last executing test programs: 11.746158159s ago: executing program 0 (id=1814): r0 = socket$inet_udp(0x2, 0x2, 0x0) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi0\x00', 0x400, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) socket$kcm(0x10, 0x2, 0x4) r4 = getpid() r5 = socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x21, 0x80084, 0x100, 0x4, 0x2c}, 0x50) r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r8, &(0x7f0000003340)=[{{0x0, 0xfffffffffffffed1, &(0x7f0000000280)=[{&(0x7f0000000600)='4', 0x1}], 0x1, &(0x7f00000002c0)=[@rights={{0x10}}], 0x10, 0x40}}], 0x1, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r7, 0x0, r9, 0x0, 0x39011, 0x0) sendmsg$DEVLINK_CMD_RELOAD(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r6, 0x1, 0x70bd2b, 0x25dfdbfb, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r4}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x30) r10 = socket$inet6_sctp(0xa, 0x1, 0x84) shutdown(r10, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r10, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x4e21, @local}]}, &(0x7f0000000440)=0xc) setsockopt$inet_sctp6_SCTP_CONTEXT(r10, 0x84, 0x11, &(0x7f0000000100)={r11, 0xd}, 0x8) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='syz_tun\x00', 0x10) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) 9.033894075s ago: executing program 0 (id=1817): io_uring_setup(0x5, 0x0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000040)) ioctl$PPPIOCSACTIVE(r0, 0x40087446, &(0x7f0000000140)={0x7, &(0x7f00000000c0)=[{0x6, 0x9, 0xad, 0x8aa9}, {0x0, 0x4, 0x1, 0xa}, {0x2, 0x1, 0xc, 0x60000000}, {0x8, 0xcd, 0xb, 0x4}, {0x800, 0xb, 0x2, 0x2}, {0x8, 0x4a, 0x1, 0x5}, {0x7, 0xfc, 0x4, 0xc}]}) r1 = socket$pppoe(0x18, 0x1, 0x0) socketpair(0x8, 0x80000, 0x10001, &(0x7f0000000000)={0xffffffffffffffff}) r3 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000080)={'vxcan0\x00', 0x0}) bind$can_raw(r3, &(0x7f00000001c0)={0x1d, r4}, 0x10) setsockopt$CAN_RAW_RECV_OWN_MSGS(r3, 0x65, 0x4, &(0x7f00000003c0)=0x1, 0x4) r5 = socket$tipc(0x1e, 0x2, 0x0) getpeername$tipc(r5, &(0x7f0000000500)=@name, &(0x7f0000000540)=0x10) sendmsg$can_raw(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000480)=@can={{0x2, 0x0, 0x0, 0x1}, 0x4, 0x3, 0x0, 0x0, "985300"}, 0x10}}, 0xd209f6d814827b17) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000080)=0x3) ioctl$TIOCSTI(r6, 0x5412, &(0x7f0000000080)=0x13) getpeername$packet(r2, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) setsockopt$inet6_tcp_TLS_RX(r2, 0x11a, 0x2, &(0x7f0000000180)=@ccm_128={{}, "c1e1a9aed27912bc", "3776bc9cc5a9cd22bbadb07ccf9eeba2", "97e4c1a6", "c60c0e523d0dc178"}, 0x28) connect$pppoe(r1, &(0x7f0000000080)={0x18, 0x0, {0x3, @local, 'geneve0\x00'}}, 0x1e) r7 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000400)='syz1\x00', 0x200002, 0x0) openat$cgroup_ro(r7, &(0x7f00000004c0)='io.stat\x00', 0x0, 0x0) setsockopt$inet6_udp_int(r2, 0x11, 0x5, &(0x7f0000000340)=0xaf48, 0x4) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PPPIOCATTCHAN(r8, 0x40047438, &(0x7f0000000100)=0x1) r9 = syz_open_dev$media(&(0x7f00000006c0), 0x4, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r9, 0x80047c05, 0x0) pselect6(0x900, 0x0, 0x0, &(0x7f0000000240)={0x1f}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) ioctl$PPPIOCCONNECT(r8, 0x4004743a, &(0x7f0000000380)) socket$nl_route(0x10, 0x3, 0x0) 8.811179464s ago: executing program 0 (id=1820): r0 = openat$ppp(0xffffff9c, &(0x7f00000002c0), 0x0, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f0000000080)=@req3={0x4, 0x200, 0x80, 0x20000, 0xfff, 0x0, 0x1}, 0x1c) mmap(&(0x7f0000568000/0x2000)=nil, 0x1000000, 0x0, 0x11, r1, 0x0) move_pages(0x0, 0x2064, &(0x7f0000000040)=[&(0x7f0000ff9000/0x2000)=nil], &(0x7f0000001180), &(0x7f0000000000), 0x0) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000001600)=0x24) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000001640)={&(0x7f00000000c0)={0x14, 0x3a, 0x301, 0x70bd25, 0xfffffffc, {0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x448d3}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x2400, 0x0) r5 = socket$netlink(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r6, 0x1, 0x3, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000}, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000040)={0xffffffffffffffff, 0xe0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa9, 0x0, 0x0, 0x0}}, 0x10) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x20, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000240)='GPL\x00', 0x1, 0x0, 0x0, 0x41000, 0x0, '\x00', r7, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r8, 0x0, 0x22, 0x0, &(0x7f0000000380)="f6f4e9a1d78ad62ceef1884386dd78bb3fb7dbfc8180ca8395ccfda2e499b3dcf581", 0x0, 0xa1b, 0x0, 0x2f, 0x0, &(0x7f0000000700)="010a", 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001500)={0x6, 0x6, &(0x7f0000000400)=@raw=[@jmp={0x5, 0x0, 0x4, 0x9, 0x7, 0x100, 0xfffffffffffffff0}, @alu={0x4, 0x0, 0x3, 0x3, 0x8, 0xfffffffffffffff0}, @btf_id={0x18, 0x2, 0x3, 0x0, 0x2}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @generic={0x5, 0x2, 0x4, 0x8000, 0x200}], &(0x7f0000000440)='syzkaller\x00', 0x8000, 0x1000, &(0x7f0000000480)=""/4096, 0x40f00, 0x3, '\x00', r9, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001480)={0x1b34, 0x7, 0x4, 0x81}, 0x10, 0x0, 0x0, 0x1, 0x0, &(0x7f00000014c0)=[{0x3, 0x4, 0x9, 0x5}], 0x10, 0x5}, 0x94) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f00000015c0)={'tunl0\x00', @broadcast}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=@newlink={0x20, 0x10, 0x801, 0x70bd2b, 0x25dfdbf7, {0x0, 0x0, 0x0, 0x0, 0x2202e, 0x2180}}, 0x20}, 0x1, 0x0, 0x0, 0x20048050}, 0x40054) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="340000001300050022bd7000ffdbdf2507000000", @ANYRES32=r9, @ANYBLOB="800800000311000014001a80100005800c000880"], 0x34}, 0x1, 0x0, 0x0, 0x24040010}, 0x20000040) ioctl$PPPIOCSACTIVE(r0, 0x40087446, &(0x7f0000000340)={0x7, &(0x7f0000000300)=[{0x6638, 0xfe, 0x0, 0x2}, {0x7, 0x3, 0x9, 0xef2}, {0x7, 0x5, 0x6d, 0xb56}, {0xfff, 0x1b, 0x2, 0xff}, {0x684e, 0x2, 0x7, 0x6}, {0x7fff, 0x9, 0x7, 0x8}, {0x8001, 0xf3, 0x5, 0x2d90}]}) r10 = openat$sr(0xffffff9c, &(0x7f0000000000), 0x48100, 0x0) readv(r10, &(0x7f0000000280)=[{&(0x7f0000000040)=""/11, 0xb}, {&(0x7f0000000080)=""/38, 0x26}, {&(0x7f00000000c0)=""/123, 0x7b}, {&(0x7f00000001c0)=""/54, 0x36}, {&(0x7f0000000200)=""/119, 0x77}], 0x5) 4.495721116s ago: executing program 0 (id=1834): fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000b40)='source', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000003c0)={'ip6_vti0\x00', &(0x7f0000000340)={'syztnl0\x00', 0x0, 0x29, 0x4, 0x4, 0xbd, 0x50, @local, @mcast1, 0x700, 0x7800, 0x1, 0x6}}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000500)=ANY=[@ANYRESHEX=r0, @ANYBLOB="81cb89f549c11ab7dfb0820faca7facd50c853334a1836147d986708935f2330b3a9226349b6c0c929fdafca5f2e2e113c6d70cf5b5085f703e90ed70268"], &(0x7f0000000000)='GPL\x00', 0x6, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', r0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = syz_usb_connect(0x3, 0x3d, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000bdce4208110f80106afc0000000109022b00010000000009043700022ee5cd0009058010ff037f790209050e0320000980070705ab0b78"], 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$printer(0x1, 0x2d, &(0x7f0000000400)=ANY=[@ANYBLOB="12010002000000202505a8a440000102030109021b0001010ea003090400040207010307090501020002f301073affedde31dd2f29ec58afaa0b49d11a5b60838a2372dc3bb5525d712fa65cd107781f6905c937a496f744595a2c793cf0caece252922953f23fb5ac79ba33a11677dc1179c9ed0d00"/133], 0x0) fsopen(&(0x7f0000000100)='ramfs\x00', 0x1) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000000)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) read$char_usb(r2, &(0x7f0000000080)=""/163, 0xa3) r3 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r3, 0x84, 0x7, &(0x7f00000005c0)={0x9}, 0x4) fcntl$setlease(r3, 0x400, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/profiling', 0x0, 0x0) syz_usb_disconnect(r1) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r5 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$DRM_IOCTL_VERSION(r5, 0xc0406400, &(0x7f0000000300)={0x1, 0x8, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) 3.782823065s ago: executing program 1 (id=1838): syz_emit_ethernet(0x66, &(0x7f0000000340)={@random="cf702e8cf675", @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x30, 0x3a, 0xff, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @dev, @dev, [{0x2, 0x1, "703b744dc5c6"}]}}}}}}, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(camellia)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000025c0)=@newtaction={0x100, 0x30, 0x800, 0x70bd2a, 0x25dfdbfc, {}, [{0xec, 0x1, [@m_ipt={0x34, 0x1a, 0x0, 0x0, {{0x8}, {0xc, 0x2, 0x0, 0x1, [@TCA_IPT_HOOK={0x8, 0x2, 0x1}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x1}}}}, @m_ipt={0x58, 0xc, 0x0, 0x0, {{0x8}, {0x30, 0x2, 0x0, 0x1, [@TCA_IPT_TABLE={0x24, 0x1, 'security\x00'}, @TCA_IPT_HOOK={0x8, 0x2, 0x2}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}, @m_ipt={0x5c, 0x20, 0x0, 0x0, {{0x8}, {0x4}, {0x31, 0x6, "78eecaa209275119972ece92d2e88234b9706d227b2a1990c2f992e5abc79d597fc027585b2a522cbba2bbfd70"}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0x100}, 0x1, 0x0, 0x0, 0x24004000}, 0x24048880) recvmmsg$unix(r1, &(0x7f0000000e00)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000000)={0x0, @in6={{0xa, 0x4e23, 0xc, @loopback, 0x4}}}, 0x84) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000540)=@newtaction={0x6c, 0x30, 0xb, 0x70bd2b, 0x0, {}, [{0x58, 0x1, [@m_ct={0x54, 0x1, 0x0, 0x0, {{0x7}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x7ff, 0x1000, 0xfffffffffffffffe, 0x0, 0x2400}}, @TCA_CT_ACTION={0x6, 0x3, 0x19}, @TCA_CT_NAT_IPV4_MIN={0x8, 0x9, @multicast2}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4008890}, 0x40) ioctl$XFS_IOC_ERROR_INJECTION(r0, 0x40085874, &(0x7f0000000100)={r2, 0x5}) unshare(0x2c060000) syz_open_dev$vim2m(0x0, 0xbfb, 0x2) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x0) setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', &(0x7f0000002a40)='system.posix_acl_default\x00', &(0x7f00000004c0)=ANY=[@ANYBLOB, @ANYBLOB], 0x2c, 0x0) socket(0x10, 0x3, 0x0) r4 = syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x0) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x183383, 0x0) read$midi(r4, &(0x7f0000000180)=""/187, 0xbb) ioctl$SNDCTL_SEQ_PANIC(r5, 0x5100) r6 = openat$incfs(0xffffffffffffff9c, 0x0, 0x1a10c1, 0x9c37611dc13d0d83) fchown(r6, 0xffffffffffffffff, 0x0) socket$kcm(0xa, 0x2, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x206000, 0x162) ioctl$F2FS_IOC_RESIZE_FS(r4, 0x4008f510, &(0x7f0000000040)=0x5) r7 = socket(0x2, 0x80805, 0x0) setsockopt$IP_VS_SO_SET_ADD(r7, 0x0, 0x482, &(0x7f0000000240)={0x84, @rand_addr=0x64010102, 0x4e20, 0x3, 'lc\x00', 0x3, 0xa7e, 0x49}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r7, 0x0, 0x487, &(0x7f0000000080)={{0x84, @private=0xa010102, 0x4f21, 0x3, 'lblcr\x00', 0x29, 0x5, 0x10}, {@multicast1, 0x4e20, 0x10048, 0x4, 0x44}}, 0x44) 3.232764906s ago: executing program 0 (id=1839): openat$random(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000280), 0x3000c11, &(0x7f0000000740)={[{@mpol={'mpol', 0x3d, {'interleave', '=relative', @val={0x3a, [0x33, 0x2d, 0x4e, 0x3a, 0x36, 0x2f, 0x30]}}}, 0x4e}]}) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000280)='net/fib_triestat\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000480)=""/134, 0x86}], 0x1, 0x800, 0x78) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000300)={0x0}, 0x1, 0x0, 0x0, 0x40}, 0x87d4b69a72310a97) r5 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) r6 = gettid() bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x18, 0x4, 0x0, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0xe4}, 0x94) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) tkill(r6, 0xb) ioctl$TIOCL_SETSEL(r1, 0x541c, &(0x7f0000001900)={0x2, {0xc, 0x117, 0x5, 0x101, 0x200}}) 3.002750891s ago: executing program 3 (id=1840): r0 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'macsec0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="480006001400b59527bd7000ffdbdf250a1700ff", @ANYRES32=r1, @ANYBLOB="1400020000000000000000000000000000000001"], 0x48}, 0x1, 0x0, 0x0, 0x2004c040}, 0x0) 2.95778423s ago: executing program 3 (id=1841): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) pwritev2(r1, &(0x7f0000000740), 0x0, 0x8, 0x1, 0x1c) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r2, 0x40146f2c, &(0x7f00000000c0)={0x1, 0x0, 0x3, 0x13, 0x4}) mkdir(&(0x7f00000003c0)='./file0\x00', 0x21) openat$dir(0xffffffffffffff9c, 0x0, 0x400000, 0x6) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000440)={0x0, 0xfffffffc, 0xffdffff8, 0x8, 0x8, "000000000000000000000000000000f30200"}) r4 = syz_open_pts(r3, 0x2000) pselect6(0x40, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x800, 0x40000}, 0x0, &(0x7f0000000240)={0x800001f, 0x0, 0x181, 0x0, 0x0, 0x9e24}, 0x0, 0x0) ioctl$TIOCPKT(r3, 0x5420, &(0x7f0000000340)=0x8) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000000)=0x13) mount$bpf(0x0, 0x0, 0x0, 0x5805040, &(0x7f0000002640)=ANY=[@ANYBLOB='uid=', @ANYRESHEX=0x0, @ANYBLOB="d0f07fbe134b42555b65adb8c3469d6fb47ee1f547843804e4ee9c722f39a1b2adaa5fbef0022e029f8470c59d9d0cc6a83766b0e7a268c8f2083c15b570a4de12461a945b1636ebc05e832f6e9e44c7f65decf5b452b12b77650a09756bcaa7bdec5af95ecdf548340c4a02b01cb6b438967dd5e62574bdb449d5d4a75cc9587956049e994940ad6bd746994f08e38751cd2312256126a8e318baa12d6a47232681fb42a79dca16c7d825f33ee367ba6aef49c41e3e1b63d524ca0f665e323fcbdb785f7aa87574f1cdad6359e8529e5e3aad9fc24c86cf0ac5f46e2de05be93fdb86225d0aaaab41e42c24142f68b1d15d"]) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(0xffffffffffffffff, &(0x7f0000000300)={@val={0x8, 0x19}, @val={0x7, 0x0, 0x0, 0xb, 0x14}, @ipv4=@tcp={{0x5, 0x4, 0x0, 0x17, 0x28, 0x200, 0x0, 0x3, 0x6, 0x0, @multicast1, @multicast2}, {{0x4e22, 0x4e20, 0x41424344, 0x41424344, 0x1, 0x0, 0x5, 0x10, 0x7, 0x0, 0x5}}}}, 0x36) openat(0xffffffffffffff9c, 0x0, 0x0, 0x8c) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r6, &(0x7f0000000600)={0x2020}, 0x2020) close(r0) socket$nl_netfilter(0x10, 0x3, 0xc) 2.947919914s ago: executing program 1 (id=1842): pipe2$9p(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80880) write$P9_RFSYNC(r0, &(0x7f0000000180)={0x7, 0x33, 0x2}, 0x7) r1 = socket(0xa, 0x3, 0x3a) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) ioctl$KVM_PRE_FAULT_MEMORY(r5, 0xc040aed5, &(0x7f00000000c0)={0xf000, 0x118000}) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) setsockopt$MRT6_ADD_MIF(r1, 0x29, 0xca, &(0x7f0000000000)={0x4, 0x1, 0x4}, 0xc) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) setsockopt$MRT6_ADD_MIF(r1, 0x29, 0xca, &(0x7f00000000c0)={0x0, 0x0, 0x3, r6, 0x230d}, 0xc) setsockopt$MRT6_FLUSH(r1, 0x29, 0xd4, &(0x7f0000000080)=0xa, 0x4) 1.940964727s ago: executing program 3 (id=1843): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SMC_PNETID_DEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={0x2c, r1, 0x1, 0x0, 0x25dfdbfe, {0x2, 0x2, 0x2}, [@SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x2c}, 0x1, 0x40030000000000, 0x0, 0x800}, 0x4000) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) r3 = openat$audio(0xffffff9c, &(0x7f0000000340), 0x682501, 0x0) r4 = gettid() r5 = socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0}, &(0x7f0000000100)=0xc) setresuid(r6, 0x0, 0x0) getgroups(0x4, &(0x7f0000000380)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xee01]) r8 = getpid() sched_setscheduler(r8, 0x2, &(0x7f0000000200)=0x4) sched_setaffinity(r8, 0xfffffffffffffeef, &(0x7f0000000240)=0x2) r9 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r9, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r9, &(0x7f0000002140)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(r9, 0x0, 0x0, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x90, 0x0, 0x1, {0x6, 0x2, 0x9, 0xfffffffffffffffd, 0x6, 0x0, {0x40, 0x0, 0xb, 0xfffc, 0x0, 0x1, 0x0, 0xffffffff, 0x120, 0x2000, 0xa8, r10, r11, 0x501, 0x4}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r12 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r12}, &(0x7f0000bbdffc)) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000480)={{0x1, 0x1, 0x18, r0, {0x0, 0xee00}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000004c0)={{0x1, 0x1, 0x18, r0, {0xee00, 0xffffffffffffffff}}, './file0\x00'}) sendmsg$netlink(r0, &(0x7f0000000600)={&(0x7f0000000200)=@kern={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000300)=[{&(0x7f0000000240)={0x5c, 0x3e, 0x0, 0x70bd26, 0x25dfdbfd, "", [@generic="bf4ebbf35461f724d626f19457b8f69c2befa79e40bf53cd66f91b6f276c17dfc09523473912e630604fed6800ddaa8e20477b81f03f09aad995b83ccfc5f3db474a9f9c4f7c2a6f08"]}, 0x5c}, {&(0x7f00000002c0)={0x18, 0x23, 0x100, 0x70bd2b, 0x25dfdbfc, "", [@typed={0x8, 0x7f, 0x0, 0x0, @u32=0x8001}]}, 0x18}], 0x2, &(0x7f0000000500)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, r0, r0, r3, r0]}}, @rights={{0x18, 0x1, 0x1, [r0, r0, r0]}}, @rights={{0x20, 0x1, 0x1, [r0, r0, r0, r0, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [r0, r0, r0]}}, @cred={{0x18, 0x1, 0x2, {r4, r6, r7}}}, @cred={{0x18, 0x1, 0x2, {r8, 0x0, r11}}}, @rights={{0x14, 0x1, 0x1, [r0, r0]}}, @cred={{0x18, 0x1, 0x2, {r12, r13, r14}}}], 0xcc, 0x48}, 0x4000) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3c000000faf039a7bd9a66829b9a649c4e3bc0abcfec48cc4bbc0c6451b1dca410ce81596b98a10086dc33d8d5fc95cdd80c623a04437d62c4b9c9f4a724b4838000000000000000caa8", @ANYRES16=r2, @ANYBLOB="0100ffffffff0000000001000000100007800c00018008000100", @ANYRES32, @ANYBLOB="0c00040006000000000000000c0006000100000000000000"], 0x3c}}, 0x20000000) r15 = socket$nl_crypto(0x10, 0x3, 0x15) connect$netlink(r15, &(0x7f0000000080)=@unspec, 0xc) semget$private(0x0, 0x2, 0x56) semctl$GETALL(0x0, 0x0, 0xd, &(0x7f0000000900)=""/252) ioctl$NILFS_IOCTL_RESIZE(r0, 0x40086e8b, &(0x7f0000000180)=0x9) 1.52298129s ago: executing program 2 (id=1844): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x4, 0x14, &(0x7f00000000c0)=ANY=[@ANYRES64, @ANYRES32], 0x0, 0x2, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000600)={{0x1, 0x1, 0x18, r0, {0x26}}, '\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00'}) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={0x0, 0x5c}}, 0x0) socket(0x400000000010, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xc, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) open(&(0x7f0000000440)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x181040, 0x2c) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x4ce903, 0x8e) fsetxattr$trusted_overlay_origin(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) socket$inet_mptcp(0x2, 0x1, 0x106) keyctl$instantiate(0xc, 0x0, &(0x7f00000006c0)=ANY=[], 0x2a, 0x0) pipe2$watch_queue(&(0x7f0000001180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r4 = add_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000000100)={'syz', 0x3}, &(0x7f0000000080), 0x0, 0xfffffffffffffffe) write$binfmt_format(0xffffffffffffffff, &(0x7f0000000140)='-1\x00', 0x3) keyctl$KEYCTL_WATCH_KEY(0x20, r4, r3, 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, r4, r3, 0xffffffffffffffff) keyctl$revoke(0x3, r4) r5 = add_key$user(&(0x7f0000000380), &(0x7f0000000000), &(0x7f00000003c0)='X', 0x1, 0xfffffffffffffffe) r6 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000100)={r5, r6, r6}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'wp512-generic\x00'}}) 1.213717407s ago: executing program 0 (id=1845): r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_TABLE(r0, 0x0, 0xcf, &(0x7f0000000040)=0xfc, 0x4) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, &(0x7f00000000c0)={0x8, 0x0, 0x0, 0xc, @vifc_lcl_addr=@local, @dev={0xac, 0x14, 0x14, 0x3c}}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000340)=ANY=[@ANYBLOB="aaaaaaaaaaaaff0961d54cff08004500001c0000000000029078ac1414bbe01102907880000000000000558e1115ea18af572d0397f4d0ed978afa72979423df872ea4a5f62e6901891d2b98464594f2ef758fd94d7a4185de43bbb71b55ee305e98b30d78950cf4b7f815efe87693dfe276dd2d3e7dda63986f5d549200b99bdd982752af408ef4c1eae665792d071dbd244d05d9a35c521c1978bc7668abccba54d66d255d5a583d4dedcfb5f84f27ebebcc597ee2907b7b949bdb43047c338093f5c360d0b7d6b84396346db30f64e75f18d1a1f9b6"], 