last executing test programs: 8.026940879s ago: executing program 4 (id=5523): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) 7.243543975s ago: executing program 4 (id=5526): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=@newqdisc={0x24, 0x29, 0x4ee4e6a52ff56541, 0x5001, 0xfffffdfb, {0x0, 0x0, 0x0, r2, {0x4}, {0xffff, 0xffff}, {0x0, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x400dc}, 0x4000080) 7.136178562s ago: executing program 4 (id=5529): r0 = socket$inet6(0xa, 0x3, 0x3c) setsockopt$inet6_IPV6_RTHDR(r0, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="0002020100000008ff"], 0x18) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x2, @dev={0xfe, 0x80, '\x00', 0x2c}, 0x5}, 0x1c) syz_usb_connect$uac3(0x0, 0xa0, &(0x7f00000000c0)=ANY=[@ANYBLOB="12011003000000403512100040000102030109028e000301002040080b0201012130c60904000000010130000a2401042a00ff0f000013240305000102060202800000070010"], 0x0) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000100)="88", 0xfdef}], 0x1) 6.884770054s ago: executing program 3 (id=5531): syz_emit_ethernet(0x36, &(0x7f0000000080)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x4020, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) 6.816497067s ago: executing program 3 (id=5532): socket$inet_udp(0x2, 0x2, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000000000003000000400001802c0004001400010002000000ac1414aa0000"], 0x54}}, 0x0) 6.724949246s ago: executing program 3 (id=5533): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x80002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000001480)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r1, 0x0, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x50}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0x7}, {}, {0x7, 0xe}}, [@filter_kind_options=@f_fw={{0x7}, {0xc, 0x2, [@TCA_FW_CLASSID={0x8, 0x1, {0x1, 0x6}}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8d0}, 0x8000) 6.449705874s ago: executing program 3 (id=5534): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = shmget(0x0, 0x1000, 0x2, &(0x7f0000871000/0x1000)=nil) syz_open_procfs(0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) shmctl$IPC_INFO(r4, 0x3, 0x0) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x1c, 0x1, 0x4, 0x101, 0x0, 0x0, {0x0, 0x0, 0x400}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x1c}}, 0x0) close(0x3) 6.07935639s ago: executing program 4 (id=5535): writev(0xffffffffffffffff, &(0x7f00000004c0)=[{0x0}, {&(0x7f0000000200)="24f5bb", 0x3}], 0x2) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}], 0x10) sendto$inet6(r0, &(0x7f0000000a40)='\x00', 0x1, 0x0, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000100)={0x7, 0x84, 0x2, 0x5, 0x5, 0xf2, 0x0, 0x0, 0xfa, 0x2, 0x3, 0x6, 0x2, 0x2}, 0xe) recvmmsg(r0, &(0x7f0000000200)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=""/36, 0x18}, 0x6}], 0x400000000000084, 0x40000100, 0x0) 5.126331785s ago: executing program 4 (id=5541): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x50) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x80002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000001480)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x282400, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) socket$unix(0x1, 0x5, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) close(r3) 4.899385556s ago: executing program 0 (id=5542): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x9, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9, 0xfe00}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x8}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x6, 0x1, 0xb, 0x8, 0x9}, {0x4, 0x0, 0x0, 0x8}, {}, {}, {}, {0x18, 0x8, 0x2, 0x0, r0}, {}, {0x46, 0x0, 0x0, 0x76}}], {{}, {0x6, 0x0, 0x7, 0x8, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, @cgroup_sock, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 4.706928244s ago: executing program 3 (id=5543): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r4, {0xffff}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x5, 0xd, 0x8b, 0xd, 0x2, 0x4, 0x2, 0xf, 0x6, 0x3, 0x7, 0x8, 0x4, 0x10, 0x4], 0x3, [0xb, 0x3, 0xad1e, 0x2002, 0x1, 0x4, 0x2, 0xd06, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xe, 0x100], [0xfff1, 0x5, 0xffff, 0xfff5, 0x4, 0x8, 0x1, 0x9, 0x5, 0x2, 0xc, 0x4, 0xfffc, 0x3, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r5, 0x0, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffe00, {0x0, 0x0, 0x0, r9, {0xc}, {0x8}, {0xfff2, 0xffe1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0xe, [0xc, 0x5, 0x0, 0xf, 0x10, 0x2, 0x4, 0x2, 0xf, 0x6, 0x6, 0x1, 0xc, 0x4, 0x10, 0x4], 0x3, [0xb, 0x5, 0x7fff, 0x2002, 0x1, 0x4, 0x2, 0xd06, 0xff05, 0x8000, 0xb, 0x3, 0x5, 0x6, 0xd, 0x1], [0x2, 0x5, 0x2, 0xfff5, 0x4, 0x8, 0x7, 0x9, 0x5, 0x2, 0xc, 0x40, 0xfffc, 0x3, 0x1, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) close(0x3) 4.648672672s ago: executing program 0 (id=5544): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x80002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000001480)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x50}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0x7}, {}, {0x7, 0xe}}, [@filter_kind_options=@f_fw={{0x7}, {0xc, 0x2, [@TCA_FW_CLASSID={0x8, 0x1, {0x1, 0x6}}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8d0}, 0x8000) 4.636420987s ago: executing program 1 (id=5545): r0 = socket$inet6(0xa, 0x3, 0x3c) setsockopt$inet6_IPV6_RTHDR(r0, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="0002020100000008ff"], 0x18) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x2, @dev={0xfe, 0x80, '\x00', 0x2c}, 0x5}, 0x1c) syz_usb_connect$uac3(0x0, 0xa0, &(0x7f00000000c0)=ANY=[@ANYBLOB="12011003000000403512100040000102030109028e000301002040080b0201012130c60904000000010130000a2401042a00ff0f00001324030500010206020280000007001000"], 0x0) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000100)="88", 0xfdef}], 0x1) 3.794475846s ago: executing program 2 (id=5546): r0 = socket$igmp6(0xa, 0x3, 0x2) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000002bc0)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) r1 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x4ea4, 0x20000, @local, 0x9}, 0x1c) sendmsg(r1, &(0x7f00000000c0)={0x0, 0x952b, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0xffd0}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) 3.445957055s ago: executing program 2 (id=5547): ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000440)={0x0, 0x100000000000000c, 0x1, [0x0, 0x0, 0x3, 0x401, 0x1], [0x9, 0xb, 0x7, 0x1, 0xd, 0x2, 0x10, 0x7, 0x5, 0xffffffff, 0x10000, 0x1, 0x9, 0x5, 0x2, 0x3d2, 0x9, 0x10, 0x402, 0x5de, 0x9, 0x7, 0x3, 0x8001, 0x40000000000009, 0x2, 0x9, 0x547, 0xca66, 0x46, 0x8, 0x81, 0x0, 0x8, 0x6, 0x5, 0x7, 0xfffffffffffffffe, 0x4, 0x6, 0x5, 0x5, 0x8, 0xfffffffffffffffd, 0x1, 0x400000000, 0x6, 0x8, 0x4, 0x8, 0x3, 0x10000, 0xd, 0x2, 0x8, 0xf, 0x3, 0x1f1, 0x32, 0x0, 0xbba, 0x701bf6c8, 0xf9, 0x8, 0x8, 0xe, 0x8000000000000000, 0xfffffffffffffffb, 0xb, 0x66fe, 0x6, 0x7, 0x1, 0x1, 0x8, 0x1000008000, 0x2, 0xe34b, 0x1000, 0x4, 0x1b12, 0x8001, 0x225f, 0x0, 0xfff, 0x9, 0x6, 0x0, 0x4, 0xb554, 0xfff, 0x4, 0x805, 0x10001, 0x5, 0x100000000, 0x2cf, 0x5, 0x400000000000, 0x5, 0x44, 0x565a, 0x8001, 0xb40, 0x81, 0x9, 0x100000001, 0x7fff, 0x8, 0x9, 0x8000000000000001, 0x9, 0x3, 0x3ff, 0x3fd, 0x2, 0xb, 0xfc, 0x0, 0x0, 0x1]}) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000002bc0)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) r1 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x4ea4, 0x0, @mcast1, 0x9}, 0x1c) sendmsg(r1, 0x0, 0x44004) 3.443943202s ago: executing program 1 (id=5548): pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002, 0x2004}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x22004001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendto$inet6(r1, &(0x7f0000000080)="44f9b108b1cd", 0x6, 0x1, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x406f413, 0x0) 3.274596394s ago: executing program 1 (id=5549): sendmsg$ETHTOOL_MSG_PRIVFLAGS_GET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000480)={0x58, 0x0, 0x400, 0x70bd29, 0x25dfdbfb, {}, [@HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_1\x00'}]}, @HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg1\x00'}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000800}, 0x40010) sendmsg$ETHTOOL_MSG_RINGS_GET(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="0a012a20", @ANYRES16=0x0, @ANYBLOB, @ANYRES32, @ANYBLOB="0c001a804800030001"], 0x2c}}, 0x0) r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000240)="aefc00001a0025f01d85bc04fef7681d020b49ff708800008003280008021000ac0a1410bc71176a36ede498534108e58342fa94a235a2a441f9", 0xfcae) 3.149820954s ago: executing program 1 (id=5550): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r0, 0x0, 0x0, 0x20044840) sendmmsg$inet(r0, &(0x7f0000003d00)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000bc0)="4490137c227c56ee66c372f3105eb186dd8062fad2d5b5bfb0ba068e74a8d026", 0x20}], 0x1}}, {{0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000001500)="24acadd7f04daaa04e88680351d9ce53f67fd2afefe557d4bd561f02df2570f175951d4bdd97ec433ec583c79fa668922a61c8662e0890ce06996f5ba401e582dfb5197822bee50c6cd4b3a6f9d14f1fde9b1698ad6847d4fde0458282ece396a1e212cd02e6fb62599df5ecb5984843ee04e96eb26fa2a8100a0b7b2d032fff965485ded83b39d6c9835416a8db5414a6c54101693e6b05e652b49fceaf4a0cc2b7898034ff0eb5150b3e85b9ff5658ba346d0b6b5a3a71eb084311606cf6b8ccf7c45a79b319a201e9c5ae9f0aab5c4dd7a77de7f5ae2edb307892dbfa8377446d8cabb9302b27250c66ddaeb3988933df044b6ae4570671cf861484b9124827dbe78a0388eecac9e6ad371287ca014fa658c6f1308b046b2fc0cc3d5b8ba48f3b1319d5976bb45f3c630f01c77b93f07fe2b304a98383258a37791da00145e24f619c5dd07939c39212ca7d8421dcf50ab703f86dacf4a4159a123d25a7a9ad2319a876af43da4cf86b0f6a7f261562e1b10681a71d941a5e90031452e37f4a616b85fe6b48803cbca2369565be720ef5fd1e6326234c34f6e13ba39f9460acc6", 0x1a2}], 0x1}}, {{&(0x7f0000000140)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x44}}, 0x10, 0x0}}, {{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000840)="31f8cf62241b165c06f727f727e30bed2dfe9991220e661bd1da20", 0x1b}], 0x1}}, {{0x0, 0x0, &(0x7f0000003780)=[{0x0}], 0x1}}], 0x5, 0x2090) 3.148165659s ago: executing program 2 (id=5551): writev(0xffffffffffffffff, &(0x7f00000004c0)=[{0x0}, {&(0x7f0000000200)="24f5bb", 0x3}], 0x2) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}], 0x10) sendto$inet6(r0, &(0x7f0000000a40)='\x00', 0x1, 0x0, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000100)={0x7, 0x84, 0x2, 0x5, 0x5, 0xf2, 0x0, 0x0, 0xfa, 0x2, 0x3, 0x6, 0x2, 0x2}, 0xe) recvmmsg(r0, &(0x7f0000000200)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=""/36, 0x18}, 0x6}], 0x400000000000084, 0x40000100, 0x0) 2.223840926s ago: executing program 1 (id=5552): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x44004000) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r1) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000003c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x80, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_EXPRESSIONS={0x54, 0x4, 0x0, 0x1, [{0x50, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x40, 0x2, 0x0, 0x1, [@NFTA_TARGET_REV={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_TARGET_INFO={0x2c, 0x3, "7339f2f10455afb9fdd672bad09dfb78c7699c74e891a0c700"/40}, @NFTA_TARGET_NAME={0x8, 0x1, 'TEE\x00'}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xa8}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8923, &(0x7f0000000040)={'bond0\x00', 0x1001}) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="4400000010000104a5270b7357000000925e4a44", @ANYRES32, @ANYBLOB="0dfa130016000000240012000c00010000000000000000000c0002f60800000001180000080001"], 0x44}}, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r3, 0xc020f509, &(0x7f0000000280)={r3, 0x7, 0x104, 0x7ff}) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000180)=0x800, 0x4) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB='H'], 0x48}, 0x1, 0x0, 0x0, 0x20004810}, 0x0) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000001500)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c00000005000000020000000000000f8300000044942d050000000400000f01000000050000000900000000000000040000000400000004000000830000000100000080002e616100"/105], &(0x7f00000014c0)=""/2, 0x69, 0x2, 0x1}, 0x28) socket$kcm(0x2, 0xa, 0x2) 2.195656313s ago: executing program 2 (id=5553): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = shmget(0x0, 0x1000, 0x2, &(0x7f0000871000/0x1000)=nil) syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_mr_vif\x00') sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) shmctl$IPC_INFO(r4, 0x3, 0x0) sendmsg$NFULNL_MSG_CONFIG(r0, 0x0, 0x0) close(0x3) 920.380851ms ago: executing program 2 (id=5554): socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r1) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000001c0)=ANY=[@ANYBLOB="98030000", @ANYRES16=r2, @ANYBLOB="010028057000fcdbdf253b000000080003", @ANYRES32=r3, @ANYBLOB="04008e00080057001b0a000004006c000500190107000000080026006c090000560333"], 0x398}}, 0x0) 566.162393ms ago: executing program 4 (id=5555): llistxattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000100)=""/244, 0xf4) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00'}) socket(0x10, 0x80002, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='io\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r4, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r6 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r6, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) fstat(r2, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) setreuid(0x0, r7) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000012edfffebfa30000000000000703000028feffff620af0fff8ffffff61a4f0ff000000003e040000000000003f00000000000000b604000001ede0ff2500000017ffff17cc040000000000007b0a00fe000000006e04000000000000c6000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be3619184e50b91f32050e436fe275daf51efd601b6482a0800000098efd2a102ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc532ef58de3c1b7646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff095edc710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9e104d4d91af25b8123deda8a3658d42ecbf28bf6d8e8afcb913466aaa7f6df70252e79166d8582755a314d31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040b96e37c4f46010400000000c3da29faf75ddd1aa96960bca97af133824b881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d4cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f1300010000949b3aab06b1e042ff2164d80c8ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090df9a2867b3acec439c163fc8706869ada11390d4dbcf840fa68e7d7071b53ac29df826f8ae6d6e18c1e0600bf870768d5217e9bb5a05d9e224e67f1231bd236ed200073824d93c4e1a0f50a74bb4850486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931485747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee6330000000000000000000000000000000000004000000000000000038600008fb854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885f69754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8264f7b029b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8265e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347926a4bac694c55fe9d145906d410f58f1951405d10504efe402cae085afef5dbd617e87ddbd239e4a50d7eb8e327fb5db12cbd6a9efe8e671c4f251cafffe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f8cb66701f4578ba4cb9b706e605a88c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa232697526e24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f467b6bbf3aa4371f5e76ab3f6a20278a3c779e03afd9a6af6fd518e5dce030f88ec5a5cb7601a161da0f80893220800c523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f626483632a2ab547f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe917d1767e38ba49e3e57fafea83e495a6a1d1a4ebf83434986091dd66ffe3ffed0c39552a312e2db596d9c827e02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007fe79d2d25e30830b92fca00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d07d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cf026657a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b53208ad8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2cccb15b5d7d3e37e8b7d28921c4b9280979521173f322df408d9818b6cc400090300000021911480a876fbba698801937e8b4264eb6f5137bdaa075f1488d22230592a79000000000000000000000000000000000000000000110000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b308706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb5237ea1694addebc14c3ae49f88c462ea2050acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399f055f2fa278783f26d0a52aefb0a5ef0b41e14a6fe6ba306206670b84894e901a523fcbadfeff535f2514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014f38fee012365f963b2a85e7d8075c333475b9f0284405e3127dde7e41285fbe0bdd370c06c6a41744c3d24eab511317f97b7b4a1c2ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd6d6ab7e0e843591d2618e2d2cdc7081c8fafffe9c3500800000087de4ee7aac6478d99de7dd82bef044a6d33c789d566c90c46ad581aa22f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119dcf5bda599d625054776151b2cd1fcde238bdc527594a6c17aa9728af24e2bb7a3830e7092b01b119ea4e7e7f0e21527d622cc29c9f0c8720195368f8374337ab4d130619d93c5ef37e7ddd0b2da147e6e513455b88753452de959a6cbfa1ffbc7ad5d8c3b48017fd31dcf72f337b639253f44cb27a12174bc4c191e21015d0c431a71906eb9c6a14c8a060459ef26787ce3d1cbfd5cc459f0048b5d06f6cbd3e9b34c89f3fb2f951ae81d7fcc8bc0000000000000000000000000000000000000000009231feef3117197c796369f776c8b2ea3970f358107945d9e74e9bdfa58e68b65a8f01bc4b73cc31df5aa29f363917f90e3fa1eaf553db1c761dd9b634a9c4d7c21c24fe6d953ed9438cad0f8dfe03e5e2f73019352f1fb682a5a6ebbf24ebc49e3d7058e696eb3f4b642f36c9006c0067e24a64aa8c53dd824a3c08bfda74a143c855030ae004ac797c575c202d8091eb77565212548ead770d68000000000099347593f67da85d1c962bfb320d1553a74ec3bf003ba62b1784dbf0168a7e85f28b77bdebce96bf386a6dd5df162a16f2b7e8a4de0ffc464a87f91f81866d2ef0af71ebb07a739c3cb1b7000000000000"], &(0x7f00000001c0)='GPL\x00'}, 0x48) pread64(r1, &(0x7f000001a240)=""/102400, 0x19000, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000040), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r8, 0x0) fdatasync(r8) getsockopt$inet_tcp_buf(r1, 0x6, 0x36, &(0x7f0000000300)=""/168, &(0x7f0000000080)=0xa8) 547.920193ms ago: executing program 0 (id=5556): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000002dc0)=ANY=[@ANYBLOB], 0x94}}, 0x0) 496.863233ms ago: executing program 3 (id=5557): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000206d049cc20000000000010902a400010000000009040000010300000009210000000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, &(0x7f0000000100)={0x0, 0x2, 0x8, {0x8, 0xe, "99f16cf21b62"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 431.085211ms ago: executing program 2 (id=5558): syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0x1235, 0x8014, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x1, 0x60, 0x10, {0x8, 0xb, 0x0, 0x2, 0x1, 0x1, 0x30, 