last executing test programs: 10m43.995472964s ago: executing program 1 (id=2): syz_mount_image$vfat(&(0x7f0000000300), &(0x7f00000005c0)='./file0\x00', 0x0, &(0x7f0000000540)=ANY=[], 0x4, 0x1296, &(0x7f0000001b80)="$eJzs3c9rY0UcAPBv2nQ37bpN1XV1F8RBL4qQ3fbgyUuRXRArSrULKghvbaoh6Q+aUEgRt548Cf4Zoh69CeI/0IsXz4Ig0ovHPYhP2qRr0/SX/Qny+VwyzMx35jud18ALb3gbr341X59rVuayVgwUClFcGoriwxQpBmIwOtbipXu//PrsO++9/8bk1NSd6ZTuTr47/kpKafS5Hz/49Lvnf2pduff96A+XY31sYOPPid/Wr6/f2Pj726g1U62ZFhZbKUv3Fxdb2f1GNc3WmvVKSm83qlmzmmoLzepyT/tcY3FpqZ2yhdmrI0vL1WYzZQvtVK+2U6uQWsvtlH2c1RZSpVJJV0eCk5j55mGe5xF5PhSXIs/zfDhG4ko8FldjNMoxFo/HE/FkXIun4no8Hc/Eja1eF503AAAAAAAAAAAAAAAAAAAA/L8ccv6/4Pw/AAAAAAAAAAAAAAAAAAAAnL3d5/+LEd7/DwAAAAAAAAAAAAAAAAAAAOfskPf/7zr//7Lz/wAAAAAAAAAAAAAAAAAAAHAWSp2P6ZRKEfNfrMyszHQ+O/WTc1GLRlTjdpTjr9g6/d/RKd99ferO7bRlLG7NP+jGP1iZGeyNHx8qx1hhz/jx4YhIKfXGX46RnfETUY5re88/0Zl/V3wpXnxhM/7zTnwlyvHzR7EYjZiNKHRXvxX/2XhKr701Ndwbf3Oz374Gz3hbAAAA4DRV0iP99+9r3U6d9lJve6epe3+euj0LB/w+sOv+vBg3ixe1arY126v1rNGoLh+zcGn/cS6dbOS+QiEisthZMzry+/Tm5EccZ/tyO6V8dhQGjxF1/DSGDu5zgj2N4pH/mKv10lFSPfrudJNf212TlyN21Nz68M36oeP88fWOmlKc9nbvVRh4tNKB7mWWNdaOfLHFWp6faYZ9/4zD7dX65YOi9v/OKJzxdxLn599Nv+hMAAAAAAAAAAAA+C/2fPpvOCL6ngf8pK9m+/Hw3vD+kfef/ctzWCEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/sAPHAgAAAADC/K3T6NgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4KgAA//+hs8cA") r0 = openat(0xffffffffffffff9c, &(0x7f0000004280)='.\x00', 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x541b, 0x0) 10m41.104279005s ago: executing program 1 (id=16): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=@newlink={0x58, 0x10, 0x403, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @ip6erspan={{0x14}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x14, 0x7, @mcast1}, @IFLA_GRE_COLLECT_METADATA={0x4}]}}}, @IFLA_MASTER={0x8}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000800}, 0x8000) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newqdisc={0x50, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x4}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}, @TCA_RATE={0x6, 0x5, {0x4, 0xad}}]}, 0x50}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='ramfs\x00', 0x10, 0x0) syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f00000001c0)='./file2\x00', 0x404, &(0x7f000001bd80), 0x4, 0x441, &(0x7f0000000280)="$eJzs28tvG8UfAPDv2kn66zP5VeXRBxAoiIpH0qSl9MAFBBIHkJDgUI4hSatQt0FNkGgVQUCoHFEl7ogjEv8AnOCCgBMSV7ijShXKpYWT0dq7ie3aaZI62RR/PtK2M7tjzXw9O/bMThxAzxpO/0ki9kTE7xExWM82Fxiu/3draWHy76WFySSq1Tf/Smrlbi4tTOZF89ftzjN9EaVPkzjcpt65y1fOT1Qq05ey/Oj8hfdG5y5feXbmwsS56XPTF8dPnz55Yuz5U+PPdSXONK6bhz6cPXLw1bevvT555to7P3+T5PG3xNElw6tdfKJa7XJ1xdrbkE76CmwI61KuD9Por43/wSjHSucNxiufFNo4YFNVq9Xq/Z0vL1aB/7Akim4BUIz8iz5d/+bHFk09toUbL9YXQGnct7KjfqUvSlmZ/pb1bTcNR8SZxX++TI/YnOcQAABNvk/nP8+0m/+VovG50L5sD2UoIv4fEfsj4lREHIiI+yJqZR+IiAfXWX/rJsnt85/S9Q0Ftkbp/O+FbG+ref6Xz/5iqJzl9tbi70/OzlSmj2fvybHo35Hmx1ap44eXf/u807XG+V96pPXnc8GsHdf7djS/ZmpifuJuYm504+OIQ33t4k+WdwKSiDgYEYc2WMfMU18f6XTtzvGvogv7TNWvIp6s9/9itMSfS1bfnxz9X1Smj4/md8Xtfvn16hud6r+r+Lsg7f9dbe//5fiHksb92rn113H1j8/ar2n2bfz+H0jeajr3wcT8/KWxiIHktXqjG8+Pt5QbXymfxn/saPvxvz9W3onDEZHexA9FxMMR8UjWd49GxGMRcXSV+H966fF3O13bDv0/ta7+X0kMROuZ9ony+R+/a6p0aD3xp/1/spY6lp1Zy+ffWtq1sbsZAAAA7j2liNgTSWlkOV0qjYzU/4b/QOwqVWbn5p8+O/v+xan6bwSGor+UP+kabHgeOpYt6/P8eEv+RPbc+Ivyzlp+ZHK2MlV08NDjdncY/6k/y0W3Dth0fq8Fvcv4h95l/EPvMv6hd7UZ/zuLaAew9dp9/39UQDuArdcy/m37QQ+x/ofe1Tj+kwLbAWw93//Qk+Z2xp1/JN8DiYHt0Yx7KBGltRf+Nrvbim6zxNoTBX8wAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdMm/AQAA//8iOuPQ") r4 = creat(&(0x7f0000000000)='./file1\x00', 0x4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r6, 0x6, 0x23, &(0x7f0000000040), &(0x7f0000000140)=0xfffffce1) pwritev2(r5, &(0x7f0000000100)=[{&(0x7f0000000080)="ff", 0xabfb}], 0x1, 0x5412, 0x0, 0x0) fcntl$setstatus(r4, 0x4, 0x6000) io_setup(0x202, &(0x7f0000000200)=0x0) io_submit(r7, 0x1, &(0x7f0000000240)=[&(0x7f00000000c0)={0x25, 0x0, 0x0, 0x8, 0x20, r4, 0x0, 0x0, 0x2000}]) syz_mount_image$fuse(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x400a8, &(0x7f0000000380)=ANY=[], 0x5, 0x0, 0x0) accept4$nfc_llcp(r5, &(0x7f0000000800), &(0x7f0000000880)=0x60, 0x0) io_pgetevents(r7, 0x5, 0x2, &(0x7f0000000700)=[{}, {}], &(0x7f0000000740)={0x0, 0x3938700}, &(0x7f00000007c0)={&(0x7f0000000780)={[0x5]}, 0x8}) symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') mount$fuse(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x104000, 0x0) mount$bind(&(0x7f0000000480)='./file0/file0\x00', &(0x7f0000000340)='./file0/file0/../file0\x00', 0x0, 0x1a1c08, 0x0) mount$fuse(0x0, &(0x7f00000005c0)='./file0/file0\x00', 0x0, 0x88000, 0x0) mount$bind(&(0x7f0000000100)='./file0\x00', &(0x7f0000000180)='./file0/file0/../file0\x00', 0x0, 0x2125099, 0x0) mount$bind(&(0x7f0000000300)='.\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x185093, 0x0) syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000280)='./file0\x00', 0x2800000, &(0x7f00000002c0)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@test_dummy_encryption_v1}, {@noload}, {@test_dummy_encryption_v1}, {@nodiscard}, {@data_err_ignore}, {@usrquota}, {@journal_ioprio}, {@resuid}]}, 0x1, 0xbc1, &(0x7f00000043c0)="$eJzs3M9rXNUeAPDvvfnZNu9N+ng8Xt+meTweLTzeNO0j5bUItlJx40LQrdCQTkrI9AdJpCbNYqL/gKhrwY2gFqULu+5Gwa0brVuLC6FIbBRENHLnR5omM0nazuTG5POBM/ecOXfu+X7nMnPPgZkbwJ41lD2kEYci4nwSUag/n0ZEb7XWH1Gp7be0OD/20+L8WBLLyy9+n0QSEfcX58cax0rq2wP1Rn9EfPFMEn95ff2407Nzk6Plcmmq3j42c+nqsenZuf9OXBq9WLpYunz85P9HToycHD410rZcf/7mzK0f//nct5VfPvj1xg9vvZfEmRio963Oo571ExuKoZX3ZLXuiBhtw/F3gq56PqvzTLo3eVHa4aAAAGgpXTWH+1sUoiseTN4K8emXuQYHAAAAtMVyV8QyAAAAsMsl1v8AAACwyzV+B3B/cX6sUfL9RcL2unc2IgZr+S/VS62nOyrVbX/0RMT++0ms/ltrUnvZExuKiLtfn/o4K9Hkf8idVlmIiL83O/9JNf/B+j+h1+afRsRwG8YfWtP+I+V/pg3j550/AHvT7bO1C9n661+6Mv+JJte/7ibXrsex0fVv0/uItEFj/re0bv73IP+uFvO/F7Y4xvX337nWqi/L/6lbz37UKNn42faJknoE9xYi/tHdLP9kJf+kRf7ntzhG4bdrpVZ9eee//G7EkWief0Oy8f2Jjo1PlEvDtcemYyx8PvJhq/Hzzj87//tb5L/Z+b/60JFa39Tn5XPnbrbq2zz/9Lve5KVqrbf+zKujMzNTxyN6k+fXP39i43wb+zSOkeV/9F8bf/6b5Z99J1Tq70OW+UJ9m7VfWzPm0zeuf7JR/tnaL8/zf+Exz/8bWxzj35+9ebRV3+r1b1ay8e8mtbUwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADSkETEQSVqMiKRaT9NiMeJARPw19qflK9Mz/xm/8srlC1lfxGD0pOMT5dJwRBRq7SRrH6/WH7RPrGn/LyIORsTbhX3VdnHsSvlC3skDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACw4kBEDESSFiMijYilQpoWi3lHBQAAALTdYN4BAAAAAB1n/Q8AAAC7n/U/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHXbw8O07SURUTu+rlkxvva8n18iATkvzDgDITVfeAQC56d7abv2djgPYfo+4xjddgF0o2aS/9QSgr+2xAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALBzHTl0+04SEZXT+6ol01vv62n6isPbGB3QSWneAQC56dqos3v74gC2n4847F3N1/jAXpJs0t9f3yepROXhnr5OhgUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADADjNQLUlajIi0Wk/TYjHiTxExGD3J+ES5NBwRf46Irwo9fVm7L++gAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaLvp2bnJ0XK5NKWiopJvJdkZYdQqeX8zAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACQh+nZucnRcrk0NZ13JAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEDepmfnJkfL5dLUFio3H2XnVZW8cwQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAID+/BwAA//+99w6C") 10m36.962719681s ago: executing program 1 (id=23): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x1c1a82, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4801}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x301142, 0x0) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @broadcast}) write$cgroup_devices(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="1bd4000c"], 0xffdd) 10m35.65187749s ago: executing program 1 (id=29): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000380)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f00000001c0)={0x48, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_RW$syz(r0, 0x3ba0, &(0x7f00000003c0)={0x48, 0x8, r2, 0x0, 0x0, 0x3a42a, 0x1, &(0x7f0000000500)="18", 0x10000}) 10m34.848376993s ago: executing program 32 (id=29): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000380)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f00000001c0)={0x48, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_RW$syz(r0, 0x3ba0, &(0x7f00000003c0)={0x48, 0x8, r2, 0x0, 0x0, 0x3a42a, 0x1, &(0x7f0000000500)="18", 0x10000}) 9.60608862s ago: executing program 3 (id=3485): r0 = epoll_create1(0x0) r1 = socket$unix(0x1, 0x1, 0x0) close(r1) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001480)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$tun(r3, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r3, 0x0) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xba81d000) recvfrom(r2, &(0x7f0000002800)=""/4071, 0xfffffffffffffdab, 0x17, 0x0, 0x0) writev(r2, &(0x7f0000001400)=[{&(0x7f0000000140)="58dd", 0x2}], 0x1) setsockopt$sock_int(r2, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f00000002c0)) 8.481180922s ago: executing program 0 (id=3489): r0 = syz_usb_connect(0x5, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000a00)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 8.407882839s ago: executing program 4 (id=3490): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000cf8bed20d90f25004029000000010902120001000000000904"], 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000480)={0x2c, &(0x7f0000000280)={0x0, 0x30, 0x1, "da"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, &(0x7f00000005c0)={0x14, 0x0, 0x0}, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 8.367111966s ago: executing program 3 (id=3491): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000a00), r1) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f00000000c0)={0x38, r2, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x4}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x100}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x38}}, 0x4008000) 8.239812536s ago: executing program 3 (id=3492): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000020000000900010073797a300000000040000000030a09020000000000000000020000000900010073797a30000000000900030073797a3200000000140004800800014000000000080002400000000014000000110001"], 0x88}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={{0x14}, [@NFT_MSG_NEWCHAIN={0x28, 0x3, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_USERDATA={0x5, 0x3, 'Y'}]}], {0x14}}, 0x50}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a38000000030a03000000000000000000020000000900010073797a30000000000900030000000000000003000c000240000000000000000114000000110001"], 0x60}}, 0x0) 7.993138249s ago: executing program 3 (id=3494): r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000800)={0x44, &(0x7f00000004c0), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000001c0)={0x1c, &(0x7f0000000940)=ANY=[], 0x0, 0x0}) 6.543625796s ago: executing program 0 (id=3500): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xca02}) preadv(r0, &(0x7f0000000140)=[{&(0x7f0000000080)=""/11, 0xb}], 0x1, 0x1d40, 0x4) 6.475821588s ago: executing program 6 (id=3501): socket$kcm(0x10, 0x2, 0x0) syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) syz_open_dev$loop(&(0x7f0000000100), 0x9, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) pipe(&(0x7f00000001c0)) socket$nl_generic(0x10, 0x3, 0x10) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)) r0 = syz_open_dev$dri(&(0x7f00000003c0), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000300)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@updpolicy={0xb8, 0x15, 0x1, 0x0, 0xfffffffe, {{@in=@multicast1=0xe0000002, @in=@multicast1, 0x4e20, 0x0, 0x0, 0x0, 0xa, 0x10, 0x20}, {0x0, 0x1, 0x100, 0x0, 0x0, 0x9, 0xffffffff}, {0x0, 0x200, 0x4}, 0x2000, 0x6e6bb5, 0x2, 0x0, 0x1}}, 0xb8}}, 0x24000080) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x1, &(0x7f00000000c0)=[r1], &(0x7f0000000000), &(0x7f0000000200), &(0x7f0000000000)=[0x2], 0x0, 0x1}) 6.384494545s ago: executing program 6 (id=3502): r0 = fanotify_init(0xf00, 0x181000) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0xa880, 0x97) fanotify_mark(r0, 0x5, 0x4800003e, r1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000140)='fdinfo/3\x00') read$FUSE(r2, &(0x7f00000040c0)={0x2020}, 0x2020) 6.268900843s ago: executing program 6 (id=3503): r0 = epoll_create1(0x0) r1 = socket$unix(0x1, 0x1, 0x0) close(r1) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001480)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$tun(r3, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r3, 0x0) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xba81d000) recvfrom(r2, 0x0, 0x0, 0x17, 0x0, 0x0) writev(r2, &(0x7f0000001400)=[{&(0x7f0000000140)="58dd", 0x2}], 0x1) setsockopt$sock_int(r2, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f00000002c0)) 6.10721317s ago: executing program 4 (id=3504): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000a00), r1) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f00000000c0)={0x38, r2, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x4}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x100}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x38}}, 0x4008000) 5.9562133s ago: executing program 4 (id=3505): syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x759, &(0x7f00000000c0)={[{@usrquota}, {@nobarrier}], [], 0x2c}, 0x0, 0x4f6, &(0x7f00000002c0)="$eJzs3EtvVFUcAPD/nbaUCtiKTx7KKBobjZSW58IFEE3YmJhoDC5rWwhSwNCaAGmkGAOJCw2fwMfOxE/gSjdGjQuNW4lbY0JMN6ALc82duVOnvZ2+mHYs/f2SGc6999w55z/3HuY8ZhrAulXOnpKIzRHxa0R0VzdnZihX/7kzNTH019TEUBJp+tqfSSXf7amJoVrW2nmb8o3eUkTpgyR2FIvtHLt0+czg6OjIhXxH33gpT50dPDVyauTcwOHD+/d1HTo4cKApcWZ1ur39vfM7tx1/88YrQyduvPX9l1l90/x4fRxVPZXnDYsuoa2wpxzlme9lnWcWX/U1YUtdOmnPnkutqwyLlt212eXqqLT/7mirbFV1x8vvt7RywIpK0zTtLOyd/iybTOslSfWENL2aAveAJFpdA6A1ah/0t6eykerEUHEcfG+7dTQqI6As7jv5o3qkvTKCLfdUx0YdK1T+QxFxYvLvT7JHzDkPAQDQXF8fjbh+rNrvqD2qR0rxSF2++/O1oZ6IeCAitkbEg3n/5eGISt5HI+KxunM2L2IVoDxru9j/+bkrT9R3V5sm6/+9mK9tzez/Tde8py3f2lKJvyM5eXp0ZG/+nvRGR2e23V986elptW9e+uXjRuWX6/p/2SMrv9YXzOvxR/usCbrhwfHBu4275tbVyht7pRh/Eu1JLRWxLSK2L+P1s/fs9HNf7Gx0fEb8WZyF+D9q/OLty6jQLOlnEc9Wr/9kzIo/8vW/pLI+efadvrFLl184Xb8+2X/o4MCBvo0xOrK3r3ZXFP3w07VX82RhGDHP9a81jRVdSMuu/31z3v/TK5c9WWp6vXZs6WVcu3m94Zhmuff/huT1Srq2PntxcHz8Qn/EhmSyuH/gv3MvDnbNyJ/F37t77va/NeKfT/PzdkREdhM/HhFPRMSuvO5PRsRTEbF7nvi/O/b0242GkAvHv7Ky+IeXdP0bJY78GDH3obYz335VKPjDciH+jmh0/fdXUr35nuHB8Y0LxTVfTesTd/0GAgAAwBqwqzJPm5T25BNNm6NU2rMnYtP0DMrY+PMnz797brg6n9sTHaXaTFd33Xxofz43nG1nZw3UbWfH91XmjdM0Tbuy7Wz8PrqltaHDurepQfvP/F78SQtwr1nSOlqjX7QBa9Ls9n9z0Wc2/wsZwOpqwvdogDVK+4f1a9Htf6V+BQe0zFzt/0rEnRZUBVhlc7X/Nwp7jqxKXYDVZfwP69fy278vA8Ba5/Mf1qVF/Uh+GYmtx+fJk7SvTKGNE6WY/68A9ETU9tT6NPO/4G+liObUsK2pkXbNuKalOfNsjGaUFaUF87Qv4Q8xrG6i9P+oRjXRGREL3L3TN9uVWuLySles0gg+b+3/TgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHfv3wAAAP//C4DT6g==") recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x141, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff, 0x6, 0x0, @val=@tracing={0x0, 0x5}}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x2, 0x0, 0x0, 0x3}, [@func={0x85, 0x0, 0x1, 0x0, 0x1}, @exit]}, &(0x7f0000000000)='syzkaller\x00', 0x1, 0x98, &(0x7f00000001c0)=""/152, 0x0, 0xa}, 0x94) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) setsockopt$TIPC_SRC_DROPPABLE(r3, 0x10f, 0x80, &(0x7f0000001640)=0x4f1d, 0x4) sendmmsg$inet(r3, &(0x7f0000001540), 0x0, 0xc0f1) r4 = gettid() syz_usb_connect$midi(0x5, 0x32, &(0x7f00000008c0)=ANY=[@ANYBLOB="1201100100000008920a20104000010203010902200001010000050b03000209047005250101de00"/50], 0x0) socketpair(0x22, 0x80000, 0x0, &(0x7f0000000800)) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x4, @tid=r4}, &(0x7f0000bbdffc)=0x0) timer_settime(r5, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) 5.497411175s ago: executing program 6 (id=3507): write$char_usb(0xffffffffffffffff, &(0x7f0000000080)="d6f5fbcf8c5f6b1eab996ddbb1a3fa9e7faef2c7e9b975084ebb6f5557284549957db0e43ddd82283e9404df9f48beef3bbdd77a64dd1807932d9fc1530c25d99c0108e15f903702feb5de78597f9aa52ffbbaa5b0228712aba726a32334d84e12920ffc0f4553e561dc7b6570bcaca912b5e63022bbf50cdbee9d0cc9586939fe7d49ccbde680e7e0cd18997741457262cdba41de28c9e3a6e1fe79bd5c5c2459f4f619fc95346792b3f20155bbaaa9a07248026b6159c403bea11fa2b5e85ba3e189f96d08063e2d3fc85078655058cd151e6e60ed04bd487becfe0ec08c6af41bd54fe99c4b94c18fa34940161469afcd05e1c1cd5a98ba5f28d768fcec333f2cb041afc799c8eea8f460e58de122899d699da77dcb9655b52b93be558a36c317426b69e9240d73f87776a10bec23122eeb4dee2bb94c9fed02d69693935ca436bdc62cfb19aa3c7d2be9c561eca2", 0x150) r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc71f, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xe8, 0xb, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x7ffd, 0x0, 0x1, {0x22, 0x1e3}}, {{{0x9, 0x5, 0x81, 0x3, 0x38d707d343173689, 0x5, 0xa, 0x70}}}}}]}}]}}, 0x0) syz_usb_control_io$uac3(0xffffffffffffffff, 0x0, &(0x7f0000000440)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f0000000840)={0x44, 0x0, &(0x7f0000000340)={0x0, 0xa, 0x1, 0xc1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) 5.424531745s ago: executing program 0 (id=3508): openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) socket$kcm(0x2, 0xa, 0x2) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x1ae8, 0x0, 0x2, 0x151}, 0x0, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r0) socket$inet_tcp(0x2, 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0x0) syz_fuse_handle_req(0xffffffffffffffff, &(0x7f0000000200)="3c9c20523ded4c0f106ae6b96d6b7c81dd12652802946ac25759763c968d6b9e50a9ffdca850ab65da37d03cd977de1c00849b4b64b7f7d8087576752468d6d010dc4dbf741ef8a0ac3f7f5e5a9ca0d96399660a17960c45137169f24f0bbf258dc68d62291617bf96648992ea261cf1b85662010d9fefdcd72730abce7bd15e6bbbdf23709fc161f43e02c77839c6208e381a4cdead31a44bebe16f240c5658b177618b38905afa550955915a3effef2f37ca73fd99586ab777695fd6f4c223424d7927d0cf9fed3985d7e188fbe0d97f6903dbc6cfd5c7cb90baf93c4cf5a0096139b6e461ebdf826e1c6e59f1cf82256df35eef636d26afd07f2787cacd2575c7551d67039fd61470b15523ac8f032cb142f71939bc376bc75864ebce299982b4e521521f3f25d44651157e00a6d1098df73a002bb65403a1dc9f2d4082d9cdb81380a9776e6bc1009c6b2e95f5f0a726e0a0e821cf577ee471373261bc251a77fdb7900e6b063d5f8f2ae455f013ac763150215c641b3ed93b3cae765b9074e2779a0ec7431b042ec0c7245e83f5bc7b203f01e989c8659117e19bcb272190bd22758963988e62c315a27e7a894749c552d59c307e4f1de677c59912227ef4ff00168b1bedf09cb5e8498e8926e286eb3ac3f27e2b3a551a0554c1963b976e0875913d0b139b1fef3b856452f493a26858ce54aea75418798cf70287f9c0572341edbe66ab66e862bff4184906daa99eb484ba9a8fe9c6f2b94b5a2519bb0d2816bc597a692ae91e089c3f922c6992fdf0a45ffa2d4555493b4e2ad45b92bd98bc1ea9cd7b46e0d6aa2611734a314602587c7348cd6cb2b6207da9bbc6318dc7791d8d3530dfc1649edea2aee299387f9f004cfbd1c260b49c26b850f341bcab52d9a0cdc13e530f1614b48d935c140f2ddb5206a04c917aa4e530fa2f93d2093b955dfa893508e5f0717e3ba58bbbf7c83a0b96a9ab00ccb564ae3da0160ed6277bebb4f014b4a77862ebb503dbd456010eb67bf8c518cc60b6c460e7929d650faa63b3e0207857e17d8e88b7cacf8854543f6eaf5f86015f6091baaaa50a03f3915eaea9fc5e6e0be736017628f721963f8716d162dd52c295e8da6d492722c685535a87c96f9dd341463aff98241003dc8b2e4135bba31745e9353235caccb3d4064adaafb371b79540f95681ffb1f6ac8116f42a175ffd31f1df99c0f89b20c07f121fe1dc630b432a39bef3e3cfbf92574a6c9ca71ac889adcc47644e1ea0f11f8c21a509b1ca1b275e21fdceb3e553045721c4e030ae4454376660142890d753c072624c2ee5d27a25ebd6b9b2a923b62c510719791c22d33a61c002b8af5948779ce70b90f69aba9f504c8d3f2649d74fd02feeefe327d9474677be4bf110d6fa97fdf4d89484154755a30dbea41194ec7c46b28f397c49b5aa4888f1fedeb7d7fd12229ba4dedb1a02f46a5cd990c1dcfec6e3d533a4f9587f6a28f838225b74076e18c69b501f0ebdf33562e6b9047f94dde375f295d782d16da09aa141e79fc96124f7297b97ddc8d59e239a0783ad9ef3294068b91c3ab9ada4419fb4132c7ddd8dd653167af8b9435fad20db5a0ffce5d496ae656843f4cb1bf98c190dc17555bbafb7081cd935d9623ec2ffec4dd176ef4400f4ef83f0df958bd18e21809e019b8a57bfb89f68ac636da4041f202d24186dab8f8d4157789e32d03759e70c136bb758bfd1b5d49a3fa1b9fb551939fc9ba7b7afeaaee00cf7e019c716998e233e040498b46ca35a87ec2743167646287898bdc47f44da28ad4853020b1d22852ca201b7b8ef41653f502b09756183fdded700521b7b3110ca92d8c545b2f1b26d5c371f5afd3353c12a06ef9e533a1f3b787c5fb107a05b58440d4a6de49f0c34c4f2801d8e4ca1f6f5eee0af97ff50628457ba364283d2d992b4f9b62daafc6135279ebb9263b0cf3b8026cbe58f5b2f4f6c3cf1e841e16525327335e2d86c83a8d7f59f67db18db1fd518474ef630f9d2f4a03d4f0f00a61513c849c6fc85e7a7da40ed4604f0908c3852a515aab56198bc489f51606148832d24163e020a8723b0d6c84b343a485ec52882c584b32e3441058c181a22b8e093d88776bf43ae66c3de0d0babafc0dd341e1f385d6e54ec4959cf1accb88318c37a0488d893575e6a38ea6b1b94da576b0a2f5d253bff49c5d4f21aaf441deeaa748011488e8ed571baf16cc8bf50f1dcaf1415e1dfa251831166a075f19fb33adde935512ef8cffc91a607abad19fd56a137ea2b519c6d413b36c7d6d592f4d4a6b8ada921ec066233d53836ed2fb22275d6b4f38dd295da21f73afd8ba9075edb9ad253a721caa08c4aaedb77434cdf37f3c9bfbce1753dae7771d57cb37d60bdb711b01a27224e8c7e0624ae23401d9676e8b926c55061f67aa7f4a9312f414c7f23f2388cb4af37405994bf0e685f88341224d6a036891919bc175033d477d2e9f71b3f62e53d5ddfc1f27c607adf802659ecae88ae5ab362fdeb413a926c559ebd39f9f8abac01f938c62f25281ce29b32acf10003edf87941e3bac7ab8fc5f23b7091f25708968ac6b4eee6d7eaff8dba0ee43645845c68d179bf9f6ab9f348a3391fe4a7e9387d0afbfdddc6f65053305ec9c6b6947cd6812f58f66dff62be596f57f49e25fa2a772d1626befe49083cab88f9ec597eae0748018007776728c76761e90ab4341e2b8ebeb6aff6fc2fd4f28f1f9d295193eb0a34bc50974c1c93d6f480d3f65b3dc412cc72a25e1054b661139f7fdd84ce01d8fd40d73ad4c420e51b5bedee1c89dd58c3e5b1560c310e7e2287f8f0a01f823bfae541db946b0d7ea87e772b2881f5d5f36f09ecbf21df27151257857badefc198927343294623ded45662ef48f966ee7bce73e5116b49739a92b5f34c5359990fb3524c33219d3c3414b1d9b643ae7b2c188cd3118a76ee9ec5335c95afa5e96ccf7ab072754dfebd4afa2492681480399cd388d82ba6118d0c2d00b9534ac27e15a141fbd92cc4b52730ee7fe7f1150ab062772fbfe4956ea0ba731814dabc4a05d0327f5b51ca395e6ba74aeb76c698f35db68c7d09a70ab26d1b1bd5941d2d72f08ce0328002ea5e1c2fd0583e99233112f1ce3647e47362c20f2c231499a5c1474917bdfed84d1a02b2b2bd05ef07b0624d1089b7aeb7b0350ee656876901ca438df1df85b6a0ec27843b4ffaf97e47c478cf5e2bc95f1dbc26a39a56718970d0c7a4d1d1fa4f3760e30381d19de5d9b00aba120049a424b7586aefed101fab0fc064355e81ff4f41ec33a5e818a87712db81454574dc6b9dcaf2725bfeaf00905fbc09a6b6518303913b56a12149e7affad6cb62fc866ba5ad868f5356bbcc08292796659f0a38b92ffaf21a79e7a63283dc2d851ec5b8152868c0cbacdcb53f276a6a307587c5a951fedfc9c9a221efd0c03a6a35017ee3c70f1c64366603ad50ff2fb6298cb29ca59825d191fbf46941e0109049c9a0f399055187968f903174b028a59ed91188bc3aa3502bbf64bf9151536987d13a738060ba0607700e27ca75d8f11897c1656a2d11e54620b0c140bcc5d114d53e16791726592fb5cfde119462341f4a3313186467ac23e42bcfe01c5b33e499ce14e5b20559cfddbc1385cedaf71ba49113d3e24847b0f5d1011bf173b48009f840e10cb6e0e3fdea52a7468ec4edf35396c64ce7484e6eb9ed4f809b31bbc8a8097e3e2b1839b4bd2bd840f9aa3652e85aeda6ed7dcf242fb11a94710a0031bf2b0683538c292d3af365a57a69ba327692cb6c163cf7c4698851b2e158cf3abb223e00a3c835981cd261460e382780fca37530249c9ed33a8b857ba6414336bab255f8e2e750a79c36641a0dd54671f98f7280f7679147f108603394bd143f9385a0d114609b308f973feca21ea2e53de1bd6bd7809efacdc5b4487f7ffbca05dd803fc12e13b8103da1723cc8bc73f26de7d256bf7d60c7c1ac47dc47a7810c43403b780052e42b74e69e1a3380fe9b80c7a2b7f4617f4009230e8688afccd99ff92a69b1487b385ef2fb7729546c317d7b3106af5f2ac26222057158240bb07a3a61a359d1bf3e809220529580f3298b0dff10c8fe1265c8e5ea41424e5a0941c5dc94fd9d7a33ef1550f3f30a4f73ac5fab6b6c34a03f1575abebee4625d041843ec815ecf854c8455a5897a9533e4d5e95a1c5121d4716a82da80abe9325a92904837a586adb63b31ce0464b7cf0e9ac48125ccef7da201292a02b9aff8622f8334ca34447861873cb640a44dae8e5837f9add02bd1f5f577957d82021c805f1d9d00de7a1a71dc5e3fea80bad67aa76a51053290821521eb20385925d668c733859ed4e0d923c72d4ed7a20b90ac87de48ba4bfb6a3bcc63907a205bb721ce181a9bf6470a70b7ffbff9f20703243cd0a10afd1f93c781ab8cc8cff9283aa94a28a35642e09d3f7843a91a2581fc8dea10dc63efd8e1e9ded53372f4e080e3d1258e0a5ba26ea97c0e25de7df6ddd230d2345f36e7c4fe1890473fc029055b8158c4f691ef3e65c0370d8e299bc978e6c861683a5e6a448e18b145f515cbc8b89addb7ad0482057a1d8df5da6ee12501782529e871cf6f82427e0780ba8f66c00d43b8a09ea3fc58cfc5a5e1191528f0e6f4368add0d8ca5424334500fc26e52648d0761e8f81a666b27f581cc43d3515766ee0212d2d996b2442dfc660bca3598c61fac63e866c2b8749f78cecd90c6aa0eb344016f36f079202b9b43eaa9a924427d44f4de3a96957aa87429c2f88b80247b931355b53fe7bfb69264eb2838e392368e236ddeb578188fff1006a7ceb6207962cf0b61bd3cbe213ae9b5f0357a160aa697275bdb821d436cbcfcfb1f406ba5fe6c449f81d49912ac17f66088dbf6cc02ccc6e4a58b258e02e7f0b86bfc5eb792c8115ecce5c95e49213f6f831c658d6c12678c59b760b0888dd6abb9c51aceedf982e0a99e4263966e7b3efe4141fcdd2763146eb183130ebb708a2d86c09dcc91f60ebb07b427f2f53169057235c3cbc75153323ebcd86834d5abb87eb5bedbd3537af4e7070127ec5ee42b98fced9bc84e14a7ab170becfaf0d05b6b55b58d4e650190d5722497daee40c580ee433bb5889bed411d7dca299c12a347046e4f4afa55d014178cc4f488d0958c6e9e9614ffa3f51a687a9d1d0c45794e1632b8934558feedc13e5667e73a3d6d8b1152968628b084eec9b1d7719438ffb61164e2638afc45a2790a8e7b0505ab46b2a07f14345f8bc6a025c054c71183d9165fda5e72717e5b1ea63d814ae11f5291a82ff799a265ffeed035af29706f7045565e0c36519d2a65a10971a7c147cf76614c92feeedf6cb06a7440bc01229088e492158bb4b5f1533c040701e2e27d627cfb07b645c895ddc3bc6e182176ea7012261bef6be384a1fe33fd9e46962652b36dd8dd9872dcd1700901605c40b2e56f5b37d06715b297c67c61c0ed9f240644314acdd1567b533dbcf3ef37c9c7692039323dde20756d7d8c87fe87304e6657475550b0f809994918d7da380c7a70a178fe9666494854d0a8e741de4f5dc296a10a1801738d49fd23f8ade43c20cf12c1cd8691d0a08a0dac811ab87b6cfb16431d0a2076ee16a2cd8706952a26d9d60634441c1f42690500e88dbaa3ca5739cdb903ea9a0e4a3ebcd55ff10188c550a381a4c650972ad89635d493966a16ec8da9d7b87ed087129df490f83cedcdd2b5dc24c377e208d850e4c987f7fea345bb86cb16da33f43b3ccc62fe31aa102a9e49d49c0f16eeff031bf12496f4469289a26596dca40d3fd4dfa7535155145c365e826bdad6734ffb47ffb1ae4d900cd27fa691ea28b15346f68f47ae2ce0a83a3005d5858e6e587f1609517d8d9330718c647c9b08dd925338406d4cef2a39bab25a37c8092185a7fcf36324fa0648ff8da6317d55355fd18932ad3404eb010bb29aed83982514eb74be3ec28f5c84ab6dbac7bf4e7aa399cf2461bce9bc4600a8ed1e37f3a31b2bae2c92f3c8ccfec5aa296e8499ef76014661dbd0d672fa8f16b7e1bbc864b215e702cd7c12eb5be6dc3239b52a59025a2a7ed459b7def94018a62d5ae7eb059d930a4c3eef8e3ce6ea3bb09a2817c92d28065d610e4e8d943df84961e8ea31cc77bd8250d352302227ec3a9bfdf7249e2c9c6094dc5a949ec003f2c1325506b17ca0ef12d7c650ef253d51d89b40f790b7492252273222225e245c833d64c55a48d971c510a9dbaff075ce7b53422ab68747703bed9fb94c60f857f14d07119fe17ee693af929802885acd14a9893a87085944260a596180cff4bbe4151ba1b19266c1d13a491c5bc983f158d6d5d218cabc78063baf95b6e93beb3d1cbbf72b984664b01330f39b5169d517d13cbbe2f5d6290d746a45fd5c0072a6e96a885d5324b139937d23f4a7282b7ef5c598aac3cb4eee4b25ad296d7e12ea3f27f58374d2ea4154ce22065a391d0b718aa89c9438346318c584613b065af2f32d18b1bae2aa17b8480c3698188257bc2797172c78bf0b163405c1d6fe4cd1c6c68d5a72c032dabbb8e84e767882d34854e30b4264dddcd0ba7c3d03f8b543d16391dc6a4f4110f57ceda8ed64fe9087789191cd471b1bd53b3825749c84e55a425546b7bbde748270296bb207d50bfe7cdbe13734d04ba7fbd8e684f435a397f9747286b9f791b6172bd12761dee4a56852a830ea14eeb1d2834c51af097fc72f44f8122c2a05996c21222b55d6f41abf0f3f7bf58343da4cebb5f59921ee4956e4b8e6690b2313cd59d3939d8dc7ec394c01800058b614a478d69f84abc3941ab10d69029dce4acfd11ae4252d5154d2c1b4b7d68fd3fd9adedaf3686110be8cb656b9373bfd30178b3e9a998ae4d2793e6f1386b3809ab2d712ee89d45abc6e3d8e19e9e4c1f6621ad20410b