last executing test programs: 2m57.363575322s ago: executing program 1 (id=328): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = dup(r1) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r1, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x4}, 0x1c, &(0x7f0000000380)}, 0x48043) r3 = dup(r1) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000000)='ip6gretap0\x00', 0x10) write$tun(r2, &(0x7f0000000280)=ANY=[], 0x16) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) write$P9_RVERSION(r2, &(0x7f0000000100)=ANY=[], 0x13) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e60, 0xeffffff2, @empty, 0x5}}, 0x10001fc, 0x6, 0xffff1896, 0x3, 0x26, 0xffffffb9, 0x1a}, 0x9c) close_range(r0, 0xffffffffffffffff, 0x0) 2m57.108763584s ago: executing program 1 (id=331): r0 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0xb, 0x1, 0x4, 0x0, 0x7}) r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f00000005c0)={0x1, @pix_mp={0x3ff, 0x2fe, 0x4f424752, 0x3, 0x0, [{0xc3, 0x3}, {0x3, 0x7fffffff}, {0x6, 0x8}, {0x5, 0x2000008}, {0x802}, {0x5, 0x3}, {0x6, 0x40b}, {0x10001, 0x800004}], 0x0, 0xd, 0x2, 0x3078182a3427730f, 0x1}}) 2m56.831039168s ago: executing program 1 (id=332): r0 = creat(0x0, 0x6a) close(r0) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000f00), 0x2, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 2m56.237863208s ago: executing program 1 (id=335): syz_mount_image$ext4(&(0x7f0000000780)='ext4\x00', &(0x7f00000007c0)='./file0\x00', 0x4, &(0x7f0000000800), 0x1, 0x76a, &(0x7f0000001800)="$eJzs2E9rXFUYB+D33kxi2sZOqi6sm4oVWpBO/rWhqZvWhSAIFgquVAx2koZMmpJJ0WSV4lIXLgQVEbQbFyLNQuhGNCD4AXRjv4IgKrpwIYzcySQN6SSNdeKh6fPAyZxz37n5vWeGucydAB5YTxZ/soi+iBiMiHLreB4RPc1Zb8TS6vNujCxfKkYWjcaFX7PitLg+snxp7X9lrccD0TwljkfEc89n8ejbd+bWFxanx2u16lxrPTA/c2WgvrB4YmpmfLI6Wb08PHz61NjJodHRsY7tdWggXvvuq7MvL527+uXgK7PTRb99rdrGfXRS1uZYKSJe3Y2wBLpa++nacCwrJWwIAIBtFd/zH4mIp5rf4crRFbe/vJXj1rdJmwMAAAA6onGkAQAAAOxxqX9/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg/tBoZNEAAAAA9rTUvz8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHB/uT6yfGlt/J+5v5yLiP7V/ButsVopxVLzsTe6I2L/H1mUNpyXRcRgB/KXrkXE4+32nzXz+6O3udqcn0fE+cT5r3cgHx5kK8X152y7z1++fv2JNp+/0upp/9na9e/GHde/2/ldW1z/ruww4/MfX3p3y/xrEU+U2uVn6/nZFvlLO8z/5sXDH21Va3wWcSza52/MGpifuTJQX1g8MTUzPlmdrF4eHj59auzk0Ojo2MDEVK06uPq3bcYnX7zz/Xb7379Vfhbbvv7v7XD/Rw89+/Wn2+QfP7r9+9/u9S96Wt5h/u8/HPx7q1qRf3GL/d/t/V/ZYf4LN8/f3OFTAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADYI/KI6Issr6zP87xSiTgQEY/F/rw2W59/ZmL26uWLRS2iP7rzialadTAiyqvrrFgPNee318Ob1iMRcSgi3i/va64rb8zWLqbePAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOsORERfZHklIvKI+LOc55VK6q4AAACAjutP3QAAAACw69z/AwAAwN7n/h8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIBddujIyq0sIpbO7GuOQk+r1p20M2C35akbAJLpSt0AkEwpdQNAMu7xgewu9d57qAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACw9xw7vHIri4ilM/uao9DTqnUn7QzYbXnqBoBkulI3ACRTSt0AkIx7fCC7S733HioAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7D19zZHllYjIm/M8r1QiHo6I/ujOJqZq1cGIOBgRP5W7HyrWQ6mbBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoOPqC4vT47Vadc7ExMRkfZL6ygQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAr1hcXp8VqtOldP3QkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABp5T9nEVGMY+Wn+zZXe7K/ys3HiHjz4wsfvDU+Pz83VBz/bf34/Iet48Mp+gcAAAA2W7tPX7uPBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2Kn6wuL0eK1WndvFSeo9AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/zj8BAAD//5GsoMo=") mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000680), 0x0, &(0x7f0000000340)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) 2m54.606267189s ago: executing program 1 (id=341): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0xc, 0x8001, 0x0, 0x9, 0x4f, 0x8, 0xfa11, 0x1}, 0x0) fcntl$getownex(r0, 0x10, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000000c0)={0xffffffffffffffff, 0xe0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xc5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x47, 0x8, 0x0, 0x0}}, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) fchdir(r2) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) close(0x3) syz_open_dev$midi(&(0x7f0000000000), 0x3, 0x88c02) syz_open_procfs(0x0, &(0x7f0000000180)='fd/3\x00') syz_usb_disconnect(r3) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x3, &(0x7f0000000100)=[{0x6, 0x8, 0x7, 0xffffffff}, {0x2000, 0x43, 0x1, 0x80000000}, {0x1, 0x6, 0x9, 0x8}]}) close_range(r4, 0xffffffffffffffff, 0x0) mkdirat$cgroup(r2, &(0x7f0000000dc0)='syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/fscaps', 0x102, 0x0) fchown(r5, 0xee01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) r6 = openat$cgroup_freezer_state(r2, &(0x7f00000002c0), 0x2, 0x0) write$cgroup_freezer_state(r6, &(0x7f00000000c0)='FROZEN\x00', 0x7) sendfile(r6, r6, 0x0, 0x8000002) syz_open_procfs(0xffffffffffffffff, &(0x7f0000002f00)='fdinfo\x00') 2m48.95080732s ago: executing program 1 (id=360): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f00000010c0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x900}}], 0x1, 0x20000800) r1 = openat$cgroup_devices(r0, &(0x7f0000000080)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="62a02a3a34096d72"], 0xa) 2m48.104756932s ago: executing program 32 (id=360): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f00000010c0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x900}}], 0x1, 0x20000800) r1 = openat$cgroup_devices(r0, &(0x7f0000000080)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="62a02a3a34096d72"], 0xa) 13.391100584s ago: executing program 2 (id=777): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r4, &(0x7f0000001a40)=""/102392, 0x18ff8) socket$nl_generic(0x10, 0x3, 0x10) writev(0xffffffffffffffff, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r6 = socket$packet(0x11, 0x3, 0x300) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1, 0xa, &(0x7f0000000280)=ANY=[@ANYBLOB="18110000d1d6a67289e262cd81f7904568624ea2b3684ab73e9276a5ab1eb3b037b4f1b8b48e12748872e460430a0bcaae001ca05960378074552e3f42ea3214a662566d06a85b3ebdba7e8019af832fcda9ed700cd1679cba6e01dc498da64389f5e7be55a2486f44842015a04e74698e4b18cbb52885cfff0de521ccc7b55406e73691ed2d2b8fdf74049053eda275bbd6b9e2d8b2d0dc015a78c953", @ANYRES32=r5, @ANYBLOB], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r6, 0x1, 0x32, &(0x7f0000000040)=r7, 0x4) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000080)={{0x1, 0x1, 0x18, r7}, './file0\x00'}) r9 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x6, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000240)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r9, 0x5, 0xb68, 0xffffffffffffff6b, &(0x7f0000000000)="ff", 0x0, 0x149c, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x48) 13.371414095s ago: executing program 5 (id=778): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) syz_open_dev$loop(&(0x7f0000000140), 0x4, 0x80000) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x48f, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0xa0000, 0x0) fcntl$setown(r1, 0x8, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x2000fb) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'veth0\x00', 0x0}) setsockopt$packet_int(r3, 0x107, 0x14, &(0x7f0000000180)=0x19ca, 0x4) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(r3, &(0x7f00000000c0)="3f03fe7f0302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c153cfdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, r4, 0x1, 0x0, 0x6, @multicast}, 0x14) accept4(r0, 0x0, 0x0, 0x80000) 11.034640781s ago: executing program 2 (id=784): r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r0, 0x0, 0xc8, 0x0, 0x0) 10.627197491s ago: executing program 2 (id=786): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) r0 = syz_open_dev$MSR(&(0x7f0000000140), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102392, 0x18ff8) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r1 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$netlink(r1, &(0x7f0000001100)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000300)=ANY=[@ANYBLOB="e00000001000090500000000000000006f6d888f1d1c4e5ad85ce4966dbd0000002b0e13e735a3184f123d6da2f1acfac0ee2dd2b184b27db1f302de337c0004000000000000bf852c8986626691b01b5f44e4ce2d712d2828da"], 0xe0}], 0x1, 0x0, 0x0, 0x80}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) bind$802154_dgram(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r1, 0x0, 0x0, 0x4000010) io_submit(0x0, 0x0, &(0x7f0000000140)) r2 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r2, &(0x7f0000000040)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x20, @local}}, 0x80, 0x0, 0x0, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb71658bda99b49720fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x0) 9.599675662s ago: executing program 2 (id=789): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000240), 0x4000000044402, 0x0) socket(0x2b, 0x80801, 0x1) r1 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) r2 = getpid() r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='net/ip_tables_matches\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000580)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000140)={0x3, 0x8, 0x1, 0x0, 0x7f}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0xbc3d, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$RDMA_USER_CM_CMD_RESOLVE_IP(r6, 0x0, 0x0) unshare(0xe060400) memfd_create(0x0, 0x3) unshare(0x2c060000) rt_sigqueueinfo(0x0, 0x21, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r1, 0xc1105517, &(0x7f0000000340)={{0xfffffffe, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x6, 0x2, 0x4, r2, 0x0, 0x0, 'syz1\x00', 0x0}) syz_open_procfs(0x0, &(0x7f00000000c0)='net/ptype\x00') io_setup(0xc00, &(0x7f0000000000)=0x0) io_submit(r7, 0x2, &(0x7f0000000080)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x8, r0, &(0x7f0000000040)="1e", 0x1, 0x4b}, 0x0]) syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0009030320d812010079de01ec020109021b000100000300090400"], 0x0) 8.943012415s ago: executing program 5 (id=791): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGREPORT(r1, 0x400c4807, &(0x7f0000000040)={0x3, 0x2, 0x7}) 8.296984227s ago: executing program 0 (id=793): r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x2}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000022c0)=@newtfilter={0x38, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0xffff, 0x5}, {}, {0x7, 0x7}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x8, 0x2, [@TCA_CGROUP_ACT={0x4}]}}]}, 0x38}}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) r6 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r6, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r7, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000280)='M', 0x1}], 0x1}, 0x4) 8.22513028s ago: executing program 3 (id=794): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r4, &(0x7f0000001a40)=""/102392, 0x18ff8) socket$nl_generic(0x10, 0x3, 0x10) writev(0xffffffffffffffff, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r6 = socket$packet(0x11, 0x3, 0x300) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1, 0xa, &(0x7f0000000280)=ANY=[@ANYBLOB="18110000d1d6a67289e262cd81f7904568624ea2b3684ab73e9276a5ab1eb3b037b4f1b8b48e12748872e460430a0bcaae001ca05960378074552e3f42ea3214a662566d06a85b3ebdba7e8019af832fcda9ed700cd1679cba6e01dc498da64389f5e7be55a2486f44842015a04e74698e4b18cbb52885cfff0de521ccc7b55406e73691ed2d2b8fdf74049053eda275bbd6b9e2d8b2d0dc015a78c953", @ANYRES32=r5, @ANYBLOB], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r6, 0x1, 0x32, &(0x7f0000000040)=r7, 0x4) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000080)={{0x1, 0x1, 0x18, r7}, './file0\x00'}) r9 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x6, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000240)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r9, 0x5, 0xb68, 0xffffffffffffff6b, &(0x7f0000000000)="ff", 0x0, 0x149c, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x48) 7.911275836s ago: executing program 0 (id=796): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) 6.612030231s ago: executing program 5 (id=800): r0 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @empty}, 0x20) syz_emit_ethernet(0x46, &(0x7f0000000440)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd60f91e2e00107300fc040000000000000000000000000000ff02000000000000000000000000000100000000ff"], 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) recvfrom$l2tp6(r0, &(0x7f0000000380)=""/160, 0xa0, 0x40, 0x0, 0x0) 6.337780294s ago: executing program 5 (id=801): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0xc, 0x8001, 0x0, 0x9, 0x4f, 0x8, 0xfa11, 0x1}, 0x0) fcntl$getownex(r0, 0x10, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000000c0)={0xffffffffffffffff, 0xe0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xc5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x47, 0x8, 0x0, 0x0}}, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) fchdir(r2) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) close(0x3) syz_open_dev$midi(&(0x7f0000000000), 0x3, 0x88c02) syz_open_procfs(0x0, &(0x7f0000000180)='fd/3\x00') syz_usb_disconnect(r3) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x3, &(0x7f0000000100)=[{0x6, 0x8, 0x7, 0xffffffff}, {0x2000, 0x43, 0x1, 0x80000000}, {0x1, 0x6, 0x9, 0x8}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) r4 = openat$cgroup_freezer_state(r2, &(0x7f00000002c0), 0x2, 0x0) sendfile(r4, r4, 0x0, 0x8000002) 5.800390891s ago: executing program 3 (id=803): openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) shmctl$IPC_INFO(0x0, 0x3, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000006000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f00000001c0)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b000ee6d6c2f800000c00f3266bac0000f3066b808008ed0660f38806f008ee0", 0x3a}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x2, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x24040000) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000240)={{&(0x7f0000400000/0x1000)=nil, 0x20400000}, 0x1}) r4 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_CREATE_BUFS(r4, 0xc100565c, &(0x7f00000013c0)={0x0, 0x2, 0x2, {0x5, @vbi={0x0, 0x0, 0x4, 0x0, [], [0x8200], 0x1}}}) ioctl$VIDIOC_QBUF(r4, 0xc058565d, &(0x7f0000000200)=@fd={0x0, 0x5, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, "8000"}, 0x0, 0x2, {}, 0x20800}) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2) 5.323485695s ago: executing program 2 (id=804): bpf$ENABLE_STATS(0x20, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet_smc(0x2b, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) syz_clone(0x1100000, 0x0, 0x0, 0x0, 0x0, 0x0) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) gettid() r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, 0x0, 0x0) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) ioctl$VIDIOC_CROPCAP(r4, 0xc02c563a, &(0x7f00000000c0)={0xa, {0x4, 0x3, 0x1, 0x401}, {0x0, 0x2, 0x4, 0x1000}, {0xa47, 0x5}}) syz_open_procfs(0x0, &(0x7f0000000140)='net/ip6_flowlabel\x00') setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000b00)={{{@in6=@remote, @in=@initdev={0xac, 0x1e, 0x5, 0x0}, 0x0, 0x5, 0x0, 0x0, 0x2, 0x0, 0x10, 0x1}, {0x7fe000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff}, {0x0, 0x0, 0x3}, 0x0, 0x0, 0x1, 0x1}, {{@in=@rand_addr=0xffffffff, 0x4d6, 0x32}, 0x2, @in6=@remote, 0x0, 0x2, 0x0, 0xb7, 0xb, 0x81}}, 0xe8) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) syz_usb_connect$hid(0x2, 0x36, 0x0, 0x0) flistxattr(r0, &(0x7f0000000080)=""/210, 0xd2) 4.739166564s ago: executing program 0 (id=807): openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r1, &(0x7f0000000280)={0x1f, 0x0, @none, 0x0, 0x2}, 0xe) listen(r1, 0x1) mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='trans=fd,rfdno', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) 4.672678817s ago: executing program 3 (id=808): r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r0, 0x0, 0xc8, 0x0, 0x0) 4.447210198s ago: executing program 3 (id=810): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGREPORT(r1, 0x400c4807, &(0x7f0000000040)={0x3, 0x2, 0x7}) 4.41568025s ago: executing program 0 (id=811): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='huge=always,huge=wit']) chdir(&(0x7f0000000140)='./file0\x00') r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000040), 0x208e24b) io_setup(0x8, 0x0) 4.363727493s ago: executing program 4 (id=812): bpf$PROG_LOAD(0x5, 0x0, 0x4c) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0xb, 0x88}, 0x0) syz_mount_image$hfsplus(&(0x7f00000000c0), &(0x7f0000000980)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x3200004, &(0x7f0000000a80)=ANY=[@ANYBLOB="63726561746f723da8fa40b32c6465636f6d706f73652c63726561746f723dbd1c66f52c6e6c733d63703836392c6769643d", @ANYRESHEX=0x0, @ANYBLOB="2c666f7263652c00f2d2d783dca321ca066f379066a92598376c0a6fb6ebb186b9be7a1d0debd4c2ce3408ded03a80e9839d59c9e7ee798f53e0387168295df851a241c8ce5a7094002fc55c1a66f9e609ea2409393aeb7f8902fcfb60db30dde50ac8f677ad022ab20fcf35644f0090f1861caf534652a239e63533b1a1d4251af75bb0ab1e3bffcf118f464e5f296a5e488bc804019abdcd6deed70d74ab439ff1b9839c7a8666aefe533565f6c6146cfd6ee47347c7dd230d2bfddd5b171026823367db7821b2c9b936b83cd77a9374bfba82530c6b3267130c"], 0x3, 0x6b4, &(0x7f0000000180)="$eJzs3U9sHFcdB/DvbJx1Nkip+y8NCKlWI1XQiMTOqiRISA0IoRwiFMGlVytxGiubtHJclFaIbICCxIkT6oFDURUOPSGEkMoJUc5ISFw45R6pNw45AEYzO7te2xvH29het/18pPF7s2/ee7/5Zf54Z2NtgM+t86/mYDdFzp+4cKtcv3e33bl3t329X08ynaSRTPWKFK2k+Cg5l96SL5Yv1sMVD5vn5fsfFlPvftDurZVjvX+w3r6xVb9NRm7ZTQ4NVg4kme1V/7PtYTeNVy3VOJfWxnu46a0ai0HcZcKO9xMHk7a6SXetsfHI7ts/b4F963bvvrnJTHI4vbtrdYurrw6PvjJM3pbXpu7exQEAAAC7ZeR7+WFPPMiD3MqRvQkHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPhuK3ncGFvXS6NdnU/S//7859J36zQmH+5jeuVIV339i0oEAAAAAAAAAwGN5/kEe5FaO9NdXi+oz/xeqlWeqn1/Im7mZxSznZG5lIStZyXLmk8wMDdS8tbCysjy/ueevU/ZcXV29Xfc8PbLn6fVxdTcGOup/GmzaCAAAAAAAAAA+t36S82uf/wMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwH5QJAd6RbU806/PpDGV5FCSZjE72Lw50WB3wF8mHQAAAADsvlZdHin+16usFtV7/qPV+/5DeTM3spKlrKSTxVyungX03vU3/tFtd+7dbV8vl80Df+vjseKoRkzv2cPomeeqLZ4d9Dif7+YHOZHZXMxylvLDLGQli5nNd6raQorM1E8vZu7dbaUf6+Z4z61bu7gxtueH6mV8x6pIWrmSpSq2k7nU7IfeqLc7NjTbn5rJhhnvlNkpXqltM0eX67Lco1/V5Y478Ek6zVR7fnCQkbk692U2nhzO++bcj3mcbJxpPo3BM6hn1mYpVzfOdOfj5vg5P1yXZa5/vls57xnzUdr6THR/Wa71j76jW+c8+eo//3rxauPGtatXbp7YxV3aGxuPifZQJp7bViY6ZSa6j5GJQ48T/85p1tnoncTjXS1fqPoeyVK+l9dzOYs5k7nM52zm8o2cTjunh/L67NZ5ra5vjfHOteNfqSvlPekXQ/emPTP9sIYyr08O5XX4SjdTtQ2/spalp7aRpaKZ0Vn618hQpr5UV8o5fjp0x5m8jZmYH8rE01tn4rf/XU1ys3Pj2vLVhTe2Od+LdVmetu+svza/vyM7NL56d8vj5anyHyu928bw0VG2Pd1v25CvZv2Jy1Q92Lq2Zqrzudf2qDO1HOnonVEj9dqeGzlLu2o7NtS27recvJ7O4LcQAPaxwy8dbrbut/7eeq/1s9bV1oVD354+O/3lZg7+berPB37f+F3jm8VLeS8/zpFJRwoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJ8FN996+9pCp7O4vA8raezwgHdGNvVT0XuluT/2/dNamd7qiPpDki26NycRcyvJvkhdpvZgrumMaLoweKWVNAbxJLm2T77gDtgNp1auv3Hq5ltvf23p+sJri68t3jh99swrZ9pfn7996spSZ3Gu93PSUQK7Ye3XgElHAgAAAAAAAAAAAGzXWH9F0Mwn+tuDEdMW3QnsKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPDpdP7VHOymyPzcybly/d7ddqdc+vW1LaeSNJIUP0qKj5Jz6S2ZGRqueNg8L9//8DcvvvtBe22sqf72jQ39/vjv1dUx96JbL5lNcqAuH216W+NdqsrmoGF8xWAPy4Qd7ycOJu3/AQAA//9Hgwei") syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000240)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x2b1245d, 0x0, 0xfc, 0x0, &(0x7f00000000c0)) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, 0x0) r0 = socket$caif_seqpacket(0x25, 0x5, 0x4) setsockopt$CAIFSO_LINK_SELECT(r0, 0x116, 0x7f, 0x0, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000000140), 