17896] usbhid: probe of 3-1:0.0 failed with error -71 [ 1568.582790][T11643] em28xx 2-1:0.89: V4L2 device video103 deregistered [ 1568.624037][T11643] em28xx 2-1:0.89: Registering snapshot button... [ 1568.632240][T17896] usb 3-1: USB disconnect, device number 16 [ 1568.662132][T11643] input: em28xx snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.89/input/input11 [ 1568.696156][T11643] em28xx 2-1:0.89: Remote control support is not available for this card. [ 1568.705384][ T22] em28xx 2-1:0.89: Closing input extension [ 1568.716385][ T22] em28xx 2-1:0.89: Deregistering snapshot button [ 1568.757348][ T22] em28xx 2-1:0.89: Freeing device [ 1569.085674][T15094] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 1569.290895][T15094] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1569.291001][T15094] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1569.291062][T15094] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1569.308654][T15094] usb 4-1: config 0 descriptor?? [ 1569.322359][T17896] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 1569.351501][T11643] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 1569.568170][T15094] usbhid 4-1:0.0: can't add hid device: -71 [ 1569.608968][T15094] usbhid: probe of 4-1:0.0 failed with error -71 [ 1569.619248][ T22] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 1569.704545][T15094] usb 4-1: USB disconnect, device number 20 [ 1570.089383][T20628] netlink: 112 bytes leftover after parsing attributes in process `syz.0.3840'. [ 1570.145747][T11643] usb 6-1: Using ep0 maxpacket: 8 [ 1570.153454][ T22] usb 2-1: New USB device found, idVendor=056a, idProduct=0003, bcdDevice= 0.00 [ 1570.164076][T17896] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1570.181330][T11643] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 1570.191423][ T22] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1570.200001][T17896] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1570.210000][T11643] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1570.221207][ T22] usb 2-1: config 0 descriptor?? [ 1570.226424][T17896] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1570.235490][T11643] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1570.250821][T17896] usb 3-1: config 0 descriptor?? [ 1570.256834][T11643] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1570.268142][T11643] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1570.285667][T11643] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1570.295252][T11643] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1570.325857][T15094] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 1570.496029][T17896] usbhid 3-1:0.0: can't add hid device: -71 [ 1570.502696][T17896] usbhid: probe of 3-1:0.0 failed with error -71 [ 1570.516164][T15094] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1570.517170][T11643] usb 6-1: GET_CAPABILITIES returned 0 [ 1570.540589][T15094] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1570.544508][T11643] usbtmc 6-1:16.0: can't read capabilities [ 1570.559073][T15094] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1570.568568][T17896] usb 3-1: USB disconnect, device number 17 [ 1570.622233][T15094] usb 4-1: config 0 descriptor?? [ 1570.755696][ T7] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 1570.864766][ T22] usbhid 2-1:0.0: can't add hid device: -71 [ 1570.871982][ T22] usbhid: probe of 2-1:0.0 failed with error -71 [ 1570.884418][ T22] usb 2-1: USB disconnect, device number 23 [ 1570.900115][T20635] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1570.912088][T20635] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1570.923861][ T125] usb 6-1: USB disconnect, device number 10 [ 1570.932704][T20615] usbtmc 6-1:16.0: usb_control_msg returned -71 [ 1570.941349][T20634] usbtmc 6-1:16.0: send_request_dev_dep_msg_in returned -19 [ 1570.957714][ T7] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1570.978333][ T7] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1570.988430][ T7] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1571.005866][T17896] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 1571.007540][ T7] usb 1-1: config 0 descriptor?? [ 1571.042751][T15094] keytouch 0003:0926:3333.0006: fixing up Keytouch IEC report descriptor [ 1571.064018][T15094] input: HID 0926:3333 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0926:3333.0006/input/input12 [ 1571.193475][T15094] keytouch 0003:0926:3333.0006: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.3-1/input0 [ 1571.196108][T17896] usb 3-1: Using ep0 maxpacket: 8 [ 1571.229928][T17896] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 1571.238973][ T7] usbhid 1-1:0.0: can't add hid device: -71 [ 1571.275778][T17896] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1571.276283][ T7] usbhid: probe of 1-1:0.0 failed with error -71 [ 1571.313740][T17896] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1571.349515][ T7] usb 1-1: USB disconnect, device number 18 [ 1571.355172][T17896] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1571.389340][T17896] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1571.466361][T17896] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1571.498397][T17896] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1571.574189][ T125] usb 4-1: USB disconnect, device number 21 [ 1571.747108][T17896] usb 3-1: GET_CAPABILITIES returned 0 [ 1571.753897][T17896] usbtmc 3-1:16.0: can't read capabilities [ 1571.900069][T15094] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 1571.975759][ T7] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 1572.041581][ T125] usb 3-1: USB disconnect, device number 18 [ 1572.046244][T20633] usbtmc 3-1:16.0: usb_control_msg returned -71 [ 1572.095985][T15094] usb 2-1: Using ep0 maxpacket: 8 [ 1572.104359][T15094] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 1572.125852][T15094] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1572.148592][T15094] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1572.176305][ T7] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1572.195616][ T7] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1572.206376][T15094] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1572.229929][ T7] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1572.239986][T15094] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1572.264683][ T7] usb 1-1: config 0 descriptor?? [ 1572.275867][T15094] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1572.303578][T15094] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1572.715918][T15094] usb 