3772ac920a7c94729eab9b508f0e493d36abe5df286158ea3cd5b1da16668b482dd5baa90c9d2b7a05f6f73012ba136d6e78ab935094f4f97ee7e156d6001bf2872dc7ee081e31850badf171ee96fa4c91751053e58822657a811f8db0e23e6ccd0e48f8a3bcbb90c2ec3e83989f583e51c496ac29b81b2af25988d8283c2201a6cc1f1e5cc4f926817a542b8821a8347140b2c4ef0ae629922e6625f7400b2bddb6783eded022a9f157c754e29c85f71a2d38dfade7851d182ff2100425a80ed829966238bc9e108d97dd086ba46cf623a0d5c0e5a0b1c86a304f1363034d880425d7a6fbc3ce234a0678604e74f0d40744f6ac68183d4b0570dbeb77e3b19f8ca204519015968d83ff7a39b8840170ae29f205c957ab3887eb8dbcb5339f1af44f566fa96be59f1bc82ef7edc6cb3b7860a746c4bac8ccf68a76bb9a934238e830f11d05171fe5aae1273d7446e5e80ff3959c9535215f30c63c7559561f288116c441080cd6ff338628e35eef6d92aae44866be47b0cda019bb18126fef4247c94db0c8fd29cde7460d0b2f710471564af2738ad782e16ea97cebe6a89ef8f3590d71d86257eae312ebf48e478366645c4ebf664a709bc553ca846758ba734170b26363bb88d408365827d61e16400b4b1de6e45a7e3e692459ef2b2002dc37cf91c8b8a5f8e6060fff0a72bd966b6c999322356154805586db159a874ccc52cbd9b6c5681ec8ad50b768546f2e6dd9ce4d1528203f73712ffd8be7fad6d786fc560e5047c0a87860987a6bebb9b025dd1bbbda3cdea5731c41e2e1975f7a889ff38d38fd2601d5a1b7e8ea833188e3af14caffa4b66c041103d55eb5511c5bbb85a0192aa7bf0acb17cb84a29456d466f6eda261f612d5e4603e4aea389b68648d5503e9c1b5c3984acdd325dc5dbaf35d9e44bdf7a8b4c89ce30b4b648b9e1d38fa91bc5c8d8f601a6b82e1f42f6e04acf3f9fac8d26b03a09bd7cdb35175ad55f17b22db328803d66324c0970c38d81cdc1b7ee67a2d910e8064f81fbc0d2a6a7aaade8000b8be4fe111d354731cea9380d39ece8b146d34f74b7ee87322e4d772f3570a46d81cdbbeb21f7f66fa8baa869e4b8637f8a061bb8efd7e06966f3186d1c730cc0a4f38683054f1fa775bbd3cae02102ad9c773fb7eb874bed5fd84167fa86029abeb7d9056d26b66bf7f4c5ba675482c71b08d2ecb9b23bd2be801a4df9531396c7f4bbb59602500464dc04ff7c5622eaa9887ccff24bd88a52ad69f58880012db03dc4d051626b1fb0faa510fccb6b73f3953e461165dc58eac1063b664a2a18adc06102af134737f34bace2fb21b8d54cbd674c1a10a75463345b4ffd0f9fb5894e6ff8b455f5d35bd1313392cef7c4c441ce8d21302dfd58688e5d9454bcdc03a9c3ef269697506ff9ef4522cc0efa935aa368aafcc48cc2a5b6be32a89b29d0062c33ecfe44dd070a43ebc63f3cf99a3a142176c93c1d7acef0d42261f8f6d50c837d9a43e8951b35516e050069af0633e6388323029c9092475e1a7e81639d9d2e5b81424e1576920b977d329b5b087011718a39ebd31983512c4c43df67c2919e29ef909fc8c79fe2ac41e08a269690a32b63037abfc9d5b1196b86edb8e4312f3b8b8d4e265c0e6b0db372d742f1ce5bde46490af51ee9ce24e36ce8b59f7213e68929e4174a2760f076cd1a7b38db164c67c0e902f05d4d3f8d77225586b975a1655f7dedc3c20e815f6e2cedfb8d331e9c4e0c8c2c21217fdfae1b2149612ef0eaf71bcd23224cda2d0ee00955d1ea88a56f508923ffa2fb1aeba4f4fc4a02c187fdf3b4d791d5566acfdf4b63e9c3990f12059fa2562206098967cd36f06c502ae79cb99f4880a8c28a14d207bd12c30f9604bb3bb2e00f46151bf5940445036dda64c135d8af713b033fd836ed11d64a18846c62fdb1310821901d18b45b337970a9949dc1ed45d4afb3596dde4a7df1c009f6cbdffd0f1f4eb12f1a1d23b87a72baf07b9d90913a7e247a2023e91ab2c77aae0e9d666593b61d85facac3c8f50cb4f2e9e4a435897623f3ce626edd98b50ca2a764756a438a63e26fe480bc5eb7c54ddf055cc985b051dbde037967ed3de9d08b2db79701608bdd2bb06d8471075dcd76d1422e4b3b221ec687b73056b74ff69e395da32447278dc9b6e499abeca743d4c0d2ae2cc3c0e1b253862cd22f4266e922d1c255fa755899d3d277ef04f55170e389b4c4f14e2c0ef58d9d9058e4f5122d96250d7f66288bdbac3959a6e674b51b0802cb451faf40376cf00022672766fc96e229d63d1fee5310fec48ee58b76a6d98770452b3a472ce5c20ca58e14538e961fb7dd969865e15be4c1ea65153c1d3e021f88fdc7630045b6db7d1f5b92b2fbbb1fcbd1c2175e8f6a5d00dce1400a34e3982f0115f60c4c4df2e0dfde764b10f08958ddf6955c8c5e7e287dc4328a00b74addb10a73131ff3bfd9779f23901ec8407369460d0d3f04f53b6445def63b7b19d8a38dab779ea3dd7bfc7cb74506358b23e0c190da6e306a4ade9a2dff29d4703ec25058d0034c5a84ef97a1120050155f29579b27f4fb7c400d1628e7b4312082e870e5cce27eb5eb811182a2535962e022979d2df66884ac2608175ef7b333ed88bbfa66644198ba201a74581612fe604a0bf952f8e4edf3e73eb93c52f1a1f91190f9a1ec2010ca2e97d1a8acd310d802522ab38d10b9995f2d6ce43758a9ccafae4578b45b7ad69590d81c1c84172b7e81cbb813b381304e5524323436be4fa418af2924c972d17d3fdef13b3d15384c29da414fb5ce9c757d905380f5904ca24bd4dfda8e1e782f39a42f8920060c0ccb17a6db8a767ac9e33cb431593674ed9969f617f1cc6fe972e3455bdf31276eae587f3083a0826ed6516b7a8fabbf27bf23ffb806e566ed75fe93597d5ed4113244e98c61f42fd2ceacfdeb9610673b075b148fe23956109843e07ec5a1bc6004214351537613b8f7f2c4c0ae9484fee92f446e5d2fc4a2b44175022c0a5b7b4272df00002e4ffdf4eb56f632e6bf41fc6f8f7fcb04306ac0619b0eb8fc2751bb64cc29db25162baf8b6b5d61d45f041157b8412d699e8e615af31944d80fe52b89e1a21df2615b4abbe02ee7d936cacec938a813e5f867b541cb245e0cfb5f826bc017e958686ce3e6b888ab8230629356c0134c5b5cb0d8fc267338c336d5082d20c49c68739d6b56d22198a903c36fdb6d5db70785c65ca6286f4125083704e7f9607502a951297d1838f40e424d54ba94cd33748050d511625bf3d889a5bd0bb04e263f633b200fff5aa45b0fde945554ed4c3b7bcef65ecbb63c0979bd48149a19851d9dabff8e8f5b889e453a1b8bcff72ecf6280703cf90a5bc285469fc39d74c897fe5ec0a36b49825adcbbd412861b5a951dd7af16ebb70b921006ed14647afc1b115683a815dc3f4bd4983778573aefc6a637ae41dec4c041f6f6914f4e10c5c98fa6a5c052b64d3260cbef91fe234ac8127bcfa2c2031d581332c411b22d8617cd2720e1a4ccd6571e8c593457e038b387004e9c839b998384829d46e3d0ccd5ba8a1dcd338f1cf572e52a80e17c4f72fe147587735648b417858f27ef10eef745dafa9eea5f2d80c920d62e0cc2e3567fe9302ab8554e3c4a6c17a5fa5a8bcffa0df138a257fc308ad57a9ce63e6cae6e9cdf4f991f50a057daf64b20ef53b7056efbba8024eca0f703273e3c9be5e4f7008f44da6e9cb00cf3828acc53a7b12e48e1dbb778b61aea347a8f7b945a3f85745d640ce8a8567c0f00cdaef81f8a77ec849d0281c772cd276201a446a4522ba99a7426db7debabe8c98ad9aaa0f37fae2a73127d594540e015d5ad9b409a7c33e82ad27ec0a8ada34ece920e518ab6175726a904f9ccaa1fa243918d31b6728d88cbf05db8fda8d9f1155e23054eef268bb9f9f57fe887a5da5588013a6b642bd500d678671ceaae7f0c22ff7ea0ce48c055a65b2f7f8ee65ec7c00306d75efb2cb5b3385c18e05b9c9645f62b5bc363cfe8a363d77e9eedc2d7c936b5e880c30a17abdb2b33059302ab5182a6e04bc9f3a16121c86463c7a66398d7e6d98d62152429c149f4d7fbeb109eb19e8f36208d977dde6cdefd61ae2747ffc83812035a4427ab513fb0a7402adda1d3bd6aa5745cbea133a835006455aafb239b497e3b40533e8b3120053bfc2b296441fe2b2829dfbf79c325b7648981f87a1383efeb137d7e4fee9bd0a3a34a76334ee94ce7436454c99d6471c5c4e9fc937f62553e32dda49709d3873416be8da8430d0635ae982f999d95e04248504de9bb769d786a8eba4766ef18e528765dcaca0209ec27c713aac7d8da406d3f7db7812c8dfb9268b3a342b252f810e5461ac40e8fecc182898f7aa5398fe4867eb9a25c01f053843ce76c013c24a6b8861c60629e803da6b8d09e182013e417a0f5a504b1416707b9e5dfe9f2ef957487cf3cb477f0ff8347521325be19f7d382080e78764b35eccc0ab73b15179881d3cfb246033bfcac13ebdc153b3426694a40325a49f50d7c1f519b733b4b8544fea238fa4528bb654fef724447337888011e5", 0x2000, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f00000010c0)=ANY=[@ANYBLOB="12010000eafa7240936901b0293df400100109021b00"], 0x0) syz_ublk_setup_io_uring(0x6b41, &(0x7f00000003c0)={0x0, 0xdcf4, 0x110, 0x6, 0x1000248}, 0x0, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x2) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) ppoll(&(0x7f0000000300)=[{r2, 0x4236}], 0x1, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000300), 0x2, 0x4}}, 0x20) writev(r1, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) 4.763502619s ago: executing program 3 (id=3510): r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000080)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000040)={0x10, &(0x7f0000000080)=ANY=[], 0x0, 0x0}) 4.002258585s ago: executing program 0 (id=3511): socket$key(0xf, 0x3, 0x2) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000062d14406d0470084761000000010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000a80)={0x44, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 3.811242772s ago: executing program 5 (id=3513): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r0 = socket$kcm(0x2, 0xa, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x3f}}, 0x10) r1 = socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="00070000420091"], 0xfe33) recvmsg(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)=""/4125, 0x101d}], 0x1}, 0x40002022) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(0xffffffffffffffff, &(0x7f0000000280)={@val={0x6f01, 0x800}, @val={0x1, 0x0, 0x27, 0x0, 0x27}, @mpls={[], @ipv4=@tcp={{0x6, 0x4, 0x0, 0x0, 0xfd5e, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffff20, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0xb, 0x0, 0x700, 0x0, 0x18, {[@window={0x9, 0xfffffffffffffec4}, @timestamp={0x5, 0x2, 0xffffff07, 0xffc1}, @generic={0x0, 0x2, "d588381203c1"}]}}}}}}, 0xfd6c) 3.650008079s ago: executing program 6 (id=3514): ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000100)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x98f911, 0x8000, '\x00', @string=&(0x7f00000000c0)=0x81}}) r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000100)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200de7e001009058b1e20"], 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000cc0)={0x34, &(0x7f0000000b00)={0x40, 0xe}, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r1, 0xc0145b0d, &(0x7f0000000040)) 3.564432377s ago: executing program 5 (id=3515): openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/cpuinfo\x00', 0x0, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="040e04f74120"], 0x7) openat$vim2m(0xffffffffffffff9c, 0x0, 0x2, 0x0) 3.476605552s ago: executing program 5 (id=3516): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x40, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) ioctl$TIOCMSET(r0, 0x5418, &(0x7f0000000100)=0x8002) openat$ttyS3(0xffffff9c, &(0x7f0000000080), 0x6001, 0x0) 3.299302714s ago: executing program 5 (id=3517): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(0x0, r2) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f00000000c0)={0x38, r3, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r1}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x4}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x100}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x38}}, 0x4008000) 3.216185757s ago: executing program 5 (id=3518): r0 = syz_usb_connect(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12014101175129205705092006c70102010109022400010200100009045819028ab53800090506020001000006090582020002"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, &(0x7f0000000200)={0x14, 0x0, 0x0}, &(0x7f0000000700)={0x2c, &(0x7f0000000740)={0x20, 0xc, 0x9, "66fea31c0171b4d17f"}, 0x0, &(0x7f0000000640)={0x0, 0x8, 0x1, 0x9}, 0x0, 0x0}) 2.658383082s ago: executing program 4 (id=3519): r0 = epoll_create1(0x0) r1 = socket$unix(0x1, 0x1, 0x0) close(r1) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001480)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$tun(r3, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r3, 0x0) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xba81d000) recvfrom(r2, 0x0, 0x0, 0x17, 0x0, 0x0) writev(r2, &(0x7f0000001400)=[{&(0x7f0000000140)="58dd", 0x2}], 0x1) setsockopt$sock_int(r2, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f00000002c0)) 2.050185873s ago: executing program 2 (id=3520): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xca02}) preadv(r0, &(0x7f0000000140)=[{&(0x7f0000000080)=""/11, 0xb}], 0x1, 0x1d40, 0x4) 1.908834257s ago: executing program 6 (id=3521): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 1.882767085s ago: executing program 3 (id=3522): r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000800)={0x44, &(0x7f00000004c0), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000001c0)={0x1c, &(0x7f0000000940)=ANY=[], 0x0, 0x0}) 1.702258301s ago: executing program 4 (id=3523): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) writev(r0, &(0x7f00000006c0)=[{&(0x7f0000000440)="2e9b3d0007e03dd65193dfb6c575963f8864", 0x12}, {&(0x7f0000000300)="1100f8ae", 0x12}, {&(0x7f00000002c0)="00021221", 0x4}], 0x3) 1.552481771s ago: executing program 4 (id=3524): unshare(0x64000600) syz_usb_connect$cdc_ncm(0x2, 0x175, &(0x7f0000000400)=ANY=[@ANYBLOB="12015002020000"], 0x0) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) 1.421770485s ago: executing program 0 (id=3525): setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='bbr', 0x3) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000a80)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000000140)="91f8a9848519def38491bbc4173c3c6f357d0272b7319130feaab952ac4703cad04be68907e50e", 0x27}, {&(0x7f0000000e80)="44900000000056ee66c372f3105eb186dd8062fad2d5b5bfb0ba06f274a8d026bd209da8ffa6a26e3b3f8075704a9d0ef9aff7e1e7db24609f02d34e76992c9df9fe6888c6c9a4825c6223be6ac54536025af1dea54e527c68b0ff250261953f2da79a78104c2d9e7b16ed86b124945aa9ab7581ebd385fb61d442035db81e18c2d2462d0bb25fff9d3b1ce90b597992b2a4d541611ce77f58dce7c95001", 0x9e}], 0x2}}, {{0x0, 0x0, &(0x7f0000001900)=[{&(0x7f00000014c0)="fa98151f51a5cd01a13cca732ada71da23eb1dbc1760afa900e0a7e5bd78d1aae07a60bfa40ae396026e0e2659a1e1332ac789341255aedc3223c16d66ce458c85f3c4372aa7f0ba420f8f046adc689289630718809a", 0x56}, {&(0x7f0000001540)="417e1fcc84ba36d92eced7b76463a43ac6c3c9eb0773f03237cfb1c88c6f5c3ff8deb0767df1a43ed83eee5101fafe74471d69f3cdc3446cf9ded344d8fd6aa575be67f8f82a441939bdba0aa19c5c1438243d72a5b568bbc12cc965c0c639ee7fbb0c980242dc0b2856e9142f0909a2d9f4388e6c9be93c703892c4e14676278a121f86052dbb6694647460a139614be42fb89d5b1da1a07994b7509c5dcc1c63cba1acb07b44c35d557db3b025ebb1fd5688a91a7ff0e10cc58cad5b11d03df3e48d", 0xc3}, {&(0x7f0000001640)="22c042cdf9bd9c9359e29aca901441bdb830df717384916ecdcc1d0484ed77459f0c", 0x22}], 0x3}}, {{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000180)="9ed900f8a0d57b7656fa291a92dc9f58d067b2f1f69c6459442d67fb9436fd2078b14a2f", 0x24}, {&(0x7f00000002c0)="1a88f556665b77544a4f49495e71b694fb12eed4456b2ee14a4b13db92ebb7c2218e99c782d0b6a4bdeb49b9fc1638681e1b9d3264936a5602931030d6d53f6b979b85b0fedb3308b25785b1460fa910931a49d5107106e4e748a8679ded0e7b6fd03f2739a7ebb6399eabcd10bbaca33fa48116bc41b10eab20e805e435f5c7a75325387052bf0d4fefc4d414aed4ce8f82b0c627471a7fa0a789bbf6b5632a048ec0f3e391965bf6c6a64065b36c8c01cc6cfbbaba2316e3a8c34704a0de866867ff8af9f6f2227f7e9686fa75c310943d8ef74921e792ea7d378c237bb817c3", 0xe1}, {&(0x7f00000003c0)="7131821ef34992a7c3b4a30c7b10ab67375b1bdb027a5e1bdf1bff0a522c00e69535b60e7a4de35915f5f45a8f035f024d1a2ebd2ca1851fde44ef6ea33b34a5f71eb9c5db3573f871121fd352bffebb0535c4fa382bb7b35858425c0574055585dfc9236c0b008a04e25cda5f35f40550110c34741f377c963922a4acf4b39fbb260a7ef745bf706ed34c423eca2fbed0acf3b4915062e4aa13d770c023c057da26bec248682391fe18b640a7071c29834424d724b2755a", 0xb8}], 0x3}}], 0x3, 0x4000000) syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="130100002add1e20ef050a02369101020301090224"], 0x0) sendto$inet(0xffffffffffffffff, &(0x7f00000000c0)="f43945ca", 0x4, 0x340080d1, 0x0, 0x0) 1.02186713s ago: executing program 2 (id=3526): r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x88440) ioctl$EVIOCGMASK(r0, 0x80104592, &(0x7f0000000300)={0x0, 0xffffffffffffff36, &(0x7f0000000200)="952bb3e006ae9a4c3a"}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000100)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) 534.894716ms ago: executing program 2 (id=3527): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r0 = socket$kcm(0x2, 0xa, 0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x3f}}, 0x10) r1 = socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="00070000420091"], 0xfe33) recvmsg(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)=""/4125, 0x101d}], 0x1}, 0x40002022) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(0xffffffffffffffff, &(0x7f0000000280)={@val={0x6f01, 0x800}, @val={0x1, 0x0, 0x27, 0x0, 0x27}, @mpls={[], @ipv4=@tcp={{0x6, 0x4, 0x0, 0x0, 0xfd5e, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffff20, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0xb, 0x0, 0x700, 0x0, 0x18, {[@window={0x9, 0xfffffffffffffec4}, @timestamp={0x5, 0x2, 0xffffff07, 0xffc1}, @generic={0x0, 0x2, "d588381203c1"}]}}}}}}, 0xfd6c) 419.791072ms ago: executing program 5 (id=3528): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000d507df08c410448200dc0102030109021200010000000009040000"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000840)={0x1c, &(0x7f00000006c0)={0x20, 0x15, 0x4, "e8008914"}, 0x0, 0x0}) 291.005532ms ago: executing program 2 (id=3529): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='westwood', 0x8) sendto$inet(r0, &(0x7f0000000580)="17", 0x7fbc, 0x1000803c, 0x0, 0x0) 240.071488ms ago: executing program 2 (id=3530): r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000100)=[@in6={0xa, 0x4e24, 0x14, @loopback}], 0x1c) setsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f00000000c0)={0x0, 0x8, 0x35df0380, 0x200}, 0x10) sendto$inet6(r0, &(0x7f0000000200)="9f", 0x1, 0x4000800, 0x0, 0x0) 92.693649ms ago: executing program 2 (id=3531): syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x759, &(0x7f00000000c0)={[{@usrquota}, {@nobarrier}], [], 0x2c}, 0x0, 0x4f6, &(0x7f00000002c0)="$eJzs3EtvVFUcAPD/nbaUCtiKTx7KKBobjZSW58IFEE3YmJhoDC5rWwhSwNCaAGmkGAOJCw2fwMfOxE/gSjdGjQuNW4lbY0JMN6ALc82duVOnvZ2+mHYs/f2SGc6999w55z/3HuY8ZhrAulXOnpKIzRHxa0R0VzdnZihX/7kzNTH019TEUBJp+tqfSSXf7amJoVrW2nmb8o3eUkTpgyR2FIvtHLt0+czg6OjIhXxH33gpT50dPDVyauTcwOHD+/d1HTo4cKApcWZ1ur39vfM7tx1/88YrQyduvPX9l1l90/x4fRxVPZXnDYsuoa2wpxzlme9lnWcWX/U1YUtdOmnPnkutqwyLlt212eXqqLT/7mirbFV1x8vvt7RywIpK0zTtLOyd/iybTOslSfWENL2aAveAJFpdA6A1ah/0t6eykerEUHEcfG+7dTQqI6As7jv5o3qkvTKCLfdUx0YdK1T+QxFxYvLvT7JHzDkPAQDQXF8fjbh+rNrvqD2qR0rxSF2++/O1oZ6IeCAitkbEg3n/5eGISt5HI+KxunM2L2IVoDxru9j/+bkrT9R3V5sm6/+9mK9tzez/Tde8py3f2lKJvyM5eXp0ZG/+nvRGR2e23V986elptW9e+uXjRuWX6/p/2SMrv9YXzOvxR/usCbrhwfHBu4275tbVyht7pRh/Eu1JLRWxLSK2L+P1s/fs9HNf7Gx0fEb8WZyF+D9q/OLty6jQLOlnEc9Wr/9kzIo/8vW/pLI+efadvrFLl184Xb8+2X/o4MCBvo0xOrK3r3ZXFP3w07VX82RhGDHP9a81jRVdSMuu/31z3v/TK5c9WWp6vXZs6WVcu3m94Zhmuff/huT1Srq2PntxcHz8Qn/EhmSyuH/gv3MvDnbNyJ/F37t77va/NeKfT/PzdkREdhM/HhFPRMSuvO5PRsRTEbF7nvi/O/b0242GkAvHv7Ky+IeXdP0bJY78GDH3obYz335VKPjDciH+jmh0/fdXUr35nuHB8Y0LxTVfTesTd/0GAgAAwBqwqzJPm5T25BNNm6NU2rMnYtP0DMrY+PMnz797brg6n9sTHaXaTFd33Xxofz43nG1nZw3UbWfH91XmjdM0Tbuy7Wz8PrqltaHDurepQfvP/F78SQtwr1nSOlqjX7QBa9Ls9n9z0Wc2/wsZwOpqwvdogDVK+4f1a9Htf6V+BQe0zFzt/0rEnRZUBVhlc7X/Nwp7jqxKXYDVZfwP69fy278vA8Ba5/Mf1qVF/Uh+GYmtx+fJk7SvTKGNE6WY/68A9ETU9tT6NPO/4G+liObUsK2pkXbNuKalOfNsjGaUFaUF87Qv4Q8xrG6i9P+oRjXRGREL3L3TN9uVWuLySles0gg+b+3/TgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHfv3wAAAP//C4DT6g==") recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x141, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff, 0x6, 0x0, @val=@tracing={0x0, 0x5}}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x2, 0x0, 0x0, 0x3}, [@func={0x85, 0x0, 0x1, 0x0, 0x1}, @exit]}, &(0x7f0000000000)='syzkaller\x00', 0x1, 0x98, &(0x7f00000001c0)=""/152, 0x0, 0xa}, 0x94) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) setsockopt$TIPC_SRC_DROPPABLE(r3, 0x10f, 0x80, &(0x7f0000001640)=0x4f1d, 0x4) sendmmsg$inet(r3, &(0x7f0000001540), 0x0, 0xc0f1) r4 = gettid() syz_usb_connect$midi(0x5, 0x32, &(0x7f00000008c0)=ANY=[@ANYBLOB="1201100100000008920a20104000010203010902200001010000050b03000209047005250101de00"/50], 0x0) socketpair(0x22, 0x80000, 0x0, &(0x7f0000000800)) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x4, @tid=r4}, &(0x7f0000bbdffc)=0x0) timer_settime(r5, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) 0s ago: executing program 0 (id=3532): sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)={0x68, 0x0, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_IFINDEX={0x8}, @WGDEVICE_A_PEERS={0x4c, 0x8, 0x0, 0x1, [{0x48, 0x0, 0x0, 0x1, [@WGPEER_A_ALLOWEDIPS={0x20, 0x9, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @empty}, {0x5, 0x3, 0xfd}}]}]}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @a_g}]}]}]}, 0x68}}, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @broadcast}) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f00000003c0)={0x0, {0x2, 0x4e20, @rand_addr=0x64010100}, {0x2, 0x4a2c, @remote}, {0x2, 0x4e22, @multicast2}, 0x204, 0x0, 0x0, 0x0, 0x2008, 0x0, 0x4200003, 0x2, 0x2}) write$tun(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="080000fa"], 0xdc) kernel console output (not intermixed with test programs): 6A:00C5.0035: unknown main item tag 0x0 [ 655.059949][ T9] wacom 0003:056A:00C5.0035: unknown main item tag 0x0 [ 655.083475][ T5768] usb 4-1: new high-speed USB device number 109 using dummy_hcd [ 655.137046][ T9] wacom 0003:056A:00C5.0035: hidraw0: USB HID v0.81 Device [HID 056a:00c5] on usb-dummy_hcd.6-1/input0 [ 655.160158][ T9] usb 7-1: USB disconnect, device number 6 [ 655.270276][ T5768] usb 4-1: Using ep0 maxpacket: 32 [ 655.289763][ T5783] usb 5-1: USB disconnect, device number 106 [ 655.293466][ T5768] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 655.307615][T14470] fido_id[14470]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.6/usb7/report_descriptor': No such file or directory [ 655.314002][ T5768] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 655.388274][ T5768] usb 4-1: config 0 descriptor?? [ 655.468421][T14423] bridge0: port 1(bridge_slave_0) entered blocking state [ 655.475895][T14423] bridge0: port 1(bridge_slave_0) entered disabled state [ 655.483877][T14423] bridge_slave_0: entered allmulticast mode [ 655.492808][T14423] bridge_slave_0: entered promiscuous mode [ 655.522699][T14423] bridge0: port 2(bridge_slave_1) entered blocking state [ 655.530181][T14423] bridge0: port 2(bridge_slave_1) entered disabled state [ 655.537876][T14423] bridge_slave_1: entered allmulticast mode [ 655.552328][T14423] bridge_slave_1: entered promiscuous mode [ 655.595455][T14423] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 655.604568][ T5768] dvb-usb: found a 'Elgato EyeTV Sat' in cold state, will try to load a firmware [ 655.609570][T14423] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 655.616116][ T5768] usb 4-1: Direct firmware load for dvb-usb-az6027-03.fw failed with error -2 [ 655.632292][ T5768] usb 4-1: Falling back to sysfs fallback for: dvb-usb-az6027-03.fw [ 655.662379][T14423] team0: Port device team_slave_0 added [ 655.670875][T14423] team0: Port device team_slave_1 added [ 655.706529][T14423] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 655.713576][T14423] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 655.739883][T14423] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 655.757022][T14423] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 655.764120][T14423] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 655.791963][T14423] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 655.890435][T14423] hsr_slave_0: entered promiscuous mode [ 655.899766][T14423] hsr_slave_1: entered promiscuous mode [ 655.906340][T14423] debugfs: 'hsr0' already exists in 'hsr' [ 655.912304][T14423] Cannot create hsr debugfs directory [ 656.358909][T14493] loop4: detected capacity change from 0 to 512 [ 656.379450][T14493] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (17031!=33349) [ 656.405980][T14423] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 656.419559][T14493] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a84ce01c, mo2=0002] [ 656.437256][T14493] System zones: 1-12 [ 656.446102][T14493] EXT4-fs (loop4): orphan cleanup on readonly fs [ 656.453048][T14493] EXT4-fs error (device loop4): ext4_free_branches:1020: inode #11: comm syz.4.3063: invalid indirect mapped block 12 (level 1) [ 656.466688][T14493] loop4: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 656.467041][T14493] EXT4-fs error (device loop4): ext4_free_branches:1020: inode #11: comm syz.4.3063: invalid indirect mapped block 2 (level 2) [ 656.476280][ C1] EXT4-fs (loop4): error count since last fsck: 1 [ 656.476316][ C1] EXT4-fs (loop4): initial error at time 1783870853: ext4_free_branches:1020: inode 11 [ 656.476364][ C1] EXT4-fs (loop4): last error at time 1783870853: ext4_free_branches:1020: inode 11 [ 656.515797][T14493] loop4: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 656.517893][T14493] EXT4-fs (loop4): 1 truncate cleaned up [ 656.533300][ T5630] Bluetooth: hci6: command tx timeout [ 656.565886][T14493] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000007 ro without journal. Quota mode: writeback. [ 656.598229][T14423] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 656.696767][T14423] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 656.809851][T14423] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 657.194407][ T5783] usb 5-1: new high-speed USB device number 107 using dummy_hcd [ 657.194640][T14423] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 657.233770][T14423] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 657.257727][T14423] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 657.276838][T14423] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 657.294664][T14423] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 657.312181][T14423] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 657.335972][T14423] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 657.360324][T14423] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 657.364349][ T5783] usb 5-1: Using ep0 maxpacket: 8 [ 657.398445][ T5783] usb 5-1: config 1 has an invalid descriptor of length 222, skipping remainder of the config [ 657.433117][ T5783] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 657.456606][ T30] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 657.478835][ T5783] usb 5-1: New USB device found, idVendor=0a92, idProduct=1020, bcdDevice= 0.40 [ 657.499576][ T24] usb 1-1: USB disconnect, device number 11 [ 657.518828][ T5783] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 657.552334][ T5783] usb 5-1: Product: syz [ 657.571194][ T5783] usb 5-1: Manufacturer: syz [ 657.585595][ T5783] usb 5-1: SerialNumber: syz [ 657.631265][T14423] 8021q: adding VLAN 0 to HW filter on device bond0 [ 657.633890][ T30] usb 7-1: Using ep0 maxpacket: 32 [ 657.646899][ T30] usb 7-1: too many endpoints for config 0 interface 0 altsetting 252: 223, using maximum allowed: 30 [ 657.669291][ T30] usb 7-1: config 0 interface 0 altsetting 252 has 1 endpoint descriptor, different from the interface descriptor's value: 223 [ 657.705771][ T30] usb 7-1: config 0 interface 0 has no altsetting 0 [ 657.729772][ T30] usb 7-1: New USB device found, idVendor=056a, idProduct=00c5, bcdDevice= 0.00 [ 657.730339][T14423] 8021q: adding VLAN 0 to HW filter on device team0 [ 657.759723][ T30] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 657.785380][ T1052] bridge0: port 1(bridge_slave_0) entered blocking state [ 657.792617][ T1052] bridge0: port 1(bridge_slave_0) entered forwarding state [ 657.817943][ T30] usb 7-1: config 0 descriptor?? [ 657.871184][T11845] bridge0: port 2(bridge_slave_1) entered blocking state [ 657.878426][T11845] bridge0: port 2(bridge_slave_1) entered forwarding state [ 658.040708][ T30] usbhid 7-1:0.0: can't add hid device: -71 [ 658.072160][ T30] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 658.138183][ T30] usb 7-1: USB disconnect, device number 7 [ 658.603676][ T5630] Bluetooth: hci6: command tx timeout [ 658.813683][ T955] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 658.953419][ T955] usb 1-1: device descriptor