last executing test programs: 1m25.832324951s ago: executing program 0 (id=133): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=ANY=[@ANYBLOB="1800"], 0x18}}, 0x0) pipe2$watch_queue(&(0x7f00000002c0), 0x80) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB="00042dbd7000fd"], 0x14}, 0x1, 0x0, 0x0, 0x2010}, 0x4001) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x38, 0xfff, 0x0, 0x180, 0x4, 0xff, 0xf1, 0x0, 0x7fffffffffffe, 0x5, 0x4005, 0x8, 0x0, 0x45, 0x1, 0xbdb], 0xdddd0000, 0x1c4213}) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e22, @broadcast}, 0x10) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1m25.46173226s ago: executing program 0 (id=136): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x181800, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x10004, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(0xffffffffffffffff, 0x1, &(0x7f0000000200)={0x100}, 0x0) close(0xffffffffffffffff) umount2(&(0x7f00000002c0)='./file0\x00', 0x0) r2 = openat$vicodec0(0xffffff9c, &(0x7f0000001dc0), 0x2, 0x0) ioctl$VIDIOC_DQBUF(r2, 0xc04c5611, &(0x7f0000001e00)=@overlay={0x1, 0xa, 0x4, 0x800, 0x9, {0x77359400}, {0x1, 0xc, 0x6, 0x6, 0x4, 0x1, "6db7036d"}, 0x4, 0x3, {}, 0x2}) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x28081) syz_open_procfs$namespace(0x0, &(0x7f00000003c0)='ns/net\x00') writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x5, 0xfffffffffffffffd, 0x8001, 0x0, 0x5, 0x45}, 0x0, &(0x7f0000000080)={0x3ff, 0x4, 0x100000, 0x9, 0x0, 0x10, 0x80000002}, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 1m24.794203285s ago: executing program 0 (id=139): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x48, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000007c0)=@file={0x0, './file1/file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x19, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4000}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r1 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl(r1, 0x8b2c, &(0x7f0000000040)) socket$packet(0x11, 0x2, 0x300) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043ef502"], 0xf8) ioctl$VIDIOC_S_PARM(r1, 0xc0cc5616, &(0x7f0000000840)={0x5, @output={0x0, 0x1, {0x9, 0xfffffff9}, 0x101, 0x2}}) mount(0x0, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='xfs\x00', 0x2208004, 0x0) syz_open_dev$cec(&(0x7f0000000200), 0xffffffffffffffff, 0x4ae60) 1m24.655711782s ago: executing program 0 (id=140): openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000480), 0xfffffffffffffffa, 0x1841) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000500)="9b7385220700000000000000e57c489b51b14b7aea6ef45d0c085cb7df42ccf49eabcf03d0e97bb857dbd8d553a187d0", 0x30}, {&(0x7f0000000540)="53000000d073b0f3347edc854b4bc4db1e2e1302af076bb6c9909a18e554d5ecc9db5942dac6a182a0efc18289ba2d68f7e5121dc8db62a39389242ce69529ab9bb7aad26d928b530b9345c2ccce127c140538", 0x53}], 0x2) write$USERIO_CMD_SET_PORT_TYPE(0xffffffffffffffff, 0x0, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(0xffffffffffffffff, 0xc05c6104, 0x0) ioctl$CEC_TRANSMIT(0xffffffffffffffff, 0xc0386105, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0xf9ba, 0x101) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_GET(r4, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc040}, 0x4000000) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'macvtap0\x00', 0x0}) sendmmsg(0xffffffffffffffff, &(0x7f0000001240), 0x0, 0x8010) sendmsg$ETHTOOL_MSG_CHANNELS_SET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x30, r3, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [@ETHTOOL_A_CHANNELS_COMBINED_COUNT={0x8, 0x9, 0x6}, @ETHTOOL_A_CHANNELS_HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x8080}, 0x8885) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2) 1m23.509867901s ago: executing program 0 (id=149): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x2, 0x2, 0x7}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_ADDFB2(r3, 0xc06864b8, &(0x7f0000000580)={0x0, 0xc1, 0x7f, 0x20203843, 0x0, [0x2], [0x800]}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f0000000200)={&(0x7f00000000c0), 0x0, 0x0, 0x0, 0x1, 0x59}) socket$inet6(0xa, 0x2, 0x0) socket$kcm(0x10, 0x3, 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000040), 0x0) socket$pppl2tp(0x18, 0x1, 0x1) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) 1m20.576652383s ago: executing program 0 (id=157): r0 = syz_open_dev$video(&(0x7f0000000100), 0x3, 0x2000) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r4 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) ioctl$SNDCTL_DSP_SPEED(r4, 0xc0045002, &(0x7f0000000080)=0x3ff) write$dsp(r4, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newsa={0x138, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in=@rand_addr=0x64010101, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@dev={0xac, 0x14, 0x14, 0x3f}, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) syz_emit_ethernet(0x6a, &(0x7f00000002c0)={@local, @broadcast, @void, {@ipv4={0x800, @tipc={{0xc, 0x4, 0x0, 0x3c, 0x5c, 0x67, 0x0, 0x3, 0x6, 0x0, @rand_addr=0x64010100, @local, {[@rr={0x7, 0xf, 0x7, [@initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0xa}, @multicast2]}, @ssrr={0x89, 0x7, 0x1e, [@multicast1]}, @lsrr={0x83, 0x3, 0x93}]}}, @payload_mcast={{{{{{0x2c, 0x0, 0x0, 0x0, 0x0, 0xb, 0x1, 0x2, 0x5, 0x0, 0x1, 0x1, 0x0, 0x1, 0x800, 0x1, 0x1, 0x4e21, 0x4e22}, 0x1}, 0x3}, 0x1}}}}}}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newsa={0x138, 0x18, 0x1, 0xfffffffe, 0x100, {{@in6=@ipv4={'\x00', '\xff\xff', @multicast2}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x71c, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@dev={0xac, 0x14, 0x14, 0x25}, {0x0, 0x192, 0x9ba3, 0xffff, 0x8251c, 0x5, 0xfffffffffffffffc}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0xfffffffa, 0xfffffffc}, 0x80, 0x3500, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={&(0x7f00000000c0)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0xe, @in={0x2, 0x0, @multicast1=0xe0000009}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}]}, 0x50}}, 0x0) ioctl$VIDIOC_S_FMT(r0, 0xc0cc5605, &(0x7f00000025c0)={0x1, @vbi={0x8, 0x449, 0x47524247, 0x0, [0x4, 0x3], [0x40, 0x2], 0x13a}}) r7 = socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000180)={@local, @multicast, @void, {@ipv6={0x86dd, @generic={0xc, 0x6, '\x00', 0x0, 0x2c, 0x1, @empty, @mcast2}}}}, 0x0) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="0c04000010000104000000000000000000480000", @ANYRES32=r7, @ANYBLOB="101000000000000008000d0005000000e4031680a40001800c00070000000000adffffff0c00", @ANYRES16=r7], 0x40c}}, 0x0) 1m5.423939739s ago: executing program 32 (id=157): r0 = syz_open_dev$video(&(0x7f0000000100), 0x3, 0x2000) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r4 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) ioctl$SNDCTL_DSP_SPEED(r4, 0xc0045002, &(0x7f0000000080)=0x3ff) write$dsp(r4, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newsa={0x138, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in=@rand_addr=0x64010101, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@dev={0xac, 0x14, 0x14, 0x3f}, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) syz_emit_ethernet(0x6a, &(0x7f00000002c0)={@local, @broadcast, @void, {@ipv4={0x800, @tipc={{0xc, 0x4, 0x0, 0x3c, 0x5c, 0x67, 0x0, 0x3, 0x6, 0x0, @rand_addr=0x64010100, @local, {[@rr={0x7, 0xf, 0x7, [@initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0xa}, @multicast2]}, @ssrr={0x89, 0x7, 0x1e, [@multicast1]}, @lsrr={0x83, 0x3, 0x93}]}}, @payload_mcast={{{{{{0x2c, 0x0, 0x0, 0x0, 0x0, 0xb, 0x1, 0x2, 0x5, 0x0, 0x1, 0x1, 0x0, 0x1, 0x800, 0x1, 0x1, 0x4e21, 0x4e22}, 0x1}, 0x3}, 0x1}}}}}}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newsa={0x138, 0x18, 0x1, 0xfffffffe, 0x100, {{@in6=@ipv4={'\x00', '\xff\xff', @multicast2}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x71c, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@dev={0xac, 0x14, 0x14, 0x25}, {0x0, 0x192, 0x9ba3, 0xffff, 0x8251c, 0x5, 0xfffffffffffffffc}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0xfffffffa, 0xfffffffc}, 0x80, 0x3500, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={&(0x7f00000000c0)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0xe, @in={0x2, 0x0, @multicast1=0xe0000009}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}]}, 0x50}}, 0x0) ioctl$VIDIOC_S_FMT(r0, 0xc0cc5605, &(0x7f00000025c0)={0x1, @vbi={0x8, 0x449, 0x47524247, 0x0, [0x4, 0x3], [0x40, 0x2], 0x13a}}) r7 = socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000180)={@local, @multicast, @void, {@ipv6={0x86dd, @generic={0xc, 0x6, '\x00', 0x0, 0x2c, 0x1, @empty, @mcast2}}}}, 0x0) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="0c04000010000104000000000000000000480000", @ANYRES32=r7, @ANYBLOB="101000000000000008000d0005000000e4031680a40001800c00070000000000adffffff0c00", @ANYRES16=r7], 0x40c}}, 0x0) 13.374648787s ago: executing program 5 (id=434): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000240), 0x2, 0x40102) writev(r0, 0x0, 0x0) syz_mount_image$erofs(&(0x7f0000000180), &(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="00ea2eb34e7ea51c9446c55a2d1e0be39af9faf44ad59cb6ad1c94490d970e811439edddc71c9b18946b559ce53bee0a1abe562fc3f3898e5826eda1962cf6e3c4c0ade52151923a70b46eacfc1aaaebcf156e549e884bcabc1333f344f31cd30cd93cb2814e0dbc24a7a107e295e86e09283c825fe177c89c6385f68f2c843cffffffff15539bab6142ceed9265ba989d1a283fc4ffc83f3a7a6c746823e656ad78f3b5a336cdbd83dad59e0debb36b4ea5e658e253f01637cc03f704a08019f95b92fffffffff8dd21552d6967ab1b01e5d52a5793eb179deee4572770a5197127b090287bca2a4eaa1705b42c16968d0201d3ba3cc8000000657ea095f152b1b6a1e6ad8d24ad17f649ccc23d4ecbcdb5620cc48f95f563c2230f859d196e6c4f00b8e3a7b01fcb1d79dcc09b7a854ec8c31dd27ff9b4a2864e1dcaf719d20b56769d51228ecc1915fb8c8b598c11b3c296b05f9c5355fc6f19a7b28f5ae9a0d0804ccc5716cfac0246ddffa2f12077a02a959aa1b74373c38b2bcc90743b80666eae25dea73e127263b8fdbc64fe862b994ca8473d0000000000000000"], 0x1, 0x17d, &(0x7f00000004c0)="$eJzsmD9P6lAYxp/TciH35iY6u2giCTBY2qJGBgdmB038FzeJVIIWMdBB2PwUzn4CZ+JC4sfQQZ1ccHNyqGl7gAP+HdTE+PyG9zzv6dvTc94mT5OCEPJrub15uD5LJS90AP+RRELO3+mDGk2pb489Zi4ry+cn5v1Vu7OUH11PAPD9jz8/BqBT0OHJ3PeH707KcQ1aX69DQ0bqTQgYUm9Dw4bUDgS2pN5TdC2oN4zdiusYOzW3FAgzCFYQ7CDkRvfXPRYoKfsTyvVGs7VfdF2n/oXivf51CxoWlf2p76vXG1PpnwUNltQ5CKxKvYBErzdRS5TzT8QG6+vffH4KCoqfJgb+5J8KpBR/iin+kfWqh9lGszVTqRbLTtk5sO3cvDlrmnN2NjSiKL7hf39Df/qnrP/nldq4iOOo6Hl1K4r93I7iS44bD/1PQ3o6yoWcUwm/B+NiKhjSuswJIYQQQgghhBBCCCHk05mECP+CDpF/NmWvhNVPAQAA//94vnZt") chdir(0x0) r1 = openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) lseek(r1, 0xfffffffffffffffc, 0x2) getdents(r1, 0x0, 0x54) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r2 = syz_open_procfs(0x0, 0x0) writev(r2, &(0x7f00000000c0)=[{}], 0x1) openat(0xffffffffffffff9c, 0x0, 0x101042, 0x0) r3 = syz_open_dev$dvb_demux(&(0x7f00000003c0), 0x0, 0x105e01) ioctl$DVB_DEMUX_DMX_GET_STC(r3, 0xc0106f32, &(0x7f0000000040)={0xfffffffc}) bind$inet(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x10) 13.142622839s ago: executing program 5 (id=436): ioctl$FAT_IOCTL_GET_ATTRIBUTES(0xffffffffffffffff, 0x80047210, 0x0) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000700)=ANY=[@ANYBLOB="1201000000000010711e0920000000000001090224000100000000090400090103000100092105000001220500090581030002"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB='\x00\x00\b'], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_open_dev$hidraw(&(0x7f00000001c0), 0x7fff800000000, 0x1050c0) 11.670224716s ago: executing program 1 (id=441): syz_usb_connect(0x0, 0x5a, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) setsockopt$RXRPC_SECURITY_KEYRING(0xffffffffffffffff, 0x110, 0x2, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(0xffffffffffffffff, 0x40946400, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x3) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = userfaultfd(0x801) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000800) ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1000000, 0x5d032, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x80801) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_usb_connect$cdc_ncm(0x3, 0x72, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_GET(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="5c0000000101010100000000000000000a0000003c00018005000280050001003a0000002c00010900000300fc02000000"], 0x5c}}, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) 8.162164327s ago: executing program 5 (id=444): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000000c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="0100fdffffff000000001e0000000800", @ANYRES32], 0x5c}, 0x1, 0x0, 0x0, 0x30ea32fe53398b3d}, 0x0) 8.073894532s ago: executing program 4 (id=446): socket$kcm(0x10, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000480)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x1}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) add_key$fscrypt_v1(0x0, &(0x7f0000000480)={'fscrypt:', @auto=[0x0, 0x0, 0x0, 0x34]}, &(0x7f00000000c0)={0x0, "3e82554dc8ccfbc2e85ec82d4ee9df60f6ae16b1a5f2c848722ba3b132e4fde178c945bd950b0477e801fc8a1be9b4ebbe9c2289a6b0aa00"}, 0x48, 0xfffffffffffffffe) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/timer_list\x00', 0x0, 0x0) r4 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/tcp_sack\x00', 0x1, 0x0) sendfile(r4, r3, &(0x7f00000000c0)=0x8b, 0x100000500) 7.857295583s ago: executing program 3 (id=447): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000100)={0x0, 0x5, 0x40}, 0x8) 7.278313723s ago: executing program 4 (id=449): sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x48, 0x0, 0x0) connect$unix(r1, &(0x7f00000007c0)=@file={0x0, './file1/file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x19, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4000}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r3 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl(r3, 0x8b2c, &(0x7f0000000040)) socket$packet(0x11, 0x2, 0x300) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043ef502"], 0xf8) ioctl$VIDIOC_S_PARM(r3, 0xc0cc5616, &(0x7f0000000840)={0x5, @output={0x0, 0x1, {0x9, 0xfffffff9}, 0x101, 0x2}}) mount(0x0, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='xfs\x00', 0x2208004, 0x0) syz_open_dev$cec(&(0x7f0000000200), 0xffffffffffffffff, 0x4ae60) 7.278139833s ago: executing program 3 (id=450): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_procfs(0x0, &(0x7f00000000c0)='net/softnet_stat\x00') openat$ptp0(0xffffff9c, &(0x7f0000000080), 0x400, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{0x0}], 0x1) syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) read$FUSE(0xffffffffffffffff, 0x0, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x1000000, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) 7.244839555s ago: executing program 2 (id=451): socket$nl_route(0x10, 0x3, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000240)=0x3) ioctl$SNDCTL_DSP_CHANNELS(r0, 0xc0045006, &(0x7f0000000080)=0x7f) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f0000000000)=0xffffffff) read$dsp(r0, &(0x7f0000000340)=""/36, 0x24) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x8081) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bind$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) 7.182235338s ago: executing program 5 (id=452): r0 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001900599c6d0e000091d028ef8020"], 0xfe33) r1 = syz_usb_connect$hid(0x0, 0x6c, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000000000040b827ed0100000000000109022400010000000009040000010300000009210000200122050009058103"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000b80)={0x24, 0x0, 0x0, &(0x7f0000000b00)={0x0, 0x22, 0x5, {[@global=@item_4={0x3, 0x1, 0x0, "efb9ce47"}]}}, 0x0}, 0x0) socket(0x18, 0x2, 0x400000) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000040)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x12, r2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x1, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1802000000000000000000000920000095"], &(0x7f0000000000)='syzkaller\x00', 0x8, 0xff5, &(0x7f0000001840)=""/4085, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x11d}, 0x94) syz_usb_control_io$hid(r1, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) write(r3, &(0x7f0000000000)="240000001a005f7f00f9f407000904bf80000000080000000000000004001e", 0x1f) setsockopt$netlink_NETLINK_NO_ENOBUFS(r3, 0x10e, 0xc, &(0x7f0000000340)=0x6, 0x4) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[], 0x24}}, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000140)={0x44, &(0x7f0000000380)=ANY=[@ANYBLOB="20de238f6735cfaa1ae95581fcc01d6c438312cfea227f4fcfc37b4d3a1c770b753a6d3b7f2096978be96b55531635edcbb8c557d3db2e18057d4d10659af0e160984346c583ea9b14005e6873e5ced0fc4c915b498108fffe291cc3adc4539e0c9e49a5a6ebc33c4cfe7c5005e40530175f089e84bc3fc659a4f5ebe70eed9d606fddcdae9e3607456eeaca1ca60882b7e6100f9b10b78abdda9956542b06b36473472f5f61a3ee7631ee0da5af9b89165b2d54a7748bbea70a4e236d5e671f2e58864f7936661244e4d7a8824c919eafe9c1b052462481997be94145ad"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 7.093439973s ago: executing program 1 (id=453): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x100}) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) 5.398800261s ago: executing program 3 (id=454): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000240), 0x2, 0x40102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2f) syz_mount_image$erofs(&(0x7f0000000180), &(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="00ea2eb34e7ea51c9446c55a2d1e0be39af9faf44ad59cb6ad1c94490d970e811439edddc71c9b18946b559ce53bee0a1abe562fc3f3898e5826eda1962cf6e3c4c0ade52151923a70b46eacfc1aaaebcf156e549e884bcabc1333f344f31cd30cd93cb2814e0dbc24a7a107e295e86e09283c825fe177c89c6385f68f2c843cffffffff15539bab6142ceed9265ba989d1a283fc4ffc83f3a7a6c746823e656ad78f3b5a336cdbd83dad59e0debb36b4ea5e658e253f01637cc03f704a08019f95b92fffffffff8dd21552d6967ab1b01e5d52a5793eb179deee4572770a5197127b090287bca2a4eaa1705b42c16968d0201d3ba3cc8000000657ea095f152b1b6a1e6ad8d24ad17f649ccc23d4ecbcdb5620cc48f95f563c2230f859d196e6c4f00b8e3a7b01fcb1d79dcc09b7a854ec8c31dd27ff9b4a2864e1dcaf719d20b56769d51228ecc1915fb8c8b598c11b3c296b05f9c5355fc6f19a7b28f5ae9a0d0804ccc5716cfac0246ddffa2f12077a02a959aa1b74373c38b2bcc90743b80666eae25dea73e127263b8fdbc64fe862b994ca8473d0000000000000000"], 0x1, 0x17d, &(0x7f00000004c0)="$eJzsmD9P6lAYxp/TciH35iY6u2giCTBY2qJGBgdmB038FzeJVIIWMdBB2PwUzn4CZ+JC4sfQQZ1ccHNyqGl7gAP+HdTE+PyG9zzv6dvTc94mT5OCEPJrub15uD5LJS90AP+RRELO3+mDGk2pb489Zi4ry+cn5v1Vu7OUH11PAPD9jz8/BqBT0OHJ3PeH707KcQ1aX69DQ0bqTQgYUm9Dw4bUDgS2pN5TdC2oN4zdiusYOzW3FAgzCFYQ7CDkRvfXPRYoKfsTyvVGs7VfdF2n/oXivf51CxoWlf2p76vXG1PpnwUNltQ5CKxKvYBErzdRS5TzT8QG6+vffH4KCoqfJgb+5J8KpBR/iin+kfWqh9lGszVTqRbLTtk5sO3cvDlrmnN2NjSiKL7hf39Df/qnrP/nldq4iOOo6Hl1K4r93I7iS44bD/1PQ3o6yoWcUwm/B+NiKhjSuswJIYQQQgghhBBCCCHk05mECP+CDpF/NmWvhNVPAQAA//94vnZt") r1 = openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) lseek(r1, 0xfffffffffffffffc, 0x2) r2 = syz_open_procfs(0x0, 0x0) writev(r2, &(0x7f00000000c0)=[{}], 0x1) openat(0xffffffffffffff9c, 0x0, 0x101042, 0x0) syz_open_dev$dvb_demux(&(0x7f00000003c0), 0x0, 0x105e01) bind$inet(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x10) 5.065321878s ago: executing program 2 (id=455): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x20042, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0, 0x3a}], 0x1, 0x8, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 4.464668249s ago: executing program 3 (id=456): bind$netlink(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$nullb(0xffffffffffffff9c, 0x0, 0x2803, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TEST(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)={0x24, 0xb, 0x6, 0x801, 0x0, 0x0, {0x5, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x4800}, 0x20000080) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000001a40)=""/102392, 0x18ff8) r2 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) sendmmsg$inet(r2, &(0x7f0000000c40)=[{{&(0x7f0000000040)={0x2, 0x0, @multicast2}, 0x23, 0x0}}], 0x1e1730a30afb6559, 0x8014) syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) 4.306697627s ago: executing program 1 (id=457): madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r0 = syz_io_uring_setup(0x82e, &(0x7f0000000300)={0x0, 0xcd1d, 0x10100, 0x1000000, 0x20000}, &(0x7f0000000040), &(0x7f0000000080), &(0x7f0000000000)) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) io_uring_register$IORING_REGISTER_PBUF_RING(r0, 0x16, &(0x7f0000000380)={&(0x7f0000001000)={[{0x0}, {0x0}, {0x0}, {0x0}]}, 0x4, 0x2}, 0x1) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$vim2m_VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, 0x0) 4.074372749s ago: executing program 2 (id=458): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x2, 0x0, &(0x7f0000000340)={&(0x7f0000001380)=ANY=[@ANYBLOB], 0x70}, 0x1, 0x7}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000300)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmmsg(r2, &(0x7f0000000180), 0x4000190, 0x0) io_uring_enter(0xffffffffffffffff, 0x1, 0x20, 0x1, 0x0, 0x0) ioctl$SG_SCSI_RESET(0xffffffffffffffff, 0x2284, 0x0) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000002380)=[{{0x0, 0x3f, &(0x7f0000001340)=[{&(0x7f00000002c0)=""/4096, 0x1000}], 0x1}}], 0x4000000000003b9, 0x26022, 0x0) r3 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, 0x0, 0x0) readv(r3, &(0x7f0000000640)=[{&(0x7f0000000180)=""/117, 0x75}], 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b80)={0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x37, '\x00', 0x0, 0x2a, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x0) setsockopt$inet_msfilter(r2, 0x0, 0x29, &(0x7f00000012c0)={@initdev={0xac, 0x1e, 0x0, 0x0}, @rand_addr=0x64010102, 0x0, 0x7, [@private=0xa010100, @broadcast, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @dev={0xac, 0x14, 0x14, 0x32}, @multicast2, @private=0xa010102]}, 0x2c) 3.551273677s ago: executing program 2 (id=459): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0x4e21, @empty}], 0x10) sendmsg$inet_sctp(r0, &(0x7f0000000140)={&(0x7f0000000340)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f0000000380)=[{&(0x7f0000000040)='N', 0x1}], 0x1, 0x0, 0x0, 0x40080}, 0x4000890) getsockopt$inet_sctp_SCTP_PR_STREAM_STATUS(r0, 0x84, 0x74, 0x0, &(0x7f0000000400)) 3.48679673s ago: executing program 4 (id=460): sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000042c0)='mounts\x00') r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) read$FUSE(r1, &(0x7f0000000200)={0x2020}, 0x2020) mount(&(0x7f0000000300), &(0x7f0000000080)='.