last executing test programs: 25.041924134s ago: executing program 2 (id=4301): syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$rtl8150(0xffffffffffffffff, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0x1, "1f"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac2(0xffffffffffffffff, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(0xffffffffffffffff, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5, 0x1, "03"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f00000016c0)={0x44, &(0x7f0000001400)={0x0, 0xf, 0xe1, "455acb0a55f076ae37e92aefde11b529503da2c5994c15bc141ff0b771922f602cc95f62f0af3959dea0f22e96858261c357a45880aaa2b4fd20497f6e4084157a106f09ca7e749a472109ad3ebb8fecfa4254324aca4c4c562ee7ebd6ce32e0527489dd798f64a7aece0f1a53b669208d50b02467c7f2856675b75be7325da9661f9a09bae49d795a4204e1263950d627a978d240453326b632f4757f7a0412ea395ebeb48da33768f645311608e7e49d9efdcc9b86cc140df8e91b598b8a0d6c410d6899e8fadae348bcbe5f89c7c772fe7dd0bcc460f2cf5938662351a8eeab"}, &(0x7f0000001500)={0x0, 0xa, 0x1, 0x1}, 0x0, 0x0, 0x0, &(0x7f0000001600)={0x20, 0x83, 0x2}, &(0x7f0000001640)={0x20, 0x87, 0x2, 0x3}, &(0x7f0000001680)={0x20, 0x89, 0x2}}) socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(0xffffffffffffffff, &(0x7f0000000040)={0x18, 0x0, {0x1, @random="b9fc7cff49bb", 'wlan1\x00'}}, 0x1e) close(0x3) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="d8000000150081054e81f782db44b9040a783b020a000000040000a11800020000e9400084150e1208000f0100810401a80016ea1f0006400303000803600cfab94dcf5c04", 0x45}], 0x1, 0x0, 0x0, 0x7400}, 0x4000) clock_settime(0x17, &(0x7f0000000100)) socket$inet6_sctp(0xa, 0x5, 0x84) socket$netlink(0x10, 0x3, 0x4) r1 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000440)={0x9, 0xb, 0x8, 0x3, 0xa, "bca52cdd06b3288abef863374e8f7d8327e4ff"}) 21.056171067s ago: executing program 2 (id=4306): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00"/11], 0x50) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xd4ad1185e214d3bd}}, [], {0x14}}, 0x28}}, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x20, 0xf, &(0x7f0000000280)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8fea, 0x0, 0x0, 0x0, 0x5}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x67a021c03d2005e9, 0x4, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r1, 0x18000000000002a0, 0x14, 0x0, &(0x7f0000000040)="b90103a974f9a500009e0ff008001fffffe10000", 0x0, 0x104, 0x6000000000000000, 0x19, 0x0, &(0x7f0000000400)="9209558f0c5fb25cd57f98113135c3171b8b331fbc04f0e695", 0x0}, 0x50) 20.861480019s ago: executing program 2 (id=4308): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000340)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0xffffffff, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0x3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x100, 0xffffffff, 0x6361, 0x7, 0xfffffffd, 0x40000004}}}}]}, 0x4c}}, 0x20000804) close(r1) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r5) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r6) r7 = socket$unix(0x1, 0x1, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r9, {}, {0x2, 0xb}, {0xb, 0xb}}, [@qdisc_kind_options=@q_pfifo_fast={0xf}]}, 0x34}, 0x1, 0x0, 0x0, 0x2000c061}, 0x4008000) ioctl$SIOCSIFHWADDR(r6, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 19.205010719s ago: executing program 2 (id=4312): socket$nl_netfilter(0x10, 0x3, 0xc) lsm_set_self_attr(0x68, &(0x7f0000000100)={0x6c, 0x1, 0x20}, 0x20, 0x0) syz_usb_connect$uac3(0x5, 0x80, &(0x7f0000000000)=ANY=[@ANYBLOB="12011003000000208205440040000102030109026e"], 0x0) bind$vsock_stream(0xffffffffffffffff, &(0x7f0000000440)={0x28, 0x0, 0x0, @local}, 0x10) listen(0xffffffffffffffff, 0xa) r0 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r0, &(0x7f0000000000)={0x28, 0x0, 0x0, @local}, 0x10) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000000)={0x28, 0x0, 0x0, @local}, 0x10) r2 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="2800000014001901000000000000000228"], 0x28}}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sysvipc/msg\x00', 0x0, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000c00)=[{0x0}], 0x1, 0x0, 0x0, 0x40000}, 0xcc000) r4 = syz_open_dev$sg(&(0x7f00000002c0), 0x0, 0x40) ioctl$SG_IO(r4, 0x2285, &(0x7f00000001c0)={0x53, 0xfffffffffffffffc, 0x6, 0x1, @buffer={0x300, 0x50, &(0x7f0000000440)=""/80}, &(0x7f0000000380)="259374c94982", 0x0, 0x2, 0x1c, 0xffffffffffffffff, 0x0}) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x4e22, 0x1000, @dev={0xfe, 0x80, '\x00', 0x21}, 0x9}, 0x1c) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x41, &(0x7f00000000c0)=0x307ea, 0x4) 15.812505882s ago: executing program 2 (id=4316): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee7, 0x8031, 0xffffffffffffffff, 0x8ccbf000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000200), 0x4, 0x0) read$msr(r3, &(0x7f0000032680)=""/102392, 0x18ff8) r4 = open(&(0x7f0000000040)='./bus\x00', 0x0, 0x30) r5 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC(r5, 0x0, 0xcc, 0x0, 0x0) setsockopt$MRT_ADD_MFC_PROXY(r5, 0x0, 0xd2, 0x0, 0x0) openat$comedi(0xffffffffffffff9c, 0x0, 0x202, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x48) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x8, 0xc, &(0x7f0000000080)=ANY=[@ANYRESOCT=r5, @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x26, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0x16, 0xc, &(0x7f00000003c0)=ANY=[@ANYRESHEX=r2, @ANYRES16=0x0, @ANYRES32=r5, @ANYRES64=r7, @ANYBLOB="806942bad995f8ae74fd1cdbb1f8ce061eed7470cb148e3968e02396c63196285763159a7e6002a4635968b180b16743614cdd7f8e745d380673ef24fcd26bb614812afd8eedfc0f09a15c846064fb0466a14b4f95f3a627f9ee635c3cc5bb4e9591101b9c4b91bd93b92ae506cc965ea1aed7d847effb7eba372d8271153b9252093cc71059ab", @ANYRESHEX=r4, @ANYRESHEX=r4, @ANYRESOCT], &(0x7f0000000000)='syzkaller\x00', 0xffffffff, 0x0, 0x0, 0x41100, 0x11, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r7, 0x0, 0x0, 0x0, 0x0, 0x7ff}, 0x94) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) setsockopt$MRT_DEL_MFC_PROXY(r5, 0x0, 0xd3, &(0x7f0000000100)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1, 0x0, "c6c0e6ec8755b5dc4ed95f844a69e9000000040600", 0xd, 0x201, 0x489c, 0x6}, 0x3c) ftruncate(r4, 0x2007ffb) sendfile(r4, r4, 0x0, 0x1000000201005) socket$nl_generic(0x10, 0x3, 0x10) 12.115704145s ago: executing program 2 (id=4318): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee7, 0x8031, 0xffffffffffffffff, 0x8ccbf000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r3, 0x84, 0x7f, &(0x7f0000000040)="020000000980ffff", 0x8) setsockopt$inet6_int(r3, 0x29, 0x33, &(0x7f0000000080)=0x1, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000032680)=""/102392, 0x18ff8) r5 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0x0) fchdir(r6) r7 = open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x80) ftruncate(r7, 0x2007ffb) r8 = socket$unix(0x1, 0x5, 0x0) bind$unix(r8, &(0x7f0000000dc0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) 8.712175888s ago: executing program 0 (id=4323): syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040840508000201000000010902200001010080fa09040000020806f4000705810200020007050202"], 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x600, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='attr/current\x00') read$FUSE(r0, &(0x7f0000001140)={0x2020}, 0x2020) write$FUSE_INIT(r0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x1c0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000180)='./file0/../file0\x00', &(0x7f00000002c0), 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='fd=', @ANYRESDEC=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010400000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x10}, 0x0) 7.522357485s ago: executing program 4 (id=4325): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000004840)={0x24, 0xd, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x40041d5}, 0xc080) 7.035133979s ago: executing program 4 (id=4327): pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f00000005c0)='fd', 0x0, r0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x2) fchdir(r2) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r3, r3) setpgid(0x0, r3) link(&(0x7f0000000280)='./file0/../file0/file0\x00', 0x0) 6.7740586s ago: executing program 0 (id=4328): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x5001}) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000000200)=0xc) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000400)={'syzkaller1\x00', 0x0}) connect$unix(0xffffffffffffffff, &(0x7f0000000200)=@file={0x1}, 0x6e) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000500)={@dev={0xfe, 0x80, '\x00', 0x2}, 0x40, r2}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000600)={'syzkaller1\x00', 0x41}) write$tun(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0105300007002800060000006000000000308440fe800000000000000000000000000001fe800000000000000000000000000002"], 0x64) 5.51436896s ago: executing program 4 (id=4329): r0 = socket$inet_sctp(0x2, 0x1, 0x84) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e22, @local}, 0x10) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000080)={0x0, 0x7, 0x30}, 0xc) sendto$inet(r0, &(0x7f00000000c0)='}', 0x1, 0x0, &(0x7f00000001c0)={0x2, 0x4e22, @local}, 0x10) sendmmsg(r0, &(0x7f0000000180)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=':', 0x1}], 0x1}}], 0x1, 0x11) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000200)={0x0, 0x1, 0x0, 0x5, 0x44, 0x2, 0x8}, 0x20) sendto$inet(r0, &(0x7f0000000300)="ab", 0x34000, 0x0, &(0x7f0000000380)={0x2, 0x4e22, @local}, 0x10) 5.455445602s ago: executing program 0 (id=4330): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setreuid(0x0, 0xee01) listen(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x2) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x1ff) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r5, 0x0) listen(r4, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r6, 0x1780) r7 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$DCCPDIAG_GETSOCK(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4c00000012000301000000000000000000009db7000000000000010004000000000000000000000000000000000000000000000000000000691d0f76e77044d1eb94e56239e4"], 0x4c}, 0x1, 0x0, 0x0, 0x20000000}, 0x800) 5.19304907s ago: executing program 1 (id=4333): mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x14) 4.88305142s ago: executing program 3 (id=4334): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000380)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) sendmsg$NLBL_UNLABEL_C_STATICADD(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x44}}, 0x8004) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)={0x20, 0xb, 0x6, 0x201, 0x0, 0x0, {0x5, 0x0, 0x2}, [@IPSET_ATTR_DATA={0x4}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_GET_EMULATED_CPUID(r1, 0xc008ae09, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 4.866114219s ago: executing program 0 (id=4335): r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000000000201c1b091c00000000000109022d0001000060000904008002030000000921080400012205000905810320000908070905020340"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_read(r0, 0x2, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\b'], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_connect(0x5, 0x36, 0x0, 0x0) 4.775390353s ago: executing program 4 (id=4336): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000a0)='./proc/net/afs/rootcell\x00', 0x2, 0x0) write(r0, &(0x7f00000000c0)='syz0\n', 0x5) 4.527382741s ago: executing program 4 (id=4337): socket$key(0xf, 0x3, 0x2) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f0000000140)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b000ee6d2f2f800000c0d23266bac0000f3066b808008ed0660f38806f008ee0", 0x3a}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000040)={0x1}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x3, 0x0, 0x1}, {}, {0xeda7, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x1}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x20000000, 0x3, 0x3f8, 0x0, 0x0, 0x2004cb, 0x3, 0x0, 0xfffffffffffffff8, 0x0, 0x9, 0x2000000000003ff, 0x2], 0x2000, 0x200206}) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)) ioctl$KVM_RUN(r2, 0xae80, 0x0) 4.092937571s ago: executing program 1 (id=4338): socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x85, &(0x7f0000000240)={0x0, @in={{0x2, 0x0, @empty}}, 0x7, 0x23}, 0x90) 3.92518766s ago: executing program 3 (id=4339): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x2800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x181603, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$kcm(0x2, 0xa, 0x2) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='freezer.self_freezing\x00', 0x275a, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000000)="8ee8c9b8ee088ed8660f3801b2d6352ed9ff660f3882040f01cf0fc72d2626652e0f01ca0fc7386635002000000f22e0", 0xffffffffffffff8b}], 0x1, 0x50, 0x0, 0x0) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) pipe(&(0x7f0000000240)) ioctl$KVM_RUN(r3, 0xae80, 0x0) 2.24043825s ago: executing program 4 (id=4340): r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000059770c40c009030243d3000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000f00)={0x2c, &(0x7f0000000180)=ANY=[@ANYBLOB="000cd200"], 0x0, 0x0, 0x0, 0x0}) 2.143388531s ago: executing program 1 (id=4341): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x3, &(0x7f00000001c0)=0x1, 0x4) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e24, @empty}, 0x10) sendmmsg$inet(r0, &(0x7f0000002f80)=[{{&(0x7f0000000200)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x26}}, 0x10, &(0x7f0000002640)=[{&(0x7f0000000240)="2bb67d620b7401a08b5f7c1ac1e8d7d7d0cffd84c843d0b484a36d2a9b05649807869a61b74492894b146d184840e0777205a4628235d6b1e06db312ed17", 0x3e}], 0x1}}], 0x1, 0x20008005) setsockopt$inet_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000040)=@gcm_256={{0x304}, "c42d63f980dfbaa6", "43bcecdd21f55be0266a460d84605c030802ac0b38baa9d317c79977994ab3fe", "2b710100", "d23a3ee3389eec27"}, 0x38) 1.944639147s ago: executing program 1 (id=4342): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000200)) 1.808322088s ago: executing program 1 (id=4343): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='configfs\x00', &(0x7f0000000000)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) mount(&(0x7f0000000400)=@filename='sysfs\x00', &(0x7f0000000300)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config/usb_gadget/g_uac2\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000200)='0x1234\n', 0x7) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g_uac2/idProduct\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='0x5678\n', 0x7) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g_uac2/functions/uac2.usb0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g_uac2/functions/uac2.usb0/c_chmask\x00', 0x1, 0x0) write(r2, &(0x7f0000000700)='0\n', 0x2) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000940)={{{@in6=@mcast2, @in=@remote}}, {{@in=@dev}, 0x0, @in=@remote}}, &(0x7f0000000a40)=0xe4) openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g_uac2/functions/uac2.usb0/p_chmask\x00', 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/usb_gadget/g_uac2/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000001300)='./config/usb_gadget/g_uac2/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000001400)='./config/usb_gadget/g_uac2/configs/c.1/uac2.usb0\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000001500)='./config/usb_gadget/g_uac2/UDC\x00', 0x1, 0x0) write(r3, &(0x7f0000001600)='usbip-vudc.0', 0xc) 1.763621986s ago: executing program 3 (id=4344): chdir(0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./file1\x00', 0x8042, 0x0) fcntl$setlease(r0, 0x400, 0x1) fcntl$setlease(r0, 0x400, 0x1) 1.305271899s ago: executing program 0 (id=4345): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4321, @loopback}, 0x10) r1 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r1, &(0x7f0000000040)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x24) connect$rxrpc(r1, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4321, @loopback}}, 0x24) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[{0x18, 0x110, 0x1, "01"}], 0x18}, 0x0) recvfrom(r0, &(0x7f0000000300)=""/256, 0x100, 0x0, 0x0, 0x0) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write(r3, &(0x7f0000000500)="0100", 0x2) read(r2, &(0x7f0000000314), 0x2) sendto$inet(r0, &(0x7f0000000300), 0x2f, 0x0, &(0x7f0000000080)={0x2, 0x1234, @loopback}, 0x10) recvmsg(r1, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) 1.252871286s ago: executing program 3 (id=4346): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) shutdown(r0, 0x1) 1.001831759s ago: executing program 3 (id=4347): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0) write(r1, &(0x7f0000000440)='44100,48000,88200,96000,176400,192000,352', 0x29) symlinkat(&(0x7f0000000580)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00') write(0xffffffffffffffff, &(0x7f0000000640)='usbip-vudc.0', 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7, 0x2) r3 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r3, 0x40946400, &(0x7f00000000c0)={'pcmda12\x00', [0x100, 0x7, 0x2, 0x1000, 0xf, 0x5, 0x79, 0x3, 0x80008, 0x6, 0xffffffff, 0x1, 0x800008, 0x5, 0x100, 0x101, 0xfffffffb, 0x9, 0x7f, 0x7fffffff, 0x89, 0xca9f, 0xfffffffe, 0x20001e58, 0xffffffff, 0xf39e, 0x3, 0x8, 0xa6b8, 0x0, 0xfffffff8]}) r4 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r4, 0x29, 0x3b, &(0x7f0000000140)=ANY=[], 0x8) setsockopt$inet6_udp_int(r4, 0x11, 0x67, &(0x7f0000000040)=0x91, 0x4) connect$inet6(r4, &(0x7f0000000080)={0xa, 0x4e26, 0x8, @mcast2, 0xa}, 0x1c) setsockopt$SO_BINDTODEVICE_wg(r4, 0x1, 0x19, &(0x7f0000000000)='wg0\x00', 0x4) sendmmsg$inet6(r4, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) pselect6(0x40, &(0x7f0000000000)={0xa, 0x80000001, 0x2, 0x10000000000006, 0x12, 0x8, 0x80000000, 0x8}, 0x0, 0x0, 0x0, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000080)=ANY=[@ANYBLOB="fffffffffffffdf9a684a51b86dd600c7a00d8c225ccd109a27f3291082000183afffe800000000000e700000000000000bbfe8000000000000000000000000000aa8800907800000000fe800000"], 0x0) ioctl$vim2m_VIDIOC_S_FMT(r2, 0xc0d05605, 0x0) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000000)={{{@in=@dev, @in6=@mcast1}}, {{@in6=@dev}, 0x0, @in=@broadcast}}, &(0x7f0000000280)=0xe4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x6b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94) prlimit64(0x0, 0xe, 0x0, 0x0) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000000002) 325.922359ms ago: executing program 0 (id=4348): r0 = syz_usb_connect(0x3, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000075f84c1071042703a461000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000100)={0x2c, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f00000000c0)=ANY=[@ANYBLOB="00000100000011"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) 269.949041ms ago: executing program 1 (id=4349): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x1, 0x2}, 0x4) syz_open_dev$usbfs(0x0, 0x76, 0x101301) syz_genetlink_get_family_id$nl80211(&(0x7f0000000c00), 0xffffffffffffffff) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000019140)='net/fib_trie\x00') pread64(r1, &(0x7f0000000080)=""/102356, 0x18fd4, 0x200) ioctl$PPPIOCGL2TPSTATS(r1, 0x80487436, &(0x7f0000019180)="97a1606ab58e71aafe5bbd52e840795961f2e9bf92796ccfdcc9d98f213a79f8ae9e01ffe3f8244b35cf18d01b8c6e180c3b4ea4621ea6b4c9288ef3adacdb4ab3164b48327ce7f5cd1500675135b589d0e2aee950702e249496924544e16375ed49effa0d77130827b59112bb1a75f51bf79b85d72479b725ea9ebc7cf8092aab09d83ec9ad5a1afaa8c319af9b98fb6db1acd8a1b2170fdbe041c9803d69426f4a5e803ec8d96f5c295c264ed29d47927ae4438cf7defb2e3536e4075b691cc208f41516c4a6212f4149ccb4") bpf$LINK_DETACH(0x22, &(0x7f0000000240)=r1, 0x4) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8b18, &(0x7f0000000000)={'wlan0\x00'}) prctl$PR_SET_MM(0x41555856, 0xf7354000, &(0x7f0000ffa000/0x3000)=nil) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000001c0)=0x420, 0x4) syz_open_dev$usbfs(&(0x7f00000000c0), 0x76, 0x10bb41) r3 = socket$inet_tcp(0x2, 0x1, 0x0) set_robust_list(0x0, 0x0) mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000700)='./my_configfs/target/core/rd_mcp_0\x00', 0x1ff) mkdir(&(0x7f0000000800)='./my_configfs/target/core/rd_mcp_0/dev0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000b00)='./my_configfs/target/core/rd_mcp_0/dev0/enable\x00', 0x0, 0x10) rmdir(&(0x7f0000000280)='./my_configfs/target/core/rd_mcp_0/dev0\x00') r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x80c01) openat$audio(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(0x3) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r4, 0xc0105303, &(0x7f00000000c0)={0xf7, 0x9, 0x6}) setsockopt$sock_int(r3, 0x1, 0x53, 0x0, 0x0) 0s ago: executing program 3 (id=4350): sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x84}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000006c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc14000000110001"], 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) kernel console output (not intermixed with test programs): f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1553.354370][T21297] RSP: 002b:00007fea2c737028 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 1553.354410][T21297] RAX: ffffffffffffffda RBX: 00007fea2ba25fa0 RCX: 00007fea2b79e0d9 [ 1553.354440][T21297] RDX: 0000000000007721 RSI: 0000000000002219 RDI: 0000000000000000 [ 1553.354451][T21297] RBP: 00007fea2c737090 R08: 0000000000000000 R09: 0000000000000000 [ 1553.354461][T21297] R10: 0000000000000016 R11: 0000000000000246 R12: 0000000000000001 [ 1553.354472][T21297] R13: 00007fea2ba26038 R14: 00007fea2ba25fa0 R15: 00007ffc0a444c68 [ 1553.354498][T21297] [ 1553.686784][T21295] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3870'. [ 1553.741583][T21299] 8021q: adding VLAN 0 to HW filter on device bond26 [ 1553.751143][T21299] bond25: (slave bond26): making interface the new active one [ 1553.765635][T21299] bond25: (slave bond26): Enslaving as an active interface with an up link [ 1553.766437][T21303] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3870'. [ 1554.050087][T21303] 8021q: adding VLAN 0 to HW filter on device bond25 [ 1554.692052][ T188] usb 4-1: USB disconnect, device number 53 [ 1558.641212][T21346] fuse: Bad value for 'user_id' [ 1558.646423][T21346] fuse: Bad value for 'user_id' [ 1559.115750][T21349] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 1559.779988][T21358] x_tables: duplicate underflow at hook 3 [ 1559.798657][T21357] binder: 21354:21357 ioctl c0306201 0 returned -14 [ 1561.236683][T10869] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 1561.495355][T10869] usb 4-1: Using ep0 maxpacket: 16 [ 1561.501711][T10869] usb 4-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 1561.526093][T10869] usb 4-1: config 0 has an invalid interface number: 8 but max is 0 [ 1561.553991][T10869] usb 4-1: config 0 has no interface number 0 [ 1561.581066][T10869] usb 4-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1561.617623][T10869] usb 4-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1561.678529][T10869] usb 4-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 1561.693925][T10869] usb 4-1: Product: syz [ 1561.700527][T10869] usb 4-1: SerialNumber: syz [ 1561.806032][T10869] usb 4-1: config 0 descriptor?? [ 1561.854392][T10869] cm109 4-1:0.8: invalid payload size 0, expected 4 [ 1561.879618][T10869] input: CM109 USB driver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.8/input/input61 [ 1562.139501][T21372] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=27 sclass=netlink_route_socket pid=21372 comm=syz.3.3891 [ 1562.611288][ C1] cm109_urb_ctl_callback: 44 callbacks suppressed [ 1562.611367][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1562.618084][ T10] usb 4-1: USB disconnect, device number 54 [ 1562.624934][ C1] cm109 4-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 1562.697240][ T10] cm109 4-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 1563.160638][T21398] fuse: Bad value for 'user_id' [ 1563.165838][T21398] fuse: Bad value for 'user_id' [ 1564.415827][T21403] binder: 21401:21403 ioctl 8914 2000000003c0 returned -22 [ 1564.569839][T21407] binder: BINDER_SET_CONTEXT_MGR already set [ 1564.596915][T21407] binder: 21405:21407 ioctl 4018620d 200000000040 returned -16 [ 1566.141145][ T9651] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 1567.362949][ T9651] usb 4-1: Using ep0 maxpacket: 32 [ 1567.376106][ T9651] usb 4-1: New USB device found, idVendor=041e, idProduct=403c, bcdDevice=cc.d7 [ 1567.390488][ T9651] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1567.400006][ T9651] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1567.670724][ T9651] usb 4-1: config 0 descriptor?? [ 1568.260589][ T188] usb 4-1: USB disconnect, device number 55 [ 1573.934871][T21488] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1575.595423][T21502] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3932'. [ 1575.865976][ T188] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 1576.065983][ T188] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 1576.087277][ T188] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1576.111785][ T188] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1576.134044][ T188] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1576.167596][ T188] usb 3-1: config 0 descriptor?? [ 1576.239344][T21511] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3936'. [ 1576.525510][ T5794] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 1576.566615][T21516] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3938'. [ 1576.636376][T21516] netlink: 212 bytes leftover after parsing attributes in process `syz.0.3938'. [ 1576.687633][ T5794] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 1576.719076][ T5794] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1576.752362][ T5794] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1576.779655][T21516] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3938'. [ 1576.785611][ T5794] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1576.815384][ T188] pyra 0003:1E7D:2CF6.000C: item fetching failed at offset 5/7 [ 1576.842582][ T188] pyra 0003:1E7D:2CF6.000C: parse failed [ 1576.855909][ T5794] usb 4-1: config 0 descriptor?? [ 1576.873051][ T188] pyra 0003:1E7D:2CF6.000C: probe with driver pyra failed with error -22 [ 1578.359338][ T5794] pyra 0003:1E7D:2CF6.000D: item fetching failed at offset 5/7 [ 1578.677576][ T5794] pyra 0003:1E7D:2CF6.000D: parse failed [ 1578.683399][ T5794] pyra 0003:1E7D:2CF6.000D: probe with driver pyra failed with error -22 [ 1579.780021][T21535] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1579.860360][ T24] usb 3-1: USB disconnect, device number 49 [ 1579.881414][ T9651] usb 4-1: USB disconnect, device number 56 [ 1580.171347][T21544] binder: BINDER_SET_CONTEXT_MGR already set [ 1580.206933][T21544] binder: 21540:21544 ioctl 4018620d 200000000040 returned -16 [ 1580.565324][ T24] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 1580.818877][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 1580.838657][ T24] usb 3-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1580.879398][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1580.922214][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1580.970106][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1581.018400][ T24] usb 3-1: config 0 descriptor?? [ 1581.175381][T10869] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 1581.356346][T10869] usb 4-1: Using ep0 maxpacket: 16 [ 1581.379486][T10869] usb 4-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 1581.414001][T10869] usb 4-1: config 0 has an invalid interface number: 8 but max is 0 [ 1581.435589][T10869] usb 4-1: config 0 has no interface number 0 [ 1581.452319][T10869] usb 4-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1581.472032][ T24] ft260 0003:0403:6030.000E: unknown main item tag 0x0 [ 1581.486609][T10869] usb 4-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1581.502981][ T24] ft260 0003:0403:6030.000E: unknown main item tag 0x0 [ 1581.529692][T10869] usb 4-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 1581.551825][T10869] usb 4-1: Product: syz [ 1581.559505][T10869] usb 4-1: SerialNumber: syz [ 1581.664360][T10869] usb 4-1: config 0 descriptor?? [ 1581.671516][ T24] ft260 0003:0403:6030.000E: chip code: 0000 0000 [ 1581.780938][T10869] cm109 4-1:0.8: invalid payload size 0, expected 4 [ 1581.870953][ T24] ft260 0003:0403:6030.000E: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.2-1/input0 [ 1581.904432][T10869] input: CM109 USB driver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.8/input/input62 [ 1581.973339][T21560] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=27 sclass=netlink_route_socket pid=21560 comm=syz.3.3949 [ 1582.336890][ T24] ft260 0003:0403:6030.000E: failed to retrieve status: -71 [ 1582.546333][ T24] ft260 0003:0403:6030.000E: failed to reset I2C controller: -71 [ 1582.860480][T21569] x_tables: duplicate underflow at hook 3 [ 1583.119021][T21572] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3953'. [ 1583.145162][T21572] netlink: 212 bytes leftover after parsing attributes in process `syz.2.3953'. [ 1583.168277][T21572] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3953'. [ 1585.031671][ T24] usb 3-1: USB disconnect, device number 50 [ 1585.421284][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1585.428577][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1585.436466][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1585.444524][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1585.451985][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1585.465363][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1585.475314][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1585.483506][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1585.492169][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1585.500016][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1585.515456][T21593] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3959'. [ 1585.529175][T18876] usb 4-1: USB disconnect, device number 57 [ 1585.535155][ C1] cm109 4-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 1585.547887][T21593] netlink: 212 bytes leftover after parsing attributes in process `syz.2.3959'. [ 1585.560770][T21593] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3959'. [ 1585.586797][T18876] cm109 4-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 1585.616625][T21591] syzkaller0: entered promiscuous mode [ 1585.660169][T21591] syzkaller0: entered allmulticast mode [ 1586.295508][ T5794] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 1586.517219][ T5794] usb 4-1: Using ep0 maxpacket: 32 [ 1586.537202][ T5794] usb 4-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1586.573452][ T5794] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1586.639206][ T5794] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1586.667273][ T5794] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1586.806753][ T5794] usb 4-1: config 0 descriptor?? [ 1587.011436][T18876] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 1587.229692][T18876] usb 3-1: Using ep0 maxpacket: 32 [ 1587.279754][ T5794] ft260 0003:0403:6030.000F: unknown main item tag 0x0 [ 1587.291538][ T5794] ft260 0003:0403:6030.000F: unknown main item tag 0x0 [ 1587.305711][ T10] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 1587.475616][ T5794] ft260 0003:0403:6030.000F: chip code: 0000 0000 [ 1587.483406][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 1587.500959][ T10] usb 5-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1587.537927][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1587.678995][ T5794] ft260 0003:0403:6030.000F: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.3-1/input0 [ 1587.697146][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1587.727358][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1587.804101][T21624] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3967'. [ 1588.228304][ C0] raw-gadget.0 gadget.3: ignoring, device is not running [ 1588.229046][ T5794] ft260 0003:0403:6030.000F: failed to retrieve status: -32 [ 1588.229381][ C0] raw-gadget.0 gadget.3: ignoring, device is not running [ 1588.230109][ T5794] ft260 0003:0403:6030.000F: failed to reset I2C controller: -32 [ 1588.252148][ T10] usb 5-1: config 0 descriptor?? [ 1588.259310][ T5794] usb 4-1: USB disconnect, device number 58 [ 1588.674098][ T10] ft260 0003:0403:6030.0010: unknown main item tag 0x0 [ 1588.674180][ T10] ft260 0003:0403:6030.0010: unknown main item tag 0x0 [ 1588.843273][T21628] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3968'. [ 1588.843341][T21628] netlink: 212 bytes leftover after parsing attributes in process `syz.0.3968'. [ 1588.843419][T21628] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3968'. [ 1588.863674][ T10] ft260 0003:0403:6030.0010: chip code: 0000 0000 [ 1589.019190][T21632] tipc: Enabling of bearer rejected, failed to enable media [ 1589.064984][ T10] ft260 0003:0403:6030.0010: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.4-1/input0 [ 1589.365693][ T10] ft260 0003:0403:6030.0010: failed to retrieve status: -32, no wakeup [ 1589.621480][T21617] ft260 0003:0403:6030.0010: ft260_i2c_read: failed with -38 [ 1589.775067][ T24] usb 5-1: USB disconnect, device number 49 [ 1590.290821][T18876] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1590.298879][T18876] usb 3-1: New USB device found, idVendor=0582, idProduct=0044, bcdDevice= 0.40 [ 1590.309284][T18876] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 1590.318329][T18876] usb 3-1: can't read configurations, error -71 [ 1590.416765][T21651] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 1590.941257][T21662] syzkaller0: entered promiscuous mode [ 1590.984903][T21662] syzkaller0: entered allmulticast mode [ 1592.707695][T21695] FAULT_INJECTION: forcing a failure. [ 1592.707695][T21695] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1592.754006][T21695] CPU: 1 UID: 0 PID: 21695 Comm: syz.1.3985 Not tainted syzkaller #0 PREEMPT(full) [ 1592.754031][T21695] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1592.754042][T21695] Call Trace: [ 1592.754066][T21695] [ 1592.754073][T21695] dump_stack_lvl+0x100/0x190 [ 1592.754102][T21695] should_fail_ex.cold+0x5/0xa [ 1592.754124][T21695] _copy_from_iter+0x1f4/0x1690 [ 1592.754170][T21695] ? __asan_memset+0x23/0x50 [ 1592.754190][T21695] ? __pfx__copy_from_iter+0x10/0x10 [ 1592.754213][T21695] ? __pfx___alloc_skb+0x10/0x10 [ 1592.754268][T21695] netlink_sendmsg+0x808/0xda0 [ 1592.754439][T21695] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1592.754460][T21695] ? selinux_socket_sendmsg+0x198/0x2f0 [ 1592.754525][T21695] ____sys_sendmsg+0xa4d/0xbe0 [ 1592.754575][T21695] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1592.754596][T21695] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1592.754632][T21695] ___sys_sendmsg+0x190/0x1e0 [ 1592.754652][T21695] ? __pfx____sys_sendmsg+0x10/0x10 [ 1592.754667][T21695] ? __lock_acquire+0x49f/0x1a40 [ 1592.754691][T21695] ? get_pid_task+0x106/0x250 [ 1592.754732][T21695] __sys_sendmsg+0x160/0x210 [ 1592.754753][T21695] ? __pfx___sys_sendmsg+0x10/0x10 [ 1592.754786][T21695] do_syscall_64+0x115/0x870 [ 1592.754826][T21695] ? clear_bhb_loop+0x70/0xc0 [ 1592.754848][T21695] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1592.754867][T21695] RIP: 0033:0x7fea2b79e0d9 [ 1592.754883][T21695] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1592.754900][T21695] RSP: 002b:00007fea2c737028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1592.754933][T21695] RAX: ffffffffffffffda RBX: 00007fea2ba25fa0 RCX: 00007fea2b79e0d9 [ 1592.754943][T21695] RDX: 0000000000000000 RSI: 000020000000c2c0 RDI: 0000000000000003 [ 1592.754954][T21695] RBP: 00007fea2c737090 R08: 0000000000000000 R09: 0000000000000000 [ 1592.754964][T21695] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1592.754974][T21695] R13: 00007fea2ba26038 R14: 00007fea2ba25fa0 R15: 00007ffc0a444c68 [ 1592.754998][T21695] [ 1592.980665][T21696] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1593.318719][T21704] syzkaller0: entered promiscuous mode [ 1593.333441][T21704] syzkaller0: entered allmulticast mode [ 1593.705489][ T24] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 1593.942927][ T30] audit: type=1800 audit(1786394168.176:722): pid=21716 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.2.3994" name="power" dev="configfs" ino=86418 res=0 errno=0 [ 1593.985880][ T24] usb 2-1: New USB device found, idVendor=0584, idProduct=0008, bcdDevice= 1.02 [ 1594.013852][ T24] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1594.039347][ T24] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1594.072389][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1594.122682][T21720] netlink: 'syz.4.3996': attribute type 1 has an invalid length. [ 1594.139600][ T24] ums-alauda 2-1:1.0: USB Mass Storage device detected [ 1594.155710][ T5794] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 1594.245213][ T24] ums-alauda 2-1:1.0: This device (0584,0008,0102 S 06 P f4) has unneeded SubClass and Protocol entries in unusual_devs.h (kernel syzkaller) [ 1594.245213][ T24] Please send a copy of this message to and [ 1594.459031][ T5794] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1594.546655][ T5794] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1594.565391][ T5794] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1594.607672][ T5794] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1594.643811][T21731] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3996'. [ 1594.652910][ T5794] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1594.679909][ T24] scsi host1: usb-storage 2-1:1.0 [ 1594.725032][ T5794] usb 4-1: config 0 descriptor?? [ 1595.050257][T21720] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3996'. [ 1596.946953][ T3299] scsi 1:0:0:0: Direct-Access Fujifilm DPC-R1 (Alauda) 0102 PQ: 0 ANSI: 0 CCS [ 1597.031486][T21726] 8021q: adding VLAN 0 to HW filter on device bond27 [ 1597.044497][ T3299] scsi 1:0:0:1: Direct-Access Fujifilm DPC-R1 (Alauda) 0102 PQ: 0 ANSI: 0 CCS [ 1597.056954][ T5794] usbhid 4-1:0.0: can't add hid device: -71 [ 1597.063013][ T5794] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 1597.065088][T10869] usb 2-1: USB disconnect, device number 57 [ 1597.086743][ T5794] usb 4-1: USB disconnect, device number 59 [ 1597.094409][ T30] audit: type=1400 audit(1786394171.326:723): avc: denied { unmount } for pid=5610 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 1597.126722][T21726] bond26: (slave bond27): making interface the new active one [ 1597.176659][T21726] bond26: (slave bond27): Enslaving as an active interface with an up link [ 1597.298917][T21720] 8021q: adding VLAN 0 to HW filter on device bond26 [ 1597.361591][T21752] FAULT_INJECTION: forcing a failure. [ 1597.361591][T21752] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1597.474513][T21752] CPU: 0 UID: 0 PID: 21752 Comm: syz.2.4002 Not tainted syzkaller #0 PREEMPT(full) [ 1597.474539][T21752] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1597.474550][T21752] Call Trace: [ 1597.474557][T21752] [ 1597.474564][T21752] dump_stack_lvl+0x100/0x190 [ 1597.474594][T21752] should_fail_ex.cold+0x5/0xa [ 1597.474617][T21752] _copy_from_iter+0x1f4/0x1690 [ 1597.474646][T21752] ? __asan_memset+0x23/0x50 [ 1597.474666][T21752] ? __pfx__copy_from_iter+0x10/0x10 [ 1597.474689][T21752] ? __pfx___alloc_skb+0x10/0x10 [ 1597.474720][T21752] netlink_sendmsg+0x808/0xda0 [ 1597.474744][T21752] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1597.474766][T21752] ? selinux_socket_sendmsg+0x198/0x2f0 [ 1597.474797][T21752] ____sys_sendmsg+0xa4d/0xbe0 [ 1597.474823][T21752] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1597.474844][T21752] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1597.474882][T21752] ___sys_sendmsg+0x190/0x1e0 [ 1597.474902][T21752] ? __pfx____sys_sendmsg+0x10/0x10 [ 1597.474918][T21752] ? __lock_acquire+0x49f/0x1a40 [ 1597.474939][T21752] ? get_pid_task+0x106/0x250 [ 1597.474981][T21752] __sys_sendmsg+0x160/0x210 [ 1597.475005][T21752] ? __pfx___sys_sendmsg+0x10/0x10 [ 1597.475036][T21752] do_syscall_64+0x115/0x870 [ 1597.475061][T21752] ? clear_bhb_loop+0x70/0xc0 [ 1597.475081][T21752] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1597.475099][T21752] RIP: 0033:0x7fbad6b9e0d9 [ 1597.475114][T21752] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1597.475130][T21752] RSP: 002b:00007fbad7af1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1597.475149][T21752] RAX: ffffffffffffffda RBX: 00007fbad6e25fa0 RCX: 00007fbad6b9e0d9 [ 1597.475167][T21752] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 1597.475177][T21752] RBP: 00007fbad7af1090 R08: 0000000000000000 R09: 0000000000000000 [ 1597.475187][T21752] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1597.475197][T21752] R13: 00007fbad6e26038 R14: 00007fbad6e25fa0 R15: 00007ffe910b9598 [ 1597.475227][T21752] [ 1599.465377][ T10] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 1599.704142][ T10] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1599.719600][ T10] usb 3-1: New USB device found, idVendor=200c, idProduct=100b, bcdDevice= 0.40 [ 1599.775619][ T9651] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 1599.787269][ T10] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1599.893562][ T10] usb 3-1: string descriptor 0 read error: -22 [ 1599.929629][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1600.484484][T21767] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1600.537877][T21767] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1600.615370][ T9651] usb 5-1: Using ep0 maxpacket: 32 [ 1600.625543][ T9651] usb 5-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1600.645190][ T9651] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1600.662054][ T9651] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1600.680272][T21776] ip_tables: iptables: counters copy to user failed while replacing table [ 1600.689813][ T9651] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1600.711551][ T9651] usb 5-1: config 0 descriptor?? [ 1600.728251][ T30] audit: type=1400 audit(1786394174.956:724): avc: denied { associate } for pid=21775 comm="syz.0.4011" name="cgroup" scontext=root:object_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 1600.739975][T21776] netlink: 6 bytes leftover after parsing attributes in process `syz.0.4011'. [ 1600.769553][T21776] sit0: entered promiscuous mode [ 1600.992279][ T10] usb 3-1: current rate 7020544 is different from the runtime rate 48000 [ 1601.162503][ T9651] ft260 0003:0403:6030.0011: unknown main item tag 0x0 [ 1601.184865][T21785] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4014'. [ 1601.222355][ T9651] ft260 0003:0403:6030.0011: unknown main item tag 0x0 [ 1601.236081][T10869] usb 3-1: USB disconnect, device number 53 [ 1601.253559][T21785] netlink: 212 bytes leftover after parsing attributes in process `syz.3.4014'. [ 1601.279122][T21785] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4014'. [ 1601.336373][ T9651] ft260 0003:0403:6030.0011: chip code: 0000 0000 [ 1601.592787][ T9651] ft260 0003:0403:6030.0011: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.4-1/input0 [ 1601.750730][ T9651] ft260 0003:0403:6030.0011: failed to retrieve status: -32, no wakeup [ 1601.763055][T21790] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4015'. [ 1601.792314][ T9651] ft260 0003:0403:6030.0011: failed to retrieve status: -71 [ 1601.802618][T21790] netlink: 212 bytes leftover after parsing attributes in process `syz.0.4015'. [ 1601.821650][ T9651] ft260 0003:0403:6030.0011: failed to reset I2C controller: -71 [ 1601.843361][T21790] netlink: 32 bytes leftover after parsing attributes in process `syz.0.4015'. [ 1601.903972][ T9651] usb 5-1: USB disconnect, device number 50 [ 1602.672143][T21796] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4016'. [ 1602.734096][T21796] netlink: 212 bytes leftover after parsing attributes in process `syz.2.4016'. [ 1602.785003][T21796] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4016'. [ 1602.834466][T21807] F2FS-fs (nbd4): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 1602.850000][T21807] F2FS-fs (nbd4): Can't find valid F2FS filesystem in 1th superblock [ 1602.859091][T21807] F2FS-fs (nbd4): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 1602.870611][T21807] F2FS-fs (nbd4): Can't find valid F2FS filesystem in 2th superblock [ 1603.005372][T10869] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 1603.305837][T10869] usb 2-1: device descriptor read/64, error -71 [ 1603.450662][T21816] se_device not configured yet, cannot port link [ 1603.537505][ T30] audit: type=1400 audit(1786394177.686:725): avc: denied { write } for pid=21810 comm="syz.4.4022" name="lun_0" dev="configfs" ino=8701 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1604.375328][ T30] audit: type=1400 audit(1786394177.686:726): avc: denied { write } for pid=21810 comm="syz.4.4022" name="lun_0" dev="configfs" ino=8701 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1604.425364][ T30] audit: type=1400 audit(1786394177.706:727): avc: denied { write } for pid=21810 comm="syz.4.4022" name="dev0" dev="configfs" ino=8689 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1604.515431][T10869] usb 2-1: new high-speed USB device number 59 using dummy_hcd [ 1604.601093][ T30] audit: type=1400 audit(1786394177.706:728): avc: denied { setattr } for pid=21810 comm="syz.4.4022" name="dev0" dev="configfs" ino=8689 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1604.715679][T10869] usb 2-1: device descriptor read/64, error -71 [ 1604.875650][T10869] usb usb2-port1: attempt power cycle [ 1606.516299][T10869] usb 2-1: new high-speed USB device number 60 using dummy_hcd [ 1606.538123][T10869] usb 2-1: Using ep0 maxpacket: 16 [ 1606.546236][T10869] usb 2-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 1606.557951][T10869] usb 2-1: config 0 has an invalid interface number: 8 but max is 0 [ 1606.566575][T10869] usb 2-1: config 0 has no interface number 0 [ 1606.572813][T10869] usb 2-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1606.742322][T10869] usb 2-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1606.787011][T10869] usb 2-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 1606.799421][T10869] usb 2-1: Product: syz [ 1606.815577][T10869] usb 2-1: SerialNumber: syz [ 1606.850244][T10869] usb 2-1: config 0 descriptor?? [ 1606.872412][T10869] cm109 2-1:0.8: invalid payload size 0, expected 4 [ 1607.209551][T21830] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=27 sclass=netlink_route_socket pid=21830 comm=syz.1.4028 [ 1607.253006][T10869] input: CM109 USB driver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.8/input/input63 [ 1607.483897][T21844] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4031'. [ 1607.575827][T21844] netlink: 212 bytes leftover after parsing attributes in process `syz.4.4031'. [ 1607.615469][T21844] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4031'. [ 1607.832702][T21851] netlink: 32 bytes leftover after parsing attributes in process `syz.0.4027'. [ 1608.135659][T10869] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 1608.504376][T10869] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 1608.588582][T10869] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1608.641358][T10869] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1608.678349][T10869] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1608.710830][T10869] usb 1-1: config 0 descriptor?? [ 1608.729897][T21859] tipc: Enabled bearer , priority 0 [ 1608.810827][T21859] syzkaller0: entered promiscuous mode [ 1608.874500][T21859] syzkaller0: entered allmulticast mode [ 1609.069692][T21859] tipc: Resetting bearer [ 1609.112901][ C1] cm109_urb_ctl_callback: 82 callbacks suppressed [ 1609.112963][ C1] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1609.126724][ C1] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1609.133841][ C1] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1609.141144][ C1] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1609.148382][ C1] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1609.165389][ C1] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1609.172991][ C1] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1609.185320][ C1] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1609.192489][ C1] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1609.205323][ C1] cm109 2-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1609.226709][ T24] usb 2-1: USB disconnect, device number 60 [ 1609.232699][ C1] cm109 2-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 1609.313133][T21858] tipc: Resetting bearer [ 1609.339809][ T24] cm109 2-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 1609.402352][T10869] pyra 0003:1E7D:2CF6.0012: item fetching failed at offset 5/7 [ 1609.414907][T21868] x_tables: duplicate underflow at hook 3 [ 1609.431629][T10869] pyra 0003:1E7D:2CF6.0012: parse failed [ 1609.562047][T10869] pyra 0003:1E7D:2CF6.0012: probe with driver pyra failed with error -22 [ 1610.258664][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 1610.271802][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1610.954610][T21858] tipc: Disabling bearer [ 1611.088859][T18876] usb 1-1: USB disconnect, device number 41 [ 1611.127457][ T9651] tipc: Node number set to 688145290 [ 1612.136626][T21895] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4042'. [ 1612.175139][T21895] netlink: 212 bytes leftover after parsing attributes in process `syz.3.4042'. [ 1612.195367][T21895] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4042'. [ 1613.108387][T18876] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 1613.542160][T18876] usb 4-1: New USB device found, idVendor=0fc5, idProduct=1227, bcdDevice=2d.d8 [ 1613.572743][T18876] usb 4-1: config 219 has too many interfaces: 243, using maximum allowed: 32 [ 1613.600355][T18876] usb 4-1: config 219 has an invalid descriptor of length 0, skipping remainder of the config [ 1613.729207][T18876] usb 4-1: config 219 has 1 interface, different from the descriptor's value: 243 [ 1613.754038][T18876] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1613.762624][T18876] usb 4-1: Product: syz [ 1613.772568][T18876] usb 4-1: Manufacturer: syz [ 1613.827099][T18876] usb 4-1: SerialNumber: syz [ 1614.333892][T18876] usbsevseg 4-1:219.0: USB 7 Segment device now attached [ 1614.414343][T21923] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4049'. [ 1614.949398][T18876] usb 4-1: USB disconnect, device number 60 [ 1615.007303][T18876] usbsevseg 4-1:219.0: USB 7 Segment now disconnected [ 1615.692377][T21935] tipc: Enabled bearer , priority 0 [ 1615.723676][T21935] syzkaller0: entered promiscuous mode [ 1615.771051][T21935] syzkaller0: entered allmulticast mode [ 1616.021720][T21935] tipc: Resetting bearer [ 1616.473530][T21934] tipc: Resetting bearer [ 1616.503942][T21934] tipc: Disabling bearer [ 1616.836590][T21947] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4056'. [ 1616.878436][T21947] netlink: 212 bytes leftover after parsing attributes in process `syz.1.4056'. [ 1616.935387][T21947] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4056'. [ 1616.993978][T21951] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4056'. [ 1617.306878][ T10] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 1617.745600][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 1618.488878][T21965] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4060'. [ 1619.241152][T21970] binder: BINDER_SET_CONTEXT_MGR already set [ 1619.268363][T21970] binder: 21969:21970 ioctl 4018620d 200000000040 returned -16 [ 1619.316971][T21970] binder: 21969:21970 ioctl c0306201 0 returned -14 [ 1619.361516][T21972] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4062'. [ 1619.797227][T18876] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 1620.126120][T18876] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 1620.145458][ T10] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1620.153280][ T10] usb 4-1: New USB device found, idVendor=0582, idProduct=0044, bcdDevice= 0.40 [ 1620.188424][T18876] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1620.228314][ T10] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 1620.247012][T18876] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1620.402143][ T10] usb 4-1: can't read configurations, error -71 [ 1620.815651][ T10] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 1620.822951][T18876] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1620.838881][T18876] usb 5-1: config 0 descriptor?? [ 1621.027175][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 1621.068952][ T10] usb 4-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1621.107299][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1621.185563][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1621.245280][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1621.308247][ T10] usb 4-1: config 0 descriptor?? [ 1621.833119][T18876] pyra 0003:1E7D:2CF6.0013: item fetching failed at offset 5/7 [ 1622.144650][T18876] pyra 0003:1E7D:2CF6.0013: parse failed [ 1622.154473][T18876] pyra 0003:1E7D:2CF6.0013: probe with driver pyra failed with error -22 [ 1622.365568][ T10] ft260 0003:0403:6030.0014: unknown main item tag 0x0 [ 1622.386726][T21999] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4069'. [ 1622.399260][ T10] ft260 0003:0403:6030.0014: unknown main item tag 0x0 [ 1622.451141][T21999] netlink: 212 bytes leftover after parsing attributes in process `syz.1.4069'. [ 1622.479842][T22003] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 1622.491501][T21999] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4069'. [ 1622.600328][ T10] ft260 0003:0403:6030.0014: chip code: 0000 0000 [ 1622.798616][ T10] ft260 0003:0403:6030.0014: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.3-1/input0 [ 1622.954369][T18876] usb 5-1: USB disconnect, device number 51 [ 1623.071440][ T10] ft260 0003:0403:6030.0014: failed to retrieve status: -32, no wakeup [ 1623.281912][ T10] ft260 0003:0403:6030.0014: failed to retrieve status: -71 [ 1623.293174][ T10] ft260 0003:0403:6030.0014: failed to reset I2C controller: -71 [ 1623.389482][ T10] usb 4-1: USB disconnect, device number 62 [ 1623.664014][T22013] binder: 22012:22013 ioctl c0306201 0 returned -14 [ 1624.255529][T18876] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 1624.441739][T22025] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4072'. [ 1624.452733][T18876] usb 4-1: Using ep0 maxpacket: 32 [ 1624.711546][T18876] usb 4-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1624.832512][T18876] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1624.866947][T18876] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1624.898544][T18876] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1624.971170][T18876] usb 4-1: config 0 descriptor?? [ 1625.676710][T18876] ft260 0003:0403:6030.0015: unknown main item tag 0x0 [ 1625.685715][T18876] ft260 0003:0403:6030.0015: unknown main item tag 0x0 [ 1625.746132][T18876] ft260 0003:0403:6030.0015: chip code: 0000 0000 [ 1625.947156][T18876] ft260 0003:0403:6030.0015: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.3-1/input0 [ 1626.167952][T18876] ft260 0003:0403:6030.0015: failed to retrieve status: -32, no wakeup [ 1627.605438][T22044] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1628.417118][T22054] netlink: 'syz.4.4085': attribute type 1 has an invalid length. [ 1628.506711][T18876] usb 4-1: USB disconnect, device number 63 [ 1628.821234][T22064] netlink: 60 bytes leftover after parsing attributes in process `syz.4.4085'. [ 1628.904023][ T30] audit: type=1400 audit(1786394203.136:729): avc: denied { bind } for pid=22065 comm="syz.1.4088" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1628.958662][T22056] 8021q: adding VLAN 0 to HW filter on device bond29 [ 1628.986830][ T30] audit: type=1400 audit(1786394203.136:730): avc: denied { name_bind } for pid=22065 