last executing test programs: 5m5.112451133s ago: executing program 1 (id=5203): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) r1 = syz_pidfd_open(r0, 0x0) wait4(0x0, 0x0, 0x80000000, 0x0) pidfd_getfd(r1, 0xffffffffffffffff, 0x0) 5m4.308836351s ago: executing program 1 (id=5209): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000100)={@val={0x2000}, @void, @eth={@broadcast, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x3e, 0x0, 0x0, 0x0, 0x29, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1}, {0x0, 0x0, 0x2a, 0x0, @gue={{0x2, 0x0, 0x0, 0x0, 0x2a}, "ebc7a1e0ff5befe1fdbc66e400d7e83306de422b4a81099bdac9"}}}}}}}, 0x50) 5m4.155313167s ago: executing program 1 (id=5214): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000100)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e21, 0x657e, @dev={0xfe, 0x80, '\x00', 0x14}, 0x2}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000003c0), 0x3) getsockopt$bt_hci(r0, 0x11a, 0x2, 0x0, 0x0) 5m4.093784267s ago: executing program 1 (id=5216): mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x195011, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) 5m3.95443313s ago: executing program 1 (id=5219): r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x0) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) readv(r0, &(0x7f0000000640)=[{&(0x7f0000000100)=""/74, 0x4a}], 0x1) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000480)={0x0, 0x0, 0x0, {0x0, 0x1}, {0x80, 0x2}}) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2250) 5m2.424514911s ago: executing program 1 (id=5227): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000380)=ANY=[@ANYBLOB="1201000000000010ac05470200000000000109022400010000500009040002010300010009210000000122f80409058103"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x62081, 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4010}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) 5m1.716723161s ago: executing program 32 (id=5227): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000380)=ANY=[@ANYBLOB="1201000000000010ac05470200000000000109022400010000500009040002010300010009210000000122f80409058103"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x62081, 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4010}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) 1m20.121590392s ago: executing program 2 (id=8001): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000180)=0x15) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000140)=0x15) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000000)=0x15) 1m20.042051354s ago: executing program 2 (id=8002): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) r2 = eventfd2(0x4, 0x1) ioctl$VHOST_SET_VRING_ERR(r1, 0x4008af22, &(0x7f00000001c0)={0x0, r2}) close_range(r0, 0xffffffffffffffff, 0x0) 1m19.950225039s ago: executing program 2 (id=8003): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'chacha20-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d0ff0f1d0dbd301e5a47b2f3caa73dcd2a6a370554375a", 0x20) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$NL80211_CMD_SET_COALESCE(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000700)=ANY=[], 0x240}, 0x1, 0x0, 0x0, 0xd0}, 0x4048010) recvmsg$can_j1939(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000640)=[{&(0x7f00000000c0)=""/133, 0x85}], 0x1}, 0x140) 1m19.856746667s ago: executing program 2 (id=8005): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='ramfs\x00', 0x2014800, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, 0x0, 0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x204) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x37, 0x7fffffff}]}) close_range(r1, 0xffffffffffffffff, 0x0) 1m19.738267348s ago: executing program 2 (id=8007): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)={0x90, 0x0, 0x2, {0x3, 0x0, 0x0, 0x5, 0x0, 0x1000, {0x0, 0x0, 0x20, 0xfffffffffffffffd, 0xf5, 0x0, 0x0, 0x0, 0x7, 0x2000, 0x2, 0x0, 0x0, 0x4}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$tmpfs(0x0, 0x0, 0x0, 0x80004, &(0x7f0000000980)=ANY=[@ANYBLOB='huge=advise,huge=within_size,huge=advise,mode=00000000000000000000007,grpquota_inode_hardlimit=94g830\b,usr']) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 1m18.402225253s ago: executing program 2 (id=8017): r0 = add_key$keyring(&(0x7f0000000200), &(0x7f0000000240)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb) r1 = add_key$keyring(&(0x7f00000000c0), &(0x7f00000002c0)={'syz', 0x0}, 0x0, 0x0, r0) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r0, r2, 0x9e) r3 = add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000280)={'fscrypt:', @auto=[0x66, 0x0, 0x0, 0x0, 0x61, 0x57, 0x0, 0x34, 0x0, 0x0, 0x64, 0x35, 0x0, 0x39, 0x65]}, &(0x7f0000000180)={0x0, "de8d0d27ca969fa15f8b3b7bae39c1b3327d4332f8c149d2d65a347d67f6db7eb90dfdad3cdebaaf421412f812305c9da91699b5a02c1295596f0fd9ec78f2fd", 0x18}, 0x48, r0) keyctl$KEYCTL_MOVE(0x1e, r3, r0, r1, 0x0) 1m18.045888485s ago: executing program 33 (id=8017): r0 = add_key$keyring(&(0x7f0000000200), &(0x7f0000000240)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb) r1 = add_key$keyring(&(0x7f00000000c0), &(0x7f00000002c0)={'syz', 0x0}, 0x0, 0x0, r0) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r0, r2, 0x9e) r3 = add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000280)={'fscrypt:', @auto=[0x66, 0x0, 0x0, 0x0, 0x61, 0x57, 0x0, 0x34, 0x0, 0x0, 0x64, 0x35, 0x0, 0x39, 0x65]}, &(0x7f0000000180)={0x0, "de8d0d27ca969fa15f8b3b7bae39c1b3327d4332f8c149d2d65a347d67f6db7eb90dfdad3cdebaaf421412f812305c9da91699b5a02c1295596f0fd9ec78f2fd", 0x18}, 0x48, r0) keyctl$KEYCTL_MOVE(0x1e, r3, r0, r1, 0x0) 51.394395309s ago: executing program 4 (id=8315): mount(0x0, 0x0, &(0x7f0000000180)='ceph\x00', 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r1 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, 0x0, &(0x7f0000000180)) 51.30430625s ago: executing program 4 (id=8317): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r0, 0x0, 0x2e, &(0x7f0000000340)={0x8, {{0x2, 0x8000, @multicast2}}, {{0x2, 0x0, @multicast2}}}, 0x108) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000003c0)=[{0x0}], 0x1}, 0x20000880) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) getsockopt$inet_buf(r0, 0x0, 0x30, &(0x7f0000000340)=""/225, &(0x7f0000000180)=0xe1) 51.12029182s ago: executing program 4 (id=8322): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000cc, 0x0) fcntl$setpipe(r1, 0x407, 0x100004) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 50.122985204s ago: executing program 4 (id=8337): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x12b) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) move_mount(r0, &(0x7f0000000580)='./file0/../file0\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./file0/file0\x00', 0x100) 50.008963251s ago: executing program 4 (id=8339): r0 = socket(0x2, 0x3, 0x6) bind$inet(r0, &(0x7f0000000080)={0x2, 0xfffa, @local}, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000640)={{0x14}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @synproxy={{0xd}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x70}}, 0x0) sendto$inet(r0, &(0x7f00000023c0)='\x00\x00\x00\x00', 0x4, 0x0, &(0x7f0000002400)={0x2, 0x0, @multicast2}, 0x10) 49.538184153s ago: executing program 4 (id=8346): r0 = gettid() prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x11, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) futex(&(0x7f000000cffc)=0x1, 0x6, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0) 49.262860053s ago: executing program 34 (id=8346): r0 = gettid() prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x11, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) futex(&(0x7f000000cffc)=0x1, 0x6, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0) 7.796654148s ago: executing program 6 (id=8835): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000000c0)="25b89ca38ffd48f3be52163448412ba88b3b3470", 0x14}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f7", 0x1d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5", 0x5e}, {&(0x7f0000000800)="38c4340e8710b8eaedd392cbf07690d4a3f2b8eadcac25284b2afc2a941cbe880cf2d0823ecd83a7b84b4154e5a802b7de51c5b236647c77656a585c60798db780", 0x41}], 0x4}], 0x1, 0x20044014) recvmmsg(r1, &(0x7f0000004440)=[{{0x0, 0x0, &(0x7f0000000a80)=[{&(0x7f0000000a00)=""/66, 0x42}, {&(0x7f0000001b40)=""/154, 0x9a}], 0x2}, 0x3}], 0x1, 0x40, 0x0) 7.69961875s ago: executing program 6 (id=8836): r0 = socket(0x11, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000005c0)={'gre0\x00', 0x0}) bind$packet(r0, &(0x7f0000000180)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @dev}, 0x14) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000240)=0xe9, 0x4) sendmsg$netlink(r0, &(0x7f0000002ac0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000280)=ANY=[@ANYBLOB="02011400012918000e3580009f00016d2900002f0600ac141430e0000001808a8972bd0b72e41082b1a3d206"], 0xdd12}], 0x1}, 0x10) 7.502322507s ago: executing program 6 (id=8839): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000000c0)="25b89ca38ffd48f3be52163448412ba88b3b3470", 0x14}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f7", 0x1d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459", 0x53}, {&(0x7f0000000800)="38c4340e8710b8eaedd392cb", 0xc}], 0x4, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x20044014) recvmmsg(r1, &(0x7f0000004440)=[{{0x0, 0x0, &(0x7f0000000a80)=[{&(0x7f0000001b40)=""/154, 0x9a}], 0x1}, 0x3}], 0x1, 0x40, 0x0) 7.451421241s ago: executing program 6 (id=8840): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$nfs4(&(0x7f0000000040)='/', &(0x7f0000000080)='./file0\x00', 0x0, 0x197841, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) move_mount(r0, &(0x7f0000000380)='./file0\x00', r0, 0x0, 0x40) 7.342395832s ago: executing program 6 (id=8849): r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) fcntl$notify(r0, 0x402, 0x8000001f) r1 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) fcntl$notify(r1, 0x402, 0x80000024) r2 = open(&(0x7f0000000280)='.\x00', 0x2000, 0x148) fcntl$notify(r2, 0x402, 0x36) 7.02486333s ago: executing program 6 (id=8842): mount(0x0, 0x0, &(0x7f0000000240)='vxfs\x00', 0x200000, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)={0x2c, r1, 0x1, 0x70bd2b, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x5}, 0x4004080) 6.607376591s ago: executing program 35 (id=8842): mount(0x0, 0x0, &(0x7f0000000240)='vxfs\x00', 0x200000, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)={0x2c, r1, 0x1, 0x70bd2b, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x5}, 0x4004080) 3.630817065s ago: executing program 3 (id=8865): r0 = syz_open_dev$usbfs(0x0, 0x20000007d, 0x0) dup3(0xffffffffffffffff, r0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="4c000000020601080000000000000000000000400500010006200000050005000a00000005000400000000000900020073797a310000000011000300686173683a69702c6d61726b"], 0x4c}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)={0x4c, 0x9, 0x6, 0x201, 0x0, 0x0, {0x5, 0x0, 0xffff}, [@IPSET_ATTR_DATA={0x24, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @local}}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x2}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x4c}}, 0x4000080) 3.337529437s ago: executing program 3 (id=8866): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000005c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='fd=', @ANYRESOCT=r0, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000004140)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_WRITE(r0, &(0x7f0000000240)={0x18, 0x0, r1, {0x7}}, 0x18) newfstatat(0xffffffffffffff9c, &(0x7f0000000ac0)='./file0\x00', 0x0, 0x2000) 2.379053288s ago: executing program 3 (id=8875): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000180)=0x80, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f00000002c0)={'batadv_slave_0\x00', 0x0}) bind$xdp(r0, &(0x7f0000000100)={0x2c, 0x0, r2}, 0x10) 1.739987768s ago: executing program 0 (id=8877): r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) close(r0) eventfd(0x100000ae) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000001c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) mount$9p_fd(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) read$FUSE(r0, &(0x7f00000041c0)={0x2020}, 0x2020) 1.52938621s ago: executing program 3 (id=8880): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000100)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) mlock(&(0x7f0000ffc000/0x2000)=nil, 0x2000) 1.395678014s ago: executing program 3 (id=8881): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) ptrace$setregset(0x4205, r1, 0x202, &(0x7f00000004c0)={0x0}) 1.085546135s ago: executing program 3 (id=8882): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) futex(&(0x7f000000cffc), 0x80, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) 1.084932195s ago: executing program 5 (id=8889): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000500)={0x0, 0x1, 0xdddd1000, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_PRE_FAULT_MEMORY(r2, 0xc040aed5, &(0x7f0000000080)={0x100000, 0x18000}) 965.134641ms ago: executing program 5 (id=8883): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000005c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='fd=', @ANYRESOCT=r0, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000004140)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_WRITE(r0, &(0x7f0000000240)={0x18, 0x0, r1, {0x7}}, 0x18) newfstatat(0xffffffffffffff9c, &(0x7f0000000ac0)='./file0\x00', 0x0, 0x2000) 825.637222ms ago: executing program 0 (id=8884): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1c, &(0x7f00000001c0)=[@in6={0xa, 0x0, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0xfffffffb}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x7a, &(0x7f0000000340)={r2, @in6={{0xa, 0x3, 0x0, @dev={0xfe, 0x80, '\x00', 0x36}}}}, &(0x7f0000000040)=0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000025c0)={r3, 0x200, 0x10}, 0x8) 724.433975ms ago: executing program 5 (id=8885): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r0, &(0x7f0000000100)={0xa, 0xffff, 0x0, @private1, 0x200000}, 0x1c) sendto$inet6(r0, &(0x7f00000001c0)='O', 0x1, 0x80, &(0x7f0000000280)={0xa, 0x0, 0x0, @private2}, 0x1c) shutdown(r0, 0x1) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x4}, 0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7c, &(0x7f00000000c0), &(0x7f0000000180)=0x8) 604.895142ms ago: executing program 0 (id=8886): r0 = userfaultfd(0x80801) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x3000002, 0x5d031, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x54}) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0xf0ffffff) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000199000/0x800000)=nil, 0x800000}) 526.203452ms ago: executing program 5 (id=8887): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000180)=0x80, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f00000002c0)={'batadv_slave_0\x00', 0x0}) bind$xdp(r0, &(0x7f0000000100)={0x2c, 0x0, r2}, 0x10) 410.719857ms ago: executing program 0 (id=8888): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000400)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="18"], 0x18, 0x4}], 0x1, 0x0) recvmmsg(r1, &(0x7f0000002300)=[{{0x0, 0x0, &(0x7f0000000f80)=[{&(0x7f0000000900)=""/82, 0x52}], 0x1}, 0x7f}], 0x1, 0x11102, 0x0) 221.298825ms ago: executing program 0 (id=8890): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[], 0x9c}, 0x1, 0x0, 0x0, 0x4004001}, 0x20004000) recvmsg(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f00000005c0)=""/15, 0xf}, {&(0x7f0000000ac0)=""/138, 0x8a}], 0x2}, 0x0) 151.464898ms ago: executing program 5 (id=8891): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000340)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x21c0, 0x103) 38.265797ms ago: executing program 0 (id=8892): r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_wait_time\x00', 0x275a, 0x0) write$uinput_user_dev(r2, &(0x7f0000000b00)={'syz0\x00', {0x5, 0x7, 0x3, 0x7}, 0xc, [0x2, 0x9, 0x0, 0x1, 0x8, 0xea45, 0xe, 0x1, 0x0, 0x0, 0x800008, 0xc, 0x3, 0x5, 0x1, 0xb, 0x93f, 0x7fffffff, 0x51, 0x8, 0x800, 0xfffffffa, 0x3ff, 0x2, 0x7, 0x10001, 0x7ff, 0x0, 0x8, 0x6, 0x401, 0xc, 0x9, 0x4, 0x2, 0x1, 0x5, 0x4, 0x1, 0x4, 0xa, 0x8, 0x3, 0x8, 0x1, 0x2, 0x8c00, 0x6, 0x939, 0x5, 0x9, 0x2, 0x2, 0x4, 0xfffffff7, 0x7fff, 0x6, 0x5, 0x2, 0x56f00ca6, 0x5, 0x2a, 0x1, 0x23], [0x1, 0x9, 0x9, 0x1, 0x5, 0xe, 0x800, 0xc, 0xfffffffa, 0x2329, 0xfd8, 0x3, 0x5, 0x5, 0x0, 0x24e, 0x1, 0xfffffff7, 0x2, 0x3, 0x5, 0x9, 0x82, 0x8, 0x1, 0x40, 0xa3, 0x8, 0xffffffff, 0x5, 0x10000, 0x1, 0xffffff00, 0x7ff, 0x6, 0x7, 0x0, 0xe, 0xd, 0x10, 0x2, 0x9, 0x7, 0x8, 0x5, 0x8000, 0x800, 0x5, 0xc5, 0x3, 0x1, 0x9, 0x8, 0x3, 0xfffffff7, 0x3, 0x24c, 0x1ff, 0x2a0, 0x5, 0x6, 0x6, 0x7, 0x7], [0x2, 0x9, 0x1a9e1bfa, 0xfffffffc, 0x8, 0x6, 0x5, 0x8001, 0x7, 0x5, 0x2, 0x7fffffff, 0x8000, 0x1, 0x1, 0x5, 0x4, 0x2, 0x2b0, 0x5, 0x97f82544, 0x8, 0x0, 0x9, 0x5, 0x5, 0x4, 0x10000, 0xc93, 0xffffff3c, 0x8b2, 0x7, 0x0, 0xff, 0x140, 0x2, 0x4, 0xb, 0x4, 0x6, 0x7, 0x7c13, 0x5, 0x1, 0x7, 0x8000, 0xe, 0xf3, 0x4, 0x8, 0x0, 0xffffff00, 0x100, 0x7, 0x2, 0x0, 0x9, 0xdd, 0x1, 0x9, 0xc3, 0x7751c64, 0x7a3], [0x9, 0x3889, 0xffff9a7f, 0x200, 0x6, 0x2, 0x3, 0x1, 0x5, 0x4, 0x3, 0x1f, 0x3, 0x6, 0x6, 0x2, 0x9, 0x101, 0x2, 0x66608000, 0x5, 0x7ff, 0x6, 0x5, 0xa476, 0x5, 0x9, 0xffff, 0xd, 0x0, 0xffffff81, 0x5, 0x10001, 0x61, 0x10, 0x1000, 0x8, 0x100, 0x7, 0x20000000, 0x8, 0x1d, 0xb32a, 0xec000000, 0x2, 0x1904, 0x4, 0x9, 0x8, 0x7ff, 0x80, 0x5, 0xfffffffb, 0x7, 0x6e79, 0x8, 0x10000, 0x9371, 0x4f89, 0x7, 0x580, 0x10001, 0x80, 0x8]}, 0x45c) 0s ago: executing program 5 (id=8893): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f0000000b80)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a40000000000000400b3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459ba9dcf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b22e", 0x90}], 0x2, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f00000006c0)=""/220, 0xdc}], 0x1}, 0x0) kernel console output (not intermixed with test programs): netlink: 4 bytes leftover after parsing attributes in process `syz.2.6640'. [ 574.595022][T21606] syzkaller1: entered promiscuous mode [ 574.618696][T21606] syzkaller1: entered allmulticast mode [ 575.100684][T21638] syzkaller1: entered promiscuous mode [ 575.106379][T21638] syzkaller1: entered allmulticast mode [ 575.635469][ T5933] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 575.807224][T21666] netlink: 