0x8, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0xd}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x800002) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x68, '\x00', 0x0, 0x2}, 0x94) r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000840), 0x8400, 0x0) ioctl$vim2m_VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405668, 0x0) ioctl$FS_IOC_SETFLAGS(r4, 0x40186f40, &(0x7f0000000440)=0x1f) setns(0xffffffffffffffff, 0x24020000) syz_clone(0x120e1100, 0x0, 0x0, 0x0, 0x0, 0x0) 2.861964787s ago: executing program 0 (id=813): syz_mount_image$nilfs2(&(0x7f0000000000), &(0x7f00000000c0)='./file2\x00', 0x3208c00, &(0x7f0000000340)=ANY=[], 0x1, 0xab6, &(0x7f0000000ec0)="$eJzs3U2MG1cBAOBn73qTTVLilIQuSWkTftry091ms4SfCJqqERJRU3GrVHGJ0rREpOEnlaBVJZJc6I1WVbhCEaciUQFCai8o6olLJRqJS0+FAweiIFXiAKWJ0drveccvdsfOZtf2+vukt88z79nvzezMeDwz770ATKxq8+/S0lwlhItvvHzkn/f8Y3Z5zoPtHPXm3+k0WQmh1oo650fvTrXia+89f6JbXAmLzb9pOjx6tf3erSGEc2FvuBTqYffFyy+9tfjIsfNHL+x7+9VDV9Zk4QEAYMJ869KhpV1/+8ueHe+/dtfhsKk9P52f1+P0ttA67z8cT/zT+X81dE5XCqFoJss3HUM1yzfVJV+xnFqWb7pH+TPZ59ba6Xs68m0qKX+qMK/bcsM4S9txPcyE+Y7panV+vvWbPDR/189U5s+cOv3k2SFVFLjl/n13CGGvMGhoNBo/aa7AEaiLINxsaGwf9hEIoCW/X3iDc/mVhdVpf9p0f+Vffaja/f1wC6z39q/88Sr/1+cdcbh1NurWlJYr7Ufb4nR+HyF/fmnQ/T99Xn4/otZnPXvdRxiX+wu96jm1zvW4Wb3qn28XG9XX4p2ytB6+nqUX95/8fzou/2Ogu/+s1/X/V2aHfq1zOexd3/Jua6/otSxnrT9/kFAb47pPYGgM5agDjIOV5+ZaGlFKz5/ry9M3laRvLkmfLUnfUpK+tSQdJtkfnvlZeLGy8js//00/6PWwdJ0tnfh+ZMD65NcjBy0/f+53UKstP3+eGEbZ68cfO/nlJx6/3Hr+v9Le/q/H7T39RKvHfetSzJCuF+bX1dvP/tc7y6n2yHd7Vp/bbsjfaJW4szNfZefK54TCceaGeswV3/WDG+rTzndn5+fXs3yzMWzO6pufn2zJ3pfOP9JxNa2v6Wx5a9lyzGT1SMeVHTHO6wE3I22P9VCpdnv+P22fc6FWefLU6ZMPxOm0nf55qrZpef7+4of+Zn3qDqzOyv7eff9P319zobP9z7b2/Fq1eFzYvjK/Ujwu1LP5i63J9m3yNP9AnE7fc9+Zmm3Onz/xvdNP3OqFhwl39tnnvnv89OmTP9wwLw6HVX7O7FislnTkHJX69PPig8ZIVMOLfl6UHTk26pODMDkWnnn6+wtnn33u/lNPH3/q5FMnzxw4ePDA4uLBrxxYWmie1y8Uz+6BjWTlS3/YNQEAAAAAAAAAAAD69aOjRy7/9c0vvdNq/7/S/i+1/09P/qb2/y9k7f/zdvKpVUBqB7ijS3pz3L3XO+sxk+WrxfDRrL47s3J2Ze/7WIzb4/jF9v+pvX3er2uqzx3Z/Lz/3pRvLpuf95cyk/VB0h4vMDbY/2ScvhDjXwUYosps99kx/tD+rX/7Qjt/6p9CvxTjKf3f0taQ+jFJ7b979euUjv871qGO3Hrr0Zxw2MsIdPevkR//s3Am3jvf1PDrGRqN4ddh9eHD17OwwUKjYRQPYDQMe/zPdN0zxWf+9M3NyyFlu/pQ5/Ey778UVmPUx59U/sYa/7M9/l1fx78uvat39PPc/+gK//3FlXcKxYbd/R5/8+VP/UDvLC+z6P1Yflr+e0N/5TdeycrPbwj16X9Z+Vv6LP+G5b+zrKTuIxl+EMtPq+2+T/VbfqvGlWpnPfLrxun+X37dOLmWLX/q23Pg5b/JgRqvx/JhkvUeZ7bfEWxHU7fxf6dHcPzfXvLnML4Yp9OBMD3nkH8jD1r/9HxF+h7YlX1+peT7bVzGKe5l0sf//WqMy/aHNP5v2h7rXaarhelal3U77tsKbDTvjvz9vzEL50agDoOGn45AHSYijMYY2MXQaDSG2pF3eeFb1qUek2rYvbgP++7zsMsf9vovk4//m5/D5+P/VrMfEPn4v/n78/F/8/R8fL08fUsspJLlS/Lxf/P0O7LPza9gz5Wkf7wkfXdJ+p6V9Nks/RvFevZ6/ydK0veVpN9Vkn53SfrtJelTJemfLkn/TEn6PSXp95Wkf7YkfaNrtkcp7FSTtvwwyfL2efZ/mBzp/k+v/X9nSTowvn7+2v6HH//9t+ut9v8z7d9r6T7e4Thdi7+dfxyn8/veoTC9nPZmnP57lj7q1ztgkuT9Z+Tf7/eWpAPjKz3nZf+GCVTp3mNPfr+tV79Vvc7zGS+fi/HnY/yFGN8f4/kYL8R4f4wX16l+rI2Hf/fHQy9WVn7vb8/S+32ePG8PlPcTdaDP+uTXBwZ9nj3vx29Qqy3/JpuDAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADE21+Xdpaa4SwsU3Xj7y2LFTC8tzHmznqDf/Themau33hfBAjKdi/Mv44tp7z58oxtdjXAmLoRIq7fnh0avtkraGEM6FveFSqIfdFy+/9NbiI8fOH72w7+1XD11ZuzUAAAAAG9//AwAA//+1ERnn") openat(0xffffffffffffff9c, 0x0, 0x105142, 0x2c) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x8882, 0x0) accept4$tipc(r0, 0x0, 0x0, 0x400) write$P9_RGETLOCK(0xffffffffffffffff, &(0x7f0000000100)=ANY=[], 0xffffff6a) capset(&(0x7f0000a31000)={0x20080522}, &(0x7f0000000080)) r1 = syz_open_dev$sg(&(0x7f00000000c0), 0x0, 0x2) r2 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x0) syz_read_part_table(0x1096, &(0x7f0000001500)="$eJzsz7FNw1AQBuDfxE4clBqJBSiokFgAUbABLSOwAqFgCwoKCuZiCyg49GwLsgEU31fYz+f7z77wp4bDh4tNkoe5OE6Vp7Osu9V0rErGVXI8x1bJyWv65GXX3lWX57mvz127LJl6z1E7fdVH1b6qqnVtW+ktldSQtHKGdFNk/m7GzeEfboY25Pbm+v4yaY1DPs+zWwLbVP+zw36+TfFumdmsk6vfTR9P+7YoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPwP3wEAAP//Tj0ibw==") fchdir(r3) r4 = open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x80) r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x1c1840, 0x0) syz_init_net_socket$rose(0xb, 0x5, 0x0) r6 = openat(0xffffffffffffff9c, 0x0, 0x1c1002, 0x0) sendfile(r6, r5, 0x0, 0x7fffffff) ftruncate(r4, 0x2007ffb) sendfile(r4, r4, 0x0, 0x1000000201005) write$UHID_CREATE2(r4, &(0x7f0000000240)={0xb, {'syz0\x00', 'syz1\x00', 'syz0\x00', 0x6d, 0xfbff, 0x3ff, 0xbf, 0xa, 0x0, "89663e60fa6043335be5db82d20bede70dac44ccf62ee83200279d33746cb619d401350ae860c9efdf16c1326456fe2062c75ce4f930fce55592a193ed46fe13bf22228a3d626980ceaa536ae5d72866b11e99b881ecfe2afee4e8e91f2436ecd82902b876ae5e4456ec6011f9"}}, 0x185) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r1, 0x5393, &(0x7f00000001c0)) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x2200) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xa3f, 0x0) 2.741893413s ago: executing program 4 (id=814): r0 = socket$phonet(0x23, 0x2, 0x1) setsockopt$SO_BINDTODEVICE_wg(r0, 0x1, 0x19, &(0x7f0000000000)='wg1\x00', 0x4) sendto$phonet(r0, 0x0, 0x0, 0x4000, &(0x7f0000000100)={0x23, 0x2, 0xbb, 0x5}, 0x10) openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/bus/input/devices\x00', 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x27, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = dup(r3) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r3, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x48043) r5 = dup(r3) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000000)='ip6gretap0\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000400)={0x0, @in={{0x2, 0x4e24, @empty}}, 0x8003, 0xbffc, 0xe652, 0x5, 0x134, 0x48, 0xff}, 0x9c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0xce20, 0x6, @empty, 0x2d}}, 0x7, 0x1, 0xf06, 0x3, 0xb4, 0x7f, 0x9}, 0x9c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e60, 0xeffffff2, @empty, 0x5}}, 0x10001fc, 0x6, 0xffff1896, 0x3, 0x26, 0xffffffb9, 0x1a}, 0x9c) bind$alg(0xffffffffffffffff, 0x0, 0x0) openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) 1.427147249s ago: executing program 3 (id=815): r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, 0x0, 0x0) sendmsg$rds(r0, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x4000, @remote}, 0x10, 0x0, 0x0, &(0x7f00000004c0)=[@mask_fadd={0x58, 0x114, 0x8, {{0xffffffff, 0x20005}, 0xfffffffffffffffd, 0x0, 0x1, 0x9, 0xd3f, 0x4, 0x8, 0x81a}}], 0x58}, 0x0) 1.321771164s ago: executing program 4 (id=816): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0xffffffffffffff34, &(0x7f0000000080)={0x0, 0xb8}}, 0x0) getsockname$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000000)=0x14) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="34000000100081eee80000040000000010000000", @ANYRES32=r3, @ANYBLOB="ddfffffdff000000140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=@ipv4_newaddr={0x20, 0x14, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0xff, r3}, [@IFA_LOCAL={0x8, 0x2, @local}]}, 0x20}}, 0x0) r4 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r4, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @local}, 0xc) r5 = socket(0x10, 0x803, 0x4) sendmsg$nl_route(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x20088814}, 0x0) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r7 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r7, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) sendmmsg(r7, &(0x7f0000007fc0), 0x800001d, 0x1c) setsockopt$inet_mreq(r6, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x4, 0x0, 0x0) 1.245107517s ago: executing program 0 (id=817): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x4, 0x7fff0026}]}) close_range(r0, 0xffffffffffffffff, 0x0) socket$alg(0x26, 0x5, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000240), 0x880, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') socket$packet(0x11, 0x3, 0x300) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000000140)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2405000005000000000000000c240000e9fffff5ffffffff092403f3", @ANYRES8=r1], 0x0) 1.062318537s ago: executing program 3 (id=818): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) 1.061314977s ago: executing program 5 (id=819): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000100)={0x1, "ff0f000000000000f5a72d866b0000000000f0ffdefe00"}) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r2, 0xc0184800, &(0x7f0000000100)={0x1, r1}) ioctl$DMA_BUF_SET_NAME_A(r3, 0x40086203, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x7, 0x7f, 0xa9, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0x6, 0x0, 0x7, 0x3c5b, 0x1, 0x20, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x6, 0x7, 0x5, 0x8, 0x4c74, 0x10000, 0x7, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0xffffffff, 0x7, 0x5, 0x3b, 0x18e, 0x6, 0x6, 0x0, 0x8, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x1007, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x7, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x40, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x200009, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x408, 0x3ff, 0x5, 0xfffffffd, 0x100, 0x4, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x200, 0x1fd, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x4, 0xa9, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x7ff, 0x2006, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0x20000b9, 0xce4, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xfffc, 0xa620, 0x1, 0x5, 0x801, 0x2000002, 0x150, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0x10000, 0x3, 0x7e, 0x9, 0x9622, 0x7, 0xaf, 0x20000008, 0x5, 0x226, 0x2, 0x5, 0x10000000, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0x6c1b, 0x0, 0x4, 0x5, 0x7ff, 0xd7, 0x200, 0xb, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 850.954567ms ago: executing program 4 (id=820): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) socket$unix(0x1, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r3, {0xffff}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x5, 0xd, 0x8b, 0xd, 0x2, 0x4, 0x2, 0xf, 0x6, 0x3, 0x7, 0x8, 0x4, 0x10, 0x4], 0x3, [0xb, 0x3, 0xad1e, 0x2002, 0x1, 0x4, 0x2, 0xd06, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xe, 0x100], [0xfff1, 0x5, 0xffff, 0xfff5, 0x4, 0x8, 0x1, 0x9, 0x5, 0x2, 0xc, 0x4, 0xfffc, 0x3, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffe00, {0x0, 0x0, 0x0, r6, {0x8}, {0xffff}, {0xfff2, 0xffe1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x45, 0x1, {0xe, [0xc, 0x5, 0x0, 0xf, 0x10, 0x2, 0x4, 0x2, 0xf, 0x6, 0x6, 0x1, 0x8, 0x4, 0x10, 0x4], 0x3, [0xb, 0x5, 0x7fff, 0x2002, 0x1, 0x4, 0x2, 0xd06, 0xff05, 0x8000, 0xb, 0x3, 0x5, 0x6, 0xd, 0x100], [0x2, 0x5, 0x2, 0xfff5, 0x4, 0x8, 0x7, 0x9, 0x5, 0x2, 0xc, 0x40, 0xfffc, 0x3, 0x1, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffe00, {0x0, 0x0, 0x0, r9, {0xc}, {0x8}, {0xfff2, 0xffe1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0xe, [0xc, 0x5, 0x0, 0xf, 0x10, 0x2, 0x4, 0x2, 0xf, 0x6, 0x6, 0x1, 0xc, 0x4, 0x10, 0x4], 0x3, [0xb, 0x5, 0x7fff, 0x2002, 0x1, 0x4, 0x2, 0xd06, 0xff05, 0x8000, 0xb, 0x3, 0x5, 0x6, 0xd, 0x1], [0x2, 0x5, 0x2, 0xfff5, 0x4, 0x8, 0x7, 0x9, 0x5, 0x2, 0xc, 0x40, 0xfffc, 0x3, 0x1, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) 813.227829ms ago: executing program 5 (id=821): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xe, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) remap_file_pages(&(0x7f0000902000/0x2000)=nil, 0x2000, 0x0, 0x40, 0x1) 446.826127ms ago: executing program 4 (id=822): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, 0x0, 0x0) r1 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) write$apparmor_exec(r1, &(0x7f0000000500)=ANY=[@ANYBLOB='stack : :'], 0x11) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$OSF_MSG_ADD(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000008c0)=ANY=[@ANYBLOB="08150000000511040000000000000000010000055402"], 0x1508}}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={0xffffffffffffffff, 0x0, 0xa, 0x0, &(0x7f0000000900)="928e04b416cac951c35f", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) writev(r2, &(0x7f0000000040), 0x2) 326.821173ms ago: executing program 2 (id=823): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='huge=always,huge=wit']) chdir(&(0x7f0000000140)='./file0\x00') r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000040), 0x208e24b) io_setup(0x8, 0x0) 0s ago: executing program 4 (id=824): bpf$PROG_LOAD(0x5, 0x0, 0x4c) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0xb, 0x88}, 0x0) syz_mount_image$hfsplus(&(0x7f00000000c0), &(0x7f0000000980)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x3200004, &(0x7f0000000a80)=ANY=[@ANYBLOB="63726561746f723da8fa40b32c6465636f6d706f73652c63726561746f723dbd1c66f52c6e6c733d63703836392c6769643d", @ANYRESHEX=0x0, @ANYBLOB="2c666f7263652c00f2d2d783dca321ca066f379066a92598376c0a6fb6ebb186b9be7a1d0debd4c2ce3408ded03a80e9839d59c9e7ee798f53e0387168295df851a241c8ce5a7094002fc55c1a66f9e609ea2409393aeb7f8902fcfb60db30dde50ac8f677ad022ab20fcf35644f0090f1861caf534652a239e63533b1a1d4251af75bb0ab1e3bffcf118f464e5f296a5e488bc804019abdcd6deed70d74ab439ff1b9839c7a8666aefe533565f6c6146cfd6ee47347c7dd230d2bfddd5b171026823367db7821b2c9b936b83cd77a9374bfba82530c6b3267130c"], 0x3, 0x6b4, &(0x7f0000000180)="$eJzs3U9sHFcdB/DvbJx1Nkip+y8NCKlWI1XQiMTOqiRISA0IoRwiFMGlVytxGiubtHJclFaIbICCxIkT6oFDURUOPSGEkMoJUc5ISFw45R6pNw45AEYzO7te2xvH29het/18pPF7s2/ee7/5Zf54Z2NtgM+t86/mYDdFzp+4cKtcv3e33bl3t329X08ynaSRTPWKFK2k+Cg5l96SL5Yv1sMVD5vn5fsfFlPvftDurZVjvX+w3r6xVb9NRm7ZTQ4NVg4kme1V/7PtYTeNVy3VOJfWxnu46a0ai0HcZcKO9xMHk7a6SXetsfHI7ts/b4F963bvvrnJTHI4vbtrdYurrw6PvjJM3pbXpu7exQEAAAC7ZeR7+WFPPMiD3MqRvQkHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPhuK3ncGFvXS6NdnU/S//7859J36zQmH+5jeuVIV339i0oEAAAAAAAAAwGN5/kEe5FaO9NdXi+oz/xeqlWeqn1/Im7mZxSznZG5lIStZyXLmk8wMDdS8tbCysjy/ueevU/ZcXV29Xfc8PbLn6fVxdTcGOup/GmzaCAAAAAAAAAA+t36S82uf/wMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwH5QJAd6RbU806/PpDGV5FCSZjE72Lw50WB3wF8mHQAAAADsvlZdHin+16usFtV7/qPV+/5DeTM3spKlrKSTxVyungX03vU3/tFtd+7dbV8vl80Df+vjseKoRkzv2cPomeeqLZ4d9Dif7+YHOZHZXMxylvLDLGQli5nNd6raQorM1E8vZu7dbaUf6+Z4z61bu7gxtueH6mV8x6pIWrmSpSq2k7nU7IfeqLc7NjTbn5rJhhnvlNkpXqltM0eX67Lco1/V5Y478Ek6zVR7fnCQkbk692U2nhzO++bcj3mcbJxpPo3BM6hn1mYpVzfOdOfj5vg5P1yXZa5/vls57xnzUdr6THR/Wa71j76jW+c8+eo//3rxauPGtatXbp7YxV3aGxuPifZQJp7bViY6ZSa6j5GJQ48T/85p1tnoncTjXS1fqPoeyVK+l9dzOYs5k7nM52zm8o2cTjunh/L67NZ5ra5vjfHOteNfqSvlPekXQ/emPTP9sIYyr08O5XX4SjdTtQ2/spalp7aRpaKZ0Vn618hQpr5UV8o5fjp0x5m8jZmYH8rE01tn4rf/XU1ys3Pj2vLVhTe2Od+LdVmetu+svza/vyM7NL56d8vj5anyHyu928bw0VG2Pd1v25CvZv2Jy1Q92Lq2Zqrzudf2qDO1HOnonVEj9dqeGzlLu2o7NtS27recvJ7O4LcQAPaxwy8dbrbut/7eeq/1s9bV1oVD354+O/3lZg7+berPB37f+F3jm8VLeS8/zpFJRwoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJ8FN996+9pCp7O4vA8raezwgHdGNvVT0XuluT/2/dNamd7qiPpDki26NycRcyvJvkhdpvZgrumMaLoweKWVNAbxJLm2T77gDtgNp1auv3Hq5ltvf23p+sJri68t3jh99swrZ9pfn7996spSZ3Gu93PSUQK7Ye3XgElHAgAAAAAAAAAAAGzXWH9F0Mwn+tuDEdMW3QnsKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPDpdP7VHOymyPzcybly/d7ddqdc+vW1LaeSNJIUP0qKj5Jz6S2ZGRqueNg8L9//8DcvvvtBe22sqf72jQ39/vjv1dUx96JbL5lNcqAuH216W+NdqsrmoGF8xWAPy4Qd7ycOJu3/AQAA//9Hgwei") syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000240)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x2b1245d, 0x0, 0xfc, 0x0, &(0x7f00000000c0)) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, 0x0) r0 = socket$caif_seqpacket(0x25, 0x5, 0x4) setsockopt$CAIFSO_LINK_SELECT(r0, 0x116, 0x7f, 0x0, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000000140), 0x8, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0xd}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x800002) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x68, '\x00', 0x0, 0x2}, 0x94) r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000840), 0x8400, 0x0) ioctl$vim2m_VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405668, 0x0) ioctl$FS_IOC_SETFLAGS(r4, 0x40186f40, &(0x7f0000000440)=0x1f) setns(0xffffffffffffffff, 0x24020000) syz_clone(0x120e1100, 0x0, 0x0, 0x0, 0x0, 0x0) kernel console output (not intermixed with test programs): cketSize 0 [ 157.936791][ T22] usb 1-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 157.986776][ T22] usb 1-1: config 0 interface 0 has no altsetting 0 [ 158.007945][ T4311] usb 3-1: Using ep0 maxpacket: 32 [ 158.015744][ T4311] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 158.064011][ T4311] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 158.084983][ T22] usb 1-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 158.102398][ T4311] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 158.112288][ T22] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 158.146400][ T22] usb 1-1: Product: syz [ 158.151242][ T4311] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 158.161272][ T22] usb 1-1: Manufacturer: syz [ 158.176482][ T22] usb 1-1: SerialNumber: syz [ 158.198527][ T4311] usb 3-1: config 0 descriptor?? [ 158.226489][ T22] usb 1-1: config 0 descriptor?? [ 158.235295][ T4311] hub 3-1:0.0: USB hub found [ 158.253153][ T4371] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 158.413155][ T4311] hub 3-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 158.748018][ T27] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 158.819911][ T4311] hid-generic 0003:046D:C31C.0003: unknown main item tag 0x0 [ 158.911023][ T4311] hid-generic 0003:046D:C31C.0003: hidraw0: USB HID v8.00 Device [HID 046d:c31c] on usb-dummy_hcd.2-1/input0 [ 158.979682][ T27] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 159.007769][ T27] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 159.026531][ T27] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 159.056706][ T27] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 159.083198][ T27] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 159.111034][ T27] usb 5-1: config 0 descriptor?? [ 159.547614][ T27] usbhid 5-1:0.0: can't add hid device: -71 [ 159.556326][ T27] usbhid: probe of 5-1:0.0 failed with error -71 [ 159.568371][ T4791] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 159.589948][ T27] usb 5-1: USB disconnect, device number 7 [ 159.758097][ T4791] usb 2-1: Using ep0 maxpacket: 32 [ 159.766945][ T4791] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 159.790887][ T4791] usb 2-1: config 0 has no interface number 0 [ 159.808865][ T4791] usb 2-1: config 0 interface 184 has no altsetting 0 [ 159.826612][ T4791] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 159.847206][ T22] usb 1-1: can't set config #0, error -71 [ 159.856561][ T4791] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 159.882401][ T22] usb 1-1: USB disconnect, device number 7 [ 159.895252][ T4791] usb 2-1: Product: syz [ 159.903408][ T4791] usb 2-1: Manufacturer: syz [ 159.908965][ T4791] usb 2-1: SerialNumber: syz [ 159.915918][ T4791] usb 2-1: config 0 descriptor?? [ 159.930452][ T4791] smsc75xx v1.0.0 [ 160.056171][ T5031] loop0: detected capacity change from 0 to 4096 [ 160.074148][ T5031] ntfs3: loop0: Different NTFS' sector size (4096) and media sector size (512) [ 160.136581][ T5031] ntfs3: loop0: Mark volume as dirty due to NTFS errors [ 160.276343][ T5033] loop4: detected capacity change from 0 to 2048 [ 160.317415][ T5033] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 160.327472][ T5033] ext4 filesystem being mounted at /29/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 160.546965][ T5028] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 160.582913][ T5028] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 160.676761][ T4280] EXT4-fs (loop4): unmounting filesystem. [ 161.019054][ T22] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 161.059706][ T5048] binder: 5045:5048 ioctl c0306201 0 returned -14 [ 161.239944][ T4791] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -71 [ 161.255343][ T22] usb 1-1: Using ep0 maxpacket: 16 [ 161.297300][ T22] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 161.320656][ T4791] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 161.350914][ T22] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 161.363278][ T4791] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 161.375037][ T22] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 161.383712][ T4791] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 161.394005][ T22] usb 1-1: Product: syz [ 161.398961][ T4791] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 161.410573][ T22] usb 1-1: Manufacturer: syz [ 161.415754][ T22] usb 1-1: SerialNumber: syz [ 161.433419][ T22] usb 1-1: config 0 descriptor?? [ 161.438726][ T4791] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 161.473097][ T22] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 161.483842][ T4791] smsc75xx: probe of 2-1:0.184 failed with error -71 [ 161.497527][ T22] em28xx 1-1:0.0: DVB interface 0 found: bulk [ 161.521990][ T4791] usb 2-1: USB disconnect, device number 10 [ 162.093450][ T22] em28xx 1-1:0.0: unknown em28xx chip ID (0) [ 162.444176][ T4791] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 162.513305][ T22] em28xx 1-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 162.522270][ T22] em28xx 1-1:0.0: board has no eeprom [ 162.617768][ T5063] input: syz1 as /devices/virtual/input/input8 [ 162.643934][ T4791] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 162.684172][ T4791] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 162.706549][ T4791] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 162.744675][ T4791] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 162.757732][ T4791] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 162.772221][ T4791] usb 2-1: config 0 descriptor?? [ 162.800932][ T22] em28xx 1-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 162.814059][ T22] em28xx 1-1:0.0: dvb set to bulk mode. [ 162.863055][ T22] usb 1-1: USB disconnect, device number 8 [ 162.873409][ T22] em28xx 1-1:0.0: Disconnecting em28xx [ 162.894814][ T4350] em28xx 1-1:0.0: Binding DVB extension [ 163.090348][ T4350] em28xx 1-1:0.0: Registering input extension [ 163.096769][ T22] em28xx 1-1:0.0: Closing input extension [ 163.118568][ T22] em28xx 1-1:0.0: Freeing device [ 163.188823][ T4791] usbhid 2-1:0.0: can't add hid device: -71 [ 163.194965][ T4791] usbhid: probe of 2-1:0.0 failed with error -71 [ 163.235923][ T4791] usb 2-1: USB disconnect, device number 11 [ 163.343548][ T4311] usb 3-1: USB disconnect, device number 7 [ 163.776995][ T5076] loop2: detected capacity change from 0 to 4096 [ 163.860676][ T5076] ntfs3: loop2: Different NTFS' sector size (4096) and media sector size (512) [ 163.946745][ T5076] ntfs3: loop2: Mark volume as dirty due to NTFS errors [ 165.278061][ T7] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 165.387501][ T5098] loop3: detected capacity change from 0 to 1024 [ 165.398930][ T5098] EXT4-fs: Ignoring removed orlov option [ 165.405118][ T5098] EXT4-fs: quotafile must be on filesystem root [ 165.994669][ T5103] Zero length message leads to an empty skb [ 166.039104][ T4311] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 166.118037][ T7] usb 1-1: Using ep0 maxpacket: 16 [ 166.125542][ T7] usb 1-1: config 0 has no interfaces? [ 166.143468][ T7] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 166.163267][ T7] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 166.174417][ T7] usb 1-1: Manufacturer: syz [ 166.186676][ T7] usb 1-1: config 0 descriptor?? [ 166.217163][ C1] vcan0: j1939_tp_rxtimer: 0xffff888027755c00: rx timeout, send abort [ 166.258100][ T4311] usb 2-1: Using ep0 maxpacket: 32 [ 166.266684][ T4311] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 166.279698][ T4311] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 166.292302][ T4311] usb 2-1: config 0 descriptor?? [ 166.338035][ T4333] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 166.453499][ T4324] usb 1-1: USB disconnect, device number 9 [ 166.498339][ T7] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 166.512681][ T4311] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 166.522165][ T4311] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 166.528831][ T4333] usb 4-1: Using ep0 maxpacket: 16 [ 166.534441][ T4311] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 166.547235][ T4311] usb 2-1: media controller created [ 166.553758][ T4333] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 166.572475][ T4333] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 166.583481][ T4311] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 166.597310][ T4333] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 166.607525][ T4333] usb 4-1: Product: syz [ 166.616750][ T4333] usb 4-1: Manufacturer: syz [ 166.623038][ T4333] usb 4-1: SerialNumber: syz [ 166.633256][ T4333] usb 4-1: config 0 descriptor?? [ 166.642662][ T4333] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 166.654929][ T4333] em28xx 4-1:0.0: DVB interface 0 found: bulk [ 166.692128][ T7] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 166.703648][ T7] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 166.715106][ T7] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 166.718862][ C1] vcan0: j1939_tp_rxtimer: 0xffff888027756c00: rx timeout, send abort [ 166.737756][ T5102] netlink: 36 bytes leftover after parsing attributes in process `syz.1.197'. [ 166.752640][ C1] vcan0: j1939_tp_rxtimer: 0xffff888027755c00: abort rx timeout. Force session deactivation [ 166.757235][ T5102] netlink: 36 bytes leftover after parsing attributes in process `syz.1.197'. [ 166.778478][ T7] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 166.796366][ T7] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 166.824388][ T7] usb 3-1: config 0 descriptor?? [ 166.831699][ T5102] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 166.857542][ T5102] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 166.915597][ T5102] netlink: 16 bytes leftover after parsing attributes in process `syz.1.197'. [ 166.937275][ T5102] netlink: 32 bytes leftover after parsing attributes in process `syz.1.197'. [ 166.956945][ T5102] device gre0 entered promiscuous mode [ 166.980032][ T5102] az6027: more than 2 i2c messages at a time is not handled yet. TODO. [ 166.993138][ T5109] loop4: detected capacity change from 0 to 4096 [ 167.033672][ T4311] az6027: usb out operation failed. (-71) [ 167.048219][ T4311] az6027: usb out operation failed. (-71) [ 167.068971][ T5109] ntfs3: loop4: Different NTFS' sector size (4096) and media sector size (512) [ 167.079745][ T4311] stb0899_attach: Driver disabled by Kconfig [ 167.086102][ T4311] az6027: no front-end attached [ 167.086102][ T4311] [ 167.104317][ T4311] az6027: usb out operation failed. (-71) [ 167.110688][ T4311] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 167.151740][ T5109] ntfs3: loop4: Mark volume as dirty due to NTFS errors [ 167.180131][ T4311] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input10 [ 167.194041][ T4311] dvb-usb: schedule remote query interval to 400 msecs. [ 167.201399][ T4311] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 167.214304][ T4311] usb 2-1: USB disconnect, device number 12 [ 167.238984][ C1] vcan0: j1939_tp_rxtimer: 0xffff888027756c00: abort rx timeout. Force session deactivation [ 167.259771][ T4333] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 167.268669][ T7] usbhid 3-1:0.0: can't add hid device: -71 [ 167.274912][ T7] usbhid: probe of 3-1:0.0 failed with error -71 [ 167.300350][ T7] usb 3-1: USB disconnect, device number 8 [ 167.524846][ T4311] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 167.554092][ T5114] loop0: detected capacity change from 0 to 2048 [ 167.625870][ T5114] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 167.661194][ T5114] ext4 filesystem being mounted at /41/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 167.705056][ T4333] em28xx 4-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 167.735059][ T4333] em28xx 4-1:0.0: board has no eeprom [ 167.786205][ T5119] overlayfs: missing 'lowerdir' [ 167.798922][ T4324] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 167.961506][ T4269] EXT4-fs (loop0): unmounting filesystem. [ 167.997936][ T4324] usb 5-1: device descriptor read/64, error -71 [ 168.099087][ T4333] em28xx 4-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 168.107251][ T4333] em28xx 4-1:0.0: dvb set to bulk mode. [ 168.124385][ T7] em28xx 4-1:0.0: Binding DVB extension [ 168.149271][ T4333] usb 4-1: USB disconnect, device number 8 [ 168.204416][ T4333] em28xx 4-1:0.0: Disconnecting em28xx [ 168.267926][ T4324] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 168.409334][ T7] em28xx 4-1:0.0: Registering input extension [ 168.420623][ T4333] em28xx 4-1:0.0: Closing input extension [ 168.428147][ T4324] usb 5-1: device descriptor read/64, error -71 [ 168.444507][ T4333] em28xx 4-1:0.0: Freeing device [ 168.559297][ T4324] usb usb5-port1: attempt power cycle [ 169.008228][ T4324] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 169.058623][ T4324] usb 5-1: device descriptor read/8, error -71 [ 169.327946][ T4324] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 169.368921][ T4324] usb 5-1: device descriptor read/8, error -71 [ 169.391652][ C1] vcan0: j1939_tp_rxtimer: 0xffff888027684000: rx timeout, send abort [ 169.492256][ T4324] usb usb5-port1: unable to enumerate USB device [ 169.891673][ C1] vcan0: j1939_tp_rxtimer: 0xffff888027684400: rx timeout, send abort [ 169.901241][ C1] vcan0: j1939_tp_rxtimer: 0xffff888027684000: abort rx timeout. Force session deactivation [ 170.400919][ C1] vcan0: j1939_tp_rxtimer: 0xffff888027684400: abort rx timeout. Force session deactivation [ 170.717782][ T5165] binder: 5163:5165 ioctl 4018620d 0 returned -22 [ 171.440549][ T5181] loop1: detected capacity change from 0 to 64 [ 171.929588][ T7] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 172.168183][ T7] usb 1-1: Using ep0 maxpacket: 8 [ 172.178879][ T7] usb 1-1: no configurations [ 172.192862][ T7] usb 1-1: can't read configurations, error -22 [ 172.368096][ T7] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 172.558259][ T7] usb 1-1: Using ep0 maxpacket: 8 [ 172.564838][ T7] usb 1-1: no configurations [ 172.585435][ T7] usb 1-1: can't read configurations, error -22 [ 172.605166][ T7] usb usb1-port1: attempt power cycle [ 172.638908][ T5202] loop4: detected capacity change from 0 to 4096 [ 172.654833][ T5202] ntfs3: loop4: Different NTFS' sector size (4096) and media sector size (512) [ 172.761196][ T5202] ntfs3: loop4: Mark volume as dirty due to NTFS errors [ 173.038293][ T7] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 173.078743][ T7] usb 1-1: Using ep0 maxpacket: 8 [ 173.084932][ T7] usb 1-1: no configurations [ 173.106503][ T5208] loop2: detected capacity change from 0 to 2048 [ 173.117990][ T7] usb 1-1: can't read configurations, error -22 [ 173.174876][ T5208] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 173.228389][ T5208] ext4 filesystem being mounted at /57/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 173.297994][ T7] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 173.350327][ T7] usb 1-1: Using ep0 maxpacket: 8 [ 173.361727][ T5215] overlayfs: missing 'lowerdir' [ 173.371843][ T7] usb 1-1: no configurations [ 173.384743][ T7] usb 1-1: can't read configurations, error -22 [ 173.400840][ T7] usb usb1-port1: unable to enumerate USB device [ 173.427988][ T4311] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 173.459539][ T4277] EXT4-fs (loop2): unmounting filesystem. [ 173.618078][ T4311] usb 4-1: Using ep0 maxpacket: 8 [ 173.625474][ T4311] usb 4-1: config 2 has an invalid interface number: 31 but max is 0 [ 173.654079][ T4311] usb 4-1: config 2 has no interface number 0 [ 173.705005][ T4311] usb 4-1: config 2 interface 31 has no altsetting 0 [ 173.727599][ T4311] usb 4-1: New USB device found, idVendor=1a86, idProduct=e092, bcdDevice=53.3f [ 173.757967][ T4311] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 173.797423][ T4311] usb 4-1: Product: syz [ 173.803251][ T4311] usb 4-1: Manufacturer: syz [ 173.819148][ T5219] loop2: detected capacity change from 0 to 8192 [ 173.830369][ T4311] usb 4-1: SerialNumber: syz [ 173.927520][ T5219] syz.2.238: attempt to access beyond end of device [ 173.927520][ T5219] loop2: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 173.941443][ T5219] Buffer I/O error on dev loop2, logical block 57847, async page read [ 173.953297][ T5219] syz.2.238: attempt to access beyond end of device [ 173.953297][ T5219] loop2: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 173.967239][ T5219] Buffer I/O error on dev loop2, logical block 57847, async page read [ 173.976378][ T26] audit: type=1800 audit(1773904024.856:30): pid=5219 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.238" name="file2" dev="loop2" ino=1048602 res=0 errno=0 [ 174.268745][ T4311] ch9200: probe of 4-1:2.31 failed with error -22 [ 174.305977][ T4311] usb 4-1: USB disconnect, device number 9 [ 175.065706][ T5240] netlink: 12 bytes leftover after parsing attributes in process `syz.2.247'. [ 175.235588][ T5237] loop3: detected capacity change from 0 to 4096 [ 175.257566][ T5237] ntfs3: loop3: Different NTFS' sector size (4096) and media sector size (512) [ 175.322336][ T5237] ntfs3: loop3: Mark volume as dirty due to NTFS errors [ 175.864651][ T5258] input: syz0 as /devices/virtual/input/input12 [ 176.008377][ T5252] binder: 5248:5252 ioctl c0306201 0 returned -14 [ 176.038305][ T22] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 176.409172][ T22] usb 4-1: Using ep0 maxpacket: 8 [ 176.415347][ T22] usb 4-1: too many configurations: 35, using maximum allowed: 8 [ 176.425665][ T22] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 176.436649][ T22] usb 4-1: can't read configurations, error -61 [ 176.608025][ T22] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 176.767936][ T7] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 176.908181][ T22] usb 4-1: Using ep0 maxpacket: 8 [ 176.914432][ T22] usb 4-1: too many configurations: 35, using maximum allowed: 8 [ 176.936420][ T22] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 176.996951][ T22] usb 4-1: can't read configurations, error -61 [ 177.040414][ T22] usb usb4-port1: attempt power cycle [ 177.114771][ T7] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 177.157064][ T7] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 177.171670][ T7] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 177.182022][ T7] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 177.209972][ T5262] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 177.467966][ T22] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 177.529801][ T22] usb 4-1: Using ep0 maxpacket: 8 [ 177.539103][ T22] usb 4-1: too many configurations: 35, using maximum allowed: 8 [ 177.577732][ T22] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 177.648765][ T22] usb 4-1: can't read configurations, error -61 [ 177.724614][ T7] usb 3-1: USB disconnect, device number 9 [ 177.743900][ T5282] loop1: detected capacity change from 0 to 64 [ 177.858049][ T22] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 177.898376][ T26] audit: type=1800 audit(1773904028.766:31): pid=5282 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.262" name="file1" dev="loop1" ino=22 res=0 errno=0 [ 177.921900][ T22] usb 4-1: Using ep0 maxpacket: 8 [ 177.935144][ T22] usb 4-1: too many configurations: 35, using maximum allowed: 8 [ 177.986715][ T22] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 178.024217][ T22] usb 4-1: can't read configurations, error -61 [ 178.036715][ T22] usb usb4-port1: unable to enumerate USB device [ 178.522308][ T5288] loop4: detected capacity change from 0 to 1024 [ 178.824536][ T5291] ubi: mtd0 is already attached to ubi31 [ 179.339918][ T11] hfsplus: b-tree write err: -5, ino 25 [ 179.346147][ T11] hfsplus: b-tree write err: -5, ino 4 [ 179.438194][ T11] hfsplus: b-tree write err: -5, ino 2 [ 179.451117][ T11] hfsplus: b-tree write err: -5, ino 26 [ 180.066518][ T5309] loop3: detected capacity change from 0 to 64 [ 180.185303][ T26] audit: type=1800 audit(1773904031.056:32): pid=5309 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.273" name="file1" dev="loop3" ino=22 res=0 errno=0 [ 180.740162][ T5320] netlink: 16 bytes leftover after parsing attributes in process `syz.3.278'. [ 181.148366][ T5330] loop1: detected capacity change from 0 to 1024 [ 181.237969][ T22] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 181.522428][ T4333] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 181.535545][ T5340] ubi: mtd0 is already attached to ubi31 [ 181.590167][ T22] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 181.617705][ T22] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 181.652707][ T22] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 181.677931][ T22] usb 5-1: config 0 descriptor?? [ 181.694116][ T22] pwc: Askey VC010 type 2 USB webcam detected. [ 181.707965][ T4333] usb 3-1: Using ep0 maxpacket: 32 [ 181.717504][ T4333] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 181.737987][ T4333] usb 3-1: config 0 has no interface number 0 [ 181.744360][ T4333] usb 3-1: config 0 interface 184 has no altsetting 0 [ 181.755137][ T4333] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 181.764724][ T4333] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 181.773015][ T4333] usb 3-1: Product: syz [ 181.777518][ T4333] usb 3-1: Manufacturer: syz [ 181.785973][ T4333] usb 3-1: SerialNumber: syz [ 181.800292][ T4333] usb 3-1: config 0 descriptor?? [ 181.814168][ T4333] smsc75xx v1.0.0 [ 182.002983][ T9] hfsplus: b-tree write err: -5, ino 25 [ 182.009141][ T9] hfsplus: b-tree write err: -5, ino 4 [ 182.039626][ T9] hfsplus: b-tree write err: -5, ino 2 [ 182.060277][ T9] hfsplus: b-tree write err: -5, ino 26 [ 182.328970][ T22] pwc: recv_control_msg error -32 req 02 val 2b00 [ 182.346466][ T22] pwc: recv_control_msg error -32 req 02 val 2700 [ 182.357367][ T22] pwc: recv_control_msg error -32 req 02 val 2c00 [ 182.366386][ T22] pwc: recv_control_msg error -32 req 04 val 1000 [ 182.375219][ T22] pwc: recv_control_msg error -32 req 04 val 1300 [ 182.382639][ T22] pwc: recv_control_msg error -32 req 04 val 1400 [ 182.395121][ T22] pwc: recv_control_msg error -32 req 02 val 2000 [ 182.414887][ T22] pwc: recv_control_msg error -32 req 02 val 2100 [ 182.435490][ T22] pwc: recv_control_msg error -32 req 04 val 1500 [ 182.461399][ T22] pwc: recv_control_msg error -32 req 02 val 2500 [ 182.497226][ T22] pwc: recv_control_msg error -32 req 02 val 2400 [ 182.542401][ T22] pwc: recv_control_msg error -32 req 02 val 2600 [ 182.578301][ T22] pwc: recv_control_msg error -32 req 02 val 2900 [ 182.819896][ T22] pwc: recv_control_msg error -71 req 04 val 1100 [ 182.836858][ T22] pwc: recv_control_msg error -71 req 04 val 1200 [ 182.877690][ T22] pwc: Registered as video103. [ 182.934934][ T22] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input13 [ 183.019192][ T22] usb 5-1: USB disconnect, device number 12 [ 183.135356][ T4333] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -71 [ 183.161161][ T4333] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 183.193631][ T4333] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 183.228099][ T4333] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 183.254931][ T4333] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 183.285700][ T4333] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 183.326425][ T4333] smsc75xx: probe of 3-1:0.184 failed with error -71 [ 183.399160][ T4333] usb 3-1: USB disconnect, device number 10 [ 185.711506][ T5395] 9pnet_fd: Insufficient options for proto=fd [ 186.251301][ T5409] binder: BINDER_SET_CONTEXT_MGR already set [ 186.276995][ T5409] binder: 5408:5409 ioctl 4018620d 200000004a80 returned -16 [ 188.353767][ T5439] loop2: detected capacity change from 0 to 2048 [ 188.588024][ T5439] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 188.628689][ T5439] ext4 filesystem being mounted at /69/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 189.419871][ T5451] overlayfs: failed to create directory ./bus/index (errno: 28); mounting read-only [ 189.528056][ T5451] overlayfs: try deleting index dir or mounting with '-o index=off' to disable inodes index. [ 189.580196][ T5459] binder: BINDER_SET_CONTEXT_MGR already set [ 189.621011][ T5459] binder: 5458:5459 ioctl 4018620d 200000004a80 returned -16 [ 190.469437][ T4277] EXT4-fs (loop2): unmounting filesystem. [ 190.743466][ T26] audit: type=1804 audit(1773904041.616:33): pid=5481 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.327" name="/newroot/58/file1" dev="fuse" ino=1 res=1 errno=0 [ 191.303289][ T4791] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 191.500880][ T5500] binder: 5495:5500 ioctl c0306201 0 returned -14 [ 191.518152][ T4791] usb 1-1: Using ep0 maxpacket: 32 [ 191.534756][ T4791] usb 1-1: config 0 has an invalid interface number: 184 but max is 0 [ 191.547991][ T4791] usb 1-1: config 0 has no interface number 0 [ 191.555089][ T4791] usb 1-1: config 0 interface 184 has no altsetting 0 [ 191.575975][ T4791] usb 1-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 191.593437][ T4791] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 191.605196][ T4791] usb 1-1: Product: syz [ 191.611894][ T4791] usb 1-1: Manufacturer: syz [ 191.617415][ T4791] usb 1-1: SerialNumber: syz [ 191.656118][ T4791] usb 1-1: config 0 descriptor?? [ 191.691182][ T4791] smsc75xx v1.0.0 [ 192.117072][ T5488] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 192.138314][ T5488] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 192.225831][ T5503] loop1: detected capacity change from 0 to 2048 [ 192.358345][ T5503] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 192.418185][ T5503] ext4 filesystem being mounted at /73/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 192.769510][ T4791] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 192.810613][ T4791] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 192.822033][ T4791] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 192.834945][ T4791] smsc75xx: probe of 1-1:0.184 failed with error -71 [ 192.870759][ T4791] usb 1-1: USB disconnect, device number 14 [ 193.237075][ T5511] overlayfs: failed to create directory ./bus/index (errno: 28); mounting read-only [ 193.312343][ T5511] overlayfs: try deleting index dir or mounting with '-o index=off' to disable inodes index. [ 193.477074][ T4268] EXT4-fs (loop1): unmounting filesystem. [ 193.553922][ T5519] ipt_CLUSTERIP: Please specify destination IP [ 194.177993][ T4791] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 194.663209][ T4791] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 194.695777][ T4791] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 194.744515][ T4791] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 194.768054][ T4791] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 194.809388][ T5049] kernel write not supported for file /vcs (pid: 5049 comm: kworker/1:10) [ 194.826518][ T5530] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 195.120837][ T7] usb 2-1: USB disconnect, device number 13 [ 197.010605][ T7] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 197.199635][ T7] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 197.224477][ T7] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 197.255845][ T7] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 197.279951][ T7] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 197.310099][ T7] usb 5-1: SerialNumber: syz [ 197.437008][ T5565] netlink: 8 bytes leftover after parsing attributes in process `syz.0.352'. [ 197.552305][ T7] usb 5-1: 0:2 : does not exist [ 197.636000][ T7] usb 5-1: USB disconnect, device number 13 [ 197.694125][ T4371] udevd[4371]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 197.871516][ T4324] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 198.105253][ T5573] netlink: 4768 bytes leftover after parsing attributes in process `syz.3.356'. [ 198.119445][ T4324] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 198.148069][ T4324] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 198.181663][ T5573] netlink: 4768 bytes leftover after parsing attributes in process `syz.3.356'. [ 198.191762][ T4324] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 198.222840][ T4324] usb 3-1: config 0 descriptor?? [ 198.262208][ T4324] pwc: Askey VC010 type 2 USB webcam detected. [ 198.699089][ T7] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 198.763182][ T4324] pwc: recv_control_msg error -32 req 02 val 2b00 [ 198.772218][ T4324] pwc: recv_control_msg error -32 req 02 val 2700 [ 198.791369][ T4324] pwc: recv_control_msg error -32 req 02 val 2c00 [ 198.820411][ T4324] pwc: recv_control_msg error -32 req 04 val 1000 [ 198.841296][ T4324] pwc: recv_control_msg error -32 req 04 val 1300 [ 198.853148][ T4324] pwc: recv_control_msg error -32 req 04 val 1400 [ 198.861404][ T4324] pwc: recv_control_msg error -32 req 02 val 2000 [ 198.878830][ T4324] pwc: recv_control_msg error -32 req 02 val 2100 [ 198.900612][ T4324] pwc: recv_control_msg error -32 req 04 val 1500 [ 198.911396][ T4324] pwc: recv_control_msg error -32 req 02 val 2500 [ 198.928049][ T4324] pwc: recv_control_msg error -32 req 02 val 2400 [ 198.935862][ T4324] pwc: recv_control_msg error -32 req 02 val 2600 [ 198.942754][ T7] usb 1-1: Using ep0 maxpacket: 8 [ 198.953091][ T7] usb 1-1: config 2 has an invalid interface number: 31 but max is 0 [ 198.963146][ T4324] pwc: recv_control_msg error -32 req 02 val 2900 [ 198.974700][ T7] usb 1-1: config 2 has no interface number 0 [ 198.989938][ T7] usb 1-1: config 2 interface 31 has no altsetting 0 [ 199.005689][ T7] usb 1-1: New USB device found, idVendor=1a86, idProduct=e092, bcdDevice=53.3f [ 199.016371][ T7] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 199.025808][ T7] usb 1-1: Product: syz [ 199.031334][ T7] usb 1-1: Manufacturer: syz [ 199.036577][ T7] usb 1-1: SerialNumber: syz [ 199.152068][ T11] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 199.175135][ T4324] pwc: recv_control_msg error -71 req 04 val 1100 [ 199.196582][ T4324] pwc: recv_control_msg error -71 req 04 val 1200 [ 199.216827][ T4324] pwc: Registered as video103. [ 199.263157][ T4324] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input14 [ 199.323540][ T4324] usb 3-1: USB disconnect, device number 11 [ 199.431076][ T11] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 199.674922][ T7] ch9200: probe of 1-1:2.31 failed with error -22 [ 199.738138][ T7] usb 1-1: USB disconnect, device number 15 [ 199.762509][ T1276] ieee802154 phy0 wpan0: encryption failed: -22 [ 199.770236][ T1276] ieee802154 phy1 wpan1: encryption failed: -22 [ 199.906267][ T11] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 199.997106][ T5587] binder: 5586:5587 ioctl c0306201 0 returned -14 [ 200.090287][ T11] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 202.238141][ T7] usb 3-1: new full-speed USB device number 12 using dummy_hcd [ 202.302502][ T4272] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 202.313759][ T4272] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 202.325191][ T4272] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 202.333785][ T4272] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 202.343430][ T4272] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 202.351490][ T4272] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 202.453592][ T7] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 202.479869][ T7] usb 3-1: config 0 has no interfaces? [ 202.528010][ T4324] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 202.564374][ T7] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 202.709795][ T7] usb 3-1: config 0 has no interfaces? [ 202.814388][ T5619] No such timeout policy "syz0" [ 202.840593][ T5619] loop0: detected capacity change from 0 to 1024 [ 202.849328][ T4324] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 202.889693][ T5619] EXT4-fs (loop0): unsupported inode size: 8 [ 202.896106][ T5619] EXT4-fs (loop0): blocksize: 1024 [ 203.609519][ T7] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 203.678591][ T4324] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 203.690484][ T7] usb 3-1: config 0 has no interfaces? [ 203.707038][ T4324] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 203.878016][ T4324] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 203.925264][ T4324] usb 5-1: SerialNumber: syz [ 203.931091][ T7] usb 3-1: New USB device found, idVendor=0451, idProduct=5152, bcdDevice=c0.b9 [ 203.946911][ T7] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 204.001462][ T7] usb 3-1: Product: syz [ 204.112215][ T5625] binder: 5623:5625 ioctl c0306201 0 returned -14 [ 204.399758][ T4272] Bluetooth: hci0: command 0x0409 tx timeout [ 204.447610][ T7] usb 3-1: Manufacturer: syz [ 204.524355][ T4324] usb 5-1: 0:2 : does not exist [ 204.593122][ T7] usb 3-1: SerialNumber: syz [ 204.666885][ T7] usb 3-1: config 0 descriptor?? [ 204.674565][ T4324] usb 5-1: USB disconnect, device number 14 [ 204.948926][ T4371] udevd[4371]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 205.568005][ T4324] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 206.045852][ T5611] chnl_net:caif_netlink_parms(): no params data found [ 206.108160][ T4324] usb 1-1: Using ep0 maxpacket: 8 [ 206.115176][ T4324] usb 1-1: config 2 has an invalid interface number: 31 but max is 0 [ 206.167571][ T5647] netlink: 16 bytes leftover after parsing attributes in process `syz.3.377'. [ 206.197906][ T4324] usb 1-1: config 2 has no interface number 0 [ 206.204443][ T4324] usb 1-1: config 2 interface 31 has no altsetting 0 [ 206.247532][ T4324] usb 1-1: New USB device found, idVendor=1a86, idProduct=e092, bcdDevice=53.3f [ 206.420057][ T4324] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 206.448701][ T4324] usb 1-1: Product: syz [ 206.462337][ T4324] usb 1-1: Manufacturer: syz [ 206.468445][ T4324] usb 1-1: SerialNumber: syz [ 206.484642][ T4276] Bluetooth: hci0: command 0x041b tx timeout [ 206.958167][ T4276] Bluetooth: hci1: command 0x0406 tx timeout [ 206.964821][ T4272] Bluetooth: hci2: command 0x0406 tx timeout [ 206.964951][ T4270] Bluetooth: hci4: command 0x0406 tx timeout [ 206.977333][ T48] Bluetooth: hci3: command 0x0406 tx timeout [ 207.069545][ T7] usb 3-1: USB disconnect, device number 12 [ 207.112388][ T4324] ch9200: probe of 1-1:2.31 failed with error -22 [ 207.128146][ T4324] usb 1-1: USB disconnect, device number 16 [ 207.159909][ T5664] loop4: detected capacity change from 0 to 1024 [ 207.451618][ T5669] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.383'. [ 207.543203][ T5671] ubi: mtd0 is already attached to ubi31 [ 207.760696][ T5669] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.383'. [ 208.087710][ T4323] hfsplus: b-tree write err: -5, ino 25 [ 208.108128][ T4323] hfsplus: b-tree write err: -5, ino 4 [ 208.113795][ T4323] hfsplus: b-tree write err: -5, ino 2 [ 208.171803][ T4323] hfsplus: b-tree write err: -5, ino 26 [ 208.284966][ T5611] bridge0: port 1(bridge_slave_0) entered blocking state [ 208.313995][ T5611] bridge0: port 1(bridge_slave_0) entered disabled state [ 208.340037][ T5611] device bridge_slave_0 entered promiscuous mode [ 208.388154][ T4791] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 208.401323][ T5611] bridge0: port 2(bridge_slave_1) entered blocking state [ 208.408484][ T22] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 208.417522][ T5611] bridge0: port 2(bridge_slave_1) entered disabled state [ 208.433809][ T5611] device bridge_slave_1 entered promiscuous mode [ 208.488193][ T5683] netlink: 12 bytes leftover after parsing attributes in process `syz.4.386'. [ 208.558081][ T48] Bluetooth: hci0: command 0x040f tx timeout [ 208.608036][ T4791] usb 3-1: Using ep0 maxpacket: 16 [ 208.613658][ T22] usb 1-1: Using ep0 maxpacket: 16 [ 208.639122][ T4791] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 208.658115][ T22] usb 1-1: config 0 has no interfaces? [ 208.689635][ T22] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 208.703314][ T5686] loop4: detected capacity change from 0 to 1024 [ 208.733714][ T4791] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 208.764626][ T22] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 208.774115][ T4791] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 208.795054][ T22] usb 1-1: Manufacturer: syz [ 208.802627][ T4791] usb 3-1: Product: syz [ 208.818408][ T4791] usb 3-1: Manufacturer: syz [ 208.824869][ T22] usb 1-1: config 0 descriptor?? [ 208.858308][ T4791] usb 3-1: SerialNumber: syz [ 209.007047][ T4791] usb 3-1: config 0 descriptor?? [ 209.024467][ T4791] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 209.035102][ T4791] em28xx 3-1:0.0: DVB interface 0 found: bulk [ 209.050647][ T5687] ubi: mtd0 is already attached to ubi31 [ 209.056748][ T11] device hsr_slave_0 left promiscuous mode [ 209.077207][ T11] device hsr_slave_1 left promiscuous mode [ 209.113136][ T11] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 209.169968][ T11] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 209.218863][ T11] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 209.247665][ T11] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 209.257797][ T11] device bridge_slave_1 left promiscuous mode [ 209.266634][ T11] bridge0: port 2(bridge_slave_1) entered disabled state [ 209.297600][ T11] device bridge_slave_0 left promiscuous mode [ 209.305928][ T11] bridge0: port 1(bridge_slave_0) entered disabled state [ 209.452923][ T11] device veth1_macvtap left promiscuous mode [ 209.482013][ T11] device veth0_macvtap left promiscuous mode [ 209.495515][ T11] device veth1_vlan left promiscuous mode [ 209.504056][ T11] device veth0_vlan left promiscuous mode [ 209.603505][ T2946] hfsplus: b-tree write err: -5, ino 25 [ 209.629945][ T2946] hfsplus: b-tree write err: -5, ino 4 [ 209.637662][ T4791] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 209.667187][ T2946] hfsplus: b-tree write err: -5, ino 2 [ 209.683713][ T2946] hfsplus: b-tree write err: -5, ino 26 [ 210.064105][ T4791] em28xx 3-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 210.179795][ T4791] em28xx 3-1:0.0: board has no eeprom [ 210.287965][ T4791] em28xx 3-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 210.313772][ T4791] em28xx 3-1:0.0: dvb set to bulk mode. [ 210.375071][ T4791] usb 3-1: USB disconnect, device number 13 [ 210.410933][ T4791] em28xx 3-1:0.0: Disconnecting em28xx [ 210.443550][ T4340] em28xx 3-1:0.0: Binding DVB extension [ 210.638331][ T48] Bluetooth: hci0: command 0x0419 tx timeout [ 210.806884][ T4340] em28xx 3-1:0.0: Registering input extension [ 210.823951][ T4791] em28xx 3-1:0.0: Closing input extension [ 210.883570][ T4791] em28xx 3-1:0.0: Freeing device [ 211.255154][ T5719] loop4: detected capacity change from 0 to 2048 [ 211.273162][ T5720] loop3: detected capacity change from 0 to 2048 [ 211.342077][ T5722] 9pnet_fd: Insufficient options for proto=fd [ 211.351583][ T5719] NILFS (loop4): broken superblock, retrying with spare superblock (blocksize = 1024) [ 211.408205][ T5720] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 211.425521][ T5720] ext4 filesystem being mounted at /76/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 211.445051][ T5726] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 211.464680][ T5720] overlayfs: missing 'lowerdir' [ 211.729187][ T4275] EXT4-fs (loop3): unmounting filesystem. [ 212.095969][ T5731] binder: BINDER_SET_CONTEXT_MGR already set [ 212.133511][ T5731] binder: 5730:5731 ioctl 4018620d 200000004a80 returned -16 [ 212.448992][ T4333] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 212.482906][ T5739] loop3: detected capacity change from 0 to 1024 [ 212.493070][ T5739] EXT4-fs: Ignoring removed orlov option [ 212.499525][ T5739] EXT4-fs: quotafile must be on filesystem root [ 212.747991][ T4333] usb 3-1: Using ep0 maxpacket: 16 [ 212.763014][ T4333] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 212.925330][ T4333] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 212.990141][ T4333] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 213.057028][ T4333] usb 3-1: Product: syz [ 213.088248][ T4333] usb 3-1: Manufacturer: syz [ 213.123074][ T4333] usb 3-1: SerialNumber: syz [ 213.204888][ T4333] usb 3-1: config 0 descriptor?? [ 213.265292][ T4333] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 213.296391][ T5741] netlink: 4768 bytes leftover after parsing attributes in process `syz.3.403'. [ 213.304260][ T4333] em28xx 3-1:0.0: DVB interface 0 found: bulk [ 213.319437][ T5741] netlink: 4768 bytes leftover after parsing attributes in process `syz.3.403'. [ 213.859568][ T11] team0 (unregistering): Port device team_slave_1 removed [ 213.868491][ T4333] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 213.907696][ T5749] 9pnet_fd: Insufficient options for proto=fd [ 213.999781][ T11] team0 (unregistering): Port device team_slave_0 removed [ 214.073668][ T11] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 214.132219][ T11] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 214.285646][ T4340] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 214.323053][ T4333] em28xx 3-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 214.348740][ T4333] em28xx 3-1:0.0: board has no eeprom [ 214.468075][ T4333] em28xx 3-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 214.479715][ T4333] em28xx 3-1:0.0: dvb set to bulk mode. [ 214.485911][ T14] em28xx 3-1:0.0: Binding DVB extension [ 214.494932][ T4340] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 214.515007][ T4333] usb 3-1: USB disconnect, device number 14 [ 214.528175][ T4340] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 214.556840][ T4333] em28xx 3-1:0.0: Disconnecting em28xx [ 214.557604][ T4340] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 214.588008][ T4340] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 214.606336][ T4340] usb 4-1: SerialNumber: syz [ 214.663185][ T14] em28xx 3-1:0.0: Registering input extension [ 214.671504][ T4333] em28xx 3-1:0.0: Closing input extension [ 214.698711][ T4333] em28xx 3-1:0.0: Freeing device [ 214.799725][ T11] bond0 (unregistering): Released all slaves [ 214.851115][ T4340] usb 4-1: 0:2 : does not exist [ 214.890041][ T4340] usb 4-1: USB disconnect, device number 14 [ 214.969972][ T5611] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 214.984194][ T5754] loop2: detected capacity change from 0 to 2048 [ 215.014805][ T5737] netlink: 7 bytes leftover after parsing attributes in process `syz.4.400'. [ 215.074538][ T5611] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 215.117617][ T5754] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 215.140200][ T4371] udevd[4371]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 215.239709][ T5754] ext4 filesystem being mounted at /84/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 215.280204][ T5611] team0: Port device team_slave_0 added [ 215.305548][ T5754] overlayfs: missing 'lowerdir' [ 215.333920][ T5611] team0: Port device team_slave_1 added [ 215.413516][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 215.567948][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 215.735027][ T4277] EXT4-fs (loop2): unmounting filesystem. [ 215.785923][ T5611] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 215.825366][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 215.833574][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 215.890169][ T5763] loop4: detected capacity change from 0 to 2048 [ 215.941555][ T5611] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 215.961046][ T5763] NILFS (loop4): broken superblock, retrying with spare superblock (blocksize = 1024) [ 216.054528][ T5771] binder: 5769:5771 ioctl c0306201 0 returned -14 [ 216.550632][ T5773] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 216.699303][ T5611] device hsr_slave_0 entered promiscuous mode [ 216.747239][ T5611] device hsr_slave_1 entered promiscuous mode [ 216.786902][ T5611] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 216.816690][ T5611] Cannot create hsr debugfs directory [ 217.003467][ T26] audit: type=1804 audit(1773904067.876:34): pid=5781 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.412" name="/newroot/84/file2/bus" dev="loop4" ino=2097152 res=1 errno=0 [ 217.298173][ T5788] netlink: 16 bytes leftover after parsing attributes in process `syz.2.417'. [ 217.557645][ T5611] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 217.649858][ T5611] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 217.692467][ T5049] usb 1-1: USB disconnect, device number 17 [ 217.730205][ T5611] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 217.981116][ T5611] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 218.151596][ T5805] loop0: detected capacity change from 0 to 2048 [ 218.291477][ T5805] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 218.409630][ T5805] ext4 filesystem being mounted at /79/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 218.873226][ T5805] overlayfs: missing 'workdir' [ 218.995116][ T5611] 8021q: adding VLAN 0 to HW filter on device bond0 [ 219.064071][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 219.089033][ T4269] EXT4-fs (loop0): unmounting filesystem. [ 219.099086][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 219.129879][ T5611] 8021q: adding VLAN 0 to HW filter on device team0 [ 219.188659][ T4406] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 219.219813][ T4406] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 219.253670][ T4406] bridge0: port 1(bridge_slave_0) entered blocking state [ 219.261118][ T4406] bridge0: port 1(bridge_slave_0) entered forwarding state [ 219.328932][ T4406] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 219.368033][ T4406] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 219.400509][ T4406] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 219.437653][ T4406] bridge0: port 2(bridge_slave_1) entered blocking state [ 219.445197][ T4406] bridge0: port 2(bridge_slave_1) entered forwarding state [ 219.479000][ T26] audit: type=1326 audit(1773904070.356:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5830 comm="syz.0.430" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffac679c799 code=0x7ffc0000 [ 219.520310][ T4406] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 219.545393][ T4406] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 219.577044][ T4406] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 219.631948][ T26] audit: type=1326 audit(1773904070.386:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5830 comm="syz.0.430" exe="/root/syz-executor" sig=0 arch=c000003e syscall=293 compat=0 ip=0x7ffac679c799 code=0x7ffc0000 [ 219.688214][ T4415] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 219.737704][ T4406] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 219.868490][ T4406] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 219.887727][ T26] audit: type=1326 audit(1773904070.386:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5830 comm="syz.0.430" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffac679c799 code=0x7ffc0000 [ 219.914172][ T4415] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 219.936822][ T4406] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 219.947280][ T4406] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 219.956716][ T4406] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 219.965668][ T26] audit: type=1326 audit(1773904070.406:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5830 comm="syz.0.430" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7ffac679c799 code=0x7ffc0000 [ 219.996589][ T4406] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 220.024369][ T4406] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 220.042728][ T26] audit: type=1326 audit(1773904070.406:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5830 comm="syz.0.430" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffac679c799 code=0x7ffc0000 [ 220.048165][ T4415] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 220.077500][ T4406] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 220.101141][ T4415] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 220.114916][ T4415] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 220.140507][ T5611] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 220.168354][ T26] audit: type=1326 audit(1773904070.416:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5830 comm="syz.0.430" exe="/root/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7ffac679c799 code=0x7ffc0000 [ 220.217662][ T26] audit: type=1326 audit(1773904070.416:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5830 comm="syz.0.430" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffac679c799 code=0x7ffc0000 [ 220.337372][ T26] audit: type=1326 audit(1773904070.416:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5830 comm="syz.0.430" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7ffac679c799 code=0x7ffc0000 [ 220.424448][ T5834] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 220.432673][ T26] audit: type=1326 audit(1773904070.416:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5830 comm="syz.0.430" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffac679c799 code=0x7ffc0000 [ 220.948645][ T7] usb 3-1: USB disconnect, device number 15 [ 221.541570][ T4405] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 221.553222][ T4405] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 221.581764][ T5611] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 222.018351][ T5861] loop0: detected capacity change from 0 to 1024 [ 222.028461][ T5861] EXT4-fs: Ignoring removed orlov option [ 222.034409][ T5861] EXT4-fs: quotafile must be on filesystem root [ 223.965044][ T5867] No such timeout policy "syz0" [ 223.987579][ T5867] loop4: detected capacity change from 0 to 1024 [ 224.867867][ C1] sched: RT throttling activated [ 224.891819][ T5867] EXT4-fs (loop4): unsupported inode size: 8 [ 224.898056][ T5867] EXT4-fs (loop4): blocksize: 1024 [ 225.672623][ T5875] futex_wake_op: syz.4.435 tries to shift op by -1; fix this program [ 226.308123][ T5049] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 226.808057][ T5049] usb 1-1: Using ep0 maxpacket: 8 [ 226.813863][ T5049] usb 1-1: too many configurations: 35, using maximum allowed: 8 [ 226.884226][ T5049] usb 1-1: config 0 has no interfaces? [ 226.929203][ T5049] usb 1-1: config 0 has no interfaces? [ 226.975699][ T5049] usb 1-1: config 0 has no interfaces? [ 227.003658][ T5049] usb 1-1: config 0 has no interfaces? [ 227.031694][ T5049] usb 1-1: config 0 has no interfaces? [ 227.055766][ T5890] loop3: detected capacity change from 0 to 2048 [ 227.084541][ T5049] usb 1-1: config 0 has no interfaces? [ 227.134567][ T5049] usb 1-1: config 0 has no interfaces? [ 227.161101][ T5049] usb 1-1: config 0 has no interfaces? [ 227.178910][ T5890] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 227.189154][ T5049] usb 1-1: New USB device found, idVendor=0af0, idProduct=6751, bcdDevice=75.cb [ 227.248442][ T5890] ext4 filesystem being mounted at /94/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 227.270024][ T5890] overlayfs: missing 'workdir' [ 227.294727][ T5049] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 227.369757][ T4275] EXT4-fs (loop3): unmounting filesystem. [ 227.394377][ T5049] usb 1-1: config 0 descriptor?? [ 227.652123][ T4333] usb 1-1: USB disconnect, device number 18 [ 227.740501][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 227.773101][ T5903] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.442'. [ 227.783936][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 227.813159][ T5903] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.442'. [ 227.836486][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 227.851683][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 227.887283][ T5611] device veth0_vlan entered promiscuous mode [ 227.905195][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 227.946648][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 227.995254][ T5611] device veth1_vlan entered promiscuous mode [ 228.157207][ T4355] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 228.236753][ T4355] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 228.261046][ T5906] loop3: detected capacity change from 0 to 8192 [ 228.269614][ T4355] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 228.303440][ T4355] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 228.356384][ T5611] device veth0_macvtap entered promiscuous mode [ 228.379524][ T5911] netlink: 16 bytes leftover after parsing attributes in process `syz.2.444'. [ 228.780002][ T5611] device veth1_macvtap entered promiscuous mode [ 229.244178][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 229.411143][ T5919] syz.3.443: attempt to access beyond end of device [ 229.411143][ T5919] loop3: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 229.433472][ T5919] Buffer I/O error on dev loop3, logical block 57847, async page read [ 229.454802][ T5919] syz.3.443: attempt to access beyond end of device [ 229.454802][ T5919] loop3: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 229.475056][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 229.548240][ T5919] Buffer I/O error on dev loop3, logical block 57847, async page read [ 229.577528][ T5611] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 229.589582][ T5611] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 229.601759][ T5611] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 229.613382][ T5611] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 229.631780][ T5611] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 229.643200][ T5611] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 229.653701][ T26] kauditd_printk_skb: 35 callbacks suppressed [ 229.653717][ T26] audit: type=1800 audit(1773904080.446:79): pid=5919 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.443" name="file2" dev="loop3" ino=1048604 res=0 errno=0 [ 229.662523][ T5611] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 229.761029][ T5611] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 229.826247][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 229.848810][ T2971] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 229.869441][ T2971] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 229.889405][ T5611] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 229.905584][ T5611] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 229.958082][ T5611] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 230.284142][ T5611] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 230.471030][ T5611] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 230.655535][ T5611] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 230.724594][ T5611] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 230.797969][ T5611] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 230.849257][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 230.901661][ T2971] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 230.928538][ T2971] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 231.018956][ T5611] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 231.066837][ T5611] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 231.093481][ T5611] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 231.230256][ T5940] loop2: detected capacity change from 0 to 1024 [ 231.240642][ T5940] EXT4-fs: Ignoring removed orlov option [ 231.246717][ T5940] EXT4-fs: quotafile must be on filesystem root [ 231.567456][ T5611] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 232.330952][ T4406] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 232.407321][ T4406] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 232.517678][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 232.568298][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 232.576663][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 232.695410][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 232.887792][ T5957] futex_wake_op: syz.3.454 tries to shift op by -1; fix this program [ 234.427068][ T5983] netlink: 48 bytes leftover after parsing attributes in process `syz.4.458'. [ 235.395571][ T5994] Cannot find add_set index 0 as target [ 235.714372][ T5999] netlink: 16 bytes leftover after parsing attributes in process `syz.4.463'. [ 235.764931][ T5993] netlink: 4 bytes leftover after parsing attributes in process `syz.5.460'. [ 237.212424][ T6013] loop0: detected capacity change from 0 to 1024 [ 237.222062][ T6013] EXT4-fs: Ignoring removed orlov option [ 237.228466][ T6013] EXT4-fs: quotafile must be on filesystem root [ 238.451446][ T22] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 238.638067][ T22] usb 1-1: Using ep0 maxpacket: 8 [ 238.645434][ T22] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 238.674653][ T6022] loop3: detected capacity change from 0 to 1024 [ 238.686404][ T22] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 238.774544][ T22] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 238.988034][ T2120] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 239.006427][ T22] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40 [ 239.071163][ T6027] ubi: mtd0 is already attached to ubi31 [ 239.266541][ T22] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 239.274985][ T22] usb 1-1: Product: syz [ 239.279368][ T22] usb 1-1: Manufacturer: syz [ 239.284401][ T22] usb 1-1: SerialNumber: syz [ 239.302568][ T6015] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 239.419626][ T22] cdc_ether: probe of 1-1:1.0 failed with error -22 [ 239.447228][ T22] usbtest 1-1:1.0: couldn't get endpoints, -22 [ 239.481809][ T22] usbtest: probe of 1-1:1.0 failed with error -22 [ 239.501145][ T2120] usb 5-1: unable to get BOS descriptor or descriptor too short [ 239.626484][ T4350] usb 1-1: USB disconnect, device number 19 [ 239.637435][ T2120] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 239.660431][ T4323] hfsplus: b-tree write err: -5, ino 25 [ 239.666604][ T4323] hfsplus: b-tree write err: -5, ino 4 [ 239.707878][ T2120] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 239.737712][ T4323] hfsplus: b-tree write err: -5, ino 2 [ 239.757981][ T2120] usb 5-1: config 1 interface 1 altsetting 1 has an invalid endpoint with address 0x0, skipping [ 239.768885][ T4323] hfsplus: b-tree write err: -5, ino 26 [ 239.807484][ T2120] usb 5-1: New USB device found, idVendor=0d8c, idProduct=0103, bcdDevice= 0.40 [ 239.834920][ T2120] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 239.942522][ T2120] usb 5-1: Product: syz [ 239.962379][ T2120] usb 5-1: Manufacturer: syz [ 239.979029][ T2120] usb 5-1: SerialNumber: syz [ 240.033042][ T6033] loop3: detected capacity change from 0 to 2048 [ 240.107713][ T6033] NILFS (loop3): broken superblock, retrying with spare superblock (blocksize = 1024) [ 240.228228][ T6036] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 240.379746][ T2120] snd-usb-audio: probe of 5-1:1.0 failed with error -22 [ 240.432132][ T2120] usb 5-1: USB disconnect, device number 15 [ 240.598876][ T6039] netlink: 48 bytes leftover after parsing attributes in process `syz.0.472'. [ 240.940126][ T4371] udevd[4371]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 241.255789][ T26] audit: type=1804 audit(1773904092.126:80): pid=6040 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.471" name="/newroot/102/file2/bus" dev="loop3" ino=2097152 res=1 errno=0 [ 241.791308][ T6058] Cannot find add_set index 0 as target [ 242.473913][ T6064] loop0: detected capacity change from 0 to 1024 [ 242.483793][ T6064] EXT4-fs: Ignoring removed orlov option [ 242.489798][ T6064] EXT4-fs: quotafile must be on filesystem root [ 243.968027][ T2120] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 244.169996][ T2120] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 244.280898][ T2120] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 244.312157][ T2120] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 244.346689][ T2120] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 244.467504][ T2120] usb 4-1: SerialNumber: syz [ 244.819307][ T2120] usb 4-1: 0:2 : does not exist [ 244.843393][ T2120] usb 4-1: USB disconnect, device number 15 [ 245.869233][ T4371] udevd[4371]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 245.993054][ T6093] binder: 6090:6093 ioctl c0306201 0 returned -14 [ 246.328507][ T6092] loop3: detected capacity change from 0 to 8192 [ 246.541683][ T6101] binder: 6098:6101 ioctl c0306201 0 returned -14 [ 248.599903][ T6092] syz.3.486: attempt to access beyond end of device [ 248.599903][ T6092] loop3: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 248.631694][ T6092] Buffer I/O error on dev loop3, logical block 57847, async page read [ 248.647786][ T6092] syz.3.486: attempt to access beyond end of device [ 248.647786][ T6092] loop3: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 248.666095][ T6092] Buffer I/O error on dev loop3, logical block 57847, async page read [ 248.920775][ T26] audit: type=1800 audit(1773904099.796:81): pid=6092 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.486" name="file2" dev="loop3" ino=1048609 res=0 errno=0 [ 249.828024][ T4340] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 250.103389][ T4340] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 250.118050][ T4340] usb 6-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 250.128606][ T4340] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 250.143857][ T4340] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 250.246074][ T6126] loop0: detected capacity change from 0 to 1024 [ 250.258791][ T6116] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 250.596744][ T6126] ubi: mtd0 is already attached to ubi31 [ 250.863439][ T6138] loop4: detected capacity change from 0 to 1024 [ 250.876790][ T6138] EXT4-fs: Ignoring removed orlov option [ 250.882744][ T6138] EXT4-fs: quotafile must be on filesystem root [ 251.197611][ T4388] hfsplus: b-tree write err: -5, ino 25 [ 251.217616][ T4388] hfsplus: b-tree write err: -5, ino 4 [ 251.287916][ T4350] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 251.637470][ T22] usb 6-1: USB disconnect, device number 2 [ 251.668637][ T4388] hfsplus: b-tree write err: -5, ino 2 [ 251.746071][ T4388] hfsplus: b-tree write err: -5, ino 26 [ 252.249974][ T4350] usb 4-1: unable to