0x7}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xd, 0xa, 0x8}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x40, 0xf, 0x87, {0xa, 0x25, 0x25, 0x6, 0xff}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0xfa, 0x4, 0x2, {0xa, 0x25, 0x25, 0x401, 0x8, 0x1000}}}}}}}}]}}, 0x0) 399.602397ms ago: executing program 1 (id=5559): syz_usb_connect(0x1, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a82300000904000002ca744d00090503034d00ff99090805", @ANYRES32], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) timer_create(0x0, 0x0, &(0x7f0000000000)=0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = dup3(r0, r2, 0x80000) r4 = dup(r3) read(r4, &(0x7f00000014c0)=""/4096, 0x1000) timer_settime(r1, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) 378.978757ms ago: executing program 0 (id=5560): sendmsg$ETHTOOL_MSG_PRIVFLAGS_GET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000480)={0x58, 0x0, 0x400, 0x70bd29, 0x25dfdbfb, {}, [@HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_1\x00'}]}, @HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg1\x00'}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000800}, 0x40010) sendmsg$ETHTOOL_MSG_RINGS_GET(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="0a012a20", @ANYRES16=0x0, @ANYBLOB="e60f000901008b00005d33", @ANYRES32, @ANYBLOB="0c001a804800030001"], 0x2c}}, 0x0) r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000240)="aefc00001a0025f01d85bc04fef7681d020b49ff708800008003280008021000ac0a1410bc71176a36ede498534108e58342fa94a235a2a441f9", 0xfcae) 256.845352ms ago: executing program 0 (id=5561): ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000440)={0x0, 0x100000000000000c, 0x1, [0x0, 0x0, 0x3, 0x401, 0x1], [0x9, 0xb, 0x7, 0x1, 0xd, 0x2, 0x10, 0x7, 0x5, 0xffffffff, 0x10000, 0x1, 0x9, 0x5, 0x2, 0x3d2, 0x9, 0x10, 0x402, 0x5de, 0x9, 0x7, 0x3, 0x8001, 0x40000000000009, 0x2, 0x9, 0x547, 0xca66, 0x46, 0x8, 0x81, 0x0, 0x8, 0x6, 0x5, 0x7, 0xfffffffffffffffe, 0x4, 0x6, 0x5, 0x5, 0x8, 0xfffffffffffffffd, 0x1, 0x400000000, 0x6, 0x8, 0x4, 0x8, 0x3, 0x10000, 0xd, 0x2, 0x8, 0xf, 0x3, 0x1f1, 0x32, 0x0, 0xbba, 0x701bf6c8, 0xf9, 0x8, 0x8, 0xe, 0x8000000000000000, 0xfffffffffffffffb, 0xb, 0x66fe, 0x6, 0x7, 0x1, 0x1, 0x8, 0x1000008000, 0x2, 0xe34b, 0x1000, 0x4, 0x1b12, 0x8001, 0x225f, 0x0, 0xfff, 0x9, 0x6, 0x0, 0x4, 0xb554, 0xfff, 0x4, 0x805, 0x10001, 0x5, 0x100000000, 0x2cf, 0x5, 0x400000000000, 0x5, 0x44, 0x565a, 0x8001, 0xb40, 0x81, 0x9, 0x100000001, 0x7fff, 0x8, 0x9, 0x8000000000000001, 0x9, 0x3, 0x3ff, 0x3fd, 0x2, 0xb, 0xfc, 0x0, 0x0, 0x1]}) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000002bc0)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) r1 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x4ea4, 0x0, @mcast1, 0x9}, 0x1c) sendmsg(r1, 0x0, 0x44004) 0s ago: executing program 0 (id=5562): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000001880)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000180)="0a6ea58d6228d8465b159e2424b8ff9911fe6cdb30318d43e279513641a27c8f0d56cb29f637becc8ed81426b052082f45a42ee732bddce4a1477de081b96cb0539b43715c711bcdd4d9a54d21d5c3af77bf119e795c6e2403df71c1f8914ca0f4f683a7d3160d9a2e416d339b81def057e0ecacc256bed81747a400110f8ec63310787c807fd4d7a57ce53527b4e578115ba08652f4d784c6dea1341b5ad51b71a68e", 0xa3}, {0x0}], 0x2}}], 0x1, 0x20044840) sendmmsg$inet(r0, &(0x7f0000001480)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000bc0)="4490", 0x2}], 0x1}}, {{0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000001500)="24acadd7f04daaa04e88680351d9ce53f67fd2afefe557d4bd561f02df2570f175951d4bdd97ec433ec583c79fa668922a61c8662e0890ce06996f5ba401e582dfb5197822bee50c6cd4b3a6f9d14f1fde9b1698ad6847d4fde0458282ece396a1e212cd02e6fb62599df5ecb5984843ee04e96eb26fa2a8100a0b7b2d032fff965485ded83b39d6c9835416a8db5414a6c54101693e6b05e652b49fceaf4a0cc2b7898034ff0eb5150b3e85b9ff5658ba346d0b6b5a3a71eb084311606cf6b8ccf7c45a79b319a201e9c5ae9f0aab5c4dd7a77de7f5ae2edb30", 0xda}], 0x1}}], 0x2, 0x2090) sendto$inet(r0, &(0x7f0000000580)="17", 0xfdef, 0x10008095, 0x0, 0x0) kernel console output (not intermixed with test programs): ize 0 [ 781.388598][ T29] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 781.420309][ T29] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 781.457913][ T29] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 781.483543][T17084] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(3) [ 781.487743][ T29] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 781.490573][T17084] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 781.525208][T17084] vhci_hcd vhci_hcd.0: Device attached [ 781.527897][ T29] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 781.693207][ T1559] vhci_hcd vhci_hcd.3: vhci_device speed not set [ 781.761623][ T1559] usb 39-1: new full-speed USB device number 2 using vhci_hcd [ 781.765403][ T29] usb 3-1: usb_control_msg returned -32 [ 781.781604][ T29] usbtmc 3-1:16.0: can't read capabilities [ 782.200587][T17088] vhci_hcd: connection reset by peer [ 782.250069][ T150] vhci_hcd vhci_hcd.3: stop threads [ 782.279530][ T150] vhci_hcd vhci_hcd.3: release socket [ 782.299645][ T150] vhci_hcd vhci_hcd.3: disconnect device [ 782.633385][T17092] usbtmc 3-1:16.0: usb_control_msg returned -32 [ 782.666951][ T5691] usb 3-1: USB disconnect, device number 71 [ 782.789635][T17103] netlink: 'syz.1.3305': attribute type 10 has an invalid length. [ 782.867259][T17103] veth0_vlan: left promiscuous mode [ 782.897026][T17103] veth0_vlan: entered promiscuous mode [ 782.945451][T17103] team0: Device veth0_vlan failed to register rx_handler [ 783.860042][T14127] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 783.876430][T14127] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 783.895760][T14127] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 783.907936][T14127] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 783.924160][T14127] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 785.154017][ T150] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 785.533178][ T150] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 785.930848][ T150] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 786.042085][T14127] Bluetooth: hci2: command tx timeout [ 786.145206][T17140] bridge0: port 1(bridge_slave_0) entered blocking state [ 786.164246][T17140] bridge0: port 1(bridge_slave_0) entered disabled state [ 786.186913][T17140] bridge_slave_0: entered allmulticast mode [ 786.207718][T17140] bridge_slave_0: entered promiscuous mode [ 786.291023][ T150] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 786.335601][T17140] bridge0: port 2(bridge_slave_1) entered blocking state [ 786.354679][T17140] bridge0: port 2(bridge_slave_1) entered disabled state [ 786.380439][T17140] bridge_slave_1: entered allmulticast mode [ 786.402634][T17140] bridge_slave_1: entered promiscuous mode [ 786.604799][T17140] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 786.788723][T17140] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 786.914459][ T1559] vhci_hcd vhci_hcd.3: vhci_device speed not set [ 787.099451][T17140] team0: Port device team_slave_0 added [ 787.156877][T17140] team0: Port device team_slave_1 added [ 787.428262][T17140] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 787.460790][T17140] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 787.575054][T17140] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 787.776292][T17140] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 787.816290][T17140] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 787.930308][T17140] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 788.122038][T14127] Bluetooth: hci2: command tx timeout [ 788.294024][ T150] bridge_slave_1: left allmulticast mode [ 788.346897][ T150] bridge_slave_1: left promiscuous mode [ 788.363912][ T150] bridge0: port 2(bridge_slave_1) entered disabled state [ 788.420070][ T150] bridge_slave_0: left allmulticast mode [ 788.453928][ T150] bridge_slave_0: left promiscuous mode [ 788.485065][ T150] bridge0: port 1(bridge_slave_0) entered disabled state [ 789.533676][ T150] bond1 (unregistering): (slave gretap1): Releasing active interface [ 790.034813][ T150] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 790.072178][ T150] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 790.086711][ T150] bond0 (unregistering): Released all slaves [ 790.106318][ T150] bond1 (unregistering): Released all slaves [ 790.137291][ T150] bond2 (unregistering): Released all slaves [ 790.170483][ T150] bond3 (unregistering): Released all slaves [ 790.205103][T14127] Bluetooth: hci2: command tx timeout [ 790.229380][ T150] bond4 (unregistering): Released all slaves [ 790.278644][ T150] bond5 (unregistering): Released all slaves [ 790.308038][T17271] kvm: user requested TSC rate below hardware speed [ 790.337892][ T150] bond6 (unregistering): Released all slaves [ 790.365955][ T150] bond7 (unregistering): Released all slaves [ 790.391643][ T150] bond8 (unregistering): Released all slaves [ 790.418834][ T150] bond9 (unregistering): Released all slaves [ 790.470719][ T150] bond10 (unregistering): Released all slaves [ 790.501056][ T150] bond11 (unregistering): Released all slaves [ 790.550565][T17241] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3355'. [ 790.585383][ T5293] 8021q: adding VLAN 0 to HW filter on device eth1 [ 790.598797][T17265] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.3365'. [ 790.672303][T17140] hsr_slave_0: entered promiscuous mode [ 790.693319][T17140] hsr_slave_1: entered promiscuous mode [ 790.708671][T17140] debugfs: 'hsr0' already exists in 'hsr' [ 790.743044][T17140] Cannot create hsr debugfs directory [ 790.778468][ T150] tipc: Disabling bearer [ 790.834703][ T150] tipc: Left network mode [ 792.281713][T14127] Bluetooth: hci2: command tx timeout [ 792.402503][T17317] kvm: user requested TSC rate below hardware speed [ 793.048282][ T150] hsr_slave_0: left promiscuous mode [ 793.070306][ T150] hsr_slave_1: left promiscuous mode [ 793.089468][ T150] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 793.117586][ T150] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 793.930680][ T150] team0 (unregistering): Port device team_slave_1 removed [ 794.004885][ T150] team0 (unregistering): Port device team_slave_0 removed [ 794.513595][ T5293] 8021q: adding VLAN 0 to HW filter on device eth2 [ 794.700620][T17352] kvm: user requested TSC rate below hardware speed [ 796.534154][T17140] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 796.574034][T17140] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 796.604327][T17140] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 796.662270][T17140] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 796.722447][T17140] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 796.779639][T17140] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 796.814830][T17140] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 796.859013][T17140] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 798.248218][T17140] 8021q: adding VLAN 0 to HW filter on device bond0 [ 798.377315][T17140] 8021q: adding VLAN 0 to HW filter on device team0 [ 798.454076][ T8918] bridge0: port 1(bridge_slave_0) entered blocking state [ 798.461268][ T8918] bridge0: port 1(bridge_slave_0) entered forwarding state [ 798.562726][ T7873] bridge0: port 2(bridge_slave_1) entered blocking state [ 798.569918][ T7873] bridge0: port 2(bridge_slave_1) entered forwarding state [ 798.979821][T17140] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 799.196335][T17140] veth0_vlan: entered promiscuous mode [ 799.258205][T17140] veth1_vlan: entered promiscuous mode [ 799.400994][T17140] veth0_macvtap: entered promiscuous mode [ 799.446858][T17140] veth1_macvtap: entered promiscuous mode [ 799.560806][T17140] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 799.611150][T17140] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 799.680983][ T8918] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 799.708236][ T8918] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 799.756135][ T8918] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 799.819761][ T8918] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 800.112543][T17311] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 800.168037][T17311] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 800.300037][ T150] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 800.325035][ T150] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 800.566762][T14127] Bluetooth: hci2: ACL packet too small [ 800.592852][T17450] syzkaller0: entered promiscuous mode [ 800.620099][T17450] syzkaller0: entered allmulticast mode [ 803.041648][T12156] usb 3-1: new high-speed USB device number 72 using dummy_hcd [ 803.156093][T17525] netlink: 'syz.0.3423': attribute type 2 has an invalid length. [ 803.164708][T17525] netlink: 'syz.0.3423': attribute type 2 has an invalid length. [ 803.213721][T12156] usb 3-1: Using ep0 maxpacket: 32 [ 803.229899][T12156] usb 3-1: unable to get BOS descriptor or descriptor too short [ 803.251418][T12156] usb 3-1: config 8 has an invalid interface number: 152 but max is 0 [ 803.269451][T12156] usb 3-1: config 8 has no interface number 0 [ 803.278457][T12156] usb 3-1: config 8 interface 152 has no altsetting 0 [ 803.289047][T12156] usb 3-1: New USB device found, idVendor=1584, idProduct=6003, bcdDevice=79.c7 [ 803.299537][T12156] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 803.319617][T12156] usb 3-1: Product: syz [ 803.341243][T12156] usb 3-1: Manufacturer: syz [ 803.354206][T12156] usb 3-1: SerialNumber: syz [ 803.683811][T12156] dvb-usb: found a 'Uniwill STK7700P based (Hama and others)' in cold state, will try to load a firmware [ 804.024599][T12156] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 804.081284][T12156] dib0700: firmware download failed at 7 with -22 [ 804.140674][T12156] usb 3-1: USB disconnect, device number 72 [ 807.467818][ T30] audit: type=1800 audit(1780021465.273:14430): pid=17601 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.3439" name="bus" dev="tmpfs" ino=758 res=0 errno=0 [ 809.097422][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 809.104553][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 810.547621][T17631] netlink: 'syz.2.3450': attribute type 6 has an invalid length. [ 810.631001][T17633] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3451'. [ 811.030764][ T5691] usb 3-1: new high-speed USB device number 73 using dummy_hcd [ 811.216310][ T5691] usb 3-1: Using ep0 maxpacket: 16 [ 811.228697][ T5691] usb 3-1: New USB device found, idVendor=046d, idProduct=08b5, bcdDevice=d7.01 [ 811.238399][ T5691] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 811.253016][ T5691] usb 3-1: Product: syz [ 811.257278][ T5691] usb 3-1: Manufacturer: syz [ 811.261950][ T5691] usb 3-1: SerialNumber: syz [ 811.284517][ T5691] usb 3-1: config 0 descriptor?? [ 811.304832][ T5691] pwc: Logitech QuickCam Orbit/Sphere USB webcam detected. [ 811.499056][ T5691] pwc: Warning: more than 1 configuration available. [ 812.104231][ T5691] pwc: recv_control_msg error -71 req 02 val 2b00 [ 812.125062][ T5691] pwc: recv_control_msg error -71 req 02 val 2700 [ 812.137213][ T5691] pwc: recv_control_msg error -71 req 04 val 1600 [ 812.150879][ T5691] pwc: recv_control_msg error -71 req 02 val 2c00 [ 812.158954][ T5691] pwc: recv_control_msg error -71 req 04 val 1000 [ 812.168412][ T5691] pwc: recv_control_msg error -71 req 04 val 1300 [ 812.181716][ T5691] pwc: recv_control_msg error -71 req 04 val 1400 [ 812.200319][ T5691] pwc: recv_control_msg error -71 req 02 val 2000 [ 812.204083][T17605] vlan2: entered allmulticast mode [ 812.212521][ T5691] pwc: recv_control_msg error -71 req 02 val 2100 [ 812.212998][ T5691] pwc: recv_control_msg error -71 req 06 val 0600 [ 812.236996][ T5691] pwc: recv_control_msg error -71 req 04 val 1500 [ 812.241612][T17605] bond0: entered allmulticast mode [ 812.252162][ T5691] pwc: recv_control_msg error -71 req 02 val 2500 [ 812.255352][T17605] bond_slave_0: entered allmulticast mode [ 812.266735][T17605] bond_slave_1: entered allmulticast mode [ 812.271125][ T5691] pwc: recv_control_msg error -71 req 02 val 2400 [ 812.304955][ T5691] pwc: recv_control_msg error -71 req 02 val 2600 [ 812.326304][ T5691] pwc: recv_control_msg error -71 req 02 val 2900 [ 812.354975][ T5691] pwc: recv_control_msg error -71 req 02 val 2800 [ 812.373599][ T5691] pwc: recv_control_msg error -71 req 04 val 1100 [ 812.402863][ T5691] pwc: recv_control_msg error -71 req 04 val 1200 [ 812.430709][ T5691] pwc: Failed to power off camera (-71) [ 812.514844][ T5691] pwc: Registered as video103. [ 812.543017][ T5691] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input223 [ 812.593436][ T5691] usb 3-1: USB disconnect, device number 73 [ 813.587579][T17695] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3468'. [ 815.491607][T12156] usb 4-1: new low-speed USB device number 85 using dummy_hcd [ 815.667431][T12156] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 815.706465][T12156] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 64, setting to 8 [ 815.737612][T12156] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 22 [ 815.767447][T12156] usb 4-1: New USB device found, idVendor=04d9, idProduct=a070, bcdDevice= 0.00 [ 815.796043][T12156] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 815.852023][T12156] usb 4-1: config 0 descriptor?? [ 815.870870][T17744] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 816.320454][T12156] holtek_mouse 0003:04D9:A070.0014: ignoring exceeding usage max [ 816.351438][T12156] hid_parser_main: 36 callbacks suppressed [ 816.384294][T12156] holtek_mouse 0003:04D9:A070.0014: unknown main item tag 0x0 [ 816.412160][T12156] holtek_mouse 0003:04D9:A070.0014: unknown main item tag 0x0 [ 816.433086][T12156] holtek_mouse 0003:04D9:A070.0014: unknown main item tag 0x0 [ 816.454810][T12156] holtek_mouse 0003:04D9:A070.0014: reserved main item tag 0xe [ 816.475564][T12156] holtek_mouse 0003:04D9:A070.0014: unknown main item tag 0x0 [ 816.527003][T12156] holtek_mouse 0003:04D9:A070.0014: hidraw0: USB HID v0.08 Device [HID 04d9:a070] on usb-dummy_hcd.3-1/input0 [ 816.586197][T12156] usb 4-1: USB disconnect, device number 85 [ 816.799410][T17752] fido_id[17752]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 818.022568][ T5691] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 818.204238][ T5691] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 818.251718][ T5691] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 818.274093][ T5691] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 818.283440][ T1559] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 818.296965][T17787] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3501'. [ 818.297162][ T5691] usb 4-1: SerialNumber: syz [ 818.317112][T17788] xt_l2tp: v2 sid > 0xffff: 65536 [ 