last executing test programs: 10.935006554s ago: executing program 3 (id=856): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000001180)=ANY=[@ANYBLOB="12010000090003206d0414c34000ffff000109022400010400a000090400000103010100093700086ce82201000905815f"], 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x14, &(0x7f0000000dc0)=ANY=[@ANYBLOB="00020c0000000c0002"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000000)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000500)={0x20, 0x0, 0x4}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f00000006c0)={0x84, 0x0, 0x0, 0x0, &(0x7f00000005c0)={0x20, 0x0, 0x4, {0x5}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 8.974991996s ago: executing program 4 (id=869): openat(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a98000000060a0b040000000000000000020000006c000480680001800a000100696e6e65720000005800028008000240000000840800034000000007080004400000000f"], 0xc0}}, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@tracing={0x0, 0x5}}, 0x20) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) r2 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f0000000240)=r2) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f0000000040)={0x1, r2}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/246, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/70, 0x100000}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0x73, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000000)=0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) 8.109057294s ago: executing program 0 (id=873): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ptrace$ARCH_SHSTK_ENABLE(0x1e, r0, 0x0, 0x5001) socket$kcm(0x10, 0x2, 0x0) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, 0x0, &(0x7f0000000140)) 7.025145978s ago: executing program 0 (id=874): ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000000100000024000180060005004e230007060001000200000008000300ac1414aa080006000100"], 0x38}}, 0x0) listen(r0, 0xc) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x30, r5, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1=0xac1414aa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}]}, 0x30}}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x14, r7, 0x1, 0x70bd2c, 0x25dfdbff}, 0x14}}, 0x800) 6.970944239s ago: executing program 0 (id=875): pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) fchdir(0xffffffffffffffff) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x13, &(0x7f0000000000)=0xffffff7e, 0x4) syz_usb_connect(0x5, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010003ac9bcc20d118af1ebb5a0102030109022400010700800b0904"], &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="40000000200001000000000000000000020000000000000000000000140011"], 0x40}}, 0x0) r3 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r3, 0xc4c85512, &(0x7f0000000280)={{0xc, 0x0, 0x0, 0x0, '\x00', 0xffffffff}, 0x0, [0x40000000, 0x0, 0x4, 0x3, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x2, 0x3, 0x4, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x5, 0x4829d, 0x0, 0xe, 0x0, 0x0, 0x1000008000, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0xffffffffffffffff, 0xfffffffffffffffc, 0x0, 0xc, 0x2, 0xfffffffffffffffc, 0x4, 0x0, 0x10000, 0x4, 0xfdfffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x1, 0x20040000000, 0x0, 0x8, 0x80000000, 0xc20, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x4, 0x0, 0xfffffffffffffffd, 0x7, 0x0, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x40000000000, 0x0, 0x0, 0x0, 0x1, 0x0, 0xfffffffffffffffc, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x1075, 0xfffffffffffffffe, 0x0, 0x8, 0x0, 0xfffffffffffffffc, 0x3, 0x7, 0x7, 0x20, 0x6, 0xffffffff80000001, 0x2, 0x0, 0xfffffffffffffffc, 0x4]}) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r4, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_QUEUEPAIR_SETPF(r4, 0x7a9, &(0x7f0000000340)={{@hyper, 0x2}, 0xe145, 0x3, 0x69c9, 0x2, 0xd, 0x385a2d2f, 0x0, 0x100000000}) r5 = syz_open_dev$video4linux(&(0x7f0000000480), 0xd, 0x123002) ioctl$VIDIOC_SUBDEV_S_FMT(r5, 0xc0585605, &(0x7f0000000240)={0x1, 0x0, {0x9, 0xfffff966, 0x3013, 0x0, 0x2, 0x2, 0x2}}) getsockopt$inet_sctp_SCTP_PR_STREAM_STATUS(r1, 0x84, 0x74, &(0x7f00000002c0)=""/198, &(0x7f00000003c0)=0xc6) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000080)=[{0x6, 0x8, 0x3, 0x7ffffdbd}]}) connect$vsock_stream(0xffffffffffffffff, 0x0, 0x0) syncfs(0xffffffffffffffff) madvise(&(0x7f0000000000/0x600000)=nil, 0x600707, 0x18) splice(r0, 0x0, r2, 0x0, 0x8001, 0xd) 6.94916761s ago: executing program 2 (id=876): r0 = socket(0x10, 0x803, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) syz_genetlink_get_family_id$devlink(0x0, r0) sendmsg$DEVLINK_CMD_TRAP_POLICER_GET(r0, 0x0, 0x4008000) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MPP(r1, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xec0}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000240)={'syzkaller0\x00', @broadcast}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x200504, 0x0) close(r6) r7 = socket$unix(0x1, 0x5, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r9, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x7, 0x6361, 0x5, 0xffffffff, 0x5}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x240080c1}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0x80000, {0x0, 0x0, 0x0, r9, {0x0, 0x6}, {0x3, 0xb}, {0xfff3, 0x6}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0xb, 0x8, 0x1}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x2404c0f1}, 0x6008000) ioctl$SIOCSIFHWADDR(r6, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 6.765068916s ago: executing program 2 (id=878): syz_open_dev$evdev(0x0, 0x1c, 0x140) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x121a03, 0x0) r0 = fsopen(&(0x7f0000000080)='qnx4\x00', 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x28383, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket(0x40000000015, 0x5, 0x0) bind$inet(r2, 0x0, 0x0) epoll_create1(0x0) socket$inet6(0xa, 0x80003, 0x6) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x2, 0x3, 0xfffffffffffffffd, 0x400000, 0x0, 0xffffffffffffff1b, 0x7b}, 0x0, &(0x7f0000000280)={0x3fc, 0x0, 0x0, 0x1, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[], 0xc4}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x7, 0x20000000080, 0x0, 0x4, 0x4, 0x7}, 0x0, &(0x7f00000002c0)={0x3ff, 0x400, 0xffffffffffffffff, 0x6, 0x4, 0xf, 0x4000000007d5}, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 6.398024808s ago: executing program 4 (id=881): openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x162e02, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) syz_io_uring_setup(0x207f, &(0x7f0000000080)={0x0, 0x8000, 0x2000, 0x40003, 0x352}, &(0x7f0000000100), &(0x7f00000003c0), &(0x7f0000000180)) fcntl$lock(0xffffffffffffffff, 0x410, &(0x7f0000000080)={0x0, 0x0, 0x4, 0x1fd}) ioctl$KVM_CLEAR_DIRTY_LOG(0xffffffffffffffff, 0xc018aec0, &(0x7f0000000000)={0x5, 0x180, 0x300, 0x0}) r0 = fsopen(&(0x7f0000000200)='udf\x00', 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000000)=0x14) sendto$packet(r1, &(0x7f0000000640), 0x0, 0x40, &(0x7f0000000200)={0x11, 0x86dd, r3, 0x1, 0x0, 0x6, @local}, 0x14) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000240)='uid', &(0x7f00000008c0)='-\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80=\x8a\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\x1f\x03\x00\x00\x00\x00\x00\x00\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9ak\x00\x00\x00\x00\x00\x00\x00\n\xa72\xa3\xef^\xe7\x8f', 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, &(0x7f00000002c0)="4df75a20d804ee4ce2aa8a0797d68e953766cd7a4855880c9bf8c2b7cf738dc33732698d631778d116a24fd82e39c234c499eff943378c8ca92835aac201b216e92cae0faa84392b", 0x0, 0x48) openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x20000, 0x0) r4 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r5 = syz_usb_connect(0x3, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000df2bfd404b0c0001cad7010203010902240001000000000904450002c9cee40009050802ff03000000090582030004"], 0x0) syz_usb_ep_write$ath9k_ep1(r5, 0x82, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="01a651d2"]) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x0, 0x2, 0x0, 0x4002004c4, 0x1004, 0xffffffffffffffff, 0xc595, 0x0, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0x80000004000000, 0x8d], 0xeeee8000, 0x2010d3}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) fallocate(0xffffffffffffffff, 0x10, 0x0, 0x72000) 6.288842581s ago: executing program 2 (id=884): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ptrace$ARCH_SHSTK_ENABLE(0x1e, r0, 0x0, 0x5001) r3 = socket$inet6_sctp(0xa, 0x801, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000140)) 5.957755382s ago: executing program 3 (id=886): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_int(r0, 0x29, 0x1a, &(0x7f0000000100)=0x8001, 0x4) sendmmsg$inet6(r0, &(0x7f0000000480)=[{{&(0x7f0000000040)={0xa, 0x4e23, 0xb, @loopback, 0x1}, 0x1c, &(0x7f0000000380)=[{&(0x7f0000000140)='2', 0x1}], 0x1}}], 0x1, 0x8000) 4.561530376s ago: executing program 2 (id=887): pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c00)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x59, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) getpid() syz_open_procfs(0xffffffffffffffff, &(0x7f0000019140)='net/fib_trie\x00') prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_usbip_server_init(0x5) writev(r2, 0x0, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r3, 0x8955, &(0x7f00000003c0)={{0x2, 0x4e22, @empty}, {0x20000010304, @local}, 0x6, {0x2, 0x4e20, @rand_addr=0x64010101}}) fcntl$setpipe(r0, 0x407, 0x0) write$FUSE_INIT(r0, &(0x7f0000000340)={0x50, 0xfffffffffffffff5, 0x0, {0x7, 0x28, 0x2, 0xffffffffc28c554a, 0x0, 0x40, 0x8, 0x3, 0x0, 0x0, 0x4, 0x8}}, 0x50) vmsplice(r0, &(0x7f0000000140)=[{&(0x7f0000000100)="eb", 0x20000101}], 0x1, 0x0) fcntl$setpipe(r0, 0x407, 0x2000000) ioctl$sock_inet_udp_SIOCINQ(r0, 0x541b, 0x0) 4.253901265s ago: executing program 3 (id=888): r0 = socket(0x10, 0x803, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) syz_genetlink_get_family_id$devlink(0x0, r0) sendmsg$DEVLINK_CMD_TRAP_POLICER_GET(r0, 0x0, 0x4008000) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MPP(r1, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xec0}, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000240)={'syzkaller0\x00', @broadcast}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x200504, 0x0) close(r6) r7 = socket$unix(0x1, 0x5, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r9, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x7, 0x6361, 0x5, 0xffffffff, 0x5}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x240080c1}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0x80000, {0x0, 0x0, 0x0, r9, {0x0, 0x6}, {0x3, 0xb}, {0xfff3, 0x6}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0xb, 0x8, 0x1}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x2404c0f1}, 0x6008000) ioctl$SIOCSIFHWADDR(r6, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 3.529573218s ago: executing program 1 (id=890): syz_emit_ethernet(0xa2, &(0x7f0000000000)={@link_local, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "081f20", 0x6c, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, [{0x0, 0xa, "a78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96489269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af1802"}, {0x18}, {0x18, 0x1, "45976e75e433"}]}}}}}}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r3 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r3, 0x29, 0x2e, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) process_vm_readv(r0, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFDSTADDR(r4, 0x8918, &(0x7f0000000080)={@loopback={0x0, 0x3fc}, 0x0, r5}) 3.297098606s ago: executing program 0 (id=891): openat(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a98000000060a0b040000000000000000020000006c000480680001800a000100696e6e65720000005800028008000240000000840800034000000007080004400000000f"], 0xc0}}, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@tracing={0x0, 0x5}}, 0x20) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) r2 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f0000000240)=r2) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f0000000040)={0x1, r2}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/246, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/70, 0x100000}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0x73, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000000)=0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) 2.601425508s ago: executing program 3 (id=892): ioctl$KVM_CLEAR_DIRTY_LOG(0xffffffffffffffff, 0xc018aec0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000005c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x13c8, 0x11e0, 0xc8, 0x8, 0x11e0, 0x5803, 0x12f8, 0x2e8, 0x2e8, 0x12f8, 0x2e8, 0x3, 0x0, {[{{@uncond, 0x0, 0x1198, 0x11e0, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "cfcaf80c672f61cd17ae5119b5135c2aee68d23a465cd431e1ecef50c3234e082555f67222476147864fa03182f5df11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f35a214e67262c1fe4b124e0f7323a587d2a1fcfe36bbf12eca0a7b66c60c527bac2b5", 0x2, 0x3}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x1, 0x0, 0x0, './cgroup.cpu/syz1\x00', 0x0, {0xfffffffffffffffc}}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x82, 0x8, 0xe, 'syz0\x00', {0x1}}}}, {{@uncond, 0x0, 0xa8, 0x118}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x5, 0x5, 0x9, 0x1, 0x0, "f66026c5e6e4409b4fed9e7027bc4e8c6b10d1bd2e4c13b96328722f2d860d2371d0ae65ef518c01cf9b398b7099487a3f073b38f0d17df76a133ae1adcee537"}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1428) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000001500)=[{{0x0, 0x0, &(0x7f0000000300)=[{0x0}, {&(0x7f00000005c0)="f2", 0x1}], 0x2}}, {{0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000bc0)="e7bc2f4799fe560c31cf5a20a1b22fb77ce7f19e605b6a8d2645af02e63f9a9d7ba31907ccc0f4aa71ec0762b3a8e3332fe3603b4624ac6a578ccd9a27b381a8dad12b3e3de940a99238945935184cd93dd174b70ecb9c3c99d2df9dd0cbef6a9e230f7dd8367384f034a7a011388990e94cd4", 0x73}, {&(0x7f0000000c80)="6c3e28dcd5c7eb9bc39a4bbc398357f3ad842b38a95863911bbd6e6afd9641d356257181e43b6e60349f69ec5f529734f76708a6c5eccb57005c1a513d8030d12c", 0x41}, {&(0x7f0000000d00)="dc6e94ac2db166801ffce85f6f44f2cb071c6b5113bc6bbf2f503d468253693a01102fcb8157c6e8a2b5620efa5d22400147cce896821150f95c0c69fa587a1f99fcb28cfeb09f45cb836f0ff891be10bb209dc04adc202ef866f27b74faa5ad3a2e5d40ebd6785c4e4a97ac13238c746d1109d12af5446c4e84591f121a494251e43bed18f6269bdd2e56f9c211dd7145f664286911b8bb3acf76a1b5ece94183a6c8cc47f2e1dd4e91dc10be8732e92e8620fa060fb15016c2dc9b6da18325e778660d499aec6215b0f9f679fa76d22cdd4ae3776203e2054240594f1c9b77ad77cf3f", 0xe4}, {&(0x7f0000000fc0)="c6eae69212ba50dd664af774c32d34273a3baad9692140de74d9294c555a8c2e0d53acea79b788b5eb1a12ada17eda2b2fb96c439ce16e6266afda6613fd7c90be9a9dfcd1b099fe6b023b725241a6e1048c700e7a939bd3a38f1101213b81c252dd8c44b7e647940438343d0d082507", 0x70}, {&(0x7f00000010c0)="978d1129fddf5e2f1be8be48f935ef4f71893a57f79be3e44522d3987ccee23f4e717d8c8e14573937040fb658a24f1c9e0c7f98a24fa1209a6ea754e1244234c715713d120b6929614443fd6b4223bc04c3a8c9241ccbb6a8b0bb19fe4eedae48642a74e97588dc36bf06a4c1fb17b47b39240a6a8e9b5daa97e63d777e665841a349c52022252eafc1c129e154ab390624dd7fb8ac1e44c203140d6aab524f61cd8642ee0f380ebb21dc9267a8fbefa6eec89ff97e7800f44f89b17d43206217941c34067892c05465382550a1da2519", 0xd1}, {&(0x7f00000011c0)}], 0x6}}], 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f00000001c0)={{0xeeee8000, 0x4, 0x3, 0xf1, 0x5, 0xfa, 0xd4, 0x6, 0x0, 0x4, 0x7, 0x4f}, {0x5000, 0x2, 0xd, 0x9, 0x8, 0x3, 0xb, 0xb, 0x5, 0xf, 0x3, 0xc0}, {0xffff1000, 0x9000, 0xb, 0x1, 0x2, 0x7, 0x4, 0x4, 0x81, 0x0, 0x6, 0x5}, {0xeeee8000, 0x2000, 0x8, 0xf8, 0x3, 0x46, 0x2, 0xd, 0x6, 0xf3, 0x8, 0x1}, {0x100000, 0x4000, 0x9, 0x9, 0x3, 0x9, 0xd, 0x6, 0x5, 0x9, 0xc, 0x4b}, {0x6000, 0x0, 0x4, 0x4, 0x3, 0x7d, 0x0, 0xff, 0x4, 0x90, 0x1, 0xfc}, {0x8000000, 0x4000, 0x0, 0x9d, 0x3, 0x0, 0x0, 0xb, 0x5, 0x7, 0x9, 0xf8}, {0xf7f63004, 0x8000000, 0xf, 0x5, 0x7, 0x7, 0xa, 0x9, 0x54, 0x1, 0x2, 0x7}, {0xdddd1000, 0x5}, {0x4, 0x9}, 0x40030000, 0x0, 0x80a0000, 0x300, 0x1, 0xa901, 0xe6e70c00, [0x3, 0x401, 0x7, 0xc5]}) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 2.21946676s ago: executing program 1 (id=893): syz_mount_image$ext4(&(0x7f0000000780)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0xa00008, &(0x7f00000002c0), 0x1, 0x7ad, &(0x7f00000007c0)="$eJzs3c9rG1ceAPDvyD/jZNdeWNjNngwLu4YQeZ31JruwsFn2sBQaCLTnJEZWTGrZCpYcYmNIQin00kNLD4XmknPTprdc++PaXvo39FAS0tYJTemhuIw0SmRbcpzEklL8+cBY782M9N533sybZ82gCWDfGk//5CIORwykydFsfhLZjOiPOFlf7+H6WiGdktjYeOW7pLbOg/W1QjS9J3Uwy/wxIj57I+JIbnu5lZXV+ZlSqbiU5SerCxcnKyurRy8szMwV54qLx6emp4+d+MeJ43sX6w9frh66+/b///rRyZ9e/8Ottz5P4mQcypY1x7FXxmM82yYD6Sbc5H97XViPJb2uAM8kPTT76kd5HI7R6NuhJf/T1ZoBAJ1yJSI2AIB9JnH+B4B9pvE9wIP1tUJjivr1nKs9/WKiS+79NyKG6/E3rm/Wl/TXr9l9NVy7DjryIKldI2lIImJsD8ofj4jrt8/cTKfo0HVIgFauXouIc2PjW/v/tIfbes/C0/rbLtYZ35LX/0H3fJKOf/65ffwXkcuO/+Ha363jn6EWx+6zePLxn7uzKTuwB4U2Scd//266t+1hU/yZsb4s95vamG8gOX+hVEz7tt9GxEQMDKX5qR3KmLj/8/12y5rHf9+/89oHafnp6+M1cnf6hza/Z3amOvM8MTe7dy3iT/2t4k8etX/SZvx7epdlvPSvN99vtyyNP423MW2Pv7M2bkT8pWX7P74PKtnx/sTJ2u4w2dgpWvj46/dG2pXf3P7Xb6clrRUa/wt0Q9r+IzvHP5Y0369Zefoyvrgx+mm7ZZvjP3MzLX9z/K33/8Hk1Vp6MJt3eaZaXZqKGExe3j7/2OP3NvKN9dP4J/7c+vjfaf9Pu6FzWXrjCTc/9t/99sNnj7+z0vhn0/ZPsiCe2P5Pn7j1cL6vXfm7a//pWmoim7O9/+vf9rm7reBzbTwAAAAAAAAAAAAAAAAAAAAAAAAA2KVcRByKJJd/lM7l8vn6M7x/HyO5UrlSPXK+vLw4G7VnZY/FQK7xU5ejTb+HOpX9Hn4jf2xL/u8R8buIeHfoQC2fL5RLs70OHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyB9s8/z/1zVCvawcAdMxwrysAAHSd8z8A7D9tzv+DrWcf6GhdAIDuqJ3/k/5eVwMA6CLf/wPA/uP8DwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQIedPnUqnTZ+XF8rpPnZSyvL8+VLR2eLlfn8wnIhXygvXczPlctzpWK+UF5o+0FX6y+lcvnidCwuX56sFivVycrK6tmF8vJi9eyFhZm54tniQNciAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDdq6yszs+USsUliZ0TV16IalzLmq3XW0PihUgMRUSnimjuJQ70pnMCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+BX4JQAA//9qsh/Y") mount$overlay(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) 1.974101197s ago: executing program 2 (id=894): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x1000008, 0x31, 0xffffffffffffffff, 0xd363f000) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) shutdown(0xffffffffffffffff, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000080), 0x101800, 0x0) pread64(r1, &(0x7f00000000c0)=""/60, 0x3c, 0x100000000) syz_mount_image$exfat(&(0x7f00000009c0), &(0x7f0000000000)='./file1\x00', 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB='utf8,umask=00000000uid=', @ANYRESHEX=0xee01, @ANYBLOB=',dmask=00000000000000000000001,time_offset=0x0000000000000007,namecase=1,errors=remount-ro,dmask=00000000000000000000001,time_offset=0x0000000000000006,sys_tz,\x00'], 0x1, 