comm="syz.1.4088" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 1629.013333][T22054] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4085'. [ 1629.029643][T22066] binder: 22065:22066 ioctl c0306201 200000000440 returned -14 [ 1629.101237][ T30] audit: type=1400 audit(1786394203.136:731): avc: denied { node_bind } for pid=22065 comm="syz.1.4088" saddr=fc02::1 src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 1629.160302][T22056] bond28: (slave bond29): making interface the new active one [ 1629.206011][T22056] bond28: (slave bond29): Enslaving as an active interface with an up link [ 1629.401084][T22054] 8021q: adding VLAN 0 to HW filter on device bond28 [ 1629.969935][T22072] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4090'. [ 1630.012621][T22072] netlink: 212 bytes leftover after parsing attributes in process `syz.1.4090'. [ 1630.147286][T22072] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4090'. [ 1631.536191][T22091] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4095'. [ 1631.580236][T22091] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4095'. [ 1632.319025][T22095] hpfs: Bad magic ... probably not HPFS [ 1632.498507][T22097] bond30 (unregistering): Released all slaves [ 1632.773826][T22109] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4099'. [ 1633.070320][T22116] x_tables: duplicate underflow at hook 3 [ 1633.164312][T22117] tipc: Enabled bearer , priority 0 [ 1633.194818][T22117] syzkaller0: entered promiscuous mode [ 1633.210812][T22117] syzkaller0: entered allmulticast mode [ 1633.355901][T22117] tipc: Resetting bearer [ 1633.383212][T22115] tipc: Resetting bearer [ 1633.537133][T22115] tipc: Disabling bearer [ 1633.645930][ T188] usb 2-1: new high-speed USB device number 61 using dummy_hcd [ 1633.975456][ T188] usb 2-1: Using ep0 maxpacket: 32 [ 1635.306080][T22133] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4106'. [ 1635.363465][T22134] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4106'. [ 1636.082275][T22148] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 1636.116396][T22146] tipc: Enabled bearer , priority 0 [ 1636.154955][T22146] syzkaller0: entered promiscuous mode [ 1636.176466][T22146] syzkaller0: entered allmulticast mode [ 1636.315448][T22146] tipc: Resetting bearer [ 1636.326013][T22144] tipc: Resetting bearer [ 1636.365144][ T24] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 1636.393069][T22144] tipc: Disabling bearer [ 1636.421227][ T188] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1636.435338][T18876] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 1636.488616][ T188] usb 2-1: New USB device found, idVendor=0582, idProduct=0044, bcdDevice= 0.40 [ 1636.510397][ T188] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 1636.528494][ T188] usb 2-1: can't read configurations, error -71 [ 1636.546990][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 1636.553317][ T24] usb 4-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 1636.574625][ T24] usb 4-1: config 0 has an invalid interface number: 8 but max is 0 [ 1636.583537][ T24] usb 4-1: config 0 has no interface number 0 [ 1636.597570][ T24] usb 4-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1636.620817][T18876] usb 3-1: Using ep0 maxpacket: 16 [ 1636.643801][T18876] usb 3-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 1636.662333][ T24] usb 4-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1636.691237][T18876] usb 3-1: config 0 has an invalid interface number: 8 but max is 0 [ 1636.716931][ T24] usb 4-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 1636.725307][T18876] usb 3-1: config 0 has no interface number 0 [ 1636.735400][ T24] usb 4-1: Product: syz [ 1636.739716][T18876] usb 3-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1636.753877][ T24] usb 4-1: SerialNumber: syz [ 1636.770780][T18876] usb 3-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1636.783989][ T24] usb 4-1: config 0 descriptor?? [ 1636.797835][ T24] cm109 4-1:0.8: invalid payload size 0, expected 4 [ 1636.809189][T18876] usb 3-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 1636.956435][ T188] usb 2-1: new high-speed USB device number 62 using dummy_hcd [ 1637.246952][ T188] usb 2-1: Using ep0 maxpacket: 16 [ 1637.285412][T22145] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=27 sclass=netlink_route_socket pid=22145 comm=syz.3.4111 [ 1637.335118][ T188] usb 2-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 1637.421228][ T188] usb 2-1: config 0 has an invalid interface number: 8 but max is 0 [ 1637.478223][T18876] usb 3-1: Product: syz [ 1637.481114][ T188] usb 2-1: config 0 has no interface number 0 [ 1637.521613][ T188] usb 2-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1637.613508][ T188] usb 2-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1637.924898][ T24] input: CM109 USB driver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.8/input/input64 [ 1637.929194][ T188] usb 2-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 1637.942523][T18876] usb 3-1: SerialNumber: syz [ 1637.948558][ C1] cm109_urb_ctl_callback: 90 callbacks suppressed [ 1637.948628][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1637.963812][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1637.971513][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1637.979476][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1637.989173][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1637.996740][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1637.997681][ T188] usb 2-1: Product: syz [ 1638.006580][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1638.016328][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1638.020958][ T188] usb 2-1: SerialNumber: syz [ 1638.025301][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1638.043647][ C1] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1638.051981][T18876] usb 3-1: config 0 descriptor?? [ 1638.070842][ T24] usb 4-1: USB disconnect, device number 64 [ 1638.070896][ C1] cm109 4-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 1638.094125][T18876] cm109 3-1:0.8: invalid payload size 0, expected 4 [ 1638.107635][ T188] usb 2-1: config 0 descriptor?? [ 1638.109898][T18876] input: CM109 USB driver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.8/input/input65 [ 1638.124019][ T24] cm109 4-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 1638.130530][ T188] cm109 2-1:0.8: invalid payload size 0, expected 4 [ 1638.229988][ T188] input: CM109 USB driver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.8/input/input66 [ 1638.333005][T22154] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=27 sclass=netlink_route_socket pid=22154 comm=syz.1.4114 [ 1638.576487][T22150] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=27 sclass=netlink_route_socket pid=22150 comm=syz.2.4113 [ 1638.602786][T22167] x_tables: duplicate underflow at hook 3 [ 1640.124231][T22185] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 1640.305354][ T9651] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 1640.306100][ T5794] usb 3-1: USB disconnect, device number 54 [ 1640.313086][ C1] cm109 3-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 1640.361462][ T5794] cm109 3-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 1640.512909][ T10] usb 2-1: USB disconnect, device number 62 [ 1640.518984][ C0] cm109 2-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 1640.536001][ T9651] usb 5-1: New USB device found, idVendor=0584, idProduct=0008, bcdDevice= 1.02 [ 1640.849873][ T10] cm109 2-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 1640.858040][ T9651] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1640.882058][ T9651] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1640.923921][ T9651] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1640.984960][ T9651] ums-alauda 5-1:1.0: USB Mass Storage device detected [ 1641.055627][ T9651] ums-alauda 5-1:1.0: This device (0584,0008,0102 S 06 P f4) has unneeded SubClass and Protocol entries in unusual_devs.h (kernel syzkaller) [ 1641.055627][ T9651] Please send a copy of this message to and [ 1641.180000][ T9651] scsi host1: usb-storage 5-1:1.0 [ 1641.695940][ T24] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 1641.855522][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 1641.868604][ T24] usb 3-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1641.898746][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1641.921365][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1641.941877][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1641.968627][ T24] usb 3-1: config 0 descriptor?? [ 1642.477470][ T24] ft260 0003:0403:6030.0016: unknown main item tag 0x0 [ 1642.489677][ T3244] scsi 1:0:0:0: Direct-Access Fujifilm DPC-R1 (Alauda) 0102 PQ: 0 ANSI: 0 CCS [ 1642.499857][ T24] ft260 0003:0403:6030.0016: unknown main item tag 0x0 [ 1642.511379][ T3244] scsi 1:0:0:1: Direct-Access Fujifilm DPC-R1 (Alauda) 0102 PQ: 0 ANSI: 0 CCS [ 1642.592076][ T24] ft260 0003:0403:6030.0016: chip code: 0000 0000 [ 1642.650054][ T3244] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 1642.714406][ T3244] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 1642.791841][ T24] ft260 0003:0403:6030.0016: failed to retrieve system status [ 1642.804751][ T24] ft260 0003:0403:6030.0016: probe with driver ft260 failed with error -5 [ 1642.998783][ T24] usb 3-1: USB disconnect, device number 55 [ 1643.075371][ T3299] sd 1:0:0:0: [sdb] Media removed, stopped polling [ 1643.083542][ T9651] usb 5-1: USB disconnect, device number 52 [ 1643.104029][ T3320] sd 1:0:0:1: [sdc] Media removed, stopped polling [ 1643.244604][ T30] audit: type=1400 audit(1786394217.476:732): avc: denied { create } for pid=22225 comm="syz.1.4132" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1643.494169][ T30] audit: type=1400 audit(1786394217.506:733): avc: denied { setopt } for pid=22225 comm="syz.1.4132" lport=5 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1643.710711][T22230] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4133'. [ 1643.866871][T22230] netlink: 212 bytes leftover after parsing attributes in process `syz.4.4133'. [ 1643.936693][T18876] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 1643.953090][T22230] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4133'. [ 1643.977777][ T3299] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 1644.011892][ T3320] sd 1:0:0:1: [sdc] Attached SCSI removable disk [ 1644.125638][T21073] sd 1:0:0:1: [sdc] Test Unit Ready failed: Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK [ 1644.182880][T18876] usb 1-1: Using ep0 maxpacket: 16 [ 1644.208053][ T30] audit: type=1400 audit(1786394218.436:734): avc: denied { create } for pid=22232 comm="syz.2.4135" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1644.236783][T18876] usb 1-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 1644.302810][T18876] usb 1-1: config 0 has an invalid interface number: 8 but max is 0 [ 1644.335097][T18876] usb 1-1: config 0 has no interface number 0 [ 1644.345591][ T30] audit: type=1400 audit(1786394218.566:735): avc: denied { bind } for pid=22232 comm="syz.2.4135" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1644.380982][T18876] usb 1-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1644.433546][T18876] usb 1-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1644.454232][ T30] audit: type=1400 audit(1786394218.686:736): avc: denied { write } for pid=22232 comm="syz.2.4135" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1644.500578][T18876] usb 1-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 1644.520899][T18876] usb 1-1: Product: syz [ 1644.534129][ T30] audit: type=1400 audit(1786394218.716:737): avc: denied { connect } for pid=22232 comm="syz.2.4135" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1644.564675][T18876] usb 1-1: SerialNumber: syz [ 1644.595303][T18876] usb 1-1: config 0 descriptor?? [ 1644.630544][T18876] cm109 1-1:0.8: invalid payload size 0, expected 4 [ 1644.782886][T22248] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4139'. [ 1644.919737][T22250] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4139'. [ 1645.274153][T22231] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=27 sclass=netlink_route_socket pid=22231 comm=syz.0.4134 [ 1645.510101][ T30] audit: type=1400 audit(1786394218.996:738): avc: denied { write } for pid=22239 comm="syz.1.4137" lport=5 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1645.532430][T18876] input: CM109 USB driver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.8/input/input67 [ 1646.283266][ C1] cm109_urb_ctl_callback: 379 callbacks suppressed [ 1646.283289][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1646.287996][ T5794] usb 1-1: USB disconnect, device number 42 [ 1646.289896][ C1] cm109 1-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 1646.644974][T22263] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4141'. [ 1647.121736][ T5794] cm109 1-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 1648.740522][ T9651] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 1649.301849][ T30] audit: type=1400 audit(1786394223.536:739): avc: denied { bind } for pid=22286 comm="syz.0.4148" lport=64 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1649.385428][ T10] usb 2-1: new high-speed USB device number 63 using dummy_hcd [ 1650.035326][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 1650.045761][ T10] usb 2-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1650.066768][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1650.097262][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1650.134774][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1650.179853][ T10] usb 2-1: config 0 descriptor?? [ 1650.565318][T19224] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 1650.615411][ T24] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 1650.615957][ T10] ft260 0003:0403:6030.0017: unknown main item tag 0x0 [ 1650.650589][ T10] ft260 0003:0403:6030.0017: unknown main item tag 0x0 [ 1650.725331][T19224] usb 1-1: Using ep0 maxpacket: 32 [ 1650.739630][T19224] usb 1-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1650.766350][T19224] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1650.795291][T19224] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1650.807747][ T10] ft260 0003:0403:6030.0017: chip code: 0000 0000 [ 1650.825305][T19224] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1650.876603][T19224] usb 1-1: config 0 descriptor?? [ 1650.946662][ T24] usb 5-1: New USB device found, idVendor=0584, idProduct=0008, bcdDevice= 1.02 [ 1650.969124][ T24] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1650.984702][ T24] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1651.001911][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1651.008211][ T10] ft260 0003:0403:6030.0017: failed to retrieve system status [ 1651.047709][ T10] ft260 0003:0403:6030.0017: probe with driver ft260 failed with error -5 [ 1651.153350][ T24] ums-alauda 5-1:1.0: USB Mass Storage device detected [ 1651.167831][ T24] ums-alauda 5-1:1.0: This device (0584,0008,0102 S 06 P f4) has unneeded SubClass and Protocol entries in unusual_devs.h (kernel syzkaller) [ 1651.167831][ T24] Please send a copy of this message to and [ 1651.197792][ T24] scsi host1: usb-storage 5-1:1.0 [ 1651.220819][ T10] usb 2-1: USB disconnect, device number 63 [ 1651.269837][T22312] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4154'. [ 1651.326016][T19224] usbhid 1-1:0.0: can't add hid device: -32 [ 1651.473439][T19224] usbhid 1-1:0.0: probe with driver usbhid failed with error -32 [ 1651.582196][T19224] usb 1-1: USB disconnect, device number 43 [ 1652.006691][ T24] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 1652.413887][ T24] usb 3-1: New USB device found, idVendor=0584, idProduct=0008, bcdDevice= 1.02 [ 1652.893797][ T24] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1652.903775][ T3314] scsi 1:0:0:0: Direct-Access Fujifilm DPC-R1 (Alauda) 0102 PQ: 0 ANSI: 0 CCS [ 1652.918587][ T24] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1652.928496][ T3314] scsi 1:0:0:1: Direct-Access Fujifilm DPC-R1 (Alauda) 0102 PQ: 0 ANSI: 0 CCS [ 1652.939142][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1652.965194][ T24] ums-alauda 3-1:1.0: USB Mass Storage device detected [ 1652.994835][ T24] ums-alauda 3-1:1.0: This device (0584,0008,0102 S 06 P f4) has unneeded SubClass and Protocol entries in unusual_devs.h (kernel syzkaller) [ 1652.994835][ T24] Please send a copy of this message to and [ 1653.084274][ T3314] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 1653.163455][ T24] scsi host2: usb-storage 3-1:1.0 [ 1653.259788][ T3314] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 1653.401590][ T24] usb 5-1: USB disconnect, device number 54 [ 1653.410130][ T3299] sd 1:0:0:0: [sdb] Media removed, stopped polling [ 1653.421410][ T3244] sd 1:0:0:1: [sdc] Media removed, stopped polling [ 1654.283209][ T3299] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 1654.297684][ T3244] sd 1:0:0:1: [sdc] Attached SCSI removable disk [ 1654.310318][ T3345] scsi 2:0:0:0: Direct-Access Fujifilm DPC-R1 (Alauda) 0102 PQ: 0 ANSI: 0 CCS [ 1654.345450][T21073] sd 1:0:0:1: [sdc] Test Unit Ready failed: Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK [ 1654.413009][ T3345] scsi 2:0:0:1: Direct-Access Fujifilm DPC-R1 (Alauda) 0102 PQ: 0 ANSI: 0 CCS [ 1654.945875][ T9651] usb 3-1: USB disconnect, device number 56 [ 1654.985076][ T3299] sd 2:0:0:0: [sdd] Media removed, stopped polling [ 1655.028559][ T3345] sd 2:0:0:0: Attached scsi generic sg1 type 0 [ 1655.036106][T18876] usb 2-1: new high-speed USB device number 64 using dummy_hcd [ 1655.235924][T18876] usb 2-1: Using ep0 maxpacket: 32 [ 1655.287536][ T3345] sd 2:0:0:1: Attached scsi generic sg3 type 0 [ 1655.290294][ T3299] sd 2:0:0:0: [sdd] Attached SCSI removable disk [ 1655.296817][T18236] sd 2:0:0:1: [sde] Test Unit Ready failed: Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK [ 1655.315164][T18876] usb 2-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1655.354257][T21090] sd 2:0:0:0: [sdd] Test Unit Ready failed: Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK [ 1655.379313][T18876] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1655.684498][T18236] sd 2:0:0:1: [sde] Read Capacity(10) failed: Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK [ 1655.890003][T18236] sd 2:0:0:1: [sde] Sense not available. [ 1655.905314][T18876] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1655.922366][T18876] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1655.964469][T18236] sd 2:0:0:1: [sde] 0 512-byte logical blocks: (0 B/0 B) [ 1655.971737][T18236] sd 2:0:0:1: [sde] 0-byte physical blocks [ 1656.037108][T18236] sd 2:0:0:1: [sde] Test WP failed, assume Write Enabled [ 1656.047101][T18236] sd 2:0:0:1: [sde] Asking for cache data failed [ 1656.060167][T21086] udevd[21086]: inotify_add_watch(7, /dev/sdb, 10) failed: No such file or directory [ 1656.080230][T18236] sd 2:0:0:1: [sde] Assuming drive cache: write through [ 1656.088217][T18876] usb 2-1: config 0 descriptor?? [ 1656.310134][T21088] sd 2:0:0:1: [sde] Test Unit Ready failed: Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK [ 1656.356706][T18236] sd 2:0:0:1: [sde] Attached SCSI removable disk [ 1656.603511][T18876] ft260 0003:0403:6030.0018: unknown main item tag 0x0 [ 1656.633199][T18876] ft260 0003:0403:6030.0018: unknown main item tag 0x0 [ 1656.848223][T10869] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 1656.864771][T18876] ft260 0003:0403:6030.0018: chip code: 0000 0000 [ 1656.967413][T18876] ft260 0003:0403:6030.0018: failed to retrieve system status [ 1657.004118][T18876] ft260 0003:0403:6030.0018: probe with driver ft260 failed with error -5 [ 1657.324043][T10869] usb 1-1: New USB device found, idVendor=0584, idProduct=0008, bcdDevice= 1.02 [ 1657.400499][T10869] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1657.412423][T18876] usb 2-1: USB disconnect, device number 64 [ 1657.442151][T10869] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1657.532428][T10869] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1657.622976][T21086] udevd[21086]: inotify_add_watch(7, /dev/sdd, 10) failed: No such file or directory [ 1657.759054][T10869] ums-alauda 1-1:1.0: USB Mass Storage device detected [ 1657.905973][T22388] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4175'. [ 1657.919265][T10869] ums-alauda 1-1:1.0: This device (0584,0008,0102 S 06 P f4) has unneeded SubClass and Protocol entries in unusual_devs.h (kernel syzkaller) [ 1657.919265][T10869] Please send a copy of this message to and [ 1657.969054][T10869] scsi host1: usb-storage 1-1:1.0 [ 1657.974782][T22388] netlink: 212 bytes leftover after parsing attributes in process `syz.4.4175'. [ 1658.045516][T22388] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4175'. [ 1658.731501][T22411] tipc: Enabled bearer , priority 0 [ 1658.778650][T22411] syzkaller0: entered promiscuous mode [ 1658.817551][T22411] syzkaller0: entered allmulticast mode [ 1658.937666][T22408] tipc: Resetting bearer [ 1659.062405][ T3358] scsi 1:0:0:0: Direct-Access Fujifilm DPC-R1 (Alauda) 0102 PQ: 0 ANSI: 0 CCS [ 1659.096206][T22408] tipc: Disabling bearer [ 1659.185838][ T3358] scsi 1:0:0:1: Direct-Access Fujifilm DPC-R1 (Alauda) 0102 PQ: 0 ANSI: 0 CCS [ 1659.556506][ T3358] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 1659.610288][T10869] usb 1-1: USB disconnect, device number 44 [ 1659.616590][T18236] sd 1:0:0:0: [sdb] Media removed, stopped polling [ 1659.669256][ T3299] sd 1:0:0:1: [sdc] Test Unit Ready failed: Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK [ 1659.690703][ T3358] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 1659.725981][ T3299] sd 1:0:0:1: [sdc] Read Capacity(10) failed: Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK [ 1659.799043][ T3299] sd 1:0:0:1: [sdc] Sense not available. [ 1659.831249][ T3299] sd 1:0:0:1: [sdc] 0 512-byte logical blocks: (0 B/0 B) [ 1659.852214][T18236] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 1659.958973][ T3299] sd 1:0:0:1: [sdc] 0-byte physical blocks [ 1660.231655][ T3299] sd 1:0:0:1: [sdc] Test WP failed, assume Write Enabled [ 1660.274104][ T3299] sd 1:0:0:1: [sdc] Asking for cache data failed [ 1660.301905][ T3299] sd 1:0:0:1: [sdc] Assuming drive cache: write through [ 1660.465582][ T3299] sd 1:0:0:1: [sdc] Attached SCSI removable disk [ 1660.470268][T21074] sd 1:0:0:1: [sdc] Test Unit Ready failed: Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK [ 1660.652487][T22429] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4185'. [ 1660.750479][T22429] netlink: 212 bytes leftover after parsing attributes in process `syz.3.4185'. [ 1660.843229][T22429] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4185'. [ 1660.859481][T21086] udevd[21086]: inotify_add_watch(7, /dev/sdb, 10) failed: No such file or directory [ 1664.293209][T22461] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4193'. [ 1664.565365][ T29] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 1664.778124][ T29] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 1664.811895][ T29] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1664.831903][T22468] netlink: 'syz.1.4195': attribute type 1 has an invalid length. [ 1664.860172][ T29] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1664.892771][ T29] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1664.964108][ T29] usb 5-1: config 0 descriptor?? [ 1665.006937][T22474] netlink: 60 bytes leftover after parsing attributes in process `syz.1.4195'. [ 1665.294355][T22468] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4195'. [ 1665.346968][T22472] 8021q: adding VLAN 0 to HW filter on device bond32 [ 1665.402881][T22472] bond31: (slave bond32): making interface the new active one [ 1665.443279][T22472] bond31: (slave bond32): Enslaving as an active interface with an up link [ 1665.524412][T22468] 8021q: adding VLAN 0 to HW filter on device bond31 [ 1666.222159][ T29] usbhid 5-1:0.0: can't add hid device: -71 [ 1666.274869][ T29] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1666.320419][T10869] usb 2-1: new high-speed USB device number 65 using dummy_hcd [ 1666.362688][ T29] usb 5-1: USB disconnect, device number 55 [ 1666.476440][T10869] usb 2-1: device descriptor read/64, error -71 [ 1666.755373][T10869] usb 2-1: new high-speed USB device number 66 using dummy_hcd [ 1666.925361][T10869] usb 2-1: device descriptor read/64, error -71 [ 1667.056494][T10869] usb usb2-port1: attempt power cycle [ 1667.455413][T10869] usb 2-1: new high-speed USB device number 67 using dummy_hcd [ 1667.527906][T10869] usb 2-1: device descriptor read/8, error -71 [ 1667.815514][T10869] usb 2-1: new high-speed USB device number 68 using dummy_hcd [ 1668.214735][T10869] usb 2-1: device descriptor read/8, error -71 [ 1668.326149][T10869] usb usb2-port1: unable to enumerate USB device [ 1669.065367][T10869] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 1669.382749][T10869] usb 4-1: New USB device found, idVendor=0584, idProduct=0008, bcdDevice= 1.02 [ 1669.442942][T10869] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1669.500898][T10869] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1669.551704][T10869] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1669.606222][ T8914] usb 2-1: new high-speed USB device number 69 using dummy_hcd [ 1669.646058][T10869] ums-alauda 4-1:1.0: USB Mass Storage device detected [ 1669.713843][T10869] ums-alauda 4-1:1.0: This device (0584,0008,0102 S 06 P f4) has unneeded SubClass and Protocol entries in unusual_devs.h (kernel syzkaller) [ 1669.713843][T10869] Please send a copy of this message to and [ 1669.785905][ T8914] usb 2-1: Using ep0 maxpacket: 32 [ 1669.825487][ T8914] usb 2-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1669.853975][ T8914] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1669.877235][ T8914] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1669.904532][ T8914] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1669.935768][ T8914] usb 2-1: config 0 descriptor?? [ 1669.952389][T10869] scsi host1: usb-storage 4-1:1.0 [ 1670.335883][T19224] usb 5-1: new high-speed USB device number 56 using dummy_hcd [ 1670.390747][ T8914] ft260 0003:0403:6030.0019: unknown main item tag 0x0 [ 1670.408193][ T8914] ft260 0003:0403:6030.0019: unknown main item tag 0x0 [ 1670.447992][T22519] syzkaller0: entered promiscuous mode [ 1670.459649][T22519] syzkaller0: entered allmulticast mode [ 1670.515333][T19224] usb 5-1: Using ep0 maxpacket: 32 [ 1670.526800][T19224] usb 5-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1670.556316][T19224] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1670.573707][ T8914] ft260 0003:0403:6030.0019: chip code: 0000 0000 [ 1670.589447][T19224] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1670.615270][T19224] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1670.638531][T19224] usb 5-1: config 0 descriptor?? [ 1670.664559][ T30] audit: type=1400 audit(1786394244.896:740): avc: denied { ioctl } for pid=22517 comm="syz.0.4207" path="socket:[88959]" dev="sockfs" ino=88959 ioctlcmd=0x8916 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1670.747662][ T30] audit: type=1400 audit(1786394244.986:741): avc: denied { setopt } for pid=22517 comm="syz.0.4207" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 1670.769015][ T8914] ft260 0003:0403:6030.0019: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.1-1/input0 [ 1670.971469][ T8914] ft260 0003:0403:6030.0019: failed to retrieve status: -32, no wakeup [ 1671.083380][ C0] raw-gadget.2 gadget.4: ignoring, device is not running [ 1671.094973][T19224] usbhid 5-1:0.0: can't add hid device: -71 [ 1671.117926][T19224] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1671.149660][T18236] scsi 1:0:0:0: Direct-Access Fujifilm DPC-R1 (Alauda) 0102 PQ: 0 ANSI: 0 CCS [ 1671.175578][T19224] usb 5-1: USB disconnect, device number 56 [ 1671.199258][T22507] ft260 0003:0403:6030.0019: ft260_i2c_read: failed with -38 [ 1671.214985][T10869] usb 2-1: USB disconnect, device number 69 [ 1671.231529][T18236] scsi 1:0:0:1: Direct-Access Fujifilm DPC-R1 (Alauda) 0102 PQ: 0 ANSI: 0 CCS [ 1671.367804][T18236] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 1671.437627][T18236] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 1671.565407][ T29] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 1671.697565][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 1671.706157][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1671.755353][ T29] usb 1-1: Using ep0 maxpacket: 16 [ 1671.806634][ T29] usb 1-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 1671.866675][ T29] usb 1-1: config 0 has an invalid interface number: 8 but max is 0 [ 1671.893157][ T29] usb 1-1: config 0 has no interface number 0 [ 1671.917803][ T3314] sd 1:0:0:0: [sdb] Media removed, stopped polling [ 1671.924815][T10869] usb 4-1: USB disconnect, device number 65 [ 1671.935514][ T3345] sd 1:0:0:1: [sdc] Media removed, stopped polling [ 1671.945079][ T29] usb 1-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1672.031173][ T29] usb 1-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1672.259600][ T29] usb 1-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 1672.377654][ T29] usb 1-1: Product: syz [ 1672.455613][ T29] usb 1-1: SerialNumber: syz [ 1672.628658][ T29] usb 1-1: config 0 descriptor?? [ 1672.874743][ T29] cm109 1-1:0.8: invalid payload size 0, expected 4 [ 1672.930180][ T29] input: CM109 USB driver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.8/input/input68 [ 1673.132622][ T3314] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 1673.220541][ T3345] sd 1:0:0:1: [sdc] Attached SCSI removable disk [ 1673.238027][T21073] sd 1:0:0:1: [sdc] Test Unit Ready failed: Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK [ 1673.280784][T22528] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=27 sclass=netlink_route_socket pid=22528 comm=syz.0.4210 [ 1673.579126][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1673.585309][ T8914] usb 1-1: USB disconnect, device number 45 [ 1673.586288][ C1] cm109 1-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 1673.710114][ T188] usb 2-1: new high-speed USB device number 70 using dummy_hcd [ 1673.720841][ T8914] cm109 1-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 1673.916369][ T188] usb 2-1: Using ep0 maxpacket: 8 [ 1673.956947][ T188] usb 2-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 1674.017405][ T188] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1674.037265][T21074] udevd[21074]: inotify_add_watch(7, /dev/sdb, 10) failed: No such file or directory [ 1674.093452][ T188] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1674.143412][ T188] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1674.159406][ T188] usb 2-1: Product: syz [ 1674.208623][ T188] usb 2-1: Manufacturer: syz [ 1674.241795][ T188] usb 2-1: SerialNumber: syz [ 1674.518530][T22557] binder: 22555:22557 ioctl c0306201 0 returned -14 [ 1674.905354][T10869] usb 4-1: new high-speed USB device number 66 using dummy_hcd [ 1675.065830][T10869] usb 4-1: Using ep0 maxpacket: 32 [ 1675.075191][T10869] usb 4-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1675.095925][T10869] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1675.112037][T10869] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1675.133433][T10869] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1675.157259][T10869] usb 4-1: config 0 descriptor?? [ 1675.675357][T22563] sit0: left promiscuous mode [ 1676.129701][T10869] ft260 0003:0403:6030.001A: unknown main item tag 0x0 [ 1676.148271][T10869] ft260 0003:0403:6030.001A: unknown main item tag 0x0 [ 1676.284392][T10869] ft260 0003:0403:6030.001A: chip code: 0000 0000 [ 1676.310613][T10869] ft260 0003:0403:6030.001A: failed to retrieve system status [ 1676.326520][T10869] ft260 0003:0403:6030.001A: probe with driver ft260 failed with error -5 [ 1676.522231][T10869] usb 2-1: USB disconnect, device number 70 [ 1676.567220][ T188] usb 4-1: USB disconnect, device number 66 [ 1676.755374][ T9651] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 1677.045383][ T9651] usb 1-1: Using ep0 maxpacket: 32 [ 1677.051808][ T9651] usb 1-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1677.072203][ T9651] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1677.084832][ T9651] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1677.106436][ T9651] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1677.197035][ T9651] usb 1-1: config 0 descriptor?? [ 1677.309499][T22581] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4224'. [ 1677.389082][T22581] netlink: 212 bytes leftover after parsing attributes in process `syz.3.4224'. [ 1677.430472][T22581] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4224'. [ 1677.691781][ T9651] usbhid 1-1:0.0: can't add hid device: -71 [ 1677.738222][ T9651] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 1677.952880][ T9651] usb 1-1: USB disconnect, device number 46 [ 1678.293570][ T30] audit: type=1400 audit(1786394252.206:742): avc: denied { setopt } for pid=22583 comm="syz.4.4225" laddr=::1 lport=34082 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1679.613303][T22604] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 conventional PCI endpoint [ 1679.949433][T22616] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4232'. [ 1680.145310][ T8914] usb 5-1: new high-speed USB device number 57 using dummy_hcd [ 1680.325290][ T8914] usb 5-1: Using ep0 maxpacket: 8 [ 1680.346498][ T8914] usb 5-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 1680.400109][ T8914] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1680.425437][ T8914] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1680.454802][ T8914] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1680.463267][ T8914] usb 5-1: Product: syz [ 1680.470000][ T8914] usb 5-1: Manufacturer: syz [ 1680.506982][ T8914] usb 5-1: SerialNumber: syz [ 1681.945360][ T8914] usb 2-1: new high-speed USB device number 71 using dummy_hcd [ 1682.148802][ T8914] usb 2-1: New USB device found, idVendor=0584, idProduct=0008, bcdDevice= 1.02 [ 1682.187484][ T8914] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1682.220115][ T8914] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1682.264817][ T8914] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1682.311522][ T8914] ums-alauda 2-1:1.0: USB Mass Storage device detected [ 1682.350101][ T8914] ums-alauda 2-1:1.0: This device (0584,0008,0102 S 06 P f4) has unneeded SubClass and Protocol entries in unusual_devs.h (kernel syzkaller) [ 1682.350101][ T8914] Please send a copy of this message to and [ 1682.432221][ T8914] scsi host1: usb-storage 2-1:1.0 [ 1682.535421][T19224] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 1683.026080][T19224] usb 1-1: New USB device found, idVendor=0584, idProduct=0008, bcdDevice= 1.02 [ 1683.055813][T19224] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1683.061917][ T9651] usb 5-1: USB disconnect, device number 57 [ 1683.074905][T19224] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1683.105682][T19224] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1683.150563][T19224] ums-alauda 1-1:1.0: USB Mass Storage device detected [ 1683.231191][T19224] ums-alauda 1-1:1.0: This device (0584,0008,0102 S 06 P f4) has unneeded SubClass and Protocol entries in unusual_devs.h (kernel syzkaller) [ 1683.231191][T19224] Please send a copy of this message to and [ 1683.335957][T19224] scsi host2: usb-storage 1-1:1.0 [ 1683.480202][ T3320] scsi 1:0:0:0: Direct-Access Fujifilm DPC-R1 (Alauda) 0102 PQ: 0 ANSI: 0 CCS [ 1683.538490][ T3320] scsi 1:0:0:1: Direct-Access Fujifilm DPC-R1 (Alauda) 0102 PQ: 0 ANSI: 0 CCS [ 1684.157653][ T3320] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 1684.190454][ T3320] scsi 1:0:0:1: Attached scsi generic sg2 type 0 [ 1684.705610][ T395] scsi 2:0:0:0: Direct-Access Fujifilm DPC-R1 (Alauda) 0102 PQ: 0 ANSI: 0 CCS [ 1685.300096][ T395] scsi 2:0:0:1: Direct-Access Fujifilm DPC-R1 (Alauda) 0102 PQ: 0 ANSI: 0 CCS [ 1685.452398][T22673] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4244'. [ 1685.525364][ T8914] usb 1-1: USB disconnect, device number 47 [ 1685.594322][T19224] usb 2-1: USB disconnect, device number 71 [ 1685.605380][ T3345] sd 1:0:0:0: [sdb] Media removed, stopped polling [ 1685.613881][ T12] sd 1:0:0:1: [sdc] Media removed, stopped polling [ 1685.716102][ T9651] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 1685.769311][ T395] sd 2:0:0:0: Attached scsi generic sg1 type 0 [ 1685.772007][ T3320] sd 2:0:0:0: [sdd] Test Unit Ready failed: Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK [ 1685.810776][ T3345] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 1685.841750][ T3320] sd 2:0:0:0: [sdd] Read Capacity(10) failed: Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK [ 1685.867919][T22677] syzkaller0: entered promiscuous mode [ 1685.884037][ T3320] sd 2:0:0:0: [sdd] Sense not available. [ 1685.912131][T22677] syzkaller0: entered allmulticast mode [ 1685.919922][ T9651] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 1685.930936][ T3320] sd 2:0:0:0: [sdd] 0 512-byte logical blocks: (0 B/0 B) [ 1685.979028][T22668] sd 2:0:0:1: [sde] Test Unit Ready failed: Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK [ 1685.982609][ T9651] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1685.989803][ T188] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 