\x00', &(0x7f0000000180)='devtmpfs\x00', 0x2200892, 0x0) pread64(r0, &(0x7f0000002240)=""/237, 0xed, 0x4eb) 3.410421954s ago: executing program 4 (id=461): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$ptp0(0xffffffffffffff9c, 0x0, 0x0, 0x0) msgsnd(0x0, &(0x7f0000000180)=ANY=[@ANYRESOCT], 0x2000, 0x0) execveat$binfmt(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x0) mknodat$loop(0xffffffffffffff9c, 0x0, 0xc000, 0x0) syz_open_dev$usbmon(0x0, 0x9, 0xa0002) 3.301756609s ago: executing program 1 (id=462): r0 = syz_usb_connect(0x3, 0x24, &(0x7f0000001c80)=ANY=[@ANYBLOB="12010000941b6508c410c1ea2f700102030109021200010000000009040102"], 0x0) r1 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, 0x0) bind$can_j1939(r1, 0x0, 0x0) add_key$user(0x0, &(0x7f0000000100)={'syz', 0x2}, &(0x7f0000000080)="01", 0x1, 0xffffffffffffffff) add_key$user(&(0x7f0000000140), &(0x7f00000003c0)={'syz', 0x0}, &(0x7f0000000400)="f40fc24077021c9b084c60ffc26f26db12b9e78d629870bb26edb4a5e1cc0942ed8c58ca4fe84b94a0e31ea64089ee9ca1efb52945ffebbfea11dd3d0ddc36a10285eccab940ab5c96cb5d81dadde6cfd6ea08d5abcb00bb35436929ddabce530b63fab525337057438cf64a506d54d5c83e3e593d1d53ad0e6a44168fe8cfc6ad98b653d84636e4ddc1f2ab58762b3494250b9557f5b606a43e50874c90143034142cd5f73b8e3b", 0xa8, 0xfffffffffffffffb) keyctl$dh_compute(0x17, 0x0, &(0x7f0000001380)=""/4093, 0xffd, 0x0) syz_genetlink_get_family_id$mptcp(0x0, r1) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) sendmsg$inet(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000000c0)="7b9050", 0x3}, {0x0}, {0x0}], 0x3}, 0x40090) symlink(&(0x7f0000000080)='.\x00', &(0x7f0000000240)='./file0\x00') getsockopt$TIPC_SRC_DROPPABLE(r1, 0x10f, 0x80, &(0x7f00000002c0), &(0x7f0000000380)=0x4) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r3 = fanotify_init(0x200, 0x0) fanotify_mark(r3, 0x1, 0x4800003e, r2, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000580)='./file0\x00', 0x0, 0x0, 0x8, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, 0x0, 0x0) chmod(&(0x7f0000000180)='./file0\x00', 0x259) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r5, 0x89f1, &(0x7f0000000340)={'sit0\x00', &(0x7f00000001c0)=@ethtool_cmd={0x3a, 0x5, 0x0, 0x0, 0x7, 0x0, 0x3, 0xfc, 0x3, 0xfc, 0x0, 0x1, 0x0, 0xff, 0x0, 0x1045}}) r6 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r6, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) 2.665155932s ago: executing program 2 (id=463): syz_usb_connect(0x0, 0x5a, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) setsockopt$RXRPC_SECURITY_KEYRING(0xffffffffffffffff, 0x110, 0x2, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(0xffffffffffffffff, 0x40946400, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x3) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = userfaultfd(0x801) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000800) ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1000000, 0x5d032, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x80801) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_usb_connect$cdc_ncm(0x3, 0x72, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_GET(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="5c0000000101010100000000000000000a0000003c00018005000280050001003a0000002c00010900000300fc02000000"], 0x5c}}, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) 2.51817263s ago: executing program 4 (id=464): socket(0xa, 0x5, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000000380)={0xfffc}, 0x8) sendto$inet6(r0, &(0x7f00000004c0)='W', 0x1, 0x4, &(0x7f0000000100)={0xa, 0x0, 0x3, @loopback, 0x8}, 0x1c) getpeername(r0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r0, 0x84, 0x16, &(0x7f0000000040)=ANY=[@ANYBLOB="180000f6d8369d723fd7fd6437dab4cead00"], 0x4) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000300)={0x614b, 0x0, 0x8001, 0x10, 0x5, 0xfffffc01, 0x10001, 0x9}, &(0x7f0000000340)=0x20) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) write(r3, &(0x7f0000000400)="1113687780fefab361d94a0dd7a95379ac0c0fc249f56b53ef19017a44f186ed885373f8d443e66e17ac32c4f3b60d8625d9fd6479f5fab5700bcfe817c722624f3bdf32404846e404cd8fe797ba8bbf9edf29167c5450b2b0888b8d33a629239d0c4d325c76ceedc47f4718084ba57ead2e225957b3e1a773d78304551ac0b60f2f0003071204d5c52ddeca97cc637a60df6b7cc1038f67100f4ac283388c1c8ce3d147a7b2e794872a7c5fdc", 0xad) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) ioctl$F2FS_IOC_GET_FEATURES(r1, 0x8004f50c, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305829, 0x0) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f00000000c0)=0x7) syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_NODES(0xffffffffffffffff, 0x0, 0x20000000) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r4, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x7, @null, @bpq0, 0x0, [@bcast, @bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) syz_open_procfs$namespace(0x0, &(0x7f0000000240)='ns/time_for_children\x00') r5 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r5, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x6, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bpq0, 0x0, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @default, @bcast, @null]}) ioctl$sock_rose_SIOCDELRT(r5, 0x890c, &(0x7f00000000c0)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x6, @null, @bpq0, 0x1, [@null, @default, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @default]}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x0) 2.261074754s ago: executing program 5 (id=465): syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="040f04"], 0x7) close(0xffffffffffffffff) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r0, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r1) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) listen(r2, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) accept(r1, 0x0, 0x0) recvfrom(r3, 0x0, 0x0, 0x4100, 0x0, 0x0) mmap(&(0x7f0000200000/0x4000)=nil, 0x4000, 0x4, 0x200000006c832, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[], 0x38}}, 0x0) 2.182278147s ago: executing program 2 (id=466): r0 = syz_usb_connect$cdc_ncm(0x0, 0x7a, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000020000402505a1a44000010203010902680002010040000904000001020e0000052406000105240000000d370f0100000000000000000006241a0000000c241b4800f3ff00050080050905810300020000000904010000020d00000904010102020d0000090582020004000000090503020002"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000300)={0x0, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 1.496346103s ago: executing program 4 (id=467): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, &(0x7f0000000140)=0x8) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="4400000096ca077900000000000000", @ANYRES32=0x0, @ANYBLOB="0000000008290400240012800b000100697036746e6c0000140002800600120000000000060012"], 0x44}}, 0x0) r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000014da2108ab1204000000000000010902240001b30000040904410c17ff5d810009050f1f05e13f000009058303"], 0x0) io_uring_setup(0x160f, 0x0) socket$netlink(0x10, 0x3, 0x0) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'batadv0\x00', 0x0}) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x24000805, &(0x7f0000000340)={0x11, 0x86dd, r2, 0x1, 0x0, 0x6, @local}, 0x14) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000640)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x41c, 0x3c}}, './file0\x00'}) r3 = syz_open_dev$sndctrl(&(0x7f0000000300), 0x1, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000440)=[{0x20, 0x2, 0x81, 0xfffff034}, {0x6, 0x1, 0x12, 0xffffffff}]}, 0x8) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @broadcast}) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r3, 0xc2c45512, &(0x7f0000000340)={{0x8, 0x6, 0x0, 0x5, '\x00', 0xfffffffd}, 0x0, [0x101, 0x0, 0x0, 0x0, 0x4000000, 0x100001, 0x7, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x80000003, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x4, 0x4, 0x5, 0x0, 0x0, 0xe4, 0x0, 0x9, 0x3, 0x800, 0x8, 0x0, 0x0, 0x6, 0x0, 0x0, 0xa, 0x1, 0xcdc, 0x0, 0xffffffff, 0x600000, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x2, 0x0, 0x1559, 0x3, 0x3, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x8, 0x4, 0x800, 0x0, 0x3, 0x2, 0x0, 0x3, 0x0, 0x2, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x9, 0x80000000, 0x400000, 0x3, 0xc13, 0x0, 0x0, 0xfffffffc, 0x80000000, 0x0, 0x9, 0x80000000, 0xfffffffd, 0x0, 0x3, 0x800001, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x3, 0x0, 0x40000000, 0x2cbb, 0x2, 0x7b1ae8f, 0x6c, 0x0, 0x80000005, 0x0, 0x3, 0x2d6, 0x80000, 0x6, 0x100000, 0x0, 0x0, 0x4, 0x1, 0x2002001, 0x0, 0x0, 0xd686, 0x0, 0x8, 0x40000000, 0xfffffffb]}) socket$inet6_udp(0xa, 0x2, 0x0) syz_open_dev$radio(&(0x7f0000000000), 0x2, 0x2) syz_usb_ep_read(r1, 0xf, 0xffffffffffffffd2, 0x0) socket$nl_route(0x10, 0x3, 0x0) 1.418281207s ago: executing program 3 (id=468): r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x0, 0x80) ioctl$I2C_PEC(r0, 0x708, 0xfffffffffffffffe) pwrite64(0xffffffffffffffff, 0x0, 0x0, 0x5) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x2, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb010018000000000000"], 0x0, 0x34}, 0x28) syz_io_uring_setup(0x7b6, &(0x7f0000000500)={0x0, 0x146, 0x0, 0x2, 0x400000}, &(0x7f0000000300)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f00000001c0)=@IORING_OP_WRITE={0x17, 0x6, 0x4000, @fd, 0x8, 0x0, 0x0, 0x0, 0x1}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000000c0), &(0x7f0000000100)}, 0x20) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000800)={0xffffffffffffffff, 0x20, &(0x7f00000007c0)={&(0x7f0000000600)=""/249, 0xf9, 0x0, 0x0}}, 0x10) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000940)=@bpf_lsm={0x1d, 0x3, &(0x7f0000000340)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x9b}}, &(0x7f0000000480)='syzkaller\x00', 0x3, 0x0, 0x0, 0x41100, 0x9, '\x00', 0x0, 0x1b, r1, 0x8, &(0x7f00000004c0)={0x1, 0x4}, 0x8, 0x10, &(0x7f00000005c0)={0x0, 0x6, 0x7, 0x8000}, 0x10, r6, 0x0, 0x0, &(0x7f0000000840)=[r1, r5], &(0x7f0000000880)}, 0x94) r7 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) pivot_root(0x0, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000040)=0x1c9, 0x12) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, 0x0) gettid() r8 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0xc0040, 0x0) ioctl$LOOP_CTL_REMOVE(r8, 0x4c81, 0x0) ioctl$I2C_SMBUS(r0, 0x720, &(0x7f00000000c0)={0x1, 0x1, 0x5, &(0x7f0000000000)={0x1f, "90f5000012f300800000000000049942a55e00"}}) 1.389732689s ago: executing program 5 (id=469): r0 = openat$tun(0xffffff9c, &(0x7f0000000000), 0x200, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x50) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x50, 0xffffffffffffffff, 0x0) r1 = socket(0x2c, 0x3, 0x1000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, r1) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f00000001c0)=0x0) sched_setattr(r4, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x100000001, 0xfffffe0000000001, 0xfa11, 0x65aa}, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) syz_io_uring_setup(0x4ad9, &(0x7f0000000300)={0x0, 0x9731, 0x4000, 0x3, 0x145}, &(0x7f00000003c0), 0x0, &(0x7f0000000000)) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) syz_open_procfs(0x0, &(0x7f0000000180)='cgroup\x00') r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a312000000038000000030a01040000000000000000010000010900010073797a30000000000c00024000000000000000010900030003000000000000001400000011"], 0xac}, 0x1, 0x0, 0x0, 0x8040}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10e) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x4b301, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000240)=0xd) writev(r6, &(0x7f0000000080)=[{&(0x7f0000000280)='*', 0x1}], 0x1) syz_usb_connect(0x5, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000092ecc620ac05c2773aeb0102030109022400010000"], 0x0) 544.882782ms ago: executing program 1 (id=470): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x102, 0x0) close(r1) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x4, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000300)={'syzkaller0\x00', @multicast}) socket$phonet_pipe(0x23, 0x5, 0x2) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = socket$unix(0x1, 0x5, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r8, {0x0, 0xd}, {0xc, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0xe, 0x0, 0x0, 0x6}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r5, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r9, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000088a8ffff86ddee162fd4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 206.15155ms ago: executing program 1 (id=471): sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x48, 0x0, 0x0) connect$unix(r1, &(0x7f00000007c0)=@file={0x0, './file1/file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x19, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4000}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r3 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl(r3, 0x8b2c, &(0x7f0000000040)) socket$packet(0x11, 0x2, 0x300) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043ef502"], 0xf8) ioctl$VIDIOC_S_PARM(r3, 0xc0cc5616, &(0x7f0000000840)={0x5, @output={0x0, 0x1, {0x9, 0xfffffff9}, 0x101, 0x2}}) mount(0x0, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='xfs\x00', 0x2208004, 0x0) syz_open_dev$cec(&(0x7f0000000200), 0xffffffffffffffff, 0x4ae60) 0s ago: executing program 3 (id=472): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$sock(r0, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x8000) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x8, 0x16, &(0x7f00000022c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_cipso(0x0, r3) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="8000000000010104000000000000000002000000240001801400018008000100e000000108000200e00000010c000280050001000000000024000280140001800800010000000000080002007f0000010c00028005000100000000000800074000000000080003400000100e140005800500"], 0x80}}, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) ioctl$sock_netdev_private(0xffffffffffffffff, 0x8914, &(0x7f0000000000)) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @bpq0, 0x1, 'syz1\x00', @null, 0x7, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default]}) r7 = syz_init_net_socket$ax25(0x3, 0x5, 0xca) bind$ax25(r7, &(0x7f0000000280)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @null]}, 0x48) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000180)=@bpq0, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000600), r7) syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), r1) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) writev(r8, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x2, 0x1, 0x3ffffe) socket$nl_route(0x10, 0x3, 0x0) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000100)={0x0, 0x2, 0x10}, 0xc) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0300000004000000040000000a000000000000", @ANYRES32=r9, @ANYBLOB, @ANYRES32=r2, @ANYRES32, @ANYBLOB="020000000500000003100000000000000000000000000000a8000000ed2228772fc2070ea999d50ab9e0faee217dc00b7c69dea8378dd2bb6f38e6bab3980fa4299775bdf52acc5e2edefaaa22817f0d385d75aebb542cb01306a8580724c2650c5c838f8f3a989e470098e8b7e384e679418c4b1d73e4dacd0f10f24b6ed340b63340eb49ad761c0c0583bdda408b0a1b818e43575cb2f2b5c8fbd82fd5b5e92ccced3c27f7f675c4e0155507457e82ad2b3f40613f6b16b2fa806c9a7600"], 0x50) kernel console output (not intermixed with test programs): RCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 54.808693][ T4243] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 54.821183][ T4243] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 54.830838][ T4243] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 54.842785][ T4191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 54.854197][ T4191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 54.871419][ T4191] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 54.898444][ T4191] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.907545][ T4191] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.917278][ T4191] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.926397][ T4191] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.944095][ T597] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 54.952152][ T597] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 54.961085][ T597] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 54.976499][ T4185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 54.988319][ T4185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 54.999903][ T4185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 55.011103][ T4185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 55.021958][ T4185] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 55.030773][ T4187] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 55.041338][ T4187] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 55.051308][ T4187] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 55.062373][ T4187] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 55.073943][ T4187] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 55.084496][ T4187] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 55.096435][ T4187] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 55.104335][ T4264] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4'. [ 55.139289][ T4263] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4'. [ 55.161618][ T597] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 55.170495][ T597] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 55.179655][ T597] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 55.188850][ T597] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 55.198746][ T597] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 55.208434][ T597] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 55.218941][ T4185] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.228620][ T4185] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.237961][ T4185] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.246960][ T4185] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.284844][ T4186] device veth0_macvtap entered promiscuous mode [ 55.292471][ T4187] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 55.303483][ T4187] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 55.315392][ T4187] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 55.325870][ T4187] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 55.336315][ T4187] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 55.347067][ T4187] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 55.358656][ T4187] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 55.394014][ T4186] device veth1_macvtap entered promiscuous mode [ 55.409676][ T4243] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 55.418844][ T4243] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 55.432326][ T4243] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 55.442971][ T4243] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 55.474323][ T4187] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.484813][ T4187] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.495189][ T4187] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.508042][ T4187] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.559532][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 55.570858][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 55.581984][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 55.592753][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 55.602797][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 55.613904][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 55.623981][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 55.635080][ T4232] Bluetooth: hci2: command 0x040f tx timeout [ 55.640852][ T7] Bluetooth: hci0: command 0x040f tx timeout [ 55.641154][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 55.649504][ T7] Bluetooth: hci4: command 0x040f tx timeout [ 55.659019][ T4186] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 55.683030][ T597] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 55.692327][ T597] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 55.694938][ T7] Bluetooth: hci3: command 0x040f tx timeout [ 55.702387][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 55.714416][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 55.723797][ T4232] Bluetooth: hci1: command 0x040f tx timeout [ 55.730842][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 55.741238][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 55.741333][ T597] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 55.752891][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 55.766695][ T597] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 55.770364][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 55.786068][ T4231] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 55.788779][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 55.805112][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 55.815858][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 55.826000][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 55.836794][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 55.848701][ T4186] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 55.868450][ T597] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 55.884146][ T597] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 55.893033][ T597] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 55.909236][ T4186] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.923140][ T4186] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.932155][ T4186] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.941053][ T4186] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.993001][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 56.003764][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 56.022946][ T597] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 56.032665][ T597] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 56.042462][ T597] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 56.048653][ T4243] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 56.064231][ T4247] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 56.072448][ T4243] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 56.102588][ T144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 56.127296][ T144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 56.135980][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 56.144366][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 56.145990][ T4231] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 56.197685][ T4231] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 56.208545][ T4231] usb 4-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 56.218190][ T4231] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 56.227008][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 56.247401][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 56.258395][ T4231] usb 4-1: config 0 descriptor?? [ 56.277373][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 56.307963][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 56.346085][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 56.368484][ T4243] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 56.511823][ T4282] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2'. [ 56.575602][ T4284] Zero length message leads to an empty skb [ 56.755267][ T1108] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 56.771128][ T4231] elan 0003:04F3:0755.0001: unknown main item tag 0x0 [ 56.784505][ T4231] elan 0003:04F3:0755.0001: unknown main item tag 0x0 [ 56.823675][ T4231] elan 0003:04F3:0755.0001: unknown main item tag 0x0 [ 56.839908][ T4231] elan 0003:04F3:0755.0001: unknown main item tag 0x0 [ 56.869896][ T4231] elan 0003:04F3:0755.0001: unknown main item tag 0x0 [ 56.912213][ T4231] elan 0003:04F3:0755.0001: failed to start in urb: -90 [ 56.949756][ T4231] elan 0003:04F3:0755.0001: hidraw0: USB HID v1.01 Device [HID 04f3:0755] on usb-dummy_hcd.3-1/input0 [ 56.971595][ T4266] udc-core: couldn't find an available UDC or it's busy [ 56.988466][ T4266] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 57.136366][ T1108] usb 1-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 57.158340][ T1108] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 57.239509][ T1108] usb 1-1: config 0 descriptor?? [ 57.277677][ T1108] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 57.315001][ T4293] syz.3.6 uses obsolete (PF_INET,SOCK_PACKET) [ 57.365396][ T4227] usb 4-1: USB disconnect, device number 2 [ 57.705885][ T4227] Bluetooth: hci4: command 0x0419 tx timeout [ 57.714808][ T4227] Bluetooth: hci0: command 0x0419 tx timeout [ 57.732254][ T4227] Bluetooth: hci2: command 0x0419 tx timeout [ 57.787116][ T4232] Bluetooth: hci1: command 0x0419 tx timeout [ 57.803701][ T4232] Bluetooth: hci3: command 0x0419 tx timeout [ 58.056693][ T26] audit: type=1326 audit(1776828596.996:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4295 comm="syz.3.8" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcbfd39c819 code=0x7ffc0000 [ 58.095955][ T4296] process 'syz.3.8' launched './file2' with NULL argv: empty string added [ 58.157292][ T26] audit: type=1326 audit(1776828596.996:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4295 comm="syz.3.8" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcbfd39c819 code=0x7ffc0000 [ 58.230626][ T26] audit: type=1326 audit(1776828597.026:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4295 comm="syz.3.8" exe="/root/syz-executor" sig=0 arch=c000003e syscall=259 compat=0 ip=0x7fcbfd39c819 code=0x7ffc0000 [ 58.405309][ T1108] gspca_stv06xx: HDCS-1000/1100 sensor detected [ 58.420412][ T26] audit: type=1326 audit(1776828597.026:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4295 comm="syz.3.8" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcbfd39c819 code=0x7ffc0000 [ 58.473857][ T26] audit: type=1326 audit(1776828597.026:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4295 comm="syz.3.8" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcbfd39c819 code=0x7ffc0000 [ 58.571522][ T26] audit: type=1326 audit(1776828597.036:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4295 comm="syz.3.8" exe="/root/syz-executor" sig=0 arch=c000003e syscall=322 compat=0 ip=0x7fcbfd39c819 code=0x7ffc0000 [ 58.688346][ T26] audit: type=1326 audit(1776828597.246:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4295 comm="syz.3.8" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcbfd39c819 code=0x7ffc0000 [ 58.751477][ T26] audit: type=1326 audit(1776828597.246:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4295 comm="syz.3.8" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcbfd39c819 code=0x7ffc0000 [ 58.822255][ T26] audit: type=1326 audit(1776828597.246:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4295 comm="syz.3.8" exe="/root/syz-executor" sig=0 arch=c000003e syscall=28 compat=0 ip=0x7fcbfd39c819 code=0x7ffc0000 [ 58.855640][ T4310] loop1: detected capacity change from 0 to 16 [ 58.904846][ T4310] erofs: (device loop1): mounted with root inode @ nid 36. [ 58.943039][ T26] audit: type=1326 audit(1776828597.246:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4295 comm="syz.3.8" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcbfd39c819 code=0x7ffc0000 [ 59.025102][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #382!!! [ 59.035112][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #382!!! [ 59.045093][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #382!!! [ 59.055093][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #382!!! [ 59.065091][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #382!!! [ 59.075096][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #382!!! [ 59.085092][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #382!!! [ 59.095106][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #382!!! [ 59.105099][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #382!!! [ 59.115091][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #382!!! [ 60.539217][ T1108] STV06xx: probe of 1-1:0.0 failed with error -71 [ 61.009109][ T4316] loop1: detected capacity change from 0 to 32768 [ 61.035304][ T1108] usb 1-1: USB disconnect, device number 2 [ 61.205775][ T4316] XFS (loop1): Mounting V5 Filesystem [ 62.068999][ T4316] XFS (loop1): Ending clean mount [ 62.129554][ T4186] XFS (loop1): Unmounting Filesystem [ 62.188621][ T4339] netlink: 8 bytes leftover after parsing attributes in process `syz.3.18'. [ 62.745313][ T4227] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 63.025245][ T4227] usb 4-1: Using ep0 maxpacket: 32 [ 63.155687][ T4227] usb 4-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 63.205111][ T4227] usb 4-1: config 155 interface 0 altsetting 0 has an invalid endpoint with address 0xE2, skipping [ 63.255109][ T4227] usb 4-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 63.469616][ T4227] usb 4-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 63.499305][ T4227] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 63.539521][ T4227] usb 4-1: Product: syz [ 63.588903][ T4227] usb 4-1: Manufacturer: syz [ 63.593552][ T4227] usb 4-1: SerialNumber: syz [ 63.688005][ T4227] imon:imon_find_endpoints: no valid input (IR) endpoint found [ 63.711161][ T4227] imon 4-1:155.0: unable to initialize intf0, err -19 [ 63.752086][ T4227] imon:imon_probe: failed to initialize context! [ 63.790959][ T4227] imon 4-1:155.0: unable to register, err -19 [ 64.062196][ T4365] tipc: Started in network mode [ 64.080065][ T4365] tipc: Node identity bbbbbb01, cluster identity 4711 [ 64.096786][ T4365] tipc: Enabled bearer , priority 10 [ 65.450204][ T4376] loop0: detected capacity change from 0 to 32768 [ 65.473816][ T13] tipc: Node number set to 3149642497 [ 65.514144][ T4232] usb 4-1: USB disconnect, device number 3 [ 65.666426][ T4387] netlink: 8 bytes leftover after parsing attributes in process `syz.3.31'. [ 65.700265][ T4376] XFS (loop0): Mounting V5 Filesystem [ 65.798730][ T4376] XFS (loop0): Ending clean mount [ 65.886864][ T4187] XFS (loop0): Unmounting Filesystem [ 66.100074][ T4398] tipc: Enabling of bearer rejected, already enabled [ 66.605279][ T4232] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 66.870097][ T4232] usb 5-1: Using ep0 maxpacket: 8 [ 67.020103][ T4232] usb 5-1: config 0 has an invalid interface number: 31 but max is 0 [ 67.038622][ T4232] usb 5-1: config 0 has no interface number 0 [ 67.085339][ T4406] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.093594][ T4406] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.235392][ T4232] usb 5-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 67.260426][ T4232] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 67.278980][ T4232] usb 5-1: Product: syz [ 67.293391][ T4232] usb 5-1: Manufacturer: syz [ 67.309357][ T4232] usb 5-1: SerialNumber: syz [ 67.330261][ T4232] usb 5-1: config 0 descriptor?? [ 67.976626][ T4406] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 68.040760][ T4406] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 68.932594][ T4406] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 68.943052][ T4406] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 68.959756][ T4406] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 68.969495][ T4406] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 69.170923][ T4440] netlink: 8 bytes leftover after parsing attributes in process `syz.1.45'. [ 69.226352][ T4232] usb 5-1: Found UVC 0.04 device syz (046d:08c3) [ 69.233060][ T4232] usb 5-1: No valid video chain found. [ 69.255360][ T4232] usb 5-1: USB disconnect, device number 2 [ 69.322859][ T4449] tipc: Enabling of bearer rejected, already enabled [ 69.357476][ T4450] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 70.145972][ T4406] syz.4.38 (4406) used greatest stack depth: 19792 bytes left [ 70.845152][ T2239] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 71.235202][ T2239] usb 5-1: Using ep0 maxpacket: 16 [ 71.239236][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.247075][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.355278][ T2239] usb 5-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xF3, skipping [ 71.575784][ T2239] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 71.604033][ T2239] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 71.639857][ T2239] usb 5-1: Product: syz [ 71.644048][ T2239] usb 5-1: Manufacturer: syz [ 71.664941][ T2239] usb 5-1: SerialNumber: syz [ 71.711039][ T2239] usb 5-1: config 0 descriptor?? [ 71.715887][ T13] usb 1-1: new low-speed USB device number 3 using dummy_hcd [ 72.140680][ T13] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 72.156674][ T13] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 72.182014][ T13] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 72.193654][ T4230] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 72.217018][ T13] usb 1-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 72.238765][ T13] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 72.295447][ T4478] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 72.316432][ T13] hub 1-1:1.0: bad descriptor, ignoring hub [ 72.325133][ T13] hub: probe of 1-1:1.0 failed with error -5 [ 72.343520][ T13] cdc_wdm 1-1:1.0: skipping garbage [ 72.355820][ T13] cdc_wdm 1-1:1.0: skipping garbage [ 72.384046][ T13] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 72.397679][ T13] cdc_wdm 1-1:1.0: Unknown control protocol [ 72.606082][ T4230] usb 4-1: config index 0 descriptor too short (expected 1572, got 36) [ 72.628856][ T4230] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 72.665289][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 72.672372][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 72.705103][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 72.711738][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 72.735179][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 72.741817][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 73.063529][ T4492] loop2: detected capacity change from 0 to 16 [ 73.145585][ T4492] erofs: (device loop2): mounted with root inode @ nid 36. [ 73.206227][ T4230] usb 4-1: New USB device found, idVendor=05ac, idProduct=0238, bcdDevice= 0.40 [ 73.238141][ T4230] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 73.288626][ T4230] usb 4-1: Product: syz [ 73.308690][ T4230] usb 4-1: Manufacturer: syz [ 73.331417][ T4230] usb 4-1: SerialNumber: syz [ 73.960445][ T4270] usb 5-1: USB disconnect, device number 3 [ 73.970142][ T4230] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/input/input5 [ 74.185354][ T3546] bcm5974 4-1:1.0: could not read from device [ 74.215342][ T4230] bcm5974 4-1:1.0: could not read from device [ 74.245171][ T3546] bcm5974 4-1:1.0: could not read from device [ 74.261142][ T4230] input: failed to attach handler mousedev to device input5, error: -5 [ 74.315629][ T3546] bcm5974 4-1:1.0: could not read from device [ 74.325855][ T4230] usb 4-1: USB disconnect, device number 4 [ 74.339194][ T3546] bcm5974 4-1:1.0: could not read from device [ 75.119208][ T4270] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 75.252178][ T4201] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 75.261967][ T4201] CPU: 1 PID: 4201 Comm: kworker/u5:7 Not tainted syzkaller #0 [ 75.269522][ T4201] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 75.279591][ T4201] Workqueue: hci4 hci_rx_work [ 75.284307][ T4201] Call Trace: [ 75.287592][ T4201] [ 75.290525][ T4201] dump_stack_lvl+0x188/0x250 [ 75.295248][ T4201] ? show_regs_print_info+0x20/0x20 [ 75.300443][ T4201] ? load_image+0x400/0x400 [ 75.304959][ T4201] sysfs_create_dir_ns+0x26a/0x290 [ 75.310075][ T4201] ? sysfs_warn_dup+0xa0/0xa0 [ 75.314747][ T4201] ? process_one_work+0x85f/0x1010 [ 75.319861][ T4201] ? do_raw_spin_unlock+0x11d/0x230 [ 75.325078][ T4201] kobject_add_internal+0x6e0/0xd90 [ 75.330288][ T4201] kobject_add+0x160/0x230 [ 75.334713][ T4201] ? kobject_init+0x1d0/0x1d0 [ 75.339391][ T4201] ? klist_children_get+0x50/0x50 [ 75.344397][ T4201] ? get_device_parent+0x121/0x3f0 [ 75.349581][ T4201] device_add+0x483/0xfb0 [ 75.353906][ T4201] hci_conn_add_sysfs+0xd1/0x1e0 [ 75.358825][ T4201] le_conn_complete_evt+0xc48/0x15c0 [ 75.364095][ T4201] ? cs_le_create_conn+0x5e0/0x5e0 [ 75.369199][ T4201] ? __mutex_trylock_common+0x155/0x260 [ 75.374765][ T4201] hci_le_meta_evt+0x285/0x3c90 [ 75.379629][ T4201] ? hci_event_packet+0x37b/0x1370 [ 75.384770][ T4201] ? __lock_acquire+0x7d10/0x7d10 [ 75.389784][ T4201] ? hci_remote_host_features_evt+0x280/0x280 [ 75.395830][ T4201] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 75.401441][ T4201] ? mark_lock+0x94/0x320 [ 75.405749][ T4201] ? mutex_unlock+0x10/0x10 [ 75.410256][ T4201] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 75.416218][ T4201] ? lock_chain_count+0x20/0x20 [ 75.421057][ T4201] ? __rwlock_init+0x140/0x140 [ 75.425807][ T4201] hci_event_packet+0xe48/0x1370 [ 75.430726][ T4201] ? lockdep_hardirqs_on+0x94/0x140 [ 75.435908][ T4201] ? rcu_lock_release+0x20/0x20 [ 75.440739][ T4201] ? hci_send_to_monitor+0x9c/0x4a0 [ 75.445913][ T4201] hci_rx_work+0x255/0xa10 [ 75.450330][ T4201] process_one_work+0x85f/0x1010 [ 75.455255][ T4201] ? worker_detach_from_pool+0x240/0x240 [ 75.460863][ T4201] ? lockdep_hardirqs_off+0x70/0x100 [ 75.466127][ T4201] ? _raw_spin_lock_irq+0xb7/0xf0 [ 75.471128][ T4201] ? _raw_spin_lock_irqsave+0x100/0x100 [ 75.476667][ T4201] ? wq_worker_running+0x97/0x170 [ 75.481669][ T4201] worker_thread+0xaa6/0x1290 [ 75.486335][ T4201] ? lockdep_hardirqs_on+0x94/0x140 [ 75.491518][ T4201] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 75.497412][ T4201] kthread+0x436/0x520 [ 75.501458][ T4201] ? rcu_lock_release+0x20/0x20 [ 75.506288][ T4201] ? kthread_blkcg+0xd0/0xd0 [ 75.510857][ T4201] ret_from_fork+0x1f/0x30 [ 75.515270][ T4201] [ 75.519984][ T4201] kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 75.533310][ T4201] Bluetooth: hci4: failed to register connection device [ 75.547212][ T4270] usb 5-1: Using ep0 maxpacket: 16 [ 75.675605][ T13] usb 1-1: USB disconnect, device number 3 [ 75.681625][ T4270] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 75.755998][ T4270] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 75.980248][ T4270] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 1.40 [ 76.002167][ T4270] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 76.018567][ T4270] usb 5-1: Product: syz [ 76.023873][ T4270] usb 5-1: Manufacturer: syz [ 76.034129][ T4270] usb 5-1: SerialNumber: syz [ 76.165194][ T4232] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 76.350903][ T23] cfg80211: failed to load regulatory.db [ 76.425406][ T4270] usb 5-1: 0:2 : does not exist [ 76.535195][ T4232] usb 2-1: Using ep0 maxpacket: 32 [ 76.655733][ T4232] usb 2-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xA6, skipping [ 76.687130][ T4232] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 76.713443][ T4232] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 76.814216][ T4530] netlink: 12 bytes leftover after parsing attributes in process `syz.0.73'. [ 77.124809][ T4270] usb 5-1: 5:0: cannot get min/max values for control 3 (id 5) [ 77.875280][ T4232] usb 2-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 78.585571][ T4270] usb 5-1: 5:0: cannot get min/max values for control 5 (id 5) [ 78.669322][ T4232] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 78.680489][ T4232] usb 2-1: Product: syz [ 78.688167][ T4232] usb 2-1: Manufacturer: syz [ 78.692803][ T4232] usb 2-1: SerialNumber: syz [ 78.701604][ T4232] usb 2-1: config 0 descriptor?? [ 78.875178][ T4270] usb 5-1: 5:0: cannot get min/max values for control 8 (id 5) [ 78.983249][ T4543] loop3: detected capacity change from 0 to 16 [ 80.024126][ T23] usb 2-1: USB disconnect, device number 2 [ 80.222842][ T4543] erofs: (device loop3): mounted with root inode @ nid 36. [ 80.365271][ T4270] usb 5-1: 5:0: cannot get min/max values for control 3 (id 5) [ 80.685310][ T4270] usb 5-1: 5:0: cannot get min/max values for control 5 (id 5) [ 80.727768][ T4270] usb 5-1: USB disconnect, device number 4 [ 81.602656][ T4579] netlink: 12 bytes leftover after parsing attributes in process `syz.2.88'. [ 83.913995][ T4588] loop1: detected capacity change from 0 to 16 [ 85.022593][ T4588] erofs: (device loop1): mounted with root inode @ nid 36. [ 85.831917][ T4584] delete_channel: no stack [ 86.348492][ T4617] af_packet: tpacket_rcv: packet too big, clamped from 628 to 4294967272. macoff=96 [ 86.415163][ T23] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 86.805269][ T23] usb 1-1: config 1 has an invalid descriptor of length 19, skipping remainder of the config [ 86.819776][ T23] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 86.906257][ T4626] loop3: detected capacity change from 0 to 16 [ 86.925452][ T23] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 86.962930][ T23] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=67 [ 87.001480][ T4626] erofs: (device loop3): mounted with root inode @ nid 36. [ 87.026748][ T23] usb 1-1: SerialNumber: syz [ 87.386187][ T4634] netlink: 12 bytes leftover after parsing attributes in process `syz.3.102'. [ 88.919087][ T23] usb 1-1: 0:2 : does not exist [ 89.338442][ T4177] udevd[4177]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 89.366349][ T23] usb 1-1: USB disconnect, device number 4 [ 90.005129][ T4267] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 90.296050][ T4267] usb 3-1: Using ep0 maxpacket: 8 [ 90.371515][ T4662] netlink: 8 bytes leftover after parsing attributes in process `syz.3.111'. [ 90.435421][ T4267] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 90.446990][ T4267] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 90.458040][ T4267] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 90.468433][ T4267] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 90.481771][ T4267] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 90.491042][ T4267] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 90.770855][ T4267] usb 3-1: GET_CAPABILITIES returned 0 [ 90.797890][ T4267] usbtmc 3-1:16.0: can't read capabilities [ 90.883704][ T4673] loop3: detected capacity change from 0 to 16 [ 91.009407][ T4650] udc-core: couldn't find an available UDC or it's busy [ 91.032702][ T4673] erofs: (device loop3): mounted with root inode @ nid 36. [ 91.057886][ T4650] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 91.146589][ T23] usb 3-1: USB disconnect, device number 2 [ 91.245361][ T2239] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 91.495179][ T2239] usb 2-1: Using ep0 maxpacket: 32 [ 91.515162][ T7] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 91.615187][ T2239] usb 2-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 91.946931][ T7] usb 4-1: config 220 has an invalid interface number: 76 but max is 2 [ 91.960334][ T7] usb 4-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 91.971274][ T7] usb 4-1: config 220 has no interface number 2 [ 91.986939][ T7] usb 4-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 91.990130][ T2239] usb 2-1: config 155 interface 0 altsetting 0 has an invalid endpoint with address 0xE2, skipping [ 92.011248][ T2239] usb 2-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 92.011789][ T7] usb 4-1: config 220 interface 0 has no altsetting 0 [ 92.031505][ T7] usb 4-1: config 220 interface 76 has no altsetting 0 [ 92.038475][ T7] usb 4-1: config 220 interface 1 has no altsetting 0 [ 92.055494][ T4227] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 92.175279][ T2239] usb 2-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 92.184331][ T2239] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 92.192870][ T2239] usb 2-1: Product: syz [ 92.197122][ T2239] usb 2-1: Manufacturer: syz [ 92.201993][ T2239] usb 2-1: SerialNumber: syz [ 92.215404][ T7] usb 4-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 92.224564][ T4270] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 92.232459][ T7] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 92.241370][ T7] usb 4-1: Product: syz [ 92.246002][ T7] usb 4-1: Manufacturer: syz [ 92.246814][ T2239] imon:imon_find_endpoints: no valid input (IR) endpoint found [ 92.250818][ T7] usb 4-1: SerialNumber: syz [ 92.264462][ T2239] imon 2-1:155.0: unable to initialize intf0, err -19 [ 92.271615][ T2239] imon:imon_probe: failed to initialize context! [ 92.280860][ T2239] imon 2-1:155.0: unable to register, err -19 [ 92.501506][ T4677] udc-core: couldn't find an available UDC or it's busy [ 92.509447][ T4677] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 92.550261][ T4691] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 92.559652][ T4691] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 92.568489][ T4691] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 92.577278][ T4691] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 92.588247][ T4227] usb 5-1: unable to get BOS descriptor or descriptor too short [ 92.597432][ T4691] 9pnet: Insufficient options for proto=fd [ 92.635317][ T4270] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 92.646608][ T4270] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 92.656646][ T4270] usb 3-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 92.667605][ T7] usb 4-1: Found UVC 7.01 device syz (8086:0b07) [ 92.674015][ T4270] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 92.675389][ T4227] usb 5-1: config 1 has an invalid interface number: 4 but max is 2 [ 92.682260][ T7] usb 4-1: No valid video chain found. [ 92.695143][ T4227] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 92.696358][ T7] usb 4-1: selecting invalid altsetting 0 [ 92.709478][ T4227] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 92.713823][ T4270] usb 3-1: config 0 descriptor?? [ 92.728854][ T4227] usb 5-1: config 1 has no interface number 0 [ 92.734983][ T4227] usb 5-1: config 1 interface 4 has no altsetting 0 [ 92.826085][ T7] usb 4-1: selecting invalid altsetting 0 [ 92.831962][ T7] usbtest: probe of 4-1:220.1 failed with error -22 [ 92.848353][ T7] usb 4-1: USB disconnect, device number 5 [ 92.895384][ T4227] usb 5-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 92.904569][ T4227] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 92.912974][ T4227] usb 5-1: Product: syz [ 92.917793][ T4227] usb 5-1: Manufacturer: syz [ 92.922396][ T4227] usb 5-1: SerialNumber: syz [ 92.979668][ T4227] snd-usb-audio: probe of 5-1:1.4 failed with error -2 [ 92.994315][ T4227] snd-usb-audio: probe of 5-1:1.1 failed with error -2 [ 93.022908][ T4175] udevd[4175]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 93.371529][ T7] usb 5-1: USB disconnect, device number 5 [ 93.432844][ T4700] netlink: 8 bytes leftover after parsing attributes in process `syz.3.123'. [ 93.442068][ T4270] hid-led: probe of 0003:27B8:01ED.0002 failed with error -71 [ 93.449964][ T26] kauditd_printk_skb: 26 callbacks suppressed [ 93.449975][ T26] audit: type=1326 audit(1776828632.386:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4702 comm="syz.0.124" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5f9d6c3819 code=0x7ffc0000 [ 93.473239][ T4270] usb 3-1: USB disconnect, device number 3 [ 93.559334][ T4227] usb 2-1: USB disconnect, device number 3 [ 94.085153][ T4227] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 94.335198][ T4227] usb 4-1: Using ep0 maxpacket: 16 [ 94.455366][ T4227] usb 4-1: config index 0 descriptor too short (expected 16456, got 72) [ 94.475529][ T4227] usb 4-1: config 0 has an invalid interface number: 125 but max is 1 [ 94.509254][ T4227] usb 4-1: config 0 has an invalid interface number: 125 but max is 1 [ 94.549674][ T4227] usb 4-1: config 0 has an invalid interface number: 125 but max is 1 [ 94.575774][ T4227] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 94.603379][ T4227] usb 4-1: config 0 has no interface number 0 [ 94.622343][ T4227] usb 4-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 94.657683][ T4227] usb 4-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 94.688732][ T4227] usb 4-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 94.705304][ T4227] usb 4-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 94.728702][ T4227] usb 4-1: config 0 interface 125 has no altsetting 0 [ 94.737977][ T4227] usb 4-1: config 0 interface 125 has no altsetting 2 [ 95.025899][ T4227] usb 4-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 95.034980][ T4227] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 95.053204][ T4745] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 95.062062][ T4745] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 95.071227][ T4745] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 95.080001][ T4745] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 95.092928][ T4745] 9pnet: Insufficient options for proto=fd [ 95.405020][ T4227] usb 4-1: Product: syz [ 95.409303][ T4227] usb 4-1: Manufacturer: syz [ 95.413901][ T4227] usb 4-1: SerialNumber: syz [ 95.421495][ T4227] usb 4-1: config 0 descriptor?? [ 95.466607][ T4227] usb 4-1: selecting invalid altsetting 2 [ 96.017855][ T4752] netlink: 8 bytes leftover after parsing attributes in process `syz.2.138'. [ 96.289308][ T4719] udc-core: couldn't find an available UDC or it's busy [ 96.298575][ T4719] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 96.505288][ T4227] get_1284_register timeout [ 96.525187][ C1] usb 4-1: async_complete: urb error -104 [ 96.531019][ C1] usb 4-1: async_complete: urb error -104 [ 96.536802][ C1] usb 4-1: async_complete: urb error -104 [ 96.566540][ T4227] usb 4-1: USB disconnect, device number 6 [ 97.109607][ T4788] tipc: Enabling of bearer rejected, already enabled [ 97.335892][ T4794] netlink: 12 bytes leftover after parsing attributes in process `syz.3.152'. [ 97.867232][ T4174] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 98.405696][ T4174] Bluetooth: hci0: Injecting HCI hardware error event [ 98.898730][ T4201] Bluetooth: hci0: hardware error 0x00 [ 99.297066][ T4806] netlink: 8 bytes leftover after parsing attributes in process `syz.1.155'. [ 99.455167][ T4267] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 99.763687][ T4808] netlink: 8 bytes leftover after parsing attributes in process `syz.1.156'. [ 99.866387][ T4270] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 99.874847][ T4267] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 99.898160][ T4270] Bluetooth: hci2: Injecting HCI hardware error event [ 99.921815][ T4267] usb 3-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xBA, skipping [ 99.945773][ T4194] Bluetooth: hci2: hardware error 0x00 [ 100.115247][ T4267] usb 3-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 100.143198][ T4816] MPTCP: kernel_bind error, err=-98 [ 100.160438][ T4267] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 100.375160][ T4267] usb 3-1: Product: syz [ 100.395651][ T4267] usb 3-1: Manufacturer: syz [ 100.400375][ T4267] usb 3-1: SerialNumber: syz [ 100.411827][ T4267] usb 3-1: config 0 descriptor?? [ 100.435411][ T4802] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 100.447313][ T4802] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 100.475839][ T4267] usb 3-1: ucan: probing device on interface #0 [ 100.488434][ T4267] usb 3-1: ucan: invalid EP count (1) [ 100.510337][ T4267] usb 3-1: ucan: probe failed; try to update the device firmware [ 100.875204][ T4174] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 101.075178][ T4227] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 101.155326][ T4174] usb 5-1: Using ep0 maxpacket: 8 [ 101.785252][ T4174] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 101.799160][ T4174] usb 5-1: config 179 has no interface number 0 [ 101.810417][ T4174] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 101.827383][ T4174] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 101.840946][ T4174] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 101.854796][ T4174] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid wMaxPacketSize 0 [ 101.868427][ T4174] usb 5-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 101.882328][ T4174] usb 5-1: config 179 interface 65 has no altsetting 0 [ 101.891961][ T4174] usb 5-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 101.901499][ T4174] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 101.977612][ T4174] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:179.65/input/input6 [ 102.063093][ T4831] loop3: detected capacity change from 0 to 32768 [ 102.094139][ T4831] XFS (loop3): Mounting V5 Filesystem [ 102.100140][ T4227] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 102.120797][ T4227] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 102.130106][ T4227] usb 2-1: Product: syz [ 102.134705][ T4227] usb 2-1: Manufacturer: syz [ 102.145996][ T4227] usb 2-1: SerialNumber: syz [ 102.192006][ T4831] XFS (loop3): Ending clean mount [ 102.244397][ T4199] XFS (loop3): Unmounting Filesystem [ 102.253129][ T4174] usb 3-1: USB disconnect, device number 4 [ 102.361704][ T4844] netlink: 8 bytes leftover after parsing attributes in process `syz.2.165'. [ 102.383768][ T23] usb 5-1: USB disconnect, device number 6 [ 102.406621][ T23] xpad 5-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 102.675480][ T4227] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -32 [ 104.723193][ T4884] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 104.732012][ T4884] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 104.740786][ T4884] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 104.749628][ T4884] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 104.762121][ T4884] 9pnet: Insufficient options for proto=fd [ 104.852007][ T4890] netlink: 8 bytes leftover after parsing attributes in process `syz.2.176'. [ 105.272299][ T4898] input: syz0 as /devices/virtual/input/input7 [ 105.279340][ T4270] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 105.805432][ T4227] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x000000e8. ret = -71 [ 105.847864][ T4227] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x000000ec. ret = -71 [ 105.907433][ T4227] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x000000f0. ret = -71 [ 105.947122][ T4227] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x000000f4. ret = -71 [ 105.965305][ T4270] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 105.975530][ T4267] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 105.980270][ T4227] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x00000090. ret = -71 [ 105.989564][ T4270] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 106.021248][ T4270] usb 3-1: New USB device found, idVendor=0489, idProduct=e057, bcdDevice= 0.00 [ 106.031710][ T4270] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 106.045596][ T4919] netlink: 8 bytes leftover after parsing attributes in process `syz.1.188'. [ 106.059790][ T4270] usb 3-1: config 0 descriptor?? [ 106.065849][ T4227] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 106.087869][ T4227] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 106.097932][ T4227] lan78xx: probe of 2-1:1.0 failed with error -71 [ 106.122253][ T4227] usb 2-1: USB disconnect, device number 4 [ 106.235341][ T4267] usb 5-1: Using ep0 maxpacket: 16 [ 106.315344][ T4270] Bluetooth: Can't get state to change to load ram patch err [ 106.326266][ T4270] Bluetooth: Loading patch file failed [ 106.345253][ T4270] ath3k: probe of 3-1:0.0 failed with error -71 [ 106.354810][ T4270] usb 3-1: USB disconnect, device number 5 [ 106.360932][ T4267] usb 5-1: config 8 has an invalid interface number: 234 but max is 0 [ 106.369729][ T4267] usb 5-1: config 8 has no interface number 0 [ 106.378178][ T4267] usb 5-1: config 8 interface 234 altsetting 1 bulk endpoint 0xD has invalid maxpacket 16 [ 106.393872][ T4267] usb 5-1: config 8 interface 234 has no altsetting 0 [ 106.585225][ T4267] usb 5-1: New USB device found, idVendor=1608, idProduct=021c, bcdDevice= 6.42 [ 106.594506][ T4267] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 106.605136][ T4227] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 106.608170][ T4267] usb 5-1: Product: syz [ 106.619068][ T4267] usb 5-1: Manufacturer: syz [ 106.623708][ T4267] usb 5-1: SerialNumber: syz [ 106.646506][ T4908] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 106.886906][ T4908] netlink: 'syz.4.182': attribute type 11 has an invalid length. [ 106.975139][ T23] usb 4-1: new low-speed USB device number 7 using dummy_hcd [ 107.126827][ T4227] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 107.145224][ T4270] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 107.146320][ T4227] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 107.171314][ T4227] usb 2-1: Product: syz [ 107.178044][ T4227] usb 2-1: Manufacturer: syz [ 107.182766][ T4227] usb 2-1: SerialNumber: syz [ 107.335180][ T23] usb 4-1: config 0 has no interfaces? [ 107.405152][ T4270] usb 3-1: Using ep0 maxpacket: 16 [ 107.555410][ T4270] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 107.567624][ T4267] io_ti 5-1:8.234: Edgeport TI 2 port adapter converter detected [ 107.575296][ T23] usb 4-1: string descriptor 0 read error: -22 [ 107.577621][ T4270] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 107.594621][ T23] usb 4-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 107.596269][ T4270] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 107.614732][ T4267] io_ti 5-1:8.234: Direct firmware load for edgeport/down3.bin failed with error -2 [ 107.614783][ T23] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 107.624912][ T4267] io_ti 5-1:8.234: Falling back to sysfs fallback for: edgeport/down3.bin [ 107.641374][ T4270] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 107.651432][ T4270] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 107.667486][ T4227] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -32 [ 107.683795][ T23] usb 4-1: config 0 descriptor?? [ 107.755346][ T4270] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 107.765923][ T4270] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 107.773932][ T4270] usb 3-1: Manufacturer: syz [ 107.780927][ T4270] usb 3-1: config 0 descriptor?? [ 108.010221][ T4932] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 108.019109][ T4932] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 108.028001][ T4932] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 108.036803][ T4932] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 108.050159][ T4932] 9pnet: Insufficient options for proto=fd [ 108.074435][ T4934] udc-core: couldn't find an available UDC or it's busy [ 108.087876][ T4934] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 108.169148][ T4934] netlink: 4 bytes leftover after parsing attributes in process `syz.3.190'. [ 108.456203][ T4174] usb 4-1: USB disconnect, device number 7 [ 108.902239][ T4952] 8021q: adding VLAN 0 to HW filter on device bond2 [ 108.931070][ T4952] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.935683][ T4955] MPTCP: addr_signal error, rm_addr=1 [ 108.940133][ T4952] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.954421][ T4952] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.963501][ T4952] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.974452][ T4952] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 108.996360][ T4333] IPv6: ADDRCONF(NETDEV_CHANGE): bond2: link becomes ready [ 109.260928][ T4961] loop4: detected capacity change from 0 to 16 [ 109.918342][ T4961] erofs: (device loop4): mounted with root inode @ nid 36. [ 110.305164][ T4270] rc_core: IR keymap rc-hauppauge not found [ 110.311198][ T4270] Registered IR keymap rc-empty [ 110.317751][ T4270] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 110.355228][ T4270] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 110.386144][ T4270] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 110.406982][ T4270] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input8 [ 110.436834][ T4270] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 110.465186][ T4270] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 110.495166][ T4270] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 110.525244][ T4270] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 110.555278][ T4270] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 110.585190][ T4270] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 110.625153][ T4270] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 110.665520][ T4270] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 110.695153][ T4270] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 110.695240][ T4227] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x000000e8. ret = -71 [ 110.725232][ T4270] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 110.735307][ T4227] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x000000ec. ret = -71 [ 110.762521][ T4270] mceusb 3-1:0.0: Registered with mce emulator interface version 1 [ 110.765207][ T4227] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x000000f0. ret = -71 [ 110.772827][ T4270] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 110.800798][ T4270] usb 3-1: USB disconnect, device number 6 [ 110.805240][ T4227] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x000000f4. ret = -71 [ 110.835339][ T4227] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x00000090. ret = -71 [ 110.850263][ T4227] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 110.863879][ T4227] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 110.874134][ T4227] lan78xx: probe of 2-1:1.0 failed with error -71 [ 110.894465][ T4227] usb 2-1: USB disconnect, device number 5 [ 111.117551][ T4978] 9pnet: Insufficient options for proto=fd [ 111.725197][ T4227] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 111.755128][ T4232] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 112.035202][ T4227] usb 2-1: Using ep0 maxpacket: 16 [ 112.121453][ T4997] loop3: detected capacity change from 0 to 16 [ 112.155860][ T4232] usb 3-1: config 220 has an invalid interface number: 76 but max is 2 [ 112.164730][ T4227] usb 2-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 112.193947][ T4997] erofs: (device loop3): mounted with root inode @ nid 36. [ 112.229997][ T4232] usb 3-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 112.267163][ T4227] usb 2-1: config 0 interface 0 has no altsetting 0 [ 112.332719][ T4227] usb 2-1: New USB device found, idVendor=046d, idProduct=c626, bcdDevice= 0.00 [ 112.345988][ T4232] usb 3-1: config 220 has no interface number 2 [ 112.401912][ T4232] usb 3-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 112.429124][ T4227] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 112.532662][ T4232] usb 3-1: config 220 interface 0 has no altsetting 0 [ 112.546802][ T4227] usb 2-1: config 0 descriptor?? [ 112.601834][ T4232] usb 3-1: config 220 interface 76 has no altsetting 0 [ 112.669781][ T4232] usb 3-1: config 220 interface 1 has no altsetting 0 [ 112.866025][ T4232] usb 3-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 112.886522][ T4232] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 112.915644][ T4232] usb 3-1: Product: syz [ 112.919837][ T4232] usb 3-1: Manufacturer: syz [ 112.924420][ T4232] usb 3-1: SerialNumber: syz [ 113.067003][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.158215][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.166894][ T4989] udc-core: couldn't find an available UDC or it's busy [ 113.180393][ T4989] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 113.188238][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.196645][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.203921][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.211327][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.218733][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.226648][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.233789][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.240970][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.248278][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.255562][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.262724][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.271536][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.278755][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.287376][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.295915][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.303080][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.310873][ T4232] usb 3-1: Found UVC 7.01 device syz (8086:0b07) [ 113.327822][ T4232] usb 3-1: No valid video chain found. [ 113.333346][ T4232] usb 3-1: selecting invalid altsetting 0 [ 113.344206][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.353505][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.367646][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.375012][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.472208][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.481692][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.493487][ T4232] usb 3-1: selecting invalid altsetting 0 [ 113.504018][ T4232] usbtest: probe of 3-1:220.1 failed with error -22 [ 113.515021][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.567394][ T4232] usb 3-1: USB disconnect, device number 7 [ 113.573972][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.602658][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.637251][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.657527][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.664709][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.677789][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.688391][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.699094][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.707493][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.714780][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.722114][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.729682][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.736880][ T4227] logitech 0003:046D:C626.0003: unknown main item tag 0x0 [ 113.759522][ T4227] logitech 0003:046D:C626.0003: hidraw0: USB HID v0.08 Device [HID 046d:c626] on usb-dummy_hcd.1-1/input0 [ 113.902205][ T4227] usb 2-1: USB disconnect, device number 6 [ 114.110781][ T21] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 114.179775][ T5025] 9pnet: Insufficient options for proto=fd [ 114.475295][ T21] usb 4-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 114.486018][ T21] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 114.499318][ T21] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 114.508911][ T21] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 114.527441][ T21] usb 4-1: config 0 descriptor?? [ 114.577912][ T21] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 115.027721][ T5031] loop1: detected capacity change from 0 to 16 [ 115.035333][ T7] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 115.052755][ T5031] erofs: (device loop1): mounted with root inode @ nid 36. [ 116.076902][ T7] usb 3-1: Using ep0 maxpacket: 32 [ 116.174652][ T5038] chnl_net:caif_netlink_parms(): no params data found [ 116.240908][ T5038] bridge0: port 1(bridge_slave_0) entered blocking state [ 116.250305][ T5038] bridge0: port 1(bridge_slave_0) entered disabled state [ 116.259870][ T5038] device bridge_slave_0 entered promiscuous mode [ 116.271851][ T5038] bridge0: port 2(bridge_slave_1) entered blocking state [ 116.279604][ T5038] bridge0: port 2(bridge_slave_1) entered disabled state [ 116.289268][ T5038] device bridge_slave_1 entered promiscuous mode [ 116.319246][ T5038] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 116.332612][ T5038] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 116.367534][ T5038] team0: Port device team_slave_0 added [ 116.382540][ T5038] team0: Port device team_slave_1 added [ 116.398986][ T5038] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 116.406418][ T5038] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 116.432392][ C0] vkms_vblank_simulate: vblank timer overrun [ 116.438759][ T5038] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 116.451224][ T5038] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 116.458639][ T5038] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 116.484531][ C0] vkms_vblank_simulate: vblank timer overrun [ 116.492590][ T5038] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 116.509192][ T7] usb 3-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 116.515195][ T21] usb 4-1: USB disconnect, device number 8 [ 116.545938][ T7] usb 3-1: config 155 interface 0 altsetting 0 has an invalid endpoint with address 0xE2, skipping [ 116.557105][ T7] usb 3-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 116.610312][ T5049] loop3: detected capacity change from 0 to 16 [ 116.640067][ T5049] erofs: (device loop3): mounted with root inode @ nid 36. [ 116.720718][ T597] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 116.741395][ T597] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 116.766176][ T7] usb 3-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 116.911775][ T7] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 116.971932][ T7] usb 3-1: Product: syz [ 116.987885][ T7] usb 3-1: Manufacturer: syz [ 117.002936][ T7] usb 3-1: SerialNumber: syz [ 117.856427][ T5056] loop2: detected capacity change from 0 to 7 [ 117.881213][ T4179] Dev loop2: unable to read RDB block 7 [ 117.893097][ T4179] loop2: AHDI p2 p3 [ 117.897611][ T4179] loop2: partition table partially beyond EOD, truncated [ 117.914610][ T4179] loop2: p3 start 335544320 is beyond EOD, truncated [ 117.961231][ T5056] Dev loop2: unable to read RDB block 7 [ 117.969767][ T597] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 117.975328][ T5056] loop2: AHDI p2 p3 [ 117.983995][ T5056] loop2: partition table partially beyond EOD, truncated [ 117.991379][ T7] usb 3-1: can't set config #155, error -71 [ 118.002423][ T5056] loop2: p3 start 335544320 is beyond EOD, truncated [ 118.009889][ T7] usb 3-1: USB disconnect, device number 8 [ 118.019242][ T597] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 118.068065][ T5038] device hsr_slave_0 entered promiscuous mode [ 118.068294][ T5058] program syz.4.232 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 118.083907][ T5038] device hsr_slave_1 entered promiscuous mode [ 118.105572][ T4227] Bluetooth: hci1: command 0x0409 tx timeout [ 118.112199][ T5038] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 118.128154][ T5038] Cannot create hsr debugfs directory [ 118.217222][ T597] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 118.235162][ T4536] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 118.311097][ T5070] loop4: detected capacity change from 0 to 16 [ 118.363945][ T5070] erofs: (device loop4): mounted with root inode @ nid 36. [ 119.069943][ T597] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.186354][ T597] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 119.241135][ T597] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 120.125369][ T4536] usb 2-1: unable to get BOS descriptor or descriptor too short [ 120.213441][ T21] Bluetooth: hci1: command 0x041b tx timeout [ 120.315283][ T4536] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 120.333162][ T4536] usb 2-1: can't read configurations, error -71 [ 120.365788][ T5095] netlink: 20 bytes leftover after parsing attributes in process `syz.2.242'. [ 121.511597][ T5107] loop4: detected capacity change from 0 to 16 [ 122.165232][ T5107] erofs: (device loop4): mounted with root inode @ nid 36. [ 122.265160][ T4227] Bluetooth: hci1: command 0x040f tx timeout [ 122.527094][ T5038] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 122.608841][ T5038] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 122.634846][ T5114] netlink: 'syz.2.246': attribute type 10 has an invalid length. [ 122.785162][ T5038] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 123.432336][ T5038] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 124.425192][ T4228] Bluetooth: hci1: command 0x0419 tx timeout [ 124.714276][ T5038] 8021q: adding VLAN 0 to HW filter on device bond0 [ 124.807306][ T4535] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 124.822362][ T4535] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 124.972899][ T5156] netlink: 28 bytes leftover after parsing attributes in process `syz.2.258'. [ 124.974378][ T5038] 8021q: adding VLAN 0 to HW filter on device team0 [ 125.097904][ T4535] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 125.125580][ T4535] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 125.148963][ T4228] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 125.177484][ T4535] bridge0: port 1(bridge_slave_0) entered blocking state [ 125.184612][ T4535] bridge0: port 1(bridge_slave_0) entered forwarding state [ 125.193519][ T4535] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 125.202833][ T4535] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 125.252465][ T4535] bridge0: port 2(bridge_slave_1) entered blocking state [ 125.259768][ T4535] bridge0: port 2(bridge_slave_1) entered forwarding state [ 125.315534][ T4535] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 125.324612][ T4535] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 125.537743][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 125.550394][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 125.561656][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 125.570886][ T4228] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 125.611475][ T4228] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 125.630540][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 125.662415][ T5165] netlink: 8 bytes leftover after parsing attributes in process `syz.4.261'. [ 125.703287][ T4535] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 125.734768][ T4535] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 125.776515][ T597] device hsr_slave_0 left promiscuous mode [ 125.786203][ T4228] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 125.799735][ T4228] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 125.807920][ T4228] usb 4-1: Product: syz [ 125.812155][ T4228] usb 4-1: Manufacturer: syz [ 125.816886][ T4228] usb 4-1: SerialNumber: syz [ 125.823744][ T597] device hsr_slave_1 left promiscuous mode [ 125.841307][ T597] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 125.866441][ T4228] cdc_ncm 4-1:1.0: skipping garbage [ 125.907391][ T597] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 126.026575][ T597] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 126.069061][ T597] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 126.176793][ T597] device bridge_slave_1 left promiscuous mode [ 126.252150][ T597] bridge0: port 2(bridge_slave_1) entered disabled state [ 126.451868][ T597] device bridge_slave_0 left promiscuous mode [ 126.500486][ T597] bridge0: port 1(bridge_slave_0) entered disabled state [ 126.817928][ T597] device veth1_macvtap left promiscuous mode [ 126.849879][ T597] device veth0_macvtap left promiscuous mode [ 126.872282][ T597] device veth1_vlan left promiscuous mode [ 126.886333][ T597] device veth0_vlan left promiscuous mode [ 126.965340][ T4228] cdc_ncm 4-1:1.0: bind() failure [ 126.988403][ T4228] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 127.022417][ T4228] cdc_ncm 4-1:1.1: bind() failure [ 127.224731][ T4228] usb 4-1: USB disconnect, device number 9 [ 127.395147][ T7] usb 3-1: new full-speed USB device number 9 using dummy_hcd [ 127.400870][ T597] team0 (unregistering): Port device team_slave_1 removed [ 127.426970][ T597] team0 (unregistering): Port device team_slave_0 removed [ 127.450191][ T597] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 127.496229][ T597] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 127.580773][ T597] bond0 (unregistering): Released all slaves [ 127.701821][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 127.719807][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 127.733735][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 127.744994][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 127.765815][ T5038] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 127.845353][ T7] usb 3-1: unable to get BOS descriptor or descriptor too short [ 127.921221][ T7] usb 3-1: not running at top speed; connect to a high speed hub [ 128.034386][ T7] usb 3-1: config 251 has an invalid descriptor of length 0, skipping remainder of the config [ 128.236055][ T7] usb 3-1: New USB device found, idVendor=1199, idProduct=9003, bcdDevice=d7.00 [ 128.245262][ T5038] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 128.253149][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 128.265614][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 128.273165][ T7] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 128.292958][ T7] usb 3-1: Product: syz [ 128.307905][ T7] usb 3-1: Manufacturer: syz [ 128.317791][ T7] usb 3-1: SerialNumber: syz [ 128.495144][ T5019] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 128.657327][ T4333] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 128.684033][ T4333] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 128.693749][ T7] qmi_wwan: probe of 3-1:251.0 failed with error -22 [ 128.735279][ T5019] usb 2-1: Using ep0 maxpacket: 8 [ 128.810008][ T7] usb 3-1: USB disconnect, device number 9 [ 128.822326][ T5038] device veth0_vlan entered promiscuous mode [ 128.845507][ T4535] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 128.853776][ T4535] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 128.855346][ T5019] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 128.883229][ T4535] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 128.898000][ T4535] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 128.915524][ T5019] usb 2-1: config 179 has no interface number 0 [ 128.928955][ T5038] device veth1_vlan entered promiscuous mode [ 128.945324][ T5019] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 128.984797][ T5019] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 129.002757][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 129.012172][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 129.025719][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 129.033923][ T5019] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 129.045851][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 129.062670][ T5019] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid wMaxPacketSize 0 [ 129.075369][ T5038] device veth0_macvtap entered promiscuous mode [ 129.084785][ T5038] device veth1_macvtap entered promiscuous mode [ 129.101644][ T5019] usb 2-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 129.125302][ T5019] usb 2-1: config 179 interface 65 has no altsetting 0 [ 129.141234][ T5019] usb 2-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 129.167520][ T5038] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 129.170785][ T5019] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 129.208654][ T5038] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 129.233910][ T5038] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 129.248352][ T5019] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:179.65/input/input9 [ 129.269291][ T5038] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 129.295607][ T5038] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 129.315066][ T5038] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 129.337422][ T5038] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 129.380968][ T4333] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 129.419736][ T4333] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 129.469020][ T4333] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 129.516074][ T4333] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 129.561051][ T5038] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 129.590628][ T5038] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 129.650484][ T5038] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 129.682617][ T5038] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 130.211602][ T5038] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 130.222116][ T5038] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 130.233275][ T5038] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 130.364225][ T5257] loop2: detected capacity change from 0 to 32768 [ 130.380376][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 130.400896][ T1244] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 130.421233][ T5038] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 130.453830][ T5038] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 130.489351][ T5257] XFS (loop2): Mounting V5 Filesystem [ 130.504724][ T5038] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 130.549780][ T5038] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 130.570200][ T5257] XFS (loop2): Ending clean mount [ 130.646294][ T4229] usb 2-1: USB disconnect, device number 9 [ 130.653017][ T4229] xpad 2-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 130.790061][ T4191] XFS (loop2): Unmounting Filesystem [ 130.902349][ T1244] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 130.924001][ T1244] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 130.962206][ T4243] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 131.006201][ T4247] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 131.014364][ T4247] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 131.103222][ T4247] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 131.380324][ T5310] netlink: 8 bytes leftover after parsing attributes in process `syz.3.286'. [ 131.805637][ T5322] 9pnet: Insufficient options for proto=fd [ 131.993225][ T5328] tipc: Enabling of bearer rejected, already enabled [ 132.639203][ T4227] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 132.715170][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.721552][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.871198][ T5331] loop1: detected capacity change from 0 to 32768 [ 132.995157][ T4227] usb 4-1: Using ep0 maxpacket: 32 [ 133.073931][ T5331] XFS (loop1): Mounting V5 Filesystem [ 133.117051][ T4227] usb 4-1: config 4 has too many interfaces: 223, using maximum allowed: 32 [ 133.127674][ T4227] usb 4-1: config 4 has 1 interface, different from the descriptor's value: 223 [ 133.137846][ T4227] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 149, changing to 11 [ 133.151671][ T4227] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 58436, setting to 1024 [ 133.285450][ T4227] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 133.308382][ T4227] usb 4-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 133.356181][ T4227] usb 4-1: Product: syz [ 133.383014][ T4227] usb 4-1: Manufacturer: syz [ 133.401453][ T5331] XFS (loop1): Ending clean mount [ 133.436094][ T5325] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 133.509142][ T4227] hub 4-1:4.0: USB hub found [ 133.527611][ T4186] XFS (loop1): Unmounting Filesystem [ 133.738849][ T4227] hub 4-1:4.0: 2 ports detected [ 134.561354][ T5380] netlink: 4 bytes leftover after parsing attributes in process `syz.2.296'. [ 135.042320][ T4227] hub 4-1:4.0: hub_hub_status failed (err = -71) [ 135.049104][ T4227] hub 4-1:4.0: config failed, can't get hub status (err -71) [ 135.071727][ T5395] netlink: 8 bytes leftover after parsing attributes in process `syz.2.300'. [ 135.116015][ T4227] usb 4-1: USB disconnect, device number 10 [ 135.245270][ T4228] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 135.505359][ T4536] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 135.519569][ T5416] tipc: Enabling of bearer rejected, already enabled [ 135.525277][ T4228] usb 2-1: Using ep0 maxpacket: 8 [ 135.645362][ T4228] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 135.653900][ T4228] usb 2-1: config 179 has no interface number 0 [ 135.660588][ T4228] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 135.672670][ T4228] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 135.684568][ T4228] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 135.696282][ T4228] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid wMaxPacketSize 0 [ 135.715195][ T4228] usb 2-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 135.729150][ T4228] usb 2-1: config 179 interface 65 has no altsetting 0 [ 135.749241][ T4228] usb 2-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 135.769523][ T4228] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 135.785348][ T4536] usb 3-1: Using ep0 maxpacket: 32 [ 135.819897][ T4228] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:179.65/input/input10 [ 135.935254][ T13] usb 6-1: new low-speed USB device number 2 using dummy_hcd [ 135.995749][ T5436] 9pnet: Insufficient options for proto=fd [ 136.125295][ T4536] usb 3-1: config 1 interface 0 altsetting 4 bulk endpoint 0x1 has invalid maxpacket 1023 [ 136.137091][ T4536] usb 3-1: config 1 interface 0 altsetting 4 bulk endpoint 0x82 has invalid maxpacket 104 [ 136.147263][ T4536] usb 3-1: config 1 interface 0 has no altsetting 0 [ 136.154883][ T7] usb 2-1: USB disconnect, device number 10 [ 136.161590][ T7] xpad 2-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 136.325272][ T4536] usb 3-1: New USB device found, idVendor=03f0, idProduct=0004, bcdDevice= 0.40 [ 136.334806][ T4536] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 136.348252][ T4536] usb 3-1: Product: 쇝跜䡂쟅⚁ꬲ낞轷㓵䕯熳䩖撌⁻ʘ貎쨇諲穄慛챬ṁ峲鬵鵱콓쭋뭻 [ 136.360771][ T13] usb 6-1: config index 0 descriptor too short (expected 1307, got 27) [ 136.369324][ T4536] usb 3-1: Manufacturer: 䂋톢䛑娉䶙柛꽸띡脜뼨麀꭫ﾍ愵获⬡ᣰ嬓淝䧇㕡懦ꜵ梱•ꚩ櫸谼㨌흜鷀퀐즵퀮饘ᣯ萞䝟ꋆ몐㔱䰟鉀䕝ⷞ垍憴쾅蜃ffi䃌꥾叼暵`㊦欌ꈨ䪰醛뫅중穄꽉黀⠲⫁읿껩솦꺁蒇糃Ꮵ䧢凩٫⟐㯎柂䯄֠ᎆ랞∦뼜굋滺깬흞斩뒷├穃닳蓎㭺 [ 136.402960][ T13] usb 6-1: config 0 has an invalid interface number: 0 but max is -1 [ 136.411141][ T13] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 136.420489][ T13] usb 6-1: too many endpoints for config 0 interface 0 altsetting 0: 246, using maximum allowed: 30 [ 136.431444][ T13] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x84 is Bulk; changing to Interrupt [ 136.441791][ T4536] usb 3-1: SerialNumber: syz [ 136.448316][ T13] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 136.458175][ T13] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 246 [ 136.471433][ T5400] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 136.478829][ T5400] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 136.725936][ T13] usb 6-1: string descriptor 0 read error: -22 [ 136.726159][ T5453] netlink: 28 bytes leftover after parsing attributes in process `syz.1.307'. [ 136.736346][ T13] usb 6-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 136.768572][ T4536] usblp0: Disabling reads from problematic bidirectional printer [ 136.783568][ T13] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 136.793460][ T13] usb 6-1: config 0 descriptor?? [ 136.803971][ T4536] usblp 3-1:1.0: usblp0: USB Unidirectional printer dev 10 if 0 alt 4 proto 3 vid 0x03F0 pid 0x0004 [ 136.823310][ T4536] usb 3-1: USB disconnect, device number 10 [ 136.841815][ T4536] usblp0: removed [ 136.848497][ T4179] udevd[4179]: setting mode of /dev/bus/usb/003/010 to 020664 failed: No such file or directory [ 136.862701][ T4179] udevd[4179]: setting owner of /dev/bus/usb/003/010 to uid=0, gid=7 failed: No such file or directory [ 136.865937][ T13] hub 6-1:0.0: bad descriptor, ignoring hub [ 136.901554][ T13] hub: probe of 6-1:0.0 failed with error -5 [ 136.912094][ T13] input: USB Acecad 302 Tablet 0460:0008 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/input/input11 [ 136.969604][ T5462] netlink: 8 bytes leftover after parsing attributes in process `syz.3.311'. [ 137.228423][ T5466] udc-core: couldn't find an available UDC or it's busy [ 137.235695][ T5466] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 137.461307][ T5466] netlink: 4 bytes leftover after parsing attributes in process `syz.5.303'. [ 137.490811][ T5470] device syzkaller0 entered promiscuous mode [ 137.498556][ T5466] netlink: 4 bytes leftover after parsing attributes in process `syz.5.303'. [ 137.749109][ T26] audit: type=1326 audit(1776828676.686:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5475 comm="syz.2.315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b055f5819 code=0x7ffc0000 [ 137.771223][ C1] vkms_vblank_simulate: vblank timer overrun [ 137.785618][ T26] audit: type=1326 audit(1776828676.716:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5475 comm="syz.2.315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=293 compat=0 ip=0x7f4b055f5819 code=0x7ffc0000 [ 137.808448][ T26] audit: type=1326 audit(1776828676.716:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5475 comm="syz.2.315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b055f5819 code=0x7ffc0000 [ 137.831022][ T26] audit: type=1326 audit(1776828676.716:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5475 comm="syz.2.315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f4b055f5819 code=0x7ffc0000 [ 137.853096][ C1] vkms_vblank_simulate: vblank timer overrun [ 137.859743][ T26] audit: type=1326 audit(1776828676.716:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5475 comm="syz.2.315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b055f5819 code=0x7ffc0000 [ 137.883318][ T26] audit: type=1326 audit(1776828676.716:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5475 comm="syz.2.315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f4b055f5819 code=0x7ffc0000 [ 137.907087][ T26] audit: type=1326 audit(1776828676.716:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5475 comm="syz.2.315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b055f5819 code=0x7ffc0000 [ 137.929732][ T26] audit: type=1326 audit(1776828676.716:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5475 comm="syz.2.315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7f4b055f5819 code=0x7ffc0000 [ 137.951811][ C1] vkms_vblank_simulate: vblank timer overrun [ 137.959001][ T4228] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 137.971308][ T26] audit: type=1326 audit(1776828676.716:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5475 comm="syz.2.315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b055f5819 code=0x7ffc0000 [ 137.993925][ T26] audit: type=1326 audit(1776828676.716:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5475 comm="syz.2.315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=29 compat=0 ip=0x7f4b055f5819 code=0x7ffc0000 [ 138.213717][ T5484] 9pnet: Insufficient options for proto=fd [ 138.285138][ T4228] usb 2-1: Using ep0 maxpacket: 32 [ 138.445382][ T4228] usb 2-1: config 139 has an invalid interface number: 49 but max is 0 [ 138.459464][ T4228] usb 2-1: config 139 has no interface number 0 [ 138.467551][ T4228] usb 2-1: config 139 interface 49 has no altsetting 0 [ 138.507053][ T5019] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 138.520162][ T5019] Bluetooth: hci1: Injecting HCI hardware error event [ 138.529661][ T4194] Bluetooth: hci1: hardware error 0x00 [ 138.547343][ T5490] capability: warning: `syz.2.320' uses deprecated v2 capabilities in a way that may be insecure [ 138.593761][ T5019] usb 6-1: USB disconnect, device number 2 [ 138.635499][ T4228] usb 2-1: New USB device found, idVendor=10c4, idProduct=8244, bcdDevice=72.75 [ 138.644579][ T4228] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 138.675892][ T4228] usb 2-1: Product: syz [ 138.680393][ T4228] usb 2-1: Manufacturer: syz [ 138.696789][ T5497] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 138.725776][ T4228] usb 2-1: SerialNumber: syz [ 139.094628][ T5508] netlink: 8 bytes leftover after parsing attributes in process `syz.3.327'. [ 139.145923][ T4228] radio-usb-si4713 2-1:139.49: Si4713 development board discovered: (10C4:8244) [ 139.945626][ T5515] loop4: detected capacity change from 0 to 16 [ 141.390161][ T4228] radio-usb-si4713: probe of 2-1:139.49 failed with error -71 [ 141.407736][ T5515] erofs: (device loop4): mounted with root inode @ nid 36. [ 141.430354][ T4228] usbhid 2-1:139.49: couldn't find an input interrupt endpoint [ 141.446940][ T4228] usb 2-1: USB disconnect, device number 11 [ 141.755272][ T5535] tipc: Enabling of bearer rejected, already enabled [ 141.765257][ T4536] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 141.905414][ T4228] usb 2-1: new full-speed USB device number 12 using dummy_hcd [ 142.090328][ T5555] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 142.099446][ T5555] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 142.108185][ T5555] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 142.116940][ T5555] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 142.179353][ T5564] netlink: 12 bytes leftover after parsing attributes in process `syz.2.339'. [ 142.188616][ T4536] usb 4-1: Using ep0 maxpacket: 8 [ 142.305515][ T4228] usb 2-1: config 0 interface 0 altsetting 251 has an invalid endpoint with address 0x3B, skipping [ 142.325316][ T4536] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 142.339402][ T4228] usb 2-1: config 0 interface 0 has no altsetting 0 [ 142.355136][ T4536] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 142.365109][ T4536] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 142.375734][ T4536] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 142.391269][ T4536] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 142.400434][ T4536] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 142.526904][ T4228] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 142.544678][ T4228] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 142.571030][ T4228] usb 2-1: Product: syz [ 142.587920][ T4228] usb 2-1: Manufacturer: syz [ 142.612198][ T4228] usb 2-1: SerialNumber: syz [ 142.647836][ T4228] usb 2-1: config 0 descriptor?? [ 142.665422][ T4536] usb 4-1: GET_CAPABILITIES returned 0 [ 142.672077][ T4536] usbtmc 4-1:16.0: can't read capabilities [ 142.675964][ T5519] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 142.806174][ T4228] snd-usb-audio: probe of 2-1:0.0 failed with error -22 [ 142.887979][ T4945] udevd[4945]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 142.903895][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 142.905118][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 142.905155][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 142.905190][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 142.905226][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 142.905261][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 142.905295][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 142.905330][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 142.905365][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 142.905399][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 142.905434][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 142.905468][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 142.905502][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 142.905536][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 142.905571][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 142.905605][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 142.916484][ T7] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 