818.324274][T17787] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3501'. [ 818.461579][ T1559] usb 2-1: Using ep0 maxpacket: 16 [ 818.479593][ T1559] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 818.523792][ T1559] usb 2-1: New USB device found, idVendor=0fe6, idProduct=9700, bcdDevice=d1.9a [ 818.549359][ T1559] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 818.569695][ T1559] usb 2-1: Product: syz [ 818.579647][ T1559] usb 2-1: Manufacturer: syz [ 818.589972][ T1559] usb 2-1: SerialNumber: syz [ 818.612744][ T1559] usb 2-1: config 0 descriptor?? [ 818.647998][ T1559] sr9700 2-1:0.0: probe with driver sr9700 failed with error -22 [ 818.872195][T12156] usb 2-1: USB disconnect, device number 42 [ 819.453602][T17804] usb usb7: usbfs: process 17804 (syz.2.3507) did not claim interface 0 before use [ 819.502008][ T5691] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -22 [ 819.566656][T17809] binder: 17808:17809 ioctl 40046205 0 returned -22 [ 819.648036][T17816] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3512'. [ 819.657674][T17816] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3512'. [ 820.596237][T17841] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3523'. [ 820.611065][T17841] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3523'. [ 820.827154][ T10] usb 4-1: USB disconnect, device number 86 [ 820.904006][T17857] netlink: 68 bytes leftover after parsing attributes in process `syz.3.3530'. [ 820.941611][ T5691] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 821.101556][ T5691] usb 5-1: Using ep0 maxpacket: 32 [ 821.124953][ T5691] usb 5-1: unable to get BOS descriptor or descriptor too short [ 821.146165][ T5691] usb 5-1: New USB device found, idVendor=0582, idProduct=0102, bcdDevice= 0.40 [ 821.161631][ T5691] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 821.179891][ T5691] usb 5-1: Product: syz [ 821.193861][ T5691] usb 5-1: Manufacturer: syz [ 821.204910][ T5691] usb 5-1: SerialNumber: syz [ 821.444294][ T5691] usb 5-1: Audio class v2/v3 interfaces need an interface association [ 821.512654][ T5691] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 821.578472][T17636] udevd[17636]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 822.355579][T17886] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3540'. [ 822.881629][ T5724] usb 3-1: new high-speed USB device number 74 using dummy_hcd [ 823.031593][ T5724] usb 3-1: Using ep0 maxpacket: 16 [ 823.038629][ T5724] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 823.050161][ T5724] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 823.060303][ T5724] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 823.073629][ T5724] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 823.086946][ T5724] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 823.097464][ T5724] usb 3-1: config 0 descriptor?? [ 823.512546][ T5724] microsoft 0003:045E:07DA.0015: unknown main item tag 0x0 [ 823.526311][ T5724] microsoft 0003:045E:07DA.0015: unknown main item tag 0x0 [ 823.542822][ T5724] microsoft 0003:045E:07DA.0015: unknown main item tag 0x0 [ 823.565005][ T5724] microsoft 0003:045E:07DA.0015: unknown main item tag 0x0 [ 823.596076][ T5724] microsoft 0003:045E:07DA.0015: unknown main item tag 0x0 [ 823.619513][ T5724] microsoft 0003:045E:07DA.0015: unknown main item tag 0x0 [ 823.636615][ T5724] microsoft 0003:045E:07DA.0015: unknown main item tag 0x0 [ 823.644968][ T5724] microsoft 0003:045E:07DA.0015: unknown main item tag 0x0 [ 823.676916][ T5724] microsoft 0003:045E:07DA.0015: unknown main item tag 0x0 [ 823.685031][ T5724] microsoft 0003:045E:07DA.0015: unknown main item tag 0x0 [ 823.763442][ T5724] input: HID 045e:07da as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:045E:07DA.0015/input/input224 [ 823.791139][T12152] usb 5-1: USB disconnect, device number 65 [ 823.850515][T17903] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 823.892026][T12156] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 823.900366][T17903] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 823.915352][ T5724] microsoft 0003:045E:07DA.0015: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.2-1/input0 [ 824.098882][T12156] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 824.115304][T12152] usb 3-1: USB disconnect, device number 74 [ 824.144016][T12156] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 824.166133][T17907] fido_id[17907]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/3-1/report_descriptor': No such file or directory [ 824.189166][T12156] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 824.205423][T12156] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 824.232359][T12156] usb 4-1: config 0 descriptor?? [ 824.686664][T12156] pyra 0003:1E7D:2CF6.0016: hidraw0: USB HID v0.00 Device [HID 1e7d:2cf6] on usb-dummy_hcd.3-1/input0 [ 825.261131][T12156] pyra 0003:1E7D:2CF6.0016: couldn't init struct pyra_device [ 825.288242][T12156] pyra 0003:1E7D:2CF6.0016: couldn't install mouse [ 825.304172][T12156] pyra 0003:1E7D:2CF6.0016: probe with driver pyra failed with error -71 [ 825.340159][T12156] usb 4-1: USB disconnect, device number 87 [ 827.165319][T17964] ip6gretap1: entered promiscuous mode [ 827.644017][T12152] usb 3-1: new high-speed USB device number 75 using dummy_hcd [ 827.660634][T17981] xt_l2tp: v2 sid > 0xffff: 65536 [ 827.814091][T12152] usb 3-1: Using ep0 maxpacket: 32 [ 827.846818][T12152] usb 3-1: config 2 has an invalid interface number: 88 but max is 0 [ 827.878860][T12152] usb 3-1: config 2 has no interface number 0 [ 827.898285][T12152] usb 3-1: config 2 interface 88 altsetting 7 bulk endpoint 0x6 has invalid maxpacket 256 [ 827.954458][T12152] usb 3-1: config 2 interface 88 has no altsetting 0 [ 827.971999][T12152] usb 3-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.06 [ 827.999956][T12152] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 828.041712][T12152] usb 3-1: Product: syz [ 828.046675][T12152] usb 3-1: Manufacturer: syz [ 828.057801][T12152] usb 3-1: SerialNumber: syz [ 828.081910][T17972] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 828.309044][T17972] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 828.531887][ T1559] usb 4-1: new high-speed USB device number 88 using dummy_hcd [ 828.701568][ T1559] usb 4-1: Using ep0 maxpacket: 16 [ 828.732214][ T1559] usb 4-1: New USB device found, idVendor=0d49, idProduct=7010, bcdDevice= c.90 [ 828.760302][ T1559] usb 4-1: New USB device strings: Mfr=1, Product=6, SerialNumber=3 [ 828.781523][ T1559] usb 4-1: Product: syz [ 828.788906][ T1559] usb 4-1: Manufacturer: syz [ 828.829386][ T1559] usb 4-1: SerialNumber: syz [ 828.851274][ T1559] usb 4-1: config 0 descriptor?? [ 828.911929][ T1559] ums-onetouch 4-1:0.0: USB Mass Storage device detected [ 829.208908][T12152] asix 3-1:2.88 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 829.249203][T12152] asix 3-1:2.88: probe with driver asix failed with error -71 [ 829.284078][T12152] usb 3-1: USB disconnect, device number 75 [ 829.465756][T18012] xt_hashlimit: size too large, truncated to 1048576 [ 829.638346][T12152] usb 4-1: USB disconnect, device number 88 [ 830.498651][T18023] xt_CT: You must specify a L4 protocol and not use inversions on it [ 830.560235][T18034] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3595'. [ 830.671571][T12155] usb 3-1: new high-speed USB device number 76 using dummy_hcd [ 830.844198][T12155] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 830.875226][T12155] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 830.904755][T12155] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 830.927478][T12155] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 830.947554][T12155] usb 3-1: SerialNumber: syz [ 831.192536][T12155] usb 3-1: 0:2 : does not exist [ 831.332368][T12155] usb 3-1: USB disconnect, device number 76 [ 831.622469][T18052] usb usb8: usbfs: process 18052 (syz.0.3604) did not claim interface 2 before use [ 832.108173][T18064] kvm: requested 16761 ns i8254 timer period limited to 200000 ns [ 832.119703][T12152] usb 3-1: new high-speed USB device number 77 using dummy_hcd [ 832.150406][T18064] kvm: requested 67047 ns i8254 timer period limited to 200000 ns [ 832.190777][T18064] kvm: requested 87161 ns i8254 timer period limited to 200000 ns [ 832.222207][T18064] kvm: requested 117333 ns i8254 timer period limited to 200000 ns [ 832.240216][T18064] kvm: requested 16761 ns i8254 timer period limited to 200000 ns [ 832.258052][T18064] kvm: requested 63695 ns i8254 timer period limited to 200000 ns [ 832.293708][T12152] usb 3-1: Using ep0 maxpacket: 8 [ 832.302091][T18064] kvm: requested 16761 ns i8254 timer period limited to 200000 ns [ 832.304115][T12152] usb 3-1: config 0 interface 0 altsetting 6 endpoint 0x81 has an invalid bInterval 196, changing to 11 [ 832.317506][T18064] kvm: requested 67047 ns i8254 timer period limited to 200000 ns [ 832.326520][T12152] usb 3-1: config 0 interface 0 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 832.333112][T18064] kvm: requested 83809 ns i8254 timer period limited to 200000 ns [ 832.371550][T12152] usb 3-1: config 0 interface 0 has no altsetting 0 [ 832.380963][T18064] kvm: requested 103923 ns i8254 timer period limited to 200000 ns [ 832.384379][T12152] usb 3-1: New USB device found, idVendor=04b3, idProduct=3100, bcdDevice= 0.00 [ 832.403146][T12152] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 832.433791][T12152] usb 3-1: config 0 descriptor?? [ 832.866246][T12152] lenovo 0003:04B3:3100.0017: ignoring exceeding usage max [ 832.876787][T12152] lenovo 0003:04B3:3100.0017: unknown main item tag 0x0 [ 832.885333][T12152] lenovo 0003:04B3:3100.0017: unknown main item tag 0x0 [ 832.894394][T12152] lenovo 0003:04B3:3100.0017: unknown main item tag 0x0 [ 832.895677][ T10] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 832.903111][T12152] lenovo 0003:04B3:3100.0017: unknown main item tag 0x0 [ 832.916754][T12152] lenovo 0003:04B3:3100.0017: unknown main item tag 0x0 [ 832.928646][T12152] lenovo 0003:04B3:3100.0017: unknown main item tag 0x0 [ 832.937765][T12152] lenovo 0003:04B3:3100.0017: unknown main item tag 0x0 [ 832.945421][T12152] lenovo 0003:04B3:3100.0017: unknown main item tag 0x0 [ 832.979274][T12152] lenovo 0003:04B3:3100.0017: hidraw0: USB HID v0.04 Device [HID 04b3:3100] on usb-dummy_hcd.2-1/input0 [ 833.093795][ T10] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 833.103397][T12152] usb 3-1: USB disconnect, device number 77 [ 833.124088][ T10] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 833.140080][ T10] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 833.155218][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 833.183086][T18078] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 833.248599][ T10] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 833.447654][ T10] usb 2-1: USB disconnect, device number 43 [ 833.462029][T12155] usb 4-1: new full-speed USB device number 89 using dummy_hcd [ 833.615223][T18102] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3625'. [ 833.624867][T18102] vlan0: entered promiscuous mode [ 833.643640][T12155] usb 4-1: config 248 has an invalid interface number: 192 but max is 1 [ 833.663010][T12155] usb 4-1: config 248 has 1 interface, different from the descriptor's value: 2 [ 833.691636][T12155] usb 4-1: config 248 has no interface number 0 [ 833.699216][T12155] usb 4-1: config 248 interface 192 has no altsetting 0 [ 833.709358][T12155] usb 4-1: New USB device found, idVendor=19d2, idProduct=1170, bcdDevice=66.cd [ 833.730578][T12155] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 833.749276][T12155] usb 4-1: Product: syz [ 833.759075][T12155] usb 4-1: Manufacturer: syz [ 833.764066][T12155] usb 4-1: SerialNumber: syz [ 833.999025][T12155] cdc_ether 4-1:248.192: skipping garbage [ 834.009404][T12155] usb 4-1: No union descriptors [ 834.026810][T12155] usb 4-1: USB disconnect, device number 89 [ 834.518057][T18130] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3636'. [ 834.541244][T18130] vlan0: entered promiscuous mode [ 836.766325][T14127] Bluetooth: hci5: command 0x0406 tx timeout [ 838.241424][T18217] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3672'. [ 838.571869][ T5691] usb 3-1: new high-speed USB device number 78 using dummy_hcd [ 838.615569][T18226] xt_hashlimit: size too large, truncated to 1048576 [ 838.663771][T18229] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3677'. [ 838.741556][ T5691] usb 3-1: Using ep0 maxpacket: 32 [ 838.758896][ T5691] usb 3-1: unable to get BOS descriptor or descriptor too short [ 838.784592][ T5691] usb 3-1: New USB device found, idVendor=0d8c, idProduct=0103, bcdDevice= 0.40 [ 838.807338][ T5691] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 838.824846][ T5691] usb 3-1: Product: syz [ 838.834244][ T5691] usb 3-1: Manufacturer: syz [ 838.844160][ T5691] usb 3-1: SerialNumber: syz [ 839.101361][T18219] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 839.138730][T18219] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 839.237805][T18219] bridge_slave_0: left allmulticast mode [ 839.271981][T18219] bridge_slave_0: left promiscuous mode [ 839.291916][T18219] bridge0: port 1(bridge_slave_0) entered disabled state [ 839.313586][T18219] bridge_slave_1: left allmulticast mode [ 839.319578][T18219] bridge_slave_1: left promiscuous mode [ 839.328141][T18219] bridge0: port 2(bridge_slave_1) entered disabled state [ 839.364402][T18219] bond0: (slave bond_slave_0): Releasing backup interface [ 839.418290][T18219] bond0: (slave bond_slave_1): Releasing backup interface [ 839.502450][T18219] team0: Port device team_slave_0 removed [ 839.528680][T18219] team0: Port device team_slave_1 removed [ 839.536416][T18219] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 839.545085][T18219] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 839.557052][T18219] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 839.566464][T18219] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 839.577602][T18219] net_ratelimit: 869 callbacks suppressed [ 839.577622][T18219] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 839.656276][ T5691] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 839.665716][ T5691] usb 3-1: MIDIStreaming interface descriptor not found [ 839.760825][ T5691] usb 3-1: USB disconnect, device number 78 [ 839.845603][T17644] udevd[17644]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 840.109727][T18260] vlan0: left promiscuous mode [ 840.491427][T18269] xt_hashlimit: size too large, truncated to 1048576 [ 841.630024][T18303] xt_hashlimit: size too large, truncated to 1048576 [ 841.862178][T18313] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3708'. [ 842.512134][T12156] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 842.651732][T12156] usb 2-1: device descriptor read/64, error -71 [ 842.698842][T18346] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3723'. [ 842.722002][ T1559] usb 4-1: new high-speed USB device number 90 using dummy_hcd [ 842.891662][T12156] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 842.903173][ T1559] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 842.915208][ T1559] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 842.928445][ T1559] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 842.937967][ T1559] usb 4-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 842.950029][ T1559] usb 4-1: Manufacturer: syz [ 842.957832][ T1559] usb 4-1: config 0 descriptor?? [ 843.021613][T12156] usb 2-1: device descriptor read/64, error -71 [ 843.101614][T12152] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 843.133645][T12156] usb usb2-port1: attempt power cycle [ 843.273389][T12152] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 843.284505][T12152] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 843.294456][T12152] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 843.307484][T12152] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 843.316815][T12152] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 843.327719][T12152] usb 5-1: config 0 descriptor?? [ 843.471659][T12155] usb 3-1: new high-speed USB device number 79 using dummy_hcd [ 843.482042][T12156] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 843.502231][T12156] usb 2-1: device descriptor read/8, error -71 [ 843.626255][T12155] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 843.637317][T12155] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 843.646359][T12155] usb 3-1: Product: syz [ 843.653059][T12155] usb 3-1: Manufacturer: syz [ 843.657748][T12155] usb 3-1: SerialNumber: syz [ 843.741704][T12156] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 843.755806][T12152] plantronics 0003:047F:FFFF.0019: unknown main item tag 0x0 [ 843.764968][T12152] plantronics 0003:047F:FFFF.0019: unknown main item tag 0x0 [ 843.774638][T12152] plantronics 0003:047F:FFFF.0019: unknown main item tag 0x0 [ 843.783340][ T1559] uclogic 0003:256C:006D.0018: failed retrieving Huion firmware version: -22 [ 843.783417][ T1559] uclogic 0003:256C:006D.0018: failed probing parameters: -22 [ 843.783539][ T1559] uclogic 0003:256C:006D.0018: probe with driver uclogic failed with error -22 [ 843.815312][T12152] plantronics 0003:047F:FFFF.0019: unknown main item tag 0x0 [ 843.823493][T12156] usb 2-1: device descriptor read/8, error -71 [ 843.830376][T12152] plantronics 0003:047F:FFFF.0019: unknown main item tag 0x0 [ 843.839599][T12152] plantronics 0003:047F:FFFF.0019: unknown main item tag 0x0 [ 843.848307][T12152] plantronics 0003:047F:FFFF.0019: unknown main item tag 0x0 [ 843.857298][T12152] plantronics 0003:047F:FFFF.0019: unknown main item tag 0x0 [ 843.865589][T12152] plantronics 0003:047F:FFFF.0019: unknown main item tag 0x0 [ 843.874680][T12152] plantronics 0003:047F:FFFF.0019: unknown main item tag 0x0 [ 843.889718][T12152] plantronics 0003:047F:FFFF.0019: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 843.933372][T12156] usb usb2-port1: unable to enumerate USB device [ 843.991053][T12156] usb 4-1: USB disconnect, device number 90 [ 844.004300][ T10] usb 5-1: USB disconnect, device number 66 [ 844.687312][T12155] cdc_ncm 3-1:1.0: SET_NTB_FORMAT failed [ 844.730807][T12155] cdc_ncm 3-1:1.0: bind() failure [ 844.767032][T12155] cdc_ncm 3-1:1.1: CDC Union missing and no IAD found [ 844.782537][T12155] cdc_ncm 3-1:1.1: bind() failure [ 844.796382][T12155] usb 3-1: USB disconnect, device number 79 [ 844.900578][T18370] fuse: Bad value for 'group_id' [ 844.906554][T18370] fuse: Bad value for 'group_id' [ 845.040737][T18372] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3734'. [ 845.512491][ T1559] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 845.693328][ T1559] usb 4-1: Using ep0 maxpacket: 32 [ 845.715853][ T1559] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 845.748428][ T1559] usb 4-1: config 0 has no interfaces? [ 845.761534][ T1559] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 