read/64, error -71 [ 659.014289][ T5855] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 659.183536][ T5855] usb 7-1: Using ep0 maxpacket: 32 [ 659.200221][ T5855] usb 7-1: config index 0 descriptor too short (expected 29220, got 36) [ 659.230511][ T5855] usb 7-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 659.248710][ T955] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 659.257885][ T5855] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 659.283502][ T5855] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 659.297855][ T5855] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 659.308173][ T5855] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 659.320980][ T5855] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 18 [ 659.343227][ T5855] usb 7-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 659.343326][ T5855] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 659.348312][ T5855] usb 7-1: config 0 descriptor?? [ 659.401683][T14423] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 659.408850][ T955] usb 1-1: device descriptor read/64, error -71 [ 659.518771][T14423] veth0_vlan: entered promiscuous mode [ 659.535505][ T955] usb usb1-port1: attempt power cycle [ 659.537985][T14423] veth1_vlan: entered promiscuous mode [ 659.589618][T14423] veth0_macvtap: entered promiscuous mode [ 659.601106][T14423] veth1_macvtap: entered promiscuous mode [ 659.622838][T14423] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 659.646996][T14423] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 659.676965][T12682] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 659.686098][T12682] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 659.695122][T12682] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 659.710994][T12682] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 659.836276][T11849] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 659.851848][T11849] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 659.882882][T11849] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 659.891727][ T955] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 659.900101][T11849] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 659.925545][ T955] usb 1-1: device descriptor read/8, error -71 [ 660.193460][ T955] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 660.236560][ T955] usb 1-1: device descriptor read/8, error -71 [ 660.973748][ T5630] Bluetooth: hci6: command tx timeout [ 661.116771][ T955] usb usb1-port1: unable to enumerate USB device [ 661.222165][ T955] usb 5-1: USB disconnect, device number 107 [ 661.364618][T14571] netlink: 14 bytes leftover after parsing attributes in process `syz.5.3083'. [ 661.450697][ T5634] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000007. [ 661.825961][ T5775] usb 7-1: USB disconnect, device number 8 [ 661.843570][ T955] usb 5-1: new high-speed USB device number 108 using dummy_hcd [ 661.943645][ T9] usb 3-1: new full-speed USB device number 84 using dummy_hcd [ 662.003602][ T955] usb 5-1: Using ep0 maxpacket: 32 [ 662.013918][ T955] usb 5-1: too many endpoints for config 0 interface 0 altsetting 252: 223, using maximum allowed: 30 [ 662.027030][ T955] usb 5-1: config 0 interface 0 altsetting 252 has 1 endpoint descriptor, different from the interface descriptor's value: 223 [ 662.042530][ T955] usb 5-1: config 0 interface 0 has no altsetting 0 [ 662.072021][ T955] usb 5-1: New USB device found, idVendor=056a, idProduct=00c5, bcdDevice= 0.00 [ 662.082279][ T955] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 662.109125][ T955] usb 5-1: config 0 descriptor?? [ 662.121236][ T9] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 662.139735][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 662.149321][ T9] usb 3-1: Product: syz [ 662.153872][ T9] usb 3-1: Manufacturer: syz [ 662.158545][ T9] usb 3-1: SerialNumber: syz [ 662.167403][ T9] usb 3-1: config 0 descriptor?? [ 662.323971][ T5783] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 662.327863][ T955] usbhid 5-1:0.0: can't add hid device: -71 [ 662.341148][ T955] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 662.353659][ T5870] usb 7-1: new full-speed USB device number 9 using dummy_hcd [ 662.354315][ T955] usb 5-1: USB disconnect, device number 108 [ 662.384763][ T9] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 662.485353][ T5783] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 662.495794][ T5783] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 662.507338][ T5783] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 662.525983][ T5783] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=67 [ 662.534884][ T5870] usb 7-1: unable to get BOS descriptor or descriptor too short [ 662.544426][ T5783] usb 1-1: SerialNumber: syz [ 662.554475][ T5870] usb 7-1: unable to read config index 0 descriptor/start: -71 [ 662.567075][ T5870] usb 7-1: can't read configurations, error -71 [ 662.795422][ T5783] usb 1-1: 0:2 : does not exist [ 662.877338][ T5783] usb 1-1: USB disconnect, device number 16 [ 662.981736][ T6055] udevd[6055]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 663.002114][ T9] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 663.363650][ T5775] usb 5-1: new high-speed USB device number 109 using dummy_hcd [ 663.513812][ T5775] usb 5-1: device descriptor read/64, error -71 [ 663.773351][ T5775] usb 5-1: new high-speed USB device number 110 using dummy_hcd [ 663.803654][ T5870] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 663.913664][ T5775] usb 5-1: device descriptor read/64, error -71 [ 663.963400][ T5870] usb 7-1: Using ep0 maxpacket: 32 [ 663.975907][ T5870] usb 7-1: config index 0 descriptor too short (expected 29220, got 36) [ 663.984367][ T5870] usb 7-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 663.993222][ T5870] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 664.002580][ T5870] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 664.012895][ T5870] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 664.023189][ T5870] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 664.025496][ T5775] usb usb5-port1: attempt power cycle [ 664.034204][ T5870] usb 7-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 664.034279][ T5870] usb 7-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 664.062169][ T5870] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 664.077141][ T5870] usb 7-1: config 0 descriptor?? [ 664.393458][ T5775] usb 5-1: new high-speed USB device number 111 using dummy_hcd [ 664.414156][ T5775] usb 5-1: device descriptor read/8, error -71 [ 664.684424][ T5775] usb 5-1: new high-speed USB device number 112 using dummy_hcd [ 664.692319][ T5749] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 664.714266][ T5775] usb 5-1: device descriptor read/8, error -71 [ 664.725417][ T24] usb 3-1: USB disconnect, device number 84 [ 664.823814][ T5775] usb usb5-port1: unable to enumerate USB device [ 664.853534][ T5749] usb 1-1: Using ep0 maxpacket: 32 [ 664.865798][ T5749] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 664.875755][ T5749] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 664.890803][ T5749] usb 1-1: config 0 descriptor?? [ 665.102062][ T5749] dvb-usb: found a 'Elgato EyeTV Sat' in cold state, will try to load a firmware [ 665.213429][ T24] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 665.363399][ T24] usb 3-1: Using ep0 maxpacket: 16 [ 665.370666][ T24] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 665.383397][ T24] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 665.392638][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 665.400783][ T24] usb 3-1: Product: syz [ 665.405063][ T24] usb 3-1: Manufacturer: syz [ 665.409697][ T24] usb 3-1: SerialNumber: syz [ 665.417440][ T24] usb 3-1: config 0 descriptor?? [ 666.525558][ T24] usb 7-1: USB disconnect, device number 11 [ 666.533405][ T5783] usb 5-1: new full-speed USB device number 113 using dummy_hcd [ 666.698989][ T5783] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 666.718554][ T5783] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 666.737557][ T5783] usb 5-1: Product: syz [ 666.747038][ T5783] usb 5-1: Manufacturer: syz [ 666.755664][ T5783] usb 5-1: SerialNumber: syz [ 666.777347][ T5783] usb 5-1: config 0 descriptor?? [ 666.993334][ T5783] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 667.093391][ T5775] usb 7-1: new full-speed USB device number 12 using dummy_hcd [ 667.250090][ T5775] usb 7-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice= 0.40 [ 667.259433][ T5775] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 667.269399][ T5775] usb 7-1: Product: syz [ 667.273818][ T5775] usb 7-1: Manufacturer: syz [ 667.278494][ T5775] usb 7-1: SerialNumber: syz [ 667.581245][T14670] loop0: detected capacity change from 0 to 512 [ 667.659453][T14670] EXT4-fs (loop0): ext4_check_descriptors: Checksum for group 0 failed (17031!=33349) [ 667.694757][T14670] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a84ce01c, mo2=0002] [ 667.714378][T14670] System zones: 1-12 [ 667.732729][T14670] EXT4-fs (loop0): orphan cleanup on readonly fs [ 667.756802][T14670] EXT4-fs error (device loop0): ext4_free_branches:1020: inode #11: comm syz.0.3126: invalid indirect mapped block 12 (level 1) [ 667.822787][T14670] loop0: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 667.823436][T14670] EXT4-fs error (device loop0): ext4_free_branches:1020: inode #11: comm syz.0.3126: invalid indirect mapped block 2 (level 2) [ 667.845911][ C0] EXT4-fs (loop0): error count since last fsck: 1 [ 667.845946][ C0] EXT4-fs (loop0): initial error at time 1783870864: ext4_free_branches:1020: inode 11 [ 667.846005][ C0] EXT4-fs (loop0): last error at time 1783870864: ext4_free_branches:1020: inode 11 [ 667.881496][T14670] loop0: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 667.901224][T14670] EXT4-fs (loop0): 1 truncate cleaned up [ 668.598793][T14670] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000007 ro without journal. Quota mode: writeback. [ 668.810244][ T5776] usb 3-1: USB disconnect, device number 85 [ 669.218493][ T5775] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 669.328420][ T5775] snd-usb-audio 7-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 669.530819][ T5783] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 669.558729][ T5783] usb 5-1: USB disconnect, device number 113 [ 669.753677][ T5776] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 669.849041][ T5775] usb 7-1: USB disconnect, device number 12 [ 669.850765][ T5648] udevd[5648]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 669.964249][ T5776] usb 3-1: Using ep0 maxpacket: 32 [ 669.972155][ T5776] usb 3-1: config index 0 descriptor too short (expected 29220, got 36) [ 669.981492][ T5776] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 669.994648][ T5776] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 670.017086][ T5776] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 670.027029][ T5776] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 670.044536][ T5776] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 670.063383][ T5776] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 670.098492][ T5776] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 670.130384][ T5776] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 670.163862][ T5776] usb 3-1: config 0 descriptor?? [ 670.240644][T14707] netlink: 'syz.5.3137': attribute type 10 has an invalid length. [ 670.563361][ T9] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 670.643538][ T5775] usb 5-1: new high-speed USB device number 114 using dummy_hcd [ 670.713343][ T9] usb 7-1: Using ep0 maxpacket: 32 [ 670.726976][ T9] usb 7-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 670.746729][ T9] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 670.780414][ T9] usb 7-1: config 0 descriptor?? [ 670.807921][ T5626] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000007. [ 671.639675][ T9] dvb-usb: found a 'Elgato EyeTV Sat' in cold state, will try to load a firmware [ 671.679402][ T5775] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 671.693577][ T5775] usb 5-1: New USB device found, idVendor=046d, idProduct=c71f, bcdDevice= 0.00 [ 671.703146][ T5775] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 671.728296][ T5775] usb 5-1: config 0 descriptor?? [ 671.735674][T14713] raw-gadget.4 gadget.4: fail, usb_ep_enable returned -22 [ 671.787850][T14723] overlayfs: failed to decode file handle (len=6, type=0, flags=0, err=-22) [ 672.165694][ T5775] hid_parser_main: 1 callbacks suppressed [ 672.165727][ T5775] logitech-djreceiver 0003:046D:C71F.0036: unknown main item tag 0x0 [ 672.180853][ T5775] logitech-djreceiver 0003:046D:C71F.0036: unknown main item tag 0x0 [ 672.189007][ T5775] logitech-djreceiver 0003:046D:C71F.0036: unknown main item tag 0x0 [ 672.197250][ T5775] logitech-djreceiver 0003:046D:C71F.0036: unknown main item tag 0x0 [ 672.206026][ T5775] logitech-djreceiver 0003:046D:C71F.0036: unknown main item tag 0x0 [ 672.214633][ T5775] logitech-djreceiver 0003:046D:C71F.0036: unknown main item tag 0x0 [ 672.222768][ T5775] logitech-djreceiver 0003:046D:C71F.0036: unknown main item tag 0x0 [ 672.231033][ T5775] logitech-djreceiver 0003:046D:C71F.0036: unknown main item tag 0x0 [ 672.239232][ T5775] logitech-djreceiver 0003:046D:C71F.0036: unknown main item tag 0x0 [ 672.247519][ T5775] logitech-djreceiver 0003:046D:C71F.0036: unknown main item tag 0x0 [ 672.257542][ T5775] logitech-djreceiver 0003:046D:C71F.0036: collection stack underflow [ 672.265799][ T5775] logitech-djreceiver 0003:046D:C71F.0036: item 0 1 0 12 parsing failed [ 672.274763][ T5775] logitech-djreceiver 0003:046D:C71F.0036: logi_dj_probe: parse failed [ 672.284906][ T5775] logitech-djreceiver 0003:046D:C71F.0036: probe with driver logitech-djreceiver failed with error -22 [ 672.365684][ T5775] usb 5-1: USB disconnect, device number 114 [ 672.561039][ T5775] usb 3-1: USB disconnect, device number 86 [ 673.084283][ T5775] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 673.255556][ T5775] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 673.283345][ T5775] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 673.304177][ T5775] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 673.319201][ T5775] usb 3-1: config 0 descriptor?? [ 673.331292][ T5775] pwc: Askey VC010 type 2 USB webcam detected. [ 673.544887][ T5775] pwc: send_video_command error -71 [ 673.557420][ T5775] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 673.568388][ T5775] Philips webcam 3-1:0.0: probe with driver Philips webcam failed with error -71 [ 673.584056][ T5775] usb 3-1: USB disconnect, device number 87 [ 673.670597][T14761] overlayfs: failed to decode file handle (len=6, type=248, flags=0, err=-22) [ 673.726629][ T5855] usb 5-1: new high-speed USB device number 115 using dummy_hcd [ 673.887301][ T5855] usb 5-1: unable to get BOS descriptor or descriptor too short [ 673.900100][ T5855] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 673.917621][ T5855] usb 5-1: string descriptor 0 read error: -22 [ 673.925446][ T5855] usb 5-1: New USB device found, idVendor=200c, idProduct=100b, bcdDevice= 0.40 [ 673.936188][ T5855] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 673.993411][ T5775] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 674.145827][ T5775] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 674.156353][ T5775] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 674.166141][ T5775] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 674.177396][ T5775] usb 3-1: config 0 descriptor?? [ 674.190109][ T5775] pwc: Askey VC010 type 2 USB webcam detected. [ 674.569425][ T5855] usb 5-1: 1:1: cannot get freq at ep 0x1 [ 674.728890][ T5855] usb 5-1: USB disconnect, device number 115 [ 674.789962][ T5775] pwc: recv_control_msg error -71 req 02 val 2700 [ 674.813095][ T5775] pwc: recv_control_msg error -71 req 02 val 2c00 [ 674.829521][ T5775] pwc: recv_control_msg error -71 req 04 val 1000 [ 674.841340][ T5775] pwc: recv_control_msg error -71 req 04 val 1300 [ 674.848518][ T5775] pwc: recv_control_msg error -71 req 04 val 1400 [ 674.855724][ T5775] pwc: recv_control_msg error -71 req 02 val 2000 [ 674.863829][ T5775] pwc: recv_control_msg error -71 req 02 val 2100 [ 674.871632][ T5775] pwc: recv_control_msg error -71 req 04 val 1500 [ 674.879046][ T5775] pwc: recv_control_msg error -71 req 02 val 2500 [ 674.886115][ T5775] pwc: recv_control_msg error -71 req 02 val 2400 [ 674.893093][ T5775] pwc: recv_control_msg error -71 req 02 val 2600 [ 674.900361][ T5775] pwc: recv_control_msg error -71 req 02 val 2900 [ 674.907595][ T5775] pwc: recv_control_msg error -71 req 02 val 2800 [ 674.914887][ T5775] pwc: recv_control_msg error -71 req 04 val 1100 [ 674.921732][ T5775] pwc: recv_control_msg error -71 req 04 val 1200 [ 674.940993][ T5775] pwc: Registered as video103. [ 674.951879][ T5775] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input64 [ 674.989081][ T5775] usb 3-1: USB disconnect, device number 88 [ 675.694375][ T5776] usb 3-1: new high-speed USB device number 89 using dummy_hcd [ 675.865276][ T5776] usb 3-1: Using ep0 maxpacket: 32 [ 675.872698][ T5776] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 675.886328][ T5776] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 675.899387][ T5776] usb 3-1: config 0 descriptor?? [ 676.053375][ T5783] usb 5-1: new high-speed USB device number 116 using dummy_hcd [ 676.119400][ T5776] dvb-usb: found a 'Elgato EyeTV Sat' in cold state, will try to load a firmware [ 676.213481][ T5783] usb 5-1: Using ep0 maxpacket: 16 [ 676.220478][ T5783] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 676.231181][ T5783] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 676.247417][ T5783] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 676.256640][ T5783] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 676.264719][ T5783] usb 5-1: Product: syz [ 676.268973][ T5783] usb 5-1: Manufacturer: syz [ 676.273669][ T5783] usb 5-1: SerialNumber: syz [ 676.281900][ T5783] usb 5-1: config 0 descriptor?? [ 678.204832][T14829] netlink: 'syz.0.3177': attribute type 10 has an invalid length. [ 678.983776][ T24] usb 5-1: USB disconnect, device number 116 [ 679.503360][ T5855] usb 5-1: new full-speed USB device number 117 using dummy_hcd [ 679.681376][ T5855] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 679.700209][ T5855] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 679.713411][ T5855] usb 5-1: Product: syz [ 679.717845][ T5855] usb 5-1: Manufacturer: syz [ 679.722490][ T5855] usb 5-1: SerialNumber: syz [ 679.730874][ T5855] usb 5-1: config 0 descriptor?? [ 679.944192][ T5855] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 681.796471][ T5855] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 681.811794][ T5855] usb 5-1: USB disconnect, device number 117 [ 683.373386][ T5870] usb 5-1: new high-speed USB device number 118 using dummy_hcd [ 683.543334][ T5870] usb 5-1: Using ep0 maxpacket: 8 [ 683.550140][ T5870] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 683.559956][ T5870] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 683.580695][ T5870] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 683.603384][ T5870] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 683.613924][ T5870] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 683.624033][ T5870] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 683.637290][ T5870] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 683.647551][ T5870] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 683.662502][ T5870] usbtmc 5-1:16.0: probe with driver usbtmc failed with error -22 [ 685.176517][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.183912][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 685.250464][ T5632] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 685.263057][ T5632] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 685.271147][ T5632] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 685.282376][ T5632] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 685.291661][ T5632] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 686.221952][ T5775] usb 5-1: USB disconnect, device number 118 [ 686.583147][T14945] bridge0: port 1(bridge_slave_0) entered blocking state [ 686.591738][T14945] bridge0: port 1(bridge_slave_0) entered disabled state [ 686.599024][T14945] bridge_slave_0: entered allmulticast mode [ 686.607526][T14945] bridge_slave_0: entered promiscuous mode [ 686.619027][T14945] bridge0: port 2(bridge_slave_1) entered blocking state [ 686.626534][T14945] bridge0: port 2(bridge_slave_1) entered disabled state [ 686.633798][T14945] bridge_slave_1: entered allmulticast mode [ 686.641437][T14945] bridge_slave_1: entered promiscuous mode [ 686.678172][T14945] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 686.691843][T14945] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 686.746293][T14945] team0: Port device team_slave_0 added [ 686.755830][T14945] team0: Port device team_slave_1 added [ 686.832412][T14945] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 686.839762][T14945] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 686.866270][T14945] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 686.880241][T14945] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 686.887939][T14945] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 686.915398][T14945] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 686.976896][T14945] hsr_slave_0: entered promiscuous mode [ 686.983842][T14945] hsr_slave_1: entered promiscuous mode [ 686.990419][T14945] debugfs: 'hsr0' already exists in 'hsr' [ 686.996350][T14945] Cannot create hsr debugfs directory [ 687.169928][T14945] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 687.251579][T14945] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 687.322267][T14945] team0: Port device netdevsim1 removed [ 687.328050][ T5630] Bluetooth: hci4: command tx timeout [ 687.340602][T14945] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 687.455781][T14945] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 687.692532][T14945] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 687.736644][T14945] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 687.756700][T14945] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 687.774897][T14945] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 687.784404][T14945] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 687.900567][T14945] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 687.936878][T14945] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 688.000745][T14945] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 688.083628][ T5855] usb 5-1: new high-speed USB device number 119 using dummy_hcd [ 689.069849][T14945] 8021q: adding VLAN 0 to HW filter on device bond0 [ 689.093361][ T5855] usb 5-1: Using ep0 maxpacket: 32 [ 689.116743][ T5855] usb 5-1: too many endpoints for config 0 interface 0 altsetting 252: 223, using maximum allowed: 30 [ 689.164461][ T5855] usb 5-1: config 0 interface 0 altsetting 252 has 1 endpoint descriptor, different from the interface descriptor's value: 223 [ 689.171755][T14945] 8021q: adding VLAN 0 to HW filter on device team0 [ 689.227009][ T8214] bridge0: port 1(bridge_slave_0) entered blocking state [ 689.229354][ T5855] usb 5-1: config 0 interface 0 has no altsetting 0 [ 689.234319][ T8214] bridge0: port 1(bridge_slave_0) entered forwarding state [ 689.288533][ T8214] bridge0: port 2(bridge_slave_1) entered blocking state [ 689.295779][ T8214] bridge0: port 2(bridge_slave_1) entered forwarding state [ 689.298759][ T5855] usb 5-1: New USB device found, idVendor=056a, idProduct=00c5, bcdDevice= 0.00 [ 689.360172][ T5855] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 689.402581][ T5855] usb 5-1: config 0 descriptor?? [ 689.407939][ T5630] Bluetooth: hci4: command tx timeout [ 689.935667][ T5855] usbhid 5-1:0.0: can't add hid device: -71 [ 689.941876][ T5855] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 689.962787][ T5855] usb 5-1: USB disconnect, device number 119 [ 690.194570][T14945] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 690.644858][T14945] veth0_vlan: entered promiscuous mode [ 690.657732][T14945] veth1_vlan: entered promiscuous mode [ 690.693177][T14945] veth0_macvtap: entered promiscuous mode [ 690.704739][T14945] veth1_macvtap: entered promiscuous mode [ 690.729994][T14945] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 690.746598][T14945] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 690.764606][ T138] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 690.774057][ T138] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 690.785111][ T138] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 690.793895][ T138] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 690.873745][ T5783] usb 5-1: new high-speed USB device number 120 using dummy_hcd [ 690.903152][ T138] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 690.920560][ T138] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 690.956203][ T138] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 690.965550][ T138] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 691.056844][ T5783] usb 5-1: unable to get BOS descriptor or descriptor too short [ 691.068773][ T5783] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 691.083588][ T5783] usb 5-1: string descriptor 0 read error: -22 [ 691.103480][ T5783] usb 5-1: New USB device found, idVendor=200c, idProduct=100b, bcdDevice= 0.40 [ 691.125063][ T5783] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 691.323362][ T5775] usb 6-1: new full-speed USB device number 83 using dummy_hcd [ 691.483402][ T5630] Bluetooth: hci4: command tx timeout [ 691.495591][ T5775] usb 6-1: config 0 has no interfaces? [ 691.504232][ T5775] usb 6-1: New USB device found, idVendor=0b48, idProduct=1003, bcdDevice=7b.54 [ 691.513502][ T5775] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 691.521590][ T5775] usb 6-1: Product: syz [ 691.527457][ T5775] usb 6-1: Manufacturer: syz [ 691.534107][ T5775] usb 6-1: SerialNumber: syz [ 691.546431][ T5775] usb 6-1: config 0 descriptor?? [ 691.771561][ T5783] usb 5-1: 1:1: cannot get freq at ep 0x1 [ 691.785793][ T5870] usb 6-1: USB disconnect, device number 83 [ 691.883097][ T5783] usb 5-1: USB disconnect, device number 120 [ 692.673435][ T955] usb 5-1: new high-speed USB device number 121 using dummy_hcd [ 692.753450][ T5775] usb 6-1: new high-speed USB device number 84 using dummy_hcd [ 692.845761][ T955] usb 5-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 692.854960][ T955] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 692.869251][ T955] usb 5-1: config 0 descriptor?? [ 692.878962][ T955] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 692.915311][ T5775] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 692.926287][ T5775] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 692.936355][ T5775] usb 6-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 692.945517][ T5775] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 692.956984][ T5775] usb 6-1: config 0 descriptor?? [ 693.381290][ T5775] hid_parser_main: 363 callbacks suppressed [ 693.381354][ T5775] cm6533_jd 0003:0D8C:0022.0037: unknown main item tag 0x0 [ 693.401368][ T5775] cm6533_jd 0003:0D8C:0022.0037: unknown main item tag 0x0 [ 693.411572][ T5775] cm6533_jd 0003:0D8C:0022.0037: unknown main item tag 0x0 [ 693.442201][ T5775] cm6533_jd 0003:0D8C:0022.0037: hiddev0,hidraw0: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.5-1/input0 [ 693.563395][ T5630] Bluetooth: hci4: command tx timeout [ 693.598736][ T5775] usb 6-1: USB disconnect, device number 84 [ 694.221499][T15094] binder: 15093:15094 ioctl c0306201 200000000040 returned -14 [ 694.312075][ T955] usb 5-1: USB disconnect, device number 121 [ 694.553446][ T5873] usb 6-1: new full-speed USB device number 85 using dummy_hcd [ 694.906311][ T5873] usb 6-1: config 0 has no interfaces? [ 694.915412][ T5873] usb 6-1: New USB device found, idVendor=0b48, idProduct=1003, bcdDevice=7b.54 [ 694.924810][ T5873] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 694.932838][ T5873] usb 6-1: Product: syz [ 694.937376][ T5873] usb 6-1: Manufacturer: syz [ 694.942126][ T5873] usb 6-1: SerialNumber: syz [ 695.656639][ T5873] usb 6-1: config 0 descriptor?? [ 695.794150][ T955] usb 5-1: new high-speed USB device number 122 using dummy_hcd [ 695.994651][ T955] usb 5-1: Using ep0 maxpacket: 8 [ 696.002396][ T955] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 696.010943][ T955] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 696.022098][ T955] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 696.032662][ T955] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 696.035103][ T5873] usb 6-1: USB disconnect, device number 85 [ 696.051027][ T955] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 696.068596][ T955] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 696.104766][ T955] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 696.115782][ T955] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 696.142693][ T955] usbtmc 5-1:16.0: probe with driver usbtmc failed with error -22 [ 697.164192][ T955] usb 6-1: new high-speed USB device number 86 using dummy_hcd [ 697.345348][ T955] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 697.355884][ T955] usb 6-1: config 0 has no interfaces? [ 697.361401][ T955] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 697.371841][ T955] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 697.382838][ T955] usb 6-1: config 0 descriptor?? [ 698.441283][ T5783] usb 5-1: USB disconnect, device number 122 [ 698.794531][ T5783] usb 5-1: new full-speed USB device number 123 using dummy_hcd [ 698.960180][ T5783] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 698.984777][ T5783] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 698.993058][ T5783] usb 5-1: Product: syz [ 698.998513][ T5783] usb 5-1: Manufacturer: syz [ 699.006433][ T5783] usb 5-1: SerialNumber: syz [ 699.025609][ T5783] usb 5-1: config 0 descriptor?? [ 699.043385][T15138] loop3: detected capacity change from 0 to 1024 [ 699.051235][T15138] EXT4-fs: Ignoring removed mblk_io_submit option [ 699.058502][T15138] EXT4-fs: inline encryption not supported [ 699.075130][T15138] EXT4-fs (loop3): can't mount with data_err=abort, fs mounted w/o journal [ 699.377890][ T5783] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 699.698836][T15148] netlink: 264 bytes leftover after parsing attributes in process `syz.3.3274'. [ 700.037036][ T30] usb 6-1: USB disconnect, device number 86 [ 700.493526][ T5873] usb 6-1: new full-speed USB device number 87 using dummy_hcd [ 700.634748][ T5873] usb 6-1: device descriptor read/64, error -71 [ 700.883412][ T5873] usb 6-1: new full-speed USB device number 88 using dummy_hcd [ 701.175730][ T5783] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 701.199365][ T5783] usb 5-1: USB disconnect, device number 123 [ 701.243556][ T5873] usb 6-1: device descriptor read/64, error -71 [ 701.370940][ T5873] usb usb6-port1: attempt power cycle [ 701.823625][T15177] loop3: detected capacity change from 0 to 1024 [ 701.861484][T15177] EXT4-fs: Ignoring removed mblk_io_submit option [ 701.904638][ T5873] usb 6-1: new full-speed USB device number 89 using dummy_hcd [ 701.933926][T15177] EXT4-fs: inline encryption not supported [ 701.979209][ T5873] usb 6-1: device descriptor read/8, error -71 [ 702.007688][T15177] EXT4-fs (loop3): can't mount with data_err=abort, fs mounted w/o journal [ 702.654613][T15188] netlink: 264 bytes leftover after parsing attributes in process `syz.4.3290'. [ 702.933498][ T5873] usb 6-1: new full-speed USB device number 90 using dummy_hcd [ 702.966031][ T5873] usb 6-1: device descriptor read/8, error -71 [ 703.105286][ T5873] usb usb6-port1: unable to enumerate USB device [ 703.503566][ T5783] usb 5-1: new high-speed USB device number 124 using dummy_hcd [ 703.635882][ T10] usb 6-1: new full-speed USB device number 91 using dummy_hcd [ 703.677145][ T5783] usb 5-1: Using ep0 maxpacket: 16 [ 703.692477][ T5783] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 703.715957][ T5783] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 703.750206][ T5783] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 703.776361][ T5783] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 703.803078][ T5783] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 703.846077][ T5783] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 703.855658][ T10] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 703.872266][ T5783] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 703.883421][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 703.896920][ T5783] usb 5-1: Manufacturer: syz [ 703.903282][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 703.927287][ T5783] usb 5-1: config 0 descriptor?? [ 703.927941][ T10] usb 6-1: New USB device found, idVendor=3823, idProduct=0001, bcdDevice= 3.eb [ 703.951345][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 703.981089][ T10] usb 6-1: Product: syz [ 703.993271][ T10] usb 6-1: Manufacturer: syz [ 704.004468][ T10] usb 6-1: SerialNumber: syz [ 704.022077][ T10] usb 6-1: config 0 descriptor?? [ 704.042517][T15203] raw-gadget.5 gadget.5: fail, usb_ep_enable returned -22 [ 704.271760][ T10] input: syz syz as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/input/input65 [ 704.273528][ T5783] rc_core: IR keymap rc-hauppauge not found [ 704.291353][ T5783] Registered IR keymap rc-empty [ 704.301980][ T5783] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 704.323372][ T5783] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 704.355215][ T5783] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 704.394068][ T5783] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input66 [ 704.440666][ T5783] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 704.474539][ T5783] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 704.480713][ T955] usb 6-1: USB disconnect, device number 91 [ 704.482335][ C1] usbtouchscreen 6-1:0.0: usbtouch_irq - usb_submit_urb failed with result: -19 [ 704.524591][ T5783] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 704.553415][ T5783] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 704.574242][ T5783] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 704.613510][ T5783] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 704.633423][ T5783] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 704.653402][ T5783] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 704.674734][ T5783] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 704.703938][ T5783] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 704.738654][ T5783] mceusb 5-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 704.748625][ T5783] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 704.768200][ T5783] usb 5-1: USB disconnect, device number 124 [ 707.013983][ T5775] usb 5-1: new high-speed USB device number 125 using dummy_hcd [ 707.022406][ T955] usb 6-1: new full-speed USB device number 92 using dummy_hcd [ 707.173681][ T955] usb 6-1: device descriptor read/64, error -71 [ 707.193848][ T5775] usb 5-1: Using ep0 maxpacket: 8 [ 707.208792][ T5775] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 707.226161][ T5775] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 707.250603][ T5775] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 707.265039][ T5775] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 707.278182][ T5775] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 707.294831][ T5775] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 707.308023][ T5775] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 707.453423][ T955] usb 6-1: new full-speed USB device number 93 using dummy_hcd [ 707.527843][ T5775] usb 5-1: usb_control_msg returned -32 [ 707.533604][ T5775] usbtmc 5-1:16.0: can't read capabilities [ 707.583369][ T955] usb 6-1: device descriptor read/64, error -71 [ 707.693827][ T955] usb usb6-port1: attempt power cycle [ 708.033657][ T955] usb 6-1: new full-speed USB device number 94 using dummy_hcd [ 708.055146][ T955] usb 6-1: device descriptor read/8, error -71 [ 708.235844][T15260] usbtmc 5-1:16.0: usb_control_msg returned -32 [ 708.303327][ T955] usb 6-1: new full-speed USB device number 95 using dummy_hcd [ 708.325372][ T955] usb 6-1: device descriptor read/8, error -71 [ 708.433850][ T955] usb usb6-port1: unable to enumerate USB device [ 710.597848][ T5873] usb 5-1: USB disconnect, device number 125 [ 710.835621][ T955] usb 6-1: new high-speed USB device number 96 using dummy_hcd [ 711.031215][ T955] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 711.085275][ T955] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 711.122084][ T955] usb 6-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 711.149930][ T955] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=67 [ 711.172623][ T955] usb 6-1: SerialNumber: syz [ 711.422098][ T955] usb 6-1: 0:2 : does not exist [ 711.557148][ T955] usb 6-1: USB disconnect, device number 96 [ 711.637595][ T5648] udevd[5648]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 711.833346][ T5870] usb 5-1: new high-speed USB device number 126 using dummy_hcd [ 711.986029][ T5870] usb 5-1: Using ep0 maxpacket: 32 [ 712.007422][ T5870] usb 5-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 712.037410][ T5870] usb 5-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 712.064770][ T5870] usb 5-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 712.076442][ T5870] usb 5-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 712.094191][ T5870] usb 5-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 712.113302][ T5870] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 712.121366][ T5870] usb 5-1: Product: syz [ 712.125848][ T5870] usb 5-1: Manufacturer: syz [ 712.130485][ T5870] usb 5-1: SerialNumber: syz [ 712.155195][ C1] imon 5-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 712.168136][ T5870] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/input/input67 [ 712.373417][ T5870] imon 5-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 712.382974][ T5870] (id 0x00) [ 712.463344][ T5870] rc_core: IR keymap rc-imon-pad not found [ 712.469477][ T5870] Registered IR keymap rc-empty [ 712.474746][ T5870] imon 5-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 712.486426][ T5870] imon 5-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 712.575020][ T5870] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/rc/rc0 [ 712.591951][ T5870] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/rc/rc0/input68 [ 712.623696][ T5870] imon 5-1:155.0: iMON device (15c2:ffdc, intf0) on usb<5:126> initialized [ 713.671004][ T5870] usb 5-1: USB disconnect, device number 126 [ 713.677879][T15314] imon:send_packet: packet tx failed (-71) [ 713.708812][T15314] imon:vfd_write: send packet #2 failed [ 713.770394][T15317] loop5: detected capacity change from 0 to 1024 [ 713.779697][T15317] EXT4-fs: Ignoring removed mblk_io_submit option [ 713.787118][T15317] EXT4-fs: inline encryption not supported [ 713.817588][T15317] EXT4-fs (loop5): can't mount with data_err=abort, fs mounted w/o journal [ 714.122673][T15319] bond0: (slave bond_slave_0): Releasing backup interface [ 715.072649][ T5783] usb 6-1: new high-speed USB device number 97 using dummy_hcd [ 715.257809][ T5783] usb 6-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 715.277755][ T5783] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 715.298884][ T5783] usb 6-1: config 0 descriptor?? [ 715.321380][ T5783] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 716.506668][ T5776] dvb-usb: did not find the firmware file 'dvb-usb-az6027-03.fw' (status -2). You can use /scripts/get_dvb_firmware to get the firmware [ 716.509135][ T5749] dvb-usb: did not find the firmware file 'dvb-usb-az6027-03.fw' (status -2). You can use /scripts/get_dvb_firmware to get the firmware [ 716.539857][ T9] dvb-usb: did not find the firmware file 'dvb-usb-az6027-03.fw' (status -2). You can use /scripts/get_dvb_firmware to get the firmware [ 716.565441][ T5768] dvb-usb: did not find the firmware file 'dvb-usb-az6027-03.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 716.581385][ T9] dvb_usb_az6027 7-1:0.0: probe with driver dvb_usb_az6027 failed with error -2 [ 716.606273][ T9] usb 7-1: USB disconnect, device number 13 [ 716.622939][ T5768] dvb_usb_az6027 4-1:0.0: probe with driver dvb_usb_az6027 failed with error -110 [ 716.627780][ T5776] dvb_usb_az6027 3-1:0.0: probe with driver dvb_usb_az6027 failed with error -2 [ 716.639464][ T5749] dvb_usb_az6027 1-1:0.0: probe with driver dvb_usb_az6027 failed with error -2 [ 716.690765][ T5768] usb 4-1: USB disconnect, device number 109 [ 716.718560][ T5776] usb 3-1: USB disconnect, device number 89 [ 716.726088][ T5749] usb 1-1: USB disconnect, device number 17 [ 717.133436][ T5749] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 717.194394][ T5783] usb 6-1: USB disconnect, device number 97 [ 717.344322][ T5749] usb 1-1: device descriptor read/all, error -71 [ 717.434096][ T5768] usb 7-1: new high-speed USB device number 14 using dummy_hcd [ 717.453945][ T9] usb 3-1: new high-speed USB device number 90 using dummy_hcd [ 717.593321][ T5768] usb 7-1: Using ep0 maxpacket: 32 [ 717.608850][ T5768] usb 7-1: config 0 has an invalid interface number: 132 but max is 0 [ 717.630721][ T9] usb 3-1: config 16 has too many interfaces: 90, using maximum allowed: 32 [ 717.641223][ T5768] usb 7-1: config 0 has no interface number 0 [ 717.653448][ T5855] usb 5-1: new high-speed USB device number 127 using dummy_hcd [ 717.662880][ T9] usb 3-1: config 16 has an invalid descriptor of length 20, skipping remainder of the config [ 717.673723][ T5768] usb 7-1: config 0 interface 132 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 717.707989][ T9] usb 3-1: config 16 has 0 interfaces, different from the descriptor's value: 90 [ 717.732180][ T9] usb 3-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 717.743372][ T5768] usb 7-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 717.759014][ T9] usb 3-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 717.767992][ T5768] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 717.782011][ T5768] usb 7-1: Product: syz [ 717.786309][ T9] usb 3-1: Manufacturer: syz [ 717.791493][ T5768] usb 7-1: Manufacturer: syz [ 717.796795][ T9] usb 3-1: SerialNumber: syz [ 717.804371][ T5768] usb 7-1: SerialNumber: syz [ 717.827202][ T5768] usb 7-1: config 0 descriptor?? [ 717.869753][ T5855] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 717.869798][ T5855] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 717.890746][ T5855] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 717.890823][ T5855] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=67 [ 717.890863][ T5855] usb 5-1: SerialNumber: syz [ 718.124643][ T5855] usb 5-1: 0:2 : does not exist [ 718.137381][ T5855] usb 5-1: unit 5 not found! [ 718.166372][T15391] netlink: 264 bytes leftover after parsing attributes in process `syz.0.3362'. [ 718.276907][ T5855] usb 5-1: USB disconnect, device number 127 [ 718.393050][ T6055] udevd[6055]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 720.071168][ T31] kauditd_printk_skb: 52 callbacks suppressed [ 720.071195][ T31] audit: type=1326 audit(1783870916.751:356): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15420 comm="syz.3.3373" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fe81239de59 code=0x0 [ 720.233909][ T5749] usb 6-1: new high-speed USB device number 98 using dummy_hcd [ 720.292341][ T9] usb 3-1: USB disconnect, device number 90 [ 720.327509][ T5768] usb 7-1: USB disconnect, device number 14 [ 720.418818][ T5749] usb 6-1: unable to get BOS descriptor or descriptor too short [ 720.453777][ T5749] usb 6-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 720.481580][ T5749] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 720.511562][ T5749] usb 6-1: Product: syz [ 720.524585][ T5749] usb 6-1: Manufacturer: syz [ 720.533653][ T5749] usb 6-1: SerialNumber: syz [ 720.564692][ T5749] usb 6-1: selecting invalid altsetting 1 [ 720.571280][ T5749] usb 6-1: unit 6 not found! [ 720.778311][ T5749] usb 6-1: 2:0: cannot get min/max values for control 1 (id 2) [ 720.813057][ T5749] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 720.835268][ T5749] usb 6-1: selecting invalid altsetting 1 [ 720.841972][ T5749] usb 6-1: unit 6 not found! [ 721.011856][ T5749] usb 6-1: 2:0: cannot get min/max values for control 1 (id 2) [ 721.080010][ T5749] snd-usb-audio 6-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 721.954263][ T5749] usb 6-1: selecting invalid altsetting 1 [ 721.975568][ T5749] usb 6-1: unit 6 not found! [ 722.027095][T15453] loop6: detected capacity change from 0 to 512 [ 722.070600][T15453] EXT4-fs (loop6): ext4_check_descriptors: Checksum for group 0 failed (17031!=33349) [ 722.115042][T15453] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a84ce01c, mo2=0002] [ 722.155793][T15453] System zones: 1-12 [ 722.179669][T15453] EXT4-fs (loop6): orphan cleanup on readonly fs [ 722.192302][ T5749] usb 6-1: 2:0: cannot get min/max values for control 1 (id 2) [ 722.219059][T15453] EXT4-fs error (device loop6): ext4_free_branches:1020: inode #11: comm syz.6.3385: invalid indirect mapped block 12 (level 1) [ 722.283120][T15453] loop6: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 722.284081][ C1] EXT4-fs (loop6): error count since last fsck: 1 [ 722.299815][ C1] EXT4-fs (loop6): initial error at time 1783870918: ext4_free_branches:1020: inode 11 [ 722.309560][ C1] EXT4-fs (loop6): last error at time 1783870918: ext4_free_branches:1020: inode 11 [ 722.361325][T15453] EXT4-fs error (device loop6): ext4_free_branches:1020: inode #11: comm syz.6.3385: invalid indirect mapped block 2 (level 2) [ 722.376250][ T5749] snd-usb-audio 6-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 722.410414][T15453] loop6: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 722.411037][T15453] EXT4-fs (loop6): 1 truncate cleaned up [ 722.416610][ T5749] usb 6-1: USB disconnect, device number 98 [ 722.457655][T15453] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000007 ro without journal. Quota mode: writeback. [ 722.484308][ T31] audit: type=1326 audit(1783870919.161:357): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15460 comm="syz.2.3388" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa1cd59de59 code=0x7ffc0000 [ 722.522377][ T5648] udevd[5648]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 722.543585][ T31] audit: type=1326 audit(1783870919.161:358): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15460 comm="syz.2.3388" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa1cd59de59 code=0x7ffc0000 [ 722.620957][ T31] audit: type=1326 audit(1783870919.161:359): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15460 comm="syz.2.3388" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa1cd59de59 code=0x7ffc0000 [ 722.692686][ T31] audit: type=1326 audit(1783870919.161:360): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15460 comm="syz.2.3388" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa1cd59de59 code=0x7ffc0000 [ 722.720808][ T5768] usb 4-1: new high-speed USB device number 110 using dummy_hcd [ 722.799961][ T31] audit: type=1326 audit(1783870919.161:361): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15460 comm="syz.2.3388" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fa1cd55e68e code=0x7ffc0000 [ 722.910904][ T31] audit: type=1326 audit(1783870919.161:362): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15460 comm="syz.2.3388" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa1cd59daeb code=0x7ffc0000 [ 722.937024][ T5873] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 722.945595][ T5768] usb 4-1: Using ep0 maxpacket: 32 [ 722.961021][ T5768] usb 4-1: config 0 has an invalid interface number: 132 but max is 0 [ 722.971147][ T31] audit: type=1326 audit(1783870919.161:363): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15460 comm="syz.2.3388" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa1cd59daeb code=0x7ffc0000 [ 722.998523][ T5768] usb 4-1: config 0 has no interface number 0 [ 723.007593][ T5768] usb 4-1: config 0 interface 132 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 723.032250][ T31] audit: type=1326 audit(1783870919.231:364): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15460 comm="syz.2.3388" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa1cd59daeb code=0x7ffc0000 [ 723.044424][ T5768] usb 4-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 723.072339][ T31] audit: type=1326 audit(1783870919.231:365): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15460 comm="syz.2.3388" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa1cd59daeb code=0x7ffc0000 [ 723.083261][ T5768] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 723.121121][ T5873] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 723.128463][ T5768] usb 4-1: Product: syz [ 723.139196][ T5873] usb 3-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 723.143277][ T5768] usb 4-1: Manufacturer: syz [ 723.158565][ T5873] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 723.163151][ T5768] usb 4-1: SerialNumber: syz [ 723.173820][ T5749] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 723.188700][ T5873] usb 3-1: config 0 descriptor?? [ 723.208116][ T5768] usb 4-1: config 0 descriptor?? [ 723.209656][ T5873] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 723.245573][ T5783] usb 6-1: new high-speed USB device number 99 using dummy_hcd [ 723.328165][ T5749] usb 7-1: Using ep0 maxpacket: 8 [ 723.350054][ T5749] usb 7-1: config 1 has an invalid descriptor of length 222, skipping remainder of the config [ 723.372924][ T5749] usb 7-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 723.396331][ T5749] usb 7-1: New USB device found, idVendor=0a92, idProduct=1020, bcdDevice= 0.40 [ 723.414115][ T5749] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 723.417566][ T5783] usb 6-1: unable to get BOS descriptor or descriptor too short [ 723.449064][ T5749] usb 7-1: Product: syz [ 723.449966][ T5783] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 723.453893][ T5749] usb 7-1: Manufacturer: syz [ 723.468400][ T5749] usb 7-1: SerialNumber: syz [ 723.476435][ T5783] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 723.489099][ T5783] usb 6-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 723.500109][ T5783] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 723.512270][ T5783] usb 6-1: Product: syz [ 723.516939][ T5783] usb 6-1: Manufacturer: syz [ 723.521942][ T5783] usb 6-1: SerialNumber: syz [ 723.548509][ T5783] usb 6-1: selecting invalid altsetting 1 [ 723.555295][ T5783] usb 6-1: unit 6 not found! [ 724.392026][ T5783] usb 6-1: 2:0: failed to get current value for ch 0 (-71) [ 724.465017][ T5783] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 724.483891][ T5783] usb 6-1: USB disconnect, device number 99 [ 724.551271][ T5648] udevd[5648]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 724.829511][T15494] netlink: 264 bytes leftover after parsing attributes in process `syz.0.3400'. [ 725.078390][ T31] kauditd_printk_skb: 714 callbacks suppressed [ 725.079052][ T31] audit: type=1326 audit(1783870921.701:1080): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15460 comm="syz.2.3388" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fa1cd55e68e code=0x7ffc0000 [ 725.645004][ T31] audit: type=1326 audit(1783870921.861:1081): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15460 comm="syz.2.3388" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fa1cd55e68e code=0x7ffc0000 [ 725.707969][ T5870] usb 3-1: USB disconnect, device number 91 [ 725.751882][T15497] binder: BINDER_SET_CONTEXT_MGR already set [ 725.804617][T15497] binder: 15496:15497 ioctl 4018620d 200000000040 returned -16 [ 725.809114][ T5749] usb 4-1: USB disconnect, device number 110 [ 725.814776][ T31] audit: type=1326 audit(1783870921.901:1082): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15460 comm="syz.2.3388" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fa1cd55e68e code=0x7ffc0000 [ 725.873403][ T5783] usb 7-1: USB disconnect, device number 15 [ 725.912409][ T31] audit: type=1326 audit(1783870921.911:1083): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15460 comm="syz.2.3388" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fa1cd55e68e code=0x7ffc0000 [ 726.006008][ T31] audit: type=1326 audit(1783870921.921:1084): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15460 comm="syz.2.3388" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fa1cd55e68e code=0x7ffc0000 [ 726.088766][ T31] audit: type=1326 audit(1783870922.011:1085): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15460 comm="syz.2.3388" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fa1cd55e68e code=0x7ffc0000 [ 726.169545][ T5966] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000007. [ 726.182157][ T31] audit: type=1326 audit(1783870922.071:1086): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15460 comm="syz.2.3388" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fa1cd55e68e code=0x7ffc0000 [ 726.221721][ T31] audit: type=1326 audit(1783870922.191:1087): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15460 comm="syz.2.3388" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fa1cd55e68e code=0x7ffc0000 [ 726.314179][ T5749] usb 4-1: new high-speed USB device number 111 using dummy_hcd [ 726.332649][T15513] loop5: detected capacity change from 0 to 7 [ 726.345906][T15513] Dev loop5: unable to read RDB block 7 [ 726.357701][T15513] loop5: unable to read partition table [ 726.373573][T15513] loop5: partition table beyond EOD, truncated [ 726.407665][T15513] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 726.495079][ T5749] usb 4-1: Using ep0 maxpacket: 16 [ 726.529648][ T5749] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 726.570797][ T5749] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 726.615597][ T5749] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 726.659269][ T5749] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 726.699122][ T5749] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 726.723933][ T5749] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 726.735773][ T5749] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 726.750095][ T5749] usb 4-1: Manufacturer: syz [ 726.785113][ T5749] usb 4-1: config 0 descriptor?? [ 726.923770][ T5768] usb 3-1: new full-speed USB device number 92 using dummy_hcd [ 727.040234][T15528] faux_driver vkms: [drm] Unknown color mode 7; guessing buffer size. [ 727.884142][ T5749] rc_core: IR keymap rc-hauppauge not found [ 727.890605][ T5749] Registered IR keymap rc-empty [ 727.903455][ T5749] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 727.913855][ T5768] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 727.933277][ T5768] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 727.941425][ T5768] usb 3-1: Product: syz [ 727.949847][ T5768] usb 3-1: Manufacturer: syz [ 727.954709][ T5749] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 727.974887][ T5768] usb 3-1: SerialNumber: syz [ 727.997180][ T5749] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 728.014946][ T5768] usb 3-1: config 0 descriptor?? [ 728.042388][ T5749] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input69 [ 728.080617][ T5749] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 728.113431][ T5749] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 728.146098][ T5749] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 728.183794][ T5749] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 728.213388][ T5749] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 728.223342][ T5775] usb 1-1: new full-speed USB device number 20 using dummy_hcd [ 728.242946][ T5768] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 728.253810][ T5749] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 728.293885][ T5749] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 728.303900][ T5783] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 728.313444][ T5749] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 728.333894][ T5749] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 728.363818][ T5749] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 728.387752][ T5749] mceusb 4-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 728.399580][ T5749] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 728.414594][ T5775] usb 1-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 728.429303][ T5749] usb 4-1: USB disconnect, device number 111 [ 728.435534][ T5775] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 728.450999][ T5775] usb 1-1: Product: syz [ 728.457982][ T5775] usb 1-1: Manufacturer: syz [ 728.462818][ T5775] usb 1-1: SerialNumber: syz [ 728.473351][ T5783] usb 7-1: Using ep0 maxpacket: 32 [ 728.494948][ T5775] usb 1-1: config 0 descriptor?? [ 728.495986][ T5783] usb 7-1: config 0 has an invalid interface number: 132 but max is 0 [ 728.520524][ T5775] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 728.542985][ T5783] usb 7-1: config 0 has no interface number 0 [ 728.563906][ T5783] usb 7-1: config 0 interface 132 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 728.605570][ T5783] usb 7-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 728.633890][ T5783] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 728.661829][ T5783] usb 7-1: Product: syz [ 728.673671][ T5783] usb 7-1: Manufacturer: syz [ 728.674965][T15543] loop5: detected capacity change from 0 to 512 [ 728.685077][ T5783] usb 7-1: SerialNumber: syz [ 728.700130][T15543] EXT4-fs (loop5): ext4_check_descriptors: Checksum for group 0 failed (17031!