'syz.4.6659': attribute type 4 has an invalid length. [ 575.828659][ T5933] usb 4-1: unable to get BOS descriptor or descriptor too short [ 575.837564][T21666] netlink: 'syz.4.6659': attribute type 27 has an invalid length. [ 575.854823][ T5933] usb 4-1: config 6 has an invalid interface number: 200 but max is 0 [ 575.871092][ T5933] usb 4-1: config 6 has no interface number 0 [ 575.878559][T21666] netlink: 3609 bytes leftover after parsing attributes in process `syz.4.6659'. [ 575.888386][ T5933] usb 4-1: config 6 interface 200 has no altsetting 0 [ 575.899978][ T5933] usb 4-1: New USB device found, idVendor=05d8, idProduct=810c, bcdDevice=18.5f [ 575.914460][ T5933] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 575.957683][ T5933] usb 4-1: Product: syz [ 575.961936][ T5933] usb 4-1: Manufacturer: syz [ 575.966557][ T5933] usb 4-1: SerialNumber: syz [ 576.003309][T21669] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6660'. [ 576.065051][T21669] netlink: 'syz.2.6660': attribute type 1 has an invalid length. [ 576.089915][T21669] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6660'. [ 576.333722][T21679] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6664'. [ 576.813036][ T5933] dvb-usb: found a 'Artec T14 - USB2.0 DVB-T' in warm state. [ 576.826813][ T5933] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 576.848848][ T5933] dvbdev: DVB: registering new adapter (Artec T14 - USB2.0 DVB-T) [ 576.856753][ T5933] usb 4-1: media controller created [ 576.906671][ T5933] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 576.958143][T21700] syzkaller1: entered promiscuous mode [ 576.967283][T21700] syzkaller1: entered allmulticast mode [ 577.007665][ T5933] dvb-usb: recv bulk message failed: -22 [ 577.124672][T21702] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6675'. [ 577.190030][T21706] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6676'. [ 577.206189][T21706] netlink: 'syz.4.6676': attribute type 1 has an invalid length. [ 577.214401][T21706] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6676'. [ 577.217843][ T5933] dvb-usb: bulk message failed: -71 (6/0) [ 577.263354][ T5933] dvb-usb: no frontend was attached by 'Artec T14 - USB2.0 DVB-T' [ 577.302686][ T5933] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input76 [ 577.362877][ T5933] dvb-usb: schedule remote query interval to 150 msecs. [ 577.370907][ T5933] dvb-usb: Artec T14 - USB2.0 DVB-T successfully initialized and connected. [ 577.389758][ T5933] usb 4-1: USB disconnect, device number 89 [ 577.480584][ T5933] dvb-usb: Artec T14 - USB2.0 DVB-T successfully deinitialized and disconnected. [ 577.520080][T21715] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6680'. [ 577.824897][T21726] netlink: 'syz.2.6685': attribute type 4 has an invalid length. [ 577.841568][T21726] netlink: 'syz.2.6685': attribute type 27 has an invalid length. [ 577.867870][T21726] netlink: 3609 bytes leftover after parsing attributes in process `syz.2.6685'. [ 578.184207][T21743] syzkaller1: entered promiscuous mode [ 578.193113][T21743] syzkaller1: entered allmulticast mode [ 578.230840][T21746] program syz.2.6695 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 578.438846][T21758] syzkaller1: entered promiscuous mode [ 578.445333][T21758] syzkaller1: entered allmulticast mode [ 579.099986][T21781] syzkaller1: entered promiscuous mode [ 579.105523][T21781] syzkaller1: entered allmulticast mode [ 579.171978][T21780] syzkaller1: entered promiscuous mode [ 579.187452][T21780] syzkaller1: entered allmulticast mode [ 579.528944][T21800] netlink: 'syz.0.6717': attribute type 11 has an invalid length. [ 579.760605][T21813] program syz.3.6721 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 580.047907][ T5897] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 580.061748][T21826] netlink: 'syz.2.6728': attribute type 11 has an invalid length. [ 580.211733][ T5897] usb 5-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 580.223821][ T5897] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 580.239572][ T5897] usb 5-1: Product: syz [ 580.243822][ T5897] usb 5-1: Manufacturer: syz [ 580.248872][ T5897] usb 5-1: SerialNumber: syz [ 580.256597][ T5897] usb 5-1: config 0 descriptor?? [ 580.572500][ T30] audit: type=1326 audit(1751593174.272:109): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21846 comm="syz.0.6738" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f7798d8e929 code=0x0 [ 580.642771][T21853] netlink: 'syz.3.6740': attribute type 11 has an invalid length. [ 581.284283][ T5897] usb 5-1: Firmware version (0.0) predates our first public release. [ 581.292804][ T5897] usb 5-1: Please update to version 0.2 or newer [ 581.332227][ T5897] usb 5-1: USB disconnect, device number 16 [ 581.853464][T21873] syzkaller1: entered promiscuous mode [ 581.859279][T21873] syzkaller1: entered allmulticast mode [ 582.824634][T21918] input: syz0 as /devices/virtual/input/input77 [ 583.437628][ T5933] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 583.589672][ T5933] usb 5-1: unable to get BOS descriptor or descriptor too short [ 583.601203][ T5933] usb 5-1: config 6 has an invalid interface number: 200 but max is 0 [ 583.609512][ T5933] usb 5-1: config 6 has no interface number 0 [ 583.615623][ T5933] usb 5-1: config 6 interface 200 has no altsetting 0 [ 583.625446][ T5933] usb 5-1: New USB device found, idVendor=05d8, idProduct=810c, bcdDevice=18.5f [ 583.634571][ T5933] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 583.642659][ T5933] usb 5-1: Product: syz [ 583.646846][ T5933] usb 5-1: Manufacturer: syz [ 583.651992][ T5933] usb 5-1: SerialNumber: syz [ 584.426017][ T5933] dvb-usb: found a 'Artec T14 - USB2.0 DVB-T' in warm state. [ 584.436145][ T5933] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 584.446115][ T5933] dvbdev: DVB: registering new adapter (Artec T14 - USB2.0 DVB-T) [ 584.454067][ T5933] usb 5-1: media controller created [ 584.474333][ T5933] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 584.625562][ T5933] dvb-usb: recv bulk message failed: -22 [ 584.827776][ T5933] dvb-usb: bulk message failed: -71 (6/0) [ 584.834326][ T5933] dvb-usb: no frontend was attached by 'Artec T14 - USB2.0 DVB-T' [ 584.844550][ T5933] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input78 [ 584.858078][ T5933] dvb-usb: schedule remote query interval to 150 msecs. [ 584.865052][ T5933] dvb-usb: Artec T14 - USB2.0 DVB-T successfully initialized and connected. [ 584.882089][ T5933] usb 5-1: USB disconnect, device number 17 [ 584.966356][ T5933] dvb-usb: Artec T14 - USB2.0 DVB-T successfully deinitialized and disconnected. [ 585.017624][T19795] Bluetooth: hci4: command 0x1003 tx timeout [ 585.017712][ T5838] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 586.587846][ T5904] usb 3-1: new full-speed USB device number 83 using dummy_hcd [ 586.780230][ T5904] usb 3-1: config 0 has an invalid interface number: 230 but max is 0 [ 586.792077][ T5904] usb 3-1: config 0 has no interface number 0 [ 586.798642][ T5904] usb 3-1: config 0 interface 230 altsetting 2 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 586.812537][ T5904] usb 3-1: config 0 interface 230 altsetting 2 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 586.823906][ T5904] usb 3-1: config 0 interface 230 has no altsetting 0 [ 586.834906][ T5904] usb 3-1: New USB device found, idVendor=0781, idProduct=0005, bcdDevice= 0.05 [ 586.850927][ T5904] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 586.859297][ T5904] usb 3-1: Product: syz [ 586.863503][ T5904] usb 3-1: Manufacturer: syz [ 586.873891][ T5904] usb 3-1: SerialNumber: syz [ 586.890309][ T5904] usb 3-1: config 0 descriptor?? [ 586.896140][T21967] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 586.905358][T21967] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 586.917870][ T5904] ums-usbat 3-1:0.230: USB Mass Storage device detected [ 586.936467][ T5904] ums-usbat 3-1:0.230: Quirks match for vid 0781 pid 0005: 1 [ 587.006333][T21996] __nla_validate_parse: 3 callbacks suppressed [ 587.006357][T21996] netlink: 9 bytes leftover after parsing attributes in process `syz.0.6805'. [ 587.025381][T21996] gretap0: entered promiscuous mode [ 587.040685][T21996] netlink: 5 bytes leftover after parsing attributes in process `syz.0.6805'. [ 587.051090][T21996] 0{X: renamed from gretap0 [ 587.058826][T21996] 0{X: left promiscuous mode [ 587.064143][T21996] 0{X: entered allmulticast mode [ 587.072894][T21996] A link change request failed with some changes committed already. Interface 30{X may have been left with an inconsistent configuration, please check. [ 587.787240][T22003] 9pnet_fd: Insufficient options for proto=fd [ 588.457644][ T5838] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 588.457708][T19795] Bluetooth: hci4: command 0x1003 tx timeout [ 589.246859][ T5904] ums-usbat 3-1:0.230: probe with driver ums-usbat failed with error -5 [ 589.395234][ T5925] usb 3-1: USB disconnect, device number 83 [ 589.671415][T22060] syzkaller1: entered promiscuous mode [ 589.678013][T22060] syzkaller1: entered allmulticast mode [ 590.195391][T22081] syzkaller1: entered promiscuous mode [ 590.207677][T22081] syzkaller1: entered allmulticast mode [ 590.424895][T22092] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 590.490134][T22095] netlink: 'syz.0.6851': attribute type 3 has an invalid length. [ 590.546209][T22095] netlink: 'syz.0.6851': attribute type 1 has an invalid length. [ 590.562761][T22095] netlink: 116 bytes leftover after parsing attributes in process `syz.0.6851'. [ 590.576127][T22095] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 590.779989][ T5925] usb 5-1: new full-speed USB device number 18 using dummy_hcd [ 590.939527][ T5925] usb 5-1: config 0 has an invalid interface number: 230 but max is 0 [ 590.957715][ T5925] usb 5-1: config 0 has no interface number 0 [ 590.965708][ T5925] usb 5-1: config 0 interface 230 altsetting 2 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 590.983933][ T5925] usb 5-1: config 0 interface 230 altsetting 2 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 590.995854][ T5925] usb 5-1: config 0 interface 230 has no altsetting 0 [ 591.011165][ T5925] usb 5-1: New USB device found, idVendor=0781, idProduct=0005, bcdDevice= 0.05 [ 591.023167][ T5925] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 591.043051][ T5925] usb 5-1: Product: syz [ 591.047286][ T5925] usb 5-1: Manufacturer: syz [ 591.068920][ T5925] usb 5-1: SerialNumber: syz [ 591.081071][ T5925] usb 5-1: config 0 descriptor?? [ 591.087914][T22100] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 591.095302][T22100] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 591.109953][ T5925] ums-usbat 5-1:0.230: USB Mass Storage device detected [ 591.148787][ T5925] ums-usbat 5-1:0.230: Quirks match for vid 0781 pid 0005: 1 [ 591.624218][T22152] loop5: detected capacity change from 0 to 4391 [ 591.658340][T16825] buffer_io_error: 23 callbacks suppressed [ 591.658359][T16825] Buffer I/O error on dev loop5, logical block 548, async page read [ 591.677619][T22153] loop5: detected capacity change from 4391 to 5279 [ 591.749274][T16825] Buffer I/O error on dev loop5, logical block 659, async page read [ 592.222101][T22162] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6888'. [ 592.233593][T22165] netlink: 'syz.3.6882': attribute type 3 has an invalid length. [ 592.242669][T22165] netlink: 'syz.3.6882': attribute type 1 has an invalid length. [ 592.250877][T22165] netlink: 116 bytes leftover after parsing attributes in process `syz.3.6882'. [ 592.261690][T22165] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 592.375529][T22173] netlink: 19 bytes leftover after parsing attributes in process `syz.0.6883'. [ 593.379934][ T5925] ums-usbat 5-1:0.230: probe with driver ums-usbat failed with error -5 [ 593.565349][ T5904] usb 5-1: USB disconnect, device number 18 [ 594.182111][T22190] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6894'. [ 594.522603][T22207] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 594.597831][ T9] usb 4-1: new high-speed USB device number 90 using dummy_hcd [ 594.757450][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 594.769324][ T9] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 594.781579][ T9] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 594.804502][ T9] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 594.830434][ T9] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 594.855816][ T9] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 594.876259][T22220] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6906'. [ 594.887052][ T9] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 594.896649][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 595.151541][ T9] usb 4-1: usb_control_msg returned -32 [ 595.157203][ T9] usbtmc 4-1:16.0: can't read capabilities [ 595.303751][T22226] binder: 22225:22226 ioctl c0306201 200000001a80 returned -14 [ 595.536413][T22244] usbtmc 4-1:16.0: control status returned 0 [ 595.738231][ T5925] usb 4-1: USB disconnect, device number 90 [ 596.965912][T22292] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 597.365462][T22310] syzkaller1: entered promiscuous mode [ 597.373464][T22310] syzkaller1: entered allmulticast mode [ 597.402921][T22300] binder: 22298:22300 ioctl c0306201 200000001a80 returned -14 [ 597.451496][T22312] syzkaller1: entered promiscuous mode [ 597.457006][T22312] syzkaller1: entered allmulticast mode [ 597.541602][T22316] syzkaller1: entered promiscuous mode [ 597.547240][T22316] syzkaller1: entered allmulticast mode [ 597.596851][T22320] sctp: [Deprecated]: syz.3.6949 (pid 22320) Use of struct sctp_assoc_value in delayed_ack socket option. [ 597.596851][T22320] Use struct sctp_sack_info instead [ 598.100239][T22338] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 598.212337][T22341] sctp: [Deprecated]: syz.4.6959 (pid 22341) Use of struct sctp_assoc_value in delayed_ack socket option. [ 598.212337][T22341] Use struct sctp_sack_info instead [ 598.345820][T22347] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6962'. [ 598.709427][T22362] syzkaller1: entered promiscuous mode [ 598.714964][T22362] syzkaller1: entered allmulticast mode [ 599.099547][T22381] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6978'. [ 600.147750][ T5925] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 600.298309][ T5925] usb 3-1: Using ep0 maxpacket: 8 [ 600.305698][ T5925] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 600.315491][ T5925] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 600.325718][ T5925] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 600.337468][ T5925] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 600.347860][ T5925] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 600.360975][ T5925] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 600.370061][ T5925] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 600.601414][ T5925] usb 3-1: usb_control_msg returned -32 [ 600.607218][ T5925] usbtmc 3-1:16.0: can't read capabilities [ 600.802835][T22448] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 600.972246][T22457] usbtmc 3-1:16.0: control status returned 0 [ 600.994857][T22460] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7009'. [ 601.173680][ T5904] usb 3-1: USB disconnect, device number 84 [ 601.547622][ T5925] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 601.709446][ T5925] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 601.733021][ T5925] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 601.745230][ T5925] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 601.775003][ T5925] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 601.788869][ T5925] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 601.798397][ T5925] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 601.809602][ T5925] usb 4-1: config 0 descriptor?? [ 602.234471][ T5925] hid_parser_main: 5 callbacks suppressed [ 602.234489][ T5925] plantronics 0003:047F:FFFF.0032: unknown main item tag 0x0 [ 602.251531][ T5925] plantronics 0003:047F:FFFF.0032: unknown main item tag 0x0 [ 602.259399][ T5925] plantronics 0003:047F:FFFF.0032: unknown main item tag 0x0 [ 602.266852][ T5925] plantronics 0003:047F:FFFF.0032: unknown main item tag 0x0 [ 602.274415][ T5925] plantronics 0003:047F:FFFF.0032: unknown main item tag 0x0 [ 602.282185][ T5925] plantronics 0003:047F:FFFF.0032: unknown main item tag 0x0 [ 602.289679][ T5925] plantronics 0003:047F:FFFF.0032: unknown main item tag 0x0 [ 602.297097][ T5925] plantronics 0003:047F:FFFF.0032: unknown main item tag 0x0 [ 602.304848][ T5925] plantronics 0003:047F:FFFF.0032: unknown main item tag 0x0 [ 602.312324][ T5925] plantronics 0003:047F:FFFF.0032: unknown main item tag 0x0 [ 602.335990][ T5925] plantronics 0003:047F:FFFF.0032: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 602.499168][ T5904] usb 4-1: USB disconnect, device number 91 [ 603.828092][ T5904] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 603.997508][ T5904] usb 4-1: Using ep0 maxpacket: 16 [ 604.004186][ T5904] usb 4-1: config 0 has no interfaces? [ 604.012078][ T5904] usb 4-1: New USB device found, idVendor=06cb, idProduct=0006, bcdDevice=9a.eb [ 604.021695][ T5904] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 604.029915][ T5904] usb 4-1: Product: syz [ 604.034094][ T5904] usb 4-1: Manufacturer: syz [ 604.038752][ T5904] usb 4-1: SerialNumber: syz [ 604.045644][ T5904] usb 4-1: config 0 descriptor?? [ 604.459917][T22528] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 604.468968][T22528] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 604.480777][ T10] usb 4-1: USB disconnect, device number 92 [ 604.697599][T22493] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 604.697648][ T5838] Bluetooth: hci0: command 0x0c1a tx timeout [ 604.710880][T22496] Bluetooth: hci0: Opcode 0x0401 failed: -110 [ 605.096838][T22543] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.7056'. [ 605.305870][T22550] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.7061'. [ 605.947525][ T10] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 606.097506][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 606.114479][ T10] usb 3-1: config index 0 descriptor too short (expected 74, got 45) [ 606.132285][ T10] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 606.158563][ T10] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 606.172500][ T10] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 606.184679][ T10] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 606.195448][ T10] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 606.210355][ T10] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 606.234446][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 606.458165][ T10] usb 3-1: GET_CAPABILITIES returned 0 [ 606.471207][ T10] usbtmc 3-1:16.0: can't read capabilities [ 606.560232][T22610] netlink: 104 bytes leftover after parsing attributes in process `syz.0.7079'. [ 606.668477][ C0] usbtmc 3-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 606.682661][T22575] usbtmc 3-1:16.0: Unable to send data, error -71 [ 606.690369][ T5904] usb 3-1: USB disconnect, device number 85 [ 606.787499][ T5838] Bluetooth: hci0: command 0x0c1a tx timeout [ 607.246356][T22613] program syz.4.7081 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 607.577755][ T5904] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 607.734599][ T5904] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 607.769146][ T5904] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 607.780827][ T5904] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 607.803825][ T5904] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 607.813419][ T5904] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 607.826405][ T5904] usb 3-1: config 0 descriptor?? [ 608.259672][ T5904] plantronics 0003:047F:FFFF.0033: reserved main item tag 0xd [ 608.283733][ T5904] plantronics 0003:047F:FFFF.0033: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 608.522369][ T5904] usb 3-1: USB disconnect, device number 86 [ 608.531209][T22662] netlink: 104 bytes leftover after parsing attributes in process `syz.4.7100'. [ 609.281628][T22680] program syz.3.7110 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 609.345736][T22684] netlink: 104 bytes leftover after parsing attributes in process `syz.3.7111'. [ 609.377726][ T10] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 609.552839][ T10] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 609.563556][ T10] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 609.593265][ T10] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 609.613667][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 609.626893][ T10] usb 3-1: SerialNumber: syz [ 609.847831][ T10] usb 3-1: 0:2 : does not exist [ 609.861757][ T10] usb 3-1: USB disconnect, device number 87 [ 609.892493][ T5844] udevd[5844]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 610.647657][ T5904] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 610.819589][ T5904] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 610.833583][ T5904] usb 3-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 610.846296][ T5904] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 610.858808][ T5904] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 610.866807][ T5904] usb 3-1: Product: syz [ 610.872856][ T5904] usb 3-1: Manufacturer: syz [ 610.878799][ T5904] usb 3-1: SerialNumber: syz [ 610.893513][ T5904] cdc_mbim 3-1:1.0: skipping garbage [ 611.094613][T22701] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 611.499770][ T5838] Bluetooth: hci0: command 0x0c1a tx timeout [ 611.503735][T22687] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 611.717057][T22701] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 611.730264][ T5904] cdc_mbim 3-1:1.0: cdc-wdm0: USB WDM device [ 611.743664][ T5904] wwan wwan0: port wwan0mbim0 attached [ 611.759746][ T5904] cdc_mbim 3-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.2-1, CDC MBIM, c6:dc:26:68:fe:fd [ 611.931334][ T5837] usb 3-1: USB disconnect, device number 88 [ 611.952280][ T5837] cdc_mbim 3-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.2-1, CDC MBIM [ 612.011599][ T5837] wwan wwan0: port wwan0mbim0 disconnected [ 612.532131][T22690] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 612.846972][T22762] netlink: 168 bytes leftover after parsing attributes in process `syz.3.7134'. [ 612.908353][T22764] syzkaller1: entered promiscuous mode [ 612.940345][T22764] syzkaller1: entered allmulticast mode [ 613.130769][T22773] netlink: 'syz.3.7138': attribute type 29 has an invalid length. [ 613.143183][T22773] netlink: 'syz.3.7138': attribute type 29 has an invalid length. [ 613.152223][T22773] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7138'. [ 613.467992][T22785] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7144'. [ 613.494678][T22783] Bluetooth: MGMT ver 1.23 [ 613.588184][T19795] Bluetooth: hci0: command 0x0c1a tx timeout [ 613.598731][ T5838] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 613.698810][T22783] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 614.137716][ T9] usb 4-1: new high-speed USB device number 93 using dummy_hcd [ 614.217557][ T5924] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 614.309781][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 614.319818][ T9] usb 4-1: New USB device found, idVendor=2770, idProduct=930c, bcdDevice=8d.6a [ 614.329203][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 614.337233][ T9] usb 4-1: Product: syz [ 614.341617][ T9] usb 4-1: Manufacturer: syz [ 614.346244][ T9] usb 4-1: SerialNumber: syz [ 614.353519][ T9] usb 4-1: config 0 descriptor?? [ 614.363014][ T9] gspca_main: sq930x-2.14.0 probing 2770:930c [ 614.367523][ T5924] usb 5-1: Using ep0 maxpacket: 8 [ 614.381678][ T5924] usb 5-1: config index 0 descriptor too short (expected 74, got 45) [ 614.390323][ T5924] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 614.403902][ T5924] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 614.414659][ T5924] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 614.430644][ T5924] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 614.440951][ T5924] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 614.454219][ T5924] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 614.463635][ T5924] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 614.682828][ T5924] usb 5-1: GET_CAPABILITIES returned 0 [ 614.688812][ T5924] usbtmc 5-1:16.0: can't read capabilities [ 614.910088][ C0] usbtmc 5-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 614.919423][ C0] usbtmc 5-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 614.934557][T19795] block nbd2: Receive control failed (result -32) [ 614.935126][T22816] block nbd2: shutting down sockets [ 614.949657][T22809] usbtmc 5-1:16.0: Unable to send data, error -71 [ 614.961719][ T5904] usb 5-1: USB disconnect, device number 19 [ 615.327612][ T10] usb 3-1: new high-speed USB device number 89 using dummy_hcd [ 615.417510][ T9] gspca_sq930x: reg_w 0105 0f00 failed -71 [ 615.423424][ T9] sq930x 4-1:0.0: probe with driver sq930x failed with error -71 [ 615.435068][ T9] usb 4-1: USB disconnect, device number 93 [ 615.499646][ T10] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 615.514504][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 615.536791][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 615.554464][ T10] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 615.575995][ T10] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 615.587566][T19795] Bluetooth: hci3: command 0x0405 tx timeout [ 615.597166][ T10] usb 3-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 615.605430][ T10] usb 3-1: Manufacturer: syz [ 615.621182][ T10] usb 3-1: config 0 descriptor?? [ 615.657480][T19795] Bluetooth: hci0: command 0x0c1a tx timeout [ 616.049629][ T10] appleir 0003:05AC:8243.0034: unknown main item tag 0x0 [ 616.088435][ T10] appleir 0003:05AC:8243.0034: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.2-1/input0 [ 616.293551][T22858] syzkaller1: entered promiscuous mode [ 616.316144][T22858] syzkaller1: entered allmulticast mode [ 616.688175][T22876] netlink: 168 bytes leftover after parsing attributes in process `syz.4.7185'. [ 616.930216][ T30] audit: type=1326 audit(1751593210.632:110): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22886 comm="syz.4.7189" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f6eb0d8e929 code=0x0 [ 617.947061][T22902] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7191'. [ 618.148841][ T9] usb 3-1: USB disconnect, device number 89 [ 618.257767][T22908] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 618.698112][T22937] netlink: 16 bytes leftover after parsing attributes in process `syz.4.7209'. [ 618.888323][T22943] loop4: detected capacity change from 0 to 524255232 [ 619.071629][T22952] Bluetooth: MGMT ver 1.23 [ 619.095872][T22955] syzkaller1: entered promiscuous mode [ 619.109044][T22955] syzkaller1: entered allmulticast mode [ 619.604959][ T5849] Bluetooth: hci4: sending frame failed (-49) [ 619.607806][ T9] usb 4-1: new high-speed USB device number 94 using dummy_hcd [ 619.619353][ T5838] Bluetooth: hci4: Opcode 0x1003 failed: -49 [ 619.763192][T22985] netlink: 'syz.0.7230': attribute type 29 has an invalid length. [ 619.772366][T22985] netlink: 'syz.0.7230': attribute type 29 has an invalid length. [ 619.781019][T22985] netlink: 'syz.0.7230': attribute type 29 has an invalid length. [ 619.790190][T22985] netlink: 'syz.0.7230': attribute type 29 has an invalid length. [ 619.811750][ T9] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 619.823885][ T9] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 619.842116][ T9] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 619.853927][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 619.863793][ T9] usb 4-1: Product: syz [ 619.868434][ T9] usb 4-1: Manufacturer: syz [ 619.871645][T22987] netlink: 184 bytes leftover after parsing attributes in process `syz.0.7231'. [ 619.873142][ T9] usb 4-1: SerialNumber: syz [ 619.894495][ T9] cdc_mbim 4-1:1.0: skipping garbage [ 619.907698][ T5924] usb 3-1: new high-speed USB device number 90 using dummy_hcd [ 619.997629][ T5925] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 620.068038][ T5924] usb 3-1: Using ep0 maxpacket: 16 [ 620.082559][ T5924] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 620.103884][ T5924] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 620.104258][T22964] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 620.117041][ T5924] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 620.133470][ T5924] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 620.142703][ T5838] Bluetooth: hci0: command 0x0c1a tx timeout [ 620.149030][ T5925] usb 5-1: Using ep0 maxpacket: 16 [ 620.155439][T19795] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 620.162330][ T5924] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 620.170535][ T5924] usb 3-1: Product: syz [ 620.174937][ T5924] usb 3-1: Manufacturer: syz [ 620.179796][ T5924] usb 3-1: SerialNumber: syz [ 620.184704][ T5925] usb 5-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 620.193775][ T5925] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 620.215865][ T5925] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 620.227451][T19795] Bluetooth: hci3: command 0x0405 tx timeout [ 620.235639][ T5925] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 620.245219][ T5925] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 620.253607][ T5925] usb 5-1: Product: syz [ 620.258021][ T5925] usb 5-1: Manufacturer: syz [ 620.262693][ T5925] usb 5-1: SerialNumber: syz [ 620.620351][ T5924] usb 3-1: 0:2 : does not exist [ 620.741575][T22964] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 620.752831][ T9] cdc_mbim 4-1:1.0: cdc-wdm0: USB WDM device [ 620.763207][ T9] wwan wwan0: port wwan0mbim0 attached [ 620.783141][ T9] cdc_mbim 4-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.3-1, CDC MBIM, 9a:cb:5c:5f:35:9c [ 620.997107][ T5837] usb 4-1: USB disconnect, device number 94 [ 621.009905][ T5837] cdc_mbim 4-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.3-1, CDC MBIM [ 621.073177][ T5837] wwan wwan0: port wwan0mbim0 disconnected [ 621.253780][ T5925] usb 5-1: 0:2 : does not exist [ 621.271147][ T5924] usb 3-1: USB disconnect, device number 90 [ 621.698925][ T5925] usb 5-1: 1:0: failed to get current value for ch 0 (-22) [ 621.763164][ T5925] usb 5-1: USB disconnect, device number 20 [ 621.890370][T16825] udevd[16825]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 622.696183][ T30] audit: type=1326 audit(1751593216.392:111): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23063 comm="syz.2.7253" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fd7d238e929 code=0x0 [ 623.199689][T23083] netlink: 184 bytes leftover after parsing attributes in process `syz.3.7259'. [ 623.498555][T19795] block nbd4: Receive control failed (result -32) [ 623.510770][T23068] block nbd4: shutting down sockets [ 623.686685][ T30] audit: type=1326 audit(1751593217.382:112): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23088 comm="syz.3.7271" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fd7cc98e929 code=0x0 [ 623.797462][ T5925] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 623.903388][T23107] netlink: 184 bytes leftover after parsing attributes in process `syz.4.7270'. [ 623.963006][ T5925] usb 3-1: Using ep0 maxpacket: 8 [ 623.985449][ T5925] usb 3-1: New USB device found, idVendor=2770, idProduct=930c, bcdDevice=8d.6a [ 623.998840][ T5925] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 624.006877][ T5925] usb 3-1: Product: syz [ 624.011523][ T5925] usb 3-1: Manufacturer: syz [ 624.016156][ T5925] usb 3-1: SerialNumber: syz [ 624.028491][ T5925] usb 3-1: config 0 descriptor?? [ 624.037935][ T5925] gspca_main: sq930x-2.14.0 probing 2770:930c [ 624.327469][ T5924] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 624.478955][ T5924] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 624.490105][ T5924] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 624.501369][ T5924] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 624.511212][ T5924] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 624.525559][ T5924] usb 5-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 624.534712][ T5924] usb 5-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 624.546678][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.546778][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.562826][ T5924] usb 5-1: Manufacturer: syz [ 624.573323][ T5924] usb 5-1: config 0 descriptor?? [ 624.990790][ T5924] appleir 0003:05AC:8243.0035: unknown main item tag 0x0 [ 625.003204][ T5924] appleir 0003:05AC:8243.0035: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.4-1/input0 [ 625.077704][ T5925] gspca_sq930x: reg_w 0105 0f00 failed -71 [ 625.083655][ T5925] sq930x 3-1:0.0: probe with driver sq930x failed with error -71 [ 625.100132][ T5925] usb 3-1: USB disconnect, device number 91 [ 626.041352][T23140] netlink: 16 bytes leftover after parsing attributes in process `syz.3.7282'. [ 626.174986][ T1106] nci: nci_rf_discover_ntf_packet: unsupported rf_tech_and_mode 0x1b [ 627.061842][T23165] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7293'. [ 627.092470][ T5904] usb 5-1: USB disconnect, device number 21 [ 628.205780][ T5925] Process accounting resumed [ 628.379357][ T5924] usb 4-1: new high-speed USB device number 95 using dummy_hcd [ 628.550131][ T5924] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 628.575561][ T5924] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 628.598962][ T5924] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 628.610365][ T5924] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 628.625583][ T5924] usb 4-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 628.635190][ T5924] usb 4-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 628.643747][ T5924] usb 4-1: Manufacturer: syz [ 628.674064][ T5924] usb 4-1: config 0 descriptor?? [ 629.040124][T23213] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 629.122679][ T5924] appleir 0003:05AC:8243.0036: unknown main item tag 0x0 [ 629.158679][ T5924] appleir 0003:05AC:8243.0036: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.3-1/input0 [ 630.869481][ T5837] Process accounting resumed [ 631.249127][ T5904] usb 4-1: USB disconnect, device number 95 [ 631.311761][T23287] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7344'. [ 631.373590][T23289] 9pnet: p9_errstr2errno: server reported unknown error [ 631.474275][T23291] loop3: detected capacity change from 0 to 1 [ 631.485233][T23291] Dev loop3: unable to read RDB block 1 [ 631.491151][T23291] loop3: unable to read partition table [ 631.497869][T23291] loop3: partition table beyond EOD, truncated [ 631.504193][T23291] loop_reread_partitions: partition scan of loop3 (被x ) failed (rc=-5) [ 632.817476][ T5904] usb 3-1: new high-speed USB device number 92 using dummy_hcd [ 632.989306][ T5904] usb 3-1: config 0 has no interfaces? [ 632.994852][ T5904] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 633.014637][ T5904] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 633.050812][ T5904] usb 3-1: config 0 descriptor?? [ 633.278679][T23327] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 633.300406][T23327] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 633.312985][T23327] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 633.323413][T23327] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 633.337126][T23327] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 633.352434][T23327] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 633.364854][T23355] binder: 23354:23355 ioctl c018620b 200000000100 returned -14 [ 633.381309][ T5837] usb 3-1: USB disconnect, device number 92 [ 633.847572][ T5837] usb 3-1: new high-speed USB device number 93 using dummy_hcd [ 634.009506][ T5837] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 634.025731][ T5837] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 634.061714][T23384] trusted_key: syz.3.7386 sent an empty control message without MSG_MORE. [ 634.189082][T23386] netlink: 23 bytes leftover after parsing attributes in process `syz.0.7387'. [ 634.309811][ T5837] usb 3-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 634.323554][ T5837] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 634.334482][ T5837] usb 3-1: Product: syz [ 634.340955][ T5837] usb 3-1: Manufacturer: syz [ 634.350824][ T5837] usb 3-1: SerialNumber: syz [ 634.357207][ T5925] libceph: connect (1)[c::]:6789 error -22 [ 634.363312][ T5925] libceph: mon0 (1)[c::]:6789 connect error [ 634.388955][ T5837] usb 3-1: unit 9 not found! [ 634.589251][ T5837] usb 3-1: 4:0: cannot get min/max values for control 2 (id 4) [ 634.630165][ T5925] libceph: connect (1)[c::]:6789 error -22 [ 634.639481][ T5837] usb 