last executing test programs: 6m21.905524077s ago: executing program 0 (id=2614): sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x38, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}]}, 0x38}}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="3800000041000701fefffffffeffffff017c0000040042800c00018006000600800a000014000280100014800c0006"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) 6m21.855784744s ago: executing program 0 (id=2617): r0 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r0, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x1c, {0x2, 0x0, @multicast2}}, 0x24) bind$rxrpc(r0, &(0x7f00000000c0)=@in4={0x21, 0x2, 0x2, 0x10, {0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x24) 6m21.802912327s ago: executing program 0 (id=2618): openat$cuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fdinfo/3\x00') read$FUSE(r0, &(0x7f00000040c0)={0x2020}, 0x2020) 6m21.800932013s ago: executing program 0 (id=2619): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$nfs4(&(0x7f0000000040)='/', &(0x7f0000000080)='./file0\x00', 0x0, 0x197841, 0x0) umount2(&(0x7f0000000100)='./file0\x00', 0xc) 6m21.739619064s ago: executing program 0 (id=2620): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x28) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r0, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0x4, &(0x7f0000001a40)=@framed={{0x18, 0x0, 0x0, 0x0, 0xc4f, 0x0, 0x0, 0x0, 0xfffffffc}, [@ldst={0x2, 0x1, 0x3, 0x1, 0x0, 0x40, 0xfffffffffffffff0}]}, &(0x7f0000000180)='syzkaller\x00', 0x7, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, 0x18, r0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r1, 0x0, 0x0, 0x0, 0x10, 0x4a7}, 0x94) 6m21.564981696s ago: executing program 0 (id=2621): r0 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x1, 0x0) write$proc_mixer(r0, &(0x7f0000000380)=ANY=[@ANYBLOB="4f4741494e20274361707475726520566f6c756d65272030303030303030303030303030303030303030300a494741494e0a50486ce2369e9e7101d386d8c8cc4f4e454f55540a535045414b455220274344204361707475726527203030303030303030313337343338"], 0x4000) close(r0) 6m21.539899467s ago: executing program 32 (id=2621): r0 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x1, 0x0) write$proc_mixer(r0, &(0x7f0000000380)=ANY=[@ANYBLOB="4f4741494e20274361707475726520566f6c756d65272030303030303030303030303030303030303030300a494741494e0a50486ce2369e9e7101d386d8c8cc4f4e454f55540a535045414b455220274344204361707475726527203030303030303030313337343338"], 0x4000) close(r0) 4m23.441557942s ago: executing program 4 (id=6301): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {}, 0x2, 0x0, 0x0, 0x1, 0x0, 0x3}}, 0xb8}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b8000000150001000000000000000000e00000020000000000"], 0xb8}}, 0x0) 4m23.273953444s ago: executing program 4 (id=6306): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_ifreq(r0, 0x8910, &(0x7f0000000000)={'veth0_vlan\x00', @ifru_settings={0x8, 0x4, @te1=0x0}}) ioctl$sock_netdev_private(r0, 0x8948, &(0x7f0000000000)) 4m23.174254681s ago: executing program 4 (id=6308): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000fc0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x4, 0x8, &(0x7f0000000240)=@framed={{0x18, 0x2, 0x0, 0x0, 0x40800b, 0x0, 0x0, 0x0, 0x800}, [@call={0x85, 0x0, 0x0, 0x13}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}]}, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41000, 0x1, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x200000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002280)={r1, 0x0, 0xe, 0x0, &(0x7f0000000040)="0000100000000300230a03000000", 0x0, 0x57af, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 4m23.102899066s ago: executing program 4 (id=6310): setresuid(0xee01, 0xee01, 0x0) r0 = syz_clone3(&(0x7f0000001880)={0x100000200, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) prlimit64(r0, 0x3, 0x0, 0x0) 4m23.033555114s ago: executing program 4 (id=6312): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x51) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000080)={0x8}) linkat(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./file7\x00', 0x1000) 4m23.006242805s ago: executing program 4 (id=6313): r0 = socket(0x10, 0x80002, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl1\x00', 0x0, 0x29, 0x7, 0x3f, 0x2, 0x13, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, 0x1, 0x700, 0x66b6, 0x40}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000380)={'syztnl1\x00', 0x0}) 4m7.981382093s ago: executing program 33 (id=6313): r0 = socket(0x10, 0x80002, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl1\x00', 0x0, 0x29, 0x7, 0x3f, 0x2, 0x13, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, 0x1, 0x700, 0x66b6, 0x40}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000380)={'syztnl1\x00', 0x0}) 1m28.844923746s ago: executing program 5 (id=11235): r0 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x42}, 0x10) r1 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) bind$llc(r1, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x81, 0x42}, 0x10) 1m28.82492727s ago: executing program 5 (id=11236): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a010400000000000000000a0000040900010073797a3100000000080005400000000209000200ef0000000000000008000a4000000000080003400000000414000000110001"], 0x6c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a3100000000140003"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 1m28.746751156s ago: executing program 5 (id=11238): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000e00), r0) sendmsg$IEEE802154_SCAN_REQ(r1, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000001200)={&(0x7f00000011c0)={0x14, r2, 0x1, 0x70bd28, 0x25dfdbfc}, 0x14}}, 0x80) 1m28.725754129s ago: executing program 5 (id=11241): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x262) 1m28.657032124s ago: executing program 5 (id=11243): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setrlimit(0x7, &(0x7f00000000c0)={0x4, 0x4}) sendmmsg$unix(r0, &(0x7f000000bbc0)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000001180)="dd", 0x1}], 0x1, &(0x7f00000003c0)=[@rights={{0x10, 0x1, 0x1, [r0]}}], 0x10, 0x20000041}}], 0x1, 0xc004) recvmmsg(r1, &(0x7f0000001140)=[{{0x0, 0x0, 0x0}}], 0x700, 0x2, 0x0) 1m28.331065117s ago: executing program 5 (id=11253): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0e000000040000000800000007"], 0x50) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=@newlink={0x38, 0x10, 0x439, 0x70bd23, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0xb881, 0x4}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x24048007}, 0x4040844) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3800000041000701fefffffffeffffff017c0000040042800c000180060006006558000014000280100014800c00", @ANYRES8=r0], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) 1m28.225595085s ago: executing program 34 (id=11253): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0e000000040000000800000007"], 0x50) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=@newlink={0x38, 0x10, 0x439, 0x70bd23, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0xb881, 0x4}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x24048007}, 0x4040844) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3800000041000701fefffffffeffffff017c0000040042800c000180060006006558000014000280100014800c00", @ANYRES8=r0], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) 1m16.571407929s ago: executing program 2 (id=11514): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x0, {0x7, 0x1f, 0x0, 0x10400, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x4, 0x4}}, 0x50) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000380)={0xfffffff8, 0x0, 0x0, 'queue0\x00'}) write$sndseq(r0, &(0x7f0000000000)=[{0x1e, 0x0, 0x0, 0x0, @tick, {}, {}, @raw32}], 0x1001a) 1m16.459688544s ago: executing program 2 (id=11516): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r0, &(0x7f0000000c80)=[{{&(0x7f0000000980)={0xa, 0x4e21, 0x4, @private0={0xfc, 0x0, '\x00', 0x1}, 0xa}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000022c0)='t', 0x1}], 0x1}}, {{&(0x7f0000000300)={0xa, 0x4e23, 0x1, @private1={0xfc, 0x1, '\x00', 0x1}, 0x18}, 0x1c, &(0x7f00000003c0)=[{&(0x7f00000004c0)="af", 0x1}], 0x1}}], 0x2, 0x40800) shutdown(r0, 0x1) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f00000000c0)={0x0, 0x7}, &(0x7f0000000100)=0x8) 1m16.400795519s ago: executing program 2 (id=11518): syz_open_dev$sndpcmc(&(0x7f0000000400), 0x0, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000000440), 0x0, 0xa0e00) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000040)) openat$audio(0xffffffffffffff9c, &(0x7f0000000240), 0x141802, 0x0) 1m16.389767821s ago: executing program 2 (id=11520): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) 1m16.31385901s ago: executing program 2 (id=11529): openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi4\x00', 0x500, 0x0) r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) 1m16.021137039s ago: executing program 2 (id=11524): r0 = socket(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x2c4, 0x24, 0x3fe3aa0262d8c783, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0x8}}, [@qdisc_kind_options=@q_choke={{0xa}, {0x294, 0x2, [@TCA_CHOKE_PARMS={0x14, 0x1, {0x0, 0x0, 0x0, 0x0, 0x2}}, @TCA_CHOKE_PARMS={0x5, 0x1, {0x64, 0x2, 0x3, 0x17, 0x11, 0x8, 0x4}}, @TCA_CHOKE_MAX_P={0x0, 0x3, 0x2}, @TCA_CHOKE_PARMS={0x14}, @TCA_CHOKE_MAX_P={0x8}, @TCA_CHOKE_STAB={0x104, 0x2, "dc542b4e237011fb38ddb228806571a8633206e26df63a43bbc516382325dedd79c1cf0a26379dfaf72cb5ab9ab7efe16f312ee9ab598d1ac0d7903ac69c51f1b6842ebecf00dec5deff737b59f0c1f0b57cc6c2b7b8c5b2c527aafa57222f4bd2355ccab39fa20d4033b6b687491532080101805feb9c6fa8a56a77186efcb394ce1a1cd7f2130835e3bf9e3ac25d0a102a808be13beb51f37da6d10046f131834545ee5013f43e41e91eb18a12c28540ab4106286e0f7568f6a9cd0c0da51df08e42848096b25d455ebec9adfd6e493d8c9725bc2d49bbbae0a5375b359f91d9dad20ed109ffbc52469cffd2cf5df7773f7a4c72ae167485315c326281efc4"}, @TCA_CHOKE_MAX_P={0x8}, @TCA_CHOKE_PARMS={0x14, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, @TCA_CHOKE_PARMS={0x14}, @TCA_CHOKE_STAB={0x104, 0x2, "554b956aa3fcfbc4a187baf0437163b5d33108db016465f92a93480d2c246d90f03741da6ee916f7c9917dbd81da67d6150151679559af8402b932745d19fbfbd679c133c4714565f91cd05790d990818bac85598b6a844cb2c2d277aaca9a88ee0e6a834ba02b4e549f11fb13e9fe33730c55997f2d3b7e6469210db81587fc522295f49a78f4e08ddfb01172b12a19b303a0c47fa3500cdc3e6725a79dcd3731c37083c3bbe73c43e7e2ea82c72986a1499c677c565ea1cfc874e7e978e4ebe8d338f0b37807d40333ee570133982998623ec809826f1009856a9d9d8e839c65d3ead78c6b3cb8f7beee8e59f19de93d06628a2cdfa4333d96882b96c36cc3"}]}}, @TCA_STAB={0x0, 0x8, 0x0, 0x1, [{{0x0, 0x1, {0x40, 0x26, 0xffff, 0x8, 0x2, 0x2, 0x8}}, {0x0, 0x2, [0x6, 0x6]}}, {{0x0, 0x1, {0x4, 0xc, 0x7f, 0x8, 0x0, 0x10, 0x3}}, {0x0, 0x2, [0x5fd]}}, {{0x0, 0x1, {0x7, 0x80, 0x0, 0x1000, 0x2, 0x7fffffff, 0x10088}}, {0x0, 0x2, [0x4, 0xffff, 0xff52, 0x9]}}]}, @TCA_RATE={0x0, 0x5, {0x2, 0x2}}, @TCA_RATE={0x0, 0x5, {0x10, 0x2}}]}, 0x2c4}}, 0x0) 1m15.917616644s ago: executing program 35 (id=11524): r0 = socket(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x2c4, 0x24, 0x3fe3aa0262d8c783, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0x8}}, [@qdisc_kind_options=@q_choke={{0xa}, {0x294, 0x2, [@TCA_CHOKE_PARMS={0x14, 0x1, {0x0, 0x0, 0x0, 0x0, 0x2}}, @TCA_CHOKE_PARMS={0x5, 0x1, {0x64, 0x2, 0x3, 0x17, 0x11, 0x8, 0x4}}, @TCA_CHOKE_MAX_P={0x0, 0x3, 0x2}, @TCA_CHOKE_PARMS={0x14}, @TCA_CHOKE_MAX_P={0x8}, @TCA_CHOKE_STAB={0x104, 0x2, "dc542b4e237011fb38ddb228806571a8633206e26df63a43bbc516382325dedd79c1cf0a26379dfaf72cb5ab9ab7efe16f312ee9ab598d1ac0d7903ac69c51f1b6842ebecf00dec5deff737b59f0c1f0b57cc6c2b7b8c5b2c527aafa57222f4bd2355ccab39fa20d4033b6b687491532080101805feb9c6fa8a56a77186efcb394ce1a1cd7f2130835e3bf9e3ac25d0a102a808be13beb51f37da6d10046f131834545ee5013f43e41e91eb18a12c28540ab4106286e0f7568f6a9cd0c0da51df08e42848096b25d455ebec9adfd6e493d8c9725bc2d49bbbae0a5375b359f91d9dad20ed109ffbc52469cffd2cf5df7773f7a4c72ae167485315c326281efc4"}, @TCA_CHOKE_MAX_P={0x8}, @TCA_CHOKE_PARMS={0x14, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, @TCA_CHOKE_PARMS={0x14}, @TCA_CHOKE_STAB={0x104, 0x2, "554b956aa3fcfbc4a187baf0437163b5d33108db016465f92a93480d2c246d90f03741da6ee916f7c9917dbd81da67d6150151679559af8402b932745d19fbfbd679c133c4714565f91cd05790d990818bac85598b6a844cb2c2d277aaca9a88ee0e6a834ba02b4e549f11fb13e9fe33730c55997f2d3b7e6469210db81587fc522295f49a78f4e08ddfb01172b12a19b303a0c47fa3500cdc3e6725a79dcd3731c37083c3bbe73c43e7e2ea82c72986a1499c677c565ea1cfc874e7e978e4ebe8d338f0b37807d40333ee570133982998623ec809826f1009856a9d9d8e839c65d3ead78c6b3cb8f7beee8e59f19de93d06628a2cdfa4333d96882b96c36cc3"}]}}, @TCA_STAB={0x0, 0x8, 0x0, 0x1, [{{0x0, 0x1, {0x40, 0x26, 0xffff, 0x8, 0x2, 0x2, 0x8}}, {0x0, 0x2, [0x6, 0x6]}}, {{0x0, 0x1, {0x4, 0xc, 0x7f, 0x8, 0x0, 0x10, 0x3}}, {0x0, 0x2, [0x5fd]}}, {{0x0, 0x1, {0x7, 0x80, 0x0, 0x1000, 0x2, 0x7fffffff, 0x10088}}, {0x0, 0x2, [0x4, 0xffff, 0xff52, 0x9]}}]}, @TCA_RATE={0x0, 0x5, {0x2, 0x2}}, @TCA_RATE={0x0, 0x5, {0x10, 0x2}}]}, 0x2c4}}, 0x0) 1.244381336s ago: executing program 6 (id=13097): socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x60ae0}], 0x318, 0x0, 0xdb0, 0xf5ffffff}, 0x3f01) sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0x18, &(0x7f00000000c0), 0x31}, 0x0) sendmmsg$sock(r1, &(0x7f0000002c80)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0) 1.11799586s ago: executing program 3 (id=13104): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) wait4(0x0, 0x0, 0x8, 0x0) 1.026448573s ago: executing program 3 (id=13106): mkdir(&(0x7f0000000100)='./bus\x00', 0xe8) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x20) mount$9p_virtio(&(0x7f00000001c0), &(0x7f00000002c0)='./file0\x00', &(0x7f00000004c0), 0x8017, 0x0) mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000000)={[{@upperdir={'upperdir', 0x3d, './file0'}}]}) 1.025772896s ago: executing program 1 (id=13107): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22, 0xffffffff, @mcast2, 0x2}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000180)=[{&(0x7f00000001c0)="580000001500add427323b472545b45602117fffffff81000e22d991000000000000a80013007b00090080007f000001e809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) 998.50315ms ago: executing program 3 (id=13108): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000004f00)={0x1, 0x0, [{0x40000083}]}) 996.668509ms ago: executing program 1 (id=13109): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0xe) writev(0xffffffffffffffff, &(0x7f0000001500)=[{0x0}], 0x1) ioctl$TIOCSLCKTRMIOS(r0, 0x80047437, &(0x7f00000010c0)) 909.504033ms ago: executing program 1 (id=13110): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f00000004c0)={0x1, 0x0, [{0x4b564d06, 0x0, 0x400000000000000}]}) 747.274502ms ago: executing program 1 (id=13112): io_uring_register$IORING_REGISTER_FILES_UPDATE2(0xffffffffffffffff, 0xe, &(0x7f0000000240)={0x3, 0x0, &(0x7f00000000c0), 0x0}, 0x20) r0 = syz_open_dev$media(&(0x7f0000000380), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc0287c02, &(0x7f0000000100)={0x80000000, 0x0, &(0x7f0000000200)=[{{}, {0x80000000, 0x0}}, {{}, {0x80000000, 0x0}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000001c0)={{r2, r1, 0x1, [0x0, 0xf7df]}, {r2, r3, 0x4, [0x6]}, 0x1, [0x8, 0x3df]}) 746.928973ms ago: executing program 1 (id=13114): r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f00000000c0)={0x1, {{0xa, 0x4e20, 0x5, @mcast2, 0x6}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000500)={0x1, {{0xa, 0x4e20, 0x0, @mcast1}}}, 0x8c) 725.493569ms ago: executing program 1 (id=13116): unshare(0x6a040000) syz_usb_disconnect(0xffffffffffffffff) r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000000)={'filter\x00', 0x0, 0x0, 0x0, [0xd19, 0x5, 0x0, 0xfffffffffffffffb, 0x1000007ff, 0x9]}, &(0x7f0000000080)=0x78) 677.463175ms ago: executing program 3 (id=13117): r0 = syz_io_uring_setup(0xf03, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) r4 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_FIXED_FD_INSTALL={0x36, 0x5, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, {0x0, r4}}) io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) 676.695904ms ago: executing program 3 (id=13119): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x68, '\x00', 0x0, @fallback=0x1, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r1, 0x2000000, 0x0, 0x0, &(0x7f0000000200), 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 616.220071ms ago: executing program 7 (id=13120): r0 = syz_open_procfs(0x0, &(0x7f0000000380)='clear_refs\x00') writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)='4', 0x1}], 0x1) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000240), 0xffffffffffffffff) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3) 615.737871ms ago: executing program 3 (id=13121): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @loopback}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) 548.489404ms ago: executing program 7 (id=13122): r0 = socket$packet(0x11, 0x3, 0x300) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000800)={0x0, 0x0, 0x80, 0x2, 0x1e5}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_LISTEN={0x39, 0x2604a75b2a194040, 0x0, r0, 0x0, 0x0, 0x800}) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x68ba, 0x0, 0x0, 0x10}}}, &(0x7f0000000440)) 459.864237ms ago: executing program 7 (id=13123): openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040301, 0x0) r0 = add_key$user(&(0x7f0000000000), &(0x7f0000000340)={'syz', 0x2}, &(0x7f0000000480)="d25a9850a9a91163f76c5357f3bbadf2656e10d77f85d1028e60ab4e45b931e71645d3d636e82cfdeaadb674e1693d4a7de63820fefc4f787e272b122ebbff6884b3de82f8a3df9a2d0b67e46c349917110300b94240185146e52ac1540130161b6534e99e466173af4c775f238fae344b198915446b576be455f251e79f7ec703f937cd8530410f3700000000000000", 