last executing test programs: 7m11.801679174s ago: executing program 2 (id=644): r0 = socket$inet(0x2, 0x3, 0x8d) setsockopt$inet_msfilter(r0, 0x0, 0x8, &(0x7f0000000340)=ANY=[@ANYRES32], 0x1) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000000c0)={0x0, @local, @local}, &(0x7f0000000100)=0xc) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000000)={@ipv4={'\x00', '\xff\xff', @broadcast}, 0x2c, r1}) r2 = socket(0xa, 0x1, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4c, &(0x7f0000000000)=0x5, 0x4) ioctl(r2, 0x8916, &(0x7f0000000000)) ioctl(r2, 0x8936, &(0x7f0000000000)) 7m4.610384416s ago: executing program 2 (id=665): sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) setsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0xff, 0x7fffffff}]}) alarm(0x38) bind$unix(0xffffffffffffffff, &(0x7f0000000040)=@abs={0x1, 0x0, 0x4e22}, 0x6e) 7m4.322928525s ago: executing program 2 (id=668): unshare(0x60040000) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20, 0xbb6, @loopback, 0x5}, 0x28) connect$inet6(r0, &(0x7f0000000480)={0xa, 0x4e20, 0x9, @loopback, 0x106}, 0x1c) r1 = fcntl$dupfd(r0, 0x406, r0) setsockopt$inet6_buf(r0, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) sendmmsg$unix(r1, &(0x7f0000000340)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000640)='+', 0x1}], 0x1, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYBLOB="1c"], 0x38}}], 0x1, 0x100) write$binfmt_elf64(r1, &(0x7f00000004c0)=ANY=[], 0xfffffdcf) 6m58.221360142s ago: executing program 2 (id=697): mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$bpf(0x200000000000, &(0x7f0000000440)='./file0/../file0\x00', 0x0, 0x1a1046, 0x0) mount$bpf(0x0, &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x200000000000, &(0x7f0000000140)='./file0\x00', 0x0, 0x80000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000000)='.\x00', 0x0, 0x8b7848, 0x0) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x84000, 0x0) 6m57.895707771s ago: executing program 2 (id=698): r0 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0xa) r1 = landlock_create_ruleset(&(0x7f00000001c0)={0x2fbd, 0x1}, 0x18, 0x0) landlock_restrict_self(r1, 0x0) link(&(0x7f0000000140)='.\x00', &(0x7f0000000180)='./file0\x00') 6m55.206299382s ago: executing program 2 (id=710): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e24, 0x2, @empty, 0xcac2d78a}}, 0x0, 0x0, 0x43, 0x0, "ee8b0e650926a96ecc136e7fb980e989db9e8bf9b93129488f651a8de213eb94cd46e19d9c65a018444a131f4da58ae36556dd38ea6c029607462029add09240005c6776267517308a3d40aa1c788df6"}, 0xd8) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000001c0)=@gcm_256={{0x304}, "6ae04425ace3f60c", "acba84f0a6731f234db1cc7f3f382ad796bd667cb12ea99509873931d2873103", "0f9dafb4", "ec3fff9afd96e6c0"}, 0x38) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000040)=0x2, 0x4) ioctl$int_in(r0, 0x5421, &(0x7f0000000140)=0x1) writev(r0, &(0x7f0000000080)=[{&(0x7f00000002c0)="ec", 0xfdef}], 0x1) 6m54.814799114s ago: executing program 32 (id=710): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e24, 0x2, @empty, 0xcac2d78a}}, 0x0, 0x0, 0x43, 0x0, "ee8b0e650926a96ecc136e7fb980e989db9e8bf9b93129488f651a8de213eb94cd46e19d9c65a018444a131f4da58ae36556dd38ea6c029607462029add09240005c6776267517308a3d40aa1c788df6"}, 0xd8) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000001c0)=@gcm_256={{0x304}, "6ae04425ace3f60c", "acba84f0a6731f234db1cc7f3f382ad796bd667cb12ea99509873931d2873103", "0f9dafb4", "ec3fff9afd96e6c0"}, 0x38) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000040)=0x2, 0x4) ioctl$int_in(r0, 0x5421, &(0x7f0000000140)=0x1) writev(r0, &(0x7f0000000080)=[{&(0x7f00000002c0)="ec", 0xfdef}], 0x1) 17.81359708s ago: executing program 3 (id=2501): mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x401c2, 0x0) ftruncate(r0, 0x8800000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r2, &(0x7f00000034c0)=[{{0x0, 0x0, &(0x7f0000001e40)=[{&(0x7f0000000b80)=""/4096, 0x20001b80}, {&(0x7f0000001b80)=""/112, 0x70}], 0x2, 0x0, 0xa0028cb4}}], 0x40000000000013c, 0x700, 0x0) r3 = io_uring_setup(0x70c3, &(0x7f0000000180)={0x0, 0x2c3f, 0x0, 0x20001, 0x2}) close_range(r3, 0xffffffffffffffff, 0x0) sendfile(r1, r0, 0x0, 0x578410eb) 17.363686752s ago: executing program 1 (id=2505): r0 = socket$netlink(0x10, 0x3, 0x4) write(r0, &(0x7f00000000c0)="2700000014000707030e0000120f11000100f5fe0012ff000000073e8a151f7508bfb4df0564399c0854295e0adeb253ca6f292aeb19b91ff494c84aeffea67d64e363228bd3df8041da3ca8e567ad3d6c2fdd90949623ceba1a33242f3bcad91795abb2ac6df650f5a5bb2867ea6e664232e8acbe25e75662a00793d8083ef570b82772a98aacc45cc930b005623af637658b9cad774fdb2406c7efb635fa42192d82b4f6a4aaf9ccecaf1b37fec59a49e91e094f00bae2249cb1bcb63ce544b3ad5d469a694baf32006129086882e404d50034953e3fea24cf79db1929d6e2cdba2ccefc7c8ea9804bacf336ce6ee49a3023fa7c0ad40e562bb1ad1e56ecaca0d10256650dacec861c93dd4542581a04c6b36d1896", 0x116) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e21, 0x7ff, @ipv4={'\x00', '\xff\xff', @empty}, 0x7}, 0x1c) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) sendfile(r4, r4, 0x0, 0x800000000004) connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e21, 0x659, @empty, 0xff}, 0x1c) connect$unix(r3, &(0x7f0000000180)=@file={0x1, './file0\x00'}, 0x6e) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000240), 0xb375) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000027c0)=@base={0x4, 0x4, 0x4, 0x10005}, 0x50) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r5, 0x58, &(0x7f0000000340)={0x0, 0x0}}, 0x10) r7 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000080)={r6}, 0xc) dup2(r7, r5) fsetxattr$trusted_overlay_upper(r0, &(0x7f0000000000), &(0x7f0000000040)={0x0, 0xfb, 0x65, 0x7, 0x66, "2573fc19ec145fede3ca189698db78d5", "13d324e71d16ddb1cd363824a11a8db1f8783d33a149f6a48dec511f9883975ad244bc550a9987382b2e0d5acb94cc6cb2426fa27235acd11627ab1f40b552599f7637db7203d456f2dbeca5239d0eaa"}, 0x65, 0x1) 16.804436422s ago: executing program 1 (id=2509): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r0, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x4e20, 0x0, @private2}]}, &(0x7f0000000180)=0x10) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000a00)={r3, @in6={{0xa, 0x4e23, 0x2, @loopback, 0xfffffffd}}, 0x0, 0x0, 0x0, 0x0, 0x54, 0x6}, 0x9c) 16.681238926s ago: executing program 1 (id=2511): r0 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x1) r1 = fsopen(&(0x7f00000003c0)='tmpfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) fsmount(r1, 0x0, 0xf) fsconfig$FSCONFIG_CMD_RECONFIGURE(r1, 0x7, 0x0, 0x0, 0x0) 16.500955603s ago: executing program 3 (id=2514): r0 = socket$netlink(0x10, 0x3, 0x4) write(r0, &(0x7f00000000c0)="2700000014000707030e0000120f11000100f5fe0012ff000000073e8a151f7508bfb4df0564399c0854295e0adeb253ca6f292aeb19b91ff494c84aeffea67d64e363228bd3df8041da3ca8e567ad3d6c2fdd90949623ceba1a33242f3bcad91795abb2ac6df650f5a5bb2867ea6e664232e8acbe25e75662a00793d8083ef570b82772a98aacc45cc930b005623af637658b9cad774fdb2406c7efb635fa42192d82b4f6a4aaf9ccecaf1b37fec59a49e91e094f00bae2249cb1bcb63ce544b3ad5d469a694baf32006129086882e404d50034953e3fea24cf79db1929d6e2cdba2ccefc7c8ea9804bacf336ce6ee49a3023fa7c0ad40e562bb1ad1e56ecaca0d10256650dacec861c93dd4542581a04c6b36d1896", 0x116) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e21, 0x7ff, @ipv4={'\x00', '\xff\xff', @empty}, 0x7}, 0x1c) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) sendfile(r4, r4, 0x0, 0x800000000004) r5 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) connect$unix(r3, &(0x7f0000000180)=@file={0x1, './file0\x00'}, 0x6e) write$cgroup_pid(r5, &(0x7f0000000240), 0xb375) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000027c0)=@base={0x4, 0x4, 0x4, 0x10005}, 0x50) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r6, 0x58, &(0x7f0000000340)={0x0, 0x0}}, 0x10) r8 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000080)={r7}, 0xc) dup2(r8, r6) fsetxattr$trusted_overlay_upper(r0, &(0x7f0000000000), &(0x7f0000000040)={0x0, 0xfb, 0x15, 0x7, 0x66, "2573fc19ec145fede3ca189698db78d5"}, 0x15, 0x1) 16.362430486s ago: executing program 1 (id=2516): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f00000001c0)='./file0/../file0\x00', 0x0, 0x2125099, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x404, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) 15.157639377s ago: executing program 3 (id=2520): syz_open_dev$media(&(0x7f00000012c0), 0x66, 0x180502) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f000068b000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) ioctl$DRM_IOCTL_MODE_GETFB(0xffffffffffffffff, 0xc01c64ad, 0x0) r0 = io_uring_setup(0x185d, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x1, 0x800000bf}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x900) 14.989769751s ago: executing program 1 (id=2521): r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x180, 0x0) ioctl$PTP_PIN_GETFUNC2(r0, 0xc0603d0f, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) fchdir(0xffffffffffffffff) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_open_dev$video(0x0, 0x8, 0x20202) syz_open_dev$audion(&(0x7f0000000040), 0x1ff, 0x0) syz_open_dev$sndctrl(&(0x7f0000000040), 0x80000000, 0x0) open(&(0x7f0000000000)='.\x00', 0x1040480, 0x0) 14.836623206s ago: executing program 3 (id=2522): mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x0, &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x3a52025, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000100), 0x0, 0x0, 0x0) mount$bpf(0x200000000000, &(0x7f0000000000)='.\x00', 0x0, 0x8b7848, 0x0) mount$bpf(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x20000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x200000000000, &(0x7f0000000080)='./file0/../file0\x00', 0x0, 0x2042, 0x0) 14.424063945s ago: executing program 3 (id=2525): socket$packet(0x11, 0x3, 0x300) mkdir(&(0x7f0000000380)='./file1\x00', 0xa) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x400000, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r0 = openat$autofs(0xffffffffffffff9c, &(0x7f00000002c0), 0x100, 0x0) r1 = open(&(0x7f0000000000)='.\x00', 0x0, 0x244) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r0, 0xc0189379, &(0x7f0000000200)={{0x1, 0x1, 0x18, r1}, './file1\x00'}) mount$9p_fd(0x0, &(0x7f00000000c0)='./file1\x00', &(0x7f0000000180), 0x8015, 0x0) 13.053335242s ago: executing program 1 (id=2529): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x103080, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000024000/0x18000)=nil, &(0x7f0000000680)=[@text16={0x10, &(0x7f00000001c0)="66b9800000c00f326635010000000f3064660f38828e4258660f08676ac744240012e93bf96766c744240201000000f20f78ecf5543e660f3829544e66b9800000c00f326635002000000f300f01df66b805000000f3a5a90a000f01c40f019c09000f01c2", 0x65}], 0x1, 0x7d, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f0000000100)={0xbc, 0x0, 0x7}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 12.591168294s ago: executing program 33 (id=2529): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x103080, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000024000/0x18000)=nil, &(0x7f0000000680)=[@text16={0x10, &(0x7f00000001c0)="66b9800000c00f326635010000000f3064660f38828e4258660f08676ac744240012e93bf96766c744240201000000f20f78ecf5543e660f3829544e66b9800000c00f326635002000000f300f01df66b805000000f3a5a90a000f01c40f019c09000f01c2", 0x65}], 0x1, 0x7d, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f0000000100)={0xbc, 0x0, 0x7}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 10.987745549s ago: executing program 5 (id=2533): r0 = epoll_create1(0x80000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x17a, 0x0) epoll_pwait(r0, &(0x7f0000000140)=[{}], 0x1, 0x2d516fb6, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000100)={0x20000014}) pselect6(0x40, &(0x7f0000000000)={0xa, 0x7ffffffe, 0x2, 0x10000000000006, 0xf, 0x8, 0x80000002, 0x8}, 0x0, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) 9.521400461s ago: executing program 5 (id=2534): ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) r0 = syz_usb_connect(0x1, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12012000f1048108cd060202d4920000000109021b1901000000d40904150001da40df0009058202"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, &(0x7f00000002c0)={0x14, &(0x7f0000000200)={0x0, 0xe, 0x68, {0x68, 0x1, "fc4f2bcaf8cae32800b60c1f1c064b3d18118e783a83007e8f6ae981583f8a8662fbda122564441bf066a63349b8d619c492ab478b00f071e503b31dc06445508b0707edf9cf282e71b14adc2a498755ed991c7bf5087acccaa72f7392836e93cf2c9266e9dc"}}, &(0x7f0000000280)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x42c}}}, &(0x7f0000000680)={0x34, &(0x7f0000000440)={0x40, 0x16, 0x9b, "5a94d89d14519ac7b59bf9a53295aed8f36ad696a47a9365f8b93ab93edad1ff20da679b5787d578df23b7d8db3659efc2892ac239c35d121ed0f8b11abee7ec81c359b3487be8baa428689c63078f28dbc98bdc3bf9195034630fdfef2b136735ef610d1d54ff9b66224c963d84ac9523a73379945fd80e02cbd5fa59e9ec240387c5306f254175b710e832bda250ea8ec7a6e2dd9da679c3ad54"}, &(0x7f0000000540)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000000580)={0x0, 0x8, 0x1, 0x7}, &(0x7f00000005c0)={0x20, 0x0, 0x19, {0x17, "18aa8df0781386620172270995d63c8a90bb44763c27c0"}}, &(0x7f0000000600)={0x20, 0x1, 0x1, 0xfa}, &(0x7f0000000640)={0x20, 0x0, 0x1}}) syz_usb_disconnect(r0) r1 = socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@link_local, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x64, 0x0, 0x0, 0x1, 0x0, @private=0xa010100, @multicast1}, @address_request}}}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000014c0)=@newtaction={0x68, 0x30, 0xb, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x6a00}, [{0x54, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x6, 0xff, 0x4, 0x6, 0x6}, 0x4}}]}, {0x4, 0xa}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x2000a804) io_uring_setup(0xf08, &(0x7f00000003c0)={0x0, 0xfb6e, 0x800, 0x44, 0x246}) 6.964587086s ago: executing program 4 (id=2541): pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_BIND_IP(r1, &(0x7f0000000500)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e21, 0x8, @mcast2, 0x2}}}, 0x30) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r3, &(0x7f0000000980), 0xfdef) splice(r0, 0x0, r3, 0x0, 0x80, 0x4) timer_settime(0x0, 0x0, 0x0, 0x0) read$FUSE(r2, &(0x7f0000000980)={0x2020}, 0x2020) 6.841744084s ago: executing program 3 (id=2542): r0 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x48240) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4) bind$alg(0xffffffffffffffff, 0x0, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)=[{0x0, 0x10}], 0x1, 0x0, 0x0, 0x4000880}, 0x4008000) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000040)={0x0}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r0, 0xc01864c6, &(0x7f0000000240)={0x0, 0x0, 0x80000}) 6.329826243s ago: executing program 0 (id=2543): r0 = socket$netlink(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000100)=0x1800, 0x4) sendmsg$IPCTNL_MSG_EXP_GET(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f00000008c0)={0x14, 0x1, 0x2, 0x101, 0x0, 0x0, {0x7, 0x0, 0x3}}, 0x14}, 0x1, 0x0, 0x0, 0x200080c4}, 0x20000810) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x144, 0x10, 0x1, 0xbffffffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in=@local, 0x1, 0x794, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@loopback, {0x0, 0x9, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0x1ff}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0x2, 0x1, 0xfd, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @mark={0xc, 0x15, {0x35075a, 0x3}}]}, 0x144}, 0x1, 0x0, 0x0, 0x8801}, 0x10) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newsa={0x138, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@loopback, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) 6.328726933s ago: executing program 4 (id=2544): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94) syz_emit_ethernet(0x32, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x0, 0x2, 0x9c, 0x0, @val=0x80}}}}}}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r1, &(0x7f0000000440), &(0x7f0000000040)=@udp=r0}, 0x20) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x21) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) recvmmsg(r0, &(0x7f0000003280)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)=""/205, 0xcd}], 0x1}, 0x9}], 0x1, 0x7, 0x0) 6.15593499s ago: executing program 0 (id=2545): r0 = gettid() timer_create(0x1, &(0x7f0000533fa0)={0x0, 0x11, 0x4, @tid=r0}, &(0x7f0000000000)=0x0) timer_settime(r1, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) futex(&(0x7f0000000240)=0x1, 0x86, 0x2, 0x0, 0x0, 0xfffffffc) prctl$PR_SET_SECCOMP(0x4e, 0x1, 0x0) syz_clone(0xb44040, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x82) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, r2, 0x0) 6.004410379s ago: executing program 5 (id=2546): r0 = io_uring_setup(0x180d, &(0x7f0000000500)={0x0, 0x4178, 0x800, 0x8001002, 0x3d7}) r1 = syz_create_resource$binfmt(&(0x7f0000000000)='./file0\x00') r2 = openat$binfmt(0xffffffffffffff9c, r1, 0x41, 0x1ff) fcntl$setlease(r2, 0x400, 0x1) open$dir(&(0x7f0000000700)='./file0\x00', 0x0, 0x90) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x200, 0xc7) close_range(r0, 0xffffffffffffffff, 0x0) 5.268184172s ago: executing program 5 (id=2547): ioctl$vim2m_VIDIOC_G_FMT(0xffffffffffffffff, 0xc0d05604, &(0x7f0000000000)={0x2, @sliced={0x9, [0x8, 0x1, 0x2, 0x60, 0xaf, 0x1, 0x200, 0xc, 0xff, 0x80, 0xd65, 0x8, 0xffff, 0xff, 0x0, 0x7ff, 0x2, 0x16, 0x1, 0x1, 0x7fff, 0x2, 0x0, 0x7, 0x200, 0x8, 0x4, 0x9, 0x100, 0x8, 0x101, 0xad, 0x1, 0x6, 0x7, 0x7ff, 0x5a2, 0x5a, 0x0, 0x7, 0x97, 0x3, 0x8, 0x5, 0x9, 0x80, 0x800, 0x30], 0x8000}}) openat$vnet(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000300)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x7, 0xfa11, 0x7ff}, 0x0) r2 = socket$inet(0x2, 0x3, 0x9) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r3, 0x0, 0x0) sendmsg$NFQNL_MSG_CONFIG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000020303"], 0x1c}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800"], 0xa8}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a14000000020a0506020000000000000000000007140000001100010000000000000000000000000abf08bfba86d940a23b5f8f0800b5c2522473ad089eb3d4040fc86fa5760f8692707c6259e5e1fa5dceca1730e4de7a2786974036740b1deb991601c408dcc2e639f6cb8cedec0dfc688e28b5cbbe662b3e3a36de87224299b6955337562eb68ac0a8c3a022aa45fb3d9a50ac3e88e0ece968fba6f0c908b78c856a05e43bbedc523138c6cdaa615d04187794605d52"], 0x3c}, 0x1, 0x0, 0x0, 0x2000094}, 0x80) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x4b, 0x1, 0xffffffff, 