3-1: USB disconnect, device number 93 [ 634.647196][ T5925] libceph: mon0 (1)[c::]:6789 connect error [ 634.676916][T23399] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7391'. [ 634.677653][ T5844] udevd[5844]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 635.131051][T23390] ceph: No mds server is up or the cluster is laggy [ 635.147510][ T5837] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 635.181299][T23406] syzkaller1: entered promiscuous mode [ 635.186826][T23406] syzkaller1: entered allmulticast mode [ 635.297978][ T5837] usb 5-1: Using ep0 maxpacket: 8 [ 635.314038][ T5837] usb 5-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 635.337830][ T5837] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 635.345881][ T5837] usb 5-1: Product: syz [ 635.358725][ T5837] usb 5-1: Manufacturer: syz [ 635.363413][ T5837] usb 5-1: SerialNumber: syz [ 635.385342][ T5837] usb 5-1: config 0 descriptor?? [ 635.414753][ T5837] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 636.637698][ T5837] gspca_sonixj: reg_w1 err -71 [ 636.683116][ T5837] sonixj 5-1:0.0: probe with driver sonixj failed with error -71 [ 636.699894][ T5837] usb 5-1: USB disconnect, device number 22 [ 637.167213][T23467] random: crng reseeded on system resumption [ 637.222593][T23467] Restarting kernel threads ... [ 637.238558][T23467] Done restarting kernel threads. [ 637.443671][T23475] 9pnet: p9_errstr2errno: server reported unknown error pA;KZ44/@qkp [ 637.443671][T23475] [ 639.077666][ T5904] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 639.237893][ T5904] usb 5-1: Using ep0 maxpacket: 8 [ 639.255365][ T5904] usb 5-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 639.285443][ T5904] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 639.304761][ T5904] usb 5-1: Product: syz [ 639.314881][ T5904] usb 5-1: Manufacturer: syz [ 639.326334][ T5904] usb 5-1: SerialNumber: syz [ 639.344250][ T5904] usb 5-1: config 0 descriptor?? [ 639.557564][ T5904] usb 5-1: dvb_usb_v2: found a 'Terratec H7' in warm state [ 639.600699][ T5925] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 639.787497][ T5925] usb 3-1: Using ep0 maxpacket: 32 [ 639.794433][ T5925] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 639.817661][ T5925] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 639.829879][ T5925] usb 3-1: config 0 descriptor?? [ 639.958019][ T5837] usb 4-1: new high-speed USB device number 96 using dummy_hcd [ 640.042806][ T5925] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 640.055096][ T5925] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 640.086466][ T5925] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 640.105699][ T5925] usb 3-1: media controller created [ 640.130652][ T5837] usb 4-1: Using ep0 maxpacket: 8 [ 640.142698][ T5837] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 640.171385][ T5837] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 640.191056][ T5925] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 640.207457][ T5837] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 640.227515][ T5837] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 640.255221][ T5837] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 640.265186][ T5837] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 640.375104][ T5904] usb write operation failed. (-71) [ 640.398538][ T5904] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 640.416421][ T5904] dvbdev: DVB: registering new adapter (Terratec H7) [ 640.423656][ T5904] usb 5-1: media controller created [ 640.434820][ T5904] usb read operation failed. (-71) [ 640.441999][ T5904] usb write operation failed. (-71) [ 640.453534][ T5904] dvb_usb_az6007 5-1:0.0: probe with driver dvb_usb_az6007 failed with error -5 [ 640.470445][ T5904] usb 5-1: USB disconnect, device number 23 [ 640.493302][ T5837] usb 4-1: GET_CAPABILITIES returned 0 [ 640.499330][ T5837] usbtmc 4-1:16.0: can't read capabilities [ 640.703928][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 640.713238][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 640.722308][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 640.731370][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 640.742612][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 640.751724][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 640.760929][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 640.770044][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 640.779160][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 640.788265][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 640.798394][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 640.807535][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 640.816610][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 640.826243][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 640.835381][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 640.844977][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 640.858132][ T5904] usb 4-1: USB disconnect, device number 96 [ 640.877841][ T5925] az6027: usb out operation failed. (-71) [ 640.883917][ T5925] stb0899_attach: Driver disabled by Kconfig [ 640.890501][ T5925] az6027: no front-end attached [ 640.890501][ T5925] [ 640.898627][ T5925] az6027: usb out operation failed. (-71) [ 640.918197][ T5925] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 640.927231][ T5925] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input80 [ 640.959566][ T5925] dvb-usb: schedule remote query interval to 400 msecs. [ 640.966567][ T5925] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 641.007185][ T5925] usb 3-1: USB disconnect, device number 94 [ 641.106356][ T5925] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 641.642504][T23586] binder: 23585:23586 ioctl c0306201 2000000003c0 returned -14 [ 641.854828][T23592] input: syz1 as /devices/virtual/input/input81 [ 642.977838][T23614] netlink: 'syz.3.7479': attribute type 12 has an invalid length. [ 643.237511][ T9] usb 3-1: new high-speed USB device number 95 using dummy_hcd [ 643.407546][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 643.416967][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 643.437443][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 643.457378][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 643.477481][ T9] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 643.487189][ T9] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 643.540961][ T9] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 643.550898][ T9] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 643.571038][ T9] usb 3-1: Manufacturer: syz [ 643.606319][ T9] usb 3-1: config 0 descriptor?? [ 643.897896][T23624] 9pnet: p9_errstr2errno: server reported unknown error pA;KZ4 [ 643.957474][ T9] rc_core: IR keymap rc-hauppauge not found [ 643.963435][ T9] Registered IR keymap rc-empty [ 643.977680][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 644.015849][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 644.038578][ T9] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 644.091061][ T9] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input82 [ 644.108619][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 644.127528][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 644.147721][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 644.167692][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 644.197839][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 644.218218][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 644.248523][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 644.267575][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 644.287538][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 644.307618][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 644.339064][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 644.371560][ T9] mceusb 3-1:0.0: Registered 424242424242 with mce emulator interface version 4e [ 644.383543][ T5877] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 644.401847][ T9] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 644.477968][ T9] usb 3-1: USB disconnect, device number 95 [ 644.551220][ T5877] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 644.578544][ T5877] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 644.609268][ T5877] usb 5-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 644.628229][ T5877] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 644.648805][ T5877] usb 5-1: config 0 descriptor?? [ 645.035305][T23643] 9pnet: p9_errstr2errno: server reported unknown error pA;KZ44/@qkp [ 645.035305][T23643] C<+ [ 645.270050][ T5877] usb 5-1: string descriptor 0 read error: -22 [ 645.492745][ T5877] input: HID 256c:006d as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:256C:006D.0037/input/input83 [ 645.507069][T23657] loop1: detected capacity change from 0 to 7 [ 645.534328][ T5844] loop1: [POWERTEC] [ 645.554138][T23657] loop1: [POWERTEC] [ 645.613715][ T5877] uclogic 0003:256C:006D.0037: input,hidraw0: USB HID v0.00 Device [HID 256c:006d] on usb-dummy_hcd.4-1/input0 [ 645.675938][ T5877] usb 5-1: USB disconnect, device number 24 [ 645.814937][T23662] fido_id[23662]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 645.887842][ T10] usb 3-1: new high-speed USB device number 96 using dummy_hcd [ 645.914102][T23671] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7504'. [ 646.051160][ T10] usb 3-1: Using ep0 maxpacket: 32 [ 646.061522][ T10] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 646.075568][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 646.089702][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 646.099758][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 646.111189][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 646.125870][ T10] usb 3-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 646.135186][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 646.143482][ T10] usb 3-1: Product: syz [ 646.148290][ T10] usb 3-1: Manufacturer: syz [ 646.153310][ T10] usb 3-1: SerialNumber: syz [ 646.162025][ T10] usb 3-1: config 0 descriptor?? [ 646.268801][T23682] binder: 23681:23682 ioctl c0306201 200000000640 returned -22 [ 646.578545][ T10] iforce 3-1:0.0: usb_submit_urb failed: -32 [ 646.584797][ T10] input input84: Device does not respond to id packet M [ 646.592793][ T10] iforce 3-1:0.0: usb_submit_urb failed: -32 [ 646.599466][ T10] input input84: Device does not respond to id packet P [ 646.607026][ T10] iforce 3-1:0.0: usb_submit_urb failed: -32 [ 646.614760][ T10] input input84: Device does not respond to id packet B [ 646.828317][ T10] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 646.846309][ T10] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 646.853736][ T10] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 646.862444][ T10] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 646.871121][ T10] input: Unknown I-Force Device [%04x:%04x] as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input84 [ 646.902813][ T10] usb 3-1: USB disconnect, device number 96 [ 646.943721][ T68] nci: nci_extract_activation_params_iso_dep: unsupported activation_rf_tech_and_mode 0x6 [ 648.060762][T23748] overlayfs: failed to verify upper (604/file0, ino=3170, err=-116) [ 648.082060][T23748] overlayfs: failed to verify index dir 'upper' xattr [ 648.097141][T23748] overlayfs: try deleting index dir or mounting with '-o index=off' to disable inodes index. [ 648.561635][T23771] binder: 23770:23771 ioctl c0306201 2000000003c0 returned -14 [ 648.597596][ T5925] usb 4-1: new high-speed USB device number 97 using dummy_hcd [ 648.777743][ T5925] usb 4-1: Using ep0 maxpacket: 32 [ 648.788474][ T5925] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 648.821406][ T5925] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 648.847431][ T5925] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 648.865849][ T5925] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 648.921126][ T5925] usb 4-1: config 0 descriptor?? [ 648.959476][ T5925] hub 4-1:0.0: USB hub found [ 649.151620][ T5925] hub 4-1:0.0: config failed, can't read hub descriptor (err -22) [ 649.279587][ T5933] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 649.397980][ T5925] hid-generic 0003:046D:C31C.0038: hidraw0: USB HID v8.00 Device [HID 046d:c31c] on usb-dummy_hcd.3-1/input0 [ 649.437498][ T5933] usb 5-1: Using ep0 maxpacket: 32 [ 649.446155][ T5933] usb 5-1: config 0 has an invalid interface number: 12 but max is 0 [ 649.464692][ T5933] usb 5-1: config 0 has no interface number 0 [ 649.474858][ T5933] usb 5-1: config 0 interface 12 has no altsetting 0 [ 649.497267][ T5933] usb 5-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 649.517472][ T5933] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 649.525664][ T5933] usb 5-1: Product: syz [ 649.545246][ T5933] usb 5-1: Manufacturer: syz [ 649.557759][ T5933] usb 5-1: SerialNumber: syz [ 649.583277][ T5933] usb 5-1: config 0 descriptor?? [ 649.718461][ T5837] usb 4-1: USB disconnect, device number 97 [ 650.809616][ T5933] f81534 5-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 650.819405][ T5933] f81534 5-1:0.12: f81534_find_config_idx: read failed: -71 [ 650.826750][ T5933] f81534 5-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 650.841251][ T5933] f81534 5-1:0.12: probe with driver f81534 failed with error -71 [ 650.859018][ T5933] usb 5-1: USB disconnect, device number 25 [ 651.367602][ T5877] usb 4-1: new high-speed USB device number 98 using dummy_hcd [ 651.467477][ T10] usb 3-1: new high-speed USB device number 97 using dummy_hcd [ 651.561731][ T5877] usb 4-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 651.575612][ T5877] usb 4-1: config 0 interface 0 has no altsetting 0 [ 651.594087][ T5877] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 651.617862][ T5877] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 651.626075][ T5877] usb 4-1: Product: syz [ 651.629365][T23855] netlink: 'syz.0.7587': attribute type 10 has an invalid length. [ 651.650283][ T10] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 651.660187][ T5877] usb 4-1: Manufacturer: syz [ 651.661737][T23855] hsr_slave_0: left promiscuous mode [ 651.665191][ T10] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 651.680989][T23855] hsr_slave_1: left promiscuous mode [ 651.684754][ T5877] usb 4-1: SerialNumber: syz [ 651.697761][ T5877] usb 4-1: config 0 descriptor?? [ 651.713809][ T5877] usb 4-1: selecting invalid altsetting 0 [ 651.726234][ T10] usb 3-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 651.741943][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 651.753531][ T10] usb 3-1: Product: syz [ 651.765474][ T10] usb 3-1: Manufacturer: syz [ 651.771319][ T10] usb 3-1: SerialNumber: syz [ 651.779303][ T10] usb 3-1: config 0 descriptor?? [ 651.787183][T23839] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 651.843950][T23839] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 651.920798][ T5877] usb 4-1: USB disconnect, device number 98 [ 652.071048][T23839] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 652.093453][T23839] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 652.475116][T23874] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7595'. [ 652.927986][ T10] dm9601 3-1:0.0 (unnamed net_device) (uninitialized): Error reading MODE_CTRL [ 652.951037][ T10] usb 3-1: USB disconnect, device number 97 [ 653.407628][ T5933] psmouse serio2: Failed to reset mouse on : -5 [ 653.585458][T23900] loop6: detected capacity change from 0 to 1 [ 653.601045][T23900] Dev loop6: unable to read RDB block 1 [ 653.612488][T23900] loop6: unable to read partition table [ 653.619012][T23900] loop6: partition table beyond EOD, truncated [ 653.625475][T23900] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 653.843846][T23906] syzkaller1: entered promiscuous mode [ 653.852826][T23906] syzkaller1: entered allmulticast mode [ 654.699705][T23928] netlink: 176 bytes leftover after parsing attributes in process `syz.2.7617'. [ 655.446810][T23955] syzkaller0: refused to change device tx_queue_len [ 655.729066][T23966] input: syz1 as /devices/virtual/input/input86 [ 655.808272][ T9] usb 3-1: new full-speed USB device number 98 using dummy_hcd [ 655.969936][ T9] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 655.984137][ T9] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 656.006581][ T9] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 656.023515][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 656.031829][ T9] usb 3-1: Product: syz [ 656.036501][ T9] usb 3-1: Manufacturer: syz [ 656.050009][ T9] usb 3-1: SerialNumber: syz [ 656.186886][T18227] nci: nci_rx_work: unknown MT 0x6 [ 656.290394][ T9] usb 3-1: 0:2 : does not exist [ 656.312672][ T9] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 656.349182][ T9] usb 3-1: USB disconnect, device number 98 [ 656.398717][ T5844] udevd[5844]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 657.217597][ T5933] misc userio: Buffer overflowed, userio client isn't keeping up [ 657.394594][T24000] 9pnet: p9_errstr2errno: server reported unknown error [ 658.070399][T24017] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7657'. [ 658.293399][ T5933] input: PS/2 Generic Mouse as /devices/serio2/input/input85 [ 658.539333][ T5933] psmouse serio2: Failed to enable mouse on [ 658.776866][T24035] batadv_slave_0: entered promiscuous mode [ 658.803483][T24035] batadv_slave_0: left promiscuous mode [ 659.177639][ T30] audit: type=1326 audit(1751593252.872:113): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24051 comm="syz.4.7673" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f6eb0d8e929 code=0x0 [ 659.516868][T24067] netlink: 'syz.0.7680': attribute type 27 has an invalid length. [ 659.559065][T24067] 0{X: left allmulticast mode [ 659.607359][T24067] bridge0: port 2(bridge_slave_1) entered disabled state [ 659.614935][T24067] bridge0: port 1(bridge_slave_0) entered disabled state [ 659.773173][T24067] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 659.793238][T24067] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 659.938173][ T1106] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 659.946612][ T1106] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 659.959360][ T1106] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 659.972949][ T1106] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 660.410863][T24094] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 