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000240)=ANY=[@ANYBLOB="1201000050cb5340450c10108e492940a80909021b", @ANYRESHEX=r0, @ANYRES16=r0, @ANYRES64=r1, @ANYRESDEC=r0], 0x0) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write(r3, &(0x7f00000000c0)='R', 0x1) pipe(&(0x7f00000001c0)) syz_open_procfs(0x0, &(0x7f0000000040)='fd/4\x00') r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000040)="2e00000010008108040f80ecdb4cb92e0a480e000f000000e8bd6efb250314000e000100240248ff050005001200", 0x2e}], 0x1}, 0x40880) syz_emit_ethernet(0x2a, &(0x7f0000000080)={@local, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @address_request}}}}, 0x0) setsockopt$MRT_ADD_MFC_PROXY(r2, 0x0, 0xd2, &(0x7f0000000200)={@empty, @multicast2=0xe0000300, 0xfffd, "028a3f6c58b274e6d8451693efe42811ee1df06e9264f7d866b1970548fc3c7b", 0xb2, 0xfffffff7, 0x4, 0x40000006}, 0x3c) r5 = socket(0x2b, 0x1, 0x1) setsockopt$inet6_tcp_int(r5, 0x6, 0x2e, &(0x7f0000000040)=0x4, 0x4) socket$can_raw(0x1d, 0x3, 0x1) r6 = socket(0x10, 0x3, 0x0) write(r6, &(0x7f0000000e80)="1300000032001f00320300f9002304000a04d6", 0x13) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r8 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x404, &(0x7f0000002140)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}}) close_range(r7, 0xffffffffffffffff, 0x0) r9 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r9, &(0x7f0000000040)={0xa, 0x4e23, 0xc, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x7}, 0x1c) setsockopt$SO_BINDTODEVICE(r9, 0x1, 0x19, &(0x7f0000000080)='batadv0\x00', 0x10) sendto$inet6(r9, &(0x7f0000000000)="8f6bb66f", 0x5ac, 0x0, 0x0, 0xfffffffffffffec8) 1.127051115s ago: executing program 1 (id=1846): io_uring_setup(0x5, &(0x7f00000002c0)) r0 = openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000040)) ioctl$PPPIOCSACTIVE(r0, 0x40087446, &(0x7f0000000140)={0x7, &(0x7f00000000c0)=[{0x6, 0x9, 0xad, 0x8aa9}, {0x0, 0x4, 0x1, 0xa}, {0x2, 0x1, 0xc, 0x60000000}, {0x8, 0xcd, 0xb, 0x4}, {0x800, 0xb, 0x2, 0x2}, {0x8, 0x4a, 0x1, 0x5}, {0x7, 0xfc, 0x4, 0xc}]}) r1 = socket$pppoe(0x18, 0x1, 0x0) socketpair(0x8, 0x80000, 0x10001, &(0x7f0000000000)={0xffffffffffffffff}) r3 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000080)={'vxcan0\x00', 0x0}) bind$can_raw(r3, &(0x7f00000001c0)={0x1d, r4}, 0x10) setsockopt$CAN_RAW_RECV_OWN_MSGS(r3, 0x65, 0x4, &(0x7f00000003c0)=0x1, 0x4) r5 = socket$tipc(0x1e, 0x2, 0x0) getpeername$tipc(r5, &(0x7f0000000500)=@name, &(0x7f0000000540)=0x10) sendmsg$can_raw(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000480)=@can={{0x2, 0x0, 0x0, 0x1}, 0x4, 0x3, 0x0, 0x0, "985300"}, 0x10}}, 0xd209f6d814827b17) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000080)=0x3) ioctl$TIOCSTI(r6, 0x5412, &(0x7f0000000080)=0x13) getpeername$packet(r2, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) setsockopt$inet6_tcp_TLS_RX(r2, 0x11a, 0x2, &(0x7f0000000180)=@ccm_128={{}, "c1e1a9aed27912bc", "3776bc9cc5a9cd22bbadb07ccf9eeba2", "97e4c1a6", "c60c0e523d0dc178"}, 0x28) connect$pppoe(r1, &(0x7f0000000080)={0x18, 0x0, {0x3, @local, 'geneve0\x00'}}, 0x1e) r7 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000400)='syz1\x00', 0x200002, 0x0) openat$cgroup_ro(r7, &(0x7f00000004c0)='io.stat\x00', 0x0, 0x0) setsockopt$inet6_udp_int(r2, 0x11, 0x5, &(0x7f0000000340)=0xaf48, 0x4) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PPPIOCATTCHAN(r8, 0x40047438, &(0x7f0000000100)=0x1) r9 = syz_open_dev$media(&(0x7f00000006c0), 0x4, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r9, 0x80047c05, 0x0) pselect6(0x900, 0x0, 0x0, &(0x7f0000000240)={0x1f}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) ioctl$PPPIOCCONNECT(r8, 0x4004743a, &(0x7f0000000380)) socket$nl_route(0x10, 0x3, 0x0) 1.064339231s ago: executing program 3 (id=1847): openat$random(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000280), 0x3000c11, &(0x7f0000000740)={[{@mpol={'mpol', 0x3d, {'interleave', '=relative', @val={0x3a, [0x33, 0x2d, 0x4e, 0x3a, 0x36, 0x2f, 0x30]}}}, 0x4e}]}) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000280)='net/fib_triestat\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000480)=""/134, 0x86}], 0x1, 0x800, 0x78) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000300)={0x0}, 0x1, 0x0, 0x0, 0x40}, 0x87d4b69a72310a97) r5 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) r6 = gettid() bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x18, 0x4, 0x0, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0xe4}, 0x94) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) tkill(r6, 0xb) ioctl$TIOCL_SETSEL(r1, 0x541c, &(0x7f0000001900)={0x2, {0xc, 0x117, 0x5, 0x101, 0x200}}) 933.009687ms ago: executing program 1 (id=1848): io_uring_setup(0x5, 0x0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000040)) ioctl$PPPIOCSACTIVE(r0, 0x40087446, &(0x7f0000000140)={0x7, &(0x7f00000000c0)=[{0x6, 0x9, 0xad, 0x8aa9}, {0x0, 0x4, 0x1, 0xa}, {0x2, 0x1, 0xc, 0x60000000}, {0x8, 0xcd, 0xb, 0x4}, {0x800, 0xb, 0x2, 0x2}, {0x8, 0x4a, 0x1, 0x5}, {0x7, 0xfc, 0x4, 0xc}]}) r1 = socket$pppoe(0x18, 0x1, 0x0) socketpair(0x8, 0x80000, 0x10001, &(0x7f0000000000)={0xffffffffffffffff}) r3 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000080)={'vxcan0\x00', 0x0}) bind$can_raw(r3, &(0x7f00000001c0)={0x1d, r4}, 0x10) setsockopt$CAN_RAW_RECV_OWN_MSGS(r3, 0x65, 0x4, &(0x7f00000003c0)=0x1, 0x4) r5 = socket$tipc(0x1e, 0x2, 0x0) getpeername$tipc(r5, &(0x7f0000000500)=@name, &(0x7f0000000540)=0x10) sendmsg$can_raw(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000480)=@can={{0x2, 0x0, 0x0, 0x1}, 0x4, 0x3, 0x0, 0x0, "985300"}, 0x10}}, 0xd209f6d814827b17) read(r3, &(0x7f0000002fc0)=""/52, 0x34) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000080)=0x3) ioctl$TIOCSTI(r6, 0x5412, &(0x7f0000000080)=0x13) getpeername$packet(r2, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) setsockopt$inet6_tcp_TLS_RX(r2, 0x11a, 0x2, &(0x7f0000000180)=@ccm_128={{}, "c1e1a9aed27912bc", "3776bc9cc5a9cd22bbadb07ccf9eeba2", "97e4c1a6", "c60c0e523d0dc178"}, 0x28) connect$pppoe(r1, &(0x7f0000000080)={0x18, 0x0, {0x3, @local, 'geneve0\x00'}}, 0x1e) r7 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000400)='syz1\x00', 0x200002, 0x0) openat$cgroup_ro(r7, &(0x7f00000004c0)='io.stat\x00', 0x0, 0x0) setsockopt$inet6_udp_int(r2, 0x11, 0x5, &(0x7f0000000340)=0xaf48, 0x4) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PPPIOCATTCHAN(r8, 0x40047438, &(0x7f0000000100)=0x1) r9 = syz_open_dev$media(&(0x7f00000006c0), 0x4, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r9, 0x80047c05, 0x0) pselect6(0x900, 0x0, 0x0, &(0x7f0000000240)={0x1f}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) ioctl$PPPIOCCONNECT(r8, 0x4004743a, &(0x7f0000000380)) socket$nl_route(0x10, 0x3, 0x0) 615.236513ms ago: executing program 1 (id=1849): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) syz_emit_ethernet(0x4a, &(0x7f00000002c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000086dd6000000000140600fe8000000000000000000000000000bbfe8000000000000000000000000000aa00004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="0000000000000400"], 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000750000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000e00000095"], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="07000000040000001800000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x9, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000001000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000000000850000001b"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r2}, 0x8) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) readv(r3, &(0x7f0000000600)=[{&(0x7f00000002c0)=""/127, 0x7f}], 0x1) syz_emit_ethernet(0x8a, &(0x7f0000000180)={@local, @dev, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "00fa2e", 0x54, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x15, 0x20, 0x8000, 0x0, 0x0, {[@exp_fastopen={0xfe, 0x7, 0xf989, "4aaf94"}, @generic={0x8, 0x2}, @md5sig={0x13, 0x12, "f89c3aadcc9361de319598bb9ae9a46b"}, @window={0x3, 0x3, 0x9}, @generic={0x5, 0x7, "e803000002"}, @exp_fastopen={0xfe, 0x6, 0xf989, "ea0e"}, @md5sig={0x13, 0x12, "aa1da78e648e284a4f94ac791c0cd796"}]}}}}}}}}, 0x0) 508.705723ms ago: executing program 2 (id=1850): socket$inet6(0xa, 0x3, 0x5) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000700)={'wlan0\x00', 0x0}) ioprio_set$pid(0x2, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sched_setscheduler(0x0, 0x5, &(0x7f0000000480)) sendmsg$NL80211_CMD_RELOAD_REGDB(r4, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)={0x14, r5, 0x421, 0x70bd2f, 0x25dfdbfe}, 0x14}}, 0x400d4) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x8}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000001540)={0x6, 0xc, &(0x7f0000001480)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r6}, {}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x33}}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$NL80211_CMD_TRIGGER_SCAN(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="10007d", @ANYRES8=0x0, @ANYRES32=r1], 0x2c}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000080)=0xfff, 0x4) socketpair(0x8, 0x80000, 0x10001, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r7, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r0, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp={0x2c, 0x0, r8}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x36}], 0x1}}], 0x0, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0xc09, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x24104}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_AD_USER_PORT_KEY={0x6, 0x19, 0x4}, @IFLA_BOND_MODE={0x5, 0x1, 0x4}]}}}]}, 0x44}}, 0x0) 432.870748ms ago: executing program 2 (id=1851): landlock_restrict_self(0xffffffffffffffff, 0x4) socket$igmp6(0xa, 0x3, 0x2) syz_open_dev$dvb_dvr(0x0, 0x0, 0x2a400) socket$nl_route(0x10, 0x3, 0x0) r0 = gettid() r1 = socket(0x21, 0x2, 0x10000000000002) connect$rxrpc(r1, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x8000, @multicast2}}, 0x24) r2 = syz_open_dev$dvb_demux(&(0x7f0000000140), 0x0, 0x62400) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r2, 0x40146f2c, &(0x7f0000000040)={0xffe9, 0x0, 0x1, 0xa, 0x4}) sendmmsg(r1, &(0x7f0000000180)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=[{0x10, 0x110, 0x1}], 0x10, 0xe000}, 0x5}], 0x1, 0x0) recvmmsg(r1, &(0x7f0000002940)=[{{0x0, 0x0, 0x0}}], 0xf000, 0x10002, 0x0) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r1, 0x84, 0x5, 0x0, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f00000003c0)={0xffffffffffffffff, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}}) getrlimit(0x5, &(0x7f0000001500)) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, 0x0, 0x0) 315.069865ms ago: executing program 1 (id=1852): landlock_restrict_self(0xffffffffffffffff, 0x4) socket$igmp6(0xa, 0x3, 0x2) syz_open_dev$dvb_dvr(0x0, 0x0, 0x2a400) socket$nl_route(0x10, 0x3, 0x0) r0 = gettid() r1 = socket(0x21, 0x2, 0x10000000000002) connect$rxrpc(r1, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x8000, @multicast2}}, 0x24) r2 = syz_open_dev$dvb_demux(&(0x7f0000000140), 0x0, 0x62400) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r2, 0x40146f2c, &(0x7f0000000040)={0xffe9, 0x0, 0x1, 0xa, 0x4}) sendmmsg(r1, &(0x7f0000000180)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=[{0x10, 0x110, 0x1}], 0x10, 0xe000}, 0x5}], 0x1, 0x0) recvmmsg(r1, &(0x7f0000002940)=[{{0x0, 0x0, 0x0}}], 0xf000, 0x10002, 0x0) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r1, 0x84, 0x5, 0x0, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f00000003c0)={0xffffffffffffffff, 0x1000, {0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6abad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e0000000000000000000000000000000000ffff", "32d8cc26f7061a74df2cfc06c89f3d9a234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce6, 0xa]}}) getrlimit(0x5, &(0x7f0000001500)) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, 0x0, 0x0) 91.892132ms ago: executing program 2 (id=1853): setresuid(0xee00, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = add_key$user(&(0x7f0000000200), &(0x7f0000000300)={'syz', 0x1}, &(0x7f0000000240)="03", 0x1, 0xfffffffffffffffe) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000040)=0xfffffffffffffff7) r4 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$update(0x2, r4, &(0x7f0000000880)="2bcd2defe96da2d02d2247c8473553242d7b35c80792060552f58769230000000000000005ed88b0f47cb29b44c8e8fa78854d6a338d756c7160a74ec7e6676338705ea154bdef167e40ed31726087f165964e471efb48a949cf3a1ac64e0438e3515f5498f254a84fefef25d6e3fe15e6c121c7de4b94f55f76be9a5f8ca43984e7cad730dcead45190550d2b7d7953278b0b1a0910b4413c176bb2ffee3dc21bba4489fbbfc2b680032661ee4f77fab988a7397da8146d0724f2e695ef6895", 0xc0) keyctl$dh_compute(0x17, &(0x7f0000000100)={r2, r4, r4}, &(0x7f0000000140)=""/61, 0x3d, &(0x7f0000000340)={&(0x7f0000000280)={'cbcmac(aes)\x00'}}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="0a417e4bfd37165256b013f2f932706eda9590eba69de7a5d99870be174f92f6aebdf77bf7a66ee028fdf463fdfdb769277867339e740f06cb0669a4e54ea951e326c6a625376f130f72db", @ANYRES16=r1, @ANYRES16=r4, @ANYRESOCT=r0, @ANYBLOB="6e8a90963928f0f2653efa1b4d2af693252e35cf7032a5a60d73325da1a6c9", @ANYRESHEX=0x0, @ANYRES8=r2, @ANYRES32=r2, @ANYRESHEX=r1], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, 0x0, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0xedf0e51957efc755, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r5, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000580)="b9ff03076804268c989e14f088a8", 0x0, 0x500, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x5}, 0x50) r6 = openat$ptp1(0xffffff9c, &(0x7f0000000000), 0x2000, 0x0) ioctl$PTP_SYS_OFFSET(r6, 0x43403d05, &(0x7f0000000040)={0x9}) write$FUSE_ENTRY(0xffffffffffffffff, 0x0, 0x0) r7 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) setsockopt$llc_int(r7, 0x10c, 0x6, &(0x7f0000000480)=0x9, 0x4) sendmsg$unix(r0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=[@cred={{0x18, 0x1, 0x2, {0xffffffffffffffff}}}], 0x18, 0x40000}, 0x0) 91.471641ms ago: executing program 2 (id=1854): setreuid(0x0, 0xee00) request_key(&(0x7f0000000440)='rxrpc_s\x00', &(0x7f0000000480)={'syz', 0x2}, &(0x7f0000000500)='/dev/vc:u#\x00', 0xffffffffffffffff) 64.480461ms ago: executing program 3 (id=1855): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0026}]}) r1 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x101280, 0x48) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000040)={0x0, 0x0, r1, 0xfe0, 0x80000}) close_range(r0, 0xffffffffffffffff, 0x2) memfd_create(&(0x7f0000000140)='-\t:\xfd\xff\xff\xff\xff\xff\a\x00\x00\x00SP\xb3\xc9\x9c\x9d\xd2\x1f,\xc6\xea/\x9d\x0f0KR\xc8\xe3,<$P\x91\x1fj_\xa35\x86\xe5\xechCGz\'\xa9\xb3\x86\r&\"\xff\xc8\x13\xc3e\xdf\x1bh\x031\xda\x1bNG\xac\xf3O\x02\x83\x96\x00\xfc\x00\x00\x00\x00\x00', 0x4) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ff5000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0x0, r0}, 0x68) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e24, 0x9, @local, 0x10007}, 0x1c) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) sendmmsg$inet(r2, &(0x7f0000003a00)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000004c0)="cce6", 0x2}], 0x1}}], 0x1, 0x44801) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ff2000/0xd000)=nil, 0xd000, 0x0, 0x0, 0x0, 0x0, 0x100000, 0x0, 0x0}, &(0x7f0000000240)=0x40) 2.306088ms ago: executing program 3 (id=1856): io_uring_setup(0x5, &(0x7f00000002c0)) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, 0x0) ioctl$PPPIOCSACTIVE(r0, 0x40087446, &(0x7f0000000140)={0x7, &(0x7f00000000c0)=[{0x6, 0x9, 0xad, 0x8aa9}, {0x0, 0x4, 0x1, 0xa}, {0x2, 0x1, 0xc, 0x60000000}, {0x8, 0xcd, 0xb, 0x4}, {0x800, 0xb, 0x2, 0x2}, {0x8, 0x4a, 0x1, 0x5}, {0x7, 0xfc, 0x4, 0xc}]}) r1 = socket$pppoe(0x18, 0x1, 0x0) socketpair(0x8, 0x80000, 0x10001, &(0x7f0000000000)={0xffffffffffffffff}) r3 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000080)={'vxcan0\x00', 0x0}) bind$can_raw(r3, &(0x7f00000001c0)={0x1d, r4}, 0x10) setsockopt$CAN_RAW_RECV_OWN_MSGS(r3, 0x65, 0x4, &(0x7f00000003c0)=0x1, 0x4) r5 = socket$tipc(0x1e, 0x2, 0x0) getpeername$tipc(r5, &(0x7f0000000500)=@name, &(0x7f0000000540)=0x10) sendmsg$can_raw(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000480)=@can={{0x2, 0x0, 0x0, 0x1}, 0x4, 0x3, 0x0, 0x0, "985300"}, 0x10}}, 0xd209f6d814827b17) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000080)=0x3) ioctl$TIOCSTI(r6, 0x5412, &(0x7f0000000080)=0x13) getpeername$packet(r2, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) setsockopt$inet6_tcp_TLS_RX(r2, 0x11a, 0x2, &(0x7f0000000180)=@ccm_128={{}, "c1e1a9aed27912bc", "3776bc9cc5a9cd22bbadb07ccf9eeba2", "97e4c1a6", "c60c0e523d0dc178"}, 0x28) connect$pppoe(r1, &(0x7f0000000080)={0x18, 0x0, {0x3, @local, 'geneve0\x00'}}, 0x1e) r7 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000400)='syz1\x00', 0x200002, 0x0) openat$cgroup_ro(r7, &(0x7f00000004c0)='io.stat\x00', 0x0, 0x0) setsockopt$inet6_udp_int(r2, 0x11, 0x5, &(0x7f0000000340)=0xaf48, 0x4) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PPPIOCATTCHAN(r8, 0x40047438, &(0x7f0000000100)=0x1) r9 = syz_open_dev$media(&(0x7f00000006c0), 0x4, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r9, 0x80047c05, 0x0) pselect6(0x900, 0x0, 0x0, &(0x7f0000000240)={0x1f}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) ioctl$PPPIOCCONNECT(r8, 0x4004743a, &(0x7f0000000380)) socket$nl_route(0x10, 0x3, 0x0) 0s ago: executing program 2 (id=1857): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, 0x0, 0x50) ioctl$SNDCTL_SYNTH_ID(r0, 0xc08c5114, &(0x7f00000003c0)={"637bf629b5896eeb77e137c6e7f24b7891d6f012acc9fe23b2a34566bb56", 0x2, 0x1, 0x0, 0x101, 0x81, 0x5, 0x1, 0x6, [0x5, 0x4, 0x1, 0x401, 0x3, 0x2ab9, 0x4e2edc8b, 0x80000001, 0x8, 0x7, 0x3, 0x4, 0x7ef, 0xc, 0xffff0000, 0x2, 0x6, 0x7, 0x6]}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) syz_io_uring_setup(0x48, &(0x7f0000000300)={0x0, 0xf20f, 0x40, 0x2, 0x1b}, &(0x7f0000000100), &(0x7f00000000c0), &(0x7f0000000000)) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_route(0x10, 0x3, 0x0) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) socket$kcm(0xa, 0x1, 0x106) (async) r4 = socket$kcm(0xa, 0x1, 0x106) sendmsg$kcm(r4, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x20000011) sendmsg$kcm(r4, &(0x7f0000000780)={&(0x7f0000000000)=@in6={0xa, 0xfffe, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0x2}, 0x80, 0x0}, 0xe07e872420dfefca) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000003580)=ANY=[@ANYRES64=r1], 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8010) (async) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000003580)=ANY=[@ANYRES64=r1], 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8010) socket$nl_rdma(0x10, 0x3, 0x14) (async) r5 = socket$nl_rdma(0x10, 0x3, 0x14) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000580)={@map=r0, 0x36, 0x0, 0x1, &(0x7f00000001c0)=[0x0], 0x1, 0x0, &(0x7f0000000480)=[0x0], &(0x7f0000000500)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000540)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000005c0)={@fallback=r3, r0, 0x36, 0x0, 0x0, @void, @value=r0, @void, @void, r6}, 0x20) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="38000000031401002cbd7000fcdbdf250900020073797a32000000000800410073697700140033006c6f"], 0x38}, 0x1, 0x0, 0x0, 0x8040044}, 0x810) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="38000000031401002cbd7000fcdbdf250900020073797a32000000000800410073697700140033006c6f"], 0x38}, 0x1, 0x0, 0x0, 0x8040044}, 0x810) sendmsg$RDMA_NLDEV_CMD_DELLINK(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000015c0)=ANY=[@ANYBLOB="18000000041401002dbd7000fedbdf250800010000000000ba30b28e994c1a08786eb8", @ANYRESOCT], 0x18}, 0x1, 0x0, 0x0, 0x671ec167a4b72164}, 0x0) (async) sendmsg$RDMA_NLDEV_CMD_DELLINK(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000015c0)=ANY=[@ANYBLOB="18000000041401002dbd7000fedbdf250800010000000000ba30b28e994c1a08786eb8", @ANYRESOCT], 0x18}, 0x1, 0x0, 0x0, 0x671ec167a4b72164}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0xd, &(0x7f0000000080), 0x24) (async) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0xd, &(0x7f0000000080), 