last executing test programs: 7m7.309539167s ago: executing program 32 (id=6396): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)={0x30, r2, 0x1, 0x72bd29, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_TX_RATES={0x14, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x10, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x5, 0x1, [0x30]}, @NL80211_TXRATE_HT={0x4}]}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x20000855}, 0x0) 7m7.091537249s ago: executing program 3 (id=6401): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1, 0x4, &(0x7f0000000580)=@framed={{0x18, 0x5, 0x0, 0x0, 0x40000}, [@call={0x85, 0x0, 0x0, 0x7d}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000080)=r0, 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)={{0x14}, [], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x28}}, 0x0) 7m6.842247143s ago: executing program 3 (id=6403): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x41, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) write$UHID_INPUT(r1, &(0x7f0000000240)={0x8, {"7f9654d636ab18b7938a2804505c72e9994ca22404fc203334cc21ed3d6a776fd12d13f9602b2980f983c31a5d1e431db778099ce3af3fb20e1ee1f4fdb77cbb36154982a93c19825d6fd273ab1eb5bcd47adad50de8a6791486e482e29ecc94284921f33b941cfc1000c9781d9a828c5ec7a2c77b4e624a5aa0e9e39782bad733eda81ba47e1c6116e4170e6587dd6210a57abe91f1f80c4e31139d8b73fe35ac1f99ea82dd6aa9c9aa67de88ae3e141020e1a876bbc449d2d843aa7e6d90b948b7e28770e6ac71010c63f17e90fd20806a9f8d9f418ee3af74aac64b04a27c4f5e3626ca2da546c79d24acadd11e8d272a22fc54078fd5e64475993668980a9f95aff964ded28f79c862e674356af492b8377a759d8ccf1accb9a18ef7ad16f438dde69cd020d71552b0810688c882a26a22b23f4b35471b08b379193db1cd7934a4049ff1b00d9795cda6e73951641d5e2365c24facd5afd09ed1d096d758b4fef66fe1aa22395d67b7e1db623d4a60a7dc93893d6c4a91df79535a855868c5dc0033d5c428cd25b85c5deb6e81068553bc84cead4d1eba8aa57e2b354a6899e44acbd3834491219b3e231cd55d82f161774a689efe197cc193ac0124c67738a0a1d5f16a6768c2c2ba7386c8c95ca08c55117f344f5a2bca0d09e79ea3fc49491f2c7adc513c2779c1bf62b1a8643d23e9e8b2ae41d4a59f1b82b82e092b36eb851b8456da871b4057aec325a9d4cccafde61f2abc85e3cabeabb856f6ffbfe23d69219ec8fae6beb54abe7870dbae823d49806a967a1c7f252999804f106745f20490bb3347b59321dc69765567abcbd89de04d89622170005df5871ed0fb72345a11da074060d7d4ee2e437f71a45723fb6b02de56067e54f54c52d10f7874a13cbfb3bd65ce54f9d6719ea210e0cf79e4e2157736ec07ac5915682ab81bced665c1e72fab8d8cfe509de0f21fe374b957b379fd5918061e21c2e96985cc1354b2de859b0f1a463ab04683b1253eda671c2353b5c208aca652f5419ffc4949a7fa909b95653f42d97390c400b4a1c308b11e73e9a06d3b164d3361e75584d70e6bc61d570a7e0c7da330f643194c1893fcd6489fac605eead61b53dff18caf526ecccc9bbd9146bc3c3bb67677695e6fddaab081786e9084014e60f5c03ae5a9087726b05e17402cd2fbb80d773b8a41470b1f901a8c2b2d57450181f4fc5bc53c7cb3dc032b84567492607cb08832eca9f79da9210d197863e5db5a74a9823dc0cc8bd9f3a9b6ff5a7d15d4747a9b26e088f4fad96d81cd1214226b1c4585d418d593220fcbb9ad949266cc48163e3498b46ebcdf7b2b5ecfe67539a61ed9e39b02d5b35ac0d0e7fa830034ca2da8a7ddf04bcf2cee939994369feb77023e0e3de04b21db7a640a92c17748245005cd75a7deba4ff0e4c104a9db2d9a98ec8edb3562050a3bac5f322290e3d8b6fb21770ac436d4cb12b97fc8f76d7bb9eeed85663eb0626f1ad1719ee4b07f7de2c1d1a31c27c6879f4fa3dbdfb2bfc0898beabafbeca9f13050e6b2f6c432e423cd5cb6b8fa56fe32c3e50104e44462c0a5c69de6a7ac5ae3d9f07ceed64dbffa42e4663838bfcde92f0fcb895f3b93c59b0e48c09890dfc36436db56b708f6e7cbbd2a6305f573cee099dbcd263cb96d9fb69cbc3cb06d8f5e3789698a17e71d22b4665ff5447fcc17a31bb136c8bb4b984573bcaf1cb650198c1266e6ddfd42d44f9de02cb9d915c5334c550fac3fcee56790aeb09d81e7690a32d8b0cc477b23f15257820de227be1ffaec2f63f3266b8f5dd78947dcee355fe59bfb100e5244425532bb1d115acd211b8c16b0ec0aae00fca5d4511a05c3ff027a1cac56210a10d81c01b90e156cc7b33de0fac825dc516d398166096013e068db935483c93ba95da39b5ae4087d84479a4c4809f28f93790dc279637bd6f3dc441d315cf6bd7b0e3d92070a45baf4445ce063fd12690eb002f5ca068a256bc54100c99a02a346beca39072163c4b297d117f1ed9fef42e3dbc11d36a0a0db52e84461c6fbb4aad62cd6c8dc9ae6a3390a5e8773ac599e67436220c8d541a9039762bffaa7f490e31dddbc362fb4ff686cda905f3b02a1db76d4d570d970434921ca8a4765af6d5c8b881e1f4ffa7e2d9ef5f5511b94f88474674ec790bb5186c73446a227bf1ffd19b605733abd1bd41e421aeaf2ed4617088c7ceef85451225056435993e89e4bccd2c2e4b39af99feef11fea645eeb5cf9f77b1e19a72d3efb613100969b84302789714bca65bcbc96762b4012a5700c62aed706433b9f142b7302442b6a9958b0e28e8b1cfa9eeb4ac0d71f497b23babf9f0221dcb658d9f4db5d45bee30d2ad7c97d6a562e014a7701c15325ec5d42ab732b37714a77a95c03fb15bbfba6fade32bf50f985a1df362ca7216cc152907dd931acb58a63920f581e82b590c0d6a0033009f8e50c3263d3f58596b63d507cadbc809a6690561f74d0772bf92d04e06c47a350724b106f5e83f7e71c4b2a983bf5ad7d8684e7b8b5dc1273d0fa5879b8e61bde33d602bc8ff0913b6d32dcac366d568dc7cf82bbfc405cbe418a2644c26592b32ca1a632fc95123efb784cfb6953a94ebeccd24fba389a0e56b043df07d9a2dd38a1196e5e55576b25f85cb96f6560802a4a58b7a6857e8454faa2c880bf32d464562b2bdc5f0df22b663f2c01fc944f1cfd1908f617f8295a5440bb79ae178ea46a95baeea48322105146ac3ed2de7d3796ddddcc848a8ecf4a00dd055733b4f59211f5a40deea44e74b3bc57953b26ed61e6fd67889edfe8d0902385e37666aacec072735630ecc441c3cc6b09bb2f63aa4e332c6df728dc74078a83ce20454dfd616d116270666ddc09c5fea2e8442bc43455d0257fac92f3780061178f9420bf8e463f29896c12383dbb9a81bc5c87376e647c8a9786cb514fb9696d9c0a8d303c5c4b5b7c5f601c01fa19323e02f675c371bc44fbc1ac5704d41a89a2a4ccec6ac8440c532f07da25aa2dce6a5d2ebe694eb4017d178b221213bfe2a01d9cfe689bd190776bca6c032f446eb8862587a7826e35f3f691763212eee6af2e49bbeb0a27e07c5714b74e373798c7bebce265f7ebef3a1ea64078cf1e8a9d433af32c53090c972ffedbadafb50b9a6e540abd84f8e938583ea725954be3b236c5d8aca7d486d21902a2902f25a7c02dbe83c39bd0b81513f9ef198c49d560e930ae224ff47f92e4851e1f7ab5bb406abcf6596569261e6b0c67bb3b854e9c6de60bfb60fcf29241ff237151310ecd19f8b2cfe764c1df1a2de9d840eca47aa169ba9a415901204ec31ccdfd76e908029ae34fb12dc286758c64fd6d42bc82b14e07e421f4b42b180cd6ef40cac8062928b4a420a4577f24295f54de9048ac9d34307bf93e463cea4967cf4880166f68ed1eb965db2e4fb9f5f0b1c695d621e427ccb9a3188073ee6fde729c6698346efa1c0ba643c1efd20858965511da750060d551c44c435a5f1603fae7357e0bc78e92aad3d88790ec2aa1a42d6fe7e0ffc57f3599e406db63be7dd32692df32ce33dee0a2becdb02d6e435e09de3d356497543db23f53da25643f9c585e275297800d8beed47f0e622f86fc25d2e87036fdceebfe7257cb6de0c02412d1c0758acfcd0862e99ad17a118f46f635a87477e8b825423d94ada35bf0b5444aa7d3de4bb7eec7ae5129fcc2cba651cc972f5500fc5161149d29f452962afb102a01ae76825cb4477460be0b85d75058595c27e9b7fae3492ec3925c671bee5f4ca534d5a294f783d6cc073c992139b61d21fd98297b04c0578dafd5f7ebcaf8d4d9185aea3d76e813421f4573b38c25093c015a65e44fb297f0f6ac2d02c4237b37a3bfca2406c5c95ae5812816bacad59ba7c6f72d7c644ff25b592ed1e89b276e05866c01a4ced7fc6dd9f190c20d420d7c8a1fe908833a24c5e5bd7a95a2a6fbf147fc4b29a179718166dd0fbae2fc6b8c8aac6194fa6baf0d3edc36b2316c56c441ba53e3e7aaaf0a1405566ff584f73a637b74dde9bcb4d41da2be6c9df5d533fbac54f5fb52a8a793757cfe19aa90048c6d07e3474136ae1be2455b0d0d02eb4b5961ba883209355c0dd2af4aad98e7b971e358a7d9b55fe17cd6095f257355d9b99e5ea52848f17b35a80792d9ed0fef6fe3eef9a324902409969823be20bbe0e8dba9c747cd1a14d3642d877b86271f3f0c322a142c4ff635b37d542c3265b5fe8589a732bb1a55010b930dd0196cd43ac3634c01b4a44c517197d03a3d89c67f5c09aab409e84c0af466bfbd0c96d240101a2542c66b4b4b8ef65b41b0079995c52cc9720d2c1d7c128c6f17a65cc798c1986cfbd8888460c54438edc4f91f3580391c8b57d9aee209a59a116c1c44775437e9c30e6d87e82ce84e28532b19441e32ab9aea22177bac9daad25a6c88395e9348d6780de630cddb266c411011175bdb6255a36535180818447d43ffba3758d311539fe9f6811fa470bf3767b4c2d4cdf37854c7ee28730bb1d39d5c0dfffcdbf353cca3e13079f3ae66b839c7dd36914022a0e75bca5b622f521420b73249ef47f03c1fb03ecf7557882afcaa7cf454a68ad237d4ce860bd6b1531c1cafe2cfb76bc4188271ef6bdfb304ee0e6932463a1909f03d6e8a27b5f137d6b342841d613863dfdf37d5ec3a98d667810fb6f82d67620bdefed8b3ff98420a6c7ee577c3ba68b95a20403608a7ba6526ec9e8662c6e15ab09b1a9019d4958af04cb2e4890ee6b1077fcaa5cc0817f388461b230fe631e75f18ab392a5ca5de4a024ca16dd05fcfdf92114e43a5c4a169d462ff0dba57deeaf5eaafd892f8ccbd72ac56471162e1416bca39859b4184ba0d1b3f7ec05db4ef4cf0142867fa9be328a0be8aa74c716aad9411008607980861f4f72e9bfa60195e2f939d3f6a44a6cec07dd376d1bccaa126686f313d5f7918ecd1215026982c82ed1922ef70e36e8ed59b2d5ceab3b4aad7e53049062dd5ba0e87f7005c3f4d2b788245cdc2f35ef2572bea5ea92dfad406ade6d5ad18be8eeb4c652e5277b244645c68c0c0f5a68d42e00d59b75941917b2cdf31fdf809f2078ca97fd5beba65b34e0621138ea0e94feb87166b2dac2232ebca575e5c0a4d565d9992f733bbfbe68a63d99ee93398604065d5517c33ed0e067bdb643e73102f16137afd7d4bf21e8065ea028c392a6dcefbe642dc3fb03a239d9c8b17023eacc8e19fea11c34a10644af1b786fc0f4504038c2ee59c1b353f3d7b9313df025b4b5874ca63ec164a3fe35bf390d266f53dcda6a8e190e63a56ffdf4f7c5c02aa22d376db06d4d2b96be5b331f897d1ecfd25c13a1c194c265dd95a5724a6435bc8138224d9db28b689b9cea5132cd19601dbc4a43e70c71e27e8fd0689d09484974e8a4605f8553735fffaf5654a087e323ca14e02b681b9bbe592bd6b719ae2e86bdf918b27c79d52dd334d1aa7ebc1bff76e97572faad092010a1022f7d33089049107a89c364ae7dd022d119e8f6ab795fd71d76a90e8202339401ff9e9918ea8c8e12f7b0ba10d9ebde5d1bc5988f2d07b34579d8c282628204f2978d8b0cf95dc41f3775a4053f833267c64b42336d7c850f2918ef0dd6d62e43fcc173254eb34748efd4754609ce25ade162ba3c91bb844aaf6fd648ee5a8fc5c64346603f8258592d67b9613e8f7ac0def0958f13436581d729e0b3e062738eb06b2116abe837529690a614fc5d3f53b4d4602e57060", 0x1000}}, 0x1006) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x11, r1, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0xfe, "0062ba7d82000000160000000000f738096304"}) 7m2.111816888s ago: executing program 3 (id=6416): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000200)=@ccm_128={{0x303}, "416a0be7c02c37c0", "c3a5059aee1679bc50218d2188f33a9e", "d2dccbc7", "f6464c4abe4b8e0f"}, 0x1) 7m0.201080045s ago: executing program 3 (id=6405): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) umount2(&(0x7f00000002c0)='./file0\x00', 0x4) 6m59.320865174s ago: executing program 3 (id=6420): bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000180)='workqueue_activate_work\x00', r0}, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="d000000010000104ffffffffffffffff0000ffff", @ANYRES32=0x0, @ANYBLOB="08d10000000000009c00128009000100766c616e000000008c0002800c0002000e0000000c0000000600050088a80000640003800c0001007b4b0000000000000c000100020000f4140000000c000100bf000000000400000c00010002000300ff0100000c00010005000000090000002000010002000000080000000c00010005000000120000000c0001000200000004000000100004800c007f02dd790000a400000014000300766c616e30"], 0xd0}, 0x1, 0x0, 0x0, 0x40}, 0x0) 6m58.920806668s ago: executing program 3 (id=6425): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = epoll_create1(0x0) r2 = socket(0x1, 0x80802, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000240)={0xc0000006}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x2, r2, 0x0) 6m58.599135578s ago: executing program 33 (id=6425): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = epoll_create1(0x0) r2 = socket(0x1, 0x80802, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000240)={0xc0000006}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x2, r2, 0x0) 5m18.56610264s ago: executing program 6 (id=7339): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8822d55593a2179}, 0xc) r1 = socket$inet6(0xa, 0x3, 0x87) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000280)={{{@in=@broadcast, @in=@remote, 0x0, 0x0, 0x4e21, 0x0, 0xa}, {0x0, 0x4, 0x0, 0x80000000, 0x6, 0x9, 0x0, 0x40000000000000}, {0x8000000000000000, 0x100009, 0x53e5, 0x21}, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1}, {{@in=@multicast1, 0xfffffffd, 0x32}, 0x2, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x1502, 0x4, 0x0, 0x0, 0x4, 0xfffffffd, 0x1}}, 0xe8) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) 5m18.376989013s ago: executing program 6 (id=7341): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffffd]}, 0x0, 0x8) r1 = gettid() tkill(r1, 0x16) ppoll(&(0x7f0000000040)=[{r0, 0x200}], 0x1, 0x0, &(0x7f0000000180)={[0x10001, 0xc1]}, 0x8) 5m18.186055395s ago: executing program 6 (id=7344): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000002000000000000000700000018"], 0x0, 0x7fff, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$KVM_SET_MSRS(r2, 0x4140aecd, &(0x7f0000000100)) 5m17.800302581s ago: executing program 6 (id=7349): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000100)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x44000, 0x0) 5m16.518189118s ago: executing program 6 (id=7355): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000000)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000100)={@local}) ioctl$IOCTL_VMCI_CTX_ADD_NOTIFICATION(r0, 0x7af, &(0x7f00000000c0)={@my=0x0, 0xfffffff7}) ioctl$IOCTL_VMCI_CTX_REMOVE_NOTIFICATION(r0, 0x7b0, &(0x7f0000000380)={@my=0x0, 0x200}) 5m15.990939697s ago: executing program 6 (id=7358): r0 = syz_io_uring_setup(0x5c2, &(0x7f0000000280)={0x0, 0xb81, 0x3080, 0x8003, 0x25f}, &(0x7f0000000240)=0x0, &(0x7f0000000200)=0x0) poll(&(0x7f0000000000)=[{r0, 0x20}], 0x1, 0x9) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffff8, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000004c0)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x68, 0x3, r0, 0x0, 0x0, 0x0, 0x1, 0x1, {0x2}}) io_uring_enter(r0, 0x6e2, 0x620, 0x1, 0x0, 0x0) 5m13.892114208s ago: executing program 34 (id=7358): r0 = syz_io_uring_setup(0x5c2, &(0x7f0000000280)={0x0, 0xb81, 0x3080, 0x8003, 0x25f}, &(0x7f0000000240)=0x0, &(0x7f0000000200)=0x0) poll(&(0x7f0000000000)=[{r0, 0x20}], 0x1, 0x9) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffff8, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000004c0)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x68, 0x3, r0, 0x0, 0x0, 0x0, 0x1, 0x1, {0x2}}) io_uring_enter(r0, 0x6e2, 0x620, 0x1, 0x0, 0x0) 3m21.293287006s ago: executing program 1 (id=8533): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)={0x34, r2, 0x1, 0x70bd2e, 0x0, {}, [@ETHTOOL_A_COALESCE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}, @ETHTOOL_A_COALESCE_USE_CQE_MODE_TX={0x5, 0x18, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x104}, 0x0) 3m21.170279785s ago: executing program 1 (id=8535): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xca02}) r1 = socket$netlink(0x10, 0x3, 0x0) preadv(r0, &(0x7f0000000300)=[{&(0x7f0000000180)=""/2, 0x2}], 0x1, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) 3m21.11940713s ago: executing program 1 (id=8537): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) sendmsg$NL80211_CMD_GET_COALESCE(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x20}, 0x1, 0x0, 0x0, 0x4004}, 0x44000) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ptrace$setregset(0x4205, r0, 0x1, &(0x7f00000001c0)={0x0}) 3m20.899902723s ago: executing program 1 (id=8548): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x41) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x84000, 0x0) 3m20.010007059s ago: executing program 1 (id=8544): r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r0, 0x40045108, &(0x7f0000001080)=0x2) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000980), 0x0, 0x0) ioctl$SNDCTL_SEQ_RESET(r1, 0x5100) ioctl$SNDCTL_SEQ_RESET(r1, 0x5100) 3m19.63416938s ago: executing program 1 (id=8549): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) 3m19.184846312s ago: executing program 35 (id=8549): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) 2m28.576130865s ago: executing program 0 (id=9007): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket(0x21, 0x2, 0x10000000000002) connect$rxrpc(r0, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x8000, @multicast2}}, 0x24) sendmmsg(r0, &(0x7f0000000180)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=[{0x10, 0x110, 0x1}], 0x10, 0xe000}, 0x5}], 0x1, 0x0) recvmmsg(r0, &(0x7f0000002940)=[{{0x0, 0x0, 0x0}}], 0xf000, 0x10002, 0x0) syz_usb_connect(0x2, 0x0, 0x0, 0x0) 2m26.920903194s ago: executing program 0 (id=9018): ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0) fchdir(0xffffffffffffffff) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) geteuid() 2m23.048892476s ago: executing program 0 (id=9035): r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r1 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2) ftruncate(r1, 0x1000006) fcntl$addseals(r1, 0x409, 0x7) ioctl$UDMABUF_CREATE(r0, 0x40187542, &(0x7f0000000000)={r1, 0x0, 0x0, 0x1000000}) ioctl$UDMABUF_CREATE(r0, 0x40187542, &(0x7f00000001c0)={r1, 0x0, 0x0, 0x1000000}) 2m22.153090415s ago: executing program 0 (id=9042): syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, 0x0, 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x4) mount$fuse(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x104000, 0x0) 2m22.104698442s ago: executing program 0 (id=9043): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x6, 0xb}, 0x50) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xd, &(0x7f0000000f80)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000085000000a000000095"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000040)=r1, 0x4) sendmsg$inet(r3, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x4800) 2m21.902146956s ago: executing program 0 (id=9044): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f0000000000)={0x79, 0x0, 0x52f}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_CAP_HYPERV_SYNIC(r2, 0x4068aea3, &(0x7f00000000c0)) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000001c0)={0x1, 0x0, [{0x48}]}) 2m21.55873179s ago: executing program 36 (id=9044): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f0000000000)={0x79, 0x0, 0x52f}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_CAP_HYPERV_SYNIC(r2, 0x4068aea3, &(0x7f00000000c0)) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000001c0)={0x1, 0x0, [{0x48}]}) 34.613535341s ago: executing program 4 (id=10018): r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) bind$can_raw(r0, &(0x7f0000000040)={0x1d, r1}, 0x10) recvmmsg(r0, &(0x7f0000000dc0)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000001c0)=""/57, 0x39}, {0x0}], 0x2}, 0x4}], 0x1, 0x22, 0x0) setsockopt$CAN_RAW_RECV_OWN_MSGS(r0, 0x65, 0x4, &(0x7f00000003c0)=0x1, 0x4) sendmsg$can_raw(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@can={{}, 0x0, 0x0, 0x0, 0x0, "0000000000000003"}, 0x10}}, 0x48040) 34.465523209s ago: executing program 4 (id=10021): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000000300)) r1 = inotify_init() readv(r1, &(0x7f0000000140)=[{&(0x7f0000000340)=""/263, 0x107}], 0x1) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) fcntl$setstatus(r1, 0x4, 0x42800) 34.327074799s ago: executing program 4 (id=10022): socketpair$unix(0x1, 0x3, 0x0, 0x0) r0 = syz_io_uring_setup(0x10b, &(0x7f0000000140)={0x0, 0x334e, 0x10, 0x3, 0x800}, &(0x7f00000003c0)=0x0, &(0x7f0000000300)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000540)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000040)='./file0/file0\x00', 0x60, 0x185500, 0x12345}) io_uring_enter(r0, 0x7277, 0x0, 0x0, 0x0, 0x0) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000040), 0x8002) 32.857297741s ago: executing program 4 (id=10035): mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, 0x0, 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x226) move_mount(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', r1, &(0x7f0000000100)='./file0\x00', 0x1) 32.4784342s ago: executing program 4 (id=10041): unshare(0x6e000000) r0 = socket$netlink(0x10, 0x3, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100009dea7840b418fbff7bdc010203010902"], 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'macvtap0\x00', 0x0}) r2 = gettid() sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="2800000010000100"/20, @ANYRES32=r1, @ANYBLOB="6d3082610000000008001300", @ANYRES32=r2], 0x28}}, 0x0) 31.524432945s ago: executing program 4 (id=10051): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412b", 0xf}, {&(0x7f0000000140)="ebe3", 0x2}], 0x2}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) 30.774751578s ago: executing program 37 (id=10051): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412b", 0xf}, {&(0x7f0000000140)="ebe3", 0x2}], 0x2}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) 3.826758698s ago: executing program 5 (id=10251): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @remote}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='veth0_to_bridge\x00', 0x10) sendto$inet(r0, 0x0, 0x0, 0x84, &(0x7f0000000000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x12}}, 0x10) sendmmsg$inet(r0, &(0x7f0000004d00)=[{{0x0, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x300, 0xf00) 3.708578863s ago: executing program 5 (id=10254): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x60880, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0x8}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x7f}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001300)=@newtfilter={0x4c, 0x2c, 0xd27, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {}, {0x8, 0x4}}, [@filter_kind_options=@f_flower={{0xb}, {0x1c, 0x2, [@TCA_FLOWER_KEY_IPV4_DST={0x8, 0xc, @broadcast}, @TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8035}, @TCA_FLOWER_KEY_IPV4_DST_MASK={0x8, 0xd, 0xff}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000}, 0x44010) 3.525159813s ago: executing program 5 (id=10257): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x60880, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0x8}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x7f}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {}, {0x8, 0x4}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_IPV4_DST={0x8, 0xc, @broadcast}, @TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8035}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000}, 0x44010) 3.514935772s ago: executing program 7 (id=10259): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(aes-aesni)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmsg$NFT_MSG_GETSETELEM(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000008c0)={0x30, 0xd, 0xa, 0x0, 0x0, 0x0, {0x3, 0x0, 0x2}, [@NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x2000c804}, 