0x6, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x24040001) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000a40)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a4c000000030a0fdb00000000000000000a0020050900030073797a30000000000900010073797a310000000014000480080002403cb140bb08000140000000030a000700726f75746500000014000000110001"], 0x74}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) r6 = socket$kcm(0xa, 0x922000000003, 0x11) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a6c000000060a0b040000000000000000020000004000048018000180080001006f7366000c000280080001400000000424000180090001006d6574610000000014000280080002400000000c08000340000000150900010073797a30000000000900020073797a320000000014000000110001"], 0x94}}, 0x0) sendmsg$kcm(r6, &(0x7f0000000000)={&(0x7f0000000500)=@l2tp6={0xa, 0x0, 0x3, @loopback, 0x1, 0xfffffffe}, 0x80, 0x0}, 0x0) shutdown(r2, 0x0) recvmmsg(r2, &(0x7f00000066c0), 0xa0d, 0x0, 0x0) r8 = openat$audio(0xffffffffffffff9c, &(0x7f0000000200), 0xa2442, 0x0) ioctl$SNDCTL_DSP_SETFMT(r8, 0xc0045005, &(0x7f0000000040)=0x1000) ioctl$SNDCTL_DSP_SYNC(r8, 0x5001, 0x0) 5.141989704s ago: executing program 4 (id=2548): r0 = socket$netlink(0x10, 0x3, 0x4) write(r0, &(0x7f00000000c0)="2700000014000707030e0000120f11000100f5fe0012ff000000073e8a151f7508bfb4df0564399c0854295e0adeb253ca6f292aeb19b91ff494c84aeffea67d64e363228bd3df8041da3ca8e567ad3d6c2fdd90949623ceba1a33242f3bcad91795abb2ac6df650f5a5bb2867ea6e664232e8acbe25e75662a00793d8083ef570b82772a98aacc45cc930b005623af637658b9cad774fdb2406c7efb635fa42192d82b4f6a4aaf9ccecaf1b37fec59a49e91e094f00bae2249cb1bcb63ce544b3ad5d469a694baf32006129086882e404d50034953e3fea24cf79db1929d6e2cdba2ccefc7c8ea9804bacf336ce6ee49a3023fa7c0ad40e562bb1ad1e56ecaca0d10256650dacec861c93dd4542581a04c6b36d1896", 0x116) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e21, 0x7ff, @ipv4={'\x00', '\xff\xff', @empty}, 0x7}, 0x1c) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) sendfile(r4, r4, 0x0, 0x800000000004) connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e21, 0x659, @empty, 0xff}, 0x1c) connect$unix(r3, &(0x7f0000000180)=@file={0x1, './file0\x00'}, 0x6e) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000240), 0xb375) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000027c0)=@base={0x4, 0x4, 0x4, 0x10005}, 0x50) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r5, 0x58, &(0x7f0000000340)={0x0, 0x0}}, 0x10) r7 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000080)={r6}, 0xc) dup2(r7, r5) fsetxattr$trusted_overlay_upper(r0, &(0x7f0000000000), &(0x7f0000000040)={0x0, 0xfb, 0x69, 0x7, 0x66, "2573fc19ec145fede3ca189698db78d5", "13d324e71d16ddb1cd363824a11a8db1f8783d33a149f6a48dec511f9883975ad244bc550a9987382b2e0d5acb94cc6cb2426fa27235acd11627ab1f40b552599f7637db7203d456f2dbeca5239d0eaa7599de01"}, 0x69, 0x1) 5.112105373s ago: executing program 0 (id=2549): r0 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x1, 0x803, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r1, 0x2458a}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_FAIL_OVER_MAC={0x5, 0xd, 0x1}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000044}, 0x4000040) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2c0000001000010400000000fedbdf2500000000", @ANYRES32=r5, @ANYBLOB="00030000800000000a0001"], 0x2c}}, 0x884) 3.90267598s ago: executing program 4 (id=2550): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f000000e280)={0x2020}, 0x2020) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f000000e000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000845000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000507000/0x2000)=nil, &(0x7f000000e000/0x4000)=nil, &(0x7f0000fe9000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = io_uring_setup(0x1632, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) 3.654263312s ago: executing program 4 (id=2551): r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x2000000f5, 0x2) ioctl$vim2m_VIDIOC_G_FMT(r0, 0xc0d05604, &(0x7f0000000000)={0x2, @sliced={0x9, [0x8, 0x1, 0x2, 0x60, 0xaf, 0x1, 0x200, 0xc, 0xff, 0x80, 0xd65, 0x8, 0xffff, 0xff, 0x0, 0x7ff, 0x2, 0x16, 0x1, 0x1, 0x7fff, 0x2, 0x0, 0x7, 0x200, 0x8, 0x4, 0x9, 0x100, 0x8, 0x101, 0xad, 0x1, 0x6, 0x7, 0x7ff, 0x5a2, 0x5a, 0x0, 0x7, 0x97, 0x3, 0x8, 0x5, 0x9, 0x80, 0x800, 0x30], 0x8000}}) openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000300)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x7, 0xfa11, 0x7ff}, 0x0) r3 = socket$inet(0x2, 0x3, 0x9) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x400c000}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000020303000000000000"], 0x1c}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800"], 0xa8}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a14000000020a0506020000000000000000000007140000001100010000000000000000000000000abf08bfba86d940a23b5f8f0800b5c2522473ad089eb3d4040fc86fa5760f8692707c6259e5e1fa5dceca1730e4de7a2786974036740b1deb991601c408dcc2e639f6cb8cedec0dfc688e28b5cbbe662b3e3a36de87224299b6955337562eb68ac0a8c3a022aa45fb3d9a50ac3e88e0ece968fba6f0c908b78c856a05e43bbedc523138c6cdaa615d04187794605d52"], 0x3c}, 0x1, 0x0, 0x0, 0x2000094}, 0x80) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x4b, 0x1, 0xffffffff, 0x6, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x24040001) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000a40)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a4c000000030a0fdb00000000000000000a0020050900030073797a30000000000900010073797a310000000014000480080002403cb140bb08000140000000030a000700726f75746500000014000000110001"], 0x74}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) r7 = socket$kcm(0xa, 0x922000000003, 0x11) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a6c000000060a0b040000000000000000020000004000048018000180080001006f7366000c000280080001400000000424000180090001006d6574610000000014000280080002400000000c08000340000000150900010073797a30000000000900020073797a320000000014000000110001"], 0x94}}, 0x0) sendmsg$kcm(r7, &(0x7f0000000000)={&(0x7f0000000500)=@l2tp6={0xa, 0x0, 0x3, @loopback, 0x1, 0xfffffffe}, 0x80, 0x0}, 0x0) shutdown(r3, 0x0) recvmmsg(r3, &(0x7f00000066c0), 0xa0d, 0x0, 0x0) r9 = openat$audio(0xffffffffffffff9c, &(0x7f0000000200), 0xa2442, 0x0) ioctl$SNDCTL_DSP_SETFMT(r9, 0xc0045005, &(0x7f0000000040)=0x1000) ioctl$SNDCTL_DSP_SYNC(r9, 0x5001, 0x0) 3.580106792s ago: executing program 0 (id=2552): openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r0, &(0x7f00000060c0)=[{{0x0, 0x0, &(0x7f0000004d40)}}], 0x1, 0x10002, 0x0) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c045942824251d7d17b5191584bcd4fbe40a23424d", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1d19cb307b3472ab9cdb042d2", "643fcbb2c5a57df67d074af6e8dafe09"}}}}}}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000096c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x5, 0x0, 0x0, 0x60ff78ce1cb3c070}, 0x94) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000007300)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000006200)='syzkaller\x00', 0x7, 0x0, 0x0, 0x0, 0x4c, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 2.342130224s ago: executing program 0 (id=2553): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) close(0x3) r1 = socket(0x2, 0x80805, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r2, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x7a, &(0x7f0000000340)={r3, @in6={{0xa, 0x4e23, 0x4, @private0, 0x2}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r1, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30}], 0x1, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000080)={0x0, 0x8001}, &(0x7f00000000c0)=0x8) 1.849382803s ago: executing program 0 (id=2554): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5, r0}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) 250.74969ms ago: executing program 4 (id=2555): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000000)={@local}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r1, 0x7a8, &(0x7f0000000540)={{@hyper, 0x2}, @hyper, 0x0, 0x0, 0x5e}) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r2, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r2, 0x7a0, &(0x7f0000000240)={@hyper}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r2, 0x7a8, &(0x7f0000000540)={{@hyper, 0x2}, @hyper, 0x0, 0x0, 0x5e}) close_range(r0, 0xffffffffffffffff, 0x0) 167.045495ms ago: executing program 5 (id=2556): r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) ioctl$int_in(r1, 0x5421, &(0x7f0000000000)=0x5) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r1, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) r2 = epoll_create(0x4) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000200)={0x10}) connect$unix(r0, &(0x7f0000001140)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) close(0x3) 0s ago: executing program 5 (id=2557): ioperm(0x7, 0x81, 0x2) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x80000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x14b042, 0x0) splice(r1, 0x0, r2, 0x0, 0xa, 0x1) kernel console output (not intermixed with test programs): abled bearer , priority 0 [ 320.082491][ T8502] tipc: Resetting bearer [ 320.781723][ T8501] tipc: Resetting bearer [ 322.731987][ T8501] tipc: Disabling bearer [ 324.234446][ T1321] ieee802154 phy0 wpan0: encryption failed: -22 [ 324.234614][ T1321] ieee802154 phy1 wpan1: encryption failed: -22 [ 326.041949][ T5910] tipc: Node number set to 2622856955 [ 326.462063][ T37] audit: type=1800 audit(1776269326.653:17): pid=8553 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.5.903" name="file0" dev="overlay" ino=129 res=0 errno=0 [ 330.390112][ T8585] netlink: 12 bytes leftover after parsing attributes in process `syz.1.913'. [ 333.526060][ T8608] netlink: 8 bytes leftover after parsing attributes in process `syz.4.916'. [ 333.526223][ T8608] netlink: 20 bytes leftover after parsing attributes in process `syz.4.916'. [ 334.149388][ T8610] tipc: Enabled bearer , priority 0 [ 334.370963][ T8607] tipc: Resetting bearer [ 334.382539][ T5910] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 334.495254][ T8606] tipc: Disabling bearer [ 334.537180][ T5910] usb 2-1: unable to get BOS descriptor or descriptor too short [ 334.538777][ T5910] usb 2-1: config 1 interface 0 altsetting 12 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 334.538812][ T5910] usb 2-1: config 1 interface 0 has no altsetting 0 [ 334.566931][ T5910] usb 2-1: New USB device found, idVendor=07c0, idProduct=1125, bcdDevice= 0.40 [ 334.567032][ T5910] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 334.567103][ T5910] usb 2-1: Product: syz [ 334.567159][ T5910] usb 2-1: Manufacturer: syz [ 334.567215][ T5910] usb 2-1: SerialNumber: syz [ 334.650297][ T8612] mkiss: ax0: crc mode is auto. [ 336.761432][ T5910] usbhid 2-1:1.0: can't add hid device: -71 [ 336.761570][ T5910] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 336.785685][ T5910] usb 2-1: USB disconnect, device number 13 [ 338.653089][ T8620] netlink: 20 bytes leftover after parsing attributes in process `syz.3.920'. [ 338.791010][ T8618] netlink: 'syz.3.920': attribute type 2 has an invalid length. [ 341.984841][ T8659] netlink: 56 bytes leftover after parsing attributes in process `syz.4.932'. [ 341.988367][ T8659] netlink: 12 bytes leftover after parsing attributes in process `syz.4.932'. [ 341.988454][ T8659] netlink: 55 bytes leftover after parsing attributes in process `syz.4.932'. [ 343.560886][ T807] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 343.714135][ T807] usb 2-1: unable to get BOS descriptor or descriptor too short [ 343.715696][ T807] usb 2-1: config 1 interface 0 altsetting 12 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 343.715733][ T807] usb 2-1: config 1 interface 0 has no altsetting 0 [ 343.718860][ T807] usb 2-1: New USB device found, idVendor=07c0, idProduct=1125, bcdDevice= 0.40 [ 343.718892][ T807] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 343.718915][ T807] usb 2-1: Product: syz [ 343.718932][ T807] usb 2-1: Manufacturer: syz [ 343.718948][ T807] usb 2-1: SerialNumber: syz [ 345.741181][ T807] usb 2-1: can't set config #1, error -71 [ 345.772441][ T807] usb 2-1: USB disconnect, device number 14 [ 350.198152][ T8705] netlink: 20 bytes leftover after parsing attributes in process `syz.3.944'. [ 350.794070][ T1158] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 351.327907][ T36] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 351.696734][ T36] usb 2-1: Using ep0 maxpacket: 16 [ 351.699297][ T36] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 351.699349][ T36] usb 2-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 351.699374][ T36] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 352.636052][ T59] Bluetooth: hci1: command tx timeout [ 352.741017][ T36] usb 2-1: config 0 descriptor?? [ 353.536564][ T36] mcp2221 0003:04D8:00DD.0006: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.1-1/input0 [ 353.905865][ T1158] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 356.305630][ T1158] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 357.597370][ T36] usb 2-1: USB disconnect, device number 15 [ 357.640932][ T5910] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 357.792229][ T5910] usb 5-1: Using ep0 maxpacket: 8 [ 357.812992][ T5910] usb 5-1: unable to get BOS descriptor or descriptor too short [ 357.819649][ T5910] usb 5-1: config 236 has an invalid interface number: 121 but max is 0 [ 357.819679][ T5910] usb 5-1: config 236 has no interface number 0 [ 357.819714][ T5910] usb 5-1: config 236 interface 121 has no altsetting 0 [ 357.911407][ T5910] usb 5-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 0.02 [ 357.911443][ T5910] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 357.911466][ T5910] usb 5-1: Product: syz [ 357.911482][ T5910] usb 5-1: Manufacturer: syz [ 357.911497][ T5910] usb 5-1: SerialNumber: syz [ 358.384850][ T5910] usb 5-1: USB disconnect, device number 12 [ 358.582288][ T1158] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 359.372721][ T8758] netlink: 12 bytes leftover after parsing attributes in process `syz.5.960'. [ 360.433897][ T8772] tmpfs: Bad value for 'mpol' [ 367.516219][ T1230] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 368.070719][ T1230] usb 1-1: Using ep0 maxpacket: 16 [ 368.206018][ T1230] usb 1-1: device descriptor read/all, error -71 [ 369.751340][ T1230] usb 2-1: new full-speed USB device number 16 using dummy_hcd [ 369.832040][ T36] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 369.935160][ T1230] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 369.935194][ T1230] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 369.935235][ T1230] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice=1a.de [ 369.935260][ T1230] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 370.014415][ T1230] usb 2-1: config 0 descriptor?? [ 370.090681][ T36] usb 4-1: Using ep0 maxpacket: 16 [ 370.093305][ T36] usb 4-1: config index 0 descriptor too short (expected 65, got 36) [ 370.093364][ T36] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 370.093392][ T36] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 370.093420][ T36] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 370.093458][ T36] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 370.093501][ T36] usb 4-1: New USB device found, idVendor=1781, idProduct=0898, bcdDevice= 0.00 [ 370.093526][ T36] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 370.104688][ T36] usb 4-1: config 0 descriptor?? [ 370.106585][ T8817] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 370.124000][ T36] input: PXRC Flight Controller Adapter as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input10 [ 370.240826][ T1230] ath6kl: Failed to submit usb control message: -71 [ 370.240873][ T1230] ath6kl: unable to send the bmi data to the device: -71 [ 370.240888][ T1230] ath6kl: Unable to send get target info: -71 [ 370.319558][ T1230] ath6kl: Failed to init ath6kl core: -71 [ 370.320165][ T1230] ath6kl_usb 2-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 370.396537][ T1230] usb 2-1: USB disconnect, device number 16 [ 371.249416][ T36] usb 4-1: USB disconnect, device number 17 [ 371.249520][ C1] pxrc 4-1:0.0: pxrc_usb_irq - usb_submit_urb failed with result: -19 [ 371.790764][ T5867] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 371.959311][ T5867] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 371.959334][ T5867] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 372.003142][ T5867] usb 1-1: New USB device found, idVendor=0d8c, idProduct=0014, bcdDevice= 0.40 [ 372.003175][ T5867] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 372.003197][ T5867] usb 1-1: Product: syz [ 372.003212][ T5867] usb 1-1: Manufacturer: syz [ 372.003228][ T5867] usb 1-1: SerialNumber: syz [ 372.320298][ T5867] usb 1-1: 0:1 : does not exist [ 372.333980][ T5867] usb 1-1: 3:0: failed to get current value for ch 0 (-71) [ 372.336184][ T5867] usb 1-1: unit 0 not found! [ 372.396961][ T1158] bridge_slave_1: left allmulticast mode [ 372.430011][ T1158] bridge_slave_1: left promiscuous mode [ 372.580349][ T1158] bridge0: port 2(bridge_slave_1) entered disabled state [ 372.970279][ T1158] bridge_slave_0: left allmulticast mode [ 372.970313][ T1158] bridge_slave_0: left promiscuous mode [ 373.190837][ T1158] bridge0: port 1(bridge_slave_0) entered disabled state [ 373.322558][ T5867] usb 1-1: USB disconnect, device number 15 [ 374.070451][ T6177] udevd[6177]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 379.041454][ T36] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 379.290796][ T36] usb 1-1: Using ep0 maxpacket: 8 [ 379.292738][ T36] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 379.292800][ T36] usb 1-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 379.292819][ T36] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 379.297622][ T36] usb 1-1: config 0 descriptor?? [ 379.330727][ T5910] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 379.351001][ T36] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 379.496617][ T5910] usb 5-1: unable to get BOS descriptor or descriptor too short [ 379.498211][ T5910] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 379.498312][ T5910] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 50, changing to 7 [ 379.498358][ T5910] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 379.498387][ T5910] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 379.567490][ T5910] usb 5-1: New USB device found, idVendor=2b53, idProduct=0024, bcdDevice= 0.40 [ 379.567525][ T5910] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 379.567546][ T5910] usb 5-1: Product: syz [ 379.567561][ T5910] usb 5-1: Manufacturer: syz [ 379.567576][ T5910] usb 5-1: SerialNumber: syz [ 379.950070][ T36] gspca_vc032x: reg_w err -71 [ 379.950188][ T36] vc032x 1-1:0.0: probe with driver vc032x failed with error -71 [ 379.984814][ T36] usb 1-1: USB disconnect, device number 16 [ 380.976496][ T1158] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 381.443533][ T1158] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 382.223403][ T1158] bond0 (unregistering): Released all slaves [ 382.270376][ T5910] usb 5-1: USB disconnect, device number 13 [ 382.299325][ T8911] netlink: 168 bytes leftover after parsing attributes in process `syz.4.1013'. [ 383.077725][ T1158] tipc: Left network mode [ 383.949058][ T8944] ALSA: mixer_oss: invalid OSS volume '' [ 383.949083][ T8944] ALSA: mixer_oss: invalid OSS volume '[sRkz1+eZu;' [ 383.949115][ T8944] ALSA: mixer_oss: invalid OSS volume '#F!c)7 -!6P4X1u' [ 383.949141][ T8944] ALSA: mixer_oss: invalid OSS volume 'mٗ0 2"\d˽ha1' [ 383.949165][ T8944] ALSA: mixer_oss: invalid OSS volume ']-]zQTU' [ 383.949196][ T8944] ALSA: mixer_oss: invalid OSS volume 'qdhK' [ 383.949216][ T8944] ALSA: mixer_oss: invalid OSS volume 'f|o`wg|zsݷN@6f' [ 383.949252][ T8944] ALSA: mixer_oss: invalid OSS volume 'g' [ 383.949274][ T8944] ALSA: mixer_oss: invalid OSS volume 'Hb0r2Q64dpZoȝ' [ 383.949336][ T8944] ALSA: mixer_oss: invalid OSS volume 'Fm[#}Îr}[* ' [ 383.949352][ T8944] ALSA: mixer_oss: invalid OSS volume 'O."]j#H)XU^d' [ 383.949369][ T8944] ALSA: mixer_oss: invalid OSS volume ')Qk' [ 383.949389][ T8944] ALSA: mixer_oss: invalid OSS volume '[B,PV#ìbjVf-r*'Z' [ 383.949407][ T8944] ALSA: mixer_oss: invalid OSS volume 'wމF6FlCĜJF=' [ 383.949433][ T8944] ALSA: mixer_oss: invalid OSS volume '3j+鼺Jrs' [ 383.949454][ T8944] ALSA: mixer_oss: invalid OSS volume '7=8&ul:u7*;|VA+s4' [ 383.949477][ T8944] ALSA: mixer_oss: invalid OSS volume '[+Tx=y4hhMS]/(1' [ 383.949516][ T8944] ALSA: mixer_oss: invalid OSS volume 'UD4n' [ 383.949537][ T8944] ALSA: mixer_oss: invalid OSS volume 'Б*'fԏ]ft<+O[' [ 383.949556][ T8944] ALSA: mixer_oss: invalid OSS volume '%' [ 384.350132][ T8957] overlayfs: conflicting options: userxattr,redirect_dir=follow [ 385.143231][ T1321] ieee802154 phy0 wpan0: encryption failed: -22 [ 385.143309][ T1321] ieee802154 phy1 wpan1: encryption failed: -22 [ 385.273763][ T8974] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1036'. [ 387.753183][ T8967] gre1: entered promiscuous mode [ 392.587230][ T9053] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1057'. [ 392.587258][ T9053] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1057'. [ 392.587280][ T9053] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1057'. [ 392.587299][ T9053] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1057'. [ 393.932080][ T1158] hsr_slave_0: left promiscuous mode [ 394.055072][ T37] audit: type=1326 audit(1776269394.453:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9074 comm="syz.1.1067" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f660a83c819 code=0x7ffc0000 [ 394.057589][ T1158] hsr_slave_1: left promiscuous mode [ 394.121243][ T37] audit: type=1326 audit(1776269394.463:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9074 comm="syz.1.1067" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f660a83c819 code=0x7ffc0000 [ 394.187914][ T37] audit: type=1326 audit(1776269394.573:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9074 comm="syz.1.1067" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f660a83c819 code=0x7ffc0000 [ 394.187973][ T37] audit: type=1326 audit(1776269394.583:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9074 comm="syz.1.1067" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f660a83c819 code=0x7ffc0000 [ 394.188016][ T37] audit: type=1326 audit(1776269394.583:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9074 comm="syz.1.1067" exe="/root/syz-executor" sig=0 arch=c000003e syscall=114 compat=0 ip=0x7f660a83c819 code=0x7ffc0000 [ 394.188059][ T37] audit: type=1326 audit(1776269394.583:23): auid=4294967295 uid=0 gid=60928 ses=4294967295 subj=_ pid=9074 comm="syz.1.1067" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f660a83c819 code=0x7ffc0000 [ 394.188097][ T37] audit: type=1326 audit(1776269394.583:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9074 comm="syz.1.1067" exe="/root/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f660a83c819 code=0x7ffc0000 [ 394.188133][ T37] audit: type=1326 audit(1776269394.583:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9074 comm="syz.1.1067" exe="/root/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7f660a83c819 code=0x7ffc0000 [ 394.449601][ T1158] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 394.560986][ T1158] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 394.894464][ T1158] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 394.894496][ T1158] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 395.687366][ T1158] veth1_macvtap: left promiscuous mode [ 395.730362][ T1158] veth0_macvtap: left promiscuous mode [ 395.790244][ T1158] veth1_vlan: left promiscuous mode [ 395.840116][ T1158] veth0_vlan: left promiscuous mode [ 397.226739][ T9121] netlink: 'syz.3.1085': attribute type 30 has an invalid length. [ 398.491598][ T9079] netlink: 'syz.4.1069': attribute type 1 has an invalid length. [ 398.496694][ T5458] 8021q: adding VLAN 0 to HW filter on device eth1 [ 398.923232][ T9121] bond2: option arp_missed_max: invalid value (0) [ 398.923372][ T9121] bond2: option arp_missed_max: allowed values 1 - 255 [ 399.707114][ T9121] bond2 (unregistering): Released all slaves [ 400.166775][ T9159] netlink: 1047 bytes leftover after parsing attributes in process `syz.1.1099'. [ 400.452803][ T9166] netlink: 'syz.1.1102': attribute type 1 has an invalid length. [ 403.173194][ T9210] syz.1.1117: vmalloc error: size 70368744185856, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 403.173605][ T9210] CPU: 0 UID: 0 PID: 9210 Comm: syz.1.1117 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 403.173638][ T9210] Tainted: [L]=SOFTLOCKUP [ 403.173646][ T9210] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 403.173669][ T9210] Call Trace: [ 403.173678][ T9210] [ 403.173688][ T9210] dump_stack_lvl+0xe8/0x150 [ 403.173731][ T9210] warn_alloc+0x263/0x3e0 [ 403.173764][ T9210] ? kasan_save_track+0x4f/0x80 [ 403.173791][ T9210] ? kasan_save_track+0x3e/0x80 [ 403.173816][ T9210] ? kasan_save_free_info+0x46/0x50 [ 403.173835][ T9210] ? __kasan_slab_free+0x5c/0x80 [ 403.173862][ T9210] ? tomoyo_path_number_perm+0x501/0x630 [ 403.173894][ T9210] ? security_file_ioctl+0xc3/0x2a0 [ 403.173926][ T9210] ? __se_sys_ioctl+0x47/0x170 [ 403.173959][ T9210] ? __pfx_warn_alloc+0x10/0x10 [ 403.174012][ T9210] __vmalloc_node_range_noprof+0x132/0x1730 [ 403.174040][ T9210] ? register_lock_class+0x31/0x2e0 [ 403.174069][ T9210] ? __lock_acquire+0x6b5/0x2cf0 [ 403.174102][ T9210] ? kasan_quarantine_put+0xbb/0x1f0 [ 403.174141][ T9210] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 403.174185][ T9210] ? dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 403.174224][ T9210] vmalloc_noprof+0xb2/0xe0 [ 403.174253][ T9210] ? dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 403.174296][ T9210] dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 403.174333][ T9210] ? dvb_demux_do_ioctl+0x323/0x540 [ 403.174371][ T9210] dvb_demux_do_ioctl+0x460/0x540 [ 403.174411][ T9210] dvb_usercopy+0x199/0x2e0 [ 403.174450][ T9210] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 403.174486][ T9210] ? __pfx_dvb_usercopy+0x10/0x10 [ 403.174532][ T9210] ? __fget_files+0x3a6/0x420 [ 403.174556][ T9210] ? __fget_files+0x2a/0x420 [ 403.174583][ T9210] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 403.174618][ T9210] dvb_demux_ioctl+0x29/0x40 [ 403.174653][ T9210] __se_sys_ioctl+0xff/0x170 [ 403.174683][ T9210] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 403.174709][ T9210] do_syscall_64+0x15f/0xf80 [ 403.174732][ T9210] ? trace_irq_disable+0x3b/0x140 [ 403.174765][ T9210] ? clear_bhb_loop+0x40/0x90 [ 403.174794][ T9210] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 403.174823][ T9210] RIP: 0033:0x7f660a83c819 [ 403.174852][ T9210] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 403.174874][ T9210] RSP: 002b:00007f6608a96028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 403.174899][ T9210] RAX: ffffffffffffffda RBX: 00007f660aab5fa0 RCX: 00007f660a83c819 [ 403.174916][ T9210] RDX: 0000400000002000 RSI: 0000000000006f2d RDI: 0000000000000003 [ 403.174931][ T9210] RBP: 00007f660a8d2c91 R08: 0000000000000000 R09: 0000000000000000 [ 403.174946][ T9210] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 403.174960][ T9210] R13: 00007f660aab6038 R14: 00007f660aab5fa0 R15: 00007ffdd3ebbde8 [ 403.174997][ T9210] [ 403.175041][ T9210] Mem-Info: [ 403.175052][ T9210] active_anon:3120 inactive_anon:23394 isolated_anon:0 [ 403.175052][ T9210] active_file:18630 inactive_file:42766 isolated_file:0 [ 403.175052][ T9210] unevictable:768 dirty:207 writeback:0 [ 403.175052][ T9210] slab_reclaimable:11910 slab_unreclaimable:105955 [ 403.175052][ T9210] mapped:30320 shmem:21194 pagetables:1297 [ 403.175052][ T9210] sec_pagetables:0 bounce:0 [ 403.175052][ T9210] kernel_misc_reclaimable:0 [ 403.175052][ T9210] free:1284865 free_pcp:5231 free_cma:0 [ 403.175115][ T9210] Node 0 active_anon:12480kB inactive_anon:93576kB active_file:74304kB inactive_file:171064kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:121280kB dirty:828kB writeback:0kB shmem:83240kB kernel_stack:13108kB pagetables:5052kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 403.175170][ T9210] Node 1 active_anon:0kB inactive_anon:0kB active_file:216kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB kernel_stack:32kB pagetables:136kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 403.175224][ T9210] Node 0 DMA free:15360kB boost:0kB min:20kB low:32kB high:44kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 403.175293][ T9210] lowmem_reserve[]: 0 2505 2505 2505 2505 [ 403.175334][ T9210] Node 0 DMA32 free:1187260kB boost:0kB min:3928kB low:6464kB high:9000kB reserved_highatomic:0KB free_highatomic:0KB active_anon:12480kB inactive_anon:93576kB active_file:74304kB inactive_file:171064kB unevictable:1536kB writepending:828kB zspages:0kB present:3129332kB managed:2565376kB mlocked:0kB bounce:0kB free_pcp:20924kB local_pcp:1248kB free_cma:0kB [ 403.175406][ T9210] lowmem_reserve[]: 0 0 0 0 0 [ 403.175453][ T9210] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:152kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 403.175519][ T9210] lowmem_reserve[]: 0 0 0 0 0 [ 403.175558][ T9210] Node 1 Normal free:3936840kB boost:0kB min:6368kB low:10476kB high:14584kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:216kB inactive_file:0kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 403.175628][ T9210] lowmem_reserve[]: 0 0 0 0 0 [ 403.175666][ T9210] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 403.847223][ T9210] Node 0 DMA32: 618*4kB (UE) 1826*8kB (UME) 1190*16kB (UME) 561*32kB (UME) 392*64kB (UME) 194*128kB (UME) 123*256kB (UME) 66*512kB (UME) 28*1024kB (UM) 23*2048kB (UME) 230*4096kB (M) = 1187128kB [ 403.847419][ T9210] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 403.848059][ T9210] Node 1 Normal: 4*4kB (U) 7*8kB (UM) 8*16kB (UM) 10*32kB (UM) 7*64kB (UM) 5*128kB (UM) 2*256kB (M) 3*512kB (UM) 1*1024kB (M) 0*2048kB 960*4096kB (UM) = 3936840kB [ 403.848256][ T9210] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 403.848276][ T9210] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 403.848297][ T9210] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 403.848317][ T9210] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 403.848336][ T9210] 80661 total pagecache pages [ 403.848349][ T9210] 0 pages in swap cache [ 403.848358][ T9210] Free swap = 124996kB [ 403.848372][ T9210] Total swap = 124996kB [ 403.848381][ T9210] 2097051 pages RAM [ 403.848390][ T9210] 0 pages HighMem/MovableOnly [ 403.848398][ T9210] 424054 pages reserved [ 403.848406][ T9210] 0 pages cma reserved [ 404.194107][ T37] audit: type=1326 audit(1776269404.593:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9218 comm="syz.3.1120" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbf3ba8c819 code=0x7ffc0000 [ 404.194212][ T37] audit: type=1326 audit(1776269404.593:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9218 comm="syz.3.1120" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbf3ba8c819 code=0x7ffc0000 [ 404.254236][ T37] audit: type=1326 audit(1776269404.653:28): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9218 comm="syz.3.1120" exe="/root/syz-executor" sig=0 arch=c000003e syscall=106 compat=0 ip=0x7fbf3ba8c819 code=0x7ffc0000 [ 404.257535][ T37] audit: type=1326 audit(1776269404.653:29): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9218 comm="syz.3.1120" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbf3ba8c819 code=0x7ffc0000 [ 404.257603][ T37] audit: type=1326 audit(1776269404.653:30): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9218 comm="syz.3.1120" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbf3ba8c819 code=0x7ffc0000 [ 407.609869][ T9271] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1139'. [ 407.913257][ T9280] tmpfs: Bad value for 'mpol' [ 408.195288][ T5458] 8021q: adding VLAN 0 to HW filter on device eth2 [ 408.366504][ T9296] ieee802154 phy0 wpan0: encryption failed: -22 [ 409.949712][ T9328] netlink: 'syz.5.1161': attribute type 12 has an invalid length. [ 409.955019][ T9323] geneve2: entered promiscuous mode [ 410.070165][ T7020] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 410.070227][ T7020] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 410.070272][ T7020] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 410.070316][ T7020] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 410.358373][ T9340] netlink: 36 bytes leftover after parsing attributes in process `syz.5.1164'. [ 410.358407][ T9340] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1164'. [ 410.500748][ T9348] netlink: 'syz.1.1168': attribute type 10 has an invalid length. [ 410.500773][ T9348] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1168'. [ 410.903275][ T9348] dummy0: entered promiscuous mode [ 411.824809][ T9348] bridge0: port 2(dummy0) entered blocking state [ 411.825002][ T9348] bridge0: port 2(dummy0) entered disabled state [ 411.825463][ T9348] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 411.973999][ T37] audit: type=1326 audit(1776269412.373:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9366 comm="syz.4.1175" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe7850fc819 code=0x7ffc0000 [ 411.978681][ T37] audit: type=1326 audit(1776269412.373:32): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9366 comm="syz.4.1175" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe7850fc819 code=0x7ffc0000 [ 412.036084][ T37] audit: type=1326 audit(1776269412.433:33): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9366 comm="syz.4.1175" exe="/root/syz-executor" sig=0 arch=c000003e syscall=247 compat=0 ip=0x7fe7850fc819 code=0x7ffc0000 [ 412.036175][ T37] audit: type=1326 audit(1776269412.433:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9366 comm="syz.4.1175" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe7850fc819 code=0x7ffc0000 [ 412.036237][ T37] audit: type=1326 audit(1776269412.433:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9366 comm="syz.4.1175" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe7850fc819 code=0x7ffc0000 [ 412.210804][ T807] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 412.241687][ T9371] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1176'. [ 412.358281][ T5458] 8021q: adding VLAN 0 to HW filter on device eth3 [ 412.423544][ T807] usb 6-1: unable to get BOS descriptor or descriptor too short [ 412.426614][ T807] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 8 [ 412.426651][ T807] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 16 [ 412.476270][ T807] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 412.476307][ T807] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 412.476332][ T807] usb 6-1: Product: syz [ 412.476350][ T807] usb 6-1: Manufacturer: syz [ 412.476368][ T807] usb 6-1: SerialNumber: syz [ 412.828300][ T807] cdc_ncm 6-1:1.0: bind() failure [ 412.863940][ T5177] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 413.496718][ T5177] usb 2-1: Using ep0 maxpacket: 32 [ 413.518700][ T5177] usb 2-1: config 239 has an invalid descriptor of length 0, skipping remainder of the config [ 413.518732][ T5177] usb 2-1: config 239 has 1 interface, different from the descriptor's value: 3 [ 413.573390][ T5177] usb 2-1: New USB device found, idVendor=0582, idProduct=003b, bcdDevice= 0.40 [ 413.573426][ T5177] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 413.573449][ T5177] usb 2-1: Product: syz [ 413.573466][ T5177] usb 2-1: Manufacturer: syz [ 413.573483][ T5177] usb 2-1: SerialNumber: syz [ 413.743675][ T807] cdc_ncm 6-1:1.1: CDC Union missing and no IAD found [ 413.743728][ T807] cdc_ncm 6-1:1.1: bind() failure [ 414.018127][ T807] usb 6-1: USB disconnect, device number 5 [ 414.130298][ T5177] usb 2-1: unit 2 not found! [ 414.235907][ T9394] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1184'. [ 414.330834][ T5177] usb 2-1: USB disconnect, device number 17 [ 415.286976][ T9413] netdevsim netdevsim4 5@: renamed from netdevsim0 (while UP) [ 415.855652][ T6177] udevd[6177]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:239.