2-1: GET_CAPABILITIES returned 0 [ 1572.725760][T15094] usbtmc 2-1:16.0: can't read capabilities [ 1573.108000][ T7] usbhid 1-1:0.0: can't add hid device: -71 [ 1573.117144][T20638] usbtmc 2-1:16.0: usb_control_msg returned -71 [ 1573.122061][ T7] usbhid: probe of 1-1:0.0 failed with error -71 [ 1573.154290][T20649] usbtmc 2-1:16.0: send_request_dev_dep_msg_in returned -90 [ 1573.176165][ T7] usb 1-1: USB disconnect, device number 19 [ 1573.198258][T15094] usb 2-1: USB disconnect, device number 24 [ 1573.665696][T17896] usb 4-1: new full-speed USB device number 22 using dummy_hcd [ 1573.901339][T17896] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1574.041640][T17896] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1574.261203][T17896] usb 4-1: Product: syz [ 1574.346940][T17896] usb 4-1: Manufacturer: syz [ 1574.431651][T17896] usb 4-1: SerialNumber: syz [ 1574.528939][T17896] usb 4-1: config 0 descriptor?? [ 1574.802070][T17896] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1574.859427][T15094] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 1574.879705][T20681] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3856'. [ 1574.920732][ T7] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 1575.058328][T15094] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1575.085700][T15094] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1575.114222][T15094] usb 6-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 1575.145222][T15094] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1575.155307][ T7] usb 2-1: Using ep0 maxpacket: 8 [ 1575.162865][ T7] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 1575.184752][ T7] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1575.244459][T15094] usb 6-1: config 0 descriptor?? [ 1575.251555][ T7] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1575.264677][ T7] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1575.275381][ T7] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1575.860523][ T7] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1575.870813][ T7] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1576.108817][ T7] usb 2-1: GET_CAPABILITIES returned 0 [ 1576.119384][ T7] usbtmc 2-1:16.0: can't read capabilities [ 1576.451792][T20705] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1576.473510][T20705] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1576.501623][T15597] usb 2-1: USB disconnect, device number 25 [ 1576.505748][T20674] usbtmc 2-1:16.0: usb_control_msg returned -71 [ 1576.537367][T20704] usbtmc 2-1:16.0: send_request_dev_dep_msg_in returned -19 [ 1576.645950][ T7] usb 1-1: new full-speed USB device number 20 using dummy_hcd [ 1576.850442][ T7] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1576.875763][ T7] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1576.885289][ T7] usb 1-1: Product: syz [ 1576.905665][ T7] usb 1-1: Manufacturer: syz [ 1576.910936][ T7] usb 1-1: SerialNumber: syz [ 1576.927632][ T7] usb 1-1: config 0 descriptor?? [ 1577.141956][ T7] usb 1-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1577.654924][ T4367] usb 6-1: USB disconnect, device number 11 [ 1577.760283][T20731] tipc: Enabled bearer , priority 0 [ 1577.768912][T15094] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 1577.771625][T20731] device syzkaller0 entered promiscuous mode [ 1577.851280][T20731] tipc: Resetting bearer [ 1577.864147][T20730] tipc: Resetting bearer [ 1577.908856][T20730] tipc: Disabling bearer [ 1577.918398][T17896] dvb_usb_rtl28xxu: probe of 4-1:0.0 failed with error -71 [ 1577.935863][ T125] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 1577.936409][T17896] usb 4-1: USB disconnect, device number 22 [ 1577.965681][T15094] usb 3-1: Using ep0 maxpacket: 32 [ 1577.975030][T15094] usb 3-1: config 0 has an invalid interface number: 89 but max is 0 [ 1577.987439][T15094] usb 3-1: config 0 has no interface number 0 [ 1577.994412][T15094] usb 3-1: config 0 interface 89 has no altsetting 0 [ 1578.006838][T15094] usb 3-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1578.051799][T15094] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1578.065750][T15094] usb 3-1: Product: syz [ 1578.071603][T15094] usb 3-1: Manufacturer: syz [ 1578.076932][T15094] usb 3-1: SerialNumber: syz [ 1578.088042][T15094] usb 3-1: config 0 descriptor?? [ 1578.108135][T15094] em28xx 3-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1578.118605][T15094] em28xx 3-1:0.89: Video interface 89 found: bulk [ 1578.140163][ T125] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1578.157518][ T125] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1578.170502][ T125] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1578.180479][ T125] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1578.193149][ T125] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1578.210583][ T125] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1578.221104][ T125] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1578.231761][ T125] usb 2-1: Product: syz [ 1578.236182][ T125] usb 2-1: Manufacturer: syz [ 1578.252813][ T125] cdc_wdm 2-1:1.0: skipping garbage [ 1578.259731][ T125] cdc_wdm 2-1:1.0: skipping garbage [ 1578.269611][ T125] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 1578.276088][ T125] cdc_wdm 2-1:1.0: Unknown control protocol [ 1578.355772][ T4367] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 1578.545050][T20736] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1578.546449][ T4367] usb 6-1: Using ep0 maxpacket: 8 [ 1578.555196][T20736] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1578.584912][T20736] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1578.599716][ T4367] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 1578.606265][T20736] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1578.608621][ T4367] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1578.635276][ T4367] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1578.646611][ T4367] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1578.658057][ T4367] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1578.672154][ T4367] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1578.683712][ T4367] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1578.703290][T15094] em28xx 3-1:0.89: unknown em28xx chip ID (0) [ 1578.745842][T17896] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 1578.752088][ T125] usb 2-1: USB disconnect, device number 26 [ 1578.754412][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 