last executing test programs: 8m15.217904987s ago: executing program 1 (id=185): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, 0x0, &(0x7f00000001c0)='syzkaller\x00'}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'veth1_to_hsr\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000000c0)={r1, r2, 0x25, 0x0, @val=@iter={0x0}}, 0x20) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000004c00)=@newtfilter={0x24, 0x11, 0xd27, 0xffffffff, 0x0, {0x0, 0x0, 0x74, r2, {0x0, 0x7}, {0x0, 0x4}}}, 0x24}, 0x1, 0xf0ffffffffffff}, 0x0) r3 = syz_init_net_socket$rose(0xb, 0x5, 0x0) r4 = openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/fs/binfmt_misc/syz1\x00', 0x2, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r7 = gettid() r8 = getpid() rt_tgsigqueueinfo(r8, r7, 0x1b, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000540)=@nat={'nat\x00', 0x670, 0x5, 0x3f0, 0x208, 0x208, 0xffffffff, 0x2b0, 0x168, 0x380, 0x380, 0xffffffff, 0x380, 0x380, 0x5, 0x0, {[{{@ip={@rand_addr=0x64010104, @initdev={0xac, 0x1e, 0x1, 0x0}, 0xff0000ff, 0xffffff00, 'veth1_to_bridge\x00', 'wg1\x00', {}, {0xff}, 0x16}, 0x0, 0x130, 0x168, 0x48, {}, [@common=@unspec=@string={{0xc0}, {0x5, 0xc, 'kmp\x00', "48ae43e4c6b2bfd892aa7400051624fa86999b13d39b99407a9b7abe75a728baa18da576811985de44110b8602025e1298ea55f1c5087ab16f67b18ca90ac68f0b3d6a068f727f7d23fa5fad26a59a5da2651212bdf9d29248ae63e2349b2470915eea2c39ade5129ff26b6fe772493180cfda2cdd49412e9469d85abdb467ba", 0x79, 0x2, {0x1}}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0xf, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, @port=0x4e22, @port=0x4e24}}}}, {{@uncond, 0x0, 0x70, 0xa0}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0xfffc, 0xd, 0x1}, {0x2, 0x4, 0x3}, 0x1000, 0x100}}}, {{@ip={@multicast2, @broadcast, 0xff, 0x0, 'virt_wifi0\x00', 'batadv_slave_1\x00', {}, {0xff}}, 0x0, 0x70, 0xa8}, @MASQUERADE={0x38, 'MASQUERADE\x00', 0x0, {0x1, {0x2, @loopback, @empty, @icmp_id=0x68, @port=0x4e22}}}}, {{@uncond, 0x0, 0x70, 0xa8}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x10, @rand_addr, @dev={0xac, 0x14, 0x14, 0x2a}, @icmp_id, @icmp_id}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x450) r9 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x1816c1, 0x1ff) close(r9) execve(&(0x7f0000000380)='./file1\x00', 0x0, 0xfffffffffffffffe) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r5, 0x6, 0xe, &(0x7f0000000400)={@in={{0x2, 0x4e22, @multicast2}}, 0x0, 0x0, 0x3b, 0x0, "74b726a137c433aa4cf0f8a94c7510ddbf387212ce63ffca84192f1a7e8fada98c09787c0f09d31204d72b1adc22136d0634dc3a24c89484e02716f385873737b1b6f21d8d87d45685a6377fb167d2e7"}, 0xd8) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x0, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36) ioctl$USBDEVFS_DISCARDURB(r3, 0x550b, &(0x7f0000000180)=0x7ff) readv(r4, &(0x7f0000001400)=[{&(0x7f00000000c0)=""/28, 0x1c}], 0x1) 8m9.28549176s ago: executing program 1 (id=197): openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_sock_diag(0x10, 0x3, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) r3 = socket$inet6(0xa, 0x2, 0x0) clock_gettime(0x3, 0x0) recvmmsg(r3, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0x15) ioctl$TCSETS(r4, 0x40384708, &(0x7f0000000040)={0x8, 0x40000001, 0x2000004, 0x7, 0x1a, "3e180000650000000000000000cb00002000"}) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0026}]}) close_range(r5, 0xffffffffffffffff, 0x0) 8m8.066045788s ago: executing program 1 (id=199): r0 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000180)=0x7) sendmsg$DEVLINK_CMD_SB_PORT_POOL_SET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="04010000100053"], 0x104}, 0x1, 0xf0ffffff, 0x0, 0x20040890}, 0x200080c0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000500)={0xa, 0x4e20, 0xffffffff, @empty, 0x4}, 0x1c) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000200)={0x1, &(0x7f0000000000)=[{0x6, 0x9, 0x8}]}, 0x10) syz_emit_ethernet(0x83, &(0x7f0000019300)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaaaa86dd6a000000004d1100fe8000000000000000000000000000aaff0200000000000000000000000000014e214e20004d9078040000004000000009000000000000002102ee856c4c459ead7bfb3a0dd1ff62f3401d93e319b3b5651dcc97e49e4999c94cd6ebfacc1ec4246a9ec63b426fbde8a80a5c0688a011b53c4f1b3d223aa1dfb04dfa06add4973e182e76a27dbcdce2dcf7b391d57bf6f648b3172c1596fc0f3cdc5519341ce0efed93cadd133dba52766d1034ed795efb064bbd1a80e5e026a6161f7b2f9f85c7da6e20df496025bf503536386814f8e6e2c771695430b500f897f962ed0c7299f7db0abdbc5dcd67cd17d01b3a73c79cd659a6fcdd673ea862aaa87438d4f5f83aaf99132e9466a4"], 0x0) 8m7.107315834s ago: executing program 1 (id=202): getsockopt$XDP_STATISTICS(0xffffffffffffffff, 0x11b, 0x7, &(0x7f0000000000), &(0x7f0000000040)=0x30) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x8, 0x0, 0x6, 0x1, 0xfffffe0001000001, 0xfa11, 0xffffffff}, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000003100)='net/ip6_mr_cache\x00') read$FUSE(r2, &(0x7f0000012f40)={0x2020}, 0x2040) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000002c0), 0x80000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r3, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r4, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f0000000180)={0x28, 0x2, r4, 0x0, &(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x100000000}) ioctl$IOMMU_HWPT_ALLOC$NONE(r3, 0x3b89, &(0x7f0000000000)={0x28, 0x2, r5, r4, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_IOAS_UNMAP$ALL(r3, 0x3b86, &(0x7f0000000040)={0x18, r4}) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r6, 0x107, 0x7, &(0x7f00000001c0)=0x7, 0x4) r7 = syz_open_procfs(0x0, &(0x7f0000000000)='net/sctp\x00') getdents64(r7, &(0x7f0000000400)=""/35, 0x23) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x2, 0x16, &(0x7f0000000180)=ANY=[@ANYBLOB="611230000000000061134c0000000000bf2000000000000016001000071b48013d030100000000000702000000b00000bc26100000000000bf67200000000000160200000fff07006702000007000000360600000ee600f0bf050000000000000f650000000000006507f4ff02000000070700004c0040001f75000000000000bf54000000000000070500000300f9ffad430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a83683d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf5fe7030586"], &(0x7f0000000100)='GPL\x00'}, 0x48) syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) recvmmsg(r8, &(0x7f0000001640)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000004c0)=""/4096, 0x1e67}, {&(0x7f00000000c0)=""/250, 0x4}], 0x2, 0x0, 0xd64}}], 0x300, 0x34000, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=@newqdisc={0x44, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x0, 0x10}, {0xffff, 0x8}, {0x2}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x4, 0x9, 0x2}}]}}]}, 0x44}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x40000) 8m6.126108477s ago: executing program 1 (id=206): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x161642, 0x0) socket$nl_route(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x2, 0x0) syz_open_procfs(0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) ioctl$KVM_CAP_EXCEPTION_PAYLOAD(r1, 0x4068aea3, &(0x7f0000000180)={0xa4, 0x0, 0x1}) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000240)={{0x8000000, 0xf000, 0x0, 0x2, 0x8, 0x0, 0x40, 0x2, 0x0, 0x8, 0x9, 0x10}, {0xffff1000, 0xd000, 0xc, 0x8, 0xfb, 0x9, 0x0, 0x2, 0x7, 0x7, 0x3, 0xff}, {0x6000, 0x3000, 0xc, 0x0, 0x7, 0x9, 0x40, 0x0, 0x3, 0x9, 0x0, 0xfc}, {0xeeef0000, 0xd000, 0xf, 0xff, 0x0, 0xfe, 0xa, 0x0, 0xfe, 0x3, 0x4}, {0xdddd0000, 0xf000, 0x4, 0x0, 0xff, 0x4, 0x6, 0xb, 0x0, 0x3c}, {0xeeee8000, 0x4000, 0x0, 0x3, 0x5, 0x2, 0x2, 0x1, 0x0, 0x0, 0x80}, {0xdddd1000, 0xdddd1000, 0x0, 0x2, 0xff, 0x0, 0xff, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x3000, 0xe, 0x0, 0x1, 0x1, 0x83, 0xa, 0x26, 0x96}, {0x1, 0x4}, {0x80a0000, 0xff}, 0x9dfeffdb, 0x0, 0xeeee8000, 0x600, 0x1, 0x5800, 0x0, [0x4000000000013, 0x0, 0x1]}) r6 = mmap$KVM_VCPU(&(0x7f0000004000/0x2000)=nil, 0x930, 0x2800002, 0x11, r5, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r6, 0x20, 0x0, 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1, 0x11, r5, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)=@arm64={0xa, 0x3, 0x0, '\x00', 0x3}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 8m3.233925128s ago: executing program 1 (id=213): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e20, 0xeb, @remote, 0x4}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000580), 0x3) socket$pptp(0x18, 0x1, 0x2) syz_io_uring_setup(0xa3, &(0x7f0000000300)={0x0, 0x14b6, 0x8, 0x1, 0x133}, &(0x7f00000001c0)=0x0, 0x0, 0x0) openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000ac0)=ANY=[@ANYBLOB="060000000400000010100000890000", @ANYRES32, @ANYBLOB='\"\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) sendmsg$inet(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000b80)='n', 0x1}], 0x1}, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x9, 0x7a8, 0x6}, 0x14) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000000c0)=@gcm_128={{0x303}, '\r\x00', "8a36c47a9c625dfaf08ace81c500", "f8ffffff", "362d3017f069109d"}, 0x28) 7m55.460548739s ago: executing program 4 (id=234): openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) socket$packet(0x11, 0x3, 0x300) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x82200, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000a40)='/sys/kernel/fscaps', 0x2280, 0x30) read$watch_queue(r0, &(0x7f0000005800)=""/7, 0x7) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x2, 0x6, 0xfffffffffffffffd}, 0x0, &(0x7f0000000240)={0x3ff, 0x0, 0x1, 0x9, 0xfffffffffffffffc, 0x0, 0x7fffffff}, 0x0, 0x0) 7m54.139289036s ago: executing program 4 (id=237): r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000100), 0x8000) readv(r0, &(0x7f0000001c80)=[{&(0x7f0000000740)=""/200, 0xc8}], 0x20) 7m52.604112128s ago: executing program 4 (id=241): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x9da, 0x1a, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x40, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x9, 0x3, 0x0, 0x4, 0x0, {0x9, 0x21, 0x20, 0x0, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x3, 0x8, 0xc5}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}) 7m46.085886312s ago: executing program 32 (id=213): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e20, 0xeb, @remote, 0x4}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000580), 0x3) socket$pptp(0x18, 0x1, 0x2) syz_io_uring_setup(0xa3, &(0x7f0000000300)={0x0, 0x14b6, 0x8, 0x1, 0x133}, &(0x7f00000001c0)=0x0, 0x0, 0x0) openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000ac0)=ANY=[@ANYBLOB="060000000400000010100000890000", @ANYRES32, @ANYBLOB='\"\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) sendmsg$inet(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000b80)='n', 0x1}], 0x1}, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x9, 0x7a8, 0x6}, 0x14) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000000c0)=@gcm_128={{0x303}, '\r\x00', "8a36c47a9c625dfaf08ace81c500", "f8ffffff", "362d3017f069109d"}, 0x28) 7m45.956308106s ago: executing program 4 (id=250): sendmsg$DEVLINK_CMD_SB_PORT_POOL_SET(0xffffffffffffffff, 0x0, 0x200080c0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20, 0xffffffff, @empty, 0x4}, 0x1c) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000200)={0x1, &(0x7f0000000000)=[{0x6, 0x9, 0x8}]}, 0x10) syz_emit_ethernet(0x83, &(0x7f0000019300)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaaaa86dd6a000000004d1100fe8000000000000000000000000000aaff0200000000000000000000000000014e214e20004d9078040000004000000009000000000000002102ee856c4c459ead7bfb3a0dd1ff62f3401d93e319b3b5651dcc97e49e4999c94cd6ebfacc1ec4246a9ec63b426fbde8a80a5c0688a011b53c4f1b3d223aa1dfb04dfa06add4973e182e76a27dbcdce2dcf7b391d57bf6f648b3172c1596fc0f3cdc5519341ce0efed93cadd133dba52766d1034ed795efb064bbd1a80e5e026a6161f7b2f9f85c7da6e20df496025bf503536386814f8e6e2c771695430b500f897f962ed0c7299f7db0abdbc5dcd67cd17d01b3a73c79cd659a6fcdd673ea862aaa87438d4f5f83aaf99132e9466a4"], 0x0) 7m45.154581479s ago: executing program 4 (id=254): openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000180), 0x90, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) 7m43.992202189s ago: executing program 4 (id=255): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) close(r4) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=@newtfilter={0x88, 0x2c, 0xd3f, 0x30bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0xb, 0xfff3}, {}, {0x8, 0x10}}, [@filter_kind_options=@f_basic={{0xa}, {0x58, 0x2, [@TCA_BASIC_ACT={0x54, 0x3, [@m_connmark={0x50, 0x1, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x3, 0x200, 0x1, 0x1000, 0x10}, 0x1}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x10}, 0x8080) r8 = socket$unix(0x1, 0x1, 0x0) r9 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r9, &(0x7f00000000c0)={&(0x7f0000000140)=@xdp={0x2c, 0x8, r10, 0x3c}, 0x80, &(0x7f0000000500)=[{&(0x7f00000002c0)="f2", 0x14}], 0x1}, 0x4011) 7m28.919284623s ago: executing program 33 (id=255): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) close(r4) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=@newtfilter={0x88, 0x2c, 0xd3f, 0x30bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0xb, 0xfff3}, {}, {0x8, 0x10}}, [@filter_kind_options=@f_basic={{0xa}, {0x58, 0x2, [@TCA_BASIC_ACT={0x54, 0x3, [@m_connmark={0x50, 0x1, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x3, 0x200, 0x1, 0x1000, 0x10}, 0x1}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x10}, 0x8080) r8 = socket$unix(0x1, 0x1, 0x0) r9 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r9, &(0x7f00000000c0)={&(0x7f0000000140)=@xdp={0x2c, 0x8, r10, 0x3c}, 0x80, &(0x7f0000000500)=[{&(0x7f00000002c0)="f2", 0x14}], 0x1}, 0x4011) 13.356561577s ago: executing program 0 (id=1482): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x80000000, 0x0, 'queue0\x00', 0x32a}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket(0x15, 0x5, 0x0) getsockopt(r4, 0x200000000114, 0x2710, &(0x7f000001eec0)=""/102389, &(0x7f0000000000)=0xc74) write$sndseq(r0, &(0x7f0000000000)=[{0x1e, 0x0, 0x0, 0x0, @tick, {}, {}, @raw32}], 0x1001a) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) 11.840425704s ago: executing program 0 (id=1487): socket$tipc(0x1e, 0x5, 0x0) socket$tipc(0x1e, 0x5, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x7f9, &(0x7f0000000040)={0x0, 0xc8df, 0xfc00, 0x0, 0x1e4}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x300, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x1}, {0xfff1, 0xffff}, {0xe, 0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40005}, 0x20040000) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3, &(0x7f0000000000)=0x6, 0x4) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 10.66433456s ago: executing program 0 (id=1490): r0 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x802) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r4 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000100), 0x8500, 0x0) r5 = open_tree(r4, &(0x7f00000002c0)='\x00', 0x81101) connect$inet(0xffffffffffffffff, 0x0, 0x0) getpeername$inet(0xffffffffffffffff, 0x0, 0x0) move_mount(r5, 0x0, r5, 0x0, 0x276) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) 7.849861444s ago: executing program 0 (id=1508): socket$nl_generic(0x10, 0x3, 0x10) r0 = fanotify_init(0x0, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) brk(0x689d80000000) r1 = syz_open_dev$cec(&(0x7f0000000100), 0x0, 0x103000) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x2241, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(r1, 0xc05c6104, &(0x7f00000001c0)={"f2efe21e", 0x9, 0x6, 0x4d, 0x0, 0x1ff, "2179d46fd08e3c0ced34c7d0c7e6d7", "7ca24a13", '\x00', "a2a200", ["06000000100000000ecb00", "bed0f3d6ce7a5f7389827f04", "d409343c60abd64f2fdc9ddf", "fc43009f621000"]}) r2 = syz_open_dev$cec(&(0x7f0000000d00), 0x0, 0xc0b02) ioctl$CEC_TRANSMIT(r2, 0xc0386105, &(0x7f0000000d40)={0x0, 0x1, 0x4, 0x4, 0x0, 0x4063, "57c1169b6664ea61326ac71ae7213059", 0x0, 0xfc, 0x0, 0x10}) ioctl$CEC_TRANSMIT(r2, 0xc0386105, &(0x7f0000000140)={0x100000000, 0x800, 0xf, 0x80000001, 0xfe1c, 0x6, "72aba977db089b65fdfdc5bd97abc350", 0x74, 0x3, 0xa7, 0x7, 0x8, 0x7, 0x29}) syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$dri(0x0, 0x2, 0xc8d03) r3 = socket(0x1d, 0x2, 0x6) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000140)={'vxcan1\x00', 0x0}) bind$can_j1939(r3, &(0x7f0000000000)={0x1d, r5, 0x3}, 0x18) sendmmsg$inet(r3, &(0x7f0000002e00)=[{{0x0, 0x0, &(0x7f0000001300)=[{&(0x7f0000000080)="d171e4c4c55f7973", 0x8}], 0x1}}, {{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)}], 0x1}}], 0x2, 0x0) syz_usb_connect(0x4, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r3) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r6, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r6, 0x2) syz_emit_ethernet(0x4a, &(0x7f0000000600)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "4600f5", 0x14, 0x6, 0x1, @remote, @rand_addr=' \x01\x00', {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0x0, 0x0, 0x2}}}}}}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000200)=ANY=[@ANYBLOB], 0x5a) sendto$inet_nvme_of_msg(r3, &(0x7f0000000680)={@cmd={{0x4, 0xd, 0x48, 0xa}, {@auth_common={0x7f, 0x80, 0xbe0, 0x6, "e9cf4b6db6f5510d94b6f59c0a4bd46abd4dc0", @anon_struct={0x3, 0x7e}, 0x7, 0xe, 0x2, 0x9, 0xb, "9ef322afa195add877c93c24d19dcae4"}}}, @val=0x0}, 0x88, 0x0, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 5.691895711s ago: executing program 6 (id=1530): r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000140)={0x800042, 0xf8, 0x1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f0000000140)=[{0x20, 0x0, 0x0, 0xfffff00c}, {0x20, 0x0, 0x0, 0x81}, {0x6}]}, 0x10) sendmmsg(r3, &(0x7f0000001c00), 0x400000000000159, 0x40840) io_uring_enter(0xffffffffffffffff, 0x7357, 0x9fcb, 0x1, &(0x7f0000000780)={[0x7]}, 0x8) setxattr$security_capability(0x0, &(0x7f0000000280), 0x0, 0x0, 0x0) r5 = getpgid(0x0) r6 = syz_pidfd_open(r5, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) process_madvise(r6, &(0x7f0000000080)=[{0x0}], 0x1, 0x14, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000000), 0xffffffffffffffff) 5.636537268s ago: executing program 5 (id=1533): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f00000004c0)=ANY=[], 0x8) connect$inet6(r0, &(0x7f00000003c0)={0xa, 0xfffe, 0x3000000, @mcast2, 0x6}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000240)='bridge0\x00', 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) setsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, &(0x7f0000000080)=0x5, 0x4) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_CAP_HYPERV_SYNIC2(r3, 0x4068aea3, &(0x7f0000000140)) io_uring_register$IORING_REGISTER_RESTRICTIONS(0xffffffffffffffff, 0xb, 0x0, 0x0) io_uring_register$IORING_REGISTER_EVENTFD(0xffffffffffffffff, 0x4, 0x0, 0x1) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000040)={0x2, 0x0, [{0x400000b0, 0x0, 0x5}, {0x400000b1, 0x0, 0x8000000000000001}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) 4.779575188s ago: executing program 3 (id=1537): r0 = socket(0x2b, 0x1, 0x1) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e1f, 0x2, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e5b, 0x80000000, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, 0x5}, 0x1c) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x12, &(0x7f0000000200)=0xb1e0, 