0x90, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) 400.443588ms ago: executing program 7 (id=13124): r0 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty, 0x0, 0xfffffffd}, 0x20) connect$l2tp6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x22}, 0x6, 0x4}, 0x20) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000100)) 400.042903ms ago: executing program 7 (id=13125): madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x66) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) 316.255519ms ago: executing program 6 (id=13126): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000002100b704000000000000850000005700000095"], 0x0, 0x100}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r1, 0x2000000, 0xe, 0x0, &(0x7f00000004c0)="630b008646dc3f0adf33c9f7b986", 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2}, 0x50) 249.550848ms ago: executing program 6 (id=13127): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2003, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_GET_MSRS_cpu(r2, 0xc008ae88, &(0x7f0000000080)={0x1, 0x0, [{0xd90}]}) 103.692351ms ago: executing program 6 (id=13128): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f0000001bc0)={'syz1\x00', {0x0, 0x7513, 0x8, 0x9}, 0x1a, [0x7, 0x9, 0x7f, 0x3, 0xb96, 0x4, 0x8, 0xc245, 0x1, 0x80000000, 0x101, 0x2, 0x7, 0x100, 0x5, 0x80000001, 0x3, 0x4, 0x4, 0x1, 0xffff0000, 0xb, 0x8, 0xa6, 0x800, 0x7e727be, 0x9, 0x9, 0x4, 0x2, 0x2924, 0xb, 0x9, 0x2, 0xffff, 0xd0, 0x4, 0x6, 0x4, 0x8, 0xa0f3, 0x2, 0x6, 0x1, 0x4, 0x5f, 0x9, 0x7fff, 0x5, 0x7, 0x8, 0x9, 0x101, 0xc4d, 0x1, 0x5, 0x0, 0x2, 0x7, 0xfffffffe, 0x100, 0x8, 0x4, 0x4], [0x800, 0x40, 0x1ff, 0x5, 0x4, 0xf9, 0x80000, 0x8bec, 0x7fff, 0x9, 0x3, 0x6, 0x80, 0xd9, 0x6, 0x5, 0x2, 0x9, 0x960f, 0x4, 0x1, 0x9, 0x2, 0x3895d2eb, 0x3, 0x7, 0xfffffffd, 0x1, 0x2, 0x1, 0x4, 0x1, 0x6c, 0x8, 0x6, 0x38, 0x1, 0x100, 0x7, 0x8001, 0x8, 0x3, 0x1, 0x1ff, 0x4, 0x8, 0xfffffff5, 0xffffff65, 0x9, 0x3, 0x1, 0x9, 0x5, 0x7, 0x5, 0x8, 0x0, 0x3, 0x8255, 0xe, 0x2, 0xffffffb2, 0x4, 0xc559], [0x8, 0x4, 0x800, 0xacf, 0x1000, 0x9, 0x4, 0x106, 0x6, 0xfffffffa, 0x2, 0x3, 0x759, 0x3d4c, 0x1, 0x7f, 0x1, 0x95d, 0x8001, 0x657, 0x4f, 0x8, 0xffffff22, 0xd10, 0xe, 0x9, 0x10000, 0x4a00, 0x0, 0x2, 0x0, 0x60d, 0x1, 0x7fff, 0x8464, 0xbc44, 0xc656, 0x40, 0x5, 0x4, 0xbb3, 0x3c9, 0xd1, 0x9, 0xb, 0x401, 0xe, 0xffff, 0x3, 0xabd, 0x3, 0x9, 0x7, 0x81af, 0x96ff, 0xfffffe01, 0xc, 0x4, 0x3, 0x9d9f, 0x2, 0x65, 0x1, 0x7], [0x77, 0xe, 0x5, 0x0, 0xa0e, 0x7, 0x7, 0x4, 0x2, 0xfffffffd, 0xfffffffd, 0x9, 0x2, 0x1, 0xfffffff2, 0x2, 0x80000000, 0xffff, 0xffffffff, 0x400, 0x0, 0xffffffff, 0x200, 0x2, 0x2, 0xffffff79, 0xf, 0x7fff, 0x6, 0x2, 0x6, 0x0, 0x5799, 0x0, 0x6, 0x5, 0x5, 0x3, 0x522, 0x2, 0x9, 0x7f, 0xc, 0x0, 0x9a0, 0x81, 0x3, 0x0, 0x4, 0xe662, 0x1a, 0x8, 0x2e, 0x2, 0x1ff, 0x200, 0x6, 0x4, 0xf9, 0xfffffff9, 0x3, 0x7a, 0x4, 0x15]}, 0x45c) 103.481348ms ago: executing program 7 (id=13129): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x3ff, &(0x7f0000000500)=0x0) read$FUSE(r0, &(0x7f0000001740)={0x2020}, 0xffffffffffffffec) io_submit(r2, 0xf000, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f00000001c0)='m', 0xffffff4c}]) 103.160296ms ago: executing program 6 (id=13130): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000000003080005400000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWCHAIN={0x38, 0x3, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0x7}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x2}, @NFTA_CHAIN_HOOK={0xc, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x60}, 0x1, 0x0, 0x0, 0x40080a5}, 0x20008040) 0s ago: executing program 6 (id=13131): r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESDEC], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, 0x0, 0x0) syz_usb_disconnect(r0) kernel console output (not intermixed with test programs): after parsing attributes in process `syz.1.10431'. [ 393.112473][T28394] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10431'. [ 393.730618][T28427] netlink: 24 bytes leftover after parsing attributes in process `syz.5.10444'. [ 394.503756][T28458] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 395.795071][T28504] binder: 28503:28504 ioctl c018620c 80000140 returned -1 [ 396.054653][T28508] netlink: 4 bytes leftover after parsing attributes in process `syz.5.10480'. [ 396.059283][T28508] netlink: 104 bytes leftover after parsing attributes in process `syz.5.10480'. [ 396.062502][T28508] netlink: 104 bytes leftover after parsing attributes in process `syz.5.10480'. [ 396.065679][ T7530] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 396.216909][ T7530] usb 6-1: config 0 interface 0 altsetting 251 bulk endpoint 0x9 has invalid maxpacket 99 [ 396.220348][ T7530] usb 6-1: config 0 interface 0 has no altsetting 0 [ 396.224843][ T7530] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 396.228602][ T7530] usb 6-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 396.231576][ T7530] usb 6-1: Product: syz [ 396.233123][ T7530] usb 6-1: Manufacturer: syz [ 396.234608][ T7530] usb 6-1: SerialNumber: syz [ 396.241855][ T7530] usb 6-1: config 0 descriptor?? [ 396.244497][T28506] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 396.250276][ T7530] usb 6-1: selecting invalid altsetting 0 [ 396.384914][T28524] kvm: apic: phys broadcast and lowest prio [ 396.462513][T11567] usb 6-1: USB disconnect, device number 22 [ 396.554410][T28530] batadv_slave_1: entered promiscuous mode [ 396.559163][T28530] batadv_slave_1: left promiscuous mode [ 396.613913][T28532] ALSA: mixer_oss: invalid OSS volume '' [ 396.616559][T28532] ALSA: mixer_oss: invalid OSS volume '6;Z' [ 396.630182][ T64] Bluetooth: hci2: command 0x1003 tx timeout [ 396.635546][ T5753] Bluetooth: hci2: Opcode 0x1003 failed: -110 [ 397.423314][T28544] netlink: 76 bytes leftover after parsing attributes in process `syz.2.10498'. [ 397.427664][T28534] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 397.430975][T28534] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 397.889939][T28573] kvm_intel: kvm [28572]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0x1d9) = 0xcd [ 397.930047][ T42] kauditd_printk_skb: 409 callbacks suppressed [ 397.930066][ T42] audit: type=1800 audit(2000000158.602:658): pid=28577 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.10513" name="SYSV00000000" dev="tmpfs" ino=6 res=0 errno=0 [ 398.080316][T28585] netlink: 132 bytes leftover after parsing attributes in process `syz.3.10517'. [ 398.085697][T28585] netlink: 'syz.3.10517': attribute type 12 has an invalid length. [ 398.089391][T28585] netlink: 132 bytes leftover after parsing attributes in process `syz.3.10517'. [ 398.226122][ T846] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 398.385771][ T846] usb 6-1: Using ep0 maxpacket: 32 [ 398.389608][ T846] usb 6-1: config index 0 descriptor too short (expected 156, got 27) [ 398.392597][ T846] usb 6-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 398.397793][ T846] usb 6-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 398.402666][ T846] usb 6-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 398.407362][ T846] usb 6-1: config 0 interface 0 has no altsetting 0 [ 398.412003][ T846] usb 6-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 398.416376][ T846] usb 6-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 398.419270][ T846] usb 6-1: Product: syz [ 398.420714][ T846] usb 6-1: Manufacturer: syz [ 398.422404][ T846] usb 6-1: SerialNumber: syz [ 398.425726][T28597] pim6reg: entered allmulticast mode [ 398.426034][ T846] usb 6-1: config 0 descriptor?? [ 398.433586][ T846] ldusb 6-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 398.438147][ T846] ldusb 6-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 398.440411][T28597] pim6reg: left allmulticast mode [ 398.644747][ T34] usb 6-1: USB disconnect, device number 23 [ 398.657728][ T34] ldusb 6-1:0.0: LD USB Device #0 now disconnected [ 399.446655][ T5753] Bluetooth: hci2: sending frame failed (-49) [ 399.458608][ T64] Bluetooth: hci2: Entering manufacturer mode failed (-49) [ 399.515621][ T5753] Bluetooth: hci3: command 0x0c1a tx timeout [ 399.517848][ T64] Bluetooth: hci1: command 0x0406 tx timeout [ 400.629867][ T42] audit: type=1326 audit(2000000161.302:659): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28685 comm="syz.3.10563" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd4fec code=0x7ffc0000 [ 400.648140][ T42] audit: type=1326 audit(2000000161.302:660): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28685 comm="syz.3.10563" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd4fec code=0x7ffc0000 [ 400.657655][ T42] audit: type=1326 audit(2000000161.312:661): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28685 comm="syz.3.10563" exe="/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf7fd4fec code=0x7ffc0000 [ 400.669248][ T42] audit: type=1326 audit(2000000161.312:662): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28685 comm="syz.3.10563" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd4fec code=0x7ffc0000 [ 400.679734][ T42] audit: type=1326 audit(2000000161.312:663): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28685 comm="syz.3.10563" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd4fec code=0x7ffc0000 [ 400.690398][ T42] audit: type=1326 audit(2000000161.322:664): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28685 comm="syz.3.10563" exe="/syz-executor" sig=0 arch=40000003 syscall=345 compat=1 ip=0xf7fd4fec code=0x7ffc0000 [ 400.702440][ T42] audit: type=1326 audit(2000000161.322:665): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28685 comm="syz.3.10563" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd4fec code=0x7ffc0000 [ 400.711699][ T42] audit: type=1326 audit(2000000161.322:666): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28685 comm="syz.3.10563" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd4fec code=0x7ffc0000 [ 400.721997][ T42] audit: type=1326 audit(2000000161.332:667): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28685 comm="syz.3.10563" exe="/syz-executor" sig=0 arch=40000003 syscall=371 compat=1 ip=0xf7fd4fec code=0x7ffc0000 [ 400.747612][T28695] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10567'. [ 401.075573][T11567] usb 10-1: new high-speed USB device number 9 using dummy_hcd [ 401.246417][T11567] usb 10-1: Using ep0 maxpacket: 8 [ 401.250996][T11567] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 401.256110][T11567] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 401.260389][T11567] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 401.265139][T11567] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 401.282059][T11567] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 401.286423][T11567] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 401.499810][T11567] usb 10-1: GET_CAPABILITIES returned 0 [ 401.501818][T11567] usbtmc 10-1:16.0: can't read capabilities [ 401.712073][T28702] usb 10-1: usbtmc_ioctl_clear_in_halt returned -32 [ 401.719215][ T10] usb 10-1: USB disconnect, device number 9 [ 402.266689][T28774] netlink: 28 bytes leftover after parsing attributes in process `syz.5.10603'. [ 402.609249][T28800] pim6reg: entered allmulticast mode [ 402.619012][T28800] pim6reg: left allmulticast mode [ 402.786609][T28815] netlink: 4 bytes leftover after parsing attributes in process `syz.5.10623'. [ 402.805249][T28815] veth0_macvtap: left promiscuous mode [ 402.870801][T28821] bad cache= option: none_mlock 0 [ 402.870801][T28821] nr_zspages 436 [ 402.870801][T28821] nr_free_cma 0 [ 402.870801][T28821] numa_hit 231140 [ 402.870801][T28821] numa_miss 4107791 [ 402.870801][T28821] numa_foreign 4107791 [ 402.870801][T28821] numa_interleave 5935 [ 402.870801][T28821] numa_local 226383 [ 402.870801][T28821] numa_other 4112548 [ 402.870801][T28821] nr_inactive_anon 79 [ 402.870801][T28821] nr_active_anon 7862 [ 402.870801][T28821] nr_inactive_file 29017 [ 402.870801][T28821] nr_active_file 1965 [ 402.870801][T28821] nr_unevictable 1768 [ 402.870801][T28821] nr_slab_reclaimable 6453 [ 402.870801][T28821] nr_slab_unreclaimable 67243 [ 402.870801][T28821] nr_isolated_anon 0 [ 402.870801][T28821] nr_isolated_file 0 [ 402.870801][T28821] workingset_nodes 119 [ 402.870801][T28821] workingset_refault_anon 10302 [ 402.870801][T28821] workingset_refault_file 1617 [ 402.870801][T28821] workingset_activate_anon 32 [ 402.870801][T28821] workingset_activate_file 35 [ 402.870801][T28821] workingset_restore_anon 32 [ 402.870801][T28821] workingset_restore_file 35 [ 402.870801][T28821] workingset_nodereclaim 361 [ 402.870801][T28821] nr_anon_pages 7331 [ 402.870801][T28821] nr_mapped 24038 [ 402.870801][T28821] nr_file_pages 33516 [ 402.870801][T28821] nr_dirty 189 [ 402.870801][T28821] nr_writeback 0 [ 402.870801][T28821] nr_shmem 2273 [ 402.870801][T28821] nr_shmem_hugepages 0 [ 402.870801][T28821] nr_shmem_pmdmapped 0 [ 402.870801][T28821] nr_file_hugepages 0 [ 402.870801][T28821] nr_file_pmdmapped 0 [ 402.870801][T28821] nr_anon_transparent_hugepages 0 [ 402.870801][T28821] nr_vmscan_write 19938 [ 402.870801][T28821] nr_vmscan_immediate_reclaim 10 [ 402.870801][T28821] nr_dirtied 37295 [ 402.870801][T28821] nr_written 37131 [ 402.870801][T28821] nr_throttled_written 0 [ 402.870801][T28821] nr_kernel_misc_reclaimable 0 [ 402.870801][T28821] nr_foll_pin_acquired 7794 [ 402.870801][T28821] nr_foll_pin_released 7794 [ 402.871189][T28821] CIFS: VFS: bad cache= option: none_mlock 0 [ 402.871189][T28821] nr_zspages 436 [ 402.871189][T28821] nr_free_cma 0 [ 402.871189][T28821] numa_hit 231140 [ 402.871189][T28821] numa_miss 4107791 [ 402.871189][T28821] numa_foreign 4107791 [ 402.871189][T28821] numa_interleave 5935 [ 402.871189][T28821] numa_local 226383 [ 402.871189][T28821] numa_other 4112548 [ 402.871189][T28821] nr_inactive_anon 79 [ 402.871189][T28821] nr_active_anon 7862 [ 402.871189][T28821] nr_inactive_file 29017 [ 402.871189][T28821] nr_active_file 1965 [ 402.871189][T28821] nr_unevictable 1768 [ 402.871189][T28821] nr_slab_reclaimable 6453 [ 402.871189][T28821] nr_slab_unreclaimable 67243 [ 402.871189][T28821] nr_isolated_anon 0 [ 402.871189][T28821] nr_isolated_file 0 [ 402.871189][T28821] workingset_nodes 119 [ 402.871189][T28821] workingset_refault_anon 10302 [ 402.871189][T28821] workingset_refault_file 1617 [ 402.871189][T28821] workingset_activate_anon 32 [ 402.871189][T28821] workingset_activate_file 35 [ 402.871189][T28821] workingset_restore_anon 32 [ 402.871189][T28821] workingset_restore_file 35 [ 402.871189][T28821] workingset_nodereclaim 361 [ 402.871189][T28821] nr_anon_pages 7331 [ 402.871189][T28821] nr_mapped 24038 [ 402.871189][T28821] nr_file_pages 33516 [ 402.871189][T28821] nr_dirty 189 [ 402.871189][T28821] nr_writeback 0 [ 402.871189][T28821] nr_shmem 2273 [ 402.871189][T28821] nr_shmem_hugepages 0 [ 402.871189][T28821] nr_shmem_pmdmapped 0 [ 402.871189][T28821] nr_file_hugepages 0 [ 402.871189][T28821] nr_file_pmdmapped 0 [ 402.871189][T28821] nr_anon_transparent_hugepages 0 [ 402.871189][T28821] nr_vmscan_write 19938 [ 402.871189][T28821] nr_vmscan_immediate_reclaim 10 [ 402.871189][T28821] nr_dirtied 37295 [ 402.871189][T28821] nr_written 37131 [ 402.871189][T28821] nr_throttled_written 0 [ 402.871189][T28821] nr_kernel_misc_reclaimable 0 [ 402.871189][T28821] nr_foll_pin_acquired 7794 [ 402.871189][T28821] nr_foll_pin_released 7794 [ 403.115815][T28840] program syz.5.10632 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 403.117038][T28836] pim6reg: entered allmulticast mode [ 403.204225][T28839] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10634'. [ 403.214096][T28841] pim6reg: left allmulticast mode [ 403.683574][ T34] kernel write not supported for file /uinput (pid: 34 comm: kworker/3:0) [ 403.700014][T28892] loop4: detected capacity change from 0 to 7 [ 403.721594][ C1] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 403.725547][ C1] Buffer I/O error on dev loop4, logical block 0, async page read [ 403.731212][ C1] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 403.734378][ C1] Buffer I/O error on dev loop4, logical block 0, async page read [ 403.737597][ C1] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 403.740664][ C1] Buffer I/O error on dev loop4, logical block 0, async page read [ 403.747189][ C1] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 403.751466][ C1] Buffer I/O error on dev loop4, logical block 0, async page read [ 403.757326][ C1] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 403.761429][ C1] Buffer I/O error on dev loop4, logical block 0, async page read [ 403.764356][ C0] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 403.767518][ C0] Buffer I/O error on dev loop4, logical block 0, async page read [ 403.770737][ C0] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 403.773932][ C0] Buffer I/O error on dev loop4, logical block 0, async page read [ 403.777501][T28892] ldm_validate_partition_table(): Disk read failed. [ 403.785541][ C1] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 403.789826][ C1] Buffer I/O error on dev loop4, logical block 0, async page read [ 403.798339][ C1] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 403.802157][ C1] Buffer I/O error on dev loop4, logical block 0, async page read [ 403.805259][ C1] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 403.808396][ C1] Buffer I/O error on dev loop4, logical block 0, async page read [ 403.811852][T28892] Dev loop4: unable to read RDB block 0 [ 403.815701][T28892] loop4: unable to read partition table [ 403.818130][T28892] loop4: partition table beyond EOD, truncated [ 403.820323][T28892] loop_reread_partitions: partition scan of loop4 (Cj̖P= ) failed (rc=-5) [ 403.831640][ T5863] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 403.970700][T28908] Failed to get privilege flags for destination (handle=0x2:0x0) [ 404.006965][ T5863] usb 6-1: Using ep0 maxpacket: 8 [ 404.014379][ T5863] usb 6-1: config 0 has an invalid interface number: 55 but max is 0 [ 404.021154][ T5863] usb 6-1: config 0 has no interface number 0 [ 404.025792][ T5863] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 404.032856][ T5863] usb 6-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 404.045333][ T5863] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 404.052423][ T5863] usb 6-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 404.057839][T28912] netlink: 7 bytes leftover after parsing attributes in process `syz.3.10666'. [ 404.060292][ T5863] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 404.066748][ T5863] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 404.080699][ T5863] usb 6-1: config 0 descriptor?? [ 404.115906][ T5863] ldusb 6-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 404.304850][ T7530] usb 6-1: USB disconnect, device number 24 [ 404.315010][ T7530] ldusb 6-1:0.55: LD USB Device #0 now disconnected [ 404.485794][ T34] usb 8-1: new full-speed USB device number 12 using dummy_hcd [ 404.641857][ T34] usb 8-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 404.645886][ T34] usb 8-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 404.649342][ T34] usb 8-1: Product: syz [ 404.651252][ T34] usb 8-1: Manufacturer: syz [ 404.653483][ T34] usb 8-1: SerialNumber: syz [ 404.661558][ T34] usb 8-1: config 0 descriptor?? [ 404.876448][ T61] usb 8-1: USB disconnect, device number 12 [ 405.110168][T28984] netlink: 12 bytes leftover after parsing attributes in process `syz.5.10702'. [ 405.138877][T28986] bond0: entered promiscuous mode [ 405.140849][T28986] bond_slave_0: entered promiscuous mode [ 405.143221][T28986] bond_slave_1: entered promiscuous mode [ 405.149344][T28986] bond0: left promiscuous mode [ 405.150950][T28986] bond_slave_0: left promiscuous mode [ 405.152905][T28986] bond_slave_1: left promiscuous mode [ 405.250463][T28993] vivid-000: disconnect [ 405.254715][T28989] vivid-000: reconnect [ 405.473975][T29009] netlink: 'syz.2.10715': attribute type 2 has an invalid length. [ 405.483719][T29009] netlink: 'syz.2.10715': attribute type 11 has an invalid length. [ 405.488047][T29009] netlink: 88 bytes leftover after parsing attributes in process `syz.2.10715'. [ 405.889758][T29042] netlink: 27 bytes leftover after parsing attributes in process `syz.5.10730'. [ 405.983775][T29044] 8021q: adding VLAN 0 to HW filter on device bond1 [ 405.988990][T29044] bond0: (slave bond1): Enslaving as an active interface with an up link [ 406.050157][T29049] openvswitch: netlink: IP tunnel dst address not specified [ 406.053235][T29049] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 406.159199][T29062] netlink: 12 bytes leftover after parsing attributes in process `syz.5.10737'. [ 406.978463][ T42] kauditd_printk_skb: 2 callbacks suppressed [ 406.978474][ T42] audit: type=1326 audit(2000000167.652:670): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29116 comm="syz.1.10763" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x0 [ 407.666812][T29139] /dev/nullb0: Can't open blockdev [ 407.673003][T29139] /dev/nullb0: Can't open blockdev [ 407.801058][ T42] audit: type=1800 audit(2000000168.472:671): pid=29151 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.10778" name="SYSV00000000" dev="tmpfs" ino=2 res=0 errno=0 [ 407.939864][T29163] netlink: 16 bytes leftover after parsing attributes in process `syz.2.10784'. [ 408.053060][T29173] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(3) [ 408.055779][T29173] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 408.071980][T29173] vhci_hcd vhci_hcd.0: Device attached [ 408.079369][T29173] vhci_hcd vhci_hcd.0: pdev(5) rhport(1) sockfd(5) [ 408.081667][T29173] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 408.084856][T29173] vhci_hcd vhci_hcd.0: Device attached [ 408.090464][T29173] vhci_hcd vhci_hcd.0: pdev(5) rhport(2) sockfd(7) [ 408.093558][T29173] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 408.097912][T29173] vhci_hcd vhci_hcd.0: Device attached [ 408.122281][T29173] vhci_hcd vhci_hcd.0: pdev(5) rhport(3) sockfd(9) [ 408.124583][T29173] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 408.129091][T29173] vhci_hcd vhci_hcd.0: Device attached [ 408.131679][T29186] vhci_hcd: connection closed [ 408.133552][T29184] vhci_hcd: connection closed [ 408.134020][ T5556] vhci_hcd vhci_hcd.5: stop threads [ 408.137076][T29181] vhci_hcd: connection closed [ 408.140146][ T5556] vhci_hcd vhci_hcd.5: release socket [ 408.142949][T29174] vhci_hcd: connection closed [ 408.148209][ T5556] vhci_hcd vhci_hcd.5: disconnect device [ 408.159735][ T5556] vhci_hcd vhci_hcd.5: stop threads [ 408.161503][ T5556] vhci_hcd vhci_hcd.5: release socket [ 408.167581][ T5556] vhci_hcd vhci_hcd.5: disconnect device [ 408.173041][ T5556] vhci_hcd vhci_hcd.5: stop threads [ 408.175072][ T5556] vhci_hcd vhci_hcd.5: release socket [ 408.178863][ T5556] vhci_hcd vhci_hcd.5: disconnect device [ 408.186440][ T5556] vhci_hcd vhci_hcd.5: stop threads [ 408.189680][ T5556] vhci_hcd vhci_hcd.5: release socket [ 408.197455][ T5556] vhci_hcd vhci_hcd.5: disconnect device [ 408.246594][ T846] vhci_hcd vhci_hcd.5: vhci_device speed not set [ 408.459214][T29214] 8021q: adding VLAN 0 to HW filter on device bond2 [ 408.463028][T29214] bond2: entered allmulticast mode [ 408.466540][T29214] bond0: (slave bond2): Enslaving as an active interface with an up link [ 408.598455][T29223] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10807'. [ 408.896310][T29252] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10820'. [ 408.927436][T29256] netlink: 'syz.5.10822': attribute type 4 has an invalid length. [ 409.893770][T29332] PID 29332 killed due to inadequate hugepage pool [ 409.997628][T29351] /dev/nullb0: Can't open blockdev [ 410.004826][T29351] /dev/nullb0: Can't open blockdev [ 410.015328][T29353] netlink: 24 bytes leftover after parsing attributes in process `syz.3.10865'. [ 410.113209][T29362] overlayfs: lowerdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 410.120817][T29362] overlayfs: overlapping lowerdir path [ 410.341958][ T846] kernel write not supported for file bpf-map (pid: 846 comm: kworker/0:2) [ 411.104961][T29448] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10908'. [ 411.216565][T29457] Bluetooth: hci2: Frame reassembly failed (-84) [ 412.004298][T29486] dvmrp8: entered allmulticast mode [ 412.908743][T29502] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 413.265593][ T5753] Bluetooth: hci2: Entering manufacturer mode failed (-110) [ 414.786183][ C2] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 414.807717][T29624] netlink: 144 bytes leftover after parsing attributes in process `syz.1.10985'. [ 415.005942][T11567] usb 10-1: new high-speed USB device number 10 using dummy_hcd [ 415.160768][T11567] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 415.166234][T11567] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 415.173251][T11567] usb 10-1: New USB device found, idVendor=0ccd, idProduct=0014, bcdDevice= 0.40 [ 415.180817][T11567] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 415.184253][T11567] usb 10-1: Product: syz [ 415.187203][T11567] usb 10-1: Manufacturer: syz [ 415.189776][T11567] usb 10-1: SerialNumber: syz [ 415.327037][T29650] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11004'. [ 415.410241][T11567] usb 10-1: 0:1 : does not exist [ 415.412920][T11567] usb 10-1: unit 2 not found! [ 415.414766][T11567] usb 10-1: unit 80 not found! [ 415.440054][T11567] usb 10-1: USB disconnect, device number 10 [ 415.467870][ T5754] udevd[5754]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb10/10-1/10-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 415.652861][T29667] tmpfs: Too small a size for current use [ 415.745083][ T5753] Bluetooth: hci1: Malformed HCI Event [ 416.871864][ T5753] Bluetooth: hci3: unexpected event for opcode 0x0000 [ 416.986608][T29697] dvmrp8: entered allmulticast mode [ 417.465908][ T9] usb 8-1: new high-speed USB device number 13 using dummy_hcd [ 417.581543][T29748] dvmrp8: entered allmulticast mode [ 417.615558][ T9] usb 8-1: Using ep0 maxpacket: 8 [ 417.627736][ T9] usb 8-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 417.635911][ T9] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 417.670468][ T13] dvmrp8: left allmulticast mode [ 417.673017][ T9] pvrusb2: Hardware description: Terratec Grabster AV400 [ 417.676050][ T9] pvrusb2: ********** [ 417.677780][ T9] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 417.681182][ T9] pvrusb2: Important functionality might not be entirely working. [ 417.683738][ T9] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 417.687781][ T9] pvrusb2: ********** [ 417.878779][ T2514] pvrusb2: Invalid write control endpoint [ 417.960225][ T2514] pvrusb2: Invalid write control endpoint [ 417.962934][ T2514] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 417.969634][ T2514] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 417.975252][ T2514] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 417.984534][ T2514] pvrusb2: Device being rendered inoperable [ 417.994270][ T2514] cx25840 2-0044: Unable to detect h/w, assuming cx23887 [ 417.998886][ T2514] cx25840 2-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 418.061355][ T2514] pvrusb2: Attached sub-driver cx25840 [ 418.067450][ T2514] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 418.070880][ T2514] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 418.078032][T29732] pvrusb2: Killing an I2C write to 0 that is too large (desired=62 limit=61) [ 418.090005][ T9] usb 8-1: USB disconnect, device number 13 [ 418.891429][T29813] netlink: 'syz.3.11072': attribute type 7 has an invalid length. [ 420.160476][T29892] netlink: 8 bytes leftover after parsing attributes in process `syz.5.11106'. [ 420.164407][T29892] netlink: 12 bytes leftover after parsing attributes in process `syz.5.11106'. [ 420.221580][T29898] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 420.471917][ T42] audit: type=1400 audit(2000000181.142:672): apparmor="DENIED" operation="stack_onexec" class="file" info="label not found" error=-2 profile="unconfined" name=3AAE86AD47AA0D9495E6D80F7BDE2D18FFB36CF152AED2D408FB58E305FC8E2F2F7D91F81B621CC4214D4A27E1614FBEE0BEAC8F4A045070B770212D46D4A2DF096B791F2A4BA218E12CB76AA24945B70A7C9DD5EDEAC52B5A876F73CFBE66371A72F11F3D9544D6B59B4A5541DCEF5CBF11FFFF37DFD147C8A3E5098A207BE806EA7167101F8C1B5C8FE41E170FD0C775DBC5BE0B6D3AB625AB702E5B1DC15F9C4B3D09BE812F340E681E0694F5BADF640DA3FDFC2F929B4C2BEB9A592C577287B6021BFEEC24146C7F95608BB60A736207A09D9F47E89C4044EADDE57CDEFD15F25B822D2EAF2205DF0D6B71B63EE0B63CB598F26509AF36983578F6F4198A0843CC1B1BD780015007AB9709CC6211E3B5C685B972B5C5E95F054A7A9FE149282F679C8466B9734E3850EC98419DD0C887715902F9E7802842085BC606F30C2654869E9E3701FD0FC69137FE165592689465EEBD5CAFAD7C29DE2ADADEC42A818D8EE389CA1FE33A1EF23617C89116A3A458B56612E4C36C43A9150D5331ADBB0BEB01A062B1F1349FC2ECEA76CB7C40CDFE378185F3099B1D71414D0FDA5A47F8593260CC0BD723A4CCA81435F04 [ 420.570612][T29920] netlink: 52 bytes leftover after parsing attributes in process `syz.3.11118'. [ 420.865720][ T5753] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 420.873296][ T5753] Bluetooth: hci3: Injecting HCI hardware error event [ 420.881518][ T5753] Bluetooth: hci3: hardware error 0x00 [ 420.939932][T29937] macvlan0: entered promiscuous mode [ 420.942722][T29937] netlink: 'syz.1.11125': attribute type 2 has an invalid length. [ 421.098206][T29943] trusted_key: encrypted_key: keyword 'load' not allowed when called from .update method [ 421.726041][T29967] dvmrp8: entered allmulticast mode [ 421.752890][T29986] hugetlbfs: syz.1.11145 (29986): Using mlock ulimits for SHM_HUGETLB is obsolete [ 421.796814][T29988] loop9: detected capacity change from 0 to 255852544 [ 421.903825][T29993] syz.1.11149 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 421.918731][T29994] fuse: Invalid rootmode [ 421.926911][T29988] loop9: detected capacity change from 255852544 to 524287871 [ 422.324037][T30011] dvmrp8: entered allmulticast mode [ 422.480785][ T13] dvmrp8: left allmulticast mode [ 422.484132][T30030] netlink: 4 bytes leftover after parsing attributes in process `syz.5.11164'. [ 422.502279][T30030] netlink: 4 bytes leftover after parsing attributes in process `syz.5.11164'. [ 422.533593][T30033] netlink: 'syz.1.11166': attribute type 3 has an invalid length. [ 422.609701][T30042] netlink: 224 bytes leftover after parsing attributes in process `syz.5.11169'. [ 422.613447][T30042] netlink: 220 bytes leftover after parsing attributes in process `syz.5.11169'. [ 422.784539][T30057] loop8: detected capacity change from 0 to 7 [ 422.808006][T30057] loop8: [POWERTEC] [ 422.949938][ T5753] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 423.175640][ T34] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 423.325761][ T34] usb 6-1: Using ep0 maxpacket: 32 [ 423.331222][ T34] usb 6-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 423.334997][ T34] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 423.342329][ T34] usb 6-1: config 0 descriptor?? [ 423.351245][ T34] as10x_usb: device has been detected [ 423.354707][ T34] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 423.365127][ T34] usb 6-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 423.414990][ T34] as10x_usb: error during firmware upload part1 [ 423.417432][ T34] Registered device nBox DVB-T Dongle [ 423.495746][ T29] usb 8-1: new high-speed USB device number 14 using dummy_hcd [ 423.549245][ T34] usb 6-1: USB disconnect, device number 25 [ 423.595764][ T34] Unregistered device nBox DVB-T Dongle [ 423.600205][ T34] as10x_usb: device has been disconnected [ 423.655882][ T29] usb 8-1: Using ep0 maxpacket: 16 [ 423.662848][ T29] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 423.667260][ T29] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 423.670927][ T29] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 423.674170][ T29] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 423.678344][ T29] usb 8-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 423.684081][ T29] usb 8-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 423.688781][ T29] usb 8-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 423.691385][ T29] usb 8-1: Manufacturer: syz [ 423.697421][ T29] usb 8-1: config 0 descriptor?? [ 423.906986][T30114] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11202'. [ 423.965707][ T29] rc_core: IR keymap rc-hauppauge not found [ 423.968186][ T29] Registered IR keymap rc-empty [ 423.970584][ T29] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 423.985730][ T29] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 424.006308][ T29] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/rc/rc0 [ 424.011443][ T29] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/rc/rc0/input49 [ 424.018223][ T29] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 424.045589][ T29] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 424.075702][ T29] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 424.095548][ T29] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 424.116949][ T29] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 424.147281][ T29] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 424.165701][ T29] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 424.187885][ T29] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 424.215567][ T29] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 424.235675][ T29] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 424.268187][ T29] mceusb 8-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 424.272981][ T29] mceusb 8-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 424.282800][ T29] usb 8-1: USB disconnect, device number 14 [ 425.150207][T30173] loop7: detected capacity change from 0 to 7 [ 425.161815][ C0] blk_print_req_error: 6 callbacks suppressed [ 425.161840][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 425.168834][ C0] buffer_io_error: 10 callbacks suppressed [ 425.168858][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 425.178594][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 425.182447][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 425.190625][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 425.195198][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 425.200157][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 425.203224][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 425.205919][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 425.209330][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 425.213484][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 425.217800][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 425.224365][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 425.227990][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 425.231061][T30173] ldm_validate_partition_table(): Disk read failed. [ 425.234607][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 425.238677][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 425.247130][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 425.251757][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 425.257573][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 425.261512][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 425.265098][T30173] Dev loop7: unable to read RDB block 0 [ 425.272044][T30183] 8021q: adding VLAN 0 to HW filter on device bond2 [ 425.275134][T30173] loop7: unable to read partition table [ 425.275786][T30183] bond0: (slave bond2): Enslaving