1578.768410][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 1578.774704][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 1578.912919][ T4367] usb 6-1: GET_CAPABILITIES returned 0 [ 1578.918972][ T4367] usbtmc 6-1:16.0: can't read capabilities [ 1578.965814][T17896] usb 4-1: Using ep0 maxpacket: 8 [ 1578.983888][T17896] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 1578.992302][T17896] usb 4-1: config 0 has no interface number 0 [ 1578.998694][T17896] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1579.008863][T17896] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1579.018756][T17896] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1579.032354][T17896] usb 4-1: config 0 descriptor?? [ 1579.040505][T17896] iowarrior 4-1:0.1: no interrupt-in endpoint found [ 1579.253492][T20740] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1579.266001][T20740] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1579.345832][T20733] usbtmc 6-1:16.0: usb_control_msg returned -71 [ 1579.347080][T17896] usb 6-1: USB disconnect, device number 12 [ 1579.360463][T20739] usbtmc 6-1:16.0: send_request_dev_dep_msg_in returned -19 [ 1579.725408][T15094] em28xx 3-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 1579.743685][T15094] em28xx 3-1:0.89: board has no eeprom [ 1579.791259][ T7] dvb_usb_rtl28xxu: probe of 1-1:0.0 failed with error -32 [ 1579.803446][ T7] usb 1-1: USB disconnect, device number 20 [ 1579.815777][T15094] em28xx 3-1:0.89: Identified as Terratec Grabby (card=67) [ 1579.830522][T15094] em28xx 3-1:0.89: analog set to bulk mode. [ 1579.846544][T18549] em28xx 3-1:0.89: Registering V4L2 extension [ 1579.858003][T15094] usb 3-1: USB disconnect, device number 19 [ 1579.865414][T15094] em28xx 3-1:0.89: Disconnecting em28xx [ 1579.963201][T18549] em28xx 3-1:0.89: Config register raw data: 0xffffffed [ 1579.970702][T18549] em28xx 3-1:0.89: AC97 chip type couldn't be determined [ 1579.978176][T18549] em28xx 3-1:0.89: No AC97 audio processor [ 1579.995418][T18549] usb 3-1: Decoder not found [ 1580.000670][T18549] em28xx 3-1:0.89: failed to create media graph [ 1580.008004][T18549] em28xx 3-1:0.89: V4L2 device video103 deregistered [ 1580.016583][T18549] em28xx 3-1:0.89: Registering snapshot button... [ 1580.038460][T18549] input: em28xx snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.89/input/input13 [ 1580.063352][T18549] em28xx 3-1:0.89: Remote control support is not available for this card. [ 1580.072423][T15094] em28xx 3-1:0.89: Closing input extension [ 1580.079884][T15094] em28xx 3-1:0.89: Deregistering snapshot button [ 1580.109789][T15094] em28xx 3-1:0.89: Freeing device [ 1580.705903][T15094] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 1580.726639][ T7] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 1581.285675][T15094] usb 3-1: Using ep0 maxpacket: 8 [ 1581.293551][ T7] usb 6-1: New USB device found, idVendor=056a, idProduct=0003, bcdDevice= 0.00 [ 1581.303459][ T7] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1581.312338][T15094] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 1581.322792][T15094] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1581.336281][ T7] usb 6-1: config 0 descriptor?? [ 1581.342641][T15094] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1581.355281][T15094] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1581.367407][T15094] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1581.382154][T15094] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1581.399987][T15094] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1581.515689][T17896] usb 4-1: USB disconnect, device number 23 [ 1581.630887][T15094] usb 3-1: GET_CAPABILITIES returned 0 [ 1581.643065][T15094] usbtmc 3-1:16.0: can't read capabilities [ 1581.675469][T20773] netlink: 112 bytes leftover after parsing attributes in process `syz.3.3884'. [ 1581.973096][ T7] usbhid 6-1:0.0: can't add hid device: -71 [ 1581.980280][ T7] usbhid: probe of 6-1:0.0 failed with error -71 [ 1581.995942][T20780] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1582.017235][ T7] usb 6-1: USB disconnect, device number 13 [ 1582.026292][T20780] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1582.063572][T15094] usb 3-1: USB disconnect, device number 20 [ 1582.075896][T20758] usbtmc 3-1:16.0: usb_control_msg returned -71 [ 1582.095820][T20779] usbtmc 3-1:16.0: send_request_dev_dep_msg_in returned -19 [ 1582.575727][ T7] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 1582.619487][T20789] tipc: Enabled bearer , priority 0 [ 1582.658168][T20789] device syzkaller0 entered promiscuous mode [ 1582.671061][T20789] tipc: Resetting bearer [ 1582.700621][T20791] tipc: Enabling of bearer rejected, failed to enable media [ 1582.729363][T20788] tipc: Resetting bearer [ 1582.778569][ T7] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1582.801831][ T7] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1582.845780][ T7] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1582.892492][ T7] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1582.934374][ T7] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1582.959816][ T7] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1582.986847][ T7] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1583.005351][ T7] usb 4-1: Product: syz [ 1583.015479][ T7] usb 4-1: Manufacturer: syz [ 1583.050189][ T7] cdc_wdm 4-1:1.0: skipping garbage [ 1583.064036][ T7] cdc_wdm 4-1:1.0: skipping garbage [ 1583.102493][ T7] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 1583.118647][ T7] cdc_wdm 4-1:1.0: Unknown control protocol [ 1583.135903][T15094] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 1583.322077][T20806] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1583.344509][T20806] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1583.353931][T15094] usb 1-1: Using ep0 maxpacket: 8 [ 1583.361876][T15094] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 1583.366774][T20806] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1583.380990][T15094] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1583.408638][T15094] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1583.414331][T20806] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1583.436926][T15094] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1583.456469][T15094] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1583.477171][T15094] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1583.489925][T15094] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1583.734369][T15094] usb 