845.777888][ T1559] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 845.820596][ T1559] usb 4-1: config 0 descriptor?? [ 845.877204][T18394] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3745'. [ 845.991865][T12155] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 846.151543][T12155] usb 2-1: Using ep0 maxpacket: 8 [ 846.169325][T12155] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 846.192607][T12155] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 846.214022][T12155] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 846.234201][T12155] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 846.256553][T12155] usb 2-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 846.276990][T12155] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 846.307002][T12155] usb 2-1: config 0 descriptor?? [ 847.001526][T14127] Bluetooth: hci0: command 0x0406 tx timeout [ 848.270098][ T1559] usb 4-1: USB disconnect, device number 91 [ 848.601823][T14128] Bluetooth: hci5: command 0x0406 tx timeout [ 848.601908][T18390] Bluetooth: hci5: Opcode 0x0c1a failed: -110 [ 848.639490][T18390] Bluetooth: hci5: Error when powering off device on rfkill (-110) [ 848.867090][T18433] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3756'. [ 849.006077][T18439] usb usb7: usbfs: interface 0 claimed by hub while 'syz.0.3758' sets config #0 [ 849.369693][T18390] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 849.386352][T18390] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 849.456091][T18390] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 849.469422][T18390] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 849.532034][T18390] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 849.545227][T18390] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 849.614033][T18390] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 849.629384][T18390] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 849.853705][ T5691] usb 2-1: USB disconnect, device number 48 [ 850.196278][T18464] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3769'. [ 850.410705][T18470] netlink: 232 bytes leftover after parsing attributes in process `syz.0.3773'. [ 850.551609][T12152] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 850.762504][T12152] usb 2-1: unable to get BOS descriptor or descriptor too short [ 850.781030][T12152] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 850.800959][T12152] usb 2-1: can't read configurations, error -71 [ 851.413693][T18493] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3782'. [ 851.487723][T18497] netlink: 'syz.3.3785': attribute type 2 has an invalid length. [ 851.517667][T18497] netlink: 'syz.3.3785': attribute type 2 has an invalid length. [ 852.121821][T18518] netlink: 232 bytes leftover after parsing attributes in process `syz.3.3793'. [ 852.319314][T18522] syz_tun: entered allmulticast mode [ 852.339656][T18522] dvmrp8: entered allmulticast mode [ 852.349318][T18521] syz_tun: left allmulticast mode [ 852.393939][T18524] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3796'. [ 852.439005][T18526] netlink: 'syz.2.3797': attribute type 2 has an invalid length. [ 852.453013][T18526] netlink: 'syz.2.3797': attribute type 2 has an invalid length. [ 853.104621][T18548] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3808'. [ 853.584276][T18563] netlink: 232 bytes leftover after parsing attributes in process `syz.2.3813'. [ 854.154267][T18579] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3820'. [ 854.391165][T18583] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3822'. [ 854.675160][T18594] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3827'. [ 855.249689][T18614] __nla_validate_parse: 2 callbacks suppressed [ 855.249714][T18614] netlink: 132 bytes leftover after parsing attributes in process `syz.4.3835'. [ 855.934639][T18637] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3844'. [ 856.158203][T18643] netlink: 132 bytes leftover after parsing attributes in process `syz.1.3847'. [ 856.618522][T18657] netlink: 232 bytes leftover after parsing attributes in process `syz.0.3854'. [ 856.815285][T18664] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3856'. [ 857.607502][T18684] input: syz0 as /devices/virtual/input/input225 [ 857.622235][T18684] input: failed to attach handler leds to device input225, error: -6 [ 857.814717][T18690] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3867'. [ 857.841591][T12152] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 857.860863][T18692] netlink: 232 bytes leftover after parsing attributes in process `syz.2.3868'. [ 858.005188][T12152] usb 2-1: Using ep0 maxpacket: 32 [ 858.020210][T12152] usb 2-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 858.033979][T12152] usb 2-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 858.051682][T12152] usb 2-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 858.082068][T12152] usb 2-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 858.108573][T12152] usb 2-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 858.132639][T12152] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 858.144140][T12152] usb 2-1: Product: syz [ 858.152436][T12152] usb 2-1: Manufacturer: syz [ 858.164781][T12152] usb 2-1: SerialNumber: syz [ 858.192194][ C1] imon 2-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 858.207298][T12152] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:155.0/input/input226 [ 858.401923][T12152] imon 2-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 858.428382][T12152] (id 0x00) [ 858.573699][T12152] rc_core: IR keymap rc-imon-pad not found [ 858.608712][T12152] Registered IR keymap rc-empty [ 858.629337][T12152] imon 2-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 858.663036][T12152] imon 2-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 858.703497][T12152] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:155.0/rc/rc0 [ 858.726223][T12152] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:155.0/rc/rc0/input227 [ 858.754771][T12152] imon 2-1:155.0: iMON device (15c2:ffdc, intf0) on usb<2:51> initialized [ 858.902997][T18717] syzkaller0: entered promiscuous mode [ 858.928757][T18717] syzkaller0: entered allmulticast mode [ 859.212669][T18732] netlink: 232 bytes leftover after parsing attributes in process `syz.2.3884'. [ 859.374437][T18740] xt_hashlimit: size too large, truncated to 1048576 [ 859.931090][T18758] syzkaller0: entered promiscuous mode [ 859.960241][T18758] syzkaller0: entered allmulticast mode [ 860.204449][T18772] misc userio: No port type given on /dev/userio [ 860.221949][T18772] misc userio: The device must be registered before sending interrupts [ 860.585504][T18734] imon:send_packet: task interrupted [ 860.609353][T18734] imon:send_packet: packet tx failed (-512) [ 860.622011][T18734] imon:vfd_write: send packet #1 failed [ 860.656861][T12152] usb 2-1: USB disconnect, device number 51 [ 861.632573][ T5691] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 861.857099][ T5691] usb 2-1: unable to get BOS descriptor or descriptor too short [ 861.875909][ T5691] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 861.898261][ T5691] usb 2-1: can't read configurations, error -71 [ 861.946160][T18811] sctp: [Deprecated]: syz.3.3914 (pid 18811) Use of int in max_burst socket option deprecated. [ 861.946160][T18811] Use struct sctp_assoc_value instead [ 862.203397][ T10] usb 3-1: new low-speed USB device number 80 using dummy_hcd [ 862.379188][ T10] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 862.394309][ T10] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 862.406242][ T10] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 862.425691][ T10] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 862.454776][ T10] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 862.485115][ T10] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 862.496549][ T10] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 862.518487][ T10] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 862.540812][ T10] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 862.554424][ T10] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 862.571423][ T10] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 862.580518][ T10] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 862.591686][ T10] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 862.604194][ T10] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 862.619956][T18839] sctp: [Deprecated]: syz.0.3927 (pid 18839) Use of int in max_burst socket option deprecated. [ 862.619956][T18839] Use struct sctp_assoc_value instead [ 862.636948][ T10] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 862.662594][ T10] usb 3-1: string descriptor 0 read error: -22 [ 862.669210][ T10] usb 3-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 862.690331][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 862.721677][ T10] adutux 3-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 862.827266][T18845] sctp: [Deprecated]: syz.3.3928 (pid 18845) Use of struct sctp_assoc_value in delayed_ack socket option. [ 862.827266][T18845] Use struct sctp_sack_info instead [ 864.918750][T18884] syzkaller0: entered promiscuous mode [ 864.926515][T18884] syzkaller0: entered allmulticast mode [ 864.948328][T18884] tipc: Started in network mode [ 864.955263][T18884] tipc: Node identity da37f7e6c794, cluster identity 4711 [ 864.964226][T18884] tipc: Enabled bearer , priority 0 [ 865.031135][T18882] tipc: Resetting bearer [ 865.046568][ T10] usb 3-1: USB disconnect, device number 80 [ 865.153963][T18882] tipc: Disabling bearer [ 865.531599][ T5691] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 865.693108][ T5691] usb 2-1: device descriptor read/64, error -71 [ 865.942722][ T5691] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 866.081624][ T5691] usb 2-1: device descriptor read/64, error -71 [ 866.202113][ T5691] usb usb2-port1: attempt power cycle [ 866.553601][ T5691] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 866.602542][ T5691] usb 2-1: device descriptor read/8, error -71 [ 866.852936][ T5691] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 866.882358][ T5691] usb 2-1: device descriptor read/8, error -71 [ 867.012251][ T5691] usb usb2-port1: unable to enumerate USB device [ 867.215752][T18953] loop2: detected capacity change from 0 to 7 [ 867.233498][T18953] Dev loop2: unable to read RDB block 7 [ 867.243733][T18953] loop2: unable to read partition table [ 867.249865][T18953] loop2: partition table beyond EOD, truncated [ 867.258876][T18953] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 869.113942][T18989] syzkaller0: entered promiscuous mode [ 869.133575][T18989] syzkaller0: entered allmulticast mode [ 870.525831][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.533528][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 871.144153][T19017] syzkaller1: entered promiscuous mode [ 871.160039][T19017] syzkaller1: entered allmulticast mode [ 871.815185][T19023] syzkaller0: entered promiscuous mode [ 871.845549][T19023] syzkaller0: entered allmulticast mode [ 872.363674][T19037] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4008'. [ 872.724789][T19049] misc userio: Invalid payload size [ 872.760346][T19049] misc userio: The device must be registered before sending interrupts [ 873.019487][T19059] syzkaller0: entered promiscuous mode [ 873.061041][T19059] syzkaller0: entered allmulticast mode [ 873.093129][T19066] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4022'. [ 873.153624][T19059] tipc: Started in network mode [ 873.167872][T19059] tipc: Node identity b23532e79668, cluster identity 4711 [ 873.208286][T19059] tipc: Enabled bearer , priority 0 [ 873.250896][T19056] tipc: Resetting bearer [ 873.360309][T19056] tipc: Disabling bearer [ 873.392466][T19078] sctp: [Deprecated]: syz.3.4025 (pid 19078) Use of struct sctp_assoc_value in delayed_ack socket option. [ 873.392466][T19078] Use struct sctp_sack_info instead [ 873.538728][T19084] netlink: 60 bytes leftover after parsing attributes in process `syz.0.4030'. [ 873.702582][T19088] sctp: [Deprecated]: syz.3.4032 (pid 19088) Use of int in max_burst socket option deprecated. [ 873.702582][T19088] Use struct sctp_assoc_value instead [ 873.864742][T19094] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 874.297329][T19107] syzkaller0: entered promiscuous mode [ 874.319447][T19110] netlink: 60 bytes leftover after parsing attributes in process `syz.0.4043'. [ 874.320793][T19107] syzkaller0: entered allmulticast mode [ 874.448716][T19107] tipc: Enabled bearer , priority 0 [ 874.474949][T19106] tipc: Resetting bearer [ 874.574173][T19106] tipc: Disabling bearer [ 875.691029][T19155] syzkaller0: entered promiscuous mode [ 875.724502][T19155] syzkaller0: entered allmulticast mode [ 875.864772][T19158] tipc: Started in network mode [ 875.881939][T19158] tipc: Node identity a63af7485239, cluster identity 4711 [ 875.930062][T19158] tipc: Enabled bearer , priority 0 [ 875.955550][T19151] tipc: Resetting bearer [ 876.085766][T19151] tipc: Disabling bearer [ 877.217830][T19192] netlink: 'syz.3.4076': attribute type 12 has an invalid length. [ 877.236604][T19192] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4076'. [ 877.291119][T19192] bond0: option primary_reselect: invalid value (17) [ 877.466067][T19202] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 877.549899][T19205] syzkaller0: entered promiscuous mode [ 877.549927][T19205] syzkaller0: entered allmulticast mode [ 877.902737][T19223] sctp: [Deprecated]: syz.2.4090 (pid 19223) Use of int in max_burst socket option deprecated. [ 877.902737][T19223] Use struct sctp_assoc_value instead [ 878.898084][T19253] sctp: [Deprecated]: syz.1.4102 (pid 19253) Use of int in max_burst socket option deprecated. [ 878.898084][T19253] Use struct sctp_assoc_value instead [ 879.182802][T19262] syzkaller0: entered promiscuous mode [ 879.201660][T19262] syzkaller0: entered allmulticast mode [ 880.364646][T19288] sctp: [Deprecated]: syz.1.4116 (pid 19288) Use of int in max_burst socket option deprecated. [ 880.364646][T19288] Use struct sctp_assoc_value instead [ 880.417542][T19289] misc userio: Invalid payload size [ 880.589003][T19297] syzkaller0: entered promiscuous mode [ 880.595965][T19297] syzkaller0: entered allmulticast mode [ 880.680295][T19295] syzkaller0: entered promiscuous mode [ 880.693038][T19295] syzkaller0: entered allmulticast mode [ 881.726524][T19319] sctp: [Deprecated]: syz.4.4130 (pid 19319) Use of int in max_burst socket option deprecated. [ 881.726524][T19319] Use struct sctp_assoc_value instead [ 882.748060][T19335] misc userio: Invalid payload size [ 883.199062][T19345] sctp: [Deprecated]: syz.2.4141 (pid 19345) Use of int in max_burst socket option deprecated. [ 883.199062][T19345] Use struct sctp_assoc_value instead [ 883.451726][T19355] use of bytesused == 0 is deprecated and will be removed in the future, [ 883.471625][T19355] use the actual size instead. [ 883.491251][ T30] audit: type=1326 audit(1780021541.313:14431): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19354 comm="syz.3.4145" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f8270d9ce59 code=0x0 [ 883.820751][T12155] IPVS: starting estimator thread 0... [ 883.828572][T19368] IPVS: lc: FWM 3 0x00000003 - no destination available [ 883.932846][T19369] IPVS: using max 27 ests per chain, 64800 per kthread [ 884.367120][ T1559] IPVS: starting estimator thread 0... [ 884.376854][T19393] IPVS: lc: FWM 3 0x00000003 - no destination available [ 884.481572][T19394] IPVS: using max 25 ests per chain, 60000 per kthread [ 888.287873][ T5691] usb 3-1: new full-speed USB device number 81 using dummy_hcd [ 888.454743][ T5691] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 888.480582][ T5691] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 888.494234][ T5691] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 888.503933][ T5691] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 888.725963][T19492] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4206'. [ 888.735201][T19492] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4206'. [ 888.775120][ T5691] usb 3-1: usb_control_msg returned -32 [ 888.781417][ T5691] usbtmc 3-1:16.0: can't read capabilities [ 888.980652][ T1559] usb 3-1: USB disconnect, device number 81 [ 891.670321][T19495] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4207'. [ 891.686917][T19495] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4207'. [ 891.733846][ T150] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 891.733974][T19495] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4207'. [ 891.754292][ T150] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 891.770628][T19495] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4207'. [ 891.795841][ T150] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 891.808082][ T150] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 892.615678][T19543] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4225'. [ 892.650861][T19543] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4225'. [ 892.676186][T19546] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4226'. [ 892.846922][T19552] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4228'. [ 893.199964][ T1559] IPVS: starting estimator thread 0... [ 893.321992][T19569] IPVS: using max 28 ests per chain, 67200 per kthread [ 893.844403][T19589] __nla_validate_parse: 5 callbacks suppressed [ 893.844425][T19589] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4244'. [ 894.422259][T19609] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4252'. [ 894.865749][T19619] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4256'. [ 894.900475][T19619] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4256'. [ 894.979436][ T150] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 894.989750][T19619] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4256'. [ 895.009171][ T150] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 895.025384][T19619] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4256'. [ 895.041366][ T150] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 895.060670][ T150] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 895.214725][T19627] syzkaller0: entered promiscuous mode [ 895.220707][T19627] syzkaller0: entered allmulticast mode [ 895.238922][T19627] tipc: Started in network mode [ 895.244806][T19627] tipc: Node identity eec403aeda82, cluster identity 4711 [ 895.252619][T19627] tipc: Enabled bearer , priority 0 [ 895.269433][T19626] tipc: Resetting bearer [ 895.305529][T19626] tipc: Disabling bearer [ 895.601998][T12152] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 895.628105][T19646] loop2: detected capacity change from 0 to 7 [ 895.644258][T19646] Dev loop2: unable to read RDB block 7 [ 895.650087][T19646] loop2: unable to read partition table [ 895.651099][T19648] syz_tun: entered allmulticast mode [ 895.656820][T19646] loop2: partition table beyond EOD, truncated [ 895.678368][T19646] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 895.704365][T19648] dvmrp8: entered allmulticast mode [ 895.742554][T19650] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4271'. [ 895.764250][T12152] usb 4-1: config 0 has no interfaces? [ 895.779332][T12152] usb 4-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 895.791319][ T150] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 895.800495][T19650] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4271'. [ 895.809561][T12152] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 895.809592][T12152] usb 4-1: Product: syz [ 895.809610][T12152] usb 4-1: Manufacturer: syz [ 895.809626][T12152] usb 4-1: SerialNumber: syz [ 895.819257][T12152] usb 4-1: config 0 descriptor?? [ 895.828780][ T150] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 895.869402][ T150] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 895.898707][ T150] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 896.110529][ T5691] usb 4-1: USB disconnect, device number 92 [ 896.141345][T19663] syzkaller0: entered promiscuous mode [ 896.151342][T19663] syzkaller0: entered allmulticast mode [ 896.168832][T19663] tipc: Started in network mode [ 896.174041][T19663] tipc: Node identity 0662055074b, cluster identity 4711 [ 896.181266][T19663] tipc: Enabled bearer , priority 0 [ 896.190113][T19662] tipc: Resetting bearer [ 896.216239][T19662] tipc: Disabling bearer [ 896.290702][T19669] syzkaller0: entered promiscuous mode [ 896.296520][T19669] syzkaller0: entered allmulticast mode [ 896.725071][T19682] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4285'. [ 896.785277][T19682] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4285'. [ 896.785327][ T7875] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 896.839927][ T7875] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 896.869223][ T7875] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 896.908201][ T7875] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 897.343262][ T5691] usb 5-1: new full-speed USB device number 67 using dummy_hcd [ 897.514445][ T5691] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 897.541721][ T5691] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 897.558362][ T5691] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 897.567975][ T5691] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 897.792925][ T5691] usb 5-1: usb_control_msg returned -32 [ 897.807567][ T5691] usbtmc 5-1:16.0: can't read capabilities [ 897.880877][T19723] loop2: detected capacity change from 0 to 7 [ 897.899897][T19723] Dev loop2: unable to read RDB block 7 [ 897.909467][T19723] loop2: unable to read partition table [ 897.915651][T19723] loop2: partition table beyond EOD, truncated [ 897.929033][T19723] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 898.032811][ T5691] usb 5-1: USB disconnect, device number 67 [ 898.871929][T19749] loop2: detected capacity change from 0 to 7 [ 898.888716][T19749] Dev loop2: unable to read RDB block 7 [ 898.898283][T19749] loop2: AHDI p1 p2 p3 [ 898.903016][T19749] loop2: partition table partially beyond EOD, truncated [ 898.910483][T19749] loop2: p1 start 1601398130 is beyond EOD, truncated [ 898.918287][T19749] loop2: p2 start 1702059890 is beyond EOD, truncated [ 899.515929][T19775] loop2: detected capacity change from 0 to 7 [ 899.537450][T19775] Dev loop2: unable to read RDB block 7 [ 899.551207][T19775] loop2: AHDI p1 p2 p3 [ 899.564827][T19775] loop2: partition table partially beyond EOD, truncated [ 899.575756][T19775] loop2: p1 start 1601398130 is beyond EOD, truncated [ 899.587679][T19775] loop2: p2 start 1702059890 is beyond EOD, truncated [ 899.672664][ T10] usb 2-1: new low-speed USB device number 58 using dummy_hcd [ 899.863432][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 899.891813][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 899.911489][ T10] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 899.926563][ T10] usb 2-1: New USB device found, idVendor=1770, idProduct=ff00, bcdDevice= 0.00 [ 899.939506][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 899.955210][ T10] usb 2-1: config 0 descriptor?? [ 899.967500][T19771] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 899.982970][T12152] usb 5-1: new high-speed USB device number 68 using dummy_hcd [ 900.186664][T12152] usb 5-1: unable to get BOS descriptor or descriptor too short [ 900.204839][T12152] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 900.221663][T12152] usb 5-1: can't read configurations, error -71 [ 901.415313][ T10] usbhid 2-1:0.0: can't add hid device: -71 [ 901.432458][ T10] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 901.466803][ T10] usb 2-1: USB disconnect, device number 58 [ 903.401681][T12155] usb 5-1: new full-speed USB device number 70 using dummy_hcd [ 903.553260][T12155] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 903.565297][T12155] usb 5-1: config 0 has no interface number 0 [ 903.581686][T12155] usb 5-1: config 0 interface 1 altsetting 128 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 903.581727][ T10] usb 3-1: new low-speed USB device number 82 using dummy_hcd [ 903.619014][T12155] usb 5-1: config 0 interface 1 altsetting 128 endpoint 0x81 has invalid wMaxPacketSize 0 [ 903.631401][T12155] usb 5-1: config 0 interface 1 altsetting 128 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 903.646470][T12155] usb 5-1: config 0 interface 1 has no altsetting 0 [ 903.653550][T12155] usb 5-1: New USB device found, idVendor=145f, idProduct=0212, bcdDevice= 0.00 [ 903.663042][T12155] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 903.673915][T19880] __nla_validate_parse: 3 callbacks suppressed [ 903.673929][T19880] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4375'. [ 903.691806][T12155] usb 5-1: config 0 descriptor?? [ 903.773435][ T10] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 903.781920][ T10] usb 3-1: config 0 has no interface number 0 [ 903.788424][ T10] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 903.803417][ T10] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 903.815721][ T10] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 903.826809][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 903.838522][ T10] usb 3-1: config 0 descriptor?? [ 903.846686][T19878] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 903.863782][ T10] iowarrior 3-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 903.949361][T19886] xt_hashlimit: size too large, truncated to 1048576 [ 903.991589][T12152] usb 4-1: new high-speed USB device number 93 using dummy_hcd [ 904.102311][ T10] usb 3-1: USB disconnect, device number 82 [ 904.144553][T12152] usb 4-1: unable to get BOS descriptor or descriptor too short [ 904.157425][T12152] usb 4-1: too many endpoints for config 1 interface 0 altsetting 9: 33, using maximum allowed: 30 [ 904.171410][T12152] usb 4-1: config 1 interface 0 altsetting 9 has 1 endpoint descriptor, different from the interface descriptor's value: 33 [ 904.185608][T12152] usb 4-1: config 1 interface 0 has no altsetting 0 [ 904.196792][T12152] usb 4-1: string descriptor 0 read error: -22 [ 904.203547][T12152] usb 4-1: New USB device found, idVendor=05ac, idProduct=029a, bcdDevice= 0.40 [ 904.213170][T12152] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 904.468126][T12155] input: HID 145f:0212 Pen as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.1/0003:145F:0212.001A/input/input233 [ 904.614749][T12155] input: HID 145f:0212 Pad as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.1/0003:145F:0212.001A/input/input234 [ 904.653293][T12152] apple 0003:05AC:029A.001B: collection stack underflow [ 904.680058][T12152] apple 0003:05AC:029A.001B: item 0 4 0 12 parsing failed [ 904.711071][T12155] uclogic 0003:145F:0212.001A: input,hidraw0: USB HID v4.06 Keypad [HID 145f:0212] on usb-dummy_hcd.4-1/input1 [ 904.730282][T12152] apple 0003:05AC:029A.001B: parse failed [ 904.749547][T12152] apple 0003:05AC:029A.001B: probe with driver apple failed with error -22 [ 904.796643][T12155] usb 5-1: USB disconnect, device number 70 [ 904.861042][T12152] usb 4-1: USB disconnect, device number 93 [ 905.029255][T19899] fido_id[19899]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/5-1/report_descriptor': No such file or directory [ 905.181045][T19908] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4386'. [ 905.730236][T19931] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4397'. [ 905.852042][ T10] usb 5-1: new high-speed USB device number 71 using dummy_hcd [ 906.022004][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 906.037470][ T10] usb 5-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 906.076841][ T10] usb 5-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 906.107647][ T10] usb 5-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 906.130490][ T10] usb 5-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 906.140130][ T10] usb 5-1: Product: syz [ 906.145009][ T10] usb 5-1: Manufacturer: syz [ 906.156457][ T10] hub 5-1:4.0: USB hub found [ 906.381573][T12155] usb 4-1: new high-speed USB device number 94 using dummy_hcd [ 906.395344][ T10] hub 5-1:4.0: config failed, can't read hub descriptor (err -22) [ 906.434012][ T10] usb 5-1: USB disconnect, device number 71 [ 906.541649][T12155] usb 4-1: Using ep0 maxpacket: 32 [ 906.559150][T12155] usb 4-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 906.582459][T12155] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 906.594722][T12155] usb 4-1: Product: syz [ 906.600583][T12155] usb 4-1: Manufacturer: syz [ 906.607785][T12155] usb 4-1: SerialNumber: syz [ 906.767834][T19964] xt_hashlimit: size too large, truncated to 1048576 [ 907.047577][T12155] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 907.064971][T12155] usb 4-1: MIDIStreaming interface descriptor not found [ 907.731648][ T1559] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 907.903859][ T1559] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 907.915432][ T1559] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 907.926197][ T1559] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 907.943676][ T1559] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 907.961160][ T1559] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 907.984728][ T1559] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 908.227329][ T1559] snd-usb-audio 3-1:27.0: probe with driver snd-usb-audio failed with error -12 [ 908.255526][ T1559] usb 3-1: USB disconnect, device number 83 [ 908.400605][T20021] syzkaller0: entered promiscuous mode [ 908.406486][T20021] syzkaller0: entered allmulticast mode [ 908.589909][T20025] create_pit_timer: 5 callbacks suppressed [ 908.589930][T20025] kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 908.756714][T20032] netlink: 'syz.1.4434': attribute type 25 has an invalid length. [ 909.080107][T20046] syzkaller0: entered promiscuous mode [ 909.093536][T20046] syzkaller0: entered allmulticast mode [ 909.171213][ T10] usb 4-1: USB disconnect, device number 94 [ 909.212604][ T1559] usb 2-1: new high-speed USB device number 59 using dummy_hcd [ 909.349120][T20054] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4444'. [ 909.391588][ T1559] usb 2-1: Using ep0 maxpacket: 32 [ 909.404087][ T1559] usb 2-1: config 0 has an invalid interface number: 188 but max is 0 [ 909.427015][ T1559] usb 2-1: config 0 has no interface number 0 [ 909.436835][ T1559] usb 2-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 909.454456][ T1559] usb 2-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 909.464548][ T1559] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 909.473173][ T1559] usb 2-1: Product: syz [ 909.477621][ T1559] usb 2-1: Manufacturer: syz [ 909.486379][ T1559] usb 2-1: SerialNumber: syz [ 909.496609][ T1559] usb 2-1: config 0 descriptor?? [ 909.503865][T20042] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 909.591627][ T10] usb 4-1: new low-speed USB device number 95 using dummy_hcd [ 909.730162][T20042] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 909.763809][ T10] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 909.775849][ T10] usb 4-1: config 0 has no interface number 0 [ 909.782918][ T10] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 909.795757][ T10] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 909.810204][ T10] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 909.819923][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 909.835254][ T10] usb 4-1: config 0 descriptor?? [ 909.847615][T20052] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 909.864968][ T10] iowarrior 4-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 910.086366][ T5699] usb 4-1: USB disconnect, device number 95 [ 910.195149][T20080] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4456'. [ 910.782027][ T1559] asix 2-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 910.797023][ T1559] asix 2-1:0.188: probe with driver asix failed with error -71 [ 910.813190][ T1559] usb 2-1: USB disconnect, device number 59 [ 911.031930][T12156] usb 5-1: new high-speed USB device number 72 using dummy_hcd [ 911.138630][T20112] kvm: kvm [20110]: vcpu1, guest rIP: 0x914e Unhandled WRMSR(0x187) = 0xffff0000ffff0000 [ 911.148617][T20112] kvm: kvm [20110]: vcpu1, guest rIP: 0x9150 Unhandled WRMSR(0x187) = 0xffff0000ffff0000 [ 911.159036][T20112] kvm: kvm [20110]: vcpu1, guest rIP: 0x914e Unhandled WRMSR(0x186) = 0xffff0000ffff0000 [ 911.169109][T20112] kvm: kvm [20110]: vcpu1, guest rIP: 0x9150 Unhandled WRMSR(0x186) = 0xffff0000ffff0000 [ 911.184937][T20112] kvm: kvm [20110]: vcpu1, guest rIP: 0x914e Unhandled WRMSR(0x11e) = 0xffff0000ffff0000 [ 911.196455][T20112] kvm: kvm [20110]: vcpu1, guest rIP: 0x9150 Unhandled WRMSR(0x11e) = 0xffff0000ffff0000 [ 911.207917][T12156] usb 5-1: unable to get BOS descriptor or descriptor too short [ 911.217784][T12156] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 911.236476][T20112] kvm: kvm [20110]: vcpu1, guest rIP: 0x914e Unhandled WRMSR(0xc2) = 0xffff0000ffff0000 [ 911.249904][T12156] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 911.259403][T12156] usb 5-1: too many endpoints for config 1 interface 1 altsetting 76: 188, using maximum allowed: 30 [ 911.271633][T20112] kvm: kvm [20110]: vcpu1, guest rIP: 0x9150 Unhandled WRMSR(0xc2) = 0xffff0000ffff0000 [ 911.281707][T12156] usb 5-1: config 1 interface 1 altsetting 76 has 0 endpoint descriptors, different from the interface descriptor's value: 188 [ 911.295752][T20112] kvm: kvm [20110]: vcpu1, guest rIP: 0x914e Unhandled WRMSR(0xc1) = 0xffff0000ffff0000 [ 911.306188][T12156] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 911.319568][T20112] kvm: kvm [20110]: vcpu1, guest rIP: 0x9150 Unhandled WRMSR(0xc1) = 0xffff0000ffff0000 [ 911.321651][T12156] usb 5-1: config 1 interface 1 has no altsetting 0 [ 911.353877][T12156] usb 5-1: string descriptor 0 read error: -22 [ 911.365898][T12156] usb 5-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 911.384081][T12156] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 911.655177][T20128] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4478'. [ 912.239553][T12156] usb 5-1: 2:0: failed to get current value for ch 1 (-32) [ 912.462196][T12156] usb 5-1: USB disconnect, device number 72 [ 913.182073][ T10] usb 2-1: new high-speed USB device number 60 using dummy_hcd [ 913.285770][T20169] loop2: detected capacity change from 0 to 7 [ 913.300363][T20169] Dev loop2: unable to read RDB block 7 [ 913.306644][T20169] loop2: AHDI p1 p2 p3 [ 913.312123][T20169] loop2: partition table partially beyond EOD, truncated [ 913.334381][T20169] loop2: p1 start 1601398130 is beyond EOD, truncated [ 913.344091][T20169] loop2: p2 start 1702059890 is beyond EOD, truncated [ 913.364888][ T10] usb 2-1: config 0 has no interfaces? [ 913.379838][ T10] usb 2-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 913.404666][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 913.415708][T20172] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4497'. [ 913.433426][ T10] usb 2-1: Product: syz [ 913.449744][ T10] usb 2-1: Manufacturer: syz [ 913.460898][ T10] usb 2-1: SerialNumber: syz [ 913.493830][ T10] usb 2-1: config 0 descriptor?? [ 913.723466][ T10] usb 2-1: USB disconnect, device number 60 [ 914.150490][T20191] netlink: 'syz.0.4505': attribute type 16 has an invalid length. [ 914.159221][T20191] netlink: 'syz.0.4505': attribute type 3 has an invalid length. [ 914.168184][T20191] netlink: 'syz.0.4505': attribute type 2 has an invalid length. [ 914.177521][T20191] netlink: 'syz.0.4505': attribute type 1 has an invalid length. [ 914.186171][T20191] netlink: 64022 bytes leftover after parsing attributes in process `syz.0.4505'. [ 914.617692][T20214] netlink: 'syz.0.4516': attribute type 16 has an invalid length. [ 914.670553][T20214] netlink: 64138 bytes leftover after parsing attributes in process `syz.0.4516'. [ 914.951596][ T1559] usb 2-1: new high-speed USB device number 61 using dummy_hcd [ 914.981795][T12156] usb 4-1: new high-speed USB device number 96 using dummy_hcd [ 915.124658][ T1559] usb 2-1: config 0 has no interfaces? [ 915.143794][ T1559] usb 2-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 915.154894][ T1559] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 915.162978][T12156] usb 4-1: Using ep0 maxpacket: 16 [ 915.167874][T12156] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 915.169043][ T1559] usb 2-1: Product: syz [ 915.183602][ T1559] usb 2-1: Manufacturer: syz [ 915.188349][ T1559] usb 2-1: SerialNumber: syz [ 915.189671][T12156] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 915.204456][ T1559] usb 2-1: config 0 descriptor?? [ 915.219534][T12156] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 915.239151][T12156] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 915.247636][T12156] usb 4-1: Product: syz [ 915.252114][T12156] usb 4-1: Manufacturer: syz [ 915.256830][T12156] usb 4-1: SerialNumber: syz [ 915.276138][T12156] usb 4-1: 0:2 : does not exist [ 915.291801][ T29] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 915.425891][T12155] usb 2-1: USB disconnect, device number 61 [ 915.441902][ T29] usb 3-1: Using ep0 maxpacket: 8 [ 915.465316][ T29] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 915.494249][T12156] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 915.509435][ T29] usb 3-1: config 0 has no interface number 0 [ 915.570697][ T29] usb 3-1: config 0 interface 1 altsetting 129 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 915.655766][ T29] usb 3-1: config 0 interface 1 altsetting 129 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 915.695214][ T29] usb 3-1: config 0 interface 1 has no altsetting 0 [ 915.716580][ T29] usb 3-1: New USB device found, idVendor=28bd, idProduct=1903, bcdDevice= 