0x152b, &(0x7f0000002f80)="$eJzs3AmYjtXbAPD7Puc8Y0zS2yTLcM65H95kOSZJsiTJkiRJkmRLSJrkLwmJIVvSkIRkGZJlCMkyMWns+74kJEmTJCHZkvNdir/66r8vvuub+3ddzzXnfs9zn+c87/0+8yyzfNN5SI1GNas2ICL4l+AvX5IBIBYABgDANQAQAEDZ+LLxF/pzSkz+1zbC/r0eSrvSM2BXEtc/e+P6Z29c/+yN65+9cf2zN65/9sb1z964/oxlZ5umFbiWl+y78PP/7IzP//+PZJUa88WaUtd3AYj5e1O4/tkb1///reDvWYnrn71x/bOr2Cs9AfZ/AB//2UGOv9jD9c/euP6MZWdX+vnzf36Rf7UfItnhPfgr+88YY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjP0XnPaXKQC41L7S82KMMcYYY4wxxti/j89xpWfAGGOMMcYYY4yx/zwEARIUBBADOSAWckIcCAC4GnLDNRCBayEeroM8cD3khXyQHwpAAhSEQqDBgAWCEApDEYjCDVAUboRiUBxKQElwUAoS4SYoDTdDGbgFysKtUA5ug/JQASpCJbgdKsMdUAXuhKpwF1SD6lADasLdUAvugdpwL9SB+6Au3A/14AGoDw9CA3gIGsLD0AgegcbwKDSBptAMmkOLfyr/BegOL0IP6AnJ0At6w0vQB/pCP+gPA+BlGAivwCB4FVJgMAyB12AovA7D4A0YDiNgJLwJo+AtGA1jYCyMg1QYDxPgbZgI78AkmAxTYCqkwTSYDu/CDJgJs+A9mA3vwxyYC/NgPqTDB7AAFkIGfAiL4CPIhMWwBJbCMlgOK2AlrILVsAbWwjpYDxtgI2yCzbAFtsI22A474GPYCZ/ALtgNe/5cv38k/9Sv8j+FvdAFAQEFClSoMAZjMBZjMQ7jMBfmwtyYGyMYwXiMxzyYB/NiXsyP+TEBE7AQFkKDBgkJC2NhjGIUi2JRLIbFsASWQIcOEzERS+PNWAbLYFksi+WwHJbHClgBK2ElrIyVsQpWwapYFathNayBNfBuvBt7YW2sjXWwDtbFupceT2EDbIANsSE2wkbYGBtjE2yCzbAZtsAW2BJbYitshW2wDbbFttgO22ESJmF7bI8dsAN2xI7YCTthZ+yMXbArds16IQfgi/gi9sRqohf2xt7YB1Ny9MP+2B9fxoH4Cr6Cr2IKDsYh+Bq+hq/jMDyJw3EEjsSRWFm8haNxDJIYh6mYihNwAk7EiTgJJ+NknIppOA2n43ScgTNxJr6Hs/F9fB/n4lycj+mYjgtwIWZgBi7CU5iJi3EJLsVluByX4UpchStxDa7FNbge1+NG3IibcTNuxa24Hbfjx6gA8BPcjbsxBffiXtyH+3A/7scDeACzMAsP4kE8hIfwMB7GI3gEj+IxPI7H8ASewJN4Ck/jaTyLZ/EcPpfwVcOPi69OAXGBEkrEiBgRK2JFnIgTuUQukVvkFhEREfEiXuQReURekVfkF/lFgkgQhUQhYYQRJMIYABBRERVFRVFRTBQTJUQJ4YQTiSJRlBalRRlRRpQVt4py4jZRXlQQrV0lUUlUFm1cFXGnqCqqimqiuqghaoqaopaoJWqL2qKOqCPqirqinnhA1Be9sB8+JC5UppEYjI3FEGwimgp58QhoKYZhK9FatBFPiBE4HNuJli5JPC3ai9HYQfxJjMFnRScxDjuL50UX0VV0Ey+I7qKV6yF6iknYS/QWU7GP6Cv6if5iBlYX7+HsnDXEqyJFDBZDxGtiPr4uhok3xHAxQowUb4pR4i0xWowRY8U4kSrGiwnibTFRvCMmicliipgq0sQ0MV28K2aImWKWeE/MFu+LOWKumCfmi3TxgVggFooM8aFYJD4SmWKxWCKWimViuVghVopVYrVYI9aKdWK92CA2ik1is9gitoptYrvYIT4WO8UnYpfYLfaIT8Ve8ZnYJz4X+8UX4oD4UmSJr8RB8bU4JL4Rh8W34oj4ThwVx8Rx8b04IX4QJ8UpcVqcEWfFj+Kc+EmcF16ARCmklEoGMkbmkLEyp4yTV8lcMrj47l4r4+V1Mo+8XuaV+WR+WUAmyIKykNTSSCtJhrKwLCKj8gZZVN4oi8nisoQsKZ0sJRPlTbK0vFmWkbfIsvJWWU7eJsvLCrKirCRvl5XlHRIiv2yjmqwua8ia8m6ZDPfI2vJeWUfeJ+vK+2U9+YCsLx+UDeRDsqF8WDaSj8jG8lHZRDaVzWRz2UI+JlvKx2Ur2Vq2kU/ItvJJ2U4+JZPk07K99Bc/Is/KTvI52Vk+L7vIrrKb/Emel172kD0l9ALZW74k+8i+sp/sLwfIl+VA+YocJF+VKXKwHCJfk0Pl63KYfEMOlyPkSPmmHCXfkqPlGDlWjpOpcrycIN+WE+U7cpKcLKfIqTJNTpP9Lo40S8q/mf/2r/MvnHrlNDno561vlJvkZrlFbpXb5Ha5Q34sd8qdcpfcJffIPXKv3Cv3yX1yv9wvD8gDMktmyYPyoDwkD8nD8rA8Io/Io/KYPCO/lyfkD/KkPCVPyTPyrDwrz118D0ChEkoqpQIVo3KoWJVTxamrVC51tcqtrlERda2KV9epPOp6lVflU/lVAZWgCqpCSiujrCIVqsKqiIqqG/DiB0aVUCWVU6VUorrpH8lXRdWNqpgq/pv8S/NL/gvza6FaqJaqpWqlWqk2qo1qq9qqdqqdSlJJqr1qrzqoDqqj6qg6qU6qs+qsuqguqpvqprqr7qqH6qGSVbLqrV5SfVRf1U/1VwPUy2qgGqgGqUEqRaWoIWqIGqqGqmFqmBquhquRaqQapUap0Wq0GqvGqlSVqiaoCWqimqgmqUlqipqi0lSamq6mqxlqhpqlZqnZaraao+aoeWqeSlfpaoFaoDJUhlqkFqlMtVgtVkvVUrVcLVcr1Uq1Wq1Wa9VatV6tV5lqk9qktqgtapvapnaoHWqn2ql2qV1qj9qj9qq9ap/ap/ar/eqAOqCyVJY6qA6qQ+qQOqwOqyPqiDqqjqrj6rg6oU6ok+qkOq1Oq7PqrDqnzqnz6ryCQIAIRKACFcQEMUFsEBvEBXFBriBXkDvIHUSCSBAfxAd5guuDvEG+IH9QIEgICgaFAh2YwAbiYtGjwQ1B0eDGoFhQPCgRlAxcUCpIDG4KSgc3B2WCW4Kywa1BueC2oHxQIagYVApuDyoHdwRVgjuDqsFdQbWgelAjqBncHdQK7glqB/cGdYL7grrB/UG94IGgfvBg0CB4KGgYPBw0Ch4JGgePBk2CpkGzoHnQ4t86vvcn8z3ueuieOln30r31S7qP7qv76f56gH5ZD9Sv6EH6VZ2iB+sh+jU9VL+uh+k39HA9Qo/Ub+pR+i09Wo/RY/U4narH6wn6bT1Rv6Mn6cl6ip6q0/Q0PV2/q2fomXqWfk/P1u/rOXqunqfn63T9gV6gF+oM/aFepD/SmXqxXqKX6mV6uV6hV+pVerVeo9fqdXq93qA36k16s96it+pterveoT/WO/UnepferffoT/Ve/Znepz/X+/UX+oD+Umfpr/RB/bU+pL/Rh/W3+oj+Th/Vx/Rx/b0+oX/QJ/UpfVqf0Wf1j/qc/kmf1/7Cxf2F07tRRpkYE2NiTayJM3Eml8llcpvcJmIiJt7Emzwmj8lr8pr8Jr9JMAmmkClkLiBDprApbKImaoqaoqaYKWZKmBLGGWcSTaIpbUqbMqaMKWvKmnKmnClvypuKpqK53dxu7jB3mDvNneYuc5epbqqbmqamqWVqmdqmtqlj6pi6pq6pZ+qZ+qa+aWAamIamoWlkGpnGprFpYpqYZqaZaWFamJampWllWpk2po1pa9qadqadSTJJpr1pbzqYDqaj6Wg6mU6ms+lsupguppvpZrqb7qaH6WGSTbLpbXqbPqaP6Wf6mQFmgBloBppBZpBJMSlmiBlihpqhZpgZZoabEWbkhQtV85YZbcaYsWacSTWpZoKZYCaaiWaSmWSmmCkmzaSZ6Wa6mWFmmFlmlpltZps5Zo6ZZ+aZdJNuFpgFJsNkmEVmkck0mWaJWWKWmWVmhVlhVplVZo1ZY9bBOrPBbDCbzCazxWwx28w2s8PsMDvNTrPL7DJ7zB6z1+w1+8w+s9/sNwfMAZNlssxBc9AcMofMYXPYHDFHzFFz1Bw3x80Jc8KcNCfNaXPanDX5Lp4vvYm1OW2cvcrmslfb3PYa+7/j/LaATbAFbSGrbV6b7zexsdYWs8VtCVvSOlvKJtqbfheXtxVsRVvJ3m4r2ztsld/Ftew9tra919ax99ma9u7fxHXt/baefcTWRwSwTW1D29w2so/YxvZR28Q2tc1sc9vWPmnb2adskn3atrfP/C5eYBfaVXa1XWPX2l12tz1tz9hD9ht71v5oe9iedoB92Q60r9hB9lWbYgf/Lh5p37Sj7Ft2tB1jx9pxv4un2Kk2zU6z0+27doad+bs43X5gZ9sMO8fOtfPs/J/jC3PKsB/aRfYjm2kDWGKX2mV2uV1hV/55rkvtervBbrQ77Sd2i91qt9ntdselC2G72+6xn9q99jN70H5t99sv7AF72GbZr36OL+zfYfutPWK/s0ftMXvcfm9P2B/UpewL+/69/cmet94CIQFJUhRQDOWgWMpJcXQV5aKrKTddQxG6luLpOspD11Neykf5qQAlUEEqRJoMWSIKqTAVoSjdQJemV4JKkqNSlEg3UWm6mcrQLVSWbqVydBuVpwpUkSrR7VSZ7qAqdCdVpbuoGlWnGlST7qZadA/VpnupDt1Hdel+qkcPUH16kBrQQ9SQHqZG9Ag1pkepCTWlZtScWtBj1JIep1bUmtrQE9SWnqR29BQl0dPUnp6hDvQn6kjPUid6jjrT89SFulI3eoG604vUg3pSMvWi3vQS9aG+1I/60wB6mQbSKzSIXqUUGkxD6DUaSq/TMHqDhtMIGklv0ih6i0bTGBpL4yiVxtMEepsm0js0iSbTFJpKaTSNptO7NINm0ix6j2bT+zSH5tI8mk/p9AEtoIWUQR/SIvqIMmkxLaGltIyW0wpaSatoNa2htbSO1tMG2kibaDNtoa20jbbTDvqYdtIntIt20x76lPbSZ7SPPqf99AUdoC8pi76ig/Q1HaJv6DB963vSd3SUjtFx+p5O0A90kk7RaTpDZ+lHOkc/0XnyBCGGIpShCoMwJswRxoY5w7jwqjBXeHWYO7wmjITXhvHhdWGe8Powb5gvzB8WCBPCgmGhUIcmtCGFYVg4LBJGwxvCouGNYbGweFgiLBm6sFSYGN4Ulg5vDsuEt4Rlw1vDcuFtYfmwQvjIfZXC28PK4R1hlfDOsGp4V1gtrB7WCGuGd4e1wnvC2uG9YZ3wvrBMeH9YL3wgrB8+GDYIHwobhg+HjcJHwsbho2GTsGnYLGwetggfC1uGj4etwtZhm/CJsG34ZNgufCpMCp8O24fP/Nx//8K/3J8c9gp7hy+FL4Xe3yvnRedH06MfRBdEF0Yzoh9GF0U/imZGF0eXRJdGl0WXR1dEV0ZXRVdH10TXRtdF10c3RDdGva+ZAxw64aRTLnAxLoeLdTldnLvK5XJXu9zuGhdx17p4d53L4653eV0+l98VcAmuoCvktDPOOnKhK+yKuKi7wRV1N7pirrgr4Uo650q5RNfctXAtXEv3uGvlWrs27gn3hHvSPemeck+5p11794zr4P7kOrpnXSf3nHvOPe+6uK6um3vBdXfjc/9yTCa73q636+P6uH6unxvgBriBbqAb5Aa5FJfihrghbqgb6oa5YW64G+5GupFulBvlRrvRbqwb61JdqpvgJriJbqKb5Ca5KW6KS3Npbrqb7ma4Ga7yzF+2MsfNcfPcPJfu0t0Cd+GaMcMtcotcpst0S9wSt8wtcyvcCrfKrXJr3Bq3zq1zG9wGt8ltclvcFrfNbXM73A630+10u/w1vwzq9rp9bp/b7/a7A+5Ll+W+cgfd1+6Q+8Yddt+6I+47d9Qdc8fd9+6E+8GddKfcaXfGnXU/unPuJ3feeZcaGR+ZEHk7MjHyTmRSZHJkSmRqJC0yLTI98m5kRmRmZFbkvcjsyPuROZG5kXmR+ZH0yAeRBZGFkYzIh5FFkY8imZHFkSWRpZFlkeUR7wtuCX1hX8RH/Q2+qL/RF/PFfQlf0jtfyif6m3xpf7Mv42/xZf2tvpy/zZf3FXxF/6hv4pv6Zr65b+Ef8y39476Vb+3b+Cd8W/+kb+ef8kn+ad/eP+M7+D/5jv5Z38k/5zv7530X39V38y/47v5F38P39Mm+l+/tX/J9fF/fz/f3A/zLfqB/xQ/yr/oUP9gP8a/5of51P8y/4Yf7EX5kzJt+1KVbZBjnU/14P8G/7Sf6d/wkP9lP8VN9mp/mp/t3/Qw/08/y7/nZ/n0/x8/18/x8n+4/8Av8Qp/hP/SL/Ec+0y++9FDSr/Ar/Sq/2q/xa/06v95v8Bv9Jr/Zb/Fb/Ta/3e/wH/ud/hO/y+/2e/ynfq//zO/zn/v9/gt/wH/ps/xX/qD/2h/y3/jD/lt/xH/nj/pj/rj/3p/wP/iT/pQ/7c/4s/5Hf87/5M/z36wxxhhjjP1dxl9uit/2/PI4v9cf5IhfrdwbAK7eWiDr1/0XrijX5f2l3VcktI0AwNM9Oz90aalWLTk5+eK6mRKCInMBLv0k6IIYuBwvhjbwJCRBayj9h/PvK7qepb8xfvRWgLhf5cTC5fjy+J8DYPIfjP/YEyMXlAtPx/+V8ecCFCtyOScnXI4XQ5ufn6+0hjJ/Yf75Wv6N+ef8IhWg1a9ycsHl+PL8E+FxeAaSfrMmY4wxxhhjjDH2i76iYsdL95+XfuPzj+7PE9TlnBxwOf5b9+eMMcYYY4wxxhi78p7t2u2px5KSWnf8xxtV/qmsv7vRGP5TI3PjDxveA1x6RQHAvzggwIWG/G/uxeb/yrZSLh46/7tr2RkfwP+NUv7zjbF/fuUKf2NijDHGGGOM/dtdvvr/7evqSk2IMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhjLhv4b/1fsSu8jY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxdqX9TwAAAP//HmP+kg==") prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x8b}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x4000000000001, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) ptrace(0x10, 0x1) gettid() r3 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x4058534c, &(0x7f00000003c0)={0x80, 0x1, {0x3, 0x3, 0x8b2c, 0x3, 0x2c7}}) link(0x0, &(0x7f0000000240)='./file1\x00') sendto$inet6(0xffffffffffffffff, &(0x7f0000000080)="7800000018002507b9409b14ffff", 0xe, 0x0, 0x0, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x481, 0x0) r5 = dup(r4) ioctl$PTP_EXTTS_REQUEST2(r5, 0x40603d07, &(0x7f0000000040)={0x78969284}) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r5, 0xc0a85322, &(0x7f0000000440)) 1.952933608s ago: executing program 1 (id=895): socket$pppoe(0x18, 0x1, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0xfffffffffffffdbc, 0x2, {{0x1, 0xd, 0x0, 0x9, 0x8}, 0x6, 0x1, 0x1, 0x4, 0x8, 0xe, 0x7, 0x1d, 0x3, 0x9, {0xa2d6, 0x200, 0xb, 0x40, 0x2, 0x1ff}}}}]}, 0x78}}, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000027c0)=@newtfilter={0x4ac, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r6, {0x0, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0x478, 0x2, [@TCA_MATCHALL_ACT={0x474, 0x2, [@m_police={0x470, 0x1, 0x0, 0x0, {{0xb}, {0x444, 0x2, 0x0, 0x1, [[@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x1080, 0x4, 0x80000ec2, 0x6, 0x8, 0x400, 0x5, 0x1, 0x7, 0x470, 0x487, 0x100, 0xa99, 0xffffff01, 0x5, 0x37f, 0x8, 0x6, 0x3, 0x3, 0x800, 0xd2f5, 0x40, 0x4, 0x4, 0x5, 0x7, 0x12, 0x2, 0x8, 0x101, 0xffffffff, 0x2, 0x10000, 0xa6, 0x3, 0x10000, 0x5, 0x4, 0x0, 0x3, 0x0, 0xd, 0x6, 0x98, 0x8, 0x6, 0x9, 0x1000, 0xb3000, 0xf, 0x3, 0x9, 0xb4, 0x94d, 0x9, 0x8, 0x6, 0x140, 0xec0, 0xffff, 0x4, 0x2, 0x3ff, 0x3e, 0xb827, 0x0, 0x0, 0x365, 0x8, 0x8, 0xf, 0x1, 0xfffffffe, 0xfffffff6, 0x93, 0x7ff, 0x92, 0x0, 0x7, 0xfffffffc, 0x7ff, 0x9, 0x2, 0x0, 0x2, 0x8, 0x1, 0x3, 0x9, 0xc, 0x5, 0x3, 0x3, 0x400, 0x100000, 0x7f, 0x2, 0x8, 0x4, 0x7, 0x4, 0x7, 0xfffffffa, 0x101, 0xadd9, 0xe, 0x400, 0x7, 0x7fffffff, 0x2, 0x4, 0x0, 0x5, 0x4, 0x3, 0x8, 0x9, 0x6, 0x6, 0x2, 0xb, 0x3, 0x7f, 0xffff, 0x401, 0x1685, 0xa252, 0x2, 0x200, 0x3, 0x1, 0x400, 0xfffffffc, 0xfffffffc, 0x1000, 0x7ff, 0x1, 0x1f6, 0x751, 0x7, 0x40000000, 0x4, 0xffffdbb7, 0x50, 0xf, 0xf, 0xe, 0x3, 0x0, 0x81, 0xfff80000, 0x7a7, 0x1, 0x6, 0x3, 0x8, 0x4, 0x5, 0x2, 0x0, 0x4e8, 0x80, 0x4, 0x8, 0x5, 0x0, 0x5, 0x7fff, 0x7, 0x8, 0x6a4941c5, 0x2ea567b4, 0x8, 0x80000000, 0x9, 0x40, 0x2, 0xfff, 0x8, 0x3, 0x1, 0x1, 0x0, 0x0, 0xd3bed341, 0x691f, 0x0, 0x2, 0x9, 0x6, 0x0, 0x1ff, 0x3, 0x3, 0x6, 0x5fc8462f, 0x0, 0x7, 0xffff, 0xfffffffc, 0x5, 0x0, 0xb9a6, 0x522, 0x2, 0x2, 0x900, 0x8, 0xbb99, 0xb8000000, 0x8, 0xffffff01, 0xc0a1, 0x8, 0x8, 0xa, 0x59, 0x9, 0x2, 0x101, 0x5f502dc7, 0x7, 0x0, 0x4, 0x6, 0x80000001, 0x3, 0xffffff97, 0x2, 0xfff, 0x1, 0x40, 0x8, 0x3, 0x710, 0x8, 0x1, 0xfffff339, 0x3, 0x8001, 0x1, 0x8001, 0x9, 0x8, 0xfffffffa, 0x8, 0x9, 0x3, 0xe, 0x10000, 0x9, 0x9, 0x7, 0xfffffff8]}, @TCA_POLICE_TBF={0x3c, 0x1, {0xfffffe00, 0x6, 0x5, 0x1, 0xdbec, {0x8, 0x0, 0xb55, 0x5, 0x7, 0x5}, {0x6, 0x0, 0xd, 0x5, 0x1, 0x5d17}, 0x2, 0x0, 0x6}}]]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x4ac}, 0x1, 0x0, 0x0, 0x10}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=@gettaction={0x30, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}]}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x4}]}, 0x30}}, 0x0) 1.860072751s ago: executing program 4 (id=896): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha224\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000540)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000500)="89", 0x1}], 0x4, 0x0, 0x0, 0x40011}, 0x40400c0) 1.330449388s ago: executing program 4 (id=897): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ptrace$ARCH_SHSTK_ENABLE(0x1e, r0, 0x0, 0x5001) r3 = socket$inet6_sctp(0xa, 0x801, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000140)) 1.26802579s ago: executing program 1 (id=898): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mreq(r1, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) close_range(r0, 0xffffffffffffffff, 0x0) 1.160776903s ago: executing program 2 (id=899): r0 = socket(0x15, 0x5, 0x0) getsockopt(r0, 0x200000000114, 0x2710, &(0x7f0000032580)=""/102396, &(0x7f0000000000)=0x18ffc) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) socket$nl_generic(0x10, 0x3, 0x10) openat$ocfs2_control(0xffffff9c, 0x0, 0x60000, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x48) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0x6, &(0x7f0000000140)={0x20000008, 0x8c}, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) accept4(r2, 0x0, 0x0, 0x800) bind$alg(r2, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(xtea)\x00'}, 0x58) syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000040)=ANY=[@ANYBLOB="12010003000000103d10000140000102030109026e000301d8100c080b"], 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/key-users\x00', 0x0, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043ef50d"], 0xf8) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) socket$rds(0x15, 0x5, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) 1.160601513s ago: executing program 0 (id=900): r0 = syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa401) timer_create(0x0, 0x0, 0x0) r1 = openat$fb0(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) r2 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmmsg(r2, &(0x7f00000094c0)=[{{0x0, 0x0, 0x0}}, {{&(0x7f00000011c0)=@nl=@kern={0x10, 0x0, 0x0, 0x10000}, 0x80, &(0x7f00000043c0)=[{&(0x7f0000001240)="1f", 0x1}], 0x1, &(0x7f0000004400)=ANY=[@ANYBLOB="10"], 0x10}}], 0x2, 0x10) ioctl$FBIOPUT_VSCREENINFO(r1, 0x4601, &(0x7f0000000380)={0x353, 0x360, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x0, 0x0, 0x1, 0x1, 0x4, 0x9f6, 0x3, 0x1ff, 0x803d, 0x1, 0x7, 0x5f, 0x202, 0x1, 0xc}) r3 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r3, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) r4 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r3, &(0x7f0000000100)=@name={0x1e, 0x2, 0x2, {{0x42}, 0x4}}, 0x10) bind$tipc(r4, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) bind$tipc(r4, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x2}}, 0x10) r5 = socket$tipc(0x1e, 0x5, 0x0) r6 = openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) pread64(r6, 0x0, 0x0, 0x10000) bind$tipc(r5, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000140)={0x42, 0x3}, 0x10) bind$tipc(r3, 0x0, 0x0) close(r3) ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f00000001c0)={0x82, 0x0, 0x81, 0x0, 0x0, 0x1, 0x0}) 1.150886763s ago: executing program 1 (id=901): pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r2, 0x0, 0x13, &(0x7f0000000000)=0xffffff7e, 0x4) syz_usb_connect(0x5, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010003ac9bcc20d118af1ebb5a0102030109022400010700800b0904"], &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="40000000200001000000000000000000020000000000000000000000140011"], 0x40}}, 0x0) r4 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r4, 0xc4c85512, &(0x7f0000000280)={{0xc, 0x0, 0x0, 0x0, '\x00', 0xffffffff}, 0x0, [0x40000000, 0x0, 0x4, 0x3, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x2, 0x3, 0x4, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x5, 0x4829d, 0x0, 0xe, 0x0, 0x0, 0x1000008000, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0xffffffffffffffff, 0xfffffffffffffffc, 0x0, 0xc, 0x2, 0xfffffffffffffffc, 0x4, 0x0, 0x10000, 0x4, 0xfdfffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x1, 0x20040000000, 0x0, 0x8, 0x80000000, 0xc20, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x4, 0x0, 0xfffffffffffffffd, 0x7, 0x0, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x40000000000, 0x0, 0x0, 0x0, 0x1, 0x0, 0xfffffffffffffffc, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x1075, 0xfffffffffffffffe, 0x0, 0x8, 0x0, 0xfffffffffffffffc, 0x3, 0x7, 0x7, 0x20, 0x6, 0xffffffff80000001, 0x2, 0x0, 0xfffffffffffffffc, 0x4]}) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) r5 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r5, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_QUEUEPAIR_SETPF(r5, 0x7a9, &(0x7f0000000340)={{@hyper, 0x2}, 0xe145, 0x3, 0x69c9, 0x2, 0xd, 0x385a2d2f, 0x0, 0x100000000}) r6 = syz_open_dev$video4linux(&(0x7f0000000480), 0xd, 0x123002) ioctl$VIDIOC_SUBDEV_S_FMT(r6, 0xc0585605, &(0x7f0000000240)={0x1, 0x0, {0x9, 0xfffff966, 0x3013, 0x0, 0x2, 0x2, 0x2}}) getsockopt$inet_sctp_SCTP_PR_STREAM_STATUS(r1, 0x84, 0x74, &(0x7f00000002c0)=""/198, &(0x7f00000003c0)=0xc6) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000080)=[{0x6, 0x8, 0x3, 0x7ffffdbd}]}) connect$vsock_stream(0xffffffffffffffff, 0x0, 0x0) syncfs(0xffffffffffffffff) madvise(&(0x7f0000000000/0x600000)=nil, 0x600707, 0x18) splice(r0, 0x0, r3, 0x0, 0x8001, 0xd) 1.000162348s ago: executing program 3 (id=902): r0 = socket(0x10, 0x803, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) syz_genetlink_get_family_id$devlink(0x0, r0) sendmsg$DEVLINK_CMD_TRAP_POLICER_GET(r0, 0x0, 0x4008000) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MPP(r1, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xec0}, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000240)={'syzkaller0\x00', @broadcast}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x200504, 0x0) close(r6) r7 = socket$unix(0x1, 0x5, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r9, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x7, 0x6361, 0x5, 0xffffffff, 0x5}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x240080c1}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0x80000, {0x0, 0x0, 0x0, r9, {0x0, 0x6}, {0x3, 0xb}, {0xfff3, 0x6}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0xb, 0x8, 0x1}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x2404c0f1}, 0x6008000) ioctl$SIOCSIFHWADDR(r6, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 101.378916ms ago: executing program 1 (id=903): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_usb_connect$cdc_ncm(0x6, 0x73, &(0x7f0000000b40)={{0x12, 0x1, 0x110, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x61, 0x2, 0x1, 0x1, 0x30, 0x6, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "4ac0c1c9a1"}, {0x5, 0x24, 0x0, 0x6}, {0xd, 0x24, 0xf, 0x1, 0x400, 0x6, 0x3, 0xf}, {0x6, 0x24, 0x1a, 0x7192}}, {{0x9, 0x5, 0x81, 0x3, 0x200, 0xff, 0x84, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10, 0x6, 0x76, 0x98}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0x0, 0x6, 0x50}}}}}}}]}}, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f0000000340)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400ff0160291d0009", @ANYRES8], 0x0) r1 = syz_open_dev$audion(0x0, 0x3, 0x1) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="4c00000002060108000034e40000000000000000050001000600000005000400000000000900020073797a3100000000050005000200000c12000300686173683a6e65742c706f7274"], 0x4c}, 0x1, 0x0, 0x0, 0x8840}, 0x2) setsockopt$IP_VS_SO_SET_EDITDEST(0xffffffffffffffff, 0x0, 0x489, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c000000070601080000001e000000000a00000405000100", @ANYRESHEX], 0x1c}, 0x1, 0x0, 0x0, 0x20000005}, 0x80) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x10, 0x2}, 0x10) ioctl$TUNATTACHFILTER(r1, 0x401054d5, &(0x7f0000000140)={0x0, &(0x7f0000000040)}) close_range(r0, 0xffffffffffffffff, 0x0) 100.207307ms ago: executing program 3 (id=904): r0 = socket$unix(0x1, 0x1, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$kcm(0x11, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r5, {0x0, 0xd}, {0xffff, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_FLOW_MODE={0x8, 0x5, 0x3}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040a1}, 0x4890) syz_mount_image$ext4(&(0x7f0000000080)='ext3\x00', &(0x7f00000000c0)='./file0\x00', 0x8a, &(0x7f0000000500)={[{@jqfmt_vfsold}, {@data_err_ignore}, {@acl}, {@noload}, {@data_err_ignore}, {@usrjquota, 0x22}, {@init_itable_val={'init_itable', 0x3d, 0x2}}, {@init_itable_val={'init_itable', 0x3d, 0xfd}}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x7}}]}, 0x6, 0x47e, &(0x7f0000000640)="$eJzs3MtvG8UfAPDv2kn66+uXUMqjpYXQUlHxSJr0QQ9cikDiABISHIo4hSStSt0GNUGiVQUth3JElbgjuCHxF3ChXBBwQuKEBBJHhFShXlo4Ga29a1zHTpzEsQP+fKRNZjKzmvnu7tjjWW8C6Fuj6Y8kYltE/BwRw9Xs3RVGq7/u3Lo8/eety9NJlMuv/pFU6t2+dXk6r5rvt7WaKZeXaPfaGxFTpdLshSw/vnDu7fH5i5eePnNu6vTs6dnzk8ePHzm8d+jY5NGOxJnGdXv3e3N7dr34+vWXp09ef/O7L9L+bsvK6+PolNHq0W3qQKcb67HtdelkoIcdYUWKEZGersHK+B+OYmyulQ3HCx/0tHPAuiqXC+VNrYuvlIH/sHSiDvSj/I0+/fybb12aemwIN09EbR3jTrZVSwaikNUZzD4jrYfRiDh55a9P0i3WaR0CAKDejRMR8VSz+V8h7q+r9//sHspIRNwTETsi4t6I2BkR90VU6j4QEQ+usP3GOySL5z/l4VUF1qZ0/vdsdm/r7vlfPvuLkWKW216JfzA5daY0eyg7JgdjcFOan1iija+f//GjVmX18790S9vP54JZP34faFigm5lamFpLzPVuXo3YPdAs/qQ2503nx7siYvcq2zjzxOd7WpWNLBv/EjowKS9/GvF49fxfiYb4c0nL+5MTzxybPDr+vyjNHhrPr4rFvv/h2iut2l98/g98FtFm/B1w80Y5tjRc/w2HdSQZylKl0uyF+RU28FPEtV8+bPmZZrXX/1DyWiWdd+3dqYWFCxMRQ8lLi/8++c++eT6vn17/B/fX4k+ibvzvyPZJz/9DEZFexHsj4uGIeCTr+6MRsS8i9i9xCL597rG3Vh7/EqvyHZTGP9P09a92/Y+kqfmLl85W7tevIlE8+82XK48/tSU7/0cquYPZPu28/rXbwbUePwAAAPg3KFS+A58UxmrpQmFsrPod/p2xpVCam1948tTcO+dnqt+VH4nBQr7SNVy3HjqRreXl+cmG/OFs3fjj4uZKfmx6rjTT6+Chz21tMf5TvxWrv3/taQ+BdeV5Lehfxj/0L+Mf+pfxD/3L+If+1Wz8v9+DfgDdt8z7/+Zu9QPoPvN/6F/GP/Sv5cb/vu48iwx0V8tn4wtreuRfokeJr4bW9r8a2k9EYYOEvEETxTbqXM1GYfUvg9G08kDb/8zirkT+pr585U1Ni3r4ogQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANBBfwcAAP//7+7Zrg==") ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0xdd86, r6, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000840)='\'', 0x28}], 0x1}, 0x4) 48.625749ms ago: executing program 4 (id=905): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x7e, 0x2, 0x3, 0x80000000, 0x20000006, 0x4f, 0x6, 0x5d, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x3, 0x0, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x8000024, 0xd, 0x7, 0xfffffffc, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x242, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x88, 0x6, 0xffff, 0x0, 0x5, 0x4, 0x8008, 0x400, 0x80, 0x0, 0x5, 0x1006, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x2008004, 0x5, 0xfffffff3, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bc, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0xd, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f2e, 0xd, 0x4e2, 0x2, 0x4, 0xb, 0xc, 0x9, 0x8, 0x9, 0x6, 0x43, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x6, 0x3, 0x9, 0x1, 0x3, 0x3, 0x81, 0x48c93690, 0x42, 0x3], [0x7, 0x63fa0f21, 0x7, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0x100b, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xca, 0x2, 0x3, 0x27ff, 0x12b, 0x4, 0x1, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x3c484551], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x93a, 0x5, 0x6, 0x0, 0x100, 0xce7, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x101, 0x10000, 0x2000004, 0x7fff, 0xffff, 0xa620, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x16, 0xffffffff, 0x8, 0x5, 0x4, 0xc8, 0xfffffff9, 0xfffff000, 0x10000, 0x0, 0x7b, 0x100, 0x9602, 0x7, 0xaf, 0x5, 0x6, 0x223, 0x5, 0x5, 0x8, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0xdd3, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 3.43029ms ago: executing program 4 (id=906): openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x162e02, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) syz_io_uring_setup(0x207f, &(0x7f0000000080)={0x0, 0x8000, 0x2000, 0x40003, 0x352}, &(0x7f0000000100), &(0x7f00000003c0), &(0x7f0000000180)) fcntl$lock(0xffffffffffffffff, 0x410, &(0x7f0000000080)={0x0, 0x0, 0x4, 0x1fd}) ioctl$KVM_CLEAR_DIRTY_LOG(0xffffffffffffffff, 0xc018aec0, &(0x7f0000000000)={0x5, 0x180, 0x300, 0x0}) r0 = fsopen(&(0x7f0000000200)='udf\x00', 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000000)=0x14) sendto$packet(r1, &(0x7f0000000640), 0x0, 0x40, &(0x7f0000000200)={0x11, 0x86dd, r3, 0x1, 0x0, 0x6, @local}, 0x14) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000240)='uid', &(0x7f00000008c0)='-\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80=\x8a\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\x1f\x03\x00\x00\x00\x00\x00\x00\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9ak\x00\x00\x00\x00\x00\x00\x00\n\xa72\xa3\xef^\xe7\x8f', 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, &(0x7f00000002c0)="4df75a20d804ee4ce2aa8a0797d68e953766cd7a4855880c9bf8c2b7cf738dc33732698d631778d116a24fd82e39c234c499eff943378c8ca92835aac201b216e92cae0faa84392b", 0x0, 0x48) openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x20000, 