last executing test programs: 5m58.478805288s ago: executing program 2 (id=942): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan1\x00'}) r1 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101001, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sendto(0xffffffffffffffff, 0x0, 0x0, 0x48000, 0x0, 0x0) socket$l2tp6(0xa, 0x2, 0x73) msgsnd(0x0, &(0x7f00000035c0)=ANY=[@ANYBLOB], 0x1b, 0x5f005e4c1fdd0237) socket$packet(0x11, 0x2, 0x300) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, &(0x7f0000000040)=0x4, 0x4) listen(0xffffffffffffffff, 0x7f) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={0xffffffffffffffff, 0x0, &(0x7f0000000a80)=@tcp6}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{}, &(0x7f00000004c0), &(0x7f0000000500)}, 0x20) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000140)={'comedi_bond\x00', [0x3, 0x2, 0x7fffffff, 0x8, 0x2f, 0x2006, 0xf1, 0x8, 0x80ffa, 0x2, 0x0, 0x8500, 0x1003, 0x1000004, 0xf, 0x10000, 0xffffffa8, 0x7ffffffd, 0x1ff, 0x9ea, 0x10, 0x40000, 0x8, 0x5, 0x746f, 0x8, 0x5, 0x8, 0x0, 0x4, 0x7ffd]}) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x50, 0x2, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}]}, 0x50}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) 5m57.404009277s ago: executing program 2 (id=945): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000009c0)={0x3, 0xd, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000000000000000000000000000850000004f00000018110000", @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000009800000095"], &(0x7f0000000680)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000004c0)={r0, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000240)="d2ff03066003008cb89e08d988a8", 0x0, 0xd5b4, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 5m57.31525452s ago: executing program 2 (id=947): syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) ioperm(0x5, 0x6, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[], 0x2c}, 0x1, 0x0, 0x0, 0x40001}, 0x20008000) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x800, 0x0) r0 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) read$FUSE(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb4e02000) syz_clone(0x2000, 0x0, 0xff36, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x9, &(0x7f0000000000)=0x3, 0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) fsopen(&(0x7f0000000100)='mqueue\x00', 0x1) symlinkat(&(0x7f0000000280)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x41000000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet6(0xa, 0x2, 0x0) 5m52.081858731s ago: executing program 2 (id=955): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000009c0)={0x3, 0xd, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000000000000000000000000000850000004f00000018110000", @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000009800000095"], &(0x7f0000000680)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000004c0)={r0, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000240)="d2ff03066003008cb89e08d988a8", 0x0, 0xd5b4, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 5m50.127869005s ago: executing program 2 (id=962): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) socket$kcm(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/wakeup_count', 0x101a02, 0x0) sendfile(r0, r0, 0x0, 0x101) syz_open_dev$usbfs(&(0x7f00000000c0), 0x201, 0x402) socket$inet_tcp(0x2, 0x1, 0x0) pselect6(0x40, &(0x7f0000000180)={0x6, 0x0, 0x1fd, 0x7d, 0xfffffffffffffffd, 0x7f, 0x104, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xae07, 0x9, 0x4, 0x15, 0x80000006, 0x8}, 0x0, 0x0) 5m47.780417308s ago: executing program 2 (id=965): openat$sw_sync(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000005580)=""/102392, 0x18ff8) accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000240)={0x28, 0x0, 0xffffffff, @host}, 0x10, 0x800) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r2, &(0x7f0000000080)={0x0, 0x0, 0x3, 0x1}, 0x8) r3 = openat$dma_heap(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r3, 0xc0184800, &(0x7f0000000100)={0x1}) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x59032, 0xffffffffffffffff, 0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)) close_range(r4, 0xffffffffffffffff, 0x0) 5m32.561204272s ago: executing program 32 (id=965): openat$sw_sync(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000005580)=""/102392, 0x18ff8) accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000240)={0x28, 0x0, 0xffffffff, @host}, 0x10, 0x800) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r2, &(0x7f0000000080)={0x0, 0x0, 0x3, 0x1}, 0x8) r3 = openat$dma_heap(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r3, 0xc0184800, &(0x7f0000000100)={0x1}) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x59032, 0xffffffffffffffff, 0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)) close_range(r4, 0xffffffffffffffff, 0x0) 2m27.280293562s ago: executing program 0 (id=1271): socket$nl_generic(0x10, 0x3, 0x10) creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000700), 0x101180, 0x0) ioctl$SOUND_MIXER_WRITE_VOLUME(r4, 0xc0040d07, &(0x7f0000000040)=0x121) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b14, &(0x7f0000000000)={'wlan1\x00', @random="018d008dffff"}) sendmmsg$inet(r0, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)="2a73ed35", 0x732a}], 0x1}}], 0x400000000000292, 0x0) 2m25.978185147s ago: executing program 0 (id=1274): openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) mount(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)='sysfs\x00', 0x8000, 0x0) truncate(&(0x7f0000000100)='./file0\x00', 0x0) 2m25.800252392s ago: executing program 0 (id=1277): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r0) sendmsg$NFC_CMD_FW_DOWNLOAD(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000680)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="fbdbdf251509010000"], 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x4000004) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000040), r0) 2m25.618779697s ago: executing program 0 (id=1278): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan1\x00'}) r1 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101001, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sendto(0xffffffffffffffff, &(0x7f0000000300)="6ac5c6", 0x3, 0x48000, 0x0, 0x0) socket$l2tp6(0xa, 0x2, 0x73) msgsnd(0x0, 0x0, 0x1b, 0x5f005e4c1fdd0237) socket$packet(0x11, 0x2, 0x300) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, &(0x7f0000000040)=0x4, 0x4) listen(0xffffffffffffffff, 0x7f) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={0xffffffffffffffff, 0x0, 0x0}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{}, &(0x7f00000004c0), &(0x7f0000000500)}, 0x20) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000140)={'comedi_bond\x00', [0x3, 0x2, 0x7fffffff, 0x8, 0x2f, 0x2006, 0xf1, 0x8, 0x80ffa, 0x2, 0x0, 0x8500, 0x1003, 0x1000004, 0xf, 0x10000, 0xffffffa8, 0x7ffffffd, 0x1ff, 0x9ea, 0x10, 0x40000, 0x8, 0x5, 0x746f, 0x8, 0x5, 0x8, 0x0, 0x4, 0x7ffd]}) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) 2m24.736722091s ago: executing program 0 (id=1279): socket$inet_icmp(0x2, 0x2, 0x1) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/udp\x00') pread64(r0, 0x0, 0x0, 0x1f5) 2m24.540039836s ago: executing program 0 (id=1280): ioperm(0x5, 0x6, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x800, 0x0) ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb4e02000) syz_clone(0x2000, 0x0, 0xff36, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x1, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x9, &(0x7f0000000000)=0x3, 0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) fsopen(&(0x7f0000000100)='mqueue\x00', 0x1) symlinkat(&(0x7f0000000280)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x41000000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet6(0xa, 0x2, 0x0) 2m9.450658306s ago: executing program 33 (id=1280): ioperm(0x5, 0x6, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x800, 0x0) ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb4e02000) syz_clone(0x2000, 0x0, 0xff36, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x1, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x9, &(0x7f0000000000)=0x3, 0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) fsopen(&(0x7f0000000100)='mqueue\x00', 0x1) symlinkat(&(0x7f0000000280)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x41000000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet6(0xa, 0x2, 0x0) 7.040242649s ago: executing program 5 (id=1762): syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f00000019c0), 0x0, 0x24088000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xf, &(0x7f0000000200)=ANY=[@ANYRESDEC, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x9, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x14, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000007efff100004000", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac00", "f4bd000000801900", [0x8, 0xffffffff9673e35d]}}) 6.722486867s ago: executing program 5 (id=1764): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000380)=0x2, 0x4) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000003c0)={{{@in6=@mcast2, @in=@loopback, 0x0, 0x0, 0x4e21, 0x0, 0xa}, {}, {0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3}, {{@in=@multicast1, 0x4d3, 0x6c}, 0x0, @in=@multicast2, 0x0, 0x0, 0x0, 0x3, 0x1ff}}, 0xe8) bind$inet(r0, &(0x7f0000000480)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x28040001, 0x0, 0x0) sendmsg$inet(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000280)="1f", 0x1}], 0x1}, 0x48c0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000200)=0x11, 0x4) recvmmsg(r0, &(0x7f00000003c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/72, 0x48}, 0x6}], 0x41f, 0x40, 0x0) 6.554428002s ago: executing program 3 (id=1765): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x0, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}, @flat=@binder={0x73622a85, 0x10b}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x4c, 0x0, &(0x7f0000000800)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000880)={@flat=@binder={0x73622a85, 0x1, 0x1}, @flat=@handle={0x73682a85, 0x1000, 0x3}, @ptr={0x70742a85, 0x0, 0x0, 0x4c, 0x1, 0x16}}, &(0x7f0000000380)={0x0, 0x18, 0x30}}, 0x400}], 0x0, 0x0, 0x0}) 6.480220805s ago: executing program 5 (id=1766): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x2840, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000580)={{0x2000, 0x41000, 0x8, 0xf4, 0x3, 0xe4, 0x40, 0x2, 0x0, 0x30, 0x19}, {0x41000, 0x3000, 0xe, 0x0, 0x40, 0x5, 0x7d, 0x9, 0x58, 0x3, 0x3, 0x1}, {0x54000, 0xfec00000, 0x8, 0x5, 0x3, 0x7, 0xfe, 0x89, 0x7, 0xab, 0x5, 0x81}, {0x30000, 0x8000000, 0x3, 0x5d, 0x4, 0x8, 0x9, 0xfa, 0x80, 0x7, 0xe, 0x4}, {0x30000, 0x9000, 0x10, 0x1, 0x3, 0x7, 0xab, 0x7f, 0x47, 0x83, 0xf7, 0x82}, {0x1000, 0x80a0000, 0x8, 0xa0, 0xb5, 0x8, 0x1, 0xd, 0x88, 0xf, 0x1, 0xfd}, {0x54000, 0x2, 0x4, 0x5, 0x7, 0x2, 0xb, 0x0, 0x5, 0x7e, 0xff, 0x70}, {0x58000, 0xb000, 0xe, 0xd, 0xf, 0x47, 0x3, 0x3, 0x2, 0x3, 0x7, 0x9}, {0x50000, 0x2d}, {0x10000, 0x7fff}, 0x80000031, 0x0, 0x6000, 0x14222c, 0xb, 0x9501, 0x3000, [0x6840000000000002, 0x3, 0x91, 0x101]}) 6.323686799s ago: executing program 3 (id=1767): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000005580)=""/102392, 0x18ff8) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='quota,grpquota_block_hardlimit=']) ioctl$IOMMU_TEST_OP_ADD_RESERVED(0xffffffffffffffff, 0x3ba0, 0x0) write$P9_RSTATu(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="330200007d02000005f2000000040000000001000000050000000000000000000000000000000000000000000000000000001b00046e6f6465767b65766f6f7e0539c60005000037d93a8b920000003800704a86cec602007dfa673effeb09b5351f5bde054000000000187b8200b500002b595fcb14034354b9fd9ef196a51cd5157adc8103b494e10f00cfc26dd7c5b499bfb42b93807e8b5a5d00f8f669fb716dcf315ecaf385409ac65b9408678c2c3ba61d52c36cde7b07dbdab2884baf05007e04e69db0c3ca00000000000047ec21cabff20f9c1cbe36f4fd1a4cc29e953fa5e052157480e8000000000000000000000081ffffff002c016f6465762f6eb17b2300f9daa5ee23266ecf85fea65e42d979a3fde5f455daf03b1172d97badc7095afd76fe4f0441f7f7741eac030000ecff0000dba0c2f7f09ff53c7e4d1ad66e2d070198019f30118447aa9a74f51685f506ae894806878267d5a1298d792c4a37f2e1cbbd2482929a0d8972b5cf732ea5b0d723859dba3f93aed3b42ee7cac07de09d1d68a60333a882467d2b31aacdf9188549b1125d6c4c9b18c2fb56c57d7dc626e4390796a1eb48274669ab13f8b11d146059f310e2634d593fec65d529f382066664df244e4c90570a70049f39"], 0x233) 6.309490529s ago: executing program 1 (id=1768): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff4000/0xa000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f000042d000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f000044c000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f00005b6000/0x4000)=nil, &(0x7f000069d000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{{}, 0x0, 0x2}], 0x37) 6.163164023s ago: executing program 5 (id=1769): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@getchain={0x24, 0x11, 0x839, 0x70bd27, 0x0, {0x0, 0x0, 0x0, r2, {0xffe0}, {0x3, 0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x4040091}, 0x0) 6.020344877s ago: executing program 1 (id=1770): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, 0x0, &(0x7f0000001700)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x401}, 0x94) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000040)=0xfe) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0301, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7ffffcb9}]}) openat$dsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) 5.336503156s ago: executing program 5 (id=1771): syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000480)='./file0\x00', 0x40410, &(0x7f00000000c0)={[{@noload}, {@stripe={'stripe', 0x3d, 0x6}}, {@debug}, {@noload}, {@abort}, {@nobarrier}, {@norecovery}, {@sb={'sb', 0x3d, 0x200}}, {@sysvgroups}]}, 0xff, 0x459, &(0x7f0000000980)="$eJzs3MtvVNUfAPDvvTMtlMev/Sk+QNAqGomPlpbnwg1GExeamOgC46q2hSADVVoTIUTRBS4NiXvj0sS/wJVujLoycat7Q0IMG9DEZMy9c28ZhpnSoQODzOeTXDhn7pne873nnplzz5mZAAbWePZPErEpIn6LiNFG9voC443/rl4+O/vX5bOzSdTrb/yZ5OWuXD47WxYtn7exkanXi/y6Nsc9/3bETK02f6rITy6deG9y8fSZ54+dmDk6f3T+5PTBg3v37BjeP72vJ3FmcV3Z9tHC9q2vvHXhtdnDF9756ZusvpuK/c1x9MjIeOPstvVUjw/Wb5ub0km1jxWhK5WIyJprKO//o1GJkeV9o/Hyp32tHHBb1ev1erv358K5OnAPS6LfNQD6o3yjz+5/y+0ODT3uCpcORbx/oBH/1WJr7KlGWpQZarm/7aXxiDh87u8vsy1uzzwEAMB1vjsUEc+1G/+l8WBTuf8VayhjEfH/iLgvIu6PiC0R8UBEXvahiHi4y+O3rpDcOP5JL95SYKuUjf9eKNa2lsd//9Tz+AtjlSK3OY9/KDlyrDa/uzgnu2JoXZafWuEY37/06+ed9jWP/7ItO345FmxIL1ZbJujmZpZm1hj2skufRGyrtsSfS6JcxkkiYmtEbOvqL1+7wzj2zNfbO5W6efwr6ME6U/2riKcb7X8uWuIvJR3XJ6cO7J/eN7k+avO7J8ur4kY//3L+9U7HX1P8PZC1/4bW6z+3HP9Ysj5i8fSZ4/l67WK0rhDf1PnfP+t4T3Or1/9w8maeHi4e+3BmaenUVMRw8uqNj09fe26RrzbHv2tnu/jT/DWujPaRiMgu4h0R8WhEPFbU/fGIeCIidq4Q/48vPvlu9/GvMCvfQ1n8czdr/2hu/+4TleM/fNt9/KWs/ffmqV3FI6t5/VttBddy7gAAAOC/Is0/A5+kE8vpNJ2YaHyGf0tsSGsLi0vPHln44ORc47PyYzGUljNdo03zoVPF3HCZn27J7ynmjb+ojOT5idmF2ly/g4cBt7FD/8/8Uel37YDbzve1YHDp/zC49H8YXPo/DC79HwZXu/7/cR/qAdx53v9hcOn/MLj0fxhc+j8MpI7fjU/X9JV/iXs+EWn3z6pGX+ucrPTDECN3xVltk6iu+scsbjGxru2ufr8yAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA9Ma/AQAA//+nZunQ") r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000100), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000b40)=ANY=[@ANYBLOB="14020000", @ANYRES16=r1, @ANYBLOB="01002bbd7000fbdbdf250100000008000100010000000c000480050003000500000008000200010000000400088008000100ffffffff24000c8004000b801c000b80080009004caadf0908000a00ee65000008000a0060640000a8000c801c000b8008000900"], 0x214}, 0x1, 0x0, 0x0, 0x1}, 0x48084) 4.502732128s ago: executing program 1 (id=1772): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r0) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001800)=ANY=[@ANYBLOB="180000002500010324bd7002ffdbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x4008}, 0x0) recvmmsg(r0, &(0x7f0000006cc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000003300)=""/4104, 0x1008}, {&(0x7f00000013c0)=""/250, 0xfa}], 0x2}, 0x5}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, &(0x7f0000003280)=[{&(0x7f0000001ac0)=""/121, 0x79}, {&(0x7f0000001b80)=""/130, 0x82}, {&(0x7f0000004580)=""/4090, 0xffa}, {&(0x7f0000002d80)=""/208, 0xd0}, {&(0x7f0000002e80)=""/251, 0xfb}, {&(0x7f0000002f80)=""/245, 0xf5}, {&(0x7f0000003080)=""/222, 0xde}, {&(0x7f0000003180)=""/246, 0xf6}], 0x8}, 0x81}], 0x4, 0x0, 0x0) 4.252042215s ago: executing program 5 (id=1773): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0xa8442, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x80082, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000022c0)=@newtfilter={0x44, 0x2c, 0xd27, 0x170bd2b, 0x2, {0x0, 0x0, 0x0, r3, {0x0, 0x10}, {}, {0x8, 0xc695d31f854950dd}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x17ea}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0xc804}, 0x2) close(r1) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r4, &(0x7f0000000280)={&(0x7f0000000540)=@xdp={0x2c, 0x0, r3, 0x27}, 0x80, &(0x7f00000000c0)=[{&(0x7f00000001c0)="27030200dc0f14000e00113c0ff000000000ff8400000066e4532cc10200000003125ce882cbf490d90812533f00", 0x2e}], 0x1}, 0x45) 4.000000332s ago: executing program 4 (id=1774): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000380)=0x2, 0x4) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000003c0)={{{@in6=@mcast2, @in=@loopback, 0x0, 0x0, 0x4e21, 0x0, 0xa}, {}, {0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3}, {{@in=@multicast1, 0x4d3, 0x6c}, 0x0, @in=@multicast2, 0x0, 0x0, 0x0, 0x3, 0x1ff}}, 0xe8) bind$inet(r0, &(0x7f0000000480)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x28040001, &(0x7f0000000040)={0x2, 0x24e23, @local}, 0x10) sendmsg$inet(r0, 0x0, 0x48c0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000200)=0x11, 0x4) recvmmsg(r0, &(0x7f00000003c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/72, 0x48}, 0x6}], 0x41f, 0x40, 0x0) 3.805309017s ago: executing program 4 (id=1775): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x0, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}, @flat=@binder={0x73622a85, 0x10b}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x4c, 0x0, &(0x7f0000000800)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000880)={@flat=@binder={0x73622a85, 0x1, 0x1}, @flat=@handle={0x73682a85, 0x1000, 0x3}, @ptr={0x70742a85, 0x0, 0x0, 0x4c, 0x1, 0x16}}, &(0x7f0000000380)={0x0, 0x18, 0x30}}, 0x400}], 