last executing test programs: 5m54.88237186s ago: executing program 4 (id=7419): r0 = syz_io_uring_setup(0x49f, &(0x7f0000000400)={0x0, 0xe7a9, 0x400, 0x7ffe, 0x40024e}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_READ=@use_registered_buffer={0x16, 0x9, 0x6000, @fd_index=0x5, 0xc54, 0x0, 0x0, 0x18, 0x1, {0x3, r3}}) io_uring_enter(r0, 0x3d0e, 0x4c1, 0x43, 0x0, 0x0) 5m54.337890876s ago: executing program 4 (id=7426): add_key$user(0x0, 0x0, &(0x7f00000007c0)="3e12d23d346cfdeb1708e9b982bf3187ef6b10dac616f738274bc1c03bee4423fa20837e6e86b86592e9be8351aa0000000037d5095f839fa4a3507df4f7526f2440e7988da94ccd868dd8bb844bf127ee741d1e43eba0b67b516be14a8b51a75bfd611b2d7ae6a21d056c2c5116a416a76b0204dc55ea62d43c809e0ed6e56163fdab317afd5c34d614367e4425bb9a97e38b8beb84ef6d549eed5aaa86dbe646fc77a9b3df93199c796fa597f452bed6b6fbcc812df9be8e35d8d15086609c033a5d2a42d5dcb0d103098fa302c5b1d48f913f8b22a30a47d9ae02000000e2b855845f39806305f56d918cc5b4023fdbe9cae4147c84583ec9dd375031ba5ae65e31f00e641832d29ed658b91f33595b033222944765cb6a50d859f754ed83eefd480be0e3100965f081190bbb39a5965ceaa74775b88885041ff4e66e618d6c37c787f014eadb6c9f659ae43f57608e09d62083", 0x155, 0xfffffffffffffffe) socket$vsock_stream(0x28, 0x1, 0x0) r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000900)=ANY=[@ANYBLOB="2800000014001901000000000000000228"], 0x28}}, 0x0) read$watch_queue(r0, &(0x7f0000000200)=""/234, 0xea) 5m54.036197229s ago: executing program 4 (id=7429): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x101, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x9}]}, &(0x7f00000002c0)=0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) setsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000180)={r2, 0x2, 0x8, 0x5}, 0x10) 5m52.91814872s ago: executing program 4 (id=7439): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) umount2(&(0x7f0000000140)='./file0\x00', 0x0) 5m51.833147044s ago: executing program 4 (id=7448): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000002c0), 0x1) io_uring_setup(0x410d, &(0x7f0000000200)={0x0, 0x23cf, 0x0, 0xfffffffc}) r1 = syz_open_dev$usbmon(&(0x7f0000000900), 0x7, 0x0) ioctl$MON_IOCX_MFETCH(r1, 0xc0109207, &(0x7f0000000c40)={0x0, 0xfe72}) close_range(r0, r1, 0x0) 5m51.229910836s ago: executing program 4 (id=7456): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x640c7080, 0x0, 0x0, 0x0, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 5m50.599502043s ago: executing program 32 (id=7456): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x640c7080, 0x0, 0x0, 0x0, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 3m36.498159726s ago: executing program 0 (id=8722): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/bus/input/devices\x00', 0x0, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000000000040d90455a018000000000109022400010000000009040100010300000009210000000122050009058103"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000ac0)={0x2c, &(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\b'], 0x0, 0x0, 0x0, 0x0}, 0x0) read$FUSE(r0, &(0x7f0000004100)={0x2020}, 0x2020) 3m33.282265679s ago: executing program 0 (id=8745): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000100)={&(0x7f0000000180)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f00000001c0)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f0000000640)={0x0, 0x0, r2, r3, 0x2, 0x9, 0xb792, 0x2, {0xc, 0x2, 0x2, 0xba, 0x5, 0xacd, 0x794, 0x8731, 0xa, 0x7e6d, 0x7ffc, 0x10000, 0x2c692ca7, 0x4, "9f0a4aceaefbe82ed2bc600bd5171e6200"}}) 3m33.106588862s ago: executing program 0 (id=8746): r0 = socket$alg(0x26, 0x5, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000180)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) bind$alg(r0, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(cipher_null)\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f0000005c00)=[{{0x0, 0x56, &(0x7f0000000180)=[{&(0x7f0000000300)="f3e35409de14757036beb8a9904e486ad378444d92eebca28e7bfa695f15414df90544c3f2a3bb1e99cc426d39040d53ca1a688ae50c513590ba6a7257551c63a954cd4cde8a515b54310cf74ec0df8e77cb447e86788fe5787477908556462ee70ba92a7b73aaee7e2719168fa61fa71c0e", 0x72}, {&(0x7f0000000200)="db85b4c5900ec0b439166150f7d7cc4815034f47e30c1baec276cf12bb2a1bce83c7323ba65b7904b0dca49b906b65e6", 0x30}, {&(0x7f0000000080)="3e34e7df4589a8589adaa8baa651ffc8a926c9c300fb6c0030", 0x19}], 0x3}}, {{0x0, 0x0, &(0x7f0000000f40)=[{0x0}, {0x0, 0x24}], 0x2}}, {{&(0x7f0000003740)=@abs, 