660.574361][T24101] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 661.857495][ T10] usb 3-1: new high-speed USB device number 99 using dummy_hcd [ 662.019900][ T10] usb 3-1: Using ep0 maxpacket: 32 [ 662.049065][ T10] usb 3-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 662.067394][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 662.082749][ T10] usb 3-1: Product: syz [ 662.090986][ T10] usb 3-1: Manufacturer: syz [ 662.097151][ T10] usb 3-1: SerialNumber: syz [ 662.109714][ T10] usb 3-1: config 0 descriptor?? [ 662.128922][ T10] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 662.607276][T24178] mac80211_hwsim hwsim15 : renamed from wlan0 (while UP) [ 662.782097][T24182] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 663.033771][T24190] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7734'. [ 663.107516][ T5933] usb 5-1: new full-speed USB device number 26 using dummy_hcd [ 663.271684][ T5933] usb 5-1: config 5 has an invalid interface number: 143 but max is 1 [ 663.291777][ T5933] usb 5-1: config 5 has an invalid interface number: 179 but max is 1 [ 663.321115][ T5933] usb 5-1: config 5 has an invalid descriptor of length 10, skipping remainder of the config [ 663.336890][ T10] gspca_ov534_9: reg_w failed -71 [ 663.338263][ T5933] usb 5-1: config 5 has no interface number 0 [ 663.358169][ T5933] usb 5-1: config 5 has no interface number 1 [ 663.364433][ T5933] usb 5-1: config 5 interface 143 altsetting 138 endpoint 0x4 has invalid maxpacket 1023, setting to 64 [ 663.382046][ T5933] usb 5-1: config 5 interface 143 has no altsetting 0 [ 663.393958][ T5933] usb 5-1: New USB device found, idVendor=19d2, idProduct=0038, bcdDevice= e.8c [ 663.404833][ T5933] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 663.413148][ T5933] usb 5-1: Product: syz [ 663.417906][ T5933] usb 5-1: Manufacturer: syz [ 663.422542][ T5933] usb 5-1: SerialNumber: syz [ 663.637438][ T10] gspca_ov534_9: Unknown sensor 0000 [ 663.637533][ T10] ov534_9 3-1:0.0: probe with driver ov534_9 failed with error -22 [ 663.660348][ T10] usb 3-1: USB disconnect, device number 99 [ 663.661281][ T5933] usb 5-1: bad CDC descriptors [ 663.707488][ T5933] usb 5-1: USB disconnect, device number 26 [ 664.693755][T24246] 9pnet: p9_errstr2errno: server reported unknown error pA;KZ44/@qkp [ 664.693755][T24246] C< [ 664.727586][ T5933] usb 3-1: new low-speed USB device number 100 using dummy_hcd [ 664.902429][ T5933] usb 3-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 664.915817][ T5933] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 664.927107][ T5933] usb 3-1: config 0 descriptor?? [ 666.184913][ T5933] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 666.187534][ T10] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 666.210865][ T5933] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 666.227587][ T5933] asix 3-1:0.0: probe with driver asix failed with error -71 [ 666.239086][ T5933] usb 3-1: USB disconnect, device number 100 [ 666.357480][ T10] usb 4-1: Using ep0 maxpacket: 8 [ 666.364866][ T10] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 666.373457][ T10] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 666.383968][ T10] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 666.393791][ T10] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 666.403797][ T10] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 666.416818][ T10] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 666.426401][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 666.649752][ T10] usb 4-1: usb_control_msg returned -32 [ 666.655419][ T10] usbtmc 4-1:16.0: can't read capabilities [ 666.967601][ T10] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 667.037543][ T5925] usb 3-1: new high-speed USB device number 101 using dummy_hcd [ 667.059460][T24305] usbtmc 4-1:16.0: usb_control_msg returned -32 [ 667.139019][ T10] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 667.151869][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 667.162905][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 667.173910][ T10] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 667.187269][ T10] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 667.191192][ T5925] usb 3-1: Using ep0 maxpacket: 8 [ 667.196405][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 667.205969][ T5925] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 667.212707][ T10] usb 5-1: config 0 descriptor?? [ 667.224666][ T5925] usb 3-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 667.234272][ T5925] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 667.246810][ T5925] usb 3-1: config 0 descriptor?? [ 667.255930][ T5925] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 667.272702][ T5933] usb 4-1: USB disconnect, device number 99 [ 667.666876][ T10] plantronics 0003:047F:FFFF.0039: ignoring exceeding usage max [ 667.688164][ T10] plantronics 0003:047F:FFFF.0039: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 668.067873][ T10] usb 4-1: new full-speed USB device number 100 using dummy_hcd [ 668.229509][ T10] usb 4-1: config 0 has an invalid interface number: 128 but max is 0 [ 668.238297][ T10] usb 4-1: config 0 has no interface number 0 [ 668.246794][ T10] usb 4-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 668.256030][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 668.264281][ T10] usb 4-1: Product: syz [ 668.268652][ T10] usb 4-1: Manufacturer: syz [ 668.273306][ T10] usb 4-1: SerialNumber: syz [ 668.281212][ T10] usb 4-1: config 0 descriptor?? [ 668.481736][ T5925] gspca_vc032x: reg_w err -71 [ 668.486552][ T5925] vc032x 3-1:0.0: probe with driver vc032x failed with error -71 [ 668.493596][ T5897] usb 5-1: USB disconnect, device number 27 [ 668.509144][ T5925] usb 3-1: USB disconnect, device number 101 [ 669.286665][T24331] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7796'. [ 669.332030][ T10] usb 4-1: non-Atmel transceiver xxxx3800 [ 669.533745][ T10] usb 4-1: Firmware version (0.0) predates our first public release. [ 669.548254][ T10] usb 4-1: Please update to version 0.2 or newer [ 669.569695][ T10] usb 4-1: atusb_probe: initialization failed, error = -19 [ 669.606781][ T10] usb 4-1: USB disconnect, device number 100 [ 670.346099][T24367] netlink: 763 bytes leftover after parsing attributes in process `syz.3.7811'. [ 671.036982][T24380] input: syz0 as /devices/virtual/input/input87 [ 671.255448][T24386] 9pnet: p9_errstr2errno: server reported unknown error pA;KZ44/@q [ 672.995822][T24441] 9pnet: p9_errstr2errno: server reported unknown error pA;KZ44/@qkp [ 672.995822][T24441] [ 673.098314][T19795] Bluetooth: hci0: command 0x0c1a tx timeout [ 673.104495][ T5925] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 673.116035][ T5925] Bluetooth: hci0: Error when powering off device on rfkill (-110) [ 673.127534][ T10] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 673.307753][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 673.316967][ T10] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 673.327503][ T10] usb 5-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 673.336564][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 673.350916][ T10] usb 5-1: config 0 descriptor?? [ 673.360294][ T10] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 674.576977][ T10] gspca_vc032x: reg_w err -71 [ 674.584694][ T10] vc032x 5-1:0.0: probe with driver vc032x failed with error -71 [ 674.596987][ T10] usb 5-1: USB disconnect, device number 28 [ 675.257860][ T5925] Bluetooth: hci3: Opcode 0x0c1a failed: -110 [ 675.259309][T19795] Bluetooth: hci3: command 0x0405 tx timeout [ 675.270583][ T5925] Bluetooth: hci3: Error when powering off device on rfkill (-110) [ 676.057972][ T10] usb 4-1: new high-speed USB device number 101 using dummy_hcd [ 676.207589][ T10] usb 4-1: Using ep0 maxpacket: 8 [ 676.221894][ T10] usb 4-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 676.235166][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 676.244446][ T10] usb 4-1: Product: syz [ 676.252501][ T10] usb 4-1: Manufacturer: syz [ 676.257253][ T10] usb 4-1: SerialNumber: syz [ 676.265787][ T10] usb 4-1: config 0 descriptor?? [ 676.275306][ T10] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 676.472091][T24526] 9pnet: p9_errstr2errno: server reported unknown error pA;KZ44/@qkp [ 676.472091][T24526] C<+ [ 676.627470][ T5837] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 676.777630][ T5837] usb 5-1: Using ep0 maxpacket: 32 [ 676.789617][ T5837] usb 5-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 676.798975][ T5837] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 676.810461][ T5837] usb 5-1: config 0 descriptor?? [ 677.021493][ T5837] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 677.033345][ T5837] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 677.050853][ T5837] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 677.058216][ T5837] usb 5-1: media controller created [ 677.081665][ T5837] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 677.500991][ T10] gspca_sonixj: reg_w1 err -71 [ 677.547691][ T10] sonixj 4-1:0.0: probe with driver sonixj failed with error -71 [ 677.561555][ T10] usb 4-1: USB disconnect, device number 101 [ 677.837814][ T5837] az6027: usb out operation failed. (-71) [ 677.843594][ T5837] stb0899_attach: Driver disabled by Kconfig [ 677.850034][ T5837] az6027: no front-end attached [ 677.850034][ T5837] [ 677.857586][ T5837] az6027: usb out operation failed. (-71) [ 677.863852][ T5837] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 677.874148][ T5837] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input88 [ 677.899488][ T5837] dvb-usb: schedule remote query interval to 400 msecs. [ 677.906517][ T5837] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 677.925058][ T5837] usb 5-1: USB disconnect, device number 29 [ 677.981114][ T5837] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 678.222126][T24547] random: crng reseeded on system resumption [ 678.255225][T24547] Restarting kernel threads ... [ 678.266748][T24547] Done restarting kernel threads. [ 678.457727][T24553] usb usb8: usbfs: process 24553 (syz.3.7884) did not claim interface 0 before use [ 678.480240][T24556] loop1: detected capacity change from 0 to 7 [ 678.507425][T24556] loop1: [POWERTEC] [ 678.555866][T24560] netlink: 'syz.0.7886': attribute type 12 has an invalid length. [ 679.062814][T24576] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7900'. [ 680.368364][T24604] usb usb8: usbfs: process 24604 (syz.4.7912) did not claim interface 0 before use [ 680.626835][T24613] overlayfs: failed to verify upper (1797/file0, ino=9278, err=-116) [ 680.657537][T24613] overlayfs: failed to verify index dir 'upper' xattr [ 680.674931][T24613] overlayfs: try deleting index dir or mounting with '-o index=off' to disable inodes index. [ 680.794536][T24621] binder: 24620:24621 ioctl c0306201 2000000003c0 returned -14 [ 681.298890][T24636] usb usb8: usbfs: process 24636 (syz.2.7926) did not claim interface 0 before use [ 681.555324][ T10] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 681.717449][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 681.730164][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 681.754999][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 681.777172][ T10] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 681.797952][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 681.822339][ T10] usb 5-1: config 0 descriptor?? [ 681.831001][ T10] hub 5-1:0.0: USB hub found [ 681.891769][T24659] netlink: 'syz.2.7946': attribute type 27 has an invalid length. [ 682.012650][T24659] bridge0: port 2(bridge_slave_1) entered disabled state [ 682.022646][T24659] bridge0: port 1(bridge_slave_0) entered disabled state [ 682.063330][ T10] hub 5-1:0.0: config failed, can't read hub descriptor (err -22) [ 682.172880][T24659] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 682.190185][T24659] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 682.304506][ T12] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 682.319327][ T10] hid-generic 0003:046D:C31C.003A: hidraw0: USB HID v8.00 Device [HID 046d:c31c] on usb-dummy_hcd.4-1/input0 [ 682.337694][ T12] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 682.346865][ T12] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 682.377624][ T12] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 682.638549][ T10] usb 5-1: USB disconnect, device number 30 [ 683.754579][T24693] 9pnet: p9_errstr2errno: server reported unknown error pA;KZ44/@q [ 683.996172][T24703] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 684.497599][ T5925] usb 3-1: new full-speed USB device number 102 using dummy_hcd [ 684.659526][ T5925] usb 3-1: config 0 has an invalid interface number: 50 but max is 0 [ 684.668512][ T5925] usb 3-1: config 0 has no interface number 0 [ 684.677743][ T5925] usb 3-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 684.697558][ T5925] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 684.716032][ T5925] usb 3-1: Product: syz [ 684.723836][ T5925] usb 3-1: Manufacturer: syz [ 684.733511][ T5925] usb 3-1: SerialNumber: syz [ 684.750473][ T5925] usb 3-1: config 0 descriptor?? [ 684.767773][ T5925] yurex 3-1:0.50: Could not find endpoints [ 684.943133][T24729] input: syz0 as /devices/virtual/input/input89 [ 685.223402][ T5925] usb 3-1: USB disconnect, device number 102 [ 685.567428][ T10] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 685.717412][ T10] usb 5-1: Using ep0 maxpacket: 16 [ 685.724705][ T10] usb 5-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 685.738402][ T10] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 685.765454][ T10] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 685.781273][ T10] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 685.791698][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 685.800319][ T10] usb 5-1: Product: syz [ 685.807853][ T10] usb 5-1: Manufacturer: syz [ 685.812493][ T10] usb 5-1: SerialNumber: syz [ 685.981365][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.988081][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.187436][ T5897] usb 3-1: new full-speed USB device number 103 using dummy_hcd [ 686.241612][ T10] usb 5-1: 0:2 : does not exist [ 686.340823][ T5897] usb 3-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 686.353249][ T5897] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 686.365204][ T5897] usb 3-1: config 0 descriptor?? [ 686.382475][ T5897] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 686.644029][T24770] netlink: 40 bytes leftover after parsing attributes in process `syz.0.7986'. [ 686.671140][ T5897] gp8psk: usb in 128 operation failed. [ 686.885131][ T5897] gp8psk: usb in 146 operation failed. [ 686.894286][ T5897] gp8psk: failed to get FW version [ 686.908379][ T5897] gp8psk: FPGA Version = 46 [ 687.087583][ T10] usb 5-1: 1:0: failed to get current value for ch 0 (-22) [ 687.110028][ T5897] gp8psk: usb in 138 operation failed. [ 687.115546][ T5897] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 687.166933][ T5897] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 687.178655][ T10] usb 5-1: USB disconnect, device number 31 [ 687.203083][ T5897] usb 3-1: USB disconnect, device number 103 [ 687.211974][ T5844] udevd[5844]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 688.470890][T24817] af_packet: tpacket_rcv: packet too big, clamped from 54 to 4294967286. macoff=82 [ 690.433437][T24854] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8025'. [ 690.695171][ T5838] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 690.707870][ T5838] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 690.716319][ T5838] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 690.725525][ T5838] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 690.734510][ T5838] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 690.779127][T19795] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 690.791242][T19795] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 690.798858][T19795] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 690.809277][T19795] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 690.821527][T19795] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 690.950712][T24867] 9pnet: p9_errstr2errno: server reported unknown error [ 691.324053][T24859] chnl_net:caif_netlink_parms(): no params data found [ 691.599275][T24859] bridge0: port 1(bridge_slave_0) entered blocking state [ 691.606423][T24859] bridge0: port 1(bridge_slave_0) entered disabled state [ 691.637649][T24859] bridge_slave_0: entered allmulticast mode [ 691.645536][T24859] bridge_slave_0: entered promiscuous mode [ 691.660141][T24859] bridge0: port 2(bridge_slave_1) entered blocking state [ 691.687622][T24859] bridge0: port 2(bridge_slave_1) entered disabled state [ 691.698582][T24859] bridge_slave_1: entered allmulticast mode [ 691.706515][T24859] bridge_slave_1: entered promiscuous mode [ 691.819881][T24859] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 691.833221][T24859] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 691.894985][T24859] team0: Port device team_slave_0 added [ 691.905809][T24859] team0: Port device team_slave_1 added [ 691.989994][T24859] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 691.997107][T24859] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 692.007554][ T5837] usb 4-1: new full-speed USB device number 102 using dummy_hcd [ 692.039110][T24859] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 692.060401][T24859] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 692.087382][T24859] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 692.138205][T24859] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 692.213072][ T5837] usb 4-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 692.227039][ T5837] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 692.271177][ T5837] usb 4-1: config 0 descriptor?? [ 692.283112][T24859] hsr_slave_0: entered promiscuous mode [ 692.299095][T24859] hsr_slave_1: entered promiscuous mode [ 692.305503][T24859] debugfs: 'hsr0' already exists in 'hsr' [ 692.317548][T24859] Cannot create hsr debugfs directory [ 692.505683][ T5837] udl 4-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 692.581735][ T5837] [drm] Initialized udl 0.0.1 for 4-1:0.0 on minor 2 [ 692.591169][ T5837] [drm] Initialized udl on minor 2 [ 692.851997][T24859] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 