1-1: GET_CAPABILITIES returned 0 [ 1583.740586][T15094] usbtmc 1-1:16.0: can't read capabilities [ 1584.060250][T20811] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1584.107139][T20811] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1584.120801][T15094] usb 1-1: USB disconnect, device number 21 [ 1584.396087][ T4367] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 1584.605649][ T4367] usb 3-1: Using ep0 maxpacket: 8 [ 1584.629185][ T4367] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 1584.639703][ T4367] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1584.650528][ T4367] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1584.663100][ T4367] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1584.673834][ T4367] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1584.689213][ T4367] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1584.698920][ T4367] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1584.953653][ T4367] usb 3-1: GET_CAPABILITIES returned 0 [ 1584.959568][ T4367] usbtmc 3-1:16.0: can't read capabilities [ 1585.251410][ T7] usb 3-1: USB disconnect, device number 21 [ 1585.330834][ T4367] usb 4-1: USB disconnect, device number 24 [ 1585.333336][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 1585.345627][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 1585.352039][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 1585.880229][ T4367] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 1586.075195][ T4367] usb 4-1: Using ep0 maxpacket: 8 [ 1586.102796][ T4367] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 1586.111795][ T4367] usb 4-1: config 0 has no interface number 0 [ 1586.121749][ T4367] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1586.132593][ T4367] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1586.144326][ T4367] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1586.170895][ T4367] usb 4-1: config 0 descriptor?? [ 1586.203182][ T4367] iowarrior 4-1:0.1: no interrupt-in endpoint found [ 1586.425792][ T7] usb 4-1: USB disconnect, device number 25 [ 1587.335681][T17896] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 1587.535729][T17896] usb 4-1: Using ep0 maxpacket: 32 [ 1587.575105][T17896] usb 4-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 1587.599457][T17896] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1587.608124][T17896] usb 4-1: Product: syz [ 1587.612946][T17896] usb 4-1: Manufacturer: syz [ 1587.618912][T17896] usb 4-1: SerialNumber: syz [ 1587.638035][T17896] usb 4-1: config 0 descriptor?? [ 1587.666206][T17896] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 1588.325808][ T4367] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 1588.534406][ T4367] usb 3-1: Using ep0 maxpacket: 8 [ 1588.542866][ T4367] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 1588.552279][ T4367] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1588.563299][ T4367] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1588.574130][ T4367] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1588.584976][ T4367] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1588.598968][ T4367] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1588.622536][ T4367] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1588.868413][ T4367] usb 3-1: GET_CAPABILITIES returned 0 [ 1588.874037][ T4367] usbtmc 3-1:16.0: can't read capabilities [ 1589.064771][T20788] tipc: Disabling bearer [ 1589.217157][T20838] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1589.251692][T20838] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1589.300783][T20842] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3907'. [ 1589.516209][T11643] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 1589.593860][T20851] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3910'. [ 1589.699060][T11643] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1589.715378][T11643] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1589.725613][T15094] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 1589.740850][T11643] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1589.768030][T11643] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1589.789173][T11643] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1589.822724][T11643] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1589.835809][T11643] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1589.845065][T20856] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3911'. [ 1589.854738][T11643] usb 2-1: Product: syz [ 1589.859583][T11643] usb 2-1: Manufacturer: syz [ 1589.872661][T11643] cdc_wdm 2-1:1.0: skipping garbage [ 1589.878429][T11643] cdc_wdm 2-1:1.0: skipping garbage [ 1589.886334][T11643] cdc_wdm 2-1:1.0: cdc-wdm1: USB WDM device [ 1589.892751][T11643] cdc_wdm 2-1:1.0: Unknown control protocol [ 1589.935737][T15094] usb 1-1: Using ep0 maxpacket: 8 [ 1589.944910][T15094] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 1589.954149][T17896] gspca_stk1135: reg_w 0x2ff err -71 [ 1589.966040][T17896] gspca_stk1135: serial bus timeout: status=0x00 [ 1589.971462][T15094] usb 1-1: config 0 has no interface number 0 [ 1589.977744][T17896] gspca_stk1135: Sensor write failed [ 1589.985883][T15094] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1589.986989][T17896] gspca_stk1135: serial bus timeout: status=0x00 [ 1590.004807][T17896] gspca_stk1135: Sensor write failed [ 1590.008519][T15094] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1590.010863][T17896] gspca_stk1135: serial bus timeout: status=0x00 [ 1590.031950][T17896] gspca_stk1135: Sensor read failed [ 1590.035191][T15094] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1590.040647][T17896] gspca_stk1135: serial bus timeout: status=0x00 [ 1590.055862][T17896] gspca_stk1135: Sensor read failed [ 1590.061478][T17896] gspca_stk1135: Detected sensor type unknown (0x0) [ 1590.069492][T15094] usb 1-1: config 0 descriptor?? [ 1590.086971][T17896] gspca_stk1135: serial bus timeout: status=0x00 [ 1590.095687][T17896] gspca_stk1135: Sensor read failed [ 1590.102311][T17896] gspca_stk1135: serial bus timeout: status=0x00 [ 1590.112698][T17896] gspca_stk1135: Sensor read failed [ 1590.114952][T15094] iowarrior 1-1:0.1: no interrupt-in endpoint found [ 1590.128528][T17896] gspca_stk1135: serial bus timeout: status=0x00 [ 1590.152161][T17896] gspca_stk1135: Sensor write failed [ 1590.161858][T17896] gspca_stk1135: serial bus timeout: status=0x00 [ 1590.169195][T17896] gspca_stk1135: Sensor write failed [ 