as an active interface with an up link [ 425.277646][T30173] loop7: partition table beyond EOD, truncated [ 425.284459][T30173] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 425.334461][T30179] ldm_validate_partition_table(): Disk read failed. [ 425.347848][T30179] Dev loop7: unable to read RDB block 0 [ 425.352928][T30179] loop7: unable to read partition table [ 425.358082][T30179] loop7: partition table beyond EOD, truncated [ 425.668372][T30212] netlink: 232 bytes leftover after parsing attributes in process `syz.1.11246'. [ 426.064911][ T64] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 426.075330][ T64] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 426.080963][ T64] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 426.089307][ T64] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 426.093691][ T64] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 426.604830][T30233] bridge0: port 1(bridge_slave_0) entered blocking state [ 426.608300][T30233] bridge0: port 1(bridge_slave_0) entered disabled state [ 426.612373][T30233] bridge_slave_0: entered allmulticast mode [ 426.617797][T30233] bridge_slave_0: entered promiscuous mode [ 426.625242][T30233] bridge0: port 2(bridge_slave_1) entered blocking state [ 426.628114][T30233] bridge0: port 2(bridge_slave_1) entered disabled state [ 426.631560][T30233] bridge_slave_1: entered allmulticast mode [ 426.636306][T30233] bridge_slave_1: entered promiscuous mode [ 426.661508][T30233] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 426.669434][T30233] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 426.689235][T30233] team0: Port device team_slave_0 added [ 426.692586][T30233] team0: Port device team_slave_1 added [ 426.711601][T30233] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 426.714709][T30233] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 426.730671][T30233] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 426.740176][T30233] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 426.742746][T30233] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 426.775830][T30233] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 426.812644][T30233] hsr_slave_0: entered promiscuous mode [ 426.820067][T30233] hsr_slave_1: entered promiscuous mode [ 426.826830][T30233] debugfs: 'hsr0' already exists in 'hsr' [ 426.829141][T30233] Cannot create hsr debugfs directory [ 427.065564][T30233] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 427.108597][T30233] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 427.116604][T30233] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 427.129496][T30233] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 427.146108][T30233] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 427.156585][T30233] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 427.162009][T30233] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 427.170515][T30233] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 427.205368][T30233] bridge0: port 2(bridge_slave_1) entered blocking state [ 427.208552][T30233] bridge0: port 2(bridge_slave_1) entered forwarding state [ 427.211215][T30233] bridge0: port 1(bridge_slave_0) entered blocking state [ 427.213939][T30233] bridge0: port 1(bridge_slave_0) entered forwarding state [ 427.282136][T30233] 8021q: adding VLAN 0 to HW filter on device bond0 [ 427.301551][ T103] bridge0: port 1(bridge_slave_0) entered disabled state [ 427.306586][ T103] bridge0: port 2(bridge_slave_1) entered disabled state [ 427.333887][T30233] 8021q: adding VLAN 0 to HW filter on device team0 [ 427.363673][ T103] bridge0: port 1(bridge_slave_0) entered blocking state [ 427.366536][ T103] bridge0: port 1(bridge_slave_0) entered forwarding state [ 427.373533][ T1162] bridge0: port 2(bridge_slave_1) entered blocking state [ 427.377050][ T1162] bridge0: port 2(bridge_slave_1) entered forwarding state [ 427.766151][T30233] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 427.989004][T30233] veth0_vlan: entered promiscuous mode [ 428.006435][T30233] veth1_vlan: entered promiscuous mode [ 428.040858][T30233] veth0_macvtap: entered promiscuous mode [ 428.046970][T30233] veth1_macvtap: entered promiscuous mode [ 428.061696][T30233] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 428.091239][T30233] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 428.099846][ T13] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 428.104541][ T13] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 428.104601][ T13] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 428.104621][ T13] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 428.155849][ T5753] Bluetooth: hci2: command tx timeout [ 428.267829][ T103] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 428.267848][ T103] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 428.306375][ T103] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 428.314878][ T103] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 428.482292][T30392] netlink: 24 bytes leftover after parsing attributes in process `syz.1.11310'. [ 428.482313][T30392] netlink: 24 bytes leftover after parsing attributes in process `syz.1.11310'. [ 428.601768][T30399] : renamed from vlan0 (while UP) [ 428.906920][ T7530] usb 11-1: new high-speed USB device number 2 using dummy_hcd [ 429.055604][ T7530] usb 11-1: Using ep0 maxpacket: 8 [ 429.058992][ T7530] usb 11-1: config index 0 descriptor too short (expected 30, got 18) [ 429.067862][ T7530] usb 11-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 429.073108][ T7530] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 429.077819][ T7530] usb 11-1: Product: syz [ 429.079793][ T7530] usb 11-1: Manufacturer: syz [ 429.081954][ T7530] usb 11-1: SerialNumber: syz [ 429.086639][ T7530] usb 11-1: config 0 descriptor?? [ 429.090711][ T7530] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 429.094651][ T7530] usb 11-1: setting power ON [ 429.096537][ T7530] dvb-usb: bulk message failed: -22 (2/0) [ 429.104085][ T7530] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 429.110163][ T7530] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 429.114455][ T7530] usb 11-1: media controller created [ 429.124684][ T7530] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 429.134265][ T7530] usb 11-1: selecting invalid altsetting 6 [ 429.142385][ T7530] usb 11-1: digital interface selection failed (-22) [ 429.146294][ T7530] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 429.150174][ T7530] usb 11-1: setting power OFF [ 429.152053][ T7530] dvb-usb: bulk message failed: -22 (2/0) [ 429.154161][ T7530] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 429.158096][ T7530] (NULL device *): no alternate interface [ 429.178971][ T7530] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 429.223191][ T7530] hid_parser_main: 75 callbacks suppressed [ 429.223209][ T7530] hid-generic 0000:0000:0000.000A: unknown main item tag 0x0 [ 429.239495][ T7530] hid-generic 0000:0000:0000.000A: hidraw1: HID v0.00 Device [syz1] on syz0 [ 429.313617][ T61] usb 11-1: USB disconnect, device number 2 [ 429.541320][ T61] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 429.544053][ T61] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 429.556761][ T61] hid-generic 0000:0000:0000.000B: hidraw1: HID v0.00 Device [syz0] on syz0 [ 430.026384][T30490] dvmrp8: entered allmulticast mode [ 430.172365][T30509] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11363'. [ 430.188829][ T5828] dvmrp8: left allmulticast mode [ 430.236323][ T5753] Bluetooth: hci2: command tx timeout [ 431.074988][T30558] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11384'. [ 432.083046][T30590] netlink: 'syz.2.11398': attribute type 4 has an invalid length. [ 432.083073][T30590] netlink: 17 bytes leftover after parsing attributes in process `syz.2.11398'. [ 432.222158][T30611] pimreg: tun_chr_ioctl cmd 1074025684 [ 432.321543][ T5753] Bluetooth: hci2: command tx timeout [ 433.807587][T30672] netlink: 'syz.1.11433': attribute type 4 has an invalid length. [ 434.385908][ T5753] Bluetooth: hci2: command tx timeout [ 434.759835][T30725] netlink: 140 bytes leftover after parsing attributes in process `syz.3.11457'. [ 434.812373][ T9] IPVS: starting estimator thread 0... [ 434.915532][T30728] IPVS: using max 43 ests per chain, 103200 per kthread [ 435.790441][T30771] netlink: 'syz.3.11477': attribute type 32 has an invalid length. [ 435.793219][T30771] netlink: 220 bytes leftover after parsing attributes in process `syz.3.11477'. [ 435.797050][T30771] netlink: 'syz.3.11477': attribute type 32 has an invalid length. [ 435.799602][T30771] netlink: 220 bytes leftover after parsing attributes in process `syz.3.11477'. [ 436.000262][T30773] netlink: 'syz.3.11478': attribute type 4 has an invalid length. [ 436.005302][T30773] netlink: 17 bytes leftover after parsing attributes in process `syz.3.11478'. [ 436.375690][T30807] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11493'. [ 436.695984][ T61] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 436.865563][ T61] usb 6-1: Using ep0 maxpacket: 8 [ 436.900408][ T61] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 436.907344][ T61] usb 6-1: config 0 has no interface number 0 [ 436.911692][ T61] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 436.915774][ T1169] Bluetooth: hci4: received HCILL_GO_TO_SLEEP_ACK in state 1 [ 436.921030][ T61] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 436.921058][ T61] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 436.930408][ T61] usb 6-1: config 0 descriptor?? [ 436.953119][ T61] iowarrior 6-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 436.953183][ T60] Bluetooth: hci4: Frame reassembly failed (-84) [ 437.143356][T30841] GUP no longer grows the stack in syz.2.11508 (30841): 80009000-8000a000 (80005000) [ 437.151990][T30841] CPU: 3 UID: 0 PID: 30841 Comm: syz.2.11508 Tainted: G L syzkaller #0 PREEMPT(full) [ 437.152025][T30841] Tainted: [L]=SOFTLOCKUP [ 437.152032][T30841] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 437.152045][T30841] Call Trace: [ 437.152052][T30841] [ 437.152063][T30841] dump_stack_lvl+0x100/0x190 [ 437.152102][T30841] gup_vma_lookup.cold+0x83/0x96 [ 437.152175][T30841] __get_user_pages+0x241/0x32a0 [ 437.152206][T30841] ? down_read_killable+0x35e/0x520 [ 437.152236][T30841] ? __pfx___get_user_pages+0x10/0x10 [ 437.152271][T30841] __gup_longterm_locked+0x87d/0x16f0 [ 437.152304][T30841] ? __pfx___gup_longterm_locked+0x10/0x10 [ 437.152329][T30841] ? lock_acquire+0x1b9/0x370 [ 437.152371][T30841] gup_fast_fallback+0x16dc/0x2790 [ 437.152412][T30841] ? __pfx_gup_fast_fallback+0x10/0x10 [ 437.152441][T30841] ? __lock_acquire+0x49f/0x1a40 [ 437.152469][T30841] ? finish_task_switch.isra.0+0x2cd/0x10c0 [ 437.152510][T30841] get_user_pages_fast+0xa7/0xf0 [ 437.152535][T30841] ? __pfx_get_user_pages_fast+0x10/0x10 [ 437.152561][T30841] ? iov_iter_advance+0xac/0x6d0 [ 437.152591][T30841] __iov_iter_get_pages_alloc+0x8f2/0x1f20 [ 437.152618][T30841] ? pipe_lock+0x69/0x80 [ 437.152648][T30841] ? __pfx___iov_iter_get_pages_alloc+0x10/0x10 [ 437.152673][T30841] ? __pfx___mutex_lock+0x10/0x10 [ 437.152726][ T61] usb 6-1: USB disconnect, device number 26 [ 437.152726][T30841] ? iovec_from_user+0xda/0x140 [ 437.152764][T30841] iov_iter_get_pages2+0xa3/0x100 [ 437.152788][T30841] ? __pfx_iov_iter_get_pages2+0x10/0x10 [ 437.152813][T30841] ? wait_for_space+0x2ca/0x3b0 [ 437.152849][T30841] __do_sys_vmsplice+0x7dd/0x13c0 [ 437.152890][T30841] ? __pfx___do_sys_vmsplice+0x10/0x10 [ 437.152928][T30841] ? __pfx_futex_wait+0x10/0x10 [ 437.153002][T30841] ? __do_fast_syscall_32+0xe7/0x970 [ 437.153021][T30841] __do_fast_syscall_32+0xe7/0x970 [ 437.153044][T30841] do_fast_syscall_32+0x32/0x70 [ 437.153063][T30841] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 437.153087][T30841] RIP: 0023:0xf706efec [ 437.153110][T30841] Code: Unable to access opcode bytes at 0xf706efc2. [ 437.153119][T30841] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 000000000000013c [ 437.153139][T30841] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000280 [ 437.153154][T30841] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 437.153166][T30841] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 437.153180][T30841] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 437.153190][T30841] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 437.153217][T30841] [ 438.256710][T30872] netlink: 'syz.1.11522': attribute type 4 has an invalid length. [ 438.260557][T30872] netlink: 17 bytes leftover after parsing attributes in process `syz.1.11522'. [ 438.300716][T30878] overlayfs: lowerdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 438.366936][T29477] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 438.382777][T29477] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 438.391021][T29477] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 438.442339][T29477] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 438.451515][T29477] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 438.944800][T30879] bridge0: port 1(bridge_slave_0) entered blocking state [ 438.947668][T30879] bridge0: port 1(bridge_slave_0) entered disabled state [ 438.948474][ T5756] Bluetooth: hci4: command 0x1003 tx timeout [ 438.948636][ T5753] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 438.951064][T30879] bridge_slave_0: entered allmulticast mode [ 438.959330][T30879] bridge_slave_0: entered promiscuous mode [ 438.965947][T30879] bridge0: port 2(bridge_slave_1) entered blocking state [ 438.968958][T30879] bridge0: port 2(bridge_slave_1) entered disabled state [ 438.972175][T30879] bridge_slave_1: entered allmulticast mode [ 438.975777][T30879] bridge_slave_1: entered promiscuous mode [ 439.008792][T30879] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 439.027174][T30879] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 439.060977][T30879] team0: Port device team_slave_0 added [ 439.067043][T30879] team0: Port device team_slave_1 added [ 439.095335][T30879] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 439.104033][T30879] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 439.115530][T30879] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 439.124814][T30879] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 439.128743][T30879] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 439.140747][T30879] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 439.190612][T30879] hsr_slave_0: entered promiscuous mode [ 439.194204][T30879] hsr_slave_1: entered promiscuous mode [ 439.197415][T30879] debugfs: 'hsr0' already exists in 'hsr' [ 439.199995][T30879] Cannot create hsr debugfs directory [ 439.411417][T30879] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 439.420891][T30879] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 439.424519][T30879] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 439.435080][T30879] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 439.441510][T30879] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 439.447974][T30879] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 439.451012][T30879] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 439.457789][T30879] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 439.554505][T30879] 8021q: adding VLAN 0 to HW filter on device bond0 [ 439.596772][T30879] 8021q: adding VLAN 0 to HW filter on device team0 [ 439.608990][ T1162] bridge0: port 1(bridge_slave_0) entered blocking state [ 439.611386][ T1162] bridge0: port 1(bridge_slave_0) entered forwarding state [ 439.620717][ T1162] bridge0: port 2(bridge_slave_1) entered blocking state [ 439.624397][ T1162] bridge0: port 2(bridge_slave_1) entered forwarding state [ 439.988346][T30879] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 440.165844][T30879] veth0_vlan: entered promiscuous mode [ 440.178621][T30879] veth1_vlan: entered promiscuous mode [ 440.202911][T30879] veth0_macvtap: entered promiscuous mode [ 440.213166][T30879] veth1_macvtap: entered promiscuous mode [ 440.224313][T30879] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 440.240272][T30879] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 440.251184][ T5556] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 440.254758][ T5556] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 440.261287][ T5556] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 440.265120][ T5556] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 440.329396][ T103] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 440.342390][ T103] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 440.433642][ T1199] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 440.436958][ T1199] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 440.545787][ T5753] Bluetooth: hci0: command tx timeout [ 441.250122][T31006] netlink: 36 bytes leftover after parsing attributes in process `syz.6.11564'. [ 442.367772][T31055] netlink: 120 bytes leftover after parsing attributes in process `syz.1.11587'. [ 442.539508][T31058] netlink: 'syz.6.11586': attribute type 4 has an invalid length. [ 442.543729][T31058] netlink: 17 bytes leftover after parsing attributes in process `syz.6.11586'. [ 442.613486][T31070] Bluetooth: received HCILL_WAKE_UP_IND in state 2 [ 442.619052][ T74] Bluetooth: hci4: Frame reassembly failed (-84) [ 442.621815][ T74] Bluetooth: hci4: Frame reassembly failed (-84) [ 442.625762][ T5756] Bluetooth: hci0: command tx timeout [ 442.999780][T31092] netlink: 4 bytes leftover after parsing attributes in process `syz.6.11603'. [ 443.012401][T31092] bridge0: port 2(bridge_slave_1) entered disabled state [ 443.033889][T31092] bridge_slave_1 (unregistering): left allmulticast mode [ 443.039032][T31092] bridge_slave_1 (unregistering): left promiscuous mode [ 