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 416.124853][ T9434] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 416.290705][ T5177] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 416.518826][ T5177] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 416.518863][ T5177] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 416.518884][ T5177] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 416.518939][ T5177] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 416.577667][ T5177] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 416.577707][ T5177] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 416.577730][ T5177] usb 1-1: Product: syz [ 416.577747][ T5177] usb 1-1: Manufacturer: syz [ 416.641836][ T5177] cdc_wdm 1-1:1.0: skipping garbage [ 416.641864][ T5177] cdc_wdm 1-1:1.0: skipping garbage [ 416.666236][ T5177] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 416.666265][ T5177] cdc_wdm 1-1:1.0: Unknown control protocol [ 417.558616][ T5458] 8021q: adding VLAN 0 to HW filter on device eth4 [ 419.347362][ T5887] usb 1-1: USB disconnect, device number 17 [ 419.753027][ T5177] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 419.866151][ T9482] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 419.866180][ T9482] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 419.866226][ T9482] hsr0: entered promiscuous mode [ 419.866259][ T9482] hsr0: entered allmulticast mode [ 419.866274][ T9482] hsr_slave_0: entered allmulticast mode [ 419.866293][ T9482] hsr_slave_1: entered allmulticast mode [ 419.932201][ T5177] usb 5-1: Using ep0 maxpacket: 16 [ 419.948665][ T5177] usb 5-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 2.00 [ 419.948697][ T5177] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 419.991873][ T5177] usb 5-1: config 0 descriptor?? [ 420.009993][ T5177] ftdi_sio 5-1:0.0: FTDI USB Serial Device converter detected [ 420.307322][ T5177] usb 5-1: Detected FT232B [ 420.510086][ T5177] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 420.518980][ T5177] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 420.628991][ T5177] usb 5-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 421.041214][ T5177] usb 5-1: USB disconnect, device number 14 [ 421.624241][ T5177] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 421.653673][ T5177] ftdi_sio 5-1:0.0: device disconnected [ 423.318971][ T9521] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1228'. [ 425.266885][ T9555] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1242'. [ 425.266911][ T9555] netlink: 348 bytes leftover after parsing attributes in process `syz.4.1242'. [ 425.266934][ T9555] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1242'. [ 425.266950][ T9555] netlink: 348 bytes leftover after parsing attributes in process `syz.4.1242'. [ 425.267114][ T9555] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1242'. [ 425.699434][ T9555] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1242'. [ 425.699460][ T9555] netlink: 348 bytes leftover after parsing attributes in process `syz.4.1242'. [ 425.699484][ T9555] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1242'. [ 425.699500][ T9555] netlink: 348 bytes leftover after parsing attributes in process `syz.4.1242'. [ 428.978998][ T9628] __nla_validate_parse: 7 callbacks suppressed [ 428.979024][ T9628] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1270'. [ 430.002380][ T9646] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1276'. [ 430.002458][ T9646] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1276'. [ 432.363213][ T9696] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1289'. [ 432.509073][ T9699] tipc: Enabling of bearer rejected, failed to enable media [ 434.519474][ T9719] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1300'. [ 434.519494][ T9719] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1300'. [ 434.896000][ T9725] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1301'. [ 435.914174][ T9745] tipc: Enabling of bearer rejected, failed to enable media [ 438.633542][ T9787] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1319'. [ 439.868769][ T9804] tipc: Enabling of bearer rejected, failed to enable media [ 442.326326][ T9848] tipc: Enabling of bearer rejected, failed to enable media [ 442.952255][ T5910] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 443.706676][ T5910] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 443.706719][ T5910] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 443.706765][ T5910] usb 1-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 443.706791][ T5910] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 443.770351][ T5910] usb 1-1: config 0 descriptor?? [ 444.278895][ T5910] playstation 0003:054C:0DF2.0007: global environment stack underflow [ 444.278920][ T5910] playstation 0003:054C:0DF2.0007: item 0 2 1 11 parsing failed [ 444.279755][ T5910] playstation 0003:054C:0DF2.0007: Parse failed [ 444.279838][ T5910] playstation 0003:054C:0DF2.0007: probe with driver playstation failed with error -22 [ 444.370646][ T807] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 444.511503][ T5910] usb 1-1: USB disconnect, device number 18 [ 444.520630][ T807] usb 4-1: Using ep0 maxpacket: 8 [ 444.543340][ T807] usb 4-1: unable to get BOS descriptor or descriptor too short [ 444.544928][ T807] usb 4-1: config 4 interface 0 has no altsetting 0 [ 444.574812][ T807] usb 4-1: string descriptor 0 read error: -22 [ 444.574919][ T807] usb 4-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 444.574945][ T807] usb 4-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 444.655618][ T807] usb 4-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 444.674933][ T807] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 444.675369][ T807] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 444.675421][ T807] usb 4-1: media controller created [ 444.731127][ T807] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 446.213582][ T5910] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 446.821146][ T807] zl10353_read_register: readreg error (reg=127, ret==0) [ 446.823228][ T1321] ieee802154 phy0 wpan0: encryption failed: -22 [ 446.823290][ T1321] ieee802154 phy1 wpan1: encryption failed: -22 [ 446.942589][ T5910] usb 2-1: Using ep0 maxpacket: 32 [ 446.945022][ T5910] usb 2-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 446.945056][ T5910] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 446.996571][ T5910] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 447.350303][ T5910] gspca_nw80x: reg_w err -71 [ 447.350413][ T5910] nw80x 2-1:3.0: probe with driver nw80x failed with error -71 [ 447.380708][ T5910] usb 2-1: USB disconnect, device number 18 [ 447.822051][ T807] usb 4-1: USB disconnect, device number 18 [ 448.108435][ T9936] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1366'. [ 450.028022][ T9954] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1373'. [ 452.900715][ T5910] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 453.091316][ T5910] usb 1-1: Using ep0 maxpacket: 32 [ 453.094779][ T5910] usb 1-1: unable to get BOS descriptor or descriptor too short [ 453.096389][ T5910] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 453.096442][ T5910] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 453.161385][ T5910] usb 1-1: New USB device found, idVendor=04fa, idProduct=4201, bcdDevice= 0.40 [ 453.161420][ T5910] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 453.161442][ T5910] usb 1-1: Product: syz [ 453.161458][ T5910] usb 1-1: Manufacturer: syz [ 453.161475][ T5910] usb 1-1: SerialNumber: syz [ 453.577772][ T5910] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 453.577845][ T5910] usb 1-1: MIDIStreaming interface descriptor not found [ 455.736736][ T5910] usb 1-1: USB disconnect, device number 19 [ 455.963428][T10027] syzkaller0: entered promiscuous mode [ 455.963457][T10027] syzkaller0: entered allmulticast mode [ 456.216627][T10031] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1400'. [ 456.858082][ T5813] udevd[5813]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 457.100743][ T5910] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 457.100915][ T1230] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 457.260838][ T1230] usb 4-1: Using ep0 maxpacket: 8 [ 457.262023][ T1230] usb 4-1: too many configurations: 123, using maximum allowed: 8 [ 457.263605][ T1230] usb 4-1: config 0 has too many interfaces: 117, using maximum allowed: 32 [ 457.263632][ T1230] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 457.263652][ T1230] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 117 [ 457.263675][ T1230] usb 4-1: config 0 has no interface number 0 [ 457.264869][ T1230] usb 4-1: config 0 has too many interfaces: 117, using maximum allowed: 32 [ 457.264895][ T1230] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 457.264916][ T1230] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 117 [ 457.264939][ T1230] usb 4-1: config 0 has no interface number 0 [ 457.266088][ T1230] usb 4-1: config 0 has too many interfaces: 117, using maximum allowed: 32 [ 457.266113][ T1230] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 457.266134][ T1230] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 117 [ 457.266157][ T1230] usb 4-1: config 0 has no interface number 0 [ 457.270299][ T1230] usb 4-1: config 0 has too many interfaces: 117, using maximum allowed: 32 [ 457.270329][ T1230] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 457.270350][ T1230] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 117 [ 457.270373][ T1230] usb 4-1: config 0 has no interface number 0 [ 457.280791][ T5910] usb 1-1: Using ep0 maxpacket: 8 [ 457.434002][ T1230] usb 4-1: config 0 has too many interfaces: 117, using maximum allowed: 32 [ 457.434024][ T1230] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 457.434038][ T1230] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 117 [ 457.434054][ T1230] usb 4-1: config 0 has no interface number 0 [ 457.435995][ T1230] usb 4-1: config 0 has too many interfaces: 117, using maximum allowed: 32 [ 457.436015][ T1230] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 457.436029][ T1230] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 117 [ 457.436045][ T1230] usb 4-1: config 0 has no interface number 0 [ 457.437288][ T1230] usb 4-1: config 0 has too many interfaces: 117, using maximum allowed: 32 [ 457.437321][ T1230] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 457.437335][ T1230] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 117 [ 457.437403][ T1230] usb 4-1: config 0 has no interface number 0 [ 457.438586][ T1230] usb 4-1: config 0 has too many interfaces: 117, using maximum allowed: 32 [ 457.438617][ T1230] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 457.438631][ T1230] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 117 [ 457.438693][ T1230] usb 4-1: config 0 has no interface number 0 [ 457.440049][ T1230] usb 4-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 0.00 [ 457.440069][ T1230] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=45 [ 457.440084][ T1230] usb 4-1: SerialNumber: syz [ 457.605129][ T5910] usb 1-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 457.605162][ T5910] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 457.605177][ T5910] usb 1-1: Product: syz [ 457.605188][ T5910] usb 1-1: Manufacturer: syz [ 457.605199][ T5910] usb 1-1: SerialNumber: syz [ 457.662903][ T1230] usb 4-1: config 0 descriptor?? [ 457.684216][ T5910] usb 1-1: config 0 descriptor?? [ 457.935834][ T5910] gspca_main: se401-2.14.0 probing 047d:5003 [ 457.946962][ T1230] gspca_main: 0000:0000 too many config [ 458.169338][ T1230] usb 4-1: USB disconnect, device number 19 [ 458.413404][ T5910] gspca_se401: Bayer format not supported! [ 458.447128][T10069] sp0: Synchronizing with TNC [ 458.484227][T10068] [U] ` [ 458.669444][ T1230] usb 1-1: USB disconnect, device number 20 [ 459.246895][T10076] macsec1: entered promiscuous mode [ 459.246921][T10076] bond0: entered promiscuous mode [ 459.246937][T10076] bond_slave_0: entered promiscuous mode [ 459.247188][T10076] bond_slave_1: entered promiscuous mode [ 459.298922][T10076] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 459.368776][T10076] bond0: left promiscuous mode [ 459.368796][T10076] bond_slave_0: left promiscuous mode [ 459.369067][T10076] bond_slave_1: left promiscuous mode [ 459.950705][T10106] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1431'. [ 459.950732][T10106] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1431'. [ 459.950746][T10106] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1431'. [ 459.954875][T10107] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1433'. [ 460.704678][T10115] team0: Device is already in use. [ 461.588604][ T5177] kernel write not supported for file /amidi2 (pid: 5177 comm: kworker/1:3) [ 465.195784][T10204] netlink: 7060 bytes leftover after parsing attributes in process `syz.5.1471'. [ 465.232108][T10200] bridge0: entered promiscuous mode [ 465.500727][T10200] bridge0: port 3(macvlan2) entered blocking state [ 465.529632][T10200] bridge0: port 3(macvlan2) entered disabled state [ 465.530130][T10200] macvlan2: entered allmulticast mode [ 465.530151][T10200] bridge0: entered allmulticast mode [ 465.596021][T10200] macvlan2: left allmulticast mode [ 465.596054][T10200] bridge0: left allmulticast mode [ 465.599064][T10200] bridge0: left promiscuous mode [ 467.361216][T10228] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1479'. [ 467.461512][ T37] audit: type=1326 audit(1776269467.863:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10232 comm="syz.1.1481" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f660a83c819 code=0x7ffc0000 [ 467.461690][ T37] audit: type=1326 audit(1776269467.863:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10232 comm="syz.1.1481" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f660a83c819 code=0x7ffc0000 [ 467.525346][ T37] audit: type=1326 audit(1776269467.923:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10232 comm="syz.1.1481" exe="/root/syz-executor" sig=0 arch=c000003e syscall=88 compat=0 ip=0x7f660a83c819 code=0x7ffc0000 [ 467.525388][ T37] audit: type=1326 audit(1776269467.923:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10232 comm="syz.1.1481" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f660a83c819 code=0x7ffc0000 [ 467.525422][ T37] audit: type=1326 audit(1776269467.923:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10232 comm="syz.1.1481" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f660a83c819 code=0x7ffc0000 [ 467.780612][ T37] audit: type=1326 audit(1776269467.923:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10232 comm="syz.1.1481" exe="/root/syz-executor" sig=0 arch=c000003e syscall=189 compat=0 ip=0x7f660a83c819 code=0x7ffc0000 [ 467.784387][ T37] audit: type=1326 audit(1776269468.173:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10232 comm="syz.1.1481" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f660a83c819 code=0x7ffc0000 [ 469.142408][ T1230] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 469.480631][ T1230] usb 4-1: Using ep0 maxpacket: 32 [ 469.483227][ T1230] usb 4-1: config 0 has no interfaces? [ 469.492763][ T1230] usb 4-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice=88.73 [ 469.492797][ T1230] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 469.492820][ T1230] usb 4-1: Product: syz [ 469.492836][ T1230] usb 4-1: Manufacturer: syz [ 469.492852][ T1230] usb 4-1: SerialNumber: syz [ 469.570431][ T1230] usb 4-1: config 0 descriptor?? [ 469.736864][T10255] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1488'. [ 469.807092][ T5177] usb 4-1: USB disconnect, device number 20 [ 470.141036][ T1230] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 470.290625][ T1230] usb 1-1: Using ep0 maxpacket: 8 [ 470.296633][ T1230] usb 1-1: unable to get BOS descriptor or descriptor too short [ 470.299634][ T1230] usb 1-1: config 4 has an invalid interface number: 147 but max is 0 [ 470.299665][ T1230] usb 1-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 470.299686][ T1230] usb 1-1: config 4 has no interface number 0 [ 470.353172][ T1230] usb 1-1: New USB device found, idVendor=04f2, idProduct=b746, bcdDevice=8e.6e [ 470.353205][ T1230] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 470.353226][ T1230] usb 1-1: Product: syz [ 470.353241][ T1230] usb 1-1: Manufacturer: syz [ 470.353258][ T1230] usb 1-1: SerialNumber: syz [ 470.671720][ T1230] uvcvideo 1-1:4.147: Found UVC 0.00 device syz (04f2:b746) [ 470.671760][ T1230] uvcvideo 1-1:4.147: No valid video chain found. [ 470.698073][ T1230] usb 1-1: USB disconnect, device number 21 [ 474.260887][ T59] Bluetooth: hci1: command 0x0406 tx timeout [ 474.712270][ T807] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 474.887941][ T807] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 474.887972][ T807] usb 4-1: config 0 has no interface number 0 [ 474.888038][ T807] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 474.888067][ T807] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 474.888108][ T807] usb 4-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.00 [ 474.888134][ T807] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 474.914816][ T807] usb 4-1: config 0 descriptor?? [ 476.538169][ T807] prodikeys 0003:041E:2801.0008: item fetching failed at offset 5/7 [ 476.539012][ T807] prodikeys 0003:041E:2801.0008: hid parse failed [ 476.539136][ T807] prodikeys 0003:041E:2801.0008: probe with driver prodikeys failed with error -22 [ 476.665427][T10366] tap0: tun_chr_ioctl cmd 2147767506 [ 476.740117][ T1230] usb 4-1: USB disconnect, device number 21 [ 477.756247][T10393] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1548'. [ 477.756280][T10393] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1548'. [ 477.797111][T10392] netlink: 4560 bytes leftover after parsing attributes in process `syz.3.1547'. [ 477.797146][T10392] netlink: 4560 bytes leftover after parsing attributes in process `syz.3.1547'. [ 478.275551][ T807] usb 5-1: new full-speed USB device number 15 using dummy_hcd [ 478.443706][ T807] usb 5-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 478.443741][ T807] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 478.468832][ T807] usb 5-1: config 0 descriptor?? [ 478.550644][ T1230] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 478.688117][ T807] udl 5-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 478.700641][ T1230] usb 4-1: Using ep0 maxpacket: 16 [ 478.729000][ T1230] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 478.729063][ T1230] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 478.729094][ T1230] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 478.729119][ T1230] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 478.729145][ T1230] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 478.786243][ T1230] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 478.786277][ T1230] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 478.786300][ T1230] usb 4-1: Manufacturer: syz [ 478.818060][ T1230] usb 4-1: config 0 descriptor?? [ 478.890470][ T807] [drm:udl_init] *ERROR* Selecting channel failed [ 479.400637][ T1230] rc_core: IR keymap rc-hauppauge not found [ 479.400659][ T1230] Registered IR keymap rc-empty [ 479.402386][ T1230] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 479.420719][ T1230] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 479.488231][ T807] [drm] Initialized udl 0.0.1 for 5-1:0.0 on minor 2 [ 479.488260][ T807] [drm] Initialized udl on minor 2 [ 479.511928][ T1230] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 479.516289][ T1230] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input12 [ 479.663073][ T1230] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 