0x10) recvmsg$unix(r1, &(0x7f0000001f80)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)=""/1, 0x1}, {&(0x7f0000000040)=""/143, 0x8f}], 0x2}, 0x40000140) 3.417028271s ago: executing program 7 (id=10260): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f00000063c0)=[{0x0, 0x0, &(0x7f0000001780)=[{&(0x7f00000002c0)="598847167aa3eeecd678a4be219c9f7ac36dd422be5e395f6579a0878eb84f76bdd866c510f785691711178ee5cb9450f77f56bbaf73c14c1ebd44", 0x3b}, {&(0x7f00000005c0)="b786bc4294b02f59a1cb691b04822a3154b2b17f39", 0x15}], 0x2, &(0x7f00000003c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x14}], 0x1, 0x800) recvmsg(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000001ec0)=[{&(0x7f0000000380)=""/4, 0x4}, {&(0x7f0000000540)=""/113, 0x71}], 0x2}, 0x40000000) 3.30576295s ago: executing program 5 (id=10262): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$EBT_SO_SET_COUNTERS(r0, 0x0, 0x81, &(0x7f0000000200)={'filter\x00', 0x0, 0x0, 0x0, [0x3, 0x8, 0x9bc6, 0x8, 0x4, 0x7fffffff], 0x1, 0x0, 0x0, [{}]}, 0x60) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000040)={'nat\x00', 0x0, 0x0, 0x0, [0x6, 0x4, 0x9, 0x9, 0x800be5, 0x7f]}, &(0x7f0000000000)=0x50) 3.305337335s ago: executing program 7 (id=10263): r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000140)={0x5, "e807000900f8fdff7fff000500000000000000000000000000000000004000", 0xffffffffffffffff}) r2 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000000)={0x20}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r1, &(0x7f0000000100)={0xa0002007}) 3.229755215s ago: executing program 7 (id=10265): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'veth1\x00', 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@RTM_NEWMDB={0x38, 0x54, 0x1e5, 0x0, 0xfffffffd, {0x7, r2}, [@MDBA_SET_ENTRY={0x20, 0x1, {r4, 0x1, 0x1, 0x1, {@ip4=@loopback, 0x86dd}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) 2.971459489s ago: executing program 7 (id=10268): r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1400000052004f030e789e7ee2ce2fa4ff612d27", 0x14) recvmmsg(r0, &(0x7f0000005c80)=[{{0x0, 0x0, 0x0}}], 0x344, 0x10122, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000000c0), 0x40921) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue0\x00'}) write$sndseq(r1, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick=0x1f4, {}, {}, @raw32={[0x2600]}}], 0xffc8) 2.429557904s ago: executing program 7 (id=10272): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000000000040ac054382408b0b00000109022400010000002009040000fd0301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000003c0)={0x24, 0x0, 0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="002281"], 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) ioctl$HIDIOCSREPORT(r1, 0x81044804, &(0x7f0000000400)={0x1, 0x2, 0xfffff2e7}) syz_usb_control_io$hid(r0, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000180)={0x0, 0x3, 0xb4, @string={0xb4, 0x3, "38462fcf05b44c980ae5f5d3957e3ffd5b3ef7901f0c089a67e3112a227256227b39b2d332853b078400df5b5127c4d3827bb9648b9a25d7e250fcfaabea0e974ad3ea376c75b34180a7e7fbdca7ca79d9d24a57a8821c3227dcd10c49a84e1c176004deecb09640f01f0f6962edf5913f6e0ced9a29b00b4e18e93d20924a28a3643be0f6e178d835ab3dec7960ba6706366074435208784ff093ec2a56c8f724d0d29e8186b25af0eb30ff1a1c757c40c2"}}, 0x0, 0x0}, 0x0) 2.243502503s ago: executing program 2 (id=10275): timer_create(0x0, &(0x7f0000000180)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000000)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x2}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) getgroups(0x2, &(0x7f0000000100)=[0xee00, 0xee00]) fchown(0xffffffffffffffff, 0x0, 0x0) 2.011163771s ago: executing program 5 (id=10279): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x80000, 0x0) ioctl$TCSBRKP(r0, 0x5425, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xe) ioctl$TCSETSW2(r1, 0x5408, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, "23f555d9adb42d4408020e90d1beaa82dc1ecf"}) ioctl$TCSETSF2(r0, 0x402c542d, &(0x7f00000001c0)={0x3, 0x8ae00000, 0x1000, 0x6, 0x5d, "5d8eac911ca5177321601215d9ed980eb1ead2", 0x3ff, 0xffff}) 1.721327489s ago: executing program 2 (id=10282): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'ip6gretap0\x00', 0x0}) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000000080)=0x1, 0x4) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x3ff, 0x2, 0x5}, 0x1c) sendto$packet(r0, &(0x7f00000000c0)='F', 0x1, 0x0, &(0x7f0000000200)={0x11, 0x8100, r1, 0x1, 0xe0}, 0x14) 1.621300677s ago: executing program 2 (id=10285): timer_create(0x3, &(0x7f0000533fa0)={0x0, 0x21}, &(0x7f00000001c0)) r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000840)={[0x3]}, 0x8, 0x80000) r1 = syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0xd495, 0x13100, 0x0, 0x4, 0x0, r0}, &(0x7f0000000100)=0x0, &(0x7f0000000200)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd=r0, 0x0, 0x0, 0x0, {0xe091}}) io_uring_enter(r1, 0x2def, 0x9566, 0x0, 0x0, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) 1.524338218s ago: executing program 5 (id=10288): syz_open_dev$dri(&(0x7f00000000c0), 0x6, 0x444400) r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000007794608cd0c39007b90000000010902120001fc0000000904"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603) ioctl$I2C_FUNCS(r1, 0x705, &(0x7f0000000000)=0x10) ioctl$I2C_RDWR(r1, 0x707, 0x0) 1.481103689s ago: executing program 2 (id=10289): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000001c0)=@ccm_128={{0x304}, "1add9416577970ef", "e14a9ae4091516e8dba110a1ece1698c", "0a18e897", "905442a38ef552e2"}, 0x28) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000180)=@ccm_128={{0x304}, "6d48948f6d364be6", "688bea3662572053b5ce04221b8e9091", "cb6fe1fd", "64558fcf143b0db2"}, 0x28) 1.3868289s ago: executing program 2 (id=10290): r0 = syz_open_dev$loop(&(0x7f0000000000), 0x3, 0x88582) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cpuset.effective_cpus\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000005c0)={r1, 0x800, {0x2a00, 0x80010000, 0x0, 0x5, 0x1, 0x0, 0x0, 0x20, 0x1c, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd6447a4a2e00d9683dda1af1ea09de2b7fb0a0100000000000000000300000000000a000029bf00", "2809e8dbe108598927875397bab22d0000b420a9c81f40f05f819e01177d3d458dac00000000000000000000003b00000000000000000200", "90be8b1c5512406c7f00", [0x4, 0x40000000000000]}}) r2 = syz_open_dev$loop(&(0x7f00000001c0), 0x5, 0x8c082) ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f0000001280)={r0, 0x200, {0x2a12, 0x80010000, 0x0, 0x2, 0x4, 0x0, 0x0, 0x3, 0x1c, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd64c6a4b4e00d9603dda1af1ea80000000000000000000000deff00000000000000000000000014a2648f00", "2809e8dbe108038948224ad54afac11d875397bdb22d0000b420a1a93c7540f4767f9e01177d3dd40600000061ac00", "0000000000000008000000000000b60500874028161db2214e00", [0xc00, 0x3]}}) ioctl$LOOP_SET_DIRECT_IO(r2, 0x4c08, 0x6) 1.279849756s ago: executing program 2 (id=10292): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x403, 0x6030, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x2}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000140)={0x0, 0x22, 0x2, {[@main=@item_012={0x1, 0x0, 0x7, "a4"}]}}, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x0, 0x14, 0xd, "5e6424818327b2369deca65eb2"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00M'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000b00)={0x84, &(0x7f0000000600)=ANY=[@ANYBLOB="200e06"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 909.143988ms ago: executing program 8 (id=10298): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52", 0xa}, {&(0x7f00000024c0)="e86127e6ef12", 0x6}], 0x2, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x2eba9c923568dbff) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0xc}, {&(0x7f0000000200)=""/68, 0x45}], 0x2}, 0x40000100) 845.135174ms ago: executing program 9 (id=10299): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x60140, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_io_uring_setup(0x49a, &(0x7f0000000400)={0x0, 0x79ad, 0x3180, 0x1, 0x40024e}, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_TEE={0x21, 0x40, 0x0, @fd_index=0x5, 0x0, 0x0, 0xc, 0xc, 0x1}) io_uring_enter(r1, 0x627, 0xc1040000, 0x43, 0x0, 0x0) 773.3568ms ago: executing program 8 (id=10300): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = mq_open(&(0x7f0000000100)='&\x00', 0x40, 0x0, 0x0) mq_notify(r1, &(0x7f0000000000)={0x110c230000, 0x3, 0x2, @thr={0x0, 0x0}}) close(r0) socket(0x5, 0x5, 0x4) mq_notify(r1, 0x0) 612.491457ms ago: executing program 8 (id=10301): r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f90324fc60", 0x14}], 0x1}, 0x200a4800) recvmsg$kcm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000004c0)=""/4135, 0x1027}], 0x1}, 0x42) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000a40)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a1d010000000000000000020000000900010073797a3000000000080002400000000098"], 0xfc}}, 0x0) r1 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0xffffffffffffffba, &(0x7f0000000080)=[{&(0x7f0000000500)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00b17d10cc40a888a8b96688a882006e9644fb02faf23884372d474d8235b094550aff7f", 0x33fe0}], 0x1}, 0x8000) 460.108196ms ago: executing program 9 (id=10302): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000006c0)=@newchain={0x43c, 0x64, 0x100, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x7}, {0xfff1}, {0xc, 0xe}}, [@f_rsvp6={{0xa}, {0x40c, 0x2, [@TCA_RSVP_POLICE={0x408, 0x5, [@TCA_POLICE_RATE={0x404, 0x2, [0x85, 0x8, 0x4, 0x9, 0x4, 0x9, 0xcf, 0x775, 0xfffffffa, 0x3, 0xa2, 0x4, 0x4, 0x7fff, 0x3, 0xf, 0x4, 0x3, 0x6, 0x2, 0x8, 0x7, 0x6, 0xffffffff, 0x9, 0x78, 0x1, 0x2, 0x4, 0x1, 0xfffffee8, 0x5, 0x9, 0xa, 0x5, 0x8000, 0xd9, 0x0, 0x16, 0x0, 0x8, 0xfffffffa, 0x1ff, 0x5, 0x3ff, 0x7, 0x0, 0x5, 0xfffffff7, 0x8, 0x50ea, 0x6, 0x8001, 0x9, 0xb0e0, 0xf, 0x5, 0x8, 0x3, 0x0, 0x4, 0x5b23, 0x5, 0x8, 0x2, 0xee, 0x7fffffff, 0x7fffffff, 0x3, 0x172, 0x5ae27a20, 0x5, 0x6, 0x4, 0x200, 0x1ff, 0x3, 0x400, 0xe6b3, 0xd171, 0x6, 0x1ff, 0x7, 0x699213b0, 0x9, 0xa, 0x12, 0x3, 0x4, 0x0, 0x100, 0x5, 0x6793, 0x0, 0x1, 0xfffffffa, 0x9, 0x80000000, 0x7, 0x5, 0x0, 0x80000000, 0x400, 0x35, 0x7, 0x5, 0x8, 0x6, 0x9, 0x0, 0x1, 0x5, 0x2, 0x2, 0x2, 0x7ff, 0x40, 0x7f, 0x5fece1ea, 0xbf7, 0x8, 0x78, 0xe, 0x80000000, 0x6, 0x8, 0x5, 0xe, 0x5, 0x200, 0x4, 0x4, 0x0, 0x0, 0x1, 0x3, 0xb, 0x70, 0x2, 0x1, 0x9, 0x1800000, 0x9, 0xbff, 0x4, 0x6, 0x800, 0x7, 0x5, 0x3, 0x0, 0x6, 0x0, 0x2, 0x6, 0x800, 0x3ff, 0x9, 0x3, 0xcc, 0xc60, 0x3, 0x8, 0x4, 0x1, 0x0, 0x7, 0x2, 0x6, 0xc, 0x4, 0x32, 0x2, 0x8, 0x1000, 0x2, 0x4, 0x4, 0x2, 0xffff, 0xb37, 0x7fff, 0xbec, 0x8, 0x5, 0x1, 0x5, 0x0, 0x1, 0xffff, 0x7f, 0x3, 0x94f, 0xc91, 0x9, 0x3, 0x2, 0xd46, 0xf, 0x200, 0x0, 0x8, 0x7fffffff, 0x0, 0x8, 0x2, 0x1, 0xb, 0x18000000, 0x4, 0x5, 0xd756, 0x6, 0x3, 0x800, 0xd3, 0x2, 0x6, 0x9, 0x9, 0x7, 0x5, 0xaec, 0x100, 0x0, 0xfffffffb, 0x40, 0xfffffffe, 0x3, 0xa, 0x7f, 0x1, 0x9c, 0x400, 0x5, 0x8000, 0x8, 0x8, 0x9, 0x6, 0xffffff7f, 0xee2b, 0x7, 0xeaf, 0x3, 0x401, 0x7, 0x7f, 0x5f, 0x1000, 0x7, 0x9, 0x7, 0x8001, 0x9, 0x3]}]}]}}]}, 0x43c}, 0x1, 0x0, 0x0, 0x1}, 0x40881) recvmmsg(r1, &(0x7f0000006fc0)=[{{0x0, 0x0, &(0x7f0000001f80)=[{&(0x7f0000000d40)=""/13, 0xd}, {&(0x7f0000000d80)=""/247, 0xf7}], 0x2}, 0x3}], 0x1, 0x1, 0x0) 285.200051ms ago: executing program 8 (id=10303): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=@newtfilter={0x50, 0x2c, 0xf25, 0x70bd25, 0x2, {0x0, 0x0, 0x0, r2, {0x0, 0xd}, {}, {0x8, 0xe}}, [@filter_kind_options=@f_flower={{0xb}, {0x20, 0x2, [@TCA_FLOWER_KEY_ENC_IPV6_DST={0x14, 0x21, @local}, @TCA_FLOWER_KEY_ENC_KEY_ID={0x8, 0x1a, 0x6}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 264.528782ms ago: executing program 9 (id=10304): r0 = syz_io_uring_setup(0x241d, &(0x7f0000000380)={0x0, 0x0, 0x13090, 0x0, 0x267}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x30, 0x9}]}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}) io_uring_enter(r0, 0x1000001, 0x0, 0x1, 0x0, 0x68) 170.272336ms ago: executing program 9 (id=10305): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_CT_DIRECTION={0x5, 0x3, 0x1}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x9}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x9}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x80}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) r1 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x3, 0x3, @dev={0xfe, 0x80, '\x00', 0xd}, 0x9}, 0x1c) sendmsg(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000004c0)="06e28092c5ec1d88d05e0a6f2ce709c63de1ab461557270000fc494605c77dc874d0734eed79ecd2e373cf63d3a4e9a461877edf08af5c6c56be907e383f7a1cce50acae1ed1944d1e00f576d2365e27c059eaceee4e56e1f161effd91efedde230512ce932b03ea7ccfb1442c3d8c8954f4b9cdc4bc9dc1f14af9e5b22f9ba40774572c6992ca3e89d70fc2ab813333d71fbea6b7a7b60004285435319ebbae2cc5f343756ed4c9eb88760294047270864a6921876a953daf8b1e8dfa14c0626ce6597cd21a38b8b115ea15c3d63f4119868d4b3948cfcda7f069a9ccb0bbaa4854f0dc1092e6f0b16873951b1e521e1ce63614fc34a7cc07f154261ec71cd457229a5897a9815f7641bdf50b05aa1d5d1a8449f02cfaaeab93fe13c3d9506d0b6601af66ef870fb98b97b7b9d1c3c2790c21dbf6f7ebd3b0a85faa3288257ab2ae248865498bf0b7f23e12cfa7a3137a9903f866eb874415cf20253e94ddfb1533827d15580041", 0x168}, {&(0x7f0000001600)="c9fbe0378bef0a6749d715b5c3e27d03e68c83579553d3bd9cc08edbae86d2f95e95a3fa8ab031e21b5a47e4205c87eefc819e6ea7bd0f6772e957f739339398cd07aeb0522339dde07af5b6ee6b94221ca3494c29be340810d421808f27877885583a2c80d4331aca54533ad84a0ccc5fa28956504f2eafc0f098f878ae3caf30b7981d5e778aaa197d235aa31c4c77fdf0e1c0d31fc7c43969830f82c4b5631e47df6b9a9f59a57e0e7bd1f9e4fcdb4150f713fb9e3530650b43a92853d1e3334fe72113d518a558343615ba8d3412bda82b725855e14c29f7ed81e1cbb76f9684cc6b7fcdc2808119a0f8328b0c5d0e996e50e95605724abb1c635b0bf633f4bcca6213fef03260e56321e3270f322eb13b8ab70c726cbce78c93e4c87d7d7b363542b1b4eb90242ae9459775aa7c045233df9912fc47d6793f40bb5543b537ed6b79e0091e3c069644ce8d6ea00125815fae3c25f4d5c847e76c0c697d7df260ba36e6917f75ccd289070477665e64ac3e00c93228b72763f28104defab475f03841980110b23d02a3d1b74d25c8f2e1c8dfd9243e0bb7a583f091f829329f045f2fc0c40bb4a5205b071d4b6959663c6bfc1f04b23db627ac9fc792cd3355dbbc031d56107ea3379209a49abf03a8347fce6d48cf1968b64558e30210b02214cd0728c6743b89bd4cc2f1d1424fcedd95fa700751a4ff438469fd9e6f3a47200f3fbbde74bdbbeabfb6f96e32366d85a8e6bb6d576687634daac56c9619e4bbeea7606f223d3976c4bea9a07406b037cef4d06cc9e447dc06901c91145aeb9b9726cbf808d253cb01e0806f21d82b928173be2f5bbed1a97e725b17d1d1bd19c14935abd242ca6501c4282f5f1a3e813c68bdb88add0b6fcc14b8355a81b9ac915e5d51212438c5d2993f26456c9ecde871752c99ddbaecb3f6f5f02a0542e898b64a6d475aae01f2aca6c6013907c085ef56483c910cdf4cdcdb516533aeb97644462cd012e0407dfdeff5428e23edd335b1590641353c54f0802f45d880cb8f22ebbac0cc094a771877aac6491aa62350ccde2993826928e6614b76c15e4aae8ede6de392f4f6567f0833ced4458bca37928cc2a70ca20cd38c11138b6ba39a6374ef7f150eb2d5a500a6b9c010d13dcf7318deb8c106e2448c6b21f62051300080dcc9d87db52cefe722035f1508fff231c22bfc8f1d2e14de70a281be8eb3649ace61896f0c33357fcd838db94aaca611b228f76cb4ab983ad3ab636c7260d57bba0061574bb0876afbeb916e252572687b8d28ba7c945f07e0286bedfd7c259769016225a158bf607dd62e11c83bc686a7ab2903ddd64d4e2c44f39ac1f76b80d6be086396e7515441afcadfecb940776ee4f776d3c294dce9aab77e5c2f6c36c20b4343d80d0c3da5f838b948aa684729c578718d3a0811a1dd654e7ad5e414d892ceb3dd704632caa4dcfdc947ce9391ab9abaa0951d12d56623b0028fe78da20a65df9eabb16e4b14bbbfea7108ab4308e7cb540ab8a810cebbf0d3b64ba108d281c91b011f2a8e565c4b802448bad1a57fe6e74fd3278211a70f0767746ed1f234e8edbcb6f8a215e66849a7f10d1533ef626e31725439afd95c9b3a673041459e473d5ddbcc187f55d72d054bf16a714ee0f4bb5d14cf29b853fd6f703b54f227d20ca414b3d6314e9448d211707158ea758e04a2fe7dad468374d62ab4240bb3c9782faa9f87aec26876714b169198931cbd486c01bb2156488467cda498d0a0c62ff6cf03fc68aa3b8051fff5d68e8374796439e9cf12dae426d3692c2d50699eae00ba4b9797fe5295740d8efb64a48bda389e841254638a118337404194e440a2338e2ce0b32395874e0d5cc36c0f1231426d82636e5a7182f82ea545bf7cd5d19ff42a1e8b90193a82452a0eec6575bf7181275d5c2ba2d74a5bda47934d8c89f3225f38959c12b3a2cae85e5108439bc262b69f5bd5f73a86776525f4ecb1685175ffc05aa5faadcc3be80d0b1d1bfc34ffc2ee1cde6bdf0000000000000000000000000000000061293c817aaec775b1f08ddb2e3ce8679267", 0x5c4}], 0x2, 0x0, 0x0, 0x2c}, 0x40440c4) 95.68945ms ago: executing program 9 (id=10306): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, &(0x7f0000000240)=ANY=[], 0x8) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast1, 0x9}, 0x1c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000440), 0x1000a) sendfile(r0, r1, &(0x7f0000000000)=0xa00, 0x1001) 94.589227ms ago: executing program 8 (id=10307): r0 = socket$inet6(0xa, 0x2, 0x0) close(0x3) r1 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000080)={@remote, 0x800, 0x0, 0x3, 0x1, 0x8}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000040)=0x5, 0x4) sendmsg$inet6(r0, &(0x7f0000000100)={&(0x7f0000000000)={0xa, 0x1, 0x80000, @local, 0xffffffff}, 0x1c, 0x0, 0x0, &(0x7f00000004c0)=[@rthdr={{0x18, 0x29, 0x39, {0x3b, 0x0, 0x2, 0x7}}}], 0x18}, 0x40048d0) 2.143394ms ago: executing program 8 (id=10308): r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x270}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x80801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x145}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000ffe000/0x2000)=nil, 0x2000}, 0x1}) 0s ago: executing program 9 (id=10309): syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f0000000440)={0x24, &(0x7f0000000240)=ANY=[@ANYBLOB='@'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r0 = syz_open_dev$evdev(&(0x7f0000001540), 0x0, 0x0) ioctl$EVIOCGLED(r0, 0x5452, &(0x7f0000000240)=""/77) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000180)={0x57, 0x0, 0x0, {0xfffe, 0x1}, {0x74, 0x2}, @const={0x6, {0x7f, 0x0, 0x8000, 0xfffd}}}) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x78, 0x822b01) write$char_usb(r1, &(0x7f0000000040)="e2", 0x1068) kernel console output (not intermixed with test programs): I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 906.743705][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 906.753597][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 906.763547][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 906.773782][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 906.784552][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 906.792995][T27026] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 906.805199][T27026] Buffer I/O error on dev loop7, logical block 0, async page read [ 906.815836][T27026] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 906.825708][T27026] Buffer I/O error on dev loop7, logical block 0, async page read [ 906.847086][T27026] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 906.866788][T27026] Buffer I/O error on dev loop7, logical block 0, async page read [ 906.879027][T27026] ldm_validate_partition_table(): Disk read failed. [ 906.886294][T27026] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 906.897086][T27026] Buffer I/O error on dev loop7, logical block 0, async page read [ 906.906467][T27026] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 906.929243][T27026] Buffer I/O error on dev loop7, logical block 0, async page read [ 906.940731][T27026] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 906.952672][T27026] Buffer I/O error on dev loop7, logical block 0, async page read [ 906.960964][T27026] Dev loop7: unable to read RDB block 0 [ 906.967783][T27026] loop7: unable to read partition table [ 906.973795][T27026] loop7: partition table beyond EOD, truncated [ 906.980461][T27026] loop_reread_partitions: partition scan of loop7 () failed (rc=-5) [ 907.815180][T27058] netlink: 16 bytes leftover after parsing attributes in process `syz.8.8891'. [ 907.872071][T27058] netlink: 16 bytes leftover after parsing attributes in process `syz.8.8891'. [ 908.286721][ T5827] usb 6-1: new full-speed USB device number 43 using dummy_hcd [ 908.354769][T27080] loop5: detected capacity change from 0 to 7 [ 908.366200][ T6040] ldm_validate_partition_table(): Disk read failed. [ 908.374416][ T6040] Dev loop5: unable to read RDB block 0 [ 908.381435][ T6040] loop5: unable to read partition table [ 908.388702][ T6040] loop5: partition table beyond EOD, truncated [ 908.405397][T27080] ldm_validate_partition_table(): Disk read failed. [ 908.414808][T27080] Dev loop5: unable to read RDB block 0 [ 908.423679][T24123] usb 5-1: new high-speed USB device number 119 using dummy_hcd [ 908.433807][T27080] loop5: unable to read partition table [ 908.441661][T27080] loop5: partition table beyond EOD, truncated [ 908.442333][ T5827] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 908.448402][T27080] loop_reread_partitions: partition scan of loop5 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 908.510817][ T5827] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 908.557217][ T5827] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 908.569347][ T5827] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 908.674972][T24123] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 908.701508][T24123] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 908.731645][T24123] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 908.743396][T24123] usb 5-1: config 0 descriptor?? [ 908.762085][T24123] pwc: Askey VC010 type 2 USB webcam detected. [ 908.830193][ T5827] usb 6-1: usb_control_msg returned -32 [ 908.837051][ T5827] usbtmc 6-1:16.0: can't read capabilities [ 909.207364][T24123] pwc: recv_control_msg error -32 req 02 val 2b00 [ 909.211631][T27097] usb 6-1: usbtmc_ioctl_clear_in_halt returned -32 [ 909.216133][T24123] pwc: recv_control_msg error -32 req 02 val 2700 [ 909.229524][T24123] pwc: recv_control_msg error -32 req 02 val 2c00 [ 909.439415][T24123] pwc: recv_control_msg error -71 req 04 val 1300 [ 909.446735][T24123] pwc: recv_control_msg error -71 req 04 val 1400 [ 909.453689][T24123] pwc: recv_control_msg error -71 req 02 val 2000 [ 909.462309][T24123] pwc: recv_control_msg error -71 req 02 val 2100 [ 909.469853][T24123] pwc: recv_control_msg error -71 req 04 val 1500 [ 909.477555][T24123] pwc: recv_control_msg error -71 req 02 val 2500 [ 909.485170][T24123] pwc: recv_control_msg error -71 req 02 val 2400 [ 909.492544][T24123] pwc: recv_control_msg error -71 req 02 val 2600 [ 909.507103][T24123] pwc: recv_control_msg error -71 req 02 val 2900 [ 909.521202][T24123] pwc: recv_control_msg error -71 req 02 val 2800 [ 909.531051][T24123] pwc: recv_control_msg error -71 req 04 val 1100 [ 909.539182][T24123] pwc: recv_control_msg error -71 req 04 val 1200 [ 909.549298][T24123] pwc: Registered as video103. [ 909.570298][T24123] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input131 [ 909.619850][T24123] usb 5-1: USB disconnect, device number 119 [ 909.982645][T27111] loop5: detected capacity change from 0 to 7 [ 909.992159][T27111] ldm_validate_partition_table(): Disk read failed. [ 910.001523][T27111] Dev loop5: unable to read RDB block 0 [ 910.008671][T27111] loop5: unable to read partition table [ 910.023901][T27111] loop5: partition table beyond EOD, truncated [ 910.039297][T27111] loop_reread_partitions: partition scan of loop5 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 910.822261][T27120] syzkaller1: entered promiscuous mode [ 910.828944][T27120] syzkaller1: entered allmulticast mode [ 911.082453][ T5827] usb 6-1: USB disconnect, device number 43 [ 911.497750][ T5827] usb 5-1: new high-speed USB device number 120 using dummy_hcd [ 911.668718][ T5827] usb 5-1: Using ep0 maxpacket: 8 [ 911.740519][T27154] loop7: detected capacity change from 0 to 7 [ 911.747917][ T5827] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 911.758764][ C1] blk_print_req_error: 60 callbacks suppressed [ 911.758783][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 911.760354][ T5827] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 911.765435][ C1] buffer_io_error: 60 callbacks suppressed [ 911.765452][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 911.801695][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 911.812227][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 911.822470][T27154] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 911.844777][T27154] Buffer I/O error on dev loop7, logical block 0, async page read [ 911.862277][T27154] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 911.882643][ T5827] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 911.895625][T27154] Buffer I/O error on dev loop7, logical block 0, async page read [ 911.918630][ T5827] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 911.936740][T27154] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 911.969052][T27154] Buffer I/O error on dev loop7, logical block 0, async page read [ 911.979690][ T5827] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 911.996758][T27154] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 912.015265][ T5827] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 912.035550][T27154] Buffer I/O error on dev loop7, logical block 0, async page read [ 912.059347][T27154] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 912.078174][T27154] Buffer I/O error on dev loop7, logical block 0, async page read [ 912.092562][T27154] ldm_validate_partition_table(): Disk read failed. [ 912.104215][T27154] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 912.122702][T27154] Buffer I/O error on dev loop7, logical block 0, async page read [ 912.180025][T27154] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 912.209529][T27154] Buffer I/O error on dev loop7, logical block 0, async page read [ 912.239440][T27154] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 912.286604][T27154] Buffer I/O error on dev loop7, logical block 0, async page read [ 912.314009][T27154] Dev loop7: unable to read RDB block 0 [ 912.326357][T27154] loop7: unable to read partition table [ 912.341504][T27154] loop7: partition table beyond EOD, truncated [ 912.368973][T27154] loop_reread_partitions: partition scan of loop7 () failed (rc=-5) [ 912.669940][ T5827] usb 5-1: GET_CAPABILITIES returned 0 [ 912.675787][ T5827] usbtmc 5-1:16.0: can't read capabilities [ 913.346846][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 914.555506][T27199] loop7: detected capacity change from 0 to 7 [ 914.578154][T27199] ldm_validate_partition_table(): Disk read failed. [ 914.586168][T27199] Dev loop7: unable to read RDB block 0 [ 914.593025][T27199] loop7: unable to read partition table [ 914.600374][T27199] loop7: partition table beyond EOD, truncated [ 914.608968][T27199] loop_reread_partitions: partition scan of loop7 () failed (rc=-5) [ 914.770060][T27208] netlink: 4 bytes leftover after parsing attributes in process `syz.5.8952'. [ 914.937308][T24123] usb 5-1: USB disconnect, device number 120 [ 916.856921][T27230] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer. [ 916.944258][T27213] loop2: detected capacity change from 0 to 1024 [ 917.294532][T27246] input: syz0 as /devices/virtual/input/input132 [ 917.471040][T27250] netlink: 52 bytes leftover after parsing attributes in process `syz.8.8968'. [ 917.522700][T27251] netlink: 4 bytes leftover after parsing attributes in process `syz.8.8968'. [ 918.476159][T27268] loop2: detected capacity change from 0 to 1024 [ 918.500362][ T6040] buffer_io_error: 25 callbacks suppressed [ 918.500381][ T6040] Buffer I/O error on dev loop2, logical block 0, async page read [ 918.519151][ T6040] Buffer I/O error on dev loop2, logical block 0, async page read [ 918.528352][ T6040] Buffer I/O error on dev loop2, logical block 0, async page read [ 918.538985][ T6040] Buffer I/O error on dev loop2, logical block 0, async page read [ 918.548505][ T6040] Buffer I/O error on dev loop2, logical block 0, async page read [ 919.012734][T27283] netlink: 'syz.4.8974': attribute type 1 has an invalid length. [ 919.357450][T27283] netlink: 'syz.4.8974': attribute type 2 has an invalid length. [ 919.365521][T27283] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8974'. [ 920.064920][T27313] loop2: detected capacity change from 0 to 1024 [ 920.122455][T27315] Buffer I/O error on dev loop2, logical block 0, lost async page write [ 920.187076][T27315] Buffer I/O error on dev loop2, logical block 1, lost async page write [ 920.226408][T27315] Buffer I/O error on dev loop2, logical block 2, lost async page write [ 920.244699][T27315] Buffer I/O error on dev loop2, logical block 3, lost async page write [ 920.277852][T27315] Buffer I/O error on dev loop2, logical block 4, lost async page write [ 921.409579][ T5929] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 921.589776][ T5929] usb 9-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 921.610353][ T5929] usb 9-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 921.740230][ T5929] usb 9-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 921.787141][ T5929] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 921.861098][T27346] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 921.892478][ T5929] usb 9-1: Quirk or no altset; falling back to MIDI 1.0 [ 922.120181][T27356] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 922.196384][ T5929] usb 9-1: USB disconnect, device number 5 [ 922.369068][ T30] kauditd_printk_skb: 206 callbacks suppressed [ 922.369235][ T30] audit: type=1326 audit(1768515476.103:702): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27358 comm="syz.7.9011" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7fd4539 code=0x0 [ 923.327907][ T5929] usb 6-1: new high-speed USB device number 44 using dummy_hcd [ 923.518171][ T5929] usb 6-1: Using ep0 maxpacket: 8 [ 923.534716][ T5929] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 923.565896][ T5929] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 923.596866][ T5929] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 923.637036][ T5929] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 923.669765][ T5929] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 923.706853][ T5929] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 923.941665][ T5929] usb 6-1: GET_CAPABILITIES returned 0 [ 923.961899][ T5929] usbtmc 6-1:16.0: can't read capabilities [ 924.166249][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 924.180377][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 924.189709][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 924.199255][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 924.209219][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 924.218443][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 924.231525][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 924.241383][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 924.251120][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 924.332070][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 924.341420][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 924.351368][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 924.360849][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 924.370238][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 924.388891][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 924.398218][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -2 [ 924.438263][T24123] usb 6-1: USB disconnect, device number 44 [ 924.963717][ T30] audit: type=1326 audit(1768515478.693:703): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27375 comm="syz.0.9018" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf704d558 code=0x7ffc0000 [ 925.066870][ T30] audit: type=1326 audit(1768515478.733:704): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27375 comm="syz.0.9018" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf704d558 code=0x7ffc0000 [ 925.123941][ T30] audit: type=1326 audit(1768515478.733:705): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27375 comm="syz.0.9018" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf704d558 code=0x7ffc0000 [ 925.196623][ T30] audit: type=1326 audit(1768515478.733:706): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27375 comm="syz.0.9018" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf704d558 code=0x7ffc0000 [ 925.227410][ T30] audit: type=1326 audit(1768515478.733:707): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27375 comm="syz.0.9018" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf704d558 code=0x7ffc0000 [ 925.253029][ T30] audit: type=1326 audit(1768515478.733:708): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27375 comm="syz.0.9018" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf704d558 code=0x7ffc0000 [ 925.282457][ T30] audit: type=1326 audit(1768515478.733:709): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27375 comm="syz.0.9018" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf704d558 code=0x7ffc0000 [ 925.306432][ T30] audit: type=1326 audit(1768515478.733:710): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27375 comm="syz.0.9018" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf704d558 code=0x7ffc0000 [ 925.331831][ T30] audit: type=1326 audit(1768515478.733:711): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27375 comm="syz.0.9018" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf704d558 code=0x7ffc0000 [ 925.667225][T24123] usb 6-1: new high-speed USB device number 45 using dummy_hcd [ 925.816894][ T5905] usb 5-1: new full-speed USB device number 121 using dummy_hcd [ 925.869366][T24123] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 925.897614][T24123] usb 6-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 925.937146][T24123] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 925.946421][T24123] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 926.000034][T27400] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 926.048641][T24123] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 926.062061][ T5905] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 926.093483][ T5905] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 926.166966][ T5905] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 926.195038][ T5905] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 926.371898][T24123] usb 6-1: USB disconnect, device number 45 [ 926.732451][ T5905] usb 5-1: usb_control_msg returned -32 [ 926.748957][ T5905] usbtmc 5-1:16.0: can't read capabilities [ 927.367805][T27423] tmpfs: Unknown parameter 'ZmHSuLVόGU9Q1' [ 927.807211][ T5929] usb 6-1: new high-speed USB device number 46 using dummy_hcd [ 927.977921][ T67] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 927.990681][ T67] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 928.001109][ T5929] usb 6-1: config 0 has no interfaces? [ 928.018526][ T5929] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 928.049034][ T5929] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 928.076716][ T5929] usb 6-1: Product: syz [ 928.081233][ T5929] usb 6-1: Manufacturer: syz [ 928.110225][ T5929] usb 6-1: config 0 descriptor?? [ 928.169474][ T67] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 928.181524][ T67] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 928.308388][ T67] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 928.339486][ T67] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 928.362148][T24123] usb 6-1: USB disconnect, device number 46 [ 928.530189][T18759] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 928.542331][T18759] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 928.552823][T18759] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 928.598647][T18759] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 928.624995][T18759] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 928.670593][ T67] netdevsim netdevsim0 netdevsim0 (unregistering): left allmulticast mode [ 928.681930][ T67] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 928.702241][T20767] usb 5-1: USB disconnect, device number 121 [ 928.705521][ T67] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 928.869633][T24114] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 929.058588][T24114] usb 9-1: Using ep0 maxpacket: 32 [ 929.074090][T24114] usb 9-1: config 0 has an invalid interface number: 12 but max is 0 [ 929.082896][T24123] usb 6-1: new high-speed USB device number 47 using dummy_hcd [ 929.104519][T24114] usb 9-1: config 0 has no interface number 0 [ 929.130036][ T67] bridge_slave_1: left allmulticast mode [ 929.142233][T24114] usb 9-1: config 0 interface 12 has no altsetting 0 [ 929.151483][ T67] bridge_slave_1: left promiscuous mode [ 929.158643][ T67] bridge0: port 2(bridge_slave_1) entered disabled state [ 929.168725][T24114] usb 9-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 929.178392][T24114] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 929.190227][ T67] bridge_slave_0: left allmulticast mode [ 929.196019][ T67] bridge_slave_0: left promiscuous mode [ 929.206375][T24114] usb 9-1: Product: syz [ 929.211842][T24114] usb 9-1: Manufacturer: syz [ 929.217590][ T67] bridge0: port 1(bridge_slave_0) entered disabled state [ 929.225270][T24114] usb 9-1: SerialNumber: syz [ 929.237801][T24114] usb 9-1: config 0 descriptor?? [ 929.280643][T24123] usb 6-1: config 0 has no interfaces? [ 929.292238][T24123] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 929.313873][T24123] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 929.342810][T24123] usb 6-1: Product: syz [ 929.355831][T24123] usb 6-1: Manufacturer: syz [ 929.380891][T24123] usb 6-1: config 0 descriptor?? [ 929.622793][T24123] usb 6-1: USB disconnect, device number 47 [ 930.037787][ T67] gretap0 (unregistering): left allmulticast mode [ 930.384945][ T67] bridge0 (unregistering): left allmulticast mode [ 930.511997][T24114] f81534 9-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 930.529043][T24114] f81534 9-1:0.12: f81534_find_config_idx: read failed: -71 [ 930.538533][T24114] f81534 9-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 930.546337][T24114] f81534 9-1:0.12: probe with driver f81534 failed with error -71 [ 930.594602][T24114] usb 9-1: USB disconnect, device number 6 [ 930.712127][ T5151] Bluetooth: hci4: command tx timeout [ 930.804160][ T67] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 930.814347][ T67] bond_slave_0: left promiscuous mode [ 930.828482][ T67] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 930.839786][ T67] bond_slave_1: left promiscuous mode [ 930.854344][ T67] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 930.865141][ T67] dummy0: left promiscuous mode [ 930.877216][ T67] bond0 (unregistering): Released all slaves [ 930.947820][T27479] netlink: 'syz.7.9056': attribute type 33 has an invalid length. [ 930.959612][T27479] netlink: 152 bytes leftover after parsing attributes in process `syz.7.9056'. [ 931.001036][T27479] netlink: 4 bytes leftover after parsing attributes in process `syz.7.9056'. [ 931.250749][ T67] tipc: Disabling bearer [ 931.286819][ T67] tipc: Left network mode [ 931.543464][T27445] chnl_net:caif_netlink_parms(): no params data found [ 931.923783][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.930775][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 931.992304][T27445] bridge0: port 1(bridge_slave_0) entered blocking state [ 932.009068][T27445] bridge0: port 1(bridge_slave_0) entered disabled state [ 932.021938][T27445] bridge_slave_0: entered allmulticast mode [ 932.038839][T27445] bridge_slave_0: entered promiscuous mode [ 932.092071][T27445] bridge0: port 2(bridge_slave_1) entered blocking state [ 932.109696][T27445] bridge0: port 2(bridge_slave_1) entered disabled state [ 932.120108][T27445] bridge_slave_1: entered allmulticast mode [ 932.144202][T27445] bridge_slave_1: entered promiscuous mode [ 932.206739][ T5905] usb 5-1: new high-speed USB device number 122 using dummy_hcd [ 932.380863][T27445] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 932.464468][ T67] batadv0: left promiscuous mode [ 932.505659][ T5905] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 932.526680][ T5905] usb 5-1: New USB device found, idVendor=1241, idProduct=5015, bcdDevice= 0.00 [ 932.538655][ T67] team_slave_0: left promiscuous mode [ 932.545291][ T67] team_slave_1: left promiscuous mode [ 932.553399][ T5905] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 932.562115][ T67] veth1_macvtap: left promiscuous mode [ 932.562212][ T67] veth0_macvtap: left promiscuous mode [ 932.562653][ T67] veth1_vlan: left promiscuous mode [ 932.596901][ T67] veth0_vlan: left promiscuous mode [ 932.618742][ T5905] usb 5-1: config 0 descriptor?? [ 932.786853][ T5151] Bluetooth: hci4: command tx timeout [ 933.149938][ T5905] holtek 0003:1241:5015.0075: hidraw0: USB HID v0.00 Device [HID 1241:5015] on usb-dummy_hcd.4-1/input0 [ 933.195655][ T5905] holtek 0003:1241:5015.0075: no inputs found [ 933.826594][ T30] kauditd_printk_skb: 1466 callbacks suppressed [ 933.826617][ T30] audit: type=1804 audit(1768515487.553:2178): pid=27544 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.8.9074" name="file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="ramfs" ino=135703 res=1 errno=0 [ 934.293741][T19131] usb 5-1: USB disconnect, device number 122 [ 934.688711][ T67] team0 (unregistering): Port device team_slave_1 removed [ 934.793935][ T67] team0 (unregistering): Port device team_slave_0 removed [ 934.823546][ T5929] usb 6-1: new high-speed USB device number 48 using dummy_hcd [ 934.866852][ T5151] Bluetooth: hci4: command tx timeout [ 934.899632][T27565] loop7: detected capacity change from 0 to 7 [ 934.919343][ T6040] Dev loop7: unable to read RDB block 7 [ 934.937994][ T6040] loop7: AHDI p3 p4 [ 934.956924][ T6040] loop7: partition table partially beyond EOD, truncated [ 934.964205][ T6040] loop7: p3 start 1886353253 is beyond EOD, truncated [ 934.989060][T27565] Dev loop7: unable to read RDB block 7 [ 934.996910][T27565] loop7: AHDI p3 p4 [ 935.002404][T27565] loop7: partition table partially beyond EOD, truncated [ 935.006770][ T5929] usb 6-1: Using ep0 maxpacket: 16 [ 935.010372][T27565] loop7: p3 start 1886353253 is beyond EOD, truncated [ 935.024614][ T5929] usb 6-1: config 0 has an invalid interface number: 105 but max is 0 [ 935.056676][ T5929] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 935.072001][ T5929] usb 6-1: config 0 has no interface number 0 [ 935.098943][ T5929] usb 6-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 935.111617][ T5929] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 935.130029][ T5929] usb 6-1: Product: syz [ 935.134345][ T5929] usb 6-1: Manufacturer: syz [ 935.150923][ T5929] usb 6-1: SerialNumber: syz [ 935.176415][ T5929] usb 6-1: config 0 descriptor?? [ 935.189014][ T5929] uvcvideo 6-1:0.105: Found UVC 0.00 device syz (046d:08f3) [ 935.213903][ T5929] uvcvideo 6-1:0.105: No valid video chain found. [ 935.483414][T19131] usb 6-1: USB disconnect, device number 48 [ 935.827097][ T5905] usb 5-1: new high-speed USB device number 123 using dummy_hcd [ 936.017548][ T5905] usb 5-1: too many configurations: 9, using maximum allowed: 8 [ 936.027675][ T5905] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 936.037304][ T5905] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 936.062179][ T5905] usb 5-1: config 0 interface 0 has no altsetting 0 [ 936.076320][ T5905] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 936.089715][ T5905] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 936.103471][ T5905] usb 5-1: config 0 interface 0 has no altsetting 0 [ 936.112155][ T5905] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 936.122428][ T5905] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 936.129017][T27445] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 936.134317][ T5905] usb 5-1: config 0 interface 0 has no altsetting 0 [ 936.159409][ T5905] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 936.170162][ T5905] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 