0.00 [ 915.738053][ T29] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 915.753163][T12156] usb 4-1: USB disconnect, device number 96 [ 915.779660][ T29] usb 3-1: config 0 descriptor?? [ 915.812447][T20234] kvm: user requested TSC rate below hardware speed [ 915.824254][T20234] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3570859521 (7141719042 ns) > initial count (984728130 ns). Using initial count to start timer. [ 915.849437][T17636] udevd[17636]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 916.226364][ T29] uclogic 0003:28BD:1903.001C: interface is invalid, ignoring [ 916.271535][ T10] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 916.413241][ T1559] usb 3-1: USB disconnect, device number 84 [ 916.431595][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 916.442797][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 916.454365][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 916.467751][ T10] usb 5-1: New USB device found, idVendor=25dd, idProduct=f3d2, bcdDevice=d2.37 [ 916.477239][ T10] usb 5-1: New USB device strings: Mfr=84, Product=45, SerialNumber=0 [ 916.485496][ T10] usb 5-1: Product: syz [ 916.489714][ T10] usb 5-1: Manufacturer: syz [ 916.497351][ T10] usb 5-1: config 0 descriptor?? [ 916.926055][ T10] hid-generic 0003:25DD:F3D2.001D: hiddev0,hidraw0: USB HID v0.00 Device [syz syz] on usb-dummy_hcd.4-1/input0 [ 917.179897][ T29] usb 5-1: USB disconnect, device number 73 [ 917.545916][T20272] kvm: Disabled LAPIC found during irq injection [ 918.124770][T20293] kvm: emulating exchange as write [ 918.426159][ T10] usb 4-1: new high-speed USB device number 97 using dummy_hcd [ 918.602381][ T5691] usb 2-1: new high-speed USB device number 62 using dummy_hcd [ 918.624440][ T10] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 918.640773][ T10] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 918.653441][ T10] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 918.665533][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=67 [ 918.674089][ T10] usb 4-1: SerialNumber: syz [ 918.781636][ T5691] usb 2-1: Using ep0 maxpacket: 8 [ 918.789622][ T5691] usb 2-1: config 0 interface 0 altsetting 6 endpoint 0x81 has an invalid bInterval 132, changing to 11 [ 918.801965][ T5691] usb 2-1: config 0 interface 0 has no altsetting 0 [ 918.809015][ T5691] usb 2-1: New USB device found, idVendor=046d, idProduct=c227, bcdDevice= 0.00 [ 918.820571][ T5691] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 918.834715][ T5691] usb 2-1: config 0 descriptor?? [ 918.914020][ T10] usb 4-1: 0:2 : does not exist [ 918.924145][ T10] usb 4-1: unit 66 not found! [ 919.007264][ T10] usb 4-1: USB disconnect, device number 97 [ 919.137301][T17636] udevd[17636]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 919.212182][ T29] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 919.257619][ T5691] hid_parser_main: 5 callbacks suppressed [ 919.257638][ T5691] lg-g15 0003:046D:C227.001E: unknown main item tag 0x3 [ 919.270985][ T5691] lg-g15 0003:046D:C227.001E: unknown main item tag 0x0 [ 919.279028][ T5691] lg-g15 0003:046D:C227.001E: unknown main item tag 0x0 [ 919.286080][ T5691] lg-g15 0003:046D:C227.001E: unknown main item tag 0x0 [ 919.293130][ T5691] lg-g15 0003:046D:C227.001E: unknown main item tag 0x0 [ 919.300093][ T5691] lg-g15 0003:046D:C227.001E: unknown main item tag 0x0 [ 919.307279][ T5691] lg-g15 0003:046D:C227.001E: unknown main item tag 0x0 [ 919.315494][ T5691] lg-g15 0003:046D:C227.001E: unknown main item tag 0x0 [ 919.326907][ T5691] lg-g15 0003:046D:C227.001E: hidraw0: USB HID v0.04 Device [HID 046d:c227] on usb-dummy_hcd.1-1/input0 [ 919.371648][ T29] usb 5-1: Using ep0 maxpacket: 8 [ 919.379217][ T29] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 919.388290][ T29] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 919.398842][ T29] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 919.412502][ T29] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 919.423655][ T29] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 919.434747][ T29] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 919.448967][ T29] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 919.465055][ T29] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 919.475058][T12152] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 919.483184][T12156] usb 2-1: USB disconnect, device number 62 [ 919.509342][ T29] usbtmc 5-1:16.0: probe with driver usbtmc failed with error -22 [ 919.642721][T12152] usb 3-1: Using ep0 maxpacket: 32 [ 919.656066][T12152] usb 3-1: config 0 has an invalid interface number: 67 but max is 0 [ 919.665606][T12152] usb 3-1: config 0 has no interface number 0 [ 919.676274][T12152] usb 3-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 919.685814][T12152] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 919.694221][T12152] usb 3-1: Product: syz [ 919.698606][T12152] usb 3-1: Manufacturer: syz [ 919.704213][T12152] usb 3-1: SerialNumber: syz [ 919.719912][T12152] usb 3-1: config 0 descriptor?? [ 920.135509][T12152] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 920.157829][T12152] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 920.413378][T12156] usb 2-1: new full-speed USB device number 63 using dummy_hcd [ 920.573719][T12156] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 920.584936][T12156] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 920.600420][T12156] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 920.611229][T12156] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 920.787953][T12152] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000104: -71 [ 920.814784][T12152] smsc95xx 3-1:0.67: probe with driver smsc95xx failed with error -71 [ 920.838854][T12152] usb 3-1: USB disconnect, device number 85 [ 920.845433][T12156] usb 2-1: usb_control_msg returned -71 [ 920.859099][T12156] usbtmc 2-1:16.0: can't read capabilities [ 920.913885][T12156] usb 2-1: USB disconnect, device number 63 [ 921.485589][T20355] syzkaller0: entered promiscuous mode [ 921.491961][T20355] syzkaller0: entered allmulticast mode [ 922.033895][ T5691] usb 5-1: USB disconnect, device number 74 [ 922.354492][ T10] usb 4-1: new full-speed USB device number 98 using dummy_hcd [ 922.501127][T20392] syzkaller1: entered promiscuous mode [ 922.516236][T20392] syzkaller1: entered allmulticast mode [ 922.542190][ T10] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 922.561870][ T10] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 922.591248][ T10] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 922.631802][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 922.648086][T20396] xt_hashlimit: size too large, truncated to 1048576 [ 923.062455][ T10] usb 4-1: usb_control_msg returned -71 [ 923.076579][ T10] usbtmc 4-1:16.0: can't read capabilities [ 923.107607][ T10] usb 4-1: USB disconnect, device number 98 [ 923.649788][T20428] loop2: detected capacity change from 0 to 7 [ 923.659636][T20428] Dev loop2: unable to read RDB block 7 [ 923.666299][T20428] loop2: unable to read partition table [ 923.673819][T20428] loop2: partition table beyond EOD, truncated [ 923.680371][T20428] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 924.609028][T20455] netlink: 132 bytes leftover after parsing attributes in process `syz.4.4618'. [ 924.647319][T20456] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 924.682947][ T10] usb 2-1: new full-speed USB device number 64 using dummy_hcd [ 924.875026][ T10] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 924.899937][ T10] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 924.936871][ T10] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 924.961604][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 925.402361][ T10] usb 2-1: usb_control_msg returned -71 [ 925.421649][ T10] usbtmc 2-1:16.0: can't read capabilities [ 925.449199][ T10] usb 2-1: USB disconnect, device number 64 [ 925.821071][T20463] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4621'. [ 926.341635][T12156] usb 2-1: new high-speed USB device number 65 using dummy_hcd [ 926.494845][T12156] usb 2-1: unable to get BOS descriptor or descriptor too short [ 926.516312][T12156] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 926.537676][T12156] usb 2-1: can't read configurations, error -71 [ 926.932331][ T5699] usb 4-1: new full-speed USB device number 99 using dummy_hcd [ 927.114020][ T5699] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 927.134613][ T5699] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 927.158722][T20501] netlink: 'syz.0.4636': attribute type 12 has an invalid length. [ 927.166154][ T5699] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 927.191524][ T5699] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 927.628585][ T5699] usb 4-1: usb_control_msg returned -71 [ 927.645859][ T5699] usbtmc 4-1:16.0: can't read capabilities [ 927.684264][ T5699] usb 4-1: USB disconnect, device number 99 [ 927.852156][T20510] loop5: detected capacity change from 0 to 7 [ 927.864125][T20510] Dev loop5: unable to read RDB block 7 [ 927.870614][T20510] loop5: AHDI p1 p2 p3 [ 927.875373][T20510] loop5: partition table partially beyond EOD, truncated [ 927.886258][T20510] loop5: p1 start 926365495 is beyond EOD, truncated [ 927.894981][T20510] loop5: p2 start 1702059890 is beyond EOD, truncated [ 928.345811][T20528] loop2: detected capacity change from 0 to 7 [ 928.353273][T20528] Dev loop2: unable to read RDB block 7 [ 928.358887][T20528] loop2: unable to read partition table [ 928.365012][T20528] loop2: partition table beyond EOD, truncated [ 928.371277][T20528] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 928.501607][T12155] usb 4-1: new high-speed USB device number 100 using dummy_hcd [ 928.665301][T12155] usb 4-1: unable to get BOS descriptor or descriptor too short [ 928.695842][T12155] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 928.723473][T12155] usb 4-1: can't read configurations, error -71 [ 929.414305][T20555] loop2: detected capacity change from 0 to 7 [ 929.436816][T20555] Dev loop2: unable to read RDB block 7 [ 929.455775][T20555] loop2: unable to read partition table [ 929.471820][T20555] loop2: partition table beyond EOD, truncated [ 929.482345][T20555] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 930.149821][T20582] xt_hashlimit: size too large, truncated to 1048576 [ 930.936634][T20617] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4688'. [ 930.953595][T20617] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4688'. [ 931.127402][T20623] xt_hashlimit: size too large, truncated to 1048576 [ 931.506344][T20625] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4691'. [ 931.972142][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.981842][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 932.386411][T20659] xt_hashlimit: size too large, truncated to 1048576 [ 933.356413][T20687] xt_hashlimit: size too large, truncated to 1048576 [ 935.365593][T20740] xt_hashlimit: size too large, truncated to 1048576 [ 935.452023][ T29] usb 3-1: new full-speed USB device number 86 using dummy_hcd [ 935.613812][ T29] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 935.631844][ T29] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 935.659814][ T29] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 935.678089][ T29] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 935.899626][ T29] usb 3-1: usb_control_msg returned -32 [ 935.905876][ T29] usbtmc 3-1:16.0: can't read capabilities [ 935.952182][T20762] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4747'. [ 936.124194][ T29] usb 3-1: USB disconnect, device number 86 [ 936.855207][T20796] random: crng reseeded on system resumption [ 936.993834][T20783] netlink: 'syz.0.4756': attribute type 12 has an invalid length. [ 937.229106][T20806] tipc: Enabled bearer , priority 10 [ 937.264130][T20806] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 937.288885][T20806] tipc: Enabled bearer , priority 10 [ 937.633495][T20818] ip6erspan0: entered allmulticast mode [ 937.976025][T20829] netlink: 'syz.0.4778': attribute type 1 has an invalid length. [ 937.985126][T20832] loop2: detected capacity change from 0 to 7 [ 938.015307][T20832] Dev loop2: unable to read RDB block 7 [ 938.024857][T20832] loop2: unable to read partition table [ 938.057311][T20832] loop2: partition table beyond EOD, truncated [ 938.080262][T20832] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 938.161743][T20829] 8021q: adding VLAN 0 to HW filter on device bond1 [ 938.227058][T20834] bond1: entered allmulticast mode [ 938.253783][T20839] netlink: 1036 bytes leftover after parsing attributes in process `syz.2.4781'. [ 938.300557][T20835] bond1: (slave ip6gretap1): making interface the new active one [ 938.312986][T20835] ip6gretap1: entered allmulticast mode [ 938.323807][T20835] bond1: (slave ip6gretap1): Enslaving as an active interface with an up link [ 938.333536][ T1559] tipc: Node number set to 1926366544 [ 938.745839][T20860] 8021q: VLANs not supported on nlmon0 [ 938.851094][T20862] loop2: detected capacity change from 0 to 7 [ 938.866718][T20862] Dev loop2: unable to read RDB block 7 [ 938.876517][T20862] loop2: unable to read partition table [ 938.883145][T20862] loop2: partition table beyond EOD, truncated [ 938.896384][T20862] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 939.665644][T20876] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 939.681786][ T10] usb 3-1: new low-speed USB device number 87 using dummy_hcd [ 939.821541][ T10] usb 3-1: device descriptor read/64, error -71 [ 940.061540][ T10] usb 3-1: new low-speed USB device number 88 using dummy_hcd [ 940.201891][ T10] usb 3-1: device descriptor read/64, error -71 [ 940.332573][ T10] usb usb3-port1: attempt power cycle [ 940.681576][ T10] usb 3-1: new low-speed USB device number 89 using dummy_hcd [ 940.714894][ T10] usb 3-1: device descriptor read/8, error -71 [ 940.961503][ T10] usb 3-1: new low-speed USB device number 90 using dummy_hcd [ 941.002310][ T10] usb 3-1: device descriptor read/8, error -71 [ 941.112013][ T10] usb usb3-port1: unable to enumerate USB device [ 942.009665][T20890] Cannot find add_set index 4 as target [ 942.890615][T20913] geneve2: entered promiscuous mode [ 943.013270][T20920] batman_adv: batadv0: Adding interface: dummy0 [ 943.020146][T20920] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 943.084248][T20920] batman_adv: batadv0: Interface activated: dummy0 [ 943.659955][T20946] syzkaller0: entered promiscuous mode [ 943.667298][T20946] syzkaller0: entered allmulticast mode [ 943.803882][T20950] syzkaller0: entered promiscuous mode [ 943.826717][T20950] syzkaller0: entered allmulticast mode [ 944.726035][T12156] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 944.833839][T21000] netlink: 'syz.1.4852': attribute type 1 has an invalid length. [ 944.894453][T12156] usb 3-1: config 0 has no interfaces? [ 944.900541][T21000] 8021q: adding VLAN 0 to HW filter on device bond1 [ 944.910895][T12156] usb 3-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 944.926728][T21006] bond1: entered allmulticast mode [ 944.936846][T12156] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 944.975646][T12156] usb 3-1: Product: syz [ 944.993745][T12156] usb 3-1: Manufacturer: syz [ 945.013095][T12156] usb 3-1: SerialNumber: syz [ 945.046566][T12156] usb 3-1: config 0 descriptor?? [ 945.270491][T12156] usb 3-1: USB disconnect, device number 91 [ 945.329395][T21024] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4863'. [ 945.780562][T21045] netlink: 'syz.0.4872': attribute type 1 has an invalid length. [ 945.904596][T21045] 8021q: adding VLAN 0 to HW filter on device bond2 [ 945.925508][T21050] bond2: entered allmulticast mode [ 946.349735][T21071] netlink: 76 bytes leftover after parsing attributes in process `syz.2.4882'. [ 946.380015][T21071] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 946.624249][T21081] vcan0: tx drop: invalid da for name 0x0000000000000001 [ 946.751560][ T10] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 946.869468][T21095] netlink: 892 bytes leftover after parsing attributes in process `syz.0.4895'. [ 946.923596][ T10] usb 4-1: config 0 has no interfaces? [ 946.936435][ T10] usb 4-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 946.963316][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 946.992640][ T10] usb 4-1: Product: syz [ 947.001872][ T10] usb 4-1: Manufacturer: syz [ 947.010714][ T10] usb 4-1: SerialNumber: syz [ 947.028183][ T10] usb 4-1: config 0 descriptor?? [ 947.260688][T12155] usb 4-1: USB disconnect, device number 102 [ 947.369323][T21118] syzkaller0: entered promiscuous mode [ 947.375183][T21118] syzkaller0: entered allmulticast mode [ 947.521025][T21125] netlink: 892 bytes leftover after parsing attributes in process `syz.4.4909'. [ 947.585868][T21123] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4908'. [ 948.060693][T21144] netlink: 'syz.1.4918': attribute type 1 has an invalid length. [ 948.134716][T21147] netlink: 892 bytes leftover after parsing attributes in process `syz.2.4920'. [ 948.171692][T21144] 8021q: adding VLAN 0 to HW filter on device bond2 [ 948.201584][T21150] bond2: entered allmulticast mode [ 948.812775][T21180] syzkaller0: entered promiscuous mode [ 948.819265][T21180] syzkaller0: entered allmulticast mode [ 948.979350][T21189] netlink: 80 bytes leftover after parsing attributes in process `syz.3.4938'. [ 949.230980][T21201] : renamed from bond0 (while UP) [ 949.255199][T21201] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4944'. [ 949.298238][T21201] team1: entered promiscuous mode [ 949.303920][T21201] team1: entered allmulticast mode [ 949.309504][T21201] 8021q: adding VLAN 0 to HW filter on device team1 [ 949.319932][T21201] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4944'. [ 949.333044][T21201] team2 (uninitialized): Failed to send options change via netlink (err -105) [ 949.382382][T21201] team2: entered promiscuous mode [ 949.387870][T21201] team2: entered allmulticast mode [ 949.394350][T21201] 8021q: adding VLAN 0 to HW filter on device team2 [ 949.807876][T21220] netlink: 80 bytes leftover after parsing attributes in process `syz.0.4952'. [ 950.218032][T21230] gretap1: entered allmulticast mode [ 950.536081][T21245] __nla_validate_parse: 1 callbacks suppressed [ 950.536103][T21245] netlink: 80 bytes leftover after parsing attributes in process `syz.3.4964'. [ 950.557042][T21248] syz_tun: left allmulticast mode [ 950.571708][T21248] dvmrp8: left allmulticast mode [ 950.897245][T21265] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4969'. [ 950.980674][T21270] loop2: detected capacity change from 0 to 7 [ 950.989034][T21270] Dev loop2: unable to read RDB block 7 [ 951.003859][T21270] loop2: unable to read partition table [ 951.012249][T21270] loop2: partition table beyond EOD, truncated [ 