[ 71.158107][ T1425] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.160246][ T1425] ieee802154 phy1 wpan1: encryption failed: -22 Warning: Permanently added '[localhost]:56043' (ED25519) to the list of known hosts. 2025/06/21 16:56:45 ignoring optional flag "sandboxArg"="0" 2025/06/21 16:56:46 parsed 1 programs [ 79.876975][ T40] audit: type=1400 audit(1750525009.565:120): avc: denied { unlink } for pid=6263 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 81.112827][ T6263] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 81.422627][ T840] cfg80211: failed to load regulatory.db [ 82.801706][ T63] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 82.805402][ T63] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 82.808274][ T63] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 82.811506][ T63] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 82.814027][ T63] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 83.183894][ T40] audit: type=1401 audit(1750525012.865:121): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 83.695741][ T6389] chnl_net:caif_netlink_parms(): no params data found [ 83.910644][ T6389] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.912905][ T6389] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.916282][ T6389] bridge_slave_0: entered allmulticast mode [ 83.922635][ T6389] bridge_slave_0: entered promiscuous mode [ 83.945625][ T6389] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.948205][ T6389] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.951070][ T6389] bridge_slave_1: entered allmulticast mode [ 83.957411][ T6389] bridge_slave_1: entered promiscuous mode [ 84.025635][ T6389] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.034201][ T6389] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.107973][ T6389] team0: Port device team_slave_0 added [ 84.114931][ T6389] team0: Port device team_slave_1 added [ 84.153003][ T6389] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.156110][ T6389] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.166700][ T6389] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.174029][ T6389] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 84.176631][ T6389] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.184673][ T6389] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 84.428214][ T6389] hsr_slave_0: entered promiscuous mode [ 84.430590][ T6389] hsr_slave_1: entered promiscuous mode [ 84.536775][ T80] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.539290][ T80] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.566107][ T98] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.569401][ T98] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.702496][ T6389] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 84.708592][ T6389] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 84.712781][ T6389] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 84.718912][ T6389] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 84.780808][ T6389] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.790987][ T6389] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.796354][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.799120][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.806821][ T98] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.809876][ T98] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.961020][ T6389] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.998327][ T6389] veth0_vlan: entered promiscuous mode [ 85.005468][ T6389] veth1_vlan: entered promiscuous mode [ 85.020418][ T6389] veth0_macvtap: entered promiscuous mode [ 85.025197][ T6389] veth1_macvtap: entered promiscuous mode [ 85.034384][ T6389] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.043657][ T6389] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.051698][ T6389] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.055485][ T6389] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.059172][ T6389] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.062710][ T6389] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 2025/06/21 16:56:54 executed programs: 0 [ 85.146205][ T5296] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 85.148988][ T5296] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 85.152093][ T5296] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 85.155161][ T5296] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 85.158049][ T5296] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 85.162995][ T63] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 85.169972][ T6454] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 85.170075][ T63] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 85.177082][ T6453] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 85.177083][ T63] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 85.177590][ T63] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 85.180298][ T6453] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 85.182559][ T63] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 