936.182510][ T5905] usb 5-1: config 0 interface 0 has no altsetting 0 [ 936.191075][ T5905] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 936.213550][ T5905] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 936.238163][ T5905] usb 5-1: config 0 interface 0 has no altsetting 0 [ 936.240423][T27445] team0: Port device team_slave_0 added [ 936.273038][T27445] team0: Port device team_slave_1 added [ 936.280862][ T5905] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 936.315731][ T5905] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 936.366786][ T5905] usb 5-1: config 0 interface 0 has no altsetting 0 [ 936.369005][T27584] netlink: 212368 bytes leftover after parsing attributes in process `syz.8.9093'. [ 936.374786][ T5905] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 936.396344][ T5905] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 936.432688][ T5905] usb 5-1: config 0 interface 0 has no altsetting 0 [ 936.432714][T27445] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 936.432733][T27445] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 936.460348][ T5905] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 936.504198][ T5905] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 936.534922][T27445] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 936.578610][T27445] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 936.614386][ T5905] usb 5-1: config 0 interface 0 has no altsetting 0 [ 936.632480][T27445] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 936.652126][ T5905] usb 5-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 936.684635][ T5905] usb 5-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 936.691095][T27445] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 936.705904][ T5905] usb 5-1: Product: syz [ 936.713551][ T5905] usb 5-1: Manufacturer: syz [ 936.718883][ T5905] usb 5-1: SerialNumber: syz [ 936.727284][ T5905] usb 5-1: config 0 descriptor?? [ 936.782050][ T5905] yurex 5-1:0.0: USB YUREX device now attached to Yurex #0 [ 936.809830][ T5929] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 936.845635][ T67] IPVS: stop unused estimator thread 0... [ 936.958630][ T5151] Bluetooth: hci4: command tx timeout [ 936.969538][ T5929] usb 9-1: config index 0 descriptor too short (expected 23569, got 27) [ 937.014010][ T5929] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 937.049412][ T5929] usb 9-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 937.075638][T27445] hsr_slave_0: entered promiscuous mode [ 937.087021][ T5929] usb 9-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 937.095270][ T5929] usb 9-1: Manufacturer: syz [ 937.128554][T27445] hsr_slave_1: entered promiscuous mode [ 937.164780][ T5929] usb 9-1: config 0 descriptor?? [ 937.343527][ T5929] rc_core: IR keymap rc-hauppauge not found [ 937.381735][ T5929] Registered IR keymap rc-empty [ 937.428023][ T5929] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/rc/rc0 [ 937.459714][ T5929] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/rc/rc0/input133 [ 937.501985][ C0] igorplugusb 9-1:0.0: Error: urb status = -32 [ 937.524271][ T5929] usb 9-1: USB disconnect, device number 7 [ 938.114377][T27623] netlink: 8 bytes leftover after parsing attributes in process `syz.7.9103'. [ 938.129747][T27445] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 938.164057][T27445] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 938.194786][T27445] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 938.309558][T27445] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 938.482618][T27636] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 938.705723][ T5827] usb 5-1: USB disconnect, device number 123 [ 938.725107][ T5827] yurex 5-1:0.0: USB YUREX #0 now disconnected [ 938.885738][T27445] 8021q: adding VLAN 0 to HW filter on device bond0 [ 939.295269][T27445] 8021q: adding VLAN 0 to HW filter on device team0 [ 939.367203][ T3564] bridge0: port 1(bridge_slave_0) entered blocking state [ 939.374863][ T3564] bridge0: port 1(bridge_slave_0) entered forwarding state [ 939.453093][ T3564] bridge0: port 2(bridge_slave_1) entered blocking state [ 939.461105][ T3564] bridge0: port 2(bridge_slave_1) entered forwarding state [ 939.904257][T27445] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 940.074436][T27445] veth0_vlan: entered promiscuous mode [ 940.092584][T27445] veth1_vlan: entered promiscuous mode [ 940.191794][T27445] veth0_macvtap: entered promiscuous mode [ 940.217133][T27445] veth1_macvtap: entered promiscuous mode [ 940.306482][T27445] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 940.393641][T27445] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 940.482728][ T36] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 940.517349][ T36] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 940.590132][ T36] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 940.642249][ T36] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 940.835035][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 940.876712][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 940.918359][ T3773] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 940.936125][ T3773] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 942.524620][T27737] netlink: 'syz.7.9137': attribute type 1 has an invalid length. [ 943.067177][T20767] usb 5-1: new high-speed USB device number 124 using dummy_hcd [ 943.096923][T24120] usb 6-1: new full-speed USB device number 49 using dummy_hcd [ 943.236707][T20767] usb 5-1: Using ep0 maxpacket: 32 [ 943.244338][T20767] usb 5-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 943.255779][T20767] usb 5-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 943.272685][T20767] usb 5-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 943.287818][T20767] usb 5-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 943.307388][T24120] usb 6-1: unable to get BOS descriptor or descriptor too short [ 943.309744][T20767] usb 5-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 943.329598][T20767] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 943.335563][T24120] usb 6-1: no configurations [ 943.347571][T20767] usb 5-1: Product: syz [ 943.351962][T20767] usb 5-1: Manufacturer: syz [ 943.352755][T24120] usb 6-1: can't read configurations, error -22 [ 943.367149][T20767] usb 5-1: SerialNumber: syz [ 943.388709][ C0] imon 5-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 943.402752][T20767] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/input/input134 [ 943.417182][ T5923] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 943.529062][T27755] input: syz0 as /devices/virtual/input/input136 [ 943.579909][ T5923] usb 10-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 943.605691][ T5923] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 943.647928][ T5923] usb 10-1: config 0 descriptor?? [ 943.664098][ T5923] cp210x 10-1:0.0: cp210x converter detected [ 943.726956][T20767] imon 5-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 943.735739][T20767] (id 0x00) [ 943.834193][T20767] rc_core: IR keymap rc-imon-pad not found [ 943.854749][T20767] Registered IR keymap rc-empty [ 943.879358][T20767] imon 5-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 943.924238][T20767] imon 5-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 943.969214][T20767] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/rc/rc0 [ 943.976173][T27764] Invalid argument reading file caps for ./file0 [ 943.986118][T20767] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/rc/rc0/input135 [ 944.074556][T20767] imon 5-1:155.0: iMON device (15c2:ffdc, intf0) on usb<5:124> initialized [ 944.084971][ T5923] cp210x 10-1:0.0: failed to get vendor val 0x0010 size 3: -32 [ 944.117323][ T5923] usb 10-1: cp210x converter now attached to ttyUSB0 [ 944.310342][ T5923] usb 10-1: USB disconnect, device number 2 [ 944.331773][ T5923] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 944.389578][ T5923] cp210x 10-1:0.0: device disconnected [ 944.701879][ T5923] usb 5-1: USB disconnect, device number 124 [ 944.988399][T27791] kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 945.177094][ T5923] usb 6-1: new high-speed USB device number 51 using dummy_hcd [ 945.360223][ T5923] usb 6-1: New USB device found, idVendor=1e7d, idProduct=3264, bcdDevice= 0.00 [ 945.383179][ T5923] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 945.411324][ T5923] usb 6-1: config 0 descriptor?? [ 945.640215][ T5923] usbhid 6-1:0.0: can't add hid device: -71 [ 945.646982][ T5923] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 945.658711][ T5923] usb 6-1: USB disconnect, device number 51 [ 946.929460][T27840] input: syz0 as /devices/virtual/input/input137 [ 947.267052][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 947.374508][T27860] netlink: 28 bytes leftover after parsing attributes in process `syz.9.9185'. [ 947.404553][T27860] netlink: 'syz.9.9185': attribute type 7 has an invalid length. [ 947.447188][T27860] netlink: 'syz.9.9185': attribute type 8 has an invalid length. [ 947.455126][T27860] netlink: 4 bytes leftover after parsing attributes in process `syz.9.9185'. [ 948.956754][ T5827] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 948.962920][ T5827] Bluetooth: hci0: Error when powering off device on rfkill (-110) [ 951.026720][ T5827] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 951.026772][ T5151] Bluetooth: hci1: command 0x0c1a tx timeout [ 951.032862][ T5827] Bluetooth: hci1: Error when powering off device on rfkill (-110) [ 953.106800][ T5151] Bluetooth: hci4: command 0x0c1a tx timeout [ 953.113035][ T5827] Bluetooth: hci4: Opcode 0x0c1a failed: -110 [ 953.119290][ T5827] Bluetooth: hci4: Error when powering off device on rfkill (-110) [ 956.686742][T24120] usb 6-1: new high-speed USB device number 52 using dummy_hcd [ 956.862143][T24120] usb 6-1: config 0 has no interfaces? [ 956.877236][T24120] usb 6-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 956.899488][T24120] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 956.952764][T24120] usb 6-1: Product: syz [ 956.993619][T24120] usb 6-1: Manufacturer: syz [ 957.005959][T24120] usb 6-1: SerialNumber: syz [ 957.024273][T24120] usb 6-1: config 0 descriptor?? [ 957.027465][T28029] netlink: 212348 bytes leftover after parsing attributes in process `syz.7.9233'. [ 957.056786][T28029] netlink: Unknown conntrack attr (0) [ 957.306141][T28035] input: syz1 as /devices/virtual/input/input138 [ 957.612006][T28013] A link change request failed with some changes committed already. Interface vlan0 may have been left with an inconsistent configuration, please check. [ 957.667517][T24120] usb 6-1: USB disconnect, device number 52 [ 958.733327][T28077] pim6reg1: entered promiscuous mode [ 958.757173][T28077] pim6reg1: entered allmulticast mode [ 958.876750][T24120] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 959.041796][T24120] usb 10-1: Using ep0 maxpacket: 32 [ 959.071668][T24120] usb 10-1: config 1 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 48, changing to 9 [ 959.120289][T24120] usb 10-1: config 1 interface 0 has no altsetting 0 [ 959.150071][T24120] usb 10-1: New USB device found, idVendor=05ac, idProduct=030a, bcdDevice= 0.40 [ 959.170251][T24120] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 959.191046][T24120] usb 10-1: Product: syz [ 959.195372][T24120] usb 10-1: Manufacturer: syz [ 959.200881][T24120] usb 10-1: SerialNumber: syz [ 959.587557][ T5827] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 959.628410][T28072] netlink: 'syz.9.9250': attribute type 2 has an invalid length. [ 959.648740][T28072] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 959.701716][T24120] input: appletouch as /devices/platform/dummy_hcd.9/usb10/10-1/10-1:1.0/input/input139 [ 959.750147][ T5827] usb 9-1: config 0 has no interfaces? [ 959.753670][T24120] usb 10-1: USB disconnect, device number 3 [ 959.767780][ T5827] usb 9-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 959.779721][ T5827] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 959.790168][ T5827] usb 9-1: Product: syz [ 959.794919][ T5827] usb 9-1: Manufacturer: syz [ 959.800626][ T5827] usb 9-1: SerialNumber: syz [ 959.811404][ T5827] usb 9-1: config 0 descriptor?? [ 959.817577][T28111] netlink: 'syz.7.9263': attribute type 11 has an invalid length. [ 959.837157][T28111] netlink: 8 bytes leftover after parsing attributes in process `syz.7.9263'. [ 959.867005][T24120] appletouch 10-1:1.0: input: appletouch disconnected [ 960.080450][T28118] netlink: 4 bytes leftover after parsing attributes in process `syz.5.9267'. [ 960.090791][T28118] netlink: 'syz.5.9267': attribute type 14 has an invalid length. [ 960.201489][T28096] A link change request failed with some changes committed already. Interface vlan0 may have been left with an inconsistent configuration, please check. [ 960.232841][ T5827] usb 9-1: USB disconnect, device number 8 [ 961.326749][T20767] usb 6-1: new high-speed USB device number 53 using dummy_hcd [ 961.489321][T20767] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 961.508413][T20767] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 961.520199][T20767] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 961.534680][T20767] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 961.545168][T20767] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 961.564424][T20767] usb 6-1: config 0 descriptor?? [ 962.038850][T20767] plantronics 0003:047F:FFFF.0076: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 962.099686][T28161] netlink: 8 bytes leftover after parsing attributes in process `syz.8.9281'. [ 962.466273][T28172] netlink: 'syz.8.9285': attribute type 1 has an invalid length. [ 962.576082][T28172] 8021q: adding VLAN 0 to HW filter on device bond1 [ 962.628870][T28174] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 962.641727][T28174] bond1: (slave batadv1): making interface the new active one [ 962.655515][T28174] bond1: (slave batadv1): Enslaving as an active interface with an up link [ 963.236754][T28197] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9293'. [ 963.550233][T28206] netlink: 'syz.7.9298': attribute type 1 has an invalid length. [ 963.581422][T28206] 8021q: adding VLAN 0 to HW filter on device bond1 [ 963.615134][T28206] bond1: (slave geneve2): making interface the new active one [ 963.624538][T28206] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 963.634118][T17066] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 963.657609][T17066] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 963.668802][T17066] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 963.679711][T17066] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 964.038485][ T5923] usb 6-1: USB disconnect, device number 53 [ 965.917058][T28266] kvm: user requested TSC rate below hardware speed [ 966.228167][T20962] usb 9-1: new high-speed USB device number 9 using dummy_hcd [ 966.389112][T20962] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 966.402792][T20962] usb 9-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 966.412881][T20962] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 966.423794][T20962] usb 9-1: config 0 descriptor?? [ 967.046882][T20962] usb 9-1: language id specifier not provided by device, defaulting to English [ 967.246367][T20962] letsketch 0003:6161:4D15.0077: Device info: Њ [ 967.447791][T20962] letsketch 0003:6161:4D15.0077: Device info: 劸 [ 967.486689][ T5905] usb 5-1: new high-speed USB device number 125 using dummy_hcd [ 967.565259][T28302] netlink: 8 bytes leftover after parsing attributes in process `syz.9.9337'. [ 967.576511][T28302] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 967.602181][T28302] bridge0: port 2(bridge_slave_1) entered disabled state [ 967.612669][T28302] bridge0: port 1(bridge_slave_0) entered disabled state [ 967.646652][ T5905] usb 5-1: Using ep0 maxpacket: 8 [ 967.664242][ T5905] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 967.679413][ T5905] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 967.705189][ T5905] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 967.716433][T20962] usb 9-1: Max retries (5) exceeded reading string descriptor 202 [ 967.736794][ T5905] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 967.748307][T20962] letsketch 0003:6161:4D15.0077: probe with driver letsketch failed with error -71 [ 967.762019][ T5905] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 967.775684][T20962] usb 9-1: USB disconnect, device number 9 [ 967.783606][ T5905] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 967.797129][ T5905] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 968.128499][ T5905] usb 5-1: GET_CAPABILITIES returned 0 [ 968.134746][ T5905] usbtmc 5-1:16.0: can't read capabilities [ 968.726048][T20767] usb 5-1: USB disconnect, device number 125 [ 968.842179][T28293] usbtmc 5-1:16.0: usb_control_msg returned -71 [ 969.455695][T28323] usbtmc 5-1:16.0: usb_control_msg returned -19 [ 969.550870][T28355] netlink: 4 bytes leftover after parsing attributes in process `syz.5.9361'. [ 969.575034][T28355] netlink: 4 bytes leftover after parsing attributes in process `syz.5.9361'. [ 969.591408][T28355] netlink: 104 bytes leftover after parsing attributes in process `syz.5.9361'. [ 969.601893][T28355] netlink: 104 bytes leftover after parsing attributes in process `syz.5.9361'. [ 969.841824][T28364] can-isotp: isotp_sendmsg: can_send_ret -ENETDOWN [ 970.194509][T28372] netlink: 36 bytes leftover after parsing attributes in process `syz.9.9368'. [ 970.559072][T28389] netlink: 4 bytes leftover after parsing attributes in process `syz.7.9374'. [ 970.586683][T28389] netlink: 'syz.7.9374': attribute type 11 has an invalid length. [ 970.610760][T28389] netlink: 'syz.7.9374': attribute type 14 has an invalid length. [ 971.291499][T28389] vxlan0: entered promiscuous mode [ 971.312049][ T49] netdevsim netdevsim7 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 971.323319][ T49] netdevsim netdevsim7 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 971.359308][ T49] netdevsim netdevsim7 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 971.398249][ T49] netdevsim netdevsim7 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 971.698104][T28429] netlink: 'syz.5.9391': attribute type 1 has an invalid length. [ 971.752626][T28429] 8021q: adding VLAN 0 to HW filter on device bond1 [ 971.798253][T28436] bond1: (slave geneve2): making interface the new active one [ 971.847391][T28436] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 971.887099][ T6162] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 972.065033][ T6162] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 972.108629][ T6162] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 972.162659][ T6162] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 972.919885][ T30] audit: type=1326 audit(1768515526.653:2179): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28474 comm="syz.4.9404" exe="/root/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf70ad539 code=0x0 [ 973.497330][T20962] usb 9-1: new high-speed USB device number 10 using dummy_hcd [ 973.666721][T20962] usb 9-1: Using ep0 maxpacket: 16 [ 973.698713][T20962] usb 9-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=9c.15 [ 973.727140][T20962] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 973.740905][T20962] usb 9-1: Product: syz [ 973.745521][T20962] usb 9-1: Manufacturer: syz [ 973.756298][T20962] usb 9-1: SerialNumber: syz [ 973.779463][T20962] usb 9-1: config 0 descriptor?? [ 973.788388][T20962] ssu100 9-1:0.0: Quatech SSU-100 USB to Serial Driver converter detected [ 974.996981][T20962] ssu100 9-1:0.0: probe with driver ssu100 failed with error -71 [ 975.023574][T20962] usb 9-1: USB disconnect, device number 10 [ 975.057702][ T5827] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 975.095472][T28534] netlink: 20 bytes leftover after parsing attributes in process `syz.5.9436'. [ 975.233233][ T5827] usb 10-1: config 0 has no interfaces? [ 975.242948][ T5827] usb 10-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 975.282089][ T5827] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 975.303037][ T5827] usb 10-1: config 0 descriptor?? [ 975.567863][ T5827] usb 10-1: USB disconnect, device number 4 [ 975.712869][T28556] netlink: 212368 bytes leftover after parsing attributes in process `syz.8.9446'. [ 975.936762][ T5827] usb 6-1: new high-speed USB device number 54 using dummy_hcd [ 976.106667][ T5827] usb 6-1: Using ep0 maxpacket: 16 [ 976.118407][ T5827] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 976.150350][ T5827] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 976.182879][ T5827] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 976.222967][ T5827] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 976.253488][ T5827] usb 6-1: Product: syz [ 976.261414][ T5827] usb 6-1: Manufacturer: syz [ 976.271317][ T5827] usb 6-1: SerialNumber: syz [ 976.503933][ T5827] usb 6-1: 0:2 : does not exist [ 976.523400][ T5827] usb 6-1: 5:0: failed to get current value for ch 0 (-22) [ 976.616974][ T5827] usb 6-1: USB disconnect, device number 54 [ 976.728071][ T6040] udevd[6040]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 978.036627][ T5827] usb 9-1: new high-speed USB device number 11 using dummy_hcd [ 978.210700][ T5827] usb 9-1: Using ep0 maxpacket: 16 [ 978.230720][ T5827] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 978.256603][ T5827] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 978.288383][ T5827] usb 9-1: config 0 interface 0 has no altsetting 0 [ 978.295549][ T5827] usb 9-1: New USB device found, idVendor=060b, idProduct=500a, bcdDevice= 0.00 [ 978.351649][ T5827] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 978.397390][ T5827] usb 9-1: config 0 descriptor?? [ 978.656684][T20962] usb 6-1: new high-speed USB device number 55 using dummy_hcd [ 978.836804][T20962] usb 