0x0, 0x0, 0x0}) 3.71364302s ago: executing program 3 (id=1776): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) ioctl$VHOST_SET_VRING_ERR(0xffffffffffffffff, 0x4008af22, &(0x7f00000001c0)) ioctl$VHOST_SET_VRING_NUM(0xffffffffffffffff, 0x4008af10, &(0x7f0000000140)={0x1, 0x9}) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)={@multicast1, @local}, 0xc) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='fdinfo/3\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000440)={[0x40000, 0x100000000, 0x0, 0x7f, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x0, 0x7, 0x0, 0x5, 0x8, 0x2, 0xffffffffffffffff], 0x0, 0x200}) ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000040)=0x3) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)={[0x101, 0xaec4, 0x6, 0x4004, 0x2, 0x4, 0xefffffffffffffff, 0x3, 0x0, 0x2000004, 0x20000, 0x1c, 0x0, 0x5, 0x1], 0x0, 0x41981}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 3.613083322s ago: executing program 4 (id=1777): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x2840, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000580)={{0x2000, 0x41000, 0x8, 0xf4, 0x3, 0xe4, 0x40, 0x2, 0x0, 0x30, 0x19}, {0x41000, 0x3000, 0xe, 0x0, 0x40, 0x5, 0x7d, 0x9, 0x58, 0x3, 0x3, 0x1}, {0x54000, 0xfec00000, 0x8, 0x5, 0x3, 0x7, 0xfe, 0x89, 0x7, 0xab, 0x5, 0x81}, {0x30000, 0x8000000, 0x3, 0x5d, 0x4, 0x8, 0x9, 0xfa, 0x80, 0x7, 0xe, 0x4}, {0x30000, 0x9000, 0x10, 0x1, 0x3, 0x7, 0xab, 0x7f, 0x47, 0x83, 0xf7, 0x82}, {0x1000, 0x80a0000, 0x8, 0xa0, 0xb5, 0x8, 0x1, 0xd, 0x88, 0xf, 0x1, 0xfd}, {0x54000, 0x2, 0x4, 0x5, 0x7, 0x2, 0xb, 0x0, 0x5, 0x7e, 0xff, 0x70}, {0x58000, 0xb000, 0xe, 0xd, 0xf, 0x47, 0x3, 0x3, 0x2, 0x3, 0x7, 0x9}, {0x50000, 0x2d}, {0x10000, 0x7fff}, 0x80000031, 0x0, 0x6000, 0x14222c, 0xb, 0x9501, 0x3000, [0x6840000000000002, 0x3, 0x91, 0x101]}) 3.424205517s ago: executing program 1 (id=1778): r0 = syz_open_dev$evdev(0x0, 0x1, 0x2002) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff4000/0xa000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f000042d000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f000044c000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f00005b6000/0x4000)=nil, &(0x7f000069d000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) write$evdev(r0, &(0x7f0000000040)=[{{}, 0x0, 0x2}], 0x37) 3.407532298s ago: executing program 4 (id=1779): r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0x0, 0x0, 0x5}, 0x10) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) sendmmsg(r1, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f00000000c0)}], 0x1}}], 0x1, 0x9200000000000000) ioctl$FIOCLEX(0xffffffffffffffff, 0x5451) recvmmsg$unix(r0, &(0x7f00000043c0)=[{{0x0, 0x0, &(0x7f0000002d00)=[{&(0x7f0000000900)=""/174, 0xae}], 0x1}}], 0x1, 0x0, 0x0) 3.349397219s ago: executing program 1 (id=1780): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, 0x0, &(0x7f0000001700)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x401}, 0x94) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) userfaultfd(0x80001) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0301, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7ffffcb9}]}) openat$dsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) 3.33391822s ago: executing program 3 (id=1781): syz_mount_image$fuse(0x0, 0x0, 0x3000009, 0x0, 0x1, 0x0, 0x0) r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r1, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) connect$unix(r0, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) close(0x3) syz_usb_connect$uac3(0x5, 0x80, &(0x7f0000000000)=ANY=[@ANYBLOB], &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0}) chdir(0x0) open(&(0x7f0000000040)='./bus\x00', 0x400141042, 0x0) mount(&(0x7f0000000280)=@filename='./bus\x00', &(0x7f0000000140)='./bus\x00', 0x0, 0x5000, 0x0) futimesat(0xffffffffffffff9c, 0x0, 0x0) 2.241691529s ago: executing program 1 (id=1782): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x4b) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(0xffffffffffffffff, 0x40146f2c, 0x0) ioctl$DVB_DEMUX_DMX_ADD_PID(0xffffffffffffffff, 0x40026f33, &(0x7f0000000100)=0x808c) ioctl$DVB_DEMUX_DMX_REMOVE_PID(0xffffffffffffffff, 0x40026f34, &(0x7f0000000040)=0x1) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000240)=0x1, 0x4) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x9, {0x9}}}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x3a, &(0x7f0000000500)={@local, @random="9366f942d32d", @val={@void, {0x8100, 0x6, 0x1, 0x4}}, {@mpls_mc={0x8848, {[], @ipv6=@generic={0xc, 0x6, "b8b728", 0x0, 0x33, 0xff, @private2={0xfc, 0x2, '\x00', 0x1}, @private1}}}}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x34, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x9, 0x1}, {0x4}, {0xe, 0xd}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x401}, @TCA_INGRESS_BLOCK={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x90}, 0x4000c00) 2.164231902s ago: executing program 4 (id=1783): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e0000000400000008000000080000", @ANYBLOB="0000fbffffffffffff7f"], 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) 1.964272387s ago: executing program 4 (id=1784): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000005580)=""/102392, 0x18ff8) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='quota,grpquota_block_hardlimit=']) ioctl$IOMMU_TEST_OP_ADD_RESERVED(0xffffffffffffffff, 0x3ba0, 0x0) write$P9_RSTATu(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="330200007d02000005f2000000040000000001000000050000000000000000000000000000000000000000000000000000001b00046e6f6465767b65766f6f7e0539c60005000037d93a8b920000003800704a86cec602007dfa673effeb09b5351f5bde054000000000187b8200b500002b595fcb14034354b9fd9ef196a51cd5157adc8103b494e10f00cfc26dd7c5b499bfb42b93807e8b5a5d00f8f669fb716dcf315ecaf385409ac65b9408678c2c3ba61d52c36cde7b07dbdab2884baf05007e04e69db0c3ca00000000000047ec21cabff20f9c1cbe36f4fd1a4cc29e953fa5e052157480e8000000000000000000000081ffffff002c016f6465762f6eb17b2300f9daa5ee23266ecf85fea65e42d979a3fde5f455daf03b1172d97badc7095afd76fe4f0441f7f7741eac030000ecff0000dba0c2f7f09ff53c7e4d1ad66e2d070198019f30118447aa9a74f51685f506ae894806878267d5a1298d792c4a37f2e1cbbd2482929a0d8972b5cf732ea5b0d723859dba3f93aed3b42ee7cac07de09d1d68a60333a882467d2b31aacdf9188549b1125d6c4c9b18c2fb56c57d7dc626e4390796a1eb48274669ab13f8b11d146059f310e2634d593fec65d529f382066664df244e4c90570a70049f39"], 0x233) 167.953145ms ago: executing program 3 (id=1785): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x0, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}, @flat=@binder={0x73622a85, 0x10b}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x4c, 0x0, &(0x7f0000000800)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000880)={@flat=@binder={0x73622a85, 0x1, 0x1}, @flat=@handle={0x73682a85, 0x1000, 0x3}, @ptr={0x70742a85, 0x0, 0x0, 0x4c, 0x1, 0x16}}, &(0x7f0000000380)={0x0, 0x18, 0x30}}, 0x400}], 0x0, 0x0, 0x0}) 0s ago: executing program 3 (id=1786): syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x1000040, &(0x7f0000000980)={[{@noblock_validity}, {@journal_dev={'journal_dev', 0x3d, 0x7}}, {@journal_ioprio={'journal_ioprio', 0x3d, 0x6}}, {@noinit_itable}, {@nogrpid}, {@nodiscard}, {@jqfmt_vfsv0}, {@noinit_itable}, {@mb_optimize_scan}, {@usrquota}, {@dioread_nolock}]}, 0x1, 0x5a3, &(0x7f00000002c0)="$eJzs3T1sG3UbAPDnznHTj7xv+krvK72gDhUgFamqk/QDClO7IipV6oDEApHjRlWcuIodaKJIpHuF6IAAdSkbDIwgBgbEwsjKwseMVNEIpKYDGDk+p2nqFCfEMcS/n3TJ/3939vP8fX7OvtOdHEDfOtr4k0Y8EREXk4jhdcsGIlt4tLneyvJi8f7yYjGJev3Sz0kkEXFvebHYWj/J/h+KiKWI+H9EfJWPOJ6uPeW+VqM6vzA1Xi6XZrP+SG366kh1fuHElenxydJkaebU8y+cOXv6zNjJsfXp3q+v7+W3NtYb3998+8Y3L92++fEnR5aK744ncS6GsmXrx7GTmq9JPs5tmH+6G8F6KOl1AmxLLqvzRin9L4Yjl1V9O/X1O4fBXUkP6KL6YER9zbom0AcSRQ99qvU9oHH825p28/vHnfPNA5BG3JXlxeJb0Yo/0Dw3EftXj00O/pI8dGTSON48vJuJsictXY+I0YGBR9//Sfb+277RnUiQrvryfHNDPbr907X9T7TZ/wy1zp3+Ra3930q2/1tpEz+3yf7vYocxfnv1xw82jX99MJ5sGz9Zi5+0iZ9GxOsdxr/1yudnN1tW/zDiWLSP35I8/vzwyOUr5dJo82/bGF8cO/Li5uOPOLhJ/OY52/2riawf/74sp7TD8X/29adPLT0m/rNPP377t3v9D0TEOx3G/8+9j17ebNmd68ndxreArW7/JPJxu8P4z507+l3WdNYQAAAAAAAAAAB2ULp6LVuSFtbaaVooNO/h/W8cTMuVau345crczETzmrfDkU9bV1oNN/tJoz+WXY/b6p/c0D+VywLmDqz2C8VKeaLHYwcAAAAAAAAAAAAAAAAAAIC/i0Mb7v//Nbd6///Gn6sG9qrNf/Ib2OvUP/Svh+s/6VkewO7z+Q99q67+oX+pf+hf6h/6l/qH/tW2/g/sfh7A7vP5D/1L/QMAAAAAAAAAAAAAAAAAAAAAAAAAQFdcvHChMdXvLy8WG/2Jgfm5qcobJyZK1anC9FyxUKzMXi1MViqT5VKhWJn+s+dLKpWrozEzd22kVqrWRqrzC69NV+ZmWr8pWsp3fUQAAAAAAAAAAAAAAAAAAADwzzO0OiVpISLf7KdpoRDxr4g4nERy+Uq5NBoR/46Ib3P5wUZ/rNdJAwAAAAAAAAAAAAAAAAAAwB5TnV+YGi+XS7PdawxkoTp71A+1ruYzsJWVI2JpZ9NoPOOWH5XPXsDubqY+aeQ6fB/2faOHOyUAAAAAAAAAAAAAAAAAAOhTD2767fQRv3c3IQAAAAAAAAAAAAAAAAAAAOhL6U9JRDSmY8PPDG1cui9Zya3+j4g3b11679p4rTY71ph/d21+7f1s/sle5A90qlWnaUQ06hgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4oDq/MDVeLpdmt9kY7GCdXo8RAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYDv+CAAA//9bQM66") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) pwrite64(r0, &(0x7f0000000180)='2', 0x1, 0xe7c) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x183042, 0x15) write$UHID_CREATE2(r1, &(0x7f0000000a80)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x0, 0x0, 0xa1, 0x400, 0x8000000}}, 0x118) pwrite64(r1, &(0x7f0000000140)='2', 0xfdef, 0xe7c) kernel console output (not intermixed with test programs): 2-1:0.0: [drm] Cannot find any crtc or sizes [ 570.742500][ T9234] syzkaller0: entered promiscuous mode [ 570.773827][ T9234] syzkaller0: entered allmulticast mode [ 571.797942][ T9006] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 571.997810][ T9006] usb 1-1: Using ep0 maxpacket: 16 [ 572.286283][ T9006] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 572.340396][ T9006] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 572.430081][ T9006] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 572.507110][ T9006] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 572.531757][ T9006] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 572.731535][ T9252] netlink: 'syz.1.893': attribute type 13 has an invalid length. [ 572.739887][ T9252] netlink: 4 bytes leftover after parsing attributes in process `syz.1.893'. [ 572.854325][ T9006] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 573.269108][ T9006] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 573.291935][ T9006] usb 1-1: Manufacturer: syz [ 573.307198][ T9006] usb 1-1: config 0 descriptor?? [ 573.635281][ T9006] rc_core: IR keymap rc-hauppauge not found [ 573.651227][ T9006] Registered IR keymap rc-empty [ 573.672649][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 573.732613][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 573.793095][ T9006] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 573.913015][ T9006] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input18 [ 573.945290][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 574.003746][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 574.042168][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 574.071056][ T9264] comedi comedi0: Minor 3 could not be opened [ 574.092210][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 574.124979][ T9266] o2cb: This node has not been configured. [ 574.132040][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 574.172050][ T9266] o2cb: Cluster check failed. Fix errors before retrying. [ 574.202224][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 574.222934][ T9266] (syz.2.894,9266,1):user_dlm_register:674 ERROR: status = -22 [ 574.232280][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 574.270849][ T9266] (syz.2.894,9266,1):dlmfs_mkdir:438 ERROR: Error -22 could not register domain "file0" [ 574.272172][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 574.352123][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 574.402005][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 574.444116][ T9006] mceusb 1-1:0.0: Registered with mce emulator interface version 1 [ 574.482846][ T9006] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 574.520115][ T9006] usb 1-1: USB disconnect, device number 12 [ 577.242759][ T5824] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 577.566043][ T9289] netlink: 'syz.1.903': attribute type 13 has an invalid length. [ 577.572317][ T5824] usb 3-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 577.574129][ T9289] netlink: 4 bytes leftover after parsing attributes in process `syz.1.903'. [ 577.584169][ T5824] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 577.613721][ T5824] usb 3-1: config 0 descriptor?? [ 577.654041][ T9290] SET target dimension over the limit! [ 578.054589][ T5824] [drm:udl_init] *ERROR* Selecting channel failed [ 578.076567][ T5824] [drm] Initialized udl 0.0.1 20120220 for 3-1:0.0 on minor 2 [ 578.084816][ T5824] [drm] Initialized udl on minor 2 [ 578.095418][ T5824] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 578.128982][ T5824] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 578.156192][ T5825] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 578.172069][ T5824] usb 3-1: USB disconnect, device number 12 [ 578.182239][ T5825] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 578.335709][ T9292] comedi comedi0: Minor 3 could not be opened [ 578.734071][ T5824] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 579.131943][ T5824] usb 4-1: Using ep0 maxpacket: 16 [ 579.140290][ T5824] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 579.163161][ T5824] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 579.181900][ T5824] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 579.224903][ T5824] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 579.403831][ T5824] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 579.715089][ T5824] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 579.842038][ T5824] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 579.876041][ T5824] usb 4-1: Manufacturer: syz [ 579.891420][ T5824] usb 4-1: config 0 descriptor?? [ 581.052038][ T5824] rc_core: IR keymap rc-hauppauge not found [ 581.058575][ T5824] Registered IR keymap rc-empty [ 581.068156][ T5824] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 581.119786][ T5824] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 581.201331][ T5824] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 581.236281][ T5824] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input19 [ 581.296377][ T9326] o2cb: This node has not been configured. [ 581.304400][ T5824] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 581.319890][ T9326] o2cb: Cluster check failed. Fix errors before retrying. [ 581.345101][ T9326] (syz.1.909,9326,0):user_dlm_register:674 ERROR: status = -22 [ 581.354189][ T5824] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 581.378829][ T9326] (syz.1.909,9326,0):dlmfs_mkdir:438 ERROR: Error -22 could not register domain "file0" [ 581.392635][ T5824] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 581.442244][ T5824] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 581.472698][ T5824] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 581.512542][ T5824] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 581.562540][ T5824] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 581.614348][ T5824] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 581.662054][ T5824] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 581.692162][ T5824] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 581.782219][ T5824] mceusb 4-1:0.0: Registered with mce emulator interface version 1 [ 581.815252][ T5824] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 581.852612][ T5824] usb 4-1: USB disconnect, device number 11 [ 582.260170][ T9333] comedi comedi0: Minor 3 could not be opened [ 582.686885][ T9336] SET target dimension over the limit! [ 583.350801][ T9341] netlink: 'syz.1.916': attribute type 13 has an invalid length. [ 583.358889][ T9341] netlink: 4 bytes leftover after parsing attributes in process `syz.1.916'. [ 585.555654][ T9350] netlink: 'syz.0.926': attribute type 13 has an invalid length. [ 585.563579][ T9350] netlink: 4 bytes leftover after parsing attributes in process `syz.0.926'. [ 585.641897][ T6267] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 586.789302][ T6267] usb 4-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 586.802061][ T6267] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 587.383401][ T6267] usb 4-1: config 0 descriptor?? [ 587.690850][ T9363] comedi comedi0: Minor 3 could not be opened [ 587.825284][ T6267] [drm:udl_init] *ERROR* Selecting channel failed [ 587.882491][ T6267] [drm] Initialized udl 0.0.1 20120220 for 4-1:0.0 on minor 2 [ 587.901868][ T6267] [drm] Initialized udl on minor 2 [ 587.913673][ T6267] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 587.939719][ T6267] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 587.952293][ T9006] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 588.002771][ T5847] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 588.011435][ T6267] usb 4-1: USB disconnect, device number 12 [ 588.017904][ T5847] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 588.151948][ T9006] usb 1-1: Using ep0 maxpacket: 16 [ 588.162428][ T9006] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 588.175645][ T9006] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 588.191199][ T9006] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 588.260432][ T9006] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 588.271242][ T9006] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 588.290735][ T9006] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 588.300738][ T9006] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 588.318322][ T9006] usb 1-1: Manufacturer: syz [ 588.381715][ T9006] usb 1-1: config 0 descriptor?? [ 588.865270][ T9006] rc_core: IR keymap rc-hauppauge not found [ 588.872103][ T9006] Registered IR keymap rc-empty [ 588.877347][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 588.912419][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 589.087111][ T9006] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 589.112553][ T9006] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input20 [ 589.360547][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 589.873397][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 590.024205][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 590.073351][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 