0x24) close(0xffffffffffffffff) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x20}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0xa}]}], {0x14}}, 0x64}}, 0x0) (async) sendmsg$NFT_BATCH(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x20}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0xa}]}], {0x14}}, 0x64}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0xfffffffffffffd19, &(0x7f00000002c0)={&(0x7f00000000c0)=@newtaction={0x60, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x4c, 0x1, [@m_ctinfo={0x48, 0x1, 0x0, 0x0, {{0xb}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CTINFO_ACT={0xd, 0x3, {0x0, 0x0, 0x4}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x60}}, 0x0) kernel console output (not intermixed with test programs): 6-1: config 0 has no interface number 0 [ 559.328019][ T7841] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 559.330628][ T5895] usb usb40-port1: attempt power cycle [ 559.332410][ T7841] usb 6-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 559.339263][ T7841] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 559.346180][ T7841] usb 6-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 559.351103][ T7841] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 559.361607][ T7841] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 559.369402][ T7841] usb 6-1: config 0 descriptor?? [ 559.374270][ T7841] ldusb 6-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 559.420791][ T9] usb 8-1: too many configurations: 9, using maximum allowed: 8 [ 559.425029][ T9] usb 8-1: config index 0 descriptor too short (expected 12315, got 27) [ 559.427757][ T9] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 559.431267][ T9] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 559.434953][ T9] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 559.438751][ T9] usb 8-1: config index 1 descriptor too short (expected 12315, got 27) [ 559.442069][ T9] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 559.445194][ T9] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 559.448586][ T9] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 559.454123][ T9] usb 8-1: config index 2 descriptor too short (expected 12315, got 27) [ 559.459655][ T9] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 559.462750][ T10] usb 7-1: new high-speed USB device number 25 using dummy_hcd [ 559.469983][ T9] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 559.473963][ T9] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 559.481742][ T9] usb 8-1: config index 3 descriptor too short (expected 12315, got 27) [ 559.484804][ T9] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 559.489623][ T9] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 559.497993][ T9] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 559.502116][ T9] usb 8-1: config index 4 descriptor too short (expected 12315, got 27) [ 559.509914][ T9] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 559.513272][ T9] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 559.518622][ T9] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 559.529346][ T9] usb 8-1: config index 5 descriptor too short (expected 12315, got 27) [ 559.532567][ T9] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 559.535965][ T9] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 559.543585][ T9] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 559.547826][ T9] usb 8-1: config index 6 descriptor too short (expected 12315, got 27) [ 559.551127][ T9] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 559.555801][ T9] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 559.558958][ T9] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 559.563135][ T9] usb 8-1: config index 7 descriptor too short (expected 12315, got 27) [ 559.566066][ T9] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 559.569008][ T9] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 559.573119][ T9] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 559.575934][T11974] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 559.579910][T11974] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 559.588059][ T9] usb 8-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 559.591157][ T9] usb 8-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 559.594113][ T9] usb 8-1: Product: syz [ 559.595611][ T9] usb 8-1: Manufacturer: syz [ 559.597235][ T9] usb 8-1: SerialNumber: syz [ 559.623409][ T10] usb 7-1: too many configurations: 9, using maximum allowed: 8 [ 559.628161][ T10] usb 7-1: config index 0 descriptor too short (expected 12315, got 27) [ 559.631242][ T10] usb 7-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 559.634333][ T10] usb 7-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 559.637877][ T10] usb 7-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 559.644345][ T10] usb 7-1: config index 1 descriptor too short (expected 12315, got 27) [ 559.647076][ T6245] usb 6-1: USB disconnect, device number 29 [ 559.647126][ C2] ldusb 6-1:0.55: usb_submit_urb failed (-19) [ 559.649680][ T10] usb 7-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 559.654886][ T10] usb 7-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 559.659939][ T10] usb 7-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 559.665348][ T10] usb 7-1: config index 2 descriptor too short (expected 12315, got 27) [ 559.668684][ T10] usb 7-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 559.670029][T11974] ldusb: No device or device unplugged -19 [ 559.671800][ T10] usb 7-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 559.674228][ T6245] ldusb 6-1:0.55: LD USB Device #0 now disconnected [ 559.677458][ T10] usb 7-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 559.686231][ T10] usb 7-1: config index 3 descriptor too short (expected 12315, got 27) [ 559.689156][ T10] usb 7-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 559.692461][ T10] usb 7-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 559.696294][ T10] usb 7-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 559.702382][ T10] usb 7-1: config index 4 descriptor too short (expected 12315, got 27) [ 559.705230][ T10] usb 7-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 559.708577][ T10] usb 7-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 559.712483][ T10] usb 7-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 559.718674][ T10] usb 7-1: config index 5 descriptor too short (expected 12315, got 27) [ 559.721920][ T10] usb 7-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 559.725308][ T10] usb 7-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 559.729192][ T10] usb 7-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 559.735398][ T10] usb 7-1: config index 6 descriptor too short (expected 12315, got 27) [ 559.738551][ T10] usb 7-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 559.741957][ T10] usb 7-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 559.747506][ T10] usb 7-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 559.753119][ T10] usb 7-1: config index 7 descriptor too short (expected 12315, got 27) [ 559.756219][ T10] usb 7-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 559.759234][ T10] usb 7-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 559.763648][ T10] usb 7-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 559.772678][ T10] usb 7-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 559.775865][ T10] usb 7-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 559.778713][ T10] usb 7-1: Product: syz [ 559.780267][ T10] usb 7-1: Manufacturer: syz [ 559.781820][ T10] usb 7-1: SerialNumber: syz [ 559.815613][ T9] usb 8-1: USB disconnect, device number 15 [ 559.911018][ T5895] usb usb40-port1: unable to enumerate USB device [ 560.031589][ T10] usb 7-1: USB disconnect, device number 25 [ 560.077500][T12003] tmpfs: Bad value for 'mpol' [ 560.300910][ T5895] libceph: connect (1)[c::]:6789 error -101 [ 560.312155][ T5895] libceph: mon0 (1)[c::]:6789 connect error [ 560.359987][T12005] ceph: No mds server is up or the cluster is laggy [ 560.646157][T12017] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 560.663142][T12015] fuse: Invalid rootmode [ 561.274058][T12025] pim6reg: entered allmulticast mode [ 561.304691][T12025] team0: entered allmulticast mode [ 561.306556][T12025] team_slave_1: entered allmulticast mode [ 561.316552][T12025] team0: left allmulticast mode [ 561.318348][T12025] team_slave_1: left allmulticast mode [ 561.320675][T12025] pim6reg: left allmulticast mode [ 561.610332][ T58] usb 44-1: device descriptor read/8, error -110 [ 561.621730][T12034] hid-generic 0003:0627:0001.0001: pid 12034 passed too large report [ 562.147345][T12041] wg2 speed is unknown, defaulting to 1000 [ 562.963643][ T5895] usb 8-1: new high-speed USB device number 16 using dummy_hcd [ 562.966164][ T58] usb usb44-port1: attempt power cycle [ 563.110274][ T5895] usb 8-1: too many configurations: 9, using maximum allowed: 8 [ 563.114307][ T5895] usb 8-1: config index 0 descriptor too short (expected 12315, got 27) [ 563.119375][ T5895] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 563.123228][ T5895] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 563.127595][ T5895] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 563.146051][ T5895] usb 8-1: config index 1 descriptor too short (expected 12315, got 27) [ 563.149504][ T5895] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 563.152852][ T5895] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 563.248598][ T5895] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 563.256993][ T5895] usb 8-1: config index 2 descriptor too short (expected 12315, got 27) [ 563.260162][ T5895] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 563.263349][ T5895] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 563.266592][ T5895] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 563.270381][ T5895] usb 8-1: config index 3 descriptor too short (expected 12315, got 27) [ 563.270395][ T5895] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 563.270406][ T5895] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 563.270416][ T5895] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 563.271232][ T5895] usb 8-1: config index 4 descriptor too short (expected 12315, got 27) [ 563.271247][ T5895] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 563.271259][ T5895] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 563.271269][ T5895] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 563.272095][ T5895] usb 8-1: config index 5 descriptor too short (expected 12315, got 27) [ 563.272110][ T5895] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 563.272121][ T5895] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 563.272132][ T5895] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 563.272968][ T5895] usb 8-1: config index 6 descriptor too short (expected 12315, got 27) [ 563.272982][ T5895] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 563.272994][ T5895] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 563.273005][ T5895] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 563.273789][ T5895] usb 8-1: config index 7 descriptor too short (expected 12315, got 27) [ 563.273803][ T5895] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 563.273814][ T5895] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 563.273825][ T5895] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 563.275461][ T5895] usb 8-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 563.275476][ T5895] usb 8-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 563.275493][ T5895] usb 8-1: Product: syz [ 563.275502][ T5895] usb 8-1: Manufacturer: syz [ 563.275510][ T5895] usb 8-1: SerialNumber: syz [ 563.375047][T12051] Bluetooth: MGMT ver 1.23 [ 563.476985][T12054] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 563.532681][ T5895] usb 8-1: USB disconnect, device number 16 [ 563.538240][ T58] usb usb44-port1: unable to enumerate USB device [ 563.633493][T12059] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1585'. [ 563.913577][T12062] syzkaller0: entered promiscuous mode [ 563.916308][T12062] syzkaller0: entered allmulticast mode [ 564.140838][T12070] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1592'. [ 564.187966][T12070] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 564.382380][T12078] fuse: Bad value for 'fd' [ 564.385864][T12078] trusted_key: encrypted_key: insufficient parameters specified [ 564.393653][T12078] trusted_key: encrypted_key: insufficient parameters specified [ 564.439689][ T5895] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 564.591443][ T5895] usb 5-1: device descriptor read/64, error -71 [ 564.829762][ T5895] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 564.879664][ T9] usb 7-1: new high-speed USB device number 26 using dummy_hcd [ 564.959758][ T5895] usb 5-1: device descriptor read/64, error -71 [ 565.039837][ T9] usb 7-1: Using ep0 maxpacket: 32 [ 565.045999][ T9] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 565.061242][ T9] usb 7-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 565.064905][ T9] usb 7-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 565.071078][ T5895] usb usb5-port1: attempt power cycle [ 565.075763][ T9] usb 7-1: Product: syz [ 565.077382][ T9] usb 7-1: Manufacturer: syz [ 565.082462][ T9] usb 7-1: SerialNumber: syz [ 565.099107][ T9] usb 7-1: config 0 descriptor?? [ 565.105468][T12083] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 565.439783][ T5895] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 565.449117][ T24] usb 7-1: USB disconnect, device number 26 [ 565.460854][ T5895] usb 5-1: device descriptor read/8, error -71 [ 565.709761][ T29] usb 8-1: new high-speed USB device number 17 using dummy_hcd [ 565.712430][ T5895] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 565.730305][ T5895] usb 5-1: device descriptor read/8, error -71 [ 565.850323][ T5895] usb usb5-port1: unable to enumerate USB device [ 565.880451][ T29] usb 8-1: too many configurations: 9, using maximum allowed: 8 [ 565.883789][ T29] usb 8-1: config index 0 descriptor too short (expected 12315, got 27) [ 565.886388][ T29] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 565.889015][ T29] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 565.892172][ T29] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 565.895716][ T29] usb 8-1: config index 1 descriptor too short (expected 12315, got 27) [ 565.898302][ T29] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 565.901918][ T29] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 565.905085][ T29] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 565.909130][ T29] usb 8-1: config index 2 descriptor too short (expected 12315, got 27) [ 565.912116][ T29] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 565.914667][ T29] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 565.917555][ T29] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 565.921256][ T29] usb 8-1: config index 3 descriptor too short (expected 12315, got 27) [ 565.923970][ T29] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 565.926993][ T29] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 565.930343][ T29] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 565.933829][ T29] usb 8-1: config index 4 descriptor too short (expected 12315, got 27) [ 565.936428][ T29] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 565.939068][ T29] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 565.942835][ T29] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 565.947762][ T29] usb 8-1: config index 5 descriptor too short (expected 12315, got 27) [ 565.951082][ T29] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 565.954021][ T29] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 565.958549][ T29] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 565.964458][ T29] usb 8-1: config index 6 descriptor too short (expected 12315, got 27) [ 565.968055][ T29] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 565.972257][ T29] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 565.976528][ T29] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 565.981539][ T29] usb 8-1: config index 7 descriptor too short (expected 12315, got 27) [ 565.985405][ T29] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 565.989007][ T29] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 565.993053][ T29] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 565.999244][ T29] usb 8-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 566.003021][ T29] usb 8-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 566.006436][ T29] usb 8-1: Product: syz [ 566.008265][ T29] usb 8-1: Manufacturer: syz [ 566.010608][ T29] usb 8-1: SerialNumber: syz [ 566.065158][T12109] syzkaller0: entered promiscuous mode [ 566.067233][T12109] syzkaller0: entered allmulticast mode [ 566.234108][ T29] usb 8-1: USB disconnect, device number 17 [ 566.528685][T12114] ceph: No mds server is up or the cluster is laggy [ 566.747582][T12119] pim6reg: entered allmulticast mode [ 566.788306][ T5895] libceph: connect (1)[c::]:6789 error -101 [ 566.790849][ T5895] libceph: mon0 (1)[c::]:6789 connect error [ 567.073427][T12113] team0: entered allmulticast mode [ 567.075179][T12113] team_slave_1: entered allmulticast mode [ 567.081489][T12113] team0: left allmulticast mode [ 567.083243][T12113] team_slave_1: left allmulticast mode [ 567.085384][T12113] pim6reg: left allmulticast mode [ 567.205189][T12132] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 567.630901][T12138] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1610'. [ 567.693990][ T1433] ieee802154 phy0 wpan0: encryption failed: -22 [ 567.697308][ T1433] ieee802154 phy1 wpan1: encryption failed: -22 [ 568.056751][T12140] comedi comedi3: pcl818: I/O base address or length out of range [ 568.779091][T12153] syzkaller0: entered promiscuous mode [ 568.781754][T12153] syzkaller0: entered allmulticast mode [ 569.119757][ T9] usb 8-1: new high-speed USB device number 18 using dummy_hcd [ 569.291135][ T9] usb 8-1: too many configurations: 9, using maximum allowed: 8 [ 569.301822][ T9] usb 8-1: config index 0 descriptor too short (expected 12315, got 27) [ 569.307357][ T9] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 569.318666][ T9] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 569.327861][ T9] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 569.334732][ T9] usb 8-1: config index 1 descriptor too short (expected 12315, got 27) [ 569.339077][ T9] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 569.342451][ T9] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 569.346077][ T9] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 569.355434][ T9] usb 8-1: config index 2 descriptor too short (expected 12315, got 27) [ 569.360624][ T9] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 569.365569][ T9] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 569.370357][ T9] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 569.377114][ T9] usb 8-1: config index 3 descriptor too short (expected 12315, got 27) [ 569.382366][ T9] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 569.386904][ T9] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 569.391127][ T9] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 569.397760][ T9] usb 8-1: config index 4 descriptor too short (expected 12315, got 27) [ 569.401481][ T9] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 569.405079][ T9] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 569.408651][ T9] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 569.412995][ T9] usb 8-1: config index 5 descriptor too short (expected 12315, got 27) [ 569.415999][ T9] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 569.419218][ T9] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 569.423554][ T9] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 569.427353][ T9] usb 8-1: config index 6 descriptor too short (expected 12315, got 27) [ 569.430313][ T9] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 569.433338][ T9] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 569.436879][ T9] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 569.441572][ T9] usb 8-1: config index 7 descriptor too short (expected 12315, got 27) [ 569.444770][ T9] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 569.447725][ T9] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 569.451161][ T9] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 569.457760][ T9] usb 8-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 569.461736][ T9] usb 8-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 569.464841][ T9] usb 8-1: Product: syz [ 569.466236][ T9] usb 8-1: Manufacturer: syz [ 569.467801][ T9] usb 8-1: SerialNumber: syz [ 569.595716][T12177] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 569.701739][ T9] usb 8-1: USB disconnect, device number 18 [ 569.817843][T12186] netlink: 'syz.2.1624': attribute type 1 has an invalid length. [ 569.841956][T12186] 8021q: adding VLAN 0 to HW filter on device bond2 [ 569.875682][T12186] bond2: (slave ip6erspan0): making interface the new active one [ 569.886739][T12186] bond2: (slave ip6erspan0): Enslaving as an active interface with an up link [ 569.898489][T12186] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1624'. [ 570.044702][T12190] syzkaller0: entered promiscuous mode [ 570.048089][T12190] syzkaller0: entered allmulticast mode [ 570.428654][T12194] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1627'. [ 571.425169][T12196] ieee802154 phy0 wpan0: encryption failed: -22 [ 571.428058][T12196] ieee802154 phy0 wpan0: encryption failed: -22 [ 572.907430][T12207] FAULT_INJECTION: forcing a failure. [ 572.907430][T12207] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 572.912426][T12207] CPU: 3 UID: 0 PID: 12207 Comm: syz.0.1631 Tainted: G L syzkaller #0 PREEMPT(full) [ 572.912447][T12207] Tainted: [L]=SOFTLOCKUP [ 572.912451][T12207] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 572.912458][T12207] Call Trace: [ 572.912463][T12207] [ 572.912468][T12207] dump_stack_lvl+0x100/0x190 [ 572.912485][T12207] should_fail_ex.cold+0x5/0xa [ 572.912500][T12207] _copy_from_iter+0x1f4/0x1690 [ 572.912515][T12207] ? __pfx__copy_from_iter+0x10/0x10 [ 572.912528][T12207] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 572.912547][T12207] copy_page_from_iter+0x238/0x300 [ 572.912560][T12207] tun_build_skb.constprop.0+0x2ea/0x18f0 [ 572.912584][T12207] ? __pfx_tun_build_skb.constprop.0+0x10/0x10 [ 572.912602][T12207] ? unwind_get_return_address+0x59/0xa0 [ 572.912618][T12207] ? arch_stack_walk+0xa6/0xf0 [ 572.912636][T12207] ? __lock_acquire+0x4a5/0x2630 [ 572.912657][T12207] tun_get_user+0x16d6/0x3c20 [ 572.912681][T12207] ? __pfx_tun_get_user+0x10/0x10 [ 572.912700][T12207] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 572.912720][T12207] ? find_held_lock+0x2b/0x80 [ 572.912734][T12207] ? tun_get+0x191/0x370 [ 572.912750][T12207] ? tun_get+0x191/0x370 [ 572.912770][T12207] tun_chr_write_iter+0xdc/0x200 [ 572.912782][T12207] vfs_write+0x6ac/0x1070 [ 572.912795][T12207] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 572.912807][T12207] ? __pfx_vfs_write+0x10/0x10 [ 572.912819][T12207] ? find_held_lock+0x2b/0x80 [ 572.912841][T12207] ksys_write+0x12a/0x250 [ 572.912854][T12207] ? __pfx_ksys_write+0x10/0x10 [ 572.912868][T12207] ? rcu_is_watching+0x12/0xc0 [ 572.912883][T12207] do_int80_emulation+0x141/0x700 [ 572.912897][T12207] asm_int80_emulation+0x1a/0x20 [ 572.912908][T12207] RIP: 0023:0xf71961ab [ 572.912918][T12207] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 572.912929][T12207] RSP: 002b:00000000f544d44c EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 572.912941][T12207] RAX: ffffffffffffffda RBX: 00000000000000c8 RCX: 0000000080000280 [ 572.912948][T12207] RDX: 0000000000000036 RSI: 0000000000000000 RDI: 0000000000000000 [ 572.912954][T12207] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 572.912960][T12207] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 572.912966][T12207] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 572.912979][T12207] [ 573.123916][T12218] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1629'. [ 573.145890][T12219] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 573.457451][T12231] tmpfs: Bad value for 'mpol' [ 573.639860][ T5895] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 573.968873][ T6245] libceph: connect (1)[c::]:6789 error -101 [ 573.971316][ T6245] libceph: mon0 (1)[c::]:6789 connect error [ 574.016356][T12232] ceph: No mds server is up or the cluster is laggy [ 574.040289][ T5895] usb 5-1: too many configurations: 9, using maximum allowed: 8 [ 574.044447][ T5895] usb 5-1: config index 0 descriptor too short (expected 12315, got 27) [ 574.047801][ T5895] usb 5-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 574.051947][ T5895] usb 5-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 574.056436][ T5895] usb 5-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 574.061952][ T5895] usb 5-1: config index 1 descriptor too short (expected 12315, got 27) [ 574.064923][ T5895] usb 5-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 574.068057][ T5895] usb 5-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 574.072258][ T5895] usb 5-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 574.076974][ T5895] usb 5-1: config index 2 descriptor too short (expected 12315, got 27) [ 574.080347][ T5895] usb 5-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 574.083941][ T5895] usb 5-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 574.088060][ T5895] usb 5-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 574.093000][ T5895] usb 5-1: config index 3 descriptor too short (expected 12315, got 27) [ 574.096405][ T5895] usb 5-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 574.099970][ T5895] usb 5-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 574.103836][ T5895] usb 5-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 574.107707][ T5895] usb 5-1: config index 4 descriptor too short (expected 12315, got 27) [ 574.110929][ T5895] usb 5-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 574.114142][ T5895] usb 5-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 574.118437][ T5895] usb 5-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 574.122809][ T5895] usb 5-1: config index 5 descriptor too short (expected 12315, got 27) [ 574.125681][ T5895] usb 5-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 574.128568][ T5895] usb 5-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 574.132294][ T5895] usb 5-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 574.136587][ T5895] usb 5-1: config index 6 descriptor too short (expected 12315, got 27) [ 574.140547][ T5895] usb 5-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 574.143558][ T5895] usb 5-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 574.146810][ T5895] usb 5-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 574.151010][ T5895] usb 5-1: config index 7 descriptor too short (expected 12315, got 27) [ 574.154178][ T5895] usb 5-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 574.157451][ T5895] usb 5-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 574.161431][ T5895] usb 5-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 574.166666][ T5895] usb 5-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 574.170606][ T5895] usb 5-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 574.173571][ T5895] usb 5-1: Product: syz [ 574.175039][ T5895] usb 5-1: Manufacturer: syz [ 574.176685][ T5895] usb 5-1: SerialNumber: syz [ 574.545789][ T5895] usb 5-1: USB disconnect, device number 25 [ 574.616109][T12246] syzkaller0: entered promiscuous mode [ 574.618596][T12246] syzkaller0: entered allmulticast mode [ 574.719835][ T6245] usb 8-1: new high-speed USB device number 19 using dummy_hcd [ 574.883862][ T6245] usb 8-1: Using ep0 maxpacket: 32 [ 574.893197][ T6245] usb 8-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 574.896375][ T6245] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 574.900070][ T6245] usb 8-1: Product: syz [ 574.901874][ T6245] usb 8-1: Manufacturer: syz [ 574.903773][ T6245] usb 8-1: SerialNumber: syz [ 574.907512][ T6245] usb 8-1: config 0 descriptor?? [ 574.914572][ T6245] dvb-usb: found a 'Pinnacle 450e DVB-S USB2.0' in warm state. [ 574.917634][ T6245] dvb-usb: bulk message failed: -22 (4/0) [ 574.920831][ T6245] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 574.924884][ T6245] dvb-usb: bulk message failed: -22 (5/0) [ 574.927435][ T6245] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 574.934715][ T6245] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 574.938644][ T6245] dvbdev: DVB: registering new adapter (Pinnacle 450e DVB-S USB2.0) [ 574.941539][ T6245] usb 8-1: media controller created [ 574.949083][ T6245] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 574.969069][ T6245] usb 8-1: selecting invalid altsetting 3 [ 574.972501][ T6245] ttusb2: set interface to alts=3 failed [ 575.016470][ T6245] DVB: Unable to find symbol tda10086_attach() [ 575.018840][ T6245] dvb-usb: no frontend was attached by 'Pinnacle 450e DVB-S USB2.0' [ 575.023264][ T6245] dvb-usb: bulk message failed: -22 (4/0) [ 575.046628][ T6245] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 575.054676][ T6245] dvb-usb: bulk message failed: -22 (5/0) [ 575.056774][ T6245] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 575.060868][ T6245] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully initialized and connected. [ 575.168206][T12243] dvb-usb: bulk message failed: -22 (7/0) [ 575.196376][T12243] ttusb2: there might have been an error during control message transfer. (rlen = 56, was 0) [ 575.207208][ T5762] Bluetooth: hci0: unexpected event for opcode 0x0419 [ 575.214281][ T40] kauditd_printk_skb: 2587 callbacks suppressed [ 575.214295][ T40] audit: type=1326 audit(1779340488.173:2676): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12242 comm="syz.3.1639" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aef7c code=0x7ffc0000 [ 575.215471][T12243] ttusb2: i2c transfer failed. [ 575.216583][ T40] audit: type=1326 audit(1779340488.173:2677): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12242 comm="syz.3.1639" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aef7c code=0x7ffc0000 [ 575.216620][ T40] audit: type=1326 audit(1779340488.173:2678): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12242 comm="syz.3.1639" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aef7c code=0x7ffc0000 [ 575.216645][ T40] audit: type=1326 audit(1779340488.173:2679): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12242 comm="syz.3.1639" exe="/syz-executor" sig=0 arch=40000003 syscall=141 compat=1 ip=0xf70aef7c code=0x7ffc0000 [ 575.216669][ T40] audit: type=1326 audit(1779340488.173:2680): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12242 comm="syz.3.1639" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aef7c code=0x7ffc0000 [ 575.216694][ T40] audit: type=1326 audit(1779340488.173:2681): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12242 comm="syz.3.1639" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aef7c code=0x7ffc0000 [ 575.216717][ T40] audit: type=1326 audit(1779340488.173:2682): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12242 comm="syz.3.1639" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aef7c code=0x7ffc0000 [ 575.216741][ T40] audit: type=1326 audit(1779340488.173:2683): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12242 comm="syz.3.1639" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aef7c code=0x7ffc0000 [ 575.216764][ T40] audit: type=1326 audit(1779340488.173:2684): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12242 comm="syz.3.1639" exe="/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf71e61ab code=0x7ffc0000 [ 575.216787][ T40] audit: type=1326 audit(1779340488.173:2685): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12242 comm="syz.3.1639" exe="/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf71e61ab code=0x7ffc0000 [ 575.307905][ T10] usb 8-1: USB disconnect, device number 19 [ 575.320449][ T10] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully deinitialized and disconnected. [ 577.468393][T12267] wg2 speed is unknown, defaulting to 1000 [ 577.560473][T12270] pim6reg: entered allmulticast mode [ 577.563575][T12266] team0: entered allmulticast mode [ 577.565491][T12266] team_slave_0: entered allmulticast mode [ 577.567813][T12266] team_slave_1: entered allmulticast mode [ 577.570521][T12268] team0: left allmulticast mode [ 577.572190][T12268] team_slave_0: left allmulticast mode [ 577.574261][T12268] team_slave_1: left allmulticast mode [ 577.576530][T12268] pim6reg: left allmulticast mode [ 577.657399][T12279] netlink: 'syz.0.1648': attribute type 21 has an invalid length. [ 577.662216][T12279] netlink: 128 bytes leftover after parsing attributes in process `syz.0.1648'. [ 577.666518][T12279] netlink: 'syz.0.1648': attribute type 5 has an invalid length. [ 577.670092][T12279] netlink: 'syz.0.1648': attribute type 6 has an invalid length. [ 577.673865][T12279] netlink: 3 bytes leftover after parsing attributes in process `syz.0.1648'. [ 577.680598][T12279] IPVS: set_ctl: invalid protocol: 137 172.20.20.170:0 [ 578.137403][T12283] pim6reg: entered allmulticast mode [ 578.149990][T12280] team0: entered allmulticast mode [ 578.152356][T12280] team_slave_1: entered allmulticast mode [ 578.187103][T12280] team0: left allmulticast mode [ 578.189138][T12280] team_slave_1: left allmulticast mode [ 578.191574][T12280] pim6reg: left allmulticast mode [ 578.962122][T12294] hub 1-0:1.0: USB hub found [ 578.964624][T12294] hub 1-0:1.0: 2 ports detected [ 578.972078][T12300] tmpfs: Bad value for 'mpol' [ 579.266898][ T6245] libceph: connect (1)[c::]:6789 error -22 [ 579.268710][T12305] syzkaller0: entered promiscuous mode [ 579.270380][ T6245] libceph: mon0 (1)[c::]:6789 connect error [ 579.286640][T12305] syzkaller0: entered allmulticast mode [ 579.315925][T12304] ceph: No mds server is up or the cluster is laggy [ 579.397749][T12314] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 579.400078][T12314] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 579.426654][T12314] vhci_hcd vhci_hcd.0: Device attached [ 579.699783][ T29] usb 40-1: SetAddress Request (42) to port 0 [ 579.713574][ T29] usb 40-1: new SuperSpeed USB device number 42 using vhci_hcd [ 579.772262][T12314] rdma_rxe: rxe_newlink: failed to add wg2 [ 580.623230][T12315] vhci_hcd: connection reset by peer [ 580.625242][ T1177] vhci_hcd vhci_hcd.1: stop threads [ 580.627170][ T1177] vhci_hcd vhci_hcd.1: release socket [ 580.629341][ T1177] vhci_hcd vhci_hcd.1: disconnect device [ 580.908184][T12329] tmpfs: Bad value for 'mpol' [ 581.257063][T12338] ceph: No mds server is up or the cluster is laggy [ 581.264145][ T58] libceph: connect (1)[c::]:6789 error -22 [ 581.271427][ T58] libceph: mon0 (1)[c::]:6789 connect error [ 581.677359][ T24] usb 7-1: new high-speed USB device number 27 using dummy_hcd [ 581.844018][ T24] usb 7-1: too many configurations: 9, using maximum allowed: 8 [ 581.854767][ T24] usb 7-1: config index 0 descriptor too short (expected 12315, got 27) [ 581.866822][ T24] usb 7-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 581.879733][ T24] usb 7-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 581.888576][ T24] usb 7-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 581.898126][ T24] usb 7-1: config index 1 descriptor too short (expected 12315, got 27) [ 581.902006][ T24] usb 7-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 581.905592][ T24] usb 7-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 581.908873][ T24] usb 7-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 581.914095][ T24] usb 7-1: config index 2 descriptor too short (expected 12315, got 27) [ 581.917880][ T24] usb 7-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 581.922831][ T24] usb 7-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 581.926829][ T24] usb 7-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 581.931976][ T24] usb 7-1: config index 3 descriptor too short (expected 12315, got 27) [ 581.935920][ T24] usb 7-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 581.939347][ T24] usb 7-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 581.943572][ T24] usb 7-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 581.959393][ T24] usb 7-1: config index 4 descriptor too short (expected 12315, got 27) [ 581.962951][ T24] usb 7-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 581.966508][ T24] usb 7-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 581.970924][ T24] usb 7-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 581.974727][ T24] usb 7-1: config index 5 descriptor too short (expected 12315, got 27) [ 581.977460][ T24] usb 7-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 581.980943][ T24] usb 7-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 581.984793][ T24] usb 7-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 581.988628][ T24] usb 7-1: config index 6 descriptor too short (expected 12315, got 27) [ 581.991474][ T24] usb 7-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 581.995022][ T24] usb 7-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 581.999098][ T24] usb 7-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 582.003589][ T24] usb 7-1: config index 7 descriptor too short (expected 12315, got 27) [ 582.007007][ T24] usb 7-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 582.010804][ T24] usb 7-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 582.015883][ T24] usb 7-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 582.062166][ T24] usb 7-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 582.065980][ T24] usb 7-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 582.069859][ T24] usb 7-1: Product: syz [ 582.071867][ T24] usb 7-1: Manufacturer: syz [ 582.073962][ T24] usb 7-1: SerialNumber: syz [ 582.908600][ T24] usb 7-1: USB disconnect, device number 27 [ 583.061149][T12366] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1667'. [ 583.271489][ T10] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 583.466437][ T10] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 583.471667][ T10] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 583.476259][ T10] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 583.495313][ T10] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 583.498736][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 583.504897][ T10] usb 6-1: Product: syz [ 583.506457][ T10] usb 6-1: Manufacturer: syz [ 583.509189][ T10] usb 6-1: SerialNumber: syz [ 583.621235][T12375] pim6reg: entered allmulticast mode [ 583.792213][T12376] pim6reg: entered allmulticast mode [ 583.831133][T12375] team0: entered allmulticast mode [ 583.834676][T12375] team_slave_0: entered allmulticast mode [ 583.837795][T12375] team_slave_1: entered allmulticast mode [ 583.854586][T12375] team0: left allmulticast mode [ 583.857679][T12375] team_slave_0: left allmulticast mode [ 583.860379][T12375] team_slave_1: left allmulticast mode [ 583.863513][T12375] pim6reg: left allmulticast mode [ 583.964157][ T10] usblp 6-1:1.0: usblp0: USB Unidirectional printer dev 30 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 584.019266][T12374] team0: entered allmulticast mode [ 584.021262][T12374] team_slave_0: entered allmulticast mode [ 584.023692][T12374] team_slave_1: entered allmulticast mode [ 584.028209][T12374] team0: left allmulticast mode [ 584.030490][T12374] team_slave_0: left allmulticast mode [ 584.032818][T12374] team_slave_1: left allmulticast mode [ 584.035225][T12374] pim6reg: left allmulticast mode [ 584.935694][ T29] usb 40-1: device descriptor read/8, error -110 [ 585.812660][ T29] usb usb40-port1: attempt power cycle [ 585.842161][T12388] tmpfs: Bad value for 'mpol' [ 586.116999][ T58] libceph: connect (1)[c::]:6789 error -101 [ 586.148056][T12392] ceph: No mds server is up or the cluster is laggy [ 586.155545][ T58] libceph: mon0 (1)[c::]:6789 connect error [ 586.412227][T12397] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 586.486709][ T29] usb usb40-port1: unable to enumerate USB device [ 587.328357][ T29] usb 6-1: USB disconnect, device number 30 [ 587.629408][T12404] pim6reg: entered allmulticast mode [ 587.706133][T12411] team0: entered allmulticast mode [ 587.708545][T12411] team_slave_0: entered allmulticast mode [ 587.711348][T12411] team_slave_1: entered