6-1: Using ep0 maxpacket: 32 [ 978.852680][ T5827] cougar 0003:060B:500A.0078: unexpected long global item [ 978.869283][ T5827] cougar 0003:060B:500A.0078: parse failed [ 978.870723][T20962] usb 6-1: New USB device found, idVendor=06a2, idProduct=0003, bcdDevice=b4.8c [ 978.875422][ T5827] cougar 0003:060B:500A.0078: probe with driver cougar failed with error -22 [ 978.926060][T20962] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 978.959762][T20962] usb 6-1: Product: syz [ 978.964132][T20962] usb 6-1: Manufacturer: syz [ 978.990147][T20962] usb 6-1: SerialNumber: syz [ 979.008456][T20962] usb 6-1: config 0 descriptor?? [ 979.032929][T20962] gspca_main: gspca_topro-2.14.0 probing 06a2:0003 [ 979.063441][ T5827] usb 9-1: USB disconnect, device number 11 [ 980.271268][T20962] gspca_topro: reg_w err -71 [ 980.298059][T20962] gspca_topro: Sensor soi763a [ 980.343433][T20962] usb 6-1: USB disconnect, device number 55 [ 980.356733][ T5905] usb 9-1: new low-speed USB device number 12 using dummy_hcd [ 980.543669][ T5905] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 980.560138][ T5905] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 980.587082][ T5905] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 980.626950][ T5905] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 980.652054][ T5905] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 980.673696][ T5905] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 980.682468][ T5905] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 980.699871][ T5905] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 980.708325][T28682] netlink: 'syz.9.9502': attribute type 3 has an invalid length. [ 980.713128][ T5905] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 980.721421][T28682] netlink: 136 bytes leftover after parsing attributes in process `syz.9.9502'. [ 980.733245][ T5905] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 980.754950][ T5905] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 980.763004][ T5905] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 980.776373][ T5905] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 980.789341][ T5905] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 980.801571][ T5905] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 980.819031][ T5905] usb 9-1: string descriptor 0 read error: -22 [ 980.825802][ T5905] usb 9-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 980.837811][ T5905] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 980.908010][ T5905] adutux 9-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 981.246786][ T5905] usb 9-1: USB disconnect, device number 12 [ 981.253652][T28696] usb 9-1: Couldn't submit interrupt_out_urb -19 [ 982.058833][T28726] netlink: 4 bytes leftover after parsing attributes in process `syz.8.9519'. [ 982.192058][T28730] netlink: 4 bytes leftover after parsing attributes in process `syz.5.9521'. [ 982.209689][T28730] netlink: 4 bytes leftover after parsing attributes in process `syz.5.9521'. [ 982.234097][T28730] netlink: 4 bytes leftover after parsing attributes in process `syz.5.9521'. [ 982.277440][T28735] input: syz1 as /devices/virtual/input/input140 [ 982.450374][T28738] netlink: 4 bytes leftover after parsing attributes in process `syz.5.9524'. [ 982.462349][T28740] netlink: 44 bytes leftover after parsing attributes in process `syz.7.9526'. [ 982.486711][T28738] netlink: 4 bytes leftover after parsing attributes in process `syz.5.9524'. [ 982.507169][T28740] netlink: 'syz.7.9526': attribute type 6 has an invalid length. [ 982.514942][T28740] netlink: 'syz.7.9526': attribute type 5 has an invalid length. [ 982.534544][T28740] netlink: 'syz.7.9526': attribute type 4 has an invalid length. [ 982.556634][T28744] input: syz0 as /devices/virtual/input/input141 [ 982.563310][T28744] input: failed to attach handler leds to device input141, error: -6 [ 983.170385][T28765] input: syz1 as /devices/virtual/input/input142 [ 983.502657][T28779] input: syz0 as /devices/virtual/input/input143 [ 983.850021][T28791] vivid-001: disconnect [ 983.863254][T28791] vivid-001: reconnect [ 983.925183][T28793] netlink: 'syz.9.9549': attribute type 12 has an invalid length. [ 983.944772][T28793] netlink: 'syz.9.9549': attribute type 29 has an invalid length. [ 983.963559][T28793] netlink: 148 bytes leftover after parsing attributes in process `syz.9.9549'. [ 984.387218][ T5827] usb 5-1: new high-speed USB device number 126 using dummy_hcd [ 984.686712][ T5827] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 984.717000][ T5905] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 984.725528][ T5827] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 984.756265][ T5827] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 984.792157][ T5827] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 984.824542][T28818] netlink: 12 bytes leftover after parsing attributes in process `syz.7.9560'. [ 984.834083][ T5827] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 984.837373][ T5827] usb 5-1: config 0 descriptor?? [ 984.866155][T28818] netlink: 'syz.7.9560': attribute type 18 has an invalid length. [ 984.906411][ T5905] usb 10-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 984.926055][ T5905] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 984.940912][ T5905] usb 10-1: Product: syz [ 984.956392][ T5905] usb 10-1: Manufacturer: syz [ 984.962091][ T5905] usb 10-1: SerialNumber: syz [ 984.982702][ T5905] usb 10-1: config 0 descriptor?? [ 985.273789][ T5905] usb 10-1: USB disconnect, device number 5 [ 985.451876][ T5827] plantronics 0003:047F:FFFF.0079: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 986.936697][ T5827] usb 5-1: reset high-speed USB device number 126 using dummy_hcd [ 987.160733][T28861] netlink: 8 bytes leftover after parsing attributes in process `syz.8.9578'. [ 987.570838][T28868] pim6reg1: entered promiscuous mode [ 987.596708][T28868] pim6reg1: entered allmulticast mode [ 987.730102][T20767] usb 5-1: USB disconnect, device number 126 [ 987.924600][T28874] veth1_vlan (unregistering): left allmulticast mode [ 988.114953][T20767] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 988.278023][T20767] usb 10-1: Using ep0 maxpacket: 16 [ 988.308709][T20767] usb 10-1: config 0 has an invalid interface number: 98 but max is 0 [ 988.324555][T20767] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 988.358224][T20767] usb 10-1: config 0 has no interface number 0 [ 988.371648][T20767] usb 10-1: config 0 interface 98 altsetting 2 bulk endpoint 0x8 has invalid maxpacket 16 [ 988.390481][T20767] usb 10-1: config 0 interface 98 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 988.401835][T20767] usb 10-1: config 0 interface 98 has no altsetting 0 [ 988.412287][T20767] usb 10-1: New USB device found, idVendor=0846, idProduct=1040, bcdDevice=d0.c9 [ 988.423521][T20767] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 988.433458][T20767] usb 10-1: Product: syz [ 988.438329][T20767] usb 10-1: Manufacturer: syz [ 988.444538][T20767] usb 10-1: SerialNumber: syz [ 988.464921][T20767] usb 10-1: config 0 descriptor?? [ 988.477726][T28878] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 988.490309][T28878] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 988.719905][T28878] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 988.743158][T28878] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 988.847859][T28895] input: syz1 as /devices/virtual/input/input145 [ 989.814870][T20767] asix 10-1:0.98 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 989.832384][T20767] asix 10-1:0.98: probe with driver asix failed with error -71 [ 989.851062][T20767] usb 10-1: USB disconnect, device number 6 [ 990.115465][T28932] 8021q: adding VLAN 0 to HW filter on device bond0 [ 990.124121][T28932] 8021q: adding VLAN 0 to HW filter on device team0 [ 990.134570][T28932] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 990.526011][T19131] IPVS: starting estimator thread 0... [ 990.636648][T28943] IPVS: using max 25 ests per chain, 60000 per kthread [ 991.870097][T20767] usb 6-1: new high-speed USB device number 56 using dummy_hcd [ 992.039520][T20767] usb 6-1: New USB device found, idVendor=8086, idProduct=0110, bcdDevice=bf.ad [ 992.056954][T20767] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 992.081089][T20767] usb 6-1: config 0 descriptor?? [ 992.103958][T20767] gspca_main: spca508-2.14.0 probing 8086:0110 [ 992.308363][T20767] gspca_spca508: reg_read err -32 [ 992.320634][T20767] gspca_spca508: reg_read err -32 [ 992.337806][T20767] gspca_spca508: reg_read err -32 [ 992.354481][T20767] gspca_spca508: reg_read err -32 [ 992.571795][T20767] gspca_spca508: reg write: error -71 [ 992.597196][T20767] spca508 6-1:0.0: probe with driver spca508 failed with error -71 [ 992.634176][T20767] usb 6-1: USB disconnect, device number 56 [ 993.365836][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 993.372917][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 993.646759][T29014] netlink: 4 bytes leftover after parsing attributes in process `syz.9.9637'. [ 993.666308][T29014] bridge_slave_1: left allmulticast mode [ 993.706304][T29014] bridge_slave_1: left promiscuous mode [ 993.720691][T29014] bridge0: port 2(bridge_slave_1) entered disabled state [ 993.780527][T29014] bridge_slave_0: left allmulticast mode [ 993.794508][T29014] bridge_slave_0: left promiscuous mode [ 993.809158][T29014] bridge0: port 1(bridge_slave_0) entered disabled state [ 994.479741][T29030] netlink: 24 bytes leftover after parsing attributes in process `syz.8.9644'. [ 994.817175][ T5827] usb 6-1: new high-speed USB device number 57 using dummy_hcd [ 994.968237][ T5827] usb 6-1: Using ep0 maxpacket: 32 [ 994.991799][ T5827] usb 6-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 995.002765][ T5827] usb 6-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 995.028208][ T5827] usb 6-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 995.040985][ T5827] usb 6-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 995.068051][ T5827] usb 6-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 995.083427][ T30] audit: type=1326 audit(1768515548.813:2180): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29048 comm="syz.8.9652" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf706d539 code=0x0 [ 995.083657][ T5827] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 995.122457][ T5827] usb 6-1: Product: syz [ 995.127130][ T5827] usb 6-1: Manufacturer: syz [ 995.131975][ T5827] usb 6-1: SerialNumber: syz [ 995.161206][ C0] imon 6-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 995.177957][ T5827] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:155.0/input/input146 [ 995.386945][ T5827] imon 6-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 995.395698][ T5827] (id 0x00) [ 995.506611][ T5827] rc_core: IR keymap rc-imon-pad not found [ 995.513075][ T5827] Registered IR keymap rc-empty [ 995.528208][ T5827] imon 6-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 995.546195][ T5827] imon 6-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 995.580647][ T5827] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:155.0/rc/rc0 [ 995.601059][ T5827] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:155.0/rc/rc0/input147 [ 995.618423][ T5827] imon 6-1:155.0: iMON device (15c2:ffdc, intf0) on usb<6:57> initialized [ 995.989323][T29034] imon:vfd_write: invalid payload size [ 996.018872][ T5827] usb 6-1: USB disconnect, device number 57 [ 996.348671][T29072] netlink: 212348 bytes leftover after parsing attributes in process `syz.9.9662'. [ 996.359724][T29072] netlink: Conntrack attr has 3 unknown bytes [ 996.645861][T29079] netlink: 8 bytes leftover after parsing attributes in process `syz.7.9665'. [ 996.968513][ T5827] usb 5-1: new high-speed USB device number 127 using dummy_hcd [ 997.166236][ T5827] usb 5-1: config 1 has an invalid interface number: 7 but max is 0 [ 997.177032][ T5827] usb 5-1: config 1 has no interface number 0 [ 997.183624][ T5827] usb 5-1: config 1 interface 7 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1024 [ 997.196921][ T5827] usb 5-1: config 1 interface 7 altsetting 0 has a duplicate endpoint with address 0x6, skipping [ 997.568357][ T5827] usb 5-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 997.616602][ T5827] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 997.626221][ T5827] usb 5-1: Product: syz [ 997.656900][ T5827] usb 5-1: Manufacturer: syz [ 997.661654][ T5827] usb 5-1: SerialNumber: syz [ 997.876785][T29077] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 997.929084][T29077] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 998.106845][T29117] netlink: 4 bytes leftover after parsing attributes in process `syz.5.9680'. [ 998.227033][ T5827] usb 5-1: Expected 3 endpoints, found: 2 [ 999.853725][ T5827] usb 5-1: USB disconnect, device number 127 [ 1000.166797][ T5898] usb 10-1: new high-speed USB device number 7 using dummy_hcd [ 1000.328893][ T5898] usb 10-1: config 0 has too many interfaces: 204, using maximum allowed: 32 [ 1000.338254][ T5898] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 204 [ 1000.347908][ T5898] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1000.366597][ T5898] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1000.382262][ T5898] usb 10-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1000.422300][ T5898] usb 10-1: New USB device found, idVendor=28bd, idProduct=0909, bcdDevice= 0.00 [ 1000.445357][ T5898] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1000.457480][ T5898] usb 10-1: config 0 descriptor?? [ 1000.907395][ T5898] input: HID 28bd:0909 as /devices/platform/dummy_hcd.9/usb10/10-1/10-1:0.0/0003:28BD:0909.007A/input/input148 [ 1001.015607][ T5898] uclogic 0003:28BD:0909.007A: input,hidraw0: USB HID v0.00 Mouse [HID 28bd:0909] on usb-dummy_hcd.9-1/input0 [ 1001.229433][ T5905] usb 10-1: USB disconnect, device number 7 [ 1001.376734][T20962] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 1001.526715][T20962] usb 9-1: Using ep0 maxpacket: 32 [ 1001.535327][T20962] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1001.549365][T20962] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1001.561161][T20962] usb 9-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1001.571683][T20962] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1001.584880][T20962] usb 9-1: config 0 descriptor?? [ 1001.596910][T20962] hub 9-1:0.0: USB hub found [ 1001.801063][T20962] hub 9-1:0.0: 1 port detected [ 1002.461612][ T5905] hub 9-1:0.0: activate --> -90 [ 1002.860196][ T5898] usb 9-1: USB disconnect, device number 13 [ 1004.484011][ T5905] usb 6-1: new high-speed USB device number 58 using dummy_hcd [ 1004.680024][ T5905] usb 6-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 1004.714251][ T5905] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1004.733161][ T5905] usb 6-1: Product: syz [ 1004.753466][ T5905] usb 6-1: Manufacturer: syz [ 1004.761417][ T5905] usb 6-1: SerialNumber: syz [ 1004.787348][ T5905] usb 6-1: config 0 descriptor?? [ 1004.937110][T20962] usb 10-1: new high-speed USB device number 8 using dummy_hcd [ 1005.116765][T20962] usb 10-1: Using ep0 maxpacket: 16 [ 1005.125473][T20962] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1005.137682][T20962] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1005.150716][T20962] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1005.162868][T20962] usb 10-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1005.174246][T20962] usb 10-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1005.191067][T20962] usb 10-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1005.201500][T20962] usb 10-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1005.210445][T20962] usb 10-1: Manufacturer: syz [ 1005.220176][T20962] usb 10-1: config 0 descriptor?? [ 1005.260100][ T5905] usb 6-1: Firmware: major: 122, minor: 42, hardware type: UNKNOWN (66) [ 1005.346967][ T5898] usb 9-1: new full-speed USB device number 14 using dummy_hcd [ 1005.472774][ T5905] usb 6-1: Read permanent extended address e6:cb:90:21:d6:84:5f:43 from device [ 1005.483288][ T5905] usb 6-1: atusb_probe: initialization failed, error = -524 [ 1005.493098][ T5905] atusb 6-1:0.0: probe with driver atusb failed with error -524 [ 1005.535313][ T5898] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1005.558850][ T5898] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1005.576684][T20962] rc_core: IR keymap rc-hauppauge not found [ 1005.582989][T20962] Registered IR keymap rc-empty [ 1005.593015][ T5898] usb 9-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1005.596776][T20962] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 1005.605877][ T5898] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1005.625265][ T5898] usb 9-1: Product: syz [ 1005.630216][ T5898] usb 9-1: Manufacturer: syz [ 1005.640999][ T5898] usb 9-1: SerialNumber: syz [ 1005.646776][T20962] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 1005.686738][T20962] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.9/usb10/10-1/10-1:0.0/rc/rc0 [ 1005.707068][ T5905] usb 6-1: USB disconnect, device number 58 [ 1005.729328][T20962] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.9/usb10/10-1/10-1:0.0/rc/rc0/input149 [ 1005.767499][T20962] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 1005.807062][T20962] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 1005.827459][T20962] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 1005.847140][T20962] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 1005.874752][ T5898] usb 9-1: 0:2 : does not exist [ 1005.886966][T20962] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 1005.887061][ T5898] usb 9-1: 5:0: failed to get current value for ch 0 (-22) [ 1005.916765][T20962] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 1005.937026][T20962] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 1005.966897][T20962] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 1005.966968][ T5898] usb 9-1: USB disconnect, device number 14 [ 1005.997055][T20962] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 1006.044197][ T6040] udevd[6040]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1006.067127][T20962] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 1006.119821][T20962] mceusb 10-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 1006.156639][T20962] mceusb 10-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1006.763869][ T5898] usb 10-1: USB disconnect, device number 8 [ 1007.176673][ T5898] usb 10-1: new full-speed USB device number 9 using dummy_hcd [ 1007.354002][ T5898] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1007.387975][ T5898] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1007.447380][ T5898] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1007.466254][ T5898] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1007.509504][T29316] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1007.519835][T29316] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1007.637051][T20962] usb 6-1: new high-speed USB device number 59 using dummy_hcd [ 1007.700605][ T5898] usb 10-1: usb_control_msg returned -32 [ 1007.711666][ T5898] usbtmc 10-1:16.0: can't read capabilities [ 1007.798421][T20962] usb 6-1: Using ep0 maxpacket: 16 [ 1007.805857][T20962] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1007.818576][T20962] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1007.831079][T20962] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1007.842056][T20962] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1007.852062][T20962] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1007.870784][T20962] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1007.880282][T20962] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1007.888715][T20962] usb 6-1: Manufacturer: syz [ 1007.896086][T20962] usb 6-1: config 0 descriptor?? [ 1008.036756][ T5905] usb 9-1: new high-speed USB device number 15 using dummy_hcd [ 1008.156795][T20962] rc_core: IR keymap rc-hauppauge not found [ 1008.163039][T20962] Registered IR keymap rc-empty [ 1008.169339][T20962] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1008.191251][ T5905] usb 9-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 1008.201494][T20962] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1008.209163][ T5905] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1008.217758][ T5905] usb 9-1: Product: syz [ 1008.221965][ T5905] usb 9-1: Manufacturer: syz [ 1008.226958][ T5905] usb 9-1: SerialNumber: syz [ 1008.233893][ T5905] usb 9-1: config 0 descriptor?? [ 1008.242946][T20962] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 1008.259576][ T5905] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 1008.270169][T20962] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input150 [ 1008.285943][T20962] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1008.307030][T20962] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1008.329238][T20962] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1008.356986][T20962] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1008.377005][T20962] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1008.396875][T20962] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1008.418278][T20962] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1008.437629][T20962] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1008.456793][T20962] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1008.476788][T20962] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1008.498868][T20962] mceusb 6-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 1008.508963][T20962] mceusb 6-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1008.623796][ T5898] usb 6-1: USB disconnect, device number 59 [ 1009.477278][ T5905] gspca_sunplus: reg_r err -71 [ 1009.483712][ T5905] sunplus 9-1:0.0: probe with driver sunplus failed with error -71 [ 1009.505265][ T5905] usb 9-1: USB disconnect, device number 15 [ 1009.970872][ T5905] usb 10-1: USB disconnect, device number 9 [ 1010.658643][ T5905] usb 9-1: new high-speed USB device number 16 using dummy_hcd [ 1010.706055][T29380] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9785'. [ 1010.721427][T29380] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9785'. [ 1010.732883][T29380] netlink: 104 bytes leftover after parsing attributes in process `syz.4.9785'. [ 1010.743105][T29380] netlink: 104 bytes leftover after parsing attributes in process `syz.4.9785'. [ 1010.816731][ T5905] usb 9-1: Using ep0 maxpacket: 8 [ 1010.823898][ T5905] usb 9-1: config 150 has an invalid interface number: 204 but max is 1 [ 1010.833306][ T5905] usb 9-1: config 150 has no interface number 0 [ 1010.839833][ T5905] usb 9-1: config 150 interface 204 has no altsetting 0 [ 1010.849934][ T5905] usb 9-1: config 150 interface 1 has no altsetting 0 [ 1010.862124][ T5905] usb 9-1: New USB device found, idVendor=04e2, idProduct=1424, bcdDevice=c7.eb [ 1010.871624][ T5905] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1010.879799][ T5905] usb 9-1: Product: syz [ 1010.884114][ T5905] usb 9-1: Manufacturer: syz [ 1010.889631][ T5905] usb 9-1: SerialNumber: syz [ 1010.966172][T29386] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9788'. [ 1010.984878][T29386] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9788'. [ 1011.018034][T29386] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9788'. [ 1011.120927][ T5905] xr_serial 9-1:150.204: xr_serial converter detected [ 1011.134658][T29388] netlink: 'syz.5.9789': attribute type 13 has an invalid length. [ 1011.247437][ T5898] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 1011.941315][ T5905] usb 9-1: xr_serial converter now attached to ttyUSB0 [ 1012.004496][T29411] netlink: 212368 bytes leftover after parsing attributes in process `syz.5.9799'. [ 1012.147125][ T5898] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 1012.181412][ T5898] usb 9-1: USB disconnect, device number 16 [ 1012.193083][ T5898] xr_serial ttyUSB0: xr_serial converter now disconnected from ttyUSB0 [ 1012.206399][ T5898] xr_serial 9-1:150.204: device disconnected [ 1012.478321][T29426] netdevsim netdevsim5 netdevsim0: entered allmulticast mode [ 1013.102875][ T30] audit: type=1326 audit(1768515566.833:2181): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29445 comm="syz.8.9815" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf706d539 code=0x0 [ 1013.272767][T29453] netlink: 'syz.7.9818': attribute type 13 has an invalid length. [ 1013.636802][ T5905] usb 6-1: new high-speed USB device number 60 using dummy_hcd [ 1013.801937][ T5905] usb 6-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 1013.812231][ T5905] usb 6-1: New USB device strings: Mfr=241, Product=2, SerialNumber=3 [ 1013.821610][ T5905] usb 6-1: Product: syz [ 1013.826300][ T5905] usb 6-1: Manufacturer: syz [ 1013.833804][ T5905] usb 6-1: SerialNumber: syz [ 1013.845633][ T5905] usb 6-1: config 0 descriptor?? [ 1013.869993][ T5905] ch341 6-1:0.0: ch341-uart converter detected [ 1014.112137][T29466] netlink: 'syz.8.9823': attribute type 4 has an invalid length. [ 1014.129519][T29466] netlink: 'syz.8.9823': attribute type 4 has an invalid length. [ 1014.253371][T29468] netlink: 'syz.8.9824': attribute type 9 has an invalid length. [ 1014.261843][T29468] netlink: 'syz.8.9824': attribute type 11 has an invalid length. [ 1014.270552][T29468] netlink: 'syz.8.9824': attribute type 12 has an invalid length. [ 1014.278676][T29468] netlink: 210020 bytes leftover after parsing attributes in process `syz.8.9824'. [ 1014.290421][T29468] netlink: 4 bytes leftover after parsing attributes in process `syz.8.9824'. [ 1014.885335][ T5905] ch341-uart ttyUSB0: break control not supported, using simulated break [ 1014.900422][ T5905] usb 6-1: ch341-uart converter now attached to ttyUSB0 [ 1014.918292][ T5905] usb 6-1: USB disconnect, device number 60 [ 1014.939619][ T5905] ch341-uart ttyUSB0: ch341-uart converter now disconnected from ttyUSB0 [ 1014.961345][ T5905] ch341 6-1:0.0: device disconnected [ 1014.986996][T20767] usb 9-1: new full-speed USB device number 17 using dummy_hcd [ 1015.036290][T29483] netlink: 'syz.9.9831': attribute type 13 has an invalid length. [ 1015.159074][T20767] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1015.175140][T20767] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1015.192166][T20767] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1015.205651][T20767] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1015.259805][T29489] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(3) [ 1015.267883][T29489] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1015.280300][T29489] vhci_hcd vhci_hcd.0: Device attached [ 1015.351617][T29490] usbip_core: unknown command [ 1015.366679][T29490] vhci_hcd: unknown pdu 4244635647 [ 1015.372130][T29490] usbip_core: unknown command [ 1015.389137][ T3435] vhci_hcd vhci_hcd.4: stop threads [ 1015.394567][ T3435] vhci_hcd vhci_hcd.4: release socket [ 1015.411845][ T30] audit: type=1326 audit(1768515569.143:2182): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29493 comm="syz.9.9834" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f54539 code=0x0 [ 1015.444138][ T3435] vhci_hcd vhci_hcd.4: disconnect device [ 1015.447424][T20767] usb 9-1: usb_control_msg returned -32 [ 1015.458391][T20767] usbtmc 9-1:16.0: can't read capabilities [ 1015.856809][T20767] usb 6-1: new high-speed USB device number 61 using dummy_hcd [ 1016.008641][T20767] usb 6-1: config 0 has no interfaces? [ 1016.020191][T20767] usb 6-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 1016.029915][T20767] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1016.038423][T20767] usb 6-1: Product: syz [ 1016.042736][T20767] usb 6-1: Manufacturer: syz [ 1016.047519][T20767] usb 6-1: SerialNumber: syz [ 1016.054768][T20767] usb 6-1: config 0 descriptor?? [ 1016.342848][ T5898] usb 6-1: USB disconnect, device number 61 [ 1016.826692][ T5827] usb 10-1: new high-speed USB device number 10 using dummy_hcd [ 1016.987969][ T5827] usb 10-1: Using ep0 maxpacket: 8 [ 1017.019387][ T5827] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1017.075631][ T5827] usb 10-1: config 0 has no interfaces? [ 1017.138892][ T5827] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1017.173598][ T5827] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1017.222435][ T5827] usb 10-1: config 0 descriptor?? [ 1017.518205][ T5827] usb 10-1: USB disconnect, device number 10 [ 1017.780758][ T5827] usb 9-1: USB disconnect, device number 17 [ 1018.365235][T29525] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer. [ 1018.946783][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 1019.619654][ T30] audit: type=1326 audit(1768515573.353:2183): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29577 comm="syz.9.9869" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f54539 code=0x0 [ 1020.181513][T29593] loop2: detected capacity change from 0 to 7 [ 1020.191691][ T6040] Dev loop2: unable to read RDB block 7 [ 1020.198538][ T6040] loop2: AHDI p1 p2 p3 [ 1020.203136][ T6040] loop2: partition table partially beyond EOD, truncated [ 1020.211533][ T6040] loop2: p1 start 1601398130 is beyond EOD, truncated [ 1020.219160][ T6040] loop2: p2 start 1702059890 is beyond EOD, truncated [ 1020.232775][T29593] Dev loop2: unable to read RDB block 7 [ 1020.239681][T29593] loop2: AHDI p1 p2 p3 [ 1020.244232][T29593] loop2: partition table partially beyond EOD, truncated [ 1020.254152][T29593] loop2: p1 start 1601398130 is beyond EOD, truncated [ 1020.261870][T29593] loop2: p2 start 1702059890 is beyond EOD, truncated [ 1021.058287][ T30] audit: type=1804 audit(1768515574.793:2184): pid=29615 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.8.9884" name="file1" dev="ramfs" ino=148525 res=1 errno=0 [ 1021.171488][T29618] input: syz0 as /devices/virtual/input/input151 [ 1021.871202][T29643] netlink: 8 bytes leftover after parsing attributes in process `syz.8.9893'. [ 1021.900801][T29643] netlink: 8 bytes leftover after parsing attributes in process `syz.8.9893'. [ 1023.175249][T29673] netlink: 12 bytes leftover after parsing attributes in process `syz.8.9904'. [ 1023.600717][T29679] vhci_hcd vhci_hcd.0: pdev(8) rhport(0) sockfd(3) [ 1023.607606][T29679] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1023.671180][T29679] vhci_hcd vhci_hcd.0: Device attached [ 1023.745430][T29680] usbip_core: unknown command [ 1023.758688][T29680] vhci_hcd: unknown pdu 4244635647 [ 1023.770611][T29680] usbip_core: unknown command [ 1023.786955][ T67] vhci_hcd vhci_hcd.8: stop threads [ 1023.816589][ T67] vhci_hcd vhci_hcd.8: release socket [ 1023.825407][ T67] vhci_hcd vhci_hcd.8: disconnect device [ 1023.856985][T20767] vhci_hcd vhci_hcd.8: vhci_device speed not set [ 1024.218124][T29694] loop3: detected capacity change from 0 to 16384 [ 1024.308227][ C1] blk_print_req_error: 25 callbacks suppressed [ 1024.308252][ C1] I/O error, dev loop3, sector 15472 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 1024.325827][ C1] I/O error, dev loop3, sector 15472 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1024.336033][ C1] buffer_io_error: 129 callbacks suppressed [ 1024.336055][ C1] Buffer I/O error on dev loop3, logical block 1934, async page read [ 1024.356763][ C1] I/O error, dev loop3, sector 3328 op 0x0:(READ) flags 0x80700 phys_seg 2 prio class 2 [ 1024.367723][ C1] I/O error, dev loop3, sector 3584 op 0x0:(READ) flags 0x80700 phys_seg 2 prio class 2 [ 1024.383144][ C1] I/O error, dev loop3, sector 3328 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1024.393507][ C1] Buffer I/O error on dev loop3, logical block 416, async page read [ 1024.402114][ C1] I/O error, dev loop3, sector 3336 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1024.412488][ C1] Buffer I/O error on dev loop3, logical block 417, async page read [ 1024.421615][ C1] I/O error, dev loop3, sector 3344 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1024.432063][ C1] Buffer I/O error on dev loop3, logical block 418, async page read [ 1024.440566][ C1] I/O error, dev loop3, sector 3352 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1024.450646][ C1] Buffer I/O error on dev loop3, logical block 419, async page read [ 1024.459867][ C1] I/O error, dev loop3, sector 3360 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1024.470400][ C1] Buffer I/O error on dev loop3, logical block 420, async page read [ 1024.479567][ C1] I/O error, dev loop3, sector 3368 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1024.490079][ C1] Buffer I/O error on dev loop3, logical block 421, async page read [ 1024.498907][ C1] Buffer I/O error on dev loop3, logical block 422, async page read [ 1024.508022][ C1] Buffer I/O error on dev loop3, logical block 423, async page read [ 1024.517055][ C1] Buffer I/O error on dev loop3, logical block 424, async page read [ 1026.869574][ T5905] hid-generic 0000:0000:0000.007B: unknown main item tag 0x0 [ 1026.908922][ T5905] hid-generic 0000:0000:0000.007B: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1027.381787][T29739] bond1: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1027.399438][ T30] audit: type=1326 audit(1768515581.133:2185): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29741 comm="syz.7.9931" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7fd4539 code=0x0 [ 1027.465900][T29739] bond1: (slave lo): Enslaving as a backup interface with an up link [ 1027.638891][T29739] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 1027.796898][ T795] usb 9-1: new high-speed USB device number 18 using dummy_hcd [ 1027.881421][T29749] netlink: 'syz.9.9934': attribute type 1 has an invalid length. [ 1027.919148][T29749] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1027.962358][T29749] bond2: (slave geneve2): making interface the new active one [ 1027.970107][ T795] usb 9-1: Using ep0 maxpacket: 16 [ 1027.978033][T29749] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 1027.996903][ T795] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1028.007648][ T795] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1028.030503][ T795] usb 9-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1028.040277][ T795] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1028.048808][ T795] usb 9-1: Product: syz [ 1028.053203][ T795] usb 9-1: Manufacturer: syz [ 1028.058155][ T795] usb 9-1: SerialNumber: syz [ 1028.295207][ T795] usb 9-1: 0:2 : does not exist [ 1028.325785][ T795] usb 9-1: 5:0: failed to get current value for ch 0 (-22) [ 1028.384432][ T795] usb 9-1: USB disconnect, device number 18 [ 1028.481282][ T6040] udevd[6040]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1029.788859][T29811] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9958'. [ 1029.799669][T29811] netlink: 'syz.4.9958': attribute type 12 has an invalid length. [ 1029.811257][T29811] netlink: 'syz.4.9958': attribute type 6 has an invalid length. [ 1029.838596][T29817] netlink: 1347 bytes leftover after parsing attributes in process `syz.5.9961'. [ 1030.116669][ T795] usb 10-1: new high-speed USB device number 11 using dummy_hcd [ 1030.266661][ T795] usb 10-1: Using ep0 maxpacket: 16 [ 1030.277248][ T795] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1030.288959][ T795] usb 10-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1030.314022][ T795] usb 10-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1030.325508][ T795] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1030.337098][ T795] usb 10-1: Product: syz [ 1030.341506][ T795] usb 10-1: Manufacturer: syz [ 1030.347423][ T795] usb 10-1: SerialNumber: syz [ 1030.361274][ T795] usb 10-1: config 0 descriptor?? [ 1030.946684][ T795] usb 9-1: new high-speed USB device number 19 using dummy_hcd [ 1031.096702][ T795] usb 9-1: Using ep0 maxpacket: 8 [ 1031.105460][ T795] usb 9-1: config index 0 descriptor too short (expected 301, got 45) [ 1031.122668][ T795] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1031.140072][ T795] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1031.155387][ T795] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1031.169765][ T795] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1031.184306][ T795] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1031.194612][ T795] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1031.416793][ T795] usb 9-1: usb_control_msg returned -32 [ 1031.423324][ T795] usbtmc 9-1:16.0: can't read capabilities [ 1031.729511][ T30] audit: type=1326 audit(1768515585.463:2186): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29854 comm="syz.4.9976" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf70ad539 code=0x0 [ 1032.064962][T29862] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 1032.074975][T29862] block device autoloading is deprecated and will be removed. [ 1032.189158][T29863] usbtmc 9-1:16.0: usb_control_msg returned -32 [ 1032.334403][ T5827] usb 9-1: USB disconnect, device number 19 [ 1032.929277][ T5827] usb 10-1: USB disconnect, device number 11 [ 1033.368906][T29898] dvmrp5: entered allmulticast mode [ 1033.427863][T29898] syz_tun: entered allmulticast mode [ 1033.465117][T29898] dvmrp5: left allmulticast mode [ 1033.709893][T29906] netlink: 'syz.7.9998': attribute type 11 has an invalid length. [ 1033.842312][T29897] syz_tun: left allmulticast mode [ 1033.967170][T29913] netlink: 4 bytes leftover after parsing attributes in process `syz.5.10001'. [ 1034.446691][ T5898] usb 10-1: new high-speed USB device number 12 using dummy_hcd [ 1034.462625][ T30] audit: type=1326 audit(1768515588.193:2187): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29929 comm="syz.8.10008" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf706d539 code=0x0 [ 1034.596862][ T5898] usb 10-1: Using ep0 maxpacket: 32 [ 1034.605376][ T5898] usb 10-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 1034.616874][ T5898] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1034.638920][ T5898] usb 10-1: config 0 descriptor?? [ 1034.659269][ T5898] as10x_usb: device has been detected [ 1034.671500][ T5898] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 1034.700269][ T5898] usb 10-1: DVB: registering adapter 2 frontend 0 (nBox DVB-T Dongle)... [ 1034.757457][ T5898] as10x_usb: error during firmware upload part1 [ 1034.764673][ T5898] Registered device nBox DVB-T Dongle [ 1034.879149][ T5898] usb 10-1: USB disconnect, device number 12 [ 1034.967154][ T5898] Unregistered device nBox DVB-T Dongle [ 1034.969139][ T5898] as10x_usb: device has been disconnected [ 1036.807316][ T795] usb 6-1: new full-speed USB device number 62 using dummy_hcd [ 1036.998859][ T795] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 1037.016794][ T795] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 7 [ 1037.053339][ T795] usb 6-1: New USB device found, idVendor=0eef, idProduct=72c4, bcdDevice= 0.00 [ 1037.062954][ T795] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1037.084808][ T795] usb 6-1: config 0 descriptor?? [ 1037.101768][T29987] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1037.333933][ T795] usbhid 6-1:0.0: can't add hid device: -71 [ 1037.354171][ T795] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1037.391879][ T795] usb 6-1: USB disconnect, device number 62 [ 1037.876772][ T795] usb 6-1: new high-speed USB device number 63 using dummy_hcd [ 1037.984508][T30023] ALSA: seq fatal error: cannot create timer (-16) [ 1038.036667][ T795] usb 6-1: Using ep0 maxpacket: 32 [ 1038.088249][ T795] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 7 [ 1038.126611][ T795] usb 6-1: New USB device found, idVendor=0eef, idProduct=72c4, bcdDevice= 0.00 [ 1038.157454][ T795] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1038.187433][ T795] usb 6-1: config 0 descriptor?? [ 1038.574014][ T1086] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1038.629141][ T1086] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1038.640256][ T795] hid-multitouch 0003:0EEF:72C4.007C: unknown main item tag 0x0 [ 1038.659173][ T1086] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 51358 - 0 [ 1038.690606][ T795] hid-multitouch 0003:0EEF:72C4.007C: hidraw0: USB HID v0.00 Device [HID 0eef:72c4] on usb-dummy_hcd.5-1/input0 [ 1038.899367][ T795] usb 6-1: USB disconnect, device number 63 [ 1038.944236][ T1086] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1038.958661][T30033] fido_id[30033]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/6-1/report_descriptor': No such file or directory [ 1038.996999][ T1086] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1039.047745][ T1086] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 51358 - 0 [ 1039.320950][ T1086] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1039.357058][ T1086] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1039.377013][ T1086] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 51358 - 0 [ 1039.422525][T18759] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1039.439032][T18759] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1039.450159][T18759] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1039.461777][T18759] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1039.470517][T18759] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1039.527811][ T5151] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1039.554583][ T5151] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1039.563204][ T5151] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1039.571982][ T5151] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1039.600715][ T5151] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1039.743456][ T1086] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1039.766677][ T1086] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1039.796591][ T1086] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 51358 - 0 [ 1040.327085][ T5923] usb 9-1: new high-speed USB device number 20 using dummy_hcd [ 1040.382132][ T1086] macsec0: left allmulticast mode [ 1040.397015][ T1086] veth1_macvtap: left allmulticast mode [ 1040.413141][ T1086] macsec0: left promiscuous mode [ 1040.425705][ T1086] bridge0: port 3(macsec0) entered disabled state [ 1040.453749][ T1086] bridge_slave_1: left allmulticast mode [ 1040.466368][ T1086] bridge_slave_1: left promiscuous mode [ 1040.479192][ T1086] bridge0: port 2(bridge_slave_1) entered disabled state [ 1040.487123][ T5923] usb 9-1: Using ep0 maxpacket: 16 [ 1040.495163][ T5923] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1040.510308][ T1086] bridge_slave_0: left allmulticast mode [ 1040.520544][ T5923] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1040.526099][ T1086] bridge0: port 1(bridge_slave_0) entered disabled state [ 1040.539694][ T5923] usb 9-1: New USB device found, idVendor=0853, idProduct=0148, bcdDevice= 0.00 [ 1040.562201][ T5923] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1040.584575][ T5923] usb 9-1: config 0 descriptor?? [ 1041.053291][ T5923] topre 0003:0853:0148.007D: unknown main item tag 0x0 [ 1041.063559][ T5923] topre 0003:0853:0148.007D: unknown main item tag 0x0 [ 1041.072738][ T5923] topre 0003:0853:0148.007D: unknown main item tag 0x0 [ 1041.080646][ T5923] topre 0003:0853:0148.007D: unknown main item tag 0x0 [ 1041.090389][ T5923] topre 0003:0853:0148.007D: unknown main item tag 0x0 [ 1041.098124][ T5923] topre 0003:0853:0148.007D: unknown main item tag 0x0 [ 1041.105684][ T5923] topre 0003:0853:0148.007D: unknown main item tag 0x0 [ 1041.119550][ T5923] topre 0003:0853:0148.007D: unknown main item tag 0x0 [ 1041.127294][ T5923] topre 0003:0853:0148.007D: unknown main item tag 0x0 [ 1041.140851][ T5923] topre 0003:0853:0148.007D: hidraw0: USB HID v0.49 Device [HID 0853:0148] on usb-dummy_hcd.8-1/input0 [ 1041.373094][T20962] usb 9-1: USB disconnect, device number 20 [ 1041.556434][T30080] netlink: 4 bytes leftover after parsing attributes in process `syz.7.10069'. [ 1041.588556][T30080] netlink: 4 bytes leftover after parsing attributes in process `syz.7.10069'. [ 1041.602129][ T1086] batman_adv: batadv0: Removing interface: macvlan3 [ 1041.627541][T30080] netlink: 4 bytes leftover after parsing attributes in process `syz.7.10069'. [ 1041.644314][ T1086] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1041.666769][T18759] Bluetooth: hci3: command tx timeout [ 1041.688925][ T1086] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1041.710179][ T1086] bond0 (unregistering): (slave bond3): Releasing backup interface [ 1041.727168][T30082] input: syz1 as /devices/virtual/input/input152 [ 1041.736002][ T1086] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 1041.783667][ T1086] bond0 (unregistering): Released all slaves [ 1041.841574][ T1086] bond1 (unregistering): Released all slaves [ 1041.893418][ T1086] bond2 (unregistering): Released all slaves [ 1042.443037][ T1086] bond3 (unregistering): Released all slaves [ 1043.064027][T30111] netlink: 8 bytes leftover after parsing attributes in process `syz.9.10081'. [ 1043.290259][ T1086] hsr0: left allmulticast mode [ 1043.301288][ T1086] veth1_macvtap: left promiscuous mode [ 1043.325496][ T1086] veth0_macvtap: left promiscuous mode [ 1043.747032][T18759] Bluetooth: hci3: command tx timeout [ 1043.884560][T30122] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 1044.471347][ T1086] team0 (unregistering): Port device team_slave_0 removed [ 1044.926316][T30148] netlink: 4 bytes leftover after parsing attributes in process `syz.5.10095'. [ 1044.966155][T30148] netlink: 'syz.5.10095': attribute type 13 has an invalid length. [ 1045.246786][T30042] chnl_net:caif_netlink_parms(): no params data found [ 1045.539201][T30042] bridge0: port 1(bridge_slave_0) entered blocking state [ 1045.547848][T30042] bridge0: port 1(bridge_slave_0) entered disabled state [ 1045.555544][T30042] bridge_slave_0: entered allmulticast mode [ 1045.563858][T30042] bridge_slave_0: entered promiscuous mode [ 1045.578581][T30042] bridge0: port 2(bridge_slave_1) entered blocking state [ 1045.611741][T30042] bridge0: port 2(bridge_slave_1) entered disabled state [ 1045.619747][T30042] bridge_slave_1: entered allmulticast mode [ 1045.628393][T30042] bridge_slave_1: entered promiscuous mode [ 1045.752051][T30042] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1045.801761][ T1086] IPVS: stop unused estimator thread 0... [ 1045.812153][T30042] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1045.826986][T18759] Bluetooth: hci3: command tx timeout [ 1046.048066][T30042] team0: Port device team_slave_0 added [ 1046.078839][T30042] team0: Port device team_slave_1 added [ 1046.467631][T30042] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1046.517382][T30042] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1046.587896][T30042] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1046.610504][T30042] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1046.631742][T30042] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1046.670514][T30188] netlink: 'syz.5.10106': attribute type 10 has an invalid length. [ 1046.686656][T30042] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1046.760556][T30188] bond0: (slave wlan1): Enslaving as an active interface with a down link [ 1046.978566][T30042] hsr_slave_0: entered promiscuous mode [ 1046.990266][T30042] hsr_slave_1: entered promiscuous mode [ 1047.021803][T30042] debugfs: 'hsr0' already exists in 'hsr' [ 1047.047092][T30042] Cannot create hsr debugfs directory [ 1047.906689][T18759] Bluetooth: hci3: command tx timeout [ 1049.075081][T30251] netlink: 212348 bytes leftover after parsing attributes in process `syz.9.10124'. [ 1049.763218][T30042] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1049.822600][T30042] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1049.872200][T30042] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1049.906251][T30042] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1050.073442][T30288] input: syz0 as /devices/virtual/input/input153 [ 1050.424764][T30042] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1050.498368][T30042] 8021q: adding VLAN 0 to HW filter on device team0 [ 1050.539638][ T67] bridge0: port 1(bridge_slave_0) entered blocking state [ 1050.547692][ T67] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1050.600388][ T67] bridge0: port 2(bridge_slave_1) entered blocking state [ 1050.608466][ T67] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1050.830551][T30042] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1051.012488][T30042] veth0_vlan: entered promiscuous mode [ 1051.062395][T30042] veth1_vlan: entered promiscuous mode [ 1051.208352][T30042] veth0_macvtap: entered promiscuous mode [ 1051.260695][T30042] veth1_macvtap: entered promiscuous mode [ 1051.358589][T30042] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1051.408404][T30042] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1051.462861][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1051.486843][ T1086] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1051.528777][ T1086] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1051.575559][ T1086] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1051.883843][ T67] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1051.930842][ T67] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1052.084588][ T67] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1052.135917][ T67] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1054.266855][ T5923] usb 10-1: new high-speed USB device number 13 using dummy_hcd [ 1054.456705][ T5923] usb 10-1: Using ep0 maxpacket: 8 [ 1054.507630][ T5923] usb 10-1: config 0 interface 0 altsetting 6 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1054.598391][ T5923] usb 10-1: config 0 interface 0 altsetting 6 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1054.635003][ T5923] usb 10-1: config 0 interface 0 has no altsetting 0 [ 1054.688479][ T5923] usb 10-1: New USB device found, idVendor=0b43, idProduct=0003, bcdDevice= 0.00 [ 1054.740392][ T5923] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1054.793487][ T5923] usb 10-1: config 0 descriptor?? [ 1054.803559][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 1054.817012][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1055.008046][T20962] usb 9-1: new high-speed USB device number 21 using dummy_hcd [ 1055.070845][ T5923] usbhid 10-1:0.0: can't add hid device: -71 [ 1055.108644][ T5923] usbhid 10-1:0.0: probe with driver usbhid failed with error -71 [ 1055.177681][ T5923] usb 10-1: USB disconnect, device number 13 [ 1055.226667][T20962] usb 9-1: Using ep0 maxpacket: 8 [ 1055.257426][T20962] usb 9-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1055.298416][T20962] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1055.373538][T20962] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1055.406606][T20962] pvrusb2: ********** [ 1055.411008][T20962] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1055.442757][T20962] pvrusb2: Important functionality might not be entirely working. [ 1055.473225][T20962] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1055.515949][T20962] pvrusb2: ********** [ 1055.560970][ T2345] pvrusb2: Invalid write control endpoint [ 1055.749311][ T2345] pvrusb2: Invalid write control endpoint [ 1055.770603][ T2345] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1055.775119][T20962] usb 9-1: USB disconnect, device number 21 [ 1055.809497][ T2345] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1055.837941][ T2345] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1055.877172][ T2345] pvrusb2: Device being rendered inoperable [ 1055.892014][ T2345] cx25840 2-0044: Unable to detect h/w, assuming cx23887 [ 1055.928918][ T2345] cx25840 2-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_c) [ 1055.955526][ T2345] pvrusb2: Attached sub-driver cx25840 [ 1055.984906][ T2345] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1056.006859][ T2345] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1056.467809][ T5923] usb 10-1: new high-speed USB device number 14 using dummy_hcd [ 1056.669934][ T5923] usb 10-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 1056.702642][ T5923] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1056.749681][ T5923] usb 10-1: config 0 descriptor?? [ 1057.077313][T24114] usb 9-1: new high-speed USB device number 22 using dummy_hcd [ 1057.251244][T24114] usb 9-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1057.286716][T24114] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1057.296135][T24114] usb 9-1: Product: syz [ 1057.301978][T24114] usb 9-1: Manufacturer: syz [ 1057.308239][T24114] usb 9-1: SerialNumber: syz [ 1057.739904][T24114] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 1057.754145][T24114] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 1057.998028][ T5923] usb 10-1: Cannot set autoneg [ 1058.004918][ T5923] MOSCHIP usb-ethernet driver 10-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 1058.024411][ T5923] usb 10-1: USB disconnect, device number 14 [ 1058.376402][T24114] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000000. ret = -EPROTO [ 1058.401205][T24114] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 1058.414197][T24114] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1058.427589][T24114] lan78xx 9-1:1.0: probe with driver lan78xx failed with error -71 [ 1058.447432][T24114] usb 9-1: USB disconnect, device number 22 [ 1058.657404][T30507] input: syz1 as /devices/virtual/input/input154 [ 1058.896614][ T5827] usb 6-1: new high-speed USB device number 64 using dummy_hcd [ 1059.076591][ T5827] usb 6-1: Using ep0 maxpacket: 8 [ 1059.093583][ T5827] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 1059.136673][ T5827] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1059.188187][ T5827] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1059.226380][ T5827] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1059.258310][ T5827] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1059.306647][ T5827] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1059.336374][ T5827] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1059.563653][ T5827] usb 6-1: usb_control_msg returned -32 [ 1059.596603][ T5827] usbtmc 6-1:16.0: can't read capabilities [ 1060.042363][ T30] audit: type=1326 audit(1768515613.773:2188): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30556 comm="syz.8.10203" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf706d539 code=0x0 [ 1060.136758][ T5827] usb 10-1: new high-speed USB device number 15 using dummy_hcd [ 1060.251341][ T30] audit: type=1326 audit(1768515613.983:2189): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30566 comm="syz.2.10204" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7fa6539 code=0x0 [ 1060.305699][ T5827] usb 10-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1060.331545][ T5827] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1060.333128][T30571] usbtmc 6-1:16.0: usb_control_msg returned -32 [ 1060.356612][ T5827] usb 10-1: Product: syz [ 1060.361251][ T5827] usb 10-1: Manufacturer: syz [ 1060.365978][ T5827] usb 10-1: SerialNumber: syz [ 1060.535138][T20962] usb 6-1: USB disconnect, device number 64 [ 1060.813345][ T5827] lan78xx 10-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 1060.848071][ T5827] lan78xx 10-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 1061.488664][ T5827] lan78xx 10-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000000. ret = -EPROTO [ 1061.518282][ T5827] lan78xx 10-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 1061.546421][ T5827] lan78xx 10-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1061.559031][ T5827] lan78xx 10-1:1.0: probe with driver lan78xx failed with error -71 [ 1061.591115][ T5827] usb 10-1: USB disconnect, device number 15 [ 1062.249535][T30630] netlink: 20 bytes leftover after parsing attributes in process `syz.9.10217'. [ 1062.285252][T30630] netlink: 28 bytes leftover after parsing attributes in process `syz.9.10217'. [ 1062.491150][T30638] kvm: vcpu 5: requested lapic timer restore with starting count register 0x390=2846233827 (22769870616 ns) > initial count (14430147192 ns). Using initial count to start timer. [ 1062.541858][T30645] netlink: 4 bytes leftover after parsing attributes in process `syz.8.10223'. [ 1062.542707][T30638] kvm: apic: phys broadcast and lowest prio [ 1062.556405][T30645] netlink: 4 bytes leftover after parsing attributes in process `syz.8.10223'. [ 1062.558223][T30638] kvm: Disabled LAPIC found during irq injection [ 1062.598301][T30645] netlink: 4 bytes leftover after parsing attributes in process `syz.8.10223'. [ 1063.263688][ T129] hid_parser_main: 155 callbacks suppressed [ 1063.263713][ T129] hid-generic 0002:0004:0009.007E: unknown main item tag 0x0 [ 1063.300031][ T129] hid-generic 0002:0004:0009.007E: unknown main item tag 0x0 [ 1063.310857][ T129] hid-generic 0002:0004:0009.007E: unknown main item tag 0x0 [ 1063.329762][ T129] hid-generic 0002:0004:0009.007E: unknown main item tag 0x0 [ 1063.349807][ T129] hid-generic 0002:0004:0009.007E: unknown main item tag 0x0 [ 1063.372207][ T129] hid-generic 0002:0004:0009.007E: unknown main item tag 0x0 [ 1063.411117][ T129] hid-generic 0002:0004:0009.007E: unknown main item tag 0x0 [ 1063.420748][ T5898] usb 10-1: new high-speed USB device number 16 using dummy_hcd [ 1063.449905][ T129] hid-generic 0002:0004:0009.007E: unknown main item tag 0x0 [ 1063.466601][ T129] hid-generic 0002:0004:0009.007E: unknown main item tag 0x0 [ 1063.487595][ T129] hid-generic 0002:0004:0009.007E: unknown main item tag 0x0 [ 1063.523898][ T129] hid-generic 0002:0004:0009.007E: hidraw0: HID v0.04 Device [syz0] on syz0 [ 1063.589001][ T5898] usb 10-1: Using ep0 maxpacket: 32 [ 1063.629648][ T5898] usb 10-1: config 0 has an invalid interface number: 56 but max is 0 [ 1063.667028][ T5898] usb 10-1: config 0 has no interface number 0 [ 1063.687658][ T5898] usb 10-1: New USB device found, idVendor=06f8, idProduct=301b, bcdDevice=b8.4d [ 1063.724725][ T5898] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1063.736864][T30685] veth1_to_bridge: entered allmulticast mode [ 1063.752095][ T5898] usb 10-1: Product: syz [ 1063.756860][T30685] veth1_to_bridge: left allmulticast mode [ 1063.766820][ T5898] usb 10-1: Manufacturer: syz [ 1063.783301][ T5898] usb 10-1: SerialNumber: syz [ 1063.790722][T30680] fido_id[30680]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 1063.831283][ T5898] usb 10-1: config 0 descriptor?? [ 1063.869943][ T5898] gspca_main: gspca_pac7302-2.14.0 probing 06f8:301b [ 1064.231533][T30703] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10240'. [ 1064.244457][ T129] usb 9-1: new high-speed USB device number 23 using dummy_hcd [ 1064.406680][ T129] usb 9-1: Using ep0 maxpacket: 32 [ 1064.447224][ T129] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1064.479190][ T129] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1064.516702][ T129] usb 9-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1064.536325][ T129] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1064.562113][ T129] usb 9-1: config 0 descriptor?? [ 1064.593117][ T129] hub 9-1:0.0: USB hub found [ 1064.704807][ T5898] input: gspca_pac7302 as /devices/platform/dummy_hcd.9/usb10/10-1/input/input155 [ 1064.823428][ T129] hub 9-1:0.0: 1 port detected [ 1064.959808][ C0] gspca_pac7302 10-1:0.56: URB error -71, resubmitting [ 1064.967254][ C0] gspca_pac7302 10-1:0.56: URB error -71, resubmitting [ 1064.974432][ C0] gspca_pac7302 10-1:0.56: URB error -71, resubmitting [ 1064.981808][ C0] gspca_pac7302 10-1:0.56: URB error -71, resubmitting [ 1064.989361][ C0] gspca_pac7302 10-1:0.56: URB error -71, resubmitting [ 1064.996561][ C0] gspca_pac7302 10-1:0.56: URB error -71, resubmitting [ 1065.003995][ C0] gspca_pac7302 10-1:0.56: URB error -71, resubmitting [ 1065.011592][ C0] gspca_pac7302 10-1:0.56: URB error -71, resubmitting [ 1065.018953][ C0] gspca_pac7302 10-1:0.56: URB error -71, resubmitting [ 1065.026283][ C0] gspca_pac7302 10-1:0.56: URB error -71, resubmitting [ 1065.038806][ C0] gspca_pac7302 10-1:0.56: URB error -71, resubmitting [ 1065.047829][ C0] gspca_pac7302 10-1:0.56: URB error -71, resubmitting [ 1065.055220][ C0] gspca_pac7302 10-1:0.56: URB error -71, resubmitting [ 1065.062519][ C0] gspca_pac7302 10-1:0.56: URB error -71, resubmitting [ 1065.070245][ C0] gspca_pac7302 10-1:0.56: URB error -71, resubmitting [ 1065.077475][ C0] gspca_pac7302 10-1:0.56: URB error -71, resubmitting [ 1065.084765][ C0] gspca_pac7302 10-1:0.56: URB error -71, resubmitting [ 1065.091989][ C0] gspca_pac7302 10-1:0.56: URB error -71, resubmitting [ 1065.099466][ C0] gspca_pac7302 10-1:0.56: URB error -71, resubmitting [ 1065.109534][ C0] gspca_pac7302 10-1:0.56: URB error -71, resubmitting [ 1065.114251][T20962] usb 10-1: USB disconnect, device number 16 [ 1065.116441][ C0] gspca_main: Resubmit URB failed with error -19 [ 1065.491511][ T5923] hub 9-1:0.0: activate --> -90 [ 1065.552356][T30739] netlink: 'syz.7.10245': attribute type 9 has an invalid length. [ 1065.569492][T30739] netlink: 'syz.7.10245': attribute type 11 has an invalid length. [ 1065.579452][T30739] netlink: 'syz.7.10245': attribute type 12 has an invalid length. [ 1065.590954][T30739] netlink: 210020 bytes leftover after parsing attributes in process `syz.7.10245'. [ 1065.602405][T30739] netlink: 4 bytes leftover after parsing attributes in process `syz.7.10245'. [ 1065.894237][ T5923] usb 9-1-port1: config error [ 1065.895249][T20962] usb 9-1: USB disconnect, device number 23 [ 1066.911206][T30788] netlink: 'syz.2.10266': attribute type 1 has an invalid length. [ 1066.964744][T30791] gretap0: entered promiscuous mode [ 1066.992119][T30791] gretap0: left promiscuous mode [ 1067.148001][T30788] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1067.190047][T30793] bond1: (slave geneve2): making interface the new active one [ 1067.201895][T30793] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 1067.239055][T30799] netlink: 8 bytes leftover after parsing attributes in process `syz.8.10269'. [ 1067.289038][T30799] netlink: 8 bytes leftover after parsing attributes in process `syz.8.10269'. [ 1068.153038][T30832] kernel read not supported for file /$@ (pid: 30832 comm: syz.9.10283) [ 1068.175493][ T30] audit: type=1800 audit(1768515621.903:2190): pid=30832 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.9.10283" name="$@" dev="mqueue" ino=154173 res=0 errno=0 [ 1068.532088][ C1] blk_print_req_error: 27 callbacks suppressed [ 1068.532109][ C1] I/O error, dev loop3, sector 16256 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 1068.556035][ C1] I/O error, dev loop3, sector 16256 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1068.566446][ C1] buffer_io_error: 24 callbacks suppressed [ 1068.566461][ C1] Buffer I/O error on dev loop3, logical block 2032, async page read [ 1068.637040][ T5905] usb 6-1: new high-speed USB device number 65 using dummy_hcd [ 1068.787668][ T5905] usb 6-1: Using ep0 maxpacket: 8 [ 1068.802567][ T5905] usb 6-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1068.814242][ T5905] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1068.837520][ T5923] usb 3-1: new high-speed USB device number 73 using dummy_hcd [ 1068.848233][ T5905] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1068.873185][ T5905] pvrusb2: ********** [ 1068.881796][ T5905] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1068.899976][ T5905] pvrusb2: Important functionality might not be entirely working. [ 1068.912989][ T5905] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1068.930154][ T5905] pvrusb2: ********** [ 1069.006941][ T5923] usb 3-1: Using ep0 maxpacket: 32 [ 1069.016466][ T5923] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1069.032496][ T5923] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1069.057171][ T5923] usb 3-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1069.057431][ T2345] pvrusb2: Invalid write control endpoint [ 1069.077680][ T5923] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1069.105104][ T5923] usb 3-1: config 0 descriptor?? [ 1069.210824][ T2345] pvrusb2: Invalid write control endpoint [ 1069.224218][ T2345] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1069.234961][ T2345] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1069.243771][ T2345] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1069.250967][T30873] netlink: 'syz.8.10301': attribute type 9 has an invalid length. [ 1069.263331][T30873] netlink: 'syz.8.10301': attribute type 11 has an invalid length. [ 1069.267098][ T2345] pvrusb2: Device being rendered inoperable [ 1069.282998][T30873] netlink: 'syz.8.10301': attribute type 12 has an invalid length. [ 1069.301850][ T2345] cx25840 2-0044: Unable to detect h/w, assuming cx23887 [ 1069.301890][T30873] netlink: 210020 bytes leftover after parsing attributes in process `syz.8.10301'. [ 1069.317024][ T2345] cx25840 2-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_d) [ 1069.331485][ T129] usb 6-1: USB disconnect, device number 65 [ 1069.361886][T30873] netlink: 4 bytes leftover after parsing attributes in process `syz.8.10301'. [ 1069.376260][ T2345] pvrusb2: Attached sub-driver cx25840 [ 1069.392637][ T2345] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1069.431425][ T2345] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1069.562612][ T5923] hid_parser_main: 7 callbacks suppressed [ 1069.562638][ T5923] ft260 0003:0403:6030.007F: unknown main item tag 0x7 [ 1069.767033][ T5923] ft260 0003:0403:6030.007F: chip code: 6424 8183 [ 1069.841632][T30888] [ 1069.844120][T30888] ===================================================== [ 1069.851251][T30888] WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected [ 1069.859005][T30888] syzkaller #0 Tainted: G L [ 1069.865559][T30888] ----------------------------------------------------- [ 1069.872858][T30888] syz.9.10309/30888 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire: [ 1069.881037][T30888] ffff88807cbc0d38 (&new->fa_lock){...