85.184055][ T6453] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 85.186894][ T63] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 85.190303][ T6453] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 85.192421][ T63] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 85.195426][ T6453] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 85.197638][ T63] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 85.206662][ T6454] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 85.348834][ T6446] chnl_net:caif_netlink_parms(): no params data found [ 85.517844][ T6446] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.520873][ T6446] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.523954][ T6446] bridge_slave_0: entered allmulticast mode [ 85.529139][ T6446] bridge_slave_0: entered promiscuous mode [ 85.556236][ T6446] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.559202][ T6446] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.562066][ T6446] bridge_slave_1: entered allmulticast mode [ 85.566512][ T6446] bridge_slave_1: entered promiscuous mode [ 85.703838][ T6446] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.710928][ T6446] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.778796][ T6455] chnl_net:caif_netlink_parms(): no params data found [ 85.797679][ T6449] chnl_net:caif_netlink_parms(): no params data found [ 85.820376][ T98] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.903265][ T6446] team0: Port device team_slave_0 added [ 85.907589][ T6446] team0: Port device team_slave_1 added [ 85.953646][ T98] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.971431][ T6450] chnl_net:caif_netlink_parms(): no params data found [ 85.983244][ T6446] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.986211][ T6446] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.996526][ T6446] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.008168][ T6446] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.011083][ T6446] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.022203][ T6446] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.151750][ T6449] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.154899][ T6449] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.157965][ T6449] bridge_slave_0: entered allmulticast mode [ 86.162351][ T6449] bridge_slave_0: entered promiscuous mode [ 86.192292][ T6455] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.195452][ T6455] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.198458][ T6455] bridge_slave_0: entered allmulticast mode [ 86.202275][ T6455] bridge_slave_0: entered promiscuous mode [ 86.207770][ T6449] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.210820][ T6449] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.213804][ T6449] bridge_slave_1: entered allmulticast mode [ 86.217631][ T6449] bridge_slave_1: entered promiscuous mode [ 86.242394][ T6455] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.245135][ T6455] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.247526][ T6455] bridge_slave_1: entered allmulticast mode [ 86.251070][ T6455] bridge_slave_1: entered promiscuous mode [ 86.406200][ T6449] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.409321][ T6450] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.412405][ T6450] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.416295][ T6450] bridge_slave_0: entered allmulticast mode [ 86.420216][ T6450] bridge_slave_0: entered promiscuous mode [ 86.426460][ T6455] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.435154][ T6446] hsr_slave_0: entered promiscuous mode [ 86.437479][ T6446] hsr_slave_1: entered promiscuous mode [ 86.439643][ T6446] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 86.442033][ T6446] Cannot create hsr debugfs directory [ 86.446304][ T6449] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.466433][ T6450] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.468752][ T6450] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.471448][ T6450] bridge_slave_1: entered allmulticast mode [ 86.474650][ T6450] bridge_slave_1: entered promiscuous mode [ 86.492813][ T6455] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.530692][ T6449] team0: Port device team_slave_0 added [ 86.551376][ T6450] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.580160][ T6455] team0: Port device team_slave_0 added [ 86.583873][ T6449] team0: Port device team_slave_1 added [ 86.602627][ T6450] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.620799][ T6455] team0: Port device team_slave_1 added [ 86.659159][ T6449] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.661347][ T6449] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.669246][ T6449] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.736969][ T6449] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.739245][ T6449] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.747863][ T6449] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.754782][ T6450] team0: Port device team_slave_0 added [ 86.770451][ T6455] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.772916][ T6455] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.782418][ T6455] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.791659][ T6455] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.794223][ T6455] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.802720][ T6455] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.828217][ T6450] team0: Port device team_slave_1 added [ 86.902522][ T6449] hsr_slave_0: entered promiscuous mode [ 86.905584][ T6449] hsr_slave_1: entered promiscuous mode [ 86.907694][ T6449] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 86.910135][ T6449] Cannot create hsr debugfs directory [ 86.971904][ T6450] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.974110][ T6450] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.982686][ T6450] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.988375][ T6450] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.990783][ T6450] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 87.001160][ T6450] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.011891][ T6455] hsr_slave_0: entered promiscuous mode [ 87.015613][ T6455] hsr_slave_1: entered promiscuous mode [ 87.018474][ T6455] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 87.021181][ T6455] Cannot create hsr debugfs directory [ 87.152675][ T6450] hsr_slave_0: entered promiscuous mode [ 87.156062][ T6450] hsr_slave_1: entered promiscuous mode [ 87.159030][ T6450] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 87.162179][ T6450] Cannot create hsr debugfs directory [ 87.236176][ T6454] Bluetooth: hci2: command tx timeout [ 87.236185][ T6003] Bluetooth: hci3: command tx timeout [ 87.236204][ T6458] Bluetooth: hci1: command tx timeout [ 87.236325][ T63] Bluetooth: hci0: command tx timeout [ 87.268706][ T98] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 87.406168][ T98] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 87.711414][ T6446] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 87.751515][ T6446] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 87.762107][ T6446] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 87.767523][ T6446] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 87.867133][ T6446] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.891735][ T6446] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.939861][ T1151] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.942123][ T1151] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.949480][ T80] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.951799][ T80] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.104443][ T6446] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.133327][ T6446] veth0_vlan: entered promiscuous mode [ 88.143707][ T6446] veth1_vlan: entered promiscuous mode [ 88.172366][ T6446] veth0_macvtap: entered promiscuous mode [ 88.177901][ T6446] veth1_macvtap: entered promiscuous mode [ 88.201381][ T6446] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.218443][ T6446] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.230558][ T98] bridge_slave_1: left allmulticast mode [ 88.232403][ T98] bridge_slave_1: left promiscuous mode [ 88.234638][ T98] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.238411][ T98] bridge_slave_0: left allmulticast mode [ 88.240197][ T98] bridge_slave_0: left promiscuous mode [ 88.242030][ T98] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.449045][ T98] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 88.453500][ T98] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 88.457420][ T98] bond0 (unregistering): Released all slaves [ 88.489560][ T6446] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.493214][ T6446] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.497279][ T6446] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.500249][ T6446] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.550441][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.552958][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.572386][ T1151] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.575674][ T1151] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.624246][ T40] audit: type=1400 audit(1750525018.305:122): avc: denied { read write } for pid=6538 comm="syz.0.16" name="raw-gadget" dev="devtmpfs" ino=849 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 88.631754][ T40] audit: type=1400 audit(1750525018.305:123): avc: denied { open } for pid=6538 comm="syz.0.16" path="/dev/raw-gadget" dev="devtmpfs" ino=849 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 88.638800][ T40] audit: type=1400 audit(1750525018.305:124): avc: denied { ioctl } for pid=6538 comm="syz.0.16" path="/dev/raw-gadget" dev="devtmpfs" ino=849 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 88.864447][ T60] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 88.908153][ T98] hsr_slave_0: left promiscuous mode [ 88.910953][ T98] hsr_slave_1: left promiscuous mode [ 88.913679][ T98] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 