0x0) r4 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r5 = syz_usb_connect(0x3, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000df2bfd404b0c0001cad7010203010902240001000000000904450002c9cee40009050802ff03000000090582030004"], 0x0) syz_usb_ep_write$ath9k_ep1(r5, 0x82, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="01a651d2"]) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x0, 0x2, 0x0, 0x4002004c4, 0x1004, 0xffffffffffffffff, 0xc595, 0x0, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0x80000004000000, 0x8d], 0xeeee8000, 0x2010d3}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) fallocate(0xffffffffffffffff, 0x10, 0x0, 0x72000) 0s ago: executing program 0 (id=907): bind$inet(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_read_part_table(0x5ee, &(0x7f00000009c0)="$eJzs1D9rZFUUAPDzspl5E3fiBFmwsBF2WRCiqy7iFhlQ4jBss7v4D0urhQhaDGyxRZglSR3jFzDEJBDSxA8QsImJEAwkjZLCIqSxERIEmUKevHkzSVArHTHi7wfDPe/ed8+5wz0zwX/aUNSqRZSlEfHrSH/hyvk7YxGRRpSKp6+u9qbTq/HeeiON5x+8+fa78VoSP/0w+mFyljdPWWTN59L+Qi/L3ZHYX9qdPF0f+/b6wc6N5aH4rtyvlx/o46OV2sjFg3Yf8iOWy2f5+d/bqG/XZudazflKpNGcPr79MIn4pbs0kUQ8qfQaZTMfK92wMtj6eU+2mvP97t2/s7qX3T/5fPSl0s5+59XiZ/R0JIMsyqXxxpXJ4v4f16fyu168NnM407l3c+3RrfHh2Gov9C7+597YHT560v8bBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGJiN+nYn5lrN+cf1qe+b08e3H77YeO7Txiefvf7FRPv9Zyc+GIr0D5veKvWj0gDq12bn8jTliJg+LsWd1b3s/kmMtvLlp/rvjScXdw3/3bJcEi+UImYv9N/itZdfmencu7n26Nb4M4db7YWkaI3s9xt//ObfOTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcOk1YrgXJfF1cj6fpe0sy/LZ4tM1VY1Ii/Bu+k6ytDt5uj725fWDnRvLD3rzm9WodoOjldqfV0z/qa/CX/BbAAAA//+ibmvW") kernel console output (not intermixed with test programs): 162.873758][ T4520] usb 3-1: Cannot retrieve CPort count: -71 [ 162.891988][ T4520] es2_ap_driver: probe of 3-1:7.0 failed with error -71 [ 162.933958][ T4520] usb 3-1: USB disconnect, device number 7 [ 163.030754][ T4534] usb 4-1: New USB device found, idVendor=0bfd, idProduct=0102, bcdDevice=cf.5c [ 163.072987][ T4534] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 163.108895][ T4534] usb 4-1: Product: в [ 163.116299][ T4178] snd-usb-audio: probe of 2-1:1.0 failed with error -71 [ 163.133645][ T4534] usb 4-1: Manufacturer: ᐇ [ 163.138489][ T4534] usb 4-1: SerialNumber: 廣눴ዞᎮ笅鿻胳饱Ჵ᪢妥睋ሷ妹⽺஽褅踾呾颥礽 [ 163.170302][ T4178] usb 2-1: USB disconnect, device number 13 [ 163.227120][ T4534] usb 4-1: config 0 descriptor?? [ 163.476734][ T5400] tipc: Enabled bearer , priority 0 [ 163.523558][ T5400] device syzkaller0 entered promiscuous mode [ 163.552388][ T5400] tipc: Resetting bearer [ 163.560813][ T5399] tipc: Resetting bearer [ 163.593726][ T5399] tipc: Disabling bearer [ 163.682957][ T4178] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 164.303307][ T4178] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 164.449206][ T4178] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 164.745965][ T4178] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 164.850862][ T4178] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 164.927551][ T5418] fuse: Unknown parameter 'user_id00000000000000000000' [ 164.951746][ T4178] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 164.990275][ T4178] usb 2-1: config 0 descriptor?? [ 165.133553][ T4534] kvaser_usb 4-1:0.162: Cannot get usb endpoint(s) [ 165.213813][ T4534] kvaser_usb 4-1:0.220: Cannot get usb endpoint(s) [ 165.265897][ T4534] usb 4-1: USB disconnect, device number 13 [ 165.306998][ T4520] usb 5-1: new full-speed USB device number 10 using dummy_hcd [ 165.476441][ T5439] 9pnet: Insufficient options for proto=fd [ 165.573325][ T4178] usbhid 2-1:0.0: can't add hid device: -71 [ 165.586003][ T4178] usbhid: probe of 2-1:0.0 failed with error -71 [ 165.773518][ T4449] udevd[4449]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 165.807697][ T4178] usb 2-1: USB disconnect, device number 14 [ 166.122328][ T4521] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 166.284325][ T5448] device syzkaller0 entered promiscuous mode [ 166.363455][ T4520] usb 5-1: config 0 interface 0 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 166.376751][ T4521] usb 3-1: Using ep0 maxpacket: 8 [ 166.382938][ T4520] usb 5-1: config 0 interface 0 has no altsetting 0 [ 166.462967][ T21] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 166.464091][ T4243] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 166.493259][ T4521] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 166.520464][ T4521] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 166.532051][ T4521] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 166.553133][ T4520] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 166.568099][ T4520] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 166.582856][ T4521] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 166.600626][ T4520] usb 5-1: Product: syz [ 166.607881][ T4520] usb 5-1: Manufacturer: syz [ 166.617546][ T4521] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 166.629887][ T4520] usb 5-1: SerialNumber: syz [ 166.631788][ T5454] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 166.639217][ T4521] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 166.654471][ T4520] usb 5-1: config 0 descriptor?? [ 166.661819][ T5454] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 166.670269][ T5454] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 166.713068][ T4243] usb 4-1: Using ep0 maxpacket: 32 [ 166.738815][ T4520] snd-usb-audio: probe of 5-1:0.0 failed with error -22 [ 166.777552][ T4449] udevd[4449]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 166.873053][ T4243] usb 4-1: unable to get BOS descriptor or descriptor too short [ 166.903973][ T5420] udc-core: couldn't find an available UDC or it's busy [ 166.910968][ T5420] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 166.923000][ T4521] usb 3-1: GET_CAPABILITIES returned 0 [ 166.928130][ T4534] usb 5-1: USB disconnect, device number 10 [ 166.928518][ T4521] usbtmc 3-1:16.0: can't read capabilities [ 166.943234][ T21] usb 1-1: unable to get BOS descriptor or descriptor too short [ 166.953382][ T4243] usb 4-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 167.043136][ T21] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 37, changing to 7 [ 167.054489][ T21] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 116, changing to 7 [ 167.130022][ T4178] usb 3-1: USB disconnect, device number 8 [ 167.132981][ T4243] usb 4-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 167.147728][ T4243] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 167.155996][ T4243] usb 4-1: Product: syz [ 167.160269][ T4243] usb 4-1: Manufacturer: syz [ 167.165211][ T4243] usb 4-1: SerialNumber: syz [ 167.332986][ T21] usb 1-1: string descriptor 0 read error: -22 [ 167.341048][ T21] usb 1-1: New USB device found, idVendor=1235, idProduct=8012, bcdDevice= 0.40 [ 167.356599][ T21] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 167.723221][ T4243] usb 4-1: Cannot retrieve CPort count: -110 [ 167.732196][ T4243] usb 4-1: Cannot retrieve CPort count: -110 [ 167.831739][ T4243] es2_ap_driver: probe of 4-1:7.0 failed with error -110 [ 168.334223][ T5469] fuse: Unknown parameter 'user_id00000000000000000000' [ 168.407796][ T21] usb 1-1: USB disconnect, device number 9 [ 169.003261][ T21] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 169.412891][ T21] usb 1-1: Using ep0 maxpacket: 16 [ 169.543197][ T21] usb 1-1: config 0 has an invalid interface number: 162 but max is 0 [ 169.564017][ T21] usb 1-1: config 0 has an invalid interface number: 220 but max is 0 [ 169.612663][ T21] usb 1-1: config 0 has 2 interfaces, different from the descriptor's value: 1 [ 169.662529][ T21] usb 1-1: config 0 has no interface number 0 [ 169.710784][ T21] usb 1-1: config 0 has no interface number 1 [ 169.734687][ T21] usb 1-1: config 0 interface 162 altsetting 213 has an invalid endpoint with address 0x80, skipping [ 169.764893][ T21] usb 1-1: config 0 interface 162 altsetting 213 endpoint 0x3 has invalid maxpacket 1024, setting to 64 [ 169.792524][ T21] usb 1-1: config 0 interface 162 altsetting 213 has a duplicate endpoint with address 0x3, skipping [ 169.822037][ T21] usb 1-1: config 0 interface 162 altsetting 213 has 9 endpoint descriptors, different from the interface descriptor's value: 12 [ 169.855212][ T21] usb 1-1: too many endpoints for config 0 interface 220 altsetting 107: 155, using maximum allowed: 30 [ 169.877850][ T21] usb 1-1: config 0 interface 220 altsetting 107 has a duplicate endpoint with address 0x3, skipping [ 169.890423][ T21] usb 1-1: config 0 interface 220 altsetting 107 has an invalid endpoint with address 0x80, skipping [ 169.908408][ T21] usb 1-1: config 0 interface 220 altsetting 107 has a duplicate endpoint with address 0x2, skipping [ 169.920059][ T21] usb 1-1: config 0 interface 220 altsetting 107 has 3 endpoint descriptors, different from the interface descriptor's value: 155 [ 169.940553][ T21] usb 1-1: config 0 interface 162 has no altsetting 0 [ 169.947924][ T21] usb 1-1: config 0 interface 220 has no altsetting 0 [ 169.987858][ T4178] usb 4-1: USB disconnect, device number 14 [ 170.042867][ T4520] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 170.043340][ T5490] loop1: detected capacity change from 0 to 1024 [ 170.070659][ T5492] device syzkaller0 entered promiscuous mode [ 170.123326][ T21] usb 1-1: New USB device found, idVendor=0bfd, idProduct=0102, bcdDevice=cf.5c [ 170.132556][ T21] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 170.140428][ T5494] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 170.148641][ T21] usb 1-1: Product: в [ 170.153114][ T21] usb 1-1: Manufacturer: ᐇ [ 170.160893][ T5490] EXT4-fs (loop1): Ignoring removed nobh option [ 170.169524][ T5494] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 170.173546][ T21] usb 1-1: SerialNumber: 廣눴ዞᎮ笅鿻胳饱Ჵ᪢妥睋ሷ妹⽺஽褅踾呾颥礽 [ 170.188494][ T5494] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 170.197468][ T5490] EXT4-fs (loop1): inline encryption not supported [ 170.210943][ T5490] EXT4-fs (loop1): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 170.214886][ T5494] device bridge_slave_0 left promiscuous mode [ 170.230969][ T21] usb 1-1: config 0 descriptor?? [ 170.238475][ T5490] EXT4-fs (loop1): bad geometry: bigalloc file system with non-zero first_data_block [ 170.238475][ T5490] [ 170.249949][ T5494] bridge0: port 1(bridge_slave_0) entered disabled state [ 171.609850][ T5494] device bridge_slave_1 left promiscuous mode [ 171.633054][ T5494] bridge0: port 2(bridge_slave_1) entered disabled state [ 171.677325][ T5494] bond0: (slave bond_slave_0): Releasing backup interface [ 171.713425][ T21] kvaser_usb 1-1:0.162: Cannot get usb endpoint(s) [ 171.733071][ T4520] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 171.749851][ T4520] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 171.771146][ T4520] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 171.785268][ T5494] bond0: (slave bond_slave_1): Releasing backup interface [ 171.798759][ T4520] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 171.801276][ T21] kvaser_usb 1-1:0.220: Cannot get usb endpoint(s) [ 171.818302][ T4520] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 171.844274][ T21] usb 1-1: USB disconnect, device number 10 [ 171.862009][ T4520] usb 5-1: config 0 descriptor?? [ 171.927885][ T5494] team0: Port device team_slave_0 removed [ 171.993158][ T5494] team0: Port device team_slave_1 removed [ 172.003713][ T5494] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 172.011243][ T5494] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 172.069854][ T5494] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 172.093922][ T5494] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 172.351521][ T5502] tipc: Enabled bearer , priority 0 [ 172.381542][ T5502] device syzkaller0 entered promiscuous mode [ 172.457744][ T5500] tipc: Resetting bearer [ 172.477266][ T4520] usbhid 5-1:0.0: can't add hid device: -71 [ 172.484057][ T4520] usbhid: probe of 5-1:0.0 failed with error -71 [ 172.685229][ T5500] tipc: Disabling bearer [ 173.333420][ T4520] usb 5-1: USB disconnect, device number 11 [ 173.360620][ T5508] device syzkaller0 entered promiscuous mode [ 173.373537][ T5516] loop3: detected capacity change from 0 to 128 [ 173.492324][ T5516] FAT-fs (loop3): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 173.662875][ T4178] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 174.012916][ T23] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 174.583563][ T9] FAT-fs (loop3): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 174.817430][ T5531] fuse: Bad value for 'fd' [ 174.872924][ T4178] usb 3-1: unable to get BOS descriptor or descriptor too short [ 174.942943][ T21] usb 1-1: new low-speed USB device number 11 using dummy_hcd [ 174.963347][ T4178] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 37, changing to 7 [ 174.985366][ T4178] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 116, changing to 7 [ 174.997194][ T23] usb 2-1: Using ep0 maxpacket: 32 [ 175.034743][ T5534] netlink: 'syz.4.323': attribute type 39 has an invalid length. [ 175.103338][ T5538] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 175.121084][ T5538] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 175.131522][ T5538] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 175.141172][ T5538] device bridge_slave_0 left promiscuous mode [ 175.143036][ T4243] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 175.148429][ T5538] bridge0: port 1(bridge_slave_0) entered disabled state [ 175.166799][ T5538] device bridge_slave_1 left promiscuous mode [ 175.173605][ T5538] bridge0: port 2(bridge_slave_1) entered disabled state [ 175.183509][ T23] usb 2-1: unable to get BOS descriptor or descriptor too short [ 175.191638][ T5538] bond0: (slave bond_slave_0): Releasing backup interface [ 175.209137][ T5538] bond0: (slave bond_slave_1): Releasing backup interface [ 175.246478][ T5538] team0: Port device team_slave_0 removed [ 175.261441][ T5538] team0: Port device team_slave_1 removed [ 175.271623][ T5538] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 175.279808][ T23] usb 2-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 175.290072][ T5538] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 175.297783][ T4178] usb 3-1: string descriptor 0 read error: -22 [ 175.304369][ T4178] usb 3-1: New USB device found, idVendor=1235, idProduct=8012, bcdDevice= 0.40 [ 175.313860][ T21] usb 1-1: config index 0 descriptor too short (expected 1307, got 27) [ 175.322555][ T21] usb 1-1: config 0 has an invalid interface number: 0 but max is -1 [ 175.331029][ T4178] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 175.339121][ T21] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 175.348767][ T21] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 246, using maximum allowed: 30 [ 175.360991][ T21] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 is Bulk; changing to Interrupt [ 175.371026][ T21] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 175.380930][ T21] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 246 [ 175.392895][ T4243] usb 4-1: Using ep0 maxpacket: 16 [ 175.408504][ T5538] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 175.416080][ T5538] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 175.453453][ T21] usb 1-1: language id specifier not provided by device, defaulting to English [ 175.473084][ T23] usb 2-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 175.492916][ T23] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 175.500974][ T23] usb 2-1: Product: syz [ 175.505582][ T23] usb 2-1: Manufacturer: syz [ 175.510387][ T23] usb 2-1: SerialNumber: syz [ 175.513112][ T4243] usb 4-1: config 0 has an invalid interface number: 162 but max is 0 [ 175.532638][ T4243] usb 4-1: config 0 has an invalid interface number: 220 but max is 0 [ 175.541450][ T4243] usb 4-1: config 0 has 2 interfaces, different from the descriptor's value: 1 [ 175.558099][ T4243] usb 4-1: config 0 has no interface number 0 [ 175.565677][ T4243] usb 4-1: config 0 has no interface number 1 [ 175.572202][ T4243] usb 4-1: config 0 interface 162 altsetting 213 has an invalid endpoint with address 0x80, skipping [ 175.589926][ T4243] usb 4-1: config 0 interface 162 altsetting 213 endpoint 0x3 has invalid maxpacket 1024, setting to 64 [ 175.609073][ T4243] usb 4-1: config 0 interface 162 altsetting 213 has a duplicate endpoint with address 0x3, skipping [ 175.620719][ T4243] usb 4-1: config 0 interface 162 altsetting 213 has 9 endpoint descriptors, different from the interface descriptor's value: 12 [ 175.642922][ T4243] usb 4-1: too many endpoints for config 0 interface 220 altsetting 107: 155, using maximum allowed: 30 [ 175.661864][ T4243] usb 4-1: config 0 interface 220 altsetting 107 has a duplicate endpoint with address 0x3, skipping [ 175.679865][ T4243] usb 4-1: config 0 interface 220 altsetting 107 has an invalid endpoint with address 0x80, skipping [ 175.702700][ T4243] usb 4-1: config 0 interface 220 altsetting 107 has a duplicate endpoint with address 0x2, skipping [ 175.722100][ T4243] usb 4-1: config 0 interface 220 altsetting 107 has 3 endpoint descriptors, different from the interface descriptor's value: 155 [ 175.743811][ T4243] usb 4-1: config 0 interface 162 has no altsetting 0 [ 175.750858][ T4243] usb 4-1: config 0 interface 220 has no altsetting 0 [ 175.867504][ T4534] usb 3-1: USB disconnect, device number 9 [ 175.923071][ T4243] usb 4-1: New USB device found, idVendor=0bfd, idProduct=0102, bcdDevice=cf.5c [ 175.948190][ T4243] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 175.956662][ T4243] usb 4-1: Product: в [ 175.960804][ T4243] usb 4-1: Manufacturer: ᐇ [ 175.978636][ T4243] usb 4-1: SerialNumber: 廣눴ዞᎮ笅鿻胳饱Ჵ᪢妥睋ሷ妹⽺஽褅踾呾颥礽 [ 176.018962][ T4243] usb 4-1: config 0 descriptor?? [ 176.053102][ T21] usb 1-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 176.066794][ T21] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 176.075462][ T21] usb 1-1: Manufacturer: 躔煟祚肂濬 [ 176.091300][ T21] usb 1-1: config 0 descriptor?? [ 176.123134][ T23] usb 2-1: Cannot retrieve CPort count: -110 [ 176.131447][ T23] usb 2-1: Cannot retrieve CPort count: -110 [ 176.138796][ T23] es2_ap_driver: probe of 2-1:7.0 failed with error -110 [ 176.147193][ T21] hub 1-1:0.0: bad descriptor, ignoring hub [ 176.161627][ T21] hub: probe of 1-1:0.0 failed with error -5 [ 176.172718][ T21] input: 躔煟祚肂濬 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input9 [ 176.355902][ T4520] usb 1-1: USB disconnect, device number 11 [ 176.363254][ T23] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 176.770803][ T23] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 176.797202][ T23] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 176.821072][ T23] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 176.861151][ T23] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 176.877019][ T23] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 176.897120][ T23] usb 5-1: config 0 descriptor?? [ 177.071495][ T5584] tipc: Enabled bearer , priority 0 [ 177.074728][ T4234] usb 2-1: USB disconnect, device number 15 [ 177.095367][ T5584] device syzkaller0 entered promiscuous mode [ 177.127291][ T5582] tipc: Resetting bearer [ 177.181970][ T5582] tipc: Disabling bearer [ 177.442997][ T23] usbhid 5-1:0.0: can't add hid device: -71 [ 177.453967][ T23] usbhid: probe of 5-1:0.0 failed with error -71 [ 177.511296][ T23] usb 5-1: USB disconnect, device number 12 [ 177.574255][ T5595] device syzkaller0 entered promiscuous mode [ 177.594017][ T5597] loop0: detected capacity change from 0 to 128 [ 177.644492][ T5597] FAT-fs (loop0): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 178.133395][ T4243] kvaser_usb 4-1:0.162: Cannot get usb endpoint(s) [ 178.235412][ T4243] kvaser_usb 4-1:0.220: Cannot get usb endpoint(s) [ 178.371640][ T4243] usb 4-1: USB disconnect, device number 15 [ 178.679147][ T4335] FAT-fs (loop0): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 178.813671][ T5611] device syzkaller0 entered promiscuous mode [ 179.024335][ T4234] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 179.755775][ T4243] usb 5-1: new low-speed USB device number 13 using dummy_hcd [ 179.833068][ T4234] usb 2-1: config 0 has an invalid interface number: 69 but max is 0 [ 179.842593][ T4234] usb 2-1: config 0 has no interface number 0 [ 179.869999][ T4234] usb 2-1: config 0 interface 69 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1023 [ 179.887460][ T4234] usb 2-1: config 0 interface 69 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 179.921458][ T5631] tipc: Enabled bearer , priority 0 [ 179.954446][ T5631] device syzkaller0 entered promiscuous mode [ 179.974553][ T5630] tipc: Resetting bearer [ 180.021717][ T5630] tipc: Disabling bearer [ 180.053188][ T4234] usb 2-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 180.063034][ T4234] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 180.071069][ T4234] usb 2-1: Product: syz [ 180.076139][ T4234] usb 2-1: Manufacturer: syz [ 180.080762][ T4234] usb 2-1: SerialNumber: syz [ 180.086135][ T4521] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 180.104094][ T4234] usb 2-1: config 0 descriptor?? [ 