=33349) [ 728.726019][ T5783] usb 7-1: config 0 descriptor?? [ 728.769294][T15543] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a84ce01c, mo2=0002] [ 728.779155][T15543] System zones: 1-12 [ 728.783497][T15543] EXT4-fs (loop5): orphan cleanup on readonly fs [ 728.807569][T15543] EXT4-fs error (device loop5): ext4_free_branches:1020: inode #11: comm syz.5.3420: invalid indirect mapped block 12 (level 1) [ 728.822281][T15543] loop5: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 728.822735][T15543] EXT4-fs error (device loop5): ext4_free_branches:1020: inode #11: comm syz.5.3420: invalid indirect mapped block 2 (level 2) [ 728.831943][ C0] EXT4-fs (loop5): error count since last fsck: 1 [ 728.832007][ C0] EXT4-fs (loop5): initial error at time 1783870925: ext4_free_branches:1020: inode 11 [ 728.832062][ C0] EXT4-fs (loop5): last error at time 1783870925: ext4_free_branches:1020: inode 11 [ 728.906278][T15543] loop5: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 728.911559][T15543] EXT4-fs (loop5): 1 truncate cleaned up [ 728.933499][ T5749] usb 4-1: new high-speed USB device number 112 using dummy_hcd [ 728.953466][T15546] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 728.958759][T15543] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000007 ro without journal. Quota mode: writeback. [ 729.327243][ T5749] usb 4-1: config 16 has too many interfaces: 90, using maximum allowed: 32 [ 729.336183][ T5749] usb 4-1: config 16 has an invalid descriptor of length 20, skipping remainder of the config [ 729.346811][ T5749] usb 4-1: config 16 has 0 interfaces, different from the descriptor's value: 90 [ 729.358188][ T5749] usb 4-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 729.367868][ T5749] usb 4-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 729.373343][ T5870] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 729.378038][ T5749] usb 4-1: Manufacturer: syz [ 729.388320][ T5749] usb 4-1: SerialNumber: syz [ 729.535624][ T5870] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 729.546892][ T5783] usb 6-1: new high-speed USB device number 100 using dummy_hcd [ 729.554711][ T5870] usb 5-1: New USB device found, idVendor=046d, idProduct=c71f, bcdDevice= 0.00 [ 729.565029][ T5870] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 729.577233][ T5870] usb 5-1: config 0 descriptor?? [ 729.583966][T15550] raw-gadget.4 gadget.4: fail, usb_ep_enable returned -22 [ 729.642008][ T5749] usb 4-1: USB disconnect, device number 112 [ 729.682708][ T5768] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 729.697739][ T5768] usb 3-1: USB disconnect, device number 92 [ 729.713333][ T5783] usb 6-1: Using ep0 maxpacket: 8 [ 729.737481][ T5783] usb 6-1: config 1 has an invalid descriptor of length 222, skipping remainder of the config [ 729.749738][ T5783] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 729.761753][ T5783] usb 6-1: New USB device found, idVendor=0a92, idProduct=1020, bcdDevice= 0.40 [ 729.771109][ T5783] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 729.779340][ T5783] usb 6-1: Product: syz [ 729.784036][ T5783] usb 6-1: Manufacturer: syz [ 729.788682][ T5783] usb 6-1: SerialNumber: syz [ 730.009934][ T5870] logitech-djreceiver 0003:046D:C71F.0038: unknown main item tag 0x0 [ 730.027512][ T5870] logitech-djreceiver 0003:046D:C71F.0038: unknown main item tag 0x0 [ 730.036562][ T5870] logitech-djreceiver 0003:046D:C71F.0038: unknown main item tag 0x0 [ 730.045159][ T5870] logitech-djreceiver 0003:046D:C71F.0038: unknown main item tag 0x0 [ 730.054143][ T5870] logitech-djreceiver 0003:046D:C71F.0038: unknown main item tag 0x0 [ 730.062317][ T5870] logitech-djreceiver 0003:046D:C71F.0038: unknown main item tag 0x0 [ 730.072973][ T5870] logitech-djreceiver 0003:046D:C71F.0038: unknown main item tag 0x0 [ 730.082968][ T5870] logitech-djreceiver 0003:046D:C71F.0038: unknown main item tag 0x0 [ 730.091437][ T5870] logitech-djreceiver 0003:046D:C71F.0038: unknown main item tag 0x0 [ 730.100088][ T5870] logitech-djreceiver 0003:046D:C71F.0038: unknown main item tag 0x0 [ 730.223936][ T5768] usb 5-1: USB disconnect, device number 2 [ 730.523339][ T5870] usb 4-1: new low-speed USB device number 113 using dummy_hcd [ 730.675068][ T5870] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 730.682709][ T5870] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 730.694141][ T5870] usb 4-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 730.705962][ T5870] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 730.717401][ T5870] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 730.728710][ T5783] usb 3-1: new full-speed USB device number 93 using dummy_hcd [ 730.737956][ T5870] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 730.746073][ T5870] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 730.758063][ T5870] usb 4-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 730.785647][ T5870] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 730.796979][ T5870] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 730.811519][ T5870] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 730.831093][ T5870] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 730.842017][ T5870] usb 4-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 730.862142][ T5870] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 730.874196][ T5870] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 730.888939][ T5870] usb 4-1: string descriptor 0 read error: -22 [ 730.896902][ T5870] usb 4-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 730.907329][ T5870] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 730.916206][ T5783] usb 3-1: config 150 has an invalid interface number: 204 but max is 2 [ 730.926106][ T5783] usb 3-1: config 150 has an invalid descriptor of length 0, skipping remainder of the config [ 730.938609][ T5783] usb 3-1: config 150 has 1 interface, different from the descriptor's value: 3 [ 730.948292][ T5783] usb 3-1: config 150 has no interface number 0 [ 730.961572][ T5870] adutux 4-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 730.970617][ T5783] usb 3-1: config 150 interface 204 has no altsetting 0 [ 730.985853][ T5783] usb 3-1: New USB device found, idVendor=04e2, idProduct=1424, bcdDevice=c7.eb [ 730.995157][ T5783] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 731.003351][ T5783] usb 3-1: Product: syz [ 731.007739][ T5783] usb 3-1: Manufacturer: syz [ 731.012519][ T5783] usb 3-1: SerialNumber: syz [ 731.083463][ T5768] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 731.088860][ T5870] usb 7-1: USB disconnect, device number 16 [ 731.237321][ T5783] xr_serial 3-1:150.204: skipping garbage [ 731.257341][ T5768] usb 5-1: unable to get BOS descriptor or descriptor too short [ 731.282321][ T5768] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 731.293659][ T5768] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 731.308596][ T5768] usb 5-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 731.319412][ T5768] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 731.329216][ T5768] usb 5-1: Product: syz [ 731.333898][ T5768] usb 5-1: Manufacturer: syz [ 731.338671][ T5768] usb 5-1: SerialNumber: syz [ 731.373900][ T5768] usb 5-1: selecting invalid altsetting 1 [ 731.382752][ T5768] usb 5-1: unit 6 not found! [ 731.388826][ T5775] gspca_stk1135: reg_w 0x351 err -71 [ 731.417538][ T5775] gspca_stk1135: serial bus timeout: status=0x00 [ 731.444888][ T5775] gspca_stk1135: Sensor write failed [ 731.454565][ T5775] gspca_stk1135: serial bus timeout: status=0x00 [ 731.478901][ T5775] gspca_stk1135: Sensor write failed [ 731.488657][ T5775] gspca_stk1135: serial bus timeout: status=0x00 [ 731.495776][ T5775] gspca_stk1135: Sensor read failed [ 731.501158][ T5775] gspca_stk1135: serial bus timeout: status=0x00 [ 731.509160][ T5775] gspca_stk1135: Sensor read failed [ 731.515428][ T5775] gspca_stk1135: Detected sensor type unknown (0x0) [ 731.529811][ T5775] gspca_stk1135: serial bus timeout: status=0x00 [ 731.538258][ T5775] gspca_stk1135: Sensor read failed [ 731.543990][ T5775] gspca_stk1135: serial bus timeout: status=0x00 [ 731.550373][ T5775] gspca_stk1135: Sensor read failed [ 731.561635][ T5775] gspca_stk1135: serial bus timeout: status=0x00 [ 731.570867][ T5775] gspca_stk1135: Sensor write failed [ 731.577299][ T5775] gspca_stk1135: serial bus timeout: status=0x00 [ 731.583923][ T5775] gspca_stk1135: Sensor write failed [ 731.589335][ T5775] stk1135 1-1:0.0: probe with driver stk1135 failed with error -71 [ 731.615044][ T5775] usb 1-1: USB disconnect, device number 20 [ 731.693045][ T5870] usb 6-1: USB disconnect, device number 100 [ 731.763627][ T5749] usb 7-1: new full-speed USB device number 17 using dummy_hcd [ 731.779106][ T5768] usb 5-1: 2:0: cannot get min/max values for control 1 (id 2) [ 731.852628][T14945] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000007. [ 731.924522][ T5768] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 731.944074][ T5749] usb 7-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 731.972147][ T5749] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 731.998980][ T5749] usb 7-1: Product: syz [ 732.010425][ T5749] usb 7-1: Manufacturer: syz [ 732.021959][ T5749] usb 7-1: SerialNumber: syz [ 732.050582][ T5749] usb 7-1: config 0 descriptor?? [ 732.111291][ T5648] udevd[5648]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 732.266430][ T5749] usb 7-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 732.443349][ T5630] Bluetooth: hci6: command tx timeout [ 733.133368][ T5775] usb 6-1: new full-speed USB device number 101 using dummy_hcd [ 733.273422][ T5775] usb 6-1: device descriptor read/64, error -71 [ 733.318160][ T5768] usb 4-1: USB disconnect, device number 113 [ 733.534530][ T5775] usb 6-1: new full-speed USB device number 102 using dummy_hcd [ 733.571013][ T5783] usb 3-1: USB disconnect, device number 93 [ 733.667052][T15594] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3438'. [ 733.679851][ T5749] dvb_usb_rtl28xxu 7-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 733.694531][ T5775] usb 6-1: device descriptor read/64, error -71 [ 733.708361][ T5749] usb 7-1: USB disconnect, device number 17 [ 733.803710][ T5775] usb usb6-port1: attempt power cycle [ 733.810799][ T5768] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 733.852593][T15598] netlink: 264 bytes leftover after parsing attributes in process `syz.2.3440'. [ 733.872322][ T5783] usb 5-1: USB disconnect, device number 3 [ 733.976594][ T5768] usb 1-1: Using ep0 maxpacket: 32 [ 734.004014][ T5768] usb 1-1: unable to get BOS descriptor or descriptor too short [ 734.038584][ T5768] usb 1-1: config 14 has an invalid interface number: 57 but max is 1 [ 734.043744][T15603] loop2: detected capacity change from 0 to 512 [ 734.070593][ T5768] usb 1-1: config 14 has an invalid interface number: 228 but max is 1 [ 734.074512][T15603] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (17031!=33349) [ 734.104291][T15603] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a84ce01c, mo2=0002] [ 734.112993][ T5768] usb 1-1: config 14 has no interface number 0 [ 734.122110][ T5768] usb 1-1: config 14 has no interface number 1 [ 734.149883][T15603] System zones: 1-12 [ 734.154174][ T5768] usb 1-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 734.154602][T15603] EXT4-fs (loop2): orphan cleanup on readonly fs [ 734.165335][ T5775] usb 6-1: new full-speed USB device number 103 using dummy_hcd [ 734.184996][T15603] EXT4-fs error (device loop2): ext4_free_branches:1020: inode #11: comm syz.2.3443: invalid indirect mapped block 12 (level 1) [ 734.193332][ T5768] usb 1-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0x1B, changing to 0xB [ 734.225645][T15603] loop2: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 734.227228][T15603] EXT4-fs error (device loop2): ext4_free_branches:1020: inode #11: comm syz.2.3443: invalid indirect mapped block 2 (level 2) [ 734.236496][ C1] EXT4-fs (loop2): error count since last fsck: 1 [ 734.236529][ C1] EXT4-fs (loop2): initial error at time 1783870930: ext4_free_branches:1020: inode 11 [ 734.236585][ C1] EXT4-fs (loop2): last error at time 1783870930: ext4_free_branches:1020: inode 11 [ 734.270475][ T5768] usb 1-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 734.277230][T15603] loop2: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 734.288621][ T5775] usb 6-1: device descriptor read/8, error -71 [ 734.306127][T15603] EXT4-fs (loop2): 1 truncate cleaned up [ 734.321504][T15603] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000007 ro without journal. Quota mode: writeback. [ 734.357483][ T5768] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 734.394152][ T5768] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 734.424009][ T5768] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 0, changing to 7 [ 734.441839][ T5768] usb 1-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 734.457058][ T5768] usb 1-1: config 14 interface 57 has no altsetting 0 [ 734.504488][ T5768] usb 1-1: config 14 interface 228 has no altsetting 0 [ 734.530969][ T5768] usb 1-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 734.561412][ T5768] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 734.584003][ T5775] usb 6-1: new full-speed USB device number 104 using dummy_hcd [ 734.597421][ T5768] usb 1-1: Product: syz [ 734.609786][ T5768] usb 1-1: Manufacturer: syz [ 734.625093][ T5775] usb 6-1: device descriptor read/8, error -71 [ 734.635394][ T5768] usb 1-1: SerialNumber: syz [ 734.753761][ T5775] usb usb6-port1: unable to enumerate USB device [ 734.943319][ T5873] usb 4-1: new low-speed USB device number 114 using dummy_hcd [ 734.984296][ T5749] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 735.101109][ T5768] legousbtower 1-1:14.57: interrupt endpoints not found [ 735.115629][ T5873] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 735.123368][ T5873] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 735.135046][ T5873] usb 4-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 735.147018][ T5873] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 735.154171][ T5749] usb 3-1: Using ep0 maxpacket: 8 [ 735.158605][ T5873] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 735.166975][ T5749] usb 3-1: config 1 has an invalid descriptor of length 222, skipping remainder of the config [ 735.176017][ T5873] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 735.185838][ T5749] usb 3-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 735.192736][ T5873] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 735.205086][ T5749] usb 3-1: New USB device found, idVendor=0a92, idProduct=1020, bcdDevice= 0.40 [ 735.213401][ T5873] usb 4-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 735.221352][ T5749] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 735.237684][ T5873] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 735.241121][ T5749] usb 3-1: Product: syz [ 735.257813][ T5775] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 735.258787][ T5873] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 735.265756][ T5749] usb 3-1: Manufacturer: syz [ 735.278408][ T5873] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 735.282208][ T5749] usb 3-1: SerialNumber: syz [ 735.289430][ T5873] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 735.304559][ T5873] usb 4-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 735.319319][ T5873] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 735.331893][ T5873] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 735.350999][ T5873] usb 4-1: string descriptor 0 read error: -22 [ 735.357432][ T5873] usb 4-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 735.368718][ T5873] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 735.389467][ T5873] adutux 4-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 735.423526][ T5775] usb 5-1: Using ep0 maxpacket: 32 [ 735.430591][ T5775] usb 5-1: config 0 has an invalid interface number: 67 but max is 0 [ 735.439718][ T5775] usb 5-1: config 0 has no interface number 0 [ 735.448622][ T5775] usb 5-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 735.457817][ T5775] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 735.467364][ T5775] usb 5-1: Product: syz [ 735.471602][ T5775] usb 5-1: Manufacturer: syz [ 735.476505][ T5775] usb 5-1: SerialNumber: syz [ 735.484639][ T5775] usb 5-1: config 0 descriptor?? [ 735.533362][ T5768] legousbtower 1-1:14.228: LEGO USB Tower firmware version is 228.166 build 40507 [ 735.546364][ T5768] legousbtower 1-1:14.228: LEGO USB Tower #-159 now attached to major 180 minor 1 [ 736.001080][T15630] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3452'. [ 736.064052][ T5768] usb 7-1: new full-speed USB device number 18 using dummy_hcd [ 736.192141][T15632] sd 0:0:1:0: PR command failed: 1026 [ 736.199570][T15632] sd 0:0:1:0: Sense Key : Illegal Request [current] [ 736.207235][T15632] sd 0:0:1:0: Add. Sense: Invalid command operation code [ 736.242024][ T5768] usb 7-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 736.251948][ T5768] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 736.260712][ T5768] usb 7-1: Product: syz [ 736.265644][ T5768] usb 7-1: Manufacturer: syz [ 736.270345][ T5768] usb 7-1: SerialNumber: syz [ 736.282727][ T5768] usb 7-1: config 0 descriptor?? [ 736.504759][ T5768] usb 7-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 736.533608][ T5775] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -71 [ 736.554911][ T5775] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 736.568952][ T5775] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 736.583038][ T5775] smsc95xx 5-1:0.67: probe with driver smsc95xx failed with error -71 [ 736.603415][ T5775] usb 5-1: USB disconnect, device number 4 [ 737.132180][ T5873] usb 3-1: USB disconnect, device number 94 [ 737.331406][ T5775] usb 1-1: USB disconnect, device number 21 [ 737.466240][ T5775] legousbtower 1-1:14.228: LEGO USB Tower #-159 now disconnected [ 737.491005][T14423] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000007. [ 737.757101][ T30] usb 4-1: USB disconnect, device number 114 [ 737.892640][T15660] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3465'. [ 737.905545][ T5870] usb 6-1: new high-speed USB device number 105 using dummy_hcd [ 737.922909][ T5768] dvb_usb_rtl28xxu 7-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 737.954805][ T5768] usb 7-1: USB disconnect, device number 18 [ 737.964351][ T5873] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 738.083325][ T5870] usb 6-1: Using ep0 maxpacket: 32 [ 738.095845][ T5870] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 738.123782][ T5870] usb 6-1: config 0 has no interfaces? [ 738.133475][ T5873] usb 5-1: device descriptor read/64, error -71 [ 738.144936][ T5870] usb 6-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 738.154181][ T5870] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 738.162228][ T5870] usb 6-1: Product: syz [ 738.166754][ T5870] usb 6-1: Manufacturer: syz [ 738.171386][ T5870] usb 6-1: SerialNumber: syz [ 738.179687][ T5870] usb 6-1: config 0 descriptor?? [ 738.334470][ T5775] usb 4-1: new high-speed USB device number 115 using dummy_hcd [ 738.391705][ T5768] usb 6-1: USB disconnect, device number 105 [ 738.394125][ T5873] usb 5-1: new full-speed USB device number 6 using dummy_hcd [ 738.493557][ T5775] usb 4-1: Using ep0 maxpacket: 16 [ 738.506666][ T5775] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 738.523051][ T5775] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 738.533381][ T5873] usb 5-1: device descriptor read/64, error -71 [ 738.535704][ T5775] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 738.550464][ T5775] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 738.561699][ T5775] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 738.577736][ T5775] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 738.587397][ T5775] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 738.595637][ T5775] usb 4-1: Manufacturer: syz [ 738.608883][ T5775] usb 4-1: config 0 descriptor?? [ 738.663756][ T5873] usb usb5-port1: attempt power cycle [ 739.013377][ T5873] usb 5-1: new full-speed USB device number 7 using dummy_hcd [ 739.054036][ T5873] usb 5-1: device descriptor read/8, error -71 [ 739.123416][ T5768] usb 7-1: new full-speed USB device number 19 using dummy_hcd [ 739.273667][ T5768] usb 7-1: device descriptor read/64, error -71 [ 739.303313][ T5873] usb 5-1: new full-speed USB device number 8 using dummy_hcd [ 739.334132][ T5873] usb 5-1: device descriptor read/8, error -71 [ 739.451505][T15687] loop5: detected capacity change from 0 to 512 [ 739.461193][ T5873] usb usb5-port1: unable to enumerate USB device [ 739.485950][T15687] EXT4-fs (loop5): ext4_check_descriptors: Checksum for group 0 failed (17031!