951.018568][T21270] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 951.169570][T21273] syzkaller0: entered promiscuous mode [ 951.182984][T21273] syzkaller0: entered allmulticast mode [ 951.408372][T21281] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4977'. [ 951.433323][T21281] vlan2: entered allmulticast mode [ 951.438736][T21281] bond_slave_1: entered allmulticast mode [ 951.457800][T21281] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4977'. [ 953.379558][T21342] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5003'. [ 953.575213][T21354] §: renamed from sit0 (while UP) [ 953.750592][ T30] audit: type=1326 audit(1780021611.573:14432): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21358 comm="syz.3.5009" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f8270d9ce59 code=0x0 [ 955.189036][T21401] xt_hashlimit: size too large, truncated to 1048576 [ 955.943390][T21433] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5043'. [ 955.982058][T21433] 8021q: adding VLAN 0 to HW filter on device bond1 [ 956.104229][T21440] xt_hashlimit: size too large, truncated to 1048576 [ 956.688635][T21462] netlink: 48 bytes leftover after parsing attributes in process `syz.4.5056'. [ 956.720988][T21462] netlink: 48 bytes leftover after parsing attributes in process `syz.4.5056'. [ 956.876892][T21473] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5059'. [ 956.974797][T21473] 8021q: adding VLAN 0 to HW filter on device bond0 [ 956.992722][T12152] usb 3-1: new full-speed USB device number 92 using dummy_hcd [ 957.016820][T21479] gretap1: entered allmulticast mode [ 957.027162][T21479] bond0: (slave gretap1): Enslaving as an active interface with an up link [ 957.084529][T21473] bond0 (unregistering): (slave gretap1): Releasing backup interface [ 957.094926][T21488] xt_hashlimit: size too large, truncated to 1048576 [ 957.126663][T21473] bond0 (unregistering): Released all slaves [ 957.136191][T12152] usb 3-1: device descriptor read/64, error -71 [ 957.392256][T12152] usb 3-1: new full-speed USB device number 93 using dummy_hcd [ 957.541579][T12152] usb 3-1: device descriptor read/64, error -71 [ 957.589254][T21503] netlink: 48 bytes leftover after parsing attributes in process `syz.3.5071'. [ 957.599461][T21503] netlink: 48 bytes leftover after parsing attributes in process `syz.3.5071'. [ 957.662085][T12152] usb usb3-port1: attempt power cycle [ 958.041895][T12152] usb 3-1: new full-speed USB device number 94 using dummy_hcd [ 958.086071][T12152] usb 3-1: device descriptor read/8, error -71 [ 958.174271][T21528] netlink: 48 bytes leftover after parsing attributes in process `syz.1.5083'. [ 958.207975][T21528] netlink: 48 bytes leftover after parsing attributes in process `syz.1.5083'. [ 958.334377][T12152] usb 3-1: new full-speed USB device number 95 using dummy_hcd [ 958.373231][T12152] usb 3-1: device descriptor read/8, error -71 [ 958.492538][T12152] usb usb3-port1: unable to enumerate USB device [ 958.597459][T21542] syzkaller0: entered promiscuous mode [ 958.617201][T21542] syzkaller0: entered allmulticast mode [ 958.883688][T21555] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5096'. [ 958.988969][T21555] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5096'. [ 959.490857][T21576] syzkaller0: entered promiscuous mode [ 959.503938][T21576] syzkaller0: entered allmulticast mode [ 959.663099][T21584] vcan0: tx drop: invalid da for name 0x0000000000000001 [ 960.061165][T21592] syzkaller0: entered promiscuous mode [ 960.067824][T21592] syzkaller0: entered allmulticast mode [ 963.495605][T21612] syzkaller0: entered promiscuous mode [ 963.522147][T21612] syzkaller0: entered allmulticast mode [ 963.707484][T21616] syzkaller0: entered promiscuous mode [ 963.736313][T21616] syzkaller0: entered allmulticast mode [ 963.911591][T12156] usb 5-1: new low-speed USB device number 75 using dummy_hcd [ 964.087057][T12156] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 964.119503][T12156] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 964.155911][T12156] usb 5-1: config 0 has no interface number 0 [ 964.169947][T12156] usb 5-1: config 0 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 964.203528][T12156] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 964.230086][T12156] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 964.269933][T12156] usb 5-1: config 0 descriptor?? [ 964.284803][T21649] syzkaller0: entered promiscuous mode [ 964.297553][T12156] iowarrior 5-1:0.1: no interrupt-in endpoint found [ 964.303990][T21649] syzkaller0: entered allmulticast mode [ 964.504631][T12152] usb 5-1: USB disconnect, device number 75 [ 968.177143][T21679] __nla_validate_parse: 3 callbacks suppressed [ 968.177165][T21679] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5144'. [ 968.223292][T21678] ip6erspan0: entered allmulticast mode [ 968.409370][T21688] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5149'. [ 968.521386][T21688] 8021q: adding VLAN 0 to HW filter on device bond2 [ 968.658456][T21704] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5155'. [ 968.672348][ T5691] usb 5-1: new low-speed USB device number 76 using dummy_hcd [ 968.853826][ T5691] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 968.875328][ T5691] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 968.897795][ T5691] usb 5-1: config 0 has no interface number 0 [ 968.910753][ T5691] usb 5-1: config 0 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 968.930153][T21717] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5161'. [ 968.939209][ T5691] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 968.939242][ T5691] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 968.952993][T21715] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5160'. [ 968.970021][ T5691] usb 5-1: config 0 descriptor?? [ 968.983077][ T5691] iowarrior 5-1:0.1: no interrupt-in endpoint found [ 968.984554][T21719] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5161'. [ 968.998329][T21715] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5160'. [ 969.018844][T21717] team3: entered promiscuous mode [ 969.021207][T21715] netlink: 58 bytes leftover after parsing attributes in process `syz.3.5160'. [ 969.024689][T21717] team3: entered allmulticast mode [ 969.043291][T21717] 8021q: adding VLAN 0 to HW filter on device team3 [ 969.059388][T21719] team4 (uninitialized): Failed to send options change via netlink (err -105) [ 969.089962][T21719] team4: entered promiscuous mode [ 969.095619][T21719] team4: entered allmulticast mode [ 969.101256][T21719] 8021q: adding VLAN 0 to HW filter on device team4 [ 969.123315][T21722] team0 (unregistering): Port device team_slave_0 removed [ 969.136090][T21722] team0 (unregistering): Port device team_slave_1 removed [ 969.205225][ T1559] usb 5-1: USB disconnect, device number 76 [ 969.379911][T21730] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5166'. [ 969.514674][T21730] 8021q: adding VLAN 0 to HW filter on device bond0 [ 969.907837][T21749] : renamed from bond0 (while UP) [ 969.947090][T21749] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5174'. [ 970.067331][T21749] team1: entered promiscuous mode [ 970.078863][T21749] team1: entered allmulticast mode [ 970.093212][T21749] 8021q: adding VLAN 0 to HW filter on device team1 [ 970.327212][T21754] team2 (uninitialized): Failed to send options change via netlink (err -105) [ 970.385642][T21754] team2: entered promiscuous mode [ 970.391633][T21754] team2: entered allmulticast mode [ 970.407933][T21754] 8021q: adding VLAN 0 to HW filter on device team2 [ 970.482740][T21764] 8021q: adding VLAN 0 to HW filter on device bond3 [ 970.728831][T21780] netlink: 'syz.0.5187': attribute type 16 has an invalid length. [ 971.205559][T21799] 8021q: adding VLAN 0 to HW filter on device bond4 [ 971.303556][T21805] netlink: 'syz.3.5198': attribute type 1 has an invalid length. [ 971.332341][T12156] usb 3-1: new high-speed USB device number 96 using dummy_hcd [ 971.372407][T21805] bond5: entered allmulticast mode [ 971.474012][T12156] usb 3-1: device descriptor read/64, error -71 [ 971.582736][T21813] tipc: Enabling of bearer rejected, failed to enable media [ 971.588443][T21816] netlink: 'syz.1.5201': attribute type 16 has an invalid length. [ 971.712935][T21818] ip6erspan0: entered allmulticast mode [ 971.743884][T12156] usb 3-1: new high-speed USB device number 97 using dummy_hcd [ 971.882917][T12156] usb 3-1: device descriptor read/64, error -71 [ 971.906696][T21828] 8021q: adding VLAN 0 to HW filter on device bond6 [ 972.002707][T12156] usb usb3-port1: attempt power cycle [ 972.198025][T21842] tipc: Enabling of bearer rejected, failed to enable media [ 972.381739][T12156] usb 3-1: new high-speed USB device number 98 using dummy_hcd [ 972.422243][T12156] usb 3-1: device descriptor read/8, error -71 [ 972.682745][T12156] usb 3-1: new high-speed USB device number 99 using dummy_hcd [ 972.724978][T12156] usb 3-1: device descriptor read/8, error -71 [ 972.856278][T12156] usb usb3-port1: unable to enumerate USB device [ 972.882406][T21868] loop2: detected capacity change from 0 to 7 [ 972.900847][T21868] Dev loop2: unable to read RDB block 7 [ 972.920626][T21868] loop2: unable to read partition table [ 972.942161][T21868] loop2: partition table beyond EOD, truncated [ 972.957076][T21870] tipc: Enabling of bearer rejected, failed to enable media [ 972.957284][T21868] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 973.142408][T21875] : renamed from bond0 (while UP) [ 973.193525][T21875] team0: entered promiscuous mode [ 973.198859][T21875] team0: entered allmulticast mode [ 973.212737][T21875] 8021q: adding VLAN 0 to HW filter on device team0 [ 973.231832][T21880] __nla_validate_parse: 16 callbacks suppressed [ 973.231852][T21880] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5229'. [ 973.293681][T21880] team1 (uninitialized): Failed to send options change via netlink (err -105) [ 973.372207][T21880] team1: entered promiscuous mode [ 973.377557][T21880] team1: entered allmulticast mode [ 973.383929][T21880] 8021q: adding VLAN 0 to HW filter on device team1 [ 973.536340][T21891] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5237'. [ 974.156545][T21913] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5247'. [ 974.244782][T21919] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5247'. [ 974.336556][T21913] team5: entered promiscuous mode [ 974.359048][T21913] team5: entered allmulticast mode [ 974.379144][T21913] 8021q: adding VLAN 0 to HW filter on device team5 [ 974.403575][T21919] team6 (uninitialized): Failed to send options change via netlink (err -105) [ 974.503266][T21919] team6: entered promiscuous mode [ 974.532022][T21919] team6: entered allmulticast mode [ 974.544814][T21919] 8021q: adding VLAN 0 to HW filter on device team6 [ 975.224133][T21960] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5268'. [ 975.356993][T21966] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5271'. [ 975.385169][T21966] 8021q: adding VLAN 0 to HW filter on device bond1 [ 976.336502][T22001] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5285'. [ 976.733651][T22009] tipc: Enabled bearer , priority 10 [ 977.290453][T22021] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5294'. [ 977.784708][T22037] syzkaller0: entered promiscuous mode [ 977.790377][T22037] syzkaller0: entered allmulticast mode [ 977.955722][ T1559] tipc: Node number set to 877003694 [ 978.941838][T22074] syzkaller0: entered promiscuous mode [ 978.947890][T22074] syzkaller0: entered allmulticast mode [ 979.629734][T22092] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5326'. [ 980.475644][T22123] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5340'. [ 981.207024][T22149] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5354'. [ 981.271250][T22150] : renamed from bond0 (while UP) [ 981.298761][T22150] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5353'. [ 981.392402][T22150] team1: entered promiscuous mode [ 981.409178][T22150] team1: entered allmulticast mode [ 981.426022][T22150] 8021q: adding VLAN 0 to HW filter on device team1 [ 981.752063][T22184] loop2: detected capacity change from 0 to 7 [ 981.761324][T22184] Dev loop2: unable to read RDB block 7 [ 981.769608][T22184] loop2: unable to read partition table [ 981.785515][T22184] loop2: partition table beyond EOD, truncated [ 981.793789][T22184] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 982.200378][T22203] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5376'. [ 982.226713][T22203] team2: entered promiscuous mode [ 982.231914][T22203] team2: entered allmulticast mode [ 982.237412][T22203] 8021q: adding VLAN 0 to HW filter on device team2 [ 982.727724][T22221] netlink: 44 bytes leftover after parsing attributes in process `syz.1.5385'. [ 983.116607][T22226] syzkaller0: entered promiscuous mode [ 983.122549][T22226] syzkaller0: entered allmulticast mode [ 984.264120][T22246] loop2: detected capacity change from 0 to 7 [ 984.281913][T22246] loop2: [ 984.297525][T22246] loop2: partition table partially beyond EOD, truncated [ 986.900564][T22250] tipc: Enabled bearer , priority 0 [ 986.910908][T22251] syzkaller0: entered promiscuous mode [ 986.923583][T22251] syzkaller0: entered allmulticast mode [ 986.968631][T22255] tipc: Resetting bearer [ 987.019997][T22248] tipc: Resetting bearer [ 987.086111][T22248] tipc: Disabling bearer [ 987.211065][T22275] netlink: 64 bytes leftover after parsing attributes in process `syz.0.5406'. [ 987.782680][T22293] syzkaller0: entered promiscuous mode [ 987.796927][T22293] syzkaller0: entered allmulticast mode [ 991.310563][T22311] netlink: 132 bytes leftover after parsing attributes in process `syz.2.5422'. [ 992.738362][T22372] netlink: 'syz.0.5445': attribute type 16 has an invalid length. [ 992.755477][T22372] netlink: 64138 bytes leftover after parsing attributes in process `syz.0.5445'. [ 992.952286][T22374] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5446'. [ 993.403835][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 993.415962][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 994.476325][T22396] netlink: 'syz.4.5456': attribute type 16 has an invalid length. [ 994.498425][T22396] netlink: 64138 bytes leftover after parsing attributes in process `syz.4.5456'. [ 994.936407][T12155] usb 5-1: new high-speed USB device number 77 using dummy_hcd [ 995.105043][T12155] usb 5-1: unable to get BOS descriptor or descriptor too short [ 995.117644][T12155] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 995.125792][T12155] usb 5-1: can't read configurations, error -71 [ 996.602792][T22412] netlink: 128 bytes leftover after parsing attributes in process `syz.4.5462'. [ 996.621649][T22412] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 997.511526][ T5724] usb 3-1: new high-speed USB device number 100 using dummy_hcd [ 997.677134][ T5724] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 997.698270][ T5724] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 997.722815][ T5724] usb 3-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 997.735136][ T5724] usb 3-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 997.744335][ T5724] usb 3-1: Manufacturer: syz [ 997.755614][ T5724] usb 3-1: config 0 descriptor?? [ 998.635714][ T5724] input: syz Pen as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:256C:006D.001F/input/input235 [ 998.735312][ T5724] input: syz Pad as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:256C:006D.001F/input/input236 [ 998.798820][ T5724] input: syz Touch Strip as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:256C:006D.001F/input/input237 [ 998.848333][ T5724] input: syz Dial as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:256C:006D.001F/input/input238 [ 998.924765][ T5724] uclogic 0003:256C:006D.001F: input,hidraw0: USB HID v0.00 Keypad [syz] on usb-dummy_hcd.2-1/input0 [ 998.967086][ T5724] usb 3-1: USB disconnect, device number 100 [ 999.316239][T22463] fido_id[22463]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/3-1/report_descriptor': No such file or directory [ 999.832911][T22477] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5482'. [ 1001.655388][T22479] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1001.664487][T22479] batadv_slave_0: entered promiscuous mode [ 1001.670429][T22479] batadv_slave_0: entered allmulticast mode [ 1002.235746][T22498] syzkaller0: entered promiscuous mode [ 1002.246629][T22498] syzkaller0: entered allmulticast mode [ 1002.384592][T22503] bond2: entered allmulticast mode [ 1002.874955][T12156] usb 4-1: new full-speed USB device number 103 using dummy_hcd [ 1002.906992][T22519] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5498'. [ 1003.047602][T12156] usb 4-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1003.071931][T12156] usb 4-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 1003.107374][T12156] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1003.120034][T12156] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1003.157822][T12156] usbtmc 4-1:16.0: bulk endpoints not found [ 1003.360686][T22533] bond3: entered allmulticast mode [ 1003.502631][T12156] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 1003.688322][T12156] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1003.709446][T12156] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 1003.727250][T12156] usb 5-1: can't read configurations, error -71 [ 1004.256307][T22567] bond0: entered allmulticast mode [ 1004.283148][T22567] ip6gretap1: entered allmulticast mode [ 1004.289237][T22567] bond0: (slave ip6gretap1): Enslaving as an active interface with an up link [ 1004.376163][T22571] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5520'. [ 1005.495429][T22590] pim6reg0: tun_chr_ioctl cmd 2147767511 [ 1005.628189][T12155] usb 4-1: USB disconnect, device number 103 [ 1005.701578][ T5691] usb 2-1: new high-speed USB device number 67 using dummy_hcd [ 1005.771606][ T1559] usb 5-1: new high-speed USB device number 81 using dummy_hcd [ 1005.837892][T22600] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5532'. [ 1005.861570][ T5691] usb 2-1: Using ep0 maxpacket: 16 [ 1005.871972][ T5691] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1005.899115][ T5691] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1005.919509][ T5691] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1005.946373][ T5691] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1005.957428][ T5691] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1005.982019][ T1559] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1005.992689][ T1559] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 1006.001877][ T1559] usb 5-1: can't read configurations, error -71 [ 1006.015644][ T5691] usb 2-1: config 0 descriptor?? [ 1006.440493][ T5691] microsoft 0003:045E:07DA.0020: unbalanced collection at end of report description [ 1006.466826][ T5691] microsoft 0003:045E:07DA.0020: parse failed [ 