443.042487][T31092] bridge0: port 2(bridge_slave_1) entered disabled state [ 443.457623][T31097] netlink: 'syz.7.11605': attribute type 4 has an invalid length. [ 443.465494][T31097] netlink: 17 bytes leftover after parsing attributes in process `syz.7.11605'. [ 444.005645][ T149] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 444.175871][ T149] usb 6-1: Using ep0 maxpacket: 16 [ 444.184267][ T149] usb 6-1: config 0 interface 0 altsetting 1 endpoint 0x7 has invalid wMaxPacketSize 0 [ 444.188405][ T149] usb 6-1: config 0 interface 0 altsetting 1 endpoint 0x89 has an invalid bInterval 0, changing to 7 [ 444.195514][ T149] usb 6-1: config 0 interface 0 has no altsetting 0 [ 444.202946][ T149] usb 6-1: New USB device found, idVendor=06cb, idProduct=0006, bcdDevice=9a.eb [ 444.206598][ T149] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 444.209299][ T149] usb 6-1: Product: syz [ 444.210648][ T149] usb 6-1: Manufacturer: syz [ 444.212238][ T149] usb 6-1: SerialNumber: syz [ 444.215022][ T149] usb 6-1: config 0 descriptor?? [ 444.437580][ T149] input: syz syz as /devices/platform/dummy_hcd.1/usb6/6-1/6-1:0.0/input/input50 [ 444.635637][ T5756] Bluetooth: hci4: command 0x1003 tx timeout [ 444.643578][ T5753] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 444.715629][ T5753] Bluetooth: hci0: command tx timeout [ 444.729732][ T5901] usb 6-1: USB disconnect, device number 27 [ 444.856385][T31177] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -11 0 [ 445.061156][T31187] netlink: 16 bytes leftover after parsing attributes in process `syz.7.11646'. [ 445.068740][T31187] netlink: 16 bytes leftover after parsing attributes in process `syz.7.11646'. [ 445.085675][ T5743] usb 11-1: new high-speed USB device number 3 using dummy_hcd [ 445.263141][ T5743] usb 11-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 445.275700][ T5743] usb 11-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 445.279266][ T5743] usb 11-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 445.282905][ T5743] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 445.293456][T31175] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 445.303759][ T5743] usb 11-1: Quirk or no altset; falling back to MIDI 1.0 [ 445.507759][ T1437] ieee802154 phy0 wpan0: encryption failed: -22 [ 445.631171][T31202] netlink: 12 bytes leftover after parsing attributes in process `syz.7.11652'. [ 445.700809][ T5743] usb 11-1: USB disconnect, device number 3 [ 446.015526][T11567] usb 8-1: new high-speed USB device number 15 using dummy_hcd [ 446.178130][T11567] usb 8-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 446.184494][T11567] usb 8-1: config 0 interface 0 has no altsetting 0 [ 446.189457][T11567] usb 8-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 446.193049][T11567] usb 8-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 446.196871][T11567] usb 8-1: Product: syz [ 446.198592][T11567] usb 8-1: Manufacturer: syz [ 446.200350][T11567] usb 8-1: SerialNumber: syz [ 446.206329][T11567] usb 8-1: config 0 descriptor?? [ 446.218717][T11567] usb 8-1: selecting invalid altsetting 0 [ 446.421185][ T9] usb 8-1: USB disconnect, device number 15 [ 446.775113][T31243] netlink: 'syz.7.11671': attribute type 4 has an invalid length. [ 446.778869][T31243] netlink: 17 bytes leftover after parsing attributes in process `syz.7.11671'. [ 446.785863][ T5753] Bluetooth: hci0: command tx timeout [ 447.027671][T31274] netlink: 48 bytes leftover after parsing attributes in process `syz.1.11685'. [ 447.032795][T31274] tipc: Resetting bearer [ 447.447690][ T149] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 447.605771][ T149] usb 6-1: Using ep0 maxpacket: 8 [ 447.613191][ T149] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 447.617346][ T149] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 447.621558][ T149] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 447.629644][ T149] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 447.634425][ T149] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 447.638638][ T149] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 447.855341][ T149] usb 6-1: GET_CAPABILITIES returned 0 [ 447.861473][ T149] usbtmc 6-1:16.0: can't read capabilities [ 448.061935][ T5743] usb 6-1: USB disconnect, device number 28 [ 448.088921][T31322] netlink: 28 bytes leftover after parsing attributes in process `syz.6.11707'. [ 448.172327][T31328] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.11706'. [ 448.177206][T31324] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.11706'. [ 448.379445][T31341] o2cb: This node has not been configured. [ 448.382478][T31341] o2cb: Cluster check failed. Fix errors before retrying. [ 448.385058][T31341] (syz.7.11715,31341,1):user_dlm_register:674 ERROR: status = -22 [ 448.392278][T31341] (syz.7.11715,31341,1):dlmfs_mkdir:437 ERROR: Error -22 could not register domain "file1" [ 448.963746][T31387] ref_ctr_offset mismatch. inode: 0x1fb offset: 0x0 ref_ctr_offset(old): 0x0 ref_ctr_offset(new): 0x300000018 [ 449.481131][T31415] binder: 31414:31415 ioctl 541b 0 returned -22 [ 449.741960][ T9] hid-generic 0000:0000:0000.000C: unknown main item tag 0x3 [ 449.744649][ T9] hid-generic 0000:0000:0000.000C: unknown main item tag 0x3 [ 449.747977][ T9] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 449.750536][ T9] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 449.753113][ T9] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 449.762016][ T9] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 449.767264][ T9] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 449.770262][ T9] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 449.773389][ T9] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 449.777351][ T9] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 449.790072][ T9] hid-generic 0000:0000:0000.000C: hidraw1: HID v0.03 Device [syz1] on syz1 [ 449.824652][T31427] fido_id[31427]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 449.915551][ T5901] usb 8-1: new high-speed USB device number 16 using dummy_hcd [ 450.039884][T31433] netlink: 8 bytes leftover after parsing attributes in process `syz.6.11758'. [ 450.066768][ T5901] usb 8-1: Using ep0 maxpacket: 32 [ 450.071247][ T5901] usb 8-1: config index 0 descriptor too short (expected 35577, got 27) [ 450.079310][ T5901] usb 8-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 450.082595][ T5901] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 450.086753][ T5901] usb 8-1: config 1 has no interface number 0 [ 450.089144][ T5901] usb 8-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 450.092814][ T5901] usb 8-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 450.097781][ T5901] usb 8-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 450.100847][ T5901] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 450.117843][ T5901] snd_usb_pod 8-1:1.1: Line 6 Pocket POD found [ 450.780621][T31462] Bluetooth: received HCILL_WAKE_UP_IND in state 2 [ 450.788828][ T5756] Bluetooth: hci4: sending frame failed (-49) [ 450.793796][ T5753] Bluetooth: hci4: Opcode 0x1003 failed: -49 [ 450.879245][ T5901] snd_usb_pod 8-1:1.1: Line 6 Pocket POD now attached [ 451.081838][ T5901] usb 8-1: USB disconnect, device number 16 [ 451.086757][ T5901] snd_usb_pod 8-1:1.1: Line 6 Pocket POD now disconnected [ 451.260798][T31474] netlink: 8 bytes leftover after parsing attributes in process `syz.6.11776'. [ 451.296036][T31476] netlink: 'syz.6.11777': attribute type 9 has an invalid length. [ 451.298684][T31476] netlink: 8 bytes leftover after parsing attributes in process `syz.6.11777'. [ 451.315702][T31476] macvlan2: entered promiscuous mode [ 451.317466][T31476] hsr0: entered promiscuous mode [ 451.319499][T31476] macvlan2: entered allmulticast mode [ 451.321579][T31476] hsr0: entered allmulticast mode [ 451.323508][T31476] hsr_slave_0: entered allmulticast mode [ 451.326427][T31476] hsr_slave_1: entered allmulticast mode [ 451.554206][ T34] kernel read not supported for file /dsp (pid: 34 comm: kworker/3:0) [ 451.716940][T31489] netlink: 36 bytes leftover after parsing attributes in process `syz.7.11782'. [ 452.030926][T31512] kvm: user requested TSC rate below hardware speed [ 452.213681][T31528] netlink: 36 bytes leftover after parsing attributes in process `syz.1.11803'. [ 452.428741][T31546] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11811'. [ 452.730399][T31568] netlink: 36 bytes leftover after parsing attributes in process `syz.3.11820'. [ 453.148865][ T42] audit: type=1326 audit(2000000214.826:673): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31576 comm="syz.3.11823" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7fd4fec code=0x7ffc0000 [ 453.161713][ T42] audit: type=1326 audit(2000000214.826:674): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31576 comm="syz.3.11823" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7fd5017 code=0x7ffc0000 [ 453.176584][ T42] audit: type=1326 audit(2000000214.826:675): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31576 comm="syz.3.11823" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7fd4fec code=0x7ffc0000 [ 453.184371][ T42] audit: type=1326 audit(2000000214.826:676): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31576 comm="syz.3.11823" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7fd5017 code=0x7ffc0000 [ 453.193983][ T42] audit: type=1326 audit(2000000214.826:677): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31576 comm="syz.3.11823" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7fd4fec code=0x7ffc0000 [ 453.203363][ T42] audit: type=1326 audit(2000000214.826:678): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31576 comm="syz.3.11823" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7fd5017 code=0x7ffc0000 [ 453.211524][ T42] audit: type=1326 audit(2000000214.826:679): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31576 comm="syz.3.11823" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7fd4fec code=0x7ffc0000 [ 453.219997][ T42] audit: type=1326 audit(2000000214.826:680): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31576 comm="syz.3.11823" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7fd5017 code=0x7ffc0000 [ 453.231480][ T42] audit: type=1326 audit(2000000214.826:681): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31576 comm="syz.3.11823" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7fd4fec code=0x7ffc0000 [ 453.238823][ T42] audit: type=1326 audit(2000000214.836:682): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31576 comm="syz.3.11823" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7fd5017 code=0x7ffc0000 [ 453.357417][T31593] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 453.593444][T31593] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 453.700319][T31593] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 453.768358][T31609] __nla_validate_parse: 2 callbacks suppressed [ 453.768377][T31609] netlink: 36 bytes leftover after parsing attributes in process `syz.1.11839'. [ 453.808896][T31593] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 453.913714][T31617] netlink: 16 bytes leftover after parsing attributes in process `syz.1.11843'. [ 453.921432][T31617] bridge0: port 2(bridge_slave_1) entered disabled state [ 453.986230][ T5556] netdevsim netdevsim6 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 453.995676][ T5829] netdevsim netdevsim6 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 454.013349][ T5829] netdevsim netdevsim6 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 454.027147][ T5829] netdevsim netdevsim6 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 454.807540][T31683] bond1: entered promiscuous mode [ 454.906052][ T5743] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 455.004119][T31690] loop1: detected capacity change from 0 to 7 [ 455.013529][T31690] Dev loop1: unable to read RDB block 7 [ 455.016533][T31690] loop1: unable to read partition table [ 455.019792][T31690] loop1: partition table beyond EOD, truncated [ 455.024849][T31690] loop_reread_partitions: partition scan of loop1 (3 xC) failed (rc=-5) [ 455.065608][ T5743] usb 6-1: Using ep0 maxpacket: 8 [ 455.070032][ T5743] usb 6-1: config 179 has an invalid interface number: 65 but max is 0 [ 455.073457][ T5743] usb 6-1: config 179 has no interface number 0 [ 455.075607][ T5743] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 455.080285][ T5743] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 455.085284][ T5743] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 455.090330][ T5743] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 455.094549][ T5743] usb 6-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 455.100138][ T5743] usb 6-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 455.103207][ T5743] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 455.118027][T31674] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 455.136841][T31690] Dev loop1: unable to read RDB block 7 [ 455.139200][T31690] loop1: unable to read partition table [ 455.142943][T31690] loop1: partition table beyond EOD, truncated [ 455.146102][T31690] loop_reread_partitions: partition scan of loop1 (3 xC) failed (rc=-5) [ 455.275747][T31699] Bluetooth: MGMT ver 1.23 [ 455.351594][T11567] input: Generic X-Box pad as /devices/platform/dummy_hcd.1/usb6/6-1/6-1:179.65/input/input51 [ 455.536792][ C2] xpad 6-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 455.536792][ T9] usb 6-1: USB disconnect, device number 29 [ 455.542390][ C2] xpad 6-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 455.586396][ T5756] Bluetooth: hci4: command 0xfc11 tx timeout [ 455.596942][ T5753] Bluetooth: hci4: Entering manufacturer mode failed (-110) [ 455.755699][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 455.889510][T11567] usb 8-1: new high-speed USB device number 17 using dummy_hcd [ 456.050166][T31726] NFSD: Failed to start, no listeners configured. [ 456.051470][T11567] usb 8-1: Using ep0 maxpacket: 32 [ 456.058675][T11567] usb 8-1: config 0 has no interfaces? [ 456.064107][T11567] usb 8-1: New USB device found, idVendor=05ac, idProduct=020f, bcdDevice= 0.22 [ 456.070867][T11567] usb 8-1: New USB device strings: Mfr=1, Product=130, SerialNumber=131 [ 456.074875][T11567] usb 8-1: Product: syz [ 456.077272][T11567] usb 8-1: Manufacturer: syz [ 456.078828][T11567] usb 8-1: SerialNumber: syz [ 456.083110][T11567] usb 8-1: config 0 descriptor?? [ 456.145038][T31747] can0: slcan on ttyS3. [ 456.278374][T31747] can0 (unregistered): slcan off ttyS3. [ 456.303187][T11567] usb 8-1: USB disconnect, device number 17 [ 457.481128][T31816] openvswitch: netlink: IP tunnel dst address not specified [ 457.493979][T31816] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 457.557496][T31824] netlink: 12 bytes leftover after parsing attributes in process `syz.6.11925'. [ 457.611949][T31829] netlink: 'syz.3.11928': attribute type 4 has an invalid length. [ 457.615012][T31829] netlink: 'syz.3.11928': attribute type 8 has an invalid length. [ 457.619679][T31829] netlink: 212 bytes leftover after parsing attributes in process `syz.3.11928'. [ 457.979354][T31862] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 458.341363][T31886] loop9: detected capacity change from 0 to 7 [ 458.347847][T31886] Dev loop9: unable to read RDB block 7 [ 458.352599][T31886] loop9: unable to read partition table [ 458.359544][T31886] loop9: partition table beyond EOD, truncated [ 458.362516][T31886] loop_reread_partitions: partition scan of loop9 (被x ) failed (rc=-5) [ 458.488884][T31896] netlink: 4 bytes leftover after parsing attributes in process `syz.7.11958'. [ 458.493967][T31896] netlink: 4 bytes leftover after parsing attributes in process `syz.7.11958'. [ 460.065363][T31974] bond2 (unregistering): Released all slaves [ 460.261722][T31990] kvm: kvm [31987]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010015) = 0xeb7 [ 460.668507][T32018] netlink: 4 bytes leftover after parsing attributes in process `syz.6.12014'. [ 461.227437][ T9] kernel read not supported for file /dsp (pid: 9 comm: kworker/0:0) [ 461.282694][T32057] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 461.290864][T32057] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 461.356715][T32069] block nbd0: Unsupported socket: should be TCP or UNIX. [ 461.462261][T32057] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 461.475590][T32057] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 461.602551][T32057] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 461.605909][T32057] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 461.694977][T32057] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 461.698901][T32057] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 461.703045][T32084] kvm: kvm [32083]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010015) = 0xeb7 [ 461.832957][ T5828] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 461.926487][ T5829] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 461.930923][ T5829] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 461.952554][ T5829] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 461.955963][ T5829] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 461.982934][ T5756] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 461.992300][ T5556] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 462.005533][ T5556] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 462.010109][ T5756] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 462.016020][ T5756] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 462.047159][ T5828] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 462.073227][ T5756] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 462.080892][ T5756] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 