-}-{3:3}, at: kill_fasync+0x199/0x4d0 [ 1069.890076][T30888] [ 1069.890076][T30888] and this task is already holding: [ 1069.897857][T30888] ffff8880571b7028 (&client->buffer_lock){....}-{3:3}, at: evdev_pass_values+0xb9/0xbd0 [ 1069.908168][T30888] which would create a new lock dependency: [ 1069.914870][T30888] (&client->buffer_lock){....}-{3:3} -> (&new->fa_lock){...-}-{3:3} [ 1069.923696][T30888] [ 1069.923696][T30888] but this new dependency connects a SOFTIRQ-irq-safe lock: [ 1069.933325][T30888] (&dev->event_lock#2){..-.}-{3:3} [ 1069.933357][T30888] [ 1069.933357][T30888] ... which became SOFTIRQ-irq-safe at: [ 1069.946959][T30888] lock_acquire+0x107/0x340 [ 1069.951669][T30888] _raw_spin_lock_irqsave+0x40/0x60 [ 1069.957306][T30888] input_event+0x76/0xe0 [ 1069.961823][T30888] atp_complete_geyser_3_4+0xf6d/0x1e80 [ 1069.968078][T30888] __usb_hcd_giveback_urb+0x376/0x540 [ 1069.974185][T30888] dummy_timer+0x85f/0x45b0 [ 1069.979301][T30888] __hrtimer_run_queues+0x51c/0xc30 [ 1069.984952][T30888] hrtimer_run_softirq+0x187/0x2b0 [ 1069.990609][T30888] handle_softirqs+0x22b/0x7c0 [ 1069.995756][T30888] __irq_exit_rcu+0x60/0x150 [ 1070.000624][T30888] irq_exit_rcu+0x9/0x30 [ 1070.005236][T30888] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 1070.011644][T30888] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1070.018368][T30888] _raw_spin_unlock_irqrestore+0x47/0x80 [ 1070.024647][T30888] dummy_urb_enqueue+0x58a/0x780 [ 1070.029970][T30888] usb_hcd_submit_urb+0x328/0x1b80 [ 1070.035447][T30888] atp_open+0x63/0xc0 [ 1070.040139][T30888] input_open_device+0x1d3/0x390 [ 1070.045265][T30888] mousedev_open_device+0xcc/0x150 [ 1070.050565][T30888] mousedev_open+0x2ef/0x4a0 [ 1070.055244][T30888] chrdev_open+0x4cc/0x5e0 [ 1070.060013][T30888] do_dentry_open+0x7ce/0x1420 [ 1070.065136][T30888] vfs_open+0x3b/0x340 [ 1070.069497][T30888] path_openat+0x340e/0x3dd0 [ 1070.074262][T30888] do_filp_open+0x1fa/0x410 [ 1070.079035][T30888] do_sys_openat2+0x121/0x200 [ 1070.083946][T30888] __x64_sys_openat+0x138/0x170 [ 1070.089004][T30888] do_syscall_64+0xec/0xf80 [ 1070.093891][T30888] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1070.099973][T30888] [ 1070.099973][T30888] to a SOFTIRQ-irq-unsafe lock: [ 1070.108388][T30888] (tasklist_lock){.+.+}-{3:3} [ 1070.108416][T30888] [ 1070.108416][T30888] ... which became SOFTIRQ-irq-unsafe at: [ 1070.121946][T30888] ... [ 1070.121956][T30888] lock_acquire+0x107/0x340 [ 1070.129240][T30888] _raw_read_lock+0x36/0x50 [ 1070.133854][T30888] __do_wait+0xde/0x740 [ 1070.138120][T30888] do_wait+0x1e8/0x4f0 [ 1070.142317][T30888] kernel_wait+0xab/0x170 [ 1070.146936][T30888] call_usermodehelper_exec_work+0xbe/0x230 [ 1070.153386][T30888] process_scheduled_works+0xad1/0x1770 [ 1070.159199][T30888] worker_thread+0x8a0/0xda0 [ 1070.164003][T30888] kthread+0x711/0x8a0 [ 1070.168443][T30888] ret_from_fork+0x510/0xa50 [ 1070.173395][T30888] ret_from_fork_asm+0x1a/0x30 [ 1070.178877][T30888] [ 1070.178877][T30888] other info that might help us debug this: [ 1070.178877][T30888] [ 1070.189551][T30888] Chain exists of: [ 1070.189551][T30888] &dev->event_lock#2 --> &client->buffer_lock --> tasklist_lock [ 1070.189551][T30888] [ 1070.203408][T30888] Possible interrupt unsafe locking scenario: [ 1070.203408][T30888] [ 1070.212096][T30888] CPU0 CPU1 [ 1070.217657][T30888] ---- ---- [ 1070.223044][T30888] lock(tasklist_lock); [ 1070.227541][T30888] local_irq_disable(); [ 1070.234385][T30888] lock(&dev->event_lock#2); [ 1070.242119][T30888] lock(&client->buffer_lock); [ 1070.250126][T30888] [ 1070.253674][T30888] lock(&dev->event_lock#2); [ 1070.258713][T30888] [ 1070.258713][T30888] *** DEADLOCK *** [ 1070.258713][T30888] [ 1070.267138][T30888] 7 locks held by syz.9.10309/30888: [ 1070.272785][T30888] #0: ffff88814732c118 (&evdev->mutex){+.+.}-{4:4}, at: evdev_write+0x1a1/0x480 [ 1070.282193][T30888] #1: ffff88801b705230 (&dev->event_lock#2){..-.}-{3:3}, at: input_inject_event+0xa5/0x340 [ 1070.292963][T30888] #2: ffffffff8df41aa0 (rcu_read_lock){....}-{1:3}, at: input_inject_event+0xb6/0x340 [ 1070.303270][T30888] #3: ffffffff8df41aa0 (rcu_read_lock){....}-{1:3}, at: input_pass_values+0x8d/0x890 [ 1070.313118][T30888] #4: ffffffff8df41aa0 (rcu_read_lock){....}-{1:3}, at: evdev_events+0x79/0x340 [ 1070.322564][T30888] #5: ffff8880571b7028 (&client->buffer_lock){....}-{3:3}, at: evdev_pass_values+0xb9/0xbd0 [ 1070.333124][T30888] #6: ffffffff8df41aa0 (rcu_read_lock){....}-{1:3}, at: kill_fasync+0x53/0x4d0 [ 1070.342370][T30888] [ 1070.342370][T30888] the dependencies between SOFTIRQ-irq-safe lock and the holding lock: [ 1070.353591][T30888] -> (&dev->event_lock#2){..-.}-{3:3} { [ 1070.359578][T30888] IN-SOFTIRQ-W at: [ 1070.364009][T30888] lock_acquire+0x107/0x340 [ 1070.370432][T30888] _raw_spin_lock_irqsave+0x40/0x60 [ 1070.377816][T30888] input_event+0x76/0xe0 [ 1070.384076][T30888] atp_complete_geyser_3_4+0xf6d/0x1e80 [ 1070.391654][T30888] __usb_hcd_giveback_urb+0x376/0x540 [ 1070.398895][T30888] dummy_timer+0x85f/0x45b0 [ 1070.405747][T30888] __hrtimer_run_queues+0x51c/0xc30 [ 1070.413887][T30888] hrtimer_run_softirq+0x187/0x2b0 [ 1070.421446][T30888] handle_softirqs+0x22b/0x7c0 [ 1070.428127][T30888] __irq_exit_rcu+0x60/0x150 [ 1070.434817][T30888] irq_exit_rcu+0x9/0x30 [ 1070.441053][T30888] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 1070.448792][T30888] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1070.456614][T30888] _raw_spin_unlock_irqrestore+0x47/0x80 [ 1070.464175][T30888] dummy_urb_enqueue+0x58a/0x780 [ 1070.471049][T30888] usb_hcd_submit_urb+0x328/0x1b80 [ 1070.478178][T30888] atp_open+0x63/0xc0 [ 1070.484257][T30888] input_open_device+0x1d3/0x390 [ 1070.491296][T30888] mousedev_open_device+0xcc/0x150 [ 1070.498236][T30888] mousedev_open+0x2ef/0x4a0 [ 1070.505116][T30888] chrdev_open+0x4cc/0x5e0 [ 1070.511533][T30888] do_dentry_open+0x7ce/0x1420 [ 1070.518223][T30888] vfs_open+0x3b/0x340 [ 1070.524386][T30888] path_openat+0x340e/0x3dd0 [ 1070.531153][T30888] do_filp_open+0x1fa/0x410 [ 1070.537850][T30888] do_sys_openat2+0x121/0x200 [ 1070.544809][T30888] __x64_sys_openat+0x138/0x170 [ 1070.551638][T30888] do_syscall_64+0xec/0xf80 [ 1070.558071][T30888] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1070.565880][T30888] INITIAL USE at: [ 1070.570487][T30888] lock_acquire+0x107/0x340 [ 1070.577003][T30888] _raw_spin_lock_irqsave+0x40/0x60 [ 1070.584130][T30888] input_inject_event+0xa5/0x340 [ 1070.590926][T30888] kbd_led_trigger_activate+0xbc/0x100 [ 1070.598135][T30888] led_trigger_set+0x52d/0x950 [ 1070.604876][T30888] led_trigger_set_default+0x260/0x2a0 [ 1070.612084][T30888] led_classdev_register_ext+0x73d/0x960 [ 1070.619649][T30888] input_leds_connect+0x517/0x790 [ 1070.626434][T30888] input_register_device+0xd00/0x1170 [ 1070.633723][T30888] atkbd_connect+0x73b/0xa50 [ 1070.640149][T30888] serio_driver_probe+0x82/0xd0 [ 1070.646913][T30888] really_probe+0x26d/0xad0 [ 1070.653160][T30888] __driver_probe_device+0x18c/0x320 [ 1070.660273][T30888] driver_probe_device+0x4f/0x240 [ 1070.667041][T30888] __driver_attach+0x349/0x650 [ 1070.673636][T30888] bus_for_each_dev+0x233/0x2b0 [ 1070.680714][T30888] serio_handle_event+0x1f9/0x8d0 [ 1070.687592][T30888] process_scheduled_works+0xad1/0x1770 [ 1070.695061][T30888] worker_thread+0x8a0/0xda0 [ 1070.702012][T30888] kthread+0x711/0x8a0 [ 1070.707928][T30888] ret_from_fork+0x510/0xa50 [ 1070.714646][T30888] ret_from_fork_asm+0x1a/0x30 [ 1070.721334][T30888] } [ 1070.723923][T30888] ... key at: [] input_allocate_device.__key.6+0x0/0x20 [ 1070.733391][T30888] -> (&client->buffer_lock){....}-{3:3} { [ 1070.739143][T30888] INITIAL USE at: [ 1070.743401][T30888] lock_acquire+0x107/0x340 [ 1070.749749][T30888] _raw_spin_lock_irqsave+0x40/0x60 [ 1070.757085][T30888] evdev_ioctl_handler+0x1969/0x1f10 [ 1070.764135][T30888] __ia32_compat_sys_ioctl+0x543/0x840 [ 1070.771738][T30888] __do_fast_syscall_32+0x1dc/0x570 [ 1070.778957][T30888] do_fast_syscall_32+0x34/0x80 [ 1070.785992][T30888] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1070.794501][T30888] } [ 1070.797098][T30888] ... key at: [] evdev_open.__key.26+0x0/0x20 [ 1070.805725][T30888] ... acquired at: [ 1070.809795][T30888] _raw_spin_lock+0x2e/0x40 [ 1070.814571][T30888] evdev_pass_values+0xb9/0xbd0 [ 1070.819782][T30888] evdev_events+0x1e6/0x340 [ 1070.824466][T30888] input_pass_values+0x288/0x890 [ 1070.829669][T30888] input_event_dispose+0x330/0x6b0 [ 1070.835279][T30888] input_inject_event+0x1dd/0x340 [ 1070.840666][T30888] evdev_write+0x2fc/0x480 [ 1070.845263][T30888] vfs_write+0x27e/0xb30 [ 1070.849749][T30888] ksys_write+0x145/0x250 [ 1070.854359][T30888] __do_fast_syscall_32+0x1dc/0x570 [ 1070.860094][T30888] do_fast_syscall_32+0x34/0x80 [ 1070.865234][T30888] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1070.871941][T30888] [ 1070.874403][T30888] [ 1070.874403][T30888] the dependencies between the lock to be acquired [ 1070.874414][T30888] and SOFTIRQ-irq-unsafe lock: [ 1070.888403][T30888] -> (tasklist_lock){.+.+}-{3:3} { [ 1070.893722][T30888] HARDIRQ-ON-R at: [ 1070.897885][T30888] lock_acquire+0x107/0x340 [ 1070.904568][T30888] _raw_read_lock+0x36/0x50 [ 1070.911250][T30888] __do_wait+0xde/0x740 [ 1070.917590][T30888] do_wait+0x1e8/0x4f0 [ 1070.923852][T30888] kernel_wait+0xab/0x170 [ 1070.930557][T30888] call_usermodehelper_exec_work+0xbe/0x230 [ 1070.938656][T30888] process_scheduled_works+0xad1/0x1770 [ 1070.946318][T30888] worker_thread+0x8a0/0xda0 [ 1070.953103][T30888] kthread+0x711/0x8a0 [ 1070.959302][T30888] ret_from_fork+0x510/0xa50 [ 1070.966074][T30888] ret_from_fork_asm+0x1a/0x30 [ 1070.972935][T30888] SOFTIRQ-ON-R at: [ 1070.977096][T30888] lock_acquire+0x107/0x340 [ 1070.983694][T30888] _raw_read_lock+0x36/0x50 [ 1070.990381][T30888] __do_wait+0xde/0x740 [ 1070.996819][T30888] do_wait+0x1e8/0x4f0 [ 1071.003286][T30888] kernel_wait+0xab/0x170 [ 1071.009891][T30888] call_usermodehelper_exec_work+0xbe/0x230 [ 1071.018137][T30888] process_scheduled_works+0xad1/0x1770 [ 1071.026040][T30888] worker_thread+0x8a0/0xda0 [ 1071.032768][T30888] kthread+0x711/0x8a0 [ 1071.039045][T30888] ret_from_fork+0x510/0xa50 [ 1071.045752][T30888] ret_from_fork_asm+0x1a/0x30 [ 1071.052968][T30888] INITIAL USE at: [ 1071.057126][T30888] lock_acquire+0x107/0x340 [ 1071.063719][T30888] _raw_write_lock_irq+0x3d/0x50 [ 1071.070695][T30888] copy_process+0x2185/0x3950 [ 1071.077380][T30888] kernel_clone+0x21e/0x820 [ 1071.083890][T30888] user_mode_thread+0xdd/0x140 [ 1071.091091][T30888] rest_init+0x23/0x300 [ 1071.097347][T30888] start_kernel+0x381/0x3d0 [ 1071.104033][T30888] x86_64_start_reservations+0x24/0x30 [ 1071.111638][T30888] x86_64_start_kernel+0x143/0x1c0 [ 1071.119458][T30888] common_startup_64+0x13e/0x147 [ 1071.126596][T30888] INITIAL READ USE at: [ 1071.131189][T30888] lock_acquire+0x107/0x340 [ 1071.138070][T30888] _raw_read_lock+0x36/0x50 [ 1071.145189][T30888] __do_wait+0xde/0x740 [ 1071.151883][T30888] do_wait+0x1e8/0x4f0 [ 1071.158500][T30888] kernel_wait+0xab/0x170 [ 1071.165540][T30888] call_usermodehelper_exec_work+0xbe/0x230 [ 1071.174306][T30888] process_scheduled_works+0xad1/0x1770 [ 1071.182992][T30888] worker_thread+0x8a0/0xda0 [ 1071.190656][T30888] kthread+0x711/0x8a0 [ 1071.197258][T30888] ret_from_fork+0x510/0xa50 [ 1071.204573][T30888] ret_from_fork_asm+0x1a/0x30 [ 1071.212045][T30888] } [ 1071.215023][T30888] ... key at: [] tasklist_lock+0x18/0x40 [ 1071.223199][T30888] ... acquired at: [ 1071.227275][T30888] _raw_read_lock+0x36/0x50 [ 1071.232134][T30888] send_sigurg+0x12b/0x420 [ 1071.237455][T30888] sk_send_sigurg+0x6c/0x2e0 [ 1071.242433][T30888] queue_oob+0x420/0x4f0 [ 1071.246942][T30888] unix_stream_sendmsg+0xc32/0xde0 [ 1071.252411][T30888] __sock_sendmsg+0x21c/0x270 [ 1071.257456][T30888] ____sys_sendmsg+0x52d/0x820 [ 1071.262660][T30888] ___sys_sendmsg+0x21f/0x2a0 [ 1071.267531][T30888] __sys_sendmmsg+0x28e/0x430 [ 1071.272476][T30888] __ia32_compat_sys_sendmmsg+0xa2/0xc0 [ 1071.278207][T30888] __do_fast_syscall_32+0x1dc/0x570 [ 1071.283587][T30888] do_fast_syscall_32+0x34/0x80 [ 1071.288723][T30888] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1071.295327][T30888] [ 1071.297692][T30888] -> (&f_owner->lock){....}-{3:3} { [ 1071.303104][T30888] INITIAL USE at: [ 1071.307109][T30888] lock_acquire+0x107/0x340 [ 1071.313642][T30888] _raw_write_lock_irq+0x3d/0x50 [ 1071.320678][T30888] __f_setown+0x67/0x370 [ 1071.326933][T30888] generic_setlease+0xb6c/0xea0 [ 1071.333545][T30888] do_fcntl_add_lease+0x34d/0x460 [ 1071.340599][T30888] fcntl_setlease+0x123/0x180 [ 1071.347221][T30888] do_fcntl+0x867/0x1a50 [ 1071.353223][T30888] do_compat_fcntl64+0x477/0x720 [ 1071.360429][T30888] __do_fast_syscall_32+0x1dc/0x570 [ 1071.367461][T30888] do_fast_syscall_32+0x34/0x80 [ 1071.374185][T30888] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1071.382662][T30888] INITIAL READ USE at: [ 1071.387124][T30888] lock_acquire+0x107/0x340 [ 1071.393899][T30888] _raw_read_lock_irqsave+0x48/0x60 [ 1071.401366][T30888] send_sigio+0x38/0x370 [ 1071.408855][T30888] kill_fasync+0x24d/0x4d0 [ 1071.415670][T30888] lease_break_callback+0x26/0x30 [ 1071.423049][T30888] __break_lease+0x6e3/0x1490 [ 1071.430607][T30888] do_dentry_open+0x73a/0x1420 [ 1071.437907][T30888] vfs_open+0x3b/0x340 [ 1071.444588][T30888] path_openat+0x340e/0x3dd0 [ 1071.451816][T30888] do_filp_open+0x1fa/0x410 [ 1071.458606][T30888] do_sys_openat2+0x121/0x200 [ 1071.465668][T30888] __ia32_compat_sys_open+0x117/0x140 [ 1071.473411][T30888] __do_fast_syscall_32+0x1dc/0x570 [ 1071.481224][T30888] do_fast_syscall_32+0x34/0x80 [ 1071.488524][T30888] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1071.497395][T30888] } [ 1071.500086][T30888] ... key at: [] file_f_owner_allocate.__key+0x0/0x20 [ 1071.509142][T30888] ... acquired at: [ 1071.513139][T30888] _raw_read_lock_irqsave+0x48/0x60 [ 1071.518623][T30888] send_sigio+0x38/0x370 [ 1071.523161][T30888] kill_fasync+0x24d/0x4d0 [ 1071.527773][T30888] lease_break_callback+0x26/0x30 [ 1071.533078][T30888] __break_lease+0x6e3/0x1490 [ 1071.538025][T30888] do_dentry_open+0x73a/0x1420 [ 1071.543406][T30888] vfs_open+0x3b/0x340 [ 1071.548089][T30888] path_openat+0x340e/0x3dd0 [ 1071.552949][T30888] do_filp_open+0x1fa/0x410 [ 1071.557712][T30888] do_sys_openat2+0x121/0x200 [ 1071.562667][T30888] __ia32_compat_sys_open+0x117/0x140 [ 1071.568223][T30888] __do_fast_syscall_32+0x1dc/0x570 [ 1071.573691][T30888] do_fast_syscall_32+0x34/0x80 [ 1071.578906][T30888] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1071.585508][T30888] [ 1071.587935][T30888] -> (&new->fa_lock){...-}-{3:3} { [ 1071.593099][T30888] IN-SOFTIRQ-R at: [ 1071.597082][T30888] lock_acquire+0x107/0x340 [ 1071.603331][T30888] _raw_read_lock_irqsave+0x48/0x60 [ 1071.610272][T30888] kill_fasync+0x199/0x4d0 [ 1071.616535][T30888] sock_wake_async+0x137/0x160 [ 1071.623229][T30888] sock_def_readable+0x3c1/0x530 [ 1071.630096][T30888] tcp_data_queue+0x1e14/0x5e30 [ 1071.636701][T30888] tcp_rcv_established+0xf57/0x2580 [ 1071.643827][T30888] tcp_v4_do_rcv+0xa90/0x1430 [ 1071.650162][T30888] tcp_v4_rcv+0x2675/0x2f20 [ 1071.656585][T30888] ip_protocol_deliver_rcu+0x221/0x440 [ 1071.663793][T30888] ip_local_deliver_finish+0x3bb/0x6f0 [ 1071.671009][T30888] NF_HOOK+0x30c/0x3a0 [ 1071.676913][T30888] NF_HOOK+0x30c/0x3a0 [ 1071.682828][T30888] __netif_receive_skb+0x143/0x380 [ 1071.689748][T30888] process_backlog+0x54f/0x1340 [ 1071.696277][T30888] __napi_poll+0xae/0x320 [ 1071.702563][T30888] net_rx_action+0x64a/0xe00 [ 1071.708927][T30888] handle_softirqs+0x22b/0x7c0 [ 1071.715367][T30888] do_softirq+0x76/0xd0 [ 1071.721360][T30888] __local_bh_enable_ip+0xf8/0x130 [ 1071.728224][T30888] sk_stream_wait_memory+0x71f/0xf70 [ 1071.735180][T30888] tcp_sendmsg_locked+0x1dfb/0x5520 [ 1071.742036][T30888] tcp_sendmsg+0x2f/0x50 [ 1071.748046][T30888] __sock_sendmsg+0x19c/0x270 [ 1071.754390][T30888] __sys_sendto+0x3bd/0x520 [ 1071.760908][T30888] __ia32_sys_sendto+0xdd/0x100 [ 1071.767508][T30888] __do_fast_syscall_32+0x1dc/0x570 [ 1071.774845][T30888] do_fast_syscall_32+0x34/0x80 [ 1071.781377][T30888] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1071.789368][T30888] INITIAL USE at: [ 1071.793360][T30888] lock_acquire+0x107/0x340 [ 1071.799524][T30888] _raw_write_lock_irq+0x3d/0x50 [ 1071.806385][T30888] fasync_insert_entry+0xc3/0x270 [ 1071.813246][T30888] lease_setup+0x86/0x110 [ 1071.819267][T30888] generic_setlease+0xb6c/0xea0 [ 1071.826042][T30888] do_fcntl_add_lease+0x34d/0x460 [ 1071.832738][T30888] fcntl_setlease+0x123/0x180 [ 1071.839275][T30888] do_fcntl+0x867/0x1a50 [ 1071.845182][T30888] do_compat_fcntl64+0x477/0x720 [ 1071.851888][T30888] __do_fast_syscall_32+0x1dc/0x570 [ 1071.858920][T30888] do_fast_syscall_32+0x34/0x80 [ 1071.865610][T30888] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1071.873606][T30888] INITIAL READ USE at: [ 1071.878237][T30888] lock_acquire+0x107/0x340 [ 1071.884930][T30888] _raw_read_lock_irqsave+0x48/0x60 [ 1071.892513][T30888] kill_fasync+0x199/0x4d0 [ 1071.898963][T30888] lease_break_callback+0x26/0x30 [ 1071.906086][T30888] __break_lease+0x6e3/0x1490 [ 1071.913469][T30888] do_dentry_open+0x73a/0x1420 [ 1071.920781][T30888] vfs_open+0x3b/0x340 [ 1071.927213][T30888] path_openat+0x340e/0x3dd0 [ 1071.934074][T30888] do_filp_open+0x1fa/0x410 [ 1071.940793][T30888] do_sys_openat2+0x121/0x200 [ 1071.947734][T30888] __ia32_compat_sys_open+0x117/0x140 [ 1071.955397][T30888] __do_fast_syscall_32+0x1dc/0x570 [ 1071.962900][T30888] do_fast_syscall_32+0x34/0x80 [ 1071.969766][T30888] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1071.978576][T30888] } [ 1071.981255][T30888] ... key at: [] fasync_insert_entry.__key+0x0/0x20 [ 1071.989939][T30888] ... acquired at: [ 1071.993920][T30888] _raw_read_lock_irqsave+0x48/0x60 [ 1071.999430][T30888] kill_fasync+0x199/0x4d0 [ 1072.004400][T30888] evdev_pass_values+0x627/0xbd0 [ 1072.009630][T30888] evdev_events+0x1e6/0x340 [ 1072.014700][T30888] input_pass_values+0x288/0x890 [ 1072.020185][T30888] input_event_dispose+0x330/0x6b0 [ 1072.026027][T30888] input_inject_event+0x1dd/0x340 [ 1072.031416][T30888] evdev_write+0x2fc/0x480 [ 1072.036359][T30888] vfs_write+0x27e/0xb30 [ 1072.041132][T30888] ksys_write+0x145/0x250 [ 1072.046333][T30888] __do_fast_syscall_32+0x1dc/0x570 [ 1072.051800][T30888] do_fast_syscall_32+0x34/0x80 [ 1072.057093][T30888] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1072.063806][T30888] [ 1072.066312][T30888] [ 1072.066312][T30888] stack backtrace: [ 1072.072231][T30888] CPU: 1 UID: 0 PID: 30888 Comm: syz.9.10309 Tainted: G L syzkaller #0 PREEMPT(full) [ 1072.072265][T30888] Tainted: [L]=SOFTLOCKUP [ 1072.072272][T30888] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1072.072283][T30888] Call Trace: [ 1072.072293][T30888] [ 1072.072300][T30888] dump_stack_lvl+0xe8/0x150 [ 1072.072327][T30888] __lock_acquire+0x2a95/0x2cf0 [ 1072.072351][T30888] ? kill_fasync+0x199/0x4d0 [ 1072.072374][T30888] lock_acquire+0x107/0x340 [ 1072.072424][T30888] ? kill_fasync+0x199/0x4d0 [ 1072.072448][T30888] ? do_raw_spin_lock+0x121/0x290 [ 1072.072469][T30888] ? evdev_pass_values+0xb9/0xbd0 [ 1072.072489][T30888] _raw_read_lock_irqsave+0x48/0x60 [ 1072.072515][T30888] ? kill_fasync+0x199/0x4d0 [ 1072.072541][T30888] kill_fasync+0x199/0x4d0 [ 1072.072564][T30888] ? kill_fasync+0x53/0x4d0 [ 1072.072587][T30888] evdev_pass_values+0x627/0xbd0 [ 1072.072607][T30888] ? evdev_pass_values+0x681/0xbd0 [ 1072.072626][T30888] evdev_events+0x1e6/0x340 [ 1072.072642][T30888] ? evdev_events+0x79/0x340 [ 1072.072659][T30888] ? input_pass_values+0x8d/0x890 [ 1072.072677][T30888] input_pass_values+0x288/0x890 [ 1072.072696][T30888] ? input_handle_event+0x70c/0xf30 [ 1072.072719][T30888] input_event_dispose+0x330/0x6b0 [ 1072.072743][T30888] input_inject_event+0x1dd/0x340 [ 1072.072765][T30888] ? input_inject_event+0xb6/0x340 [ 1072.072788][T30888] evdev_write+0x2fc/0x480 [ 1072.072808][T30888] ? __pfx_evdev_write+0x10/0x10 [ 1072.072829][T30888] ? bpf_lsm_file_permission+0x9/0x20 [ 1072.072853][T30888] ? security_file_permission+0x75/0x290 [ 1072.072872][T30888] ? rw_verify_area+0x255/0x4d0 [ 1072.072896][T30888] ? __pfx_evdev_write+0x10/0x10 [ 1072.072914][T30888] vfs_write+0x27e/0xb30 [ 1072.072931][T30888] ? __pfx_vfs_write+0x10/0x10 [ 1072.072947][T30888] ? __fget_files+0x2a/0x420 [ 1072.072970][T30888] ? __fget_files+0x2a/0x420 [ 1072.072989][T30888] ? __fget_files+0x3a0/0x420 [ 1072.073008][T30888] ? __fget_files+0x2a/0x420 [ 1072.073029][T30888] ksys_write+0x145/0x250 [ 1072.073045][T30888] ? __pfx_ksys_write+0x10/0x10 [ 1072.073064][T30888] __do_fast_syscall_32+0x1dc/0x570 [ 1072.073085][T30888] ? lockdep_hardirqs_on+0x7b/0x110 [ 1072.073106][T30888] ? do_fast_syscall_32+0x34/0x80 [ 1072.073125][T30888] ? irqentry_exit+0x10f/0x670 [ 1072.073144][T30888] do_fast_syscall_32+0x34/0x80 [ 1072.073163][T30888] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1072.073183][T30888] RIP: 0023:0xf7f54539 [ 1072.073200][T30888] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1072.073214][T30888] RSP: 002b:00000000f544655c EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 1072.073235][T30888] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000040 [ 1072.073248][T30888] RDX: 0000000000001068 RSI: 0000000000000000 RDI: 0000000000000000 [ 1072.073258][T30888] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1072.073268][T30888] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1072.073278][T30888] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1072.073293][T30888] [ 1072.444722][ T5923] ft260 0003:0403:6030.007F: failed to retrieve system status [ 1072.494387][ T5923] ft260 0003:0403:6030.007F: probe with driver ft260 failed with error -71 [ 1072.597673][ T5923] usb 3-1: USB disconnect, device number 73