142.927278][ T5019] usb 4-1: USB disconnect, device number 11 [ 143.065095][ T4536] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 143.081885][ T5519] netlink: 68 bytes leftover after parsing attributes in process `syz.1.329'. [ 143.116935][ T7] Bluetooth: hci3: Injecting HCI hardware error event [ 143.144679][ T4197] Bluetooth: hci3: hardware error 0x00 [ 143.204276][ T5571] netlink: 44 bytes leftover after parsing attributes in process `syz.1.329'. [ 143.222358][ T5571] netlink: 8 bytes leftover after parsing attributes in process `syz.1.329'. [ 143.250912][ T7] usb 2-1: USB disconnect, device number 12 [ 143.405140][ T4536] usb 6-1: Using ep0 maxpacket: 32 [ 144.245200][ T4536] usb 6-1: config 4 has too many interfaces: 223, using maximum allowed: 32 [ 144.257357][ T4536] usb 6-1: config 4 has 1 interface, different from the descriptor's value: 223 [ 144.283218][ T4536] usb 6-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 144.318580][ T4536] usb 6-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 144.431400][ T5590] loop4: detected capacity change from 0 to 16 [ 144.466066][ T4536] usb 6-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 144.491611][ T5590] erofs: (device loop4): mounted with root inode @ nid 36. [ 145.076680][ T4536] usb 6-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 145.354459][ T4536] usb 6-1: Product: syz [ 145.386905][ T4536] usb 6-1: Manufacturer: syz [ 145.476557][ T4536] hub 6-1:4.0: USB hub found [ 145.696825][ T4536] hub 6-1:4.0: 2 ports detected [ 145.777783][ T5640] netlink: 136 bytes leftover after parsing attributes in process `syz.1.348'. [ 145.789017][ T5640] A link change request failed with some changes committed already. Interface ip6_vti0 may have been left with an inconsistent configuration, please check. [ 146.144242][ T5647] loop1: detected capacity change from 0 to 16 [ 146.207506][ T5647] erofs: (device loop1): mounted with root inode @ nid 36. [ 147.225634][ T7] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 147.334394][ T4536] hub 6-1:4.0: hub_hub_status failed (err = -71) [ 147.345393][ T4536] hub 6-1:4.0: config failed, can't get hub status (err -71) [ 147.404896][ T4536] usb 6-1: USB disconnect, device number 3 [ 147.556171][ T7] usb 3-1: Using ep0 maxpacket: 8 [ 147.618460][ T5679] netlink: 92 bytes leftover after parsing attributes in process `syz.1.356'. [ 147.835777][ T7] usb 3-1: New USB device found, idVendor=2770, idProduct=9120, bcdDevice=6c.77 [ 147.862692][ T7] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=239 [ 147.891648][ T7] usb 3-1: Product: syz [ 147.898475][ T7] usb 3-1: Manufacturer: syz [ 147.909377][ T7] usb 3-1: SerialNumber: syz [ 147.932025][ T7] usb 3-1: config 0 descriptor?? [ 147.978188][ T7] gspca_main: sq905-2.14.0 probing 2770:9120 [ 148.568581][ T5701] device syzkaller0 entered promiscuous mode [ 148.835899][ T5650] udc-core: couldn't find an available UDC or it's busy [ 148.845253][ T5650] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 148.899339][ T7] gspca_sq905: sq905_command: usb_control_msg failed 2 (-71) [ 148.909443][ T7] sq905: probe of 3-1:0.0 failed with error -71 [ 148.942766][ T7] usb 3-1: USB disconnect, device number 11 [ 149.069503][ T5722] loop3: detected capacity change from 0 to 16 [ 149.080190][ T5722] erofs: (device loop3): mounted with root inode @ nid 36. [ 151.435310][ T4229] usb 6-1: new full-speed USB device number 4 using dummy_hcd [ 151.485475][ T4536] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 151.501838][ T5777] loop3: detected capacity change from 0 to 16 [ 151.518251][ T5777] erofs: (device loop3): mounted with root inode @ nid 36. [ 151.846041][ T4229] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 152.325359][ T4536] usb 2-1: unable to get BOS descriptor or descriptor too short [ 152.340543][ T4229] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 152.377707][ T4229] usb 6-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 152.402794][ T4229] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 152.414717][ T4229] usb 6-1: config 0 descriptor?? [ 152.423501][ T4536] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7 [ 152.595594][ T4536] usb 2-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 152.604680][ T4536] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 152.634683][ T4536] usb 2-1: Product: syz [ 152.644449][ T4536] usb 2-1: Manufacturer: syz [ 152.786879][ T4536] usb 2-1: SerialNumber: syz [ 152.906225][ T5804] netlink: 72 bytes leftover after parsing attributes in process `syz.2.378'. [ 153.161101][ T5763] udc-core: couldn't find an available UDC or it's busy [ 153.221051][ T5763] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 153.462680][ T4536] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 153.471236][ T4229] elan 0003:04F3:0755.0004: unknown main item tag 0x0 [ 153.550089][ T4229] elan 0003:04F3:0755.0004: unknown main item tag 0x0 [ 153.559797][ T4229] elan 0003:04F3:0755.0004: unknown main item tag 0x0 [ 153.566704][ T4229] elan 0003:04F3:0755.0004: unknown main item tag 0x0 [ 153.573512][ T4229] elan 0003:04F3:0755.0004: unknown main item tag 0x0 [ 153.582434][ T4229] elan 0003:04F3:0755.0004: failed to start in urb: -90 [ 153.590918][ T4229] elan 0003:04F3:0755.0004: hidraw0: USB HID v1.01 Device [HID 04f3:0755] on usb-dummy_hcd.5-1/input0 [ 153.602251][ T4536] usb 2-1: 2:1 : unknown format tag 0x4 is detected. processed as MPEG. [ 154.159241][ T4536] usb 2-1: found format II with max.bitrate = 4, frame size=7372 [ 154.289114][ T5813] loop4: detected capacity change from 0 to 32768 [ 154.317842][ T4227] usb 6-1: USB disconnect, device number 4 [ 154.393228][ T26] kauditd_printk_skb: 6 callbacks suppressed [ 154.393243][ T26] audit: type=1326 audit(1776828693.326:55): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5826 comm="syz.2.383" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b055f5819 code=0x7ffc0000 [ 154.457561][ T5813] XFS (loop4): Mounting V5 Filesystem [ 154.501333][ T5831] fido_id[5831]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 154.536044][ T4536] usb 2-1: 2:1 : unknown format tag 0x4 is detected. processed as MPEG. [ 154.541388][ T5813] XFS (loop4): Ending clean mount [ 154.597326][ T26] audit: type=1326 audit(1776828693.366:56): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5826 comm="syz.2.383" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b055f5819 code=0x7ffc0000 [ 154.632008][ T4536] usb 2-1: found format II with max.bitrate = 4, frame size=7372 [ 154.646775][ T26] audit: type=1326 audit(1776828693.366:57): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5826 comm="syz.2.383" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b055f5819 code=0x7ffc0000 [ 154.655137][ T4229] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 154.669077][ C1] vkms_vblank_simulate: vblank timer overrun [ 154.728231][ T4185] XFS (loop4): Unmounting Filesystem [ 154.733628][ T26] audit: type=1326 audit(1776828693.366:58): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5826 comm="syz.2.383" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b055f5819 code=0x7ffc0000 [ 154.745268][ T4536] usb 2-1: parse_audio_format_rates_v2v3(): unable to retrieve number of sample rates (clock 0) [ 154.812466][ T26] audit: type=1326 audit(1776828693.366:59): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5826 comm="syz.2.383" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f4b055f5819 code=0x7ffc0000 [ 154.834565][ C1] vkms_vblank_simulate: vblank timer overrun [ 154.852710][ T4536] usb 2-1: USB disconnect, device number 13 [ 154.903769][ T26] audit: type=1326 audit(1776828693.366:60): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5826 comm="syz.2.383" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b055f5819 code=0x7ffc0000 [ 154.985265][ T4229] usb 4-1: Using ep0 maxpacket: 32 [ 155.012237][ T5846] loop5: detected capacity change from 0 to 16 [ 155.025546][ T26] audit: type=1326 audit(1776828693.366:61): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5826 comm="syz.2.383" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b055f5819 code=0x7ffc0000 [ 155.050274][ T26] audit: type=1326 audit(1776828693.366:62): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5826 comm="syz.2.383" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b055f5819 code=0x7ffc0000 [ 155.077794][ T5846] erofs: (device loop5): mounted with root inode @ nid 36. [ 155.093060][ T26] audit: type=1326 audit(1776828693.366:63): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5826 comm="syz.2.383" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b055f5819 code=0x7ffc0000 [ 155.125439][ T26] audit: type=1326 audit(1776828693.366:64): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5826 comm="syz.2.383" exe="/root/syz-executor" sig=0 arch=c000003e syscall=72 compat=0 ip=0x7f4b055f5819 code=0x7ffc0000 [ 155.150021][ T4229] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 155.183740][ T4229] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 155.345303][ T4229] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 155.371629][ T4229] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 155.386172][ T4229] usb 4-1: Product: syz [ 155.390749][ T4229] usb 4-1: Manufacturer: syz [ 155.412724][ T4229] usb 4-1: SerialNumber: syz [ 155.449552][ T4229] usb 4-1: config 0 descriptor?? [ 155.665543][ T5863] team0 (unregistering): Port device team_slave_0 removed [ 155.709348][ T5863] team0 (unregistering): Port device team_slave_1 removed [ 155.716087][ T4229] usb 4-1: USB disconnect, device number 12 [ 155.738742][ T4536] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 155.985156][ T4536] usb 6-1: Using ep0 maxpacket: 16 [ 156.225390][ T4536] usb 6-1: config index 0 descriptor too short (expected 51443, got 18) [ 156.623187][ T5897] netlink: 72 bytes leftover after parsing attributes in process `syz.2.391'. [ 157.145355][ T4536] usb 6-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 157.159045][ T4536] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 157.175556][ T4536] usb 6-1: Product: syz [ 157.179816][ T4536] usb 6-1: Manufacturer: syz [ 157.184486][ T4536] usb 6-1: SerialNumber: syz [ 157.194557][ T4536] r8152-cfgselector 6-1: config 0 descriptor?? [ 157.364477][ T5918] loop3: detected capacity change from 0 to 16 [ 157.388941][ T5918] erofs: (device loop3): mounted with root inode @ nid 36. [ 157.411928][ T5920] sctp: [Deprecated]: syz.4.397 (pid 5920) Use of int in max_burst socket option deprecated. [ 157.411928][ T5920] Use struct sctp_assoc_value instead [ 157.555291][ T4229] usb 3-1: new full-speed USB device number 12 using dummy_hcd [ 157.715174][ T4536] r8152-cfgselector 6-1: Unknown version 0x0000 [ 157.721525][ T4231] usb 2-1: new full-speed USB device number 14 using dummy_hcd [ 157.729270][ T4536] r8152-cfgselector 6-1: bad CDC descriptors [ 157.755421][ T4536] r8152-cfgselector 6-1: Unknown version 0x0000 [ 157.763717][ T4536] r8152-cfgselector 6-1: USB disconnect, device number 5 [ 157.775321][ T4227] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 157.915265][ T4229] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 157.926781][ T4229] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 157.936684][ T4229] usb 3-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 157.946398][ T4229] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 157.957392][ T4229] usb 3-1: config 0 descriptor?? [ 158.135441][ T4231] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 158.146528][ T4231] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 158.156254][ T4231] usb 2-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 158.165865][ T4231] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 158.175321][ T4227] usb 4-1: config 220 has an invalid interface number: 76 but max is 2 [ 158.176101][ T4231] usb 2-1: config 0 descriptor?? [ 158.189053][ T4227] usb 4-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 158.209844][ T4227] usb 4-1: config 220 has no interface number 2 [ 158.226573][ T4227] usb 4-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 158.237927][ T4231] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 158.252586][ T4227] usb 4-1: config 220 interface 0 has no altsetting 0 [ 158.258615][ T4231] dvb-usb: bulk message failed: -22 (3/0) [ 158.268455][ T4227] usb 4-1: config 220 interface 76 has no altsetting 0 [ 158.283026][ T4227] usb 4-1: config 220 interface 1 has no altsetting 0 [ 158.283721][ T4231] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 158.321127][ T4231] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 158.396518][ T5929] netlink: 4 bytes leftover after parsing attributes in process `syz.5.402'. [ 158.445287][ T5922] dibusb: i2c wr: len=61 is too big! [ 158.445287][ T5922] [ 158.486484][ T4227] usb 4-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 158.516644][ T4229] elan 0003:04F3:0755.0005: unknown main item tag 0x0 [ 158.524596][ T4227] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 158.565787][ T4227] usb 4-1: Product: syz [ 158.594242][ T4227] usb 4-1: Manufacturer: syz [ 158.623562][ T4227] usb 4-1: SerialNumber: syz [ 158.773717][ T5931] udc-core: couldn't find an available UDC or it's busy [ 158.808296][ T5931] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 159.088170][ T4227] usb 4-1: Found UVC 7.01 device syz (8086:0b07) [ 159.130385][ T4227] usb 4-1: No valid video chain found. [ 159.200316][ T4231] usb 2-1: media controller created [ 159.200551][ T4227] usb 4-1: selecting invalid altsetting 0 [ 159.205695][ T4229] elan 0003:04F3:0755.0005: unknown main item tag 0x0 [ 159.220097][ T4231] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 159.228993][ T4229] elan 0003:04F3:0755.0005: unknown main item tag 0x0 [ 159.238402][ T4229] elan 0003:04F3:0755.0005: unknown main item tag 0x0 [ 159.247290][ T4229] elan 0003:04F3:0755.0005: unknown main item tag 0x0 [ 159.255616][ T4231] dvb-usb: bulk message failed: -22 (6/0) [ 159.261799][ T4231] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 159.269372][ T4229] elan 0003:04F3:0755.0005: failed to start in urb: -90 [ 159.285342][ T4229] elan 0003:04F3:0755.0005: hidraw0: USB HID v1.01 Device [HID 04f3:0755] on usb-dummy_hcd.2-1/input0 [ 159.316373][ T4231] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input12 [ 159.348302][ T4231] dvb-usb: schedule remote query interval to 150 msecs. [ 159.355685][ T4231] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 159.386281][ T4227] usb 4-1: selecting invalid altsetting 0 [ 159.400099][ T4231] usb 2-1: USB disconnect, device number 14 [ 159.400247][ T4227] usbtest: probe of 4-1:220.1 failed with error -22 [ 159.486316][ T4227] usb 4-1: USB disconnect, device number 13 [ 159.487004][ T4231] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 159.934170][ T5951] netlink: 72 bytes leftover after parsing attributes in process `syz.3.406'. [ 160.615557][ T4227] usb 3-1: USB disconnect, device number 12 [ 161.033040][ T5962] loop2: detected capacity change from 0 to 16 [ 161.070559][ T5962] erofs: (device loop2): mounted with root inode @ nid 36. [ 161.425129][ T4536] usb 3-1: new low-speed USB device number 13 using dummy_hcd [ 161.662825][ T5969] loop5: detected capacity change from 0 to 16 [ 161.675265][ T4232] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 162.273877][ T5969] erofs: (device loop5): mounted with root inode @ nid 36. [ 162.395358][ T4536] usb 3-1: config index 0 descriptor too short (expected 1307, got 27) [ 162.485259][ T4536] usb 3-1: config 0 has an invalid interface number: 0 but max is -1 [ 162.548233][ T4536] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 162.608232][ T4536] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 246, using maximum allowed: 30 [ 162.774020][ T4536] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 is Bulk; changing to Interrupt [ 162.784177][ T4536] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 162.794417][ T4536] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 246 [ 162.983479][ T4232] usb 4-1: config 0 has an invalid interface number: 117 but max is 0 [ 162.992501][ T4232] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 163.003454][ T4232] usb 4-1: config 0 has no interface number 0 [ 163.009850][ T4232] usb 4-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 163.020210][ T4232] usb 4-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 163.045427][ T4536] usb 3-1: string descriptor 0 read error: -22 [ 163.052247][ T5984] netlink: 8 bytes leftover after parsing attributes in process `syz.1.419'. [ 163.123012][ T5986] netlink: 64 bytes leftover after parsing attributes in process `syz.5.418'. [ 163.697958][ T4536] usb 3-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 163.707155][ T4536] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 163.755309][ T4232] usb 4-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 163.759206][ T4536] usb 3-1: config 0 descriptor?? [ 163.769790][ T4232] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 163.788648][ T4232] usb 4-1: Product: syz [ 163.795361][ T4232] usb 4-1: Manufacturer: syz [ 163.803327][ T5990] loop4: detected capacity change from 0 to 16 [ 163.822260][ T4232] usb 4-1: SerialNumber: syz [ 163.833713][ T4232] usb 4-1: config 0 descriptor?? [ 163.835835][ T4536] hub 3-1:0.0: bad descriptor, ignoring hub [ 163.850236][ T4536] hub: probe of 3-1:0.0 failed with error -5 [ 163.869629][ T5990] erofs: (device loop4): mounted with root inode @ nid 36. [ 163.901564][ T4536] input: USB Acecad 302 Tablet 0460:0008 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input14 [ 163.982019][ T5997] netlink: 8 bytes leftover after parsing attributes in process `syz.4.424'. [ 164.000017][ T5997] C: renamed from team_slave_0 [ 164.023613][ T5997] netlink: 'syz.4.424': attribute type 1 has an invalid length. [ 164.037169][ T5997] netlink: 152 bytes leftover after parsing attributes in process `syz.4.424'. [ 164.048211][ T5997] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 164.132921][ T6001] udc-core: couldn't find an available UDC or it's busy [ 164.145224][ T6001] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 164.165430][ T5019] usb 6-1: new low-speed USB device number 6 using dummy_hcd [ 164.232818][ T6004] loop4: detected capacity change from 0 to 16 [ 165.675254][ T4232] usbtouchscreen: probe of 4-1:0.117 failed with error -71 [ 165.681590][ T6004] erofs: (device loop4): mounted with root inode @ nid 36. [ 165.690659][ T4232] usb 4-1: USB disconnect, device number 14 [ 165.787702][ T4231] usb 3-1: USB disconnect, device number 13 [ 165.857918][ T6016] IPVS: sync thread started: state = BACKUP, mcast_ifn = lo, syncid = 3, id = 0 [ 166.135319][ T5019] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 166.212215][ T6026] netlink: 64 bytes leftover after parsing attributes in process `syz.2.431'. [ 166.755261][ T5019] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 166.775614][ T5019] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 166.840874][ T5019] usb 6-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 166.850299][ T5019] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 166.933044][ T6033] netlink: 8 bytes leftover after parsing attributes in process `syz.2.433'. [ 166.945330][ T5019] usb 6-1: can't set config #1, error -71 [ 166.968927][ T5019] usb 6-1: USB disconnect, device number 6 [ 167.017646][ T6035] loop5: detected capacity change from 0 to 16 [ 167.065760][ T6035] erofs: (device loop5): mounted with root inode @ nid 36. [ 167.365634][ T13] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 167.666425][ T5019] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 167.815195][ T13] usb 3-1: config 0 has an invalid interface