1590.175331][T17896] stk1135: probe of 4-1:0.0 failed with error -71 [ 1590.197401][T17896] usb 4-1: USB disconnect, device number 26 [ 1590.217656][T20859] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1590.246914][T20859] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1590.576527][T15597] usb 2-1: USB disconnect, device number 27 [ 1591.575864][T17896] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 1591.765651][T17896] usb 4-1: Using ep0 maxpacket: 8 [ 1591.774651][T17896] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 1591.784265][T17896] usb 4-1: config 0 has no interface number 0 [ 1591.790786][T17896] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1591.802423][T17896] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1591.812414][T17896] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1591.822868][T17896] usb 4-1: config 0 descriptor?? [ 1591.830205][T17896] iowarrior 4-1:0.1: no interrupt-in endpoint found [ 1591.926294][T15094] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 1592.115840][T15094] usb 6-1: Using ep0 maxpacket: 32 [ 1592.126473][T15094] usb 6-1: config 0 has an invalid interface number: 89 but max is 0 [ 1592.135334][T15094] usb 6-1: config 0 has no interface number 0 [ 1592.141692][T15094] usb 6-1: config 0 interface 89 has no altsetting 0 [ 1592.173273][T15094] usb 6-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1592.192231][T15094] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1592.202592][T15094] usb 6-1: Product: syz [ 1592.213576][T15094] usb 6-1: Manufacturer: syz [ 1592.218506][T15094] usb 6-1: SerialNumber: syz [ 1592.225462][T15094] usb 6-1: config 0 descriptor?? [ 1592.234026][T15094] em28xx 6-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1592.244333][T15094] em28xx 6-1:0.89: Video interface 89 found: bulk [ 1592.840907][T15094] em28xx 6-1:0.89: unknown em28xx chip ID (0) [ 1593.260534][T15094] em28xx 6-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 1593.269002][T15094] em28xx 6-1:0.89: board has no eeprom [ 1593.575684][T15094] em28xx 6-1:0.89: Identified as Terratec Grabby (card=67) [ 1593.582939][T15094] em28xx 6-1:0.89: analog set to bulk mode. [ 1593.609622][T15094] em28xx 6-1:0.89: Registering V4L2 extension [ 1593.896854][T15094] em28xx 6-1:0.89: failed to get i2c transfer status from bridge register (error=-5) [ 1593.908158][ T125] usb 6-1: USB disconnect, device number 14 [ 1593.914865][ T125] em28xx 6-1:0.89: Disconnecting em28xx [ 1593.920959][T15094] em28xx 6-1:0.89: Config register raw data: 0xffffffed [ 1593.928056][T15094] em28xx 6-1:0.89: AC97 chip type couldn't be determined [ 1593.936052][T15094] em28xx 6-1:0.89: No AC97 audio processor [ 1593.943854][T15094] usb 6-1: Decoder not found [ 1593.948624][T15094] em28xx 6-1:0.89: failed to create media graph [ 1593.955029][T15094] em28xx 6-1:0.89: V4L2 device video103 deregistered [ 1593.978371][T15094] em28xx 6-1:0.89: Registering snapshot button... [ 1593.986911][T15094] input: em28xx snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.89/input/input14 [ 1593.999006][T15094] em28xx 6-1:0.89: Remote control support is not available for this card. [ 1594.008758][ T125] em28xx 6-1:0.89: Closing input extension [ 1594.015033][ T125] em28xx 6-1:0.89: Deregistering snapshot button [ 1594.062145][ T125] em28xx 6-1:0.89: Freeing device [ 1594.156063][T20836] usbtmc 3-1:16.0: usb_control_msg returned -110 [ 1594.205685][T15094] usb 3-1: USB disconnect, device number 22 [ 1594.244288][T11643] usb 4-1: USB disconnect, device number 27 [ 1594.276226][T17896] usb 1-1: USB disconnect, device number 22 [ 1594.429177][T20887] device syzkaller0 entered promiscuous mode [ 1594.745705][T17896] usb 1-1: new full-speed USB device number 23 using dummy_hcd [ 1594.949394][T17896] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1594.965360][T17896] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1594.976054][T15094] usb 6-1: new full-speed USB device number 15 using dummy_hcd [ 1594.987706][T17896] usb 1-1: Product: syz [ 1594.992688][T17896] usb 1-1: Manufacturer: syz [ 1595.005430][T17896] usb 1-1: SerialNumber: syz [ 1595.022503][T17896] usb 1-1: config 0 descriptor?? [ 1595.170107][T15094] usb 6-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1595.180399][T15094] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1595.188920][T15094] usb 6-1: Product: syz [ 1595.193104][T15094] usb 6-1: Manufacturer: syz [ 1595.197901][T15094] usb 6-1: SerialNumber: syz [ 1595.204431][T15094] usb 6-1: config 0 descriptor?? [ 1595.240668][T17896] usb 1-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1595.285667][ T125] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 1595.290064][ T4367] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 1595.426380][T15094] usb 6-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1595.477435][ T125] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1595.486441][ T125] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1595.496924][ T125] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1595.505942][ T4367] usb 3-1: Using ep0 maxpacket: 32 [ 1595.511988][ T125] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1595.513108][ T4367] usb 3-1: config 0 has an invalid interface number: 89 but max is 0 [ 1595.533554][ T125] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1595.555704][ T4367] usb 3-1: config 0 has no interface number 0 [ 1595.561989][ T4367] usb 3-1: config 0 interface 89 has no altsetting 0 [ 1595.567460][ T125] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1595.591975][ T125] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1595.598085][ T4367] usb 3-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1595.605275][ T125] usb 2-1: Product: syz [ 1595.617229][ T4367] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1595.625872][ T4367] usb 3-1: Product: syz [ 1595.633614][ T4367] usb 3-1: Manufacturer: syz [ 1595.633614][ T125] usb 2-1: Manufacturer: syz [ 1595.643843][ T4367] usb 3-1: SerialNumber: syz [ 1595.650598][ T125] cdc_wdm 2-1:1.0: skipping garbage [ 1595.653734][ T4367] usb 3-1: config 0 descriptor?? [ 1595.662658][ T125] cdc_wdm 2-1:1.0: skipping garbage [ 1595.673159][ T125] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 1595.679983][ T125] cdc_wdm 2-1:1.0: Unknown control protocol [ 1595.687066][ T4367] em28xx 3-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1595.697222][ T4367] em28xx 3-1:0.89: Video interface 89 found: bulk [ 1595.916126][T18549] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 1596.115700][T18549] usb 