allmulticast mode [ 587.719934][T12411] team0: left allmulticast mode [ 587.722211][T12411] team_slave_0: left allmulticast mode [ 587.724604][T12411] team_slave_1: left allmulticast mode [ 587.727433][T12411] pim6reg: left allmulticast mode [ 588.702545][ T29] usblp0: removed [ 589.361032][T12447] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 589.363334][T12447] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 589.378215][T12447] vhci_hcd vhci_hcd.0: Device attached [ 589.808410][T12447] rdma_rxe: rxe_newlink: failed to add wg2 [ 589.815459][ T29] usb 42-1: SetAddress Request (30) to port 0 [ 589.817966][ T29] usb 42-1: new SuperSpeed USB device number 30 using vhci_hcd [ 589.939069][T12448] vhci_hcd: connection reset by peer [ 589.941369][ T13] vhci_hcd vhci_hcd.2: stop threads [ 589.943357][ T13] vhci_hcd vhci_hcd.2: release socket [ 589.945782][ T13] vhci_hcd vhci_hcd.2: disconnect device [ 590.020644][ T24] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 590.174046][ T24] usb 6-1: too many configurations: 9, using maximum allowed: 8 [ 590.178545][ T24] usb 6-1: config index 0 descriptor too short (expected 12315, got 27) [ 590.181916][ T24] usb 6-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 590.185062][ T24] usb 6-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 590.188284][ T24] usb 6-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 590.192285][ T24] usb 6-1: config index 1 descriptor too short (expected 12315, got 27) [ 590.196369][ T24] usb 6-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 590.201714][ T24] usb 6-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 590.206240][ T24] usb 6-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 590.212272][ T24] usb 6-1: config index 2 descriptor too short (expected 12315, got 27) [ 590.215188][ T24] usb 6-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 590.218041][ T24] usb 6-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 590.221367][ T24] usb 6-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 590.237633][ T24] usb 6-1: config index 3 descriptor too short (expected 12315, got 27) [ 590.240918][ T24] usb 6-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 590.244133][ T24] usb 6-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 590.247281][ T24] usb 6-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 590.248756][T12460] tmpfs: Bad value for 'mpol' [ 590.251064][ T24] usb 6-1: config index 4 descriptor too short (expected 12315, got 27) [ 590.255246][ T24] usb 6-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 590.258266][ T24] usb 6-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 590.258281][ T24] usb 6-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 590.259034][ T24] usb 6-1: config index 5 descriptor too short (expected 12315, got 27) [ 590.267707][ T24] usb 6-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 590.270742][ T24] usb 6-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 590.273940][ T24] usb 6-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 590.277704][ T24] usb 6-1: config index 6 descriptor too short (expected 12315, got 27) [ 590.280595][ T24] usb 6-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 590.283510][ T24] usb 6-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 590.286932][ T24] usb 6-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 590.290814][ T24] usb 6-1: config index 7 descriptor too short (expected 12315, got 27) [ 590.293644][ T24] usb 6-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 590.296484][ T24] usb 6-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 590.300106][ T24] usb 6-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 590.304656][ T24] usb 6-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 590.307581][ T24] usb 6-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 590.310535][ T24] usb 6-1: Product: syz [ 590.312363][ T24] usb 6-1: Manufacturer: syz [ 590.314440][ T24] usb 6-1: SerialNumber: syz [ 590.316956][T12461] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1685'. [ 590.469622][ T58] libceph: connect (1)[c::]:6789 error -22 [ 590.472849][ T58] libceph: mon0 (1)[c::]:6789 connect error [ 590.523887][T12464] ceph: No mds server is up or the cluster is laggy [ 590.538066][ T24] usb 6-1: USB disconnect, device number 31 [ 591.019839][ T10] usb 7-1: new high-speed USB device number 28 using dummy_hcd [ 591.157940][T12477] Invalid logical block size (1) [ 591.188755][T12481] tmpfs: Bad value for 'mpol' [ 591.190781][ T10] usb 7-1: Using ep0 maxpacket: 8 [ 591.195702][ T10] usb 7-1: config 0 has an invalid interface number: 55 but max is 0 [ 591.198993][ T10] usb 7-1: config 0 has no interface number 0 [ 591.201786][ T10] usb 7-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 591.205970][ T10] usb 7-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 591.218192][ T10] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 591.226473][ T10] usb 7-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 591.235718][ T10] usb 7-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 591.238700][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 591.249461][ T10] usb 7-1: config 0 descriptor?? [ 591.267040][ T10] ldusb 7-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 591.359385][T12482] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 591.465183][T12471] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 591.469485][T12471] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 591.619649][ T5895] usb 7-1: USB disconnect, device number 28 [ 591.619753][ C0] ldusb 7-1:0.55: usb_submit_urb failed (-19) [ 591.623742][T12487] ceph: No mds server is up or the cluster is laggy [ 591.634546][ T58] libceph: connect (1)[c::]:6789 error -101 [ 591.641025][ T58] libceph: mon0 (1)[c::]:6789 connect error [ 591.914335][ T58] libceph: connect (1)[c::]:6789 error -101 [ 591.917414][ T58] libceph: mon0 (1)[c::]:6789 connect error [ 592.266973][ T5895] ldusb 7-1:0.55: LD USB Device #0 now disconnected [ 592.267967][T12471] ldusb: No device or device unplugged -19 [ 592.425922][T12495] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 592.428151][T12495] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 592.439864][T12495] vhci_hcd vhci_hcd.0: Device attached [ 592.574653][T12495] rdma_rxe: rxe_newlink: failed to add wg2 [ 592.739645][ T58] usb 40-1: SetAddress Request (46) to port 0 [ 592.747168][ T58] usb 40-1: new SuperSpeed USB device number 46 using vhci_hcd [ 592.754351][T12496] vhci_hcd: connection closed [ 592.754719][ T3512] vhci_hcd vhci_hcd.1: stop threads [ 592.758112][ T3512] vhci_hcd vhci_hcd.1: release socket [ 592.760427][ T3512] vhci_hcd vhci_hcd.1: disconnect device [ 592.789643][ T58] usb 40-1: enqueue for inactive port 0 [ 592.859809][ T10] usb 7-1: new high-speed USB device number 29 using dummy_hcd [ 593.020520][ T10] usb 7-1: too many configurations: 9, using maximum allowed: 8 [ 593.024473][ T10] usb 7-1: config index 0 descriptor too short (expected 12315, got 27) [ 593.027532][ T10] usb 7-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 593.030325][ T10] usb 7-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 593.033423][ T10] usb 7-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 593.038007][ T10] usb 7-1: config index 1 descriptor too short (expected 12315, got 27) [ 593.040833][ T10] usb 7-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 593.043533][ T10] usb 7-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 593.046631][ T10] usb 7-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 593.050734][ T10] usb 7-1: config index 2 descriptor too short (expected 12315, got 27) [ 593.053763][ T10] usb 7-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 593.056605][ T10] usb 7-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 593.060942][ T10] usb 7-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 593.065035][ T10] usb 7-1: config index 3 descriptor too short (expected 12315, got 27) [ 593.067823][ T10] usb 7-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 593.071008][ T10] usb 7-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 593.074192][ T10] usb 7-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 593.077929][ T10] usb 7-1: config index 4 descriptor too short (expected 12315, got 27) [ 593.080878][ T10] usb 7-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 593.084000][ T10] usb 7-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 593.087168][ T10] usb 7-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 593.091301][ T10] usb 7-1: config index 5 descriptor too short (expected 12315, got 27) [ 593.094532][ T10] usb 7-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 593.097414][ T10] usb 7-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 593.100555][ T10] usb 7-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 593.104271][ T10] usb 7-1: config index 6 descriptor too short (expected 12315, got 27) [ 593.107412][ T10] usb 7-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 593.110197][ T10] usb 7-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 593.113404][ T10] usb 7-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 593.117117][ T10] usb 7-1: config index 7 descriptor too short (expected 12315, got 27) [ 593.120104][ T10] usb 7-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 593.123035][ T10] usb 7-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 593.126100][ T10] usb 7-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 593.130596][ T10] usb 7-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 593.134187][ T10] usb 7-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 593.137622][ T10] usb 7-1: Product: syz [ 593.139387][ T10] usb 7-1: Manufacturer: syz [ 593.141711][ T10] usb 7-1: SerialNumber: syz [ 593.201083][ T58] usb usb40-port1: attempt power cycle [ 593.431097][ T10] usb 7-1: USB disconnect, device number 29 [ 593.521146][T12504] fuse: Bad value for 'fd' [ 593.525580][T12504] trusted_key: encrypted_key: insufficient parameters specified [ 593.544398][T12504] trusted_key: encrypted_key: insufficient parameters specified [ 593.608572][T12508] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1701'. [ 593.756806][T12510] tmpfs: Bad value for 'mpol' [ 593.800275][ T58] usb usb40-port1: unable to enumerate USB device [ 594.145483][T12514] ceph: No mds server is up or the cluster is laggy [ 594.155821][T12515] fuse: Bad value for 'fd' [ 594.166017][T12515] trusted_key: encrypted_key: insufficient parameters specified [ 594.179495][T12515] trusted_key: encrypted_key: insufficient parameters specified [ 594.900022][ T29] usb 42-1: device descriptor read/8, error -110 [ 595.088926][ T58] libceph: connect (1)[c::]:6789 error -101 [ 595.099438][ T58] libceph: mon0 (1)[c::]:6789 connect error [ 595.311398][ T29] usb usb42-port1: attempt power cycle [ 595.546136][T12533] pim6reg: entered allmulticast mode [ 595.610055][ T7418] usb 7-1: new high-speed USB device number 30 using dummy_hcd [ 595.636534][T12532] team0: entered allmulticast mode [ 595.638346][T12532] team_slave_1: entered allmulticast mode [ 595.648822][T12532] team0: left allmulticast mode [ 595.650587][T12532] team_slave_1: left allmulticast mode [ 595.653237][T12532] pim6reg: left allmulticast mode [ 595.781463][ T7418] usb 7-1: too many configurations: 9, using maximum allowed: 8 [ 595.787173][ T7418] usb 7-1: config index 0 descriptor too short (expected 12315, got 27) [ 595.795435][ T7418] usb 7-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 595.801187][ T7418] usb 7-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 595.808349][ T7418] usb 7-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 595.822836][ T7418] usb 7-1: config index 1 descriptor too short (expected 12315, got 27) [ 595.825639][ T7418] usb 7-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 595.828701][ T7418] usb 7-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 595.832433][ T7418] usb 7-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 595.842189][ T7418] usb 7-1: config index 2 descriptor too short (expected 12315, got 27) [ 595.845058][ T7418] usb 7-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 595.847991][ T7418] usb 7-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 595.851709][ T7418] usb 7-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 595.856120][ T7418] usb 7-1: config index 3 descriptor too short (expected 12315, got 27) [ 595.858844][ T7418] usb 7-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 595.861802][ T7418] usb 7-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 595.865527][ T7418] usb 7-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 595.871115][ T7418] usb 7-1: config index 4 descriptor too short (expected 12315, got 27) [ 595.874388][ T7418] usb 7-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 595.877167][ T7418] usb 7-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 595.880862][ T7418] usb 7-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 595.884625][ T7418] usb 7-1: config index 5 descriptor too short (expected 12315, got 27) [ 595.887763][ T7418] usb 7-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 595.890996][ T7418] usb 7-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 595.894335][ T7418] usb 7-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 595.898146][ T7418] usb 7-1: config index 6 descriptor too short (expected 12315, got 27) [ 595.901543][ T7418] usb 7-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 595.904464][ T7418] usb 7-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 595.907617][ T7418] usb 7-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 595.911932][ T7418] usb 7-1: config index 7 descriptor too short (expected 12315, got 27) [ 595.915073][ T7418] usb 7-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 595.918107][ T7418] usb 7-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 595.921805][ T7418] usb 7-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 595.927764][ T7418] usb 7-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 595.931050][ T7418] usb 7-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 595.933674][ T7418] usb 7-1: Product: syz [ 595.935030][ T7418] usb 7-1: Manufacturer: syz [ 595.936584][ T7418] usb 7-1: SerialNumber: syz [ 595.964027][ T29] usb usb42-port1: unable to enumerate USB device [ 596.170331][ T7418] usb 7-1: USB disconnect, device number 30 [ 596.254395][T12544] tmpfs: Bad value for 'mpol' [ 596.442402][T12550] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 596.445411][T12550] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 596.450217][T12550] vhci_hcd vhci_hcd.0: Device attached [ 596.840336][T12553] ceph: No mds server is up or the cluster is laggy [ 596.841764][ T5895] libceph: connect (1)[c::]:6789 error -101 [ 596.841864][ T5895] libceph: mon0 (1)[c::]:6789 connect error [ 596.889984][ T29] usb 44-1: SetAddress Request (59) to port 0 [ 596.890422][ T29] usb 44-1: new SuperSpeed USB device number 59 using vhci_hcd [ 596.960613][T12550] syz2: rxe_newlink: already configured on wg2 [ 597.074722][T12551] vhci_hcd: connection reset by peer [ 597.147934][ T1177] vhci_hcd vhci_hcd.3: stop threads [ 597.149754][ T1177] vhci_hcd vhci_hcd.3: release socket [ 597.151980][ T1177] vhci_hcd vhci_hcd.3: disconnect device [ 597.709727][ T7418] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 597.869822][ T7418] usb 5-1: Using ep0 maxpacket: 8 [ 597.874260][ T7418] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 597.877776][ T7418] usb 5-1: config 0 has no interface number 0 [ 597.881759][ T7418] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 597.886495][ T7418] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 597.892754][ T7418] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 597.897400][ T7418] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 597.903262][ T7418] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 597.907145][ T7418] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 597.917826][ T7418] usb 5-1: config 0 descriptor?? [ 597.934425][ T7418] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 598.135693][T12567] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 598.139986][T12567] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 598.685914][ T7418] usb 5-1: USB disconnect, device number 26 [ 598.685979][ C3] ldusb 5-1:0.55: usb_submit_urb failed (-19) [ 598.706749][T12567] ldusb: No device or device unplugged -19 [ 598.711963][ T7418] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 599.198272][T12584] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 599.208879][T12584] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 599.333120][T12586] syzkaller0: entered promiscuous mode [ 599.378007][T12586] syzkaller0: entered allmulticast mode [ 599.427952][T12589] random: crng reseeded on system resumption [ 601.362065][T12601] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 601.364245][T12601] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 601.381773][T12601] vhci_hcd vhci_hcd.0: Device attached [ 601.594034][T12601] rdma_rxe: rxe_newlink: failed to add wg2 [ 601.690827][ T5895] usb 38-1: SetAddress Request (30) to port 0 [ 601.694076][ T5895] usb 38-1: new SuperSpeed USB device number 30 using vhci_hcd [ 601.855593][T12602] vhci_hcd: connection reset by peer [ 601.858341][ T1156] vhci_hcd vhci_hcd.0: stop threads [ 601.861751][ T1156] vhci_hcd vhci_hcd.0: release socket [ 601.864604][ T1156] vhci_hcd vhci_hcd.0: disconnect device [ 601.929763][ T29] usb 44-1: device descriptor read/8, error -110 [ 602.333518][ T29] usb usb44-port1: attempt power cycle [ 602.907632][ T29] usb usb44-port1: unable to enumerate USB device [ 603.193771][T12588] pim6reg: entered allmulticast mode [ 603.196125][T12590] team0: entered allmulticast mode [ 603.197940][T12590] team_slave_0: entered allmulticast mode [ 603.200500][T12590] team_slave_1: entered allmulticast mode [ 603.202836][T12591] team0: left allmulticast mode [ 603.204539][T12591] team_slave_0: left allmulticast mode [ 603.206547][T12591] team_slave_1: left allmulticast mode [ 603.208546][T12591] pim6reg: left allmulticast mode [ 603.225207][T12597] batman_adv: batadv0: Adding interface: macsec1 [ 603.227271][T12597] batman_adv: batadv0: The MTU of interface macsec1 is too small (1468) to handle the transport of batman-adv packets. If you experience problems getting traffic through try increasing the MTU to 1500. [ 603.233844][T12597] batman_adv: batadv0: Interface activated: macsec1 [ 603.349902][T12612] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.1727'. [ 603.684291][T12618] fuse: Bad value for 'fd' [ 603.702847][T12618] trusted_key: encrypted_key: insufficient parameters specified [ 603.744858][T12618] trusted_key: encrypted_key: insufficient parameters specified [ 604.090362][T12632] FAULT_INJECTION: forcing a failure. [ 604.090362][T12632] name failslab, interval 1, probability 0, space 0, times 0 [ 604.095469][T12632] CPU: 3 UID: 0 PID: 12632 Comm: syz.0.1732 Tainted: G L syzkaller #0 PREEMPT(full) [ 604.095502][T12632] Tainted: [L]=SOFTLOCKUP [ 604.095509][T12632] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 604.095519][T12632] Call Trace: [ 604.095527][T12632] [ 604.095535][T12632] dump_stack_lvl+0x100/0x190 [ 604.095561][T12632] should_fail_ex.cold+0x5/0xa [ 604.095586][T12632] should_failslab+0xc2/0x120 [ 604.095607][T12632] kmem_cache_alloc_node_noprof+0x81/0x6f0 [ 604.095636][T12632] ? alloc_vmap_area+0x640/0x2b70 [ 604.095661][T12632] alloc_vmap_area+0x640/0x2b70 [ 604.095690][T12632] ? __pfx_alloc_vmap_area+0x10/0x10 [ 604.095740][T12632] __get_vm_area_node+0x1ca/0x330 [ 604.095769][T12632] __vmalloc_node_range_noprof+0x228/0x1630 [ 604.095794][T12632] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 604.095819][T12632] ? find_held_lock+0x2b/0x80 [ 604.095842][T12632] ? __schedule+0x325e/0x67a0 [ 604.095871][T12632] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 604.095899][T12632] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 604.095922][T12632] ? __lock_acquire+0x4a5/0x2630 [ 604.095948][T12632] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 604.095971][T12632] __vmalloc_node_noprof+0xad/0xf0 [ 604.095994][T12632] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 