180.130451][ T5609] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 180.143126][ T4243] usb 5-1: config index 0 descriptor too short (expected 1307, got 27) [ 180.158756][ T4243] usb 5-1: config 0 has an invalid interface number: 0 but max is -1 [ 180.168551][ T4234] cyberjack 2-1:0.69: Reiner SCT Cyberjack USB card reader converter detected [ 180.187876][ T4234] usb 2-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 180.199496][ T4243] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 180.331426][ T5639] netlink: 120 bytes leftover after parsing attributes in process `syz.2.344'. [ 180.410862][ T4521] usb 1-1: Using ep0 maxpacket: 32 [ 180.792841][ T4243] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 246, using maximum allowed: 30 [ 180.811008][ T4243] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 is Bulk; changing to Interrupt [ 180.821774][ T4243] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 180.845550][ T4243] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 246 [ 180.897652][ T4243] usb 5-1: language id specifier not provided by device, defaulting to English [ 180.922931][ T4521] usb 1-1: unable to get BOS descriptor or descriptor too short [ 181.017797][ T4521] usb 1-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 181.028682][ T4234] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 181.072965][ T7] Bluetooth: hci3: command 0x0406 tx timeout [ 181.080209][ T7] Bluetooth: hci2: command 0x0406 tx timeout [ 181.095158][ T7] Bluetooth: hci0: command 0x0406 tx timeout [ 181.101498][ T7] Bluetooth: hci1: command 0x0406 tx timeout [ 181.111756][ T7] Bluetooth: hci4: command 0x0406 tx timeout [ 181.202991][ T4521] usb 1-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 181.216891][ T4521] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 181.228921][ T4521] usb 1-1: Product: syz [ 181.238217][ T4521] usb 1-1: Manufacturer: syz [ 181.245443][ T4521] usb 1-1: SerialNumber: syz [ 181.418343][ T4234] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 181.445361][ T4234] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 181.464527][ T4234] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 181.481612][ T4234] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 181.497038][ T4243] usb 5-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 181.514143][ T4234] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 181.529173][ T4243] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 181.555657][ T4234] usb 4-1: config 0 descriptor?? [ 181.563145][ T4243] usb 5-1: Manufacturer: 躔煟祚肂 [ 181.586819][ T4243] usb 5-1: config 0 descriptor?? [ 181.619274][ T7] usb 2-1: USB disconnect, device number 16 [ 181.633697][ T4243] hub 5-1:0.0: bad descriptor, ignoring hub [ 181.643746][ T7] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 181.657968][ T4243] hub: probe of 5-1:0.0 failed with error -5 [ 181.842907][ T4521] usb 1-1: Cannot retrieve CPort count: -110 [ 181.849934][ T4521] usb 1-1: Cannot retrieve CPort count: -110 [ 181.858731][ T4243] input: 躔煟祚肂 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input10 [ 181.869991][ T7] cyberjack 2-1:0.69: device disconnected [ 181.875955][ T4521] es2_ap_driver: probe of 1-1:7.0 failed with error -110 [ 182.674662][ T4243] usb 5-1: USB disconnect, device number 13 [ 182.743335][ T4234] usbhid 4-1:0.0: can't add hid device: -71 [ 182.765575][ T4234] usbhid: probe of 4-1:0.0 failed with error -71 [ 182.803431][ T4234] usb 4-1: USB disconnect, device number 16 [ 183.786359][ T7] usb 1-1: USB disconnect, device number 12 [ 183.888154][ T5662] device syzkaller0 entered promiscuous mode [ 185.202835][ T7] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 185.436753][ T5668] loop0: detected capacity change from 0 to 32768 [ 185.500101][ T5677] loop2: detected capacity change from 0 to 32768 [ 185.576856][ T7] usb 2-1: config 0 has an invalid interface number: 69 but max is 0 [ 185.588426][ T5677] (syz.2.355,5677,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 185.588479][ T5668] JBD2: Ignoring recovery information on journal [ 185.589650][ T5677] (syz.2.355,5677,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 185.612092][ T5680] loop3: detected capacity change from 0 to 32768 [ 185.649405][ T7] usb 2-1: config 0 has no interface number 0 [ 185.677535][ T5680] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz.3.356 (5680) [ 185.717562][ T7] usb 2-1: config 0 interface 69 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1023 [ 185.738000][ T7] usb 2-1: config 0 interface 69 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 185.780078][ T5668] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 185.782576][ T5677] JBD2: Ignoring recovery information on journal [ 185.840538][ T5680] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm [ 185.871495][ T5680] BTRFS info (device loop3): using free space tree [ 185.933978][ T5680] BTRFS info (device loop3): has skinny extents [ 185.954294][ T7] usb 2-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 185.982938][ T7] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 186.001468][ T7] usb 2-1: Product: syz [ 186.008096][ T7] usb 2-1: Manufacturer: syz [ 186.018393][ T7] usb 2-1: SerialNumber: syz [ 186.049999][ T7] usb 2-1: config 0 descriptor?? [ 186.077847][ T5677] ocfs2: Mounting device (7,2) on (node local, slot 0) with ordered data mode. [ 186.087438][ T5683] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 186.104202][ T7] cyberjack 2-1:0.69: Reiner SCT Cyberjack USB card reader converter detected [ 186.296974][ T7] usb 2-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 186.591662][ T26] audit: type=1800 audit(1779062578.586:4): pid=5668 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.352" name="file1" dev="loop0" ino=17058 res=0 errno=0 [ 186.817699][ T5680] BTRFS info (device loop3): enabling ssd optimizations [ 187.090373][ T7] usb 2-1: USB disconnect, device number 17 [ 187.131889][ T4190] ocfs2: Unmounting device (7,0) on (node local) [ 187.161874][ T7] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 187.208607][ T7] cyberjack 2-1:0.69: device disconnected [ 187.293010][ T4234] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 187.408807][ T5673] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 10 /dev/loop3 scanned by udevd (5673) [ 187.694561][ T4234] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 187.726756][ T4234] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 187.744337][ T4234] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 187.923593][ T4234] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 187.933220][ T4234] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 187.943984][ T4234] usb 5-1: config 0 descriptor?? [ 188.043174][ T4178] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 188.352905][ T4178] usb 4-1: Using ep0 maxpacket: 32 [ 188.575387][ T4178] usb 4-1: unable to get BOS descriptor or descriptor too short [ 188.629492][ T4192] ocfs2: Unmounting device (7,2) on (node local) [ 188.634853][ T5739] device syzkaller0 entered promiscuous mode [ 188.693150][ T4178] usb 4-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 188.753178][ T4234] usbhid 5-1:0.0: can't add hid device: -71 [ 188.769461][ T4234] usbhid: probe of 5-1:0.0 failed with error -71 [ 188.795556][ T4234] usb 5-1: USB disconnect, device number 14 [ 188.883031][ T4178] usb 4-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 188.899808][ T4178] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 188.908785][ T4178] usb 4-1: Product: syz [ 188.920024][ T4178] usb 4-1: Manufacturer: syz [ 188.925215][ T4178] usb 4-1: SerialNumber: syz [ 189.523230][ T4178] usb 4-1: Cannot retrieve CPort count: -110 [ 189.564709][ T4178] usb 4-1: Cannot retrieve CPort count: -110 [ 189.702787][ T4178] es2_ap_driver: probe of 4-1:7.0 failed with error -110 [ 189.930007][ T5754] fuse: Unknown parameter '0x0000000000000004' [ 189.936748][ T4178] usb 3-1: new full-speed USB device number 10 using dummy_hcd [ 189.944580][ T5734] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 190.254150][ T4234] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 190.382994][ T5734] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 190.468278][ T5734] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 190.483582][ T4178] usb 3-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 190.484828][ T5734] usb 1-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 190.497557][ T4178] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 190.502855][ T5734] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 190.522834][ T4234] usb 5-1: device descriptor read/64, error -71 [ 190.531746][ T4178] usb 3-1: config 0 descriptor?? [ 190.548179][ T5734] usb 1-1: config 0 descriptor?? [ 190.664677][ T4178] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 190.716800][ T5760] process 'syz.1.373' launched '/dev/fd/4' with NULL argv: empty string added [ 190.792912][ T4234] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 190.892927][ T4178] gp8psk: usb in 128 operation failed. [ 190.906136][ T5745] udc-core: couldn't find an available UDC or it's busy [ 190.913907][ T5745] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 190.923353][ T5745] netlink: 8 bytes leftover after parsing attributes in process `syz.0.369'. [ 190.937077][ T23] usb 1-1: USB disconnect, device number 13 [ 190.982990][ T4234] usb 5-1: device descriptor read/64, error -71 [ 191.026209][ T5734] usb 4-1: USB disconnect, device number 17 [ 191.103008][ T4234] usb usb5-port1: attempt power cycle [ 191.523277][ T4234] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 191.673254][ T4234] usb 5-1: device descriptor read/8, error -71 [ 191.953167][ T4234] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 192.107743][ T4178] gp8psk: usb in 146 operation failed. [ 192.114014][ T4178] gp8psk: failed to get FW version [ 192.134264][ T4178] gp8psk: usb in 149 operation failed. [ 192.140169][ T4178] gp8psk: failed to get FPGA version [ 192.172924][ T4178] gp8psk: usb in 138 operation failed. [ 192.178564][ T4178] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 192.190551][ T4178] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 192.202053][ T4178] usb 3-1: USB disconnect, device number 10 [ 192.264526][ T4234] usb 5-1: device descriptor read/8, error -71 [ 192.703062][ T4197] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 192.960305][ T5776] device syzkaller0 entered promiscuous mode [ 193.026032][ T5782] fuse: Unknown parameter '0x0000000000000004' [ 193.096103][ T4234] usb usb5-port1: unable to enumerate USB device [ 193.273231][ T4197] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 193.300414][ T4197] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 193.310962][ T4197] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 193.334529][ T4197] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 193.382969][ T5734] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 193.632863][ T5734] usb 1-1: Using ep0 maxpacket: 32 [ 193.793252][ T5734] usb 1-1: unable to get BOS descriptor or descriptor too short [ 193.883426][ T5734] usb 1-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 194.132792][ T4197] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 194.168551][ T5787] loop4: detected capacity change from 0 to 32768 [ 194.185365][ T4197] usb 2-1: config 0 descriptor?? [ 194.333077][ T5734] usb 1-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 194.393669][ T1430] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.400194][ T1430] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.409429][ T5734] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 194.417531][ T5734] usb 1-1: Product: syz [ 194.421806][ T5734] usb 1-1: Manufacturer: syz [ 194.432857][ T5734] usb 1-1: SerialNumber: syz [ 194.615634][ T5787] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 195.508358][ T5800] sched: RT throttling activated [ 195.603212][ T4197] usbhid 2-1:0.0: can't add hid device: -71 [ 195.614795][ T4197] usbhid: probe of 2-1:0.0 failed with error -71 [ 195.700580][ T4197] usb 2-1: USB disconnect, device number 18 [ 195.806901][ T4189] ocfs2: Unmounting device (7,4) on (node local) [ 195.944959][ T5808] netlink: 8 bytes leftover after parsing attributes in process `syz.1.391'. [ 196.233240][ T5734] usb 1-1: Cannot retrieve CPort count: -110 [ 196.248503][ T5734] usb 1-1: Cannot retrieve CPort count: -110 [ 196.341498][ T5734] es2_ap_driver: probe of 1-1:7.0 failed with error -110 [ 196.810950][ T5820] fuse: Unknown parameter '0x0000000000000004' [ 196.833235][ T5811] netlink: 16 bytes leftover after parsing attributes in process `syz.0.384'. [ 196.852981][ T23] usb 3-1: new full-speed USB device number 11 using dummy_hcd [ 196.927255][ T5825] device syzkaller0 entered promiscuous mode [ 197.222913][ T4178] usb 5-1: new full-speed USB device number 19 using dummy_hcd [ 197.303066][ T4197] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 197.353200][ T23] usb 3-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 197.362487][ T23] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 197.376155][ T23] usb 3-1: config 0 descriptor?? [ 197.416556][ T23] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 197.523121][ T4197] usb 2-1: device descriptor read/64, error -71 [ 197.603046][ T4178] usb 5-1: config 0 interface 0 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 197.619689][ T4178] usb 5-1: config 0 interface 0 has no altsetting 0 [ 197.626532][ T23] gp8psk: usb in 128 operation failed. [ 197.783031][ T4178] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 197.792226][ T4178] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 197.804399][ T4197] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 197.812167][ T4178] usb 5-1: Product: syz [ 197.817883][ T4178] usb 5-1: Manufacturer: syz [ 197.822504][ T4178] usb 5-1: SerialNumber: syz [ 197.830873][ T4178] usb 5-1: config 0 descriptor?? [ 197.891551][ T4178] snd-usb-audio: probe of 5-1:0.0 failed with error -22 [ 197.972148][ T5673] udevd[5673]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 197.993085][ T4197] usb 2-1: device descriptor read/64, error -71 [ 198.077837][ T4178] usb 1-1: USB disconnect, device number 14 [ 198.113438][ T4197] usb usb2-port1: attempt power cycle [ 198.122935][ T23] gp8psk: usb in 146 operation failed. [ 198.128554][ T23] gp8psk: failed to get FW version [ 198.154686][ T5734] usb 5-1: USB disconnect, device number 19 [ 198.174601][ T23] gp8psk: usb in 149 operation failed. [ 198.186620][ T23] gp8psk: failed to get FPGA version [ 198.209215][ T23] gp8psk: usb in 138 operation failed. [ 198.894171][ T23] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 198.905881][ T23] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 198.917043][ T23] usb 3-1: USB disconnect, device number 11 [ 198.989302][ T5847] netlink: 8 bytes leftover after parsing attributes in process `syz.3.402'. [ 199.084391][ T5853] fuse: Unknown parameter '0x0000000000000004' [ 199.203057][ T4197] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 199.362821][ T5734] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 199.588339][ T4178] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 199.596269][ T4197] usb 2-1: device descriptor read/8, error -71 [ 199.862963][ T4197] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 199.983162][ T4178] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 200.000805][ T4178] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 200.011811][ T4178] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 200.032867][ T5734] usb 5-1: device descriptor read/64, error -71 [ 200.050355][ T4178] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 200.061394][ T4178] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 200.079546][ T4178] usb 1-1: config 0 descriptor?? [ 200.113239][ T4197] usb 2-1: device not accepting address 22, error -71 [ 200.132951][ T4197] usb usb2-port1: unable to enumerate USB device [ 200.424086][ T5734] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 200.655978][ T5734] usb 5-1: device descriptor read/64, error -71 [ 200.793987][ T5734] usb usb5-port1: attempt power cycle [ 200.858738][ T4178] usbhid 1-1:0.0: can't add hid device: -71 [ 200.894202][ T4178] usbhid: probe of 1-1:0.0 failed with error -71 [ 200.914705][ T4178] usb 1-1: USB disconnect, device number 15 [ 200.932816][ T4197] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 201.030477][ T5882] netlink: 8 bytes leftover after parsing attributes in process `syz.2.414'. [ 201.225498][ T5736] usb 4-1: new full-speed USB device number 18 using dummy_hcd [ 201.242806][ T4197] usb 2-1: Using ep0 maxpacket: 32 [ 201.302956][ T5734] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 201.719381][ T5734] usb 5-1: device descriptor read/8, error -71 [ 201.892986][ T5736] usb 4-1: config 0 interface 0 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 201.913524][ T5736] usb 4-1: config 0 interface 0 has no altsetting 0 [ 201.975287][ T4234] usb 1-1: new full-speed USB device number 16 using dummy_hcd [ 202.005054][ T5734] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 202.024515][ T5891] fuse: Unknown parameter '0x0000000000000004' [ 202.052911][ T4197] usb 2-1: unable to get BOS descriptor or descriptor too short [ 202.101073][ T5734] usb 5-1: device descriptor read/8, error -71 [ 202.107691][ T5736] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 202.121403][ T5736] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 202.132021][ T5736] usb 4-1: Product: syz [ 202.132973][ T4197] usb 2-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 202.136593][ T5736] usb 4-1: Manufacturer: syz [ 202.152492][ T5736] usb 4-1: SerialNumber: syz [ 202.159121][ T5736] usb 4-1: config 0 descriptor?? [ 202.215802][ T5736] snd-usb-audio: probe of 4-1:0.0 failed with error -22 [ 202.243299][ T5734] usb usb5-port1: unable to enumerate USB device [ 202.283730][ T4449] udevd[4449]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 202.303116][ T4197] usb 2-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 202.318887][ T4197] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 202.327212][ T4197] usb 2-1: Product: syz [ 202.331501][ T4197] usb 2-1: Manufacturer: syz [ 202.342424][ T4197] usb 2-1: SerialNumber: syz [ 202.351661][ T5898] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 202.382934][ T4234] usb 1-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 202.392203][ T4234] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 202.403138][ T4234] usb 1-1: config 0 descriptor?? [ 202.416935][ T5736] usb 4-1: USB disconnect, device number 18 [ 202.444678][ T4234] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 202.622881][ T5734] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 202.663049][ T4234] gp8psk: usb in 128 operation failed. [ 202.718094][ T5899] netlink: 16 bytes leftover after parsing attributes in process `syz.1.409'. [ 202.833011][ T5734] usb 5-1: device descriptor read/64, error -71 [ 202.913032][ T4197] usb 2-1: Cannot retrieve CPort count: -110 [ 202.919353][ T4197] usb 2-1: Cannot retrieve CPort count: -110 [ 202.929464][ T4197] es2_ap_driver: probe of 2-1:7.0 failed with error -110 [ 203.472437][ T5902] loop3: detected capacity change from 0 to 512 [ 204.204934][ T4234] gp8psk: usb in 146 operation failed. [ 204.217659][ T4234] gp8psk: failed to get FW version [ 204.380761][ T4197] usb 2-1: USB disconnect, device number 23 [ 204.415583][ T5734] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 204.423520][ T4234] gp8psk: usb in 149 operation failed. [ 204.429017][ T4234] gp8psk: failed to get FPGA version [ 204.439303][ T5902] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 204.450363][ T5902] ext4 filesystem being mounted at /74/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 204.829485][ T4234] gp8psk: usb in 138 operation failed. [ 204.835729][ T4234] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 204.858380][ T4234] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 204.886001][ T4234] usb 1-1: USB disconnect, device number 16 [ 205.003232][ T5734] usb 5-1: device descriptor read/64, error -71 [ 205.025103][ T4197] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 205.160315][ T5734] usb usb5-port1: attempt power cycle [ 205.704621][ T5734] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 205.708883][ T5924] netlink: 8 bytes leftover after parsing attributes in process `syz.3.425'. [ 205.793092][ T5734] usb 5-1: device descriptor read/8, error -71 [ 205.800426][ T5927] fuse: Unknown parameter '0x0000000000000004' [ 205.893050][ T4197] usb 2-1: unable to get BOS descriptor or descriptor too short [ 205.915571][ T5929] netlink: 76 bytes leftover after parsing attributes in process `syz.0.430'. [ 205.982070][ T5931] netlink: 'syz.2.431': attribute type 39 has an invalid length. [ 205.982983][ T4197] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 37, changing to 7 [ 206.014798][ T4197] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 116, changing to 7 [ 206.093050][ T5734] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 206.160695][ T5940] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 206.202896][ T23] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 206.222954][ T5734] usb 5-1: device descriptor read/8, error -71 [ 206.262932][ T4197] usb 2-1: string descriptor 0 read error: -22 [ 206.269413][ T4197] usb 2-1: New USB device found, idVendor=1235, idProduct=8012, bcdDevice= 0.40 [ 206.278908][ T4197] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 206.353287][ T5734] usb usb5-port1: unable to enumerate USB device [ 206.372964][ T21] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 206.393166][ T23] usb 4-1: device descriptor read/64, error -71 [ 206.612881][ T21] usb 3-1: Using ep0 maxpacket: 32 [ 206.662858][ T23] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 206.732849][ T5734] usb 5-1: new low-speed USB device number 28 using dummy_hcd [ 206.758574][ T4234] usb 2-1: USB disconnect, device number 24 [ 206.773115][ T21] usb 3-1: unable to get BOS descriptor or descriptor too short [ 206.852912][ T21] usb 3-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 206.863540][ T23] usb 4-1: device descriptor read/64, error -71 [ 207.077741][ T23] usb usb4-port1: attempt power cycle [ 207.093242][ T5734] usb 5-1: config index 0 descriptor too short (expected 1307, got 27) [ 207.102067][ T5734] usb 5-1: config 0 has an invalid interface number: 0 but max is -1 [ 207.110317][ T5734] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 207.119455][ T5734] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 246, using maximum allowed: 30 [ 207.130342][ T5734] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 is Bulk; changing to Interrupt [ 207.140378][ T5734] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 207.142914][ T21] usb 3-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 207.150562][ T5734] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 246 [ 207.172855][ T21] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 207.172887][ T21] usb 3-1: Product: syz [ 207.172904][ T21] usb 3-1: Manufacturer: syz [ 207.172921][ T21] usb 3-1: SerialNumber: syz [ 207.391574][ T5947] tipc: Enabled bearer , priority 0 [ 207.399804][ T5947] device syzkaller0 entered promiscuous mode [ 207.410628][ T5947] tipc: Resetting bearer [ 207.430219][ T5947] tipc: Disabling bearer [ 207.508821][ T23] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 207.643215][ T23] usb 4-1: device descriptor read/8, error -71 [ 207.668052][ T5948] netlink: 16 bytes leftover after parsing attributes in process `syz.2.433'. [ 207.763252][ T21] usb 3-1: Cannot retrieve CPort count: -110 [ 207.770919][ T21] usb 3-1: Cannot retrieve CPort count: -110 [ 207.991750][ T21] es2_ap_driver: probe of 3-1:7.0 failed with error -110 [ 208.051216][ T5956] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 208.069339][ T5956] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 208.082088][ T5956] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 208.108366][ T23] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 208.219075][ T23] usb 4-1: device descriptor read/8, error -71 [ 208.316111][ T5959] fuse: Unknown parameter 'fd0x0000000000000004' [ 208.358926][ T23] usb usb4-port1: unable to enumerate USB device [ 208.947802][ T5967] netlink: 76 bytes leftover after parsing attributes in process `syz.0.442'. [ 209.020454][ T5969] netlink: 'syz.3.443': attribute type 39 has an invalid length. [ 209.208770][ T5736] usb 3-1: USB disconnect, device number 12 [ 209.392849][ T23] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 209.453872][ T5734] usb 5-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 209.468762][ T5734] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 209.542891][ T4234] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 209.580268][ T5734] usb 5-1: config 0 descriptor?? [ 209.612972][ T5734] usb 5-1: can't set config #0, error -71 [ 210.043224][ T4234] usb 4-1: unable to get BOS descriptor or descriptor too short [ 210.282214][ T23] usb 2-1: device descriptor read/64, error -71 [ 210.298576][ T5734] usb 5-1: USB disconnect, device number 28 [ 210.393816][ T5991] fuse: Unknown parameter 'fd0x0000000000000004' [ 210.463105][ T4234] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 37, changing to 7 [ 210.489073][ T5997] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 210.503098][ T4234] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 116, changing to 7 [ 210.615563][ T5997] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 210.622932][ T23] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 210.647207][ T5997] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 210.784274][ T4234] usb 4-1: string descriptor 0 read error: -22 [ 210.797506][ T4234] usb 4-1: New USB device found, idVendor=1235, idProduct=8012, bcdDevice= 0.40 [ 210.812840][ T23] usb 2-1: device descriptor read/64, error -71 [ 210.848412][ T4234] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 210.942941][ T23] usb usb2-port1: attempt power cycle [ 211.322384][ T6004] netlink: 76 bytes leftover after parsing attributes in process `syz.4.455'. [ 211.352935][ T23] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 211.369599][ T21] usb 4-1: USB disconnect, device number 23 [ 211.442938][ T23] usb 2-1: device descriptor read/8, error -71 [ 211.461121][ T6006] netlink: 'syz.4.456': attribute type 39 has an invalid length. [ 211.722870][ T23] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 211.802866][ T4197] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 211.819277][ T23] usb 2-1: device descriptor read/8, error -71 [ 211.943892][ T23] usb usb2-port1: unable to enumerate USB device [ 211.952960][ T4234] usb 3-1: new low-speed USB device number 13 using dummy_hcd [ 212.142698][ T6022] fuse: Unknown parameter 'fd0x0000000000000004' [ 212.162886][ T4197] usb 5-1: Using ep0 maxpacket: 32 [ 212.563396][ T4197] usb 5-1: unable to get BOS descriptor or descriptor too short [ 214.335712][ T6034] netlink: 76 bytes leftover after parsing attributes in process `syz.1.466'. [ 214.373336][ T4234] usb 3-1: config index 0 descriptor too short (expected 1307, got 27) [ 214.382059][ T4234] usb 3-1: config 0 has an invalid interface number: 0 but max is -1 [ 214.410920][ T4234] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 214.440381][ T4234] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 246, using maximum allowed: 30 [ 214.468804][ T4234] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 is Bulk; changing to Interrupt [ 214.475258][ T4197] usb 5-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 214.502926][ T4234] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 214.522922][ T4234] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 246 [ 214.604558][ T6036] No such timeout policy "syz1" [ 214.933011][ T4234] usb 3-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 214.982942][ T4234] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 215.069027][ T6043] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 215.105412][ T6043] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 215.108376][ T4234] usb 3-1: config 0 descriptor?? [ 215.133513][ T6043] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 215.167752][ T4234] usb 3-1: can't set config #0, error -71 [ 215.192960][ T4197] usb 5-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 215.193762][ T4234] usb 3-1: USB disconnect, device number 13 [ 215.216989][ T4197] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 215.403063][ T4197] usb 5-1: can't set config #7, error -71 [ 215.464871][ T4197] usb 5-1: USB disconnect, device number 29 [ 216.286458][ T5735] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 216.312448][ T6057] loop2: detected capacity change from 0 to 128 [ 216.467705][ T6059] netlink: 'syz.0.467': attribute type 39 has an invalid length. [ 216.533052][ T5735] usb 2-1: device descriptor read/64, error -71 [ 216.533099][ T5736] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 216.660259][ T6057] FAT-fs (loop2): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 216.973220][ T5735] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 217.003482][ T5736] usb 4-1: unable to get BOS descriptor or descriptor too short [ 217.153897][ T5736] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 37, changing to 7 [ 217.240112][ T5735] usb 2-1: device descriptor read/64, error -71 [ 217.280807][ T5736] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 116, changing to 7 [ 217.345650][ T1402] FAT-fs (loop2): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 217.373313][ T5735] usb usb2-port1: attempt power cycle [ 217.602839][ T4197] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 217.613648][ T23] usb 1-1: new low-speed USB device number 17 using dummy_hcd [ 217.639786][ T6077] netlink: 76 bytes leftover after parsing attributes in process `syz.2.480'. [ 217.733204][ T5736] usb 4-1: string descriptor 0 read error: -22 [ 217.739489][ T5736] usb 4-1: New USB device found, idVendor=1235, idProduct=8012, bcdDevice= 0.40 [ 217.749003][ T5736] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 217.842892][ T5735] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 217.842942][ T4197] usb 5-1: Using ep0 maxpacket: 32 [ 217.953005][ T5735] usb 2-1: device descriptor read/8, error -71 [ 217.982959][ T4534] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 217.993331][ T23] usb 1-1: config index 0 descriptor too short (expected 1307, got 27) [ 218.008387][ T23] usb 1-1: config 0 has an invalid interface number: 0 but max is -1 [ 218.017746][ T4197] usb 5-1: unable to get BOS descriptor or descriptor too short [ 218.033241][ T23] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 218.042173][ T23] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 246, using maximum allowed: 30 [ 218.065880][ T23] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 is Bulk; changing to Interrupt [ 218.079201][ T23] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 218.096365][ T23] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 246 [ 218.133000][ T4197] usb 5-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 218.304384][ T4197] usb 5-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 218.351932][ T4197] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 218.361748][ T4534] usb 3-1: config 0 has an invalid interface number: 69 but max is 0 [ 218.370490][ T23] usb 1-1: string descriptor 0 read error: -22 [ 218.413134][ T23] usb 1-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 218.449964][ T4534] usb 3-1: config 0 has no interface number 0 [ 218.539276][ T4197] usb 5-1: Product: syz [ 218.551214][ T4534] usb 3-1: config 0 interface 69 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1023 [ 218.581981][ T23] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 218.621344][ T4197] usb 5-1: Manufacturer: syz [ 218.681208][ T4197] usb 5-1: SerialNumber: syz [ 218.705533][ T4534] usb 3-1: config 0 interface 69 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 218.812381][ T23] usb 1-1: config 0 descriptor?? [ 218.842250][ T4178] usb 4-1: USB disconnect, device number 24 [ 218.873723][ T23] hub 1-1:0.0: bad descriptor, ignoring hub [ 218.879684][ T23] hub: probe of 1-1:0.0 failed with error -5 [ 218.915151][ T23] input: USB Acecad 302 Tablet 0460:0008 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input11 [ 218.984139][ T4534] usb 3-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 219.004307][ T4534] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 219.020473][ T4534] usb 3-1: Product: syz [ 219.025197][ T4534] usb 3-1: Manufacturer: syz [ 219.029821][ T4534] usb 3-1: SerialNumber: syz [ 219.045523][ T4534] usb 3-1: config 0 descriptor?? [ 219.069141][ T23] usb 1-1: USB disconnect, device number 17 [ 219.078670][ T6079] raw-gadget.4 gadget: fail, usb_ep_enable returned -22 [ 219.097341][ T4534] cyberjack 3-1:0.69: Reiner SCT Cyberjack USB card reader converter detected [ 219.111198][ T4534] usb 3-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 219.392936][ T4197] usb 5-1: Cannot retrieve CPort count: -110 [ 219.412873][ T4197] usb 5-1: Cannot retrieve CPort count: -110 [ 219.418932][ T4197] es2_ap_driver: probe of 5-1:7.0 failed with error -110 [ 219.634279][ T6100] loop0: detected capacity change from 0 to 128 [ 219.668968][ T6100] FAT-fs (loop0): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 219.684862][ T6096] netlink: 'syz.3.486': attribute type 39 has an invalid length. [ 219.756292][ T4324] FAT-fs (loop0): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 220.057190][ T5736] usb 3-1: USB disconnect, device number 14 [ 220.078808][ T5736] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 220.093354][ T5736] cyberjack 3-1:0.69: device disconnected [ 220.275435][ T6112] netlink: 76 bytes leftover after parsing attributes in process `syz.2.491'. [ 220.458626][ T4197] usb 5-1: USB disconnect, device number 30 [ 220.642915][ T5735] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 220.677253][ T6116] netlink: 8 bytes leftover after parsing attributes in process `syz.4.493'. [ 220.842962][ T5735] usb 4-1: device descriptor read/64, error -71 [ 220.958210][ T6130] netlink: 'syz.0.499': attribute type 39 has an invalid length. [ 221.112867][ T5735] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 221.152916][ T4234] usb 5-1: new low-speed USB device number 31 using dummy_hcd [ 221.423032][ T4197] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 221.453595][ T5735] usb 4-1: device descriptor read/64, error -71 [ 221.853007][ T4197] usb 1-1: config 0 has an invalid interface number: 69 but max is 0 [ 221.861114][ T4197] usb 1-1: config 0 has no interface number 0 [ 221.862982][ T5735] usb usb4-port1: attempt power cycle [ 221.909675][ T4197] usb 1-1: config 0 interface 69 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1023 [ 221.947713][ T4197] usb 1-1: config 0 interface 69 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 221.963586][ T6144] netlink: 76 bytes leftover after parsing attributes in process `syz.1.502'. [ 221.998520][ T4234] usb 5-1: config index 0 descriptor too short (expected 1307, got 27) [ 222.010307][ T4234] usb 5-1: config 0 has an invalid interface number: 0 but max is -1 [ 222.025575][ T4234] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 222.035341][ T4234] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 246, using maximum allowed: 30 [ 222.046663][ T4234] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 is Bulk; changing to Interrupt [ 222.056814][ T4234] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 222.066629][ T4234] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 246 [ 222.123009][ T4197] usb 1-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 222.132505][ T4197] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 222.141323][ T4197] usb 1-1: Product: syz [ 222.149698][ T4197] usb 1-1: Manufacturer: syz [ 222.154424][ T4197] usb 1-1: SerialNumber: syz [ 222.168249][ T4197] usb 1-1: config 0 descriptor?? [ 222.193159][ T6141] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 222.214732][ T4197] cyberjack 1-1:0.69: Reiner SCT Cyberjack USB card reader converter detected [ 222.228548][ T4197] usb 1-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 222.343049][ T5735] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 222.350805][ T4234] usb 5-1: string descriptor 0 read error: -22 [ 222.357669][ T4234] usb 5-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 222.367237][ T5736] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 222.375213][ T4234] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 222.393912][ T4234] usb 5-1: config 0 descriptor?? [ 222.434232][ T4234] hub 5-1:0.0: bad descriptor, ignoring hub [ 222.440455][ T4234] hub: probe of 5-1:0.0 failed with error -5 [ 222.447134][ T5735] usb 4-1: device descriptor read/8, error -71 [ 222.456718][ T4234] input: USB Acecad 302 Tablet 0460:0008 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input12 [ 222.632867][ T5736] usb 3-1: Using ep0 maxpacket: 32 [ 222.648385][ T4234] usb 5-1: USB disconnect, device number 31 [ 222.723003][ T5735] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 222.823136][ T5736] usb 3-1: unable to get BOS descriptor or descriptor too short [ 222.832209][ T5735] usb 4-1: device descriptor read/8, error -71 [ 222.923314][ T5736] usb 3-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 222.963385][ T5735] usb usb4-port1: unable to enumerate USB device [ 223.153717][ T5736] usb 3-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 223.284165][ T5736] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 223.319039][ T5736] usb 3-1: Product: syz [ 223.328509][ T5736] usb 3-1: Manufacturer: syz [ 223.333446][ T5736] usb 3-1: SerialNumber: syz [ 223.347341][ T4234] usb 1-1: USB disconnect, device number 18 [ 223.673413][ T4234] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 223.703537][ T4234] cyberjack 1-1:0.69: device disconnected [ 223.849447][ T6173] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 223.857653][ T6173] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 223.993102][ T5736] usb 3-1: Cannot retrieve CPort count: -110 [ 224.017128][ T5736] usb 3-1: Cannot retrieve CPort count: -110 [ 224.048032][ T4197] usb 2-1: new full-speed USB device number 33 using dummy_hcd [ 224.074007][ T5736] es2_ap_driver: probe of 3-1:7.0 failed with error -110 [ 224.366579][ T6186] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 225.372984][ T4197] usb 2-1: config 0 interface 0 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 225.393312][ T4197] usb 2-1: config 0 interface 0 has no altsetting 0 [ 225.553018][ T6198] loop3: detected capacity change from 0 to 1024 [ 225.892957][ T4197] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 227.133356][ T4197] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 227.141715][ T4197] usb 2-1: Product: syz [ 227.146242][ T4197] usb 2-1: Manufacturer: syz [ 227.150955][ T4197] usb 2-1: SerialNumber: syz [ 227.163800][ T4197] usb 2-1: config 0 descriptor?? [ 227.213394][ T4534] usb 3-1: USB disconnect, device number 15 [ 227.346103][ T6212] tipc: Failed to remove unknown binding: 66,0,0/0:3309458030/3309458032 [ 227.363012][ T4197] usb 2-1: can't set config #0, error -71 [ 227.363826][ T6212] tipc: Failed to remove unknown binding: 66,0,0/0:3309458030/3309458031 [ 227.373784][ T4197] usb 2-1: USB disconnect, device number 33 [ 227.422684][ T6216] tipc: Failed to remove unknown binding: 66,0,0/0:3309458030/3309458032 [ 227.433241][ T6216] tipc: Failed to remove unknown binding: 66,0,0/0:3309458030/3309458031 [ 227.473414][ T23] usb 1-1: new low-speed USB device number 19 using dummy_hcd [ 228.307132][ T4234] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 228.673054][ T4234] usb 4-1: config 0 has an invalid interface number: 69 but max is 0 [ 228.681421][ T4234] usb 4-1: config 0 has no interface number 0 [ 228.687914][ T4234] usb 4-1: config 0 interface 69 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1023 [ 228.698337][ T4234] usb 4-1: config 0 interface 69 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 228.871603][ T4234] usb 4-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 228.906037][ T4234] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 228.926852][ T4234] usb 4-1: Product: syz [ 229.109880][ T4234] usb 4-1: Manufacturer: syz [ 229.115795][ T4234] usb 4-1: SerialNumber: syz [ 229.133876][ T23] usb 1-1: config index 0 descriptor too short (expected 1307, got 27) [ 229.138964][ T4234] usb 4-1: config 0 descriptor?? [ 229.147542][ T23] usb 1-1: config 0 has an invalid interface number: 0 but max is -1 [ 229.156376][ T23] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 229.167003][ T23] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 246, using maximum allowed: 30 [ 229.180561][ T23] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 is Bulk; changing to Interrupt [ 229.192784][ T23] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 229.204292][ T23] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 246 [ 229.229759][ T6211] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 229.306417][ T4202] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 229.316971][ T4202] CPU: 1 PID: 4202 Comm: kworker/u5:4 Not tainted syzkaller #0 [ 229.324729][ T4202] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 229.334986][ T4202] Workqueue: hci0 hci_rx_work [ 229.339769][ T4202] Call Trace: [ 229.343066][ T4202] [ 229.346119][ T4202] dump_stack_lvl+0x188/0x250 [ 229.350829][ T4202] ? show_regs_print_info+0x20/0x20 [ 229.356048][ T4202] ? load_image+0x400/0x400 [ 229.360611][ T4202] sysfs_create_dir_ns+0x26a/0x290 [ 229.365784][ T4202] ? sysfs_warn_dup+0xa0/0xa0 [ 229.370500][ T4202] ? preempt_schedule_thunk+0x16/0x18 [ 229.376005][ T4202] kobject_add_internal+0x6e0/0xd90 [ 229.381332][ T4202] kobject_add+0x160/0x230 [ 229.385782][ T4202] ? kobject_init+0x1d0/0x1d0 [ 229.390902][ T4202] ? klist_children_get+0x50/0x50 [ 229.395950][ T4202] ? get_device_parent+0x121/0x3f0 [ 229.401084][ T4202] device_add+0x483/0xfb0 [ 229.405466][ T4202] hci_conn_add_sysfs+0xd1/0x1e0 [ 229.410455][ T4202] le_conn_complete_evt+0xc48/0x15c0 [ 229.415763][ T4202] ? __switch_to_asm+0x34/0x60 [ 229.420648][ T4202] ? cs_le_create_conn+0x5e0/0x5e0 [ 229.425803][ T4202] hci_le_meta_evt+0x285/0x3c90 [ 229.430775][ T4202] ? mark_lock+0x94/0x320 [ 229.435304][ T4202] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 229.441318][ T4202] ? lock_chain_count+0x20/0x20 [ 229.446405][ T4202] ? hci_remote_host_features_evt+0x280/0x280 [ 229.452519][ T4202] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 229.458218][ T4202] ? lockdep_hardirqs_on+0x94/0x140 [ 229.463454][ T4202] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 229.469206][ T4202] ? hci_event_packet+0x38a/0x1370 [ 229.474347][ T4202] hci_event_packet+0xe48/0x1370 [ 229.479419][ T4202] ? rcu_lock_release+0x20/0x20 [ 229.484298][ T4202] ? hci_send_to_monitor+0x9c/0x4a0 [ 229.489712][ T4202] hci_rx_work+0x255/0xa10 [ 229.494175][ T4202] process_one_work+0x85f/0x1010 [ 229.499157][ T4202] ? worker_detach_from_pool+0x240/0x240 [ 229.506625][ T4202] ? lockdep_hardirqs_off+0x70/0x100 [ 229.511958][ T4202] ? _raw_spin_lock_irq+0xb7/0xf0 [ 229.517110][ T4202] ? _raw_spin_lock_irqsave+0x100/0x100 [ 229.522874][ T4202] ? wq_worker_running+0x97/0x170 [ 229.527941][ T4202] worker_thread+0xaa6/0x1290 [ 229.532774][ T4202] kthread+0x436/0x520 [ 229.536866][ T4202] ? rcu_lock_release+0x20/0x20 [ 229.541908][ T4202] ? kthread_blkcg+0xd0/0xd0 [ 229.546647][ T4202] ret_from_fork+0x1f/0x30 [ 229.551388][ T4202] [ 229.584515][ T4202] kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 229.594035][ T4234] cyberjack 4-1:0.69: Reiner SCT Cyberjack USB card reader converter detected [ 229.598949][ T4202] Bluetooth: hci0: failed to register connection device [ 229.626547][ T4234] usb 4-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 229.882988][ T23] usb 1-1: string descriptor 0 read error: -22 [ 229.889291][ T23] usb 1-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 229.918769][ T23] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 229.928959][ T23] usb 1-1: config 0 descriptor?? [ 230.093619][ T23] hub 1-1:0.0: bad descriptor, ignoring hub [ 230.100112][ T23] hub: probe of 1-1:0.0 failed with error -5 [ 230.109528][ T23] input: USB Acecad 302 Tablet 0460:0008 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input13 [ 230.936703][ T6242] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 231.045563][ T4234] usb 1-1: USB disconnect, device number 19 [ 231.125942][ T5735] usb 4-1: USB disconnect, device number 29 [ 231.557653][ T5735] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 231.583461][ T5735] cyberjack 4-1:0.69: device disconnected [ 232.078496][ T6276] tipc: Failed to remove unknown binding: 66,0,0/0:1724196079/1724196081 [ 232.087644][ T6276] tipc: Failed to remove unknown binding: 66,0,0/0:1724196079/1724196080 [ 232.125968][ T6276] tipc: Failed to remove unknown binding: 66,0,0/0:1724196079/1724196081 [ 232.134765][ T6276] tipc: Failed to remove unknown binding: 66,0,0/0:1724196079/1724196080 [ 232.453263][ T4234] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 232.632843][ T5735] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 232.813218][ T4234] usb 1-1: Using ep0 maxpacket: 32 [ 232.972923][ T5735] usb 4-1: Using ep0 maxpacket: 16 [ 233.019274][ T4234] usb 1-1: unable to get BOS descriptor or descriptor too short [ 233.101703][ T6284] loop1: detected capacity change from 0 to 16 [ 233.142936][ T5735] usb 4-1: config 0 has an invalid interface number: 162 but max is 0 [ 233.151280][ T5735] usb 4-1: config 0 has an invalid interface number: 220 but max is 0 [ 233.152575][ T6284] erofs: (device loop1): mounted with root inode @ nid 36. [ 233.159880][ T4234] usb 1-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 233.207909][ T5735] usb 4-1: config 0 has 2 interfaces, different from the descriptor's value: 1 [ 233.221212][ T5735] usb 4-1: config 0 has no interface number 0 [ 233.226771][ T6284] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 233.231819][ T5735] usb 4-1: config 0 has no interface number 1 [ 233.248561][ T5735] usb 4-1: config 0 interface 162 altsetting 213 has an invalid endpoint with address 0x80, skipping [ 233.261328][ T5735] usb 4-1: config 0 interface 162 altsetting 213 endpoint 0x3 has invalid maxpacket 1024, setting to 64 [ 233.280488][ T5735] usb 4-1: config 0 interface 162 altsetting 213 has a duplicate endpoint with address 0x3, skipping [ 233.292427][ T5735] usb 4-1: config 0 interface 162 altsetting 213 has 9 endpoint descriptors, different from the interface descriptor's value: 12 [ 233.312285][ T5735] usb 4-1: too many endpoints for config 0 interface 220 altsetting 107: 155, using maximum allowed: 30 [ 233.326947][ T5735] usb 4-1: config 0 interface 220 altsetting 107 has a duplicate endpoint with address 0x3, skipping [ 233.338197][ T5735] usb 4-1: config 0 interface 220 altsetting 107 has an invalid endpoint with address 0x80, skipping [ 233.352467][ T5735] usb 4-1: config 0 interface 220 altsetting 107 has a duplicate endpoint with address 0x2, skipping [ 233.367383][ T5735] usb 4-1: config 0 interface 220 altsetting 107 has 3 endpoint descriptors, different from the interface descriptor's value: 155 [ 233.382004][ T5735] usb 4-1: config 0 interface 162 has no altsetting 0 [ 233.389141][ T5735] usb 4-1: config 0 interface 220 has no altsetting 0 [ 233.412976][ T4234] usb 1-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 233.422351][ T4234] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 233.430905][ T4234] usb 1-1: Product: syz [ 233.435791][ T4234] usb 1-1: Manufacturer: syz [ 233.440411][ T4234] usb 1-1: SerialNumber: syz [ 233.562930][ T23] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 233.593638][ T5735] usb 4-1: New USB device found, idVendor=0bfd, idProduct=0102, bcdDevice=cf.5c [ 233.602940][ T5735] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 233.611024][ T5735] usb 4-1: Product: в [ 233.615562][ T5735] usb 4-1: Manufacturer: ᐇ [ 233.620331][ T5735] usb 4-1: SerialNumber: 廣눴ዞᎮ笅鿻胳饱Ჵ᪢妥睋ሷ妹⽺஽褅踾呾颥礽 [ 233.632584][ T5735] usb 4-1: config 0 descriptor?? [ 233.923058][ T23] usb 3-1: config 0 has an invalid interface number: 69 but max is 0 [ 233.931421][ T23] usb 3-1: config 0 has no interface number 0 [ 233.938129][ T23] usb 3-1: config 0 interface 69 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1023 [ 233.948496][ T23] usb 3-1: config 0 interface 69 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 233.959849][ T4197] Bluetooth: hci0: command 0x1407 tx timeout [ 233.995614][ T5735] kvaser_usb 4-1:0.162: Cannot get usb endpoint(s) [ 234.043055][ T4234] usb 1-1: Cannot retrieve CPort count: -110 [ 234.049143][ T4234] usb 1-1: Cannot retrieve CPort count: -110 [ 234.055991][ T5735] kvaser_usb 4-1:0.220: Cannot get usb endpoint(s) [ 234.062778][ T4234] es2_ap_driver: probe of 1-1:7.0 failed with error -110 [ 234.074965][ T5735] usb 4-1: USB disconnect, device number 30 [ 234.115283][ T23] usb 3-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 234.150530][ T6291] loop4: detected capacity change from 0 to 64 [ 234.151878][ T23] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 234.201718][ T6290] tipc: Failed to remove unknown binding: 66,0,0/0:999470063/999470065 [ 234.216114][ T6290] tipc: Failed to remove unknown binding: 66,0,0/0:999470063/999470064 [ 234.229146][ T6290] tipc: Failed to remove unknown binding: 66,0,0/0:999470063/999470065 [ 234.241721][ T6290] tipc: Failed to remove unknown binding: 66,0,0/0:999470063/999470064 [ 234.327742][ T23] usb 3-1: Product: syz [ 234.332434][ T23] usb 3-1: Manufacturer: syz [ 234.337237][ T23] usb 3-1: SerialNumber: syz [ 234.372300][ T23] usb 3-1: config 0 descriptor?? [ 234.393088][ T6286] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 234.413901][ T23] cyberjack 3-1:0.69: Reiner SCT Cyberjack USB card reader converter detected [ 235.283622][ T23] usb 3-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 235.292018][ T6297] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 235.409103][ T23] usb 1-1: USB disconnect, device number 20 [ 235.638047][ T6306] netlink: 'syz.0.549': attribute type 39 has an invalid length. [ 236.261664][ T5730] usb 3-1: USB disconnect, device number 16 [ 236.283710][ T6326] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 236.309323][ T5730] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 236.427510][ T5730] cyberjack 3-1:0.69: device disconnected [ 236.617140][ T6329] binder: 6327:6329 ioctl 4018620d 0 returned -22 [ 236.951764][ T6331] tipc: Failed to remove unknown binding: 66,0,0/0:1918303569/1918303571 [ 236.992069][ T6331] tipc: Failed to remove unknown binding: 66,0,0/0:1918303569/1918303570 [ 237.049622][ T6332] tipc: Failed to remove unknown binding: 66,0,0/0:1918303569/1918303571 [ 237.139026][ T6332] tipc: Failed to remove unknown binding: 66,0,0/0:1918303569/1918303570 [ 237.252877][ T4234] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 238.868500][ T5735] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 238.905080][ T6342] device syzkaller0 entered promiscuous mode [ 239.132932][ T4234] usb 4-1: Using ep0 maxpacket: 16 [ 239.285937][ T4234] usb 4-1: config 166 has an invalid interface number: 177 but max is 1 [ 239.305457][ T4234] usb 4-1: config 166 has an invalid interface number: 34 but max is 1 [ 239.322992][ T5735] usb 2-1: Using ep0 maxpacket: 32 [ 239.360125][ T4234] usb 4-1: config 166 has an invalid descriptor of length 0, skipping remainder of the config [ 239.520464][ T4234] usb 4-1: config 166 has no interface number 0 [ 239.562791][ T4234] usb 4-1: config 166 has no interface number 1 [ 239.760485][ T5735] usb 2-1: unable to get BOS descriptor or descriptor too short [ 239.780898][ T4234] usb 4-1: config 166 interface 177 altsetting 4 has an invalid endpoint with address 0x0, skipping [ 240.340948][ T4234] usb 4-1: config 166 interface 177 altsetting 4 has an invalid endpoint with address 0x0, skipping [ 240.352650][ T4234] usb 4-1: config 166 interface 34 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 240.368343][ T4234] usb 4-1: config 166 interface 34 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 240.390418][ T4234] usb 4-1: config 166 interface 177 has no altsetting 0 [ 240.397933][ T4234] usb 4-1: config 166 interface 34 has no altsetting 0 [ 240.422959][ T5735] usb 2-1: unable to read config index 0 descriptor/all [ 240.431113][ T6376] loop1: detected capacity change from 0 to 256 [ 240.571104][ T6378] device vlan1 entered promiscuous mode [ 241.341747][ T5735] usb 2-1: can't read configurations, error -71 [ 241.363480][ T4234] usb 4-1: string descriptor 0 read error: -71 [ 241.369874][ T4234] usb 4-1: New USB device found, idVendor=0bda, idProduct=0138, bcdDevice=30.12 [ 241.436457][ T4234] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 241.472978][ T4234] usb 4-1: can't set config #166, error -71 [ 241.487001][ T4234] usb 4-1: USB disconnect, device number 31 [ 241.854063][ T6392] FAT-fs (loop1): error, fat_free_clusters: deleting FAT entry beyond EOF [ 243.576152][ T6406] loop1: detected capacity change from 0 to 2048 [ 243.696558][ T6406] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 243.712103][ T6408] device syzkaller0 entered promiscuous mode [ 244.009835][ T4178] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 244.073852][ T6414] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 244.101133][ T6414] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 244.208567][ T6414] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 244.238564][ T6412] loop4: detected capacity change from 0 to 4096 [ 244.271839][ T6412] ntfs3: Unknown parameter 'windows_names' [ 245.267091][ T4178] usb 1-1: Using ep0 maxpacket: 16 [ 245.284124][ T6426] netlink: 'syz.3.582': attribute type 39 has an invalid length. [ 245.433407][ T4178] usb 1-1: config 166 has an invalid interface number: 177 but max is 1 [ 245.477915][ T4178] usb 1-1: config 166 has an invalid interface number: 34 but max is 1 [ 245.592824][ T4178] usb 1-1: config 166 has an invalid descriptor of length 0, skipping remainder of the config [ 245.628197][ T4178] usb 1-1: config 166 has no interface number 0 [ 245.861707][ T4178] usb 1-1: config 166 has no interface number 1 [ 245.887022][ T4178] usb 1-1: config 166 interface 177 altsetting 4 has an invalid endpoint with address 0x0, skipping [ 245.914645][ T4178] usb 1-1: config 166 interface 177 altsetting 4 has an invalid endpoint with address 0x0, skipping [ 245.935666][ T4178] usb 1-1: config 166 interface 34 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 245.947380][ T4178] usb 1-1: config 166 interface 34 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 245.969702][ T4178] usb 1-1: config 166 interface 177 has no altsetting 0 [ 245.978083][ T4178] usb 1-1: config 166 interface 34 has no altsetting 0 [ 246.024668][ T6434] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 246.142962][ T4178] usb 1-1: New USB device found, idVendor=0bda, idProduct=0138, bcdDevice=30.12 [ 246.156642][ T6439] tipc: Failed to remove unknown binding: 66,0,0/0:693022972/693022974 [ 246.165287][ T4178] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 246.173588][ T6439] tipc: Failed to remove unknown binding: 66,0,0/0:693022972/693022973 [ 246.178240][ T4178] usb 1-1: Product: syz [ 246.187267][ T4178] usb 1-1: Manufacturer: syz [ 246.191897][ T4178] usb 1-1: SerialNumber: syz [ 246.286684][ T6440] tipc: Failed to remove unknown binding: 66,0,0/0:693022972/693022974 [ 246.295768][ T6440] tipc: Failed to remove unknown binding: 66,0,0/0:693022972/693022973 [ 246.597938][ T4178] ums-realtek 1-1:166.177: USB Mass Storage device detected [ 246.734715][ T4178] ums-realtek 1-1:166.34: USB Mass Storage device detected [ 246.816395][ T6448] loop2: detected capacity change from 0 to 128 [ 246.882894][ T4178] usb 1-1: Found UVC 0.00 device syz (0bda:0138) [ 246.890608][ T4178] usb 1-1: No valid video chain found. [ 246.934884][ T4178] usb 1-1: USB disconnect, device number 21 [ 247.064417][ T6452] netlink: 76 bytes leftover after parsing attributes in process `syz.4.589'. [ 247.211290][ T6457] device syzkaller0 entered promiscuous mode [ 247.522777][ T6466] usb usb7: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 248.389898][ T6466] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 248.397434][ T6466] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 248.409738][ T6466] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 249.103588][ T6478] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 249.113804][ T6478] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 249.121536][ T6478] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 249.153008][ T6473] netlink: 'syz.2.596': attribute type 39 has an invalid length. [ 249.312619][ T6485] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 249.574909][ T6492] tipc: Failed to remove unknown binding: 66,0,0/0:1598288712/1598288714 [ 249.592646][ T6492] tipc: Failed to remove unknown binding: 66,0,0/0:1598288712/1598288713 [ 249.620370][ T6492] tipc: Failed to remove unknown binding: 66,0,0/0:1598288712/1598288714 [ 249.630778][ T6494] netlink: 76 bytes leftover after parsing attributes in process `syz.0.603'. [ 249.636596][ T6492] tipc: Failed to remove unknown binding: 66,0,0/0:1598288712/1598288713 [ 249.702975][ T5736] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 249.724066][ T6496] loop3: detected capacity change from 0 to 2048 [ 250.852928][ T5736] usb 3-1: Using ep0 maxpacket: 16 [ 250.907783][ T6508] loop3: detected capacity change from 0 to 512 [ 250.935966][ T6508] EXT4-fs (loop3): inline encryption not supported [ 250.959776][ T6508] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 251.005150][ T5736] usb 3-1: config 166 has an invalid interface number: 177 but max is 1 [ 251.019250][ T6508] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 251.023333][ T5736] usb 3-1: config 166 has an invalid interface number: 34 but max is 1 [ 251.057191][ T6508] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a002c118, mo2=0002] [ 251.073553][ T5736] usb 3-1: config 166 has an invalid descriptor of length 0, skipping remainder of the config [ 251.084371][ T5736] usb 3-1: config 166 has no interface number 0 [ 251.091793][ T6517] netlink: 'syz.4.609': attribute type 39 has an invalid length. [ 251.094373][ T5736] usb 3-1: config 166 has no interface number 1 [ 251.106177][ T5736] usb 3-1: config 166 interface 177 altsetting 4 has an invalid endpoint with address 0x0, skipping [ 251.117333][ T5736] usb 3-1: config 166 interface 177 altsetting 4 has an invalid endpoint with address 0x0, skipping [ 251.128427][ T5736] usb 3-1: config 166 interface 34 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 251.139409][ T5736] usb 3-1: config 166 interface 34 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 251.153184][ T5736] usb 3-1: config 166 interface 177 has no altsetting 0 [ 251.159650][ T6508] System zones: 1-12 [ 251.160162][ T5736] usb 3-1: config 166 interface 34 has no altsetting 0 [ 251.179006][ T6508] [ 251.217431][ T6508] EXT4-fs (loop3): 1 truncate cleaned up [ 251.233124][ T6521] loop4: detected capacity change from 0 to 164 [ 251.240680][ T6508] EXT4-fs (loop3): mounted filesystem without journal. Opts: nolazytime,inlinecrypt,debug,lazytime,bsddf,noload,,errors=continue. Quota mode: none. [ 251.503763][ T5736] usb 3-1: New USB device found, idVendor=0bda, idProduct=0138, bcdDevice=30.12 [ 251.559007][ T5736] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 251.568104][ T5736] usb 3-1: Product: syz [ 251.572502][ T5736] usb 3-1: Manufacturer: syz [ 251.577958][ T5736] usb 3-1: SerialNumber: syz [ 251.597249][ T6527] loop3: detected capacity change from 0 to 128 [ 251.668817][ T6528] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[4189] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[6528] [ 252.083661][ T5736] ums-realtek 3-1:166.177: USB Mass Storage device detected [ 252.398899][ T6535] tipc: Enabled bearer , priority 0 [ 252.440819][ T6535] device syzkaller0 entered promiscuous mode [ 252.687612][ T5736] ums-realtek 3-1:166.34: USB Mass Storage device detected [ 252.826276][ T6535] tipc: Resetting bearer [ 252.873040][ T5736] usb 3-1: Found UVC 0.00 device syz (0bda:0138) [ 252.879985][ T5736] usb 3-1: No valid video chain found. [ 252.938275][ T5736] usb 3-1: USB disconnect, device number 17 [ 253.026666][ T6533] tipc: Resetting bearer [ 253.060102][ T6533] tipc: Disabling bearer [ 253.071589][ T6541] netlink: 76 bytes leftover after parsing attributes in process `syz.4.615'. [ 253.089756][ T6546] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 253.110237][ T6546] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 253.168589][ T6546] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 254.417859][ T6567] netlink: 'syz.1.621': attribute type 39 has an invalid length. [ 254.515290][ T6569] loop4: detected capacity change from 0 to 256 [ 254.592453][ T6569] exFAT-fs (loop4): failed to load upcase table (idx : 0x00011a39, chksum : 0xd54015fb, utbl_chksum : 0xe619d30d) [ 255.105572][ T6582] netlink: 76 bytes leftover after parsing attributes in process `syz.2.628'. [ 255.819889][ T6585] loop3: detected capacity change from 0 to 16 [ 256.338051][ T5736] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 256.342776][ T4178] usb 1-1: new full-speed USB device number 22 using dummy_hcd [ 256.347156][ T1430] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.359606][ T1430] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.407378][ T6588] tipc: Enabled bearer , priority 0 [ 256.420163][ T6585] erofs: (device loop3): mounted with root inode @ nid 36. [ 256.505333][ T6588] device syzkaller0 entered promiscuous mode [ 256.562787][ T4178] usb 1-1: device descriptor read/64, error -71 [ 256.598906][ T6590] loop2: detected capacity change from 0 to 512 [ 256.614599][ T6588] tipc: Resetting bearer [ 256.639500][ T6587] tipc: Resetting bearer [ 256.658342][ T6590] EXT4-fs (loop2): Quota format mount options ignored when QUOTA feature is enabled [ 256.679360][ T6590] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=8842c018, mo2=0002] [ 256.690346][ T6587] tipc: Disabling bearer [ 256.696423][ T5736] usb 2-1: Using ep0 maxpacket: 16 [ 256.702894][ T6590] EXT4-fs (loop2): orphan cleanup on readonly fs [ 256.735997][ T6590] EXT4-fs warning (device loop2): ext4_enable_quotas:6488: Failed to enable quota tracking (type=2, err=-22, ino=15). Please run e2fsck to fix. [ 256.803584][ T6590] EXT4-fs (loop2): Cannot turn on quotas: error -22 [ 256.833042][ T5736] usb 2-1: config 166 has an invalid interface number: 177 but max is 1 [ 256.841532][ T5736] usb 2-1: config 166 has an invalid interface number: 34 but max is 1 [ 256.842783][ T4178] usb 1-1: new full-speed USB device number 23 using dummy_hcd [ 256.859067][ T6590] EXT4-fs error (device loop2): ext4_ext_check_inode:501: inode #13: comm syz.2.632: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 0(0) [ 256.905493][ T6590] EXT4-fs error (device loop2): ext4_orphan_get:1411: comm syz.2.632: couldn't read orphan inode 13 (err -117) [ 256.908827][ T5736] usb 2-1: config 166 has an invalid descriptor of length 0, skipping remainder of the config [ 256.930661][ T5736] usb 2-1: config 166 has no interface number 0 [ 256.941359][ T5736] usb 2-1: config 166 has no interface number 1 [ 256.951557][ T5736] usb 2-1: config 166 interface 177 altsetting 4 has an invalid endpoint with address 0x0, skipping [ 256.951962][ T6590] EXT4-fs (loop2): mounted filesystem without journal. Opts: sysvgroups,noblock_validity,min_batch_time=0x0000000000000514,debug,stripe=0x0000000000000007,journal_ioprio=0x0000000000000001,jqfmt=vfsv1,,errors=continue. Quota mode: writeback. [ 256.966127][ T5736] usb 2-1: config 166 interface 177 altsetting 4 has an invalid endpoint with address 0x0, skipping [ 257.032801][ T5736] usb 2-1: config 166 interface 34 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 257.046367][ T5736] usb 2-1: config 166 interface 34 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 257.052894][ T4178] usb 1-1: device descriptor read/64, error -71 [ 257.060116][ T5736] usb 2-1: config 166 interface 177 has no altsetting 0 [ 257.092787][ T5736] usb 2-1: config 166 interface 34 has no altsetting 0 [ 257.397828][ T6605] netlink: 'syz.4.633': attribute type 39 has an invalid length. [ 257.402938][ T4178] usb usb1-port1: attempt power cycle [ 257.423063][ T5736] usb 2-1: New USB device found, idVendor=0bda, idProduct=0138, bcdDevice=30.12 [ 257.482778][ T5736] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 257.494504][ T5736] usb 2-1: Product: syz [ 257.498719][ T5736] usb 2-1: Manufacturer: syz [ 257.543168][ T5736] usb 2-1: SerialNumber: syz [ 257.832790][ T4178] usb 1-1: new full-speed USB device number 24 using dummy_hcd [ 257.913628][ T5736] ums-realtek 2-1:166.177: USB Mass Storage device detected [ 257.923176][ T4178] usb 1-1: device descriptor read/8, error -71 [ 258.193204][ T4178] usb 1-1: new full-speed USB device number 25 using dummy_hcd [ 258.324429][ T4178] usb 1-1: device descriptor read/8, error -71 [ 258.543575][ T4178] usb usb1-port1: unable to enumerate USB device [ 258.842406][ T6620] loop2: detected capacity change from 0 to 4096 [ 258.864615][ T6622] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 258.895393][ T6622] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 258.920056][ T6622] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 258.930742][ T5736] ums-realtek 2-1:166.34: USB Mass Storage device detected [ 258.938864][ T6620] NILFS (loop2): invalid segment: Checksum error in segment payload [ 258.957659][ T6620] NILFS (loop2): trying rollback from an earlier position [ 259.063163][ T5736] usb 2-1: Found UVC 0.00 device syz (0bda:0138) [ 259.070854][ T5736] usb 2-1: No valid video chain found. [ 259.091330][ T6620] NILFS (loop2): recovery complete [ 259.110591][ T5736] usb 2-1: USB disconnect, device number 36 [ 259.162662][ T6633] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 259.308571][ T26] audit: type=1800 audit(1779062651.306:5): pid=6620 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.637" name="file1" dev="loop2" ino=12 res=0 errno=0 [ 259.589523][ T6637] device syzkaller0 entered promiscuous mode [ 259.848774][ T6642] tipc: Enabled bearer , priority 0 [ 259.889940][ T6642] device syzkaller0 entered promiscuous mode [ 259.947718][ T6642] tipc: Resetting bearer [ 259.992479][ T6641] tipc: Resetting bearer [ 260.019301][ T6641] tipc: Disabling bearer [ 260.048994][ T6644] device syzkaller0 entered promiscuous mode [ 260.788542][ T6662] netlink: 'syz.0.645': attribute type 39 has an invalid length. [ 260.972898][ T23] usb 2-1: new full-speed USB device number 37 using dummy_hcd [ 261.172869][ T23] usb 2-1: device descriptor read/64, error -71 [ 261.473045][ T23] usb 2-1: new full-speed USB device number 38 using dummy_hcd [ 261.702834][ T23] usb 2-1: device descriptor read/64, error -71 [ 261.772828][ T5735] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 261.802791][ T4197] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 261.823196][ T23] usb usb2-port1: attempt power cycle [ 261.882772][ T6667] netlink: 20 bytes leftover after parsing attributes in process `syz.2.650'. [ 261.913811][ T6667] netlink: 20 bytes leftover after parsing attributes in process `syz.2.650'. [ 262.032852][ T5735] usb 5-1: Using ep0 maxpacket: 16 [ 262.042977][ T4197] usb 1-1: Using ep0 maxpacket: 8 [ 262.162855][ T4197] usb 1-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 262.180746][ T4197] usb 1-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 262.202312][ T4197] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 262.202965][ T5735] usb 5-1: config 166 has an invalid interface number: 177 but max is 1 [ 262.212257][ T4197] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 262.231176][ T5735] usb 5-1: config 166 has an invalid interface number: 34 but max is 1 [ 262.246654][ T23] usb 2-1: new full-speed USB device number 39 using dummy_hcd [ 262.248591][ T5735] usb 5-1: config 166 has an invalid descriptor of length 0, skipping remainder of the config [ 262.281585][ T5735] usb 5-1: config 166 has no interface number 0 [ 262.293903][ T5735] usb 5-1: config 166 has no interface number 1 [ 262.306779][ T4197] usbtmc 1-1:16.0: bulk endpoints not found [ 262.306859][ T5735] usb 5-1: config 166 interface 177 altsetting 4 has an invalid endpoint with address 0x0, skipping [ 262.337983][ T5735] usb 5-1: config 166 interface 177 altsetting 4 has an invalid endpoint with address 0x0, skipping [ 262.353064][ T23] usb 2-1: device descriptor read/8, error -71 [ 262.366594][ T5735] usb 5-1: config 166 interface 34 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 262.391588][ T5735] usb 5-1: config 166 interface 34 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 262.431342][ T5735] usb 5-1: config 166 interface 177 has no altsetting 0 [ 262.446168][ T5735] usb 5-1: config 166 interface 34 has no altsetting 0 [ 262.632834][ T23] usb 2-1: new full-speed USB device number 40 using dummy_hcd [ 262.683212][ T5735] usb 5-1: New USB device found, idVendor=0bda, idProduct=0138, bcdDevice=30.12 [ 262.693453][ T6678] device syzkaller0 entered promiscuous mode [ 262.694040][ T5735] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 262.710306][ T5735] usb 5-1: Product: syz [ 262.715006][ T5735] usb 5-1: Manufacturer: syz [ 262.719773][ T5735] usb 5-1: SerialNumber: syz [ 262.733039][ T23] usb 2-1: device descriptor read/8, error -71 [ 262.803584][ T6682] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 262.813843][ T6682] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 262.821437][ T6682] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 262.854814][ T23] usb usb2-port1: unable to enumerate USB device [ 263.007383][ T5735] ums-realtek 5-1:166.177: USB Mass Storage device detected [ 263.113745][ T5735] ums-realtek 5-1:166.34: USB Mass Storage device detected [ 263.293243][ T5735] usb 5-1: Found UVC 0.00 device syz (0bda:0138) [ 263.299983][ T5735] usb 5-1: No valid video chain found. [ 265.076316][ T5735] usb 5-1: USB disconnect, device number 32 [ 265.476167][ T4197] usb 1-1: USB disconnect, device number 26 [ 265.898127][ T6710] netlink: 'syz.4.661': attribute type 39 has an invalid length. [ 266.798517][ T6731] loop0: detected capacity change from 0 to 128 [ 267.928414][ T6737] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 267.965250][ T6737] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 268.055225][ T6737] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 268.303309][ T4534] usb 1-1: new full-speed USB device number 27 using dummy_hcd [ 269.783246][ T4534] usb 1-1: device descriptor read/64, error -71 [ 270.102798][ T4534] usb 1-1: new full-speed USB device number 28 using dummy_hcd [ 270.142918][ T4234] usb 4-1: new full-speed USB device number 32 using dummy_hcd [ 270.302932][ T4534] usb 1-1: device descriptor read/64, error -71 [ 270.423078][ T4534] usb usb1-port1: attempt power cycle [ 270.500133][ T6770] netlink: 'syz.2.676': attribute type 39 has an invalid length. [ 270.549750][ T4234] usb 4-1: config 0 has an invalid interface number: 41 but max is 0 [ 270.565953][ T4234] usb 4-1: config 0 has no interface number 0 [ 270.574724][ T4234] usb 4-1: config 0 interface 41 has no altsetting 0 [ 270.644547][ T6775] loop2: detected capacity change from 0 to 256 [ 270.763217][ T4234] usb 4-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 270.783251][ T4234] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 270.809349][ T4234] usb 4-1: Product: syz [ 270.823816][ T4234] usb 4-1: Manufacturer: syz [ 270.841599][ T4234] usb 4-1: SerialNumber: syz [ 270.891287][ T4234] usb 4-1: config 0 descriptor?? [ 271.145350][ T4234] CoreChips: probe of 4-1:0.41 failed with error -71 [ 271.379684][ T4234] usb 4-1: USB disconnect, device number 32 [ 271.650744][ T6779] loop0: detected capacity change from 0 to 256 [ 271.670739][ T4534] usb 1-1: new full-speed USB device number 29 using dummy_hcd [ 271.927042][ T4534] usb 1-1: device not accepting address 29, error -71 [ 271.943161][ T4234] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 272.047465][ T6791] FAT-fs (loop0): error, fat_free_clusters: deleting FAT entry beyond EOF [ 272.212914][ T4234] usb 5-1: Using ep0 maxpacket: 16 [ 272.942564][ T4234] usb 5-1: config 166 has an invalid interface number: 177 but max is 1 [ 274.146681][ T4234] usb 5-1: config 166 has an invalid interface number: 34 but max is 1 [ 274.155422][ T4234] usb 5-1: config 166 has an invalid descriptor of length 0, skipping remainder of the config [ 274.169573][ T4234] usb 5-1: config 166 has no interface number 0 [ 274.177628][ T4234] usb 5-1: config 166 has no interface number 1 [ 274.184185][ T4234] usb 5-1: config 166 interface 177 altsetting 4 has an invalid endpoint with address 0x0, skipping [ 274.202819][ T4234] usb 5-1: config 166 interface 177 altsetting 4 has an invalid endpoint with address 0x0, skipping [ 274.208084][ T6802] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 274.214396][ T4234] usb 5-1: config 166 interface 34 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 274.232628][ T4234] usb 5-1: config 166 interface 34 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 274.246934][ T4234] usb 5-1: config 166 interface 177 has no altsetting 0 [ 274.254359][ T4234] usb 5-1: config 166 interface 34 has no altsetting 0 [ 274.263744][ T6802] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 274.293184][ T6802] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 274.422962][ T4234] usb 5-1: New USB device found, idVendor=0bda, idProduct=0138, bcdDevice=30.12 [ 274.449685][ T4234] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 274.481471][ T4234] usb 5-1: Product: syz [ 274.500943][ T4234] usb 5-1: Manufacturer: syz [ 274.517036][ T4234] usb 5-1: SerialNumber: syz [ 274.519692][ T6805] netlink: 'syz.2.690': attribute type 39 has an invalid length. [ 274.653735][ T4234] ums-realtek 5-1:166.177: USB Mass Storage device detected [ 274.733677][ T5734] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 274.853767][ T4234] ums-realtek 5-1:166.34: USB Mass Storage device detected [ 274.983048][ T5734] usb 4-1: Using ep0 maxpacket: 8 [ 275.123699][ T5734] usb 4-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 275.627597][ T5734] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 275.652830][ T5734] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 275.666088][ T5734] usb 4-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 275.679962][ T5734] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 275.702911][ T4234] usb 5-1: Found UVC 0.00 device syz (0bda:0138) [ 275.709316][ T4234] usb 5-1: No valid video chain found. [ 275.722777][ T5734] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 275.769939][ T4234] usb 5-1: USB disconnect, device number 33 [ 275.834028][ T5734] usbtmc 4-1:16.0: bulk endpoints not found [ 275.852872][ T4178] usb 3-1: new full-speed USB device number 18 using dummy_hcd [ 276.132884][ T4178] usb 3-1: device descriptor read/64, error -71 [ 276.313070][ T4234] usb 5-1: new full-speed USB device number 34 using dummy_hcd [ 276.753175][ T4234] usb 5-1: config 0 has an invalid interface number: 41 but max is 0 [ 276.862286][ T4234] usb 5-1: config 0 has no interface number 0 [ 276.897271][ T4234] usb 5-1: config 0 interface 41 has no altsetting 0 [ 276.911486][ T6837] loop0: detected capacity change from 0 to 16 [ 276.957467][ T6837] erofs: (device loop0): mounted with root inode @ nid 36. [ 277.083019][ T4234] usb 5-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 277.096761][ T4234] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 277.109823][ T4234] usb 5-1: Product: syz [ 277.126534][ T4234] usb 5-1: Manufacturer: syz [ 277.131288][ T4234] usb 5-1: SerialNumber: syz [ 277.160233][ T4234] usb 5-1: config 0 descriptor?? [ 277.321360][ T4178] usb 3-1: new full-speed USB device number 19 using dummy_hcd [ 277.766291][ T4234] CoreChips: probe of 5-1:0.41 failed with error -71 [ 278.032902][ T4234] usb 5-1: USB disconnect, device number 34 [ 278.059430][ T4197] usb 4-1: USB disconnect, device number 33 [ 278.149764][ T6849] comedi comedi3: 8255: I/O port conflict (0xffffffff80002002,4) [ 278.162593][ T6849] comedi comedi3: 8255: I/O port conflict (0x10003,4) [ 278.165057][ T4178] usb 3-1: device descriptor read/64, error -71 [ 278.176590][ T6849] comedi comedi3: 8255: I/O port conflict (0x8,4) [ 278.203156][ T6851] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 278.213027][ T6851] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 278.220739][ T6851] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 278.293331][ T4178] usb usb3-port1: attempt power cycle [ 279.088865][ T4178] usb usb3-port1: Cannot enable. Maybe the USB cable is bad? [ 280.912845][ T4178] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 281.073042][ T4178] usb 3-1: Using ep0 maxpacket: 32 [ 281.138786][ T6876] loop0: detected capacity change from 0 to 32768 [ 281.352964][ T4178] usb 3-1: config 2 has an invalid interface number: 88 but max is 0 [ 281.422810][ T6881] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 281.779743][ T4178] usb 3-1: config 2 has no interface number 0 [ 281.883981][ T4178] usb 3-1: config 2 interface 88 altsetting 7 bulk endpoint 0x6 has invalid maxpacket 256 [ 281.899669][ T4178] usb 3-1: config 2 interface 88 has no altsetting 0 [ 282.023876][ T1402] read_mapping_page failed! [ 282.028769][ T1402] ERROR: (device loop0): txCommit: [ 282.028769][ T1402] [ 282.042390][ T4178] usb 3-1: string descriptor 0 read error: -71 [ 282.243255][ T4178] usb 3-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.1e [ 282.253210][ T1402] jfs_write_inode: jfs_commit_inode failed! [ 282.254857][ T6886] netlink: 76 bytes leftover after parsing attributes in process `syz.2.718'. [ 283.005842][ T4178] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 283.042875][ T4178] usb 3-1: can't set config #2, error -71 [ 283.059294][ T4178] usb 3-1: USB disconnect, device number 21 [ 283.106779][ T6899] tipc: Enabled bearer , priority 0 [ 283.109485][ T6898] tipc: Failed to remove unknown binding: 66,0,0/0:992166126/992166127 [ 283.162517][ T6899] device syzkaller0 entered promiscuous mode [ 283.184030][ T6902] tipc: Failed to remove unknown binding: 66,0,0/0:992166126/992166127 [ 283.223421][ T6899] tipc: Resetting bearer [ 283.251212][ T6896] tipc: Resetting bearer [ 283.323228][ T6896] tipc: Disabling bearer [ 284.421546][ T6893] loop0: detected capacity change from 0 to 32768 [ 284.535843][ T6893] (syz.0.717,6893,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 284.659110][ T6893] (syz.0.717,6893,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 285.280297][ T6893] JBD2: Ignoring recovery information on journal [ 285.356891][ T6893] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 285.672810][ T5735] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 286.535474][ T5735] usb 5-1: Using ep0 maxpacket: 8 [ 286.853123][ T5735] usb 5-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 286.973111][ T4190] ocfs2: Unmounting device (7,0) on (node local) [ 286.979923][ T5735] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 287.016962][ T5735] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 287.027569][ T5735] usb 5-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 287.056038][ T5735] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 287.099321][ T5735] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 287.203966][ T5735] usbtmc 5-1:16.0: bulk endpoints not found [ 289.167522][ T6945] tipc: Failed to remove unknown binding: 66,0,0/0:1931024658/1931024659 [ 289.294660][ T6945] tipc: Failed to remove unknown binding: 66,0,0/0:1931024658/1931024659 [ 289.305248][ T6950] netlink: 76 bytes leftover after parsing attributes in process `syz.3.730'. [ 289.416257][ T6956] loop3: detected capacity change from 0 to 128 [ 289.558818][ T4234] usb 5-1: USB disconnect, device number 35 [ 290.533129][ T6956] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 290.566311][ T6956] ext4 filesystem being mounted at /131/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 290.610377][ T26] audit: type=1800 audit(1779062682.606:6): pid=6956 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.737" name="file1" dev="loop3" ino=12 res=0 errno=0 [ 291.392160][ T4234] usb 5-1: new full-speed USB device number 36 using dummy_hcd [ 291.489412][ T6974] loop0: detected capacity change from 0 to 32768 [ 291.689832][ T6974] JBD2: Ignoring recovery information on journal [ 291.802863][ T4234] usb 5-1: config 0 has an invalid interface number: 41 but max is 0 [ 291.811190][ T4234] usb 5-1: config 0 has no interface number 0 [ 292.032100][ T6974] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 292.082039][ T4234] usb 5-1: config 0 interface 41 has no altsetting 0 [ 292.121504][ T26] audit: type=1800 audit(1779062684.116:7): pid=6974 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.741" name="file1" dev="loop0" ino=17058 res=0 errno=0 [ 292.222032][ T6992] tipc: Failed to remove unknown binding: 66,0,0/0:1018567576/1018567577 [ 292.232025][ T6992] tipc: Failed to remove unknown binding: 66,0,0/0:1018567576/1018567577 [ 292.345050][ T6974] syz.0.741 (6974) used greatest stack depth: 18168 bytes left [ 292.379950][ T4234] usb 5-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 292.409250][ T4234] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 292.442870][ T4234] usb 5-1: Product: syz [ 292.457965][ T4190] ocfs2: Unmounting device (7,0) on (node local) [ 292.482865][ T4234] usb 5-1: Manufacturer: syz [ 292.656334][ T4234] usb 5-1: SerialNumber: syz [ 293.454058][ T4234] usb 5-1: config 0 descriptor?? [ 293.482880][ T4234] usb 5-1: can't set config #0, error -71 [ 293.522780][ T4234] usb 5-1: USB disconnect, device number 36 [ 293.556825][ T7008] netlink: 'syz.0.747': attribute type 1 has an invalid length. [ 293.585904][ T7008] 8021q: adding VLAN 0 to HW filter on device bond1 [ 293.745707][ T7008] device macvlan2 entered promiscuous mode [ 293.777297][ T7008] device bond1 entered promiscuous mode [ 293.804713][ T7008] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 293.865576][ T7008] team0: Port device macvlan2 added [ 294.012304][ T7011] bond1: (slave ip6gretap1): making interface the new active one [ 294.035900][ T7011] device ip6gretap1 entered promiscuous mode [ 294.096171][ T7011] bond1: (slave ip6gretap1): Enslaving as an active interface with an up link [ 294.151073][ T1402] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 294.214655][ T1402] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan2: link becomes ready [ 294.936566][ T7023] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 295.497893][ T7020] loop0: detected capacity change from 0 to 32768 [ 295.637651][ T7020] jfs_strtoUCS: char2uni returned -22. [ 295.665240][ T7020] charset = cp949, char = 0xd4 [ 295.911587][ T7030] loop4: detected capacity change from 0 to 32768 [ 296.598524][ T7030] XFS (loop4): Mounting V5 Filesystem [ 296.926763][ T7041] loop3: detected capacity change from 0 to 32768 [ 296.939894][ T7030] XFS (loop4): Ending clean mount [ 296.968736][ T7030] XFS (loop4): Quotacheck needed: Please wait. [ 297.514000][ T7064] binder: 7059:7064 ioctl c0306201 0 returned -14 [ 298.317283][ T7041] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop3 scanned by syz.3.761 (7041) [ 298.389429][ T7030] XFS (loop4): Quotacheck: Done. [ 298.396419][ T7041] BTRFS info (device loop3): using sha256 (sha256-avx2) checksum algorithm [ 298.426077][ T7041] BTRFS info (device loop3): using free space tree [ 298.461336][ T7041] BTRFS info (device loop3): has skinny extents [ 298.857251][ T7041] BTRFS error (device loop3): open_ctree failed: -12 [ 298.857924][ T5673] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop3 scanned by udevd (5673) [ 298.866334][ T4189] XFS (loop4): Unmounting Filesystem [ 300.408735][ T7101] tipc: Enabling of bearer rejected, failed to enable media [ 300.789241][ T7118] loop3: detected capacity change from 0 to 512 [ 300.878045][ T7118] EXT4-fs (loop3): Invalid want_extra_isize 101 [ 302.494013][ T7140] loop0: detected capacity change from 0 to 4096 [ 304.619272][ T7175] tipc: Enabling of bearer rejected, failed to enable media [ 305.327923][ T7182] loop0: detected capacity change from 0 to 256 [ 305.342309][ T7183] loop2: detected capacity change from 0 to 16 [ 305.390831][ T7183] erofs: (device loop2): erofs_read_superblock: blkszbits 