4-1: Using ep0 maxpacket: 8 [ 1596.123416][T18549] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 1596.131824][ C0] cdc_wdm 2-1:1.0: Unexpected error -71 [ 1596.131909][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 1596.131927][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 1596.137129][T15597] usb 2-1: USB disconnect, device number 28 [ 1596.137635][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 1596.163183][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 1596.169291][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 1596.179731][T18549] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1596.191519][T18549] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1596.201959][T18549] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1596.213175][T18549] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1596.226742][T18549] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1596.236206][T18549] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1596.291167][ T4367] em28xx 3-1:0.89: unknown em28xx chip ID (0) [ 1596.463221][T20917] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1596.474680][T20917] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1596.486361][T18549] usb 4-1: usb_control_msg returned -71 [ 1596.493429][T18549] usbtmc 4-1:16.0: can't read capabilities [ 1596.517882][T18549] usb 4-1: USB disconnect, device number 28 [ 1596.905761][ T4367] em28xx 3-1:0.89: read from i2c device at 0xa0 failed with unknown error (status=64) [ 1596.916350][ T4367] em28xx 3-1:0.89: board has no eeprom [ 1597.185838][ T4367] em28xx 3-1:0.89: Identified as Terratec Grabby (card=67) [ 1597.193285][ T4367] em28xx 3-1:0.89: analog set to bulk mode. [ 1597.222291][ T4367] usb 3-1: USB disconnect, device number 23 [ 1597.246460][ T4367] em28xx 3-1:0.89: Disconnecting em28xx [ 1597.252252][T11643] em28xx 3-1:0.89: Registering V4L2 extension [ 1597.408404][T20924] device syzkaller0 entered promiscuous mode [ 1597.419339][T11643] em28xx 3-1:0.89: Config register raw data: 0xffffffed [ 1597.435622][T11643] em28xx 3-1:0.89: AC97 chip type couldn't be determined [ 1597.442930][T11643] em28xx 3-1:0.89: No AC97 audio processor [ 1597.457416][T11643] usb 3-1: Decoder not found [ 1597.462208][T11643] em28xx 3-1:0.89: failed to create media graph [ 1597.485820][T11643] em28xx 3-1:0.89: V4L2 device video103 deregistered [ 1597.498028][T11643] em28xx 3-1:0.89: Registering snapshot button... [ 1597.506518][T11643] input: em28xx snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.89/input/input15 [ 1597.520392][T11643] em28xx 3-1:0.89: Remote control support is not available for this card. [ 1597.529433][ T4367] em28xx 3-1:0.89: Closing input extension [ 1597.535442][ T4367] em28xx 3-1:0.89: Deregistering snapshot button [ 1597.581922][ T4367] em28xx 3-1:0.89: Freeing device [ 1597.872545][T17896] dvb_usb_rtl28xxu: probe of 1-1:0.0 failed with error -32 [ 1598.056083][T20933] tipc: Enabled bearer , priority 0 [ 1598.095438][T20933] device syzkaller0 entered promiscuous mode [ 1598.191862][T20931] tipc: Resetting bearer [ 1598.236863][T20931] tipc: Disabling bearer [ 1598.479145][T15094] dvb_usb_rtl28xxu: probe of 6-1:0.0 failed with error -32 [ 1598.510586][T15094] usb 6-1: USB disconnect, device number 15 [ 1598.825814][T18549] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 1599.015879][T18549] usb 2-1: Using ep0 maxpacket: 32 [ 1599.023904][T18549] usb 2-1: config index 0 descriptor too short (expected 156, got 27) [ 1599.052631][T18549] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1599.075801][T18549] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1599.095078][T18549] usb 2-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 1599.108184][T18549] usb 2-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 1599.125759][T18549] usb 2-1: Product: syz [ 1599.141345][T18549] usb 2-1: Manufacturer: syz [ 1599.142240][T17896] usb 1-1: USB disconnect, device number 23 [ 1599.152942][T18549] usb 2-1: SerialNumber: syz [ 1599.165410][T18549] usb 2-1: config 0 descriptor?? [ 1599.225682][T15094] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 1599.344274][T18549] ldusb 2-1:0.0: Interrupt in endpoint not found [ 1599.416098][T15094] usb 3-1: Using ep0 maxpacket: 32 [ 1599.433335][T15094] usb 3-1: config 0 has an invalid interface number: 89 but max is 0 [ 1599.478659][T15094] usb 3-1: config 0 has no interface number 0 [ 1599.510470][T15094] usb 3-1: config 0 interface 89 has no altsetting 0 [ 1599.520370][T18549] usb 2-1: USB disconnect, device number 29 [ 1599.529471][T15094] usb 3-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1599.580319][T15094] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1599.596852][T15094] usb 3-1: Product: syz [ 1599.601564][T15094] usb 3-1: Manufacturer: syz [ 1599.607413][T15094] usb 3-1: SerialNumber: syz [ 1599.613927][T20971] binder: BINDER_SET_CONTEXT_MGR already set [ 1599.628921][T15094] usb 3-1: config 0 descriptor?? [ 1599.632025][T20971] binder: 20970:20971 ioctl 4018620d 200000004a80 returned -16 [ 1599.649927][T15094] em28xx 3-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1599.671291][T15094] em28xx 3-1:0.89: Video interface 89 found: bulk [ 1600.140376][T20983] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3959'. [ 1600.276247][T15094] em28xx 3-1:0.89: unknown em28xx chip ID (0) [ 1600.621957][T21002] binder: BINDER_SET_CONTEXT_MGR already set [ 1600.651056][T21002] binder: 21001:21002 ioctl 4018620d 200000004a80 returned -16 [ 1600.765655][T17896] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 1600.890893][T15094] em28xx 3-1:0.89: read from i2c device at 0xa0 failed with unknown error (status=64) [ 1600.921571][T15094] em28xx 3-1:0.89: board has no eeprom [ 1600.980634][T17896] usb 4-1: Using ep0 maxpacket: 16 [ 1600.993354][T17896] usb 4-1: config 0 interface 0 altsetting 235 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1601.021722][T17896] usb 4-1: config 0 interface 0 altsetting 235 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1601.042169][T17896] usb 4-1: config 0 interface 0 has no altsetting 0 [ 1601.062469][T17896] usb 4-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 1601.085772][T17896] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1601.095802][T18549] usb 2-1: new full-speed USB device number 30 using dummy_hcd [ 1601.113244][T17896] usb 4-1: config 0 descriptor?? [ 1601.165944][T15094] em28xx 3-1:0.89: Identified as Terratec Grabby (card=67) [ 1601.185668][T15094] em28xx 3-1:0.89: analog set to