1686.010650][ T3320] sd 2:0:0:0: [sdd] 0-byte physical blocks [ 1686.011022][ T12] sd 1:0:0:1: [sdc] Attached SCSI removable disk [ 1686.041454][ T395] sd 2:0:0:1: Attached scsi generic sg3 type 0 [ 1686.051133][T21088] sd 1:0:0:1: [sdc] Test Unit Ready failed: Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK [ 1686.090593][T22668] sd 2:0:0:1: [sde] Read Capacity(10) failed: Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK [ 1686.100142][ T3320] sd 2:0:0:0: [sdd] Test WP failed, assume Write Enabled [ 1686.167592][T22668] sd 2:0:0:1: [sde] Sense not available. [ 1686.169829][ T3320] sd 2:0:0:0: [sdd] Asking for cache data failed [ 1686.188003][ T9651] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1686.203500][T22668] sd 2:0:0:1: [sde] 0 512-byte logical blocks: (0 B/0 B) [ 1686.241460][ T3320] sd 2:0:0:0: [sdd] Assuming drive cache: write through [ 1686.261735][ T9651] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1686.288073][T22668] sd 2:0:0:1: [sde] 0-byte physical blocks [ 1686.315635][ T188] usb 4-1: Using ep0 maxpacket: 32 [ 1686.337732][T22668] sd 2:0:0:1: [sde] Test WP failed, assume Write Enabled [ 1686.367793][ T188] usb 4-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 1686.398360][T22668] sd 2:0:0:1: [sde] Asking for cache data failed [ 1686.422885][ T188] usb 4-1: config 0 has an invalid interface number: 12 but max is 0 [ 1686.453660][T22668] sd 2:0:0:1: [sde] Assuming drive cache: write through [ 1686.475362][ T188] usb 4-1: config 0 has no interface number 0 [ 1686.521992][ T188] usb 4-1: config 0 interface 12 has no altsetting 0 [ 1686.543930][ T9651] usb 3-1: config 0 descriptor?? [ 1686.584417][ T188] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1686.610632][T22668] sd 2:0:0:1: [sde] Attached SCSI removable disk [ 1686.625288][T21073] sd 2:0:0:1: [sde] Test Unit Ready failed: Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK [ 1686.650526][ T188] usb 4-1: Product: syz [ 1686.670576][ T188] usb 4-1: Manufacturer: syz [ 1686.703075][ T188] usb 4-1: SerialNumber: syz [ 1686.828153][ T188] usb 4-1: config 0 descriptor?? [ 1686.875186][T21087] udevd[21087]: inotify_add_watch(7, /dev/sdb, 10) failed: No such file or directory [ 1686.913019][ T3320] sd 2:0:0:0: [sdd] Attached SCSI removable disk [ 1687.991190][ T9651] pyra 0003:1E7D:2CF6.001B: item fetching failed at offset 5/7 [ 1688.002570][T22675] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1688.147975][ T9651] pyra 0003:1E7D:2CF6.001B: parse failed [ 1688.171247][T22699] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4250'. [ 1688.287359][ T9651] pyra 0003:1E7D:2CF6.001B: probe with driver pyra failed with error -22 [ 1688.368119][T21086] udevd[21086]: inotify_add_watch(7, /dev/sdb, 10) failed: No such file or directory [ 1688.378744][T22675] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1688.618150][T21074] udevd[21074]: inotify_add_watch(7, /dev/sdd, 10) failed: No such file or directory [ 1688.637001][T22699] netlink: 212 bytes leftover after parsing attributes in process `syz.4.4250'. [ 1688.682463][T22675] netlink: 'syz.3.4245': attribute type 5 has an invalid length. [ 1688.849996][T22699] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4250'. [ 1689.020725][T22675] ip6erspan0: entered promiscuous mode [ 1689.154686][T10869] usb 3-1: USB disconnect, device number 57 [ 1689.243227][ T188] f81534 4-1:0.12: f81534_get_register: reg: 1003 failed: -32 [ 1689.266969][ T188] f81534 4-1:0.12: f81534_find_config_idx: read failed: -32 [ 1689.286180][T21074] udevd[21074]: inotify_add_watch(7, /dev/sdd, 10) failed: No such file or directory [ 1689.311612][ T188] f81534 4-1:0.12: f81534_calc_num_ports: find idx failed: -32 [ 1689.348516][ T188] f81534 4-1:0.12: probe with driver f81534 failed with error -32 [ 1689.601208][ T188] usb 4-1: USB disconnect, device number 67 [ 1689.795827][T10869] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 1689.842372][T22716] FAULT_INJECTION: forcing a failure. [ 1689.842372][T22716] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1689.903919][T22716] CPU: 1 UID: 0 PID: 22716 Comm: syz.4.4254 Not tainted syzkaller #0 PREEMPT(full) [ 1689.903945][T22716] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1689.903956][T22716] Call Trace: [ 1689.903975][T22716] [ 1689.903983][T22716] dump_stack_lvl+0x100/0x190 [ 1689.904013][T22716] should_fail_ex.cold+0x5/0xa [ 1689.904037][T22716] _copy_to_user+0x32/0xd0 [ 1689.904092][T22716] simple_read_from_buffer+0xcb/0x170 [ 1689.904116][T22716] proc_fail_nth_read+0x1af/0x230 [ 1689.904160][T22716] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1689.904189][T22716] ? rw_verify_area+0xce/0x6d0 [ 1689.904214][T22716] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1689.904247][T22716] vfs_read+0x1e4/0xb40 [ 1689.904276][T22716] ? __pfx_vfs_read+0x10/0x10 [ 1689.904302][T22716] ? __fget_files+0x215/0x3d0 [ 1689.904326][T22716] ? __fget_files+0x21f/0x3d0 [ 1689.904352][T22716] ksys_read+0x12a/0x250 [ 1689.904369][T22716] ? __pfx_ksys_read+0x10/0x10 [ 1689.904393][T22716] do_syscall_64+0x115/0x870 [ 1689.904434][T22716] ? clear_bhb_loop+0x70/0xc0 [ 1689.904456][T22716] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1689.904474][T22716] RIP: 0033:0x7fccdd15e90e [ 1689.904489][T22716] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1689.904505][T22716] RSP: 002b:00007fccde027fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1689.904537][T22716] RAX: ffffffffffffffda RBX: 00007fccde0286c0 RCX: 00007fccdd15e90e [ 1689.904548][T22716] RDX: 000000000000000f RSI: 00007fccde0280a0 RDI: 0000000000000004 [ 1689.904559][T22716] RBP: 00007fccde028090 R08: 0000000000000000 R09: 0000000000000000 [ 1689.904569][T22716] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1689.904579][T22716] R13: 00007fccdd426038 R14: 00007fccdd425fa0 R15: 00007fff0a50ba78 [ 1689.904604][T22716] [ 1690.285388][ T8914] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 1690.396262][T10869] usb 3-1: New USB device found, idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 1690.447416][ T8914] usb 1-1: Using ep0 maxpacket: 32 [ 1690.461611][T10869] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1690.485109][T10869] usb 3-1: Product: syz [ 1690.486429][ T8914] usb 1-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1690.515954][T10869] usb 3-1: Manufacturer: syz [ 1690.543906][ T8914] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1690.568446][T10869] usb 3-1: SerialNumber: syz [ 1690.592903][ T8914] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1690.625609][ T8914] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1690.628206][T10869] usb 3-1: config 0 descriptor?? [ 1690.666055][T10869] dvb-usb: found a 'Nebula Electronics uDigiTV DVB-T USB2.0)' in warm state. [ 1690.709052][ T8914] usb 1-1: config 0 descriptor?? [ 1691.203484][ T8914] usbhid 1-1:0.0: can't add hid device: -71 [ 1691.259705][ T8914] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 1693.047532][T10869] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1693.203180][T10869] dvbdev: DVB: registering new adapter (Nebula Electronics uDigiTV DVB-T USB2.0)) [ 1693.249960][T10869] usb 3-1: media controller created [ 1693.252563][ T8914] usb 1-1: USB disconnect, device number 48 [ 1693.512999][T10869] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1694.099228][T10869] DVB: Unable to find symbol mt352_attach() [ 1694.310565][T10869] DVB: Unable to find symbol nxt6000_attach() [ 1694.343062][T10869] dvb-usb: no frontend was attached by 'Nebula Electronics uDigiTV DVB-T USB2.0)' [ 1694.418382][T10869] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input69 [ 1694.436154][T22735] syzkaller0: entered promiscuous mode [ 1694.489494][T10869] dvb-usb: schedule remote query interval to 1000 msecs. [ 1694.527713][T10869] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0) successfully initialized and connected. [ 1694.539313][T10869] dvb-usb: bulk message failed: -22 (7/0) [ 1694.558485][T22737] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1694.567479][T22735] syzkaller0: entered allmulticast mode [ 1694.597845][T22737] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1694.617274][T22737] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1694.643197][T22737] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1694.651236][T22737] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1694.692673][T10869] dvb-usb: bulk message failed: -22 (7/0) [ 1694.838135][ T5597] bridge0: port 3(syz_tun) entered disabled state [ 1695.036719][T10869] usb 3-1: USB disconnect, device number 58 [ 1695.174775][ T5597] syz_tun (unregistering): left allmulticast mode [ 1695.182716][ T5597] syz_tun (unregistering): left promiscuous mode [ 1695.190812][ T5597] bridge0: port 3(syz_tun) entered disabled state [ 1695.381717][T10869] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0 successfully deinitialized and disconnected. [ 1696.066881][T10869] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 1696.275329][T10869] usb 3-1: Using ep0 maxpacket: 16 [ 1696.294877][T10869] usb 3-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 1696.333128][T10869] usb 3-1: config 0 has an invalid interface number: 8 but max is 0 [ 1696.383514][T10869] usb 3-1: config 0 has no interface number 0 [ 1696.423334][T10869] usb 3-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1696.479651][T10869] usb 3-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1696.531497][T10869] usb 3-1: string descriptor 0 read error: -71 [ 1696.649446][T10869] usb 3-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 1696.707921][T10869] usb 3-1: config 0 descriptor?? [ 1696.724348][T10869] usb 3-1: can't set config #0, error -71 [ 1696.735413][T22737] Bluetooth: hci5: command tx timeout [ 1697.623119][T10869] usb 3-1: USB disconnect, device number 59 [ 1698.146435][T10869] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 1698.321714][T10869] usb 3-1: New USB device found, idVendor=0584, idProduct=0008, bcdDevice= 1.02 [ 1698.353683][T10869] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1698.392103][T10869] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1698.428333][T10869] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1698.462481][T10869] ums-alauda 3-1:1.0: USB Mass Storage device detected [ 1698.518314][T10869] ums-alauda 3-1:1.0: This device (0584,0008,0102 S 06 P f4) has unneeded SubClass and Protocol entries in unusual_devs.h (kernel syzkaller) [ 1698.518314][T10869] Please send a copy of this message to and [ 1698.738332][T10869] scsi host1: usb-storage 3-1:1.0 [ 1698.826239][T22737] Bluetooth: hci5: command tx timeout [ 1699.649820][T10869] usb 3-1: USB disconnect, device number 60 [ 1699.742992][T22736] bridge0: port 1(bridge_slave_0) entered blocking state [ 1699.791541][T22736] bridge0: port 1(bridge_slave_0) entered disabled state [ 1699.842529][T22736] bridge_slave_0: entered allmulticast mode [ 1699.869985][T22736] bridge_slave_0: entered promiscuous mode [ 1699.932002][T22736] bridge0: port 2(bridge_slave_1) entered blocking state [ 1699.969983][T22736] bridge0: port 2(bridge_slave_1) entered disabled state [ 1699.995898][T22736] bridge_slave_1: entered allmulticast mode [ 1700.349420][T22736] bridge_slave_1: entered promiscuous mode [ 1700.816701][T22736] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1700.866511][T22736] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1700.895974][T22737] Bluetooth: hci5: command tx timeout [ 1701.034065][T22736] team0: Port device team_slave_0 added [ 1701.060735][T22736] team0: Port device team_slave_1 added [ 1701.201761][T22736] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1701.221300][T22736] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1701.325306][T10869] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 1701.405333][T22736] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1701.473024][T22736] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1701.501863][T22736] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1701.588487][T10869] usb 3-1: Using ep0 maxpacket: 32 [ 1701.956344][T22736] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1702.299658][T22736] hsr_slave_0: entered promiscuous mode [ 1702.319772][T22736] hsr_slave_1: entered promiscuous mode [ 1702.976374][T22737] Bluetooth: hci5: command tx timeout [ 1704.171612][T10869] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1704.198983][T10869] usb 3-1: New USB device found, idVendor=0582, idProduct=0044, bcdDevice= 0.40 [ 1704.226467][T10869] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 1704.241676][T10869] usb 3-1: can't read configurations, error -71 [ 1704.503511][T22736] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1704.822153][T22736] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1705.057989][T22736] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1705.363397][T22736] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1705.985449][T22736] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1706.043317][T22736] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1706.066911][T22736] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1706.092239][T22736] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1706.118563][T22736] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1706.153454][T22736] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1706.198333][T22736] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1706.232095][T22736] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1706.532195][T22736] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1706.599307][T22736] 8021q: adding VLAN 0 to HW filter on device team0 [ 1706.641560][ T3358] bridge0: port 1(bridge_slave_0) entered blocking state [ 1706.648756][ T3358] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1706.700550][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 1706.707669][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1707.771345][T22736] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1707.922582][T22736] veth0_vlan: entered promiscuous mode [ 1707.970091][T22736] veth1_vlan: entered promiscuous mode [ 1708.088866][T22736] veth0_macvtap: entered promiscuous mode [ 1708.102907][T22736] veth1_macvtap: entered promiscuous mode [ 1708.141863][T22736] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1708.163196][T22736] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1708.263563][ T3345] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1708.359372][ T3314] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1708.371782][ T3345] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1708.383597][ T3314] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1708.395036][ T3345] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1708.456021][ T3345] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1708.488782][ T3358] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1708.499103][ T3358] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1708.551950][ T30] audit: type=1400 audit(1786394282.786:743): avc: denied { mounton } for pid=22736 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 1708.905480][ T9651] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 1709.066184][ T9651] usb 1-1: New USB device found, idVendor=0584, idProduct=0008, bcdDevice= 1.02 [ 1709.077876][ T9651] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1709.090016][ T9651] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1709.100166][ T9651] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1709.125021][ T9651] ums-alauda 1-1:1.0: USB Mass Storage device detected [ 1709.153630][ T9651] ums-alauda 1-1:1.0: This device (0584,0008,0102 S 06 P f4) has unneeded SubClass and Protocol entries in unusual_devs.h (kernel syzkaller) [ 1709.153630][ T9651] Please send a copy of this message to and [ 1709.184447][ T9651] scsi host1: usb-storage 1-1:1.0 [ 1709.342582][ T9651] usb 1-1: USB disconnect, device number 49 [ 1723.170407][ T30] audit: type=1400 audit(1786394297.406:744): avc: denied { getopt } for pid=22848 comm="syz.4.4280" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1724.917576][T20428] usb 5-1: new high-speed USB device number 58 using dummy_hcd [ 1725.033160][T22864] syzkaller0: entered promiscuous mode [ 1725.085239][T22864] syzkaller0: entered allmulticast mode [ 1725.225288][T20428] usb 5-1: Using ep0 maxpacket: 32 [ 1725.353663][ T5610] bridge0: port 3(syz_tun) entered disabled state [ 1725.454713][ T5610] syz_tun (unregistering): left allmulticast mode [ 1725.461834][ T5610] syz_tun (unregistering): left promiscuous mode [ 1725.462322][ T5607] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1725.468552][ T5610] bridge0: port 3(syz_tun) entered disabled state [ 1725.486972][ T5607] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1725.504592][ T5607] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1725.517645][ T5607] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1725.531466][ T5607] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1727.587124][T20428] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1727.612358][T20428] usb 5-1: New USB device found, idVendor=0582, idProduct=0044, bcdDevice= 0.40 [ 1727.621681][ T5607] Bluetooth: hci1: command tx timeout [ 1727.655580][T20428] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 1727.686323][T20428] usb 5-1: can't read configurations, error -71 [ 1727.718955][ T9651] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 1727.726645][T10869] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 1728.167346][T10869] usb 1-1: Using ep0 maxpacket: 16 [ 1728.196030][T10869] usb 1-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 1728.220247][T10869] usb 1-1: config 0 has an invalid interface number: 8 but max is 0 [ 1728.234636][ T9651] usb 3-1: New USB device found, idVendor=0584, idProduct=0008, bcdDevice= 1.02 [ 1728.249544][T10869] usb 1-1: config 0 has no interface number 0 [ 1728.259965][ T9651] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1728.271528][T10869] usb 1-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1728.291317][ T9651] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1728.308239][T10869] usb 1-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1728.324047][ T9651] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1728.334392][T10869] usb 1-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 1728.350887][T10869] usb 1-1: Product: syz [ 1728.369208][ T9651] ums-alauda 3-1:1.0: USB Mass Storage device detected [ 1728.375417][T10869] usb 1-1: SerialNumber: syz [ 1728.402643][ T9651] ums-alauda 3-1:1.0: This device (0584,0008,0102 S 06 P f4) has unneeded SubClass and Protocol entries in unusual_devs.h (kernel syzkaller) [ 1728.402643][ T9651] Please send a copy of this