get BOS descriptor or descriptor too short [ 252.263540][ T4350] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 252.279950][ T4350] usb 4-1: can't read configurations, error -71 [ 253.468873][ T6150] Cannot find add_set index 0 as target [ 254.179990][ T6159] binder: 6157:6159 ioctl c0306201 0 returned -14 [ 255.249102][ T6170] tipc: Enabling of bearer rejected, failed to enable media [ 256.716364][ T26] audit: type=1800 audit(1773904107.586:82): pid=6168 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.501" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 errno=0 [ 256.770804][ T6186] bond0: (slave bond_slave_1): Releasing backup interface [ 258.617256][ T6211] netlink: 48 bytes leftover after parsing attributes in process `syz.3.508'. [ 259.294104][ T6206] loop5: detected capacity change from 0 to 8192 [ 260.234653][ T6217] syz.5.507: attempt to access beyond end of device [ 260.234653][ T6217] loop5: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 260.248697][ T6217] Buffer I/O error on dev loop5, logical block 57847, async page read [ 260.262483][ T6217] syz.5.507: attempt to access beyond end of device [ 260.262483][ T6217] loop5: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 260.276551][ T6217] Buffer I/O error on dev loop5, logical block 57847, async page read [ 260.286063][ T26] audit: type=1800 audit(1773904111.156:83): pid=6217 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.507" name="file2" dev="loop5" ino=1048611 res=0 errno=0 [ 261.159312][ T6230] binder: 6226:6230 ioctl c0306201 0 returned -14 [ 261.598904][ T1276] ieee802154 phy0 wpan0: encryption failed: -22 [ 261.606684][ T1276] ieee802154 phy1 wpan1: encryption failed: -22 [ 262.258020][ T5049] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 262.507908][ T5049] usb 4-1: Using ep0 maxpacket: 16 [ 262.519505][ T5049] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 262.751033][ T5049] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 262.819943][ T5049] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 262.871879][ T5049] usb 4-1: Product: syz [ 262.876150][ T5049] usb 4-1: Manufacturer: syz [ 262.934816][ T5049] usb 4-1: SerialNumber: syz [ 262.996822][ T5049] usb 4-1: config 0 descriptor?? [ 263.037704][ T5049] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 263.076157][ T5049] em28xx 4-1:0.0: DVB interface 0 found: bulk [ 263.298015][ T22] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 263.535235][ T22] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 263.560098][ T22] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 263.607430][ T22] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 263.635241][ T5049] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 263.776997][ T22] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 263.918410][ T22] usb 3-1: SerialNumber: syz [ 264.704902][ T5049] em28xx 4-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 264.738396][ T22] usb 3-1: 0:2 : does not exist [ 264.743649][ T5049] em28xx 4-1:0.0: board has no eeprom [ 264.748237][ T7] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 264.787544][ T22] usb 3-1: USB disconnect, device number 16 [ 264.958052][ T7] usb 5-1: Using ep0 maxpacket: 16 [ 264.967698][ T7] usb 5-1: config 0 has no interfaces? [ 265.029442][ T4371] udevd[4371]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 265.066324][ T7] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 265.157703][ T7] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 265.188727][ T7] usb 5-1: Manufacturer: syz [ 265.222387][ T7] usb 5-1: config 0 descriptor?? [ 265.481453][ T2120] usb 5-1: USB disconnect, device number 16 [ 265.779396][ T6269] sctp: [Deprecated]: syz.2.521 (pid 6269) Use of int in max_burst socket option deprecated. [ 265.779396][ T6269] Use struct sctp_assoc_value instead [ 265.841363][ T6237] em28xx 4-1:0.0: reading from i2c device at 0x482c failed (error=-5) [ 265.908779][ T5049] em28xx 4-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 265.924762][ T5049] em28xx 4-1:0.0: dvb set to bulk mode. [ 265.946418][ T5049] usb 4-1: USB disconnect, device number 18 [ 265.961787][ T5049] em28xx 4-1:0.0: Disconnecting em28xx [ 265.968550][ T4350] em28xx 4-1:0.0: Binding DVB extension [ 266.243148][ T4350] em28xx 4-1:0.0: Registering input extension [ 266.257099][ T5049] em28xx 4-1:0.0: Closing input extension [ 266.289947][ T5049] em28xx 4-1:0.0: Freeing device [ 267.447620][ T6292] netlink: 4 bytes leftover after parsing attributes in process `syz.2.527'. [ 267.623602][ T6295] netlink: 4 bytes leftover after parsing attributes in process `syz.2.527'. [ 268.317772][ T6306] netlink: 27 bytes leftover after parsing attributes in process `syz.2.532'. [ 268.590074][ T6316] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.533'. [ 268.697411][ T6316] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.533'. [ 271.047899][ T7] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 271.260118][ T7] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 271.286841][ T7] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 271.324416][ T7] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 271.381404][ T7] usb 1-1: config 0 descriptor?? [ 271.414553][ T7] pwc: Askey VC010 type 2 USB webcam detected. [ 271.816212][ T7] pwc: recv_control_msg error -32 req 02 val 2b00 [ 271.832248][ T7] pwc: recv_control_msg error -32 req 02 val 2700 [ 271.869002][ T7] pwc: recv_control_msg error -32 req 02 val 2c00 [ 271.949828][ T7] pwc: recv_control_msg error -32 req 04 val 1000 [ 271.997528][ T7] pwc: recv_control_msg error -32 req 04 val 1300 [ 272.032243][ T7] pwc: recv_control_msg error -32 req 04 val 1400 [ 272.062339][ T7] pwc: recv_control_msg error -32 req 02 val 2000 [ 272.111669][ T7] pwc: recv_control_msg error -32 req 02 val 2100 [ 272.150184][ T7] pwc: recv_control_msg error -32 req 04 val 1500 [ 272.190201][ T7] pwc: recv_control_msg error -32 req 02 val 2500 [ 272.223705][ T7] pwc: recv_control_msg error -32 req 02 val 2400 [ 272.279037][ T7] pwc: recv_control_msg error -32 req 02 val 2600 [ 272.325309][ T7] pwc: recv_control_msg error -32 req 02 val 2900 [ 272.560287][ T7] pwc: recv_control_msg error -71 req 04 val 1100 [ 272.580664][ T7] pwc: recv_control_msg error -71 req 04 val 1200 [ 272.636881][ T7] pwc: Registered as video103. [ 272.686075][ T7] input: PWC snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/input/input18 [ 272.841866][ T7] usb 1-1: USB disconnect, device number 20 [ 273.536281][ T6373] netlink: 27 bytes leftover after parsing attributes in process `syz.5.544'. [ 275.920629][ T6401] loop5: detected capacity change from 0 to 2048 [ 276.006337][ T6401] NILFS (loop5): broken superblock, retrying with spare superblock (blocksize = 1024) [ 276.142679][ T6404] NILFS (loop5): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 276.156795][ T4371] udevd[4371]: incorrect nilfs2 checksum on /dev/loop5 [ 276.336446][ T6406] loop2: detected capacity change from 0 to 1024 [ 276.346562][ T6406] EXT4-fs: Ignoring removed orlov option [ 276.352517][ T6406] EXT4-fs: quotafile must be on filesystem root [ 277.352192][ T26] audit: type=1804 audit(1773904128.226:84): pid=6407 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.5.551" name="/newroot/16/file2/bus" dev="loop5" ino=2097152 res=1 errno=0 [ 277.375327][ C0] vkms_vblank_simulate: vblank timer overrun [ 277.780717][ T6412] loop2: detected capacity change from 0 to 8192 [ 279.420594][ T6419] syz.2.553: attempt to access beyond end of device [ 279.420594][ T6419] loop2: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 279.434690][ T6419] Buffer I/O error on dev loop2, logical block 57847, async page read [ 279.448088][ T6419] syz.2.553: attempt to access beyond end of device [ 279.448088][ T6419] loop2: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 279.462599][ T6419] Buffer I/O error on dev loop2, logical block 57847, async page read [ 279.473196][ T26] audit: type=1800 audit(1773904130.346:85): pid=6419 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.553" name="file2" dev="loop2" ino=1048613 res=0 errno=0 [ 280.073696][ T6426] loop4: detected capacity change from 0 to 1024 [ 280.503889][ T6436] ubi: mtd0 is already attached to ubi31 [ 280.900332][ T6440] 9pnet_fd: Insufficient options for proto=fd [ 282.816749][ T6464] netlink: 4 bytes leftover after parsing attributes in process `syz.5.565'. [ 282.857220][ T6464] netlink: 4 bytes leftover after parsing attributes in process `syz.5.565'. [ 283.212111][ T4323] hfsplus: b-tree write err: -5, ino 25 [ 283.217522][ T6467] loop2: detected capacity change from 0 to 8192 [ 283.247327][ T4323] hfsplus: b-tree write err: -5, ino 4 [ 283.287726][ T4323] hfsplus: b-tree write err: -5, ino 2 [ 283.303890][ T4323] hfsplus: b-tree write err: -5, ino 26 [ 283.530916][ T6471] syz.2.566: attempt to access beyond end of device [ 283.530916][ T6471] loop2: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 283.545549][ T6471] Buffer I/O error on dev loop2, logical block 57847, async page read [ 283.558095][ T6471] syz.2.566: attempt to access beyond end of device [ 283.558095][ T6471] loop2: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 283.572613][ T6471] Buffer I/O error on dev loop2, logical block 57847, async page read [ 283.582706][ T26] audit: type=1800 audit(1773904134.466:86): pid=6471 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.566" name="file2" dev="loop2" ino=1048615 res=0 errno=0 [ 283.997266][ T6477] loop4: detected capacity change from 0 to 1024 [ 284.241791][ T6482] 9pnet_fd: Insufficient options for proto=fd [ 284.486938][ T6489] ubi: mtd0 is already attached to ubi31 [ 285.884004][ T6371] Set syz1 is full, maxelem 65536 reached [ 286.231389][ T6515] netlink: 4 bytes leftover after parsing attributes in process `syz.0.578'. [ 286.386484][ T6518] netlink: 4 bytes leftover after parsing attributes in process `syz.0.578'. [ 286.676768][ T6521] loop3: detected capacity change from 0 to 1024 [ 287.082916][ T6526] ubi: mtd0 is already attached to ubi31 [ 287.327691][ T4405] hfsplus: b-tree write err: -5, ino 25 [ 287.352285][ T4405] hfsplus: b-tree write err: -5, ino 4 [ 287.377952][ T4405] hfsplus: b-tree write err: -5, ino 2 [ 287.388251][ T4405] hfsplus: b-tree write err: -5, ino 26 [ 287.597578][ T6541] 9pnet_fd: Insufficient options for proto=fd [ 288.121126][ T6552] netlink: 12 bytes leftover after parsing attributes in process `syz.4.588'. [ 288.328319][ T6558] netlink: 12 bytes leftover after parsing attributes in process `syz.0.590'. [ 288.828015][ T5049] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 289.023517][ T5049] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 289.054231][ T5049] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 289.082751][ T5049] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 289.114396][ T5049] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 289.134373][ T5049] usb 5-1: SerialNumber: syz [ 289.270237][ T4405] hfsplus: b-tree write err: -5, ino 25 [ 289.277082][ T4405] hfsplus: b-tree write err: -5, ino 4 [ 289.293911][ T4405] hfsplus: b-tree write err: -5, ino 2 [ 289.304065][ T4405] hfsplus: b-tree write err: -5, ino 26 [ 289.362260][ T5049] usb 5-1: 0:2 : does not exist [ 289.432717][ T5049] usb 5-1: USB disconnect, device number 17 [ 289.596499][ T6579] loop3: detected capacity change from 0 to 1024 [ 289.897738][ T4371] udevd[4371]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 289.957924][ T4350] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 290.112090][ T6591] ubi: mtd0 is already attached to ubi31 [ 290.164101][ T4350] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 290.187325][ T4350] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 290.207064][ T4350] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 290.231627][ T4350] usb 3-1: config 0 descriptor?? [ 290.250293][ T4350] pwc: Askey VC010 type 2 USB webcam detected. [ 290.660712][ T4350] pwc: recv_control_msg error -32 req 02 val 2b00 [ 290.701194][ T4350] pwc: recv_control_msg error -32 req 02 val 2700 [ 290.740287][ T4350] pwc: recv_control_msg error -32 req 02 val 2c00 [ 290.755574][ T4350] pwc: recv_control_msg error -32 req 04 val 1000 [ 290.770857][ T4350] pwc: recv_control_msg error -32 req 04 val 1300 [ 290.778493][ T4350] pwc: recv_control_msg error -32 req 04 val 1400 [ 290.788083][ T6600] 9pnet_fd: Insufficient options for proto=fd [ 290.808967][ T4350] pwc: recv_control_msg error -32 req 02 val 2000 [ 290.838927][ T4350] pwc: recv_control_msg error -32 req 02 val 2100 [ 290.858232][ T4350] pwc: recv_control_msg error -32 req 04 val 1500 [ 290.875330][ T4350] pwc: recv_control_msg error -32 req 02 val 2500 [ 290.896895][ T4350] pwc: recv_control_msg error -32 req 02 val 2400 [ 290.927158][ T4350] pwc: recv_control_msg error -32 req 02 val 2600 [ 290.964837][ T4350] pwc: recv_control_msg error -32 req 02 val 2900 [ 291.190003][ T4350] pwc: recv_control_msg error -71 req 04 val 1100 [ 291.198869][ T4350] pwc: recv_control_msg error -71 req 04 val 1200 [ 291.217564][ T4350] pwc: Registered as video103. [ 291.253453][ T4350] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input19 [ 291.333317][ T4350] usb 3-1: USB disconnect, device number 17 [ 292.198017][ T4350] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 292.434250][ T4350] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 292.476466][ T4350] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 292.577144][ T4350] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 292.635982][ T4350] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 292.717156][ T6619] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 292.853699][ T4405] hfsplus: b-tree write err: -5, ino 25 [ 292.861856][ T4405] hfsplus: b-tree write err: -5, ino 4 [ 292.945807][ T4405] hfsplus: b-tree write err: -5, ino 2 [ 293.006321][ T4405] hfsplus: b-tree write err: -5, ino 26 [ 293.063080][ T4350] usb 5-1: USB disconnect, device number 18 [ 296.460817][ T6684] loop4: detected capacity change from 0 to 1024 [ 296.926729][ T6687] netlink: 16 bytes leftover after parsing attributes in process `syz.3.619'. [ 296.959795][ T6688] ubi: mtd0 is already attached to ubi31 [ 297.274756][ T4333] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 297.506644][ T4333] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 297.567923][ T4333] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 297.593298][ T4333] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 297.683537][ T4333] usb 6-1: config 0 descriptor?? [ 297.724731][ T4333] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 298.137979][ T2120] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 298.340512][ T2120] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 298.360801][ T2120] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 298.398120][ T2120] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 298.407384][ T2120] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 298.448265][ T2120] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 298.470345][ T2971] hfsplus: b-tree write err: -5, ino 25 [ 298.477474][ T2971] hfsplus: b-tree write err: -5, ino 4 [ 298.484483][ T2120] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 298.494713][ T2971] hfsplus: b-tree write err: -5, ino 2 [ 298.501216][ T2120] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 298.515126][ T2971] hfsplus: b-tree write err: -5, ino 26 [ 298.523266][ T2120] usb 3-1: Product: syz [ 298.530085][ T2120] usb 3-1: Manufacturer: syz [ 298.561367][ T2120] cdc_wdm 3-1:1.0: skipping garbage [ 298.574600][ T2120] cdc_wdm 3-1:1.0: skipping garbage [ 298.736244][ T2120] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 298.751733][ T2120] cdc_wdm 3-1:1.0: Unknown control protocol [ 299.224168][ C1] cdc_wdm 3-1:1.0: Unexpected error -71 [ 299.224525][ T2120] usb 3-1: USB disconnect, device number 18 [ 299.237280][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 299.244868][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 299.251041][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 299.664210][ T6714] futex_wake_op: syz.4.626 tries to shift op by -1; fix this program [ 300.271562][ T4340] usb 6-1: USB disconnect, device number 3 [ 301.789982][ T6737] loop0: detected capacity change from 0 to 1024 [ 301.990776][ T6746] loop2: detected capacity change from 0 to 1024 [ 302.001290][ T6746] EXT4-fs: Ignoring removed orlov option [ 302.008006][ T6746] EXT4-fs: quotafile must be on filesystem root [ 303.872153][ T5111] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 304.112164][ T6737] ubi: mtd0 is already attached to ubi31 [ 304.239363][ T6736] xt_TCPMSS: Only works on TCP SYN packets [ 304.484889][ T6755] loop5: detected capacity change from 0 to 1024 [ 304.720766][ T4527] hfsplus: b-tree write err: -5, ino 25 [ 304.728592][ T4527] hfsplus: b-tree write err: -5, ino 4 [ 304.734406][ T4527] hfsplus: b-tree write err: -5, ino 2 [ 304.740583][ T2120] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 304.772370][ T4527] hfsplus: b-tree write err: -5, ino 26 [ 304.797909][ T14] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 305.012496][ T2120] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 305.029283][ T14] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 305.056351][ T14] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 305.068705][ T2120] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 305.137314][ T6762] futex_wake_op: syz.0.640 tries to shift op by -1; fix this program [ 305.639771][ T14] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 305.674491][ T2120] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 305.773126][ T6764] ubi: mtd0 is already attached to ubi31 [ 305.986282][ T2120] usb 3-1: config 0 descriptor?? [ 305.992156][ T14] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 306.002397][ T14] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 306.014284][ T2120] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 306.031255][ T14] usb 5-1: config 0 descriptor?? [ 306.132649][ T9] hfsplus: b-tree write err: -5, ino 25 [ 306.158444][ T9] hfsplus: b-tree write err: -5, ino 4 [ 306.178992][ T9] hfsplus: b-tree write err: -5, ino 2 [ 306.195561][ T9] hfsplus: b-tree write err: -5, ino 26 [ 306.896320][ T14] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 306.918631][ T14] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 306.958134][ T14] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 306.966081][ T14] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 307.018037][ T14] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 307.063472][ T14] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 307.082316][ T14] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 307.115070][ T14] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 307.173873][ T14] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 307.217248][ T14] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 307.246353][ T14] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 307.287517][ T14] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 307.327671][ T6778] netlink: 12 bytes leftover after parsing attributes in process `syz.5.642'. [ 307.346854][ T14] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 307.402025][ T14] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 307.447150][ T14] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 307.512086][ T14] plantronics 0003:047F:FFFF.0004: No inputs registered, leaving [ 307.572271][ T14] plantronics 0003:047F:FFFF.0004: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 