Warning: Permanently added '10.128.0.156' (ED25519) to the list of known hosts. 1970/01/01 00:00:22 parsed 1 programs 1970/01/01 00:00:22 serving rpc on tcp://33907 [ 23.721658][ T4718] cgroup: Unknown subsys name 'net' [ 23.871844][ T4718] cgroup: Unknown subsys name 'cpuset' [ 23.873197][ T4718] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 24.052161][ T4718] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 27.742870][ T4726] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 27.803458][ T4733] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 27.803843][ T4733] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 27.804005][ T4733] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 27.804316][ T4733] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 27.804514][ T4733] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 28.215430][ T2588] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 28.215441][ T2588] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 28.227581][ T2588] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 28.227593][ T2588] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 28.659935][ T4773] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.660205][ T4773] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.660276][ T4773] bridge_slave_0: entered allmulticast mode [ 28.660734][ T4773] bridge_slave_0: entered promiscuous mode [ 28.666886][ T4773] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.666947][ T4773] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.666995][ T4773] bridge_slave_1: entered allmulticast mode [ 28.667386][ T4773] bridge_slave_1: entered promiscuous mode [ 28.676944][ T4773] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 28.677790][ T4773] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 28.729277][ T4773] team0: Port device team_slave_0 added [ 28.731631][ T4773] team0: Port device team_slave_1 added [ 28.737869][ T4773] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 28.737878][ T4773] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 28.737890][ T4773] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 28.738774][ T4773] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 28.738781][ T4773] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 28.738793][ T4773] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 28.769125][ T4773] hsr_slave_0: entered promiscuous mode [ 28.770484][ T4773] hsr_slave_1: entered promiscuous mode [ 28.821801][ T4773] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 28.825719][ T4773] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 28.826575][ T4773] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 28.828057][ T4773] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 28.828433][ T4773] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 28.829508][ T4773] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 28.830722][ T4773] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 28.833776][ T4773] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 28.842988][ T4773] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.843018][ T4773] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.843163][ T4773] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.843207][ T4773] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.859326][ T4773] 8021q: adding VLAN 0 to HW filter on device bond0 [ 28.865329][ T2588] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.865832][ T2588] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.868308][ T4773] 8021q: adding VLAN 0 to HW filter on device team0 [ 28.875473][ T93] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.875510][ T93] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.877429][ T93] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.877454][ T93] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.975703][ T4773] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 28.991562][ T4773] veth0_vlan: entered promiscuous mode [ 28.993677][ T4773] veth1_vlan: entered promiscuous mode [ 29.003411][ T4773] veth0_macvtap: entered promiscuous mode [ 29.004583][ T4773] veth1_macvtap: entered promiscuous mode [ 29.008618][ T4773] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 29.015200][ T4773] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 29.031330][ T93] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.031373][ T93] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.031388][ T93] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.031402][ T93] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.096231][ T119] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 29.135914][ T119] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 29.185070][ T119] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 29.254640][ T119] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 1970/01/01 00:00:29 executed programs: 0 [ 29.456781][ T4733] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 29.457072][ T4733] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 29.457254][ T4733] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 29.457688][ T4733] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 29.458531][ T4733] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 29.595632][ T4825] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.595684][ T4825] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.595735][ T4825] bridge_slave_0: entered allmulticast mode [ 29.596157][ T4825] bridge_slave_0: entered promiscuous mode [ 29.596881][ T4825] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.596902][ T4825] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.596985][ T4825] bridge_slave_1: entered allmulticast mode [ 29.597355][ T4825] bridge_slave_1: entered promiscuous mode [ 29.605190][ T4825] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.606061][ T4825] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.612154][ T4825] team0: Port device team_slave_0 added [ 29.612938][ T4825] team0: Port device team_slave_1 added [ 29.618999][ T4825] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.619008][ T4825] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.619021][ T4825] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.619529][ T4825] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.619536][ T4825] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.619552][ T4825] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.629588][ T4825] hsr_slave_0: entered promiscuous mode [ 29.629913][ T4825] hsr_slave_1: entered promiscuous mode [ 29.630114][ T4825] debugfs: 'hsr0' already exists in 'hsr' [ 29.630171][ T4825] Cannot create hsr debugfs directory [ 31.530096][ T4733] Bluetooth: hci0: command tx timeout [ 32.674674][ T119] bridge_slave_1: left allmulticast mode [ 32.674706][ T119] bridge_slave_1: left promiscuous mode [ 32.674945][ T119] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.677682][ T119] bridge_slave_0: left allmulticast mode [ 32.677695][ T119] bridge_slave_0: left promiscuous mode [ 32.677776][ T119] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.733961][ T119] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 32.771133][ T119] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 32.782964][ T119] bond0 (unregistering): Released all slaves [ 32.836151][ T119] hsr_slave_0: left promiscuous mode [ 32.836439][ T119] hsr_slave_1: left promiscuous mode [ 32.836720][ T119] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 32.836734][ T119] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 32.837096][ T119] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 32.837107][ T119] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 32.845215][ T119] veth1_macvtap: left promiscuous mode [ 32.845244][ T119] veth0_macvtap: left promiscuous mode [ 32.845289][ T119] veth1_vlan: left promiscuous mode [ 32.845338][ T119] veth0_vlan: left promiscuous mode [ 32.947992][ T119] team0 (unregistering): Port device team_slave_1 removed [ 32.953247][ T119] team0 (unregistering): Port device team_slave_0 removed [ 33.008263][ T4398] 8021q: adding VLAN 0 to HW filter on device eth0 [ 33.194652][ T4825] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 33.196607][ T4825] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 33.197035][ T4825] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 33.197957][ T4825] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 33.198309][ T4825] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 33.199218][ T4825] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 33.199565][ T4825] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 33.204156][ T4825] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 33.231584][ T4825] 8021q: adding VLAN 0 to HW filter on device bond0 [ 33.234416][ T4825] 8021q: adding VLAN 0 to HW filter on device team0 [ 33.242814][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.242860][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.243375][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.243393][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.261003][ T4825] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 33.466869][ T4825] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 33.483872][ T4825] veth0_vlan: entered promiscuous mode [ 33.486552][ T4825] veth1_vlan: entered promiscuous mode [ 33.501641][ T4825] veth0_macvtap: entered promiscuous mode [ 33.503290][ T4825] veth1_macvtap: entered promiscuous mode [ 33.506500][ T4825] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 33.507419][ T4825] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 33.544209][ T119] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 33.544224][ T119] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 33.556964][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 33.556977][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 33.570994][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.571026][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.571042][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.571057][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.620763][ T4733] Bluetooth: hci0: command tx timeout [ 33.830164][ T4794] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 33.989848][ T4794] usb 1-1: Using ep0 maxpacket: 32 [ 33.990359][ T4794] usb 1-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 33.991202][ T4794] usb 1-1: config index 0 descriptor too short (expected 156, got 27) [ 33.991217][ T4794] usb 1-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 33.991230][ T4794] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 103, changing to 10 [ 33.991240][ T4794] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has invalid maxpacket 26217, setting to 1024 [ 33.991249][ T4794] usb 1-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 33.991259][ T4794] usb 1-1: config 0 interface 0 has no altsetting 0 [ 33.992591][ T4794] usb 1-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 33.992599][ T4794] usb 1-1: Product: syz [ 33.992604][ T4794] usb 1-1: Manufacturer: syz [ 33.992610][ T4794] usb 1-1: SerialNumber: syz [ 33.994153][ T4794] usb 1-1: config 0 descriptor?? [ 33.995009][ T4930] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 33.996325][ T4794] ldusb 1-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 33.997216][ T4794] ldusb 1-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 34.198662][ C1] ldusb 1-1:0.0: usb_submit_urb failed (-19) [ 34.198687][ T4845] usb 1-1: USB disconnect, device number 2 [ 34.203092][ T4845] ldusb 1-1:0.0: LD USB Device #0 now disconnected 1970/01/01 00:00:34 executed programs: 3 [ 34.939917][ T4845] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 35.089868][ T4845] usb 1-1: Using ep0 maxpacket: 32 [ 35.090949][ T4845] usb 1-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 35.091597][ T4845] usb 1-1: config index 0 descriptor too short (expected 156, got 27) [ 35.091611][ T4845] usb 1-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 35.091626][ T4845] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 103, changing to 10 [ 35.091636][ T4845] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has invalid maxpacket 26217, setting to 1024 [ 35.091646][ T4845] usb 1-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 35.091656][ T4845] usb 1-1: config 0 interface 0 has no altsetting 0 [ 35.093145][ T4845] usb 1-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 35.093160][ T4845] usb 1-1: Product: syz [ 35.093167][ T4845] usb 1-1: Manufacturer: syz [ 35.093172][ T4845] usb 1-1: SerialNumber: syz [ 35.094277][ T4845] usb 1-1: config 0 descriptor?? [ 35.094653][ T4931] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 35.096018][ T4845] ldusb 1-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 35.096635][ T4845] ldusb 1-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 35.296479][ T4845] usb 1-1: USB disconnect, device number 3 [ 35.296588][ C1] ldusb 1-1:0.0: usb_submit_urb failed (-19) [ 35.298097][ T4845] ldusb 1-1:0.0: LD USB Device #0 now disconnected [ 35.689843][ T4733] Bluetooth: hci0: command tx timeout [ 36.039842][ T4845] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 36.189879][ T4845] usb 1-1: Using ep0 maxpacket: 32 [ 36.190239][ T4845] usb 1-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 36.190884][ T4845] usb 1-1: config index 0 descriptor too short (expected 156, got 27) [ 36.190895][ T4845] usb 1-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 36.190906][ T4845] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 103, changing to 10 [ 36.190916][ T4845] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has invalid maxpacket 26217, setting to 1024 [ 36.190925][ T4845] usb 1-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 36.190934][ T4845] usb 1-1: config 0 interface 0 has no altsetting 0 [ 36.192198][ T4845] usb 1-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 36.192208][ T4845] usb 1-1: Product: syz [ 36.192216][ T4845] usb 1-1: Manufacturer: syz [ 36.192221][ T4845] usb 1-1: SerialNumber: syz [ 36.193353][ T4845] usb 1-1: config 0 descriptor?? [ 36.193743][ T4933] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 36.194570][ T4845] ldusb 1-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 36.195305][ T4845] ldusb 1-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 36.395717][ T4933] ================================================================== [ 36.395729][ T4933] BUG: KASAN: slab-use-after-free in dvb_device_open+0xd0/0x254 [ 36.395750][ T4933] Read of size 8 at addr ffff0000cb84d618 by task syz.0.19/4933 [ 36.395758][ T4933] [ 36.395762][ T4933] CPU: 1 UID: 0 PID: 4933 Comm: syz.0.19 Not tainted syzkaller #0 PREEMPT [ 36.395770][ T4933] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 36.395775][ T4933] Call trace: [ 36.395777][ T4933] show_stack+0x2c/0x3c (C) [ 36.395790][ T4933] __dump_stack+0x30/0x40 [ 36.395799][ T4933] dump_stack_lvl+0xd8/0x12c [ 36.395808][ T4933] print_address_description+0xb0/0x238 [ 36.395816][ T4933] print_report+0x68/0x84 [ 36.395822][ T4933] kasan_report+0x8c/0xc4 [ 36.395838][ T4933] __asan_report_load8_noabort+0x20/0x2c [ 36.395848][ T4933] dvb_device_open+0xd0/0x254 [ 36.395857][ T4933] chrdev_open+0x398/0x3e8 [ 36.395867][ T4933] do_dentry_open+0x5c4/0xfbc [ 36.395877][ T4933] vfs_open+0x44/0x2dc [ 36.395886][ T4933] path_openat+0x1084/0x18f0 [ 36.395894][ T4933] do_file_open+0x1c8/0x2e8 [ 36.395902][ T4933] do_sys_openat2+0x114/0x1e8 [ 36.395910][ T4933] do_sys_open+0xb0/0xe0 [ 36.395919][ T4933] __arm64_sys_openat+0xa8/0xc4 [ 36.395928][ T4933] invoke_syscall+0x98/0x244 [ 36.395938][ T4933] el0_svc_common+0xec/0x23c [ 36.395947][ T4933] do_el0_svc+0x4c/0x5c [ 36.395956][ T4933] el0_svc+0x60/0x1d8 [ 36.395966][ T4933] el0t_64_sync_handler+0x44/0x104 [ 36.395975][ T4933] el0t_64_sync+0x198/0x19c [ 36.395982][ T4933] [ 36.395984][ T4933] Allocated by task 1: [ 36.395988][ T4933] kasan_save_track+0x40/0x78 [ 36.395995][ T4933] kasan_save_alloc_info+0x40/0x50 [ 36.396002][ T4933] __kasan_kmalloc+0x9c/0xb4 [ 36.396008][ T4933] __kmalloc_cache_noprof+0x2f4/0x5fc [ 36.396014][ T4933] dvb_register_device+0x1a4/0x16e0 [ 36.396021][ T4933] dvb_register_frontend+0x474/0x6d0 [ 36.396030][ T4933] vidtv_bridge_probe+0x5a4/0xa58 [ 36.396037][ T4933] platform_probe+0x100/0x1a4 [ 36.396044][ T4933] really_probe+0x29c/0x800 [ 36.396049][ T4933] __driver_probe_device+0x1e0/0x350 [ 36.396059][ T4933] driver_probe_device+0x6c/0x19c [ 36.396064][ T4933] __driver_attach+0x168/0x384 [ 36.396073][ T4933] bus_for_each_dev+0x128/0x1b4 [ 36.396080][ T4933] driver_attach+0x50/0x60 [ 36.396088][ T4933] bus_add_driver+0x208/0x500 [ 36.396096][ T4933] driver_register+0x220/0x310 [ 36.396101][ T4933] __platform_driver_register+0x90/0xa4 [ 36.396107][ T4933] vidtv_bridge_init+0x4c/0x74 [ 36.396116][ T4933] do_one_initcall+0x274/0x9f8 [ 36.396124][ T4933] do_initcall_level+0x12c/0x1c4 [ 36.396130][ T4933] do_initcalls+0x70/0xd0 [ 36.396135][ T4933] do_basic_setup+0x7c/0x90 [ 36.396140][ T4933] kernel_init_freeable+0x258/0x398 [ 36.396145][ T4933] kernel_init+0x28/0x1e0 [ 36.396151][ T4933] ret_from_fork+0x10/0x20 [ 36.396156][ T4933] [ 36.396157][ T4933] Freed by task 4931: [ 36.396161][ T4933] kasan_save_track+0x40/0x78 [ 36.396166][ T4933] kasan_save_free_info+0x54/0x6c [ 36.396173][ T4933] __kasan_slab_free+0x74/0xa4 [ 36.396179][ T4933] kfree+0x188/0x658 [ 36.396187][ T4933] dvb_device_put+0x64/0xd0 [ 36.396194][ T4933] dvb_device_open+0x23c/0x254 [ 36.396201][ T4933] chrdev_open+0x398/0x3e8 [ 36.396208][ T4933] do_dentry_open+0x5c4/0xfbc [ 36.396216][ T4933] vfs_open+0x44/0x2dc [ 36.396223][ T4933] path_openat+0x1084/0x18f0 [ 36.396230][ T4933] do_file_open+0x1c8/0x2e8 [ 36.396236][ T4933] do_sys_openat2+0x114/0x1e8 [ 36.396243][ T4933] do_sys_open+0xb0/0xe0 [ 36.396251][ T4933] __arm64_sys_openat+0xa8/0xc4 [ 36.396258][ T4933] invoke_syscall+0x98/0x244 [ 36.396266][ T4933] el0_svc_common+0xec/0x23c [ 36.396274][ T4933] do_el0_svc+0x4c/0x5c [ 36.396281][ T4933] el0_svc+0x60/0x1d8 [ 36.396288][ T4933] el0t_64_sync_handler+0x44/0x104 [ 36.396296][ T4933] el0t_64_sync+0x198/0x19c [ 36.396301][ T4933] [ 36.396303][ T4933] The buggy address belongs to the object at ffff0000cb84d600 [ 36.396303][ T4933] which belongs to the cache kmalloc-256 of size 256 [ 36.396308][ T4933] The buggy address is located 24 bytes inside of [ 36.396308][ T4933] freed 256-byte region [ffff0000cb84d600, ffff0000cb84d700) [ 36.396315][ T4933] [ 36.396317][ T4933] The buggy address belongs to the physical page: [ 36.396321][ T4933] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10b84c [ 36.396328][ T4933] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 36.396333][ T4933] flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff) [ 36.396341][ T4933] page_type: f5(slab) [ 36.396348][ T4933] raw: 05ffc00000000040 ffff0000c0001b40 dead000000000100 dead000000000122 [ 36.396353][ T4933] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 36.396359][ T4933] head: 05ffc00000000040 ffff0000c0001b40 dead000000000100 dead000000000122 [ 36.396364][ T4933] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 36.396370][ T4933] head: 05ffc00000000001 fffffdffc32e1301 00000000ffffffff 00000000ffffffff [ 36.396375][ T4933] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 36.396378][ T4933] page dumped because: kasan: bad access detected [ 36.396381][ T4933] [ 36.396382][ T4933] Memory state around the buggy address: [ 36.396386][ T4933] ffff0000cb84d500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.396391][ T4933] ffff0000cb84d580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.396395][ T4933] >ffff0000cb84d600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.396398][ T4933] ^ [ 36.396401][ T4933] ffff0000cb84d680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.396405][ T4933] ffff0000cb84d700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.396409][ T4933] ================================================================== [ 36.396430][ T4933] Disabling lock debugging due to kernel taint [ 36.396434][ T4933] ------------[ cut here ]------------ [ 36.396437][ T4933] refcount_t: addition on 0; use-after-free. [ 36.396545][ T4933] WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x134/0x1f8, CPU#1: syz.0.19/4933 [ 36.522419][ T4933] Modules linked in: [ 36.523312][ T4933] CPU: 1 UID: 0 PID: 4933 Comm: syz.0.19 Tainted: G B syzkaller #0 PREEMPT [ 36.525487][ T4933] Tainted: [B]=BAD_PAGE [ 36.526292][ T4933] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 36.528274][ T4933] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 36.529883][ T4933] pc : refcount_warn_saturate+0x134/0x1f8 [ 36.531078][ T4933] lr : refcount_warn_saturate+0x134/0x1f8 [ 36.532256][ T4933] sp : ffff800099ed7700 [ 36.533120][ T4933] x29: ffff800099ed7700 x28: dfff800000000000 x27: 1fffe00019fc66e1 [ 36.534796][ T4933] x26: dfff800000000000 x25: ffff7000133daef4 x24: dfff800000000000 [ 36.536442][ T4933] x23: ffff8000873e24e8 x22: ffff0000cb014000 x21: ffff0000cb84d600 [ 36.538027][ T4933] x20: ffff0000cb84d610 x19: ffff80008a0f0000 x18: 0000000000000000 [ 36.539724][ T4933] x17: 3d3d3d3d3d3d3d3d x16: 3d3d3d3d3d3d3d3d x15: 3d3d3d3d3d3d3d3d [ 36.541510][ T4933] x14: 00000000000005da x13: 0000000000000001 x12: 0000000000000003 [ 36.543280][ T4933] x11: 0000000000000000 x10: 0000000000000002 x9 : 2aaf62fd97dc7100 [ 36.545025][ T4933] x8 : 2aaf62fd97dc7100 x7 : 0000000000000000 x6 : ffff800080483190 [ 36.546765][ T4933] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f3e60 [ 36.548553][ T4933] x2 : 0000000100000000 x1 : ffff0000c65f0000 x0 : 0000000000000000 [ 36.550097][ T4933] Call trace: [ 36.550718][ T4933] refcount_warn_saturate+0x134/0x1f8 (P) [ 36.551884][ T4933] dvb_device_get+0x9c/0xc0 [ 36.552777][ T4933] dvb_device_open+0x100/0x254 [ 36.553649][ T4933] chrdev_open+0x398/0x3e8 [ 36.554609][ T4933] do_dentry_open+0x5c4/0xfbc [ 36.555575][ T4933] vfs_open+0x44/0x2dc [ 36.556432][ T4933] path_openat+0x1084/0x18f0 [ 36.557359][ T4933] do_file_open+0x1c8/0x2e8 [ 36.558253][ T4933] do_sys_openat2+0x114/0x1e8 [ 36.559193][ T4933] do_sys_open+0xb0/0xe0 [ 36.560057][ T4933] __arm64_sys_openat+0xa8/0xc4 [ 36.561049][ T4933] invoke_syscall+0x98/0x244 [ 36.561989][ T4933] el0_svc_common+0xec/0x23c [ 36.562829][ T4933] do_el0_svc+0x4c/0x5c [ 36.563579][ T4933] el0_svc+0x60/0x1d8 [ 36.564391][ T4933] el0t_64_sync_handler+0x44/0x104 [ 36.565427][ T4933] el0t_64_sync+0x198/0x19c [ 36.566327][ T4933] irq event stamp: 2063 [ 36.567143][ T4933] hardirqs last enabled at (2063): [] __arm64_exit_to_kernel_mode+0x70/0xcc [ 36.569463][ T4933] hardirqs last disabled at (2062): [] handle_softirqs+0x9cc/0xcbc [ 36.571359][ T4933] softirqs last enabled at (2050): [] handle_softirqs+0xb2c/0xcbc [ 36.573271][ T4933] softirqs last disabled at (2041): [] __do_softirq+0x14/0x20 [ 36.575133][ T4933] ---[ end trace 0000000000000000 ]--- [ 36.578137][ T4933] ------------[ cut here ]------------ [ 36.578179][ T4933] refcount_t: underflow; use-after-free. [ 36.578286][ T4933] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x154/0x1f8, CPU#1: syz.0.19/4933 [ 36.582601][ T4933] Modules linked in: [ 36.583385][ T4933] CPU: 1 UID: 0 PID: 4933 Comm: syz.0.19 Tainted: G B W syzkaller #0 PREEMPT [ 36.585511][ T4933] Tainted: [B]=BAD_PAGE, [W]=WARN [ 36.586596][ T4933] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 36.588742][ T4933] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 36.590153][ T4933] pc : refcount_warn_saturate+0x154/0x1f8 [ 36.591333][ T4933] lr : refcount_warn_saturate+0x154/0x1f8 [ 36.592563][ T4933] sp : ffff800099ed75b0 [ 36.593450][ T4933] x29: ffff800099ed75b0 x28: ffff0000cae00800 x27: ffff0000cb84d600 [ 36.594977][ T4933] x26: ffff0000cba99308 x25: dfff800000000000 x24: ffff0000cad84180 [ 36.596668][ T4933] x23: 00000000fffffffc x22: 1fffe00019709ac7 x21: 00000000c0000000 [ 36.598272][ T4933] x20: ffff0000cb84d610 x19: ffff80008a0f0000 x18: 0000000000000000 [ 36.599763][ T4933] x17: 3d3d3d3d3d3d3d3d x16: 3d3d3d3d3d3d3d3d x15: 3d3d3d3d3d3d3d3d [ 36.601594][ T4933] x14: 0000000000000628 x13: 0000000000000001 x12: 0000000000000003 [ 36.603267][ T4933] x11: 0000000000000000 x10: 0000000000000002 x9 : 2aaf62fd97dc7100 [ 36.604786][ T4933] x8 : 2aaf62fd97dc7100 x7 : 0000000000000000 x6 : ffff800080483190 [ 36.606149][ T4933] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f3e60 [ 36.607737][ T4933] x2 : 0000000100000000 x1 : ffff0000c65f0000 x0 : 0000000000000000 [ 36.609386][ T4933] Call trace: [ 36.609966][ T4933] refcount_warn_saturate+0x154/0x1f8 (P) [ 36.611041][ T4933] dvb_device_put+0xac/0xd0 [ 36.612012][ T4933] dvb_generic_release+0xec/0x158 [ 36.613097][ T4933] __dvb_frontend_open+0x5c4/0xa34 [ 36.614198][ T4933] dvb_frontend_open+0x19c/0x70c [ 36.615183][ T4933] dvb_device_open+0x1f8/0x254 [ 36.616096][ T4933] chrdev_open+0x398/0x3e8 [ 36.616972][ T4933] do_dentry_open+0x5c4/0xfbc [ 36.617920][ T4933] vfs_open+0x44/0x2dc [ 36.618658][ T4933] path_openat+0x1084/0x18f0 [ 36.619538][ T4933] do_file_open+0x1c8/0x2e8 [ 36.620387][ T4933] do_sys_openat2+0x114/0x1e8 [ 36.621321][ T4933] do_sys_open+0xb0/0xe0 [ 36.622240][ T4933] __arm64_sys_openat+0xa8/0xc4 [ 36.623282][ T4933] invoke_syscall+0x98/0x244 [ 36.624293][ T4933] el0_svc_common+0xec/0x23c [ 36.625287][ T4933] do_el0_svc+0x4c/0x5c [ 36.626170][ T4933] el0_svc+0x60/0x1d8 [ 36.627035][ T4933] el0t_64_sync_handler+0x44/0x104 [ 36.628038][ T4933] el0t_64_sync+0x198/0x19c [ 36.628956][ T4933] irq event stamp: 2063 [ 36.629713][ T4933] hardirqs last enabled at (2063): [] __arm64_exit_to_kernel_mode+0x70/0xcc [ 36.631651][ T4933] hardirqs last disabled at (2062): [] handle_softirqs+0x9cc/0xcbc [ 36.633431][ T4933] softirqs last enabled at (2050): [] handle_softirqs+0xb2c/0xcbc [ 36.635367][ T4933] softirqs last disabled at (2041): [] __do_softirq+0x14/0x20 [ 36.637319][ T4933] ---[ end trace 0000000000000000 ]--- [ 36.640390][ T4845] usb 1-1: USB disconnect, device number 4 [ 36.640504][ C1] ldusb 1-1:0.0: usb_submit_urb failed (-19) [ 36.640977][ T4845] ldusb 1-1:0.0: LD USB Device #0 now disconnected [ 37.379972][ T4795] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 37.530057][ T4795] usb 1-1: Using ep0 maxpacket: 32 [ 37.530404][ T4795] usb 1-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 37.531025][ T4795] usb 1-1: config index 0 descriptor too short (expected 156, got 27) [ 37.531036][ T4795] usb 1-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 37.531047][ T4795] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 103, changing to 10 [ 37.531057][ T4795] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has invalid maxpacket 26217, setting to 1024 [ 37.531066][ T4795] usb 1-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 37.531076][ T4795] usb 1-1: config 0 interface 0 has no altsetting 0 [ 37.532307][ T4795] usb 1-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 37.532317][ T4795] usb 1-1: Product: syz [ 37.532324][ T4795] usb 1-1: Manufacturer: syz [ 37.532330][ T4795] usb 1-1: SerialNumber: syz [ 37.533120][ T4795] usb 1-1: config 0 descriptor?? [ 37.533453][ T4937] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 37.534131][ T4795] ldusb 1-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 37.534857][ T4795] ldusb 1-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 37.736440][ T4937] ------------[ cut here ]------------ [ 37.736487][ T4937] refcount_t: saturated; leaking memory. [ 37.736594][ T4937] WARNING: lib/refcount.c:22 at refcount_warn_saturate+0x1b4/0x1f8, CPU#1: syz.0.20/4937 [ 37.740542][ T4937] Modules linked in: [ 37.741282][ T4937] CPU: 1 UID: 0 PID: 4937 Comm: syz.0.20 Tainted: G B W syzkaller #0 PREEMPT [ 37.743256][ T4937] Tainted: [B]=BAD_PAGE, [W]=WARN [ 37.744158][ T4937] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 37.746011][ T4937] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 37.747489][ T4937] pc : refcount_warn_saturate+0x1b4/0x1f8 [ 37.748563][ T4937] lr : refcount_warn_saturate+0x1b4/0x1f8 [ 37.749680][ T4937] sp : ffff8000988f7700 [ 37.750453][ T4937] x29: ffff8000988f7700 x28: dfff800000000000 x27: 1fffe00019dc6d91 [ 37.751982][ T4937] x26: dfff800000000000 x25: ffff70001311eef4 x24: dfff800000000000 [ 37.753515][ T4937] x23: ffff8000873e24e8 x22: ffff0000cb014000 x21: 000000007ffffffe [ 37.755026][ T4937] x20: ffff0000cb84d610 x19: ffff80008a0f0000 x18: 0000000000000000 [ 37.756563][ T4937] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000001 [ 37.758092][ T4937] x14: 00000000000006a4 x13: 0000000000000001 x12: 0000000000000003 [ 37.759640][ T4937] x11: 0000000000000000 x10: 0000000000000002 x9 : a153a0264b93c100 [ 37.761052][ T4937] x8 : a153a0264b93c100 x7 : 0000000000000000 x6 : ffff800080483190 [ 37.762594][ T4937] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f3e60 [ 37.764152][ T4937] x2 : 0000000100000000 x1 : ffff0000d1169d80 x0 : 0000000000000000 [ 37.765749][ T4937] Call trace: [ 37.766361][ T4937] refcount_warn_saturate+0x1b4/0x1f8 (P) [ 37.767445][ T4937] dvb_device_get+0x9c/0xc0 [ 37.768247][ T4937] dvb_device_open+0x100/0x254 [ 37.769120][ T4937] chrdev_open+0x398/0x3e8 [ 37.769957][ T4937] do_dentry_open+0x5c4/0xfbc [ 37.770860][ T4937] vfs_open+0x44/0x2dc [ 37.771637][ T4937] path_openat+0x1084/0x18f0 [ 37.772454][ T4937] do_file_open+0x1c8/0x2e8 [ 37.773318][ T4937] do_sys_openat2+0x114/0x1e8 [ 37.774201][ T4937] do_sys_open+0xb0/0xe0 [ 37.775148][ T4937] __arm64_sys_openat+0xa8/0xc4 [ 37.776254][ T4937] invoke_syscall+0x98/0x244 [ 37.777272][ T4937] el0_svc_common+0xec/0x23c [ 37.778165][ T4937] do_el0_svc+0x4c/0x5c [ 37.778941][ T4937] el0_svc+0x60/0x1d8 [ 37.779751][ T4937] el0t_64_sync_handler+0x44/0x104 [ 37.780775][ T4937] el0t_64_sync+0x198/0x19c [ 37.781650][ T4937] irq event stamp: 0 [ 37.782396][ T4937] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [ 37.783665][ T4937] hardirqs last disabled at (0): [] copy_process+0x129c/0x34c4 [ 37.785459][ T4937] softirqs last enabled at (0): [] copy_process+0x12bc/0x34c4 [ 37.787254][ T4937] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 37.788601][ T4937] ---[ end trace 0000000000000000 ]--- [ 37.789779][ T4733] Bluetooth: hci0: command tx timeout [ 37.790178][ C1] ldusb 1-1:0.0: usb_submit_urb failed (-19) [ 37.790194][ T4845] usb 1-1: USB disconnect, device number 5 [ 37.790709][ T4845] ldusb 1-1:0.0: LD USB Device #0 now disconnected [ 38.529902][ T4383] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 38.679836][ T4383] usb 1-1: Using ep0 maxpacket: 32 [ 38.680181][ T4383] usb 1-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 38.680806][ T4383] usb 1-1: config index 0 descriptor too short (expected 156, got 27) [ 38.680817][ T4383] usb 1-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 38.680832][ T4383] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 103, changing to 10 [ 38.680842][ T4383] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has invalid maxpacket 26217, setting to 1024 [ 38.680852][ T4383] usb 1-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 38.680862][ T4383] usb 1-1: config 0 interface 0 has no altsetting 0 [ 38.682080][ T4383] usb 1-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 38.682091][ T4383] usb 1-1: Product: syz [ 38.682099][ T4383] usb 1-1: Manufacturer: syz [ 38.682106][ T4383] usb 1-1: SerialNumber: syz [ 38.682959][ T4383] usb 1-1: config 0 descriptor?? [ 38.683317][ T4938] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 38.683947][ T4383] ldusb 1-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 38.684591][ T4383] ldusb 1-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 38.885150][ T4795] usb 1-1: USB disconnect, device number 6 [ 38.885259][ C0] ldusb 1-1:0.0: usb_submit_urb failed (-19) [ 38.885680][ T4795] ldusb 1-1:0.0: LD USB Device #0 now disconnected [ 39.639819][ T4795] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 39.799812][ T4795] usb 1-1: Using ep0 maxpacket: 32 [ 39.800155][ T4795] usb 1-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 39.800785][ T4795] usb 1-1: config index 0 descriptor too short (expected 156, got 27) [ 39.800797][ T4795] usb 1-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 39.800812][ T4795] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 103, changing to 10 [ 39.800822][ T4795] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has invalid maxpacket 26217, setting to 1024 [ 39.800834][ T4795] usb 1-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 39.800843][ T4795] usb 1-1: config 0 interface 0 has no altsetting 0 [ 39.802081][ T4795] usb 1-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 39.802092][ T4795] usb 1-1: Product: syz [ 39.802100][ T4795] usb 1-1: Manufacturer: syz [ 39.802106][ T4795] usb 1-1: SerialNumber: syz [ 39.803726][ T4795] usb 1-1: config 0 descriptor?? [ 39.804025][ T4941] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 39.804738][ T4795] ldusb 1-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 39.805026][ T4795] ldusb 1-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 40.005280][ T4795] usb 1-1: USB disconnect, device number 7 [ 40.005319][ C0] ldusb 1-1:0.0: usb_submit_urb failed (-19) [ 40.005823][ T4795] ldusb 1-1:0.0: LD USB Device #0 now disconnected 1970/01/01 00:00:40 executed programs: 8 [ 40.749828][ T4795] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 40.899817][ T4795] usb 1-1: Using ep0 maxpacket: 32 [ 40.900159][ T4795] usb 1-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 40.900778][ T4795] usb 1-1: config index 0 descriptor too short (expected 156, got 27) [ 40.900792][ T4795] usb 1-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 40.900803][ T4795] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 103, changing to 10 [ 40.900813][ T4795] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has invalid maxpacket 26217, setting to 1024 [ 40.900823][ T4795] usb 1-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 40.900835][ T4795] usb 1-1: config 0 interface 0 has no altsetting 0 [ 40.902055][ T4795] usb 1-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 40.902065][ T4795] usb 1-1: Product: syz [ 40.902072][ T4795] usb 1-1: Manufacturer: syz [ 40.902078][ T4795] usb 1-1: SerialNumber: syz [ 40.902876][ T4795] usb 1-1: config 0 descriptor?? [ 40.903133][ T4943] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 40.903841][ T4795] ldusb 1-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 40.904421][ T4795] ldusb 1-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 41.104265][ T4795] usb 1-1: USB disconnect, device number 8 [ 41.104344][ C1] ldusb 1-1:0.0: usb_submit_urb failed (-19) [ 41.105283][ T4795] ldusb 1-1:0.0: LD USB Device #0 now disconnected [ 41.849826][ T4383] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 42.009889][ T4383] usb 1-1: Using ep0 maxpacket: 32 [ 42.010231][ T4383] usb 1-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 42.010852][ T4383] usb 1-1: config index 0 descriptor too short (expected 156, got 27) [ 42.010865][ T4383] usb 1-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 42.010884][ T4383] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 103, changing to 10 [ 42.010894][ T4383] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has invalid maxpacket 26217, setting to 1024 [ 42.010903][ T4383] usb 1-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 42.010913][ T4383] usb 1-1: config 0 interface 0 has no altsetting 0 [ 42.012802][ T4383] usb 