message to and [ 1728.438297][T10869] usb 1-1: config 0 descriptor?? [ 1728.453589][T10869] cm109 1-1:0.8: invalid payload size 0, expected 4 [ 1728.469221][ T9651] scsi host1: usb-storage 3-1:1.0 [ 1728.474651][T10869] input: CM109 USB driver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.8/input/input70 [ 1728.810375][T22892] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=27 sclass=netlink_route_socket pid=22892 comm=syz.0.4289 [ 1729.559044][T18236] scsi 1:0:0:0: Direct-Access Fujifilm DPC-R1 (Alauda) 0102 PQ: 0 ANSI: 0 CCS [ 1729.572268][T18236] scsi 1:0:0:1: Direct-Access Fujifilm DPC-R1 (Alauda) 0102 PQ: 0 ANSI: 0 CCS [ 1729.599284][T22871] bridge0: port 1(bridge_slave_0) entered blocking state [ 1729.664972][T22871] bridge0: port 1(bridge_slave_0) entered disabled state [ 1729.691054][T18236] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 1729.695291][ T5607] Bluetooth: hci1: command tx timeout [ 1729.707142][T22871] bridge_slave_0: entered allmulticast mode [ 1729.732741][T22871] bridge_slave_0: entered promiscuous mode [ 1729.796929][T18236] sd 1:0:0:1: Attached scsi generic sg2 type 0 [ 1729.799607][T22871] bridge0: port 2(bridge_slave_1) entered blocking state [ 1729.828236][T22871] bridge0: port 2(bridge_slave_1) entered disabled state [ 1729.857178][T22871] bridge_slave_1: entered allmulticast mode [ 1729.903616][T22871] bridge_slave_1: entered promiscuous mode [ 1730.233823][T22871] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1730.318867][T22871] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1730.486031][ T3314] sd 1:0:0:0: [sdb] Media removed, stopped polling [ 1730.486065][ T3320] sd 1:0:0:1: [sdc] Media removed, stopped polling [ 1730.495111][T20428] usb 3-1: USB disconnect, device number 63 [ 1730.502628][T22871] team0: Port device team_slave_0 added [ 1730.570675][T22871] team0: Port device team_slave_1 added [ 1730.702747][ T3314] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 1730.731055][ T3320] sd 1:0:0:1: [sdc] Attached SCSI removable disk [ 1730.754691][T22895] sd 1:0:0:1: [sdc] Test Unit Ready failed: Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK [ 1730.802251][T22871] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1730.996219][T22871] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1731.301082][T22871] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1731.390843][T22871] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1731.447339][T22871] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1731.761559][T22871] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1731.825500][ T5607] Bluetooth: hci1: command tx timeout [ 1732.081846][T22867] udevd[22867]: inotify_add_watch(7, /dev/sdb, 10) failed: No such file or directory [ 1732.393863][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1732.394856][ T8914] usb 1-1: USB disconnect, device number 50 [ 1732.400952][ C1] cm109 1-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 1732.442261][T22867] udevd[22867]: inotify_add_watch(7, /dev/sdb, 10) failed: No such file or directory [ 1732.510596][T22871] hsr_slave_0: entered promiscuous mode [ 1732.563257][T22871] hsr_slave_1: entered promiscuous mode [ 1732.572226][T22943] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4297'. [ 1732.609230][T22871] debugfs: 'hsr0' already exists in 'hsr' [ 1732.634860][T22871] Cannot create hsr debugfs directory [ 1732.787504][ T8914] cm109 1-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 1733.160408][T10869] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 1733.171063][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 1733.184484][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1733.215977][T22941] could not allocate digest TFM handle michael_mic [ 1733.293779][T22863] udevd[22863]: inotify_add_watch(7, /dev/sdc, 10) failed: No such file or directory [ 1733.369460][T10869] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 1733.392191][T10869] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1734.592280][ T5607] Bluetooth: hci1: command tx timeout [ 1734.724753][T10869] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1735.140229][T10869] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1735.236406][T10869] usb 5-1: config 0 descriptor?? [ 1736.086970][T10869] pyra 0003:1E7D:2CF6.001C: item fetching failed at offset 5/7 [ 1736.117395][T10869] pyra 0003:1E7D:2CF6.001C: parse failed [ 1736.143720][T10869] pyra 0003:1E7D:2CF6.001C: probe with driver pyra failed with error -22 [ 1736.288230][T22871] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1736.791897][T22871] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1736.936778][T20428] usb 5-1: USB disconnect, device number 60 [ 1737.312429][T22871] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1739.033747][T22871] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1740.120657][T22998] netlink: 32 bytes leftover after parsing attributes in process `syz.0.4310'. [ 1740.417486][T18876] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 1740.596123][T18876] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 1740.639883][T18876] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1740.685325][T18876] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1740.729659][T18876] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1740.775091][T18876] usb 1-1: config 0 descriptor?? [ 1740.795059][ T30] audit: type=1400 audit(1786394314.996:745): avc: denied { name_connect } for pid=23003 comm="syz.3.4311" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 1740.850826][T22871] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1740.869102][ T30] audit: type=1400 audit(1786394315.106:746): avc: denied { listen } for pid=23003 comm="syz.3.4311" lport=43353 faddr=::ffff:10.1.1.2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1740.915393][T10869] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 1740.970649][T22871] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1741.017289][T22871] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1741.081664][T22871] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1741.119578][T22871] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1741.136207][T10869] usb 3-1: Using ep0 maxpacket: 32 [ 1741.158190][T22871] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1741.185565][T22871] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1741.216054][T20428] usb 4-1: new high-speed USB device number 68 using dummy_hcd [ 1741.234024][T22871] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1741.414998][T18876] pyra 0003:1E7D:2CF6.001D: item fetching failed at offset 5/7 [ 1741.430199][T20428] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1741.456617][T18876] pyra 0003:1E7D:2CF6.001D: parse failed [ 1741.491286][T20428] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1741.505566][T18876] pyra 0003:1E7D:2CF6.001D: probe with driver pyra failed with error -22 [ 1741.547887][T20428] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 1741.608598][T20428] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1741.682190][T23005] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 1741.829070][T20428] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1741.844451][T22871] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1742.030461][T22871] 8021q: adding VLAN 0 to HW filter on device team0 [ 1742.144619][ T3345] bridge0: port 1(bridge_slave_0) entered blocking state [ 1742.151851][ T3345] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1742.260043][T18236] bridge0: port 2(bridge_slave_1) entered blocking state [ 1742.267219][T18236] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1742.522496][ T24] usb 1-1: USB disconnect, device number 51 [ 1742.799326][T23022] netlink: 32 bytes leftover after parsing attributes in process `syz.0.4313'. [ 1743.135431][ T29] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 1743.326428][ T29] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 1743.357086][ T29] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1743.405164][ T29] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1743.454709][ T29] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1743.514369][ T29] usb 1-1: config 0 descriptor?? [ 1743.524014][T18876] usb 4-1: USB disconnect, device number 68 [ 1743.890626][T10869] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1743.933565][T10869] usb 3-1: New USB device found, idVendor=0582, idProduct=0044, bcdDevice= 0.40 [ 1743.957056][T10869] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 1743.978686][T10869] usb 3-1: can't read configurations, error -71 [ 1744.889870][T22871] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1745.793886][ T29] pyra 0003:1E7D:2CF6.001E: item fetching failed at offset 5/7 [ 1745.838657][ T29] pyra 0003:1E7D:2CF6.001E: parse failed [ 1745.868351][ T29] pyra 0003:1E7D:2CF6.001E: probe with driver pyra failed with error -22 [ 1745.893732][T22871] veth0_vlan: entered promiscuous mode [ 1745.930326][T22871] veth1_vlan: entered promiscuous mode [ 1746.015329][ T29] usb 1-1: USB disconnect, device number 52 [ 1746.050280][T22871] veth0_macvtap: entered promiscuous mode [ 1746.090606][T22871] veth1_macvtap: entered promiscuous mode [ 1746.150940][T22871] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1746.219510][T22871] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1746.333973][ T395] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1746.393806][ T395] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1746.684510][ T3244] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1746.958976][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1747.120376][ T3345] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1747.147191][ T3345] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1747.415232][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1747.444295][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1749.316744][ T30] audit: type=1400 audit(1786394323.556:747): avc: denied { append } for pid=23055 comm="syz.1.4277" name="UDC" dev="configfs" ino=95267 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 1749.437322][ T30] audit: type=1800 audit(1786394323.616:748): pid=23056 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.4277" name="UDC" dev="configfs" ino=95267 res=0 errno=0 [ 1751.178838][T22737] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1751.204578][T22737] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1751.215732][T22737] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1751.235425][T22737] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1751.252921][T22737] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1751.405379][T19224] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 1751.592801][T19224] usb 1-1: New USB device found, idVendor=0584, idProduct=0008, bcdDevice= 1.02 [ 1751.680654][T19224] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1751.735428][T19224] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1751.819990][T19224] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1751.904840][T19224] ums-alauda 1-1:1.0: USB Mass Storage device detected [ 1751.986979][T19224] ums-alauda 1-1:1.0: This device (0584,0008,0102 S 06 P f4) has unneeded SubClass and Protocol entries in unusual_devs.h (kernel syzkaller) [ 1751.986979][T19224] Please send a copy of this message to and [ 1752.080870][T19224] scsi host1: usb-storage 1-1:1.0 [ 1752.283290][T19224] usb 1-1: USB disconnect, device number 53 [ 1752.366993][T18876] usb 2-1: new high-speed USB device number 72 using dummy_hcd [ 1752.579068][T18876] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1752.614937][T18876] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1752.657255][T18876] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1752.697954][T18876] usb 2-1: config 0 descriptor?? [ 1752.733722][T18876] pwc: Askey VC010 type 2 USB webcam detected. [ 1752.785365][ T29] usb 4-1: new high-speed USB device number 69 using dummy_hcd [ 1752.976108][ T29] usb 4-1: Using ep0 maxpacket: 32 [ 1753.006362][ T29] usb 4-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 1753.059312][ T29] usb 4-1: config 0 has an invalid interface number: 132 but max is 0 [ 1753.115350][ T29] usb 4-1: config 0 has no interface number 0 [ 1753.125283][ T29] usb 4-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1753.145076][T18876] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1753.157706][T18876] pwc: recv_control_msg error -32 req 02 val 2700 [ 1753.169135][T18876] pwc: recv_control_msg error -32 req 02 val 2c00 [ 1753.178076][ T29] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1753.202810][T18876] pwc: recv_control_msg error -32 req 04 val 1000 [ 1753.213374][ T5599] bridge0: port 3(syz_tun) entered disabled state [ 1753.222139][ T29] usb 4-1: Product: syz [ 1753.228662][T18876] pwc: recv_control_msg error -32 req 04 val 1300 [ 1753.240101][ T29] usb 4-1: Manufacturer: syz [ 1753.246476][ T29] usb 4-1: SerialNumber: syz [ 1753.251999][T18876] pwc: recv_control_msg error -32 req 04 val 1400 [ 1753.271647][T18876] pwc: recv_control_msg error -32 req 02 val 2000 [ 1753.314182][ T29] usb 4-1: config 0 descriptor?? [ 1753.315830][T22737] Bluetooth: hci4: command tx timeout [ 1753.327681][T18876] pwc: recv_control_msg error -32 req 02 val 2100 [ 1753.334843][ T29] em28xx 4-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 1753.347072][ T29] em28xx 4-1:0.132: Video interface 132 found: [ 1753.354044][T18876] pwc: recv_control_msg error -32 req 04 val 1500 [ 1753.364998][T18876] pwc: recv_control_msg error -32 req 02 val 2500 [ 1753.435866][ T5599] syz_tun (unregistering): left allmulticast mode [ 1753.463409][ T5599] syz_tun (unregistering): left promiscuous mode [ 1753.482404][T18876] pwc: recv_control_msg error -32 req 02 val 2400 [ 1753.505659][ T5599] bridge0: port 3(syz_tun) entered disabled state [ 1753.524056][T18876] pwc: recv_control_msg error -32 req 02 val 2600 [ 1753.644244][ T30] audit: type=1400 audit(1786394327.866:749): avc: denied { mount } for pid=23090 comm="syz.4.4327" name="/" dev="autofs" ino=95371 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 1753.771713][T18876] pwc: recv_control_msg error -71 req 02 val 2800 [ 1753.781715][ T29] em28xx 4-1:0.132: unknown em28xx chip ID (0) [ 1753.807737][T18876] pwc: recv_control_msg error -71 req 04 val 1100 [ 1753.841422][T18876] pwc: recv_control_msg error -71 req 04 val 1200 [ 1754.002754][ T29] em28xx 4-1:0.132: failed to trigger read from i2c address 0xa0 (error=-5) [ 1754.018532][T18876] pwc: Registered as video103. [ 1754.050398][T18876] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input71 [ 1754.083025][ T29] em28xx 4-1:0.132: board has no eeprom [ 1754.179409][ T29] em28xx 4-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 1754.203175][T18876] usb 2-1: USB disconnect, device number 72 [ 1754.224424][ T29] em28xx 4-1:0.132: analog set to bulk mode. [ 1754.248218][ T24] em28xx 4-1:0.132: Registering V4L2 extension [ 1754.322933][ T29] usb 4-1: USB disconnect, device number 69 [ 1754.341553][ T29] em28xx 4-1:0.132: Disconnecting em28xx [ 1754.898495][ T24] em28xx 4-1:0.132: Config register raw data: 0xffffffed [ 1754.922623][ T24] em28xx 4-1:0.132: AC97 chip type couldn't be determined [ 1754.963341][ T24] em28xx 4-1:0.132: No AC97 audio processor [ 1755.126938][ T24] usb 4-1: Decoder not found [ 1755.156163][ T24] em28xx 4-1:0.132: failed to create media graph [ 1755.178352][ T24] em28xx 4-1:0.132: V4L2 device video103 deregistered [ 1755.220017][ T24] em28xx 4-1:0.132: Remote control support is not available for this card. [ 1755.225433][ T8914] usb 1-1: new high-speed USB device number 54 using dummy_hcd [ 1755.228985][ T29] em28xx 4-1:0.132: Closing input extension [ 1755.366318][ T29] em28xx 4-1:0.132: Freeing device [ 1755.375456][T22737] Bluetooth: hci4: command tx timeout [ 1755.465773][ T8914] usb 1-1: Using ep0 maxpacket: 32 [ 1755.485643][ T8914] usb 1-1: New USB device found, idVendor=1b1c, idProduct=1c09, bcdDevice= 0.00 [ 1755.512959][T23142] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 1755.523968][ T8914] usb 1-1: config 0 interface 0 altsetting 128 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 1755.525258][T23068] bridge0: port 1(bridge_slave_0) entered blocking state [ 1755.566357][T23068] bridge0: port 1(bridge_slave_0) entered disabled state [ 1755.586202][T23068] bridge_slave_0: entered allmulticast mode [ 1755.610272][T23068] bridge_slave_0: entered promiscuous mode [ 1755.615505][ T8914] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1755.647513][ T8914] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1755.668208][T23142] kvm: pic: non byte read [ 1755.675867][ T8914] usb 1-1: config 0 descriptor?? [ 1755.678844][T23068] bridge0: port 2(bridge_slave_1) entered blocking state [ 1755.706462][T23142] kvm: pic: level sensitive irq not supported [ 1755.714359][T23068] bridge0: port 2(bridge_slave_1) entered disabled state [ 1755.716089][T23142] kvm: pic: non byte read [ 1755.730249][T23068] bridge_slave_1: entered allmulticast mode [ 1755.768847][T23142] kvm: pic: level sensitive irq not supported [ 1755.768911][T23142] kvm: pic: non byte read [ 1755.800508][T23142] kvm: pic: level sensitive irq not supported [ 1755.800615][T23142] kvm: pic: non byte read [ 1756.632878][T23068] bridge_slave_1: entered promiscuous mode [ 1756.858964][T23142] kvm: pic: level sensitive irq not supported [ 1756.946763][T23142] kvm: pic: non byte read [ 1757.036194][ T30] audit: type=1400 audit(1786394331.276:750): avc: denied { create } for pid=23152 comm="syz.3.4339" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 1757.071931][T23142] kvm: pic: level sensitive irq not supported [ 1757.072159][T23142] kvm: pic: non byte read [ 1757.118329][T23068] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1757.163906][ T8914] corsair-psu 0003:1B1C:1C09.001F: unknown main item tag 0x0 [ 1757.178618][T23068] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1757.187697][ T8914] corsair-psu 0003:1B1C:1C09.001F: unknown main item tag 0x0 [ 1757.187725][ T8914] corsair-psu 0003:1B1C:1C09.001F: unknown main item tag 0x0 [ 1757.187752][ T8914] corsair-psu 0003:1B1C:1C09.001F: unknown main item tag 0x0 [ 1757.187912][ T8914] corsair-psu 0003:1B1C:1C09.001F: unknown main item tag 0x0 [ 1757.411216][ T8914] corsair-psu 0003:1B1C:1C09.001F: hidraw0: USB HID v4.08 Device [HID 1b1c:1c09] on usb-dummy_hcd.0-1/input0 [ 1757.466029][T22737] Bluetooth: hci4: command tx timeout [ 1757.471938][T23068] team0: Port device team_slave_0 added [ 1757.521616][T23068] team0: Port device team_slave_1 added [ 1757.719238][T23068] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1757.734527][T23068] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1757.801275][T23068] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1757.825924][T18876] usb 