590.132159][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 590.171993][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 590.255771][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 590.313004][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 590.361943][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 590.414847][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 590.470713][ T9006] mceusb 1-1:0.0: Registered with mce emulator interface version 1 [ 590.494525][ T9006] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 590.529362][ T9384] SET target dimension over the limit! [ 590.602359][ T9006] usb 1-1: USB disconnect, device number 13 [ 590.933186][ T9391] netlink: 'syz.1.930': attribute type 13 has an invalid length. [ 590.941130][ T9391] netlink: 4 bytes leftover after parsing attributes in process `syz.1.930'. [ 591.956537][ T9398] comedi comedi0: Minor 3 could not be opened [ 595.046338][ T9410] binder: BINDER_SET_CONTEXT_MGR already set [ 595.052652][ T9410] binder: 9409:9410 ioctl 4018620d 200000004a80 returned -16 [ 595.062820][ T9410] binder: 9409:9410 ioctl c0306201 0 returned -14 [ 596.612146][ T9006] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 596.765912][ T9425] netlink: 'syz.3.941': attribute type 13 has an invalid length. [ 596.774144][ T9425] netlink: 4 bytes leftover after parsing attributes in process `syz.3.941'. [ 596.892153][ T9006] usb 1-1: Using ep0 maxpacket: 16 [ 596.916801][ T9006] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 596.933636][ T9006] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 596.946288][ T9006] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 596.956700][ T9006] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 596.966901][ T9006] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 596.997204][ T9006] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 597.006987][ T9006] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 597.020971][ T9006] usb 1-1: Manufacturer: syz [ 597.038186][ T9006] usb 1-1: config 0 descriptor?? [ 597.167670][ T9430] comedi comedi0: Minor 3 could not be opened [ 597.771963][ T9006] rc_core: IR keymap rc-hauppauge not found [ 597.778669][ T9006] Registered IR keymap rc-empty [ 597.787333][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 597.834936][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 597.876332][ T9006] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 597.974106][ T9006] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input21 [ 598.005754][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 598.052368][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 598.092286][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 598.130672][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 598.178396][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 598.223351][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 598.292047][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 599.406598][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 599.462967][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 599.508832][ T9006] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 599.574085][ T9006] mceusb 1-1:0.0: Registered with mce emulator interface version 1 [ 600.194951][ T9006] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 600.252414][ T9006] usb 1-1: USB disconnect, device number 14 [ 601.018023][ T9460] SET target dimension over the limit! [ 601.874235][ T9467] comedi comedi0: Minor 3 could not be opened [ 602.734106][ T9473] netlink: 'syz.0.953': attribute type 13 has an invalid length. [ 602.742187][ T9473] netlink: 4 bytes leftover after parsing attributes in process `syz.0.953'. [ 604.431923][ T9006] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 604.832565][ T9006] usb 4-1: Using ep0 maxpacket: 16 [ 604.980201][ T9006] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 605.140036][ T9006] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 605.173076][ T9006] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 605.202019][ T9006] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 605.218789][ T9006] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 605.743926][ T9006] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 605.813731][ T9006] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 606.004688][ T9494] comedi comedi0: Minor 3 could not be opened [ 606.317179][ T9006] usb 4-1: Manufacturer: syz [ 606.443004][ T9006] usb 4-1: config 0 descriptor?? [ 607.742985][ T9006] rc_core: IR keymap rc-hauppauge not found [ 607.893987][ T9006] Registered IR keymap rc-empty [ 607.986206][ T9006] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 608.265329][ T9006] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 608.352056][ T9006] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 608.379067][ T9006] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input22 [ 608.399784][ T9006] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 608.442097][ T9006] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 608.472391][ T9006] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 608.512204][ T9006] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 608.550767][ T9006] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 608.592337][ T9006] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 608.652165][ T9006] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 608.710867][ T9006] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 608.752400][ T9006] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 608.792178][ T9006] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 608.998395][ T9006] mceusb 4-1:0.0: Registered with mce emulator interface version 1 [ 609.071589][ T9526] netlink: 'syz.1.967': attribute type 13 has an invalid length. [ 609.080352][ T9526] netlink: 4 bytes leftover after parsing attributes in process `syz.1.967'. [ 609.289261][ T9006] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 609.309131][ T9006] usb 4-1: USB disconnect, device number 13 [ 612.233416][ T9544] comedi comedi0: Minor 3 could not be opened [ 613.322316][ T6267] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 613.541990][ T6267] usb 2-1: Using ep0 maxpacket: 16 [ 613.560440][ T6267] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 613.593178][ T6267] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 613.679711][ T6267] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 613.733798][ T6267] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 613.757571][ T6267] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 613.797867][ T6267] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 614.291931][ T6267] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 614.300673][ T6267] usb 2-1: Manufacturer: syz [ 614.383315][ T6267] usb 2-1: config 0 descriptor?? [ 617.512081][ T6267] rc_core: IR keymap rc-hauppauge not found [ 617.526346][ T6267] Registered IR keymap rc-empty [ 617.538849][ T6267] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 617.586575][ T6267] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 617.635916][ T6267] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 617.685948][ T6267] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input23 [ 617.751491][ T6267] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 617.822420][ T6267] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 617.872203][ T6267] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 617.915415][ T6267] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 617.965626][ T6267] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 618.032493][ T6267] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 618.081966][ T6267] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 618.137191][ T6267] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 618.193271][ T6267] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 618.742022][ T6267] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 618.871883][ T6267] mceusb 2-1:0.0: Registered with mce emulator interface version 1 [ 618.880182][ T6267] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 618.928707][ T6267] usb 2-1: USB disconnect, device number 15 [ 619.206833][ T9582] SET target dimension over the limit! [ 619.858897][ T9586] comedi comedi0: Minor 3 could not be opened [ 620.321736][ T9589] binder: 9587:9589 ioctl 4018620d 0 returned -22 [ 620.350609][ T9589] binder: 9587:9589 unknown command 0 [ 620.357137][ T9589] binder: 9587:9589 ioctl c0306201 200000000040 returned -22 [ 622.201357][ T9614] SET target dimension over the limit! [ 622.383143][ T5824] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 622.822013][ T5824] usb 2-1: Using ep0 maxpacket: 16 [ 622.841717][ T5824] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 622.874513][ T5824] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 622.912232][ T5824] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 622.952037][ T5824] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 623.000907][ T5824] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 623.096594][ T9619] comedi comedi0: Minor 3 could not be opened [ 623.572974][ T5824] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 623.623301][ T5824] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 623.637309][ T5824] usb 2-1: Manufacturer: syz [ 623.648625][ T5824] usb 2-1: config 0 descriptor?? [ 624.461944][ T5824] rc_core: IR keymap rc-hauppauge not found [ 624.470741][ T5824] Registered IR keymap rc-empty [ 624.487460][ T5824] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 624.527053][ T9629] syzkaller0: entered promiscuous mode [ 624.532997][ T5824] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 624.540562][ T9629] syzkaller0: entered allmulticast mode [ 624.570711][ T5824] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 624.621326][ T5824] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input24 [ 624.643538][ T5824] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 624.672855][ T5824] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 624.729460][ T5824] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 624.782093][ T5824] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 625.346927][ T1288] ieee802154 phy0 wpan0: encryption failed: -22 [ 625.359810][ T1288] ieee802154 phy1 wpan1: encryption failed: -22 [ 625.422062][ T5824] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 625.465067][ T5824] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 625.507056][ T5824] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 625.507460][ T9639] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 625.539602][ T9639] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 625.548515][ T9639] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 625.557877][ T9639] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 625.562127][ T5824] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 625.589645][ T9639] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 625.597407][ T9639] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 625.615151][ T5785] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 625.632924][ T5785] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 625.645714][ T5785] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 625.655080][ T5785] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 625.663258][ T5785] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 625.673557][ T5785] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 625.721975][ T5824] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 625.761992][ T5824] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 625.832370][ T5824] mceusb 2-1:0.0: Registered with mce emulator interface version 1 [ 625.871397][ T5824] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 625.984353][ T9644] SET target dimension over the limit! [ 626.462442][ T5824] usb 2-1: USB disconnect, device number 16 [ 626.920683][ T9656] comedi comedi0: Minor 3 could not be opened [ 627.586239][ T9638] chnl_net:caif_netlink_parms(): no params data found [ 627.712138][ T9639] Bluetooth: hci4: command tx timeout [ 628.851642][ T9638] bridge0: port 1(bridge_slave_0) entered blocking state [ 628.895886][ T9638] bridge0: port 1(bridge_slave_0) entered disabled state [ 628.942521][ T9638] bridge_slave_0: entered allmulticast mode [ 629.002714][ T9638] bridge_slave_0: entered promiscuous mode [ 629.044530][ T9638] bridge0: port 2(bridge_slave_1) entered blocking state [ 629.061518][ T9638] bridge0: port 2(bridge_slave_1) entered disabled state [ 629.083432][ T9638] bridge_slave_1: entered allmulticast mode [ 629.107206][ T9638] bridge_slave_1: entered promiscuous mode [ 629.265803][ T12] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 629.501530][ T9668] syzkaller0: entered promiscuous mode [ 629.507537][ T9668] syzkaller0: entered allmulticast mode [ 629.797538][ T9639] Bluetooth: hci4: command tx timeout [ 630.442162][ T2179] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 630.635664][ T2179] usb 2-1: Using ep0 maxpacket: 16 [ 630.657024][ T2179] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 630.670828][ T2179] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 630.682853][ T2179] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 630.692927][ T2179] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 630.703143][ T2179] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 630.720685][ T2179] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 630.730667][ T2179] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 630.739594][ T2179] usb 2-1: Manufacturer: syz [ 630.755911][ T2179] usb 2-1: config 0 descriptor?? [ 631.081995][ T2179] rc_core: IR keymap rc-hauppauge not found [ 631.088165][ T2179] Registered IR keymap rc-empty [ 631.105113][ T2179] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 631.142131][ T2179] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 631.184963][ T2179] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 631.221666][ T2179] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input25 [ 631.248177][ T2179] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 631.294874][ T2179] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 631.322375][ T2179] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 631.362144][ T2179] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 631.412323][ T2179] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 631.472076][ T2179] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 631.511735][ T2179] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 631.552085][ T2179] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 631.615320][ T2179] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 631.662008][ T2179] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 631.705855][ T2179] mceusb 2-1:0.0: Registered with mce emulator interface version 1 [ 631.733427][ T2179] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 631.873358][ T9639] Bluetooth: hci4: command tx timeout [ 632.989277][ T12] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 633.035155][ T9638] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 633.114130][ T6484] usb 2-1: USB disconnect, device number 17 [ 633.189232][ T12] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 633.745017][ T9638] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 633.847266][ T12] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 633.904690][ T9638] team0: Port device team_slave_0 added [ 633.950215][ T9638] team0: Port device team_slave_1 added [ 633.957639][ T9639] Bluetooth: hci4: command tx timeout [ 634.090383][ T9690] overlayfs: failed to resolve './file1': -2 [ 634.125129][ T9638] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 634.143536][ T9638] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 634.171151][ T9638] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 634.302817][ T9693] comedi comedi0: Minor 3 could not be opened [ 634.737306][ T9638] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 634.766941][ T9638] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 634.799213][ T9638] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 635.018759][ T9698] syz.1.1017 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 635.090983][ T9638] hsr_slave_0: entered promiscuous mode [ 635.105677][ T9638] hsr_slave_1: entered promiscuous mode [ 635.201680][ T9702] binder_alloc: 9700: binder_alloc_buf, no vma [ 635.341977][ T788] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 635.603202][ T788] usb 2-1: config index 0 descriptor too short (expected 1572, got 36) [ 635.718002][ T788] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 635.951233][ T788] usb 2-1: New USB device found, idVendor=05ac, idProduct=0238, bcdDevice= 0.40 [ 635.981520][ T788] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 636.076711][ T788] usb 2-1: Product: syz [ 636.109322][ T788] usb 2-1: Manufacturer: syz [ 636.127023][ T788] usb 2-1: SerialNumber: syz [ 636.188920][ T9710] SET target dimension over the limit! [ 636.361536][ T788] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/input/input26 [ 636.852653][ T788] bcm5974 2-1:1.0: could not read from device [ 636.929015][ T5125] bcm5974 2-1:1.0: could not read from device [ 637.034916][ T788] input: failed to attach handler mousedev to device input26, error: -5 [ 637.096933][ T5125] bcm5974 2-1:1.0: could not read from device [ 637.122840][ T788] usb 2-1: USB disconnect, device number 18 [ 637.432416][ T2179] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 637.632585][ T2179] usb 1-1: Using ep0 maxpacket: 16 [ 637.652932][ T2179] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 637.690493][ T2179] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 637.704288][ T2179] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 637.747262][ T2179] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 637.790046][ T2179] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 637.862955][ T2179] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 637.897101][ T2179] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 637.935857][ T2179] usb 1-1: Manufacturer: syz [ 637.956439][ T2179] usb 1-1: config 0 descriptor?? [ 638.412779][ T2179] rc_core: IR keymap rc-hauppauge not found [ 638.458856][ T2179] Registered IR keymap rc-empty [ 638.538900][ T9732] comedi