1006.481939][ T5691] microsoft 0003:045E:07DA.0020: probe with driver microsoft failed with error -22 [ 1007.166649][ T1559] usb 2-1: USB disconnect, device number 67 [ 1007.393602][T22620] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5540'. [ 1007.427936][T22620] team3: entered promiscuous mode [ 1007.435675][T22620] team3: entered allmulticast mode [ 1007.445479][T22620] 8021q: adding VLAN 0 to HW filter on device team3 [ 1007.463789][T22621] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5540'. [ 1007.554998][T22621] team4: entered promiscuous mode [ 1007.566608][T22621] team4: entered allmulticast mode [ 1007.576421][T22621] 8021q: adding VLAN 0 to HW filter on device team4 [ 1008.371512][ T10] usb 2-1: new high-speed USB device number 68 using dummy_hcd [ 1008.566700][ T10] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1008.582405][ T10] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 1008.601849][ T10] usb 2-1: can't read configurations, error -71 [ 1008.879808][T22639] xt_hashlimit: size too large, truncated to 1048576 [ 1009.176913][T22643] xt_hashlimit: size too large, truncated to 1048576 [ 1009.376794][T22649] netlink: 'syz.1.5549': attribute type 16 has an invalid length. [ 1009.395376][T22649] netlink: 64138 bytes leftover after parsing attributes in process `syz.1.5549'. [ 1010.475688][T22657] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5552'. [ 1010.541901][T22660] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5552'. [ 1011.787861][T22665] netlink: 892 bytes leftover after parsing attributes in process `syz.2.5554'. [ 1011.987881][T22657] team7: entered promiscuous mode [ 1011.994910][T22657] team7: entered allmulticast mode [ 1012.001059][T22657] 8021q: adding VLAN 0 to HW filter on device team7 [ 1012.060420][T22660] team8: entered promiscuous mode [ 1012.069302][T22660] team8: entered allmulticast mode [ 1012.082885][T22660] 8021q: adding VLAN 0 to HW filter on device team8 [ 1012.315718][T22677] netlink: 'syz.0.5560': attribute type 16 has an invalid length. [ 1012.324075][T22677] netlink: 64138 bytes leftover after parsing attributes in process `syz.0.5560'. [ 1012.394689][ T1559] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 1012.405263][T22679] xt_hashlimit: size too large, truncated to 1048576 [ 1012.531610][ T5724] usb 3-1: new high-speed USB device number 101 using dummy_hcd [ 1012.561610][T12156] usb 2-1: new low-speed USB device number 70 using dummy_hcd [ 1012.572001][ T1559] usb 4-1: Using ep0 maxpacket: 32 [ 1012.584318][ T1559] usb 4-1: config index 0 descriptor too short (expected 164, got 36) [ 1012.602312][ T1559] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1012.624747][ T1559] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1012.637812][ T1559] usb 4-1: New USB device found, idVendor=046d, idProduct=c29c, bcdDevice= 0.00 [ 1012.647298][ T1559] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1012.662814][ T1559] usb 4-1: config 0 descriptor?? [ 1012.694292][ T5724] usb 3-1: Using ep0 maxpacket: 32 [ 1012.705399][ T5724] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 64, changing to 7 [ 1012.722624][ T5724] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 250, changing to 7 [ 1012.736549][T12156] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 1012.747640][ T5724] usb 3-1: New USB device found, idVendor=1235, idProduct=8014, bcdDevice= 0.40 [ 1012.759656][T12156] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 1012.772369][ T5724] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1012.784460][T12156] usb 2-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1012.796521][ T5724] usb 3-1: Product: syz [ 1012.802442][ T5724] usb 3-1: Manufacturer: syz [ 1012.807108][ T5724] usb 3-1: SerialNumber: syz [ 1012.811997][T12156] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 1012.836519][T12156] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 1012.852670][T12156] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 1012.860790][T12156] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 1012.872511][T12156] usb 2-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1012.885362][T12156] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 1012.905689][T12156] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 1012.930571][T12156] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 1012.938803][T12156] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 1012.950017][T12156] usb 2-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1012.966354][T12156] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 1012.986608][T12156] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 1013.012032][T12156] usb 2-1: string descriptor 0 read error: -22 [ 1013.021044][T12156] usb 2-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 1013.048255][ T5724] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 1013.056339][T12156] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1013.101139][T12156] adutux 2-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 1013.113954][ T1559] logitech 0003:046D:C29C.0021: hidraw0: USB HID v0.00 Device [HID 046d:c29c] on usb-dummy_hcd.3-1/input0 [ 1013.285838][ T1559] logitech 0003:046D:C29C.0021: no inputs found [ 1013.311088][T22689] ================================================================== [ 1013.319212][T22689] BUG: KASAN: slab-use-after-free in report_descriptor_read+0xb5/0x100 [ 1013.324017][ T1559] usb 4-1: USB disconnect, device number 104 [ 1013.327569][T22689] Read of size 5 at addr ffff888047ba6140 by task fido_id/22689 [ 1013.327592][T22689] [ 1013.327606][T22689] CPU: 1 UID: 0 PID: 22689 Comm: fido_id Tainted: G L syzkaller #0 PREEMPT(full) [ 1013.327633][T22689] Tainted: [L]=SOFTLOCKUP [ 1013.327641][T22689] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1013.327651][T22689] Call Trace: [ 1013.327659][T22689] [ 1013.327667][T22689] dump_stack_lvl+0xe8/0x150 [ 1013.327692][T22689] print_address_description+0x55/0x1e0 [ 1013.327712][T22689] ? report_descriptor_read+0xb5/0x100 [ 1013.327731][T22689] print_report+0x58/0x70 [ 1013.327747][T22689] kasan_report+0x117/0x150 [ 1013.327765][T22689] ? report_descriptor_read+0xb5/0x100 [ 1013.327786][T22689] kasan_check_range+0x264/0x2c0 [ 1013.327803][T22689] ? report_descriptor_read+0xb5/0x100 [ 1013.327822][T22689] __asan_memcpy+0x29/0x70 [ 1013.327844][T22689] report_descriptor_read+0xb5/0x100 [ 1013.327864][T22689] ? __pfx_sysfs_kf_bin_read+0x10/0x10 [ 1013.327884][T22689] kernfs_fop_read_iter+0x451/0x6b0 [ 1013.327904][T22689] vfs_read+0x582/0xa70 [ 1013.327931][T22689] ? __pfx_vfs_read+0x10/0x10 [ 1013.327955][T22689] ? do_sys_openat2+0x14c/0x200 [ 1013.327973][T22689] ? kmem_cache_free+0x182/0x650 [ 1013.327997][T22689] ? fd_install+0x94/0x3d0 [ 1013.328021][T22689] ksys_read+0x150/0x270 [ 1013.328042][T22689] ? __pfx_ksys_read+0x10/0x10 [ 1013.328066][T22689] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1013.328085][T22689] do_syscall_64+0x174/0x580 [ 1013.328104][T22689] ? clear_bhb_loop+0x40/0x90 [ 1013.328123][T22689] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1013.328141][T22689] RIP: 0033:0x7feca40a7407 [ 1013.328159][T22689] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 1013.328174][T22689] RSP: 002b:00007ffe0bffe340 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 1013.328195][T22689] RAX: ffffffffffffffda RBX: 00007feca4768880 RCX: 00007feca40a7407 [ 1013.328209][T22689] RDX: 0000000000001000 RSI: 00007ffe0bffe390 RDI: 0000000000000004 [ 1013.328220][T22689] RBP: 00005645db1b9730 R08: 0000000000000000 R09: 0000000000000000 [ 1013.328232][T22689] R10: 0000000000000000 R11: 0000000000000202 R12: 00005645db1b8930 [ 1013.328243][T22689] R13: 00007ffe0bffe390 R14: 0000000000000004 R15: 00005645a75814d8 [ 1013.328271][T22689] [ 1013.328278][T22689] [ 1013.567423][T22689] Allocated by task 1559: [ 1013.571753][T22689] kasan_save_track+0x3e/0x80 [ 1013.576438][T22689] __kasan_kmalloc+0x93/0xb0 [ 1013.581117][T22689] __kmalloc_node_track_caller_noprof+0x4db/0x7b0 [ 1013.587536][T22689] kmemdup_noprof+0x2b/0x70 [ 1013.592090][T22689] hid_open_report+0x1f7/0xf00 [ 1013.596862][T22689] lg_probe+0x29c/0x8a0 [ 1013.601106][T22689] hid_device_probe+0x416/0x7a0 [ 1013.605961][T22689] really_probe+0x267/0xaf0 [ 1013.610465][T22689] __driver_probe_device+0x1ef/0x380 [ 1013.615757][T22689] driver_probe_device+0x4f/0x240 [ 1013.620786][T22689] __device_attach_driver+0x279/0x430 [ 1013.626158][T22689] bus_for_each_drv+0x258/0x2f0 [ 1013.631023][T22689] __device_attach+0x2c5/0x450 [ 1013.635788][T22689] device_initial_probe+0xa1/0xd0 [ 1013.640812][T22689] bus_probe_device+0x12a/0x220 [ 1013.645670][T22689] device_add+0x7e9/0xbb0 [ 1013.650001][T22689] hid_add_device+0x272/0x3e0 [ 1013.654678][T22689] usbhid_probe+0xbab/0x1080 [ 1013.659281][T22689] usb_probe_interface+0x659/0xc70 [ 1013.664391][T22689] really_probe+0x267/0xaf0 [ 1013.668942][T22689] __driver_probe_device+0x1ef/0x380 [ 1013.674241][T22689] driver_probe_device+0x4f/0x240 [ 1013.679315][T22689] __device_attach_driver+0x279/0x430 [ 1013.684709][T22689] bus_for_each_drv+0x258/0x2f0 [ 1013.689572][T22689] __device_attach+0x2c5/0x450 [ 1013.694339][T22689] device_initial_probe+0xa1/0xd0 [ 1013.699369][T22689] bus_probe_device+0x12a/0x220 [ 1013.704230][T22689] device_add+0x7e9/0xbb0 [ 1013.708569][T22689] usb_set_configuration+0x1a87/0x2110 [ 1013.714057][T22689] usb_generic_driver_probe+0x8d/0x150 [ 1013.719526][T22689] usb_probe_device+0x1c4/0x3b0 [ 1013.724378][T22689] really_probe+0x267/0xaf0 [ 1013.728885][T22689] __driver_probe_device+0x1ef/0x380 [ 1013.734169][T22689] driver_probe_device+0x4f/0x240 [ 1013.739194][T22689] __device_attach_driver+0x279/0x430 [ 1013.744568][T22689] bus_for_each_drv+0x258/0x2f0 [ 1013.749425][T22689] __device_attach+0x2c5/0x450 [ 1013.754189][T22689] device_initial_probe+0xa1/0xd0 [ 1013.759211][T22689] bus_probe_device+0x12a/0x220 [ 1013.764262][T22689] device_add+0x7e9/0xbb0 [ 1013.768765][T22689] usb_new_device+0xa08/0x16f0 [ 1013.773537][T22689] hub_event+0x2a1c/0x4f30 [ 1013.777958][T22689] process_scheduled_works+0xb5d/0x1860 [ 1013.783507][T22689] worker_thread+0xa53/0xfc0 [ 1013.788149][T22689] kthread+0x389/0x470 [ 1013.792227][T22689] ret_from_fork+0x514/0xb70 [ 1013.796819][T22689] ret_from_fork_asm+0x1a/0x30 [ 1013.801582][T22689] [ 1013.803905][T22689] Freed by task 1559: [ 1013.807884][T22689] kasan_save_track+0x3e/0x80 [ 1013.812571][T22689] kasan_save_free_info+0x46/0x50 [ 1013.817599][T22689] __kasan_slab_free+0x5c/0x80 [ 1013.822369][T22689] kfree+0x1c5/0x640 [ 1013.826278][T22689] hid_close_report+0x632/0x720 [ 1013.831133][T22689] hid_device_probe+0x659/0x7a0 [ 1013.835993][T22689] really_probe+0x267/0xaf0 [ 1013.840520][T22689] __driver_probe_device+0x1ef/0x380 [ 1013.845828][T22689] driver_probe_device+0x4f/0x240 [ 1013.850878][T22689] __device_attach_driver+0x279/0x430 [ 1013.856263][T22689] bus_for_each_drv+0x258/0x2f0 [ 1013.861135][T22689] __device_attach+0x2c5/0x450 [ 1013.865903][T22689] device_initial_probe+0xa1/0xd0 [ 1013.870936][T22689] bus_probe_device+0x12a/0x220 [ 1013.875880][T22689] device_add+0x7e9/0xbb0 [ 1013.880211][T22689] hid_add_device+0x272/0x3e0 [ 1013.884974][T22689] usbhid_probe+0xbab/0x1080 [ 1013.889658][T22689] usb_probe_interface+0x659/0xc70 [ 1013.894769][T22689] really_probe+0x267/0xaf0 [ 1013.899365][T22689] __driver_probe_device+0x1ef/0x380 [ 1013.904692][T22689] driver_probe_device+0x4f/0x240 [ 1013.909717][T22689] __device_attach_driver+0x279/0x430 [ 1013.915096][T22689] bus_for_each_drv+0x258/0x2f0 [ 1013.919968][T22689] __device_attach+0x2c5/0x450 [ 1013.924793][T22689] device_initial_probe+0xa1/0xd0 [ 1013.929831][T22689] bus_probe_device+0x12a/0x220 [ 1013.934690][T22689] device_add+0x7e9/0xbb0 [ 1013.939141][T22689] usb_set_configuration+0x1a87/0x2110 [ 1013.944613][T22689] usb_generic_driver_probe+0x8d/0x150 [ 1013.950339][T22689] usb_probe_device+0x1c4/0x3b0 [ 1013.955210][T22689] really_probe+0x267/0xaf0 [ 1013.959726][T22689] __driver_probe_device+0x1ef/0x380 [ 1013.965021][T22689] driver_probe_device+0x4f/0x240 [ 1013.970051][T22689] __device_attach_driver+0x279/0x430 [ 1013.975425][T22689] bus_for_each_drv+0x258/0x2f0 [ 1013.980287][T22689] __device_attach+0x2c5/0x450 [ 1013.985054][T22689] device_initial_probe+0xa1/0xd0 [ 1013.990078][T22689] bus_probe_device+0x12a/0x220 [ 1013.994932][T22689] device_add+0x7e9/0xbb0 [ 1013.999290][T22689] usb_new_device+0xa08/0x16f0 [ 1014.004091][T22689] hub_event+0x2a1c/0x4f30 [ 1014.008528][T22689] process_scheduled_works+0xb5d/0x1860 [ 1014.014077][T22689] worker_thread+0xa53/0xfc0 [ 1014.018672][T22689] kthread+0x389/0x470 [ 1014.023038][T22689] ret_from_fork+0x514/0xb70 [ 1014.027630][T22689] ret_from_fork_asm+0x1a/0x30 [ 1014.032492][T22689] [ 1014.034833][T22689] The buggy address belongs to the object at ffff888047ba6140 [ 1014.034833][T22689] which belongs to the cache kmalloc-8 of size 8 [ 1014.048637][T22689] The buggy address is located 0 bytes inside of [ 1014.048637][T22689] freed 8-byte region [ffff888047ba6140, ffff888047ba6148) [ 1014.062093][T22689] [ 1014.064425][T22689] The buggy address belongs to the physical page: [ 1014.070833][T22689] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888047ba6380 pfn:0x47ba6 [ 1014.080910][T22689] flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff) [ 1014.088976][T22689] page_type: f5(slab) [ 1014.092966][T22689] raw: 00fff00000000200 ffff88813fe17500 ffffea0002969990 ffffea0001ddfdd0 [ 1014.101550][T22689] raw: ffff888047ba6380 0000000800800069 00000000f5000000 0000000000000000 [ 1014.110128][T22689] page dumped because: kasan: bad access detected [ 1014.116536][T22689] page_owner tracks the page as allocated [ 1014.122264][T22689] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c00(GFP_NOIO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1559, tgid 1559 (kworker/0:2), ts 651373583965, free_ts 650808994263 [ 1014.142962][T22689] post_alloc_hook+0x22d/0x280 [ 1014.147844][T22689] get_page_from_freelist+0x2593/0x2610 [ 1014.153404][T22689] __alloc_frozen_pages_noprof+0x18d/0x380 [ 1014.159218][T22689] allocate_slab+0x77/0x660 [ 1014.163726][T22689] refill_objects+0x339/0x3d0 [ 1014.168444][T22689] __pcs_replace_empty_main+0x321/0x720 [ 1014.174001][T22689] __kmalloc_cache_noprof+0x392/0x660 [ 1014.179380][T22689] usb_control_msg+0x73/0x3e0 [ 1014.184060][T22689] hub_port_reset+0x3c7/0x1840 [ 1014.188923][T22689] hub_port_init+0xf50/0x28d0 [ 1014.193599][T22689] hub_event+0x2593/0x4f30 [ 1014.198027][T22689] process_scheduled_works+0xb5d/0x1860 [ 1014.203575][T22689] worker_thread+0xa53/0xfc0 [ 1014.208165][T22689] kthread+0x389/0x470 [ 1014.212238][T22689] ret_from_fork+0x514/0xb70 [ 1014.216836][T22689] ret_from_fork_asm+0x1a/0x30 [ 1014.221604][T22689] page last free pid 4986 tgid 4986 stack trace: [ 1014.227942][T22689] __free_frozen_pages+0xc1c/0xd30 [ 1014.233064][T22689] tlb_remove_table_rcu+0x85/0x100 [ 1014.238183][T22689] rcu_core+0x7cd/0x1070 [ 1014.242434][T22689] handle_softirqs+0x22a/0x840 [ 1014.247209][T22689] do_softirq+0x76/0xd0 [ 1014.251370][T22689] __local_bh_enable_ip+0xf8/0x130 [ 1014.256573][T22689] __alloc_skb+0x1aa/0x7d0 [ 1014.260997][T22689] alloc_skb_with_frags+0xc8/0x760 [ 1014.266115][T22689] sock_alloc_send_pskb+0x878/0x990 [ 1014.271322][T22689] unix_dgram_sendmsg+0x460/0x18d0 [ 1014.276458][T22689] __sys_sendto+0x672/0x710 [ 1014.281040][T22689] __x64_sys_sendto+0xde/0x100 [ 1014.285895][T22689] do_syscall_64+0x174/0x580 [ 1014.290486][T22689] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1014.296410][T22689] [ 1014.298735][T22689] Memory state around the buggy address: [ 1014.304366][T22689] ffff888047ba6000: fa fc fc fc fa fc fc fc 00 fc fc fc 06 fc fc fc [ 1014.312430][T22689] ffff888047ba6080: 00 fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc [ 1014.320495][T22689] >ffff888047ba6100: fa fc fc fc 05 fc fc fc fa fc fc fc 06 fc fc fc [ 1014.328555][T22689] ^ [ 1014.334703][T22689] ffff888047ba6180: 05 fc fc fc fa fc fc fc 00 fc fc fc 05 fc fc fc [ 1014.343026][T22689] ffff888047ba6200: 00 fc fc fc 05 fc fc fc fa fc fc fc 06 fc fc fc [ 1014.351087][T22689] ================================================================== [ 1014.387620][T22689] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1014.394887][T22689] CPU: 0 UID: 0 PID: 22689 Comm: fido_id Tainted: G L syzkaller #0 PREEMPT(full) [ 1014.405590][T22689] Tainted: [L]=SOFTLOCKUP [ 1014.409931][T22689] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1014.420002][T22689] Call Trace: [ 1014.423304][T22689] [ 1014.426276][T22689] vpanic+0x56c/0xa60 [ 1014.430294][T22689] ? __pfx_vpanic+0x10/0x10 [ 1014.434821][T22689] ? __pfx___schedule+0x10/0x10 [ 1014.439714][T22689] panic+0xc5/0xd0 [ 1014.443463][T22689] ? __pfx_panic+0x10/0x10 [ 1014.447902][T22689] ? preempt_schedule_thunk+0x16/0x30 [ 1014.453307][T22689] ? report_descriptor_read+0xb5/0x100 [ 1014.458796][T22689] check_panic_on_warn+0x89/0xb0 [ 1014.463764][T22689] ? report_descriptor_read+0xb5/0x100 [ 1014.469263][T22689] end_report+0x73/0x170 [ 1014.473527][T22689] ? report_descriptor_read+0xb5/0x100 [ 1014.479013][T22689] kasan_report+0x128/0x150 [ 1014.483635][T22689] ? report_descriptor_read+0xb5/0x100 [ 1014.489119][T22689] kasan_check_range+0x264/0x2c0 [ 1014.494096][T22689] ? report_descriptor_read+0xb5/0x100 [ 1014.499585][T22689] __asan_memcpy+0x29/0x70 [ 1014.504055][T22689] report_descriptor_read+0xb5/0x100 [ 1014.509380][T22689] ? __pfx_sysfs_kf_bin_read+0x10/0x10 [ 1014.514908][T22689] kernfs_fop_read_iter+0x451/0x6b0 [ 1014.520157][T22689] vfs_read+0x582/0xa70 [ 1014.524358][T22689] ? __pfx_vfs_read+0x10/0x10 [ 1014.529071][T22689] ? do_sys_openat2+0x14c/0x200 [ 1014.533974][T22689] ? kmem_cache_free+0x182/0x650 [ 1014.538990][T22689] ? fd_install+0x94/0x3d0 [ 1014.543479][T22689] ksys_read+0x150/0x270 [ 1014.547762][T22689] ? __pfx_ksys_read+0x10/0x10 [ 1014.552577][T22689] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1014.558692][T22689] do_syscall_64+0x174/0x580 [ 1014.563326][T22689] ? clear_bhb_loop+0x40/0x90 [ 1014.568042][T22689] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1014.573974][T22689] RIP: 0033:0x7feca40a7407 [ 1014.578424][T22689] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 1014.598054][T22689] RSP: 002b:00007ffe0bffe340 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 1014.606513][T22689] RAX: ffffffffffffffda RBX: 00007feca4768880 RCX: 00007feca40a7407 [ 1014.614582][T22689] RDX: 0000000000001000 RSI: 00007ffe0bffe390 RDI: 0000000000000004 [ 1014.622651][T22689] RBP: 00005645db1b9730 R08: 0000000000000000 R09: 0000000000000000 [ 1014.630628][T22689] R10: 0000000000000000 R11: 0000000000000202 R12: 00005645db1b8930 [ 1014.638686][T22689] R13: 00007ffe0bffe390 R14: 0000000000000004 R15: 00005645a75814d8 [ 1014.646667][T22689] [ 1014.650514][T22689] Kernel Offset: disabled [ 1014.654958][T22689] Rebooting in 86400 seconds..