bulk mode. [ 1601.214653][ T125] em28xx 3-1:0.89: Registering V4L2 extension [ 1601.227280][T15094] usb 3-1: USB disconnect, device number 24 [ 1601.263790][T15094] em28xx 3-1:0.89: Disconnecting em28xx [ 1601.302964][T18549] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1601.323218][T18549] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1601.350835][T18549] usb 2-1: Product: syz [ 1601.355131][T18549] usb 2-1: Manufacturer: syz [ 1601.360123][ T125] em28xx 3-1:0.89: Config register raw data: 0xffffffed [ 1601.373755][ T125] em28xx 3-1:0.89: AC97 chip type couldn't be determined [ 1601.381809][T18549] usb 2-1: SerialNumber: syz [ 1601.387832][ T125] em28xx 3-1:0.89: No AC97 audio processor [ 1601.396236][T18549] usb 2-1: config 0 descriptor?? [ 1601.413483][ T125] usb 3-1: Decoder not found [ 1601.431356][ T125] em28xx 3-1:0.89: failed to create media graph [ 1601.438562][ T125] em28xx 3-1:0.89: V4L2 device video103 deregistered [ 1601.567181][T17896] mcp2221 0003:04D8:00DD.0007: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.3-1/input0 [ 1601.756464][T18549] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1601.770572][ T125] em28xx 3-1:0.89: Registering snapshot button... [ 1601.771104][T21020] ================================================================== [ 1601.778614][ T125] input: em28xx snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.89/input/input16 [ 1601.785997][T21020] BUG: KASAN: use-after-free in v4l2_fh_open+0xc6/0x430 [ 1601.786113][T21020] Read of size 8 at addr ffff8880433dc738 by task v4l_id/21020 [ 1601.806585][ T125] em28xx 3-1:0.89: Remote control support is not available for this card. [ 1601.812550][T21020] [ 1601.812586][T21020] CPU: 1 PID: 21020 Comm: v4l_id Not tainted syzkaller #0 [ 1601.812606][T21020] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1601.812622][T21020] Call Trace: [ 1601.812631][T21020] [ 1601.849387][T21020] dump_stack_lvl+0x168/0x22e [ 1601.854778][T15094] em28xx 3-1:0.89: Closing input extension [ 1601.861305][T21020] ? __lock_acquire+0x7c50/0x7c50 [ 1601.861339][T21020] ? show_regs_print_info+0x12/0x12 [ 1601.861356][T21020] ? load_image+0x3b0/0x3b0 [ 1601.861409][T21020] ? _raw_spin_lock_irqsave+0xb0/0xf0 [ 1601.881935][T15094] em28xx 3-1:0.89: Deregistering snapshot button [ 1601.883785][T21020] ? __virt_addr_valid+0x188/0x540 [ 1601.883815][T21020] ? __virt_addr_valid+0x465/0x540 [ 1601.883832][T21020] ? v4l2_fh_open+0xc6/0x430 [ 1601.883847][T21020] print_report+0xa8/0x210 [ 1601.883865][T21020] kasan_report+0x10b/0x140 [ 1601.917333][T21020] ? v4l2_fh_open+0xc6/0x430 [ 1601.922066][T21020] v4l2_fh_open+0xc6/0x430 [ 1601.926862][T21020] em28xx_v4l2_open+0x152/0x990 [ 1601.933026][T21020] ? __lock_acquire+0x7c50/0x7c50 [ 1601.938405][T21020] v4l2_open+0x20b/0x360 [ 1601.943743][T21020] chrdev_open+0x597/0x670 [ 1601.949096][T21020] ? cd_forget+0x160/0x160 [ 1601.954048][T21020] ? tomoyo_file_open+0xe9/0x170 [ 1601.959255][T21020] ? fsnotify_perm+0x39b/0x550 [ 1601.964503][T21020] ? cd_forget+0x160/0x160 [ 1601.969355][T21020] do_dentry_open+0x7e9/0x10d0 [ 1601.974164][T21020] path_openat+0x25c6/0x2e70 [ 1601.979000][T21020] ? do_sys_openat2+0xcf/0x490 [ 1601.984523][T21020] ? __x64_sys_openat+0x135/0x160 [ 1601.989689][T21020] ? do_syscall_64+0x4c/0xa0 [ 1601.994402][T21020] ? do_filp_open+0x3c0/0x3c0 [ 1601.999253][T21020] do_filp_open+0x1c1/0x3c0 [ 1602.003960][T21020] ? vfs_tmpfile+0x480/0x480 [ 1602.009471][T21020] ? _raw_spin_unlock+0x24/0x40 [ 1602.014468][T21020] ? alloc_fd+0x58f/0x630 [ 1602.018921][T21020] do_sys_openat2+0x142/0x490 [ 1602.024222][T21020] ? up_read+0x20/0x20 [ 1602.028404][T21020] ? do_sys_open+0xe0/0xe0 [ 1602.032877][T21020] ? lockdep_hardirqs_on_prepare+0x3fc/0x760 [ 1602.039487][T21020] ? lock_chain_count+0x20/0x20 [ 1602.044482][T21020] __x64_sys_openat+0x135/0x160 [ 1602.049452][T21020] do_syscall_64+0x4c/0xa0 [ 1602.054337][T21020] ? clear_bhb_loop+0x60/0xb0 [ 1602.059393][T21020] ? clear_bhb_loop+0x60/0xb0 [ 1602.064535][T21020] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1602.070824][T21020] RIP: 0033:0x7f9257ea7407 [ 1602.075370][T21020] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 1602.096915][T21020] RSP: 002b:00007ffe03dc73e0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 1602.111030][T21020] RAX: ffffffffffffffda RBX: 00007f9258544880 RCX: 00007f9257ea7407 [ 1602.119984][T21020] RDX: 0000000000000000 RSI: 00007ffe03dc7f1c RDI: ffffffffffffff9c [ 1602.128177][T21020] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 1602.136659][T21020] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 1602.146394][T21020] R13: 00007ffe03dc7630 R14: 00007f92586a3000 R15: 000055b15f13f4d8 [ 1602.155718][T21020] [ 1602.159032][T21020] [ 1602.161574][T21020] Allocated by task 125: [ 1602.166043][T21020] kasan_set_track+0x4b/0x70 [ 1602.170673][T21020] __kasan_kmalloc+0x8e/0xa0 [ 1602.176163][T21020] em28xx_v4l2_init+0x107/0x2e70 [ 1602.181307][T21020] em28xx_init_extension+0x118/0x1b0 [ 1602.187577][T21020] process_one_work+0x898/0x1160 [ 1602.192941][T21020] worker_thread+0xaa2/0x1250 [ 1602.197683][T21020] kthread+0x29d/0x330 [ 1602.202315][T21020] ret_from_fork+0x1f/0x30 [ 1602.207088][T21020] [ 1602.210070][T21020] Freed by task 125: [ 1602.214220][T21020] kasan_set_track+0x4b/0x70 [ 1602.218942][T21020] kasan_save_free_info+0x2d/0x50 [ 1602.224195][T21020] ____kasan_slab_free+0x126/0x1e0 [ 1602.229534][T21020] slab_free_freelist_hook+0x131/0x1a0 [ 1602.235507][T21020] __kmem_cache_free+0xb6/0x1f0 [ 1602.240581][T21020] em28xx_v4l2_init+0x166c/0x2e70 [ 1602.245977][T21020] em28xx_init_extension+0x118/0x1b0 [ 1602.252051][T21020] process_one_work+0x898/0x1160 [ 1602.257233][T21020] worker_thread+0xaa2/0x1250 [ 1602.262519][T21020] kthread+0x29d/0x330 [ 1602.266966][T21020] ret_from_fork+0x1f/0x30 [ 1602.271964][T21020] [ 1602.274318][T21020] The buggy address belongs to the object at ffff8880433dc000 [ 1602.274318][T21020] which belongs to the cache kmalloc-8k of size 8192 [ 1602.289040][T21020] The buggy address is located 1848 bytes inside of [ 1602.289040][T21020] 8192-byte region [ffff8880433dc000, ffff8880433de000) [ 1602.303471][T21020] [ 1602.305937][T21020] The buggy address belongs to the physical page: [ 1602.312559][T21020] page:ffffea00010cf600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x433d8 [ 1602.323002][T21020] head:ffffea00010cf600 order:3 compound_mapcount:0 compound_pincount:0 [ 1602.331436][T21020] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 1602.339706][T21020] raw: 00fff00000010200 