462.114315][ T5556] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 462.120027][ T5556] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 462.247141][ T5828] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 462.406784][ T5828] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 462.642608][T32137] ubi1: attaching mtd0 [ 462.646427][T32137] ubi1 error: ubi_attach_mtd_dev: bad VID header (1073742086) or data offsets (1073742150) [ 462.790780][ T5828] bridge_slave_1: left allmulticast mode [ 462.794490][ T5828] bridge_slave_1: left promiscuous mode [ 462.802568][ T5828] bridge0: port 2(bridge_slave_1) entered disabled state [ 462.809249][ T5828] bridge_slave_0: left allmulticast mode [ 462.812146][ T5828] bridge_slave_0: left promiscuous mode [ 462.814741][ T5828] bridge0: port 1(bridge_slave_0) entered disabled state [ 463.122286][ T5828] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 463.129074][ T5828] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 463.135299][ T5828] bond0 (unregistering): Released all slaves [ 463.346590][T32093] bridge0: port 1(bridge_slave_0) entered blocking state [ 463.349749][T32093] bridge0: port 1(bridge_slave_0) entered disabled state [ 463.353024][T32093] bridge_slave_0: entered allmulticast mode [ 463.357285][T32093] bridge_slave_0: entered promiscuous mode [ 463.363157][T32093] bridge0: port 2(bridge_slave_1) entered blocking state [ 463.366255][T32093] bridge0: port 2(bridge_slave_1) entered disabled state [ 463.369502][T32093] bridge_slave_1: entered allmulticast mode [ 463.375354][T32093] bridge_slave_1: entered promiscuous mode [ 463.403627][ T5453] 8021q: adding VLAN 0 to HW filter on device eth10 [ 463.411128][T32093] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 463.418605][T32093] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 463.443603][T32093] team0: Port device team_slave_0 added [ 463.459101][T32093] team0: Port device team_slave_1 added [ 463.612984][T32175] bond3 (unregistering): Released all slaves [ 463.655201][T32093] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 463.658718][T32093] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 463.670226][T32093] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 463.690749][T32093] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 463.693815][T32093] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 463.713518][T32093] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 463.862570][T32093] hsr_slave_0: entered promiscuous mode [ 463.864342][T32190] netlink: 20 bytes leftover after parsing attributes in process `syz.3.12082'. [ 463.865467][T32093] hsr_slave_1: entered promiscuous mode [ 463.871526][T32093] debugfs: 'hsr0' already exists in 'hsr' [ 463.873645][T32093] Cannot create hsr debugfs directory [ 463.882168][T32190] vlan9: entered promiscuous mode [ 463.884613][T32190] gretap0: entered promiscuous mode [ 463.956690][ T5453] 8021q: adding VLAN 0 to HW filter on device eth11 [ 464.064982][ T5828] hsr_slave_0: left promiscuous mode [ 464.078313][ T5828] hsr_slave_1: left promiscuous mode [ 464.086282][ T5828] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 464.089271][ T5828] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 464.101824][ T5828] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 464.107321][ T5828] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 464.131089][ T5828] veth1_macvtap: left promiscuous mode [ 464.133618][ T5828] veth0_macvtap: left promiscuous mode [ 464.136264][ T5828] veth1_vlan: left promiscuous mode [ 464.140843][ T5828] veth0_vlan: left promiscuous mode [ 464.146032][ T5753] Bluetooth: hci0: command tx timeout [ 464.389534][ T5828] team0 (unregistering): Port device team_slave_1 removed [ 464.408393][ T5828] team0 (unregistering): Port device team_slave_0 removed [ 464.967421][ T5453] 8021q: adding VLAN 0 to HW filter on device eth12 [ 465.690777][T32274] evm: overlay not supported [ 465.696660][T32093] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 465.707853][T32093] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 465.713160][T32093] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 465.726585][T32093] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 465.732656][T32093] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 465.790237][T32093] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 465.794368][T32093] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 465.814617][T32093] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 465.822229][T32282] netlink: 36 bytes leftover after parsing attributes in process `syz.6.12109'. [ 465.919140][T32297] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 465.926070][T32297] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 465.945827][T32093] 8021q: adding VLAN 0 to HW filter on device bond0 [ 465.963773][T32093] 8021q: adding VLAN 0 to HW filter on device team0 [ 465.992693][ T1162] bridge0: port 1(bridge_slave_0) entered blocking state [ 465.996137][ T1162] bridge0: port 1(bridge_slave_0) entered forwarding state [ 466.022539][ T1162] bridge0: port 2(bridge_slave_1) entered blocking state [ 466.026100][ T1162] bridge0: port 2(bridge_slave_1) entered forwarding state [ 466.226860][ T5753] Bluetooth: hci0: command tx timeout [ 466.357242][T32336] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12126'. [ 466.505129][T32093] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 466.529312][T32349] netlink: 'syz.3.12130': attribute type 3 has an invalid length. [ 466.533431][T32349] netlink: 'syz.3.12130': attribute type 1 has an invalid length. [ 466.539094][T32349] netlink: 224 bytes leftover after parsing attributes in process `syz.3.12130'. [ 466.702394][T32093] veth0_vlan: entered promiscuous mode [ 466.713358][T32093] veth1_vlan: entered promiscuous mode [ 466.744718][T32093] veth0_macvtap: entered promiscuous mode [ 466.751163][T32093] veth1_macvtap: entered promiscuous mode [ 466.767204][T32093] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 466.778481][T32093] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 466.787039][T32171] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 466.796900][T32171] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 466.800642][T32171] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 466.806593][T32171] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 466.906065][ T103] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 466.908840][ T103] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 466.954932][ T103] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 466.968292][ T103] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 467.106434][ T5901] usb 8-1: new high-speed USB device number 18 using dummy_hcd [ 467.265990][ T5901] usb 8-1: Using ep0 maxpacket: 8 [ 467.281000][ T5901] usb 8-1: config 0 has no interfaces? [ 467.292660][ T5901] usb 8-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 467.297438][ T5901] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 467.301130][ T5901] usb 8-1: Product: syz [ 467.302995][ T5901] usb 8-1: Manufacturer: syz [ 467.305078][ T5901] usb 8-1: SerialNumber: syz [ 467.316233][ T5901] usb 8-1: config 0 descriptor?? [ 467.337972][T32384] netlink: 4 bytes leftover after parsing attributes in process `syz.7.12144'. [ 467.526018][ T5901] usb 8-1: USB disconnect, device number 18 [ 468.178868][T11567] kernel read not supported for file /dsp1 (pid: 11567 comm: kworker/2:4) [ 468.316049][ T5756] Bluetooth: hci0: command tx timeout [ 468.478107][ T5756] Bluetooth: hci4: command 0x1003 tx timeout [ 468.481490][ T5753] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 469.917961][T32472] netlink: 16 bytes leftover after parsing attributes in process `syz.3.12184'. [ 470.004949][T32478] netlink: 'syz.3.12187': attribute type 5 has an invalid length. [ 470.009853][T32478] netlink: 3657 bytes leftover after parsing attributes in process `syz.3.12187'. [ 470.179140][T32487] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 470.328899][ T5756] Bluetooth: hci4: sending frame failed (-49) [ 470.333805][T32487] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 470.349711][ T5753] Bluetooth: hci4: Opcode 0x1003 failed: -49 [ 470.391974][ T5753] Bluetooth: hci0: command tx timeout [ 470.417526][T32487] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 470.522893][T32497] netlink: 36 bytes leftover after parsing attributes in process `syz.7.12195'. [ 470.526720][T32497] netlink: 4 bytes leftover after parsing attributes in process `syz.7.12195'. [ 470.540053][T32487] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 470.589338][T32499] io-wq is not configured for unbound workers [ 470.689277][ T13] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 470.709941][ T13] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 470.732812][ T13] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 470.760781][ T13] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 471.106027][ C3] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 472.072727][T32540] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 472.292244][T32540] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 472.434600][T32540] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 472.579325][T32540] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 472.728101][T32171] netdevsim netdevsim7 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 472.756017][T32171] netdevsim netdevsim7 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 472.779252][T32171] netdevsim netdevsim7 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 472.845010][T32171] netdevsim netdevsim7 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 473.978265][T32657] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12268'. [ 474.044107][T32661] netlink: 'syz.3.12270': attribute type 19 has an invalid length. [ 474.048099][T32661] netlink: 144 bytes leftover after parsing attributes in process `syz.3.12270'. [ 474.054826][T32663] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 474.180644][T32671] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci0/hci0:200/input54 [ 474.207860][T32673] Bluetooth: MGMT ver 1.23 [ 474.268383][T32677] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 474.271632][T32677] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 474.308635][T32680] pimreg: entered allmulticast mode [ 474.319482][T32680] pimreg: left allmulticast mode [ 474.346405][T32677] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 474.350190][T32677] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 474.375705][ T5863] usb 11-1: new high-speed USB device number 4 using dummy_hcd [ 474.443644][T32677] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 474.455226][T32677] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 474.519634][T32677] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 474.523171][T32677] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 474.525712][ T5863] usb 11-1: Using ep0 maxpacket: 8 [ 474.536815][ T5863] usb 11-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 474.540717][ T5863] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 474.567499][ T5863] pvrusb2: Hardware description: Terratec Grabster AV400 [ 474.570137][ T5863] pvrusb2: ********** [ 474.571487][ T5863] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 474.575087][ T5863] pvrusb2: Important functionality might not be entirely working. [ 474.578211][ T5863] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 474.582326][ T5863] pvrusb2: ********** [ 474.628213][T32171] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 474.631121][T32171] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 474.640610][T32171] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 474.643856][T32171] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 474.668959][T32171] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 474.673498][T32171] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 474.692791][T32171] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 474.702216][T32171] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 474.771410][ T2514] pvrusb2: Invalid write control endpoint [ 474.817715][T32710] netlink: 12 bytes leftover after parsing attributes in process `syz.7.12294'. [ 474.838444][ T2514] pvrusb2: Invalid write control endpoint [ 474.865098][ T2514] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 474.869735][ T2514] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 474.872675][ T2514] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 474.876807][ T2514] pvrusb2: Device being rendered inoperable [ 474.879178][ T2514] cx25840 2-0044: Unable to detect h/w, assuming cx23887 [ 474.881519][ T2514] cx25840 2-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 474.894106][ T2514] pvrusb2: Attached sub-driver cx25840 [ 474.897019][ T2514] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 474.900678][ T2514] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 474.980259][T32669] pvrusb2: Attempted to execute control transfer when device not ok [ 474.999509][ T5863] usb 11-1: USB disconnect, device number 4 [ 475.227912][T32730] netdevsim netdevsim7 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 475.352687][T32730] netdevsim netdevsim7 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 475.471959][ T10] kernel write not supported for file /input/event2 (pid: 10 comm: kworker/0:1) [ 475.518611][T32730] netdevsim netdevsim7 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 475.610668][T32730] netdevsim netdevsim7 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 475.868591][ T300] pimreg: tun_chr_ioctl cmd 1074025678 [ 475.870763][ T300] pimreg: group set to 768 [ 476.431018][ T315] binder: BINDER_SET_CONTEXT_MGR bad uid 60929 != 0 [ 476.438722][ T315] binder: 314:315 ioctl 4018620d 800000c0 returned -1 [ 476.758351][ T13] netdevsim netdevsim7 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 476.767713][ T13] netdevsim netdevsim7 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 476.778180][ T13] netdevsim netdevsim7 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 476.787675][ T13] netdevsim netdevsim7 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 476.907271][ T5901] usb 8-1: new high-speed USB device number 19 using dummy_hcd [ 477.076283][ T5901] usb 8-1: Using ep0 maxpacket: 32 [ 477.082620][ T5901] usb 8-1: config 0 has no interfaces? [ 477.089889][ T5901] usb 8-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 477.093748][ T5901] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 477.098733][ T5901] usb 8-1: Product: syz [ 477.100413][ T5901] usb 8-1: Manufacturer: syz [ 477.102414][ T5901] usb 8-1: SerialNumber: syz [ 477.107044][ T5901] usb 8-1: config 0 descriptor?? [ 477.125557][ T5863] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 477.181112][ T350] dummy0: entered promiscuous mode [ 477.190218][ T348] dummy0: left promiscuous mode [ 477.275908][ T5863] usb 6-1: Using ep0 maxpacket: 16 [ 477.278436][ T5901] kernel read not supported for file /swradio5 (pid: 5901 comm: kworker/0:5) [ 477.289489][ T5863] usb 6-1: config 0 has no interfaces? [ 477.291419][ T5863] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 477.295292][ T5863] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 477.305901][ T5863] usb 6-1: config 0 descriptor?? [ 477.338347][ T326] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 477.349632][ T326] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 477.358563][ T5901] usb 8-1: USB disconnect, device number 19 [ 477.529936][ T335] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 477.540056][ T335] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 477.561611][ T34] usb 6-1: USB disconnect, device number 30 [ 478.232391][ T412] openvswitch: netlink: Missing key (keys=40, expected=100) [ 478.471227][ T5901] kernel write not supported for file /uinput (pid: 5901 comm: kworker/0:5) [ 478.587252][ T446] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12377'. [ 478.591388][ T446] netlink: 'syz.3.12377': attribute type 30 has an invalid length. [ 478.642472][ T451] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12377'. [ 478.647378][ T451] netlink: 'syz.3.12377': attribute type 30 has an invalid length. [ 479.332565][ T496] netlink: 4 bytes leftover after parsing attributes in process `syz.6.12396'. [ 479.344703][ T496] netlink: 4 bytes leftover after parsing attributes in process `syz.6.12396'. [ 479.586736][ T5863] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 479.607597][ T517] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12406'. [ 479.610941][ T517] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12406'. [ 479.749872][ T5863] usb 6-1: Using ep0 maxpacket: 8 [ 479.768337][ T5863] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 479.779817][ T5863] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 479.792417][ T5863] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 479.800532][ T5863] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 479.806403][ T5863] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 479.810101][ T5863] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 479.989630][ T538] serio: Serial port ttynull [ 480.030751][ T5863] usb 6-1: GET_CAPABILITIES returned 0 [ 480.033328][ T5863] usbtmc 6-1:16.0: can't read capabilities [ 480.241948][T32367] usb 6-1: USB disconnect, device number 31 [ 480.307729][ T548] nbd: socks must be embedded in a SOCK_ITEM attr [ 480.312602][ T548] block nbd0: shutting down sockets [ 480.514262][ T42] kauditd_printk_skb: 1402 callbacks suppressed [ 480.514277][ T42] audit: type=1326 audit(2000000242.186:2085): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=560 comm="syz.6.12426" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 