307.651204][ T14] usb 5-1: USB disconnect, device number 19 [ 307.867975][ T4340] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 308.070446][ T4340] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 308.091842][ T4340] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 308.125408][ T6785] fido_id[6785]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 308.162883][ T4340] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 308.193759][ T4340] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 308.237395][ T4340] usb 1-1: SerialNumber: syz [ 308.335666][ T2120] usb 3-1: USB disconnect, device number 19 [ 308.484677][ T4340] usb 1-1: 0:2 : does not exist [ 308.565161][ T4340] usb 1-1: USB disconnect, device number 21 [ 308.786657][ T6791] DRBG: could not allocate digest TFM handle: hmac(sha512) [ 309.295517][ T6807] loop0: detected capacity change from 0 to 1024 [ 309.305206][ T6807] EXT4-fs: Ignoring removed orlov option [ 309.311282][ T6807] EXT4-fs: quotafile must be on filesystem root [ 311.616451][ T6810] loop0: detected capacity change from 0 to 1024 [ 311.638226][ T4371] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 311.658324][ T4371] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 311.715371][ T4371] Buffer I/O error on dev loop0, logical block 0, async page read [ 312.074079][ T6812] ubi: mtd0 is already attached to ubi31 [ 312.678396][ T9] hfsplus: b-tree write err: -5, ino 25 [ 312.697992][ T9] hfsplus: b-tree write err: -5, ino 4 [ 312.720693][ T6790] netlink: 4 bytes leftover after parsing attributes in process `syz.3.647'. [ 312.740791][ T6790] netlink: 'syz.3.647': attribute type 15 has an invalid length. [ 312.749826][ T9] hfsplus: b-tree write err: -5, ino 2 [ 312.773410][ T9] hfsplus: b-tree write err: -5, ino 26 [ 312.785499][ T6790] netlink: 'syz.3.647': attribute type 18 has an invalid length. [ 312.841713][ T6790] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 312.851894][ T6790] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 312.861111][ T6790] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 312.870102][ T6790] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 313.027559][ T6790] device vxlan0 entered promiscuous mode [ 313.129251][ T6790] syz.3.647 (6790) used greatest stack depth: 20304 bytes left [ 313.228173][ T5049] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 313.372651][ T6821] binder_alloc: 6818: binder_alloc_buf, no vma [ 313.458076][ T5049] usb 1-1: Using ep0 maxpacket: 32 [ 313.958227][ T5049] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 313.983805][ T5049] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 314.045468][ T5049] usb 1-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 314.075874][ T5049] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 314.136690][ T5049] usb 1-1: Product: syz [ 314.146837][ T5049] usb 1-1: Manufacturer: syz [ 314.162244][ T5049] usb 1-1: SerialNumber: syz [ 314.208806][ T5049] usb 1-1: config 0 descriptor?? [ 315.137852][ T6837] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 315.157372][ T6837] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 315.182494][ T6827] loop3: detected capacity change from 0 to 32768 [ 315.236506][ T6827] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop3 scanned by syz.3.654 (6827) [ 315.374643][ T6827] BTRFS info (device loop3): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 315.406480][ T6827] BTRFS info (device loop3): using sha256 (sha256-avx2) checksum algorithm [ 315.425521][ T6827] BTRFS info (device loop3): using free space tree [ 315.699054][ T6827] BTRFS info (device loop3): enabling ssd optimizations [ 315.718723][ T5049] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 315.881031][ T4310] Process accounting resumed [ 315.951114][ T5049] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 316.076668][ T6862] loop5: detected capacity change from 0 to 1024 [ 316.087189][ T6862] EXT4-fs: Ignoring removed orlov option [ 316.093290][ T6862] EXT4-fs: quotafile must be on filesystem root [ 316.779478][ T5049] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 316.793139][ T5049] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 316.802877][ T5049] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 316.813950][ T5049] usb 3-1: config 0 descriptor?? [ 316.831626][ T5049] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 317.020985][ T6863] netlink: 24 bytes leftover after parsing attributes in process `syz.4.659'. [ 317.056253][ T5049] usb 1-1: USB disconnect, device number 22 [ 317.262497][ T6867] loop5: detected capacity change from 0 to 1024 [ 317.610336][ T6876] ubi: mtd0 is already attached to ubi31 [ 317.620765][ T6874] binder_alloc: 6873: binder_alloc_buf, no vma [ 318.465934][ T6875] input: syz0 as /devices/virtual/input/input20 [ 319.042363][ T41] hfsplus: b-tree write err: -5, ino 25 [ 319.076309][ T41] hfsplus: b-tree write err: -5, ino 4 [ 319.135982][ T4310] usb 3-1: USB disconnect, device number 20 [ 319.155068][ T41] hfsplus: b-tree write err: -5, ino 2 [ 319.173873][ T41] hfsplus: b-tree write err: -5, ino 26 [ 319.297867][ T6883] capability: warning: `syz.0.666' uses deprecated v2 capabilities in a way that may be insecure [ 319.507992][ T6887] loop2: detected capacity change from 0 to 1024 [ 319.950971][ T6896] ubi: mtd0 is already attached to ubi31 [ 320.578250][ T5600] hfsplus: b-tree write err: -5, ino 25 [ 320.584361][ T5600] hfsplus: b-tree write err: -5, ino 4 [ 320.767345][ T6901] loop5: detected capacity change from 0 to 1024 [ 320.777830][ T6901] EXT4-fs: Ignoring removed orlov option [ 320.784129][ T6901] EXT4-fs: quotafile must be on filesystem root [ 322.175083][ T5600] hfsplus: b-tree write err: -5, ino 2 [ 322.286444][ T5600] hfsplus: b-tree write err: -5, ino 26 [ 322.489328][ T6904] netlink: 4 bytes leftover after parsing attributes in process `syz.4.674'. [ 322.640211][ T1276] ieee802154 phy0 wpan0: encryption failed: -22 [ 322.652455][ T1276] ieee802154 phy1 wpan1: encryption failed: -22 [ 322.692760][ T6912] netlink: 52 bytes leftover after parsing attributes in process `syz.2.673'. [ 322.716725][ T6912] bridge0: port 2(bridge_slave_1) entered disabled state [ 322.727300][ T6912] bridge0: port 1(bridge_slave_0) entered disabled state [ 322.784304][ T6914] netlink: 76 bytes leftover after parsing attributes in process `syz.2.673'. [ 322.832302][ T6914] bridge0: port 2(bridge_slave_1) entered blocking state [ 322.839759][ T6914] bridge0: port 2(bridge_slave_1) entered forwarding state [ 322.847634][ T6914] bridge0: port 1(bridge_slave_0) entered blocking state [ 322.855370][ T6914] bridge0: port 1(bridge_slave_0) entered forwarding state [ 323.040114][ T4275] BTRFS info (device loop3): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 323.069791][ T6914] netlink: 52 bytes leftover after parsing attributes in process `syz.2.673'. [ 323.252007][ T6914] bridge0: port 2(bridge_slave_1) entered disabled state [ 323.259581][ T6914] bridge0: port 1(bridge_slave_0) entered disabled state [ 323.272164][ C1] vkms_vblank_simulate: vblank timer overrun [ 323.310904][ T6913] netlink: 4 bytes leftover after parsing attributes in process `syz.4.674'. [ 323.361045][ T4324] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 323.572390][ T4324] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 323.607295][ T4324] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 323.630319][ T4324] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 323.646411][ T4324] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 323.685272][ T6928] binder_alloc: 6927: binder_alloc_buf, no vma [ 323.688651][ T4324] usb 6-1: config 0 descriptor?? [ 324.027131][ T4324] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 324.319562][ T4324] usb 1-1: new full-speed USB device number 23 using dummy_hcd [ 324.560154][ T4324] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 324.599633][ T4324] usb 1-1: config 0 has no interfaces? [ 324.628237][ T4324] usb 1-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 324.677998][ T4324] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 324.714848][ T4324] usb 1-1: config 0 descriptor?? [ 324.720497][ T48] Bluetooth: hci0: command 0x0406 tx timeout [ 324.801586][ T6938] netlink: 8 bytes leftover after parsing attributes in process `syz.3.682'. [ 324.847930][ T4310] usb 3-1: new full-speed USB device number 21 using dummy_hcd [ 325.073814][ T4310] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 325.097563][ T4310] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 325.125143][ T4310] usb 3-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 325.141985][ T4310] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 325.173116][ T4310] usb 3-1: config 0 descriptor?? [ 325.191585][ T4310] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 325.199033][ T4310] dvb-usb: bulk message failed: -22 (3/0) [ 325.220395][ T4310] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 325.238212][ T4310] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 325.255899][ T4310] usb 3-1: media controller created [ 325.263216][ T4310] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 325.294598][ T4310] dvb-usb: bulk message failed: -22 (6/0) [ 325.317310][ T4310] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 325.351284][ T4310] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input21 [ 325.376244][ T4310] dvb-usb: schedule remote query interval to 150 msecs. [ 325.384935][ T4310] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 325.421744][ T4310] usb 3-1: USB disconnect, device number 21 [ 325.462843][ T4310] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 326.091392][ T4310] usb 6-1: USB disconnect, device number 4 [ 326.267152][ T6960] input: syz1 as /devices/virtual/input/input22 [ 326.757746][ T6953] loop3: detected capacity change from 0 to 32768 [ 326.787517][ T6953] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop3 scanned by syz.3.686 (6953) [ 326.825439][ T6953] BTRFS info (device loop3): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 326.844211][ T6953] BTRFS info (device loop3): using sha256 (sha256-avx2) checksum algorithm [ 326.855244][ T6953] BTRFS info (device loop3): using free space tree [ 326.886859][ T2120] usb 1-1: USB disconnect, device number 23 [ 327.384386][ T6953] BTRFS info (device loop3): enabling ssd optimizations [ 327.515963][ T2120] Process accounting resumed [ 328.255748][ T6985] loop5: detected capacity change from 0 to 8192 [ 328.595373][ T6991] syz.5.691: attempt to access beyond end of device [ 328.595373][ T6991] loop5: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 328.609644][ T6991] Buffer I/O error on dev loop5, logical block 57847, async page read [ 328.624878][ T6991] syz.5.691: attempt to access beyond end of device [ 328.624878][ T6991] loop5: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 328.639704][ T6991] Buffer I/O error on dev loop5, logical block 57847, async page read [ 328.655367][ T26] audit: type=1800 audit(1773904179.526:87): pid=6991 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.691" name="file2" dev="loop5" ino=1048617 res=0 errno=0 [ 329.108937][ T6994] loop0: detected capacity change from 0 to 2048 [ 329.228118][ T6994] NILFS (loop0): broken superblock, retrying with spare superblock (blocksize = 1024) [ 329.254618][ T6996] netlink: 8 bytes leftover after parsing attributes in process `syz.4.694'. [ 329.404356][ T6999] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 329.428535][ T5111] udevd[5111]: incorrect nilfs2 checksum on /dev/loop0 [ 329.740382][ T26] audit: type=1804 audit(1773904180.616:88): pid=7000 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.692" name="/newroot/141/file2/bus" dev="loop0" ino=2097152 res=1 errno=0 [ 329.991470][ T7005] netlink: 12 bytes leftover after parsing attributes in process `syz.2.697'. [ 330.564687][ T7012] binder: 7011:7012 ioctl c0306201 0 returned -14 [ 330.882861][ T7017] netlink: 'syz.0.700': attribute type 10 has an invalid length. [ 330.956764][ T4275] BTRFS info (device loop3): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 331.078149][ T4310] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 331.152956][ T7017] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 331.166704][ T7019] netlink: 12 bytes leftover after parsing attributes in process `syz.2.701'. [ 331.278114][ T4310] usb 5-1: Using ep0 maxpacket: 16 [ 331.288625][ T4310] usb 5-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 331.303404][ T7016] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 331.377885][ T4310] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 331.386256][ T4310] usb 5-1: Product: syz [ 331.456122][ T4310] usb 5-1: Manufacturer: syz [ 331.460940][ T4310] usb 5-1: SerialNumber: syz [ 331.498907][ T4310] usb 5-1: config 0 descriptor?? [ 331.516231][ T4310] asix: probe of 5-1:0.0 failed with error -22 [ 331.538442][ T7026] device syzkaller0 entered promiscuous mode [ 331.598291][ T7026] tipc: Started in network mode [ 331.618190][ T7026] tipc: Node identity 62b43dd8a988, cluster identity 4711 [ 331.668870][ T7026] tipc: Enabled bearer , priority 0 [ 331.691553][ T7025] tipc: Resetting bearer [ 331.787336][ T7015] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 331.845842][ T7025] tipc: Disabling bearer [ 331.856724][ T7015] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 332.294003][ T7024] usb 5-1: USB disconnect, device number 20 [ 332.791654][ T7037] netlink: 48 bytes leftover after parsing attributes in process `syz.2.706'. [ 332.908311][ T7024] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 333.152316][ T7024] usb 5-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.32 [ 333.162444][ T7024] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 333.193149][ T7024] usb 5-1: config 0 descriptor?? [ 333.235540][ T7024] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 333.321224][ T7032] loop0: detected capacity change from 0 to 8192 [ 333.431182][ T7024] gp8psk: usb in 128 operation failed. [ 333.608134][ T7041] syz.0.704: attempt to access beyond end of device [ 333.608134][ T7041] loop0: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 333.622191][ T7041] Buffer I/O error on dev loop0, logical block 57847, async page read [ 333.641203][ T7041] syz.0.704: attempt to access beyond end of device [ 333.641203][ T7041] loop0: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 333.655504][ T7041] Buffer I/O error on dev loop0, logical block 57847, async page read [ 333.667372][ T26] audit: type=1800 audit(1773904184.536:89): pid=7041 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.704" name="file2" dev="loop0" ino=1048619 res=0 errno=0 [ 333.807254][ T7024] gp8psk: usb in 137 operation failed. [ 333.814124][ T7024] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 333.858195][ T7024] dvbdev: DVB: registering new adapter (Genpix SkyWalker-1 DVB-S receiver) [ 333.867677][ T7024] usb 5-1: media controller created [ 333.924118][ T7024] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 333.962073][ T7024] gp8psk_fe: Frontend attached [ 333.970943][ T7024] usb 5-1: DVB: registering adapter 1 frontend 0 (Genpix DVB-S)... [ 334.006061][ T7024] dvbdev: dvb_create_media_entity: media entity 'Genpix DVB-S' registered. [ 334.134939][ T7046] loop2: detected capacity change from 0 to 1024 [ 334.145400][ T7046] EXT4-fs: Ignoring removed orlov option [ 334.152386][ T7046] EXT4-fs: quotafile must be on filesystem root [ 334.958352][ T7024] gp8psk: usb in 138 operation failed. [ 334.964086][ T7024] dvb-usb: Genpix SkyWalker-1 DVB-S receiver successfully initialized and connected. [ 334.976840][ T7024] gp8psk: found Genpix USB device pID = 203 (hex) [ 334.994905][ T7024] usb 5-1: USB disconnect, device number 21 [ 335.178000][ T4324] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 335.210595][ T7024] dvb-usb: Genpix SkyWalker-1 DVB-S receiver successfully deinitialized and disconnected. [ 335.247579][ T7049] binder: BINDER_SET_CONTEXT_MGR already set [ 335.273585][ T7049] binder: 7048:7049 ioctl 4018620d 200000004a80 returned -16 [ 335.338006][ T4324] usb 4-1: device descriptor read/64, error -71 [ 335.679001][ T7052] binder: 7048:7052 ioctl c0306201 0 returned -14 [ 335.759501][ T4324] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 336.111517][ T7061] netlink: 112 bytes leftover after parsing attributes in process `syz.0.713'. [ 336.188139][ T4324] usb 4-1: device descriptor read/64, error -71 [ 336.311047][ T4324] usb usb4-port1: attempt power cycle [ 336.417253][ T7069] device syzkaller0 entered promiscuous mode [ 336.487921][ T7069] tipc: Started in network mode [ 336.493126][ T7069] tipc: Node identity e60a7db0fd24, cluster identity 4711 [ 336.517998][ T7069] tipc: Enabled bearer , priority 0 [ 336.552931][ T7067] tipc: Resetting bearer [ 336.679645][ T7067] tipc: Disabling bearer [ 336.747948][ T4324] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 337.540850][ T4324] usb 4-1: device descriptor read/8, error -71 [ 337.552407][ T7075] netlink: 48 bytes leftover after parsing attributes in process `syz.0.718'. [ 338.044799][ T7087] loop2: detected capacity change from 0 to 1024 [ 338.056800][ T7087] EXT4-fs: Ignoring removed orlov option [ 338.063080][ T7087] EXT4-fs: quotafile must be on filesystem root [ 338.327959][ T4324] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 338.585004][ T4324] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 338.597310][ T4324] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 338.607988][ T4324] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 338.617877][ T4324] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 338.644671][ T7092] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 338.685158][ T7091] loop5: detected capacity change from 0 to 8192 [ 338.985081][ T7096] syz.5.723: attempt to access beyond end of device [ 338.985081][ T7096] loop5: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 338.999234][ T7096] Buffer I/O error on dev loop5, logical block 57847, async page read [ 339.077029][ T7096] syz.5.723: attempt to access beyond end of device [ 339.077029][ T7096] loop5: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 339.092559][ T7096] Buffer I/O error on dev loop5, logical block 57847, async page read [ 339.101967][ T26] audit: type=1800 audit(1773904189.976:90): pid=7096 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.723" name="file2" dev="loop5" ino=1048621 res=0 errno=0 [ 339.220685][ T4324] usb 4-1: USB disconnect, device number 22 [ 339.639127][ T7102] binder: 7098:7102 ioctl c0306201 0 returned -14 [ 341.067940][ T7] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 341.182338][ T7121] binder: BINDER_SET_CONTEXT_MGR already set [ 341.198251][ T7121] binder: 7120:7121 ioctl 4018620d 200000004a80 returned -16 [ 341.279516][ T7] usb 6-1: device descriptor read/64, error -71 [ 341.847900][ T7] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 342.028087][ T7] usb 6-1: device descriptor read/64, error -71 [ 342.168704][ T7] usb usb6-port1: attempt power cycle [ 342.597950][ T7] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 342.688954][ T7] usb 6-1: device descriptor read/8, error -71 [ 342.862989][ T7127] device syzkaller0 entered promiscuous mode [ 342.891885][ T7127] tipc: Started in network mode [ 342.897171][ T7127] tipc: Node identity 86210faa545b, cluster identity 4711 [ 342.938292][ T7127] tipc: Enabled bearer , priority 0 [ 342.958034][ T7] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 342.996201][ T7125] tipc: Resetting bearer [ 