0000000000000000 dead000000000001 ffff888017442280 [ 1602.349104][T21020] raw: 0000000000000000 0000000080020002 00000001ffffffff 0000000000000000 [ 1602.358636][T21020] page dumped because: kasan: bad access detected [ 1602.365697][T21020] page_owner tracks the page as allocated [ 1602.372433][T21020] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 20789, tgid 20788 (syz.5.3891), ts 1582641228349, free_ts 1575046479594 [ 1602.397289][T21020] post_alloc_hook+0x173/0x1a0 [ 1602.402183][T21020] get_page_from_freelist+0x1a26/0x1ac0 [ 1602.407803][T21020] __alloc_pages+0x1df/0x4e0 [ 1602.412520][T21020] alloc_slab_page+0x5d/0x160 [ 1602.417418][T21020] new_slab+0x87/0x2c0 [ 1602.421706][T21020] ___slab_alloc+0xbc6/0x1230 [ 1602.427101][T21020] __kmem_cache_alloc_node+0x1a0/0x260 [ 1602.433317][T21020] __kmalloc_node+0xa0/0x240 [ 1602.438376][T21020] kvmalloc_node+0x6c/0x180 [ 1602.443265][T21020] pfifo_fast_init+0x234/0x6a0 [ 1602.448767][T21020] qdisc_create_dflt+0x11a/0x4b0 [ 1602.453910][T21020] mq_init+0x2df/0x660 [ 1602.458076][T21020] qdisc_create_dflt+0x11a/0x4b0 [ 1602.463302][T21020] dev_activate+0x1cc/0x11a0 [ 1602.468175][T21020] __dev_open+0x334/0x420 [ 1602.472657][T21020] __dev_change_flags+0x20a/0x6a0 [ 1602.477809][T21020] page last free stack trace: [ 1602.482509][T21020] free_unref_page_prepare+0x8b4/0x9a0 [ 1602.487999][T21020] free_unref_page+0x2e/0x3f0 [ 1602.492737][T21020] __unfreeze_partials+0x1a5/0x200 [ 1602.498221][T21020] put_cpu_partial+0x17c/0x250 [ 1602.503397][T21020] qlist_free_all+0x76/0xe0 [ 1602.508395][T21020] kasan_quarantine_reduce+0x144/0x160 [ 1602.514169][T21020] __kasan_slab_alloc+0x1e/0x80 [ 1602.519139][T21020] slab_post_alloc_hook+0x4b/0x480 [ 1602.524578][T21020] __kmem_cache_alloc_node+0x140/0x260 [ 1602.530678][T21020] kmalloc_trace+0x26/0xe0 [ 1602.535124][T21020] usb_control_msg+0x70/0x3e0 [ 1602.539981][T21020] hub_ext_port_status+0x103/0x6d0 [ 1602.545312][T21020] hub_port_reset+0x765/0x1930 [ 1602.550124][T21020] hub_port_init+0xff2/0x2ac0 [ 1602.554839][T21020] hub_event+0x292c/0x54e0 [ 1602.559451][T21020] process_one_work+0x898/0x1160 [ 1602.564413][T21020] [ 1602.566867][T21020] Memory state around the buggy address: [ 1602.572601][T21020] ffff8880433dc600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1602.580862][T21020] ffff8880433dc680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1602.589022][T21020] >ffff8880433dc700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1602.597449][T21020] ^ [ 1602.601608][T21030] device syzkaller0 entered promiscuous mode [ 1602.604415][T21020] ffff8880433dc780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1602.604430][T21020] ffff8880433dc800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1602.604437][T21020] ================================================================== [ 1602.613929][T11643] usb 1-1: new full-speed USB device number 24 using dummy_hcd [ 1602.685108][T17896] usb 4-1: USB disconnect, device number 29 [ 1602.721865][T21020] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1602.729296][T21020] CPU: 0 PID: 21020 Comm: v4l_id Not tainted syzkaller #0 [ 1602.737293][T21020] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1602.747646][T21020] Call Trace: [ 1602.751027][T21020] [ 1602.755310][T21020] dump_stack_lvl+0x168/0x22e [ 1602.760118][T21020] ? memcpy+0x3c/0x60 [ 1602.764199][T21020] ? show_regs_print_info+0x12/0x12 [ 1602.770232][T21020] ? load_image+0x3b0/0x3b0 [ 1602.774866][T21020] panic+0x2c9/0x710 [ 1602.778791][T21020] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 1602.785169][T21020] ? bpf_jit_dump+0xd0/0xd0 [ 1602.789789][T21020] ? _raw_spin_unlock_irqrestore+0xf6/0x100 [ 1602.796168][T21020] ? _raw_spin_unlock+0x40/0x40 [ 1602.801142][T21020] check_panic_on_warn+0x80/0xa0 [ 1602.806289][T21020] ? v4l2_fh_open+0xc6/0x430 [ 1602.810917][T21020] end_report+0x66/0x110 [ 1602.815199][T21020] kasan_report+0x118/0x140 [ 1602.819829][T21020] ? v4l2_fh_open+0xc6/0x430 [ 1602.824520][T21020] v4l2_fh_open+0xc6/0x430 [ 1602.829233][T21020] em28xx_v4l2_open+0x152/0x990 [ 1602.834373][T21020] ? __lock_acquire+0x7c50/0x7c50 [ 1602.839452][T21020] v4l2_open+0x20b/0x360 [ 1602.843822][T21020] chrdev_open+0x597/0x670 [ 1602.848282][T21020] ? cd_forget+0x160/0x160 [ 1602.852734][T21020] ? tomoyo_file_open+0xe9/0x170 [ 1602.858325][T21020] ? fsnotify_perm+0x39b/0x550 [ 1602.863614][T21020] ? cd_forget+0x160/0x160 [ 1602.868505][T21020] do_dentry_open+0x7e9/0x10d0 [ 1602.873480][T21020] path_openat+0x25c6/0x2e70 [ 1602.878364][T21020] ? do_sys_openat2+0xcf/0x490 [ 1602.883435][T21020] ? __x64_sys_openat+0x135/0x160 [ 1602.889007][T21020] ? do_syscall_64+0x4c/0xa0 [ 1602.893891][T21020] ? do_filp_open+0x3c0/0x3c0 [ 1602.898596][T21020] do_filp_open+0x1c1/0x3c0 [ 1602.903262][T21020] ? vfs_tmpfile+0x480/0x480 [ 1602.908416][T21020] ? _raw_spin_unlock+0x24/0x40 [ 1602.914356][T21020] ? alloc_fd+0x58f/0x630 [ 1602.919087][T21020] do_sys_openat2+0x142/0x490 [ 1602.923801][T21020] ? up_read+0x20/0x20 [ 1602.928017][T21020] ? do_sys_open+0xe0/0xe0 [ 1602.932559][T21020] ? lockdep_hardirqs_on_prepare+0x3fc/0x760 [ 1602.940480][T21020] ? lock_chain_count+0x20/0x20 [ 1602.945880][T21020] __x64_sys_openat+0x135/0x160 [ 1602.951025][T21020] do_syscall_64+0x4c/0xa0 [ 1602.955487][T21020] ? clear_bhb_loop+0x60/0xb0 [ 1602.960217][T21020] ? clear_bhb_loop+0x60/0xb0 [ 1602.965031][T21020] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1602.969517][T11643] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1602.969544][T11643] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1602.969561][T11643] usb 1-1: Product: syz [ 1602.969572][T11643] usb 1-1: Manufacturer: syz [ 1602.969583][T11643] usb 1-1: SerialNumber: syz [ 1602.971330][T11643] usb 1-1: config 0 descriptor?? [ 1603.007646][T21020] RIP: 0033:0x7f9257ea7407 [ 1603.012077][T21020] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 1603.031690][T21020] RSP: 002b:00007ffe03dc73e0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 1603.040211][T21020] RAX: ffffffffffffffda RBX: 00007f9258544880 RCX: 00007f9257ea7407 [ 1603.048199][T21020] RDX: 0000000000000000 RSI: 00007ffe03dc7f1c RDI: ffffffffffffff9c [ 1603.056362][T21020] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 1603.064355][T21020] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 1603.072786][T21020] R13: 00007ffe03dc7630 R14: 00007f92586a3000 R15: 000055b15f13f4d8 [ 1603.081109][T21020] [ 1603.084418][T21020] Kernel Offset: disabled [ 1603.088850][T21020] Rebooting in 86400 seconds..