0x4) 4.77796336s ago: executing program 0 (id=1539): socket$tipc(0x1e, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f00006e3000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x7f9, &(0x7f0000000040)={0x0, 0xc8df, 0xfc00, 0x0, 0x1e4}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x300, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x1}, {0xfff1, 0xffff}, {0xe, 0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40005}, 0x20040000) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3, &(0x7f0000000000)=0x6, 0x4) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 4.712628195s ago: executing program 6 (id=1540): syz_open_dev$evdev(&(0x7f0000000700), 0x0, 0x80000) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_open_dev$vim2m(&(0x7f0000000000), 0x4541b6bf, 0x2) openat$userio(0xffffffffffffff9c, &(0x7f0000000040), 0x40000, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) 4.560140753s ago: executing program 3 (id=1541): syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0xffffffffffffff2c}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0x7, 0x20002f7}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1801000000000010"], 0x0, 0x0, 0xffc6, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 4.555046236s ago: executing program 0 (id=1542): r0 = syz_usb_connect$uac1(0x0, 0xac, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000000000106b1d010140000102030109029a0003010000000904000000010100000a24010000000201020c24020000000000000800000524050000082407000000009e0c240700000000a3e82f07070d2407010604000000000000e909240300000000"], 0x0) syz_usb_control_io(r0, &(0x7f0000000140)={0x2c, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x407}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac1(r0, &(0x7f0000001840)={0x14, 0x0, &(0x7f0000000080)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f0000000400)={0x40, 0x0, 0x1, "e6"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000740)={0x44, 0x0, 0x0, 0x0, &(0x7f00000000c0)={0x20, 0x81, 0x2, "6e0e"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, &(0x7f0000000340)={0x14, 0x0, &(0x7f00000002c0)={0x0, 0x3, 0x5, @string={0x5, 0x3, "6f8079"}}}, 0x0) 4.472413878s ago: executing program 6 (id=1544): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=@newlink={0x20, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x6}}, 0x20}}, 0x0) r1 = openat$vcsu(0xffffffffffffff9c, 0x0, 0x121000, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) socket$inet6(0xa, 0x3, 0x3c) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000100)="88", 0x1}], 0x1) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000040)={0x1, 0x9006}, 0x4) setsockopt$packet_fanout_data(r2, 0x107, 0x16, &(0x7f0000000240)={0x1, &(0x7f0000000080)=[{0x6, 0x37, 0x2, 0x9}]}, 0x10) close_range(r2, r2, 0x0) readv(r1, &(0x7f0000001880)=[{&(0x7f0000000440)=""/144, 0x90}], 0x1) bpf$MAP_CREATE(0x0, 0x0, 0x50) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000080)=0x19, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040), 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r3, 0x1, &(0x7f0000001300)=[0x0]) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r5 = eventfd(0x8c66) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000140)={0xfffffffffffffc01, 0x0, 0x8, r5, 0x11}) 4.390120926s ago: executing program 5 (id=1545): r0 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x802) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000100), 0x8500, 0x0) r3 = open_tree(r2, &(0x7f00000002c0)='\x00', 0x81101) connect$inet(0xffffffffffffffff, 0x0, 0x0) getpeername$inet(0xffffffffffffffff, 0x0, 0x0) move_mount(r3, 0x0, r3, 0x0, 0x276) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) 3.896352072s ago: executing program 6 (id=1547): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) ptrace$getsig(0x4202, r0, 0x0, &(0x7f0000000180)) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet_udp(0x2, 0x2, 0x0) r4 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r4, &(0x7f0000000140)={0x18, 0x2, {0xffff, @loopback}}, 0x1e) socket$nl_route(0x10, 0x3, 0x0) 3.527858727s ago: executing program 5 (id=1548): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=@delqdisc={0x24, 0x26, 0x1, 0x70bd2b, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {}, {0x7, 0xffff}, {0xf, 0x4}}}, 0x24}, 0x1, 0x0, 0x0, 0x4081}, 0x2400c800) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=@newlink={0x20, 0x10, 0x401}, 0x20}}, 0x4000000) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text64={0x40, &(0x7f0000000200)="f7790066baa00066b86b4266ef66ba420066b8e20066ef0f29902cbb0000f36d666666440f38826b410f786b42d1d107b8010000000f01d98fe9d89afd", 0x3d}], 0x1, 0x21, 0x0, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r4, 0x4008ae93, &(0x7f0000000040)=0x1000) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f00000002c0)={0x1, 0x0, [{0x40000073, 0x0, 0x81}]}) ioctl$KVM_SET_VCPU_EVENTS(r4, 0x4400ae8f, &(0x7f0000000140)=@x86={0x40, 0x1, 0x10, 0x0, 0x8, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x1, 0x0, 0x0, 0xfffffff8, 0x0, 0xff, 0xff, 0x1}) ioctl$KVM_RUN(r4, 0xae80, 0x0) 2.794870192s ago: executing program 2 (id=1549): r0 = openat$sequencer2(0xffffff9c, 0x0, 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f0000000040)=@l={0x92, 0x0, 0xe0, 0x0, 0x10}) read(r0, &(0x7f00000011c0)=""/221, 0x8) 2.518155233s ago: executing program 6 (id=1550): r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000140)={0x800042, 0xf8, 0x1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f0000000140)=[{0x20, 0x0, 0x0, 0xfffff00c}, {0x20, 0x0, 0x0, 0x81}, {0x6}]}, 0x10) sendmmsg(r3, &(0x7f0000001c00), 0x400000000000159, 0x40840) io_uring_enter(0xffffffffffffffff, 0x7357, 0x9fcb, 0x1, &(0x7f0000000780)={[0x7]}, 0x8) setxattr$security_capability(0x0, &(0x7f0000000280), 0x0, 0x0, 0x0) r5 = getpgid(0x0) r6 = syz_pidfd_open(r5, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) process_madvise(r6, &(0x7f0000000080)=[{0x0}], 0x1, 0x14, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000000), 0xffffffffffffffff) 2.348106881s ago: executing program 2 (id=1551): add_key$fscrypt_v1(0x0, 0x0, &(0x7f00000001c0)={0x0, "ed7775e65eafd28c998ed46d479658881ccacd0c245ad4d444213a00202509c5accfa410081d82ce2a4905411dee1154155efeb6111658c4224f35d6d4f57692", 0x22}, 0x48, 0xfffffffffffffffd) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e23, @initdev={0xac, 0x1e, 0xff, 0x0}}, 0x2, 0x0, 0x3}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="0100fdffffff0010000006000000080009000200000008000b"], 0x24}, 0x1, 0x0, 0x0, 0x24000001}, 0x890) 2.105875532s ago: executing program 3 (id=1552): socket$tipc(0x1e, 0x5, 0x0) socket$tipc(0x1e, 0x5, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x7f9, &(0x7f0000000040)={0x0, 0xc8df, 0xfc00, 0x0, 0x1e4}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x300, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x1}, {0xfff1, 0xffff}, {0xe, 0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40005}, 0x20040000) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3, &(0x7f0000000000)=0x6, 0x4) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 2.104505538s ago: executing program 2 (id=1553): r0 = socket(0x2b, 0x1, 0x1) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e1f, 0x2, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e5b, 0x80000000, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, 0x5}, 0x1c) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x12, &(0x7f0000000200)=0xb1e0, 0x4) 1.937878469s ago: executing program 3 (id=1554): syz_open_dev$evdev(&(0x7f0000000700), 0x0, 0x80000) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_open_dev$vim2m(&(0x7f0000000000), 0x4541b6bf, 0x2) openat$userio(0xffffffffffffff9c, &(0x7f0000000040), 0x40000, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) 1.860074847s ago: executing program 5 (id=1555): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x1, 0x9006}, 0x4) unshare(0x22020400) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000000)={0x1, &(0x7f0000000080)=[{0x6, 0x37, 0x2, 0x100009}]}, 0x10) 1.821836631s ago: executing program 2 (id=1556): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$IPSET_CMD_GET_BYNAME(r0, 0x0, 0x4000) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_emit_vhci(0x0, 0x7) openat$ptp0(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r3, &(0x7f0000000300)={{0x6, @rose, 0x8}, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default]}, 0x48) syz_init_net_socket$netrom(0x6, 0x5, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000340), 0x22003, 0x0) sendmsg$NFT_BATCH(r4, 0x0, 0x4) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r5 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r5, 0xc008561c, &(0x7f0000000100)={0xf0f017, 0x3}) mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103) socket(0x18, 0x6, 0xfffffffb) openat$fuse(0xffffffffffffff9c, &(0x7f0000002040), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000740)='./file0\x00', &(0x7f0000000040), 0x3210001, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[], 0x50) 1.641400532s ago: executing program 3 (id=1557): bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, 0x0, 0x0}, 0x94) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0xfffff34, 0x0, [{0xf88e470f, 0xed}]}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x77, 0x2, 0x5, 0x4002004c4, 0x1004, 0x8000100000000000, 0xc595, 0xfffffffffffffffd, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0x5, 0x9], 0xeeee8000, 0x2010d3}) ioctl$KVM_RUN(r2, 0xae80, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x42282, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.488592051s ago: executing program 2 (id=1558): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80600, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket$kcm(0x2, 0x3, 0x2) socket(0xa, 0x3, 0x87) socket$inet(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) r1 = socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000004c0)) bind$alg(r1, &(0x7f0000000300)={0x26, 'hash\x00', 0x0, 0x0, 'sha384\x00'}, 0x58) accept4(r1, 0x0, 0x0, 0x800) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) socket$inet6(0xa, 0x3, 0x100) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/oops_count', 0x0, 0x18) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r2], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x48881) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x5c, 0x7fffffff) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r3, &(0x7f0000000000), 0xd) 1.488353695s ago: executing program 5 (id=1559): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) socket$rds(0x15, 0x5, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000001c0), 0x12) write$cgroup_freezer_state(0xffffffffffffffff, &(0x7f00000000c0)='THAWED\x00', 0x7) 1.236081917s ago: executing program 5 (id=1560): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) ptrace$getsig(0x4202, r0, 0x0, &(0x7f0000000180)) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$inet6(0xa, 0x80002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r4 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r4, &(0x7f0000000140)={0x18, 0x2, {0xffff, @loopback}}, 0x1e) socket$nl_route(0x10, 0x3, 0x0) 1.212562773s ago: executing program 3 (id=1561): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x800000}, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r2, 0x25, &(0x7f00000006c0)={0x0, 0x0, 0xac1d, 0x9}) fcntl$lock(r2, 0x7, 0x0) fcntl$lock(r2, 0x25, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f00000000c0)=0xf) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$TCFLSH(r4, 0x400455c8, 0x2) ioctl$TIOCSETD(r4, 0x5412, &(0x7f0000000140)=0xffffffc0) ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000280)=0x1) 1.21172791s ago: executing program 6 (id=1562): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r0, 0x90004) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) 0s ago: executing program 2 (id=1563): add_key$fscrypt_v1(0x0, 0x0, &(0x7f00000001c0)={0x0, "ed7775e65eafd28c998ed46d479658881ccacd0c245ad4d444213a00202509c5accfa410081d82ce2a4905411dee1154155efeb6111658c4224f35d6d4f57692", 0x22}, 0x48, 0xfffffffffffffffd) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="0100fdffffff0010000006000000080009000200000008000b"], 0x24}, 0x1, 0x0, 0x0, 0x24000001}, 0x890) kernel console output (not intermixed with test programs): .297627][ T5880] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 34, using maximum allowed: 30 [ 343.297652][ T5880] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 343.297664][ T5880] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 343.297677][ T5880] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 34 [ 343.297702][ T5880] usb 4-1: New USB device found, idVendor=0b48, idProduct=2003, bcdDevice=71.94 [ 343.297715][ T5880] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 343.381497][ T5880] usb 4-1: config 0 descriptor?? [ 343.385841][ T5880] ttusbir 4-1:0.0: cannot find expected altsetting [ 343.399706][ T7805] netlink: 'syz.0.496': attribute type 1 has an invalid length. [ 343.399727][ T7805] netlink: 4 bytes leftover after parsing attributes in process `syz.0.496'. [ 343.700718][ T7811] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 343.996811][ T7814] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 345.900682][ T5933] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 345.929458][ T5803] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 345.957387][ T5803] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 345.972775][ T5803] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 345.981976][ T5933] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 345.984914][ T5803] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 345.988477][ T5803] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 346.368435][ T36] usb 4-1: USB disconnect, device number 11 [ 346.376908][ T5933] bond0 (unregistering): Released all slaves [ 346.788889][ T7676] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 346.809351][ T7676] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 346.891772][ T7676] team0: Port device team_slave_0 added [ 346.921118][ T7676] team0: Port device team_slave_1 added [ 348.270896][ T7841] netlink: 'syz.3.506': attribute type 1 has an invalid length. [ 348.270922][ T7841] netlink: 4 bytes leftover after parsing attributes in process `syz.3.506'. [ 348.327072][ T5803] Bluetooth: hci1: command tx timeout [ 348.537028][ T7676] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 348.537046][ T7676] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 348.537075][ T7676] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 349.207912][ T7676] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 349.208092][ T7676] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 349.208157][ T7676] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 350.715947][ T5803] Bluetooth: hci1: command tx timeout [ 351.615295][ T7676] hsr_slave_0: entered promiscuous mode [ 351.640772][ T7676] hsr_slave_1: entered promiscuous mode [ 351.650526][ T7676] debugfs: 'hsr0' already exists in 'hsr' [ 351.652923][ T7676] Cannot create hsr debugfs directory [ 351.804199][ T36] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 352.307693][ T36] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 352.307740][ T36] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 34, using maximum allowed: 30 [ 352.307783][ T36] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 352.307806][ T36] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 352.307829][ T36] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 34 [ 352.307870][ T36] usb 3-1: New USB device found, idVendor=0b48, idProduct=2003, bcdDevice=71.94 [ 352.307893][ T36] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 352.522737][ T36] usb 3-1: config 0 descriptor?? [ 352.648625][ T36] ttusbir 3-1:0.0: cannot find expected altsetting [ 352.735847][ T5803] Bluetooth: hci1: command tx timeout [ 354.177351][ T5933] hsr_slave_0: left promiscuous mode [ 354.240435][ T5933] hsr_slave_1: left promiscuous mode [ 354.271743][ T5933] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 354.304218][ T5933] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 354.429848][ T7909] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 354.504803][ T7913] netlink: 'syz.0.517': attribute type 1 has an invalid length. [ 354.504827][ T7913] netlink: 4 bytes leftover after parsing attributes in process `syz.0.517'. [ 354.805498][ T5803] Bluetooth: hci1: command tx timeout [ 358.119032][ T5882] usb 3-1: USB disconnect, device number 13 [ 359.447608][ T5933] team0 (unregistering): Port device team_slave_1 removed [ 359.528087][ T5933] team0 (unregistering): Port device team_slave_0 removed [ 361.793998][ T7960] netlink: 40 bytes leftover after parsing attributes in process `syz.3.527'. [ 362.275554][ T5882] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 362.468520][ T5882] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 362.468563][ T5882] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 34, using maximum allowed: 30 [ 362.468647][ T5882] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 362.468667][ T5882] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 362.468688][ T5882] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 34 [ 362.468729][ T5882] usb 4-1: New USB device found, idVendor=0b48, idProduct=2003, bcdDevice=71.94 [ 362.468750][ T5882] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 362.607425][ T5882] usb 4-1: config 0 descriptor?? [ 362.613544][ T5882] ttusbir 4-1:0.0: cannot find expected altsetting [ 363.148554][ T7966] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 363.409238][ T7824] chnl_net:caif_netlink_parms(): no params data found [ 369.422243][ T36] usb 4-1: USB disconnect, device number 12 [ 372.265926][ T8054] netlink: 40 bytes leftover after parsing attributes in process `syz.2.536'. [ 373.159370][ T7824] bridge0: port 1(bridge_slave_0) entered blocking state [ 373.159514][ T7824] bridge0: port 1(bridge_slave_0) entered disabled state [ 373.159885][ T7824] bridge_slave_0: entered allmulticast mode [ 373.168377][ T7824] bridge_slave_0: entered promiscuous mode [ 373.747423][ T7824] bridge0: port 2(bridge_slave_1) entered blocking state [ 373.748988][ T7824] bridge0: port 2(bridge_slave_1) entered disabled state [ 373.749246][ T7824] bridge_slave_1: entered allmulticast mode [ 373.770134][ T7824] bridge_slave_1: entered promiscuous mode [ 375.380335][ T7824] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 375.486111][ T7824] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 375.853356][ T7824] team0: Port device team_slave_0 added [ 375.972520][ T7824] team0: Port device team_slave_1 added [ 376.312041][ T7676] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 376.383282][ T7824] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 376.383301][ T7824] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 376.383328][ T7824] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 376.492365][ T7676] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 376.567692][ T7824] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 376.567709][ T7824] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 376.567745][ T7824] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 