343.003008][ T7] usb 6-1: device descriptor read/8, error -71 [ 343.085287][ T7125] tipc: Disabling bearer [ 343.143973][ T7128] 9pnet: Could not find request transport: fd0x0000000000000004 [ 343.161460][ T7] usb usb6-port1: unable to enumerate USB device [ 343.403786][ T7134] loop3: detected capacity change from 0 to 1024 [ 343.414745][ T7134] EXT4-fs: Ignoring removed orlov option [ 343.421370][ T7134] EXT4-fs: quotafile must be on filesystem root [ 344.634888][ T7151] binder: BINDER_SET_CONTEXT_MGR already set [ 344.675589][ T7151] binder: 7150:7151 ioctl 4018620d 200000004a80 returned -16 [ 344.820415][ T7155] binder: 7149:7155 ioctl c0306201 0 returned -14 [ 344.865438][ T7148] netlink: 12 bytes leftover after parsing attributes in process `syz.0.739'. [ 345.468233][ T4312] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 345.672661][ T4312] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 345.722695][ T4312] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 345.797886][ T4311] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 345.835935][ T4312] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 345.865083][ T4312] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 346.009926][ T4311] usb 6-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 346.036407][ T7162] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 346.047661][ T4311] usb 6-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 346.074765][ T4311] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 346.162499][ T4311] usb 6-1: Product: syz [ 346.176083][ T4311] usb 6-1: Manufacturer: syz [ 346.190633][ T4311] usb 6-1: SerialNumber: syz [ 346.227426][ T4311] usb 6-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 346.576607][ T7167] netlink: 'syz.4.748': attribute type 10 has an invalid length. [ 346.639657][ T4311] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 346.718375][ T4311] dvbdev: DVB: registering new adapter (774 Friio White ISDB-T USB2.0) [ 346.734377][ T4333] usb 4-1: USB disconnect, device number 23 [ 346.815436][ T7167] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 346.865914][ T4311] usb 6-1: media controller created [ 346.936927][ T4311] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 347.358506][ T4312] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 347.559384][ T4312] usb 3-1: config 9 has an invalid interface number: 182 but max is 0 [ 347.591635][ T4312] usb 3-1: config 9 has no interface number 0 [ 347.644180][ T4312] usb 3-1: New USB device found, idVendor=0eb1, idProduct=7007, bcdDevice= 2.10 [ 347.757249][ T4312] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 347.777475][ T4312] usb 3-1: Product: syz [ 347.784581][ T4312] usb 3-1: Manufacturer: syz [ 347.793027][ T4312] usb 3-1: SerialNumber: syz [ 347.956270][ T4311] usb 6-1: USB disconnect, device number 9 [ 348.328525][ T7173] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 348.424122][ T7173] tipc: Enabled bearer , priority 10 [ 349.003969][ T7196] usb usb6: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 349.799367][ T4311] tipc: Node number set to 3409722840 [ 350.286591][ T4312] go7007: probe of 3-1:9.182 failed with error -12 [ 350.393155][ T7209] binder: 7204:7209 ioctl c0306201 0 returned -14 [ 350.398542][ T4312] usb 3-1: USB disconnect, device number 22 [ 350.677188][ T7206] 9pnet: Could not find request transport: fd0x0000000000000004 [ 351.850769][ T7230] unsupported nlmsg_type 40 [ 351.968590][ T7231] netlink: 48 bytes leftover after parsing attributes in process `syz.3.765'. [ 352.760915][ T7236] syz.4.768 (7236) used obsolete PPPIOCDETACH ioctl [ 353.137574][ T7240] loop5: detected capacity change from 0 to 2048 [ 353.220397][ T7240] NILFS (loop5): broken superblock, retrying with spare superblock (blocksize = 1024) [ 353.272388][ T7243] NILFS (loop5): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 353.365971][ T4324] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 353.569215][ T4324] usb 5-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 353.582818][ T4324] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 353.618506][ T4324] usb 5-1: config 0 descriptor?? [ 353.703281][ T26] audit: type=1804 audit(1773904204.576:91): pid=7245 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.5.770" name="/newroot/61/file2/bus" dev="loop5" ino=2097152 res=1 errno=0 [ 353.819493][ T7247] 9pnet_fd: Insufficient options for proto=fd [ 354.038810][ T4324] [drm:udl_init] *ERROR* Selecting channel failed [ 354.141031][ T4324] [drm] Initialized udl 0.0.1 20120220 for 5-1:0.0 on minor 2 [ 354.149150][ T4324] [drm] Initialized udl on minor 2 [ 354.162734][ T4324] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 354.178976][ T4324] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 354.225722][ T4324] usb 5-1: USB disconnect, device number 22 [ 354.270894][ T7] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffed [ 354.647954][ T4308] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 354.751223][ T7264] binder: 7259:7264 ioctl c0306201 0 returned -14 [ 354.827888][ T7] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 354.860196][ T4308] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 354.902932][ T4308] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 354.963985][ T4308] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 354.988865][ T7271] netlink: 76 bytes leftover after parsing attributes in process `syz.4.779'. [ 355.025226][ T4308] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 355.035172][ T7] usb 1-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 355.113429][ T7] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 355.127315][ T7252] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 355.193642][ T7] usb 1-1: config 0 descriptor?? [ 355.515959][ T4308] usb 4-1: USB disconnect, device number 24 [ 355.648020][ T7] [drm:udl_init] *ERROR* Selecting channel failed [ 355.803981][ T7] [drm] Initialized udl 0.0.1 20120220 for 1-1:0.0 on minor 2 [ 355.981508][ T7] [drm] Initialized udl on minor 2 [ 356.025973][ T7] udl 1-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 356.099484][ T7] udl 1-1:0.0: [drm] Cannot find any crtc or sizes [ 356.232164][ T7] usb 1-1: USB disconnect, device number 24 [ 356.276307][ T4324] udl 1-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffed [ 356.441354][ T4324] udl 1-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffed [ 356.488478][ T4324] udl 1-1:0.0: [drm] Cannot find any crtc or sizes [ 356.975788][ T7287] 9pnet_fd: Insufficient options for proto=fd [ 359.368010][ T4350] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 359.531746][ T7320] netlink: 4 bytes leftover after parsing attributes in process `syz.4.792'. [ 359.558866][ T4350] usb 3-1: Using ep0 maxpacket: 32 [ 359.574173][ T4350] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 359.597978][ T7023] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 359.645751][ T4350] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 359.674870][ T4350] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 359.713194][ T4350] usb 3-1: Product: syz [ 359.726774][ T4350] usb 3-1: Manufacturer: syz [ 359.746023][ T4350] usb 3-1: SerialNumber: syz [ 359.795625][ T7023] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 359.820537][ T4350] usb 3-1: config 0 descriptor?? [ 359.843696][ T7023] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 359.866901][ T4350] hub 3-1:0.0: bad descriptor, ignoring hub [ 359.905271][ T4350] hub: probe of 3-1:0.0 failed with error -5 [ 359.913368][ T7023] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 359.980624][ T7326] 9pnet_fd: Insufficient options for proto=fd [ 359.999790][ T7023] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 360.069272][ T7327] binder: 7323:7327 ioctl c0306201 0 returned -14 [ 360.082136][ T7023] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 360.132403][ T7023] usb 6-1: config 0 descriptor?? [ 360.427984][ T7] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 360.596787][ T7023] usbhid 6-1:0.0: can't add hid device: -71 [ 360.610078][ T7023] usbhid: probe of 6-1:0.0 failed with error -71 [ 360.618114][ T7] usb 1-1: device descriptor read/64, error -71 [ 360.660814][ T7023] usb 6-1: USB disconnect, device number 10 [ 360.988077][ T7] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 361.337980][ T7] usb 1-1: device descriptor read/64, error -71 [ 361.468375][ T7] usb usb1-port1: attempt power cycle [ 361.852047][ T7345] netlink: 'syz.4.802': attribute type 10 has an invalid length. [ 361.906971][ T7344] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 362.008045][ T7] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 362.111846][ T7] usb 1-1: device descriptor read/8, error -71 [ 362.367904][ T4312] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 362.431250][ T7] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 362.468662][ T7] usb 1-1: device descriptor read/8, error -71 [ 362.549995][ T4312] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 362.581064][ T4312] usb 6-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 362.598391][ T7] usb usb1-port1: unable to enumerate USB device [ 362.690886][ T4312] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 362.746968][ T4312] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 362.758167][ T7] usb 3-1: USB disconnect, device number 23 [ 362.805831][ T7355] netlink: 4 bytes leftover after parsing attributes in process `syz.4.805'. [ 362.847548][ T7349] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 363.116882][ T4310] usb 6-1: USB disconnect, device number 11 [ 363.426887][ T7364] 9pnet_fd: Insufficient options for proto=fd [ 363.910619][ T7375] tmpfs: Bad value for 'huge' [ 364.050332][ T7376] loop4: detected capacity change from 0 to 1024 [ 364.108063][ T2120] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 364.312340][ T2120] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 364.344351][ T2120] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 364.424727][ T7379] ubi: mtd0 is already attached to ubi31 [ 365.167884][ T2120] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 365.295185][ T2120] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 365.338098][ T2120] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 365.375392][ T4388] hfsplus: b-tree write err: -5, ino 25 [ 365.382396][ T4388] hfsplus: b-tree write err: -5, ino 4 [ 365.394075][ T2120] usb 4-1: config 0 descriptor?? [ 365.422709][ T4388] hfsplus: b-tree write err: -5, ino 2 [ 365.487299][ T4388] hfsplus: b-tree write err: -5, ino 26 [ 365.777703][ T7381] loop0: detected capacity change from 0 to 2048 [ 365.876423][ T7381] NILFS (loop0): broken superblock, retrying with spare superblock (blocksize = 1024) [ 365.980831][ T2120] usbhid 4-1:0.0: can't add hid device: -71 [ 365.987489][ T2120] usbhid: probe of 4-1:0.0 failed with error -71 [ 366.022369][ T2120] usb 4-1: USB disconnect, device number 25 [ 366.076750][ T4371] udevd[4371]: incorrect nilfs2 checksum on /dev/loop0 [ 366.145463][ T7385] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 366.836345][ T7390] netlink: 4 bytes leftover after parsing attributes in process `syz.4.816'. [ 367.283875][ T7401] netlink: 16 bytes leftover after parsing attributes in process `syz.4.820'. [ 367.297950][ T7] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 367.399294][ T4308] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 367.489989][ T7] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 367.513999][ T7] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 367.568064][ T4308] usb 4-1: device descriptor read/64, error -71 [ 367.568498][ T7] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 367.616307][ T7] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 367.653085][ T7] usb 1-1: SerialNumber: syz [ 367.696991][ T7405] netlink: 4768 bytes leftover after parsing attributes in process `syz.4.822'. [ 367.718897][ T7405] netlink: 4768 bytes leftover after parsing attributes in process `syz.4.822'. [ 367.853375][ T4308] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 367.997573][ T7] usb 1-1: 0:2 : does not exist [ 368.017878][ T4308] usb 4-1: device descriptor read/64, error -71 [ 368.042471][ T7] usb 1-1: USB disconnect, device number 29 [ 368.057609][ T7409] tmpfs: Bad value for 'huge' [ 368.064793][ T7403] mmap: syz.5.821 (7403) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 368.106649][ T7403] [ 368.109153][ T7403] ====================================================== [ 368.116264][ T7403] WARNING: possible circular locking dependency detected [ 368.124176][ T7403] syzkaller #0 Not tainted [ 368.128818][ T7403] ------------------------------------------------------ [ 368.136153][ T7403] syz.5.821/7403 is trying to acquire lock: [ 368.142650][ T7403] ffff88802675c1b0 (&sb->s_type->i_mutex_key#13){+.+.}-{3:3}, at: process_measurement+0x3a2/0x1c30 [ 368.154003][ T7403] [ 368.154003][ T7403] but task is already holding lock: [ 368.162402][ T7403] ffff8880744ac4d8 (&mm->mmap_lock){++++}-{3:3}, at: __se_sys_remap_file_pages+0x1a4/0x7b0 [ 368.172725][ T7403] [ 368.172725][ T7403] which lock already depends on the new lock. [ 368.172725][ T7403] [ 368.183631][ T7403] [ 368.183631][ T7403] the existing dependency chain (in reverse order) is: [ 368.193032][ T7403] [ 368.193032][ T7403] -> #1 (&mm->mmap_lock){++++}-{3:3}: [ 368.201251][ T7403] down_read_killable+0x4c/0x340 [ 368.206965][ T7403] mmap_read_lock_killable+0x1d/0x60 [ 368.213088][ T7403] lock_mm_and_find_vma+0x2b1/0x2f0 [ 368.219122][ T7403] do_user_addr_fault+0x2db/0xb10 [ 368.226762][ T7403] exc_page_fault+0x60/0x100 [ 368.232490][ T7403] asm_exc_page_fault+0x22/0x30 [ 368.238143][ T7403] fault_in_readable+0x13e/0x1f0 [ 368.243780][ T7403] fault_in_iov_iter_readable+0xbb/0x2e0 [ 368.250278][ T7403] generic_perform_write+0x1f1/0x5c0 [ 368.256284][ T7403] __generic_file_write_iter+0x148/0x2a0 [ 368.262811][ T7403] generic_file_write_iter+0xab/0x2e0 [ 368.268941][ T7403] vfs_write+0x4b1/0xa30 [ 368.273891][ T7403] ksys_write+0x14c/0x250 [ 368.278984][ T7403] do_syscall_64+0x4c/0xa0 [ 368.292381][ T7403] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 368.298886][ T7403] [ 368.298886][ T7403] -> #0 (&sb->s_type->i_mutex_key#13){+.+.}-{3:3}: [ 368.308538][ T7403] __lock_acquire+0x2d07/0x7d10 [ 368.313982][ T7403] lock_acquire+0x1bb/0x4a0 [ 368.319540][ T7403] down_write+0x36/0x60 [ 368.324379][ T7403] process_measurement+0x3a2/0x1c30 [ 368.330509][ T7403] ima_file_mmap+0x102/0x150 [ 368.335872][ T7403] __se_sys_remap_file_pages+0x559/0x7b0 [ 368.342104][ T7403] do_syscall_64+0x4c/0xa0 [ 368.347243][ T7403] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 368.354121][ T7403] [ 368.354121][ T7403] other info that might help us debug this: [ 368.354121][ T7403] [ 368.364753][ T7403] Possible unsafe locking scenario: [ 368.364753][ T7403] [ 368.372633][ T7403] CPU0 CPU1 [ 368.378483][ T7403] ---- ---- [ 368.383903][ T7403] lock(&mm->mmap_lock); [ 368.388384][ T7403] lock(&sb->s_type->i_mutex_key#13); [ 368.390494][ T7411] loop4: detected capacity change from 0 to 1024 [ 368.396868][ T7403] lock(&mm->mmap_lock); [ 368.410386][ T7403] lock(&sb->s_type->i_mutex_key#13); [ 368.417024][ T7403] [ 368.417024][ T7403] *** DEADLOCK *** [ 368.417024][ T7403] [ 368.425770][ T7403] 1 lock held by syz.5.821/7403: [ 368.431461][ T7403] #0: ffff8880744ac4d8 (&mm->mmap_lock){++++}-{3:3}, at: __se_sys_remap_file_pages+0x1a4/0x7b0 [ 368.442256][ T7403] [ 368.442256][ T7403] stack backtrace: [ 368.448460][ T7403] CPU: 1 PID: 7403 Comm: syz.5.821 Not tainted syzkaller #0 [ 368.456063][ T7403] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 368.466362][ T7403] Call Trace: [ 368.469820][ T7403] [ 368.472803][ T7403] dump_stack_lvl+0x188/0x24e [ 368.478455][ T7403] ? load_image+0x400/0x400 [ 368.483152][ T7403] ? show_regs_print_info+0x12/0x12 [ 368.488869][ T7403] ? print_circular_bug+0x12b/0x1a0 [ 368.494338][ T7403] check_noncircular+0x296/0x330 [ 368.499533][ T7403] ? look_up_lock_class+0x75/0x140 [ 368.505180][ T7403] ? add_chain_block+0x940/0x940 [ 368.510376][ T7403] ? lockdep_lock+0xf1/0x1f0 [ 368.515040][ T7403] ? _find_first_zero_bit+0xcf/0x100 [ 368.520437][ T7403] __lock_acquire+0x2d07/0x7d10 [ 368.525817][ T7403] ? ima_match_policy+0x107/0x2120 [ 368.531804][ T7403] ? __lock_acquire+0x7d10/0x7d10 [ 368.537129][ T7403] ? verify_lock_unused+0x140/0x140 [ 368.542770][ T7403] ? ima_match_policy+0x107/0x2120 [ 368.548036][ T7403] ? ima_match_policy+0x2093/0x2120 [ 368.553314][ T7403] lock_acquire+0x1bb/0x4a0 [ 368.557978][ T7403] ? process_measurement+0x3a2/0x1c30 [ 368.563607][ T7403] ? __might_sleep+0xd0/0xd0 [ 368.568441][ T7403] ? read_lock_is_recursive+0x10/0x10 [ 368.574041][ T7403] ? ima_get_action+0x71/0xa0 [ 368.578918][ T7403] down_write+0x36/0x60 [ 368.583323][ T7403] ? process_measurement+0x3a2/0x1c30 [ 368.589046][ T7403] process_measurement+0x3a2/0x1c30 [ 368.594764][ T7403] ? ima_file_mmap+0x150/0x150 [ 368.600643][ T7403] ? aa_file_perm+0x112/0xf00 [ 368.605483][ T7403] ? aa_file_perm+0x112/0xf00 [ 368.610667][ T7403] ? mtree_load+0x100/0xa70 [ 368.615628][ T7403] ? apparmor_current_getsecid_subj+0xb1/0x110 [ 368.621942][ T7403] ima_file_mmap+0x102/0x150 [ 368.626700][ T7403] ? end_current_label_crit_section+0x14b/0x170 [ 368.633220][ T7403] ? ima_file_free+0x3e0/0x3e0 [ 368.638042][ T7403] ? common_file_perm+0x171/0x1c0 [ 368.643496][ T7403] ? bpf_lsm_mmap_file+0x5/0x10 [ 368.648616][ T7403] ? security_mmap_file+0x11b/0x180 [ 368.650183][ T4371] udevd[4371]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 368.653876][ T7403] __se_sys_remap_file_pages+0x559/0x7b0 [ 368.679354][ T7403] ? up_write+0x1bb/0x420 [ 368.684371][ T7403] ? __x64_sys_remap_file_pages+0xc0/0xc0 [ 368.690271][ T7403] ? lock_chain_count+0x20/0x20 [ 368.695374][ T7403] ? lockdep_hardirqs_on+0x94/0x140 [ 368.700718][ T7403] ? __x64_sys_remap_file_pages+0x1c/0xc0 [ 368.706775][ T7403] do_syscall_64+0x4c/0xa0 [ 368.712745][ T7403] ? clear_bhb_loop+0x60/0xb0 [ 368.721679][ T7403] ? clear_bhb_loop+0x60/0xb0 [ 368.728183][ T7403] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 368.735366][ T7403] RIP: 0033:0x7f8f2439c799 [ 368.740577][ T7403] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 368.764313][ T7403] RSP: 002b:00007f8f252b0028 EFLAGS: 00000246 ORIG_RAX: 00000000000000d8 [ 368.773222][ T7403] RAX: ffffffffffffffda RBX: 00007f8f24615fa0 RCX: 00007f8f2439c799 [ 368.781648][ T7403] RDX: 0000000000000000 RSI: 0000000000002000 RDI: 0000200000902000 [ 368.790547][ T7403] RBP: 00007f8f24432c99 R08: 0000000000000001 R09: 0000000000000000 [ 368.799547][ T7403] R10: 0000000000000040 R11: 0000000000000246 R12: 0000000000000000 [ 368.807969][ T7403] R13: 00007f8f24616038 R14: 00007f8f24615fa0 R15: 00007fff6e2e3628 [ 368.816749][ T7403] [ 368.830920][ T4308] usb usb4-port1: attempt power cycle [ 368.959812][ T7414] ubi: mtd0 is already attached to ubi31 [ 369.110401][ T7410] caif:caif_disconnect_client(): nothing to disconnect [ 369.287890][ T4308] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 369.314387][ T41] hfsplus: b-tree write err: -5, ino 25 [ 369.320614][ T41] hfsplus: b-tree write err: -5, ino 4 [ 369.326401][ T41] hfsplus: b-tree write err: -5, ino 2 [ 369.332527][ T41] hfsplus: b-tree write err: -5, ino 26 [ 369.340458][ T4308] usb 4-1: device descriptor read/8, error -71 [ 369.607891][ T4308] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 369.639813][ T4308] usb 4-1: device descriptor read/8, error -71 [ 369.758193][ T4308] usb usb4-port1: unable to enumerate USB device