comedi0: Minor 3 could not be opened [ 638.975923][ T2179] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 638.996597][ T9638] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 639.064717][ T2179] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 639.160037][ T9638] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 639.167488][ T2179] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 639.215480][ T2179] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input27 [ 639.233855][ T9638] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 639.292516][ T2179] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 639.343950][ T2179] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 639.382186][ T2179] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 639.426204][ T9638] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 639.435012][ T2179] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 639.502466][ T2179] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 639.582530][ T2179] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 639.656692][ T2179] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 639.694110][ T2179] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 639.757281][ T2179] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 639.779859][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 639.811659][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 639.822203][ T2179] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 639.836061][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 639.857899][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 639.883957][ T12] bridge_slave_1: left allmulticast mode [ 639.894539][ T2179] mceusb 1-1:0.0: Registered with mce emulator interface version 1 [ 639.902409][ T12] bridge_slave_1: left promiscuous mode [ 639.915316][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 639.932818][ T2179] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 639.985180][ T12] bridge_slave_0: left allmulticast mode [ 639.996312][ T12] bridge_slave_0: left promiscuous mode [ 639.996596][ T2179] usb 1-1: USB disconnect, device number 15 [ 640.014004][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 640.208762][ T12] veth1_macvtap: left promiscuous mode [ 640.230457][ T12] veth0_macvtap: left promiscuous mode [ 640.271561][ T12] veth1_vlan: left promiscuous mode [ 640.305981][ T12] veth0_vlan: left promiscuous mode [ 641.640772][ T9768] SET target dimension over the limit! [ 642.317442][ T12] bond1 (unregistering): (slave bond0): Releasing backup interface [ 642.351386][ T12] bond1 (unregistering): Released all slaves [ 642.706847][ T9776] comedi comedi0: Minor 3 could not be opened [ 646.172752][ T9006] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 646.253866][ T12] team0 (unregistering): Port device team_slave_1 removed [ 646.306596][ T12] team0 (unregistering): Port device team_slave_0 removed [ 646.360639][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 646.370858][ T9006] usb 2-1: Using ep0 maxpacket: 16 [ 646.378943][ T9006] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 646.389366][ T9006] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 646.401196][ T9006] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 646.411593][ T9006] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 646.421634][ T9006] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 646.439386][ T9006] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 646.449330][ T9006] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 646.458081][ T9006] usb 2-1: Manufacturer: syz [ 646.466185][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 646.479453][ T9006] usb 2-1: config 0 descriptor?? [ 646.804584][ T9006] rc_core: IR keymap rc-hauppauge not found [ 646.810890][ T9006] Registered IR keymap rc-empty [ 646.816254][ T9006] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 646.854699][ T9006] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 646.913070][ T9006] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 646.938805][ T9006] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input28 [ 646.955743][ T12] bond0 (unregistering): Released all slaves [ 646.965728][ T9006] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 647.012160][ T9006] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 647.041990][ T9006] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 647.072176][ T9006] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 647.122034][ T9006] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 647.159796][ T9006] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 647.171414][ T9757] syzkaller0: entered promiscuous mode [ 647.184206][ T9757] syzkaller0: entered allmulticast mode [ 647.192243][ T9006] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 647.275537][ T9006] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 647.312258][ T9006] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 647.345705][ T9006] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 647.386595][ T9006] mceusb 2-1:0.0: Registered with mce emulator interface version 1 [ 647.399358][ T9006] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 647.428451][ T9006] usb 2-1: USB disconnect, device number 19 [ 648.997542][ T9799] SET target dimension over the limit! [ 650.641551][ T9638] 8021q: adding VLAN 0 to HW filter on device bond0 [ 650.731523][ T9638] 8021q: adding VLAN 0 to HW filter on device team0 [ 650.851288][ T8285] bridge0: port 1(bridge_slave_0) entered blocking state [ 650.858765][ T8285] bridge0: port 1(bridge_slave_0) entered forwarding state [ 650.914084][ T8285] bridge0: port 2(bridge_slave_1) entered blocking state [ 650.922248][ T8285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 651.158013][ T12] IPVS: stop unused estimator thread 0... [ 651.267049][ T9815] comedi comedi0: Minor 3 could not be opened [ 651.718449][ T9638] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 651.800358][ T9638] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 652.478478][ T9638] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 652.811902][ T788] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 653.012506][ T788] usb 4-1: Using ep0 maxpacket: 16 [ 653.045692][ T788] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 653.082415][ T788] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 653.101455][ T788] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 653.112161][ T788] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 653.132787][ T788] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 653.148246][ T788] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 653.182603][ T788] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 653.210655][ T788] usb 4-1: Manufacturer: syz [ 653.249032][ T788] usb 4-1: config 0 descriptor?? [ 653.566057][ T9852] netlink: 'syz.0.1045': attribute type 13 has an invalid length. [ 653.574775][ T9852] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1045'. [ 653.653917][ T9638] veth0_vlan: entered promiscuous mode [ 653.743296][ T9638] veth1_vlan: entered promiscuous mode [ 654.032776][ T788] rc_core: IR keymap rc-hauppauge not found [ 654.034998][ T9638] veth0_macvtap: entered promiscuous mode [ 654.038998][ T788] Registered IR keymap rc-empty [ 654.060924][ T788] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 654.078548][ T9638] veth1_macvtap: entered promiscuous mode [ 654.093533][ T788] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 654.129034][ T9638] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 654.146560][ T788] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 654.164827][ T788] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input29 [ 654.185385][ T9638] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 654.256457][ T9861] SET target dimension over the limit! [ 654.270781][ T788] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 654.355188][ T9638] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 654.376286][ T788] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 654.376679][ T9638] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 654.422822][ T788] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 654.428851][ T9638] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 654.463619][ T788] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 654.466740][ T9638] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 654.526647][ T788] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 654.572841][ T788] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 654.602475][ T788] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 654.632871][ T788] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 654.672776][ T788] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 654.702548][ T788] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 654.746323][ T788] mceusb 4-1:0.0: Registered with mce emulator interface version 1 [ 654.780730][ T788] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 654.825294][ T788] usb 4-1: USB disconnect, device number 14 [ 655.125455][ T9868] syzkaller0: entered promiscuous mode [ 655.160702][ T9868] syzkaller0: entered allmulticast mode [ 655.589765][ T9872] comedi comedi0: Minor 3 could not be opened [ 655.930661][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 655.949266][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 656.249498][ T34] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 659.030133][ T34] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 659.038136][ T9889] overlayfs: failed to resolve './file0': -2 [ 660.076062][ T9907] netlink: 'syz.4.1054': attribute type 13 has an invalid length. [ 660.084146][ T9907] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1054'. [ 660.794953][ T9916] SET target dimension over the limit! [ 661.639397][ T9925] comedi comedi0: Minor 3 could not be opened [ 661.783152][ T6484] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 662.042486][ T6484] usb 5-1: Using ep0 maxpacket: 16 [ 662.157816][ T9926] syzkaller0: entered promiscuous mode [ 662.163826][ T6484] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 662.183216][ T9926] syzkaller0: entered allmulticast mode [ 662.191021][ T6484] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 662.232155][ T6484] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 662.285211][ T6484] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 662.299065][ T6484] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 662.422861][ T9934] comedi comedi0: Minor 3 could not be opened [ 662.794810][ T6484] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 662.918319][ T6484] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 662.933845][ T6484] usb 5-1: Manufacturer: syz [ 662.957812][ T6484] usb 5-1: config 0 descriptor?? [ 666.599371][ T6484] rc_core: IR keymap rc-hauppauge not found [ 666.631881][ T6484] Registered IR keymap rc-empty [ 666.637528][ T6484] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 666.663968][ T9954] netlink: 'syz.1.1064': attribute type 13 has an invalid length. [ 666.671986][ T9954] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1064'. [ 666.722098][ T6484] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 666.763273][ T6484] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 666.789022][ T6484] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input30 [ 667.132674][ T6484] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 667.172147][ T6484] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 667.224706][ T6484] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 667.272555][ T6484] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 667.312611][ T6484] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 667.371699][ T9966] SET target dimension over the limit! [ 667.372863][ T6484] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 667.687872][ T6484] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 667.812465][ T6484] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 667.917189][ T6484] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 668.081957][ T9973] comedi comedi0: Minor 3 could not be opened [ 668.325439][ T6484] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 668.523995][ T6484] mceusb 5-1:0.0: Registered with mce emulator interface version 1 [ 668.544854][ T6484] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 668.617092][ T6484] usb 5-1: USB disconnect, device number 2 [ 672.986063][T10010] SET target dimension over the limit! [ 673.405868][T10013] netlink: 'syz.1.1077': attribute type 13 has an invalid length. [ 673.422051][T10013] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1077'. [ 673.985501][T10027] overlayfs: failed to resolve './file0': -2 [ 674.339399][T10037] comedi comedi0: Minor 3 could not be opened [ 678.859573][T10057] Cannot find add_set index 0 as target [ 679.809449][T10062] overlayfs: failed to resolve './file0': -2 [ 680.842837][T10077] comedi comedi0: Minor 3 could not be opened [ 680.862222][ T2179] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 681.072805][ T2179] usb 5-1: Using ep0 maxpacket: 16 [ 681.088343][ T2179] usb 5-1: too many configurations: 60, using maximum allowed: 8 [ 681.106796][ T2179] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 681.141224][ T2179] usb 5-1: config 0 has no interfaces? [ 681.171845][ T2179] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 681.205094][ T2179] usb 5-1: config 0 has no interfaces? [ 681.220138][ T2179] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 681.231889][ T2179] usb 5-1: config 0 has no interfaces? [ 681.246440][ T2179] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 681.258240][ T2179] usb 5-1: config 0 has no interfaces? [ 681.293179][ T2179] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 681.304179][ T2179] usb 5-1: config 0 has no interfaces? [ 681.328580][ T2179] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 681.340847][ T2179] usb 5-1: config 0 has no interfaces? [ 681.357122][ T2179] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 681.370790][ T2179] usb 5-1: config 0 has no interfaces? [ 681.386516][ T2179] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 681.431662][ T2179] usb 5-1: config 0 has no interfaces? [ 681.455318][ T2179] usb 5-1: New USB device found, idVendor=0471, idProduct=032c, bcdDevice=ba.e9 [ 681.483732][ T2179] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=204 [ 681.495397][ T2179] usb 5-1: Product: syz [ 681.499804][ T2179] usb 5-1: Manufacturer: syz [ 681.508502][ T2179] usb 5-1: SerialNumber: syz [ 681.537276][ T2179] usb 5-1: config 0 descriptor?? [ 684.670632][ T6483] usb 5-1: USB disconnect, device number 3 [ 685.430516][T10101] SET target dimension over the limit! [ 686.138141][T10107] overlayfs: failed to resolve './file0': -2 [ 686.277689][ T1288] ieee802154 phy0 wpan0: encryption failed: -22 [ 686.284891][ T1288] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.812445][T10120] netlink: 'syz.4.1102': attribute type 13 has an invalid length. [ 686.836747][T10120] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1102'. [ 695.313896][T10159] SET target dimension over the limit! [ 695.897830][T10160] comedi comedi0: Minor 3 could not be opened [ 696.368631][T10171] overlayfs: failed to resolve './file0': -2 [ 701.205087][T10196] syzkaller0: entered promiscuous mode [ 701.211389][T10196] syzkaller0: entered allmulticast mode [ 701.276826][T10207] syzkaller0: tun_chr_ioctl cmd 2147767520 [ 701.352603][ T8285] syzkaller0: tun_net_xmit 48 [ 701.503549][T10208] netlink: 'syz.1.1120': attribute type 13 has an invalid length. [ 701.560175][T10208] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1120'. [ 701.689524][T10196] syzkaller0: tun_net_xmit 1280 [ 701.952082][T10215] comedi comedi0: Minor 3 could not be opened [ 708.226753][T10255] comedi comedi0: Minor 3 could not be opened [ 710.865823][T10276] netlink: 'syz.4.1137': attribute type 13 has an invalid length. [ 710.874397][T10276] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1137'. [ 711.583100][T10295] comedi comedi0: Minor 3 could not be opened [ 713.442214][ T788] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 715.750139][ T788] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 715.765784][ T788] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 715.909865][ T788] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 715.929704][ T788] usb 4-1: config 0 descriptor?? [ 716.007016][T10328] netlink: 'syz.1.1150': attribute type 13 has an invalid length. [ 716.015166][T10328] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1150'. [ 716.051106][ T788] usb 4-1: can't set config #0, error -71 [ 716.266220][ T788] usb 4-1: USB disconnect, device number 15 [ 722.146800][T10379] comedi comedi0: Minor 3 could not be opened [ 723.149514][T10393] netlink: 'syz.3.1160': attribute type 13 has an invalid length. [ 723.157685][T10393] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1160'. [ 723.928634][ T5824] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 724.167476][ T5824] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 724.330932][ T5824] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 727.060040][ T5824] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 727.147839][ T5824] usb 2-1: config 0 descriptor?? [ 727.748401][ T5824] usb 2-1: can't set config #0, error -71 [ 727.756744][ T5824] usb 2-1: USB disconnect, device number 20 [ 728.315917][T10428] comedi comedi0: Minor 3 could not be opened [ 736.751897][ T6483] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 736.973717][ T6483] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 737.009370][ T6483] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 737.041887][ T6483] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 737.075694][ T6483] usb 5-1: config 0 descriptor?? [ 737.107548][ T6483] pwc: Askey VC010 type 2 USB webcam detected. [ 737.522597][ T6483] pwc: recv_control_msg error -32 req 02 val 2b00 [ 737.584454][ T6483] pwc: recv_control_msg error -32 req 02 val 2700 [ 737.651555][ T6483] pwc: recv_control_msg error -32 req 02 val 2c00 [ 737.701946][ T6483] pwc: recv_control_msg error -32 req 04 val 1000 [ 737.715920][ T6483] pwc: recv_control_msg error -32 req 04 val 1300 [ 737.745898][ T6483] pwc: recv_control_msg error -32 req 04 val 1400 [ 737.792931][ T6483] pwc: recv_control_msg error -32 req 02 val 2000 [ 737.814754][ T6483] pwc: recv_control_msg error -32 req 02 val 2100 [ 737.853374][ T6483] pwc: recv_control_msg error -32 req 04 val 1500 [ 737.878137][ T6483] pwc: recv_control_msg error -32 req 02 val 2500 [ 738.116947][ T6483] pwc: recv_control_msg error -71 req 02 val 2600 [ 738.157288][ T6483] pwc: recv_control_msg error -71 req 02 val 2900 [ 738.204565][ T6483] pwc: recv_control_msg error -71 req 02 val 2800 [ 738.265564][ T6483] pwc: recv_control_msg error -71 req 04 val 1100 [ 738.295010][ T6483] pwc: recv_control_msg error -71 req 04 val 1200 [ 738.342681][ T6483] pwc: Registered as video103. [ 738.376635][ T6483] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input31 [ 738.444687][ T6483] usb 5-1: USB disconnect, device number 4 [ 738.830758][T10503] comedi comedi0: Minor 3 could not be opened [ 743.744320][T10538] netlink: 'syz.1.1186': attribute type 13 has an invalid length. [ 743.775986][T10538] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1186'. [ 743.874263][T10540] comedi comedi0: Minor 3 could not be opened [ 747.828478][ T1288] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.838815][ T1288] ieee802154 phy1 wpan1: encryption failed: -22 [ 749.072211][T10569] syzkaller0: entered promiscuous mode [ 749.112126][T10569] syzkaller0: entered allmulticast mode [ 749.568211][T10586] overlayfs: failed to resolve './file1': -2 [ 751.792022][ T5785] Bluetooth: hci4: command 0x0406 tx timeout [ 752.971087][T10594] syzkaller0: entered promiscuous mode [ 753.001826][T10594] syzkaller0: entered allmulticast mode [ 753.063778][T10045] syzkaller0: tun_net_xmit 48 [ 753.679695][T10614] comedi comedi0: Minor 3 could not be opened [ 759.949687][T10627] netlink: 'syz.3.1204': attribute type 13 has an invalid length. [ 759.958450][T10627] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1204'. [ 765.092005][ T6484] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 765.445450][ T6484] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 765.481845][ T6484] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 765.491535][T10687] netlink: 'syz.3.1215': attribute type 13 has an invalid length. [ 765.511937][ T6484] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 765.514845][T10687] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1215'. [ 765.544551][ T6484] usb 5-1: config 0 descriptor?? [ 765.564625][ T6484] pwc: Askey VC010 type 2 USB webcam detected. [ 765.968483][ T6484] pwc: recv_control_msg error -32 req 02 val 2b00 [ 765.990517][ T6484] pwc: recv_control_msg error -32 req 02 val 2700 [ 766.001263][ T6484] pwc: recv_control_msg error -32 req 02 val 2c00 [ 766.013500][ T6484] pwc: recv_control_msg error -32 req 04 val 1000 [ 766.021461][ T6484] pwc: recv_control_msg error -32 req 04 val 1300 [ 766.037241][ T6484] pwc: recv_control_msg error -32 req 04 val 1400 [ 766.053124][ T6484] pwc: recv_control_msg error -32 req 02 val 2000 [ 766.070633][ T6484] pwc: recv_control_msg error -32 req 02 val 2100 [ 766.089459][ T6484] pwc: recv_control_msg error -32 req 04 val 1500 [ 766.097739][T10689] syzkaller0: entered promiscuous mode [ 766.100432][ T6484] pwc: recv_control_msg error -32 req 02 val 2500 [ 766.122718][ T6484] pwc: recv_control_msg error -71 req 02 val 2400 [ 766.127435][T10689] syzkaller0: entered allmulticast mode [ 766.129829][ T6484] pwc: recv_control_msg error -71 req 02 val 2600 [ 766.151836][ T6484] pwc: recv_control_msg error -71 req 02 val 2900 [ 766.161026][T10045] syzkaller0: tun_net_xmit 48 [ 766.166522][ T6484] pwc: recv_control_msg error -71 req 02 val 2800 [ 766.201205][ T6484] pwc: recv_control_msg error -71 req 04 val 1100 [ 766.216482][ T6484] pwc: recv_control_msg error -71 req 04 val 1200 [ 766.254800][ T6484] pwc: Registered as video103. [ 766.272854][ T6484] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input32 [ 766.340095][ T6484] usb 5-1: USB disconnect, device number 5 [ 775.229818][T10738] netlink: 'syz.1.1228': attribute type 13 has an invalid length. [ 775.241920][ T6484] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 775.271883][T10738] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1228'. [ 775.495305][ T6484] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 775.508649][ T6484] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 775.525423][ T6484] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 775.545163][ T6484] usb 5-1: config 0 descriptor?? [ 775.563586][ T6484] pwc: Askey VC010 type 2 USB webcam detected. [ 775.967898][ T6484] pwc: recv_control_msg error -32 req 02 val 2b00 [ 776.001880][ T6484] pwc: recv_control_msg error -32 req 02 val 2700 [ 776.012007][ T6484] pwc: recv_control_msg error -32 req 02 val 2c00 [ 776.041893][ T6484] pwc: recv_control_msg error -32 req 04 val 1000 [ 776.051843][ T6484] pwc: recv_control_msg error -32 req 04 val 1300 [ 776.082165][ T6484] pwc: recv_control_msg error -32 req 04 val 1400 [ 776.101987][ T6484] pwc: recv_control_msg error -32 req 02 val 2000 [ 776.121982][ T6484] pwc: recv_control_msg error -32 req 02 val 2100 [ 776.152006][ T6484] pwc: recv_control_msg error -32 req 04 val 1500 [ 776.161880][ T6484] pwc: recv_control_msg error -32 req 02 val 2500 [ 776.191937][ T6484] pwc: recv_control_msg error -71 req 02 val 2400 [ 776.222115][ T6484] pwc: recv_control_msg error -71 req 02 val 2600 [ 776.232141][ T6484] pwc: recv_control_msg error -71 req 02 val 2900 [ 776.261930][ T6484] pwc: recv_control_msg error -71 req 02 val 2800 [ 776.271901][ T6484] pwc: recv_control_msg error -71 req 04 val 1100 [ 776.301883][ T6484] pwc: recv_control_msg error -71 req 04 val 1200 [ 776.331583][ T6484] pwc: Registered as video103. [ 776.339219][ T6484] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input33 [ 776.384565][ T6484] usb 5-1: USB disconnect, device number 6 [ 777.786271][T10752] syzkaller0: entered promiscuous mode [ 777.801562][T10752] syzkaller0: entered allmulticast mode [ 777.838226][ T8285] syzkaller0: tun_net_xmit 48 [ 785.829267][T10791] comedi comedi0: Minor 3 could not be opened [ 788.038926][T10808] netlink: 'syz.1.1241': attribute type 13 has an invalid length. [ 788.083061][T10808] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1241'. [ 788.227485][T10809] syzkaller0: entered promiscuous mode [ 788.255674][T10809] syzkaller0: entered allmulticast mode [ 788.279271][ T12] syzkaller0: tun_net_xmit 48 [ 790.271986][ T5824] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 792.558808][ T5824] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 792.570262][ T5824] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 792.580484][ T5824] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 792.605518][ T5824] usb 2-1: config 0 descriptor?? [ 792.628191][ T5824] pwc: Askey VC010 type 2 USB webcam detected. [ 793.034357][ T5824] pwc: recv_control_msg error -32 req 02 val 2b00 [ 793.061473][ T5824] pwc: recv_control_msg error -32 req 02 val 2700 [ 793.078336][ T5824] pwc: recv_control_msg error -32 req 02 val 2c00 [ 793.088215][ T5824] pwc: recv_control_msg error -32 req 04 val 1000 [ 793.113604][ T5824] pwc: recv_control_msg error -32 req 04 val 1300 [ 793.121323][ T5824] pwc: recv_control_msg error -32 req 04 val 1400 [ 793.129337][ T5824] pwc: recv_control_msg error -32 req 02 val 2000 [ 793.137227][ T5824] pwc: recv_control_msg error -32 req 02 val 2100 [ 793.146050][ T5824] pwc: recv_control_msg error -32 req 04 val 1500 [ 793.366174][ T5824] pwc: recv_control_msg error -71 req 02 val 2400 [ 793.374607][ T5824] pwc: recv_control_msg error -71 req 02 val 2600 [ 793.381661][ T5824] pwc: recv_control_msg error -71 req 02 val 2900 [ 793.394520][ T5824] pwc: recv_control_msg error -71 req 02 val 2800 [ 793.404253][ T5824] pwc: recv_control_msg error -71 req 04 val 1100 [ 793.411305][ T5824] pwc: recv_control_msg error -71 req 04 val 1200 [ 793.421170][ T5824] pwc: Registered as video103. [ 793.434330][ T5824] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input34 [ 793.480839][ T5824] usb 2-1: USB disconnect, device number 21 [ 798.520305][T10863] comedi comedi0: Minor 3 could not be opened [ 799.259036][T10866] syzkaller0: entered promiscuous mode [ 799.287979][T10866] syzkaller0: entered allmulticast mode [ 799.311083][T10867] netlink: 'syz.3.1256': attribute type 13 has an invalid length. [ 799.328196][T10867] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1256'. [ 799.392649][ T1077] syzkaller0: tun_net_xmit 48 [ 807.523911][T10911] comedi comedi0: Minor 3 could not be opened [ 808.945358][T10923] netlink: 'syz.1.1270': attribute type 13 has an invalid length. [ 809.018333][T10923] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1270'. [ 809.172475][ T1288] ieee802154 phy0 wpan0: encryption failed: -22 [ 809.178965][ T1288] ieee802154 phy1 wpan1: encryption failed: -22 [ 809.723641][T10934] syzkaller0: entered promiscuous mode [ 809.733959][T10934] syzkaller0: entered allmulticast mode [ 809.883401][T10937] syzkaller0: entered promiscuous mode [ 809.891897][T10937] syzkaller0: entered allmulticast mode [ 809.909715][ T1077] syzkaller0: tun_net_xmit 48 [ 810.070472][T10942] comedi comedi0: Minor 3 could not be opened [ 813.879354][ C1] syzkaller0: tun_net_xmit 48 [ 817.837933][T10973] comedi comedi0: Minor 3 could not be opened [ 819.785392][T10979] netlink: 'syz.4.1289': attribute type 13 has an invalid length. [ 819.807058][T10979] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1289'. [ 820.220615][T10984] syzkaller0: entered promiscuous mode [ 820.266808][T10984] syzkaller0: entered allmulticast mode [ 821.843095][T11003] comedi comedi0: Minor 3 could not be opened [ 825.645809][T11018] netlink: 'syz.4.1301': attribute type 13 has an invalid length. [ 825.661796][T11018] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1301'. [ 826.885133][ T5785] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 826.911010][ T5785] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 826.923048][ T5785] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 826.937314][ T5785] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 826.954626][ T5785] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 826.962659][ T5785] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 827.702002][T11028] chnl_net:caif_netlink_parms(): no params data found [ 827.942149][T11043] comedi comedi0: Minor 3 could not be opened [ 828.636251][T11028] bridge0: port 1(bridge_slave_0) entered blocking state [ 828.651518][T11028] bridge0: port 1(bridge_slave_0) entered disabled state [ 828.668547][T11028] bridge_slave_0: entered allmulticast mode [ 828.687415][T11028] bridge_slave_0: entered promiscuous mode [ 828.698479][T11028] bridge0: port 2(bridge_slave_1) entered blocking state [ 828.706003][T11028] bridge0: port 2(bridge_slave_1) entered disabled state [ 828.713571][T11028] bridge_slave_1: entered allmulticast mode [ 828.721438][T11028] bridge_slave_1: entered promiscuous mode [ 828.814210][T11028] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 828.829669][T11055] overlayfs: missing 'lowerdir' [ 828.838495][T11028] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 828.972267][T11028] team0: Port device team_slave_0 added [ 828.992488][ T5785] Bluetooth: hci3: command tx timeout [ 828.998294][T11028] team0: Port device team_slave_1 added [ 829.126684][T11028] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 829.138945][T11028] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 829.166748][T11028] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 829.248232][T11028] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 829.260940][T11028] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 829.315970][T11028] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 829.650528][T11028] hsr_slave_0: entered promiscuous mode [ 829.669534][T11028] hsr_slave_1: entered promiscuous mode [ 829.693034][T11028] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 829.712139][T11028] Cannot create hsr debugfs directory [ 829.801921][T10332] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 830.004758][T10332] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 830.019172][T10332] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 830.129643][T10332] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 830.171638][T10332] usb 4-1: config 0 descriptor?? [ 830.194005][T10332] pwc: Askey VC010 type 2 USB webcam detected. [ 830.593835][T11085] comedi comedi0: Minor 3 could not be opened [ 830.629692][T10332] pwc: recv_control_msg error -32 req 02 val 2b00 [ 830.734731][T10332] pwc: recv_control_msg error -32 req 02 val 2700 [ 831.089639][ T5785] Bluetooth: hci3: command tx timeout [ 831.169936][T10332] pwc: recv_control_msg error -32 req 02 val 2c00 [ 831.188200][T10332] pwc: recv_control_msg error -32 req 04 val 1000 [ 831.203774][T10332] pwc: recv_control_msg error -32 req 04 val 1300 [ 831.217350][T10332] pwc: recv_control_msg error -32 req 04 val 1400 [ 831.226603][T10332] pwc: recv_control_msg error -32 req 02 val 2000 [ 831.236797][T10332] pwc: recv_control_msg error -32 req 02 val 2100 [ 831.245982][T10332] pwc: recv_control_msg error -32 req 04 val 1500 [ 831.473450][T10332] pwc: recv_control_msg error -71 req 02 val 2400 [ 831.490947][T10332] pwc: recv_control_msg error -71 req 02 val 2600 [ 831.512716][T10332] pwc: recv_control_msg error -71 req 02 val 2900 [ 831.531044][T10332] pwc: recv_control_msg error -71 req 02 val 2800 [ 831.561667][T10332] pwc: recv_control_msg error -71 req 04 val 1100 [ 831.577647][T10332] pwc: recv_control_msg error -71 req 04 val 1200 [ 831.599488][T10332] pwc: Registered as video103. [ 831.632838][T10332] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input35 [ 831.691504][T10332] usb 4-1: USB disconnect, device number 16 [ 831.999245][T10045] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 832.042835][T10045] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 832.069709][T10045] bridge_slave_1: left allmulticast mode [ 832.085000][T10045] bridge_slave_1: left promiscuous mode [ 832.099251][T11099] overlayfs: missing 'lowerdir' [ 832.104737][T10045] bridge0: port 2(bridge_slave_1) entered disabled state [ 832.137333][T10045] bridge_slave_0: left allmulticast mode [ 832.143172][T10045] bridge_slave_0: left promiscuous mode [ 832.152338][T10045] bridge0: port 1(bridge_slave_0) entered disabled state [ 832.189005][T10045] bond1 (unregistering): (slave bond0): Releasing backup interface [ 832.215217][T10045] bond1 (unregistering): Released all slaves [ 833.151993][ T5785] Bluetooth: hci3: command tx timeout [ 833.656482][ T28] audit: type=1326 audit(1777662537.073:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11111 comm="syz.4.1326" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fab47f9cdd9 code=0x7ffc0000 [ 833.700251][ T28] audit: type=1326 audit(1777662537.073:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11111 comm="syz.4.1326" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fab47f9cdd9 code=0x7ffc0000 [ 833.726193][ T28] audit: type=1326 audit(1777662537.113:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11111 comm="syz.4.1326" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fab47f9cdd9 code=0x7ffc0000 [ 833.733434][T10045] team0 (unregistering): Port device team_slave_1 removed [ 833.791369][ T28] audit: type=1326 audit(1777662537.113:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11111 comm="syz.4.1326" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fab47f9cdd9 code=0x7ffc0000 [ 833.850784][ T28] audit: type=1326 audit(1777662537.123:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11111 comm="syz.4.1326" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=104 compat=0 ip=0x7fab47f9cdd9 code=0x7ffc0000 [ 833.888806][ T28] audit: type=1326 audit(1777662537.123:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11111 comm="syz.4.1326" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fab47f9cdd9 code=0x7ffc0000 [ 833.915298][ T28] audit: type=1326 audit(1777662537.123:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11111 comm="syz.4.1326" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fab47f9cdd9 code=0x7ffc0000 [ 833.971521][ T28] audit: type=1326 audit(1777662537.143:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11111 comm="syz.4.1326" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fab47f9cdd9 code=0x7ffc0000 [ 834.066346][T11115] comedi comedi0: Minor 3 could not be opened [ 834.105947][T10045] team0 (unregistering): Port device team_slave_0 removed [ 834.242201][ T28] audit: type=1326 audit(1777662537.143:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11111 comm="syz.4.1326" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fab47f9cdd9 code=0x7ffc0000 [ 834.475781][ T28] audit: type=1326 audit(1777662537.153:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11111 comm="syz.4.1326" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=312 compat=0 ip=0x7fab47f9cdd9 code=0x7ffc0000 [ 834.626708][T10045] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 834.761060][T10045] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 834.945502][T11120] loop4: detected capacity change from 0 to 512 [ 835.059016][T11120] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 835.104356][T11120] ext4 filesystem being mounted at /75/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 835.109713][T11124] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 835.125036][T11124] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 835.231853][ T5785] Bluetooth: hci3: command tx timeout [ 835.236649][ T9638] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 835.586634][T10045] bond0 (unregistering): Released all slaves [ 835.711385][T11130] loop2: detected capacity change from 0 to 7 [ 835.725225][T11130] Dev loop2: unable to read RDB block 7 [ 835.736613][T11130] loop2: unable to read partition table [ 835.743765][T11130] loop2: partition table beyond EOD, truncated [ 835.750116][T11130] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 835.936479][T11028] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 835.971343][T11028] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 835.999106][T11028] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 836.044901][T11028] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 837.181260][T11028] 8021q: adding VLAN 0 to HW filter on device bond0 [ 837.265393][T11028] 8021q: adding VLAN 0 to HW filter on