692.866332][T24859] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 692.868519][T19795] Bluetooth: hci0: command tx timeout [ 692.891683][T24859] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 692.905241][T24859] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 692.945302][ T5837] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 1 failed err ffffffb9 [ 692.974985][ T5837] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 693.022077][ T5933] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 693.032631][ T5837] usb 4-1: USB disconnect, device number 102 [ 693.062704][ T5933] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 693.172533][T24859] 8021q: adding VLAN 0 to HW filter on device bond0 [ 693.200084][T24859] 8021q: adding VLAN 0 to HW filter on device team0 [ 693.216111][ T1106] bridge0: port 1(bridge_slave_0) entered blocking state [ 693.224218][ T1106] bridge0: port 1(bridge_slave_0) entered forwarding state [ 693.241933][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 693.249123][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 693.407601][ T5933] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 693.496874][T24859] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 693.578062][ T5933] usb 5-1: Using ep0 maxpacket: 16 [ 693.585324][ T5933] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 693.604478][ T5933] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 693.638658][ T5933] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 693.648240][ T5933] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 693.656268][ T5933] usb 5-1: Product: syz [ 693.682603][ T5933] usb 5-1: Manufacturer: syz [ 693.702871][ T5933] usb 5-1: SerialNumber: syz [ 693.729993][ T5933] usb 5-1: config 0 descriptor?? [ 693.742307][ T5933] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 693.763628][ T5933] em28xx 5-1:0.0: Audio interface 0 found (Vendor Class) [ 693.921456][T24859] veth0_vlan: entered promiscuous mode [ 693.942947][T24859] veth1_vlan: entered promiscuous mode [ 693.988882][T24859] veth0_macvtap: entered promiscuous mode [ 693.999900][T24859] veth1_macvtap: entered promiscuous mode [ 694.025931][T24859] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 694.045147][T24859] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 694.065375][ T13] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 694.074879][ T13] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 694.087154][ T13] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 694.103284][ T13] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 694.216526][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 694.239470][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 694.293951][ T68] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 694.308788][ T68] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 694.353410][ T5933] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 694.371637][ T5933] em28xx 5-1:0.0: Config register raw data: 0xfffffffb [ 694.596250][ T5933] em28xx 5-1:0.0: AC97 chip type couldn't be determined [ 694.615011][ T5933] em28xx 5-1:0.0: No AC97 audio processor [ 694.661084][ T5933] usb 5-1: USB disconnect, device number 32 [ 694.679833][ T5933] em28xx 5-1:0.0: Disconnecting em28xx [ 694.702656][ T5933] em28xx 5-1:0.0: Freeing device [ 694.937695][T19795] Bluetooth: hci0: command tx timeout [ 696.155502][ T30] audit: type=1326 audit(1751593289.852:114): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24988 comm="syz.0.8071" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f7798d8e929 code=0x0 [ 696.638650][T25000] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 697.017859][T19795] Bluetooth: hci0: command tx timeout [ 697.953332][ T30] audit: type=1326 audit(1751593291.652:115): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25032 comm="syz.5.8090" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f7e5ab8e929 code=0x0 [ 699.107653][T19795] Bluetooth: hci0: command tx timeout [ 699.789803][ T30] audit: type=1326 audit(1751593293.492:116): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25083 comm="syz.3.8112" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd7cc98e929 code=0x0 [ 701.730596][T25142] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8138'. [ 702.157458][ T5933] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 702.317459][ T5933] usb 4-1: Using ep0 maxpacket: 32 [ 702.335989][ T5933] usb 4-1: config 0 has an invalid interface number: 67 but max is 0 [ 702.354061][ T5933] usb 4-1: config 0 has no interface number 0 [ 702.382049][ T5933] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 702.405164][ T5933] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 702.427104][ T5933] usb 4-1: Product: syz [ 702.435772][ T5933] usb 4-1: Manufacturer: syz [ 702.450814][ T5933] usb 4-1: SerialNumber: syz [ 702.462314][ T5933] usb 4-1: config 0 descriptor?? [ 702.499769][ T5933] smsc95xx v2.0.0 [ 703.726059][ T5933] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000030: -71 [ 703.749934][ T5933] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Error writing E2P_CMD [ 703.767793][ T5933] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 703.811545][ T5933] smsc95xx 4-1:0.67: probe with driver smsc95xx failed with error -71 [ 703.856365][ T5933] usb 4-1: USB disconnect, device number 103 [ 704.722654][T25189] overlayfs: invalid origin (00000079007a6b616c6c6572310000000000000180c2000000000000000000000000000000000000000000000000000000000000000000000000000000000000) [ 704.887808][T25192] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3959859366 (126715499712 ns) > initial count (55949202912 ns). Using initial count to start timer. [ 705.914360][T25231] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3959859366 (126715499712 ns) > initial count (55949202912 ns). Using initial count to start timer. [ 706.933517][ T30] audit: type=1326 audit(1751593300.622:117): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25266 comm="syz.3.8195" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd7cc98e929 code=0x0 [ 707.656198][T25290] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8203'. [ 707.681814][T25290] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8203'. [ 708.460548][T25317] netlink: 1343 bytes leftover after parsing attributes in process `syz.0.8216'. [ 708.607471][ T5837] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 708.778278][ T5837] usb 5-1: Using ep0 maxpacket: 8 [ 708.797618][ T5837] usb 5-1: config index 0 descriptor too short (expected 28277, got 36) [ 708.816749][ T5837] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 708.846501][ T5837] usb 5-1: config 0 has no interfaces? [ 708.857371][ T5837] usb 5-1: New USB device found, idVendor=046d, idProduct=c20e, bcdDevice= 0.00 [ 708.879786][ T5837] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 708.924886][ T5837] usb 5-1: config 0 descriptor?? [ 709.342179][T24925] usb 5-1: USB disconnect, device number 33 [ 710.902744][T25387] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8249'. [ 710.947394][T25387] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8249'. [ 711.807410][ T10] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 711.972368][ T10] usb 6-1: config index 0 descriptor too short (expected 65183, got 72) [ 712.021230][ T10] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 712.039357][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 712.055918][ T10] usb 6-1: Product: syz [ 712.064420][ T10] usb 6-1: Manufacturer: syz [ 712.081008][ T10] usb 6-1: SerialNumber: syz [ 712.141916][ T10] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 712.220630][ T5877] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 712.490539][T25406] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 712.507924][T25406] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 712.561031][T25406] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 712.604425][T25406] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 712.663273][T25406] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 712.706820][T25406] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 712.740637][T24925] usb 6-1: USB disconnect, device number 2 [ 713.337510][ T5877] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 713.344845][ T5877] ath9k_htc: Failed to initialize the device [ 713.371349][T24925] usb 6-1: ath9k_htc: USB layer deinitialized [ 713.677594][T24925] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 713.723576][ T68] nci: nci_ntf_packet: unknown ntf opcode 0x204 [ 713.827489][T24925] usb 6-1: Using ep0 maxpacket: 32 [ 713.839494][T24925] usb 6-1: config index 0 descriptor too short (expected 241, got 72) [ 713.848642][T24925] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 713.867485][T24925] usb 6-1: config 0 interface 0 altsetting 0 has 6 endpoint descriptors, different from the interface descriptor's value: 5 [ 713.873714][T25462] overlayfs: failed to clone upperpath [ 713.887423][T24925] usb 6-1: New USB device found, idVendor=110a, idProduct=2210, bcdDevice=bd.da [ 713.906727][T24925] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 713.917824][T24925] usb 6-1: config 0 descriptor?? [ 713.933305][T24925] mos7840 6-1:0.0: missing endpoints [ 714.153777][T24925] usb 6-1: USB disconnect, device number 3 [ 715.025861][T25492] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 715.289118][T24925] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 715.459609][T24925] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 715.484890][T24925] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 715.513105][T24925] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 715.525670][T24925] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 715.550199][T25496] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 715.575343][T24925] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 715.881081][ T10] usb 5-1: USB disconnect, device number 34 [ 716.576665][T25527] input: syz1 as /devices/virtual/input/input90 [ 717.162077][T25552] netlink: 176 bytes leftover after parsing attributes in process `syz.3.8325'. [ 717.176762][T25554] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8324'. [ 717.186403][T25552] netlink: 176 bytes leftover after parsing attributes in process `syz.3.8325'. [ 717.199442][T25554] bridge_slave_1: left allmulticast mode [ 717.205122][T25554] bridge_slave_1: left promiscuous mode [ 717.285607][T25554] bridge0: port 2(bridge_slave_1) entered disabled state [ 717.308458][T25554] bridge_slave_0: left allmulticast mode [ 717.326265][T25554] bridge_slave_0: left promiscuous mode [ 717.343525][T25554] bridge0: port 1(bridge_slave_0) entered disabled state [ 717.388914][T25554] bridge0 (unregistering): left allmulticast mode [ 718.147515][T24925] usb 6-1: new full-speed USB device number 4 using dummy_hcd [ 718.350151][T24925] usb 6-1: config 0 has an invalid interface number: 251 but max is 0 [ 718.375848][T24925] usb 6-1: config 0 has no interface number 0 [ 718.386985][T24925] usb 6-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 718.400705][T24925] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 718.411488][T24925] usb 6-1: Product: syz [ 718.415685][T24925] usb 6-1: Manufacturer: syz [ 718.430977][T24925] usb 6-1: SerialNumber: syz [ 718.450562][T24925] usb 6-1: config 0 descriptor?? [ 718.567604][T25599] syzkaller1: entered promiscuous mode [ 718.573357][T25599] syzkaller1: entered allmulticast mode [ 719.167625][ T10] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 719.177172][ T5838] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 719.186871][ T5838] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 719.197255][ T5838] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 719.208063][ T5838] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 719.216857][ T5838] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 719.276798][T24925] asix 6-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 719.288995][T24925] asix 6-1:0.251 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffb9 [ 719.302249][T24925] asix 6-1:0.251: probe with driver asix failed with error -71 [ 719.315319][T24925] usb 6-1: USB disconnect, device number 4 [ 719.349921][ T10] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 719.361591][ T10] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 719.372067][ T10] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 719.381582][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 719.403218][T25606] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 719.425901][ T10] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 719.576666][T25608] chnl_net:caif_netlink_parms(): no params data found [ 719.719765][T25608] bridge0: port 1(bridge_slave_0) entered blocking state [ 719.726993][T25608] bridge0: port 1(bridge_slave_0) entered disabled state [ 719.727141][T24925] usb 4-1: USB disconnect, device number 104 [ 719.734908][T25608] bridge_slave_0: entered allmulticast mode [ 719.749020][T25608] bridge_slave_0: entered promiscuous mode [ 719.758008][T25608] bridge0: port 2(bridge_slave_1) entered blocking state [ 719.765214][T25608] bridge0: port 2(bridge_slave_1) entered disabled state [ 719.772983][T25608] bridge_slave_1: entered allmulticast mode [ 719.788842][T25608] bridge_slave_1: entered promiscuous mode [ 719.923010][T25608] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 719.944563][T25608] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 719.988406][T25608] team0: Port device team_slave_0 added [ 719.997077][T25608] team0: Port device team_slave_1 added [ 720.046776][T25608] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 720.054202][T25608] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 720.080140][ C0] vkms_vblank_simulate: vblank timer overrun [ 720.094611][T25608] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 720.135402][T25608] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 720.143743][T25608] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 720.169756][ C0] vkms_vblank_simulate: vblank timer overrun [ 720.176509][T25608] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 720.282621][T25608] hsr_slave_0: entered promiscuous mode [ 720.290090][T25608] hsr_slave_1: entered promiscuous mode [ 720.296464][T25608] debugfs: 'hsr0' already exists in 'hsr' [ 720.303571][T25608] Cannot create hsr debugfs directory [ 720.684839][T25608] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 720.724031][T25608] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 720.765710][T25608] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 720.825212][T25608] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 721.107170][T25608] 8021q: adding VLAN 0 to HW filter on device bond0 [ 721.158953][T25608] 8021q: adding VLAN 0 to HW filter on device team0 [ 721.176239][T18227] bridge0: port 1(bridge_slave_0) entered blocking state [ 721.183669][T18227] bridge0: port 1(bridge_slave_0) entered forwarding state [ 721.211816][T18227] bridge0: port 2(bridge_slave_1) entered blocking state [ 721.219066][T18227] bridge0: port 2(bridge_slave_1) entered forwarding state [ 721.257972][T19795] Bluetooth: hci3: command tx timeout [ 721.754228][T25608] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 722.205213][T25608] veth0_vlan: entered promiscuous mode [ 722.244212][T25608] veth1_vlan: entered promiscuous mode [ 722.294345][T25608] veth0_macvtap: entered promiscuous mode [ 722.307332][T25608] veth1_macvtap: entered promiscuous mode [ 722.355316][T25608] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 722.387578][T25608] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 722.409342][ T13] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 722.428150][ T12] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 722.456547][ T12] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 722.482704][ T12] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 722.616743][ T68] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 722.650849][ T68] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 722.686039][T25683] netlink: 'syz.5.8372': attribute type 21 has an invalid length. [ 722.691859][ T68] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 722.710812][ T68] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 722.719126][T25683] netlink: 'syz.5.8372': attribute type 22 has an invalid length. [ 722.729437][T25683] netlink: 'syz.5.8372': attribute type 23 has an invalid length. [ 722.738294][T25683] netlink: 'syz.5.8372': attribute type 25 has an invalid length. [ 722.746374][T25683] netlink: 'syz.5.8372': attribute type 26 has an invalid length. [ 722.754520][T25683] netlink: 16 bytes leftover after parsing attributes in process `syz.5.8372'. [ 723.337828][T19795] Bluetooth: hci3: command tx timeout [ 724.327375][ T10] usb 4-1: new high-speed USB device number 105 using dummy_hcd [ 724.516833][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 724.525229][ T10] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 724.541024][ T10] usb 4-1: config 0 has no interface number 0 [ 724.547536][ T10] usb 4-1: config 0 interface 184 has no altsetting 0 [ 724.560808][ T10] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 724.574662][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 724.591913][ T10] usb 4-1: Product: syz [ 724.596135][ T10] usb 4-1: Manufacturer: syz [ 724.606173][ T10] usb 4-1: SerialNumber: syz [ 724.634188][ T10] usb 4-1: config 0 descriptor?? [ 724.644321][ T10] smsc75xx v1.0.0 [ 724.728676][T18227] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 725.417698][T19795] Bluetooth: hci3: command tx timeout [ 725.884160][ T10] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -71 [ 725.911506][ T10] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 725.922610][ T10] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 725.934064][ T10] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 725.944319][ T10] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 725.955133][ T10] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 725.965506][ T10] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -71 [ 725.982789][ T10] usb 4-1: USB disconnect, device number 105 [ 726.027778][ T5933] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 726.189900][ T5933] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 726.200944][ T5933] usb 6-1: config 0 has no interfaces? [ 726.206557][ T5933] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 