5-1: new high-speed USB device number 61 using dummy_hcd [ 1757.838242][T23068] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1757.850019][T23068] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1757.853688][ T8914] corsair-psu 0003:1B1C:1C09.001F: unable to initialize device (-110) [ 1757.876542][T23068] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1757.953697][ T8914] corsair-psu 0003:1B1C:1C09.001F: probe with driver corsair-psu failed with error -110 [ 1757.988317][T18876] usb 5-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 1758.028044][T18876] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1758.033651][ T8914] usb 1-1: USB disconnect, device number 54 [ 1758.072813][T18876] usb 5-1: config 0 descriptor?? [ 1758.103602][T18876] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 1758.126216][ T30] audit: type=1400 audit(1786394332.356:751): avc: denied { write } for pid=23165 comm="syz.1.4343" name="usb_gadget" dev="configfs" ino=3578 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1758.155468][T23068] hsr_slave_0: entered promiscuous mode [ 1758.187029][T23068] hsr_slave_1: entered promiscuous mode [ 1758.221003][T23068] debugfs: 'hsr0' already exists in 'hsr' [ 1758.263055][T23068] Cannot create hsr debugfs directory [ 1758.271753][ T30] audit: type=1400 audit(1786394332.436:752): avc: denied { write } for pid=23165 comm="syz.1.4343" name="functions" dev="configfs" ino=95779 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1758.328216][T18876] gp8psk: usb in 128 operation failed. [ 1758.361197][T18876] gp8psk: usb in 137 operation failed. [ 1758.377547][T18876] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1758.385321][ T30] audit: type=1400 audit(1786394332.466:753): avc: denied { write } for pid=23165 comm="syz.1.4343" name="configs" dev="configfs" ino=95780 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1758.428960][T18876] dvbdev: DVB: registering new adapter (Genpix SkyWalker-1 DVB-S receiver) [ 1758.477772][T18876] usb 5-1: media controller created [ 1758.498840][ T30] audit: type=1400 audit(1786394332.486:754): avc: denied { write } for pid=23165 comm="syz.1.4343" name="c.1" dev="configfs" ino=95788 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1758.543303][T18876] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1758.572199][ T30] audit: type=1400 audit(1786394332.506:755): avc: denied { create } for pid=23165 comm="syz.1.4343" name="uac2.usb0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=lnk_file permissive=1 [ 1758.622854][ T30] audit: type=1400 audit(1786394332.506:756): avc: denied { write } for pid=23165 comm="syz.1.4343" name="c.1" dev="configfs" ino=95788 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1758.645668][ T30] audit: type=1400 audit(1786394332.766:757): avc: denied { connect } for pid=23170 comm="syz.0.4345" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 1758.692095][T18876] gp8psk_fe: Frontend attached [ 1758.701587][ T30] audit: type=1400 audit(1786394332.866:758): avc: denied { read } for pid=23170 comm="syz.0.4345" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 1758.730624][T18876] usb 5-1: DVB: registering adapter 1 frontend 0 (Genpix DVB-S)... [ 1758.760888][T18876] dvbdev: dvb_create_media_entity: media entity 'Genpix DVB-S' registered. [ 1758.873922][ T30] audit: type=1400 audit(1786394333.106:759): avc: denied { write } for pid=23177 comm="syz.3.4347" name="functions" dev="configfs" ino=8664 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1759.281725][T18876] gp8psk: usb in 137 operation failed. [ 1759.306718][T18876] dvb-usb: Genpix SkyWalker-1 DVB-S receiver successfully initialized and connected. [ 1759.351701][T18876] gp8psk: found Genpix USB device pID = 203 (hex) [ 1759.425091][T23068] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1759.472759][T18876] usb 5-1: USB disconnect, device number 61 [ 1759.535343][T22737] Bluetooth: hci4: command tx timeout [ 1759.767091][T23184] [ 1759.769475][T23184] ====================================================== [ 1759.776525][T23184] WARNING: possible circular locking dependency detected [ 1759.783553][T23184] syzkaller #0 Not tainted [ 1759.787958][T23184] ------------------------------------------------------ [ 1759.794962][T23184] syz.1.4349/23184 is trying to acquire lock: [ 1759.801012][T23184] ffffffff8fd80de8 (&subsys->su_mutex){+.+.}-{4:4}, at: configfs_rmdir+0x5ae/0x950 [ 1759.810362][T23184] [ 1759.810362][T23184] but task is already holding lock: [ 1759.817749][T23184] ffff88805736ddc0 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: vfs_rmdir+0xed/0x8a0 [ 1759.827506][T23184] [ 1759.827506][T23184] which lock already depends on the new lock. [ 1759.827506][T23184] [ 1759.837902][T23184] [ 1759.837902][T23184] the existing dependency chain (in reverse order) is: [ 1759.846899][T23184] [ 1759.846899][T23184] -> #3 (&sb->s_type->i_mutex_key#24){++++}-{4:4}: [ 1759.855672][T23184] lock_acquire+0x1b9/0x370 [ 1759.860717][T23184] down_write+0x8b/0x1f0 [ 1759.865531][T23184] configfs_depend_item_unlocked+0xf3/0x6a0 [ 1759.871969][T23184] usbg_make_tpg+0x261/0x620 [ 1759.877136][T23184] target_fabric_make_tpg+0xab/0x8c0 [ 1759.883032][T23184] configfs_mkdir+0x51e/0xb70 [ 1759.888235][T23184] vfs_mkdir+0x361/0x850 [ 1759.893001][T23184] filename_mkdirat+0x48b/0x5e0 [ 1759.898386][T23184] __x64_sys_mkdir+0x6b/0x90 [ 1759.903495][T23184] do_syscall_64+0x115/0x870 [ 1759.908649][T23184] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1759.915051][T23184] [ 1759.915051][T23184] -> #2 (&opts->dep_lock){+.+.}-{4:4}: [ 1759.922722][T23184] lock_acquire+0x1b9/0x370 [ 1759.927747][T23184] __mutex_lock+0x1a4/0x1bd0 [ 1759.932891][T23184] usbg_make_tpg+0x1a4/0x620 [ 1759.938007][T23184] target_fabric_make_tpg+0xab/0x8c0 [ 1759.943817][T23184] configfs_mkdir+0x51e/0xb70 [ 1759.949009][T23184] vfs_mkdir+0x361/0x850 [ 1759.953779][T23184] filename_mkdirat+0x48b/0x5e0 [ 1759.959164][T23184] __x64_sys_mkdir+0x6b/0x90 [ 1759.964269][T23184] do_syscall_64+0x115/0x870 [ 1759.969375][T23184] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1759.975816][T23184] [ 1759.975816][T23184] -> #1 (tpg_instances_lock){+.+.}-{4:4}: [ 1759.983867][T23184] lock_acquire+0x1b9/0x370 [ 1759.988895][T23184] __mutex_lock+0x1a4/0x1bd0 [ 1759.993995][T23184] usbg_make_tpg+0x10b/0x620 [ 1759.999097][T23184] target_fabric_make_tpg+0xab/0x8c0 [ 1760.004896][T23184] configfs_mkdir+0x51e/0xb70 [ 1760.010094][T23184] vfs_mkdir+0x361/0x850 [ 1760.014851][T23184] filename_mkdirat+0x48b/0x5e0 [ 1760.020206][T23184] __x64_sys_mkdir+0x6b/0x90 [ 1760.025324][T23184] do_syscall_64+0x115/0x870 [ 1760.030435][T23184] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1760.036844][T23184] [ 1760.036844][T23184] -> #0 (&subsys->su_mutex){+.+.}-{4:4}: [ 1760.044646][T23184] check_prev_add+0xeb/0xe60 [ 1760.049746][T23184] __lock_acquire+0x136c/0x1a40 [ 1760.055118][T23184] lock_acquire+0x1b9/0x370 [ 1760.060126][T23184] __mutex_lock+0x1a4/0x1bd0 [ 1760.065230][T23184] configfs_rmdir+0x5ae/0x950 [ 1760.070432][T23184] vfs_rmdir+0x328/0x8a0 [ 1760.075185][T23184] filename_rmdir+0x31a/0x5c0 [ 1760.080390][T23184] __x64_sys_rmdir+0x46/0x70 [ 1760.085519][T23184] do_syscall_64+0x115/0x870 [ 1760.090637][T23184] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1760.097074][T23184] [ 1760.097074][T23184] other info that might help us debug this: [ 1760.097074][T23184] [ 1760.107282][T23184] Chain exists of: [ 1760.107282][T23184] &subsys->su_mutex --> &opts->dep_lock --> &sb->s_type->i_mutex_key#24 [ 1760.107282][T23184] [ 1760.121523][T23184] Possible unsafe locking scenario: [ 1760.121523][T23184] [ 1760.128952][T23184] CPU0 CPU1 [ 1760.134298][T23184] ---- ---- [ 1760.139645][T23184] lock(&sb->s_type->i_mutex_key#24); [ 1760.145168][T23184] lock(&opts->dep_lock); [ 1760.152114][T23184] lock(&sb->s_type->i_mutex_key#24); [ 1760.160098][T23184] lock(&subsys->su_mutex); [ 1760.164669][T23184] [ 1760.164669][T23184] *** DEADLOCK *** [ 1760.164669][T23184] [ 1760.172791][T23184] 3 locks held by syz.1.4349/23184: [ 1760.177967][T23184] #0: ffff88801e7a2450 (sb_writers#13){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x5c0 [ 1760.187357][T23184] #1: ffff88805736e280 (&sb->s_type->i_mutex_key#7/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x5c0 [ 1760.198203][T23184] #2: ffff88805736ddc0 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: vfs_rmdir+0xed/0x8a0 [ 1760.208326][T23184] [ 1760.208326][T23184] stack backtrace: [ 1760.214238][T23184] CPU: 0 UID: 0 PID: 23184 Comm: syz.1.4349 Not tainted syzkaller #0 PREEMPT(full) [ 1760.214260][T23184] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1760.214270][T23184] Call Trace: [ 1760.214326][T23184] [ 1760.214334][T23184] dump_stack_lvl+0x100/0x190 [ 1760.214391][T23184] print_circular_bug.cold+0x178/0x1c7 [ 1760.214486][T23184] check_noncircular+0x146/0x160 [ 1760.214581][T23184] ? kasan_save_stack+0x30/0x50 [ 1760.214631][T23184] check_prev_add+0xeb/0xe60 [ 1760.214841][T23184] ? vfs_rmdir+0x328/0x8a0 [ 1760.214863][T23184] ? __x64_sys_rmdir+0x46/0x70 [ 1760.214881][T23184] __lock_acquire+0x136c/0x1a40 [ 1760.214903][T23184] lock_acquire+0x1b9/0x370 [ 1760.214919][T23184] ? configfs_rmdir+0x5ae/0x950 [ 1760.214940][T23184] ? __pfx___might_resched+0x10/0x10 [ 1760.214958][T23184] ? __lock_acquire+0x49f/0x1a40 [ 1760.214979][T23184] __mutex_lock+0x1a4/0x1bd0 [ 1760.215000][T23184] ? configfs_rmdir+0x5ae/0x950 [ 1760.215020][T23184] ? configfs_rmdir+0x5ae/0x950 [ 1760.215040][T23184] ? reacquire_held_locks+0xce/0x1e0 [ 1760.215058][T23184] ? __pfx___mutex_lock+0x10/0x10 [ 1760.215077][T23184] ? do_raw_spin_lock+0x128/0x260 [ 1760.215098][T23184] ? find_held_lock+0x2b/0x80 [ 1760.215112][T23184] ? fast_dput+0x2fe/0x6d0 [ 1760.215133][T23184] ? _raw_spin_unlock+0x28/0x50 [ 1760.215190][T23184] ? fast_dput+0x168/0x6d0 [ 1760.215213][T23184] ? configfs_rmdir+0x5ae/0x950 [ 1760.215233][T23184] configfs_rmdir+0x5ae/0x950 [ 1760.215254][T23184] ? __pfx_configfs_rmdir+0x10/0x10 [ 1760.215274][T23184] ? __pfx_down_write+0x10/0x10 [ 1760.215297][T23184] vfs_rmdir+0x328/0x8a0 [ 1760.215318][T23184] filename_rmdir+0x31a/0x5c0 [ 1760.215335][T23184] ? __pfx_filename_rmdir+0x10/0x10 [ 1760.215355][T23184] ? do_getname+0x191/0x390 [ 1760.215375][T23184] __x64_sys_rmdir+0x46/0x70 [ 1760.215391][T23184] do_syscall_64+0x115/0x870 [ 1760.215411][T23184] ? clear_bhb_loop+0x70/0xc0 [ 1760.215427][T23184] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1760.215442][T23184] RIP: 0033:0x7f1e5939e0d9 [ 1760.215456][T23184] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1760.215471][T23184] RSP: 002b:00007f1e5a1e3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 1760.215511][T23184] RAX: ffffffffffffffda RBX: 00007f1e59625fa0 RCX: 00007f1e5939e0d9 [ 1760.215521][T23184] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000280 [ 1760.215530][T23184] RBP: 00007f1e59435024 R08: 0000000000000000 R09: 0000000000000000 [ 1760.215538][T23184] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1760.215547][T23184] R13: 00007f1e59626038 R14: 00007f1e59625fa0 R15: 00007fff196f9458 [ 1760.215561][T23184] [ 1760.559728][T23068] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1760.638998][T18876] dvb-usb: Genpix SkyWalker-1 DVB-S receiver successfully deinitialized and disconnected. SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1761.015236][ T8914] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 1761.037890][T23068] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1761.180448][T23068] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1761.319789][T23159] bridge0: port 3(syz_tun) entered disabled state [ 1761.344361][T23159] syz_tun (unregistering): left allmulticast mode [ 1761.368667][T23159] syz_tun (unregistering): left promiscuous mode [ 1761.375764][T23159] bridge0: port 3(syz_tun) entered disabled state [ 1761.402289][ T5600] bridge0: port 3(syz_tun) entered disabled state [ 1761.411204][ T5600] syz_tun (unregistering): left allmulticast mode [ 1761.419206][ T5600] syz_tun (unregistering): left promiscuous mode [ 1761.442565][ T5600] bridge0: port 3(syz_tun) entered disabled state [ 1761.482328][ T3358] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1761.618035][ T3358] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1761.701475][ T3358] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1761.830502][ T3358] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1761.963277][ T3358] bridge_slave_1: left allmulticast mode [ 1761.976406][ T3358] bridge_slave_1: left promiscuous mode [ 1761.996515][ T3358] bridge0: port 2(bridge_slave_1) entered disabled state [ 1762.008755][ T3358] bridge_slave_0: left allmulticast mode [ 1762.014435][ T3358] bridge_slave_0: left promiscuous mode [ 1762.035537][ T3358] bridge0: port 1(bridge_slave_0) entered disabled state [ 1762.158450][ T3358] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1762.187113][ T3358] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1762.204406][ T3358] bond0 (unregistering): Released all slaves [ 1762.436866][ T3358] hsr_slave_0: left promiscuous mode [ 1762.448409][ T3358] hsr_slave_1: left promiscuous mode [ 1762.466701][ T3358] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1762.468223][ T30] kauditd_printk_skb: 8 callbacks suppressed [ 1762.468248][ T30] audit: type=1400 audit(1786394336.706:768): avc: denied { write } for pid=23188 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1762.503250][ T3358] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1762.512143][ T3358] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1762.534616][ T3358] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1762.564279][ T30] audit: type=1400 audit(1786394336.796:769): avc: denied { write } for pid=23199 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1762.621446][ T3358] veth1_macvtap: left promiscuous mode [ 1762.627661][ T3358] veth0_macvtap: left promiscuous mode [ 1762.638475][ T3358] veth1_vlan: left promiscuous mode [ 1762.643832][ T3358] veth0_vlan: left promiscuous mode [ 1762.768232][ T3358] team0 (unregistering): Port device team_slave_1 removed [ 1762.783410][ T3358] team0 (unregistering): Port device team_slave_0 removed [ 1762.841616][ T5265] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1763.066698][ T30] audit: type=1400 audit(1786394337.296:770): avc: denied { write } for pid=23202 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1763.175085][ T30] audit: type=1400 audit(1786394337.416:771): avc: denied { write } for pid=23213 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1763.233591][ T3358] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1763.250395][ T5265] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1763.296181][ T3358] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1763.351986][ T3358] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1763.403629][ T3358] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1763.500373][ T3358] bridge_slave_1: left allmulticast mode [ 1763.513736][ T3358] bridge_slave_1: left promiscuous mode [ 1763.523526][ T3358] bridge0: port 2(bridge_slave_1) entered disabled state [ 1763.535947][ T3358] bridge_slave_0: left allmulticast mode [ 1763.549639][ T30] audit: type=1400 audit(1786394337.786:772): avc: denied { write } for pid=23216 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1763.573023][ T3358] bridge_slave_0: left promiscuous mode [ 1763.579654][ T3358] bridge0: port 1(bridge_slave_0) entered disabled state [ 1763.592039][ T3358] bridge_slave_1: left allmulticast mode [ 1763.599579][ T3358] bridge_slave_1: left promiscuous mode [ 1763.605791][ T3358] bridge0: port 2(bridge_slave_1) entered disabled state [ 1763.614310][ T3358] bridge_slave_0: left allmulticast mode [ 1763.620759][ T3358] bridge_slave_0: left promiscuous mode [ 1763.627955][ T3358] bridge0: port 1(bridge_slave_0) entered disabled state [ 1763.640049][ T30] audit: type=1400 audit(1786394337.876:773): avc: denied { write } for pid=23227 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1763.727080][ T3358] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1763.737635][ T3358] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1763.748143][ T3358] bond0 (unregistering): Released all slaves [ 1763.790192][ T3358] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1763.800810][ T3358] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1763.814110][ T3358] bond0 (unregistering): Released all slaves [ 1763.824628][ T5265] 8021q: adding VLAN 0 to HW filter on device eth3 [ 1764.021402][ T30] audit: type=1400 audit(1786394338.256:774): avc: denied { write } for pid=23230 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1764.111927][ T30] audit: type=1400 audit(1786394338.346:775): avc: denied { write } for pid=23241 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1764.152966][ T3358] hsr_slave_0: left promiscuous mode [ 1764.166811][ T3358] hsr_slave_1: left promiscuous mode [ 1764.176220][ T3358] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1764.202851][ T3358] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1764.214260][ T3358] hsr_slave_0: left promiscuous mode [ 1764.220793][ T3358] hsr_slave_1: left promiscuous mode [ 1764.226742][ T3358] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1764.234131][ T3358] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1764.245073][ T3358] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1764.252657][ T3358] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1764.264496][ T3358] veth1_macvtap: left promiscuous mode [ 1764.270919][ T3358] veth0_macvtap: left promiscuous mode [ 1764.277073][ T3358] veth1_vlan: left promiscuous mode [ 1764.282351][ T3358] veth0_vlan: left promiscuous mode [ 1764.382729][ T3358] team0 (unregistering): Port device team_slave_1 removed [ 1764.393986][ T3358] team0 (unregistering): Port device team_slave_0 removed [ 1764.522515][ T3358] team0 (unregistering): Port device team_slave_1 removed [ 1764.534004][ T3358] team0 (unregistering): Port device team_slave_0 removed [ 1764.590450][ T5265] 8021q: adding VLAN 0 to HW filter on device eth4 [ 1764.842932][ T30] audit: type=1400 audit(1786394339.076:776): avc: denied { write } for pid=23245 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1764.915645][ T30] audit: type=1400 audit(1786394339.156:777): avc: denied { write } for pid=23256 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1765.033400][ T5265] 8021q: adding VLAN 0 to HW filter on device eth5 [ 1765.368634][ T5265] 8021q: adding VLAN 0 to HW filter on device eth6 [ 1765.654211][ T5265] 8021q: adding VLAN 0 to HW filter on device eth7 [ 1765.934302][ T5265] 8021q: adding VLAN 0 to HW filter on device eth8