device team0 [ 837.285620][T10045] IPVS: stop unused estimator thread 0... [ 837.318479][ T34] bridge0: port 1(bridge_slave_0) entered blocking state [ 837.326024][ T34] bridge0: port 1(bridge_slave_0) entered forwarding state [ 837.373309][ T34] bridge0: port 2(bridge_slave_1) entered blocking state [ 837.380811][ T34] bridge0: port 2(bridge_slave_1) entered forwarding state [ 837.697427][T11155] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 837.741939][T11155] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 837.970284][T11028] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 838.849433][T11028] veth0_vlan: entered promiscuous mode [ 838.887408][T11028] veth1_vlan: entered promiscuous mode [ 838.989262][T11028] veth0_macvtap: entered promiscuous mode [ 839.015829][T11028] veth1_macvtap: entered promiscuous mode [ 839.091997][T11028] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 839.111246][T11028] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 839.128841][T11028] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 839.171615][T11028] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 839.195235][T11028] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 839.216058][T11028] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 839.243019][T11028] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 839.260398][T11028] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 839.287957][T11028] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 839.311127][T11028] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 839.518132][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 839.556864][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 839.596609][T11201] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 839.642171][T11201] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 839.657086][ T2102] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 839.680338][ T2102] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 841.913781][ T5824] usb 2-1: new full-speed USB device number 22 using dummy_hcd [ 842.601789][ T5824] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 842.639389][ T5824] usb 2-1: too many endpoints for config 1 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 842.687186][ T5824] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 842.703436][ T5824] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 842.712953][ T5824] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 842.721349][ T5824] usb 2-1: SerialNumber: syz [ 842.736575][ T5824] cdc_acm 2-1:1.0: Control and data interfaces are not separated! [ 842.745410][ T5824] cdc_acm 2-1:1.0: This needs exactly 3 endpoints [ 842.753795][ T5824] cdc_acm: probe of 2-1:1.0 failed with error -22 [ 842.932582][ T2179] usb 2-1: USB disconnect, device number 22 [ 843.471840][ T2179] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 843.675114][ T2179] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 843.691242][ T2179] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 843.701107][ T2179] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 843.719911][ T2179] usb 5-1: config 0 descriptor?? [ 843.740329][ T2179] pwc: Askey VC010 type 2 USB webcam detected. [ 844.172909][ T2179] pwc: recv_control_msg error -32 req 02 val 2b00 [ 844.216357][ T2179] pwc: recv_control_msg error -32 req 02 val 2700 [ 844.249177][ T2179] pwc: recv_control_msg error -32 req 02 val 2c00 [ 844.276682][ T2179] pwc: recv_control_msg error -32 req 04 val 1000 [ 844.291181][ T2179] pwc: recv_control_msg error -32 req 04 val 1300 [ 844.308108][ T2179] pwc: recv_control_msg error -32 req 04 val 1400 [ 844.324706][ T2179] pwc: recv_control_msg error -32 req 02 val 2000 [ 844.343370][ T2179] pwc: recv_control_msg error -32 req 02 val 2100 [ 844.358442][ T2179] pwc: recv_control_msg error -32 req 04 val 1500 [ 844.584290][ T2179] pwc: recv_control_msg error -71 req 02 val 2400 [ 844.587309][T11246] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 844.593023][ T2179] pwc: recv_control_msg error -71 req 02 val 2600 [ 844.612112][ T2179] pwc: recv_control_msg error -71 req 02 val 2900 [ 844.621325][ T2179] pwc: recv_control_msg error -71 req 02 val 2800 [ 844.631450][ T2179] pwc: recv_control_msg error -71 req 04 val 1100 [ 844.640960][ T2179] pwc: recv_control_msg error -71 req 04 val 1200 [ 844.694155][ T2179] pwc: Registered as video103. [ 844.727028][ T2179] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input36 [ 844.775643][ T2179] usb 5-1: USB disconnect, device number 7 [ 845.814999][T11284] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 846.746108][T11292] tipc: Started in network mode [ 846.751276][T11292] tipc: Node identity fe80000000000000000000000000001, cluster identity 4711 [ 846.805792][T11292] tipc: Enabled bearer , priority 10 [ 847.872739][ T6483] tipc: Node number set to 4269801488 [ 848.038957][T11296] syz.3.1369 (11296): drop_caches: 2 [ 848.281877][ T2179] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 848.491190][ T2179] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 848.533662][ T2179] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 848.599283][ T2179] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 848.649623][T11319] comedi comedi0: Minor 3 could not be opened [ 848.652580][ T2179] usb 5-1: config 0 descriptor?? [ 848.691929][ T2179] pwc: Askey VC010 type 2 USB webcam detected. [ 848.762845][ T6483] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 849.137514][ T6483] usb 4-1: config 0 has no interfaces? [ 849.188123][ T6483] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 849.266850][ T6483] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 849.283840][ T2179] pwc: recv_control_msg error -32 req 02 val 2b00 [ 849.293182][ T2179] pwc: recv_control_msg error -32 req 02 val 2700 [ 849.301584][ T2179] pwc: recv_control_msg error -32 req 02 val 2c00 [ 849.301845][ T6483] usb 4-1: config 0 descriptor?? [ 849.334057][ T2179] pwc: recv_control_msg error -32 req 04 val 1000 [ 849.634977][ T6483] usb 4-1: USB disconnect, device number 17 [ 850.524040][T11335] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 851.105944][T11363] comedi comedi0: Minor 2 could not be opened [ 851.788585][ T2179] pwc: recv_control_msg error -71 req 04 val 1300 [ 851.832900][ T2179] pwc: recv_control_msg error -71 req 04 val 1400 [ 851.855113][ T2179] pwc: recv_control_msg error -71 req 02 val 2000 [ 851.874008][ T2179] pwc: recv_control_msg error -71 req 02 val 2100 [ 851.901852][ T2179] pwc: recv_control_msg error -71 req 04 val 1500 [ 851.913686][ T2179] pwc: recv_control_msg error -71 req 02 val 2500 [ 851.924646][ T2179] pwc: recv_control_msg error -71 req 02 val 2400 [ 851.933882][ T2179] pwc: recv_control_msg error -71 req 02 val 2600 [ 851.982157][ T2179] pwc: recv_control_msg error -71 req 02 val 2900 [ 852.011930][ T2179] pwc: recv_control_msg error -71 req 02 val 2800 [ 852.068681][ T2179] pwc: recv_control_msg error -71 req 04 val 1100 [ 852.129382][ T2179] pwc: recv_control_msg error -71 req 04 val 1200 [ 852.223288][ T2179] pwc: Registered as video103. [ 852.258056][ T2179] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input37 [ 852.348691][ T2179] usb 5-1: USB disconnect, device number 8 [ 852.696248][T11380] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 852.732490][T11381] 9pnet_fd: Insufficient options for proto=fd [ 853.344049][T11397] loop4: detected capacity change from 0 to 64 [ 853.466333][ T28] kauditd_printk_skb: 4 callbacks suppressed [ 853.466350][ T28] audit: type=1800 audit(1777662556.883:17): pid=11397 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.1395" name="file1" dev="loop4" ino=21 res=0 errno=0 [ 853.601954][ T5824] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 853.847769][ T5824] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 853.912230][T11410] comedi comedi0: Minor 2 could not be opened [ 854.302512][ T5824] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 854.382001][T11413] 9pnet_fd: Insufficient options for proto=fd [ 854.409471][ T5824] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 854.459345][ T5824] usb 4-1: config 0 descriptor?? [ 854.486265][ T5824] pwc: Askey VC010 type 2 USB webcam detected. [ 855.346033][ T5824] pwc: recv_control_msg error -32 req 02 val 2b00 [ 855.376368][ T5824] pwc: recv_control_msg error -32 req 02 val 2700 [ 855.500811][ T5824] pwc: recv_control_msg error -32 req 02 val 2c00 [ 855.525053][ T5824] pwc: recv_control_msg error -32 req 04 val 1000 [ 855.545451][ T5824] pwc: recv_control_msg error -32 req 04 val 1300 [ 855.572555][ T5824] pwc: recv_control_msg error -32 req 04 val 1400 [ 856.575478][ T5824] pwc: recv_control_msg error -32 req 02 val 2000 [ 856.583662][ T5824] pwc: recv_control_msg error -32 req 02 val 2100 [ 856.688582][ T5824] pwc: recv_control_msg error -71 req 04 val 1500 [ 856.729323][ T5824] pwc: recv_control_msg error -71 req 02 val 2500 [ 856.757418][ T5824] pwc: recv_control_msg error -71 req 02 val 2400 [ 856.782766][ T5824] pwc: recv_control_msg error -71 req 02 val 2600 [ 856.831866][ T5824] pwc: recv_control_msg error -71 req 02 val 2900 [ 856.848124][ T5824] pwc: recv_control_msg error -71 req 02 val 2800 [ 856.865819][ T5824] pwc: recv_control_msg error -71 req 04 val 1100 [ 856.890073][ T5824] pwc: recv_control_msg error -71 req 04 val 1200 [ 856.909713][ T5824] pwc: Registered as video103. [ 856.957355][ T5824] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input38 [ 857.012107][ T5824] usb 4-1: USB disconnect, device number 18 [ 857.485874][T11450] loop4: detected capacity change from 0 to 128 [ 857.581937][ T5824] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 857.818256][ T5824] usb 6-1: Using ep0 maxpacket: 8 [ 857.854178][ T5824] usb 6-1: config 179 has an invalid interface number: 65 but max is 0 [ 857.881863][ T5824] usb 6-1: config 179 has no interface number 0 [ 857.902185][ T5824] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 857.922139][ T5824] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 860.806464][ T5824] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 860.817961][ T5824] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 860.830285][ T5824] usb 6-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 860.844241][ T5824] usb 6-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 860.853601][ T5824] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 861.596250][ T5824] usb 6-1: can't set config #179, error -71 [ 861.629187][ T5824] usb 6-1: USB disconnect, device number 2 [ 863.641900][ T788] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 864.671366][ T788] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 864.686833][ T788] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 864.696950][ T788] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 864.708061][ T788] usb 4-1: config 0 descriptor?? [ 864.718190][ T788] pwc: Askey VC010 type 2 USB webcam detected. [ 865.147170][ T788] pwc: recv_control_msg error -32 req 02 val 2b00 [ 865.166264][ T788] pwc: recv_control_msg error -32 req 02 val 2700 [ 865.186494][ T788] pwc: recv_control_msg error -32 req 02 val 2c00 [ 865.202673][ T788] pwc: recv_control_msg error -32 req 04 val 1000 [ 865.213129][ T788] pwc: recv_control_msg error -32 req 04 val 1300 [ 865.252884][ T788] pwc: recv_control_msg error -32 req 04 val 1400 [ 865.266405][ T788] pwc: recv_control_msg error -32 req 02 val 2000 [ 865.300071][ T788] pwc: recv_control_msg error -32 req 02 val 2100 [ 865.324659][ T788] pwc: recv_control_msg error -32 req 04 val 1500 [ 865.491846][T11529] loop5: detected capacity change from 0 to 32768 [ 865.515082][T11529] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop5 scanned by syz.5.1424 (11529) [ 865.551274][T11529] BTRFS info (device loop5): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 865.553293][ T788] pwc: recv_control_msg error -71 req 02 val 2400 [ 865.562691][T11529] BTRFS info (device loop5): using crc32c (crc32c-intel) checksum algorithm [ 865.578578][T11529] BTRFS info (device loop5): turning on sync discard [ 865.585974][T11529] BTRFS info (device loop5): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 865.596206][T11529] BTRFS info (device loop5): use zstd compression, level 3 [ 865.605305][T11529] BTRFS info (device loop5): turning on async discard [ 865.606629][ T788] pwc: recv_control_msg error -71 req 02 val 2600 [ 865.612896][T11529] BTRFS warning (device loop5): 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 865.630786][T11529] BTRFS info (device loop5): trying to use backup root at mount time [ 865.639803][T11529] BTRFS info (device loop5): enabling auto defrag [ 865.646790][T11529] BTRFS info (device loop5): using free space tree [ 865.669493][ T788] pwc: recv_control_msg error -71 req 02 val 2900 [ 865.702633][ T788] pwc: recv_control_msg error -71 req 02 val 2800 [ 865.730687][ T788] pwc: recv_control_msg error -71 req 04 val 1100 [ 865.738358][ T59] BTRFS warning (device loop5): checksum verify failed on logical 5337088 mirror 1 wanted 0xe63dbdda found 0xc926492d level 0 [ 865.760034][ T788] pwc: recv_control_msg error -71 req 04 val 1200 [ 865.767819][T11529] BTRFS error (device loop5): failed to load root extent [ 865.769697][ T788] pwc: Registered as video103. [ 865.775311][T11529] BTRFS warning (device loop5): try to load backup roots slot 1 [ 865.789528][ T59] BTRFS warning (device loop5): checksum verify failed on logical 5324800 mirror 1 wanted 0x9f73850b found 0x80379423 level 0 [ 865.817662][T11529] BTRFS warning (device loop5): couldn't read tree root [ 865.820031][ T788] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input39 [ 865.825954][T11529] BTRFS warning (device loop5): try to load backup roots slot 2 [ 865.843826][ T2102] BTRFS error (device loop5): level verify failed on logical 5255168 mirror 1 wanted 0 found 1 [ 865.895299][T11529] BTRFS warning (device loop5): couldn't read tree root [ 865.902637][T11529] BTRFS warning (device loop5): try to load backup roots slot 3 [ 865.930734][ T788] usb 4-1: USB disconnect, device number 19 [ 865.980732][T11529] BTRFS info (device loop5): enabling ssd optimizations [ 865.991101][T11529] BTRFS info (device loop5): rebuilding free space tree [ 866.119870][T11529] BTRFS info (device loop5): checking UUID tree [ 866.233390][T11552] binder_alloc: 11551: binder_alloc_buf, no vma [ 868.397781][T11028] BTRFS info (device loop5): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 869.749356][T11617] Illegal XDP return value 4291395584 on prog (id 19) dev syz_tun, expect packet loss! [ 870.267839][T11626] loop5: detected capacity change from 0 to 512 [ 870.630137][T11626] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 870.644010][ T1288] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.650659][ T1288] ieee802154 phy1 wpan1: encryption failed: -22 [ 871.128352][T11028] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 872.199022][T11649] loop2: detected capacity change from 0 to 7 [ 872.238046][T11649] Dev loop2: unable to read RDB block 7 [ 872.258068][T11649] loop2: unable to read partition table [ 872.282225][T11649] loop2: partition table beyond EOD, truncated [ 872.308681][T11649] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 873.845698][T11679] binder: 11678:11679 unknown command 1074553619 [ 873.880730][T11679] binder: 11678:11679 ioctl c0306201 200000000040 returned -22 [ 874.022517][T11686] netlink: 209852 bytes leftover after parsing attributes in process `syz.4.1463'. [ 874.263735][ T28] audit: type=1326 audit(1777662577.623:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11687 comm="syz.5.1464" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5cfbb9cdd9 code=0x7ffc0000 [ 874.557442][ T28] audit: type=1326 audit(1777662577.623:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11687 comm="syz.5.1464" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5cfbb9cdd9 code=0x7ffc0000 [ 878.157709][ T8] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 878.361224][ T8] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 878.377382][ T8] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 878.406967][ T8] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 878.423008][ T8] usb 4-1: config 0 descriptor?? [ 878.464421][ T8] pwc: Askey VC010 type 2 USB webcam detected. [ 879.414541][ T8] pwc: recv_control_msg error -32 req 02 val 2b00 [ 879.431839][ T8] pwc: recv_control_msg error -32 req 02 val 2700 [ 879.439213][ T8] pwc: recv_control_msg error -32 req 02 val 2c00 [ 879.461839][ T8] pwc: recv_control_msg error -32 req 04 val 1000 [ 879.472471][ T8] pwc: recv_control_msg error -32 req 04 val 1300 [ 879.479676][ T8] pwc: recv_control_msg error -32 req 04 val 1400 [ 879.493110][ T8] pwc: recv_control_msg error -32 req 02 val 2000 [ 879.511860][ T8] pwc: recv_control_msg error -32 req 02 val 2100 [ 879.523978][ T8] pwc: recv_control_msg error -32 req 04 val 1500 [ 879.754753][ T8] pwc: recv_control_msg error -71 req 02 val 2400 [ 879.770963][ T8] pwc: recv_control_msg error -71 req 02 val 2600 [ 879.791804][ T8] pwc: recv_control_msg error -71 req 02 val 2900 [ 879.816161][ T8] pwc: recv_control_msg error -71 req 02 val 2800 [ 879.851993][ T8] pwc: recv_control_msg error -71 req 04 val 1100 [ 879.878692][ T8] pwc: recv_control_msg error -71 req 04 val 1200 [ 879.917807][ T8] pwc: Registered as video103. [ 879.945715][ T8] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input40 [ 879.988759][ T8] usb 4-1: USB disconnect, device number 20 [ 882.444610][T11790] syzkaller0: tun_chr_ioctl cmd 2147767520 [ 882.564196][T11796] netlink: 268 bytes leftover after parsing attributes in process `syz.3.1487'. [ 882.609215][T11796] netlink: 136 bytes leftover after parsing attributes in process `syz.3.1487'. [ 882.640599][T11796] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1487'. [ 883.949970][T11814] loop3: detected capacity change from 0 to 2048 [ 884.070897][T10262] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 884.172971][ T6483] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 884.366976][ T6483] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 884.395438][ T6483] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 884.416261][ T6483] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 884.454588][ T6483] usb 5-1: config 0 descriptor?? [ 884.483700][ T6483] pwc: Askey VC010 type 2 USB webcam detected. [ 884.780879][T11830] binder: BINDER_SET_CONTEXT_MGR already set [ 884.810700][T11830] binder: 11829:11830 ioctl 4018620d 200000004a80 returned -16 [ 884.901496][ T6483] pwc: recv_control_msg error -32 req 02 val 2b00 [ 884.932643][ T6483] pwc: recv_control_msg error -32 req 02 val 2700 [ 884.952777][ T6483] pwc: recv_control_msg error -32 req 02 val 2c00 [ 884.981907][ T6483] pwc: recv_control_msg error -32 req 04 val 1000 [ 885.022019][ T6483] pwc: recv_control_msg error -32 req 04 val 1300 [ 885.042322][ T6483] pwc: recv_control_msg error -32 req 04 val 1400 [ 885.066641][ T6483] pwc: recv_control_msg error -32 req 02 val 2000 [ 885.085802][ T6483] pwc: recv_control_msg error -32 req 02 val 2100 [ 885.112631][ T6483] pwc: recv_control_msg error -32 req 04 val 1500 [ 885.161259][T11836] syzkaller0: tun_chr_ioctl cmd 2147767520 [ 885.322287][ T6483] pwc: recv_control_msg error -71 req 02 val 2400 [ 885.351831][ T6483] pwc: recv_control_msg error -71 req 02 val 2600 [ 885.358977][ T6483] pwc: recv_control_msg error -71 req 02 val 2900 [ 885.391941][ T6483] pwc: recv_control_msg error -71 req 02 val 2800 [ 885.405702][ T6483] pwc: recv_control_msg error -71 req 04 val 1100 [ 885.435628][ T6483] pwc: recv_control_msg error -71 req 04 val 1200 [ 885.462607][ T6483] pwc: Registered as video103. [ 885.469642][ T6483] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input41 [ 885.572053][ T6483] usb 5-1: USB disconnect, device number 9 [ 887.385133][T11875] binder_alloc: 11874: binder_alloc_buf, no vma [ 887.611210][T11883] netlink: 'syz.1.1503': attribute type 13 has an invalid length. [ 887.708203][T11883] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1503'. [ 888.968671][T11907] loop5: detected capacity change from 0 to 8192 [ 890.578184][T11933] syzkaller0: tun_chr_ioctl cmd 2147767520 [ 892.685611][T11981] syzkaller0: tun_chr_ioctl cmd 2147767520 [ 893.011025][T11990] loop2: detected capacity change from 0 to 7 [ 893.026572][T11093] Dev loop2: unable to read RDB block 7 [ 893.034931][T11093] loop2: AHDI p1 p2 p3 [ 893.039187][T11093] loop2: partition table partially beyond EOD, truncated [ 893.048250][T11093] loop2: p1 start 1601398130 is beyond EOD, truncated [ 893.055978][T11093] loop2: p2 start 1702059890 is beyond EOD, truncated [ 893.073971][T11990] Dev loop2: unable to read RDB block 7 [ 893.091988][T11990] loop2: AHDI p1 p2 p3 [ 893.096648][T11990] loop2: partition table partially beyond EOD, truncated [ 893.113774][T11990] loop2: p1 start 1601398130 is beyond EOD, truncated [ 893.132161][T11990] loop2: p2 start 1702059890 is beyond EOD, truncated [ 893.263070][ T788] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 893.478037][ T788] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 893.511928][ T788] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 893.561795][ T788] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 893.583233][ T788] usb 6-1: config 0 descriptor?? [ 893.606608][ T788] pwc: Askey VC010 type 2 USB webcam detected. [ 894.113740][T12016] netlink: 'syz.3.1535': attribute type 13 has an invalid length. [ 894.362416][T12016] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1535'. [ 894.811820][ T788] pwc: recv_control_msg error -32 req 02 val 2b00 [ 894.825604][ T788] pwc: recv_control_msg error -32 req 02 val 2700 [ 894.839939][ T788] pwc: recv_control_msg error -32 req 02 val 2c00 [ 894.849096][ T788] pwc: recv_control_msg error -32 req 04 val 1000 [ 894.856549][ T788] pwc: recv_control_msg error -32 req 04 val 1300 [ 894.866299][ T788] pwc: recv_control_msg error -32 req 04 val 1400 [ 894.881888][ T788] pwc: recv_control_msg error -32 req 02 val 2000 [ 894.890495][ T788] pwc: recv_control_msg error -32 req 02 val 2100 [ 894.916204][ T788] pwc: recv_control_msg error -32 req 04 val 1500 [ 895.129863][ T788] pwc: recv_control_msg error -71 req 02 val 2400 [ 895.358032][ T788] pwc: recv_control_msg error -71 req 02 val 2600 [ 895.365847][ T788] pwc: recv_control_msg error -71 req 02 val 2900 [ 895.373771][ T788] pwc: recv_control_msg error -71 req 02 val 2800 [ 895.380888][ T788] pwc: recv_control_msg error -71 req 04 val 1100 [ 895.388082][ T788] pwc: recv_control_msg error -71 req 04 val 1200 [ 895.403479][ T788] pwc: Registered as video103. [ 895.431986][ T788] input: PWC snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/input/input42 [ 895.472011][ T788] usb 6-1: USB disconnect, device number 3 [ 895.492293][T12031] syzkaller0: entered promiscuous mode [ 895.511320][T12031] syzkaller0: entered allmulticast mode [ 896.214339][T12043] Set syz0 is full, maxelem 0 reached [ 896.503847][T10332] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 896.739113][T10332] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 896.750328][T10332] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 896.771918][T10332] usb 5-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 896.781598][T10332] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 896.796452][T10332] usb 5-1: Product: syz [ 896.801038][T10332] usb 5-1: Manufacturer: syz [ 896.806235][T10332] usb 5-1: SerialNumber: syz [ 896.815873][T10332] usb 5-1: config 0 descriptor?? [ 897.044224][T12043] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 898.252216][T12054] loop2: detected capacity change from 0 to 7 [ 898.264023][T11093] Dev loop2: unable to read RDB block 7 [ 898.269894][T11093] loop2: AHDI p1 p2 p3 [ 898.274393][T11093] loop2: partition table partially beyond EOD, truncated [ 898.283659][T11093] loop2: p1 start 1601398130 is beyond EOD, truncated [ 898.290710][T11093] loop2: p2 start 1702059890 is beyond EOD, truncated [ 898.312904][T12054] Dev loop2: unable to read RDB block 7 [ 898.324112][T12054] loop2: AHDI p1 p2 p3 [ 898.328626][T12054] loop2: partition table partially beyond EOD, truncated [ 898.339507][T12054] loop2: p1 start 1601398130 is beyond EOD, truncated [ 898.348456][T12054] loop2: p2 start 1702059890 is beyond EOD, truncated [ 899.228486][ T788] usb 5-1: USB disconnect, device number 10 [ 900.283236][T12068] netlink: 'syz.4.1550': attribute type 13 has an invalid length. [ 900.291371][T12068] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1550'. [ 900.343116][ T788] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 900.556991][ T788] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 900.567698][ T788] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 900.577389][ T788] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 900.588255][ T788] usb 4-1: config 0 descriptor?? [ 900.600840][ T788] pwc: Askey VC010 type 2 USB webcam detected. [ 901.055326][ T788] pwc: recv_control_msg error -32 req 02 val 2b00 [ 901.063815][ T788] pwc: recv_control_msg error -32 req 02 val 2700 [ 901.162068][T12078] binder: BINDER_SET_CONTEXT_MGR already set [ 901.185205][T12078] binder: 12077:12078 ioctl 4018620d 200000004a80 returned -16 [ 901.237653][T12074] loop4: detected capacity change from 0 to 8192 [ 901.301819][ T788] pwc: recv_control_msg error -32 req 02 val 2c00 [ 901.310090][ T788] pwc: recv_control_msg error -32 req 04 val 1000 [ 901.320061][ T788] pwc: recv_control_msg error -32 req 04 val 1300 [ 901.328850][ T788] pwc: recv_control_msg error -32 req 04 val 1400 [ 901.338449][ T788] pwc: recv_control_msg error -32 req 02 val 2000 [ 901.351593][T12076] netlink: 'syz.5.1560': attribute type 13 has an invalid length. [ 901.360361][T12076] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1560'. [ 901.373051][ T788] pwc: recv_control_msg error -32 req 02 val 2100 [ 901.382802][ T788] pwc: recv_control_msg error -32 req 04 val 1500 [ 901.593975][ T788] pwc: recv_control_msg error -71 req 02 val 2400 [ 901.608266][ T788] pwc: recv_control_msg error -71 req 02 val 2600 [ 901.617482][ T788] pwc: recv_control_msg error -71 req 02 val 2900 [ 901.626195][ T788] pwc: recv_control_msg error -71 req 02 val 2800 [ 901.634426][ T788] pwc: recv_control_msg error -71 req 04 val 1100 [ 901.644758][ T788] pwc: recv_control_msg error -71 req 04 val 1200 [ 901.663404][ T788] pwc: Registered as video103. [ 901.669375][ T788] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input43 [ 901.694764][ T788] usb 4-1: USB disconnect, device number 21 [ 901.831799][T10332] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 902.021764][T10332] usb 5-1: Using ep0 maxpacket: 32 [ 902.029586][T10332] usb 5-1: config index 0 descriptor too short (expected 35577, got 27) [ 902.046766][T10332] usb 5-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 902.056026][T10332] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 902.065674][T10332] usb 5-1: config 1 has no interface number 0 [ 902.072335][T10332] usb 5-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 902.084806][T10332] usb 5-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 902.099089][T10332] usb 5-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 902.121893][T10332] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 902.159900][T10332] snd_usb_pod 5-1:1.1: Line 6 Pocket POD found [ 902.485008][T10332] snd_usb_pod 5-1:1.1: Line 6 Pocket POD now attached [ 902.641786][ T6483] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 902.832186][ T6483] usb 2-1: Using ep0 maxpacket: 8 [ 902.844855][ T8] usb 5-1: USB disconnect, device number 11 [ 902.862928][ T8] snd_usb_pod 5-1:1.1: Line 6 Pocket POD now disconnected [ 902.882466][ T6483] usb 2-1: config index 0 descriptor too short (expected 30, got 18) [ 902.895666][ T6483] usb 2-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 902.908709][ T6483] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 902.922488][ T6483] usb 2-1: Product: syz [ 902.926731][ T6483] usb 2-1: Manufacturer: syz [ 902.931463][ T6483] usb 2-1: SerialNumber: syz [ 902.939740][ T6483] usb 2-1: config 0 descriptor?? [ 902.950584][ T6483] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 902.964590][ T6483] usb 2-1: setting power ON [ 902.971131][ T6483] dvb-usb: bulk message failed: -22 (2/0) [ 902.998667][ T6483] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 903.015986][ T6483] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 903.029272][ T6483] usb 2-1: media controller created [ 903.076136][ T6483] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 903.118641][ T6483] usb 2-1: selecting invalid altsetting 6 [ 903.127607][ T6483] usb 2-1: digital interface selection failed (-22) [ 903.137869][ T6483] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 903.157291][ T6483] usb 2-1: setting power OFF [ 903.165991][T12094] dvb-usb: bulk message failed: -22 (3/0) [ 903.176380][ T6483] dvb-usb: bulk message failed: -22 (2/0) [ 903.185691][T12094] cxusb: i2c wr: len=79 is too big! [ 903.185691][T12094] [ 903.193610][ T6483] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 903.211936][ T6483] (NULL device *): no alternate interface [ 903.257576][ T6483] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 903.280089][ T6483] usb 2-1: USB disconnect, device number 23 [ 903.738737][T12107] binder: BINDER_SET_CONTEXT_MGR already set [ 903.771995][T12107] binder: 12106:12107 ioctl 4018620d 200000004a80 returned -16 [ 906.816087][T12127] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1570'. [ 907.096757][T12135] binder: BINDER_SET_CONTEXT_MGR already set [ 907.127275][T12135] binder: 12134:12135 ioctl 4018620d 200000004a80 returned -16 [ 908.313416][T10332] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 908.413096][T12176] loop3: detected capacity change from 0 to 2048 [ 908.494357][T12176] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 908.525733][T10332] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 908.558059][T10332] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 908.570409][T10332] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 908.588690][T10332] usb 5-1: config 0 descriptor?? [ 908.618278][T10332] pwc: Askey VC010 type 2 USB webcam detected. [ 909.535936][ T5778] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 909.669368][T10332] pwc: recv_control_msg error -32 req 02 val 2b00 [ 909.680635][T10332] pwc: recv_control_msg error -32 req 02 val 2700 [ 909.700315][T10332] pwc: recv_control_msg error -32 req 02 val 2c00 [ 909.713632][T10332] pwc: recv_control_msg error -32 req 04 val 1000 [ 909.731511][T10332] pwc: recv_control_msg error -32 req 04 val 1300 [ 909.743420][T10332] pwc: recv_control_msg error -32 req 04 val 1400 [ 909.752114][T10332] pwc: recv_control_msg error -32 req 02 val 2000 [ 909.771035][T10332] pwc: recv_control_msg error -32 req 02 val 2100 [ 909.780415][T10332] pwc: recv_control_msg error -32 req 04 val 1500 [ 909.858337][T12189] loop5: detected capacity change from 0 to 8192 [ 910.187306][T10332] pwc: recv_control_msg error -71 req 02 val 2400 [ 910.203878][T10332] pwc: recv_control_msg error -71 req 02 val 2600 [ 910.214644][T10332] pwc: recv_control_msg error -71 req 02 val 2900 [ 910.252161][T12204] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1601'. [ 910.612124][T10332] pwc: recv_control_msg error -71 req 02 val 2800 [ 910.619473][T10332] pwc: recv_control_msg error -71 req 04 val 1100 [ 910.734460][T10332] pwc: recv_control_msg error -71 req 04 val 1200 [ 910.742916][T10332] pwc: Registered as video103. [ 910.751242][T10332] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input44 [ 910.800185][T10332] usb 5-1: USB disconnect, device number 12 [ 911.316437][T12222] netlink: 'syz.4.1604': attribute type 13 has an invalid length. [ 911.330152][T12222] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1604'. [ 912.572324][ T9006] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 912.794526][ T9006] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 912.840454][ T9006] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 912.992162][ T9006] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 913.018060][ T9006] usb 4-1: config 0 descriptor?? [ 913.047200][ T9006] pwc: Askey VC010 type 2 USB webcam detected. [ 913.465167][ T9006] pwc: recv_control_msg error -32 req 02 val 2b00 [ 913.484274][ T9006] pwc: recv_control_msg error -32 req 02 val 2700 [ 913.503292][ T9006] pwc: recv_control_msg error -32 req 02 val 2c00 [ 913.511160][ T9006] pwc: recv_control_msg error -32 req 04 val 1000 [ 913.522418][ T9006] pwc: recv_control_msg error -32 req 04 val 1300 [ 913.534792][ T9006] pwc: recv_control_msg error -32 req 04 val 1400 [ 913.561936][ T9006] pwc: recv_control_msg error -32 req 02 val 2000 [ 913.577894][ T9006] pwc: recv_control_msg error -32 req 02 val 2100 [ 913.590641][ T9006] pwc: recv_control_msg error -32 req 04 val 1500 [ 914.046009][ T9006] pwc: recv_control_msg error -71 req 02 val 2400 [ 914.169662][T12269] netlink: 'syz.5.1621': attribute type 13 has an invalid length. [ 914.221566][T12269] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1621'. [ 914.338307][ T9006] pwc: recv_control_msg error -71 req 02 val 2600 [ 914.345425][ T9006] pwc: recv_control_msg error -71 req 02 val 2900 [ 914.352856][ T9006] pwc: recv_control_msg error -71 req 02 val 2800 [ 914.371827][ T9006] pwc: recv_control_msg error -71 req 04 val 1100 [ 914.383085][ T9006] pwc: recv_control_msg error -71 req 04 val 1200 [ 914.412113][ T9006] pwc: Registered as video103. [ 914.425139][ T9006] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input45 [ 914.443211][ T9006] usb 4-1: USB disconnect, device number 22 [ 917.886505][T12292] 9pnet_fd: Insufficient options for proto=fd [ 918.312024][ T8] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 918.731821][ T8] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 918.742714][ T8] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 918.839760][ T8] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 918.852342][ T8] usb 2-1: config 0 descriptor?? [ 918.974607][ T8] pwc: Askey VC010 type 2 USB webcam detected. [ 919.412796][ T8] pwc: recv_control_msg error -32 req 02 val 2b00 [ 919.419394][T12318] 9pnet_fd: Insufficient options for proto=fd [ 919.448241][ T8] pwc: recv_control_msg error -32 req 02 val 2700 [ 919.463894][ T8] pwc: recv_control_msg error -32 req 02 val 2c00 [ 919.498613][ T8] pwc: recv_control_msg error -32 req 04 val 1000 [ 919.509086][ T8] pwc: recv_control_msg error -32 req 04 val 1300 [ 919.517594][ T8] pwc: recv_control_msg error -32 req 04 val 1400 [ 919.537841][ T8] pwc: recv_control_msg error -32 req 02 val 2000 [ 919.570201][ T8] pwc: recv_control_msg error -32 req 02 val 2100 [ 919.592658][ T8] pwc: recv_control_msg error -32 req 04 val 1500 [ 919.767322][T12322] syzkaller0: entered promiscuous mode [ 919.772943][T12322] syzkaller0: entered allmulticast mode [ 919.937592][ T8] pwc: recv_control_msg error -71 req 02 val 2400 [ 919.945283][ T8] pwc: recv_control_msg error -71 req 02 val 2600 [ 919.952522][ T8] pwc: recv_control_msg error -71 req 02 val 2900 [ 920.064139][ T8] pwc: recv_control_msg error -71 req 02 val 2800 [ 920.071401][ T8] pwc: recv_control_msg error -71 req 04 val 1100 [ 920.078718][ T8] pwc: recv_control_msg error -71 req 04 val 1200 [ 920.097809][ T8] pwc: Registered as video103. [ 920.116440][ T8] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input46 [ 920.153354][ T8] usb 2-1: USB disconnect, device number 24 [ 920.757942][ T8] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 920.961888][ T8] usb 2-1: Using ep0 maxpacket: 8 [ 920.982844][ T8] usb 2-1: config index 0 descriptor too short (expected 30, got 18) [ 921.030131][ T8] usb 2-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 921.049775][ T8] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 921.065396][ T8] usb 2-1: Product: syz [ 921.079637][ T8] usb 2-1: Manufacturer: syz [ 921.091713][ T8] usb 2-1: SerialNumber: syz [ 921.107403][ T8] usb 2-1: config 0 descriptor?? [ 921.128955][ T8] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 921.141594][ T8] usb 2-1: setting power ON [ 921.146904][ T8] dvb-usb: bulk message failed: -22 (2/0) [ 921.157808][ T8] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 921.168623][ T8] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 921.189504][T12348] 9pnet_fd: Insufficient options for proto=fd [ 921.190051][ T8] usb 2-1: media controller created [ 921.266280][ T8] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 921.295924][ T8] usb 2-1: selecting invalid altsetting 6 [ 921.313632][ T8] usb 2-1: digital interface selection failed (-22) [ 921.333027][ T8] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 921.355804][ T8] usb 2-1: setting power OFF [ 