376.696321][ T7676] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 376.911866][ T7676] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 377.121072][ T1441] bridge_slave_1: left allmulticast mode [ 377.121103][ T1441] bridge_slave_1: left promiscuous mode [ 377.121394][ T1441] bridge0: port 2(bridge_slave_1) entered disabled state [ 377.287119][ T1441] bridge_slave_0: left allmulticast mode [ 377.287151][ T1441] bridge_slave_0: left promiscuous mode [ 377.287420][ T1441] bridge0: port 1(bridge_slave_0) entered disabled state [ 379.034273][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 379.034355][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.211216][ T8125] netlink: 20 bytes leftover after parsing attributes in process `syz.3.550'. [ 379.211243][ T8125] IPv6: NLM_F_CREATE should be specified when creating new route [ 379.261304][ T1441] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 379.338226][ T1441] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 379.361035][ T1441] bond0 (unregistering): Released all slaves [ 379.518130][ T7824] hsr_slave_0: entered promiscuous mode [ 379.519789][ T7824] hsr_slave_1: entered promiscuous mode [ 379.520851][ T7824] debugfs: 'hsr0' already exists in 'hsr' [ 379.520877][ T7824] Cannot create hsr debugfs directory [ 379.615451][ T5880] usb 4-1: new full-speed USB device number 13 using dummy_hcd [ 379.770015][ T5880] usb 4-1: unable to get BOS descriptor or descriptor too short [ 379.770794][ T5880] usb 4-1: not running at top speed; connect to a high speed hub [ 379.775958][ T5880] usb 4-1: New USB device found, idVendor=0644, idProduct=800f, bcdDevice= 0.40 [ 379.775991][ T5880] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 379.776011][ T5880] usb 4-1: Product: syz [ 379.776026][ T5880] usb 4-1: Manufacturer: syz [ 379.776041][ T5880] usb 4-1: SerialNumber: syz [ 380.444359][ T8138] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 382.546767][ T5880] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 382.761394][ T1441] hsr_slave_0: left promiscuous mode [ 382.797694][ T1441] hsr_slave_1: left promiscuous mode [ 382.809286][ T1441] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 382.877656][ T5880] usb 4-1: USB disconnect, device number 13 [ 382.950227][ T1441] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 383.077183][ T7460] udevd[7460]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 383.111038][ T1441] veth0_vlan: left promiscuous mode [ 384.546175][ T1441] team0 (unregistering): Port device team_slave_1 removed [ 384.690526][ T1441] team0 (unregistering): Port device team_slave_0 removed [ 385.771130][ T8167] netlink: 4 bytes leftover after parsing attributes in process `syz.2.559'. [ 386.755278][ T7676] 8021q: adding VLAN 0 to HW filter on device bond0 [ 386.880308][ T7676] 8021q: adding VLAN 0 to HW filter on device team0 [ 386.936379][ T8042] bridge0: port 1(bridge_slave_0) entered blocking state [ 386.937203][ T8042] bridge0: port 1(bridge_slave_0) entered forwarding state [ 387.199467][ T8042] bridge0: port 2(bridge_slave_1) entered blocking state [ 387.199624][ T8042] bridge0: port 2(bridge_slave_1) entered forwarding state [ 389.088817][ T5813] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 389.292950][ T5813] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 389.306918][ T5813] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 389.366052][ T5813] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 389.383478][ T5813] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 390.525520][ T36] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 391.065435][ T36] usb 1-1: Using ep0 maxpacket: 16 [ 391.074652][ T36] usb 1-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 391.074680][ T36] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 391.074699][ T36] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 391.166640][ T36] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 391.166662][ T36] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 391.166680][ T36] usb 1-1: Product: syz [ 391.166689][ T36] usb 1-1: Manufacturer: syz [ 391.166696][ T36] usb 1-1: SerialNumber: syz [ 391.484181][ T5803] Bluetooth: hci5: command tx timeout [ 392.501116][ T36] usb 1-1: 0:2 : does not exist [ 393.335491][ T31] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 393.385794][ T36] usb 1-1: USB disconnect, device number 18 [ 393.485650][ T31] usb 3-1: Using ep0 maxpacket: 32 [ 393.488173][ T31] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 393.488208][ T31] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 393.488249][ T31] usb 3-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 393.488273][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 393.535620][ T5803] Bluetooth: hci5: command tx timeout [ 393.728244][ T8234] netlink: 4 bytes leftover after parsing attributes in process `syz.3.571'. [ 393.744903][ T31] usb 3-1: config 0 descriptor?? [ 393.927758][ T7460] udevd[7460]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 394.193823][ T31] ft260 0003:0403:6030.0005: unknown main item tag 0x0 [ 394.193860][ T31] ft260 0003:0403:6030.0005: unknown main item tag 0x0 [ 394.531990][ T31] ft260 0003:0403:6030.0005: chip code: 0000 0000 [ 394.704781][ T31] ft260 0003:0403:6030.0005: failed to retrieve system status [ 394.705501][ T31] ft260 0003:0403:6030.0005: probe with driver ft260 failed with error -5 [ 394.792108][ T7824] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 395.442185][ T8247] sp0: Synchronizing with TNC [ 395.447672][ T7824] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 395.610745][ T5803] Bluetooth: hci5: command tx timeout [ 395.909178][ T7824] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 395.978302][ T9] usb 3-1: USB disconnect, device number 14 [ 396.806937][ T7824] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 397.685490][ T5803] Bluetooth: hci5: command tx timeout [ 399.308646][ T57] bridge_slave_1: left allmulticast mode [ 399.308677][ T57] bridge_slave_1: left promiscuous mode [ 399.308946][ T57] bridge0: port 2(bridge_slave_1) entered disabled state [ 399.407827][ T57] bridge_slave_0: left allmulticast mode [ 399.407857][ T57] bridge_slave_0: left promiscuous mode [ 399.408119][ T57] bridge0: port 1(bridge_slave_0) entered disabled state [ 399.536411][ T8326] netlink: 4 bytes leftover after parsing attributes in process `syz.2.589'. [ 405.899124][ T5813] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 405.910782][ T5813] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 405.917943][ T5813] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 405.919098][ T5813] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 405.922407][ T5813] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 406.207790][ T57] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 406.286078][ T57] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 406.361122][ T57] bond0 (unregistering): Released all slaves [ 406.534315][ T8208] chnl_net:caif_netlink_parms(): no params data found [ 407.781906][ T8360] netlink: 4 bytes leftover after parsing attributes in process `syz.3.598'. [ 408.005602][ T5813] Bluetooth: hci3: command tx timeout [ 409.491200][ T8208] bridge0: port 1(bridge_slave_0) entered blocking state [ 409.491429][ T8208] bridge0: port 1(bridge_slave_0) entered disabled state [ 409.496197][ T8208] bridge_slave_0: entered allmulticast mode [ 409.499879][ T8208] bridge_slave_0: entered promiscuous mode [ 410.253641][ T5813] Bluetooth: hci3: command tx timeout [ 410.946027][ T57] hsr_slave_0: left promiscuous mode [ 411.055634][ T57] hsr_slave_1: left promiscuous mode [ 411.056728][ T57] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 411.083337][ T57] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 411.995220][ T8385] netlink: 4 bytes leftover after parsing attributes in process `syz.2.607'. [ 412.345373][ T5813] Bluetooth: hci3: command tx timeout [ 412.566980][ T57] team0 (unregistering): Port device team_slave_1 removed [ 412.706964][ T57] team0 (unregistering): Port device team_slave_0 removed [ 414.406020][ T5813] Bluetooth: hci3: command tx timeout [ 415.437564][ T8208] bridge0: port 2(bridge_slave_1) entered blocking state [ 415.437794][ T8208] bridge0: port 2(bridge_slave_1) entered disabled state [ 415.438049][ T8208] bridge_slave_1: entered allmulticast mode [ 415.444062][ T8208] bridge_slave_1: entered promiscuous mode [ 415.762204][ T8405] netlink: 12 bytes leftover after parsing attributes in process `syz.0.614'. [ 416.275535][ T8208] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 416.293135][ T8409] netlink: 4 bytes leftover after parsing attributes in process `syz.2.616'. [ 416.369207][ T8208] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 416.633154][ T36] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 416.775577][ T36] usb 1-1: Using ep0 maxpacket: 16 [ 416.778010][ T36] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 416.782310][ T36] usb 1-1: New USB device found, idVendor=0e20, idProduct=0101, bcdDevice=7a.5a [ 416.782342][ T36] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 416.782362][ T36] usb 1-1: Product: syz [ 416.782377][ T36] usb 1-1: Manufacturer: syz [ 416.782392][ T36] usb 1-1: SerialNumber: syz [ 416.863941][ T36] usb 1-1: config 0 descriptor?? [ 416.906054][ T36] pegasus_notetaker 1-1:0.0: Invalid number of endpoints [ 416.906098][ T36] pegasus_notetaker 1-1:0.0: probe with driver pegasus_notetaker failed with error -22 [ 417.320200][ T5912] usb 1-1: USB disconnect, device number 19 [ 417.358154][ T8208] team0: Port device team_slave_0 added [ 418.193292][ T8208] team0: Port device team_slave_1 added [ 421.296068][ T8208] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 421.296088][ T8208] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 421.296115][ T8208] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 421.312921][ T8208] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 421.312940][ T8208] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 421.312968][ T8208] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 422.002419][ T8208] hsr_slave_0: entered promiscuous mode [ 422.003919][ T8208] hsr_slave_1: entered promiscuous mode [ 422.434179][ T8348] chnl_net:caif_netlink_parms(): no params data found [ 422.765574][ T5882] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 422.915592][ T5882] usb 1-1: Using ep0 maxpacket: 16 [ 422.918217][ T5882] usb 1-1: config 0 has no interfaces? [ 422.921389][ T5882] usb 1-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 1.88 [ 422.921420][ T5882] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 422.921440][ T5882] usb 1-1: Product: syz [ 422.921455][ T5882] usb 1-1: Manufacturer: syz [ 422.921469][ T5882] usb 1-1: SerialNumber: syz [ 422.989471][ T5882] usb 1-1: config 0 descriptor?? [ 423.816463][ T9] usb 1-1: USB disconnect, device number 20 [ 424.647753][ T8348] bridge0: port 1(bridge_slave_0) entered blocking state [ 424.647897][ T8348] bridge0: port 1(bridge_slave_0) entered disabled state [ 424.648140][ T8348] bridge_slave_0: entered allmulticast mode [ 424.679551][ T8348] bridge_slave_0: entered promiscuous mode [ 424.735563][ T5882] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 424.768220][ T8348] bridge0: port 2(bridge_slave_1) entered blocking state [ 424.768365][ T8348] bridge0: port 2(bridge_slave_1) entered disabled state [ 424.769038][ T8348] bridge_slave_1: entered allmulticast mode [ 424.777648][ T8348] bridge_slave_1: entered promiscuous mode [ 424.885469][ T5882] usb 1-1: Using ep0 maxpacket: 16 [ 424.888121][ T5882] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 424.954239][ T5882] usb 1-1: New USB device found, idVendor=0e20, idProduct=0101, bcdDevice=7a.5a [ 424.954274][ T5882] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 424.954295][ T5882] usb 1-1: Product: syz [ 424.954310][ T5882] usb 1-1: Manufacturer: syz [ 424.954324][ T5882] usb 1-1: SerialNumber: syz [ 425.172693][ T5882] usb 1-1: config 0 descriptor?? [ 425.369658][ T5882] pegasus_notetaker 1-1:0.0: Invalid number of endpoints [ 425.369702][ T5882] pegasus_notetaker 1-1:0.0: probe with driver pegasus_notetaker failed with error -22 [ 425.482446][ T5882] usb 1-1: USB disconnect, device number 21 [ 426.174929][ T8348] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 426.492052][ T8348] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 426.831382][ T8348] team0: Port device team_slave_0 added [ 427.942024][ T8348] team0: Port device team_slave_1 added [ 429.591865][ T8348] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 429.591885][ T8348] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 429.591910][ T8348] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 429.656407][ T8348] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 429.656426][ T8348] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 429.656453][ T8348] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 429.781204][ T9] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 430.226006][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 430.226036][ T9] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 430.226076][ T9] usb 3-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 430.226099][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 430.530378][ T37] audit: type=1800 audit(1776014116.476:2): pid=8549 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.3.649" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 430.666784][ T9] usb 3-1: config 0 descriptor?? [ 430.810760][ T8348] hsr_slave_0: entered promiscuous mode [ 430.812248][ T8348] hsr_slave_1: entered promiscuous mode [ 430.813386][ T8348] debugfs: 'hsr0' already exists in 'hsr' [ 430.813415][ T8348] Cannot create hsr debugfs directory [ 430.913105][ T5866] usb 3-1: USB disconnect, device number 15 [ 431.015245][ T57] bridge_slave_1: left allmulticast mode [ 431.015276][ T57] bridge_slave_1: left promiscuous mode [ 431.016300][ T57] bridge0: port 2(bridge_slave_1) entered disabled state [ 431.097203][ T57] bridge_slave_0: left allmulticast mode [ 431.097237][ T57] bridge_slave_0: left promiscuous mode [ 431.097539][ T57] bridge0: port 1(bridge_slave_0) entered disabled state [ 431.275615][ T5953] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 431.441836][ T5953] usb 4-1: Using ep0 maxpacket: 16 [ 431.450076][ T5953] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 431.450108][ T5953] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 431.450143][ T5953] usb 4-1: New USB device found, idVendor=1b1c, idProduct=1b02, bcdDevice= 0.00 [ 431.450163][ T5953] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 431.460108][ T5953] usb 4-1: config 0 descriptor?? [ 431.811512][ T57] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 431.921450][ T5953] corsair 0003:1B1C:1B02.0006: unknown main item tag 0x0 [ 431.921492][ T5953] corsair 0003:1B1C:1B02.0006: unknown main item tag 0x0 [ 431.921519][ T5953] corsair 0003:1B1C:1B02.0006: unknown main item tag 0x0 [ 431.921542][ T5953] corsair 0003:1B1C:1B02.0006: unknown main item tag 0x0 [ 431.921566][ T5953] corsair 0003:1B1C:1B02.0006: unknown main item tag 0x0 [ 431.949057][ T57] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 431.949584][ T5953] corsair 0003:1B1C:1B02.0006: hidraw0: USB HID v0.00 Device [HID 1b1c:1b02] on usb-dummy_hcd.3-1/input0 [ 432.047866][ T57] bond0 (unregistering): Released all slaves [ 432.082694][ T5953] corsair 0003:1B1C:1B02.0006: Failed to get K90 initial state (error -32). [ 432.179613][ T5953] usb 4-1: USB disconnect, device number 14 [ 432.237286][ T8561] syz_tun: entered allmulticast mode [ 433.584239][ T8208] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 433.674042][ T8580] netlink: 60 bytes leftover after parsing attributes in process `syz.3.659'. [ 433.757305][ T8208] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 433.950586][ T8208] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 434.252471][ T8596] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 434.266515][ T8208] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 434.525695][ T57] hsr_slave_0: left promiscuous mode [ 434.572982][ T57] hsr_slave_1: left promiscuous mode [ 434.574210][ T57] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 434.603249][ T57] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 435.267310][ T57] team0 (unregistering): Port device team_slave_1 removed [ 435.326539][ T57] team0 (unregistering): Port device team_slave_0 removed [ 436.684947][ T36] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 436.845548][ T36] usb 1-1: Using ep0 maxpacket: 16 [ 436.848062][ T36] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 436.851282][ T36] usb 1-1: New USB device found, idVendor=0e20, idProduct=0101, bcdDevice=7a.5a [ 436.851314][ T36] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 436.851335][ T36] usb 1-1: Product: syz [ 436.851349][ T36] usb 1-1: Manufacturer: syz [ 436.851363][ T36] usb 1-1: SerialNumber: syz [ 436.914393][ T36] usb 1-1: config 0 descriptor?? [ 436.929650][ T36] pegasus_notetaker 1-1:0.0: Invalid number of endpoints [ 436.929696][ T36] pegasus_notetaker 1-1:0.0: probe with driver pegasus_notetaker failed with error -22 [ 437.033803][ T8208] 8021q: adding VLAN 0 to HW filter on device bond0 [ 437.063727][ T8208] 8021q: adding VLAN 0 to HW filter on device team0 [ 437.123404][ T8208] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 437.123431][ T8208] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 437.222746][ T10] usb 1-1: USB disconnect, device number 22 [ 438.198733][ T8037] bridge0: port 1(bridge_slave_0) entered blocking state [ 438.198860][ T8037] bridge0: port 1(bridge_slave_0) entered forwarding state [ 438.258159][ T8037] bridge0: port 2(bridge_slave_1) entered blocking state [ 438.258328][ T8037] bridge0: port 2(bridge_slave_1) entered forwarding state [ 439.066332][ T8208] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 440.012737][ T8695] ubi16: attaching mtd0 [ 440.016120][ T8695] ubi16: scanning is finished [ 440.016137][ T8695] ubi16: empty MTD device detected [ 440.225460][ T5882] usb 3-1: new full-speed USB device number 16 using dummy_hcd [ 440.319992][ T8695] ubi16: attached mtd0 (name "mtdram test device", size 0 MiB) [ 440.320020][ T8695] ubi16: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 440.320038][ T8695] ubi16: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 440.320110][ T8695] ubi16: VID header offset: 64 (aligned 64), data offset: 128 [ 440.320124][ T8695] ubi16: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 440.320133][ T8695] ubi16: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 440.320143][ T8695] ubi16: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 722817184 [ 440.320154][ T8695] ubi16: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 440.321800][ T8701] ubi16: background thread "ubi_bgt16d" started, PID 8701 [ 440.391019][ T5882] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 440.391130][ T5882] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 440.391173][ T5882] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 440.391194][ T5882] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 