88.917833][ T98] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 88.920424][ T98] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 88.922665][ T98] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 88.941903][ T98] veth1_macvtap: left promiscuous mode [ 88.943686][ T98] veth0_macvtap: left promiscuous mode [ 88.946380][ T98] veth1_vlan: left promiscuous mode [ 88.948301][ T98] veth0_vlan: left promiscuous mode [ 89.034622][ T60] usb 5-1: Using ep0 maxpacket: 16 [ 89.050652][ T60] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 89.055153][ T60] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 56, changing to 7 [ 89.059159][ T60] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid maxpacket 57832, setting to 1024 [ 89.067620][ T60] usb 5-1: New USB device found, idVendor=2040, idProduct=0265, bcdDevice=4e.d1 [ 89.070488][ T60] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 89.072898][ T60] usb 5-1: Product: syz [ 89.074219][ T60] usb 5-1: Manufacturer: syz [ 89.083284][ T60] usb 5-1: SerialNumber: syz [ 89.090598][ T60] usb 5-1: config 0 descriptor?? [ 89.100278][ T60] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0265, interface 0, class 0) [ 89.107209][ T60] em28xx 5-1:0.0: Audio interface 0 found (Vendor Class) [ 89.314596][ T6458] Bluetooth: hci0: command tx timeout [ 89.314633][ T6003] Bluetooth: hci2: command tx timeout [ 89.314723][ T63] Bluetooth: hci3: command tx timeout [ 89.314847][ T6454] Bluetooth: hci1: command tx timeout [ 89.355892][ T60] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 89.358310][ T60] em28xx 5-1:0.0: Config register raw data: 0xfffffffb [ 89.360847][ T60] em28xx 5-1:0.0: AC97 chip type couldn't be determined [ 89.363066][ T60] em28xx 5-1:0.0: No AC97 audio processor [ 89.367562][ T60] em28xx 5-1:0.0: We currently don't support analog TV or stream capture on dual tuners. [ 89.404418][ T98] team0 (unregistering): Port device team_slave_1 removed [ 89.436385][ T60] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 89.446557][ T60] em28xx 5-1:0.0: Config register raw data: 0xfffffffb [ 89.449296][ T60] em28xx 5-1:0.0: AC97 chip type couldn't be determined [ 89.451522][ T60] em28xx 5-1:0.0: No AC97 audio processor [ 89.451964][ T98] team0 (unregistering): Port device team_slave_0 removed [ 89.665268][ T60] usb 5-1: USB disconnect, device number 2 [ 89.673737][ T60] em28xx 5-1:0.0: Disconnecting em28xx #1 [ 89.675708][ T60] em28xx 5-1:0.0: Disconnecting em28xx [ 89.684658][ T60] em28xx 5-1:0.0: Freeing device [ 89.686447][ T60] em28xx 5-1:0.0: Freeing device [ 89.876000][ T6450] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 89.882827][ T6450] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 89.888920][ T6450] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 89.892936][ T6450] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 89.949287][ T6449] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 89.955012][ T6449] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 89.959556][ T6449] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 89.963397][ T6449] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 90.045659][ T6455] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 90.052828][ T6455] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 90.066086][ T6455] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 90.070354][ T6455] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 90.101353][ T6450] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.136049][ T6450] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.144125][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.147245][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.160718][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.163552][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.176151][ T6449] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.179509][ T60] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 90.204018][ T6449] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.217160][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.219525][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.225690][ T6455] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.235649][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.238105][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.246686][ T6455] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.250888][ T6450] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 90.262347][ T1151] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.264683][ T1151] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.279024][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.281530][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.370234][ T60] usb 5-1: Using ep0 maxpacket: 16 [ 90.389464][ T60] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 90.394177][ T60] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 56, changing to 7 [ 90.395112][ T6450] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.403341][ T60] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid maxpacket 57832, setting to 1024 [ 90.410566][ T60] usb 5-1: New USB device found, idVendor=2040, idProduct=0265, bcdDevice=4e.d1 [ 90.421348][ T60] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 90.426489][ T60] usb 5-1: Product: syz [ 90.428094][ T60] usb 5-1: Manufacturer: syz [ 90.429870][ T60] usb 5-1: SerialNumber: syz [ 90.440882][ T60] usb 5-1: config 0 descriptor?? [ 90.452290][ T60] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0265, interface 0, class 0) [ 90.458865][ T6450] veth0_vlan: entered promiscuous mode [ 90.461257][ T60] em28xx 5-1:0.0: Audio interface 0 found (Vendor Class) [ 90.469274][ T6450] veth1_vlan: entered promiscuous mode [ 90.479985][ T6449] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.486667][ T6455] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.508329][ T6450] veth0_macvtap: entered promiscuous mode [ 90.519389][ T6450] veth1_macvtap: entered promiscuous mode [ 90.537848][ T6450] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.550227][ T6450] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.563497][ T6449] veth0_vlan: entered promiscuous mode [ 90.569120][ T6455] veth0_vlan: entered promiscuous mode [ 90.571611][ T6450] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.574904][ T6450] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.577613][ T6450] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.580327][ T6450] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.595191][ T6455] veth1_vlan: entered promiscuous mode [ 90.603645][ T6449] veth1_vlan: entered promiscuous mode [ 90.645294][ T6449] veth0_macvtap: entered promiscuous mode [ 90.648620][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.651309][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.663971][ T6449] veth1_macvtap: entered promiscuous mode [ 90.670196][ T6455] veth0_macvtap: entered promiscuous mode [ 90.673661][ T1151] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.677815][ T1151] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.683737][ T6455] veth1_macvtap: entered promiscuous mode [ 90.689091][ T6449] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.695879][ T6449] batman_adv: batadv0: Interface activated: batadv_slave_1 2025/06/21 16:57:00 executed programs: 10 [ 90.700919][ T6449] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.703858][ T6449] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.707159][ T60] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 90.708342][ T6449] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.710160][ T60] em28xx 5-1:0.0: Config register raw data: 0xfffffffb [ 90.711803][ T6449] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.718352][ T60] em28xx 5-1:0.0: AC97 chip type couldn't be determined [ 90.720546][ T60] em28xx 5-1:0.0: No AC97 audio processor [ 90.722346][ T60] non-slab/vmalloc memory [ 90.723430][ T6455] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.723833][ T60] list_add corruption. prev->next should be next (ffffffff8fdc0e80), but was ffffffff8261cbbc. (prev=ffff888057074250). [ 90.731813][ T60] ------------[ cut here ]------------ [ 90.733553][ T60] kernel BUG at lib/list_debug.c:32! [ 90.735484][ T60] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 90.738655][ T60] CPU: 3 UID: 0 PID: 60 Comm: kworker/3:1 Not tainted 6.16.0-rc2-syzkaller-g739a6c93cc75 #0 PREEMPT(full) [ 90.742444][ T60] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 90.745647][ T60] Workqueue: usb_hub_wq hub_event [ 90.747275][ T60] RIP: 0010:__list_add_valid_or_report+0x12b/0x190 [ 90.749298][ T60] Code: 00 00 00 00 fc ff df 48 89 f2 48 c1 ea 03 80 3c 02 00 75 5a 48 8b 16 48 89 f1 48 c7 c7 a0 7a 15 8c 48 89 ee e8 f6 68 b9 fc 90 <0f> 0b 48 89 f2 48 89 e9 4c 89 e6 48 c7 c7 20 7b 15 8c e8 de 68 b9 [ 90.755085][ T60] RSP: 0018:ffffc90000adee88 EFLAGS: 00010282 [ 90.756986][ T60] RAX: 0000000000000075 RBX: ffff88804410c000 RCX: ffffffff819b00b9 [ 90.759525][ T60] RDX: 0000000000000000 RSI: ffffffff819b7f46 RDI: 0000000000000005 [ 90.762043][ T60] RBP: ffffffff8fdc0e80 R08: 0000000000000005 R09: 0000000000000000 [ 90.764819][ T60] R10: 0000000080000000 R11: 0000000000000001 R12: ffff88804410c250 [ 90.767298][ T60] R13: ffffffff8fdc0e88 R14: ffff88804410c1a8 R15: ffff88804410da14 [ 90.769827][ T60] FS: 0000000000000000(0000) GS:ffff8880d6a53000(0000) knlGS:0000000000000000 [ 90.772717][ T60] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 90.774773][ T60] CR2: 0000560d6c545008 CR3: 0000000029c73000 CR4: 0000000000352ef0 [ 90.777186][ T60] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 90.779665][ T60] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 90.782868][ T60] Call Trace: [ 90.784284][ T60] [ 90.785234][ T60] em28xx_init_extension+0x48/0x200 [ 90.786900][ T60] em28xx_init_dev.constprop.0+0x1a10/0x3170 [ 90.788813][ T60] ? __pfx_em28xx_init_dev.constprop.0+0x10/0x10 [ 90.791045][ T60] ? rcu_is_watching+0x12/0xc0 [ 90.792995][ T60] ? lockdep_init_map_type+0x5c/0x280 [ 90.795165][ T60] ? lockdep_init_map_type+0x5c/0x280 [ 90.796860][ T60] em28xx_usb_probe+0x1285/0x3770 [ 90.798752][ T60] usb_probe_interface+0x303/0x9c0 [ 90.800826][ T60] ? __pfx_usb_probe_interface+0x10/0x10 [ 90.803131][ T60] really_probe+0x241/0xa90 [ 90.804643][ T60] __driver_probe_device+0x1de/0x440 [ 90.806282][ T60] driver_probe_device+0x4c/0x1b0 [ 90.807832][ T60] __device_attach_driver+0x1df/0x310 [ 90.809520][ T60] ? __pfx___device_attach_driver+0x10/0x10 [ 90.811313][ T60] bus_for_each_drv+0x159/0x1e0 [ 90.812848][ T60] ? __pfx_bus_for_each_drv+0x10/0x10 [ 90.814545][ T60] ? lockdep_hardirqs_on+0x7c/0x110 [ 90.816181][ T60] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 90.818025][ T60] __device_attach+0x1e4/0x4b0 [ 90.819589][ T60] ? __pfx___device_attach+0x10/0x10 [ 90.821520][ T60] ? do_raw_spin_unlock+0x172/0x230 [ 90.823563][ T60] bus_probe_device+0x17f/0x1c0 [ 90.825105][ T60] device_add+0x1148/0x1a70 [ 90.826715][ T60] ? __pfx_device_add+0x10/0x10 [ 90.828432][ T60] ? preempt_schedule_thunk+0x16/0x30 [ 90.830148][ T60] usb_set_configuration+0x1187/0x1e20 [ 90.831881][ T60] ? __pfx_usb_generic_driver_probe+0x10/0x10 [ 90.833901][ T60] usb_generic_driver_probe+0xb1/0x110 [ 90.835847][ T60] usb_probe_device+0xef/0x3e0 [ 90.837491][ T60] ? __pfx_usb_probe_device+0x10/0x10 [ 90.839199][ T60] really_probe+0x241/0xa90 [ 90.840780][ T60] __driver_probe_device+0x1de/0x440 [ 90.842446][ T60] ? usb_driver_applicable+0x1c7/0x220 [ 90.844262][ T60] driver_probe_device+0x4c/0x1b0 [ 90.845817][ T60] __device_attach_driver+0x1df/0x310 [ 90.847332][ T60] ? __pfx___device_attach_driver+0x10/0x10 [ 90.849135][ T60] bus_for_each_drv+0x159/0x1e0 [ 90.850819][ T60] ? __pfx_bus_for_each_drv+0x10/0x10 [ 90.852962][ T60] ? lockdep_hardirqs_on+0x7c/0x110 [ 90.854648][ T60] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 90.856457][ T60] __device_attach+0x1e4/0x4b0 [ 90.857956][ T60] ? __pfx___device_attach+0x10/0x10 [ 90.859635][ T60] ? do_raw_spin_unlock+0x172/0x230 [ 90.861324][ T60] bus_probe_device+0x17f/0x1c0 [ 90.862867][ T60] device_add+0x1148/0x1a70 [ 90.864365][ T60] ? __pfx_device_add+0x10/0x10 [ 90.865913][ T60] ? add_device_randomness+0xb7/0xf0 [ 90.867587][ T60] ? __usb_get_extra_descriptor+0x158/0x1c0 [ 90.869469][ T60] usb_new_device+0xd07/0x1a20 [ 90.871358][ T60] ? do_raw_spin_lock+0x12c/0x2b0 [ 90.873405][ T60] ? __pfx_usb_new_device+0x10/0x10 [ 90.875138][ T60] ? mark_held_locks+0x49/0x80 [ 90.876647][ T60] hub_event+0x2eb7/0x4fa0 [ 90.878065][ T60] ? __pfx_hub_event+0x10/0x10 [ 90.879598][ T60] ? interval_tree_remove+0x550/0xee0 [ 90.881237][ T60] ? rcu_is_watching+0x12/0xc0 [ 90.882689][ T60] process_one_work+0x9cc/0x1b70 [ 90.884218][ T60] ? __pfx_hub_event+0x10/0x10 [ 90.885670][ T60] ? __pfx_process_one_work+0x10/0x10 [ 90.887395][ T60] ? assign_work+0x1a0/0x250 [ 90.888864][ T60] worker_thread+0x6c8/0xf10 [ 90.890464][ T60] ? __kthread_parkme+0x19e/0x250 [ 90.892596][ T60] ? __pfx_worker_thread+0x10/0x10 [ 90.894744][ T60] kthread+0x3c2/0x780 [ 90.896032][ T60] ? __pfx_kthread+0x10/0x10 [ 90.897489][ T60] ? rcu_is_watching+0x12/0xc0 [ 90.899017][ T60] ? __pfx_kthread+0x10/0x10 [ 90.900493][ T60] ret_from_fork+0x5d4/0x6f0 [ 90.901860][ T60] ? __pfx_kthread+0x10/0x10 [ 90.903231][ T60] ret_from_fork_asm+0x1a/0x30 [ 90.904754][ T60] [ 90.905743][ T60] Modules linked in: [ 90.907646][ T60] ---[ end trace 0000000000000000 ]--- [ 90.910997][ T60] RIP: 0010:__list_add_valid_or_report+0x12b/0x190 [ 90.913441][ T60] Code: 00 00 00 00 fc ff df 48 89 f2 48 c1 ea 03 80 3c 02 00 75 5a 48 8b 16 48 89 f1 48 c7 c7 a0 7a 15 8c 48 89 ee e8 f6 68 b9 fc 90 <0f> 0b 48 89 f2 48 89 e9 4c 89 e6 48 c7 c7 20 7b 15 8c e8 de 68 b9 [ 90.916494][ T6455] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.919611][ T60] RSP: 0018:ffffc90000adee88 EFLAGS: 00010282 [ 90.922659][ T6449] ieee80211 phy13: Selected rate control algorithm 'minstrel_ht' [ 90.923466][ T60] RAX: 0000000000000075 RBX: ffff88804410c000 RCX: ffffffff819b00b9 [ 90.927191][ T6455] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.929130][ T60] RDX: 0000000000000000 RSI: ffffffff819b7f46 RDI: 0000000000000005 [ 90.931715][ T6455] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.934113][ T60] RBP: ffffffff8fdc0e80 R08: 0000000000000005 R09: 0000000000000000 [ 90.937323][ T6455] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.939596][ T60] R10: 0000000080000000 R11: 0000000000000001 R12: ffff88804410c250 [ 90.942244][ T6455] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.944847][ T60] R13: ffffffff8fdc0e88 R14: ffff88804410c1a8 R15: ffff88804410da14 [ 90.950019][ T60] FS: 0000000000000000(0000) GS:ffff8880d6a53000(0000) knlGS:0000000000000000 [ 90.953464][ T60] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 90.955768][ T60] CR2: 0000560d6c545008 CR3: 0000000029c73000 CR4: 0000000000352ef0 [ 90.958237][ T60] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 90.960636][ T60] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 90.963113][ T60] Kernel panic - not syncing: Fatal exception [ 90.965740][ T60] Kernel Offset: disabled [ 90.967148][ T60] Rebooting in 86400 seconds..