479.681076][ T1230] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 479.696792][ T807] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 479.700774][ T1230] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 479.720983][ T1230] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 479.740730][ T1230] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 479.760754][ T1230] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 479.785355][ T1230] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 479.803830][ T1230] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 479.820929][ T1230] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 479.843416][ T1230] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 479.912317][ T1230] mceusb 4-1:0.0: Registered with mce emulator interface version 1 [ 479.912580][ T1230] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 480.005018][ T807] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 480.275499][ T807] usb 5-1: USB disconnect, device number 15 [ 480.304286][ T1230] usb 4-1: USB disconnect, device number 22 [ 480.370389][ T6034] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffed [ 480.649828][ T6034] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 481.088621][T10439] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 481.478675][T10445] syzkaller0: entered promiscuous mode [ 481.478702][T10445] syzkaller0: entered allmulticast mode [ 482.000315][T10453] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.1572'. [ 483.619858][T10476] netlink: 'syz.1.1579': attribute type 16 has an invalid length. [ 483.619882][T10476] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1579'. [ 483.619899][T10476] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1579'. [ 483.768622][T10477] input: syz0 as /devices/virtual/input/input13 [ 484.396368][ T37] audit: type=1326 audit(1776269484.793:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10487 comm="syz.5.1584" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faae7c9c819 code=0x7ffc0000 [ 484.426001][ T37] audit: type=1326 audit(1776269484.823:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10487 comm="syz.5.1584" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faae7c9c819 code=0x7ffc0000 [ 484.466567][ T37] audit: type=1326 audit(1776269484.863:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10487 comm="syz.5.1584" exe="/root/syz-executor" sig=0 arch=c000003e syscall=447 compat=0 ip=0x7faae7c9c819 code=0x7ffc0000 [ 484.468598][ T37] audit: type=1326 audit(1776269484.863:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10487 comm="syz.5.1584" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faae7c9c819 code=0x7ffc0000 [ 484.468901][ T37] audit: type=1326 audit(1776269484.863:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10487 comm="syz.5.1584" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faae7c9c819 code=0x7ffc0000 [ 484.517553][ T37] audit: type=1326 audit(1776269484.913:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10487 comm="syz.5.1584" exe="/root/syz-executor" sig=0 arch=c000003e syscall=66 compat=0 ip=0x7faae7c9c819 code=0x7ffc0000 [ 484.517712][ T37] audit: type=1326 audit(1776269484.913:49): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10487 comm="syz.5.1584" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faae7c9c819 code=0x7ffc0000 [ 484.517833][ T37] audit: type=1326 audit(1776269484.913:50): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10487 comm="syz.5.1584" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faae7c9c819 code=0x7ffc0000 [ 484.528216][ T37] audit: type=1326 audit(1776269484.923:51): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10487 comm="syz.5.1584" exe="/root/syz-executor" sig=0 arch=c000003e syscall=261 compat=0 ip=0x7faae7c9c819 code=0x7ffc0000 [ 484.528371][ T37] audit: type=1326 audit(1776269484.923:52): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10487 comm="syz.5.1584" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faae7c9c819 code=0x7ffc0000 [ 484.695451][T10486] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 485.034339][T10493] syzkaller0: entered promiscuous mode [ 485.034368][T10493] syzkaller0: entered allmulticast mode [ 485.305951][T10506] program syz.0.1592 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 485.510684][T10508] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1590'. [ 486.103029][ T807] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 486.250765][ T807] usb 2-1: Using ep0 maxpacket: 8 [ 486.253632][ T807] usb 2-1: config 0 interface 0 has no altsetting 0 [ 486.253677][ T807] usb 2-1: New USB device found, idVendor=044e, idProduct=121e, bcdDevice= 0.00 [ 486.253703][ T807] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 486.305582][ T807] usb 2-1: config 0 descriptor?? [ 486.838832][T10535] program syz.0.1604 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 486.876678][ T807] hid-alps 0003:044E:121E.0009: unknown main item tag 0x0 [ 486.876718][ T807] hid-alps 0003:044E:121E.0009: unknown main item tag 0x0 [ 486.876757][ T807] hid-alps 0003:044E:121E.0009: unknown main item tag 0x0 [ 486.876785][ T807] hid-alps 0003:044E:121E.0009: unknown main item tag 0x0 [ 486.876813][ T807] hid-alps 0003:044E:121E.0009: unknown main item tag 0x0 [ 486.876840][ T807] hid-alps 0003:044E:121E.0009: unknown main item tag 0x0 [ 486.876867][ T807] hid-alps 0003:044E:121E.0009: unknown main item tag 0x0 [ 486.876894][ T807] hid-alps 0003:044E:121E.0009: unknown main item tag 0x0 [ 486.876922][ T807] hid-alps 0003:044E:121E.0009: unknown main item tag 0x0 [ 486.876949][ T807] hid-alps 0003:044E:121E.0009: unknown main item tag 0x0 [ 487.089395][ T807] hid-alps 0003:044E:121E.0009: hidraw0: USB HID v0.00 Device [HID 044e:121e] on usb-dummy_hcd.1-1/input0 [ 487.341520][ T807] usb 2-1: USB disconnect, device number 19 [ 487.573304][T10538] fido_id[10538]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/2-1/report_descriptor': No such file or directory [ 489.552160][T10573] syzkaller0: entered promiscuous mode [ 489.552188][T10573] syzkaller0: entered allmulticast mode [ 489.730207][ T807] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 489.890841][ T807] usb 2-1: Using ep0 maxpacket: 8 [ 489.900164][ T807] usb 2-1: unable to get BOS descriptor or descriptor too short [ 489.903453][ T807] usb 2-1: config 4 interface 0 has no altsetting 0 [ 489.950198][ T807] usb 2-1: string descriptor 0 read error: -22 [ 489.950309][ T807] usb 2-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 489.950337][ T807] usb 2-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 490.125545][ T807] usb 2-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 490.360202][ T807] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 490.361445][ T807] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 490.362697][ T807] usb 2-1: media controller created [ 490.633083][ T807] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 490.873441][T10596] program syz.4.1630 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 490.975023][T10599] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 490.975045][T10599] IPv6: NLM_F_CREATE should be set when creating new route [ 490.975299][T10599] IPv6: NLM_F_CREATE should be set when creating new route [ 490.975335][T10599] IPv6: NLM_F_CREATE should be set when creating new route [ 491.029789][T10599] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 491.345375][ T807] zl10353_read_register: readreg error (reg=127, ret==0) [ 491.648479][ T807] usb 2-1: USB disconnect, device number 20 [ 491.951806][T10617] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1636'. [ 492.880854][ T807] usb 5-1: new full-speed USB device number 16 using dummy_hcd [ 493.042696][ T807] usb 5-1: config 0 has an invalid descriptor of length 185, skipping remainder of the config [ 493.042741][ T807] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 493.042761][ T807] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 493.042782][ T807] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid maxpacket 1464, setting to 64 [ 493.042803][ T807] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 493.044986][ T807] usb 5-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 493.045009][ T807] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 493.045024][ T807] usb 5-1: Product: syz [ 493.045035][ T807] usb 5-1: Manufacturer: syz [ 493.045047][ T807] usb 5-1: SerialNumber: syz [ 493.142766][ T807] usb 5-1: config 0 descriptor?? [ 493.206270][T10629] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 493.248051][T10640] program syz.0.1645 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 493.317247][T10636] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1643'. [ 493.409930][ T807] radio-si470x 5-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 493.409955][ T807] radio-si470x 5-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 493.612306][ T807] radio-si470x 5-1:0.0: software version 0, hardware version 0 [ 493.612354][ T807] radio-si470x 5-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 493.612378][ T807] radio-si470x 5-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 493.820849][ T807] radio-si470x 5-1:0.0: si470x_set_report: usb_control_msg returned -71 [ 493.821174][ C1] radio-si470x 5-1:0.0: non-zero urb status (-71) [ 493.821522][ C1] radio-si470x 5-1:0.0: non-zero urb status (-71) [ 493.821766][ C1] radio-si470x 5-1:0.0: non-zero urb status (-71) [ 493.821995][ C1] radio-si470x 5-1:0.0: non-zero urb status (-71) [ 493.822228][ C1] radio-si470x 5-1:0.0: non-zero urb status (-71) [ 493.822486][ C1] radio-si470x 5-1:0.0: non-zero urb status (-71) [ 493.822716][ C1] radio-si470x 5-1:0.0: non-zero urb status (-71) [ 493.822928][ C1] radio-si470x 5-1:0.0: non-zero urb status (-71) [ 493.823126][ C1] radio-si470x 5-1:0.0: non-zero urb status (-71) [ 493.823331][ C1] radio-si470x 5-1:0.0: non-zero urb status (-71) [ 493.823529][ C1] radio-si470x 5-1:0.0: non-zero urb status (-71) [ 493.823728][ C1] radio-si470x 5-1:0.0: non-zero urb status (-71) [ 493.823927][ C1] radio-si470x 5-1:0.0: non-zero urb status (-71) [ 493.824131][ C1] radio-si470x 5-1:0.0: non-zero urb status (-71) [ 493.824440][ C1] radio-si470x 5-1:0.0: non-zero urb status (-71) [ 493.824667][ C1] radio-si470x 5-1:0.0: non-zero urb status (-71) [ 493.824870][ C1] radio-si470x 5-1:0.0: non-zero urb status (-71) [ 493.825081][ C1] radio-si470x 5-1:0.0: non-zero urb status (-71) [ 493.825308][ C1] radio-si470x 5-1:0.0: non-zero urb status (-71) [ 493.825519][ C1] radio-si470x 5-1:0.0: non-zero urb status (-71) [ 493.825725][ C1] radio-si470x 5-1:0.0: non-zero urb status (-71) [ 493.825932][ C1] radio-si470x 5-1:0.0: non-zero urb status (-71) [ 493.826137][ C1] radio-si470x 5-1:0.0: non-zero urb status (-71) [ 493.826457][ C1] radio-si470x 5-1:0.0: non-zero urb status (-71) [ 493.826673][ C1] radio-si470x 5-1:0.0: non-zero urb status (-71) [ 493.826936][ C1] radio-si470x 5-1:0.0: non-zero urb status (-71) [ 493.827165][ C1] radio-si470x 5-1:0.0: non-zero urb status (-71) [ 493.827300][ T807] radio-si470x 5-1:0.0: si470x_set_report: usb_control_msg returned -71 [ 493.831546][ C1] radio-si470x 5-1:0.0: non-zero urb status (-71) [ 493.831622][ C1] radio-si470x 5-1:0.0: resubmitting urb failed (-1) [ 493.907558][ T807] radio-si470x 5-1:0.0: probe with driver radio-si470x failed with error -22 [ 494.154355][ T807] usb 5-1: USB disconnect, device number 16 [ 494.294800][T10648] sctp: [Deprecated]: syz.1.1648 (pid 10648) Use of int in max_burst socket option. [ 494.294800][T10648] Use struct sctp_assoc_value instead [ 494.822725][T10656] A link change request failed with some changes committed already. Interface macsec0 may have been left with an inconsistent configuration, please check. [ 497.365676][ T37] kauditd_printk_skb: 1 callbacks suppressed [ 497.365696][ T37] audit: type=1326 audit(1776269497.763:54): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10684 comm="syz.1.1663" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f660a83c819 code=0x7fc00000 [ 498.043954][ T5910] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 498.200730][ T5910] usb 6-1: Using ep0 maxpacket: 16 [ 498.203147][ T5910] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 498.203185][ T5910] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 498.240458][ T5910] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 498.240544][ T5910] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 498.240567][ T5910] usb 6-1: Product: syz [ 498.240584][ T5910] usb 6-1: Manufacturer: syz [ 498.240601][ T5910] usb 6-1: SerialNumber: syz [ 498.249903][ T5910] usb 6-1: config 0 descriptor?? [ 498.301607][ T5910] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 498.301652][ T5910] em28xx 6-1:0.0: Audio interface 0 found (Vendor Class) [ 498.810010][T10715] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1676'. [ 498.874402][ T5910] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 499.078717][ T5910] em28xx 6-1:0.0: Config register raw data: 0xfffffffb [ 499.079164][ T5910] em28xx 6-1:0.0: AC97 chip type couldn't be determined [ 499.079184][ T5910] em28xx 6-1:0.0: No AC97 audio processor [ 499.114667][ T5910] usb 6-1: USB disconnect, device number 6 [ 499.155170][ T5910] em28xx 6-1:0.0: Disconnecting em28xx [ 499.209479][ T5910] em28xx 6-1:0.0: Freeing device [ 499.870737][T10733] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1681'. [ 500.633780][T10748] 9p: Bad value for 'wfdno' [ 501.065011][T10758] tap0: tun_chr_ioctl cmd 2148553947 [ 501.163427][ T5910] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 501.196662][ T5887] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 501.330759][ T5910] usb 4-1: Using ep0 maxpacket: 8 [ 501.333768][ T5910] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 501.333792][ T5910] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 501.333811][ T5910] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 501.333828][ T5910] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 501.333861][ T5910] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 501.333879][ T5910] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 501.380786][ T5887] usb 2-1: Using ep0 maxpacket: 32 [ 501.420069][ T5887] usb 2-1: config 0 has an invalid interface number: 188 but max is 0 [ 501.420100][ T5887] usb 2-1: config 0 has no interface number 0 [ 501.420150][ T5887] usb 2-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 501.487502][ T5887] usb 2-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 501.487536][ T5887] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 501.487559][ T5887] usb 2-1: Product: syz [ 501.487575][ T5887] usb 2-1: Manufacturer: syz [ 501.487592][ T5887] usb 2-1: SerialNumber: syz [ 501.542587][ T5887] usb 2-1: config 0 descriptor?? [ 501.546229][T10754] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 501.681399][ T5910] usb 4-1: GET_CAPABILITIES returned 0 [ 501.681442][ T5910] usbtmc 4-1:16.0: can't read capabilities [ 501.790128][T10760] program syz.5.1693 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 501.932939][ T5910] usb 4-1: USB disconnect, device number 23 [ 501.967628][T10754] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 502.229597][ T5887] asix 2-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 502.230157][ T5887] asix 2-1:0.188: probe with driver asix failed with error -71 [ 502.395885][T10765] loop5: detected capacity change from 0 to 7 [ 502.463221][T10765] Dev loop5: unable to read RDB block 7 [ 502.463259][T10765] loop5: AHDI p1 [ 502.463291][T10765] loop5: partition table partially beyond EOD, truncated [ 502.555389][ T5887] usb 2-1: USB disconnect, device number 21 [ 502.937087][T10771] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1696'. [ 503.960635][ T5887] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 504.120671][ T5887] usb 4-1: Using ep0 maxpacket: 16 [ 504.124395][ T5887] usb 4-1: config index 0 descriptor too short (expected 65532, got 18) [ 504.124532][ T5887] usb 4-1: config 0 has an invalid interface number: 0 but max is -1 [ 504.124556][ T5887] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 504.128496][ T5887] usb 4-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 504.128531][ T5887] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 504.128554][ T5887] usb 4-1: Product: syz [ 504.128570][ T5887] usb 4-1: Manufacturer: syz [ 504.128586][ T5887] usb 4-1: SerialNumber: syz [ 504.238190][ T5887] r8152-cfgselector 4-1: Unknown version 0x0000 [ 504.238211][ T5887] r8152-cfgselector 4-1: config 0 descriptor?? [ 504.348539][T10789] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1705'. [ 504.696595][ T5910] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 504.739203][ T9] r8152-cfgselector 4-1: USB disconnect, device number 24 [ 504.840630][ T5910] usb 5-1: Using ep0 maxpacket: 16 [ 504.846752][ T5910] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 504.846788][ T5910] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 504.846813][ T5910] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 504.846867][ T5910] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 504.846892][ T5910] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 504.921989][ T5910] usb 5-1: config 0 descriptor?? [ 505.419362][ T5910] hid_parser_main: 30 callbacks suppressed [ 505.419389][ T5910] microsoft 0003:045E:07DA.000A: unknown main item tag 0x0 [ 505.434274][ T5910] microsoft 0003:045E:07DA.000A: ignoring exceeding usage max [ 505.453735][ T5910] microsoft 0003:045E:07DA.000A: unbalanced collection at end of report description [ 505.460183][ T5910] microsoft 0003:045E:07DA.000A: parse failed [ 505.460307][ T5910] microsoft 0003:045E:07DA.000A: probe with driver microsoft failed with error -22 [ 505.641548][ T6034] usb 5-1: USB disconnect, device number 17 [ 506.702385][ T1230] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 506.903132][ T1230] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 506.903163][ T1230] usb 5-1: config 0 has no interface number 0 [ 506.908411][ T1230] usb 5-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 506.908443][ T1230] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 506.908458][ T1230] usb 5-1: Product: syz [ 506.908469][ T1230] usb 5-1: Manufacturer: syz [ 506.908480][ T1230] usb 5-1: SerialNumber: syz [ 506.977947][ T1230] usb 5-1: config 0 descriptor?? [ 507.255863][ T1230] usb 5-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 507.304878][ T1230] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 507.306918][ T1230] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 507.306973][ T1230] usb 5-1: media controller created [ 507.379535][ T1230] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 507.501316][ T1230] i2c i2c-1: ec100: i2c rd failed=-71 reg=33 [ 507.954137][ T1230] usb 5-1: USB disconnect, device number 18 [ 508.019749][ T1321] ieee802154 phy0 wpan0: encryption failed: -22 [ 508.019827][ T1321] ieee802154 phy1 wpan1: encryption failed: -22 [ 508.370751][ T9] usb 2-1: new full-speed USB device number 22 using dummy_hcd [ 508.523284][ T9] usb 2-1: config 0 has an invalid interface number: 8 but max is 0 [ 508.523316][ T9] usb 2-1: config 0 has no interface number 0 [ 508.523363][ T9] usb 2-1: config 0 interface 8 altsetting 0 has an endpoint descriptor with address 0x9F, changing to 0x8F [ 508.523391][ T9] usb 2-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 508.523420][ T9] usb 2-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 508.528825][ T9] usb 2-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 508.528857][ T9] usb 2-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 508.528896][ T9] usb 2-1: Product: syz [ 508.528913][ T9] usb 2-1: SerialNumber: syz [ 508.615177][ T9] usb 2-1: config 0 descriptor?? [ 508.646589][ T9] cm109 2-1:0.8: invalid payload size 0, expected 4 [ 508.650023][ T9] input: CM109 USB driver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.8/input/input14 [ 509.749729][ T807] usb 2-1: USB disconnect, device number 22 [ 509.757519][ C0] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 509.758280][ C0] cm109 2-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 509.918627][ T807] cm109 2-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 510.220731][ T5177] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 510.393913][ T5177] usb 5-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 510.393949][ T5177] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 510.393972][ T5177] usb 5-1: Product: syz [ 510.393988][ T5177] usb 5-1: Manufacturer: syz [ 510.394004][ T5177] usb 5-1: SerialNumber: syz [ 510.445705][ T5177] usb 5-1: config 0 descriptor?? [ 510.813093][ T807] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 510.970658][ T807] usb 6-1: Using ep0 maxpacket: 8 [ 511.001886][ T807] usb 6-1: config index 0 descriptor too short (expected 74, got 45) [ 511.002019][ T807] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 511.002050][ T807] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 511.002075][ T807] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 511.002099][ T807] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 511.002212][ T807] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 511.002237][ T807] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 511.289179][ T5177] usb 5-1: Firmware version (0.0) predates our first public release. [ 511.289269][ T5177] usb 5-1: Please update to version 0.2 or newer [ 511.333631][ T807] usb 6-1: GET_CAPABILITIES returned 0 [ 511.333681][ T807] usbtmc 6-1:16.0: can't read capabilities [ 511.515224][ T5177] usb 5-1: USB disconnect, device number 19 [ 511.563100][ T5910] usb 6-1: USB disconnect, device number 7 [ 511.620388][T10887] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1744'. [ 512.550672][ T5177] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 512.556775][T10907] vivid-002: disconnect [ 512.590017][T10906] vivid-002: reconnect [ 512.700606][ T5177] usb 5-1: Using ep0 maxpacket: 8 [ 512.707816][ T5177] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 512.707876][ T5177] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 512.707900][ T5177] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 512.707927][ T5177] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 512.709784][ T5177] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 512.709837][ T5177] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 512.709863][ T5177] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 512.940813][ T5910] usb 2-1: new full-speed USB device number 23 using dummy_hcd [ 513.007214][ T5177] usb 5-1: GET_CAPABILITIES returned 0 [ 513.007263][ T5177] usbtmc 5-1:16.0: can't read capabilities [ 513.091570][T10917] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1757'. [ 513.115913][ T5910] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 513.115949][ T5910] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 513.115994][ T5910] usb 2-1: New USB device found, idVendor=056a, idProduct=5000, bcdDevice= 0.00 [ 513.116011][ T5910] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 513.180067][ T5910] usb 2-1: config 0 descriptor?? [ 513.245092][ T9] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 513.311605][ T1230] usb 5-1: USB disconnect, device number 20 [ 513.391145][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 513.398942][ T9] usb 4-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 513.398970][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 513.399039][ T9] usb 4-1: Product: syz [ 513.399050][ T9] usb 4-1: Manufacturer: syz [ 513.399061][ T9] usb 4-1: SerialNumber: syz [ 513.562883][ T9] usb 4-1: config 0 descriptor?? [ 513.602559][ T9] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 514.978744][ T5910] wacom 0003:056A:5000.000B: unknown main item tag 0x0 [ 514.978845][ T5910] wacom 0003:056A:5000.000B: unknown main item tag 0x0 [ 514.978874][ T5910] wacom 0003:056A:5000.000B: unknown main item tag 0x0 [ 514.978900][ T5910] wacom 0003:056A:5000.000B: unknown main item tag 0x0 [ 514.978928][ T5910] wacom 0003:056A:5000.000B: unknown main item tag 0x0 [ 514.979018][ T5910] wacom 0003:056A:5000.000B: unknown main item tag 0x0 [ 514.979046][ T5910] wacom 0003:056A:5000.000B: unknown main item tag 0x0 [ 514.979074][ T5910] wacom 0003:056A:5000.000B: unknown main item tag 0x0 [ 514.979101][ T5910] wacom 0003:056A:5000.000B: unknown main item tag 0x0 [ 514.979390][ T5910] wacom 0003:056A:5000.000B: unknown main item tag 0x0 [ 515.096805][ T5910] wacom 0003:056A:5000.000B: reserved main item tag 0xe [ 515.096847][ T5910] wacom 0003:056A:5000.000B: ignoring exceeding usage max [ 515.121982][ T5910] wacom 0003:056A:5000.000B: reserved main item tag 0xd [ 515.122122][ T5910] wacom 0003:056A:5000.000B: item 0 2 0 11 parsing failed [ 515.160419][ T5910] wacom 0003:056A:5000.000B: parse failed [ 515.160770][ T5910] wacom 0003:056A:5000.000B: probe with driver wacom failed with error -22 [ 515.350666][ T9] gspca_sonixj: reg_r err -71 [ 515.350741][ T9] sonixj 4-1:0.0: probe with driver sonixj failed with error -71 [ 515.447179][ T37] audit: type=1800 audit(1776269771.675:55): pid=10926 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.0.1760" name="bus" dev="tmpfs" ino=1753 res=0 errno=0 [ 515.490060][ T5910] usb 2-1: USB disconnect, device number 23 [ 515.578624][ T9] usb 4-1: USB disconnect, device number 25 [ 517.600644][ T6034] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 517.751853][ T6034] usb 5-1: Using ep0 maxpacket: 16 [ 517.753854][ T6034] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 517.753888][ T6034] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 517.753927][ T6034] usb 5-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 517.753951][ T6034] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 517.834916][ T6034] usb 5-1: config 0 descriptor?? [ 518.258669][ T9] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 519.195645][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 519.198201][ T9] usb 2-1: config 0 has an invalid interface number: 186 but max is 0 [ 519.198232][ T9] usb 2-1: config 0 has no interface number 0 [ 519.198279][ T9] usb 2-1: config 0 interface 186 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 519.198305][ T9] usb 2-1: config 0 interface 186 altsetting 0 endpoint 0x1 has an invalid bInterval 18, changing to 8 [ 519.198336][ T9] usb 2-1: config 0 interface 186 altsetting 0 has an endpoint descriptor with address 0x9A, changing to 0x8A [ 519.198363][ T9] usb 2-1: config 0 interface 186 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 519.198407][ T9] usb 2-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 519.301695][ T9] usb 2-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 519.301731][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 519.301754][ T9] usb 2-1: Product: syz [ 519.301769][ T9] usb 2-1: Manufacturer: syz [ 519.301785][ T9] usb 2-1: SerialNumber: syz [ 519.358051][T10949] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 519.373718][T10949] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 519.398098][ T6034] hid (null): invalid report_size 1033 [ 519.407357][ T9] usb 2-1: config 0 descriptor?? [ 519.479296][T10965] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1775'. [ 519.795963][ T6034] usb 5-1: string descriptor 0 read error: -71 [ 519.825110][ T6034] usb 5-1: Max retries (5) exceeded reading string descriptor 200 [ 519.825206][ T6034] letsketch 0003:6161:4D15.000C: probe with driver letsketch failed with error -32 [ 519.871039][ T6034] usb 5-1: USB disconnect, device number 21 [ 520.024458][ T9] iowarrior 2-1:0.186: IOWarrior product=0x1505, serial=42424242 interface=186 now attached to iowarrior0 [ 520.174323][ T9] usb 2-1: USB disconnect, device number 24 [ 522.009867][T10988] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1783'. [ 522.600696][ T5910] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 522.765901][ T5910] usb 2-1: config 1 has an invalid interface number: 55 but max is 0 [ 522.765923][ T5910] usb 2-1: config 1 has no interface number 0 [ 522.765964][ T5910] usb 2-1: config 1 interface 55 has no altsetting 0 [ 522.769555][ T5910] usb 2-1: New USB device found, idVendor=0af0, idProduct=7211, bcdDevice=94.f7 [ 522.769589][ T5910] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 522.769610][ T5910] usb 2-1: Product: syz [ 522.769626][ T5910] usb 2-1: Manufacturer: syz [ 522.769645][ T5910] usb 2-1: SerialNumber: syz [ 523.143374][ T5910] hso 2-1:1.55: Not our interface [ 523.194800][T11009] vhci_hcd vhci_hcd.0: pdev(0) rhport(1) sockfd(6) [ 523.194830][T11009] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 523.286340][ T5910] usb 2-1: USB disconnect, device number 25 [ 523.317959][T11009] vhci_hcd vhci_hcd.0: Device attached [ 523.342150][T11006] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(3) [ 523.342181][T11006] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 523.342239][T11006] vhci_hcd vhci_hcd.0: Device attached [ 523.343799][T11010] vhci_hcd: connection closed [ 523.352780][T11013] vhci_hcd: connection closed [ 523.516034][T11008] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 523.548652][ T1158] vhci_hcd vhci_hcd.0: stop threads [ 523.549943][ T1158] vhci_hcd vhci_hcd.0: release socket [ 523.569863][ T6034] usb 33-2: new low-speed USB device number 2 using vhci_hcd [ 523.742634][ T1158] vhci_hcd vhci_hcd.0: disconnect device [ 523.743076][ T1158] vhci_hcd vhci_hcd.0: stop threads [ 523.743098][ T1158] vhci_hcd vhci_hcd.0: release socket [ 523.772312][ T1158] vhci_hcd vhci_hcd.0: disconnect device [ 524.136714][ T5177] kernel write not supported for file /input/mice (pid: 5177 comm: kworker/1:3) [ 526.099204][T11036] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1797'. [ 528.557961][T11086] netlink: 112 bytes leftover after parsing attributes in process `syz.4.1813'. [ 528.733330][ T6034] vhci_hcd vhci_hcd.0: vhci_device speed not set [ 529.450902][ T5177] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 529.708928][ T5177] usb 2-1: config 1 interface 0 has no altsetting 0 [ 529.725512][ T5177] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.40 [ 529.725545][ T5177] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 529.725566][ T5177] usb 2-1: Product: syz [ 529.725582][ T5177] usb 2-1: Manufacturer: syz [ 529.725598][ T5177] usb 2-1: SerialNumber: syz [ 529.935430][T11115] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1826'. [ 530.092702][ T5177] usbhid 2-1:1.0: can't add hid device: -71 [ 530.092834][ T5177] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 530.126981][ T5177] usb 2-1: USB disconnect, device number 26 [ 530.688066][T11127] tipc: Enabled bearer , priority 0 [ 530.707451][T11127] syzkaller0: entered promiscuous mode [ 530.707479][T11127] syzkaller0: entered allmulticast mode [ 530.783159][T11127] tipc: Resetting bearer [ 530.823441][T11125] tipc: Resetting bearer [ 531.144997][T11125] tipc: Disabling bearer [ 533.081437][T11174] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1846'. [ 534.396250][T11183] veth1_to_batadv: entered allmulticast mode [ 534.603479][T11183] pim6reg: entered allmulticast mode [ 534.716650][T11186] tipc: Started in network mode [ 534.716686][T11186] tipc: Node identity d6dbfd2269d1, cluster identity 4711 [ 534.716879][T11186] tipc: Enabled bearer , priority 0 [ 534.761227][T11186] syzkaller0: entered promiscuous mode [ 534.761256][T11186] syzkaller0: entered allmulticast mode [ 534.817588][T11186] tipc: Resetting bearer [ 534.851979][T11184] tipc: Resetting bearer [ 534.992001][ T6034] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 535.144482][T11184] tipc: Disabling bearer [ 535.167811][ T6034] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 535.167843][ T6034] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 535.167865][ T6034] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 535.167917][ T6034] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 535.169869][ T6034] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 535.169900][ T6034] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 535.169922][ T6034] usb 2-1: Product: syz [ 535.169938][ T6034] usb 2-1: Manufacturer: syz [ 535.336217][ T6034] cdc_wdm 2-1:1.0: skipping garbage [ 535.336243][ T6034] cdc_wdm 2-1:1.0: skipping garbage [ 535.355468][ T6034] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 535.355494][ T6034] cdc_wdm 2-1:1.0: Unknown control protocol [ 535.551631][ T5910] usb 2-1: USB disconnect, device number 27 [ 536.835887][T11217] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1864'. [ 537.084794][T11217] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 537.341459][T11217] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 539.454493][ T1230] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 539.920700][ T1230] usb 4-1: Using ep0 maxpacket: 8 [ 539.923026][ T1230] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 539.923060][ T1230] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 539.923089][ T1230] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 539.923116][ T1230] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 539.923165][ T1230] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 539.923247][ T1230] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 540.200675][ T6034] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 540.202051][T11272] syzkaller0: entered promiscuous mode [ 540.202072][T11272] syzkaller0: entered allmulticast mode [ 540.294558][ T1230] usb 4-1: GET_CAPABILITIES returned 0 [ 540.294611][ T1230] usbtmc 4-1:16.0: can't read capabilities [ 540.348708][T11270] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1883'. [ 540.364015][ T6034] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 540.364052][ T6034] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 540.364081][ T6034] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 540.364105][ T6034] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 540.364260][ T6034] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 540.364286][ T6034] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 540.450167][ T6034] usb 6-1: config 0 descriptor?? [ 540.544189][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 540.723261][ T5887] usb 4-1: USB disconnect, device number 26 [ 540.917500][ T6034] hid_parser_main: 371 callbacks suppressed [ 540.917520][ T6034] plantronics 0003:047F:FFFF.000D: unknown main item tag 0x0 [ 540.917543][ T6034] plantronics 0003:047F:FFFF.000D: unknown main item tag 0x0 [ 540.917563][ T6034] plantronics 0003:047F:FFFF.000D: unknown main item tag 0x0 [ 540.917581][ T6034] plantronics 0003:047F:FFFF.000D: unknown main item tag 0x0 [ 540.917600][ T6034] plantronics 0003:047F:FFFF.000D: unknown main item tag 0x0 [ 540.917619][ T6034] plantronics 0003:047F:FFFF.000D: unknown main item tag 0x0 [ 540.921733][ T6034] plantronics 0003:047F:FFFF.000D: unknown main item tag 0x0 [ 540.921772][ T6034] plantronics 0003:047F:FFFF.000D: unknown main item tag 0x0 [ 540.921800][ T6034] plantronics 0003:047F:FFFF.000D: unknown main item tag 0x0 [ 540.921828][ T6034] plantronics 0003:047F:FFFF.000D: unknown main item tag 0x0 [ 541.271185][ T6034] plantronics 0003:047F:FFFF.000D: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 541.660140][ T5910] usb 6-1: USB disconnect, device number 8 [ 541.800678][ T6034] usb 4-1: new full-speed USB device number 27 using dummy_hcd [ 541.987561][ T6034] usb 4-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 541.987607][ T6034] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 541.987630][ T6034] usb 4-1: Product: syz [ 541.987646][ T6034] usb 4-1: Manufacturer: syz [ 541.987661][ T6034] usb 4-1: SerialNumber: syz [ 542.563385][ T6034] usblp 4-1:1.0: usblp0: USB Unidirectional printer dev 27 if 0 alt 0 proto 1 vid 0x04B8 pid 0x0202 [ 545.006941][ T6034] usb 4-1: USB disconnect, device number 27 [ 545.095021][ T6034] usblp0: removed [ 545.162644][T11313] tipc: Enabled bearer , priority 0 [ 545.251858][T11313] tipc: Resetting bearer [ 545.373396][T11311] tipc: Disabling bearer [ 547.368270][T11347] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1911'. [ 547.870650][ T6077] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 548.022521][ T6077] usb 2-1: Using ep0 maxpacket: 8 [ 548.044232][ T6077] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 548.044265][ T6077] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 548.044287][ T6077] usb 2-1: Product: syz [ 548.044303][ T6077] usb 2-1: Manufacturer: syz [ 548.044318][ T6077] usb 2-1: SerialNumber: syz [ 548.056055][ T6034] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 548.106205][ T6077] usb 2-1: config 0 descriptor?? [ 548.268416][ T6034] usb 6-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 548.268449][ T6034] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 548.268471][ T6034] usb 6-1: Product: syz [ 548.268487][ T6034] usb 6-1: Manufacturer: syz [ 548.268513][ T6034] usb 6-1: SerialNumber: syz [ 548.476160][ T6077] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 548.759791][ T6034] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 548.759863][ T6034] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 548.866772][ T6077] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 