726.219282][ T5933] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 726.238353][ T5933] usb 6-1: config 0 descriptor?? [ 726.697841][ T10] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 726.862799][T25796] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8416'. [ 726.881928][ T10] usb 7-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 726.902766][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 726.926670][ T10] usb 7-1: Product: syz [ 726.947000][ T10] usb 7-1: Manufacturer: syz [ 726.964908][ T10] usb 7-1: SerialNumber: syz [ 726.983491][ T10] usb 7-1: config 0 descriptor?? [ 727.005163][ T10] ch341 7-1:0.0: ch341-uart converter detected [ 727.498698][T19795] Bluetooth: hci3: command tx timeout [ 728.025324][ T10] ch341-uart ttyUSB0: break control not supported, using simulated break [ 728.054851][ T10] usb 7-1: ch341-uart converter now attached to ttyUSB0 [ 728.080929][ T10] usb 7-1: USB disconnect, device number 2 [ 728.110891][ T10] ch341-uart ttyUSB0: ch341-uart converter now disconnected from ttyUSB0 [ 728.125386][ T10] ch341 7-1:0.0: device disconnected [ 728.247782][ T5933] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 728.437436][ T5933] usb 4-1: Using ep0 maxpacket: 16 [ 728.449310][ T5933] usb 4-1: config 0 has no interfaces? [ 728.454829][ T5933] usb 4-1: New USB device found, idVendor=0763, idProduct=1015, bcdDevice=56.88 [ 728.479017][ T5933] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 728.500381][ T5933] usb 4-1: config 0 descriptor?? [ 728.681372][T25851] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 728.717920][ T5933] usb 4-1: USB disconnect, device number 106 [ 728.841341][ T5904] usb 6-1: USB disconnect, device number 5 [ 729.095294][ T30] audit: type=1326 audit(1751593322.792:118): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25864 comm="syz.0.8438" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f7798d8e929 code=0x0 [ 730.481312][ T10] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 730.680463][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 730.712119][ T10] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 730.737721][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 730.776836][ T10] usb 6-1: config 0 descriptor?? [ 731.033990][ T10] usbhid 6-1:0.0: can't add hid device: -71 [ 731.041704][ T10] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 731.077648][ T10] usb 6-1: USB disconnect, device number 6 [ 731.260485][ T30] audit: type=1326 audit(1751593324.962:119): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25934 comm="syz.6.8468" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc4c658e929 code=0x0 [ 731.547457][ T10] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 731.697437][ T10] usb 6-1: Using ep0 maxpacket: 16 [ 731.704929][ T10] usb 6-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 731.716269][ T10] usb 6-1: config 0 interface 0 has no altsetting 0 [ 731.723408][ T10] usb 6-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 731.733634][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 731.744852][ T10] usb 6-1: config 0 descriptor?? [ 732.202539][ T10] nzxt-smart2 0003:1E71:2009.003B: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.5-1/input0 [ 732.388619][T25954] netlink: 104 bytes leftover after parsing attributes in process `syz.3.8477'. [ 732.634017][ T5933] usb 6-1: USB disconnect, device number 7 [ 733.527882][ T10] usb 6-1: new full-speed USB device number 8 using dummy_hcd [ 733.716853][ T10] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 733.726727][ T10] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 733.756390][ T10] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 733.767524][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 733.998281][T25983] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 734.007268][T25983] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 734.019989][ T10] usb 6-1: usb_control_msg returned -32 [ 734.026835][ T10] usbtmc 6-1:16.0: can't read capabilities [ 734.487802][T26006] kvm: Disabled LAPIC found during irq injection [ 734.987401][ T5837] usb 4-1: new high-speed USB device number 107 using dummy_hcd [ 735.185996][ T5837] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 735.196656][ T5837] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 735.206971][ T5837] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 735.216112][ T5837] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 735.224551][ T5837] usb 4-1: SerialNumber: syz [ 735.443198][ T5837] usb 4-1: 0:2 : does not exist [ 735.463658][ T5837] usb 4-1: USB disconnect, device number 107 [ 735.500024][ T5844] udevd[5844]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 736.187013][ T30] audit: type=1326 audit(1751593329.882:120): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26025 comm="syz.3.8504" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd7cc98e929 code=0x0 [ 736.279917][T26030] netlink: 56 bytes leftover after parsing attributes in process `syz.0.8505'. [ 736.323459][T24925] usb 6-1: USB disconnect, device number 8 [ 736.507244][ T30] audit: type=1326 audit(1751593330.202:121): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26038 comm="syz.5.8510" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f7e5ab8e929 code=0x0 [ 737.501866][T26052] batadv_slave_0: entered promiscuous mode [ 737.510190][T26051] batadv_slave_0: left promiscuous mode [ 737.624231][T19795] block nbd5: Receive control failed (result -107) [ 737.648658][T26054] block nbd5: shutting down sockets [ 737.916169][T26062] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 739.072737][T26095] netlink: 56 bytes leftover after parsing attributes in process `syz.6.8531'. [ 740.867411][ T10] usb 6-1: new full-speed USB device number 9 using dummy_hcd [ 741.020943][ T10] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 741.031303][ T10] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 741.044267][ T10] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 741.053552][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 741.061727][ T10] usb 6-1: Product: syz [ 741.066071][ T10] usb 6-1: Manufacturer: syz [ 741.070819][ T10] usb 6-1: SerialNumber: syz [ 741.249493][T26173] overlayfs: failed to clone upperpath [ 741.287667][ T10] usb 6-1: 0:2 : does not exist [ 741.313143][ T10] usb 6-1: 5:0: failed to get current value for ch 0 (-22) [ 741.377809][ T10] usb 6-1: USB disconnect, device number 9 [ 741.466497][ T5844] udevd[5844]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 741.509946][T26181] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 741.537178][T26181] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 741.997623][ T9] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 742.174448][ T9] usb 7-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 742.183406][ T9] usb 7-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 742.194229][ T9] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 742.203603][ T9] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 742.215213][ T9] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 742.241200][ T9] usb 7-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 742.250518][ T9] usb 7-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 742.259071][ T9] usb 7-1: Product: syz [ 742.263737][ T9] usb 7-1: Manufacturer: syz [ 742.276704][ T9] cdc_wdm 7-1:1.0: skipping garbage [ 742.282910][ T9] cdc_wdm 7-1:1.0: skipping garbage [ 742.292229][ T9] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 742.302351][ T9] cdc_wdm 7-1:1.0: Unknown control protocol [ 742.482445][ C1] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 742.489226][ C1] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 742.496943][ C1] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 742.503578][ C1] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 742.510708][ C1] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 742.517338][ C1] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 742.523737][ T5837] usb 7-1: USB disconnect, device number 3 [ 742.530422][ C1] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 742.530447][ C1] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 742.530466][ C1] cdc_wdm 7-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 742.706742][T26204] 9pnet: p9_errstr2errno: server reported unknown error pA;KZ44/@q [ 742.880265][T26212] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8581'. [ 743.425022][T26231] 9pnet: p9_errstr2errno: server reported unknown error pA;KZ44/@q [ 743.806394][T26242] netlink: 'syz.6.8596': attribute type 29 has an invalid length. [ 743.826090][T26242] netlink: 'syz.6.8596': attribute type 29 has an invalid length. [ 743.843045][T26242] netlink: 500 bytes leftover after parsing attributes in process `syz.6.8596'. [ 746.130161][T26300] netlink: 'syz.0.8620': attribute type 29 has an invalid length. [ 746.140293][T26300] netlink: 'syz.0.8620': attribute type 29 has an invalid length. [ 746.165291][T26300] netlink: 500 bytes leftover after parsing attributes in process `syz.0.8620'. [ 746.932067][ T5837] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 747.099542][ T5837] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 747.119459][ T5837] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 747.147161][ T5837] usb 7-1: New USB device found, idVendor=1e7d, idProduct=2d50, bcdDevice= 0.00 [ 747.156876][ T5837] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 747.181226][ T5837] usb 7-1: config 0 descriptor?? [ 747.355673][T26335] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 747.423823][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.435095][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.621639][ T5837] kovaplus 0003:1E7D:2D50.003C: hidraw0: USB HID v0.00 Device [HID 1e7d:2d50] on usb-dummy_hcd.6-1/input0 [ 748.407063][ T5837] kovaplus 0003:1E7D:2D50.003C: couldn't init struct kovaplus_device [ 748.419623][ T5837] kovaplus 0003:1E7D:2D50.003C: couldn't install mouse [ 748.433816][ T5837] kovaplus 0003:1E7D:2D50.003C: probe with driver kovaplus failed with error -71 [ 748.450930][ T5837] usb 7-1: USB disconnect, device number 4 [ 749.294222][T26395] netlink: 32 bytes leftover after parsing attributes in process `syz.6.8661'. [ 749.339834][T26397] netlink: 80 bytes leftover after parsing attributes in process `syz.5.8662'. [ 750.107535][T24925] usb 4-1: new high-speed USB device number 108 using dummy_hcd [ 750.267474][T24925] usb 4-1: Using ep0 maxpacket: 16 [ 750.283949][T24925] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 750.306736][T24925] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 750.334237][T26440] overlayfs: failed to clone upperpath [ 750.343259][T24925] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 750.373487][T24925] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 750.391045][T24925] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 750.406326][T24925] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 750.420398][T24925] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 750.439102][T24925] usb 4-1: Manufacturer: syz [ 750.455019][T24925] usb 4-1: config 0 descriptor?? [ 750.785566][T24925] rc_core: IR keymap rc-hauppauge not found [ 750.807943][T24925] Registered IR keymap rc-empty [ 750.812981][T24925] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 750.838285][T24925] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 750.863736][T24925] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 750.885863][T24925] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input91 [ 750.919150][T24925] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 750.966058][T24925] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 750.998053][T24925] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 751.018188][T24925] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 751.037415][T24925] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 751.062946][T24925] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 751.107536][T24925] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 751.147614][T24925] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 751.177480][T24925] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 751.197921][T24925] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 751.227629][T24925] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 751.262959][T24925] mceusb 4-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 751.278828][T24925] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 751.300502][T24925] usb 4-1: USB disconnect, device number 108 [ 751.878003][T26503] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 753.117666][T24925] usb 7-1: new full-speed USB device number 5 using dummy_hcd [ 753.291238][T24925] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 753.301480][T24925] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 753.313299][T24925] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 753.322633][T24925] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 753.330698][T24925] usb 7-1: Product: syz [ 753.334883][T24925] usb 7-1: Manufacturer: syz [ 753.339790][T24925] usb 7-1: SerialNumber: syz [ 753.552560][T24925] usb 7-1: 0:2 : does not exist [ 753.564871][T24925] usb 7-1: 5:0: failed to get current value for ch 0 (-22) [ 753.593391][T24925] usb 7-1: USB disconnect, device number 5 [ 753.631354][ T5844] udevd[5844]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 754.323502][T26573] tls_set_device_offload: netdev not found [ 755.252356][T26619] netlink: 'syz.0.8759': attribute type 6 has an invalid length. [ 755.267504][T26619] netlink: 'syz.0.8759': attribute type 7 has an invalid length. [ 755.287619][T26619] netlink: 13182 bytes leftover after parsing attributes in process `syz.0.8759'. [ 755.408130][ T5837] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 755.580494][ T5837] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 755.615154][ T5837] usb 7-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 755.646484][ T5837] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 755.688528][ T5837] usb 7-1: config 0 descriptor?? [ 755.703638][ T5837] pwc: Askey VC010 type 2 USB webcam detected. [ 756.132658][ T5837] pwc: recv_control_msg error -32 req 02 val 2b00 [ 756.148630][ T5837] pwc: recv_control_msg error -32 req 02 val 2700 [ 756.166104][ T5837] pwc: recv_control_msg error -32 req 02 val 2c00 [ 756.378015][ T5837] pwc: recv_control_msg error -71 req 04 val 1300 [ 756.385167][ T5837] pwc: recv_control_msg error -71 req 04 val 1400 [ 756.403044][ T5837] pwc: recv_control_msg error -71 req 02 val 2000 [ 756.411067][ T5837] pwc: recv_control_msg error -71 req 02 val 2100 [ 756.418837][ T5837] pwc: recv_control_msg error -71 req 04 val 1500 [ 756.425854][ T5837] pwc: recv_control_msg error -71 req 02 val 2500 [ 756.436065][ T5837] pwc: recv_control_msg error -71 req 02 val 2400 [ 756.444212][ T5837] pwc: recv_control_msg error -71 req 02 val 2600 [ 756.451549][ T5837] pwc: recv_control_msg error -71 req 02 val 2900 [ 756.459544][ T5837] pwc: recv_control_msg error -71 req 02 val 2800 [ 756.466806][ T5837] pwc: recv_control_msg error -71 req 04 val 1100 [ 756.477899][ T5837] pwc: recv_control_msg error -71 req 04 val 1200 [ 756.495287][ T5837] pwc: Registered as video103. [ 756.500480][T26662] netlink: 4 bytes leftover after parsing attributes in process `syz.5.8774'. [ 756.515162][ T5837] input: PWC snapshot button as /devices/platform/dummy_hcd.6/usb7/7-1/input/input92 [ 756.557621][ T5837] usb 7-1: USB disconnect, device number 6 [ 757.473905][T26701] netlink: 'syz.6.8789': attribute type 6 has an invalid length. [ 757.481861][T26701] netlink: 'syz.6.8789': attribute type 7 has an invalid length. [ 757.490760][T26701] netlink: 13182 bytes leftover after parsing attributes in process `syz.6.8789'. [ 758.595622][ C1] Unknown status report in ack skb [ 758.898240][T26756] syzkaller1: entered promiscuous mode [ 758.910640][T26756] syzkaller1: entered allmulticast mode [ 761.242038][T18227] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 761.427006][T18227] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 761.585456][T18227] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 761.825123][T18227] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 762.171737][T18227] bridge_slave_1: left allmulticast mode [ 762.187059][T18227] bridge_slave_1: left promiscuous mode [ 762.206121][T18227] bridge0: port 2(bridge_slave_1) entered disabled state [ 762.264846][T18227] bridge_slave_0: left allmulticast mode [ 762.277413][T18227] bridge_slave_0: left promiscuous mode [ 762.311786][ T5838] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 762.320099][T18227] bridge0: port 1(bridge_slave_0) entered disabled state [ 762.338160][ T5838] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 762.346354][ T5838] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 762.371452][ T5838] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 762.382174][ T5838] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 763.872030][T18227] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 763.890943][T18227] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 763.916253][T18227] bond0 (unregistering): Released all slaves [ 764.457849][T19795] Bluetooth: hci3: command tx timeout [ 764.576117][T18227] hsr_slave_0: left promiscuous mode [ 764.593190][T18227] hsr_slave_1: left promiscuous mode [ 764.604532][T18227] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 764.630230][T18227] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 764.645178][T18227] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 764.658927][T18227] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 764.719007][T18227] veth1_macvtap: left promiscuous mode [ 764.737310][T18227] veth0_macvtap: left promiscuous mode [ 764.755103][T18227] veth1_vlan: left promiscuous mode [ 764.769599][T18227] veth0_vlan: left promiscuous mode [ 765.888818][T18227] team0 (unregistering): Port device team_slave_1 removed [ 765.943559][T18227] team0 (unregistering): Port device team_slave_0 removed [ 766.557338][T19795] Bluetooth: hci3: command tx timeout [ 766.946448][T26842] chnl_net:caif_netlink_parms(): no params data found [ 767.294857][T26842] bridge0: port 1(bridge_slave_0) entered blocking state [ 767.337085][T26842] bridge0: port 1(bridge_slave_0) entered disabled state [ 767.367158][T26842] bridge_slave_0: entered allmulticast mode [ 