921.360586][ T8] dvb-usb: bulk message failed: -22 (2/0) [ 921.379201][ T8] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 921.413765][ T8] (NULL device *): no alternate interface [ 921.515171][ T8] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 921.589482][ T8] usb 2-1: USB disconnect, device number 25 [ 922.371764][ T8] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 922.575259][ T8] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 922.588734][ T8] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 922.599061][ T8] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 922.619124][ T8] usb 5-1: config 0 descriptor?? [ 922.629597][ T8] pwc: Askey VC010 type 2 USB webcam detected. [ 923.037879][ T8] pwc: recv_control_msg error -32 req 02 val 2b00 [ 923.047763][ T8] pwc: recv_control_msg error -32 req 02 val 2700 [ 923.058396][ T8] pwc: recv_control_msg error -32 req 02 val 2c00 [ 923.066765][ T8] pwc: recv_control_msg error -32 req 04 val 1000 [ 923.074995][ T8] pwc: recv_control_msg error -32 req 04 val 1300 [ 923.082940][ T8] pwc: recv_control_msg error -32 req 04 val 1400 [ 923.092158][ T8] pwc: recv_control_msg error -32 req 02 val 2000 [ 923.099430][ T8] pwc: recv_control_msg error -32 req 02 val 2100 [ 923.118503][ T8] pwc: recv_control_msg error -32 req 04 val 1500 [ 923.282943][T12369] 9pnet_fd: Insufficient options for proto=fd [ 923.338504][ T8] pwc: recv_control_msg error -71 req 02 val 2400 [ 923.350743][ T8] pwc: recv_control_msg error -71 req 02 val 2600 [ 923.360966][ T8] pwc: recv_control_msg error -71 req 02 val 2900 [ 923.372811][ T8] pwc: recv_control_msg error -71 req 02 val 2800 [ 923.389219][ T8] pwc: recv_control_msg error -71 req 04 val 1100 [ 923.399095][ T8] pwc: recv_control_msg error -71 req 04 val 1200 [ 923.419777][ T8] pwc: Registered as video103. [ 923.426978][ T8] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input47 [ 923.471196][ T8] usb 5-1: USB disconnect, device number 13 [ 924.132260][T12325] netlink: 'syz.5.1640': attribute type 13 has an invalid length. [ 924.140187][T12325] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1640'. [ 924.603836][T12394] 9pnet_fd: Insufficient options for proto=fd [ 925.020936][T12400] tmpfs: Unknown parameter 'grpquota_block_hardlim' [ 925.240100][T12405] syzkaller0: entered promiscuous mode [ 925.247489][T12405] syzkaller0: entered allmulticast mode [ 925.706649][T12416] loop3: detected capacity change from 0 to 8192 [ 927.372482][T12429] 9pnet_fd: Insufficient options for proto=fd [ 928.950800][T12415] netlink: 'syz.5.1674': attribute type 13 has an invalid length. [ 928.959294][T12415] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1674'. [ 929.557164][T12440] loop3: detected capacity change from 0 to 8192 [ 929.837520][T12452] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1689'. [ 930.415245][T12465] tmpfs: Unknown parameter 'grpquota_block_hardlim' [ 930.522202][T12468] netlink: 'syz.4.1694': attribute type 13 has an invalid length. [ 930.553455][T12468] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1694'. [ 932.037252][ T1288] ieee802154 phy0 wpan0: encryption failed: -22 [ 932.044447][ T1288] ieee802154 phy1 wpan1: encryption failed: -22 [ 933.874466][T12513] loop1: detected capacity change from 0 to 32768 [ 933.897549][T12515] tmpfs: Bad value for 'grpquota_block_hardlimit' [ 933.910807][T12513] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz.1.1712 (12513) [ 933.937425][T12513] BTRFS info (device loop1): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 933.948174][T12513] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm [ 933.957020][T12513] BTRFS info (device loop1): turning on sync discard [ 933.963829][T12513] BTRFS info (device loop1): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 933.973298][T12513] BTRFS info (device loop1): use zstd compression, level 3 [ 933.980833][T12513] BTRFS info (device loop1): turning on async discard [ 933.988017][T12513] BTRFS warning (device loop1): 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 933.998756][T12513] BTRFS info (device loop1): trying to use backup root at mount time [ 934.006891][T12513] BTRFS info (device loop1): enabling auto defrag [ 934.013376][T12513] BTRFS info (device loop1): using free space tree [ 934.050684][ T2102] BTRFS warning (device loop1): checksum verify failed on logical 5337088 mirror 1 wanted 0xe63dbdda found 0xc926492d level 0 [ 934.095560][T12530] netlink: 'syz.4.1710': attribute type 13 has an invalid length. [ 934.124680][T12513] BTRFS error (device loop1): failed to load root extent [ 934.132519][T12513] BTRFS warning (device loop1): try to load backup roots slot 1 [ 934.145810][ T3498] BTRFS warning (device loop1): checksum verify failed on logical 5324800 mirror 1 wanted 0x9f73850b found 0x80379423 level 0 [ 934.163487][T12530] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1710'. [ 934.178395][T12513] BTRFS warning (device loop1): couldn't read tree root [ 934.185695][T12513] BTRFS warning (device loop1): try to load backup roots slot 2 [ 934.202465][ T59] BTRFS error (device loop1): level verify failed on logical 5255168 mirror 1 wanted 0 found 1 [ 934.246156][T12513] BTRFS warning (device loop1): couldn't read tree root [ 934.253745][T12513] BTRFS warning (device loop1): try to load backup roots slot 3 [ 934.276530][T12513] BTRFS info (device loop1): enabling ssd optimizations [ 934.284362][T12513] BTRFS info (device loop1): rebuilding free space tree [ 934.297592][T12513] BTRFS info (device loop1): checking UUID tree [ 934.548932][ T5774] BTRFS info (device loop1): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 937.564492][T12565] netlink: 'syz.5.1723': attribute type 13 has an invalid length. [ 937.582167][T12565] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1723'. [ 938.789305][T12574] loop3: detected capacity change from 0 to 32768 [ 938.849327][T12574] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz.3.1728 (12574) [ 938.872667][T12574] BTRFS info (device loop3): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 938.883824][T12574] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm [ 938.893257][T12574] BTRFS info (device loop3): turning on sync discard [ 938.900364][T12574] BTRFS info (device loop3): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 938.910123][T12574] BTRFS info (device loop3): use zstd compression, level 3 [ 938.917599][T12574] BTRFS info (device loop3): turning on async discard [ 938.924683][T12574] BTRFS warning (device loop3): 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 938.936296][T12574] BTRFS info (device loop3): trying to use backup root at mount time [ 938.944974][T12574] BTRFS info (device loop3): enabling auto defrag [ 938.951536][T12574] BTRFS info (device loop3): using free space tree [ 939.105071][T10045] BTRFS warning (device loop3): checksum verify failed on logical 5337088 mirror 1 wanted 0xe63dbdda found 0xc926492d level 0 [ 939.188864][T12574] BTRFS error (device loop3): failed to load root extent [ 939.196273][T12574] BTRFS warning (device loop3): try to load backup roots slot 1 [ 939.208808][ T59] BTRFS warning (device loop3): checksum verify failed on logical 5324800 mirror 1 wanted 0x9f73850b found 0x80379423 level 0 [ 939.281326][T12574] BTRFS warning (device loop3): couldn't read tree root [ 939.288600][T12574] BTRFS warning (device loop3): try to load backup roots slot 2 [ 939.311962][ T2102] BTRFS error (device loop3): level verify failed on logical 5255168 mirror 1 wanted 0 found 1 [ 939.342340][T12574] BTRFS warning (device loop3): couldn't read tree root [ 939.349605][T12574] BTRFS warning (device loop3): try to load backup roots slot 3 [ 939.386495][T12574] BTRFS info (device loop3): enabling ssd optimizations [ 939.394897][T12574] BTRFS info (device loop3): rebuilding free space tree [ 939.416069][T12574] BTRFS info (device loop3): checking UUID tree [ 939.435051][T12599] loop4: detected capacity change from 0 to 512 [ 939.535797][T12599] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 939.572307][T12605] tmpfs: Bad value for 'grpquota_block_hardlimit' [ 939.743799][ T9638] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 940.235672][ T5778] BTRFS info (device loop3): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 942.817559][T12631] netlink: 'syz.4.1740': attribute type 13 has an invalid length. [ 942.831048][T12631] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1740'. [ 943.867321][T12646] binder: 12645:12646 ioctl 4018620d 0 returned -22 [ 945.402237][T12657] tmpfs: Bad value for 'grpquota_block_hardlimit' [ 946.834670][T12668] binder: BINDER_SET_CONTEXT_MGR already set [ 946.841391][T12668] binder: 12667:12668 ioctl 4018620d 200000004a80 returned -16 [ 948.323648][T12684] loop1: detected capacity change from 0 to 1024 [ 948.391579][T12686] netlink: 'syz.4.1760': attribute type 13 has an invalid length. [ 948.410193][T12688] loop2: detected capacity change from 0 to 7 [ 948.417788][T12688] Dev loop2: unable to read RDB block 7 [ 948.424020][T12688] loop2: unable to read partition table [ 948.430098][T12688] loop2: partition table beyond EOD, truncated [ 948.436988][T12688] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 948.469057][ T5140] Dev loop2: unable to read RDB block 7 [ 948.484343][T12686] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1760'. [ 948.494448][ T5140] loop2: unable to read partition table [ 948.500502][ T5140] loop2: partition table beyond EOD, truncated [ 948.996124][T12695] binder: BINDER_SET_CONTEXT_MGR already set [ 949.010288][T12695] binder: 12694:12695 ioctl 4018620d 200000004a80 returned -16 [ 949.358376][T12705] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1769'. [ 949.371352][T12703] tmpfs: Bad value for 'grpquota_block_hardlimit' [ 949.471977][T12680] Bluetooth: hci3: command 0x0406 tx timeout [ 950.716927][T12711] loop5: detected capacity change from 0 to 512 [ 950.886981][T10262] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 950.981968][T12711] netlink: 268 bytes leftover after parsing attributes in process `syz.5.1771'. [ 950.991307][T12711] netlink: 136 bytes leftover after parsing attributes in process `syz.5.1771'. [ 951.001881][T12711] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1771'. [ 951.445249][T12715] syzkaller0: entered promiscuous mode [ 951.451870][T12715] syzkaller0: entered allmulticast mode [ 951.775066][T12721] binder: BINDER_SET_CONTEXT_MGR already set [ 951.783161][T12721] binder: 12719:12721 ioctl 4018620d 200000004a80 returned -16 [ 952.759543][ T6267] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 953.153163][ T6267] usb 4-1: device descriptor read/64, error -71 [ 953.616874][ T6267] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 953.637989][T12745] tmpfs: Bad value for 'grpquota_block_hardlimit' [ 953.771758][ T6267] usb 4-1: device descriptor read/64, error -71 [ 953.900726][ T6267] usb usb4-port1: attempt power cycle [ 954.318675][ T6267] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 954.359735][ T6267] usb 4-1: device descriptor read/8, error -71 [ 954.640296][ T6267] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 954.682813][ T6267] usb 4-1: device descriptor read/8, error -71 [ 954.807656][ T6267] usb usb4-port1: unable to enumerate USB device [ 955.340353][T12748] binder: 12747:12748 ioctl c0306201 0 returned -14 [ 955.350862][T12748] binder: BINDER_SET_CONTEXT_MGR already set [ 955.361192][T12748] binder: 12747:12748 ioctl 4018620d 200000004a80 returned -16 [ 955.529084][T12750] loop3: detected capacity change from 0 to 1024 [ 955.560000][T12750] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 955.627098][T12750] EXT4-fs (loop3): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: writeback. [ 955.640360][T12750] ext4 filesystem being mounted at /491/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 955.843129][T12754] EXT4-fs error (device loop3): ext4_map_blocks:720: inode #15: comm syz.3.1786: lblock 0 mapped to illegal pblock 0 (length 1) [ 955.888120][T12754] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 117 [ 955.902755][T12754] EXT4-fs (loop3): This should not happen!! Data will be lost [ 955.902755][T12754] [ 955.967211][T12750] EXT4-fs error (device loop3): ext4_validate_block_bitmap:439: comm syz.3.1786: bg 0: block 112: padding at end of block bitmap is not set [ 956.001214][T12750] BUG: unable to handle page fault for address: ffffffffffffffec [ 956.009005][T12750] #PF: supervisor read access in kernel mode [ 956.015175][T12750] #PF: error_code(0x0000) - not-present page [ 956.021162][T12750] PGD cf35067 P4D cf35067 PUD cf37067 PMD 0 [ 956.027390][T12750] Oops: 0000 [#1] PREEMPT SMP KASAN [ 956.032607][T12750] CPU: 0 PID: 12750 Comm: syz.3.1786 Not tainted syzkaller #0 [ 956.040167][T12750] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 956.050533][T12750] RIP: 0010:ext4_ext_map_blocks+0x2d11/0x6800 [ 956.056839][T12750] Code: 8b 7c 24 10 4d 85 ff 0f 84 bd 00 00 00 e8 f7 e0 58 ff 49 8d 7f 08 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84 c0 0f 85 3d 1e 00 00 <41> 0f b7 47 08 c1 e0 04 48 8d 04 40 48 89 44 24 08 4d 89 fc 49 8d [ 956.076985][T12750] RSP: 0018:ffffc9000b81ed60 EFLAGS: 00010246 [ 956.083064][T12750] RAX: 0000000000000000 RBX: ffffffffffffffe4 RCX: 0000000000080000 [ 956.091228][T12750] RDX: ffffc9000ddad000 RSI: 000000000002bb7b RDI: ffffffffffffffec [ 956.099327][T12750] RBP: ffffc9000b81f010 R08: ffffffff911c659f R09: 1ffffffff2238cb3 [ 956.107433][T12750] R10: dffffc0000000000 R11: fffffbfff2238cb4 R12: 0000000000000001 [ 956.115433][T12750] R13: 1ffff92001703dd8 R14: dffffc0000000000 R15: ffffffffffffffe4 [ 956.123426][T12750] FS: 00007f1a4af4c6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 956.132469][T12750] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 956.139074][T12750] CR2: ffffffffffffffec CR3: 0000000062abf000 CR4: 00000000003506f0 [ 956.147234][T12750] Call Trace: [ 956.150522][T12750] [ 956.153494][T12750] ? __might_sleep+0xe0/0xe0 [ 956.158184][T12750] ? ext4_ext_release+0x10/0x10 [ 956.163193][T12750] ? __lock_acquire+0x7d40/0x7d40 [ 956.168256][T12750] ? ext4_es_lookup_extent+0x60e/0xa00 [ 956.173765][T12750] ext4_map_blocks+0x9e2/0x1b80 [ 956.178834][T12750] ? ext4_issue_zeroout+0x250/0x250 [ 956.184127][T12750] ? rcu_is_watching+0x15/0xb0 [ 956.189099][T12750] ? ext4_inode_journal_mode+0x193/0x470 [ 956.194836][T12750] ext4_do_writepages+0x1461/0x3990 [ 956.200069][T12750] ? ext4_normal_submit_inode_data_buffers+0x240/0x240 [ 956.207044][T12750] ? rcu_read_lock_any_held+0xb4/0x140 [ 956.212519][T12750] ext4_writepages+0x1dd/0x350 [ 956.217307][T12750] ? ext4_read_folio+0x2f0/0x2f0 [ 956.222340][T12750] ? ext4_da_get_block_prep+0xde1/0x1020 [ 956.227998][T12750] ? ext4_read_folio+0x2f0/0x2f0 [ 956.233050][T12750] do_writepages+0x3b3/0x630 [ 956.237654][T12750] ? folio_clear_dirty_for_io+0xc30/0xc30 [ 956.243389][T12750] ? __lock_acquire+0x7d40/0x7d40 [ 956.248525][T12750] ? __rwlock_init+0x150/0x150 [ 956.253298][T12750] ? do_raw_spin_unlock+0x121/0x230 [ 956.258676][T12750] filemap_fdatawrite_wbc+0x122/0x180 [ 956.264237][T12750] file_write_and_wait_range+0x197/0x280 [ 956.270053][T12750] ? __filemap_set_wb_err+0x1b0/0x1b0 [ 956.275460][T12750] ? __might_sleep+0xe0/0xe0 [ 956.280064][T12750] ? folio_unlock+0x118/0x2e0 [ 956.284856][T12750] generic_buffers_fsync_noflush+0x6f/0x160 [ 956.290869][T12750] ext4_sync_file+0x45b/0xd30 [ 956.295660][T12750] ? trace_ext4_fsmap_mapping+0x210/0x210 [ 956.301594][T12750] ? vfs_fsync_range+0x130/0x1a0 [ 956.306741][T12750] ext4_buffered_write_iter+0x2c0/0x350 [ 956.312758][T12750] ext4_file_write_iter+0x1d9/0x1880 [ 956.318429][T12750] ? rcu_read_lock_any_held+0xb4/0x140 [ 956.324358][T12750] ? ext4_file_read_iter+0x670/0x670 [ 956.329881][T12750] vfs_write+0x46c/0x990 [ 956.334864][T12750] ? file_end_write+0x250/0x250 [ 956.340000][T12750] ? __fget_files+0x43d/0x4b0 [ 956.344826][T12750] ? __fdget+0x180/0x210 [ 956.349210][T12750] ? __x64_sys_pwrite64+0xf6/0x230 [ 956.354567][T12750] __x64_sys_pwrite64+0x19b/0x230 [ 956.359658][T12750] ? ksys_pwrite64+0x1c0/0x1c0 [ 956.364530][T12750] ? lockdep_hardirqs_on+0x98/0x150 [ 956.369925][T12750] do_syscall_64+0x55/0xa0 [ 956.374344][T12750] ? clear_bhb_loop+0x40/0x90 [ 956.379026][T12750] ? clear_bhb_loop+0x40/0x90 [ 956.383984][T12750] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 956.390008][T12750] RIP: 0033:0x7f1a49f9cdd9 [ 956.394523][T12750] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 956.414683][T12750] RSP: 002b:00007f1a4af4c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000012 [ 956.423653][T12750] RAX: ffffffffffffffda RBX: 00007f1a4a215fa0 RCX: 00007f1a49f9cdd9 [ 956.431840][T12750] RDX: 000000000000fdef RSI: 0000200000000140 RDI: 0000000000000005 [ 956.440184][T12750] RBP: 00007f1a4a032d69 R08: 0000000000000000 R09: 0000000000000000 [ 956.448360][T12750] R10: 0000000000000e7c R11: 0000000000000246 R12: 0000000000000000 [ 956.456964][T12750] R13: 00007f1a4a216038 R14: 00007f1a4a215fa0 R15: 00007fff68ad6388 [ 956.465315][T12750] [ 956.468379][T12750] Modules linked in: [ 956.472423][T12750] CR2: ffffffffffffffec [ 956.476597][T12750] ---[ end trace 0000000000000000 ]--- [ 956.482143][T12750] RIP: 0010:ext4_ext_map_blocks+0x2d11/0x6800 [ 956.488403][T12750] Code: 8b 7c 24 10 4d 85 ff 0f 84 bd 00 00 00 e8 f7 e0 58 ff 49 8d 7f 08 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84 c0 0f 85 3d 1e 00 00 <41> 0f b7 47 08 c1 e0 04 48 8d 04 40 48 89 44 24 08 4d 89 fc 49 8d [ 956.508558][T12750] RSP: 0018:ffffc9000b81ed60 EFLAGS: 00010246 [ 956.514910][T12750] RAX: 0000000000000000 RBX: ffffffffffffffe4 RCX: 0000000000080000 [ 956.523085][T12750] RDX: ffffc9000ddad000 RSI: 000000000002bb7b RDI: ffffffffffffffec [ 956.531527][T12750] RBP: ffffc9000b81f010 R08: ffffffff911c659f R09: 1ffffffff2238cb3 [ 956.539604][T12750] R10: dffffc0000000000 R11: fffffbfff2238cb4 R12: 0000000000000001 [ 956.547754][T12750] R13: 1ffff92001703dd8 R14: dffffc0000000000 R15: ffffffffffffffe4 [ 956.555962][T12750] FS: 00007f1a4af4c6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 956.564920][T12750] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 956.571706][T12750] CR2: ffffffffffffffec CR3: 0000000062abf000 CR4: 00000000003506f0 [ 956.579885][T12750] Kernel panic - not syncing: Fatal exception [ 956.586662][T12750] Kernel Offset: disabled [ 956.591186][T12750] Rebooting in 86400 seconds..