480.528264][ T42] audit: type=1326 audit(2000000242.196:2086): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=560 comm="syz.6.12426" exe="/syz-executor" sig=0 arch=40000003 syscall=354 compat=1 ip=0xf70befec code=0x7ffc0000 [ 480.537595][ T42] audit: type=1326 audit(2000000242.196:2087): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=560 comm="syz.6.12426" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 480.555596][ T42] audit: type=1326 audit(2000000242.196:2088): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=560 comm="syz.6.12426" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 480.575658][ T42] audit: type=1326 audit(2000000242.196:2089): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=560 comm="syz.6.12426" exe="/syz-executor" sig=0 arch=40000003 syscall=354 compat=1 ip=0xf70befec code=0x7ffc0000 [ 480.590751][ T42] audit: type=1326 audit(2000000242.196:2090): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=560 comm="syz.6.12426" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 480.599093][ T42] audit: type=1326 audit(2000000242.196:2091): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=560 comm="syz.6.12426" exe="/syz-executor" sig=0 arch=40000003 syscall=436 compat=1 ip=0xf70befec code=0x7ffc0000 [ 480.608500][ T42] audit: type=1326 audit(2000000242.196:2092): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=560 comm="syz.6.12426" exe="/syz-executor" sig=0 arch=40000003 syscall=252 compat=1 ip=0xf70befec code=0x7ffc0000 [ 480.658786][ T5863] kernel write not supported for file /input/event2 (pid: 5863 comm: kworker/2:3) [ 481.190915][ T5863] kernel write not supported for file /bluetooth/6lowpan_control (pid: 5863 comm: kworker/2:3) [ 481.246302][ T604] overlayfs: invalid origin (00000079000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000) [ 482.096855][ T643] CUSE: info not properly terminated [ 482.145983][ T5901] usb 8-1: new high-speed USB device number 20 using dummy_hcd [ 482.306155][ T5901] usb 8-1: Using ep0 maxpacket: 16 [ 482.310819][ T5901] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 482.314845][ T5901] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 482.321511][ T5901] usb 8-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 482.325373][ T5901] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 482.330275][ T5901] usb 8-1: config 0 descriptor?? [ 482.645674][ T656] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12468'. [ 482.737315][ T660] netlink: 8 bytes leftover after parsing attributes in process `syz.7.12470'. [ 483.106113][ T5901] usbhid 8-1:0.0: can't add hid device: -71 [ 483.114924][ T5901] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 483.124802][ T5901] usb 8-1: USB disconnect, device number 20 [ 484.046793][ T737] sch_tbf: burst 0 is lower than device lo mtu (11337746) ! [ 484.183940][ T756] netlink: 8 bytes leftover after parsing attributes in process `syz.7.12513'. [ 484.184866][ T757] overlayfs: failed to create directory ./bus/work (errno: 13); mounting read-only [ 484.193495][ T756] netlink: 12 bytes leftover after parsing attributes in process `syz.7.12513'. [ 484.194222][ T757] overlayfs: fs on './cgroup' does not support file handles, falling back to index=off,nfs_export=off. [ 484.389562][ T767] team0: Device 26aaaaaaaaa is loopback device. Loopback devices can't be added as a team port [ 484.394949][ T767] A link change request failed with some changes committed already. Interface 26aaaaaaaaa may have been left with an inconsistent configuration, please check. [ 484.538922][ T781] netlink: 'syz.6.12525': attribute type 10 has an invalid length. [ 484.542237][ T781] netlink: 128 bytes leftover after parsing attributes in process `syz.6.12525'. [ 484.730133][ T792] netlink: 4 bytes leftover after parsing attributes in process `syz.6.12530'. [ 485.006598][T32367] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 485.063279][ T803] input: syz0 as /devices/virtual/input/input56 [ 486.060808][T32367] hid_parser_main: 68 callbacks suppressed [ 486.060830][T32367] hid-generic 0005:07C0:0009.000D: unknown main item tag 0x0 [ 486.069206][ T5557] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 486.121151][T32367] hid-generic 0005:07C0:0009.000D: hidraw1: BLUETOOTH HID v0.09 Device [syz1] on aa:aa:aa:aa:aa:aa [ 487.369787][ T34] kernel write not supported for file /uinput (pid: 34 comm: kworker/3:0) [ 487.645909][T11567] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 487.817563][T11567] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 487.822200][T11567] usb 6-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 487.826725][T11567] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 487.830171][T11567] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 487.835581][ T922] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 487.842072][T11567] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 488.007323][ T5753] Bluetooth: hci2: Received unexpected HCI Event 0x00 [ 488.047888][ T5863] usb 6-1: USB disconnect, device number 32 [ 489.696034][ T5901] usb 8-1: new high-speed USB device number 21 using dummy_hcd [ 489.856078][T30378] kernel read not supported for file /dsp1 (pid: 30378 comm: kworker/0:6) [ 489.875667][ T5901] usb 8-1: Using ep0 maxpacket: 8 [ 489.880619][ T5901] usb 8-1: config index 0 descriptor too short (expected 301, got 45) [ 489.883478][ T5901] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 489.893835][ T5901] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 489.902529][ T5901] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 489.906361][ T5901] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 489.911957][ T5901] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 489.915042][ T5901] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 490.132039][ T5901] usb 8-1: GET_CAPABILITIES returned 0 [ 490.135126][ T5901] usbtmc 8-1:16.0: can't read capabilities [ 490.338688][ T5557] usb 8-1: USB disconnect, device number 21 [ 490.902810][T11567] kernel write not supported for file /sequencer (pid: 11567 comm: kworker/2:4) [ 490.906350][ T1038] input: syz1 as /devices/virtual/input/input57 [ 491.170273][ T1062] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12636'. [ 491.174849][ T1062] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12636'. [ 491.474844][ T1099] loop5: detected capacity change from 0 to 7 [ 491.526631][ T5112] blk_print_req_error: 25 callbacks suppressed [ 491.526651][ T5112] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 491.534271][ T5112] buffer_io_error: 25 callbacks suppressed [ 491.534283][ T5112] Buffer I/O error on dev loop5, logical block 0, async page read [ 491.547411][ T1099] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 491.551798][ T1099] Buffer I/O error on dev loop5, logical block 0, async page read [ 491.558424][ T1099] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 491.562341][ T1099] Buffer I/O error on dev loop5, logical block 0, async page read [ 491.566273][ T1099] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 491.569878][ T1099] Buffer I/O error on dev loop5, logical block 0, async page read [ 491.572760][ T1099] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 491.576445][ T1099] Buffer I/O error on dev loop5, logical block 0, async page read [ 491.579580][ T1099] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 491.583265][ T1099] Buffer I/O error on dev loop5, logical block 0, async page read [ 491.587565][ T1099] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 491.590880][ T1099] Buffer I/O error on dev loop5, logical block 0, async page read [ 491.593535][ T1099] ldm_validate_partition_table(): Disk read failed. [ 491.596034][ T1099] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 491.599203][ T1099] Buffer I/O error on dev loop5, logical block 0, async page read [ 491.602065][ T1099] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 491.605052][ T1099] Buffer I/O error on dev loop5, logical block 0, async page read [ 491.607689][ T1099] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 491.610750][ T1099] Buffer I/O error on dev loop5, logical block 0, async page read [ 491.613547][ T1099] Dev loop5: unable to read RDB block 0 [ 491.616024][ T1099] loop5: unable to read partition table [ 491.618059][ T1099] loop5: partition table beyond EOD, truncated [ 491.620098][ T1099] loop_reread_partitions: partition scan of loop5 (Wý* %4FLQk݊5) failed (rc=-5) [ 491.670662][ T1114] batadv0: entered promiscuous mode [ 491.679543][ T1114] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 491.692326][ T1114] batadv0: left promiscuous mode [ 494.040922][ T1233] netlink: 4852 bytes leftover after parsing attributes in process `syz.6.12702'. [ 494.044318][ T1233] netlink: 4852 bytes leftover after parsing attributes in process `syz.6.12702'. [ 494.794383][ T42] audit: type=1800 audit(2000000256.466:2093): pid=1282 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.12724" name="SYSV00000000" dev="tmpfs" ino=1 res=0 errno=0 [ 494.915967][ T65] block nbd0: Receive control failed (result -32) [ 495.133643][ T1313] loop9: detected capacity change from 0 to 255852544 [ 495.516615][ T1337] Bluetooth: hci4: received HCILL_GO_TO_SLEEP_ACK in state 2 [ 496.405789][ T5557] usb 12-1: new high-speed USB device number 2 using dummy_hcd [ 496.565599][ T5557] usb 12-1: Using ep0 maxpacket: 8 [ 496.569650][ T5557] usb 12-1: config index 0 descriptor too short (expected 301, got 45) [ 496.572494][ T5557] usb 12-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 496.576303][ T5557] usb 12-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 496.579835][ T5557] usb 12-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 496.583050][ T5557] usb 12-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 496.587414][ T5557] usb 12-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 496.590441][ T5557] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 496.803963][ T5557] usb 12-1: GET_CAPABILITIES returned 0 [ 496.806751][ T5557] usbtmc 12-1:16.0: can't read capabilities [ 497.012849][ T5557] usb 12-1: USB disconnect, device number 2 [ 497.041430][ T1385] netlink: 16 bytes leftover after parsing attributes in process `syz.3.12765'. [ 497.413419][ T1396] macvlan2: entered allmulticast mode [ 497.416288][ T1396] batadv_slave_1: entered allmulticast mode [ 497.422621][ T1396] batman_adv: batadv0: Adding interface: macvlan2 [ 497.425142][ T1396] batman_adv: batadv0: The MTU of interface macvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 497.439004][ T1396] batman_adv: batadv0: Interface activated: macvlan2 [ 497.589731][ T5753] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 497.596542][ T5756] Bluetooth: hci4: command 0x1003 tx timeout [ 497.977735][ T42] audit: type=1326 audit(2000000259.656:2094): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1436 comm="syz.1.12786" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf703efec code=0x0 [ 498.035702][ T9] usb 8-1: new high-speed USB device number 22 using dummy_hcd [ 498.208953][ T9] usb 8-1: Using ep0 maxpacket: 8 [ 498.212707][ T9] usb 8-1: config index 0 descriptor too short (expected 301, got 45) [ 498.216054][ T9] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 498.220145][ T9] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 498.223804][ T9] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 498.228736][ T9] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 498.233184][ T9] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 498.237320][ T9] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 498.373989][ T1456] netlink: 4 bytes leftover after parsing attributes in process `syz.6.12795'. [ 498.381243][ T1456] netlink: 4 bytes leftover after parsing attributes in process `syz.6.12795'. [ 498.455875][ T9] usb 8-1: GET_CAPABILITIES returned 0 [ 498.458260][ T9] usbtmc 8-1:16.0: can't read capabilities [ 498.665321][ T9] usb 8-1: USB disconnect, device number 22 [ 498.760703][ T1474] binder: 1473:1474 ioctl c0306201 80000180 returned -14 [ 499.034845][ T1490] netlink: 27 bytes leftover after parsing attributes in process `syz.1.12811'. [ 499.230425][ T1500] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12815'. [ 499.307606][ T1506] kvm: kvm [1505]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0x4000008a) = 0x39 [ 501.410159][ T1602] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12862'. [ 501.414243][ T1602] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12862'. [ 501.418666][ T1602] netlink: 'syz.1.12862': attribute type 18 has an invalid length. [ 501.422231][ T1602] netlink: 'syz.1.12862': attribute type 15 has an invalid length. [ 502.016868][ T42] audit: type=1326 audit(2000000263.696:2095): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1646 comm="syz.1.12883" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf703efec code=0x0 [ 503.095584][ T1694] overlay: filesystem on ./bus not supported as upperdir [ 503.099473][ T1696] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12903'. [ 503.486282][ T1718] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 503.488725][ T1718] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 503.490762][ T1718] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 503.498072][ T1718] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 503.507657][ T1718] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 503.510467][ T1718] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 503.567612][ T1718] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 503.757283][ T1732] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12917'. [ 503.812670][ T1734] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12918'. [ 503.972940][ T1742] netlink: 4 bytes leftover after parsing attributes in process `syz.6.12921'. [ 504.288295][ T1759] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 504.293354][ T1759] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 504.376728][T14098] usb 8-1: new high-speed USB device number 23 using dummy_hcd [ 504.535984][T14098] usb 8-1: Using ep0 maxpacket: 8 [ 504.540964][T14098] usb 8-1: config 0 has an invalid interface number: 55 but max is 0 [ 504.546090][T14098] usb 8-1: config 0 has no interface number 0 [ 504.548950][T14098] usb 8-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 504.553581][T14098] usb 8-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 504.563070][T14098] usb 8-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 504.563486][ T1773] loop4: detected capacity change from 0 to 524287936 [ 504.568150][T14098] usb 8-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 504.577432][T14098] usb 8-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 504.582345][T14098] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 504.605592][T14098] usb 8-1: config 0 descriptor?? [ 504.619999][T14098] ldusb 8-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 504.903936][ T1794] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12946'. [ 504.908120][ T1794] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12946'. [ 505.505702][ T5753] Bluetooth: hci2: command 0x0c1a tx timeout [ 505.505719][ T5756] Bluetooth: hci1: command 0x0406 tx timeout [ 505.586565][ T5753] Bluetooth: hci0: command 0x0c1a tx timeout [ 506.061426][ T1831] Bluetooth: hci4: received HCILL_GO_TO_SLEEP_ACK in state 2 [ 506.074039][ T5756] Bluetooth: hci4: sending frame failed (-49) [ 506.082476][ T5753] Bluetooth: hci4: Opcode 0x1003 failed: -49 [ 506.641058][ T1856] binder: Binderfs stats mode cannot be changed during a remount [ 506.888480][T11567] usb 8-1: USB disconnect, device number 23 [ 506.893454][ T1879] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12987'. [ 506.899761][T11567] ldusb 8-1:0.55: LD USB Device #0 now disconnected [ 506.903481][ T1879] netlink: 'syz.1.12987': attribute type 2 has an invalid length. [ 506.957505][ T1437] ieee802154 phy0 wpan0: encryption failed: -22 [ 507.197232][ T1891] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 507.210283][ T1891] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 507.213057][ T1891] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 507.926203][T14098] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 508.090486][T14098] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 508.097564][T14098] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 508.101277][T14098] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 508.107669][T14098] usb 6-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 508.111636][T14098] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 508.114768][T14098] usb 6-1: Product: syz [ 508.116920][T14098] usb 6-1: Manufacturer: syz [ 508.118850][T14098] usb 6-1: SerialNumber: syz [ 508.122067][T14098] usb 6-1: config 0 descriptor?? [ 508.292089][ T42] audit: type=1326 audit(2000000269.966:2096): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1944 comm="syz.6.13017" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x0 [ 508.346689][T14098] adutux 6-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 509.265709][ T5753] Bluetooth: hci0: command 0x0c1a tx timeout [ 509.265821][ T5756] Bluetooth: hci2: command 0x0c1a tx timeout [ 509.265901][ T64] Bluetooth: hci1: command 0x0406 tx timeout [ 509.377452][T14098] usb 8-1: new high-speed USB device number 24 using dummy_hcd [ 509.526630][T14098] usb 8-1: Using ep0 maxpacket: 8 [ 509.536553][T14098] usb 8-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 509.540638][T14098] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 509.567555][T14098] pvrusb2: Hardware description: Terratec Grabster AV400 [ 509.570025][T14098] pvrusb2: ********** [ 509.571471][T14098] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 509.574938][T14098] pvrusb2: Important functionality might not be entirely working. [ 509.578001][T14098] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 509.581788][T14098] pvrusb2: ********** [ 509.757086][ T2514] pvrusb2: Invalid write control endpoint [ 509.812046][ T2514] pvrusb2: Invalid write control endpoint [ 509.814401][ T2514] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 509.827682][ T2514] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 509.833231][ T2514] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 509.838708][ T2514] pvrusb2: Device being rendered inoperable [ 509.843943][ T2514] cx25840 2-0044: Unable to detect h/w, assuming cx23887 [ 509.847889][ T2514] cx25840 2-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 509.852642][ T2514] pvrusb2: Attached sub-driver cx25840 [ 509.860580][ T2514] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 509.869341][ T2514] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 509.961563][ T5863] usb 8-1: USB disconnect, device number 24 [ 510.646174][T30378] usb 6-1: USB disconnect, device number 33 [ 510.897787][ T2020] netlink: 136 bytes leftover after parsing attributes in process `syz.7.13049'. [ 510.902440][ T2020] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 511.112091][ T2030] syz.3.13054: vmalloc error: size 1768304430, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 511.132486][ T2030] CPU: 1 UID: 0 PID: 2030 Comm: syz.3.13054 Tainted: G L syzkaller #0 PREEMPT(full) [ 511.132531][ T2030] Tainted: [L]=SOFTLOCKUP [ 511.132542][ T2030] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 511.132557][ T2030] Call Trace: [ 511.132567][ T2030] [ 511.132578][ T2030] dump_stack_lvl+0x100/0x190 [ 511.132618][ T2030] warn_alloc.cold+0x94/0xa8 [ 511.132646][ T2030] ? __pfx_warn_alloc+0x10/0x10 [ 511.132672][ T2030] ? __lock_acquire+0x49f/0x1a40 [ 511.132737][ T2030] __vmalloc_node_range_noprof+0x136c/0x1630 [ 511.132782][ T2030] ? lock_acquire+0x1b9/0x370 [ 511.132818][ T2030] ? ip_set_sockfn_get+0x18e/0xd20 [ 511.132853][ T2030] ? __lock_acquire+0x49f/0x1a40 [ 511.132886][ T2030] ? trace_contention_end+0x126/0x160 [ 511.132928][ T2030] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 511.132962][ T2030] ? nf_sockopt_find.isra.0+0x2a/0x290 [ 511.132995][ T2030] ? rcu_is_watching+0x12/0xc0 [ 511.133028][ T2030] ? ip_set_sockfn_get+0x18e/0xd20 [ 511.133056][ T2030] __vmalloc_node_noprof+0xad/0xf0 [ 511.133091][ T2030] ? ip_set_sockfn_get+0x18e/0xd20 [ 511.133124][ T2030] ip_set_sockfn_get+0x18e/0xd20 [ 511.133157][ T2030] ? __pfx_ip_set_sockfn_get+0x10/0x10 [ 511.133191][ T2030] ? nf_sockopt_find.isra.0+0x222/0x290 [ 511.133222][ T2030] nf_getsockopt+0x7c/0xe0 [ 511.133256][ T2030] ip_getsockopt+0x192/0x1e0 [ 511.133291][ T2030] ? __pfx_ip_getsockopt+0x10/0x10 [ 511.133314][ T2030] ? find_held_lock+0x2b/0x80 [ 511.133352][ T2030] raw_getsockopt+0x4d/0x1f0 [ 511.133378][ T2030] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 511.133414][ T2030] do_sock_getsockopt+0x50a/0x6e0 [ 511.133450][ T2030] ? __lock_acquire+0x49f/0x1a40 [ 511.133492][ T2030] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 511.133527][ T2030] ? percpu_counter_add_batch+0xb9/0x230 [ 511.133570][ T2030] ? find_held_lock+0x2b/0x80 [ 511.133606][ T2030] ? __fget_files+0x21f/0x3d0 [ 511.133652][ T2030] __sys_getsockopt+0x133/0x1d0 [ 511.133692][ T2030] ? __ia32_sys_getsockopt+0xbc/0x160 [ 511.133717][ T2030] __ia32_sys_getsockopt+0xbc/0x160 [ 511.133741][ T2030] ? __do_fast_syscall_32+0x98/0x970 [ 511.133766][ T2030] ? lockdep_hardirqs_on+0x78/0x100 [ 511.133804][ T2030] __do_fast_syscall_32+0xe7/0x970 [ 511.133836][ T2030] do_fast_syscall_32+0x32/0x70 [ 511.133863][ T2030] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 511.133899][ T2030] RIP: 0023:0xf7fd4fec [ 511.133928][ T2030] Code: Unable to access opcode bytes at 0xf7fd4fc2. [ 511.133939][ T2030] RSP: 002b:00000000f549650c EFLAGS: 00000292 ORIG_RAX: 000000000000016d [ 511.133967][ T2030] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 [ 511.133985][ T2030] RDX: 0000000000000053 RSI: 0000000000000000 RDI: 0000000080000080 [ 511.134001][ T2030] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 511.134015][ T2030] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 511.134027][ T2030] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 511.134061][ T2030] [ 511.134072][ T2030] Mem-Info: [ 511.259927][ T2030] active_anon:7765 inactive_anon:487 isolated_anon:0 [ 511.259927][ T2030] active_file:500 inactive_file:29332 isolated_file:0 [ 511.259927][ T2030] unevictable:1768 dirty:225 writeback:0 [ 511.259927][ T2030] slab_reclaimable:6780 slab_unreclaimable:75929 [ 511.259927][ T2030] mapped:24057 shmem:2264 pagetables:2244 [ 511.259927][ T2030] sec_pagetables:305 bounce:0 [ 511.259927][ T2030] kernel_misc_reclaimable:0 [ 511.259927][ T2030] free:23624 free_pcp:17815 free_cma:0 [ 511.275594][ T2030] Node 0 active_anon:12kB inactive_anon:16kB active_file:72kB inactive_file:60kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:28kB dirty:0kB writeback:0kB shmem:3536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:9056kB pagetables:1580kB sec_pagetables:1124kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 511.290077][ T2030] Node 1 active_anon:30976kB inactive_anon:1932kB active_file:1928kB inactive_file:117268kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:96180kB dirty:932kB writeback:0kB shmem:5468kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:7224kB pagetables:7432kB sec_pagetables:96kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 511.306244][ T2030] Node 0 DMA free:2056kB boost:0kB min:760kB low:948kB high:1136kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:72kB inactive_file:60kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:768kB local_pcp:208kB free_cma:0kB [ 511.318769][ T2030] lowmem_reserve[]: 0 280 280 280 280 [ 511.323757][ T2030] Node 0 DMA32 free:15924kB boost:0kB min:12776kB low:15968kB high:19160kB reserved_highatomic:0KB free_highatomic:0KB active_anon:12kB inactive_anon:16kB active_file:0kB inactive_file:0kB unevictable:3536kB writepending:0kB zspages:0kB present:1032196kB managed:287120kB mlocked:0kB bounce:0kB free_pcp:7644kB local_pcp:2748kB free_cma:0kB [ 511.335023][ T2030] lowmem_reserve[]: 0 0 0 0 0 [ 511.337043][ T2030] Node 1 DMA32 free:76380kB boost:0kB min:47140kB low:58924kB high:70708kB reserved_highatomic:0KB free_highatomic:0KB active_anon:30976kB inactive_anon:1932kB active_file:1928kB inactive_file:117268kB unevictable:3536kB writepending:932kB zspages:1740kB present:1048432kB managed:948212kB mlocked:0kB bounce:0kB free_pcp:60796kB local_pcp:19040kB free_cma:0kB [ 511.349164][ T5753] Bluetooth: hci2: command 0x0c1a tx timeout [ 511.349745][ T2030] lowmem_reserve[]: 0 0 0 0 0 [ 511.351786][ T5756] Bluetooth: hci0: command 0x0c1a tx timeout [ 511.353300][ T2030] Node 0 DMA: 84*4kB (U) 39*8kB (UM) 14*16kB (UM) 3*32kB (UM) 13*64kB (UM) 0*128kB 1*256kB (M) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 2056kB [ 511.360753][ T2030] Node 0 DMA32: 5*4kB (UME) 30*8kB (UME) 47*16kB (UME) 66*32kB (UME) 48*64kB (UME) 22*128kB (UME) 5*256kB (UME) 1*512kB (U) 1*1024kB (M) 2*2048kB (UM) 0*4096kB = 15924kB [ 511.367557][ T2030] Node 1 DMA32: 433*4kB (UME) 132*8kB (UME) 123*16kB (UM) 14*32kB (UME) 70*64kB (UME) 42*128kB (UME) 18*256kB (UME) 7*512kB (UM) 16*1024kB (UM) 10*2048kB (M) 4*4096kB (UM) = 76500kB [ 511.374263][ T2030] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 511.377583][ T2030] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 511.380537][ T2030] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 511.383814][ T2030] Node 1 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 511.388783][ T2030] 32340 total pagecache pages [ 511.390605][ T2030] 261 pages in swap cache [ 511.391990][ T2030] Free swap = 121744kB [ 511.393289][ T2030] Total swap = 124996kB [ 511.394645][ T2030] 524155 pages RAM [ 511.405535][ T2030] 0 pages HighMem/MovableOnly [ 511.407931][ T2030] 211482 pages reserved [ 511.409816][ T2030] 0 pages cma reserved [ 511.855636][T30378] kernel read not supported for file /dsp1 (pid: 30378 comm: kworker/0:6) [ 511.865852][ T5557] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 511.878450][ T2064] vcan0: tx drop: invalid da for name 0x00000000000000c7 [ 512.017063][ T5557] usb 6-1: too many configurations: 98, using maximum allowed: 8 [ 512.023879][ T5557] usb 6-1: config index 0 descriptor too short (expected 64915, got 45) [ 512.027809][ T5557] usb 6-1: config index 1 descriptor too short (expected 64915, got 45) [ 512.031691][ T5557] usb 6-1: config index 2 descriptor too short (expected 64915, got 45) [ 512.036814][ T5557] usb 6-1: config index 3 descriptor too short (expected 64915, got 45) [ 512.041050][ T5557] usb 6-1: config index 4 descriptor too short (expected 64915, got 45) [ 512.044672][ T5557] usb 6-1: config index 5 descriptor too short (expected 64915, got 45) [ 512.050626][ T5557] usb 6-1: config index 6 descriptor too short (expected 64915, got 45) [ 512.054942][ T5557] usb 6-1: config index 7 descriptor too short (expected 64915, got 45) [ 512.061306][ T5557] usb 6-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 512.064908][ T5557] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 512.068496][ T5557] usb 6-1: Product: syz [ 512.070292][ T5557] usb 6-1: Manufacturer: syz [ 512.072357][ T5557] usb 6-1: SerialNumber: syz [ 512.345038][ T5557] rtl8150 6-1:1.0: couldn't reset the device [ 512.348766][ T5557] rtl8150 6-1:1.0: probe with driver rtl8150 failed with error -5 [ 512.366965][ T5557] usb 6-1: USB disconnect, device number 34 [ 512.713627][ T2116] netlink: 40 bytes leftover after parsing attributes in process `syz.7.13089'. [ 513.045155][ T42] audit: type=1326 audit(2000000530.717:2097): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=2148 comm="syz.3.13104" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd4fec code=0x7ffc0000 [ 513.053095][ T42] audit: type=1326 audit(2000000530.717:2098): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=2148 comm="syz.3.13104" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd4fec code=0x7ffc0000 [ 513.064093][ T42] audit: type=1326 audit(2000000530.717:2099): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=2148 comm="syz.3.13104" exe="/syz-executor" sig=0 arch=40000003 syscall=120 compat=1 ip=0xf7fd4fec code=0x7ffc0000 [ 513.076525][ T42] audit: type=1326 audit(2000000530.727:2100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=2148 comm="syz.3.13104" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd4fec code=0x7ffc0000 [ 513.087637][ T42] audit: type=1326 audit(2000000530.727:2101): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=2151 comm="syz.3.13104" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71d71eb code=0x7ffc0000 [ 513.097946][ T42] audit: type=1326 audit(2000000530.727:2102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=2148 comm="syz.3.13104" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd4fec code=0x7ffc0000 [ 513.109092][ T42] audit: type=1326 audit(2000000530.767:2103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=2148 comm="syz.3.13104" exe="/syz-executor" sig=0 arch=40000003 syscall=26 compat=1 ip=0xf7fd4fec code=0x7ffc0000 [ 513.118585][ T42] audit: type=1326 audit(2000000530.767:2104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=2148 comm="syz.3.13104" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd4fec code=0x7ffc0000 [ 513.129399][ T42] audit: type=1326 audit(2000000530.767:2105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=2148 comm="syz.3.13104" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd4fec code=0x7ffc0000 [ 513.142269][ T2154] overlay: filesystem on ./file0 is read-only [ 514.257078][ T43] ------------[ cut here ]------------ [ 514.263307][ T43] time_after(jiffies, timeout) [ 514.263331][ T43] WARNING: io_uring/io_uring.c:2365 at io_ring_exit_work+0x479/0xd7a, CPU#3: kworker/u33:2/43 [ 514.270782][ T43] Modules linked in: [ 514.273285][ T43] CPU: 3 UID: 0 PID: 43 Comm: kworker/u33:2 Tainted: G L syzkaller #0 PREEMPT(full) [ 514.278130][ T43] Tainted: [L]=SOFTLOCKUP [ 514.280308][ T43] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 514.284951][ T43] Workqueue: iou_exit io_ring_exit_work [ 514.287854][ T43] RIP: 0010:io_ring_exit_work+0x479/0xd7a [ 514.290258][ T43] Code: 8e e8 3b 5e 43 01 48 8b 05 d4 a4 4b 0d 4c 8b 7c 24 38 31 ff 49 29 c7 4c 89 fe e8 42 d9 d3 00 4d 85 ff 79 12 e8 98 de d3 00 90 <0f> 0b 90 48 c7 44 24 20 70 17 00 00 e8 86 de d3 00 48 8b 74 24 20 [ 514.299156][ T43] RSP: 0000:ffffc900006afaa0 EFLAGS: 00010293 [ 514.302073][ T43] RAX: 0000000000000000 RBX: ffff888029d84710 RCX: ffffffff81354dbe [ 514.305034][ T43] RDX: ffff88801db94a80 RSI: ffffffff81354dc8 RDI: ffff88801db94a80 [ 514.307874][ T43] RBP: ffffc900006afc38 R08: 0000000000000007 R09: 0000000000000000 [ 514.310670][ T43] R10: fffffffffffffffc R11: 0000000000000000 R12: ffff888029d84000 [ 514.313202][ T43] R13: dffffc0000000000 R14: 0000000029d84700 R15: fffffffffffffffc [ 514.316333][ T43] FS: 0000000000000000(0000) GS:ffff888096ef2000(0000) knlGS:0000000000000000 [ 514.320423][ T43] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 514.323065][ T43] CR2: 00000000f74b6288 CR3: 000000006720b000 CR4: 0000000000352ef0 [ 514.325888][ T43] Call Trace: [ 514.326986][ T43] [ 514.327998][ T43] ? do_raw_spin_lock+0x128/0x260 [ 514.329734][ T43] ? __pfx_io_ring_exit_work+0x10/0x10 [ 514.331672][ T43] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 514.334182][ T43] ? debug_object_deactivate+0x2e4/0x3b0 [ 514.336878][ T43] ? rcu_is_watching+0x12/0xc0 [ 514.339297][ T43] process_one_work+0xa23/0x1940 [ 514.341793][ T43] ? __pfx_process_one_work+0x10/0x10 [ 514.344419][ T43] ? __pfx_io_ring_exit_work+0x10/0x10 [ 514.347213][ T43] worker_thread+0x5ef/0xe50 [ 514.348841][ T43] ? __pfx_worker_thread+0x10/0x10 [ 514.350505][ T43] ? kthread+0x13a/0x450 [ 514.351981][ T43] ? __pfx_worker_thread+0x10/0x10 [ 514.353894][ T43] kthread+0x370/0x450 [ 514.355508][ T43] ? __pfx_kthread+0x10/0x10 [ 514.357428][ T43] ret_from_fork+0x72b/0xd50 [ 514.359419][ T43] ? __pfx_ret_from_fork+0x10/0x10 [ 514.361614][ T43] ? __switch_to+0x800/0x10f0 [ 514.363654][ T43] ? __pfx_kthread+0x10/0x10 [ 514.365908][ T43] ret_from_fork_asm+0x1a/0x30 [ 514.368422][ T43] [ 514.370090][ T43] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 514.373485][ T43] CPU: 3 UID: 0 PID: 43 Comm: kworker/u33:2 Tainted: G L syzkaller #0 PREEMPT(full) [ 514.377989][ T43] Tainted: [L]=SOFTLOCKUP [ 514.379836][ T43] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 514.384207][ T43] Workqueue: iou_exit io_ring_exit_work [ 514.386917][ T43] Call Trace: [ 514.388294][ T43] [ 514.389353][ T43] dump_stack_lvl+0x100/0x190 [ 514.390918][ T43] vpanic+0x552/0x970 [ 514.392327][ T43] ? __pfx_vpanic+0x10/0x10 [ 514.393838][ T43] panic+0xd1/0xe0 [ 514.395190][ T43] ? __pfx_panic+0x10/0x10 [ 514.397082][ T43] ? check_panic_on_warn+0x1f/0x90 [ 514.399454][ T43] check_panic_on_warn.cold+0x19/0x34 [ 514.402156][ T43] ? io_ring_exit_work+0x479/0xd7a [ 514.404703][ T43] __warn.cold+0x191/0x318 [ 514.406633][ T43] __report_bug+0x30f/0x440 [ 514.408572][ T43] ? io_ring_exit_work+0x479/0xd7a [ 514.410724][ T43] ? __pfx___report_bug+0x10/0x10 [ 514.412850][ T43] ? rcu_is_watching+0x12/0xc0 [ 514.415132][ T43] ? trace_contention_end+0x126/0x160 [ 514.417847][ T43] ? __mutex_lock+0x26d/0x1bd0 [ 514.420433][ T43] ? io_ring_exit_work+0x422/0xd7a [ 514.422716][ T43] ? find_held_lock+0x2b/0x80 [ 514.424619][ T43] ? io_ring_exit_work+0x434/0xd7a [ 514.426489][ T43] ? io_ring_exit_work+0x479/0xd7a [ 514.428568][ T43] report_bug+0xb2/0x220 [ 514.430311][ T43] ? io_ring_exit_work+0x479/0xd7a [ 514.432658][ T43] handle_bug+0x16a/0x2a0 [ 514.434760][ T43] exc_invalid_op+0x17/0x50 [ 514.436784][ T43] asm_exc_invalid_op+0x1a/0x20 [ 514.438966][ T43] RIP: 0010:io_ring_exit_work+0x479/0xd7a [ 514.441326][ T43] Code: 8e e8 3b 5e 43 01 48 8b 05 d4 a4 4b 0d 4c 8b 7c 24 38 31 ff 49 29 c7 4c 89 fe e8 42 d9 d3 00 4d 85 ff 79 12 e8 98 de d3 00 90 <0f> 0b 90 48 c7 44 24 20 70 17 00 00 e8 86 de d3 00 48 8b 74 24 20 [ 514.448318][ T43] RSP: 0000:ffffc900006afaa0 EFLAGS: 00010293 [ 514.451222][ T43] RAX: 0000000000000000 RBX: ffff888029d84710 RCX: ffffffff81354dbe [ 514.454147][ T43] RDX: ffff88801db94a80 RSI: ffffffff81354dc8 RDI: ffff88801db94a80 [ 514.457079][ T43] RBP: ffffc900006afc38 R08: 0000000000000007 R09: 0000000000000000 [ 514.459802][ T43] R10: fffffffffffffffc R11: 0000000000000000 R12: ffff888029d84000 [ 514.462276][ T43] R13: dffffc0000000000 R14: 0000000029d84700 R15: fffffffffffffffc [ 514.464736][ T43] ? io_ring_exit_work+0x46e/0xd7a [ 514.466410][ T43] ? io_ring_exit_work+0x478/0xd7a [ 514.469073][ T43] ? do_raw_spin_lock+0x128/0x260 [ 514.471866][ T43] ? __pfx_io_ring_exit_work+0x10/0x10 [ 514.474207][ T43] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 514.476657][ T43] ? debug_object_deactivate+0x2e4/0x3b0 [ 514.478972][ T43] ? rcu_is_watching+0x12/0xc0 [ 514.480992][ T43] process_one_work+0xa23/0x1940 [ 514.483067][ T43] ? __pfx_process_one_work+0x10/0x10 [ 514.485546][ T43] ? __pfx_io_ring_exit_work+0x10/0x10 [ 514.488838][ T43] worker_thread+0x5ef/0xe50 [ 514.491527][ T43] ? __pfx_worker_thread+0x10/0x10 [ 514.493794][ T43] ? kthread+0x13a/0x450 [ 514.495646][ T43] ? __pfx_worker_thread+0x10/0x10 [ 514.497796][ T43] kthread+0x370/0x450 [ 514.499443][ T43] ? __pfx_kthread+0x10/0x10 [ 514.501166][ T43] ret_from_fork+0x72b/0xd50 [ 514.502663][ T43] ? __pfx_ret_from_fork+0x10/0x10 [ 514.504616][ T43] ? __switch_to+0x800/0x10f0 [ 514.506651][ T43] ? __pfx_kthread+0x10/0x10 [ 514.508826][ T43] ret_from_fork_asm+0x1a/0x30 [ 514.511329][ T43] [ 514.513742][ T43] Kernel Offset: disabled [ 514.515534][ T43] Rebooting in 86400 seconds..