604.096020][T12632] __vmalloc_noprof+0xa3/0x120 [ 604.096042][T12632] ? __pfx___vmalloc_noprof+0x10/0x10 [ 604.096068][T12632] ? rcu_is_watching+0x12/0xc0 [ 604.096089][T12632] ? apparmor_capable+0x1d7/0x4d0 [ 604.096109][T12632] bpf_prog_alloc_no_stats+0x58/0x640 [ 604.096131][T12632] ? security_capable+0x80/0x260 [ 604.096160][T12632] bpf_prog_alloc+0x3b/0x200 [ 604.096181][T12632] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 604.096208][T12632] bpf_prog_load+0x48c/0x2b30 [ 604.096230][T12632] ? __pfx_bpf_prog_load+0x10/0x10 [ 604.096251][T12632] ? __lock_acquire+0x4a5/0x2630 [ 604.096282][T12632] ? bpf_lsm_bpf+0x9/0x10 [ 604.096309][T12632] __sys_bpf+0x223a/0x4b90 [ 604.096326][T12632] ? hrtimer_start_range_ns+0x860/0x1a50 [ 604.096351][T12632] ? __pfx___sys_bpf+0x10/0x10 [ 604.096367][T12632] ? finish_task_switch.isra.0+0x2c6/0x1010 [ 604.096392][T12632] ? rcu_is_watching+0x12/0xc0 [ 604.096413][T12632] ? finish_task_switch.isra.0+0x2cb/0x1010 [ 604.096435][T12632] ? lockdep_hardirqs_on+0x78/0x100 [ 604.096462][T12632] ? finish_task_switch.isra.0+0x2cb/0x1010 [ 604.096486][T12632] ? rcu_is_watching+0x12/0xc0 [ 604.096507][T12632] ? trace_sched_exit_tp+0x11c/0x160 [ 604.096534][T12632] ? __schedule+0x12a7/0x67a0 [ 604.096570][T12632] ? __pfx___schedule+0x10/0x10 [ 604.096596][T12632] ? fput+0x79/0x100 [ 604.096619][T12632] ? exit_to_user_mode_loop+0xe2/0x4f0 [ 604.096641][T12632] __ia32_sys_bpf+0x79/0xf0 [ 604.096659][T12632] ? lockdep_hardirqs_on+0x78/0x100 [ 604.096684][T12632] __do_fast_syscall_32+0xe7/0x950 [ 604.096702][T12632] ? lockdep_hardirqs_on+0x78/0x100 [ 604.096729][T12632] do_fast_syscall_32+0x32/0x70 [ 604.096747][T12632] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 604.096769][T12632] RIP: 0023:0xf705ef7c [ 604.096787][T12632] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 604.096806][T12632] RSP: 002b:00000000f540b50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 604.096826][T12632] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000080 [ 604.096839][T12632] RDX: 0000000000000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 604.096850][T12632] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 604.096862][T12632] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 604.096874][T12632] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 604.096898][T12632] [ 604.096975][T12632] syz.0.1732: vmalloc error: size 4096, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 604.253553][T12632] CPU: 3 UID: 0 PID: 12632 Comm: syz.0.1732 Tainted: G L syzkaller #0 PREEMPT(full) [ 604.253602][T12632] Tainted: [L]=SOFTLOCKUP [ 604.253609][T12632] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 604.253620][T12632] Call Trace: [ 604.253628][T12632] [ 604.253635][T12632] dump_stack_lvl+0x100/0x190 [ 604.253662][T12632] warn_alloc.cold+0x95/0x1c1 [ 604.253683][T12632] ? __pfx_warn_alloc+0x10/0x10 [ 604.253710][T12632] ? lockdep_hardirqs_on+0x78/0x100 [ 604.253741][T12632] ? __get_vm_area_node+0x2c5/0x330 [ 604.253767][T12632] ? __get_vm_area_node+0x208/0x330 [ 604.253793][T12632] __vmalloc_node_range_noprof+0xccd/0x1630 [ 604.253820][T12632] ? find_held_lock+0x2b/0x80 [ 604.253844][T12632] ? __schedule+0x325e/0x67a0 [ 604.253871][T12632] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 604.253903][T12632] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 604.253926][T12632] ? __lock_acquire+0x4a5/0x2630 [ 604.253953][T12632] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 604.253976][T12632] __vmalloc_node_noprof+0xad/0xf0 [ 604.253999][T12632] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 604.254024][T12632] __vmalloc_noprof+0xa3/0x120 [ 604.254047][T12632] ? __pfx___vmalloc_noprof+0x10/0x10 [ 604.254072][T12632] ? rcu_is_watching+0x12/0xc0 [ 604.254093][T12632] ? apparmor_capable+0x1d7/0x4d0 [ 604.254114][T12632] bpf_prog_alloc_no_stats+0x58/0x640 [ 604.254137][T12632] ? security_capable+0x80/0x260 [ 604.254165][T12632] bpf_prog_alloc+0x3b/0x200 [ 604.254187][T12632] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 604.254214][T12632] bpf_prog_load+0x48c/0x2b30 [ 604.254237][T12632] ? __pfx_bpf_prog_load+0x10/0x10 [ 604.254256][T12632] ? __lock_acquire+0x4a5/0x2630 [ 604.254287][T12632] ? bpf_lsm_bpf+0x9/0x10 [ 604.254316][T12632] __sys_bpf+0x223a/0x4b90 [ 604.254334][T12632] ? hrtimer_start_range_ns+0x860/0x1a50 [ 604.254359][T12632] ? __pfx___sys_bpf+0x10/0x10 [ 604.254375][T12632] ? finish_task_switch.isra.0+0x2c6/0x1010 [ 604.254400][T12632] ? rcu_is_watching+0x12/0xc0 [ 604.254421][T12632] ? finish_task_switch.isra.0+0x2cb/0x1010 [ 604.254444][T12632] ? lockdep_hardirqs_on+0x78/0x100 [ 604.254469][T12632] ? finish_task_switch.isra.0+0x2cb/0x1010 [ 604.254494][T12632] ? rcu_is_watching+0x12/0xc0 [ 604.254514][T12632] ? trace_sched_exit_tp+0x11c/0x160 [ 604.254542][T12632] ? __schedule+0x12a7/0x67a0 [ 604.254580][T12632] ? __pfx___schedule+0x10/0x10 [ 604.254606][T12632] ? fput+0x79/0x100 [ 604.254630][T12632] ? exit_to_user_mode_loop+0xe2/0x4f0 [ 604.254653][T12632] __ia32_sys_bpf+0x79/0xf0 [ 604.254672][T12632] ? lockdep_hardirqs_on+0x78/0x100 [ 604.254698][T12632] __do_fast_syscall_32+0xe7/0x950 [ 604.254715][T12632] ? lockdep_hardirqs_on+0x78/0x100 [ 604.254743][T12632] do_fast_syscall_32+0x32/0x70 [ 604.254761][T12632] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 604.254784][T12632] RIP: 0023:0xf705ef7c [ 604.254801][T12632] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 604.254818][T12632] RSP: 002b:00000000f540b50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 604.254836][T12632] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000080 [ 604.254847][T12632] RDX: 0000000000000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 604.254857][T12632] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 604.254867][T12632] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 604.254877][T12632] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 604.254900][T12632] [ 604.255153][T12632] Mem-Info: [ 604.384753][T12632] active_anon:2254 inactive_anon:17881 isolated_anon:0 [ 604.384753][T12632] active_file:10768 inactive_file:15630 isolated_file:25 [ 604.384753][T12632] unevictable:1745 dirty:360 writeback:0 [ 604.384753][T12632] slab_reclaimable:6090 slab_unreclaimable:69374 [ 604.384753][T12632] mapped:24092 shmem:19303 pagetables:1146 [ 604.384753][T12632] sec_pagetables:309 bounce:0 [ 604.384753][T12632] kernel_misc_reclaimable:0 [ 604.384753][T12632] free:37580 free_pcp:12704 free_cma:0 [ 604.400522][T12632] Node 0 active_anon:20kB inactive_anon:20kB active_file:48kB inactive_file:2776kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:32kB dirty:4kB writeback:0kB shmem:3536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:7776kB pagetables:1472kB sec_pagetables:1112kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 604.414365][T12632] Node 1 active_anon:8996kB inactive_anon:71504kB active_file:42324kB inactive_file:59744kB unevictable:3444kB isolated(anon):0kB isolated(file):800kB mapped:96336kB dirty:1436kB writeback:0kB shmem:73676kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:5256kB pagetables:3112kB sec_pagetables:124kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 604.429255][T12632] Node 0 DMA free:3248kB boost:2048kB min:2808kB low:2996kB high:3184kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:8kB inactive_file:128kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 604.443053][T12632] lowmem_reserve[]: 0 285 285 285 285 [ 604.445715][T12632] Node 0 DMA32 free:31564kB boost:29448kB min:42536kB low:45808kB high:49080kB reserved_highatomic:0KB free_highatomic:0KB active_anon:20kB inactive_anon:20kB active_file:40kB inactive_file:2648kB unevictable:3536kB writepending:4kB zspages:24kB present:1032196kB managed:292508kB mlocked:0kB bounce:0kB free_pcp:1256kB local_pcp:0kB free_cma:0kB [ 604.458998][T12632] lowmem_reserve[]: 0 0 0 0 0 [ 604.461790][T12632] Node 1 DMA32 free:115244kB boost:0kB min:47144kB low:58928kB high:70712kB reserved_highatomic:0KB free_highatomic:0KB active_anon:8996kB inactive_anon:71504kB active_file:42324kB inactive_file:59744kB unevictable:3444kB writepending:1336kB zspages:5724kB present:1048432kB managed:948212kB mlocked:8kB bounce:0kB free_pcp:49908kB local_pcp:13952kB free_cma:0kB [ 604.476997][T12632] lowmem_reserve[]: 0 0 0 0 0 [ 604.479821][T12632] Node 0 DMA: 162*4kB (U) 51*8kB (U) 31*16kB (U) 19*32kB (U) 5*64kB (U) 4*128kB (U) 1*256kB (U) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 3248kB [ 604.487124][T12632] Node 0 DMA32: 939*4kB (UME) 390*8kB (UME) 221*16kB (UME) 305*32kB (UME) 52*64kB (UME) 13*128kB (UME) 3*256kB (M) 5*512kB (M) 1*1024kB (M) 1*2048kB (M) 0*4096kB = 31564kB [ 604.495242][T12632] Node 1 DMA32: 3091*4kB (UME) 2285*8kB (UM) 1521*16kB (UME) 110*32kB (UME) 92*64kB (UME) 87*128kB (UME) 56*256kB (UME) 20*512kB (UME) 8*1024kB (UM) 3*2048kB (M) 0*4096kB = 114436kB [ 604.502904][T12632] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 604.507027][T12632] Node 0 hugepages_total=2 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 604.510748][T12632] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 604.514292][T12632] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 604.518730][T12632] 46591 total pagecache pages [ 604.521170][T12632] 867 pages in swap cache [ 604.525752][T12632] Free swap = 89300kB [ 604.527441][T12632] Total swap = 124996kB [ 604.529141][T12632] 524155 pages RAM [ 604.530718][T12632] 0 pages HighMem/MovableOnly [ 604.532284][T12632] 210135 pages reserved [ 604.534105][T12632] 0 pages cma reserved [ 605.206649][T12637] pim6reg: entered allmulticast mode [ 605.321583][T12637] team0: entered allmulticast mode [ 605.327517][T12637] team_slave_0: entered allmulticast mode [ 605.329472][T12637] team_slave_1: entered allmulticast mode [ 605.340971][T12636] team0: left allmulticast mode [ 605.343188][T12636] team_slave_0: left allmulticast mode [ 605.345568][T12636] team_slave_1: left allmulticast mode [ 605.347893][T12636] pim6reg: left allmulticast mode [ 606.225486][T12642] syzkaller0: entered promiscuous mode [ 606.227284][T12642] syzkaller0: entered allmulticast mode [ 606.612092][ T7418] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 606.729923][ T5895] usb 38-1: device descriptor read/8, error -110 [ 606.793972][ T7418] usb 6-1: Using ep0 maxpacket: 8 [ 606.812694][ T7418] usb 6-1: config 0 has an invalid interface number: 55 but max is 0 [ 606.825641][ T7418] usb 6-1: config 0 has no interface number 0 [ 606.827569][ T7418] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 606.831507][ T7418] usb 6-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 606.835564][ T7418] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 606.847274][ T7418] usb 6-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 606.851733][ T7418] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 606.855781][ T7418] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 606.862106][ T7418] usb 6-1: config 0 descriptor?? [ 606.873409][ T7418] ldusb 6-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 607.096704][T12646] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 607.102256][T12646] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 607.150463][ T5895] usb usb38-port1: attempt power cycle [ 607.201346][ T7418] usb 6-1: USB disconnect, device number 32 [ 607.203935][ C3] ldusb 6-1:0.55: usb_submit_urb failed (-19) [ 607.213873][ T7418] ldusb 6-1:0.55: LD USB Device #0 now disconnected [ 607.214064][T12646] ldusb: No device or device unplugged -19 [ 607.720140][ T5895] usb usb38-port1: unable to enumerate USB device [ 608.067817][T12662] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 610.193273][T12681] fuse: Bad value for 'fd' [ 610.196628][T12681] trusted_key: encrypted_key: insufficient parameters specified [ 610.206916][T12681] trusted_key: encrypted_key: insufficient parameters specified [ 610.294756][T12683] netlink: 108 bytes leftover after parsing attributes in process `syz.2.1746'. [ 610.429630][ T7418] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 610.579650][ T7418] usb 6-1: Using ep0 maxpacket: 8 [ 610.584459][ T7418] usb 6-1: config 0 has an invalid interface number: 55 but max is 0 [ 610.587704][ T7418] usb 6-1: config 0 has no interface number 0 [ 610.590220][ T7418] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 610.594386][ T7418] usb 6-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 610.599156][ T7418] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 610.603400][ T7418] usb 6-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 610.608661][ T7418] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 610.613196][ T7418] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 610.619497][ T7418] usb 6-1: config 0 descriptor?? [ 610.637686][ T7418] ldusb 6-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 610.838469][T12680] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 610.841745][T12680] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 610.947300][ T6245] usb 6-1: USB disconnect, device number 33 [ 610.947390][ C3] ldusb 6-1:0.55: usb_submit_urb failed (-19) [ 610.951986][ T6245] ldusb 6-1:0.55: LD USB Device #0 now disconnected [ 610.952096][T12680] ldusb: No device or device unplugged -19 [ 611.246275][T12690] tmpfs: Bad value for 'mpol' [ 611.631708][T12695] ceph: No mds server is up or the cluster is laggy [ 611.662394][ T5895] libceph: connect (1)[c::]:6789 error -101 [ 611.664659][ T5895] libceph: mon0 (1)[c::]:6789 connect error [ 613.290278][T12712] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 613.292973][T12712] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 613.298962][T12712] vhci_hcd vhci_hcd.0: Device attached [ 613.304768][T12711] syzkaller0: entered promiscuous mode [ 613.306538][T12711] syzkaller0: entered allmulticast mode [ 613.484760][T12712] rdma_rxe: rxe_newlink: failed to add wg2 [ 613.579490][ T5895] usb 40-1: SetAddress Request (50) to port 0 [ 613.582005][ T5895] usb 40-1: new SuperSpeed USB device number 50 using vhci_hcd [ 613.796436][T12714] vhci_hcd: connection reset by peer [ 613.810738][ T46] vhci_hcd vhci_hcd.1: stop threads [ 613.813288][ T46] vhci_hcd vhci_hcd.1: release socket [ 613.816440][ T46] vhci_hcd vhci_hcd.1: disconnect device [ 614.069686][ T24] usb 8-1: new high-speed USB device number 20 using dummy_hcd [ 614.229655][ T24] usb 8-1: Using ep0 maxpacket: 8 [ 614.233418][ T24] usb 8-1: config 0 has an invalid interface number: 55 but max is 0 [ 614.236657][ T24] usb 8-1: config 0 has no interface number 0 [ 614.239221][ T24] usb 8-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 614.244317][ T24] usb 8-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 614.249616][ T24] usb 8-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 614.254116][ T24] usb 8-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 614.258483][ T24] usb 8-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 614.264834][ T24] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 614.270606][ T24] usb 8-1: config 0 descriptor?? [ 614.331342][ T24] ldusb 8-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 614.485502][T12722] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 614.489895][T12722] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 614.655499][ T7418] usb 8-1: USB disconnect, device number 20 [ 614.664782][ T7418] ldusb 8-1:0.55: LD USB Device #0 now disconnected [ 614.665702][T12722] ldusb: No device or device unplugged -19 [ 615.215030][T12730] FAULT_INJECTION: forcing a failure. [ 615.215030][T12730] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 615.219988][T12730] CPU: 2 UID: 0 PID: 12730 Comm: syz.3.1762 Tainted: G L syzkaller #0 PREEMPT(full) [ 615.220010][T12730] Tainted: [L]=SOFTLOCKUP [ 615.220015][T12730] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 615.220022][T12730] Call Trace: [ 615.220027][T12730] [ 615.220032][T12730] dump_stack_lvl+0x100/0x190 [ 615.220050][T12730] should_fail_ex.cold+0x5/0xa [ 615.220066][T12730] _copy_from_user+0x2e/0xd0 [ 615.220080][T12730] do_ip_setsockopt+0xb22/0x3200 [ 615.220096][T12730] ? __pfx_do_ip_setsockopt+0x10/0x10 [ 615.220110][T12730] ? find_held_lock+0x2b/0x80 [ 615.220127][T12730] ? __pfx___mutex_lock+0x10/0x10 [ 615.220145][T12730] ip_setsockopt+0x5a/0xf0 [ 615.220159][T12730] tcp_setsockopt+0xa7/0x100 [ 615.220181][T12730] smc_setsockopt+0x1b6/0xa40 [ 615.220198][T12730] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 615.220217][T12730] ? __pfx_smc_setsockopt+0x10/0x10 [ 615.220232][T12730] ? aa_sock_opt_perm+0xfe/0x1b0 [ 615.220251][T12730] ? __pfx_smc_setsockopt+0x10/0x10 [ 615.220266][T12730] do_sock_setsockopt+0xf3/0x1d0 [ 615.220284][T12730] __sys_setsockopt+0x119/0x190 [ 615.220301][T12730] __ia32_sys_setsockopt+0xbc/0x160 [ 615.220313][T12730] ? __do_fast_syscall_32+0x98/0x950 [ 615.220325][T12730] ? lockdep_hardirqs_on+0x78/0x100 [ 615.220343][T12730] __do_fast_syscall_32+0xe7/0x950 [ 615.220353][T12730] ? lockdep_hardirqs_on+0x78/0x100 [ 615.220373][T12730] do_fast_syscall_32+0x32/0x70 [ 615.220384][T12730] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 615.220399][T12730] RIP: 0023:0xf70aef7c [ 615.220410][T12730] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 615.220422][T12730] RSP: 002b:00000000f549d50c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 615.220433][T12730] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 [ 615.220440][T12730] RDX: 000000000000001a RSI: 0000000080000000 RDI: 000000000000002c [ 615.220447][T12730] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 615.220454][T12730] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 615.220460][T12730] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 615.220475][T12730] [ 616.413258][T12745] raw_sendmsg: syz.3.1767 forgot to set AF_INET. Fix it! [ 616.991987][T12756] trusted_key: encrypted_key: keyword 'upw' not recognized [ 617.007105][T12756] tap0: tun_chr_ioctl cmd 1074025672 [ 617.009862][T12756] tap0: ignored: set checksum disabled [ 617.529745][ T6037] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 617.749644][ T6037] usb 5-1: Using ep0 maxpacket: 8 [ 617.754323][ T6037] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 617.757964][ T6037] usb 5-1: config 0 has no interface number 0 [ 617.761294][ T6037] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 617.765668][ T6037] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 617.770737][ T6037] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 617.775592][ T6037] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 617.780149][ T6037] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 617.783025][ T6037] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 617.786742][ T6037] usb 5-1: config 0 descriptor?? [ 617.796219][ T6037] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 617.995874][T12759] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 617.999092][T12759] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 618.044753][T12772] tmpfs: Bad value for 'mpol' [ 618.223328][ T7418] usb 5-1: USB disconnect, device number 27 [ 618.223386][ C2] ldusb 5-1:0.55: usb_submit_urb failed (-19) [ 618.549736][T12759] ldusb: No device or device unplugged -19 [ 618.552134][ T7418] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 618.591747][ T24] libceph: connect (1)[c::]:6789 error -101 [ 618.594883][ T24] libceph: mon0 (1)[c::]:6789 connect error [ 618.626800][T12773] ceph: No mds server is up or the cluster is laggy [ 618.646821][T12779] netlink: 96 bytes leftover after parsing attributes in process `syz.1.1778'. [ 618.649916][ T5895] usb 40-1: device descriptor read/8, error -110 [ 618.652188][T12779] netlink: 96 bytes leftover after parsing attributes in process `syz.1.1778'. [ 618.929946][T12781] syzkaller0: entered promiscuous mode [ 618.931880][T12781] syzkaller0: entered allmulticast mode [ 619.081193][ T5895] usb usb40-port1: attempt power cycle [ 619.802033][ T5895] usb usb40-port1: unable to enumerate USB device [ 619.947995][T12797] FAULT_INJECTION: forcing a failure. [ 619.947995][T12797] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 619.953390][T12797] CPU: 0 UID: 0 PID: 12797 Comm: syz.3.1783 Tainted: G L syzkaller #0 PREEMPT(full) [ 619.953411][T12797] Tainted: [L]=SOFTLOCKUP [ 619.953415][T12797] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 