440.410791][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.410890][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.433861][ T5882] usb 3-1: config 0 descriptor?? [ 440.443091][ T5882] hub 3-1:0.0: bad descriptor, ignoring hub [ 440.443131][ T5882] hub 3-1:0.0: probe with driver hub failed with error -5 [ 440.488350][ T5882] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 440.572013][ T8348] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 440.730600][ T8348] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 440.788694][ T8348] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 440.886882][ T8348] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 441.129077][ T8714] fuse: Bad value for 'user_id' [ 441.129099][ T8714] fuse: Bad value for 'user_id' [ 441.411015][ T8208] veth0_vlan: entered promiscuous mode [ 441.524843][ T8208] veth1_vlan: entered promiscuous mode [ 441.675433][ T5953] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 441.712820][ T8208] veth0_macvtap: entered promiscuous mode [ 441.753307][ T8348] 8021q: adding VLAN 0 to HW filter on device bond0 [ 441.781194][ T8208] veth1_macvtap: entered promiscuous mode [ 441.835706][ T5953] usb 1-1: Using ep0 maxpacket: 16 [ 441.840214][ T5953] usb 1-1: config 0 has no interfaces? [ 441.843170][ T5953] usb 1-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 1.88 [ 441.843203][ T5953] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 441.843225][ T5953] usb 1-1: Product: syz [ 441.843239][ T5953] usb 1-1: Manufacturer: syz [ 441.843255][ T5953] usb 1-1: SerialNumber: syz [ 441.883280][ T8348] 8021q: adding VLAN 0 to HW filter on device team0 [ 441.911733][ T8208] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 441.923858][ T5953] usb 1-1: config 0 descriptor?? [ 441.942613][ T1114] bridge0: port 1(bridge_slave_0) entered blocking state [ 441.949087][ T1114] bridge0: port 1(bridge_slave_0) entered forwarding state [ 441.978247][ T8208] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 442.010672][ T4029] bridge0: port 2(bridge_slave_1) entered blocking state [ 442.010828][ T4029] bridge0: port 2(bridge_slave_1) entered forwarding state [ 442.083543][ T4029] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 442.088729][ T4029] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 442.093592][ T4029] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 442.128055][ T4029] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 443.105871][ T10] usb 3-1: USB disconnect, device number 16 [ 443.169121][ T10] usb 1-1: USB disconnect, device number 23 [ 443.226970][ T8730] netlink: 12 bytes leftover after parsing attributes in process `syz.2.695'. [ 443.438213][ T1441] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 443.438237][ T1441] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 443.559594][ T8037] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 443.559617][ T8037] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 443.815560][ T5805] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 443.966542][ T5805] usb 3-1: Using ep0 maxpacket: 16 [ 443.969102][ T5805] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 443.969148][ T5805] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 443.969171][ T5805] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 443.969215][ T5805] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 443.969239][ T5805] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 444.025642][ T5805] usb 3-1: config 0 descriptor?? [ 444.211664][ T8348] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 444.438913][ T5805] microsoft 0003:045E:07DA.0007: unknown main item tag 0x0 [ 444.438957][ T5805] microsoft 0003:045E:07DA.0007: ignoring exceeding usage max [ 444.538809][ T5805] input: HID 045e:07da as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:045E:07DA.0007/input/input12 [ 444.658516][ T8757] 9p: Bad value for 'rfdno' [ 445.644705][ T5805] microsoft 0003:045E:07DA.0007: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.2-1/input0 [ 446.033311][ T5805] usb 3-1: USB disconnect, device number 17 [ 448.825570][ T9] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 448.825883][ C0] raw-gadget.1 gadget.5: ignoring, device is not running [ 448.955413][ T9] usb 6-1: device descriptor read/64, error -32 [ 448.996551][ T8769] ubi: mtd0 is already attached to ubi16 [ 449.185074][ T8765] fido_id[8765]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/3-1/report_descriptor': No such file or directory [ 449.204108][ T8772] fuse: Bad value for 'user_id' [ 449.204129][ T8772] fuse: Bad value for 'user_id' [ 450.335437][ T9] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 450.365801][ T5953] usb 1-1: new full-speed USB device number 24 using dummy_hcd [ 450.474987][ T8348] veth0_vlan: entered promiscuous mode [ 450.485909][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 450.488584][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 450.488621][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 450.488645][ T9] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 450.488690][ T9] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 450.488714][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 450.555153][ T5953] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 450.555220][ T5953] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 450.555245][ T5953] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 450.604189][ T5953] usb 1-1: config 0 descriptor?? [ 450.604605][ T8348] veth1_vlan: entered promiscuous mode [ 450.625847][ T9] usb 3-1: config 0 descriptor?? [ 450.666460][ T5953] hub 1-1:0.0: bad descriptor, ignoring hub [ 450.666502][ T5953] hub 1-1:0.0: probe with driver hub failed with error -5 [ 450.695535][ T5953] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 450.818485][ T8348] veth0_macvtap: entered promiscuous mode [ 450.853840][ T8348] veth1_macvtap: entered promiscuous mode [ 450.947493][ T8348] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 450.982408][ T8348] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 451.025486][ T1441] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 451.030724][ T12] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 451.031450][ T12] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 451.031496][ T12] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 451.088297][ T9] microsoft 0003:045E:07DA.0008: unknown main item tag 0x0 [ 451.088331][ T9] microsoft 0003:045E:07DA.0008: ignoring exceeding usage max [ 451.222271][ T9] input: HID 045e:07da as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:045E:07DA.0008/input/input13 [ 451.354322][ T9] microsoft 0003:045E:07DA.0008: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.2-1/input0 [ 451.373986][ T9] usb 3-1: USB disconnect, device number 18 [ 451.498190][ T8813] 9p: Bad value for 'rfdno' [ 451.861985][ T8816] fido_id[8816]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/3-1/report_descriptor': No such file or directory [ 451.890064][ T5933] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 451.890097][ T5933] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 452.015855][ T8820] fuse: Bad value for 'user_id' [ 452.015879][ T8820] fuse: Bad value for 'user_id' [ 452.324916][ T8049] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 452.324940][ T8049] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 452.344536][ T8826] ubi: mtd0 is already attached to ubi16 [ 453.147053][ T8842] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 453.295825][ T36] usb 1-1: USB disconnect, device number 24 [ 454.451837][ T8847] 9p: Bad value for 'rfdno' [ 454.527536][ T8856] fuse: Bad value for 'fd' [ 454.935971][ T8867] ubi: mtd0 is already attached to ubi16 [ 455.249107][ T8877] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 456.149600][ T8891] fuse: Bad value for 'fd' [ 457.388380][ T8899] 9p: Bad value for 'rfdno' [ 458.081111][ T8910] ubi: mtd0 is already attached to ubi16 [ 459.297776][ T8920] fuse: Bad value for 'fd' [ 460.706658][ T8934] 9p: Bad value for 'rfdno' [ 460.773611][ T8936] netlink: 28 bytes leftover after parsing attributes in process `syz.3.754'. [ 460.974210][ T8940] syz.3.757 uses obsolete (PF_INET,SOCK_PACKET) [ 461.131821][ T8945] ubi: mtd0 is already attached to ubi16 [ 463.525551][ T5882] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 465.010423][ T8972] fuse: Bad value for 'fd' [ 465.386738][ T5882] usb 1-1: config 0 has an invalid interface number: 32 but max is 0 [ 465.386769][ T5882] usb 1-1: config 0 has no interface number 0 [ 465.387006][ T5882] usb 1-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 465.387032][ T5882] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 465.400695][ T5882] usb 1-1: config 0 descriptor?? [ 465.579110][ T5882] usb 1-1: can't set config #0, error -71 [ 465.603944][ T5882] usb 1-1: USB disconnect, device number 25 [ 465.924991][ T8984] 9p: Bad value for 'rfdno' [ 465.945700][ T5912] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 467.025979][ T5912] usb 7-1: Using ep0 maxpacket: 32 [ 467.262929][ T5912] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 467.262965][ T5912] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 467.263005][ T5912] usb 7-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 467.263029][ T5912] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 467.288411][ T8993] ubi: mtd0 is already attached to ubi16 [ 467.313815][ T5912] usb 7-1: config 0 descriptor?? [ 467.922307][ T5912] ft260 0003:0403:6030.0009: unknown main item tag 0x0 [ 467.922347][ T5912] ft260 0003:0403:6030.0009: unknown main item tag 0x0 [ 468.091635][ T5912] ft260 0003:0403:6030.0009: chip code: 0000 0000 [ 468.289336][ T5912] ft260 0003:0403:6030.0009: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.6-1/input0 [ 468.784369][ T5912] ft260 0003:0403:6030.0009: failed to retrieve status: -5, no wakeup [ 470.017015][ T9024] fuse: Bad value for 'fd' [ 470.080953][ T5912] ft260 0003:0403:6030.0009: failed to retrieve status: -71 [ 470.120534][ T5912] ft260 0003:0403:6030.0009: failed to reset I2C controller: -71 [ 470.255994][ T5912] usb 7-1: USB disconnect, device number 2 [ 471.844190][ T31] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 472.093141][ T31] usb 3-1: config 0 has an invalid interface number: 32 but max is 0 [ 472.093242][ T31] usb 3-1: config 0 has no interface number 0 [ 472.093631][ T31] usb 3-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 472.093684][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 473.031693][ T31] usb 3-1: config 0 descriptor?? [ 473.058937][ T31] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 473.514588][ T9053] ubi: mtd0 is already attached to ubi16 [ 475.177518][ T31] usb 3-1: USB disconnect, device number 19 [ 476.076729][ T9081] fuse: Bad value for 'fd' [ 476.155440][ T5912] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 476.315352][ T5912] usb 3-1: Using ep0 maxpacket: 32 [ 476.458124][ T5912] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 476.458164][ T5912] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 476.458207][ T5912] usb 3-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 476.458231][ T5912] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 476.543777][ T5912] usb 3-1: config 0 descriptor?? [ 478.076284][ T5912] ft260 0003:0403:6030.000A: unknown main item tag 0x0 [ 478.076324][ T5912] ft260 0003:0403:6030.000A: unknown main item tag 0x0 [ 478.143653][ T5912] ft260 0003:0403:6030.000A: chip code: 0000 0000 [ 478.344448][ T5912] ft260 0003:0403:6030.000A: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.2-1/input0 [ 478.546012][ T5912] ft260 0003:0403:6030.000A: failed to retrieve status: -5, no wakeup [ 478.867893][ T5912] ft260 0003:0403:6030.000A: failed to retrieve status: -71 [ 478.886409][ T5912] ft260 0003:0403:6030.000A: failed to reset I2C controller: -71 [ 479.912901][ T9110] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 479.950494][ T9109] ubi: mtd0 is already attached to ubi16 [ 480.360183][ T5912] usb 3-1: USB disconnect, device number 20 [ 480.837102][ T9133] fuse: Invalid rootmode [ 482.085766][ T5953] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 483.057421][ T5953] usb 7-1: Using ep0 maxpacket: 16 [ 483.059836][ T5953] usb 7-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 483.059863][ T5953] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 483.059883][ T5953] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 483.785670][ T5953] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 483.791054][ T5953] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 483.791082][ T5953] usb 7-1: Product: syz [ 483.791097][ T5953] usb 7-1: Manufacturer: syz [ 483.791110][ T5953] usb 7-1: SerialNumber: syz [ 484.077736][ T9170] 9p: Bad value for 'rfdno' [ 484.302463][ T9171] ubi: mtd0 is already attached to ubi16 [ 484.416113][ T5953] usb 7-1: 0:2 : does not exist [ 484.636091][ T5953] usb 7-1: 1:0: failed to get current value for ch 0 (-22) [ 484.871431][ T5953] usb 7-1: USB disconnect, device number 3 [ 484.992551][ T9186] fuse: Invalid rootmode [ 485.061632][ T7460] udevd[7460]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 486.942470][ T5953] IPVS: starting estimator thread 0... [ 488.546046][ T5882] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 488.949413][ T5882] usb 3-1: config 0 has an invalid interface number: 32 but max is 0 [ 488.949445][ T5882] usb 3-1: config 0 has no interface number 0 [ 488.949498][ T5882] usb 3-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 488.949521][ T5882] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 488.963833][ T9210] IPVS: using max 7 ests per chain, 16800 per kthread [ 489.075867][ T5882] usb 3-1: config 0 descriptor?? [ 489.082918][ T5882] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 490.217552][ T9223] ubi: mtd0 is already attached to ubi16 [ 490.422559][ T5882] usb 3-1: USB disconnect, device number 21 [ 490.514694][ T9226] 9p: Bad value for 'rfdno' [ 490.793668][ T9235] fuse: Invalid rootmode [ 490.846506][ T9232] sp0: Synchronizing with TNC [ 491.145640][ T5813] Bluetooth: hci0: unexpected event for opcode 0x6502 [ 491.775791][ T5953] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 491.935422][ T5953] usb 3-1: Using ep0 maxpacket: 16 [ 491.939495][ T5953] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 491.939511][ T5953] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 491.939522][ T5953] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 491.951879][ T5953] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 491.951909][ T5953] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 491.951935][ T5953] usb 3-1: Product: syz [ 491.951948][ T5953] usb 3-1: Manufacturer: syz [ 491.951961][ T5953] usb 3-1: SerialNumber: syz [ 492.650872][ T5953] usb 3-1: 0:2 : does not exist [ 493.463102][ T5953] usb 3-1: 1:0: failed to get current value for ch 0 (-22) [ 494.716356][ T9283] ubi: mtd0 is already attached to ubi16 [ 494.741387][ T5953] usb 3-1: USB disconnect, device number 22 [ 495.295016][ T7460] udevd[7460]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 495.315439][ T5912] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 495.454140][ T9285] fuse: Bad value for 'rootmode' [ 495.467445][ T5912] usb 6-1: config 0 has an invalid interface number: 32 but max is 0 [ 495.467479][ T5912] usb 6-1: config 0 has no interface number 0 [ 495.467532][ T5912] usb 6-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 495.467555][ T5912] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 495.471571][ T5912] usb 6-1: config 0 descriptor?? [ 495.572325][ T5912] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 496.045762][ T9287] 9p: Bad value for 'rfdno' [ 496.782956][ T5912] usb 6-1: USB disconnect, device number 4 [ 497.478276][ T9294] netlink: 8 bytes leftover after parsing attributes in process `syz.5.842'. [ 497.478499][ T9294] netlink: 'syz.5.842': attribute type 30 has an invalid length. [ 497.800357][ T1441] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 497.843721][ T8042] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 497.843843][ T8042] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 497.843976][ T8042] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 498.553346][ T5813] Bluetooth: hci0: unexpected event for opcode 0x6502 [ 498.846191][ T5882] IPVS: starting estimator thread 0... [ 498.935498][ T9308] IPVS: using max 9 ests per chain, 21600 per kthread [ 499.163725][ T9313] fuse: Bad value for 'rootmode' [ 499.515464][ T5912] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 499.665489][ T5912] usb 4-1: Using ep0 maxpacket: 16 [ 499.672580][ T5912] usb 4-1: config 0 has no interfaces? [ 499.684484][ T5912] usb 4-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 1.88 [ 499.684515][ T5912] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 499.684534][ T5912] usb 4-1: Product: syz [ 499.684547][ T5912] usb 4-1: Manufacturer: syz [ 499.684560][ T5912] usb 4-1: SerialNumber: syz [ 499.700537][ T5912] usb 4-1: config 0 descriptor?? [ 499.955898][ T5805] usb 4-1: USB disconnect, device number 15 [ 501.491872][ T37] audit: type=1804 audit(1776014187.276:3): pid=9333 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.0.858" name="/newroot/245/file0" dev="fuse" ino=1 res=1 errno=0 [ 501.886865][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.886947][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.132620][ T9350] fuse: Bad value for 'rootmode' [ 502.406974][ T9355] ubi: mtd0 is already attached to ubi16 [ 503.031974][ T9358] netlink: 4 bytes leftover after parsing attributes in process `syz.0.865'. [ 503.549923][ T9365] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 504.467277][ T9380] fuse: Unknown parameter 'use00000000000000000000' [ 505.025499][ T5953] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 505.185426][ T5953] usb 4-1: Using ep0 maxpacket: 32 [ 505.187063][ T5953] usb 4-1: config index 0 descriptor too short (expected 29220, got 36) [ 505.187081][ T5953] usb 4-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 505.187093][ T5953] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 505.187124][ T5953] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 505.187136][ T5953] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 505.187151][ T5953] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 505.187176][ T5953] usb 4-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 505.187194][ T5953] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 505.288234][ T5953] usb 4-1: config 0 descriptor?? [ 505.501230][ T5953] usblp 4-1:0.0: usblp0: USB Bidirectional printer dev 16 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 505.793931][ C0] usblp0: nonzero read bulk status received: -71 [ 505.796218][ T5912] usb 4-1: USB disconnect, device number 16 [ 505.860063][ T9382] usblp0: removed [ 507.838032][ T9416] fuse: Unknown parameter 'use00000000000000000000' [ 508.096465][ T9425] ubi: mtd0 is already attached to ubi16 [ 508.375423][ T5882] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 508.525527][ T5882] usb 4-1: Using ep0 maxpacket: 16 [ 508.527877][ T5882] usb 4-1: config 0 has no interfaces? [ 508.530261][ T5882] usb 4-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 1.88 [ 508.530280][ T5882] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 