1-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 42.012813][ T4383] usb 1-1: Product: syz [ 42.012824][ T4383] usb 1-1: Manufacturer: syz [ 42.012832][ T4383] usb 1-1: SerialNumber: syz [ 42.013622][ T4383] usb 1-1: config 0 descriptor?? [ 42.013934][ T4944] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 42.015189][ T4383] ldusb 1-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 42.015451][ T4383] ldusb 1-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 42.215087][ T4383] usb 1-1: USB disconnect, device number 9 [ 42.215198][ C1] ldusb 1-1:0.0: usb_submit_urb failed (-19) [ 42.218016][ T4383] ldusb 1-1:0.0: LD USB Device #0 now disconnected [ 42.969822][ T4383] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 43.119834][ T4383] usb 1-1: Using ep0 maxpacket: 32 [ 43.120178][ T4383] usb 1-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 43.120798][ T4383] usb 1-1: config index 0 descriptor too short (expected 156, got 27) [ 43.120810][ T4383] usb 1-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 43.120824][ T4383] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 103, changing to 10 [ 43.120834][ T4383] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has invalid maxpacket 26217, setting to 1024 [ 43.120843][ T4383] usb 1-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 43.120853][ T4383] usb 1-1: config 0 interface 0 has no altsetting 0 [ 43.122755][ T4383] usb 1-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 43.122762][ T4383] usb 1-1: Product: syz [ 43.122768][ T4383] usb 1-1: Manufacturer: syz [ 43.122773][ T4383] usb 1-1: SerialNumber: syz [ 43.123578][ T4383] usb 1-1: config 0 descriptor?? [ 43.123920][ T4946] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 43.124573][ T4383] ldusb 1-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 43.124976][ T4383] ldusb 1-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 43.326591][ T4795] usb 1-1: USB disconnect, device number 10 [ 43.326610][ C0] ldusb 1-1:0.0: usb_submit_urb failed (-19) [ 43.327558][ T4795] ldusb 1-1:0.0: LD USB Device #0 now disconnected [ 44.069824][ T4795] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 44.219819][ T4795] usb 1-1: Using ep0 maxpacket: 32 [ 44.220158][ T4795] usb 1-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 44.220789][ T4795] usb 1-1: config index 0 descriptor too short (expected 156, got 27) [ 44.220801][ T4795] usb 1-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 44.220812][ T4795] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 103, changing to 10 [ 44.220822][ T4795] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has invalid maxpacket 26217, setting to 1024 [ 44.220833][ T4795] usb 1-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 44.220844][ T4795] usb 1-1: config 0 interface 0 has no altsetting 0 [ 44.222072][ T4795] usb 1-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 44.222080][ T4795] usb 1-1: Product: syz [ 44.222085][ T4795] usb 1-1: Manufacturer: syz [ 44.222090][ T4795] usb 1-1: SerialNumber: syz [ 44.222879][ T4795] usb 1-1: config 0 descriptor?? [ 44.223207][ T4948] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 44.223882][ T4795] ldusb 1-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 44.224437][ T4795] ldusb 1-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 44.425286][ T4383] usb 1-1: USB disconnect, device number 11 [ 44.425298][ C1] ldusb 1-1:0.0: usb_submit_urb failed (-19) [ 44.426771][ T4383] ldusb 1-1:0.0: LD USB Device #0 now disconnected [ 45.169825][ T4383] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 45.339818][ T4383] usb 1-1: Using ep0 maxpacket: 32 [ 45.341235][ T4383] usb 1-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 45.341875][ T4383] usb 1-1: config index 0 descriptor too short (expected 156, got 27) [ 45.341888][ T4383] usb 1-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 45.341901][ T4383] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 103, changing to 10 [ 45.341911][ T4383] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has invalid maxpacket 26217, setting to 1024 [ 45.341920][ T4383] usb 1-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 45.341930][ T4383] usb 1-1: config 0 interface 0 has no altsetting 0 [ 45.343205][ T4383] usb 1-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 45.343219][ T4383] usb 1-1: Product: syz [ 45.343226][ T4383] usb 1-1: Manufacturer: syz [ 45.343231][ T4383] usb 1-1: SerialNumber: syz [ 45.343995][ T4383] usb 1-1: config 0 descriptor?? [ 45.344320][ T4950] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 45.345479][ T4383] ldusb 1-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 45.345736][ T4383] ldusb 1-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 45.545747][ T4383] usb 1-1: USB disconnect, device number 12 [ 45.545767][ C1] ldusb 1-1:0.0: usb_submit_urb failed (-19) [ 45.547407][ T4383] ldusb 1-1:0.0: LD USB Device #0 now disconnected 1970/01/01 00:00:46 executed programs: 13 [ 46.289821][ T4383] usb 1-1: new high-speed USB device number 13 using dummy_hcd