619.953428][T12797] Call Trace: [ 619.953433][T12797] [ 619.953438][T12797] dump_stack_lvl+0x100/0x190 [ 619.953456][T12797] should_fail_ex.cold+0x5/0xa [ 619.953471][T12797] _copy_to_user+0x32/0xd0 [ 619.953485][T12797] simple_read_from_buffer+0xcb/0x170 [ 619.953500][T12797] proc_fail_nth_read+0x1af/0x230 [ 619.953520][T12797] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 619.953538][T12797] ? rw_verify_area+0xce/0x6d0 [ 619.953550][T12797] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 619.953568][T12797] vfs_read+0x1e4/0xb30 [ 619.953582][T12797] ? __pfx_vfs_read+0x10/0x10 [ 619.953594][T12797] ? find_held_lock+0x2b/0x80 [ 619.953609][T12797] ? __fget_files+0x215/0x3d0 [ 619.953626][T12797] ? __fget_files+0x21f/0x3d0 [ 619.953643][T12797] ksys_read+0x12a/0x250 [ 619.953656][T12797] ? __pfx_ksys_read+0x10/0x10 [ 619.953669][T12797] ? rcu_is_watching+0x12/0xc0 [ 619.953683][T12797] ? rcu_is_watching+0x12/0xc0 [ 619.953698][T12797] do_int80_emulation+0x141/0x700 [ 619.953712][T12797] asm_int80_emulation+0x1a/0x20 [ 619.953723][T12797] RIP: 0023:0xf71e61ab [ 619.953733][T12797] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 619.953745][T12797] RSP: 002b:00000000f549d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 619.953756][T12797] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000f549d5d0 [ 619.953763][T12797] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 619.953769][T12797] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 619.953776][T12797] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 619.953782][T12797] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 619.953796][T12797] [ 620.830089][T12803] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 620.832612][T12803] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 620.849717][T12803] vhci_hcd vhci_hcd.0: Device attached [ 621.083147][T12803] syz2: rxe_newlink: already configured on wg2 [ 621.110038][ T5895] usb 44-1: SetAddress Request (63) to port 0 [ 621.112586][ T5895] usb 44-1: new SuperSpeed USB device number 63 using vhci_hcd [ 621.168242][T12809] openvswitch: netlink: Invalid MD length 0 for MD type 0 [ 621.171006][T12809] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 621.217617][T12804] vhci_hcd: connection reset by peer [ 621.220634][ T3512] vhci_hcd vhci_hcd.3: stop threads [ 621.224669][ T3512] vhci_hcd vhci_hcd.3: release socket [ 621.228551][ T3512] vhci_hcd vhci_hcd.3: disconnect device [ 621.231635][T12810] random: crng reseeded on system resumption [ 623.731799][T12829] pim6reg: entered allmulticast mode [ 623.804371][T12827] team0: entered allmulticast mode [ 623.806579][T12827] team_slave_1: entered allmulticast mode [ 623.810044][T12827] team0: left allmulticast mode [ 623.812593][T12827] team_slave_1: left allmulticast mode [ 623.815558][T12827] pim6reg: left allmulticast mode [ 624.155335][T12835] FAULT_INJECTION: forcing a failure. [ 624.155335][T12835] name failslab, interval 1, probability 0, space 0, times 0 [ 624.160298][T12835] CPU: 2 UID: 0 PID: 12835 Comm: syz.3.1792 Tainted: G L syzkaller #0 PREEMPT(full) [ 624.160327][T12835] Tainted: [L]=SOFTLOCKUP [ 624.160334][T12835] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 624.160345][T12835] Call Trace: [ 624.160351][T12835] [ 624.160358][T12835] dump_stack_lvl+0x100/0x190 [ 624.160385][T12835] should_fail_ex.cold+0x5/0xa [ 624.160407][T12835] should_failslab+0xc2/0x120 [ 624.160427][T12835] kmem_cache_alloc_node_noprof+0x81/0x6f0 [ 624.160463][T12835] ? __alloc_skb+0x140/0x710 [ 624.160487][T12835] __alloc_skb+0x140/0x710 [ 624.160505][T12835] ? __alloc_skb+0x5b7/0x710 [ 624.160522][T12835] ? __pfx___alloc_skb+0x10/0x10 [ 624.160538][T12835] ? genl_rcv_msg+0x4be/0x800 [ 624.160559][T12835] netlink_ack+0x117/0xb80 [ 624.160608][T12835] netlink_rcv_skb+0x333/0x420 [ 624.160633][T12835] ? __pfx_genl_rcv_msg+0x10/0x10 [ 624.160653][T12835] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 624.160689][T12835] ? netlink_deliver_tap+0x1ae/0xcc0 [ 624.160717][T12835] genl_rcv+0x28/0x40 [ 624.160732][T12835] netlink_unicast+0x585/0x850 [ 624.160757][T12835] ? __pfx_netlink_unicast+0x10/0x10 [ 624.160787][T12835] netlink_sendmsg+0x8b0/0xda0 [ 624.160814][T12835] ? __pfx_netlink_sendmsg+0x10/0x10 [ 624.160841][T12835] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 624.160870][T12835] ____sys_sendmsg+0x9e1/0xb70 [ 624.160892][T12835] ? __pfx_netlink_sendmsg+0x10/0x10 [ 624.160918][T12835] ? __pfx_____sys_sendmsg+0x10/0x10 [ 624.160951][T12835] ___sys_sendmsg+0x190/0x1e0 [ 624.160979][T12835] ? __pfx____sys_sendmsg+0x10/0x10 [ 624.161017][T12835] ? find_held_lock+0x2b/0x80 [ 624.161054][T12835] __sys_sendmsg+0x170/0x220 [ 624.161075][T12835] ? __pfx___sys_sendmsg+0x10/0x10 [ 624.161094][T12835] ? __fget_files+0x21f/0x3d0 [ 624.161120][T12835] ? ksys_write+0x1ac/0x250 [ 624.161142][T12835] ? rcu_is_watching+0x12/0xc0 [ 624.161165][T12835] __do_fast_syscall_32+0xe7/0x950 [ 624.161181][T12835] ? lockdep_hardirqs_on+0x78/0x100 [ 624.161208][T12835] do_fast_syscall_32+0x32/0x70 [ 624.161224][T12835] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 624.161245][T12835] RIP: 0023:0xf70aef7c [ 624.161258][T12835] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 624.161275][T12835] RSP: 002b:00000000f549d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 624.161292][T12835] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000200 [ 624.161303][T12835] RDX: 0000000020004810 RSI: 0000000000000000 RDI: 0000000000000000 [ 624.161312][T12835] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 624.161322][T12835] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 624.161332][T12835] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 624.161353][T12835] [ 624.592183][T12845] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 624.595052][T12845] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 624.598304][T12845] vhci_hcd vhci_hcd.0: Device attached [ 625.086591][ T6037] usb 38-1: SetAddress Request (34) to port 0 [ 625.086636][ T6037] usb 38-1: new SuperSpeed USB device number 34 using vhci_hcd [ 625.359833][ T24] usb 7-1: new high-speed USB device number 31 using dummy_hcd [ 625.402799][T12825] rdma_rxe: rxe_newlink: failed to add wg2 [ 625.509699][ T24] usb 7-1: Using ep0 maxpacket: 8 [ 625.512972][ T24] usb 7-1: config 0 has an invalid interface number: 55 but max is 0 [ 625.515856][ T24] usb 7-1: config 0 has no interface number 0 [ 625.518248][ T24] usb 7-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 625.522043][ T24] usb 7-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 625.526172][ T24] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 625.530823][ T24] usb 7-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 625.535141][ T24] usb 7-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 625.538202][ T24] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 625.544175][ T24] usb 7-1: config 0 descriptor?? [ 625.552894][ T24] ldusb 7-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 625.615551][T12846] vhci_hcd: connection reset by peer [ 625.618328][T12573] vhci_hcd vhci_hcd.0: stop threads [ 625.620660][T12573] vhci_hcd vhci_hcd.0: release socket [ 625.623082][T12573] vhci_hcd vhci_hcd.0: disconnect device [ 625.758704][T12855] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 625.769915][T12855] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 625.839777][ T9] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 625.989662][ T9] usb 6-1: Using ep0 maxpacket: 8 [ 625.992957][ T9] usb 6-1: config 0 has an invalid interface number: 55 but max is 0 [ 625.995676][ T9] usb 6-1: config 0 has no interface number 0 [ 625.997584][ T9] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 626.001555][ T9] usb 6-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 626.006253][ T9] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 626.009991][ T9] usb 6-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 626.014277][ T9] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 626.017146][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 626.021549][ T9] usb 6-1: config 0 descriptor?? [ 626.027138][ T9] ldusb 6-1:0.55: LD USB Device #1 now attached to major 180 minor 1 [ 626.062778][ T24] usb 7-1: USB disconnect, device number 31 [ 626.064929][ C2] ldusb 7-1:0.55: usb_submit_urb failed (-19) [ 626.084232][ T24] ldusb 7-1:0.55: LD USB Device #0 now disconnected [ 626.086312][T12855] ldusb: No device or device unplugged -19 [ 626.179661][ T5895] usb 44-1: device descriptor read/8, error -110 [ 626.231372][T12861] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 626.234519][T12861] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 626.535760][ T7418] usb 6-1: USB disconnect, device number 34 [ 626.544453][ T7418] ldusb 6-1:0.55: LD USB Device #1 now disconnected [ 626.574234][T12872] fuse: Bad value for 'fd' [ 626.675050][ T5895] usb usb44-port1: attempt power cycle [ 626.678024][T12869] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 626.680803][T12869] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 626.694950][T12869] vhci_hcd vhci_hcd.0: Device attached [ 626.990817][T12864] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 626.990854][T12864] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 626.990912][T12864] vhci_hcd vhci_hcd.0: Device attached [ 626.995284][T12872] trusted_key: encrypted_key: insufficient parameters specified [ 627.007213][T12872] trusted_key: encrypted_key: insufficient parameters specified [ 627.039734][ T5895] usb 44-1: SetAddress Request (65) to port 0 [ 627.039794][ T5895] usb 44-1: new SuperSpeed USB device number 65 using vhci_hcd [ 627.175563][T12875] vhci_hcd: connection closed [ 627.176033][T12573] vhci_hcd vhci_hcd.2: stop threads [ 627.179336][T12573] vhci_hcd vhci_hcd.2: release socket [ 627.181688][T12573] vhci_hcd vhci_hcd.2: disconnect device [ 627.198556][T12873] vhci_hcd: connection reset by peer [ 627.222306][T12573] vhci_hcd vhci_hcd.3: stop threads [ 627.224016][T12573] vhci_hcd vhci_hcd.3: release socket [ 627.236170][T12573] vhci_hcd vhci_hcd.3: disconnect device [ 627.518261][T12884] pim6reg: entered allmulticast mode [ 627.553994][T12884] team0: entered allmulticast mode [ 627.559702][T12884] team_slave_1: entered allmulticast mode [ 627.578812][T12883] team0: left allmulticast mode [ 627.580595][T12883] team_slave_1: left allmulticast mode [ 627.583459][T12883] pim6reg: left allmulticast mode [ 628.023469][T12895] openvswitch: netlink: Flow actions attr not present in new flow. [ 628.444183][T12901] tmpfs: Bad value for 'mpol' [ 628.736214][T12911] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1811'. [ 628.834666][ T29] libceph: connect (1)[c::]:6789 error -101 [ 628.837435][ T29] libceph: mon0 (1)[c::]:6789 connect error [ 628.933887][T12912] ceph: No mds server is up or the cluster is laggy [ 629.130487][ T5846] usb 7-1: new high-speed USB device number 32 using dummy_hcd [ 629.132639][ T1433] ieee802154 phy0 wpan0: encryption failed: -22 [ 629.136507][ T1433] ieee802154 phy1 wpan1: encryption failed: -22 [ 629.279898][ T5846] usb 7-1: Using ep0 maxpacket: 8 [ 629.286105][ T5846] usb 7-1: config 0 has an invalid interface number: 55 but max is 0 [ 629.288969][ T5846] usb 7-1: config 0 has no interface number 0 [ 629.291447][ T5846] usb 7-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 629.295368][ T5846] usb 7-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 629.300068][ T5846] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 629.304199][ T5846] usb 7-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 629.308524][ T5846] usb 7-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 629.311982][ T5846] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 629.315993][ T5846] usb 7-1: config 0 descriptor?? [ 629.327811][ T5846] ldusb 7-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 629.474266][T12918] tmpfs: Bad value for 'mpol' [ 629.524461][T12916] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 629.527515][T12916] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 629.674483][ C0] ldusb 7-1:0.55: usb_submit_urb failed (-19) [ 629.676591][ T5846] usb 7-1: USB disconnect, device number 32 [ 629.700639][T12916] ldusb: No device or device unplugged -19 [ 629.704568][ T5846] ldusb 7-1:0.55: LD USB Device #0 now disconnected [ 629.952846][T12924] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 630.088917][T12924] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 630.088968][T12928] tmpfs: Bad value for 'mpol' [ 630.169936][ T6037] usb 38-1: device descriptor read/8, error -110 [ 630.283932][T12924] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 631.174610][T12929] ceph: No mds server is up or the cluster is laggy [ 631.177067][ T29] libceph: connect (1)[c::]:6789 error -101 [ 631.192404][ T29] libceph: mon0 (1)[c::]:6789 connect error [ 631.690045][ T29] libceph: connect (1)[c::]:6789 error -101 [ 631.694646][ T6037] usb usb38-port1: attempt power cycle [ 631.707184][ T29] libceph: mon0 (1)[c::]:6789 connect error [ 631.861532][T12924] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 632.048520][ T138] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 632.064126][ T225] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 632.075855][ T225] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 632.080500][ T7418] libceph: connect (1)[c::]:6789 error -101 [ 632.082879][ T7418] libceph: mon0 (1)[c::]:6789 connect error [ 632.087262][ T225] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 632.089640][ T5895] usb 44-1: device descriptor read/8, error -110 [ 632.176152][T12937] ceph: No mds server is up or the cluster is laggy [ 632.360718][ T6037] usb usb38-port1: unable to enumerate USB device [ 632.584343][ T5895] usb usb44-port1: unable to enumerate USB device [ 632.592712][T12952] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1821'. [ 632.664592][T12954] ip6gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 632.682165][T12956] bridge1: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 632.748343][T12949] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 632.795345][T12957] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1820'. [ 632.854205][T12949] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 632.908771][T12949] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 633.119242][T12949] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 633.559420][T12962] pim6reg: entered allmulticast mode [ 633.693841][T12968] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1824'. [ 633.743808][T12962] team0: entered allmulticast mode [ 633.746471][T12962] team_slave_0: entered allmulticast mode [ 633.749061][T12962] team_slave_1: entered allmulticast mode [ 633.757534][T12962] team0: left allmulticast mode [ 633.759825][T12962] team_slave_0: left allmulticast mode [ 633.762273][T12962] team_slave_1: left allmulticast mode [ 633.765070][T12962] pim6reg: left allmulticast mode [ 635.056568][ T40] kauditd_printk_skb: 108 callbacks suppressed [ 635.056674][ T40] audit: type=1326 audit(1779340548.013:2794): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12977 comm="syz.1.1827" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7f37f7c code=0x0 [ 635.083769][T12979] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 635.086710][T12979] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 635.092593][T12979] vhci_hcd vhci_hcd.0: Device attached [ 635.366000][T12988] FAULT_INJECTION: forcing a failure. [ 635.366000][T12988] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 635.372105][T12988] CPU: 3 UID: 0 PID: 12988 Comm: syz.1.1829 Tainted: G L syzkaller #0 PREEMPT(full) [ 635.372141][T12988] Tainted: [L]=SOFTLOCKUP [ 635.372148][T12988] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 635.372161][T12988] Call Trace: [ 635.372169][T12988] [ 635.372178][T12988] dump_stack_lvl+0x100/0x190 [ 635.372208][T12988] should_fail_ex.cold+0x5/0xa [ 635.372234][T12988] _copy_from_user+0x2e/0xd0 [ 635.372258][T12988] cmsghdr_from_user_compat_to_kern+0x4eb/0x7d0 [ 635.372293][T12988] ? __pfx_cmsghdr_from_user_compat_to_kern+0x10/0x10 [ 635.372321][T12988] ? __import_iovec+0x1d2/0x640 [ 635.372351][T12988] ____sys_sendmsg+0x607/0xb70 [ 635.372385][T12988] ? __pfx_____sys_sendmsg+0x10/0x10 [ 635.372428][T12988] ___sys_sendmsg+0x190/0x1e0 [ 635.372482][T12988] ? __pfx____sys_sendmsg+0x10/0x10 [ 635.372527][T12988] ? find_held_lock+0x2b/0x80 [ 635.372571][T12988] __sys_sendmsg+0x170/0x220 [ 635.372597][T12988] ? __pfx___sys_sendmsg+0x10/0x10 [ 635.372619][T12988] ? __fget_files+0x21f/0x3d0 [ 635.372651][T12988] ? ksys_write+0x1ac/0x250 [ 635.372676][T12988] ? rcu_is_watching+0x12/0xc0 [ 635.372704][T12988] __do_fast_syscall_32+0xe7/0x950 [ 635.372727][T12988] ? lockdep_hardirqs_on+0x78/0x100 [ 635.372760][T12988] do_fast_syscall_32+0x32/0x70 [ 635.372781][T12988] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 635.372812][T12988] RIP: 0023:0xf7f37f7c [ 635.372830][T12988] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 635.372849][T12988] RSP: 002b:00000000f53f650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 635.372870][T12988] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000140 [ 635.372883][T12988] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 635.372895][T12988] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 635.372906][T12988] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 635.372918][T12988] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 635.372945][T12988] [ 635.400626][ T5895] usb 44-1: SetAddress Request (67) to port 0 [ 635.477348][ T5895] usb 44-1: new SuperSpeed USB device number 67 using vhci_hcd [ 635.969806][T12980] vhci_hcd: connection reset by peer [ 635.972840][ T225] vhci_hcd vhci_hcd.3: stop threads [ 635.974877][ T225] vhci_hcd vhci_hcd.3: release socket [ 635.977464][ T225] vhci_hcd vhci_hcd.3: disconnect device [ 636.069722][ T7418] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 636.250457][ T7418] usb 6-1: too many configurations: 9, using maximum allowed: 8 [ 636.253970][ T7418] usb 6-1: config index 0 descriptor too short (expected 12315, got 27) [ 636.256635][ T7418] usb 6-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 636.259421][ T7418] usb 6-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 636.262822][ T7418] usb 6-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 636.266581][ T7418] usb 6-1: config index 1 descriptor too short (expected 12315, got 27) [ 636.269952][ T7418] usb 6-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 636.273146][ T7418] usb 6-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 636.276119][ T7418] usb 6-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 636.280531][ T7418] usb 6-1: config index 2 descriptor too short (expected 12315, got 27) [ 636.283060][ T7418] usb 6-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 636.285554][ T7418] usb 6-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 636.288992][ T7418] usb 6-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 636.293079][ T7418] usb 6-1: config index 3 descriptor too short (expected 12315, got 27) [ 636.295490][ T7418] usb 6-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 636.298191][ T7418] usb 6-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 636.301602][ T7418] usb 6-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 636.305467][ T7418] usb 6-1: config index 4 descriptor too short (expected 12315, got 27) [ 636.307850][ T7418] usb 6-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 636.310468][ T7418] usb 6-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 636.313797][ T7418] usb 6-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 636.317703][ T7418] usb 6-1: config index 5 descriptor too short (expected 12315, got 27) [ 636.320224][ T7418] usb 6-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 636.322657][ T7418] usb 6-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 636.325622][ T7418] usb 6-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 636.330367][ T7418] usb 6-1: config index 6 descriptor too short (expected 12315, got 27) [ 636.333213][ T7418] usb 6-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 636.335826][ T7418] usb 6-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 