508.530292][ T5882] usb 4-1: Product: syz [ 508.530301][ T5882] usb 4-1: Manufacturer: syz [ 508.530309][ T5882] usb 4-1: SerialNumber: syz [ 508.539913][ T5882] usb 4-1: config 0 descriptor?? [ 508.775220][ T5805] usb 4-1: USB disconnect, device number 17 [ 509.775419][ T5805] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 510.125600][ T5805] usb 4-1: Using ep0 maxpacket: 32 [ 510.127667][ T5805] usb 4-1: config index 0 descriptor too short (expected 29220, got 36) [ 510.127696][ T5805] usb 4-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 510.127718][ T5805] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 510.127753][ T5805] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 510.127766][ T5805] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 510.127781][ T5805] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 510.127806][ T5805] usb 4-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 510.127819][ T5805] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 510.132396][ T5805] usb 4-1: config 0 descriptor?? [ 511.074870][ T9] usb 7-1: new full-speed USB device number 4 using dummy_hcd [ 511.139712][ T5805] usblp 4-1:0.0: usblp0: USB Bidirectional printer dev 18 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 511.231214][ T9] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 511.231253][ T9] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 511.231294][ T9] usb 7-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 511.231318][ T9] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 511.276785][ T9] usb 7-1: config 0 descriptor?? [ 511.298408][ T9] hub 7-1:0.0: USB hub found [ 511.342245][ T5126] usb 4-1: USB disconnect, device number 18 [ 511.398646][ T5126] usblp0: removed [ 511.550280][ C0] raw-gadget.1 gadget.6: ignoring, device is not running [ 511.550445][ T9] hub 7-1:0.0: config failed, can't read hub descriptor (err -22) [ 511.620645][ T9] usbhid 7-1:0.0: can't add hid device: -71 [ 511.620777][ T9] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 511.677092][ T9] usb 7-1: USB disconnect, device number 4 [ 511.789269][ T9452] fuse: Unknown parameter 'use00000000000000000000' [ 512.066599][ T9455] netlink: 8 bytes leftover after parsing attributes in process `syz.2.899'. [ 512.066746][ T9455] netlink: 'syz.2.899': attribute type 30 has an invalid length. [ 513.147227][ T9468] ubi: mtd0 is already attached to ubi16 [ 513.398071][ T9] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 514.167069][ T5813] Bluetooth: hci5: command 0x0406 tx timeout [ 514.455474][ T9] usb 3-1: device descriptor read/64, error -71 [ 514.735423][ T9] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 514.901862][ T9] usb 3-1: device descriptor read/64, error -71 [ 515.056045][ T9] usb usb3-port1: attempt power cycle [ 515.505493][ T9] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 515.542584][ T9] usb 3-1: device descriptor read/8, error -71 [ 515.655814][ T9486] fuse: Unknown parameter 'user_i00000000000000000000' [ 515.785518][ T9] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 515.806712][ T9] usb 3-1: device descriptor read/8, error -71 [ 515.917211][ T9] usb usb3-port1: unable to enumerate USB device [ 515.983084][ T9490] netlink: 4 bytes leftover after parsing attributes in process `syz.3.912'. [ 516.521457][ T9494] netlink: 8 bytes leftover after parsing attributes in process `syz.2.914'. [ 516.521538][ T9494] netlink: 'syz.2.914': attribute type 30 has an invalid length. [ 517.465471][ T10] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 517.615412][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 517.620562][ T10] usb 4-1: config index 0 descriptor too short (expected 29220, got 36) [ 517.620582][ T10] usb 4-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 517.620594][ T10] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 517.620625][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 517.620638][ T10] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 517.620652][ T10] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 517.620678][ T10] usb 4-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 517.620691][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 517.637267][ T10] usb 4-1: config 0 descriptor?? [ 518.301267][ T10] usblp 4-1:0.0: usblp0: USB Bidirectional printer dev 19 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 518.558476][ T10] usb 4-1: USB disconnect, device number 19 [ 518.582219][ T10] usblp0: removed [ 518.889165][ T9501] 9p: Bad value for 'rfdno' [ 518.896394][ T9507] netlink: 'syz.2.918': attribute type 3 has an invalid length. [ 519.723790][ T9516] fuse: Unknown parameter 'user_i00000000000000000000' [ 521.026631][ T9536] ubi: mtd0 is already attached to ubi16 [ 521.722710][ T9544] overlayfs: failed to resolve './file1': -2 [ 522.833008][ T9548] 9p: Bad value for 'rfdno' [ 525.032173][ T9559] fuse: Unknown parameter 'user_i00000000000000000000' [ 525.645435][ T31] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 525.795426][ T31] usb 1-1: Using ep0 maxpacket: 32 [ 525.798194][ T31] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 525.798224][ T31] usb 1-1: config 0 has no interface number 0 [ 525.798275][ T31] usb 1-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 525.801920][ T31] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 525.801954][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 525.801976][ T31] usb 1-1: Product: syz [ 525.801991][ T31] usb 1-1: Manufacturer: syz [ 525.802048][ T31] usb 1-1: SerialNumber: syz [ 525.884210][ T31] usb 1-1: config 0 descriptor?? [ 525.891578][ T9562] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 525.955542][ T10] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 526.104813][ T9562] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 526.136468][ T10] usb 4-1: Using ep0 maxpacket: 8 [ 526.139202][ T10] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 526.139245][ T10] usb 4-1: config 0 interface 0 has no altsetting 0 [ 526.142442][ T10] usb 4-1: New USB device found, idVendor=0e41, idProduct=4142, bcdDevice=d4.6e [ 526.142471][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 526.142492][ T10] usb 4-1: Product: syz [ 526.142506][ T10] usb 4-1: Manufacturer: syz [ 526.142519][ T10] usb 4-1: SerialNumber: syz [ 526.153860][ T10] usb 4-1: config 0 descriptor?? [ 526.233128][ T10] snd_usb_toneport 4-1:0.0: Line 6 TonePort UX2 found [ 526.404242][ T10] snd_usb_toneport 4-1:0.0: cannot get proper max packet size [ 526.404555][ T10] snd_usb_toneport 4-1:0.0: Line 6 TonePort UX2 now disconnected [ 526.412682][ T10] snd_usb_toneport 4-1:0.0: probe with driver snd_usb_toneport failed with error -22 [ 526.631307][ T10] usb 4-1: USB disconnect, device number 20 [ 526.870940][ T9578] 9p: Bad value for 'rfdno' [ 526.912178][ T31] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 526.912213][ T31] asix 1-1:0.188 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffc3 [ 526.912528][ T31] asix 1-1:0.188: probe with driver asix failed with error -61 [ 527.056558][ T9] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 527.160452][ T9584] overlayfs: failed to resolve './file1': -2 [ 527.558265][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 527.785542][ T9] usb 3-1: config 0 has an invalid interface number: 12 but max is 0 [ 527.785575][ T9] usb 3-1: config 0 has no interface number 0 [ 527.786368][ T9] usb 3-1: config 0 interface 12 has no altsetting 0 [ 528.105490][ T9] usb 3-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 528.105523][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 528.105545][ T9] usb 3-1: Product: syz [ 528.105560][ T9] usb 3-1: Manufacturer: syz [ 528.105575][ T9] usb 3-1: SerialNumber: syz [ 528.120526][ T9] usb 3-1: config 0 descriptor?? [ 528.480662][ T5805] usb 1-1: USB disconnect, device number 26 [ 528.580037][ T9591] fuse: Unknown parameter 'user_id00000000000000000000' [ 529.364180][ T9] f81534 3-1:0.12: f81534_set_register: reg: 1003 data: 38 failed: -71 [ 529.364246][ T9] f81534 3-1:0.12: f81534_find_config_idx: read failed: -71 [ 529.364265][ T9] f81534 3-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 529.364361][ T9] f81534 3-1:0.12: probe with driver f81534 failed with error -71 [ 529.380091][ T9] usb 3-1: USB disconnect, device number 27 [ 529.530049][ T5803] Bluetooth: hci3: command 0x0406 tx timeout [ 531.391049][ T37] audit: type=1800 audit(1776014217.346:4): pid=9614 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.3.953" name="SYSV00000000" dev="tmpfs" ino=1 res=0 errno=0 [ 531.475614][ T9] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 531.570892][ T9618] 9p: Bad value for 'rfdno' [ 531.625745][ T9] usb 3-1: Using ep0 maxpacket: 8 [ 531.634688][ T9] usb 3-1: config index 0 descriptor too short (expected 12362, got 45) [ 531.634725][ T9] usb 3-1: config 102 has too many interfaces: 120, using maximum allowed: 32 [ 531.634746][ T9] usb 3-1: config 102 has an invalid descriptor of length 102, skipping remainder of the config [ 531.634765][ T9] usb 3-1: config 102 has 0 interfaces, different from the descriptor's value: 120 [ 531.634803][ T9] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 531.634827][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 531.941808][ T9622] netlink: 12 bytes leftover after parsing attributes in process `syz.3.955'. [ 532.485303][ T9] usb 3-1: string descriptor 0 read error: -71 [ 532.535402][ T9] usb 3-1: USB disconnect, device number 28 [ 536.387822][ T9629] fuse: Unknown parameter 'user_id00000000000000000000' [ 537.177412][ T9645] netlink: 8 bytes leftover after parsing attributes in process `syz.3.964'. [ 537.177576][ T9645] netlink: 'syz.3.964': attribute type 30 has an invalid length. [ 538.037852][ T37] audit: type=1800 audit(1776014223.946:5): pid=9651 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.5.965" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 538.065981][ T9652] 9p: Bad value for 'rfdno' [ 538.625508][ T31] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 538.778183][ T31] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 538.778243][ T31] usb 1-1: New USB device found, idVendor=046d, idProduct=c71f, bcdDevice= 0.00 [ 538.778269][ T31] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 538.817967][ T31] usb 1-1: config 0 descriptor?? [ 538.819450][ T9663] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 541.406686][ T9675] fuse: Unknown parameter 'user_id00000000000000000000' [ 542.783333][ T9686] netlink: 'syz.6.979': attribute type 3 has an invalid length. [ 542.801938][ T31] usbhid 1-1:0.0: can't add hid device: -71 [ 542.802020][ T31] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 542.804822][ T31] usb 1-1: USB disconnect, device number 27 [ 543.296821][ T37] audit: type=1800 audit(1776014229.216:6): pid=9694 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.5.982" name="SYSV00000000" dev="tmpfs" ino=1 res=0 errno=0 [ 543.343959][ T9690] 9p: Bad value for 'rfdno' [ 543.455445][ T31] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 543.592381][ T31] usb 1-1: device descriptor read/64, error -71 [ 543.968499][ T31] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 544.127000][ T31] usb 1-1: device descriptor read/64, error -71 [ 544.128145][ T9704] fuse: Bad value for 'fd' [ 544.236489][ T31] usb usb1-port1: attempt power cycle [ 544.391413][ T9709] netlink: 8 bytes leftover after parsing attributes in process `syz.5.986'. [ 544.391609][ T9709] netlink: 'syz.5.986': attribute type 30 has an invalid length. [ 544.945765][ T31] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 545.032395][ T31] usb 1-1: device descriptor read/8, error -71 [ 545.102991][ T9710] syz.6.988 (9710) used greatest stack depth: 17384 bytes left [ 545.267942][ T31] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 545.293484][ T31] usb 1-1: device descriptor read/8, error -71 [ 545.387126][ T9723] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 545.396083][ T31] usb usb1-port1: unable to enumerate USB device [ 545.449694][ T9722] 9p: Bad value for 'rfdno' [ 546.736025][ T9740] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 546.858634][ T9739] fuse: Bad value for 'fd' [ 548.005459][ T5912] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 548.080353][ T9757] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1003'. [ 548.080607][ T9757] netlink: 'syz.0.1003': attribute type 30 has an invalid length. [ 548.156416][ T5912] usb 6-1: Using ep0 maxpacket: 32 [ 548.159591][ T5912] usb 6-1: config 0 has an invalid interface number: 12 but max is 0 [ 548.159631][ T5912] usb 6-1: config 0 has no interface number 0 [ 548.159692][ T5912] usb 6-1: config 0 interface 12 has no altsetting 0 [ 548.242493][ T5912] usb 6-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 548.242528][ T5912] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 548.242550][ T5912] usb 6-1: Product: syz [ 548.242565][ T5912] usb 6-1: Manufacturer: syz [ 548.242579][ T5912] usb 6-1: SerialNumber: syz [ 548.336563][ T4029] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 548.338054][ T71] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 548.338135][ T71] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 548.338212][ T71] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 548.680950][ T5912] usb 6-1: config 0 descriptor?? [ 550.535506][ T10] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 550.665450][ T10] usb 4-1: device descriptor read/64, error -71 [ 550.998477][ T9774] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1010'. [ 551.013791][ T10] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 551.555643][ T10] usb 4-1: device descriptor read/64, error -71 [ 551.587593][ T5912] f81534 6-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 551.587631][ T5912] f81534 6-1:0.12: f81534_find_config_idx: read failed: -71 [ 551.587641][ T5912] f81534 6-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 551.587697][ T5912] f81534 6-1:0.12: probe with driver f81534 failed with error -71 [ 551.665843][ T5912] usb 6-1: USB disconnect, device number 5 [ 551.665956][ T10] usb usb4-port1: attempt power cycle [ 551.835188][ T9779] fuse: Bad value for 'fd' [ 551.850358][ T9776] 9p: Bad value for 'rfdno' [ 552.005451][ T10] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 552.054700][ T10] usb 4-1: device descriptor read/8, error -71 [ 552.490721][ T10] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 552.535309][ T9795] ubi: mtd0 is already attached to ubi16 [ 553.139351][ T10] usb 4-1: device descriptor read/8, error -71 [ 553.245722][ T10] usb usb4-port1: unable to enumerate USB device [ 554.615556][ T9806] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1022'. [ 555.093239][ T9813] fuse: Unknown parameter '0x0000000000000004' [ 555.428012][ T9822] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1027'. [ 556.435456][ T5912] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 556.565453][ T5912] usb 3-1: device descriptor read/64, error -71 [ 556.805788][ T5912] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 556.935512][ T5912] usb 3-1: device descriptor read/64, error -71 [ 557.045996][ T5912] usb usb3-port1: attempt power cycle [ 557.385465][ T5912] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 557.408138][ T5912] usb 3-1: device descriptor read/8, error -71 [ 557.545390][ T5805] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 557.645920][ T5912] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 557.684275][ T5912] usb 3-1: device descriptor read/8, error -71 [ 557.797521][ T5912] usb usb3-port1: unable to enumerate USB device [ 557.862362][ T5805] usb 1-1: Using ep0 maxpacket: 32 [ 558.283666][ T9852] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1034'. [ 558.290687][ T5805] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 558.290708][ T5805] usb 1-1: config 0 has no interface number 0 [ 558.290738][ T5805] usb 1-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 558.314464][ T5805] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 558.314486][ T5805] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 558.314498][ T5805] usb 1-1: Product: syz [ 558.314506][ T5805] usb 1-1: Manufacturer: syz [ 558.314514][ T5805] usb 1-1: SerialNumber: syz [ 558.391746][ T5805] usb 1-1: config 0 descriptor?? [ 558.392571][ T9847] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 558.642386][ T9847] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 558.720716][ T9856] fuse: Unknown parameter '0x0000000000000004' [ 560.865391][ T5912] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 561.014928][ T5805] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 561.015370][ T5805] asix 1-1:0.188: probe with driver asix failed with error -32 [ 561.179927][ T5912] usb 3-1: Using ep0 maxpacket: 32 [ 561.230707][ T5912] usb 3-1: config index 0 descriptor too short (expected 29220, got 36) [ 561.230743][ T5912] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 561.230767][ T5912] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 561.230825][ T5912] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 561.230849][ T5912] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 561.230875][ T5912] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 561.230932][ T5912] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 561.230956][ T5912] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 561.319580][ T5912] usb 3-1: config 0 descriptor?? [ 561.645604][ T5805] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 562.095448][ T5805] usb 7-1: Using ep0 maxpacket: 16 [ 562.112131][ T5805] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 562.112199][ T5805] usb 7-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 562.112245][ T5805] usb 7-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 562.112260][ T5805] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 562.146251][ T5805] usb 7-1: config 0 descriptor?? [ 562.170826][ T5805] usbhid 7-1:0.0: couldn't find an input interrupt endpoint [ 562.208995][ T5912] usblp 3-1:0.0: usblp0: USB Bidirectional printer dev 33 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 562.242540][ T5912] usb 1-1: USB disconnect, device number 32 [ 562.609039][ T9884] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1045'. [ 562.943824][ C0] usblp0: nonzero read bulk status received: -71 [ 562.946624][ T5805] usb 3-1: USB disconnect, device number 33 [ 563.022486][ T9865] usblp0: removed [ 563.220705][ T9891] fuse: Unknown parameter '0x0000000000000004' [ 563.302579][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.302655][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.785761][ T5805] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 564.524405][ T10] usb 7-1: USB disconnect, device number 5 [ 564.605627][ T5805] usb 6-1: Using ep0 maxpacket: 16 [ 564.610884][ T5805] usb 6-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 564.610914][ T5805] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 564.610933][ T5805] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 564.617323][ T5805] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 564.617352][ T5805] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 564.617370][ T5805] usb 6-1: Product: syz [ 564.617383][ T5805] usb 6-1: Manufacturer: syz [ 564.617395][ T5805] usb 6-1: SerialNumber: syz [ 565.406404][ T5805] usb 6-1: 0:2 : does not exist [ 566.508100][ T5912] usb 6-1: USB disconnect, device number 6 [ 566.885391][ T5126] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 566.935470][ T31] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 567.035416][ T5126] usb 3-1: Using ep0 maxpacket: 16 [ 567.038524][ T5126] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 192, changing to 11 [ 567.038564][ T5126] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 8 [ 567.038589][ T5126] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 567.040443][ T5126] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 567.040471][ T5126] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 567.040492][ T5126] usb 3-1: SerialNumber: syz [ 567.115547][ T31] usb 7-1: Using ep0 maxpacket: 32 [ 567.252576][ T31] usb 7-1: config 0 has an invalid interface number: 188 but max is 0 [ 567.252607][ T31] usb 7-1: config 0 has no interface number 0 [ 567.252760][ T31] usb 7-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 567.366023][ T31] usb 7-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 567.368691][ T31] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 567.370409][ T31] usb 7-1: Product: syz [ 567.370807][ T31] usb 7-1: Manufacturer: syz [ 567.371111][ T31] usb 7-1: SerialNumber: syz [ 567.443003][ T9929] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1058'. [ 567.528442][ T9917] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 567.866186][ T31] usb 7-1: config 0 descriptor?? [ 567.872448][ T9921] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 568.010623][ T5126] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -22 [ 568.062071][ T5126] usb 3-1: USB disconnect, device number 34 [ 568.108702][ T9921] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 568.223175][ T9934] fuse: Unknown parameter '0x0000000000000004' [ 568.230174][ T9933] binder: 9931:9933 ioctl c0306201 0 returned -14 [ 568.231108][ T9933] binder: 9931:9933 ioctl c0306201 0 returned -14 [ 568.505459][ T5882] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 568.659945][ T5882] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 568.659982][ T5882] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 255 [ 568.689707][ T5882] usb 1-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 568.689742][ T5882] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 568.690026][ T5882] usb 1-1: Product: syz [ 568.690042][ T5882] usb 1-1: Manufacturer: syz [ 568.690057][ T5882] usb 1-1: SerialNumber: syz [ 568.742655][ T5882] usb 1-1: config 0 descriptor?? [ 568.753035][ T9936] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 568.754065][ T9936] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 569.063006][ T9936] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 569.074784][ T9936] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 569.395430][ T5805] usb 4-1: new full-speed USB device number 25 using dummy_hcd [ 569.508622][ T5882] Error reading MAC address [ 569.679957][ T31] asix 7-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 569.680903][ T31] asix 7-1:0.188: probe with driver asix failed with error -32 [ 569.739204][ T5805] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 569.739241][ T5805] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 569.739284][ T5805] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 569.739308][ T5805] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 569.795950][ T5805] usb 4-1: config 0 descriptor?? [ 569.804802][ T5805] hub 4-1:0.0: USB hub found [ 570.019951][ T5805] hub 4-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 570.430605][ T5805] usbhid 4-1:0.0: can't add hid device: -71 [ 570.430745][ T5805] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 570.756751][ T5805] usb 4-1: USB disconnect, device number 25 [ 570.818316][ T31] usb 7-1: USB disconnect, device number 6 [ 571.576816][ T9987] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1072'. [ 571.974914][ T931] usb 1-1: USB disconnect, device number 33 [ 572.394560][ T9993] fuse: Unknown parameter '0x0000000000000004' [ 572.410819][ T9994] binder: 9992:9994 ioctl c0306201 0 returned -14 [ 573.185414][ T5805] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 573.357001][ T5805] usb 7-1: Using ep0 maxpacket: 32 [ 573.370472][ T5805] usb 7-1: config 0 has an invalid interface number: 188 but max is 0 [ 573.370516][ T5805] usb 7-1: config 0 has no interface number 0 [ 573.370585][ T5805] usb 7-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 573.385579][ T5805] usb 7-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 573.385611][ T5805] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 573.385630][ T5805] usb 7-1: Product: syz [ 573.385642][ T5805] usb 7-1: Manufacturer: syz [ 573.385655][ T5805] usb 7-1: SerialNumber: syz [ 573.455380][ T5805] usb 7-1: config 0 descriptor?? [ 573.456973][T10007] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 573.680933][T10007] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 574.135687][ T5953] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 574.346014][ T5953] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 574.347101][ T5953] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 255 [ 574.371296][ T5953] usb 3-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 574.371381][ T5953] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 574.371401][ T5953] usb 3-1: Product: syz [ 574.371414][ T5953] usb 3-1: Manufacturer: syz [ 574.371427][ T5953] usb 3-1: SerialNumber: syz [ 574.550259][ T5953] usb 3-1: config 0 descriptor?? [ 574.564440][T10036] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 574.571971][T10036] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 574.716028][ T5805] asix 7-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 574.716552][ T5805] asix 7-1:0.188: probe with driver asix failed with error -32 [ 574.898409][T10036] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 574.899860][T10036] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 575.345855][ T31] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 575.608629][ T5953] Error reading MAC address [ 575.661830][T10056] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1088'. [ 575.893863][ T31] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 575.894424][ T31] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 575.894555][ T31] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 575.894975][ T31] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 575.895105][ T31] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 575.990710][ T31] usb 1-1: config 0 descriptor?? [ 576.058666][ T5805] usb 7-1: USB disconnect, device number 7 [ 576.355088][T10060] fuse: Unknown parameter '0x0000000000000004' [ 576.548543][ T31] plantronics 0003:047F:FFFF.000B: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 576.714925][ T5805] usb 1-1: USB disconnect, device number 34 [ 576.965008][T10067] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1092'. [ 576.965220][T10067] netlink: 'syz.6.1092': attribute type 30 has an invalid length. [ 577.157578][ T291] netdevsim netdevsim6 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 577.167416][ T8037] netdevsim netdevsim6 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 577.174356][ T71] netdevsim netdevsim6 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 577.174449][ T71] netdevsim netdevsim6 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 577.667237][ T5805] usb 3-1: USB disconnect, device number 35 [ 577.672239][T10071] binder: 10070:10071 ioctl c0306201 0 returned -14 [ 577.693593][ T5813] Bluetooth: hci4: connection err: -111 [ 578.203502][T10085] fuse: Unknown parameter 'fd0x0000000000000004' [ 578.597511][T10096] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1100'. [ 579.041194][T10095] ubi: mtd0 is already attached to ubi16 [ 579.305660][ T931] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 579.814679][ T931] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 579.814897][ T931] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 255 [ 580.046248][ T931] usb 7-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 580.046299][ T931] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 580.046357][ T931] usb 7-1: Product: syz [ 580.046372][ T931] usb 7-1: Manufacturer: syz [ 580.046439][ T931] usb 7-1: SerialNumber: syz [ 580.307165][ T931] usb 7-1: config 0 descriptor?? [ 580.321299][T10099] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 580.321588][T10099] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 580.735482][T10099] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 580.735644][T10099] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 581.149458][ T931] Error reading MAC address [ 581.229900][T10124] fuse: Unknown parameter 'fd0x0000000000000004' [ 583.168003][ T9] usb 7-1: USB disconnect, device number 8 [ 584.086339][ T31] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 584.315798][ T31] usb 4-1: Using ep0 maxpacket: 32 [ 584.319055][ T31] usb 4-1: config index 0 descriptor too short (expected 29220, got 36) [ 584.319085][ T31] usb 4-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 584.319106][ T31] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 584.319159][ T31] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 584.319183][ T31] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 584.319208][ T31] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 584.319252][ T31] usb 4-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 584.319277][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 584.664518][ T31] usb 4-1: config 0 descriptor?? [ 584.887863][ T31] usblp 4-1:0.0: usblp0: USB Bidirectional printer dev 26 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 585.147442][ C0] usblp0: nonzero read bulk status received: -71 [ 585.150501][T10152] usblp0: error -71 reading from printer [ 585.161403][ C0] usblp0: nonzero read bulk status received: -71 [ 585.177985][ T31] usb 4-1: USB disconnect, device number 26 [ 585.198188][T10152] usblp0: removed [ 585.236917][ T5953] Process accounting resumed [ 585.256401][T10175] Process accounting resumed [ 585.320449][T10177] faux_driver vkms: [drm] Unknown color mode 6; guessing buffer size. [ 585.853937][ T5953] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 586.437725][ T5953] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 586.437771][ T5953] usb 6-1: too many endpoints for config 0 interface 0 altsetting 0: 34, using maximum allowed: 30 [ 586.437797][ T5953] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 586.437809][ T5953] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 586.437823][ T5953] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 34 [ 586.437848][ T5953] usb 6-1: New USB device found, idVendor=0b48, idProduct=2003, bcdDevice=71.94 [ 586.437861][ T5953] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 586.443326][ T5953] usb 6-1: config 0 descriptor?? [ 586.467929][ T5953] ttusbir 6-1:0.0: cannot find expected altsetting [ 586.935407][T10202] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 588.665658][ T5953] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 589.788876][ T5953] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 589.788914][ T5953] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 589.788937][ T5953] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 589.788964][ T5953] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 589.792014][ T5953] usb 1-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 589.792044][ T5953] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 589.792065][ T5953] usb 1-1: Product: syz [ 589.792079][ T5953] usb 1-1: Manufacturer: syz [ 589.792094][ T5953] usb 1-1: SerialNumber: syz [ 589.812824][ T5953] usb 1-1: config 0 descriptor?? [ 589.964331][ T5912] usb 6-1: USB disconnect, device number 7 [ 590.061271][T10220] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1151'. [ 590.061310][T10220] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1151'. [ 590.096889][ T5953] adutux 1-1:0.0: ADU208 now attached to /dev/usb/adutux0 [ 590.175393][ T5953] usb 1-1: USB disconnect, device number 35 [ 590.625462][ T5912] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 590.775492][ T5912] usb 3-1: Using ep0 maxpacket: 32 [ 590.778191][ T5912] usb 3-1: config index 0 descriptor too short (expected 29220, got 36) [ 590.778220][ T5912] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 590.778242][ T5912] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 590.778297][ T5912] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 590.778321][ T5912] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 590.778346][ T5912] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 590.778389][ T5912] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 590.778413][ T5912] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 590.877243][ T5912] usb 3-1: config 0 descriptor?? [ 591.499764][ T5912] usblp 3-1:0.0: usblp0: USB Bidirectional printer dev 36 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 591.748088][ T5953] usb 3-1: USB disconnect, device number 36 [ 591.849894][T10250] trusted_key: encrypted_key: insufficient parameters specified [ 592.326803][ T5953] usblp0: removed [ 592.455458][ T9] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 592.667341][ T5813] Bluetooth: hci4: unexpected event for opcode 0x0002 [ 593.513770][ T9] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 593.513819][ T9] usb 7-1: too many endpoints for config 0 interface 0 altsetting 0: 34, using maximum allowed: 30 [ 593.513864][ T9] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 593.513888][ T9] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 593.513912][ T9] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 34 [ 593.513958][ T9] usb 7-1: New USB device found, idVendor=0b48, idProduct=2003, bcdDevice=71.94 [ 593.513982][ T9] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 593.537560][ T9] usb 7-1: config 0 descriptor?? [ 593.605529][ T9] ttusbir 7-1:0.0: cannot find expected altsetting [ 593.963509][T10259] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 594.999250][T10272] autofs: Bad value for 'fd' [ 595.388476][ T9] usb 7-1: USB disconnect, device number 9 [ 595.688046][ T5953] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 595.841636][ T5813] Bluetooth: hci2: unexpected event for opcode 0x0002 [ 595.905976][ T5953] usb 6-1: Using ep0 maxpacket: 32 [ 596.275434][ T5953] usb 6-1: config index 0 descriptor too short (expected 29220, got 36) [ 596.275467][ T5953] usb 6-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 596.275490][ T5953] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 596.275547][ T5953] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 596.275569][ T5953] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 596.275595][ T5953] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 596.275642][ T5953] usb 6-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 596.275675][ T5953] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 596.545081][ T5953] usb 6-1: config 0 descriptor?? [ 596.976596][T10297] ubi: mtd0 is already attached to ubi16 [ 597.248086][ T931] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 597.328153][ T5953] usblp 6-1:0.0: usblp0: USB Bidirectional printer dev 8 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 597.360183][ T5912] usb 6-1: USB disconnect, device number 8 [ 597.376760][ T5912] usblp0: removed [ 597.495988][ T931] usb 4-1: Using ep0 maxpacket: 32 [ 597.499122][ T931] usb 4-1: config 1 interface 0 altsetting 3 endpoint 0x81 has an invalid bInterval 254, changing to 11 [ 597.499146][ T931] usb 4-1: config 1 interface 0 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 597.499163][ T931] usb 4-1: config 1 interface 0 has no altsetting 0 [ 597.502449][ T931] usb 4-1: New USB device found, idVendor=056a, idProduct=00c4, bcdDevice= 0.40 [ 597.502474][ T931] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 597.502503][ T931] usb 4-1: Product: 㢯ᡒᤆ䩋劮橌图ᖀ옓縝ꡋ兩㵦郍㉽웞艒䁹ტ⑶㦏䚬铀籀떋笡荂잹 [ 597.502524][ T931] usb 4-1: Manufacturer: щ [ 597.502538][ T931] usb 4-1: SerialNumber: syz [ 597.758960][ T931] usbhid 4-1:1.0: can't add hid device: -71 [ 597.759054][ T931] usbhid 4-1:1.0: probe with driver usbhid failed with error -71 [ 597.785877][ T931] usb 4-1: USB disconnect, device number 27 [ 599.614729][T10316] binder: 10312:10316 ioctl c0306201 0 returned -14 [ 599.813195][T10318] 9p: Bad value for 'rfdno' [ 599.865408][ T5912] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 600.060074][ T5912] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 600.060348][ T5912] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 34, using maximum allowed: 30 [ 600.106113][ T5912] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 600.106211][ T5912] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 600.106420][ T5912] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 34 [ 600.108779][ T5912] usb 3-1: New USB device found, idVendor=0b48, idProduct=2003, bcdDevice=71.94 [ 600.113238][ T5912] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 600.722466][T10327] ubi: mtd0 is already attached to ubi16 [ 600.742702][ T5912] usb 3-1: config 0 descriptor?? [ 600.763055][ T5912] ttusbir 3-1:0.0: cannot find expected altsetting [ 600.825725][T10330] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 601.225917][ T5953] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 601.235505][ T9] usb 3-1: USB disconnect, device number 37 [ 601.239780][ T5912] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 601.408817][ T5953] usb 7-1: Using ep0 maxpacket: 32 [ 601.411129][ T5953] usb 7-1: config 0 has an invalid interface number: 188 but max is 0 [ 601.411158][ T5953] usb 7-1: config 0 has no interface number 0 [ 601.411208][ T5953] usb 7-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 601.415412][ T5912] usb 4-1: Using ep0 maxpacket: 32 [ 601.442036][ T5912] usb 4-1: config index 0 descriptor too short (expected 29220, got 36) [ 601.442069][ T5912] usb 4-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 601.442101][ T5912] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 601.442776][ T5912] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 601.442803][ T5912] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 601.442828][ T5912] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 601.442875][ T5912] usb 4-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 601.442899][ T5912] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 601.638312][ T5912] usb 4-1: config 0 descriptor?? [ 601.674827][ T5953] usb 7-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 601.674862][ T5953] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 601.674883][ T5953] usb 7-1: Product: syz [ 601.674898][ T5953] usb 7-1: Manufacturer: syz [ 601.674913][ T5953] usb 7-1: SerialNumber: syz [ 601.699029][ T5953] usb 7-1: config 0 descriptor?? [ 601.759352][T10337] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 601.835367][ T10] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 601.973201][T10337] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 601.985434][ T10] usb 6-1: Using ep0 maxpacket: 16 [ 601.989539][ T10] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 192, changing to 11 [ 601.989572][ T10] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 8 [ 601.989597][ T10] usb 6-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 601.991938][ T10] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 601.992028][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 601.992046][ T10] usb 6-1: SerialNumber: syz [ 602.045131][ T5912] usblp 4-1:0.0: usblp0: USB Bidirectional printer dev 28 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 602.084125][T10339] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 602.590778][ T10] cdc_ether 6-1:1.0: probe with driver cdc_ether failed with error -71 [ 602.642764][ T10] usb 6-1: USB disconnect, device number 9 [ 602.653621][ T5805] usb 4-1: USB disconnect, device number 28 [ 603.314537][ T5805] usblp0: removed [ 603.469668][ T5953] asix 7-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 603.469990][ T5953] asix 7-1:0.188: probe with driver asix failed with error -61 [ 603.511270][T10361] netlink: 14 bytes leftover after parsing attributes in process `syz.5.1204'. [ 603.718929][T10366] ubi: mtd0 is already attached to ubi16 [ 604.715381][ T5912] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 604.811963][T10380] netlink: 104 bytes leftover after parsing attributes in process `syz.5.1210'. [ 604.869051][ T5912] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 604.869099][ T5912] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 34, using maximum allowed: 30 [ 604.869143][ T5912] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 604.869166][ T5912] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 604.869191][ T5912] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 34 [ 604.869237][ T5912] usb 3-1: New USB device found, idVendor=0b48, idProduct=2003, bcdDevice=71.94 [ 604.869261][ T5912] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 604.955460][ T5912] usb 3-1: config 0 descriptor?? [ 604.962055][ T5912] ttusbir 3-1:0.0: cannot find expected altsetting [ 605.067360][ T931] usb 7-1: USB disconnect, device number 10 [ 606.227568][ T5813] Bluetooth: hci5: unexpected event for opcode 0x0002 [ 606.443592][T10394] veth1_macvtap: left promiscuous mode [ 606.721966][ T931] usb 3-1: USB disconnect, device number 38 [ 607.027572][ T5912] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 607.182513][ T5912] usb 6-1: Using ep0 maxpacket: 16 [ 607.194658][ T5912] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 192, changing to 11 [ 607.194682][ T5912] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 8 [ 607.194703][ T5912] usb 6-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 607.241481][ T5912] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 607.241518][ T5912] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 607.241539][ T5912] usb 6-1: SerialNumber: syz [ 607.423722][T10406] ubi: mtd0 is already attached to ubi16 [ 607.860834][T10397] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 608.068963][ T5912] cdc_ether 6-1:1.0: probe with driver cdc_ether failed with error -71 [ 608.125892][ T5912] usb 6-1: USB disconnect, device number 10 [ 609.540553][ T5460] veth1_macvtap: entered promiscuous mode [ 609.751735][ T5813] Bluetooth: hci4: unexpected event for opcode 0x0002 [ 612.738345][T10512] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1250'. [ 614.115393][ T931] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 614.134413][T10531] binder: 10529:10531 ioctl c0306201 0 returned -14 [ 614.272675][ T931] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 614.272713][ T931] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 255 [ 614.297460][ T931] usb 7-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 614.297493][ T931] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 614.297514][ T931] usb 7-1: Product: syz [ 614.297528][ T931] usb 7-1: Manufacturer: syz [ 614.297543][ T931] usb 7-1: SerialNumber: syz [ 614.304375][ T931] usb 7-1: config 0 descriptor?? [ 614.311029][T10525] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 614.311152][T10525] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 614.520553][T10525] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 614.520698][T10525] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 614.625735][ T5912] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 614.775378][ T5912] usb 4-1: Using ep0 maxpacket: 32 [ 614.780974][ T5912] usb 4-1: config 0 has an invalid interface number: 188 but max is 0 [ 614.781007][ T5912] usb 4-1: config 0 has no interface number 0 [ 614.781311][ T5912] usb 4-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 614.819110][ T5912] usb 4-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 614.819131][ T5912] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 614.819143][ T5912] usb 4-1: Product: syz [ 614.819152][ T5912] usb 4-1: Manufacturer: syz [ 614.819160][ T5912] usb 4-1: SerialNumber: syz [ 614.868009][ T5912] usb 4-1: config 0 descriptor?? [ 614.869914][T10535] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 614.923771][ T931] Error reading MAC address [ 615.107308][T10535] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 616.378137][ T931] usb 7-1: USB disconnect, device number 11 [ 616.494021][T10558] fuse: Unknown parameter '0x0000000000000004' [ 616.960262][ T5912] asix 4-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 616.960589][ T5912] asix 4-1:0.188: probe with driver asix failed with error -71 [ 617.021526][ T5912] usb 4-1: USB disconnect, device number 29 [ 617.296503][T10571] binder: 10570:10571 ioctl c0306201 0 returned -14 [ 618.921517][ T5813] Bluetooth: hci4: unexpected event for opcode 0x0002 [ 619.408231][ T10] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 619.588183][ T10] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 619.588207][ T10] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 255 [ 619.590155][ T10] usb 3-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 619.590183][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 619.590204][ T10] usb 3-1: Product: syz [ 619.590219][ T10] usb 3-1: Manufacturer: syz [ 619.590232][ T10] usb 3-1: SerialNumber: syz [ 619.593738][ T10] usb 3-1: config 0 descriptor?? [ 619.594504][T10587] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 619.594629][T10587] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 619.821530][T10587] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 619.821666][T10587] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 620.245136][ T10] Error reading MAC address [ 620.367184][T10616] binder: 10615:10616 ioctl c0306201 0 returned -14 [ 620.805353][ T10] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 620.965714][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 620.968630][ T10] usb 4-1: config 0 has no interfaces? [ 620.971848][ T10] usb 4-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 1.88 [ 620.971876][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 620.971895][ T10] usb 4-1: Product: syz [ 620.971909][ T10] usb 4-1: Manufacturer: syz [ 620.971922][ T10] usb 4-1: SerialNumber: syz [ 621.029805][ T10] usb 4-1: config 0 descriptor?? [ 621.444658][ T931] usb 4-1: USB disconnect, device number 30 [ 621.456520][T10628] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1285'. [ 621.989594][ T31] usb 3-1: USB disconnect, device number 39 [ 622.941036][T10650] binder: 10647:10650 ioctl c0306201 0 returned -14 [ 624.247745][ T5805] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 624.519400][T10670] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1298'. [ 624.610212][ T5805] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 624.610249][ T5805] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 255 [ 624.638691][ T5805] usb 3-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 624.638724][ T5805] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 624.638742][ T5805] usb 3-1: Product: syz [ 624.638754][ T5805] usb 3-1: Manufacturer: syz [ 624.638764][ T5805] usb 3-1: SerialNumber: syz [ 624.649667][ T5805] usb 3-1: config 0 descriptor?? [ 624.666060][T10665] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 624.666256][T10665] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 624.751151][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.751200][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.878948][T10665] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 624.879077][T10665] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 625.180385][T10679] fuse: Unknown parameter 'fd0x0000000000000004' [ 625.207145][ T931] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 625.283091][ T5805] Error reading MAC address [ 625.355496][ T931] usb 1-1: Using ep0 maxpacket: 16 [ 625.358340][ T931] usb 1-1: config 0 has no interfaces? [ 625.385509][ T931] usb 1-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 1.88 [ 625.385542][ T931] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 625.385562][ T931] usb 1-1: Product: syz [ 625.385587][ T931] usb 1-1: Manufacturer: syz [ 625.385603][ T931] usb 1-1: SerialNumber: syz [ 625.393626][ T931] usb 1-1: config 0 descriptor?? [ 625.859221][ T931] usb 1-1: USB disconnect, device number 36 [ 626.635541][ T5953] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 626.664666][T10695] binder: 10694:10695 ioctl c0306201 0 returned -14 [ 626.785390][ T5953] usb 4-1: Using ep0 maxpacket: 16 [ 626.787346][ T5953] usb 4-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 626.787363][ T5953] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 626.787375][ T5953] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 626.792319][ T5953] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 626.792340][ T5953] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 626.792359][ T5953] usb 4-1: Product: syz [ 626.792372][ T5953] usb 4-1: Manufacturer: syz [ 626.792386][ T5953] usb 4-1: SerialNumber: syz [ 626.900950][ T10] usb 3-1: USB disconnect, device number 40 [ 627.242093][ T5953] usb 4-1: 0:2 : does not exist [ 628.116205][ T5912] usb 4-1: USB disconnect, device number 31 [ 628.288860][T10709] Invalid logical block size (8192) [ 628.545900][T10718] fuse: Unknown parameter 'fd0x0000000000000004' [ 629.177665][T10727] Bluetooth: hci0: invalid length 0, exp 2 for type 19 [ 629.396547][T10735] binder: 10734:10735 ioctl c0306201 0 returned -14 [ 631.514120][T10787] binder: 10786:10787 ioctl c0306201 0 returned -14 [ 632.878268][ T5912] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 633.028062][T10812] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 633.028772][ T5912] usb 7-1: Using ep0 maxpacket: 16 [ 633.031415][ T5912] usb 7-1: config 0 has no interfaces? [ 633.034605][ T5912] usb 7-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 1.88 [ 633.034634][ T5912] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 633.034655][ T5912] usb 7-1: Product: syz [ 633.034669][ T5912] usb 7-1: Manufacturer: syz [ 633.034684][ T5912] usb 7-1: SerialNumber: syz [ 633.098038][ T5912] usb 7-1: config 0 descriptor?? [ 633.910556][ T5912] usb 7-1: USB disconnect, device number 12 [ 635.821340][T10856] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 636.801691][T10887] binder: 10886:10887 ioctl c0306201 0 returned -14 [ 637.466851][T10899] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 638.259195][T10910] fuse: Unknown parameter '0x0000000000000003' [ 638.620908][T10919] binder: 10917:10919 ioctl c0306201 0 returned -14 [ 641.122811][T10946] fuse: Unknown parameter '0x0000000000000003' [ 642.184291][T10975] process 'syz.0.1394' launched './file0' with NULL argv: empty string added [ 642.706275][T10974] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1393'. [ 643.228181][T10980] fuse: Unknown parameter '0x0000000000000003' [ 643.955533][ T5866] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 644.105443][ T5866] usb 6-1: Using ep0 maxpacket: 16 [ 644.108434][ T5866] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 192, changing to 11 [ 644.108471][ T5866] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 8 [ 644.108498][ T5866] usb 6-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 644.110408][ T5866] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 644.110438][ T5866] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 644.110460][ T5866] usb 6-1: SerialNumber: syz [ 644.418933][T10996] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 644.635759][ T5866] cdc_ether 6-1:1.0: probe with driver cdc_ether failed with error -71 [ 644.645451][ T5912] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 644.681209][ T5866] usb 6-1: USB disconnect, device number 11 [ 644.827037][ T5912] usb 3-1: config index 0 descriptor too short (expected 39, got 27) [ 644.827104][ T5912] usb 3-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 644.827129][ T5912] usb 3-1: config 0 interface 0 has no altsetting 0 [ 644.830341][ T5912] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 644.830372][ T5912] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 644.830393][ T5912] usb 3-1: Product: syz [ 644.830408][ T5912] usb 3-1: Manufacturer: syz [ 644.830421][ T5912] usb 3-1: SerialNumber: syz [ 644.911450][ T5912] usb 3-1: config 0 descriptor?? [ 644.932196][ T5912] hub 3-1:0.0: bad descriptor, ignoring hub [ 644.932238][ T5912] hub 3-1:0.0: probe with driver hub failed with error -5 [ 644.961304][ T5912] usb 3-1: selecting invalid altsetting 0 [ 645.708476][T11023] fuse: Unknown parameter '0x0000000000000003' [ 645.984159][ T5912] usb 3-1: reset high-speed USB device number 41 using dummy_hcd [ 646.325435][ T31] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 646.475571][ T31] usb 6-1: Using ep0 maxpacket: 16 [ 646.496145][ T31] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 646.496182][ T31] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 646.496205][ T31] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 646.496252][ T31] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 646.496276][ T31] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 646.503522][T11036] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 646.510462][ T31] usb 6-1: config 0 descriptor?? [ 646.862226][ T5912] usb 3-1: USB disconnect, device number 41 [ 646.882998][T11042] ubi: mtd0 is already attached to ubi16 [ 647.869179][ T31] usbhid 6-1:0.0: can't add hid device: -71 [ 647.869270][ T31] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 647.938904][ T31] usb 6-1: USB disconnect, device number 12 [ 647.985163][T11049] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1421'. [ 648.038682][T11051] syz.6.1423: vmalloc error: size 70368744185856, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 648.039069][T11051] CPU: 1 UID: 0 PID: 11051 Comm: syz.6.1423 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 648.039096][T11051] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 648.039109][T11051] Call Trace: [ 648.039119][T11051] [ 648.039129][T11051] dump_stack_lvl+0xe8/0x150 [ 648.039308][T11051] warn_alloc+0x263/0x3e0 [ 648.039406][T11051] ? kasan_save_track+0x4f/0x80 [ 648.039492][T11051] ? kasan_save_track+0x3e/0x80 [ 648.039521][T11051] ? kasan_save_free_info+0x46/0x50 [ 648.039567][T11051] ? __kasan_slab_free+0x5c/0x80 [ 648.039599][T11051] ? tomoyo_path_number_perm+0x501/0x630 [ 648.039693][T11051] ? security_file_ioctl+0xc3/0x2a0 [ 648.039764][T11051] ? __se_sys_ioctl+0x47/0x170 [ 648.039824][T11051] ? __pfx_warn_alloc+0x10/0x10 [ 648.039871][T11051] __vmalloc_node_range_noprof+0x132/0x1730 [ 648.039925][T11051] ? look_up_lock_class+0x57/0x110 [ 648.040020][T11051] ? register_lock_class+0x31/0x2e0 [ 648.040080][T11051] ? __lock_acquire+0x6b5/0x2cf0 [ 648.040127][T11051] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 648.040174][T11051] ? dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 648.040281][T11051] vmalloc_noprof+0xb2/0xe0 [ 648.040314][T11051] ? dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 648.040350][T11051] dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 648.040383][T11051] ? dvb_demux_do_ioctl+0x323/0x540 [ 648.040427][T11051] dvb_demux_do_ioctl+0x460/0x540 [ 648.040464][T11051] dvb_usercopy+0x199/0x2e0 [ 648.040493][T11051] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 648.040525][T11051] ? __pfx_dvb_usercopy+0x10/0x10 [ 648.040570][T11051] ? __fget_files+0x3a6/0x420 [ 648.040641][T11051] ? __fget_files+0x2a/0x420 [ 648.040674][T11051] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 648.040705][T11051] dvb_demux_ioctl+0x29/0x40 [ 648.040738][T11051] __se_sys_ioctl+0xff/0x170 [ 648.040764][T11051] do_syscall_64+0x14d/0xf80 [ 648.040815][T11051] ? trace_irq_disable+0x3b/0x150 [ 648.040858][T11051] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 648.040902][T11051] ? clear_bhb_loop+0x40/0x90 [ 648.040930][T11051] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 648.040953][T11051] RIP: 0033:0x7f335b61c819 [ 648.040976][T11051] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 648.041007][T11051] RSP: 002b:00007f335986e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 648.041033][T11051] RAX: ffffffffffffffda RBX: 00007f335b895fa0 RCX: 00007f335b61c819 [ 648.041049][T11051] RDX: 0000400000002000 RSI: 0000000000006f2d RDI: 0000000000000003 [ 648.041064][T11051] RBP: 00007f335b6b2c91 R08: 0000000000000000 R09: 0000000000000000 [ 648.041077][T11051] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 648.041091][T11051] R13: 00007f335b896038 R14: 00007f335b895fa0 R15: 00007ffe69625fd8 [ 648.041151][T11051] [ 648.041160][T11051] Mem-Info: [ 648.041169][T11051] active_anon:270 inactive_anon:8129 isolated_anon:0 [ 648.041169][T11051] active_file:20028 inactive_file:37066 isolated_file:0 [ 648.041169][T11051] unevictable:807 dirty:136 writeback:0 [ 648.041169][T11051] slab_reclaimable:12173 slab_unreclaimable:105644 [ 648.041169][T11051] mapped:31261 shmem:1415 pagetables:1754 [ 648.041169][T11051] sec_pagetables:0 bounce:0 [ 648.041169][T11051] kernel_misc_reclaimable:0 [ 648.041169][T11051] free:1309210 free_pcp:4597 free_cma:0 [ 648.060421][T11051] Node 0 active_anon:1080kB inactive_anon:32516kB active_file:79912kB inactive_file:148264kB unevictable:1692kB isolated(anon):0kB isolated(file):0kB mapped:125044kB dirty:544kB writeback:0kB shmem:4124kB kernel_stack:14168kB pagetables:6844kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 648.060470][T11051] Node 1 active_anon:0kB inactive_anon:0kB active_file:200kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB kernel_stack:96kB pagetables:172kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 648.060512][T11051] Node 0 DMA free:15360kB boost:0kB min:20kB low:32kB high:44kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 648.060571][T11051] lowmem_reserve[]: 0 2506 2506 2506 2506 [ 648.060607][T11051] Node 0 DMA32 free:1279944kB boost:0kB min:3932kB low:6468kB high:9004kB reserved_highatomic:0KB free_highatomic:0KB active_anon:1080kB inactive_anon:32516kB active_file:79912kB inactive_file:148264kB unevictable:1692kB writepending:544kB zspages:0kB present:3129332kB managed:2566412kB mlocked:0kB bounce:0kB free_pcp:18388kB local_pcp:7336kB free_cma:0kB [ 648.060665][T11051] lowmem_reserve[]: 0 0 0 0 0 [ 648.060695][T11051] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:412kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 