=33349) [ 739.509780][T15687] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a84ce01c, mo2=0002] [ 739.529264][T15687] System zones: 1-12 [ 739.539146][T15687] EXT4-fs (loop5): orphan cleanup on readonly fs [ 739.544843][ T5768] usb 7-1: new full-speed USB device number 20 using dummy_hcd [ 739.566555][T15687] EXT4-fs error (device loop5): ext4_free_branches:1020: inode #11: comm syz.5.3476: invalid indirect mapped block 12 (level 1) [ 739.644447][T15687] loop5: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 739.644886][T15687] EXT4-fs error (device loop5): ext4_free_branches:1020: inode #11: comm syz.5.3476: invalid indirect mapped block 2 (level 2) [ 739.654154][ C0] EXT4-fs (loop5): error count since last fsck: 1 [ 739.654188][ C0] EXT4-fs (loop5): initial error at time 1783870936: ext4_free_branches:1020: inode 11 [ 739.654249][ C0] EXT4-fs (loop5): last error at time 1783870936: ext4_free_branches:1020: inode 11 [ 739.696991][T15687] loop5: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 739.697510][T15687] EXT4-fs (loop5): 1 truncate cleaned up [ 739.719603][T15687] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000007 ro without journal. Quota mode: writeback. [ 739.753370][ T5768] usb 7-1: device descriptor read/64, error -71 [ 739.873979][ T5768] usb usb7-port1: attempt power cycle [ 740.246210][ T5873] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 740.253539][ T5768] usb 7-1: new full-speed USB device number 21 using dummy_hcd [ 740.274709][T15695] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3479'. [ 740.286181][ T5768] usb 7-1: device descriptor read/8, error -71 [ 740.293470][ T5870] usb 6-1: new high-speed USB device number 106 using dummy_hcd [ 740.405744][ T5873] usb 1-1: unable to get BOS descriptor or descriptor too short [ 740.426026][ T5873] usb 1-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 740.435535][ T5873] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 740.443753][ T5873] usb 1-1: Product: syz [ 740.448033][ T5873] usb 1-1: Manufacturer: syz [ 740.452695][ T5873] usb 1-1: SerialNumber: syz [ 740.464685][ T5870] usb 6-1: Using ep0 maxpacket: 8 [ 740.481009][ T5870] usb 6-1: config 1 has an invalid descriptor of length 222, skipping remainder of the config [ 740.493784][ T5870] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 740.508420][ T5873] usb 1-1: selecting invalid altsetting 1 [ 740.518145][ T5870] usb 6-1: New USB device found, idVendor=0a92, idProduct=1020, bcdDevice= 0.40 [ 740.530649][ T5873] usb 1-1: unit 6 not found! [ 740.533915][ T5768] usb 7-1: new full-speed USB device number 22 using dummy_hcd [ 740.536343][ T5870] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 740.552772][ T5870] usb 6-1: Product: syz [ 740.557226][ T5870] usb 6-1: Manufacturer: syz [ 740.561876][ T5870] usb 6-1: SerialNumber: syz [ 740.564576][ T5768] usb 7-1: device descriptor read/8, error -71 [ 740.686000][ T5768] usb usb7-port1: unable to enumerate USB device [ 740.712777][ T5873] usb 1-1: 2:0: cannot get min/max values for control 1 (id 2) [ 740.725189][ T5873] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 740.752647][ T5873] usb 1-1: selecting invalid altsetting 1 [ 740.766188][ T5783] usb 3-1: new full-speed USB device number 95 using dummy_hcd [ 740.774616][ T5873] usb 1-1: unit 6 not found! [ 740.922924][ T5873] usb 1-1: 2:0: cannot get min/max values for control 1 (id 2) [ 740.940819][ T5873] snd-usb-audio 1-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 740.952902][ T5783] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 740.965797][ T5783] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 740.975286][ T5873] usb 1-1: selecting invalid altsetting 1 [ 740.983459][ T5873] usb 1-1: unit 6 not found! [ 740.988156][ T5783] usb 3-1: Product: syz [ 740.992983][ T5783] usb 3-1: Manufacturer: syz [ 740.998338][ T5783] usb 3-1: SerialNumber: syz [ 741.009081][ T5783] usb 3-1: config 0 descriptor?? [ 741.227355][ T5783] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 741.243874][ T5775] rc_core: IR keymap rc-hauppauge not found [ 741.263288][ T5775] Registered IR keymap rc-empty [ 741.268297][ T5775] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 741.303360][ T5775] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 741.335112][ T5775] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 741.336969][ T5873] usb 1-1: 2:0: cannot get min/max values for control 1 (id 2) [ 741.378747][ T5775] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input70 [ 741.407676][ T5775] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 741.441137][ T5873] snd-usb-audio 1-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 741.453545][ T5775] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 741.455533][ T5873] usb 1-1: USB disconnect, device number 22 [ 741.493955][ T5775] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 741.537597][ T5775] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 741.547491][ T5629] udevd[5629]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 741.584441][ T5775] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 741.605924][ T5775] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 741.633354][ T5775] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 741.653386][ T5775] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 741.683594][ T5775] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 741.703377][ T5775] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 741.726550][ T5775] mceusb 4-1:0.0: Registered with mce emulator interface version 1 [ 741.734842][ T5775] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 741.750154][ T5775] usb 4-1: USB disconnect, device number 115 [ 742.293644][ T5749] usb 7-1: new high-speed USB device number 23 using dummy_hcd [ 742.475173][ T5749] usb 7-1: Using ep0 maxpacket: 32 [ 742.487738][ T5749] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 742.509589][ T5749] usb 7-1: config 0 has no interfaces? [ 742.517533][ T5768] usb 6-1: USB disconnect, device number 106 [ 742.538157][ T5749] usb 7-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 742.562611][ T5749] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 742.582035][ T5749] usb 7-1: Product: syz [ 742.591611][ T5749] usb 7-1: Manufacturer: syz [ 742.601741][ T5749] usb 7-1: SerialNumber: syz [ 742.614486][ T5873] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 742.625606][ T5749] usb 7-1: config 0 descriptor?? [ 742.637906][T15726] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3492'. [ 742.662873][ T5783] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 742.685568][ T5775] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 742.692320][ T5783] usb 3-1: USB disconnect, device number 95 [ 742.742943][T14945] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000007. [ 742.786364][ T5873] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 742.829904][ T5873] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 742.856533][ T5873] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 742.857096][ T5749] usb 7-1: USB disconnect, device number 23 [ 742.875815][ T5775] usb 5-1: Using ep0 maxpacket: 32 [ 742.885989][ T5775] usb 5-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 742.900981][ T5775] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 742.907426][ T5873] usb 1-1: config 0 descriptor?? [ 742.935133][ T5873] pwc: Askey VC010 type 2 USB webcam detected. [ 742.948041][ T5775] usb 5-1: config 0 descriptor?? [ 743.083438][ T5768] usb 6-1: new high-speed USB device number 107 using dummy_hcd [ 743.103364][ T30] usb 4-1: new full-speed USB device number 116 using dummy_hcd [ 743.164496][ T5775] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 743.175500][ T5775] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 743.185986][ T5775] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 743.203353][ T5775] usb 5-1: media controller created [ 743.221735][ T5775] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 743.234539][ T30] usb 4-1: device descriptor read/64, error -71 [ 743.260518][ T5768] usb 6-1: unable to get BOS descriptor or descriptor too short [ 743.286640][ T5768] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7 [ 743.310004][ T5768] usb 6-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 743.320216][ T5768] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 743.330164][ T5873] pwc: recv_control_msg error -32 req 02 val 2b00 [ 743.339239][ T5768] usb 6-1: Product: syz [ 743.344986][ T5873] pwc: recv_control_msg error -32 req 02 val 2700 [ 743.354893][ T5768] usb 6-1: Manufacturer: syz [ 743.356307][ T5873] pwc: recv_control_msg error -32 req 02 val 2c00 [ 743.359568][ T5768] usb 6-1: SerialNumber: syz [ 743.377341][ T5873] pwc: recv_control_msg error -32 req 04 val 1000 [ 743.397390][ T5873] pwc: recv_control_msg error -32 req 04 val 1300 [ 743.416936][ T5873] pwc: recv_control_msg error -32 req 04 val 1400 [ 743.439329][ T5873] pwc: recv_control_msg error -32 req 02 val 2000 [ 743.464032][ T5873] pwc: recv_control_msg error -32 req 02 val 2100 [ 743.490997][ T30] usb 4-1: new full-speed USB device number 117 using dummy_hcd [ 743.501828][ T5873] pwc: recv_control_msg error -32 req 04 val 1500 [ 743.515394][ T5873] pwc: recv_control_msg error -32 req 02 val 2500 [ 743.529005][ T5873] pwc: recv_control_msg error -32 req 02 val 2400 [ 743.542879][ T5873] pwc: recv_control_msg error -32 req 02 val 2600 [ 743.557883][ T5873] pwc: recv_control_msg error -32 req 02 val 2900 [ 743.571536][ T5873] pwc: recv_control_msg error -71 req 02 val 2800 [ 743.588699][ T5873] pwc: recv_control_msg error -71 req 04 val 1100 [ 743.599211][ T5873] pwc: recv_control_msg error -71 req 04 val 1200 [ 743.619546][ T5873] pwc: Registered as video103. [ 743.623554][ T5768] usb 6-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 743.633460][ T30] usb 4-1: device descriptor read/64, error -71 [ 743.665506][ T5873] input: PWC snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/input/input71 [ 743.713015][ T5873] usb 1-1: USB disconnect, device number 23 [ 743.765297][ T30] usb usb4-port1: attempt power cycle [ 743.819350][ T5768] usb 6-1: 2:1 : unknown format tag 0x4 is detected. processed as MPEG. [ 743.848812][ T5768] usb 6-1: found format II with max.bitrate = 4, frame size=7372 [ 743.873270][ T5768] usb 6-1: parse_audio_format_rates_v2v3(): unable to find clock source (clock -22) [ 743.896215][ T5768] usb 6-1: 2:1 : unknown format tag 0x4 is detected. processed as MPEG. [ 743.908044][ T5768] usb 6-1: found format II with max.bitrate = 4, frame size=7372 [ 743.923327][ T5768] usb 6-1: parse_audio_format_rates_v2v3(): unable to find clock source (clock -22) [ 744.003749][ T5775] az6027: usb out operation failed. (-71) [ 744.010142][ T5775] stb0899_attach: Driver disabled by Kconfig [ 744.016697][ T5775] az6027: no front-end attached [ 744.016697][ T5775] [ 744.025772][ T5775] az6027: usb out operation failed. (-71) [ 744.031508][ T5775] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 744.033821][ T5783] usb 3-1: new full-speed USB device number 96 using dummy_hcd [ 744.044039][ T5775] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input72 [ 744.068244][ T5775] dvb-usb: schedule remote query interval to 400 msecs. [ 744.075771][ T5775] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 744.093065][ T5775] usb 5-1: USB disconnect, device number 9 [ 744.113707][ T30] usb 4-1: new full-speed USB device number 118 using dummy_hcd [ 744.154171][ T5775] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 744.154871][ T30] usb 4-1: device descriptor read/8, error -71 [ 744.174948][ T5783] usb 3-1: device descriptor read/64, error -71 [ 744.433321][ T5783] usb 3-1: new full-speed USB device number 97 using dummy_hcd [ 744.453644][ T30] usb 4-1: new full-speed USB device number 119 using dummy_hcd [ 744.485849][ T30] usb 4-1: device descriptor read/8, error -71 [ 744.539936][ T5768] usb 6-1: USB disconnect, device number 107 [ 744.573981][ T5783] usb 3-1: device descriptor read/64, error -71 [ 744.614319][ T30] usb usb4-port1: unable to enumerate USB device [ 744.684259][ T5654] udevd[5654]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 744.703561][ T5783] usb usb3-port1: attempt power cycle [ 744.849666][T15756] loop4: detected capacity change from 0 to 512 [ 744.871523][T15756] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (17031!=33349) [ 744.903832][T15756] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a84ce01c, mo2=0002] [ 744.922089][T15756] System zones: 1-12 [ 744.928380][T15756] EXT4-fs (loop4): orphan cleanup on readonly fs [ 744.936057][T15756] EXT4-fs error (device loop4): ext4_free_branches:1020: inode #11: comm syz.4.3505: invalid indirect mapped block 12 (level 1) [ 744.949997][T15756] loop4: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 744.951438][T15756] EXT4-fs error (device loop4): ext4_free_branches:1020: inode #11: comm syz.4.3505: invalid indirect mapped block 2 (level 2) [ 744.960779][ C1] EXT4-fs (loop4): error count since last fsck: 1 [ 744.960846][ C1] EXT4-fs (loop4): initial error at time 1783870941: ext4_free_branches:1020: inode 11 [ 744.960902][ C1] EXT4-fs (loop4): last error at time 1783870941: ext4_free_branches:1020: inode 11 [ 744.999787][T15756] loop4: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 745.000879][T15756] EXT4-fs (loop4): 1 truncate cleaned up [ 745.020427][T15756] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000007 ro without journal. Quota mode: writeback. [ 745.073321][ T5783] usb 3-1: new full-speed USB device number 98 using dummy_hcd [ 745.094082][ T5783] usb 3-1: device descriptor read/8, error -71 [ 745.334012][ T5783] usb 3-1: new full-speed USB device number 99 using dummy_hcd [ 745.384813][ T5783] usb 3-1: device descriptor read/8, error -71 [ 745.391665][T15761] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3506'. [ 745.514032][ T5783] usb usb3-port1: unable to enumerate USB device [ 745.603363][ T30] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 745.663447][ T5768] usb 7-1: new high-speed USB device number 24 using dummy_hcd [ 745.673358][ T5870] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 745.743301][ T9] usb 6-1: new high-speed USB device number 108 using dummy_hcd [ 745.763326][ T30] usb 5-1: Using ep0 maxpacket: 8 [ 745.769865][ T30] usb 5-1: config 1 has an invalid descriptor of length 222, skipping remainder of the config [ 745.782082][ T30] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 745.793688][ T30] usb 5-1: New USB device found, idVendor=0a92, idProduct=1020, bcdDevice= 0.40 [ 745.802778][ T30] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 745.811195][ T30] usb 5-1: Product: syz [ 745.815717][ T30] usb 5-1: Manufacturer: syz [ 745.815712][ T5768] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 745.820339][ T30] usb 5-1: SerialNumber: syz [ 745.836729][ T5768] usb 7-1: New USB device found, idVendor=046d, idProduct=c71f, bcdDevice= 0.00 [ 745.845892][ T5768] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 745.846806][ T5870] usb 1-1: config 16 has too many interfaces: 90, using maximum allowed: 32 [ 745.867040][ T5768] usb 7-1: config 0 descriptor?? [ 745.879135][ T5870] usb 1-1: config 16 has an invalid descriptor of length 20, skipping remainder of the config [ 745.891066][T15764] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 745.898669][ T5870] usb 1-1: config 16 has 0 interfaces, different from the descriptor's value: 90 [ 745.903331][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 745.910391][ T5870] usb 1-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 745.929343][ T5870] usb 1-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 745.938561][ T5870] usb 1-1: Manufacturer: syz [ 745.952893][ T9] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 745.958079][ T5870] usb 1-1: SerialNumber: syz [ 745.973562][ T9] usb 6-1: config 0 has no interfaces? [ 746.000766][ T9] usb 6-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 746.026906][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 746.035223][ T9] usb 6-1: Product: syz [ 746.039444][ T9] usb 6-1: Manufacturer: syz [ 746.044211][ T9] usb 6-1: SerialNumber: syz [ 746.060497][ T9] usb 6-1: config 0 descriptor?? [ 746.201668][ T5870] usb 1-1: USB disconnect, device number 24 [ 746.274499][ T5783] usb 6-1: USB disconnect, device number 108 [ 746.320443][ T5768] hid_parser_main: 462 callbacks suppressed [ 746.320476][ T5768] logitech-djreceiver 0003:046D:C71F.0039: unknown main item tag 0x0 [ 746.337435][ T5768] logitech-djreceiver 0003:046D:C71F.0039: unknown main item tag 0x0 [ 746.343523][ T30] usb 4-1: new full-speed USB device number 120 using dummy_hcd [ 746.345605][ T5768] logitech-djreceiver 0003:046D:C71F.0039: unknown main item tag 0x0 [ 746.345647][ T5768] logitech-djreceiver 0003:046D:C71F.0039: unknown main item tag 0x0 [ 746.345687][ T5768] logitech-djreceiver 0003:046D:C71F.0039: unknown main item tag 0x0 [ 746.345725][ T5768] logitech-djreceiver 0003:046D:C71F.0039: unknown main item tag 0x0 [ 746.345804][ T5768] logitech-djreceiver 0003:046D:C71F.0039: unknown main item tag 0x0 [ 746.394131][ T5768] logitech-djreceiver 0003:046D:C71F.0039: unknown main item tag 0x0 [ 746.402247][ T5768] logitech-djreceiver 0003:046D:C71F.0039: unknown main item tag 0x0 [ 746.410397][ T5768] logitech-djreceiver 0003:046D:C71F.0039: unknown main item tag 0x0 [ 746.518066][ T30] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 746.525690][ T5768] usb 7-1: USB disconnect, device number 24 [ 746.533620][ T30] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 746.542685][ T30] usb 4-1: Product: syz [ 746.551616][ T30] usb 4-1: Manufacturer: syz [ 746.558312][ T30] usb 4-1: SerialNumber: syz [ 746.569111][ T30] usb 4-1: config 0 descriptor?? [ 746.605373][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 746.611839][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 746.795691][ T30] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 747.065008][ T5783] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 747.125235][ T5775] usb 3-1: new high-speed USB device number 100 using dummy_hcd [ 747.236095][ T5783] usb 1-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 747.248951][ T5783] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 747.268845][ T5783] usb 1-1: config 0 descriptor?? [ 747.293380][ T5783] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 747.293554][ T5775] usb 3-1: Using ep0 maxpacket: 8 [ 747.325599][ T5775] usb 3-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 747.336237][ T5775] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 747.350511][ T5775] usb 3-1: Product: syz [ 747.354814][ T5775] usb 3-1: Manufacturer: syz [ 747.359555][ T5775] usb 3-1: SerialNumber: syz [ 747.368405][ T5775] usb 3-1: config 0 descriptor?? [ 747.383548][ T5775] gspca_main: se401-2.14.0 probing 047d:5003 [ 747.455503][ T5873] usb 7-1: new high-speed USB device number 25 using dummy_hcd [ 747.623489][ T5873] usb 7-1: Using ep0 maxpacket: 8 [ 747.630693][ T5873] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 747.642378][ T5873] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 747.655875][ T5873] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 747.667152][ T5873] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 747.683004][ T5873] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 747.692251][ T5873] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 747.792016][ T5775] gspca_se401: ExtraFeatures: 31 [ 747.797076][ T5775] gspca_se401: Frame size: 0x0 1/16th janggu [ 747.803096][ T5775] gspca_se401: Frame size: 2x0 bayer [ 747.808563][ T5775] gspca_se401: Frame size: 1x0 1/4th janggu [ 747.814772][ T5775] gspca_se401: Frame size: 0x0 1/16th janggu [ 747.833332][ T5768] usb 6-1: new high-speed USB device number 109 using dummy_hcd [ 747.899475][ T9] usb 5-1: USB disconnect, device number 10 [ 747.927295][ T5873] usb 7-1: GET_CAPABILITIES returned 0 [ 747.943326][ T5873] usbtmc 7-1:16.0: can't read capabilities [ 747.983275][ T5768] usb 6-1: Using ep0 maxpacket: 32 [ 747.995837][ T5768] usb 6-1: config 2 has an invalid interface number: 88 but max is 0 [ 748.021811][ T5775] input: se401 as /devices/platform/dummy_hcd.2/usb3/3-1/input/input73 [ 748.030788][ T5768] usb 6-1: config 2 has no interface number 0 [ 748.041147][ T5768] usb 6-1: config 2 interface 88 altsetting 25 bulk endpoint 0x6 has invalid maxpacket 256 [ 748.052484][ T5768] usb 6-1: config 2 interface 88 has no altsetting 0 [ 748.074106][ T5775] usb 3-1: USB disconnect, device number 100 [ 748.090084][ T5768] usb 6-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.06 [ 748.100940][ T5768] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 748.108793][ T5634] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000007. [ 748.121022][ T5768] usb 6-1: Product: syz [ 748.144861][ C0] usbtmc 7-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 748.154181][ C0] usbtmc 7-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 748.163487][ C0] usbtmc 7-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 748.186330][ T5768] usb 6-1: Manufacturer: syz [ 748.208795][ T5768] usb 6-1: SerialNumber: syz [ 748.230910][ T9] usb 7-1: USB disconnect, device number 25 [ 748.251461][T15790] raw-gadget.5 gadget.5: fail, usb_ep_enable returned -22 [ 748.259714][ T30] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 748.308268][ T30] usb 4-1: USB disconnect, device number 120 [ 748.482369][T15790] raw-gadget.5 gadget.5: fail, usb_ep_enable returned -22 [ 748.747182][ T5783] usb 1-1: USB disconnect, device number 25 [ 749.164096][ T30] usb 7-1: new high-speed USB device number 26 using dummy_hcd [ 749.213526][ T5783] usb 4-1: new full-speed USB device number 121 using dummy_hcd [ 749.333305][ T30] usb 7-1: Using ep0 maxpacket: 32 [ 749.344019][ T30] usb 7-1: config 0 has an invalid interface number: 132 but max is 0 [ 749.364802][ T5783] usb 4-1: device descriptor read/64, error -71 [ 749.375514][ T30] usb 7-1: config 0 has no interface number 0 [ 749.391431][ T30] usb 7-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 749.419724][ T30] usb 7-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 749.429342][ T30] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 749.437768][ T30] usb 7-1: Product: syz [ 749.441979][ T30] usb 7-1: Manufacturer: syz [ 749.447349][ T30] usb 7-1: SerialNumber: syz [ 749.462998][ T30] usb 7-1: config 0 descriptor?? [ 749.474924][ T30] em28xx 7-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 749.491746][ T30] em28xx 7-1:0.132: Video interface 132 found: [ 749.553452][ T9] usb 5-1: new full-speed USB device number 11 using dummy_hcd [ 749.623460][ T5783] usb 4-1: new full-speed USB device number 122 using dummy_hcd [ 749.633431][ T5775] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 749.683356][ T9] usb 5-1: device descriptor read/64, error -71 [ 749.726961][ T5768] asix 6-1:2.88 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 749.739502][ T5768] asix 6-1:2.88 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffb9 [ 749.750373][ T5768] asix 6-1:2.88: probe with driver asix failed with error -71 [ 749.764635][ T5783] usb 4-1: device descriptor read/64, error -71 [ 749.777071][ T5768] usb 6-1: USB disconnect, device number 109 [ 749.783528][ T5775] usb 1-1: Using ep0 maxpacket: 32 [ 749.799362][ T5775] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 749.811959][ T5775] usb 1-1: config 0 has no interfaces? [ 749.833088][ T5775] usb 1-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 749.846091][ T5775] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 749.860294][ T5775] usb 1-1: Product: syz [ 749.866909][ T5775] usb 1-1: Manufacturer: syz [ 749.871553][ T5775] usb 1-1: SerialNumber: syz [ 749.877945][ T30] em28xx 7-1:0.132: unknown em28xx chip ID (0) [ 749.892944][ T5775] usb 1-1: config 0 descriptor?? [ 749.904849][ T5783] usb usb4-port1: attempt power cycle [ 749.923366][ T9] usb 5-1: new full-speed USB device number 12 using dummy_hcd [ 750.053311][ T9] usb 5-1: device descriptor read/64, error -71 [ 750.110464][ T5768] usb 1-1: USB disconnect, device number 26 [ 750.165198][ T9] usb usb5-port1: attempt power cycle [ 750.254684][ T5783] usb 4-1: new full-speed USB device number 123 using dummy_hcd [ 750.289233][ T30] em28xx 7-1:0.132: reading from i2c device at 0xa0 failed: couldn't get the received message from the bridge (error=-5) [ 750.312317][ T5783] usb 4-1: device descriptor read/8, error -71 [ 750.327927][ T30] em28xx 7-1:0.132: board has no eeprom [ 750.433338][ T30] em28xx 7-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 750.447339][ T30] em28xx 7-1:0.132: analog set to bulk mode. [ 750.454242][ T5870] em28xx 7-1:0.132: Registering V4L2 extension [ 750.525545][ T9] usb 5-1: new full-speed USB device number 13 using dummy_hcd [ 750.564578][ T5783] usb 4-1: new full-speed USB device number 124 using dummy_hcd [ 750.569247][ T5775] usb 7-1: USB disconnect, device number 26 [ 750.589455][ T9] usb 5-1: device descriptor read/8, error -71 [ 750.607095][ T5775] em28xx 7-1:0.132: Disconnecting em28xx [ 750.609784][ T5783] usb 4-1: device descriptor read/8, error -71 [ 750.644132][ T5768] usb 6-1: new high-speed USB device number 110 using dummy_hcd [ 750.734932][ T5783] usb usb4-port1: unable to enumerate USB device [ 750.775025][T15827] loop2: detected capacity change from 0 to 512 [ 750.788310][T15827] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (17031!