9 isn't supported on this platform [ 305.683224][ T7195] FAT-fs (loop0): error, fat_free_clusters: deleting FAT entry beyond EOF [ 306.120915][ T7202] device syzkaller0 entered promiscuous mode [ 307.616647][ T4338] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 307.890138][ T7227] netlink: 64 bytes leftover after parsing attributes in process `syz.1.804'. [ 308.162831][ T4338] usb 1-1: unable to get BOS descriptor or descriptor too short [ 309.012997][ T4338] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 37, changing to 7 [ 309.024446][ T4338] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 116, changing to 7 [ 309.039487][ T7237] tipc: Enabling of bearer rejected, failed to enable media [ 310.203027][ T4338] usb 1-1: string descriptor 0 read error: -22 [ 310.209402][ T4338] usb 1-1: New USB device found, idVendor=1235, idProduct=8012, bcdDevice= 0.40 [ 310.219023][ T4338] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 310.763260][ T4338] usb 1-1: can't set config #1, error -71 [ 310.812813][ T4178] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 310.823465][ T4338] usb 1-1: USB disconnect, device number 31 [ 311.606740][ T7276] loop2: detected capacity change from 0 to 128 [ 311.641813][ T7275] loop3: detected capacity change from 0 to 512 [ 311.661042][ T7276] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 311.697330][ T7276] hpfs: filesystem error: improperly stopped [ 311.702845][ T4178] usb 5-1: config 0 has an invalid interface number: 69 but max is 0 [ 311.709356][ T7276] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 311.722484][ T7276] hpfs: You really don't want any checks? You are crazy... [ 311.723853][ T4178] usb 5-1: config 0 has no interface number 0 [ 311.736969][ T7276] hpfs: hpfs_map_sector(): read error [ 311.742559][ T7276] hpfs: code page support is disabled [ 311.745016][ T4178] usb 5-1: config 0 interface 69 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1023 [ 311.751881][ T7276] hpfs: hpfs_map_4sectors(): unaligned read [ 311.764809][ T4178] usb 5-1: config 0 interface 69 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 311.771814][ T7280] netlink: 76 bytes leftover after parsing attributes in process `syz.0.818'. [ 311.780494][ T7276] hpfs: hpfs_map_4sectors(): unaligned read [ 311.796335][ T7276] hpfs: filesystem error: unable to find root dir [ 312.051482][ T7275] EXT4-fs (loop3): 1 truncate cleaned up [ 312.139798][ T7275] EXT4-fs (loop3): mounted filesystem without journal. Opts: noload,stripe=0x000000000000030c,jqfmt=vfsv1,nojournal_checksum,jqfmt=vfsv1,usrjquota=,,errors=continue. Quota mode: none. [ 312.662129][ T7286] tipc: Enabling of bearer rejected, failed to enable media [ 312.747822][ T7276] hpfs: hpfs_map_4sectors(): unaligned read [ 312.804728][ T26] audit: type=1800 audit(1779062704.757:8): pid=7275 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.816" name="file1" dev="loop3" ino=15 res=0 errno=0 [ 312.837572][ T7276] hpfs: filesystem error: invalid bitmap block pointer 00000000 -> 7b3184b5 at aib [ 313.763715][ T4178] usb 5-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 313.945431][ T4178] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 313.953761][ T4178] usb 5-1: Product: syz [ 313.959859][ T4178] usb 5-1: config 0 descriptor?? [ 313.982931][ T4178] usb 5-1: can't set config #0, error -71 [ 313.991610][ T4178] usb 5-1: USB disconnect, device number 37 [ 314.403106][ T4178] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 317.654394][ T1430] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.660915][ T1430] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.700979][ T7320] kernel read not supported for file /eth0 (pid: 7320 comm: syz.2.828) [ 317.755611][ T26] audit: type=1800 audit(1779062709.757:9): pid=7320 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.828" name="eth0" dev="mqueue" ino=47294 res=0 errno=0 [ 317.813241][ T4178] usb 5-1: device descriptor read/all, error -71 [ 318.457815][ T7333] tipc: Enabling of bearer rejected, failed to enable media [ 319.938958][ T4178] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 321.768019][ T4178] usb 5-1: config 0 has an invalid interface number: 69 but max is 0 [ 321.789244][ T4178] usb 5-1: config 0 has no interface number 0 [ 321.802893][ T4178] usb 5-1: config 0 interface 69 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1023 [ 321.820939][ T4178] usb 5-1: config 0 interface 69 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 322.012910][ T7367] syz.3.840 (7367): drop_caches: 2 [ 322.051766][ T7382] netlink: 76 bytes leftover after parsing attributes in process `syz.0.844'. [ 322.419602][ T7397] tipc: Enabling of bearer rejected, failed to enable media [ 324.212822][ T4178] usb 5-1: string descriptor 0 read error: -71 [ 324.219493][ T4178] usb 5-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 326.810467][ T4178] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 326.826213][ T4178] usb 5-1: config 0 descriptor?? [ 326.842847][ T4178] usb 5-1: can't set config #0, error -71 [ 326.855965][ T4178] usb 5-1: USB disconnect, device number 40 [ 327.191314][ T7421] netlink: 76 bytes leftover after parsing attributes in process `syz.0.858'. [ 327.322918][ T4178] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 327.732890][ T4178] usb 4-1: Using ep0 maxpacket: 32 [ 328.140718][ T7441] tipc: Enabling of bearer rejected, failed to enable media [ 328.423229][ T4178] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 328.434598][ T4178] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 328.643244][ T4178] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 328.652490][ T4178] usb 4-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 328.667001][ T4178] usb 4-1: Product: syz [ 328.671294][ T4178] usb 4-1: Manufacturer: syz [ 328.713888][ T4178] hub 4-1:4.0: USB hub found [ 328.952947][ T4178] hub 4-1:4.0: 2 ports detected [ 329.784762][ T7465] netlink: 76 bytes leftover after parsing attributes in process `syz.0.870'. [ 329.873891][ T7471] device syzkaller0 entered promiscuous mode [ 331.050610][ T7487] tipc: Enabled bearer , priority 0 [ 331.058427][ T7487] device syzkaller0 entered promiscuous mode [ 331.079561][ T7487] tipc: Resetting bearer [ 331.085483][ T7487] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 331.093637][ T7487] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 331.115456][ T7486] tipc: Resetting bearer [ 331.130281][ T7486] tipc: Disabling bearer [ 331.165096][ T4338] hub 4-1:4.0: activate --> -90 [ 331.392462][ T4178] usb 4-1: USB disconnect, device number 34 [ 331.398782][ T4338] hub 4-1:4.0: hub_ext_port_status failed (err = -71) [ 331.502786][ T5735] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 331.691445][ T7510] netlink: 76 bytes leftover after parsing attributes in process `syz.1.883'. [ 331.804614][ T5735] usb 1-1: Using ep0 maxpacket: 32 [ 331.962416][ T5730] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 333.742869][ T5735] usb 1-1: unable to get BOS descriptor or descriptor too short [ 333.762945][ T7527] tipc: Failed to remove unknown binding: 66,0,0/0:1143097635/1143097637 [ 333.789849][ T7526] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(8) [ 333.796970][ T7526] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 333.806044][ T7526] vhci_hcd vhci_hcd.0: Device attached [ 333.829491][ T7527] tipc: Failed to remove unknown binding: 66,0,0/0:1143097635/1143097636 [ 333.852373][ T7528] tipc: Started in network mode [ 333.876771][ T7528] tipc: Node identity f27acee09103, cluster identity 4711 [ 333.905189][ T7527] tipc: Failed to remove unknown binding: 66,0,0/0:1143097635/1143097637 [ 333.920557][ T7528] tipc: Enabled bearer , priority 0 [ 333.949720][ T7527] tipc: Failed to remove unknown binding: 66,0,0/0:1143097635/1143097636 [ 333.965865][ T7531] device syzkaller0 entered promiscuous mode [ 334.052786][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 334.060960][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 334.097465][ T7528] tipc: Resetting bearer [ 334.192778][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 334.201125][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 334.222555][ T7528] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 334.352840][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 334.361200][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 334.404735][ T7529] vhci_hcd: connection closed [ 334.409632][ T4825] vhci_hcd: stop threads [ 334.468431][ T4825] vhci_hcd: release socket [ 334.492850][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 334.557472][ T4825] vhci_hcd: disconnect device [ 334.603183][ T7524] tipc: Resetting bearer [ 334.744967][ T7524] tipc: Disabling bearer [ 335.793506][ T5735] usb 1-1: unable to read config index 0 descriptor/all [ 335.800540][ T5735] usb 1-1: can't read configurations, error -71 [ 336.072985][ T5730] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 336.087333][ T5730] usb 5-1: can't read configurations, error -71 [ 336.183197][ T7560] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[4192] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[7560] [ 336.188035][ T7554] netlink: 76 bytes leftover after parsing attributes in process `syz.1.895'. [ 336.981805][ T7578] tipc: Failed to remove unknown binding: 66,0,0/0:2364618078/2364618080 [ 337.008088][ T7578] tipc: Failed to remove unknown binding: 66,0,0/0:2364618078/2364618079 [ 337.046670][ T7583] tipc: Failed to remove unknown binding: 66,0,0/0:2364618078/2364618080 [ 337.051931][ T7581] tipc: Enabled bearer , priority 0 [ 337.055420][ T7583] tipc: Failed to remove unknown binding: 66,0,0/0:2364618078/2364618079 [ 337.078935][ T7581] device syzkaller0 entered promiscuous mode [ 337.182816][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 337.191151][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 337.202573][ T7581] tipc: Resetting bearer [ 337.278405][ T7581] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 337.286740][ T7581] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 337.412980][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 337.536089][ T7579] tipc: Resetting bearer [ 337.667225][ T7579] tipc: Disabling bearer [ 337.898384][ T7590] loop3: detected capacity change from 0 to 512 [ 337.942885][ T4234] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 337.960400][ T7590] EXT4-fs (loop3): mounting ext3 file system using the ext4 subsystem [ 338.139869][ T7590] EXT4-fs (loop3): Cannot turn on journaled quota: type 0: error -2 [ 338.157323][ T7590] EXT4-fs error (device loop3): ext4_orphan_get:1432: comm syz.3.904: bad orphan inode 4 [ 338.168466][ T7590] EXT4-fs (loop3): 1 orphan inode deleted [ 338.174600][ T7590] EXT4-fs (loop3): mounted filesystem without journal. Opts: jqfmt=vfsold,data_err=ignore,acl,noload,data_err=ignore,usrjquota="init_itable=0x0000000000000002,init_itable=0x00000000000000fd,max_dir_size_kb=0x0000000000000007,,errors=continue. Quota mode: writeback. [ 338.209853][ T7590] device syzkaller0 entered promiscuous mode [ 338.367851][ T7600] loop0: detected capacity change from 0 to 2048 [ 338.414050][ T7600] loop0: p1 < > p3 p4 [ 338.414050][ T7600] p4: [ 338.434264][ T4234] usb 3-1: Using ep0 maxpacket: 16 [ 338.498288][ T7600] loop0: p3 start 458752 is beyond EOD, truncated [ 338.505178][ T7600] loop0: p4 size 722688 extends beyond EOD, truncated [ 338.521052][ T7600] loop0: p5 start 262464109 is beyond EOD, truncated [ 338.528337][ T7600] loop0: p6 size 2304 extends beyond EOD, truncated [ 338.665557][ T4202] ================================================================== [ 338.674113][ T4202] BUG: KASAN: slab-out-of-bounds in hci_le_meta_evt+0x133f/0x3c90 [ 338.682109][ T4202] Read of size 1 at addr ffff8880789a2407 by task kworker/u5:4/4202 [ 338.690204][ T4202] [ 338.692550][ T4202] CPU: 0 PID: 4202 Comm: kworker/u5:4 Not tainted syzkaller #0 [ 338.701800][ T4202] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 338.712077][ T4202] Workqueue: hci3 hci_rx_work [ 338.717227][ T4202] Call Trace: [ 338.720678][ T4202] [ 338.723832][ T4202] dump_stack_lvl+0x188/0x250 [ 338.728881][ T4202] ? show_regs_print_info+0x20/0x20 [ 338.734151][ T4202] ? load_image+0x400/0x400 [ 338.738693][ T4202] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 338.744610][ T4202] print_address_description+0x60/0x2d0 [ 338.750298][ T4202] ? hci_le_meta_evt+0x133f/0x3c90 [ 338.755654][ T4202] kasan_report+0xdf/0x130 [ 338.760111][ T4202] ? hci_le_meta_evt+0x133f/0x3c90 [ 338.765350][ T4202] hci_le_meta_evt+0x133f/0x3c90 [ 338.770429][ T4202] ? mark_lock+0x94/0x320 [ 338.774927][ T4202] ? release_firmware_map_entry+0x190/0x190 [ 338.780958][ T4202] ? hci_remote_host_features_evt+0x280/0x280 [ 338.787429][ T4202] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 338.793123][ T4202] ? mutex_unlock+0x10/0x10 [ 338.797676][ T4202] ? preempt_schedule+0xbc/0xd0 [ 338.802730][ T4202] ? schedule_preempt_disabled+0x20/0x20 [ 338.808599][ T4202] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 338.814702][ T4202] hci_event_packet+0xe48/0x1370 [ 338.819940][ T4202] ? rcu_lock_release+0x20/0x20 [ 338.824835][ T4202] ? hci_send_to_monitor+0x9c/0x4a0 [ 338.830083][ T4202] hci_rx_work+0x255/0xa10 [ 338.834557][ T4202] process_one_work+0x85f/0x1010 [ 338.839660][ T4202] ? worker_detach_from_pool+0x240/0x240 [ 338.845334][ T4202] ? lockdep_hardirqs_off+0x70/0x100 [ 338.850679][ T4202] ? _raw_spin_lock_irq+0xb7/0xf0 [ 338.855858][ T4202] ? _raw_spin_lock_irqsave+0x100/0x100 [ 338.861546][ T4202] ? wq_worker_running+0x97/0x170 [ 338.866803][ T4202] worker_thread+0xaa6/0x1290 [ 338.871586][ T4202] kthread+0x436/0x520 [ 338.875783][ T4202] ? rcu_lock_release+0x20/0x20 [ 338.880836][ T4202] ? kthread_blkcg+0xd0/0xd0 [ 338.885473][ T4202] ret_from_fork+0x1f/0x30 [ 338.890050][ T4202] [ 338.893182][ T4202] [ 338.895521][ T4202] Allocated by task 7566: [ 338.899867][ T4202] __kasan_kmalloc+0xb5/0xf0 [ 338.904667][ T4202] __alloc_skb+0x22c/0x750 [ 338.909232][ T4202] vhci_write+0xbc/0x450 [ 338.913505][ T4202] vfs_write+0x745/0xd60 [ 338.918082][ T4202] ksys_write+0x152/0x260 [ 338.922435][ T4202] do_syscall_64+0x4c/0xa0 [ 338.926983][ T4202] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 338.933012][ T4202] [ 338.935371][ T4202] Last potentially related work creation: [ 338.941361][ T4202] kasan_save_stack+0x35/0x60 [ 338.946156][ T4202] kasan_record_aux_stack+0xb8/0x100 [ 338.951564][ T4202] kvfree_call_rcu+0x105/0x7d0 [ 338.956454][ T4202] drop_sysctl_table+0x359/0x4e0 [ 338.961938][ T4202] unregister_sysctl_table+0x87/0x130 [ 338.967354][ T4202] neigh_sysctl_unregister+0x74/0x90 [ 338.972782][ T4202] addrconf_ifdown+0x16cb/0x19c0 [ 338.977769][ T4202] addrconf_notify+0x445/0xf00 [ 338.982571][ T4202] raw_notifier_call_chain+0xcb/0x160 [ 338.988354][ T4202] __dev_change_net_namespace+0x76f/0x1650 [ 338.994575][ T4202] do_setlink+0x369/0x3d60 [ 338.999208][ T4202] rtnl_newlink+0x1658/0x1a50 [ 339.003924][ T4202] rtnetlink_rcv_msg+0x844/0xf30 [ 339.008894][ T4202] netlink_rcv_skb+0x1f5/0x440 [ 339.013690][ T4202] netlink_unicast+0x774/0x920 [ 339.018627][ T4202] netlink_sendmsg+0x8ba/0xbe0 [ 339.023421][ T4202] ____sys_sendmsg+0x5b7/0x8f0 [ 339.028315][ T4202] ___sys_sendmsg+0x236/0x2e0 [ 339.033283][ T4202] __se_sys_sendmsg+0x1af/0x290 [ 339.038378][ T4202] do_syscall_64+0x4c/0xa0 [ 339.042837][ T4202] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 339.048753][ T4202] [ 339.051084][ T4202] The buggy address belongs to the object at ffff8880789a2000 [ 339.051084][ T4202] which belongs to the cache kmalloc-1k of size 1024 [ 339.065244][ T4202] The buggy address is located 7 bytes to the right of [ 339.065244][ T4202] 1024-byte region [ffff8880789a2000, ffff8880789a2400) [ 339.080549][ T4202] The buggy address belongs to the page: [ 339.086198][ T4202] page:ffffea0001e26800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x789a0 [ 339.096565][ T4202] head:ffffea0001e26800 order:3 compound_mapcount:0 compound_pincount:0 [ 339.104996][ T4202] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 339.113223][ T4202] raw: 00fff00000010200 ffffea0001e52000 0000000500000003 ffff888016c41dc0 [ 339.122033][ T4202] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 339.130848][ T4202] page dumped because: kasan: bad access detected [ 339.137557][ T4202] page_owner tracks the page as allocated [ 339.143424][ T4202] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4191, ts 58915398033, free_ts 58756189244 [ 339.162767][ T4202] get_page_from_freelist+0x1bbd/0x1ca0 [ 339.168352][ T4202] __alloc_pages+0x1ee/0x480 [ 339.172964][ T4202] new_slab+0xc0/0x4b0 [ 339.177069][ T4202] ___slab_alloc+0x80a/0xdd0 [ 339.181656][ T4202] __kmalloc_node+0x200/0x3b0 [ 339.186364][ T4202] qdisc_alloc+0x8d/0xb10 [ 339.191069][ T4202] qdisc_create_dflt+0x5f/0x430 [ 339.196039][ T4202] dev_activate+0x331/0x12b0 [ 339.200972][ T4202] __dev_open+0x33b/0x430 [ 339.205324][ T4202] dev_open+0xa7/0x180 [ 339.209676][ T4202] team_add_slave+0x692/0x2780 [ 339.214497][ T4202] do_setlink+0xe90/0x3d60 [ 339.219083][ T4202] rtnl_newlink+0x1658/0x1a50 [ 339.224053][ T4202] rtnetlink_rcv_msg+0x844/0xf30 [ 339.229040][ T4202] netlink_rcv_skb+0x1f5/0x440 [ 339.233841][ T4202] netlink_unicast+0x774/0x920 [ 339.238663][ T4202] page last free stack trace: [ 339.243368][ T4202] free_unref_page_prepare+0x637/0x6c0 [ 339.248974][ T4202] free_unref_page+0x8f/0x2a0 [ 339.253757][ T4202] qlist_free_all+0x35/0x90 [ 339.258288][ T4202] kasan_quarantine_reduce+0x150/0x160 [ 339.263755][ T4202] __kasan_slab_alloc+0x2f/0xd0 [ 339.268801][ T4202] slab_post_alloc_hook+0x4c/0x380 [ 339.274080][ T4202] kmem_cache_alloc_node+0x12d/0x2d0 [ 339.279583][ T4202] __alloc_skb+0xf4/0x750 [ 339.283945][ T4202] netlink_sendmsg+0x654/0xbe0 [ 339.288930][ T4202] __sys_sendto+0x46d/0x620 [ 339.293563][ T4202] __x64_sys_sendto+0xda/0xf0 [ 339.298307][ T4202] do_syscall_64+0x4c/0xa0 [ 339.302755][ T4202] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 339.309019][ T4202] [ 339.311441][ T4202] Memory state around the buggy address: [ 339.317430][ T4202] ffff8880789a2300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 339.325703][ T4202] ffff8880789a2380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 339.334037][ T4202] >ffff8880789a2400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 339.339353][ T7610] loop2: detected capacity change from 0 to 512 [ 339.342429][ T4202] ^ [ 339.353341][ T4202] ffff8880789a2480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 339.361441][ T4202] ffff8880789a2500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 339.369973][ T4202] ================================================================== [ 339.378238][ T4202] Disabling lock debugging due to kernel taint [ 339.387330][ T5730] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 339.396284][ T4202] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 339.403525][ T4202] CPU: 0 PID: 4202 Comm: kworker/u5:4 Tainted: G B syzkaller #0 [ 339.413019][ T4202] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 339.423656][ T4202] Workqueue: hci3 hci_rx_work [ 339.428482][ T4202] Call Trace: [ 339.431766][ T4202] [ 339.434723][ T4202] dump_stack_lvl+0x188/0x250 [ 339.439696][ T4202] ? show_regs_print_info+0x20/0x20 [ 339.444936][ T4202] ? load_image+0x400/0x400 [ 339.449620][ T4202] panic+0x2e5/0x810 [ 339.453612][ T4202] ? bpf_jit_dump+0xd0/0xd0 [ 339.458396][ T4202] ? _raw_spin_unlock_irqrestore+0x10d/0x120 [ 339.464382][ T4202] ? _raw_spin_unlock+0x40/0x40 [ 339.469241][ T4202] ? hci_le_meta_evt+0x133f/0x3c90 [ 339.474531][ T4202] check_panic_on_warn+0x80/0xa0 [ 339.479510][ T4202] ? hci_le_meta_evt+0x133f/0x3c90 [ 339.484729][ T4202] end_report+0x6d/0xf0 [ 339.489275][ T4202] kasan_report+0x102/0x130 [ 339.494057][ T4202] ? hci_le_meta_evt+0x133f/0x3c90 [ 339.499200][ T4202] hci_le_meta_evt+0x133f/0x3c90 [ 339.504234][ T4202] ? mark_lock+0x94/0x320 [ 339.508950][ T4202] ? release_firmware_map_entry+0x190/0x190 [ 339.515058][ T4202] ? hci_remote_host_features_evt+0x280/0x280 [ 339.521315][ T4202] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 339.527049][ T4202] ? mutex_unlock+0x10/0x10 [ 339.531736][ T4202] ? preempt_schedule+0xbc/0xd0 [ 339.536689][ T4202] ? schedule_preempt_disabled+0x20/0x20 [ 339.542509][ T4202] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 339.548149][ T4202] hci_event_packet+0xe48/0x1370 [ 339.553190][ T4202] ? rcu_lock_release+0x20/0x20 [ 339.558046][ T4202] ? hci_send_to_monitor+0x9c/0x4a0 [ 339.563256][ T4202] hci_rx_work+0x255/0xa10 [ 339.567775][ T4202] process_one_work+0x85f/0x1010 [ 339.572721][ T4202] ? worker_detach_from_pool+0x240/0x240 [ 339.578380][ T4202] ? lockdep_hardirqs_off+0x70/0x100 [ 339.583759][ T4202] ? _raw_spin_lock_irq+0xb7/0xf0 [ 339.588795][ T4202] ? _raw_spin_lock_irqsave+0x100/0x100 [ 339.594348][ T4202] ? wq_worker_running+0x97/0x170 [ 339.599414][ T4202] worker_thread+0xaa6/0x1290 [ 339.604284][ T4202] kthread+0x436/0x520 [ 339.608450][ T4202] ? rcu_lock_release+0x20/0x20 [ 339.613302][ T4202] ? kthread_blkcg+0xd0/0xd0 [ 339.617912][ T4202] ret_from_fork+0x1f/0x30 [ 339.622340][ T4202] [ 339.625444][ T4202] Kernel Offset: disabled [ 339.629771][ T4202] Rebooting in 86400 seconds..