548.990422][ T6077] usb 2-1: USB disconnect, device number 28 [ 549.200865][ T6034] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 549.200930][ T6034] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 549.275877][ T6034] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 549.303808][ T6034] lan78xx 6-1:1.0: probe with driver lan78xx failed with error -71 [ 549.340227][ T6034] usb 6-1: USB disconnect, device number 9 [ 549.720664][ T1230] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 549.884040][ T1230] usb 5-1: Using ep0 maxpacket: 16 [ 549.886353][ T1230] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 549.886381][ T1230] usb 5-1: config 0 has no interface number 0 [ 549.890023][ T1230] usb 5-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 549.890054][ T1230] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 549.890076][ T1230] usb 5-1: Product: syz [ 549.890090][ T1230] usb 5-1: Manufacturer: syz [ 549.890104][ T1230] usb 5-1: SerialNumber: syz [ 549.962627][ T1230] usb 5-1: config 0 descriptor?? [ 550.001346][ T1230] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 550.656119][T11390] Invalid logical block size (768) [ 551.437499][ T1230] gspca_spca1528: reg_w err -71 [ 551.437608][ T1230] spca1528 5-1:0.1: probe with driver spca1528 failed with error -71 [ 551.525954][ T1230] usb 5-1: USB disconnect, device number 22 [ 554.202478][T11470] loop5: detected capacity change from 0 to 7 [ 554.343348][T11470] Dev loop5: unable to read RDB block 7 [ 554.343379][T11470] loop5: AHDI p2 [ 554.343406][T11470] loop5: partition table partially beyond EOD, truncated [ 556.445222][ C1] vxcan0: j1939_simple_recv: Received already invalidated message [ 556.830035][ T6077] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 556.980589][ T6077] usb 4-1: Using ep0 maxpacket: 16 [ 556.982949][ T6077] usb 4-1: config 251 has an invalid interface number: 202 but max is 0 [ 556.982980][ T6077] usb 4-1: config 251 has no interface number 0 [ 556.983029][ T6077] usb 4-1: config 251 interface 202 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 556.983055][ T6077] usb 4-1: config 251 interface 202 altsetting 1 bulk endpoint 0x1 has invalid maxpacket 0 [ 556.983082][ T6077] usb 4-1: config 251 interface 202 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 556.983107][ T6077] usb 4-1: config 251 interface 202 altsetting 1 endpoint 0x6 has invalid maxpacket 1024, setting to 64 [ 556.983137][ T6077] usb 4-1: config 251 interface 202 altsetting 1 has an endpoint descriptor with address 0xC1, changing to 0x81 [ 556.983165][ T6077] usb 4-1: config 251 interface 202 altsetting 1 endpoint 0x81 has invalid wMaxPacketSize 0 [ 556.983190][ T6077] usb 4-1: config 251 interface 202 altsetting 1 bulk endpoint 0x81 has invalid maxpacket 0 [ 556.983217][ T6077] usb 4-1: config 251 interface 202 altsetting 1 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 556.983247][ T6077] usb 4-1: config 251 interface 202 has no altsetting 0 [ 556.986073][ T6077] usb 4-1: New USB device found, idVendor=0572, idProduct=cb00, bcdDevice=bb.c9 [ 556.986104][ T6077] usb 4-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 556.986126][ T6077] usb 4-1: Product: syz [ 556.986143][ T6077] usb 4-1: SerialNumber: syz [ 557.419369][ T6077] cxacru 4-1:251.202: submit of read urb for cm 0x90 failed (-90) [ 557.419419][ T6077] cxacru 4-1:251.202: usbatm_usb_probe: invalid endpoint 02! [ 557.420035][ T6077] cxacru 4-1:251.202: probe with driver cxacru failed with error -22 [ 557.481596][ T6077] usb 4-1: USB disconnect, device number 28 [ 559.531472][T11561] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1983'. [ 559.627547][ T37] audit: type=1804 audit(1776269815.895:56): pid=11557 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.0.1981" name="/newroot/383/file1" dev="tmpfs" ino=2026 res=1 errno=0 [ 561.830040][T11613] netlink: 'syz.3.2003': attribute type 1 has an invalid length. [ 561.950922][T11615] Context (ID=0x1) not attached to queue pair (handle=0x1:0x2) [ 562.850086][T11625] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2007'. [ 563.642948][T11640] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 563.680386][ T5910] IPVS: starting estimator thread 0... [ 563.770732][T11643] IPVS: using max 7 ests per chain, 16800 per kthread [ 563.930636][ T5910] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 564.096288][ T5910] usb 4-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 564.096325][ T5910] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 564.096349][ T5910] usb 4-1: Product: syz [ 564.096365][ T5910] usb 4-1: Manufacturer: syz [ 564.096381][ T5910] usb 4-1: SerialNumber: syz [ 564.129499][ T5910] usb 4-1: config 0 descriptor?? [ 564.144120][ T5910] hub 4-1:0.0: bad descriptor, ignoring hub [ 564.144163][ T5910] hub 4-1:0.0: probe with driver hub failed with error -5 [ 564.382918][ T5910] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 564.542000][ T5910] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 564.543024][ T5910] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 564.543103][ T5910] usb 4-1: media controller created [ 564.671870][ T5910] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 565.048764][ T5910] DVB: Unable to find symbol dib7000p_attach() [ 565.048789][ T5910] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 565.230677][ T5910] rc_core: IR keymap rc-dib0700-rc5 not found [ 565.230701][ T5910] Registered IR keymap rc-empty [ 565.231462][ T5910] dvb-usb: could not initialize remote control. [ 565.231476][ T5910] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 565.357324][ T5910] usb 4-1: USB disconnect, device number 29 [ 565.415439][ T5867] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 565.769705][ T5910] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully deinitialized and disconnected. [ 566.271036][ T5867] usb 2-1: Using ep0 maxpacket: 16 [ 566.273663][ T5867] usb 2-1: unable to get BOS descriptor or descriptor too short [ 566.275496][ T5867] usb 2-1: config 1 interface 0 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 566.275541][ T5867] usb 2-1: config 1 interface 0 has no altsetting 0 [ 566.278534][ T5867] usb 2-1: New USB device found, idVendor=05ac, idProduct=0262, bcdDevice= 0.40 [ 566.278566][ T5867] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 566.278589][ T5867] usb 2-1: Product: 刋ৣ콦蔅懹Ȇ꽔ﭞ칂籑⋙繤䯎ƻ潜퍵썝뵆ਟ䣉᧼퉶憋웮ꭔ⬐잃ݻ쯉⌝诶쿔蛸ʂ톖䭢╮틷㏧玢戄潞죹ƺ荣﷌힝伝￭燎꒺㸀ꐯ∿ [ 566.278617][ T5867] usb 2-1: Manufacturer: Э [ 566.278633][ T5867] usb 2-1: SerialNumber: င [ 566.717154][ T5867] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/input/input16 [ 566.935298][ T5147] bcm5974 2-1:1.0: could not read from device [ 567.274892][ T5867] usb 2-1: USB disconnect, device number 29 [ 567.279328][ T5147] bcm5974 2-1:1.0: could not read from device [ 569.456704][ T1321] ieee802154 phy0 wpan0: encryption failed: -22 [ 569.479160][ T1321] ieee802154 phy1 wpan1: encryption failed: -22 [ 570.085255][ T5797] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 574.815067][T11840] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 576.484355][ T5177] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 576.644819][ T5177] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 576.644850][ T5177] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 576.647839][ T5177] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 576.647872][ T5177] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 576.647894][ T5177] usb 2-1: SerialNumber: syz [ 577.059816][ T5177] usb 2-1: 0:2 : does not exist [ 577.466022][ T5177] usb 2-1: USB disconnect, device number 30 [ 577.906003][ T6177] udevd[6177]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 578.209194][T11906] overlayfs: overlapping lowerdir path [ 578.679559][T11922] netlink: 108 bytes leftover after parsing attributes in process `syz.5.2121'. [ 579.286338][T11941] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2126'. [ 579.823074][T11940] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2127'. [ 583.499901][T11999] veth0_to_team: entered promiscuous mode [ 586.133420][T12066] loop2: detected capacity change from 0 to 7 [ 586.168497][T12066] Dev loop2: unable to read RDB block 7 [ 586.168547][T12066] loop2: unable to read partition table [ 586.168796][T12066] loop2: partition table beyond EOD, truncated [ 586.168817][T12066] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 586.487508][T12073] loop8: detected capacity change from 0 to 8 [ 586.799125][T12073] Dev loop8: unable to read RDB block 8 [ 586.799159][T12073] loop8: unable to read partition table [ 586.799330][T12073] loop8: partition table beyond EOD, truncated [ 586.799344][T12073] loop_reread_partitions: partition scan of loop8 (被x^> ) failed (rc=-5) [ 587.250876][ T5867] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 587.420615][ T5867] usb 2-1: Using ep0 maxpacket: 8 [ 587.449092][ T5867] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 587.449145][ T5867] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 587.449165][ T5867] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 587.449196][ T5867] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 587.449216][ T5867] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 587.449254][ T5867] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 587.449275][ T5867] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 587.710019][ T37] audit: type=1800 audit(1776269844.095:57): pid=12069 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.0.2174" name="regulatory.db" dev="sda1" ino=448 res=0 errno=0 [ 587.745877][T12069] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 587.745933][T12069] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 587.745959][T12069] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 587.809234][ T5867] usb 2-1: usb_control_msg returned -32 [ 587.809281][ T5867] usbtmc 2-1:16.0: can't read capabilities [ 588.209430][ T5867] usb 2-1: USB disconnect, device number 31 [ 592.028575][T12158] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 592.583477][T12170] ALSA: mixer_oss: invalid OSS volume ':' [ 592.583499][T12170] ALSA: mixer_oss: invalid OSS volume '' [ 592.583516][T12170] ALSA: mixer_oss: invalid OSS volume '6' [ 592.583530][T12170] ALSA: mixer_oss: invalid OSS volume '7' [ 592.583543][T12170] ALSA: mixer_oss: invalid OSS volume '' [ 592.583555][T12170] ALSA: mixer_oss: invalid OSS volume '' [ 592.668993][T12175] netlink: 212408 bytes leftover after parsing attributes in process `syz.5.2214'. [ 594.913174][T12206] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2224'. [ 594.913204][T12206] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2224'. [ 596.854288][ T5177] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 597.072695][T12243] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2239'. [ 597.196225][ T5177] usb 4-1: config 6 has an invalid interface number: 14 but max is 0 [ 597.196259][ T5177] usb 4-1: config 6 has no interface number 0 [ 597.196306][ T5177] usb 4-1: config 6 interface 14 altsetting 218 endpoint 0x3 has invalid wMaxPacketSize 0 [ 597.196332][ T5177] usb 4-1: config 6 interface 14 has no altsetting 0 [ 597.207965][ T5177] usb 4-1: New USB device found, idVendor=0979, idProduct=0227, bcdDevice=6f.50 [ 597.208064][ T5177] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 597.208163][ T5177] usb 4-1: Product: syz [ 597.208198][ T5177] usb 4-1: Manufacturer: syz [ 597.208242][ T5177] usb 4-1: SerialNumber: syz [ 598.444628][T12259] netlink: 'syz.1.2244': attribute type 10 has an invalid length. [ 598.444943][T12259] dummy0: left promiscuous mode [ 598.635123][T12259] team0: Port device dummy0 added [ 598.717174][ T5177] gspca_main: jl2005bcd-2.14.0 probing 0979:0227 [ 598.717335][ T5177] command write [95] error -8 [ 598.867781][ T5177] usb 4-1: USB disconnect, device number 30 [ 601.464923][T12329] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2268'. [ 601.621866][T12329] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2268'. [ 603.121562][ T59] Bluetooth: hci1: command 0x0406 tx timeout [ 603.456049][ T5177] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 603.610585][ T5177] usb 6-1: Using ep0 maxpacket: 16 [ 603.614093][ T5177] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 603.614119][ T5177] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 603.614147][ T5177] usb 6-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 603.614164][ T5177] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 603.673403][ T5177] usb 6-1: config 0 descriptor?? [ 604.309038][ T5177] usb 6-1: language id specifier not provided by device, defaulting to English [ 604.717907][ T5177] letsketch 0003:6161:4D15.000E: Device info: О [ 604.976436][ T5177] usb 6-1: Max retries (5) exceeded reading string descriptor 201 [ 604.976501][ T5177] letsketch 0003:6161:4D15.000E: probe with driver letsketch failed with error -71 [ 605.035707][ T5177] usb 6-1: USB disconnect, device number 10 [ 605.834443][T12415] netlink: 'syz.5.2299': attribute type 10 has an invalid length. [ 605.912660][T12415] team0: Port device dummy0 added [ 605.976838][T12415] netlink: 'syz.5.2299': attribute type 10 has an invalid length. [ 605.990800][ T5910] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 606.104298][T12415] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 606.104911][T12415] team0: Port device dummy0 removed [ 606.141193][ T5910] usb 5-1: Using ep0 maxpacket: 8 [ 606.145449][ T5910] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 606.145483][ T5910] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 606.145508][ T5910] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 606.145533][ T5910] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 606.145574][ T5910] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 606.145597][ T5910] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 606.147008][T12415] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 606.257339][T12421] loop2: detected capacity change from 0 to 7 [ 606.280940][T12421] Dev loop2: unable to read RDB block 7 [ 606.280994][T12421] loop2: unable to read partition table [ 606.281174][T12421] loop2: partition table beyond EOD, truncated [ 606.281194][T12421] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 606.523642][ T5910] usb 5-1: usb_control_msg returned -32 [ 606.523706][ T5910] usbtmc 5-1:16.0: can't read capabilities [ 606.670117][T12430] trusted_key: syz.5.2306 sent an empty control message without MSG_MORE. [ 606.680661][ T807] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 606.833395][ T807] usb 2-1: config 1 interface 0 has no altsetting 0 [ 606.848068][ T807] usb 2-1: string descriptor 0 read error: -22 [ 606.848210][ T807] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.40 [ 606.848236][ T807] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 607.822224][ T807] hid_parser_main: 5 callbacks suppressed [ 607.822252][ T807] savu 0003:1E7D:2D5A.000F: unknown main item tag 0x0 [ 607.822285][ T807] savu 0003:1E7D:2D5A.000F: unknown main item tag 0x0 [ 607.822313][ T807] savu 0003:1E7D:2D5A.000F: unknown main item tag 0x0 [ 607.822342][ T807] savu 0003:1E7D:2D5A.000F: unknown main item tag 0x0 [ 607.822371][ T807] savu 0003:1E7D:2D5A.000F: unknown main item tag 0x0 [ 607.822399][ T807] savu 0003:1E7D:2D5A.000F: unknown main item tag 0x0 [ 607.822428][ T807] savu 0003:1E7D:2D5A.000F: unknown main item tag 0x0 [ 607.822456][ T807] savu 0003:1E7D:2D5A.000F: unknown main item tag 0x0 [ 607.822483][ T807] savu 0003:1E7D:2D5A.000F: unknown main item tag 0x0 [ 607.822511][ T807] savu 0003:1E7D:2D5A.000F: unknown main item tag 0x0 [ 608.020854][ T807] savu 0003:1E7D:2D5A.000F: hidraw0: USB HID vff.7f Device [HID 1e7d:2d5a] on usb-dummy_hcd.1-1/input0 [ 608.282789][T12443] netlink: 27 bytes leftover after parsing attributes in process `syz.3.2310'. [ 608.381041][ T807] usb 2-1: USB disconnect, device number 32 [ 608.477421][T12441] fido_id[12441]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 608.835534][ T807] usb 5-1: USB disconnect, device number 23 [ 609.493689][ T1230] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 609.599571][ T37] audit: type=1804 audit(1776269865.935:58): pid=12470 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.1.2323" name="bus" dev="ramfs" ino=36061 res=1 errno=0 [ 609.650587][ T1230] usb 4-1: Using ep0 maxpacket: 8 [ 609.654491][ T1230] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 609.654544][ T1230] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 609.654578][ T1230] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 609.698096][ T1230] usb 4-1: config 0 descriptor?? [ 609.948489][ T1230] iowarrior 4-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 610.304333][ T1230] usb 4-1: USB disconnect, device number 31 [ 610.395863][T12461] iowarrior 4-1:0.0: Error -2 while submitting URB [ 610.515647][T12489] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 610.624091][T12491] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 610.735121][T12494] iommufd_mock iommufd_mock2: Adding to iommu group 2 [ 611.495720][ T7020] Bluetooth: hci5: Frame reassembly failed (-84) [ 613.520777][ T59] Bluetooth: hci5: command 0x1003 tx timeout [ 613.582711][ T5797] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 613.823141][T12531] loop2: detected capacity change from 0 to 7 [ 613.825895][T12531] Dev loop2: unable to read RDB block 7 [ 613.825930][T12531] loop2: AHDI p1 p2 p3 [ 613.825960][T12531] loop2: partition table partially beyond EOD, truncated [ 613.826191][T12531] loop2: p1 start 1818582900 is beyond EOD, truncated [ 613.826214][T12531] loop2: p3 start 335544320 is beyond EOD, truncated [ 615.559116][ T37] audit: type=1326 audit(1776269871.825:59): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12544 comm="syz.1.2349" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f660a83c819 code=0x0 [ 617.544630][T12583] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2361'. [ 618.941304][T12619] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2375'. [ 619.156903][T12625] loop5: detected capacity change from 0 to 7 [ 619.186356][T12625] Dev loop5: unable to read RDB block 7 [ 619.186421][T12625] loop5: unable to read partition table [ 619.186654][T12625] loop5: partition table beyond EOD, truncated [ 619.186701][T12625] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 620.040563][ T5867] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 620.200718][ T5867] usb 6-1: Using ep0 maxpacket: 32 [ 620.205542][ T5867] usb 6-1: config 0 has an invalid interface number: 12 but max is 0 [ 620.205574][ T5867] usb 6-1: config 0 has no interface