648.060746][T11051] lowmem_reserve[]: 0 0 0 0 0 [ 648.060777][T11051] Node 1 Normal free:3941536kB boost:0kB min:6364kB low:10472kB high:14580kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:200kB inactive_file:0kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 648.060830][T11051] lowmem_reserve[]: 0 0 0 0 0 [ 648.060861][T11051] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 648.062009][T11051] Node 0 DMA32: 3965*4kB (UME) 2709*8kB (UM) 1395*16kB (UME) 191*32kB (UME) 243*64kB (UME) 373*128kB (UME) 261*256kB (UME) 187*512kB (UM) 109*1024kB (UME) 32*2048kB (UME) 198*4096kB (UME) = 1279980kB [ 648.062165][T11051] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 648.062260][T11051] Node 1 Normal: 2*4kB (UM) 5*8kB (UM) 5*16kB (UM) 5*32kB (UM) 6*64kB (UM) 4*128kB (UM) 2*256kB (M) 3*512kB (UM) 2*1024kB (UM) 0*2048kB 961*4096kB (UM) = 3941536kB [ 648.062447][T11051] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 648.062465][T11051] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 648.062481][T11051] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 648.062496][T11051] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 648.069956][T11051] 58505 total pagecache pages [ 648.069968][T11051] 0 pages in swap cache [ 648.069977][T11051] Free swap = 124996kB [ 648.069984][T11051] Total swap = 124996kB [ 648.069993][T11051] 2097051 pages RAM [ 648.070000][T11051] 0 pages HighMem/MovableOnly [ 648.070007][T11051] 423730 pages reserved [ 648.070014][T11051] 0 pages cma reserved [ 649.971834][T11083] ubi: mtd0 is already attached to ubi16 [ 650.825581][ T5805] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 651.265330][ T5805] usb 4-1: Using ep0 maxpacket: 16 [ 651.303675][ T5805] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 651.303713][ T5805] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 651.303737][ T5805] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 651.303783][ T5805] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 651.303807][ T5805] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 651.378413][ T5805] usb 4-1: config 0 descriptor?? [ 652.228448][T11115] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 652.323073][ T5805] usbhid 4-1:0.0: can't add hid device: -71 [ 652.323166][ T5805] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 652.341650][ T5805] usb 4-1: USB disconnect, device number 32 [ 653.147246][ T5805] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 654.825344][ T5805] usb 1-1: Using ep0 maxpacket: 16 [ 654.827955][ T5805] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 192, changing to 11 [ 654.827993][ T5805] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 8 [ 654.828019][ T5805] usb 1-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 654.829554][ T5805] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 654.829581][ T5805] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 654.829602][ T5805] usb 1-1: SerialNumber: syz [ 654.888767][T11135] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1452'. [ 654.913256][T11121] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 655.134604][ T5805] cdc_ether 1-1:1.0: probe with driver cdc_ether failed with error -22 [ 655.153571][ T5805] usb 1-1: USB disconnect, device number 37 [ 656.324092][T11174] sp0: Synchronizing with TNC [ 658.212968][T11202] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 662.698143][T11258] sp0: Synchronizing with TNC [ 663.029128][T11261] Process accounting resumed [ 663.353003][T11277] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 663.827535][ T31] usb 4-1: new full-speed USB device number 33 using dummy_hcd [ 664.357905][ T31] usb 4-1: New USB device found, idVendor=13d3, idProduct=3224, bcdDevice=cb.0d [ 664.357941][ T31] usb 4-1: New USB device strings: Mfr=1, Product=12, SerialNumber=3 [ 664.357963][ T31] usb 4-1: Product: syz [ 664.357978][ T31] usb 4-1: Manufacturer: syz [ 664.357992][ T31] usb 4-1: SerialNumber: syz [ 664.397476][ T31] dvb-usb: found a 'DigitalNow TinyUSB 2 DVB-t Receiver' in warm state. [ 664.608695][ T31] vp7045: USB control message 'out' went wrong. [ 664.608716][ T31] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 664.608759][ T31] dvb-usb: DigitalNow TinyUSB 2 DVB-t Receiver error while loading driver (-19) [ 664.644412][ T31] usb 4-1: USB disconnect, device number 33 [ 664.897454][T11302] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 666.050040][T11334] Bluetooth: hci0: invalid length 0, exp 2 for type 14 [ 666.068178][T11333] netlink: 14 bytes leftover after parsing attributes in process `syz.2.1521'. [ 666.399035][T11343] netdevsim netdevsim3: Firmware load for '/../file0' refused, path contains '..' component [ 666.822177][T11361] Bluetooth: hci0: invalid length 0, exp 2 for type 14 [ 668.317268][ T10] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 668.516975][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 669.786857][ T10] usb 1-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 669.786887][ T10] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 669.786907][ T10] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 669.790049][ T10] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 669.790080][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 669.790100][ T10] usb 1-1: Product: syz [ 669.790115][ T10] usb 1-1: Manufacturer: syz [ 669.790129][ T10] usb 1-1: SerialNumber: syz [ 670.256662][ T10] usb 1-1: 0:2 : does not exist [ 671.296439][ T5813] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 671.296470][ T5813] CPU: 1 UID: 0 PID: 5813 Comm: kworker/u9:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 671.296496][ T5813] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 671.296510][ T5813] Workqueue: hci3 hci_rx_work [ 671.296659][ T5813] Call Trace: [ 671.296667][ T5813] [ 671.296678][ T5813] dump_stack_lvl+0xe8/0x150 [ 671.296716][ T5813] sysfs_create_dir_ns+0x271/0x2a0 [ 671.296816][ T5813] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 671.296926][ T5813] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 671.296959][ T5813] ? rt_spin_unlock+0x160/0x200 [ 671.296995][ T5813] kobject_add_internal+0x631/0xd10 [ 671.297059][ T5813] kobject_add+0x163/0x240 [ 671.297095][ T5813] ? __pfx_kobject_add+0x10/0x10 [ 671.297134][ T5813] ? get_device_parent+0x370/0x3a0 [ 671.297233][ T5813] device_add+0x408/0xb80 [ 671.297266][ T5813] hci_conn_add_sysfs+0xd5/0x210 [ 671.297352][ T5813] le_conn_complete_evt+0x10e6/0x16b0 [ 671.297433][ T5813] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 671.297464][ T5813] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 671.297512][ T5813] ? lockdep_hardirqs_on+0x7a/0x110 [ 671.297541][ T5813] ? skb_pull_data+0xfb/0x200 [ 671.297626][ T5813] hci_le_conn_complete_evt+0x187/0x470 [ 671.297665][ T5813] hci_event_packet+0x659/0xef0 [ 671.297698][ T5813] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 671.297732][ T5813] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 671.297759][ T5813] ? __pfx_hci_event_packet+0x10/0x10 [ 671.297782][ T5813] ? rt_spin_unlock+0x14f/0x200 [ 671.297827][ T5813] ? hci_send_to_monitor+0xe2/0x590 [ 671.297862][ T5813] hci_rx_work+0x3ee/0x1030 [ 671.297896][ T5813] ? process_scheduled_works+0xa8d/0x18c0 [ 671.297945][ T5813] process_scheduled_works+0xb6e/0x18c0 [ 671.298025][ T5813] ? __pfx_process_scheduled_works+0x10/0x10 [ 671.298063][ T5813] ? assign_work+0x3d5/0x5e0 [ 671.298101][ T5813] worker_thread+0xa53/0xfc0 [ 671.298166][ T5813] kthread+0x388/0x470 [ 671.298192][ T5813] ? __pfx_worker_thread+0x10/0x10 [ 671.298235][ T5813] ? __pfx_kthread+0x10/0x10 [ 671.298267][ T5813] ret_from_fork+0x51e/0xb90 [ 671.298331][ T5813] ? __pfx_ret_from_fork+0x10/0x10 [ 671.298360][ T5813] ? __switch_to+0xc7d/0x1450 [ 671.298413][ T5813] ? __pfx_kthread+0x10/0x10 [ 671.298439][ T5813] ret_from_fork_asm+0x1a/0x30 [ 671.298481][ T5813] [ 671.877375][ T5813] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 671.887609][ T5813] Bluetooth: hci3: failed to register connection device [ 672.317957][ T5813] ================================================================== [ 672.317976][ T5813] BUG: KASAN: slab-use-after-free in l2cap_sock_ready_cb+0xe3/0x180 [ 672.318081][ T5813] Read of size 8 at addr ffff88805e33b200 by task kworker/u9:7/5813 [ 672.318100][ T5813] [ 672.318113][ T5813] CPU: 1 UID: 0 PID: 5813 Comm: kworker/u9:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 672.318137][ T5813] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 672.318150][ T5813] Workqueue: hci3 hci_rx_work [ 672.318175][ T5813] Call Trace: [ 672.318185][ T5813] [ 672.318193][ T5813] dump_stack_lvl+0xe8/0x150 [ 672.318224][ T5813] print_report+0xba/0x230 [ 672.318269][ T5813] ? l2cap_sock_ready_cb+0xe3/0x180 [ 672.318287][ T5813] kasan_report+0x117/0x150 [ 672.318308][ T5813] ? l2cap_sock_ready_cb+0xe3/0x180 [ 672.318329][ T5813] l2cap_sock_ready_cb+0xe3/0x180 [ 672.318345][ T5813] l2cap_le_start+0x25b/0x1960 [ 672.318369][ T5813] ? __pfx_l2cap_le_start+0x10/0x10 [ 672.318392][ T5813] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 672.318412][ T5813] ? lockdep_hardirqs_on+0x7a/0x110 [ 672.318431][ T5813] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 672.318449][ T5813] ? mutex_lock_nested+0x152/0x1d0 [ 672.318472][ T5813] ? l2cap_connect_cfm+0x894/0x1560 [ 672.318495][ T5813] l2cap_connect_cfm+0x8d5/0x1560 [ 672.318520][ T5813] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 672.318542][ T5813] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 672.318561][ T5813] ? lockdep_hardirqs_on+0x7a/0x110 [ 672.318579][ T5813] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 672.318597][ T5813] ? mutex_lock_nested+0x152/0x1d0 [ 672.318618][ T5813] ? hci_connect_cfm+0x2c/0x140 [ 672.318636][ T5813] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 672.318658][ T5813] hci_connect_cfm+0x95/0x140 [ 672.318677][ T5813] le_conn_complete_evt+0x1134/0x16b0 [ 672.318700][ T5813] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 672.318720][ T5813] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 672.318738][ T5813] ? lockdep_hardirqs_on+0x7a/0x110 [ 672.318755][ T5813] ? skb_pull_data+0xfb/0x200 [ 672.318777][ T5813] hci_le_conn_complete_evt+0x187/0x470 [ 672.318798][ T5813] hci_event_packet+0x659/0xef0 [ 672.318816][ T5813] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 672.318838][ T5813] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 672.318856][ T5813] ? __pfx_hci_event_packet+0x10/0x10 [ 672.318871][ T5813] ? rt_spin_unlock+0x14f/0x200 [ 672.318896][ T5813] ? hci_send_to_monitor+0xe2/0x590 [ 672.318918][ T5813] hci_rx_work+0x3ee/0x1030 [ 672.318935][ T5813] ? process_scheduled_works+0xa8d/0x18c0 [ 672.318958][ T5813] process_scheduled_works+0xb6e/0x18c0 [ 672.318989][ T5813] ? __pfx_process_scheduled_works+0x10/0x10 [ 672.319014][ T5813] ? assign_work+0x3d5/0x5e0 [ 672.319036][ T5813] worker_thread+0xa53/0xfc0 [ 672.319066][ T5813] kthread+0x388/0x470 [ 672.319082][ T5813] ? __pfx_worker_thread+0x10/0x10 [ 672.319103][ T5813] ? __pfx_kthread+0x10/0x10 [ 672.319119][ T5813] ret_from_fork+0x51e/0xb90 [ 672.319142][ T5813] ? __pfx_ret_from_fork+0x10/0x10 [ 672.319162][ T5813] ? __switch_to+0xc7d/0x1450 [ 672.319182][ T5813] ? __pfx_kthread+0x10/0x10 [ 672.319198][ T5813] ret_from_fork_asm+0x1a/0x30 [ 672.319218][ T5813] [ 672.319224][ T5813] [ 672.319228][ T5813] Allocated by task 11448: [ 672.319236][ T5813] kasan_save_track+0x3e/0x80 [ 672.319264][ T5813] __kasan_kmalloc+0x93/0xb0 [ 672.319284][ T5813] __kmalloc_noprof+0x3e7/0x7b0 [ 672.319328][ T5813] sk_prot_alloc+0xe7/0x210 [ 672.319372][ T5813] sk_alloc+0x3a/0x390 [ 672.319385][ T5813] bt_sock_alloc+0x3b/0x310 [ 672.319420][ T5813] l2cap_sock_create+0x147/0x330 [ 672.319442][ T5813] bt_sock_create+0x163/0x240 [ 672.319459][ T5813] __sock_create+0x4b2/0x9d0 [ 672.319512][ T5813] __sys_socket+0xd6/0x1b0 [ 672.319533][ T5813] __x64_sys_socket+0x7a/0x90 [ 672.319553][ T5813] do_syscall_64+0x14d/0xf80 [ 672.319570][ T5813] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 672.319585][ T5813] [ 672.319589][ T5813] Freed by task 11453: [ 672.319596][ T5813] kasan_save_track+0x3e/0x80 [ 672.319617][ T5813] kasan_save_free_info+0x46/0x50 [ 672.319634][ T5813] __kasan_slab_free+0x5c/0x80 [ 672.319655][ T5813] kfree+0x1c1/0x6c0 [ 672.319690][ T5813] __sk_destruct+0x626/0x880 [ 672.319706][ T5813] l2cap_sock_release+0x1c1/0x270 [ 672.319726][ T5813] sock_close+0xc3/0x240 [ 672.319744][ T5813] __fput+0x461/0xa90 [ 672.319783][ T5813] task_work_run+0x1d9/0x270 [ 672.319799][ T5813] exit_to_user_mode_loop+0xed/0x480 [ 672.319832][ T5813] do_syscall_64+0x32d/0xf80 [ 672.319848][ T5813] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 672.319863][ T5813] [ 672.319867][ T5813] The buggy address belongs to the object at ffff88805e33b000 [ 672.319867][ T5813] which belongs to the cache kmalloc-2k of size 2048 [ 672.319881][ T5813] The buggy address is located 512 bytes inside of [ 672.319881][ T5813] freed 2048-byte region [ffff88805e33b000, ffff88805e33b800) [ 672.319899][ T5813] [ 672.319902][ T5813] The buggy address belongs to the physical page: [ 672.319911][ T5813] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88805e33a000 pfn:0x5e338 [ 672.319928][ T5813] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 672.319941][ T5813] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 672.319955][ T5813] page_type: f5(slab) [ 672.319970][ T5813] raw: 0080000000000240 ffff88813fe1b000 ffffea000174da10 ffffea00017ed210 [ 672.319983][ T5813] raw: ffff88805e33a000 0000000800080007 00000000f5000000 0000000000000000 [ 672.319998][ T5813] head: 0080000000000240 ffff88813fe1b000 ffffea000174da10 ffffea00017ed210 [ 672.320013][ T5813] head: ffff88805e33a000 0000000800080007 00000000f5000000 0000000000000000 [ 672.320026][ T5813] head: 0080000000000003 ffffea000178ce01 00000000ffffffff 00000000ffffffff [ 672.320038][ T5813] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 [ 672.320046][ T5813] page dumped because: kasan: bad access detected [ 672.320054][ T5813] page_owner tracks the page as allocated [ 672.320061][ T5813] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5795, tgid 5795 (syz-executor), ts 89371896858, free_ts 0 [ 672.320089][ T5813] post_alloc_hook+0x231/0x280 [ 672.320112][ T5813] get_page_from_freelist+0x28bb/0x2950 [ 672.320128][ T5813] __alloc_frozen_pages_noprof+0x18d/0x380 [ 672.320144][ T5813] allocate_slab+0x77/0x660 [ 672.320179][ T5813] refill_objects+0x334/0x3c0 [ 672.320195][ T5813] __pcs_replace_empty_main+0x35c/0x710 [ 672.320213][ T5813] __kmalloc_node_track_caller_noprof+0x60b/0x7e0 [ 672.320228][ T5813] __alloc_skb+0x2c1/0x7d0 [ 672.320247][ T5813] inet6_ifinfo_notify+0x70/0x120 [ 672.320295][ T5813] addrconf_notify+0xca0/0x1050 [ 672.320312][ T5813] notifier_call_chain+0x1be/0x400 [ 672.320326][ T5813] __dev_notify_flags+0x1a9/0x310 [ 672.320359][ T5813] netif_change_flags+0xe8/0x1a0 [ 672.320373][ T5813] do_setlink+0xf82/0x4590 [ 672.320418][ T5813] rtnl_newlink+0x15ad/0x1bb0 [ 672.320465][ T5813] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 672.320487][ T5813] page_owner free stack trace missing [ 672.320493][ T5813] [ 672.320496][ T5813] Memory state around the buggy address: [ 672.320505][ T5813] ffff88805e33b100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 672.320516][ T5813] ffff88805e33b180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 672.320527][ T5813] >ffff88805e33b200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 672.320536][ T5813] ^ [ 672.320543][ T5813] ffff88805e33b280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 672.320554][ T5813] ffff88805e33b300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 672.320562][ T5813] ================================================================== [ 672.320579][ T5813] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 672.320594][ T5813] CPU: 1 UID: 0 PID: 5813 Comm: kworker/u9:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 672.320617][ T5813] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 672.320629][ T5813] Workqueue: hci3 hci_rx_work [ 672.320652][ T5813] Call Trace: [ 672.320660][ T5813] [ 672.320669][ T5813] vpanic+0x56c/0xa60 [ 672.320703][ T5813] ? __pfx_vpanic+0x10/0x10 [ 672.320740][ T5813] panic+0xc5/0xd0 [ 672.320771][ T5813] ? __pfx_panic+0x10/0x10 [ 672.320803][ T5813] ? l2cap_sock_ready_cb+0xe3/0x180 [ 672.320829][ T5813] ? l2cap_sock_ready_cb+0xe3/0x180 [ 672.320849][ T5813] check_panic_on_warn+0x89/0xb0 [ 672.320884][ T5813] ? l2cap_sock_ready_cb+0xe3/0x180 [ 672.320904][ T5813] end_report+0x73/0x180 [ 672.320925][ T5813] ? l2cap_sock_ready_cb+0xe3/0x180 [ 672.320945][ T5813] kasan_report+0x128/0x150 [ 672.320967][ T5813] ? l2cap_sock_ready_cb+0xe3/0x180 [ 672.321013][ T5813] l2cap_sock_ready_cb+0xe3/0x180 [ 672.321036][ T5813] l2cap_le_start+0x25b/0x1960 [ 672.321069][ T5813] ? __pfx_l2cap_le_start+0x10/0x10 [ 672.321099][ T5813] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 672.321124][ T5813] ? lockdep_hardirqs_on+0x7a/0x110 [ 672.321148][ T5813] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 672.321173][ T5813] ? mutex_lock_nested+0x152/0x1d0 [ 672.321203][ T5813] ? l2cap_connect_cfm+0x894/0x1560 [ 672.321234][ T5813] l2cap_connect_cfm+0x8d5/0x1560 [ 672.321276][ T5813] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 672.321306][ T5813] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 672.321330][ T5813] ? lockdep_hardirqs_on+0x7a/0x110 [ 672.321353][ T5813] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 672.321377][ T5813] ? mutex_lock_nested+0x152/0x1d0 [ 672.321407][ T5813] ? hci_connect_cfm+0x2c/0x140 [ 672.321432][ T5813] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 672.321462][ T5813] hci_connect_cfm+0x95/0x140 [ 672.321489][ T5813] le_conn_complete_evt+0x1134/0x16b0 [ 672.321520][ T5813] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 672.321548][ T5813] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 672.321570][ T5813] ? lockdep_hardirqs_on+0x7a/0x110 [ 672.321593][ T5813] ? skb_pull_data+0xfb/0x200 [ 672.321621][ T5813] hci_le_conn_complete_evt+0x187/0x470 [ 672.321650][ T5813] hci_event_packet+0x659/0xef0 [ 672.321672][ T5813] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 672.321702][ T5813] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 672.321725][ T5813] ? __pfx_hci_event_packet+0x10/0x10 [ 672.321745][ T5813] ? rt_spin_unlock+0x14f/0x200 [ 672.321778][ T5813] ? hci_send_to_monitor+0xe2/0x590 [ 672.321808][ T5813] hci_rx_work+0x3ee/0x1030 [ 672.321832][ T5813] ? process_scheduled_works+0xa8d/0x18c0 [ 672.321863][ T5813] process_scheduled_works+0xb6e/0x18c0 [ 672.321907][ T5813] ? __pfx_process_scheduled_works+0x10/0x10 [ 672.321939][ T5813] ? assign_work+0x3d5/0x5e0 [ 672.321969][ T5813] worker_thread+0xa53/0xfc0 [ 672.322011][ T5813] kthread+0x388/0x470 [ 672.322033][ T5813] ? __pfx_worker_thread+0x10/0x10 [ 672.322061][ T5813] ? __pfx_kthread+0x10/0x10 [ 672.322084][ T5813] ret_from_fork+0x51e/0xb90 [ 672.322115][ T5813] ? __pfx_ret_from_fork+0x10/0x10 [ 672.322144][ T5813] ? __switch_to+0xc7d/0x1450 [ 672.322172][ T5813] ? __pfx_kthread+0x10/0x10 [ 672.322194][ T5813] ret_from_fork_asm+0x1a/0x30 [ 672.322223][ T5813] [ 672.322429][ T5813] Kernel Offset: disabled