=33349) [ 750.799447][ T5870] em28xx 7-1:0.132: Config register raw data: 0xffffffed [ 750.814677][T15827] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a84ce01c, mo2=0002] [ 750.824285][ T5870] em28xx 7-1:0.132: AC97 chip type couldn't be determined [ 750.828320][T15829] syzkaller1: entered promiscuous mode [ 750.837206][ T5768] usb 6-1: Using ep0 maxpacket: 8 [ 750.842455][T15829] syzkaller1: entered allmulticast mode [ 750.850901][ T5870] em28xx 7-1:0.132: No AC97 audio processor [ 750.853040][ T5768] usb 6-1: New USB device found, idVendor=10c4, idProduct=8244, bcdDevice=dc.00 [ 750.857066][T15827] System zones: [ 750.866076][ T9] usb 5-1: new full-speed USB device number 14 using dummy_hcd [ 750.877429][ T5768] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 750.885718][ T5768] usb 6-1: Product: syz [ 750.888590][T15827] 1-12 [ 750.890400][ T5768] usb 6-1: Manufacturer: syz [ 750.897516][ T5768] usb 6-1: SerialNumber: syz [ 750.898577][ T5870] usb 7-1: Decoder not found [ 750.905713][ T5768] usb 6-1: config 0 descriptor?? [ 750.916674][T15827] EXT4-fs (loop2): orphan cleanup on readonly fs [ 750.924053][ T9] usb 5-1: device descriptor read/8, error -71 [ 750.936047][ T5870] em28xx 7-1:0.132: failed to create media graph [ 750.950282][T15827] EXT4-fs error (device loop2): ext4_free_branches:1020: inode #11: comm syz.2.3531: invalid indirect mapped block 12 (level 1) [ 750.993786][ T5870] em28xx 7-1:0.132: V4L2 device video103 deregistered [ 751.014210][T15827] loop2: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 751.014555][T15827] EXT4-fs error (device loop2): ext4_free_branches:1020: inode #11: comm syz.2.3531: invalid indirect mapped block 2 (level 2) [ 751.023833][ C1] EXT4-fs (loop2): error count since last fsck: 1 [ 751.023863][ C1] EXT4-fs (loop2): initial error at time 1783870947: ext4_free_branches:1020: inode 11 [ 751.023919][ C1] EXT4-fs (loop2): last error at time 1783870947: ext4_free_branches:1020: inode 11 [ 751.043577][ T9] usb usb5-port1: unable to enumerate USB device [ 751.048201][ T5870] em28xx 7-1:0.132: Remote control support is not available for this card. [ 751.055684][T15831] ================================================================== [ 751.086162][T15831] BUG: KASAN: slab-use-after-free in v4l2_open+0x351/0x490 [ 751.093382][T15831] Read of size 4 at addr ffff888079848860 by task v4l_id/15831 [ 751.100924][T15831] [ 751.103252][T15831] CPU: 0 UID: 0 PID: 15831 Comm: v4l_id Tainted: G L syzkaller #0 PREEMPT(full) [ 751.103305][T15831] Tainted: [L]=SOFTLOCKUP [ 751.103319][T15831] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 751.103341][T15831] Call Trace: [ 751.103353][T15831] [ 751.103367][T15831] dump_stack_lvl+0x100/0x190 [ 751.103407][T15831] print_report+0x13d/0x4b0 [ 751.103460][T15831] ? srso_alias_return_thunk+0x5/0xfbef5 [ 751.103504][T15831] ? __virt_addr_valid+0x239/0x430 [ 751.103544][T15831] ? v4l2_open+0x351/0x490 [ 751.103587][T15831] kasan_report+0xdf/0x1c0 [ 751.103646][T15831] ? v4l2_open+0x351/0x490 [ 751.103695][T15831] v4l2_open+0x351/0x490 [ 751.103744][T15831] ? __pfx_v4l2_open+0x10/0x10 [ 751.103787][T15831] chrdev_open+0x234/0x6a0 [ 751.103834][T15831] ? __pfx_chrdev_open+0x10/0x10 [ 751.103881][T15831] ? srso_alias_return_thunk+0x5/0xfbef5 [ 751.103924][T15831] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 751.103986][T15831] do_dentry_open+0x6ab/0x14d0 [ 751.104028][T15831] ? __pfx_chrdev_open+0x10/0x10 [ 751.104076][T15831] ? srso_alias_return_thunk+0x5/0xfbef5 [ 751.104122][T15831] vfs_open+0x82/0x3f0 [ 751.104172][T15831] ? srso_alias_return_thunk+0x5/0xfbef5 [ 751.104220][T15831] path_openat+0x2873/0x4280 [ 751.104277][T15831] ? __pfx_path_openat+0x10/0x10 [ 751.104331][T15831] do_file_open+0x20e/0x430 [ 751.104380][T15831] ? __pfx_do_file_open+0x10/0x10 [ 751.104443][T15831] ? srso_alias_return_thunk+0x5/0xfbef5 [ 751.104487][T15831] ? alloc_fd+0x471/0x7a0 [ 751.104536][T15831] ? do_getname+0x191/0x390 [ 751.104594][T15831] do_sys_openat2+0x10f/0x1e0 [ 751.104648][T15831] ? __pfx_do_sys_openat2+0x10/0x10 [ 751.104707][T15831] ? srso_alias_return_thunk+0x5/0xfbef5 [ 751.104758][T15831] __x64_sys_openat+0x12d/0x210 [ 751.104815][T15831] ? __pfx___x64_sys_openat+0x10/0x10 [ 751.104873][T15831] ? srso_alias_return_thunk+0x5/0xfbef5 [ 751.104918][T15831] ? srso_alias_return_thunk+0x5/0xfbef5 [ 751.104965][T15831] do_syscall_64+0x115/0x870 [ 751.105002][T15831] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 751.105040][T15831] RIP: 0033:0x7f456fea7407 [ 751.105067][T15831] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 751.105103][T15831] RSP: 002b:00007ffe5fd43e90 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 751.105140][T15831] RAX: ffffffffffffffda RBX: 00007f4570587880 RCX: 00007f456fea7407 [ 751.105165][T15831] RDX: 0000000000000000 RSI: 00007ffe5fd44f1c RDI: ffffffffffffff9c [ 751.105189][T15831] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 751.105212][T15831] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 751.105235][T15831] R13: 00007ffe5fd440e0 R14: 00007f457068c000 R15: 0000556e805b94d8 [ 751.105272][T15831] [ 751.105285][T15831] [ 751.382224][T15831] Allocated by task 5870: [ 751.386546][T15831] kasan_save_stack+0x30/0x50 [ 751.391250][T15831] kasan_save_track+0x14/0x30 [ 751.395948][T15831] __kasan_kmalloc+0xaa/0xb0 [ 751.400559][T15831] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 751.405943][T15831] em28xx_v4l2_init.cold+0x94/0x3a40 [ 751.411256][T15831] em28xx_init_extension+0x13a/0x200 [ 751.416573][T15831] request_module_async+0x61/0x80 [ 751.421621][T15831] process_one_work+0xa23/0x1940 [ 751.426589][T15831] worker_thread+0x5ef/0xe50 [ 751.431201][T15831] kthread+0x370/0x450 [ 751.435290][T15831] ret_from_fork+0x72b/0xd50 [ 751.439892][T15831] ret_from_fork_asm+0x1a/0x30 [ 751.444675][T15831] [ 751.446992][T15831] Freed by task 5870: [ 751.450961][T15831] kasan_save_stack+0x30/0x50 [ 751.455681][T15831] kasan_save_track+0x14/0x30 [ 751.460386][T15831] kasan_save_free_info+0x3b/0x70 [ 751.465421][T15831] __kasan_slab_free+0x5f/0x80 [ 751.470208][T15831] kfree+0x22b/0x6c0 [ 751.474109][T15831] kref_put.isra.0+0x53/0x75 [ 751.478726][T15831] em28xx_v4l2_init.cold+0x280/0x3a40 [ 751.484122][T15831] em28xx_init_extension+0x13a/0x200 [ 751.489428][T15831] request_module_async+0x61/0x80 [ 751.494474][T15831] process_one_work+0xa23/0x1940 [ 751.499435][T15831] worker_thread+0x5ef/0xe50 [ 751.504056][T15831] kthread+0x370/0x450 [ 751.508148][T15831] ret_from_fork+0x72b/0xd50 [ 751.512753][T15831] ret_from_fork_asm+0x1a/0x30 [ 751.517534][T15831] [ 751.519847][T15831] The buggy address belongs to the object at ffff888079848000 [ 751.519847][T15831] which belongs to the cache kmalloc-8k of size 8192 [ 751.533898][T15831] The buggy address is located 2144 bytes inside of [ 751.533898][T15831] freed 8192-byte region [ffff888079848000, ffff88807984a000) [ 751.547876][T15831] [ 751.550189][T15831] The buggy address belongs to the physical page: [ 751.556589][T15831] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x79848 [ 751.565352][T15831] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 751.573851][T15831] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 751.581394][T15831] page_type: f5(slab) [ 751.585376][T15831] raw: 00fff00000000040 ffff88813fe24280 dead000000000122 0000000000000000 [ 751.593963][T15831] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 751.602554][T15831] head: 00fff00000000040 ffff88813fe24280 dead000000000122 0000000000000000 [ 751.611229][T15831] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 751.619905][T15831] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 751.628578][T15831] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 751.637240][T15831] page dumped because: kasan: bad access detected [ 751.643644][T15831] page_owner tracks the page as allocated [ 751.649379][T15831] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 15804, tgid 15803 (syz.4.3524), ts 749373603858, free_ts 749341826435 [ 751.670932][T15831] post_alloc_hook+0xfd/0x120 [ 751.675624][T15831] get_page_from_freelist+0xf48/0x3530 [ 751.681102][T15831] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 751.687015][T15831] new_slab+0xa2/0x650 [ 751.691094][T15831] refill_objects+0xe3/0x410 [ 751.695700][T15831] __pcs_replace_empty_main+0x376/0x680 [ 751.701257][T15831] __kmalloc_noprof+0x66d/0x820 [ 751.706126][T15831] ops_init+0x77/0x5f0 [ 751.710293][T15831] setup_net+0x118/0x3a0 [ 751.714545][T15831] copy_net_ns+0x46f/0x7c0 [ 751.718978][T15831] create_new_namespaces+0x3ea/0xac0 [ 751.724278][T15831] unshare_nsproxy_namespaces+0xf2/0x220 [ 751.729937][T15831] ksys_unshare+0x438/0xab0 [ 751.734454][T15831] __x64_sys_unshare+0x31/0x40 [ 751.739234][T15831] do_syscall_64+0x115/0x870 [ 751.743828][T15831] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 751.749730][T15831] page last free pid 15804 tgid 15803 stack trace: [ 751.756223][T15831] __free_frozen_pages+0x79f/0x1090 [ 751.761431][T15831] qlist_free_all+0x47/0xf0 [ 751.765949][T15831] kasan_quarantine_reduce+0x1a0/0x1f0 [ 751.771427][T15831] __kasan_slab_alloc+0x69/0x90 [ 751.776328][T15831] __kmalloc_cache_noprof+0x265/0x6c0 [ 751.781716][T15831] kset_create_and_add+0x4d/0x190 [ 751.786756][T15831] netdev_register_kobject+0x1ef/0x3d0 [ 751.792238][T15831] register_netdevice+0x15b6/0x25a0 [ 751.797446][T15831] register_netdev+0x34/0x50 [ 751.802046][T15831] ip6gre_init_net+0x2aa/0x420 [ 751.806839][T15831] ops_init+0x1e2/0x5f0 [ 751.811005][T15831] setup_net+0x118/0x3a0 [ 751.815257][T15831] copy_net_ns+0x46f/0x7c0 [ 751.819701][T15831] create_new_namespaces+0x3ea/0xac0 [ 751.824997][T15831] unshare_nsproxy_namespaces+0xf2/0x220 [ 751.830643][T15831] ksys_unshare+0x438/0xab0 [ 751.835166][T15831] [ 751.837481][T15831] Memory state around the buggy address: [ 751.843101][T15831] ffff888079848700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 751.851159][T15831] ffff888079848780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 751.859222][T15831] >ffff888079848800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 751.867277][T15831] ^ [ 751.874466][T15831] ffff888079848880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 751.882533][T15831] ffff888079848900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 751.890589][T15831] ================================================================== [ 751.911796][T15827] loop2: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 751.917131][ T5775] em28xx 7-1:0.132: Closing input extension [ 751.934719][ T5775] ================================================================== [ 751.942783][ T5775] BUG: KASAN: slab-use-after-free in media_device_unregister+0x59d/0x610 [ 751.951230][ T5775] Read of size 8 at addr ffff888079848210 by task kworker/0:6/5775 [ 751.959121][ T5775] [ 751.961448][ T5775] CPU: 0 UID: 0 PID: 5775 Comm: kworker/0:6 Tainted: G L syzkaller #0 PREEMPT(full) [ 751.961500][ T5775] Tainted: [L]=SOFTLOCKUP [ 751.961514][ T5775] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 751.961540][ T5775] Workqueue: usb_hub_wq hub_event [ 751.961583][ T5775] Call Trace: [ 751.961595][ T5775] [ 751.961609][ T5775] dump_stack_lvl+0x100/0x190 [ 751.961648][ T5775] print_report+0x13d/0x4b0 [ 751.961707][ T5775] ? srso_alias_return_thunk+0x5/0xfbef5 [ 751.961752][ T5775] ? __virt_addr_valid+0x239/0x430 [ 751.961793][ T5775] ? media_device_unregister+0x59d/0x610 [ 751.961847][ T5775] kasan_report+0xdf/0x1c0 [ 751.961907][ T5775] ? media_device_unregister+0x59d/0x610 [ 751.961967][ T5775] media_device_unregister+0x59d/0x610 [ 751.962025][ T5775] em28xx_unregister_media_device+0x4e/0xe0 [ 751.962084][ T5775] em28xx_release_resources+0x79/0x1b0 [ 751.962140][ T5775] em28xx_usb_disconnect.cold+0x17d/0x253 [ 751.962199][ T5775] usb_unbind_interface+0x1dd/0x9e0 [ 751.962250][ T5775] ? srso_alias_return_thunk+0x5/0xfbef5 [ 751.962295][ T5775] ? __pfx_usb_unbind_interface+0x10/0x10 [ 751.962343][ T5775] device_remove+0x12a/0x180 [ 751.962384][ T5775] device_release_driver_internal+0x44e/0x620 [ 751.962432][ T5775] ? __entry_text_end+0x1020b5/0x1020b9 [ 751.962479][ T5775] bus_remove_device+0x2bc/0x560 [ 751.962517][ T5775] ? __pfx_bus_remove_device+0x10/0x10 [ 751.962553][ T5775] ? __pfx_device_remove_attrs+0x10/0x10 [ 751.962598][ T5775] device_del+0x376/0x9b0 [ 751.962639][ T5775] ? __pfx_device_del+0x10/0x10 [ 751.962677][ T5775] ? kobject_put+0xb9/0x640 [ 751.962757][ T5775] ? srso_alias_return_thunk+0x5/0xfbef5 [ 751.962806][ T5775] usb_disable_device+0x367/0x810 [ 751.962852][ T5775] usb_disconnect+0x2e2/0x9a0 [ 751.962896][ T5775] hub_event+0x1d0c/0x4af0 [ 751.962953][ T5775] ? srso_alias_return_thunk+0x5/0xfbef5 [ 751.962998][ T5775] ? __lock_acquire+0x49f/0x1a40 [ 751.963034][ T5775] ? do_raw_spin_unlock+0x145/0x1e0 [ 751.963081][ T5775] ? __pfx_hub_event+0x10/0x10 [ 751.963121][ T5775] ? debug_object_deactivate+0x2e4/0x3b0 [ 751.963172][ T5775] ? srso_alias_return_thunk+0x5/0xfbef5 [ 751.963220][ T5775] ? srso_alias_return_thunk+0x5/0xfbef5 [ 751.963271][ T5775] ? srso_alias_return_thunk+0x5/0xfbef5 [ 751.963319][ T5775] ? rcu_is_watching+0x12/0xc0 [ 751.963376][ T5775] process_one_work+0xa23/0x1940 [ 751.963444][ T5775] ? __pfx_process_one_work+0x10/0x10 [ 751.963501][ T5775] ? srso_alias_return_thunk+0x5/0xfbef5 [ 751.963552][ T5775] ? srso_alias_return_thunk+0x5/0xfbef5 [ 751.963600][ T5775] worker_thread+0x5ef/0xe50 [ 751.963663][ T5775] ? __pfx_worker_thread+0x10/0x10 [ 751.963728][ T5775] ? kthread+0x13a/0x450 [ 751.963778][ T5775] ? __pfx_worker_thread+0x10/0x10 [ 751.963834][ T5775] kthread+0x370/0x450 [ 751.963885][ T5775] ? __pfx_kthread+0x10/0x10 [ 751.963938][ T5775] ret_from_fork+0x72b/0xd50 [ 751.963983][ T5775] ? __pfx_ret_from_fork+0x10/0x10 [ 751.964027][ T5775] ? srso_alias_return_thunk+0x5/0xfbef5 [ 751.964071][ T5775] ? __switch_to+0x800/0x10f0 [ 751.964124][ T5775] ? __switch_to_asm+0x39/0x70 [ 751.964173][ T5775] ? __pfx_kthread+0x10/0x10 [ 751.964228][ T5775] ret_from_fork_asm+0x1a/0x30 [ 751.964289][ T5775] [ 751.964302][ T5775] [ 752.276230][ T5775] Allocated by task 5870: [ 752.280554][ T5775] kasan_save_stack+0x30/0x50 [ 752.285258][ T5775] kasan_save_track+0x14/0x30 [ 752.289965][ T5775] __kasan_kmalloc+0xaa/0xb0 [ 752.294574][ T5775] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 752.299963][ T5775] em28xx_v4l2_init.cold+0x94/0x3a40 [ 752.305280][ T5775] em28xx_init_extension+0x13a/0x200 [ 752.310590][ T5775] request_module_async+0x61/0x80 [ 752.315638][ T5775] process_one_work+0xa23/0x1940 [ 752.320607][ T5775] worker_thread+0x5ef/0xe50 [ 752.325223][ T5775] kthread+0x370/0x450 [ 752.329315][ T5775] ret_from_fork+0x72b/0xd50 [ 752.333917][ T5775] ret_from_fork_asm+0x1a/0x30 [ 752.338706][ T5775] [ 752.341019][ T5775] Freed by task 5870: [ 752.344989][ T5775] kasan_save_stack+0x30/0x50 [ 752.349693][ T5775] kasan_save_track+0x14/0x30 [ 752.354399][ T5775] kasan_save_free_info+0x3b/0x70 [ 752.359434][ T5775] __kasan_slab_free+0x5f/0x80 [ 752.364225][ T5775] kfree+0x22b/0x6c0 [ 752.368141][ T5775] kref_put.isra.0+0x53/0x75 [ 752.372761][ T5775] em28xx_v4l2_init.cold+0x280/0x3a40 [ 752.378165][ T5775] em28xx_init_extension+0x13a/0x200 [ 752.383477][ T5775] request_module_async+0x61/0x80 [ 752.388530][ T5775] process_one_work+0xa23/0x1940 [ 752.393496][ T5775] worker_thread+0x5ef/0xe50 [ 752.398111][ T5775] kthread+0x370/0x450 [ 752.402202][ T5775] ret_from_fork+0x72b/0xd50 [ 752.406806][ T5775] ret_from_fork_asm+0x1a/0x30 [ 752.411589][ T5775] [ 752.413904][ T5775] The buggy address belongs to the object at ffff888079848000 [ 752.413904][ T5775] which belongs to the cache kmalloc-8k of size 8192 [ 752.427958][ T5775] The buggy address is located 528 bytes inside of [ 752.427958][ T5775] freed 8192-byte region [ffff888079848000, ffff88807984a000) [ 752.441850][ T5775] [ 752.444169][ T5775] The buggy address belongs to the physical page: [ 752.450573][ T5775] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x79848 [ 752.459335][ T5775] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 752.467923][ T5775] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 752.475472][ T5775] page_type: f5(slab) [ 752.479456][ T5775] raw: 00fff00000000040 ffff88813fe24280 dead000000000122 0000000000000000 [ 752.488046][ T5775] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 752.496639][ T5775] head: 00fff00000000040 ffff88813fe24280 dead000000000122 0000000000000000 [ 752.505318][ T5775] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 752.513995][ T5775] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 752.522676][ T5775] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 752.531347][ T5775] page dumped because: kasan: bad access detected [ 752.537753][ T5775] page_owner tracks the page as allocated [ 752.543459][ T5775] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 15804, tgid 15803 (syz.4.3524), ts 749373603858, free_ts 749341826435 [ 752.565048][ T5775] post_alloc_hook+0xfd/0x120 [ 752.569745][ T5775] get_page_from_freelist+0xf48/0x3530 [ 752.575222][ T5775] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 752.581140][ T5775] new_slab+0xa2/0x650 [ 752.585225][ T5775] refill_objects+0xe3/0x410 [ 752.589833][ T5775] __pcs_replace_empty_main+0x376/0x680 [ 752.595394][ T5775] __kmalloc_noprof+0x66d/0x820 [ 752.600265][ T5775] ops_init+0x77/0x5f0 [ 752.604348][ T5775] setup_net+0x118/0x3a0 [ 752.608605][ T5775] copy_net_ns+0x46f/0x7c0 [ 752.613036][ T5775] create_new_namespaces+0x3ea/0xac0 [ 752.618342][ T5775] unshare_nsproxy_namespaces+0xf2/0x220 [ 752.623994][ T5775] ksys_unshare+0x438/0xab0 [ 752.628515][ T5775] __x64_sys_unshare+0x31/0x40 [ 752.633296][ T5775] do_syscall_64+0x115/0x870 [ 752.637898][ T5775] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 752.643799][ T5775] page last free pid 15804 tgid 15803 stack trace: [ 752.650294][ T5775] __free_frozen_pages+0x79f/0x1090 [ 752.655514][ T5775] qlist_free_all+0x47/0xf0 [ 752.660059][ T5775] kasan_quarantine_reduce+0x1a0/0x1f0 [ 752.665540][ T5775] __kasan_slab_alloc+0x69/0x90 [ 752.670419][ T5775] __kmalloc_cache_noprof+0x265/0x6c0 [ 752.675839][ T5775] kset_create_and_add+0x4d/0x190 [ 752.680888][ T5775] netdev_register_kobject+0x1ef/0x3d0 [ 752.686372][ T5775] register_netdevice+0x15b6/0x25a0 [ 752.691597][ T5775] register_netdev+0x34/0x50 [ 752.696203][ T5775] ip6gre_init_net+0x2aa/0x420 [ 752.700995][ T5775] ops_init+0x1e2/0x5f0 [ 752.705162][ T5775] setup_net+0x118/0x3a0 [ 752.709416][ T5775] copy_net_ns+0x46f/0x7c0 [ 752.713866][ T5775] create_new_namespaces+0x3ea/0xac0 [ 752.719166][ T5775] unshare_nsproxy_namespaces+0xf2/0x220 [ 752.724814][ T5775] ksys_unshare+0x438/0xab0 [ 752.729333][ T5775] [ 752.731648][ T5775] Memory state around the buggy address: [ 752.737271][ T5775] ffff888079848100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 752.745338][ T5775] ffff888079848180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 752.753434][ T5775] >ffff888079848200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 752.761491][ T5775] ^ [ 752.766075][ T5775] ffff888079848280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 752.774139][ T5775] ffff888079848300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 752.782195][ T5775] ================================================================== [ 752.792088][T15831] Disabling lock debugging due to kernel taint [ 752.798834][T15831] ================================================================== [ 752.806897][T15831] BUG: KASAN: slab-use-after-free in kobject_put+0x590/0x640 [ 752.814287][T15831] Read of size 1 at addr ffff8880798482f4 by task v4l_id/15831 [ 752.821828][T15831] [ 752.824151][T15831] CPU: 0 UID: 0 PID: 15831 Comm: v4l_id Tainted: G B L syzkaller #0 PREEMPT(full) [ 752.824210][T15831] Tainted: [B]=BAD_PAGE, [L]=SOFTLOCKUP [ 752.824226][T15831] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 752.824248][T15831] Call Trace: [ 752.824260][T15831] [ 752.824275][T15831] dump_stack_lvl+0x100/0x190 [ 752.824314][T15831] print_report+0x13d/0x4b0 [ 752.824367][T15831] ? srso_alias_return_thunk+0x5/0xfbef5 [ 752.824412][T15831] ? __virt_addr_valid+0x239/0x430 [ 752.824452][T15831] ? kobject_put+0x590/0x640 [ 752.824493][T15831] kasan_report+0xdf/0x1c0 [ 752.824552][T15831] ? kobject_put+0x590/0x640 [ 752.824599][T15831] kobject_put+0x590/0x640 [ 752.824643][T15831] put_device+0x1f/0x30 [ 752.824702][T15831] v4l2_open+0x2e5/0x490 [ 752.824746][T15831] ? __pfx_v4l2_open+0x10/0x10 [ 752.824790][T15831] chrdev_open+0x234/0x6a0 [ 752.824837][T15831] ? __pfx_chrdev_open+0x10/0x10 [ 752.824884][T15831] ? srso_alias_return_thunk+0x5/0xfbef5 [ 752.824928][T15831] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 752.824990][T15831] do_dentry_open+0x6ab/0x14d0 [ 752.825032][T15831] ? __pfx_chrdev_open+0x10/0x10 [ 752.825079][T15831] ? srso_alias_return_thunk+0x5/0xfbef5 [ 752.825126][T15831] vfs_open+0x82/0x3f0 [ 752.825176][T15831] ? srso_alias_return_thunk+0x5/0xfbef5 [ 752.825228][T15831] path_openat+0x2873/0x4280 [ 752.825285][T15831] ? __pfx_path_openat+0x10/0x10 [ 752.825340][T15831] do_file_open+0x20e/0x430 [ 752.825388][T15831] ? __pfx_do_file_open+0x10/0x10 [ 752.825452][T15831] ? srso_alias_return_thunk+0x5/0xfbef5 [ 752.825495][T15831] ? alloc_fd+0x471/0x7a0 [ 752.825544][T15831] ? do_getname+0x191/0x390 [ 752.825602][T15831] do_sys_openat2+0x10f/0x1e0 [ 752.825656][T15831] ? __pfx_do_sys_openat2+0x10/0x10 [ 752.825713][T15831] ? srso_alias_return_thunk+0x5/0xfbef5 [ 752.825764][T15831] __x64_sys_openat+0x12d/0x210 [ 752.825820][T15831] ? __pfx___x64_sys_openat+0x10/0x10 [ 752.825879][T15831] ? srso_alias_return_thunk+0x5/0xfbef5 [ 752.825924][T15831] ? srso_alias_return_thunk+0x5/0xfbef5 [ 752.825972][T15831] do_syscall_64+0x115/0x870 [ 752.826008][T15831] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 752.826045][T15831] RIP: 0033:0x7f456fea7407 [ 752.826072][T15831] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 752.826109][T15831] RSP: 002b:00007ffe5fd43e90 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 752.826142][T15831] RAX: ffffffffffffffda RBX: 00007f4570587880 RCX: 00007f456fea7407 [ 752.826168][T15831] RDX: 0000000000000000 RSI: 00007ffe5fd44f1c RDI: ffffffffffffff9c [ 752.826192][T15831] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 752.826220][T15831] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 752.826242][T15831] R13: 00007ffe5fd440e0 R14: 00007f457068c000 R15: 0000556e805b94d8 [ 752.826279][T15831] [ 752.826292][T15831] [ 753.114361][T15831] Allocated by task 5870: [ 753.118681][T15831] kasan_save_stack+0x30/0x50 [ 753.123388][T15831] kasan_save_track+0x14/0x30 [ 753.128087][T15831] __kasan_kmalloc+0xaa/0xb0 [ 753.132695][T15831] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 753.138084][T15831] em28xx_v4l2_init.cold+0x94/0x3a40 [ 753.143399][T15831] em28xx_init_extension+0x13a/0x200 [ 753.148710][T15831] request_module_async+0x61/0x80 [ 753.153759][T15831] process_one_work+0xa23/0x1940 [ 753.158723][T15831] worker_thread+0x5ef/0xe50 [ 753.163348][T15831] kthread+0x370/0x450 [ 753.167437][T15831] ret_from_fork+0x72b/0xd50 [ 753.172038][T15831] ret_from_fork_asm+0x1a/0x30 [ 753.176820][T15831] [ 753.179132][T15831] Freed by task 5870: [ 753.183101][T15831] kasan_save_stack+0x30/0x50 [ 753.187798][T15831] kasan_save_track+0x14/0x30 [ 753.192497][T15831] kasan_save_free_info+0x3b/0x70 [ 753.197531][T15831] __kasan_slab_free+0x5f/0x80 [ 753.202318][T15831] kfree+0x22b/0x6c0 [ 753.206219][T15831] kref_put.isra.0+0x53/0x75 [ 753.210836][T15831] em28xx_v4l2_init.cold+0x280/0x3a40 [ 753.216234][T15831] em28xx_init_extension+0x13a/0x200 [ 753.221542][T15831] request_module_async+0x61/0x80 [ 753.226590][T15831] process_one_work+0xa23/0x1940 [ 753.231988][T15831] worker_thread+0x5ef/0xe50 [ 753.236600][T15831] kthread+0x370/0x450 [ 753.240690][T15831] ret_from_fork+0x72b/0xd50 [ 753.245296][T15831] ret_from_fork_asm+0x1a/0x30 [ 753.250078][T15831] [ 753.252391][T15831] The buggy address belongs to the object at ffff888079848000 [ 753.252391][T15831] which belongs to the cache kmalloc-8k of size 8192 [ 753.266443][T15831] The buggy address is located 756 bytes inside of [ 753.266443][T15831] freed 8192-byte region [ffff888079848000, ffff88807984a000) [ 753.280333][T15831] [ 753.282651][T15831] The buggy address belongs to the physical page: [ 753.289051][T15831] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x79848 [ 753.297815][T15831] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 753.306312][T15831] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 753.313856][T15831] page_type: f5(slab) [ 753.317838][T15831] raw: 00fff00000000040 ffff88813fe24280 dead000000000122 0000000000000000 [ 753.326431][T15831] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 753.335025][T15831] head: 00fff00000000040 ffff88813fe24280 dead000000000122 0000000000000000 [ 753.343703][T15831] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 753.352382][T15831] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 753.361057][T15831] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 753.369720][T15831] page dumped because: kasan: bad access detected [ 753.376129][T15831] page_owner tracks the page as allocated [ 753.381832][T15831] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 15804, tgid 15803 (syz.4.3524), ts 749373603858, free_ts 749341826435 [ 753.403386][T15831] post_alloc_hook+0xfd/0x120 [ 753.408082][T15831] get_page_from_freelist+0xf48/0x3530 [ 753.413561][T15831] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 753.419472][T15831] new_slab+0xa2/0x650 [ 753.423553][T15831] refill_objects+0xe3/0x410 [ 753.428157][T15831] __pcs_replace_empty_main+0x376/0x680 [ 753.433719][T15831] __kmalloc_noprof+0x66d/0x820 [ 753.438588][T15831] ops_init+0x77/0x5f0 [ 753.442666][T15831] setup_net+0x118/0x3a0 [ 753.446918][T15831] copy_net_ns+0x46f/0x7c0 [ 753.451350][T15831] create_new_namespaces+0x3ea/0xac0 [ 753.456647][T15831] unshare_nsproxy_namespaces+0xf2/0x220 [ 753.462297][T15831] ksys_unshare+0x438/0xab0 [ 753.466816][T15831] __x64_sys_unshare+0x31/0x40 [ 753.471595][T15831] do_syscall_64+0x115/0x870 [ 753.476188][T15831] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 753.482120][T15831] page last free pid 15804 tgid 15803 stack trace: [ 753.488611][T15831] __free_frozen_pages+0x79f/0x1090 [ 753.493817][T15831] qlist_free_all+0x47/0xf0 [ 753.498338][T15831] kasan_quarantine_reduce+0x1a0/0x1f0 [ 753.503818][T15831] __kasan_slab_alloc+0x69/0x90 [ 753.508695][T15831] __kmalloc_cache_noprof+0x265/0x6c0 [ 753.514079][T15831] kset_create_and_add+0x4d/0x190 [ 753.519121][T15831] netdev_register_kobject+0x1ef/0x3d0 [ 753.524609][T15831] register_netdevice+0x15b6/0x25a0 [ 753.529825][T15831] register_netdev+0x34/0x50 [ 753.534426][T15831] ip6gre_init_net+0x2aa/0x420 [ 753.539222][T15831] ops_init+0x1e2/0x5f0 [ 753.543389][T15831] setup_net+0x118/0x3a0 [ 753.547643][T15831] copy_net_ns+0x46f/0x7c0 [ 753.552076][T15831] create_new_namespaces+0x3ea/0xac0 [ 753.557372][T15831] unshare_nsproxy_namespaces+0xf2/0x220 [ 753.563018][T15831] ksys_unshare+0x438/0xab0 [ 753.567538][T15831] [ 753.569855][T15831] Memory state around the buggy address: [ 753.575478][T15831] ffff888079848180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 753.583539][T15831] ffff888079848200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 753.591599][T15831] >ffff888079848280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 753.599653][T15831] ^ [ 753.607363][T15831] ffff888079848300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 753.615428][T15831] ffff888079848380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 753.623486][T15831] ================================================================== [ 753.637529][ T5775] ================================================================== [ 753.645598][ T5775] BUG: KASAN: slab-use-after-free in __media_device_unregister_entity+0x2e1/0x2f0 [ 753.647317][T15827] EXT4-fs (loop2): 1 truncate cleaned up [ 753.654828][ T5775] Read of size 8 at addr ffff888079848200 by task kworker/0:6/5775 [ 753.654865][ T5775] [ 753.654888][ T5775] CPU: 0 UID: 0 PID: 5775 Comm: kworker/0:6 Tainted: G B L syzkaller #0 PREEMPT(full) [ 753.654948][ T5775] Tainted: [B]=BAD_PAGE, [L]=SOFTLOCKUP [ 753.654964][ T5775] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 753.654992][ T5775] Workqueue: usb_hub_wq hub_event [ 753.655036][ T5775] Call Trace: [ 753.655049][ T5775] [ 753.655064][ T5775] dump_stack_lvl+0x100/0x190 [ 753.655106][ T5775] print_report+0x13d/0x4b0 [ 753.655164][ T5775] ? srso_alias_return_thunk+0x5/0xfbef5 [ 753.655218][ T5775] ? __virt_addr_valid+0x239/0x430 [ 753.655261][ T5775] ? __media_device_unregister_entity+0x2e1/0x2f0 [ 753.655318][ T5775] kasan_report+0xdf/0x1c0 [ 753.655382][ T5775] ? __media_device_unregister_entity+0x2e1/0x2f0 [ 753.655444][ T5775] __media_device_unregister_entity+0x2e1/0x2f0 [ 753.655503][ T5775] media_device_unregister+0x15e/0x610 [ 753.655566][ T5775] em28xx_unregister_media_device+0x4e/0xe0 [ 753.655628][ T5775] em28xx_release_resources+0x79/0x1b0 [ 753.655689][ T5775] em28xx_usb_disconnect.cold+0x17d/0x253 [ 753.655751][ T5775] usb_unbind_interface+0x1dd/0x9e0 [ 753.655806][ T5775] ? srso_alias_return_thunk+0x5/0xfbef5 [ 753.655854][ T5775] ? __pfx_usb_unbind_interface+0x10/0x10 [ 753.655906][ T5775] device_remove+0x12a/0x180 [ 753.655950][ T5775] device_release_driver_internal+0x44e/0x620 [ 753.656001][ T5775] ? __entry_text_end+0x1020b5/0x1020b9 [ 753.656052][ T5775] bus_remove_device+0x2bc/0x560 [ 753.656093][ T5775] ? __pfx_bus_remove_device+0x10/0x10 [ 753.656132][ T5775] ? __pfx_device_remove_attrs+0x10/0x10 [ 753.656180][ T5775] device_del+0x376/0x9b0 [ 753.656229][ T5775] ? __pfx_device_del+0x10/0x10 [ 753.656270][ T5775] ? kobject_put+0xb9/0x640 [ 753.656318][ T5775] ? srso_alias_return_thunk+0x5/0xfbef5 [ 753.656369][ T5775] usb_disable_device+0x367/0x810 [ 753.656419][ T5775] usb_disconnect+0x2e2/0x9a0 [ 753.656465][ T5775] hub_event+0x1d0c/0x4af0 [ 753.656525][ T5775] ? srso_alias_return_thunk+0x5/0xfbef5 [ 753.656573][ T5775] ? __lock_acquire+0x49f/0x1a40 [ 753.656613][ T5775] ? do_raw_spin_unlock+0x145/0x1e0 [ 753.656663][ T5775] ? __pfx_hub_event+0x10/0x10 [ 753.656705][ T5775] ? debug_object_deactivate+0x2e4/0x3b0 [ 753.656760][ T5775] ? srso_alias_return_thunk+0x5/0xfbef5 [ 753.656810][ T5775] ? srso_alias_return_thunk+0x5/0xfbef5 [ 753.656860][ T5775] ? srso_alias_return_thunk+0x5/0xfbef5 [ 753.656907][ T5775] ? rcu_is_watching+0x12/0xc0 [ 753.656963][ T5775] process_one_work+0xa23/0x1940 [ 753.657034][ T5775] ? __pfx_process_one_work+0x10/0x10 [ 753.657094][ T5775] ? srso_alias_return_thunk+0x5/0xfbef5 [ 753.657149][ T5775] ? srso_alias_return_thunk+0x5/0xfbef5 [ 753.657204][ T5775] worker_thread+0x5ef/0xe50 [ 753.657271][ T5775] ? __pfx_worker_thread+0x10/0x10 [ 753.657333][ T5775] ? kthread+0x13a/0x450 [ 753.657387][ T5775] ? __pfx_worker_thread+0x10/0x10 [ 753.657446][ T5775] kthread+0x370/0x450 [ 753.657500][ T5775] ? __pfx_kthread+0x10/0x10 [ 753.657558][ T5775] ret_from_fork+0x72b/0xd50 [ 753.657606][ T5775] ? __pfx_ret_from_fork+0x10/0x10 [ 753.657653][ T5775] ? srso_alias_return_thunk+0x5/0xfbef5 [ 753.657701][ T5775] ? __switch_to+0x800/0x10f0 [ 753.657758][ T5775] ? __switch_to_asm+0x39/0x70 [ 753.657810][ T5775] ? __pfx_kthread+0x10/0x10 [ 753.657868][ T5775] ret_from_fork_asm+0x1a/0x30 [ 753.657933][ T5775] [ 753.657947][ T5775] [ 753.991234][ T5775] Allocated by task 5870: [ 753.995560][ T5775] kasan_save_stack+0x30/0x50 [ 754.000269][ T5775] kasan_save_track+0x14/0x30 [ 754.004970][ T5775] __kasan_kmalloc+0xaa/0xb0 [ 754.009586][ T5775] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 754.014971][ T5775] em28xx_v4l2_init.cold+0x94/0x3a40 [ 754.020288][ T5775] em28xx_init_extension+0x13a/0x200 [ 754.025598][ T5775] request_module_async+0x61/0x80 [ 754.030651][ T5775] process_one_work+0xa23/0x1940 [ 754.035615][ T5775] worker_thread+0x5ef/0xe50 [ 754.040233][ T5775] kthread+0x370/0x450 [ 754.044325][ T5775] ret_from_fork+0x72b/0xd50 [ 754.048929][ T5775] ret_from_fork_asm+0x1a/0x30 [ 754.053713][ T5775] [ 754.056025][ T5775] Freed by task 5870: [ 754.059997][ T5775] kasan_save_stack+0x30/0x50 [ 754.064698][ T5775] kasan_save_track+0x14/0x30 [ 754.069400][ T5775] kasan_save_free_info+0x3b/0x70 [ 754.074438][ T5775] __kasan_slab_free+0x5f/0x80 [ 754.079228][ T5775] kfree+0x22b/0x6c0 [ 754.083131][ T5775] kref_put.isra.0+0x53/0x75 [ 754.087759][ T5775] em28xx_v4l2_init.cold+0x280/0x3a40 [ 754.093164][ T5775] em28xx_init_extension+0x13a/0x200 [ 754.098484][ T5775] request_module_async+0x61/0x80 [ 754.103537][ T5775] process_one_work+0xa23/0x1940 [ 754.108503][ T5775] worker_thread+0x5ef/0xe50 [ 754.113114][ T5775] kthread+0x370/0x450 [ 754.117206][ T5775] ret_from_fork+0x72b/0xd50 [ 754.121809][ T5775] ret_from_fork_asm+0x1a/0x30 [ 754.126591][ T5775] [ 754.128904][ T5775] The buggy address belongs to the object at ffff888079848000 [ 754.128904][ T5775] which belongs to the cache kmalloc-8k of size 8192 [ 754.142956][ T5775] The buggy address is located 512 bytes inside of [ 754.142956][ T5775] freed 8192-byte region [ffff888079848000, ffff88807984a000) [ 754.156844][ T5775] [ 754.159158][ T5775] The buggy address belongs to the physical page: [ 754.165562][ T5775] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x79848 [ 754.174321][ T5775] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 754.182819][ T5775] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 754.190362][ T5775] page_type: f5(slab) [ 754.194346][ T5775] raw: 00fff00000000040 ffff88813fe24280 dead000000000122 0000000000000000 [ 754.202935][ T5775] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 754.211526][ T5775] head: 00fff00000000040 ffff88813fe24280 dead000000000122 0000000000000000 [ 754.220205][ T5775] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 754.228883][ T5775] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 754.237557][ T5775] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 754.246307][ T5775] page dumped because: kasan: bad access detected [ 754.252710][ T5775] page_owner tracks the page as allocated [ 754.258418][ T5775] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 15804, tgid 15803 (syz.4.3524), ts 749373603858, free_ts 749341826435 [ 754.279985][ T5775] post_alloc_hook+0xfd/0x120 [ 754.284678][ T5775] get_page_from_freelist+0xf48/0x3530 [ 754.290157][ T5775] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 754.296072][ T5775] new_slab+0xa2/0x650 [ 754.300150][ T5775] refill_objects+0xe3/0x410 [ 754.304756][ T5775] __pcs_replace_empty_main+0x376/0x680 [ 754.310315][ T5775] __kmalloc_noprof+0x66d/0x820 [ 754.315183][ T5775] ops_init+0x77/0x5f0 [ 754.319267][ T5775] setup_net+0x118/0x3a0 [ 754.323520][ T5775] copy_net_ns+0x46f/0x7c0 [ 754.327953][ T5775] create_new_namespaces+0x3ea/0xac0 [ 754.333251][ T5775] unshare_nsproxy_namespaces+0xf2/0x220 [ 754.338898][ T5775] ksys_unshare+0x438/0xab0 [ 754.343415][ T5775] __x64_sys_unshare+0x31/0x40 [ 754.348192][ T5775] do_syscall_64+0x115/0x870 [ 754.352787][ T5775] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 754.358687][ T5775] page last free pid 15804 tgid 15803 stack trace: [ 754.365179][ T5775] __free_frozen_pages+0x79f/0x1090 [ 754.370389][ T5775] qlist_free_all+0x47/0xf0 [ 754.374908][ T5775] kasan_quarantine_reduce+0x1a0/0x1f0 [ 754.380387][ T5775] __kasan_slab_alloc+0x69/0x90 [ 754.385262][ T5775] __kmalloc_cache_noprof+0x265/0x6c0 [ 754.390647][ T5775] kset_create_and_add+0x4d/0x190 [ 754.395686][ T5775] netdev_register_kobject+0x1ef/0x3d0 [ 754.401168][ T5775] register_netdevice+0x15b6/0x25a0 [ 754.406382][ T5775] register_netdev+0x34/0x50 [ 754.410983][ T5775] ip6gre_init_net+0x2aa/0x420 [ 754.415772][ T5775] ops_init+0x1e2/0x5f0 [ 754.419941][ T5775] setup_net+0x118/0x3a0 [ 754.424198][ T5775] copy_net_ns+0x46f/0x7c0 [ 754.428638][ T5775] create_new_namespaces+0x3ea/0xac0 [ 754.433934][ T5775] unshare_nsproxy_namespaces+0xf2/0x220 [ 754.439582][ T5775] ksys_unshare+0x438/0xab0 [ 754.444101][ T5775] [ 754.446415][ T5775] Memory state around the buggy address: [ 754.452038][ T5775] ffff888079848100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 754.460098][ T5775] ffff888079848180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 754.468160][ T5775] >ffff888079848200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 754.476219][ T5775] ^ [ 754.480280][ T5775] ffff888079848280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 754.488341][ T5775] ffff888079848300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 754.496397][ T5775] ================================================================== [ 754.514437][T15827] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000007 ro without journal. Quota mode: writeback. [ 754.535466][T15831] ================================================================== [ 754.543543][T15831] BUG: KASAN: slab-use-after-free in kobject_put+0x88/0x640 [ 754.550856][T15831] Write of size 4 at addr ffff8880798482f0 by task v4l_id/15831 [ 754.558488][T15831] [ 754.560812][T15831] CPU: 1 UID: 0 PID: 15831 Comm: v4l_id Tainted: G B L syzkaller #0 PREEMPT(full) [ 754.560867][T15831] Tainted: [B]=BAD_PAGE, [L]=SOFTLOCKUP [ 754.560882][T15831] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 754.560905][T15831] Call Trace: [ 754.560917][T15831] [ 754.560930][T15831] dump_stack_lvl+0x100/0x190 [ 754.560971][T15831] print_report+0x13d/0x4b0 [ 754.561023][T15831] ? srso_alias_return_thunk+0x5/0xfbef5 [ 754.561068][T15831] ? __virt_addr_valid+0x239/0x430 [ 754.561108][T15831] ? kobject_put+0x88/0x640 [ 754.561150][T15831] kasan_report+0xdf/0x1c0 [ 754.561209][T15831] ? kobject_put+0x88/0x640 [ 754.561255][T15831] kasan_check_range+0x10f/0x1e0 [ 754.561294][T15831] kobject_put+0x88/0x640 [ 754.561337][T15831] put_device+0x1f/0x30 [ 754.561393][T15831] v4l2_open+0x2e5/0x490 [ 754.561437][T15831] ? __pfx_v4l2_open+0x10/0x10 [ 754.561480][T15831] chrdev_open+0x234/0x6a0 [ 754.561528][T15831] ? __pfx_chrdev_open+0x10/0x10 [ 754.561575][T15831] ? srso_alias_return_thunk+0x5/0xfbef5 [ 754.561618][T15831] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 754.561680][T15831] do_dentry_open+0x6ab/0x14d0 [ 754.561726][T15831] ? __pfx_chrdev_open+0x10/0x10 [ 754.561775][T15831] ? srso_alias_return_thunk+0x5/0xfbef5 [ 754.561821][T15831] vfs_open+0x82/0x3f0 [ 754.561871][T15831] ? srso_alias_return_thunk+0x5/0xfbef5 [ 754.561918][T15831] path_openat+0x2873/0x4280 [ 754.561975][T15831] ? __pfx_path_openat+0x10/0x10 [ 754.562029][T15831] do_file_open+0x20e/0x430 [ 754.562076][T15831] ? __pfx_do_file_open+0x10/0x10 [ 754.562139][T15831] ? srso_alias_return_thunk+0x5/0xfbef5 [ 754.562182][T15831] ? alloc_fd+0x471/0x7a0 [ 754.562232][T15831] ? do_getname+0x191/0x390 [ 754.562289][T15831] do_sys_openat2+0x10f/0x1e0 [ 754.562342][T15831] ? __pfx_do_sys_openat2+0x10/0x10 [ 754.562398][T15831] ? srso_alias_return_thunk+0x5/0xfbef5 [ 754.562448][T15831] __x64_sys_openat+0x12d/0x210 [ 754.562504][T15831] ? __pfx___x64_sys_openat+0x10/0x10 [ 754.562562][T15831] ? srso_alias_return_thunk+0x5/0xfbef5 [ 754.562606][T15831] ? srso_alias_return_thunk+0x5/0xfbef5 [ 754.562654][T15831] do_syscall_64+0x115/0x870 [ 754.562689][T15831] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 754.562764][T15831] RIP: 0033:0x7f456fea7407 [ 754.562791][T15831] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 754.562826][T15831] RSP: 002b:00007ffe5fd43e90 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 754.562861][T15831] RAX: ffffffffffffffda RBX: 00007f4570587880 RCX: 00007f456fea7407 [ 754.562886][T15831] RDX: 0000000000000000 RSI: 00007ffe5fd44f1c RDI: ffffffffffffff9c [ 754.562911][T15831] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 754.562933][T15831] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 754.562955][T15831] R13: 00007ffe5fd440e0 R14: 00007f457068c000 R15: 0000556e805b94d8 [ 754.562991][T15831] [ 754.563004][T15831] [ 754.854994][T15831] Allocated by task 5870: [ 754.859315][T15831] kasan_save_stack+0x30/0x50 [ 754.864017][T15831] kasan_save_track+0x14/0x30 [ 754.868716][T15831] __kasan_kmalloc+0xaa/0xb0 [ 754.873323][T15831] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 754.878708][T15831] em28xx_v4l2_init.cold+0x94/0x3a40 [ 754.884023][T15831] em28xx_init_extension+0x13a/0x200 [ 754.889331][T15831] request_module_async+0x61/0x80 [ 754.894377][T15831] process_one_work+0xa23/0x1940 [ 754.899339][T15831] worker_thread+0x5ef/0xe50 [ 754.903953][T15831] kthread+0x370/0x450 [ 754.908040][T15831] ret_from_fork+0x72b/0xd50 [ 754.912639][T15831] ret_from_fork_asm+0x1a/0x30 [ 754.917423][T15831] [ 754.919739][T15831] Freed by task 5870: [ 754.923713][T15831] kasan_save_stack+0x30/0x50 [ 754.928413][T15831] kasan_save_track+0x14/0x30 [ 754.933109][T15831] kasan_save_free_info+0x3b/0x70 [ 754.938146][T15831] __kasan_slab_free+0x5f/0x80 [ 754.942934][T15831] kfree+0x22b/0x6c0 [ 754.946835][T15831] kref_put.isra.0+0x53/0x75 [ 754.951449][T15831] em28xx_v4l2_init.cold+0x280/0x3a40 [ 754.956847][T15831] em28xx_init_extension+0x13a/0x200 [ 754.962152][T15831] request_module_async+0x61/0x80 [ 754.967198][T15831] process_one_work+0xa23/0x1940 [ 754.972162][T15831] worker_thread+0x5ef/0xe50 [ 754.976776][T15831] kthread+0x370/0x450 [ 754.980952][T15831] ret_from_fork+0x72b/0xd50 [ 754.985640][T15831] ret_from_fork_asm+0x1a/0x30 [ 754.990427][T15831] [ 754.992738][T15831] The buggy address belongs to the object at ffff888079848000 [ 754.992738][T15831] which belongs to the cache kmalloc-8k of size 8192 [ 755.006789][T15831] The buggy address is located 752 bytes inside of [ 755.006789][T15831] freed 8192-byte region [ffff888079848000, ffff88807984a000) [ 755.020676][T15831] [ 755.022996][T15831] The buggy address belongs to the physical page: [ 755.029395][T15831] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x79848 [ 755.038160][T15831] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 755.046661][T15831] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 755.054212][T15831] page_type: f5(slab) [ 755.058195][T15831] raw: 00fff00000000040 ffff88813fe24280 dead000000000122 0000000000000000 [ 755.066785][T15831] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 755.075373][T15831] head: 00fff00000000040 ffff88813fe24280 dead000000000122 0000000000000000 [ 755.084046][T15831] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 755.092722][T15831] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 755.101399][T15831] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 755.110062][T15831] page dumped because: kasan: bad access detected [ 755.116463][T15831] page_owner tracks the page as allocated [ 755.122167][T15831] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 15804, tgid 15803 (syz.4.3524), ts 749373603858, free_ts 749341826435 [ 755.143721][T15831] post_alloc_hook+0xfd/0x120 [ 755.148413][T15831] get_page_from_freelist+0xf48/0x3530 [ 755.153976][T15831] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 755.159888][T15831] new_slab+0xa2/0x650 [ 755.163966][T15831] refill_objects+0xe3/0x410 [ 755.168568][T15831] __pcs_replace_empty_main+0x376/0x680 [ 755.174122][T15831] __kmalloc_noprof+0x66d/0x820 [ 755.178993][T15831] ops_init+0x77/0x5f0 [ 755.183072][T15831] setup_net+0x118/0x3a0 [ 755.187347][T15831] copy_net_ns+0x46f/0x7c0 [ 755.191777][T15831] create_new_namespaces+0x3ea/0xac0 [ 755.197074][T15831] unshare_nsproxy_namespaces+0xf2/0x220 [ 755.202717][T15831] ksys_unshare+0x438/0xab0 [ 755.207235][T15831] __x64_sys_unshare+0x31/0x40 [ 755.212012][T15831] do_syscall_64+0x115/0x870 [ 755.216604][T15831] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 755.222503][T15831] page last free pid 15804 tgid 15803 stack trace: [ 755.228995][T15831] __free_frozen_pages+0x79f/0x1090 [ 755.234290][T15831] qlist_free_all+0x47/0xf0 [ 755.238810][T15831] kasan_quarantine_reduce+0x1a0/0x1f0 [ 755.244289][T15831] __kasan_slab_alloc+0x69/0x90 [ 755.249163][T15831] __kmalloc_cache_noprof+0x265/0x6c0 [ 755.254544][T15831] kset_create_and_add+0x4d/0x190 [ 755.259586][T15831] netdev_register_kobject+0x1ef/0x3d0 [ 755.265065][T15831] register_netdevice+0x15b6/0x25a0 [ 755.270276][T15831] register_netdev+0x34/0x50 [ 755.274960][T15831] ip6gre_init_net+0x2aa/0x420 [ 755.279750][T15831] ops_init+0x1e2/0x5f0 [ 755.283932][T15831] setup_net+0x118/0x3a0 [ 755.288204][T15831] copy_net_ns+0x46f/0x7c0 [ 755.292651][T15831] create_new_namespaces+0x3ea/0xac0 [ 755.297993][T15831] unshare_nsproxy_namespaces+0xf2/0x220 [ 755.303644][T15831] ksys_unshare+0x438/0xab0 [ 755.308166][T15831] [ 755.310479][T15831] Memory state around the buggy address: [ 755.316103][T15831] ffff888079848180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 755.324167][T15831] ffff888079848200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 755.332227][T15831] >ffff888079848280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 755.340289][T15831] ^ [ 755.348002][T15831] ffff888079848300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 755.356062][T15831] ffff888079848380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 755.364116][T15831] ================================================================== [ 755.378591][ T5775] ================================================================== [ 755.386663][ T5775] BUG: KASAN: slab-use-after-free in __media_device_unregister_entity+0x2d4/0x2f0 [ 755.395893][ T5775] Read of size 4 at addr ffff888079848240 by task kworker/0:6/5775 [ 755.403785][ T5775] [ 755.406112][ T5775] CPU: 0 UID: 0 PID: 5775 Comm: kworker/0:6 Tainted: G B L syzkaller #0 PREEMPT(full) [ 755.406168][ T5775] Tainted: [B]=BAD_PAGE, [L]=SOFTLOCKUP [ 755.406184][ T5775] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 755.406210][ T5775] Workqueue: usb_hub_wq hub_event [ 755.406252][ T5775] Call Trace: [ 755.406266][ T5775] [ 755.406280][ T5775] dump_stack_lvl+0x100/0x190 [ 755.406325][ T5775] print_report+0x13d/0x4b0 [ 755.406380][ T5775] ? srso_alias_return_thunk+0x5/0xfbef5 [ 755.406426][ T5775] ? __virt_addr_valid+0x239/0x430 [ 755.406467][ T5775] ? __media_device_unregister_entity+0x2d4/0x2f0 [ 755.406527][ T5775] kasan_report+0xdf/0x1c0 [ 755.406588][ T5775] ? __media_device_unregister_entity+0x2d4/0x2f0 [ 755.406648][ T5775] __media_device_unregister_entity+0x2d4/0x2f0 [ 755.406705][ T5775] media_device_unregister+0x15e/0x610 [ 755.406766][ T5775] em28xx_unregister_media_device+0x4e/0xe0 [ 755.406825][ T5775] em28xx_release_resources+0x79/0x1b0 [ 755.406883][ T5775] em28xx_usb_disconnect.cold+0x17d/0x253 [ 755.406943][ T5775] usb_unbind_interface+0x1dd/0x9e0 [ 755.406995][ T5775] ? srso_alias_return_thunk+0x5/0xfbef5 [ 755.407041][ T5775] ? __pfx_usb_unbind_interface+0x10/0x10 [ 755.407091][ T5775] device_remove+0x12a/0x180 [ 755.407133][ T5775] device_release_driver_internal+0x44e/0x620 [ 755.407182][ T5775] ? __entry_text_end+0x1020b5/0x1020b9 [ 755.407230][ T5775] bus_remove_device+0x2bc/0x560 [ 755.407268][ T5775] ? __pfx_bus_remove_device+0x10/0x10 [ 755.407305][ T5775] ? __pfx_device_remove_attrs+0x10/0x10 [ 755.407358][ T5775] device_del+0x376/0x9b0 [ 755.407400][ T5775] ? __pfx_device_del+0x10/0x10 [ 755.407439][ T5775] ? kobject_put+0xb9/0x640 [ 755.407485][ T5775] ? srso_alias_return_thunk+0x5/0xfbef5 [ 755.407534][ T5775] usb_disable_device+0x367/0x810 [ 755.407581][ T5775] usb_disconnect+0x2e2/0x9a0 [ 755.407625][ T5775] hub_event+0x1d0c/0x4af0 [ 755.407682][ T5775] ? srso_alias_return_thunk+0x5/0xfbef5 [ 755.407728][ T5775] ? __lock_acquire+0x49f/0x1a40 [ 755.407765][ T5775] ? do_raw_spin_unlock+0x145/0x1e0 [ 755.407812][ T5775] ? __pfx_hub_event+0x10/0x10 [ 755.407854][ T5775] ? debug_object_deactivate+0x2e4/0x3b0 [ 755.407906][ T5775] ? srso_alias_return_thunk+0x5/0xfbef5 [ 755.407953][ T5775] ? srso_alias_return_thunk+0x5/0xfbef5 [ 755.408000][ T5775] ? srso_alias_return_thunk+0x5/0xfbef5 [ 755.408046][ T5775] ? rcu_is_watching+0x12/0xc0 [ 755.408099][ T5775] process_one_work+0xa23/0x1940 [ 755.408167][ T5775] ? __pfx_process_one_work+0x10/0x10 [ 755.408225][ T5775] ? srso_alias_return_thunk+0x5/0xfbef5 [ 755.408277][ T5775] ? srso_alias_return_thunk+0x5/0xfbef5 [ 755.408331][ T5775] worker_thread+0x5ef/0xe50 [ 755.408395][ T5775] ? __pfx_worker_thread+0x10/0x10 [ 755.408455][ T5775] ? kthread+0x13a/0x450 [ 755.408507][ T5775] ? __pfx_worker_thread+0x10/0x10 [ 755.408563][ T5775] kthread+0x370/0x450 [ 755.408614][ T5775] ? __pfx_kthread+0x10/0x10 [ 755.408670][ T5775] ret_from_fork+0x72b/0xd50 [ 755.408716][ T5775] ? __pfx_ret_from_fork+0x10/0x10 [ 755.408761][ T5775] ? srso_alias_return_thunk+0x5/0xfbef5 [ 755.408806][ T5775] ? __switch_to+0x800/0x10f0 [ 755.408860][ T5775] ? __switch_to_asm+0x39/0x70 [ 755.408910][ T5775] ? __pfx_kthread+0x10/0x10 [ 755.408965][ T5775] ret_from_fork_asm+0x1a/0x30 [ 755.409027][ T5775] [ 755.409040][ T5775] [ 755.729593][ T5775] Allocated by task 5870: [ 755.733915][ T5775] kasan_save_stack+0x30/0x50 [ 755.738620][ T5775] kasan_save_track+0x14/0x30 [ 755.743324][ T5775] __kasan_kmalloc+0xaa/0xb0 [ 755.747936][ T5775] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 755.753325][ T5775] em28xx_v4l2_init.cold+0x94/0x3a40 [ 755.758643][ T5775] em28xx_init_extension+0x13a/0x200 [ 755.763952][ T5775] request_module_async+0x61/0x80 [ 755.769002][ T5775] process_one_work+0xa23/0x1940 [ 755.773967][ T5775] worker_thread+0x5ef/0xe50 [ 755.778585][ T5775] kthread+0x370/0x450 [ 755.782677][ T5775] ret_from_fork+0x72b/0xd50 [ 755.787281][ T5775] ret_from_fork_asm+0x1a/0x30 [ 755.792073][ T5775] [ 755.794386][ T5775] Freed by task 5870: [ 755.798358][ T5775] kasan_save_stack+0x30/0x50 [ 755.803058][ T5775] kasan_save_track+0x14/0x30 [ 755.807758][ T5775] kasan_save_free_info+0x3b/0x70 [ 755.812794][ T5775] __kasan_slab_free+0x5f/0x80 [ 755.817586][ T5775] kfree+0x22b/0x6c0 [ 755.821492][ T5775] kref_put.isra.0+0x53/0x75 [ 755.826116][ T5775] em28xx_v4l2_init.cold+0x280/0x3a40 [ 755.831531][ T5775] em28xx_init_extension+0x13a/0x200 [ 755.836843][ T5775] request_module_async+0x61/0x80 [ 755.841895][ T5775] process_one_work+0xa23/0x1940 [ 755.846859][ T5775] worker_thread+0x5ef/0xe50 [ 755.851477][ T5775] kthread+0x370/0x450 [ 755.855567][ T5775] ret_from_fork+0x72b/0xd50 [ 755.860174][ T5775] ret_from_fork_asm+0x1a/0x30 [ 755.864957][ T5775] [ 755.867273][ T5775] The buggy address belongs to the object at ffff888079848000 [ 755.867273][ T5775] which belongs to the cache kmalloc-8k of size 8192 [ 755.881332][ T5775] The buggy address is located 576 bytes inside of [ 755.881332][ T5775] freed 8192-byte region [ffff888079848000, ffff88807984a000) [ 755.895224][ T5775] [ 755.897544][ T5775] The buggy address belongs to the physical page: [ 755.903945][ T5775] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x79848 [ 755.912708][ T5775] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 755.921206][ T5775] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 755.928754][ T5775] page_type: f5(slab) [ 755.932737][ T5775] raw: 00fff00000000040 ffff88813fe24280 dead000000000122 0000000000000000 [ 755.941335][ T5775] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 755.950013][ T5775] head: 00fff00000000040 ffff88813fe24280 dead000000000122 0000000000000000 [ 755.958690][ T5775] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 755.967367][ T5775] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 755.976044][ T5775] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 755.984712][ T5775] page dumped because: kasan: bad access detected [ 755.991118][ T5775] page_owner tracks the page as allocated [ 755.996823][ T5775] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 15804, tgid 15803 (syz.4.3524), ts 749373603858, free_ts 749341826435 [ 756.018378][ T5775] post_alloc_hook+0xfd/0x120 [ 756.023113][ T5775] get_page_from_freelist+0xf48/0x3530 [ 756.028597][ T5775] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 756.034511][ T5775] new_slab+0xa2/0x650 [ 756.038594][ T5775] refill_objects+0xe3/0x410 [ 756.043196][ T5775] __pcs_replace_empty_main+0x376/0x680 [ 756.048759][ T5775] __kmalloc_noprof+0x66d/0x820 [ 756.053632][ T5775] ops_init+0x77/0x5f0 [ 756.057710][ T5775] setup_net+0x118/0x3a0 [ 756.061970][ T5775] copy_net_ns+0x46f/0x7c0 [ 756.066400][ T5775] create_new_namespaces+0x3ea/0xac0 [ 756.071703][ T5775] unshare_nsproxy_namespaces+0xf2/0x220 [ 756.077350][ T5775] ksys_unshare+0x438/0xab0 [ 756.081867][ T5775] __x64_sys_unshare+0x31/0x40 [ 756.086645][ T5775] do_syscall_64+0x115/0x870 [ 756.091238][ T5775] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 756.097139][ T5775] page last free pid 15804 tgid 15803 stack trace: [ 756.103631][ T5775] __free_frozen_pages+0x79f/0x1090 [ 756.108838][ T5775] qlist_free_all+0x47/0xf0 [ 756.113357][ T5775] kasan_quarantine_reduce+0x1a0/0x1f0 [ 756.118836][ T5775] __kasan_slab_alloc+0x69/0x90 [ 756.123737][ T5775] __kmalloc_cache_noprof+0x265/0x6c0 [ 756.129381][ T5775] kset_create_and_add+0x4d/0x190 [ 756.134426][ T5775] netdev_register_kobject+0x1ef/0x3d0 [ 756.139910][ T5775] register_netdevice+0x15b6/0x25a0 [ 756.145123][ T5775] register_netdev+0x34/0x50 [ 756.149726][ T5775] ip6gre_init_net+0x2aa/0x420 [ 756.154514][ T5775] ops_init+0x1e2/0x5f0 [ 756.158680][ T5775] setup_net+0x118/0x3a0 [ 756.162934][ T5775] copy_net_ns+0x46f/0x7c0 [ 756.167366][ T5775] create_new_namespaces+0x3ea/0xac0 [ 756.172664][ T5775] unshare_nsproxy_namespaces+0xf2/0x220 [ 756.178307][ T5775] ksys_unshare+0x438/0xab0 [ 756.182829][ T5775] [ 756.185142][ T5775] Memory state around the buggy address: [ 756.190765][ T5775] ffff888079848100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 756.198824][ T5775] ffff888079848180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 756.206886][ T5775] >ffff888079848200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 756.214942][ T5775] ^ [ 756.221087][ T5775] ffff888079848280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 756.229147][ T5775] ffff888079848300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 756.237203][ T5775] ================================================================== [ 756.272540][T15831] Kernel panic - not syncing: kasan.fault=panic_on_write set ... [ 756.280290][T15831] CPU: 1 UID: 0 PID: 15831 Comm: v4l_id Tainted: G B L syzkaller #0 PREEMPT(full) [ 756.290897][T15831] Tainted: [B]=BAD_PAGE, [L]=SOFTLOCKUP [ 756.296430][T15831] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 756.306498][T15831] Call Trace: [ 756.309785][T15831] [ 756.312717][T15831] dump_stack_lvl+0x100/0x190 [ 756.317411][T15831] vpanic+0x552/0x970 [ 756.321422][T15831] ? __pfx_vpanic+0x10/0x10 [ 756.325947][T15831] ? rcu_is_watching+0x12/0xc0 [ 756.330738][T15831] ? __pfx___schedule+0x10/0x10 [ 756.335618][T15831] ? kobject_put+0x88/0x640 [ 756.340136][T15831] panic+0xd1/0xe0 [ 756.343867][T15831] ? __pfx_panic+0x10/0x10 [ 756.348292][T15831] ? preempt_schedule_common+0x42/0xc0 [ 756.353782][T15831] ? srso_alias_return_thunk+0x5/0xfbef5 [ 756.359432][T15831] ? preempt_schedule_thunk+0x16/0x40 [ 756.364853][T15831] end_report.part.0+0x68/0x90 [ 756.369643][T15831] kasan_report.cold+0xe/0x18 [ 756.374353][T15831] ? kobject_put+0x88/0x640 [ 756.378879][T15831] kasan_check_range+0x10f/0x1e0 [ 756.383830][T15831] kobject_put+0x88/0x640 [ 756.388178][T15831] put_device+0x1f/0x30 [ 756.392362][T15831] v4l2_open+0x2e5/0x490 [ 756.396622][T15831] ? __pfx_v4l2_open+0x10/0x10 [ 756.401407][T15831] chrdev_open+0x234/0x6a0 [ 756.405856][T15831] ? __pfx_chrdev_open+0x10/0x10 [ 756.410813][T15831] ? srso_alias_return_thunk+0x5/0xfbef5 [ 756.416470][T15831] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 756.422832][T15831] do_dentry_open+0x6ab/0x14d0 [ 756.427612][T15831] ? __pfx_chrdev_open+0x10/0x10 [ 756.432571][T15831] ? srso_alias_return_thunk+0x5/0xfbef5 [ 756.438225][T15831] vfs_open+0x82/0x3f0 [ 756.442323][T15831] ? srso_alias_return_thunk+0x5/0xfbef5 [ 756.447976][T15831] path_openat+0x2873/0x4280 [ 756.452597][T15831] ? __pfx_path_openat+0x10/0x10 [ 756.457562][T15831] do_file_open+0x20e/0x430 [ 756.462086][T15831] ? __pfx_do_file_open+0x10/0x10 [ 756.467144][T15831] ? srso_alias_return_thunk+0x5/0xfbef5 [ 756.472793][T15831] ? alloc_fd+0x471/0x7a0 [ 756.477143][T15831] ? do_getname+0x191/0x390 [ 756.481677][T15831] do_sys_openat2+0x10f/0x1e0 [ 756.486384][T15831] ? __pfx_do_sys_openat2+0x10/0x10 [ 756.491611][T15831] ? srso_alias_return_thunk+0x5/0xfbef5 [ 756.497266][T15831] __x64_sys_openat+0x12d/0x210 [ 756.502145][T15831] ? __pfx___x64_sys_openat+0x10/0x10 [ 756.507547][T15831] ? srso_alias_return_thunk+0x5/0xfbef5 [ 756.513196][T15831] ? srso_alias_return_thunk+0x5/0xfbef5 [ 756.518850][T15831] do_syscall_64+0x115/0x870 [ 756.523452][T15831] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 756.529359][T15831] RIP: 0033:0x7f456fea7407 [ 756.533776][T15831] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 756.553402][T15831] RSP: 002b:00007ffe5fd43e90 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 756.561823][T15831] RAX: ffffffffffffffda RBX: 00007f4570587880 RCX: 00007f456fea7407 [ 756.569797][T15831] RDX: 0000000000000000 RSI: 00007ffe5fd44f1c RDI: ffffffffffffff9c [ 756.577770][T15831] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 756.585742][T15831] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 756.593714][T15831] R13: 00007ffe5fd440e0 R14: 00007f457068c000 R15: 0000556e805b94d8 [ 756.601696][T15831] [ 756.604997][T15831] Kernel Offset: disabled [ 756.609308][T15831] Rebooting in 86400 seconds..