number: 64 but max is 0 [ 167.935209][ T5019] usb 6-1: Using ep0 maxpacket: 16 [ 168.055810][ T5019] usb 6-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 168.085393][ T5019] usb 6-1: config 0 interface 0 has no altsetting 0 [ 168.111505][ T5019] usb 6-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 168.146443][ T5019] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 168.222083][ T5019] usb 6-1: config 0 descriptor?? [ 168.507786][ T4267] io_ti 5-1:8.234: Failed to load image "edgeport/down3.bin" err -110 [ 168.552092][ T13] usb 3-1: config 0 has an invalid descriptor of length 48, skipping remainder of the config [ 168.562942][ T4267] io_ti: probe of 5-1:8.234 failed with error -110 [ 168.572933][ T13] usb 3-1: config 0 has no interface number 0 [ 168.579283][ T4267] usb 5-1: USB disconnect, device number 7 [ 168.671903][ T6050] loop3: detected capacity change from 0 to 16 [ 168.750473][ T5019] hid-generic 0003:1E71:2009.0006: unknown main item tag 0x0 [ 168.795230][ T13] usb 3-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice=39.48 [ 169.365128][ T4267] usb 5-1: new full-speed USB device number 8 using dummy_hcd [ 170.082368][ T13] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 170.090644][ T13] usb 3-1: Product: syz [ 170.101531][ T13] usb 3-1: Manufacturer: syz [ 170.106452][ T13] usb 3-1: SerialNumber: syz [ 170.114588][ T6050] erofs: (device loop3): mounted with root inode @ nid 36. [ 170.132368][ T13] usb 3-1: config 0 descriptor?? [ 170.144725][ T5019] hid-generic 0003:1E71:2009.0006: unknown main item tag 0x0 [ 170.156117][ T13] usb 3-1: can't set config #0, error -71 [ 170.163736][ T13] usb 3-1: USB disconnect, device number 14 [ 170.236681][ T6055] netlink: 12 bytes leftover after parsing attributes in process `syz.1.441'. [ 171.784007][ T5019] hid-generic 0003:1E71:2009.0006: unknown main item tag 0x0 [ 172.109751][ T5019] hid-generic 0003:1E71:2009.0006: unknown main item tag 0x0 [ 172.117313][ T5019] hid-generic 0003:1E71:2009.0006: unknown main item tag 0x0 [ 172.128993][ T5019] hid-generic 0003:1E71:2009.0006: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.5-1/input0 [ 172.155651][ T5019] usb 6-1: USB disconnect, device number 7 [ 172.205288][ T4267] usb 5-1: device descriptor read/all, error -71 [ 172.263951][ T6060] fido_id[6060]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 172.287073][ T6062] netlink: 8 bytes leftover after parsing attributes in process `syz.2.445'. [ 172.938477][ T6077] netlink: 64 bytes leftover after parsing attributes in process `syz.5.444'. [ 173.173508][ T6086] netlink: 16186 bytes leftover after parsing attributes in process `syz.5.452'. [ 173.505164][ T13] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 175.050653][ T6097] loop3: detected capacity change from 0 to 16 [ 175.102527][ T6097] erofs: (device loop3): mounted with root inode @ nid 36. [ 175.311992][ T13] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 175.428756][ T13] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 175.590965][ T13] usb 6-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 175.733785][ T13] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 175.812488][ T4227] Bluetooth: hci4: command 0x0406 tx timeout [ 175.828281][ T13] usb 6-1: config 0 descriptor?? [ 176.505107][ T4227] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 177.008105][ T6086] netlink: 'syz.5.452': attribute type 30 has an invalid length. [ 177.030946][ T4227] usb 4-1: Using ep0 maxpacket: 8 [ 177.055042][ T13] hid-led 0003:27B8:01ED.0007: hidraw0: USB HID v0.00 Device [HID 27b8:01ed] on usb-dummy_hcd.5-1/input0 [ 177.316286][ T13] hid-led 0003:27B8:01ED.0007: ThingM blink(1) initialized [ 177.412698][ T13] usb 6-1: USB disconnect, device number 8 [ 177.633826][ T6126] fido_id[6126]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 177.705518][ T4227] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 177.865207][ T4231] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 177.939291][ T4227] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 177.952337][ T4227] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 177.962509][ T4227] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 178.032142][ T4227] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 178.052665][ T4227] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 178.086457][ T6133] IPv6: ADDRCONF(NETDEV_CHANGE): bpq0: link becomes ready [ 178.205175][ T4231] usb 2-1: Using ep0 maxpacket: 8 [ 178.335174][ T4227] usb 4-1: usb_control_msg returned -71 [ 178.335249][ T4231] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 178.341330][ T4227] usbtmc 4-1:16.0: can't read capabilities [ 178.353948][ T4231] usb 2-1: config 0 has no interface number 0 [ 178.362026][ T4231] usb 2-1: config 0 interface 1 has no altsetting 0 [ 178.375300][ T4227] usb 4-1: USB disconnect, device number 15 [ 178.425352][ T4267] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 178.555264][ T4231] usb 2-1: New USB device found, idVendor=10c4, idProduct=eac1, bcdDevice=70.2f [ 178.564330][ T4231] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 178.572816][ T4231] usb 2-1: Product: syz [ 178.577042][ T4231] usb 2-1: Manufacturer: syz [ 178.581631][ T4231] usb 2-1: SerialNumber: syz [ 178.588498][ T4231] usb 2-1: config 0 descriptor?? [ 178.815299][ T4267] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 178.827740][ T4267] usb 3-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 178.895410][ T4231] i2c-cp2615: probe of 2-1:0.1 failed with error -22 [ 179.072890][ T4267] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 179.091568][ T4267] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 179.131466][ T4267] usb 3-1: Product: syz [ 179.136786][ T4267] usb 3-1: Manufacturer: syz [ 179.144236][ T26] kauditd_printk_skb: 4 callbacks suppressed [ 179.144247][ T26] audit: type=1326 audit(1776828718.076:69): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6146 comm="syz.5.469" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74be7e5819 code=0x7ffc0000 [ 179.145498][ T4232] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 179.182299][ T4267] usb 3-1: SerialNumber: syz [ 179.189351][ T26] audit: type=1326 audit(1776828718.116:70): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6146 comm="syz.5.469" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74be7e5819 code=0x7ffc0000 [ 179.232136][ T4231] usb 2-1: USB disconnect, device number 15 [ 179.265844][ T26] audit: type=1326 audit(1776828718.126:71): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6146 comm="syz.5.469" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f74be7e5819 code=0x7ffc0000 [ 179.291800][ T4267] cdc_mbim 3-1:1.0: skipping garbage [ 179.455125][ T4232] usb 5-1: Using ep0 maxpacket: 8 [ 179.478330][ T26] audit: type=1326 audit(1776828718.126:72): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6146 comm="syz.5.469" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74be7e5819 code=0x7ffc0000 [ 179.506368][ T6140] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 179.575564][ T4232] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 179.597259][ T4232] usb 5-1: config 179 has no interface number 0 [ 179.597400][ T26] audit: type=1326 audit(1776828718.126:73): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6146 comm="syz.5.469" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74be7e5819 code=0x7ffc0000 [ 179.603564][ T4232] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 179.603595][ T4232] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 179.658976][ T26] audit: type=1326 audit(1776828718.126:74): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6146 comm="syz.5.469" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f74be7e5819 code=0x7ffc0000 [ 179.682686][ T4232] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 179.697304][ T4232] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid wMaxPacketSize 0 [ 179.715306][ T26] audit: type=1326 audit(1776828718.126:75): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6146 comm="syz.5.469" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74be7e5819 code=0x7ffc0000 [ 179.742451][ T4232] usb 5-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 179.769422][ T4232] usb 5-1: config 179 interface 65 has no altsetting 0 [ 179.822494][ T4232] usb 5-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 179.849900][ T4232] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 179.877170][ T6153] device syzkaller0 entered promiscuous mode [ 179.883763][ T26] audit: type=1326 audit(1776828718.126:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6146 comm="syz.5.469" exe="/root/syz-executor" sig=0 arch=c000003e syscall=259 compat=0 ip=0x7f74be7e5819 code=0x7ffc0000 [ 179.920743][ T6153] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 179.927692][ T4232] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:179.65/input/input15 [ 179.932935][ T26] audit: type=1326 audit(1776828718.126:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6146 comm="syz.5.469" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74be7e5819 code=0x7ffc0000 [ 180.035103][ T26] audit: type=1326 audit(1776828718.126:78): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6146 comm="syz.5.469" exe="/root/syz-executor" sig=0 arch=c000003e syscall=425 compat=0 ip=0x7f74be7e5819 code=0x7ffc0000 [ 180.225536][ T6140] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 180.255301][ T4267] cdc_mbim 3-1:1.0: dwNtbInMaxSize=0 is too small. Using 2048 [ 180.281939][ T4267] cdc_mbim 3-1:1.0: setting rx_max = 2048 [ 180.360296][ T4231] usb 5-1: USB disconnect, device number 10 [ 180.378036][ T4231] xpad 5-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 180.381485][ T6160] netlink: 8 bytes leftover after parsing attributes in process `syz.3.472'. [ 180.489951][ T4267] cdc_mbim 3-1:1.0: setting tx_max = 184 [ 180.506283][ T4267] cdc_mbim 3-1:1.0: cdc-wdm0: USB WDM device [ 180.548126][ T6159] ================================================================== [ 180.556505][ T6159] BUG: KASAN: use-after-free in ax25_release+0x5ca/0x870 [ 180.563557][ T6159] Read of size 8 at addr ffff888142b8ab08 by task syz.3.472/6159 [ 180.571262][ T6159] [ 180.573651][ T6159] CPU: 1 PID: 6159 Comm: syz.3.472 Not tainted syzkaller #0 [ 180.580929][ T6159] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 180.590983][ T6159] Call Trace: [ 180.594275][ T6159] [ 180.597192][ T6159] dump_stack_lvl+0x188/0x250 [ 180.601854][ T6159] ? show_regs_print_info+0x20/0x20 [ 180.607037][ T6159] ? _printk+0xda/0x130 [ 180.611198][ T6159] ? ax25_release+0x5ca/0x870 [ 180.615904][ T6159] ? load_image+0x400/0x400 [ 180.620388][ T6159] ? __timer_delete_sync+0x1f5/0x290 [ 180.625654][ T6159] print_address_description+0x60/0x2d0 [ 180.631193][ T6159] ? ax25_release+0x5ca/0x870 [ 180.635846][ T6159] kasan_report+0xdf/0x130 [ 180.640245][ T6159] ? ax25_release+0x5ca/0x870 [ 180.644905][ T6159] ax25_release+0x5ca/0x870 [ 180.649391][ T6159] sock_close+0xd5/0x240 [ 180.653614][ T6159] ? sock_mmap+0x90/0x90 [ 180.657861][ T6159] __fput+0x234/0x930 [ 180.661832][ T6159] task_work_run+0x125/0x1a0 [ 180.666414][ T6159] exit_to_user_mode_loop+0x10f/0x130 [ 180.671788][ T6159] exit_to_user_mode_prepare+0xee/0x180 [ 180.677511][ T6159] syscall_exit_to_user_mode+0x16/0x40 [ 180.682957][ T6159] do_syscall_64+0x58/0xa0 [ 180.687354][ T6159] ? clear_bhb_loop+0x30/0x80 [ 180.692006][ T6159] ? clear_bhb_loop+0x30/0x80 [ 180.696668][ T6159] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 180.702560][ T6159] RIP: 0033:0x7fcbfd39c819 [ 180.706961][ T6159] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 180.726566][ T6159] RSP: 002b:00007ffe68ed4838 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 180.734973][ T6159] RAX: 0000000000000000 RBX: 00007ffe68ed4920 RCX: 00007fcbfd39c819 [ 180.742927][ T6159] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 180.750878][ T6159] RBP: 000000000002c07f R08: 0000000000000001 R09: 0000000000000000 [ 180.758835][ T6159] R10: 0000001b31720000 R11: 0000000000000246 R12: 00007ffe68ed4960 [ 180.766798][ T6159] R13: 00007fcbfd615fac R14: 000000000002c13e R15: 00007fcbfd615fa0 [ 180.774776][ T6159] [ 180.777795][ T6159] [ 180.780101][ T6159] Allocated by task 6133: [ 180.784490][ T6159] __kasan_kmalloc+0xb5/0xf0 [ 180.789061][ T6159] ax25_dev_device_up+0x50/0x580 [ 180.793991][ T6159] ax25_device_event+0x483/0x4f0 [ 180.798965][ T6159] raw_notifier_call_chain+0xcb/0x160 [ 180.804346][ T6159] __dev_notify_flags+0x194/0x300 [ 180.809355][ T6159] dev_change_flags+0xe3/0x1a0 [ 180.814102][ T6159] dev_ifsioc+0x130/0xd50 [ 180.818408][ T6159] dev_ioctl+0x545/0xe30 [ 180.822630][ T6159] sock_do_ioctl+0x245/0x320 [ 180.827196][ T6159] sock_ioctl+0x4d2/0x710 [ 180.831502][ T6159] __se_sys_ioctl+0xfa/0x170 [ 180.836072][ T6159] do_syscall_64+0x4c/0xa0 [ 180.840465][ T6159] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 180.846336][ T6159] [ 180.848636][ T6159] Freed by task 6160: [ 180.852590][ T6159] kasan_set_track+0x4b/0x70 [ 180.857162][ T6159] kasan_set_free_info+0x1f/0x40 [ 180.862076][ T6159] ____kasan_slab_free+0xd5/0x110 [ 180.867077][ T6159] slab_free_freelist_hook+0xea/0x170 [ 180.872426][ T6159] kfree+0xef/0x2a0 [ 180.876246][ T6159] ax25_device_event+0x4b4/0x4f0 [ 180.881199][ T6159] raw_notifier_call_chain+0xcb/0x160 [ 180.886551][ T6159] __dev_notify_flags+0x158/0x300 [ 180.891553][ T6159] dev_change_flags+0xe3/0x1a0 [ 180.896295][ T6159] dev_ifsioc+0x130/0xd50 [ 180.900600][ T6159] dev_ioctl+0x545/0xe30 [ 180.904816][ T6159] sock_do_ioctl+0x245/0x320 [ 180.909381][ T6159] sock_ioctl+0x4d2/0x710 [ 180.913683][ T6159] __se_sys_ioctl+0xfa/0x170 [ 180.918336][ T6159] do_syscall_64+0x4c/0xa0 [ 180.922730][ T6159] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 180.928624][ T6159] [ 180.930940][ T6159] Last potentially related work creation: [ 180.936639][ T6159] kasan_save_stack+0x35/0x60 [ 180.941304][ T6159] kasan_record_aux_stack+0xb8/0x100 [ 180.946574][ T6159] insert_work+0x54/0x3d0 [ 180.950894][ T6159] __queue_work+0x9c5/0xd50 [ 180.955376][ T6159] queue_work_on+0x124/0x1f0 [ 180.959946][ T6159] inetaddr_event+0xec/0x150 [ 180.964515][ T6159] blocking_notifier_call_chain+0x103/0x1b0 [ 180.970395][ T6159] __inet_insert_ifa+0x9f7/0xbe0 [ 180.975339][ T6159] inet_rtm_newaddr+0x99a/0x1890 [ 180.980262][ T6159] rtnetlink_rcv_msg+0x844/0xf30 [ 180.985180][ T6159] netlink_rcv_skb+0x1f5/0x440 [ 180.989918][ T6159] netlink_unicast+0x774/0x920 [ 180.994665][ T6159] netlink_sendmsg+0x8ba/0xbe0 [ 180.999401][ T6159] __sys_sendto+0x46d/0x620 [ 181.003884][ T6159] __x64_sys_sendto+0xda/0xf0 [ 181.008535][ T6159] do_syscall_64+0x4c/0xa0 [ 181.013109][ T6159] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 181.019000][ T6159] [ 181.021336][ T6159] The buggy address belongs to the object at ffff888142b8ab00 [ 181.021336][ T6159] which belongs to the cache kmalloc-192 of size 192 [ 181.035368][ T6159] The buggy address is located 8 bytes inside of [ 181.035368][ T6159] 192-byte region [ffff888142b8ab00, ffff888142b8abc0) [ 181.048709][ T6159] The buggy address belongs to the page: [ 181.054322][ T6159] page:ffffea00050ae280 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x142b8a [ 181.064540][ T6159] flags: 0x57ff00000000200(slab|node=1|zone=2|lastcpupid=0x7ff) [ 181.072179][ T6159] raw: 057ff00000000200 ffffea00008c4500 0000000b0000000b ffff888016c41a00 [ 181.080756][ T6159] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 181.089414][ T6159] page dumped because: kasan: bad access detected [ 181.095808][ T6159] page_owner tracks the page as allocated [ 181.101498][ T6159] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, ts 2355294111, free_ts 0 [ 181.116324][ T6159] get_page_from_freelist+0x1bbd/0x1ca0 [ 181.121867][ T6159] __alloc_pages+0x1ee/0x480 [ 181.126440][ T6159] alloc_page_interleave+0x24/0x1e0 [ 181.131631][ T6159] new_slab+0xc0/0x4b0 [ 181.135679][ T6159] ___slab_alloc+0x80a/0xdd0 [ 181.140248][ T6159] kmem_cache_alloc_trace+0x1a5/0x2a0 [ 181.145594][ T6159] call_usermodehelper_setup+0x8a/0x260 [ 181.151119][ T6159] kobject_uevent_env+0x65e/0x890 [ 181.156138][ T6159] driver_register+0x3e2/0x430 [ 181.160894][ T6159] do_one_initcall+0x272/0x730 [ 181.165635][ T6159] do_initcall_level+0x137/0x1f0 [ 181.170551][ T6159] do_initcalls+0x4b/0x90 [ 181.174857][ T6159] kernel_init_freeable+0x3e9/0x570 [ 181.180032][ T6159] kernel_init+0x19/0x1b0 [ 181.184350][ T6159] ret_from_fork+0x1f/0x30 [ 181.188768][ T6159] page_owner free stack trace missing [ 181.194111][ T6159] [ 181.196433][ T6159] Memory state around the buggy address: [ 181.202045][ T6159] ffff888142b8aa00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 181.210082][ T6159] ffff888142b8aa80: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 181.218118][ T6159] >ffff888142b8ab00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 181.226157][ T6159] ^ [ 181.230455][ T6159] ffff888142b8ab80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 181.238490][ T6159] ffff888142b8ac00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 181.246521][ T6159] ================================================================== [ 181.254637][ T6159] Disabling lock debugging due to kernel taint [ 181.291739][ T4267] cdc_mbim 3-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.2-1, CDC MBIM, 72:e5:29:d2:49:40 [ 181.296332][ T6159] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 181.309384][ T6159] CPU: 1 PID: 6159 Comm: syz.3.472 Tainted: G B syzkaller #0 [ 181.318041][ T6159] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 181.328075][ T6159] Call Trace: [ 181.331352][ T6159] [ 181.334259][ T6159] dump_stack_lvl+0x188/0x250 [ 181.338922][ T6159] ? show_regs_print_info+0x20/0x20 [ 181.344094][ T6159] ? load_image+0x400/0x400 [ 181.348578][ T6159] panic+0x2e5/0x810 [ 181.352456][ T6159] ? bpf_jit_dump+0xd0/0xd0 [ 181.356936][ T6159] ? _raw_spin_unlock_irqrestore+0x10d/0x120 [ 181.362897][ T6159] ? _raw_spin_unlock+0x40/0x40 [ 181.367720][ T6159] ? print_memory_metadata+0x314/0x400 [ 181.373163][ T6159] ? ax25_release+0x5ca/0x870 [ 181.377829][ T6159] check_panic_on_warn+0x80/0xa0 [ 181.382743][ T6159] ? ax25_release+0x5ca/0x870 [ 181.387398][ T6159] end_report+0x6d/0xf0 [ 181.391530][ T6159] kasan_report+0x102/0x130 [ 181.396025][ T6159] ? ax25_release+0x5ca/0x870 [ 181.400683][ T6159] ax25_release+0x5ca/0x870 [ 181.405179][ T6159] sock_close+0xd5/0x240 [ 181.409402][ T6159] ? sock_mmap+0x90/0x90 [ 181.413616][ T6159] __fput+0x234/0x930 [ 181.417575][ T6159] task_work_run+0x125/0x1a0 [ 181.422141][ T6159] exit_to_user_mode_loop+0x10f/0x130 [ 181.427501][ T6159] exit_to_user_mode_prepare+0xee/0x180 [ 181.433021][ T6159] syscall_exit_to_user_mode+0x16/0x40 [ 181.438476][ T6159] do_syscall_64+0x58/0xa0 [ 181.442869][ T6159] ? clear_bhb_loop+0x30/0x80 [ 181.447519][ T6159] ? clear_bhb_loop+0x30/0x80 [ 181.452172][ T6159] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 181.458135][ T6159] RIP: 0033:0x7fcbfd39c819 [ 181.462527][ T6159] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 181.482112][ T6159] RSP: 002b:00007ffe68ed4838 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 181.490500][ T6159] RAX: 0000000000000000 RBX: 00007ffe68ed4920 RCX: 00007fcbfd39c819 [ 181.498449][ T6159] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 181.506486][ T6159] RBP: 000000000002c07f R08: 0000000000000001 R09: 0000000000000000 [ 181.514434][ T6159] R10: 0000001b31720000 R11: 0000000000000246 R12: 00007ffe68ed4960 [ 181.522383][ T6159] R13: 00007fcbfd615fac R14: 000000000002c13e R15: 00007fcbfd615fa0 [ 181.530337][ T6159] [ 181.533622][ T6159] Kernel Offset: disabled [ 181.537933][ T6159] Rebooting in 86400 seconds..