number 0 [ 620.205709][ T5867] usb 6-1: config 0 interface 12 has no altsetting 0 [ 620.245626][ T5867] usb 6-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 620.245661][ T5867] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 620.245686][ T5867] usb 6-1: Product: syz [ 620.245702][ T5867] usb 6-1: Manufacturer: syz [ 620.245720][ T5867] usb 6-1: SerialNumber: syz [ 620.327276][ T5867] usb 6-1: config 0 descriptor?? [ 622.486395][ T5867] f81534 6-1:0.12: f81534_set_register: reg: 1002 data: 2f failed: -71 [ 622.486458][ T5867] f81534 6-1:0.12: f81534_find_config_idx: read failed: -71 [ 622.486478][ T5867] f81534 6-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 622.486572][ T5867] f81534 6-1:0.12: probe with driver f81534 failed with error -71 [ 622.585779][ T5867] usb 6-1: USB disconnect, device number 11 [ 622.612819][T12671] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2395'. [ 623.534307][T12673] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2395'. [ 623.534342][T12673] nbd: device at index 64 is going down [ 625.970805][T12716] netlink: 'syz.4.2411': attribute type 4 has an invalid length. [ 628.822841][T12760] binder: 12759:12760 ioctl c0306201 2000000003c0 returned -14 [ 630.886397][ T1321] ieee802154 phy0 wpan0: encryption failed: -22 [ 630.886472][ T1321] ieee802154 phy1 wpan1: encryption failed: -22 [ 632.136816][T12803] overlayfs: failed to resolve './file0': -2 [ 633.771843][T12817] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2446'. [ 634.427877][T12845] loop2: detected capacity change from 0 to 7 [ 634.454774][T12845] loop2: [ 634.454811][T12845] loop2: partition table partially beyond EOD, truncated [ 634.541844][ T37] audit: type=1326 audit(1776269890.945:60): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12848 comm="syz.1.2457" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f660a83c819 code=0x0 [ 636.642041][T12876] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2466'. [ 637.275954][T12890] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2471'. [ 637.795899][ T807] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 637.983746][ T807] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 757, setting to 64 [ 637.994135][ T807] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 637.994169][ T807] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 637.994191][ T807] usb 4-1: Product: syz [ 637.994206][ T807] usb 4-1: Manufacturer: syz [ 637.994222][ T807] usb 4-1: SerialNumber: syz [ 639.882772][T12915] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2480'. [ 639.899187][ T807] cdc_ncm 4-1:1.0: bind() failure [ 639.938229][ T807] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 639.938266][ T807] cdc_ncm 4-1:1.1: bind() failure [ 640.152906][ T5910] usb 4-1: USB disconnect, device number 32 [ 640.271296][ T9] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 640.422692][ T9] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 640.424985][ T9] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 640.425008][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 640.425023][ T9] usb 5-1: Product: syz [ 640.425035][ T9] usb 5-1: Manufacturer: syz [ 640.425046][ T9] usb 5-1: SerialNumber: syz [ 640.762392][ T9] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 24 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 641.039979][ T9] usb 5-1: USB disconnect, device number 24 [ 641.063373][ T9] usblp0: removed [ 641.127081][T12929] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2485'. [ 643.663911][ T37] audit: type=1326 audit(1776269900.065:61): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12968 comm="syz.1.2500" exe="/root/syz-executor" sig=0 arch=c000003e syscall=435 compat=0 ip=0x7f660a83d609 code=0x7ffc0000 [ 643.664490][ T37] audit: type=1326 audit(1776269900.065:62): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12968 comm="syz.1.2500" exe="/root/syz-executor" sig=0 arch=c000003e syscall=14 compat=0 ip=0x7f660a7f957b code=0x7ffc0000 [ 643.665178][ T37] audit: type=1326 audit(1776269900.065:63): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12968 comm="syz.1.2500" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f660a83c819 code=0x7ffc0000 [ 643.666244][ T37] audit: type=1326 audit(1776269900.065:64): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12968 comm="syz.1.2500" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f660a83c819 code=0x7ffc0000 [ 643.668700][ T37] audit: type=1326 audit(1776269900.065:65): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12968 comm="syz.1.2500" exe="/root/syz-executor" sig=0 arch=c000003e syscall=273 compat=0 ip=0x7f660a7f8c6c code=0x7ffc0000 [ 643.683603][ T37] audit: type=1326 audit(1776269900.065:66): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12968 comm="syz.1.2500" exe="/root/syz-executor" sig=0 arch=c000003e syscall=14 compat=0 ip=0x7f660a7f8cce code=0x7ffc0000 [ 643.683758][ T37] audit: type=1326 audit(1776269900.085:67): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12968 comm="syz.1.2500" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f660a83c4ab code=0x7ffc0000 [ 643.684072][ T37] audit: type=1326 audit(1776269900.085:68): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12968 comm="syz.1.2500" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f660a7fd04e code=0x7ffc0000 [ 643.705087][ T37] audit: type=1326 audit(1776269900.105:69): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12968 comm="syz.1.2500" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f660a83c819 code=0x7ffc0000 [ 643.710252][ T37] audit: type=1326 audit(1776269900.105:70): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12968 comm="syz.1.2500" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f660a83c819 code=0x7ffc0000 [ 644.427791][T12986] binder: BINDER_SET_CONTEXT_MGR already set [ 644.427810][T12986] binder: 12985:12986 ioctl 4018620d 200000004a80 returned -16 [ 649.067183][ T1371] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 649.712094][ T59] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 649.781143][ T59] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 649.786590][ T59] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 649.838510][ T59] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 649.846122][ T59] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 652.001679][ T5797] Bluetooth: hci0: command tx timeout [ 652.110684][ T1230] usb 6-1: new low-speed USB device number 12 using dummy_hcd [ 652.263274][ T1230] usb 6-1: config index 0 descriptor too short (expected 6427, got 27) [ 652.263360][ T1230] usb 6-1: config 0 has an invalid interface number: 21 but max is 0 [ 652.263376][ T1230] usb 6-1: config 0 has no interface number 0 [ 652.263411][ T1230] usb 6-1: config 0 interface 21 altsetting 0 endpoint 0x82 is Bulk; changing to Interrupt [ 652.263428][ T1230] usb 6-1: config 0 interface 21 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 652.263456][ T1230] usb 6-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 652.263473][ T1230] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 652.267989][ T1230] usb 6-1: config 0 descriptor?? [ 653.036671][ T1230] usb 6-1: USB disconnect, device number 12 [ 654.082805][ T5797] Bluetooth: hci0: command tx timeout [ 654.294867][T13075] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2540'. [ 654.294894][T13075] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2540'. [ 654.382701][T11427] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 654.767539][ T1371] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 654.856637][T11427] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 654.872815][T11427] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 654.873383][T11427] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 655.614864][ T1371] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 655.784300][ T59] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 655.788973][ T59] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 655.809051][ T59] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 655.817316][ T59] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 655.854614][ T59] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 656.161245][ T5797] Bluetooth: hci0: command tx timeout [ 656.345216][T13050] chnl_net:caif_netlink_parms(): no params data found [ 656.557999][T13108] bond1: entered promiscuous mode [ 657.476598][T13113] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2547'. [ 657.603762][ T1371] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 658.081260][ T5797] Bluetooth: hci3: command tx timeout [ 658.193137][T13128] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2551'. [ 658.243739][ T5797] Bluetooth: hci0: command tx timeout [ 658.427571][T13050] bridge0: port 1(bridge_slave_0) entered blocking state [ 658.427818][T13050] bridge0: port 1(bridge_slave_0) entered disabled state [ 658.428856][T13050] bridge_slave_0: entered allmulticast mode [ 658.458543][T13050] bridge_slave_0: entered promiscuous mode [ 658.524390][T13050] bridge0: port 2(bridge_slave_1) entered blocking state [ 658.524531][T13050] bridge0: port 2(bridge_slave_1) entered disabled state [ 658.524769][T13050] bridge_slave_1: entered allmulticast mode [ 658.570391][T13050] bridge_slave_1: entered promiscuous mode [ 658.789317][T13050] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 658.876571][T13050] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 659.467460][T13050] team0: Port device team_slave_0 added [ 659.635984][T13050] team0: Port device team_slave_1 added [ 660.160602][ T5797] Bluetooth: hci3: command tx timeout [ 660.664997][T13050] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 660.665012][T13050] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 660.665034][T13050] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 660.744017][T13050] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 660.744035][T13050] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 660.744061][T13050] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 661.578299][T13050] hsr_slave_0: entered promiscuous mode [ 661.591843][T13050] hsr_slave_1: entered promiscuous mode [ 661.600809][ C1] =========================[ 661.600809][ C1] ================================================================== [ 661.600825][ C1] BUG: KASAN: slab-use-after-free in rose_t0timer_expiry+0x1ad/0x570 [ 661.600888][ C1] Read of size 8 at addr ffff88806117f020 by task ktimers/1/29 [ 661.600907][ C1] [ 661.600924][ C1] CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 661.600974][ C1] Tainted: [L]=SOFTLOCKUP [ 661.600982][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 661.600997][ C1] Call Trace: [ 661.601005][ C1] [ 661.601014][ C1] dump_stack_lvl+0xe8/0x150 [ 661.601049][ C1] print_report+0xba/0x230 [ 661.601080][ C1] ? rose_t0timer_expiry+0x1ad/0x570 [ 661.601111][ C1] kasan_report+0x117/0x150 [ 661.601141][ C1] ? rose_t0timer_expiry+0x1ad/0x570 [ 661.601179][ C1] rose_t0timer_expiry+0x1ad/0x570 [ 661.601215][ C1] call_timer_fn+0x192/0x5e0 [ 661.601238][ C1] ? __pfx_rose_t0timer_expiry+0x10/0x10 [ 661.601270][ C1] ? call_timer_fn+0xd4/0x5e0 [ 661.601293][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 661.601322][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 661.601418][ C1] ? __pfx_rose_t0timer_expiry+0x10/0x10 [ 661.601453][ C1] __run_timer_base+0x6a3/0x9f0 [ 661.601498][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 661.601543][ C1] ? __local_bh_disable_ip+0x3c/0x420 [ 661.601580][ C1] run_timer_softirq+0xb7/0x170 [ 661.601601][ C1] handle_softirqs+0x1de/0x6d0 [ 661.601638][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 661.601661][ C1] run_ktimerd+0x69/0x100 [ 661.601681][ C1] smpboot_thread_fn+0x541/0xa50 [ 661.601703][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 661.601729][ C1] kthread+0x388/0x470 [ 661.601753][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 661.601852][ C1] ? __pfx_kthread+0x10/0x10 [ 661.601916][ C1] ret_from_fork+0x514/0xb70 [ 661.602002][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 661.602074][ C1] ? __switch_to+0xc79/0x1410 [ 661.602153][ C1] ? __pfx_kthread+0x10/0x10 [ 661.602218][ C1] ret_from_fork_asm+0x1a/0x30 [ 661.602294][ C1] [ 661.602317][ C1] [ 661.602330][ C1] Allocated by task 9431: [ 661.602363][ C1] kasan_save_track+0x3e/0x80 [ 661.602430][ C1] __kasan_kmalloc+0x93/0xb0 [ 661.602496][ C1] __kmalloc_cache_noprof+0x3a6/0x690 [ 661.602566][ C1] rose_add_node+0x26f/0xf50 [ 661.602620][ C1] rose_rt_ioctl+0xdc1/0x1350 [ 661.602667][ C1] rose_ioctl+0x3fb/0x8f0 [ 661.602734][ C1] sock_do_ioctl+0x101/0x320 [ 661.602780][ C1] sock_ioctl+0x5c9/0x7f0 [ 661.602859][ C1] __se_sys_ioctl+0xff/0x170 [ 661.602926][ C1] do_syscall_64+0x15f/0xf80 [ 661.603023][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 661.603073][ C1] [ 661.603092][ C1] Freed by task 16: [ 661.603118][ C1] kasan_save_track+0x3e/0x80 [ 661.603176][ C1] kasan_save_free_info+0x46/0x50 [ 661.603239][ C1] __kasan_slab_free+0x5c/0x80 [ 661.603328][ C1] kfree+0x1c1/0x6b0 [ 661.603392][ C1] rose_timer_expiry+0x4cb/0x600 [ 661.603449][ C1] call_timer_fn+0x192/0x5e0 [ 661.603505][ C1] __run_timer_base+0x6a3/0x9f0 [ 661.603593][ C1] run_timer_softirq+0xb7/0x170 [ 661.603640][ C1] handle_softirqs+0x1de/0x6d0 [ 661.603719][ C1] run_ktimerd+0x69/0x100 [ 661.603764][ C1] smpboot_thread_fn+0x541/0xa50 [ 661.603810][ C1] kthread+0x388/0x470 [ 661.603866][ C1] ret_from_fork+0x514/0xb70 [ 661.603935][ C1] ret_from_fork_asm+0x1a/0x30 [ 661.603989][ C1] [ 661.604002][ C1] The buggy address belongs to the object at ffff88806117f000 [ 661.604002][ C1] which belongs to the cache kmalloc-512 of size 512 [ 661.604056][ C1] The buggy address is located 32 bytes inside of [ 661.604056][ C1] freed 512-byte region [ffff88806117f000, ffff88806117f200) [ 661.604126][ C1] [ 661.604139][ C1] The buggy address belongs to the physical page: [ 661.604182][ C1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88806117dc00 pfn:0x6117c [ 661.604240][ C1] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 661.604280][ C1] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 661.604327][ C1] page_type: f5(slab) [ 661.604365][ C1] raw: 0080000000000240 ffff88801a01bc80 ffffea0001327f10 ffffea0001836c10 [ 661.604417][ C1] raw: ffff88806117dc00 000000080010000f 00000000f5000000 0000000000000000 [ 661.604474][ C1] head: 0080000000000240 ffff88801a01bc80 ffffea0001327f10 ffffea0001836c10 [ 661.604539][ C1] head: ffff88806117dc00 000000080010000f 00000000f5000000 0000000000000000 [ 661.604593][ C1] head: 0080000000000002 ffffea0001845f01 00000000ffffffff 00000000ffffffff [ 661.604648][ C1] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000004 [ 661.604666][ C1] page dumped because: kasan: bad access detected [ 661.604713][ C1] page_owner tracks the page as allocated [ 661.604735][ C1] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1448, tgid 1448 (kworker/u8:11), ts 112428583726, free_ts 0 [ 661.604844][ C1] post_alloc_hook+0x231/0x280 [ 661.604912][ C1] get_page_from_freelist+0x28bb/0x2950 [ 661.604993][ C1] __alloc_frozen_pages_noprof+0x18d/0x380 [ 661.605070][ C1] allocate_slab+0x77/0x660 [ 661.605118][ C1] refill_objects+0x334/0x3c0 [ 661.605198][ C1] __pcs_replace_empty_main+0x35c/0x710 [ 661.605246][ C1] __kmalloc_noprof+0x530/0x7b0 [ 661.605308][ C1] fib6_info_alloc+0x30/0xf0 [ 661.605364][ C1] ip6_route_info_create+0x142/0x860 [ 661.605441][ C1] ip6_route_add+0x49/0x1d0 [ 661.605502][ C1] addrconf_prefix_route+0x3a2/0x480 [ 661.605567][ C1] addrconf_add_linklocal+0x262/0x4a0 [ 661.605622][ C1] addrconf_addr_gen+0x2f8/0x360 [ 661.605692][ C1] addrconf_notify+0xb1e/0x1050 [ 661.605760][ C1] notifier_call_chain+0x1ad/0x3d0 [ 661.605816][ C1] netif_state_change+0x27d/0x3a0 [ 661.605871][ C1] page_owner free stack trace missing [ 661.605886][ C1] [ 661.605906][ C1] Memory state around the buggy address: [ 661.605938][ C1] ffff88806117ef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 661.605973][ C1] ffff88806117ef80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 661.606007][ C1] >ffff88806117f000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 661.606018][ C1] ^ [ 661.606029][ C1] ffff88806117f080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 661.606042][ C1] ffff88806117f100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 661.606053][ C1] ================================================================== [ 661.606148][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 661.606225][ C1] CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 661.606298][ C1] Tainted: [L]=SOFTLOCKUP [ 661.606321][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 661.606356][ C1] Call Trace: [ 661.606379][ C1] [ 661.606411][ C1] vpanic+0x56c/0xa60 [ 661.606523][ C1] ? __pfx_vpanic+0x10/0x10 [ 661.606614][ C1] ? irqentry_exit+0x218/0x730 [ 661.606723][ C1] panic+0xc5/0xd0 [ 661.606812][ C1] ? __pfx_panic+0x10/0x10 [ 661.606893][ C1] ? rose_t0timer_expiry+0x1ad/0x570 [ 661.606996][ C1] ? rose_t0timer_expiry+0x1ad/0x570 [ 661.607077][ C1] check_panic_on_warn+0x89/0xb0 [ 661.607154][ C1] ? rose_t0timer_expiry+0x1ad/0x570 [ 661.607237][ C1] end_report+0x73/0x170 [ 661.607319][ C1] ? rose_t0timer_expiry+0x1ad/0x570 [ 661.607399][ C1] kasan_report+0x128/0x150 [ 661.607477][ C1] ? rose_t0timer_expiry+0x1ad/0x570 [ 661.607542][ C1] rose_t0timer_expiry+0x1ad/0x570 [ 661.607638][ C1] call_timer_fn+0x192/0x5e0 [ 661.607718][ C1] ? __pfx_rose_t0timer_expiry+0x10/0x10 [ 661.607805][ C1] ? call_timer_fn+0xd4/0x5e0 [ 661.607862][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 661.607941][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 661.607998][ C1] ? __pfx_rose_t0timer_expiry+0x10/0x10 [ 661.608088][ C1] __run_timer_base+0x6a3/0x9f0 [ 661.608192][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 661.608297][ C1] ? __local_bh_disable_ip+0x3c/0x420 [ 661.608394][ C1] run_timer_softirq+0xb7/0x170 [ 661.608457][ C1] handle_softirqs+0x1de/0x6d0 [ 661.608561][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 661.608617][ C1] run_ktimerd+0x69/0x100 [ 661.608666][ C1] smpboot_thread_fn+0x541/0xa50 [ 661.608723][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 661.608788][ C1] kthread+0x388/0x470 [ 661.608846][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 661.608942][ C1] ? __pfx_kthread+0x10/0x10 [ 661.609027][ C1] ret_from_fork+0x514/0xb70 [ 661.609091][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 661.609178][ C1] ? __switch_to+0xc79/0x1410 [ 661.609290][ C1] ? __pfx_kthread+0x10/0x10 [ 661.609359][ C1] ret_from_fork_asm+0x1a/0x30 [ 661.609440][ C1] [ 661.610051][ C1] Kernel Offset: disabled