636.338726][ T7418] usb 6-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 636.342469][ T7418] usb 6-1: config index 7 descriptor too short (expected 12315, got 27) [ 636.344969][ T7418] usb 6-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 636.347561][ T7418] usb 6-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 636.350710][ T7418] usb 6-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 636.355599][ T7418] usb 6-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 636.358234][ T7418] usb 6-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 636.360719][ T7418] usb 6-1: Product: syz [ 636.361887][ T7418] usb 6-1: Manufacturer: syz [ 636.363208][ T7418] usb 6-1: SerialNumber: syz [ 636.581369][ T7418] usb 6-1: USB disconnect, device number 35 [ 636.635566][T12573] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 636.653106][T12573] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 636.662854][T12573] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 636.673020][T12573] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 636.829749][ T6037] usb 8-1: new high-speed USB device number 21 using dummy_hcd [ 637.089764][ T5837] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 637.110549][ T6037] usb 8-1: too many configurations: 9, using maximum allowed: 8 [ 637.116932][ T6037] usb 8-1: config index 0 descriptor too short (expected 12315, got 27) [ 637.126144][ T6037] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 637.137872][T13007] netlink: 'syz.1.1836': attribute type 1 has an invalid length. [ 637.138480][ T6037] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 637.150538][ T6037] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 637.161626][T13007] 8021q: adding VLAN 0 to HW filter on device bond2 [ 637.169758][ T6037] usb 8-1: config index 1 descriptor too short (expected 12315, got 27) [ 637.192075][ T6037] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 637.197098][ T6037] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 637.202681][ T6037] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 637.207531][T13009] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 637.210626][T13009] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 637.215823][T13009] vhci_hcd vhci_hcd.0: Device attached [ 637.246684][ T6037] usb 8-1: config index 2 descriptor too short (expected 12315, got 27) [ 637.258388][ T6037] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 637.270256][ T5837] usb 5-1: Using ep0 maxpacket: 8 [ 637.276780][ T6037] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 637.288789][ T5837] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 637.297762][ T6037] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 637.300861][ T5837] usb 5-1: config 0 has no interface number 0 [ 637.301246][ T5837] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 637.301545][ T5837] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 637.301699][ T5837] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 637.302492][ T5837] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 637.303254][ T5837] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 637.303472][ T5837] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 637.308515][ T6037] usb 8-1: config index 3 descriptor too short (expected 12315, got 27) [ 637.308717][ T6037] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 637.308801][ T6037] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 637.308888][ T6037] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 637.321640][ T5837] usb 5-1: config 0 descriptor?? [ 637.322591][ T6037] usb 8-1: config index 4 descriptor too short (expected 12315, got 27) [ 637.322617][ T6037] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 637.322635][ T6037] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 637.322655][ T6037] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 637.336072][ T6037] usb 8-1: config index 5 descriptor too short (expected 12315, got 27) [ 637.336100][ T6037] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 637.336118][ T6037] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 637.336134][ T6037] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 637.338375][ T6037] usb 8-1: config index 6 descriptor too short (expected 12315, got 27) [ 637.338405][ T6037] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 637.338422][ T6037] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 637.338440][ T6037] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 637.342086][ T6037] usb 8-1: config index 7 descriptor too short (expected 12315, got 27) [ 637.342183][ T6037] usb 8-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 637.342203][ T6037] usb 8-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 637.342220][ T6037] usb 8-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 637.348863][ T6037] usb 8-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 637.348898][ T6037] usb 8-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 637.348916][ T6037] usb 8-1: Product: syz [ 637.348929][ T6037] usb 8-1: Manufacturer: syz [ 637.348945][ T6037] usb 8-1: SerialNumber: syz [ 637.431528][ T5837] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 637.520341][T13014] usb 42-1: SetAddress Request (35) to port 0 [ 637.520441][T13014] usb 42-1: new SuperSpeed USB device number 35 using vhci_hcd [ 637.527278][ T6245] IPVS: starting estimator thread 0... [ 637.531442][T13001] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 637.615039][T13001] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 637.619981][T13025] IPVS: using max 27 ests per chain, 64800 per kthread [ 637.649887][ T6037] usb 8-1: USB disconnect, device number 21 [ 637.693734][ T6245] usb 5-1: USB disconnect, device number 28 [ 637.693756][ C0] ldusb 5-1:0.55: usb_submit_urb failed (-19) [ 637.696658][ T6245] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 637.699333][T13001] ldusb: No device or device unplugged -19 [ 637.941018][T13010] vhci_hcd: connection reset by peer [ 637.944614][ T138] vhci_hcd vhci_hcd.2: stop threads [ 637.946521][ T138] vhci_hcd vhci_hcd.2: release socket [ 637.948760][ T138] vhci_hcd vhci_hcd.2: disconnect device [ 637.976818][T13029] tmpfs: Bad value for 'mpol' [ 638.264668][ T6037] libceph: connect (1)[c::]:6789 error -22 [ 638.270250][ T6037] libceph: mon0 (1)[c::]:6789 connect error [ 638.316192][T13033] ceph: No mds server is up or the cluster is laggy [ 639.362556][T13045] pim6reg: entered allmulticast mode [ 639.433667][T13042] team0: entered allmulticast mode [ 639.435586][T13042] team_slave_1: entered allmulticast mode [ 639.438131][T13042] team0: left allmulticast mode [ 639.440099][T13042] team_slave_1: left allmulticast mode [ 639.442385][T13042] pim6reg: left allmulticast mode [ 640.179254][T13061] tmpfs: Bad value for 'mpol' [ 640.280329][ T29] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 640.440145][ T29] usb 5-1: too many configurations: 9, using maximum allowed: 8 [ 640.444522][ T29] usb 5-1: config index 0 descriptor too short (expected 12315, got 27) [ 640.447424][ T29] usb 5-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 640.450855][ T29] usb 5-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 640.454823][ T29] usb 5-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 640.462606][ T29] usb 5-1: config index 1 descriptor too short (expected 12315, got 27) [ 640.466380][ T29] usb 5-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 640.473154][ T29] usb 5-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 640.476627][ T29] usb 5-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 640.479884][ T6037] libceph: connect (1)[c::]:6789 error -101 [ 640.482578][ T6037] libceph: mon0 (1)[c::]:6789 connect error [ 640.486407][ T29] usb 5-1: config index 2 descriptor too short (expected 12315, got 27) [ 640.489450][ T29] usb 5-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 640.492998][ T29] usb 5-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 640.496697][ T29] usb 5-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 640.502431][ T29] usb 5-1: config index 3 descriptor too short (expected 12315, got 27) [ 640.505692][ T29] usb 5-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 640.508541][ T29] usb 5-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 640.517517][T13067] ceph: No mds server is up or the cluster is laggy [ 640.520205][ T29] usb 5-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 640.528091][ T29] usb 5-1: config index 4 descriptor too short (expected 12315, got 27) [ 640.534762][ T29] usb 5-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 640.540161][ T29] usb 5-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 640.543766][ T29] usb 5-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 640.557163][ T29] usb 5-1: config index 5 descriptor too short (expected 12315, got 27) [ 640.559882][ T29] usb 5-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 640.576127][ T29] usb 5-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 640.579761][ T29] usb 5-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 640.583095][ T5895] usb 44-1: device descriptor read/8, error -110 [ 640.588665][ T29] usb 5-1: config index 6 descriptor too short (expected 12315, got 27) [ 640.592802][ T29] usb 5-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 640.596959][ T29] usb 5-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 640.605561][ T29] usb 5-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 640.610015][ T29] usb 5-1: config index 7 descriptor too short (expected 12315, got 27) [ 640.613529][ T29] usb 5-1: config 48 has too many interfaces: 120, using maximum allowed: 32 [ 640.616758][ T29] usb 5-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 640.624777][ T29] usb 5-1: config 48 has 0 interfaces, different from the descriptor's value: 120 [ 640.632135][ T29] usb 5-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 640.635293][ T29] usb 5-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 640.644351][ T29] usb 5-1: Product: syz [ 640.648608][ T29] usb 5-1: Manufacturer: syz [ 640.652529][ T29] usb 5-1: SerialNumber: syz [ 640.755379][T13078] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 640.928105][ T29] usb 5-1: USB disconnect, device number 29 [ 640.933800][T13086] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 640.990940][ T5895] usb usb44-port1: attempt power cycle [ 641.275035][T13099] siw: device registration error -23 [ 641.275255][T13100] siw: device registration error -23 [ 641.318913][T13100] ------------[ cut here ]------------ [ 641.321588][T13100] refcount_t: underflow; use-after-free. [ 641.325700][T13100] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xf4/0x130, CPU#2: syz.2.1857/13100 [ 641.330555][T13100] Modules linked in: [ 641.335191][T13100] CPU: 2 UID: 0 PID: 13100 Comm: syz.2.1857 Tainted: G L syzkaller #0 PREEMPT(full) [ 641.340044][T13100] Tainted: [L]=SOFTLOCKUP [ 641.342039][T13100] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 641.346641][T13100] RIP: 0010:refcount_warn_saturate+0xf4/0x130 [ 641.348993][T13100] Code: 06 e8 b0 98 10 fd 48 8d 3d 29 42 eb 0b 67 48 0f b9 3a e8 9f 98 10 fd 5b 5d c3 cc cc cc cc e8 93 98 10 fd 48 8d 3d 1c 42 eb 0b <67> 48 0f b9 3a e8 82 98 10 fd 5b 5d e9 1b 47 94 06 e8 76 98 10 fd [ 641.357982][T13100] RSP: 0000:ffffc900073a70f8 EFLAGS: 00010293 [ 641.361169][T13100] RAX: 0000000000000000 RBX: ffff88804b713f80 RCX: ffffffff84f7735b [ 641.363849][T13100] RDX: ffff88805c3aca00 RSI: ffffffff84f773ed RDI: ffffffff90e2b610 [ 641.366958][T13100] RBP: 0000000000000003 R08: 0000000000000005 R09: 0000000000000004 [ 641.370202][T13100] R10: 0000000000000003 R11: 000000000000001e R12: ffff88804b713f80 [ 641.374186][T13100] R13: ffffffff8a3f2940 R14: 0000000000000000 R15: 0000000000000018 [ 641.377936][T13100] FS: 0000000000000000(0000) GS:ffff888097374000(0063) knlGS:00000000f53bbb40 [ 641.381540][T13100] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 641.383911][T13100] CR2: 00000000800015c0 CR3: 0000000052e1c000 CR4: 0000000000352ef0 [ 641.387051][T13100] Call Trace: [ 641.388406][T13100] [ 641.389693][T13100] sk_common_release+0x260/0x370 [ 641.391786][T13100] inet_release+0xed/0x200 [ 641.393217][T13100] inet6_release+0x4f/0x70 [ 641.394944][T13100] sock_release+0x91/0x1c0 [ 641.397077][T13100] ? __pfx_rxe_ns_pernet_set_sk6+0x10/0x10 [ 641.399918][T13100] rxe_sock_put+0xae/0x130 [ 641.401447][T13100] ? __pfx_rxe_dellink+0x10/0x10 [ 641.403363][T13100] rxe_net_del+0xaf/0x120 [ 641.405087][T13100] rxe_dellink+0x15/0x20 [ 641.406810][T13100] nldev_dellink+0x289/0x3c0 [ 641.408678][T13100] ? __pfx_nldev_dellink+0x10/0x10 [ 641.410868][T13100] ? rcu_is_watching+0x12/0xc0 [ 641.412811][T13100] ? apparmor_capable+0x1d7/0x4d0 [ 641.414816][T13100] ? bpf_lsm_capable+0x9/0x10 [ 641.416761][T13100] ? security_capable+0x80/0x260 [ 641.418918][T13100] ? ns_capable+0xd2/0xf0 [ 641.420556][T13100] ? __pfx_nldev_dellink+0x10/0x10 [ 641.422773][T13100] rdma_nl_rcv_msg+0x392/0x6f0 [ 641.424722][T13100] ? __pfx_rdma_nl_rcv_msg+0x10/0x10 [ 641.426847][T13100] ? __lock_acquire+0x4a5/0x2630 [ 641.428872][T13100] rdma_nl_rcv_skb.constprop.0.isra.0+0x2cb/0x410 [ 641.431635][T13100] ? __pfx_rdma_nl_rcv_skb.constprop.0.isra.0+0x10/0x10 [ 641.434667][T13100] ? netlink_deliver_tap+0x1ae/0xcc0 [ 641.436861][T13100] netlink_unicast+0x585/0x850 [ 641.438816][T13100] ? __pfx_netlink_unicast+0x10/0x10 [ 641.440785][T13100] netlink_sendmsg+0x8b0/0xda0 [ 641.442690][T13100] ? __pfx_netlink_sendmsg+0x10/0x10 [ 641.444888][T13100] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 641.447217][T13100] ____sys_sendmsg+0x9e1/0xb70 [ 641.449160][T13100] ? __pfx_netlink_sendmsg+0x10/0x10 [ 641.451109][T13100] ? __pfx_____sys_sendmsg+0x10/0x10 [ 641.453332][T13100] ? __pfx___futex_wait+0x10/0x10 [ 641.455415][T13100] ? __pfx_futex_wake_mark+0x10/0x10 [ 641.457697][T13100] ___sys_sendmsg+0x190/0x1e0 [ 641.459867][T13100] ? __pfx____sys_sendmsg+0x10/0x10 [ 641.462189][T13100] ? find_held_lock+0x2b/0x80 [ 641.464152][T13100] __sys_sendmsg+0x170/0x220 [ 641.466035][T13100] ? __pfx___sys_sendmsg+0x10/0x10 [ 641.468232][T13100] ? rcu_is_watching+0x12/0xc0 [ 641.470389][T13100] __do_fast_syscall_32+0xe7/0x950 [ 641.472562][T13100] do_fast_syscall_32+0x32/0x70 [ 641.474595][T13100] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 641.477174][T13100] RIP: 0023:0xf700ef7c [ 641.478774][T13100] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 641.486464][T13100] RSP: 002b:00000000f53bb50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 641.489748][T13100] RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00000000800002c0 [ 641.492417][T13100] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 641.495572][T13100] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 641.498925][T13100] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 641.502373][T13100] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 641.505006][T13100] [ 641.506311][T13100] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 641.509311][T13100] CPU: 2 UID: 0 PID: 13100 Comm: syz.2.1857 Tainted: G L syzkaller #0 PREEMPT(full) [ 641.514381][T13100] Tainted: [L]=SOFTLOCKUP [ 641.516096][T13100] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 641.519866][T13100] Call Trace: [ 641.521192][T13100] [ 641.522246][T13100] dump_stack_lvl+0x100/0x190 [ 641.523817][T13100] vpanic+0x552/0x970 [ 641.525431][T13100] ? __pfx_vpanic+0x10/0x10 [ 641.527470][T13100] panic+0xd1/0xe0 [ 641.529180][T13100] ? __pfx_panic+0x10/0x10 [ 641.531355][T13100] ? check_panic_on_warn+0x1f/0x90 [ 641.533468][T13100] check_panic_on_warn.cold+0x19/0x34 [ 641.535694][T13100] ? refcount_warn_saturate+0xf4/0x130 [ 641.537854][T13100] __warn.cold+0x191/0x328 [ 641.539686][T13100] __report_bug+0x296/0x3d0 [ 641.541663][T13100] ? refcount_warn_saturate+0xf4/0x130 [ 641.544032][T13100] ? __pfx___report_bug+0x10/0x10 [ 641.545805][T13100] ? refcount_warn_saturate+0xed/0x130 [ 641.547936][T13100] ? refcount_warn_saturate+0x5b/0x130 [ 641.550019][T13100] ? report_bug_entry+0x9d/0x290 [ 641.552100][T13100] report_bug_entry+0xe1/0x290 [ 641.554133][T13100] ? refcount_warn_saturate+0xf4/0x130 [ 641.556560][T13100] handle_bug+0x1cd/0x2a0 [ 641.558444][T13100] exc_invalid_op+0x17/0x50 [ 641.560356][T13100] asm_exc_invalid_op+0x1a/0x20 [ 641.562320][T13100] RIP: 0010:refcount_warn_saturate+0xf4/0x130 [ 641.564648][T13100] Code: 06 e8 b0 98 10 fd 48 8d 3d 29 42 eb 0b 67 48 0f b9 3a e8 9f 98 10 fd 5b 5d c3 cc cc cc cc e8 93 98 10 fd 48 8d 3d 1c 42 eb 0b <67> 48 0f b9 3a e8 82 98 10 fd 5b 5d e9 1b 47 94 06 e8 76 98 10 fd [ 641.572429][T13100] RSP: 0000:ffffc900073a70f8 EFLAGS: 00010293 [ 641.574842][T13100] RAX: 0000000000000000 RBX: ffff88804b713f80 RCX: ffffffff84f7735b [ 641.577809][T13100] RDX: ffff88805c3aca00 RSI: ffffffff84f773ed RDI: ffffffff90e2b610 [ 641.580447][T13100] RBP: 0000000000000003 R08: 0000000000000005 R09: 0000000000000004 [ 641.583516][T13100] R10: 0000000000000003 R11: 000000000000001e R12: ffff88804b713f80 [ 641.586896][T13100] R13: ffffffff8a3f2940 R14: 0000000000000000 R15: 0000000000000018 [ 641.590179][T13100] ? __pfx_udpv6_destroy_sock+0x10/0x10 [ 641.592369][T13100] ? refcount_warn_saturate+0x5b/0x130 [ 641.594470][T13100] ? refcount_warn_saturate+0xed/0x130 [ 641.596694][T13100] ? refcount_warn_saturate+0xed/0x130 [ 641.598802][T13100] sk_common_release+0x260/0x370 [ 641.600486][T13100] inet_release+0xed/0x200 [ 641.602309][T13100] inet6_release+0x4f/0x70 [ 641.604087][T13100] sock_release+0x91/0x1c0 [ 641.605890][T13100] ? __pfx_rxe_ns_pernet_set_sk6+0x10/0x10 [ 641.608312][T13100] rxe_sock_put+0xae/0x130 [ 641.610190][T13100] ? __pfx_rxe_dellink+0x10/0x10 [ 641.612153][T13100] rxe_net_del+0xaf/0x120 [ 641.613624][T13100] rxe_dellink+0x15/0x20 [ 641.614975][T13100] nldev_dellink+0x289/0x3c0 [ 641.616807][T13100] ? __pfx_nldev_dellink+0x10/0x10 [ 641.618887][T13100] ? rcu_is_watching+0x12/0xc0 [ 641.621022][T13100] ? apparmor_capable+0x1d7/0x4d0 [ 641.623118][T13100] ? bpf_lsm_capable+0x9/0x10 [ 641.624962][T13100] ? security_capable+0x80/0x260 [ 641.626817][T13100] ? ns_capable+0xd2/0xf0 [ 641.628553][T13100] ? __pfx_nldev_dellink+0x10/0x10 [ 641.630637][T13100] rdma_nl_rcv_msg+0x392/0x6f0 [ 641.632716][T13100] ? __pfx_rdma_nl_rcv_msg+0x10/0x10 [ 641.634915][T13100] ? __lock_acquire+0x4a5/0x2630 [ 641.636911][T13100] rdma_nl_rcv_skb.constprop.0.isra.0+0x2cb/0x410 [ 641.639341][T13100] ? __pfx_rdma_nl_rcv_skb.constprop.0.isra.0+0x10/0x10 [ 641.642113][T13100] ? netlink_deliver_tap+0x1ae/0xcc0 [ 641.644355][T13100] netlink_unicast+0x585/0x850 [ 641.646519][T13100] ? __pfx_netlink_unicast+0x10/0x10 [ 641.648832][T13100] netlink_sendmsg+0x8b0/0xda0 [ 641.650748][T13100] ? __pfx_netlink_sendmsg+0x10/0x10 [ 641.652880][T13100] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 641.655145][T13100] ____sys_sendmsg+0x9e1/0xb70 [ 641.657021][T13100] ? __pfx_netlink_sendmsg+0x10/0x10 [ 641.658731][T13100] ? __pfx_____sys_sendmsg+0x10/0x10 [ 641.660983][T13100] ? __pfx___futex_wait+0x10/0x10 [ 641.663112][T13100] ? __pfx_futex_wake_mark+0x10/0x10 [ 641.665311][T13100] ___sys_sendmsg+0x190/0x1e0 [ 641.667239][T13100] ? __pfx____sys_sendmsg+0x10/0x10 [ 641.669448][T13100] ? find_held_lock+0x2b/0x80 [ 641.671560][T13100] __sys_sendmsg+0x170/0x220 [ 641.673249][T13100] ? __pfx___sys_sendmsg+0x10/0x10 [ 641.675126][T13100] ? rcu_is_watching+0x12/0xc0 [ 641.677104][T13100] __do_fast_syscall_32+0xe7/0x950 [ 641.679265][T13100] do_fast_syscall_32+0x32/0x70 [ 641.681354][T13100] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 641.683690][T13100] RIP: 0023:0xf700ef7c [ 641.685263][T13100] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 641.692863][T13100] RSP: 002b:00000000f53bb50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 641.695995][T13100] RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00000000800002c0 [ 641.699372][T13100] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 641.702504][T13100] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 641.705383][T13100] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 641.708458][T13100] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 641.712166][T13100] [ 641.714563][T13100] Kernel Offset: disabled [ 641.716228][T13100] Rebooting in 86400 seconds..