767.391066][T26842] bridge_slave_0: entered promiscuous mode [ 767.434373][T26842] bridge0: port 2(bridge_slave_1) entered blocking state [ 767.464256][T26842] bridge0: port 2(bridge_slave_1) entered disabled state [ 767.487168][T26842] bridge_slave_1: entered allmulticast mode [ 767.510272][T26842] bridge_slave_1: entered promiscuous mode [ 767.723343][T26842] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 767.770709][T26842] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 768.013496][T26842] team0: Port device team_slave_0 added [ 768.035612][T26842] team0: Port device team_slave_1 added [ 768.046894][T26987] overlayfs: failed to clone upperpath [ 768.185752][T26842] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 768.215944][T26842] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 768.241980][ C1] ================================================================== [ 768.242000][ C1] BUG: KASAN: slab-use-after-free in flush_tlb_func+0x23d/0x6c0 [ 768.242038][ C1] Write of size 8 at addr ffff88801a875540 by task syz-executor/26842 [ 768.242059][ C1] [ 768.242077][ C1] CPU: 1 UID: 0 PID: 26842 Comm: syz-executor Not tainted 6.16.0-rc4-next-20250702-syzkaller #0 PREEMPT(full) [ 768.242104][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 768.242122][ C1] Call Trace: [ 768.242131][ C1] [ 768.242141][ C1] dump_stack_lvl+0x189/0x250 [ 768.242166][ C1] ? __virt_addr_valid+0x1c8/0x5c0 [ 768.242190][ C1] ? rcu_is_watching+0x15/0xb0 [ 768.242211][ C1] ? __pfx_dump_stack_lvl+0x10/0x10 [ 768.242234][ C1] ? rcu_is_watching+0x15/0xb0 [ 768.242253][ C1] ? lock_release+0x4b/0x3e0 [ 768.242285][ C1] ? __virt_addr_valid+0x1c8/0x5c0 [ 768.242307][ C1] ? __virt_addr_valid+0x4a5/0x5c0 [ 768.242331][ C1] print_report+0xd2/0x2b0 [ 768.242359][ C1] ? flush_tlb_func+0x23d/0x6c0 [ 768.242383][ C1] kasan_report+0x118/0x150 [ 768.242409][ C1] ? flush_tlb_func+0x23d/0x6c0 [ 768.242437][ C1] kasan_check_range+0x2b0/0x2c0 [ 768.242462][ C1] flush_tlb_func+0x23d/0x6c0 [ 768.242492][ C1] ? __pfx_flush_tlb_func+0x10/0x10 [ 768.242517][ C1] ? sched_clock_cpu+0x74/0x430 [ 768.242538][ C1] ? rcu_is_watching+0x15/0xb0 [ 768.242557][ C1] ? __pfx_flush_tlb_func+0x10/0x10 [ 768.242583][ C1] __flush_smp_call_function_queue+0x370/0xaa0 [ 768.242606][ C1] ? __pfx_flush_tlb_func+0x10/0x10 [ 768.242633][ C1] __sysvec_call_function_single+0xa8/0x3d0 [ 768.242669][ C1] sysvec_call_function_single+0x9e/0xc0 [ 768.242695][ C1] [ 768.242702][ C1] [ 768.242710][ C1] asm_sysvec_call_function_single+0x1a/0x20 [ 768.242737][ C1] RIP: 0010:console_flush_all+0x7f7/0xc40 [ 768.242763][ C1] Code: 48 21 c3 0f 85 e9 01 00 00 e8 b5 36 1f 00 48 8b 5c 24 20 4d 85 f6 75 07 e8 a6 36 1f 00 eb 06 e8 9f 36 1f 00 fb 48 8b 44 24 28 <42> 80 3c 20 00 74 08 48 89 df e8 0a 4a 83 00 48 8b 1b 48 8b 44 24 [ 768.242782][ C1] RSP: 0018:ffffc9000b9fe9a0 EFLAGS: 00000293 [ 768.242803][ C1] RAX: 1ffffffff1d78ef3 RBX: ffffffff8ebc7798 RCX: ffff88803665bc00 [ 768.242820][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 768.242834][ C1] RBP: ffffc9000b9feaf0 R08: ffffffff8fc29e37 R09: 1ffffffff1f853c6 [ 768.242850][ C1] R10: dffffc0000000000 R11: fffffbfff1f853c7 R12: dffffc0000000000 [ 768.242866][ C1] R13: 0000000000000001 R14: 0000000000000200 R15: ffffffff8ebc7740 [ 768.242893][ C1] ? console_flush_all+0x13a/0xc40 [ 768.242921][ C1] ? __pfx_console_flush_all+0x10/0x10 [ 768.242946][ C1] ? kasan_save_track+0x4f/0x80 [ 768.242970][ C1] ? is_printk_cpu_sync_owner+0x32/0x40 [ 768.243001][ C1] console_unlock+0xc4/0x270 [ 768.243023][ C1] ? __pfx_console_unlock+0x10/0x10 [ 768.243046][ C1] ? is_printk_cpu_sync_owner+0x32/0x40 [ 768.243074][ C1] vprintk_emit+0x5b7/0x7a0 [ 768.243097][ C1] ? __pfx_vprintk_emit+0x10/0x10 [ 768.243117][ C1] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 768.243154][ C1] _printk+0xcf/0x120 [ 768.243179][ C1] ? __pfx__printk+0x10/0x10 [ 768.243203][ C1] ? do_raw_spin_unlock+0x122/0x240 [ 768.243230][ C1] batadv_hardif_enable_interface+0x7b9/0xa30 [ 768.243265][ C1] batadv_meshif_slave_add+0x79/0x100 [ 768.243296][ C1] do_set_master+0x533/0x6d0 [ 768.243331][ C1] do_setlink+0xcf0/0x41c0 [ 768.243362][ C1] ? trace_sched_exit_tp+0x38/0x120 [ 768.243393][ C1] ? __pfx_do_setlink+0x10/0x10 [ 768.243424][ C1] ? __lock_acquire+0xab9/0xd20 [ 768.243457][ C1] ? do_raw_spin_lock+0x121/0x290 [ 768.243486][ C1] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 768.243509][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 768.243535][ C1] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 768.243558][ C1] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 768.243585][ C1] ? rcu_is_watching+0x15/0xb0 [ 768.243606][ C1] ? __mutex_lock+0xa6d/0xe80 [ 768.243632][ C1] ? __mutex_lock+0x51b/0xe80 [ 768.243669][ C1] ? rtnl_newlink+0x8db/0x1c70 [ 768.243697][ C1] ? __pfx___mutex_lock+0x10/0x10 [ 768.243729][ C1] ? ns_capable+0x8a/0xf0 [ 768.243749][ C1] ? rtnl_link_get_net_capable+0x16a/0x350 [ 768.243782][ C1] rtnl_newlink+0x160b/0x1c70 [ 768.243816][ C1] ? __pfx_rtnl_newlink+0x10/0x10 [ 768.243847][ C1] ? __lock_acquire+0xab9/0xd20 [ 768.243882][ C1] ? __lock_acquire+0xab9/0xd20 [ 768.243922][ C1] ? is_bpf_text_address+0x26/0x2b0 [ 768.243955][ C1] ? is_bpf_text_address+0x292/0x2b0 [ 768.243985][ C1] ? is_bpf_text_address+0x26/0x2b0 [ 768.244016][ C1] ? kernel_text_address+0xa5/0xe0 [ 768.244043][ C1] ? __kernel_text_address+0xd/0x40 [ 768.244075][ C1] ? unwind_get_return_address+0x4d/0x90 [ 768.244101][ C1] ? __lock_acquire+0xab9/0xd20 [ 768.244143][ C1] ? __pfx_rtnl_newlink+0x10/0x10 [ 768.244170][ C1] rtnetlink_rcv_msg+0x7cf/0xb70 [ 768.244199][ C1] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 768.244226][ C1] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 768.244262][ C1] netlink_rcv_skb+0x208/0x470 [ 768.244290][ C1] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 768.244318][ C1] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 768.244352][ C1] ? netlink_deliver_tap+0x2e/0x1b0 [ 768.244379][ C1] ? netlink_deliver_tap+0x2e/0x1b0 [ 768.244409][ C1] netlink_unicast+0x75b/0x8d0 [ 768.244439][ C1] netlink_sendmsg+0x805/0xb30 [ 768.244472][ C1] ? __pfx_netlink_sendmsg+0x10/0x10 [ 768.244503][ C1] ? aa_sock_msg_perm+0xf1/0x1d0 [ 768.244526][ C1] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 768.244556][ C1] ? __pfx_netlink_sendmsg+0x10/0x10 [ 768.244585][ C1] __sock_sendmsg+0x219/0x270 [ 768.244611][ C1] __sys_sendto+0x3bd/0x520 [ 768.244642][ C1] ? __pfx___sys_sendto+0x10/0x10 [ 768.244685][ C1] ? fput_close_sync+0x119/0x200 [ 768.244711][ C1] ? __pfx_fput_close_sync+0x10/0x10 [ 768.244734][ C1] __x64_sys_sendto+0xde/0x100 [ 768.244765][ C1] do_syscall_64+0xfa/0x3b0 [ 768.244791][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 768.244816][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 768.244836][ C1] ? clear_bhb_loop+0x60/0xb0 [ 768.244859][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 768.244879][ C1] RIP: 0033:0x7fa5aab907bc [ 768.244897][ C1] Code: 2a 5f 02 00 44 8b 4c 24 2c 4c 8b 44 24 20 89 c5 44 8b 54 24 28 48 8b 54 24 18 b8 2c 00 00 00 48 8b 74 24 10 8b 7c 24 08 0f 05 <48> 3d 00 f0 ff ff 77 34 89 ef 48 89 44 24 08 e8 70 5f 02 00 48 8b [ 768.244914][ C1] RSP: 002b:00007ffcd53ad660 EFLAGS: 00000293 ORIG_RAX: 000000000000002c [ 768.244935][ C1] RAX: ffffffffffffffda RBX: 00007fa5ab8e4620 RCX: 00007fa5aab907bc [ 768.244950][ C1] RDX: 0000000000000028 RSI: 00007fa5ab8e4670 RDI: 0000000000000003 [ 768.244964][ C1] RBP: 0000000000000000 R08: 00007ffcd53ad6b4 R09: 000000000000000c [ 768.244978][ C1] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003 [ 768.244991][ C1] R13: 0000000000000000 R14: 00007fa5ab8e4670 R15: 0000000000000000 [ 768.245012][ C1] [ 768.245020][ C1] [ 768.245032][ C1] Allocated by task 5834: [ 768.245043][ C1] kasan_save_track+0x3e/0x80 [ 768.245064][ C1] __kasan_slab_alloc+0x6c/0x80 [ 768.245084][ C1] kmem_cache_alloc_noprof+0x1c1/0x3c0 [ 768.245106][ C1] copy_mm+0xdb/0x4b0 [ 768.245125][ C1] copy_process+0x1706/0x3c00 [ 768.245144][ C1] kernel_clone+0x21e/0x870 [ 768.245164][ C1] __x64_sys_clone+0x18b/0x1e0 [ 768.245185][ C1] do_syscall_64+0xfa/0x3b0 [ 768.245211][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 768.245231][ C1] [ 768.245237][ C1] Freed by task 26982: [ 768.245247][ C1] kasan_save_track+0x3e/0x80 [ 768.245266][ C1] kasan_save_free_info+0x46/0x50 [ 768.245293][ C1] __kasan_slab_free+0x62/0x70 [ 768.245313][ C1] kmem_cache_free+0x18f/0x400 [ 768.245334][ C1] exit_mm+0x1da/0x2c0 [ 768.245357][ C1] do_exit+0x648/0x2300 [ 768.245380][ C1] do_group_exit+0x21c/0x2d0 [ 768.245403][ C1] get_signal+0x1286/0x1340 [ 768.245432][ C1] arch_do_signal_or_restart+0x9a/0x750 [ 768.245460][ C1] exit_to_user_mode_loop+0x75/0x110 [ 768.245487][ C1] do_syscall_64+0x2bd/0x3b0 [ 768.245512][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 768.245532][ C1] [ 768.245538][ C1] The buggy address belongs to the object at ffff88801a874b40 [ 768.245538][ C1] which belongs to the cache mm_struct of size 2584 [ 768.245557][ C1] The buggy address is located 2560 bytes inside of [ 768.245557][ C1] freed 2584-byte region [ffff88801a874b40, ffff88801a875558) [ 768.245579][ C1] [ 768.245586][ C1] The buggy address belongs to the physical page: [ 768.245596][ C1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1a870 [ 768.245616][ C1] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 768.245633][ C1] memcg:ffff8880245d0281 [ 768.245643][ C1] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 768.245678][ C1] page_type: f5(slab) [ 768.245697][ C1] raw: 00fff00000000040 ffff88801a84bb40 0000000000000000 dead000000000001 [ 768.245717][ C1] raw: 0000000000000000 00000000000b000b 00000000f5000000 ffff8880245d0281 [ 768.245737][ C1] head: 00fff00000000040 ffff88801a84bb40 0000000000000000 dead000000000001 [ 768.245756][ C1] head: 0000000000000000 00000000000b000b 00000000f5000000 ffff8880245d0281 [ 768.245775][ C1] head: 00fff00000000003 ffffea00006a1c01 00000000ffffffff 00000000ffffffff [ 768.245794][ C1] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 768.245806][ C1] page dumped because: kasan: bad access detected [ 768.245821][ C1] page_owner tracks the page as allocated [ 768.245830][ C1] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52000(__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 0, tgid 0 (swapper), ts 1757352768, free_ts 0 [ 768.245862][ C1] post_alloc_hook+0x240/0x2a0 [ 768.245886][ C1] get_page_from_freelist+0x21e4/0x22c0 [ 768.245912][ C1] __alloc_frozen_pages_noprof+0x181/0x370 [ 768.245939][ C1] alloc_pages_mpol+0x232/0x4a0 [ 768.245962][ C1] allocate_slab+0x8a/0x370 [ 768.245988][ C1] ___slab_alloc+0xbeb/0x1410 [ 768.246012][ C1] kmem_cache_alloc_noprof+0x283/0x3c0 [ 768.246033][ C1] mm_alloc+0x23/0xd0 [ 768.246049][ C1] poking_init+0x69/0x2e0 [ 768.246077][ C1] start_kernel+0x1a6/0x500 [ 768.246102][ C1] x86_64_start_reservations+0x24/0x30 [ 768.246123][ C1] x86_64_start_kernel+0x143/0x1c0 [ 768.246141][ C1] common_startup_64+0x13e/0x147 [ 768.246166][ C1] page_owner free stack trace missing [ 768.246175][ C1] [ 768.246181][ C1] Memory state around the buggy address: [ 768.246193][ C1] ffff88801a875400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 768.246208][ C1] ffff88801a875480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 768.246223][ C1] >ffff88801a875500: fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc [ 768.246234][ C1] ^ [ 768.246247][ C1] ffff88801a875580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 768.246261][ C1] ffff88801a875600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 768.246273][ C1] ================================================================== [ 768.246290][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 768.246304][ C1] CPU: 1 UID: 0 PID: 26842 Comm: syz-executor Not tainted 6.16.0-rc4-next-20250702-syzkaller #0 PREEMPT(full) [ 768.246329][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 768.246342][ C1] Call Trace: [ 768.246350][ C1] [ 768.246359][ C1] dump_stack_lvl+0x99/0x250 [ 768.246382][ C1] ? __asan_memcpy+0x40/0x70 [ 768.246401][ C1] ? __pfx_dump_stack_lvl+0x10/0x10 [ 768.246424][ C1] ? __pfx__printk+0x10/0x10 [ 768.246453][ C1] panic+0x2db/0x790 [ 768.246475][ C1] ? __pfx_panic+0x10/0x10 [ 768.246497][ C1] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 768.246522][ C1] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 768.246572][ C1] ? print_memory_metadata+0x314/0x400 [ 768.246603][ C1] ? flush_tlb_func+0x23d/0x6c0 [ 768.246628][ C1] check_panic_on_warn+0x89/0xb0 [ 768.246662][ C1] ? flush_tlb_func+0x23d/0x6c0 [ 768.246686][ C1] end_report+0x78/0x160 [ 768.246710][ C1] kasan_report+0x129/0x150 [ 768.246735][ C1] ? flush_tlb_func+0x23d/0x6c0 [ 768.246765][ C1] kasan_check_range+0x2b0/0x2c0 [ 768.246792][ C1] flush_tlb_func+0x23d/0x6c0 [ 768.246823][ C1] ? __pfx_flush_tlb_func+0x10/0x10 [ 768.246848][ C1] ? sched_clock_cpu+0x74/0x430 [ 768.246869][ C1] ? rcu_is_watching+0x15/0xb0 [ 768.246890][ C1] ? __pfx_flush_tlb_func+0x10/0x10 [ 768.246918][ C1] __flush_smp_call_function_queue+0x370/0xaa0 [ 768.246941][ C1] ? __pfx_flush_tlb_func+0x10/0x10 [ 768.246969][ C1] __sysvec_call_function_single+0xa8/0x3d0 [ 768.246998][ C1] sysvec_call_function_single+0x9e/0xc0 [ 768.247023][ C1] [ 768.247031][ C1] [ 768.247041][ C1] asm_sysvec_call_function_single+0x1a/0x20 [ 768.247063][ C1] RIP: 0010:console_flush_all+0x7f7/0xc40 [ 768.247090][ C1] Code: 48 21 c3 0f 85 e9 01 00 00 e8 b5 36 1f 00 48 8b 5c 24 20 4d 85 f6 75 07 e8 a6 36 1f 00 eb 06 e8 9f 36 1f 00 fb 48 8b 44 24 28 <42> 80 3c 20 00 74 08 48 89 df e8 0a 4a 83 00 48 8b 1b 48 8b 44 24 [ 768.247109][ C1] RSP: 0018:ffffc9000b9fe9a0 EFLAGS: 00000293 [ 768.247128][ C1] RAX: 1ffffffff1d78ef3 RBX: ffffffff8ebc7798 RCX: ffff88803665bc00 [ 768.247145][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 768.247159][ C1] RBP: ffffc9000b9feaf0 R08: ffffffff8fc29e37 R09: 1ffffffff1f853c6 [ 768.247176][ C1] R10: dffffc0000000000 R11: fffffbfff1f853c7 R12: dffffc0000000000 [ 768.247192][ C1] R13: 0000000000000001 R14: 0000000000000200 R15: ffffffff8ebc7740 [ 768.247219][ C1] ? console_flush_all+0x13a/0xc40 [ 768.247247][ C1] ? __pfx_console_flush_all+0x10/0x10 [ 768.247271][ C1] ? kasan_save_track+0x4f/0x80 [ 768.247294][ C1] ? is_printk_cpu_sync_owner+0x32/0x40 [ 768.247322][ C1] console_unlock+0xc4/0x270 [ 768.247344][ C1] ? __pfx_console_unlock+0x10/0x10 [ 768.247366][ C1] ? is_printk_cpu_sync_owner+0x32/0x40 [ 768.247395][ C1] vprintk_emit+0x5b7/0x7a0 [ 768.247417][ C1] ? __pfx_vprintk_emit+0x10/0x10 [ 768.247437][ C1] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 768.247474][ C1] _printk+0xcf/0x120 [ 768.247499][ C1] ? __pfx__printk+0x10/0x10 [ 768.247525][ C1] ? do_raw_spin_unlock+0x122/0x240 [ 768.247552][ C1] batadv_hardif_enable_interface+0x7b9/0xa30 [ 768.247585][ C1] batadv_meshif_slave_add+0x79/0x100 [ 768.247618][ C1] do_set_master+0x533/0x6d0 [ 768.247656][ C1] do_setlink+0xcf0/0x41c0 [ 768.247689][ C1] ? trace_sched_exit_tp+0x38/0x120 [ 768.247722][ C1] ? __pfx_do_setlink+0x10/0x10 [ 768.247753][ C1] ? __lock_acquire+0xab9/0xd20 [ 768.247787][ C1] ? do_raw_spin_lock+0x121/0x290 [ 768.247817][ C1] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 768.247842][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 768.247868][ C1] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 768.247893][ C1] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 768.247921][ C1] ? rcu_is_watching+0x15/0xb0 [ 768.247943][ C1] ? __mutex_lock+0xa6d/0xe80 [ 768.247971][ C1] ? __mutex_lock+0x51b/0xe80 [ 768.248001][ C1] ? rtnl_newlink+0x8db/0x1c70 [ 768.248030][ C1] ? __pfx___mutex_lock+0x10/0x10 [ 768.248062][ C1] ? ns_capable+0x8a/0xf0 [ 768.248082][ C1] ? rtnl_link_get_net_capable+0x16a/0x350 [ 768.248116][ C1] rtnl_newlink+0x160b/0x1c70 [ 768.248147][ C1] ? __pfx_rtnl_newlink+0x10/0x10 [ 768.248178][ C1] ? __lock_acquire+0xab9/0xd20 [ 768.248214][ C1] ? __lock_acquire+0xab9/0xd20 [ 768.248252][ C1] ? is_bpf_text_address+0x26/0x2b0 [ 768.248285][ C1] ? is_bpf_text_address+0x292/0x2b0 [ 768.248315][ C1] ? is_bpf_text_address+0x26/0x2b0 [ 768.248347][ C1] ? kernel_text_address+0xa5/0xe0 [ 768.248374][ C1] ? __kernel_text_address+0xd/0x40 [ 768.248401][ C1] ? unwind_get_return_address+0x4d/0x90 [ 768.248426][ C1] ? __lock_acquire+0xab9/0xd20 [ 768.248467][ C1] ? __pfx_rtnl_newlink+0x10/0x10 [ 768.248494][ C1] rtnetlink_rcv_msg+0x7cf/0xb70 [ 768.248524][ C1] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 768.248551][ C1] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 768.248588][ C1] netlink_rcv_skb+0x208/0x470 [ 768.248617][ C1] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 768.248645][ C1] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 768.248686][ C1] ? netlink_deliver_tap+0x2e/0x1b0 [ 768.248714][ C1] ? netlink_deliver_tap+0x2e/0x1b0 [ 768.248746][ C1] netlink_unicast+0x75b/0x8d0 [ 768.248777][ C1] netlink_sendmsg+0x805/0xb30 [ 768.248811][ C1] ? __pfx_netlink_sendmsg+0x10/0x10 [ 768.248842][ C1] ? aa_sock_msg_perm+0xf1/0x1d0 [ 768.248866][ C1] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 768.248896][ C1] ? __pfx_netlink_sendmsg+0x10/0x10 [ 768.248926][ C1] __sock_sendmsg+0x219/0x270 [ 768.248953][ C1] __sys_sendto+0x3bd/0x520 [ 768.248983][ C1] ? __pfx___sys_sendto+0x10/0x10 [ 768.249020][ C1] ? fput_close_sync+0x119/0x200 [ 768.249047][ C1] ? __pfx_fput_close_sync+0x10/0x10 [ 768.249073][ C1] __x64_sys_sendto+0xde/0x100 [ 768.249104][ C1] do_syscall_64+0xfa/0x3b0 [ 768.249131][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 768.249157][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 768.249177][ C1] ? clear_bhb_loop+0x60/0xb0 [ 768.249201][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 768.249222][ C1] RIP: 0033:0x7fa5aab907bc [ 768.249240][ C1] Code: 2a 5f 02 00 44 8b 4c 24 2c 4c 8b 44 24 20 89 c5 44 8b 54 24 28 48 8b 54 24 18 b8 2c 00 00 00 48 8b 74 24 10 8b 7c 24 08 0f 05 <48> 3d 00 f0 ff ff 77 34 89 ef 48 89 44 24 08 e8 70 5f 02 00 48 8b [ 768.249258][ C1] RSP: 002b:00007ffcd53ad660 EFLAGS: 00000293 ORIG_RAX: 000000000000002c [ 768.249282][ C1] RAX: ffffffffffffffda RBX: 00007fa5ab8e4620 RCX: 00007fa5aab907bc [ 768.249298][ C1] RDX: 0000000000000028 RSI: 00007fa5ab8e4670 RDI: 0000000000000003 [ 768.249314][ C1] RBP: 0000000000000000 R08: 00007ffcd53ad6b4 R09: 000000000000000c [ 768.249328][ C1] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003 [ 768.249341][ C1] R13: 0000000000000000 R14: 00007fa5ab8e4670 R15: 0000000000000000 [ 768.249364][ C1] [ 768.249698][ C1] Kernel Offset: disabled