0x6e, &(0x7f0000003b40)=[{0x0}, {0x0}, {&(0x7f00000000c0)="7ec13bf28545dae7e767a91333887007a319ddd6931f155b6f6b6f6c3d2291d7547857d747621df979c986088c0c22bf43e216ce1ca767f3e75e5c93cf520b254164183491b8e6bdea14fe85fb7752edb41a5aa21ba545a5dc2ef5506abf77045c5bb3091ee2cd4cc16f33157eedacf6738d7ec90c6ddabf6acfc18e681d9e98e9283ef8c7503e97fc562d1c32a52f1bbb37971e665065bd59d30ea255d58ffe5b7b986e790dd02aaa"}], 0x3}}, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x54}}], 0x4, 0xc010) 3m32.224504683s ago: executing program 0 (id=8755): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000002280)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) umount2(&(0x7f0000000440)='./file0\x00', 0x9) 3m31.231549909s ago: executing program 0 (id=8768): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22, 0x0, @rand_addr, 0x99f}, 0x1c) connect$inet6(r0, &(0x7f0000000340)={0x2, 0x4e24, 0x0, @private0, 0x800}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000080)="580000001500add427323b472545b45602117fffffff81000e224e217f000001925aa80020007b00090080007f000001e809000000ff0000f03ac71006000000ffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1) 3m30.746835047s ago: executing program 0 (id=8770): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000180)='workqueue_activate_work\x00'}, 0x10) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000140)=ANY=[@ANYBLOB="020000000000000007000000010000000100000000000000000700fffffdfd000000000000000000000000000000000001"]) 3m30.239908641s ago: executing program 33 (id=8770): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000180)='workqueue_activate_work\x00'}, 0x10) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000140)=ANY=[@ANYBLOB="020000000000000007000000010000000100000000000000000700fffffdfd000000000000000000000000000000000001"]) 2m39.392588589s ago: executing program 2 (id=9287): r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000000), 0x8) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x80000000, @mcast2}, 0x1c) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000), 0x8) 2m39.194864392s ago: executing program 2 (id=9289): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0x7fa962bfffff, 0x11, r0, 0x0) munmap(&(0x7f0000ff9000/0x2000)=nil, 0x2000) mremap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x2000, 0x0, &(0x7f0000ff8000/0x2000)=nil) 2m38.934086614s ago: executing program 2 (id=9291): r0 = syz_io_uring_setup(0x2b06, &(0x7f0000000040), &(0x7f0000ffd000), &(0x7f0000ffe000)) write$FUSE_ENTRY(0xffffffffffffffff, &(0x7f0000000380)={0x90, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x3, 0xffffffff, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0x90) io_uring_register$IORING_REGISTER_FILES(r0, 0x14, &(0x7f00000003c0), 0x2) r1 = syz_io_uring_setup(0x1ec3, &(0x7f0000000080)={0x0, 0x6a5f, 0x0, 0x1, 0x386}, &(0x7f0000000000), &(0x7f0000000500)) io_uring_register$IORING_UNREGISTER_RING_FDS(r1, 0x15, &(0x7f0000000840)=[{0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x1, 0x0, 0x0, 0x0}], 0x2) 2m38.738294518s ago: executing program 2 (id=9292): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000002200)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, 0x0, 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x226) 2m37.729763118s ago: executing program 2 (id=9306): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000180)=0x200007ff, 0x4) setsockopt$packet_int(r0, 0x107, 0x9, &(0x7f0000000080)=0x9, 0x4) r1 = socket$netlink(0x10, 0x3, 0x4) write(r1, &(0x7f0000005c00)="2700000014000707030e0000120f0a0011000100f5fe0012ff000000078a151f75080039000500", 0x27) 2m36.946070934s ago: executing program 2 (id=9312): r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x60}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000424000/0x3000)=nil, 0x3000}, 0x1}) read(r0, &(0x7f0000000040)=""/42, 0x2a) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x2000) 2m36.465948165s ago: executing program 34 (id=9312): r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x60}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000424000/0x3000)=nil, 0x3000}, 0x1}) read(r0, &(0x7f0000000040)=""/42, 0x2a) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x2000) 9.930061544s ago: executing program 7 (id=10588): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = dup(r0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) 9.073181614s ago: executing program 3 (id=10595): r0 = userfaultfd(0x801) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x8031, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f0000000000)=0x9, 0x3, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f00000001c0)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000000)={{&(0x7f000057b000/0x3000)=nil, 0x3000}}) 7.862196029s ago: executing program 7 (id=10600): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) mkdirat$cgroup(r0, &(0x7f0000000080)='syz0\x00', 0x1ff) r1 = openat$cgroup(r0, &(0x7f0000000040)='syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000c40), 0x12) 7.585475732s ago: executing program 7 (id=10602): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &(0x7f0000000440)={0x48, 0x1, r1, 0x0, 0x97, 0x8000000}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000100)={0x28, 0x6, r1, 0x0, &(0x7f0000ffa000/0x1000)=nil, 0x1000}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000040)={0x28, 0x4, r1, 0x0, &(0x7f0000ff8000/0x1000)=nil, 0x1000}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000180)={0x48, 0x2, r1}) 7.279045926s ago: executing program 7 (id=10608): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000100)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$fuseblk(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x20000, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) 7.242845924s ago: executing program 6 (id=10609): r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x298}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) mprotect(&(0x7f00003fd000/0xc00000)=nil, 0xc00000, 0x5) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2) 7.194068316s ago: executing program 3 (id=10610): r0 = syz_io_uring_setup(0x497, &(0x7f0000000180)={0x0, 0x4885, 0x100, 0x4, 0x1d}, &(0x7f0000000340)=0x0, &(0x7f0000000600)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r0, 0x16, &(0x7f0000000040)={&(0x7f0000001000)={[{0x0, 0x0, 0x3, 0xf4}]}, 0x1, 0x1}, 0x1) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x20, 0x10, r3, 0x0, 0x0, 0x0, 0x12321, 0x1, {0x1}}) io_uring_enter(r0, 0x3516, 0x0, 0x0, 0x0, 0x0) 6.414487716s ago: executing program 5 (id=10617): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0) io_uring_setup(0x35ea, &(0x7f0000000080)={0x0, 0xb7de, 0x100, 0x1, 0x1c8}) write$dsp(r0, &(0x7f0000000280)='$', 0x1) close_range(r0, 0xffffffffffffffff, 0x0) 6.366165308s ago: executing program 6 (id=10618): r0 = syz_clone(0x80000, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000240)={0x1fff}, 0x18, 0x0) landlock_restrict_self(r1, 0x0) r2 = syz_clone(0x200100, 0x0, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) kcmp(r2, r0, 0x2, 0xffffffffffffffff, 0xffffffffffffffff) 6.348603441s ago: executing program 7 (id=10619): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000400)={0xc, 0x0, 0x0}) ioctl$IOMMU_DESTROY$ioas(r0, 0x3b80, &(0x7f0000000540)={0x8, r2}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000740)={0x48, 0x2, r1, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r0, 0x3ba0, &(0x7f0000000240)={0x48, 0xa, r3, 0x0, r2}) 5.978060617s ago: executing program 7 (id=10622): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f00000000c0)={0xfffc}, 0x8) sendto$inet6(r0, &(0x7f0000000080)="81", 0x1, 0x0, &(0x7f0000000280)={0xa, 0x0, 0x0, @loopback, 0x81}, 0x1c) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000000), &(0x7f0000000040)=0x4) r1 = syz_open_procfs(0x0, &(0x7f0000000380)='clear_refs\x00') writev(r1, &(0x7f0000000100)=[{&(0x7f0000000000)='4', 0x1}], 0x1) 5.977704231s ago: executing program 6 (id=10623): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba", 0x10}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) 5.203161957s ago: executing program 35 (id=10622): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f00000000c0)={0xfffc}, 0x8) sendto$inet6(r0, &(0x7f0000000080)="81", 0x1, 0x0, &(0x7f0000000280)={0xa, 0x0, 0x0, @loopback, 0x81}, 0x1c) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000000), &(0x7f0000000040)=0x4) r1 = syz_open_procfs(0x0, &(0x7f0000000380)='clear_refs\x00') writev(r1, &(0x7f0000000100)=[{&(0x7f0000000000)='4', 0x1}], 0x1) 5.151651444s ago: executing program 6 (id=10625): sendmsg$key(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000640)=ANY=[@ANYBLOB="020e0000180000000000000000000000030005000000000002000000ac1e00010000000000000000030006"], 0xc0}}, 0x0) r0 = syz_usb_connect(0x0, 0x36, &(0x7f00000002c0)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0) ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, &(0x7f0000000080)=0xb309) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x8, &(0x7f0000000080)=ANY=[]) r1 = syz_open_dev$evdev(&(0x7f0000000880), 0x200000000000002, 0x862b01) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2250) 5.140785237s ago: executing program 5 (id=10627): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000240)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000400)) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f00000002c0)) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r0, 0xc0182101, &(0x7f00000001c0)={r1}) 4.078832664s ago: executing program 1 (id=10630): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1c, &(0x7f00000001c0)=[@in6={0xa, 0x0, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x4}]}, &(0x7f0000000140)=0x10) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000080)={0x0, 0x8004}, 0xffc4) pwritev2(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000080)="ff", 0xabfb}], 0x1, 0x5412, 0x0, 0x0) getsockopt$bt_hci(r0, 0x84, 0x7f, &(0x7f0000000080)=""/4057, &(0x7f0000000000)=0xfd9) 4.07792536s ago: executing program 5 (id=10631): syz_open_dev$sndmidi(&(0x7f00000002c0), 0x2, 0x141101) socket$xdp(0x2c, 0x3, 0x0) r0 = syz_io_uring_setup(0x497, &(0x7f0000000400)={0x0, 0x7079, 0x10, 0x4, 0x288}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r0, 0x3516, 0x0, 0x0, 0x0, 0x0) 3.135625248s ago: executing program 5 (id=10632): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001700)=ANY=[@ANYBLOB="1800000024000103000000000000000001"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) recvmmsg(r0, &(0x7f0000004ec0)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)=""/4077, 0xfed}], 0x1}, 0x7}], 0x1, 0x2000, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r1) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="80000000", @ANYRES16=r2, @ANYBLOB="050000000000000000000200000008000300", @ANYRES32, @ANYBLOB="2d000e0080000000ffffffffffff080211000000080211000000000000000000000000006400000025030000000000000800"], 0x80}}, 0x0) 2.841192414s ago: executing program 1 (id=10633): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000180)={0x42, 0x0, 0x2}, 0x10) sendmsg$tipc(r1, &(0x7f0000000540)={&(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x4}}, 0x10, 0x0}, 0x10) dup3(r1, r0, 0x80000) 2.809678977s ago: executing program 3 (id=10634): setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x3c1, 0x3, 0x2a0, 0x0, 0x6c, 0x0, 0x0, 0x0, 0x2a0, 0x258, 0x258, 0x2a0, 0x258, 0x3, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @private0, [], [], 'wlan1\x00', '\x00', {}, {}, 0x11}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x5, 0x3, 0x7}}}, {{@ipv6={@private0, @empty, [0x0, 0x0, 0xff], [], 'lo\x00', 'erspan0\x00', {}, {}, 0x0, 0x0, 0x6, 0x4a}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x0, 0x6}, {0x2}}}}], {{'\x00', 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x2001}}, {0x28}}}}, 0x300) r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r0, 0x10e, 0x3, &(0x7f0000002040)=0x4, 0x4) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f0000001d40)=0xe, 0x4) sendmsg$NL80211_CMD_GET_MPP(r0, &(0x7f0000000d00)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000180)=ANY=[@ANYBLOB="28000000690005"], 0x28}}, 0x0) recvmmsg(r0, &(0x7f0000000800)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)=""/91, 0x5b}}, {{&(0x7f0000000000)=@isdn, 0x0, &(0x7f0000000640)=[{&(0x7f0000000080)=""/225}, {&(0x7f00000001c0)=""/65}, {&(0x7f0000000d40)=""/4096}, {&(0x7f0000000240)=""/99}, {&(0x7f00000002c0)=""/122}, {&(0x7f0000000340)=""/217}, {&(0x7f00000008c0)=""/35}, {&(0x7f0000000500)=""/227}, {&(0x7f0000000600)=""/1}]}}, {{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000700)=""/27}], 0x0, &(0x7f0000000780)=""/112}}], 0x40000000000024a, 0x40002002, 0x0) 2.565969801s ago: executing program 1 (id=10635): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80", 0x63}], 0x2, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmmsg$unix(r1, &(0x7f0000001e40)=[{{0x0, 0x0, &(0x7f0000001e00)=[{&(0x7f0000000a80)=""/14, 0xe}, {&(0x7f0000000cc0)=""/178, 0xb2}], 0x2}}], 0x1, 0x10000, 0x0) 2.492212951s ago: executing program 6 (id=10636): r0 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0xff}, 0x7}, 0x1c) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r1, 0x107, 0x16, &(0x7f0000000100)={0x2, &(0x7f0000000180)=[{0x28, 0x0, 0x0, 0xfbfff034}, {0x6, 0x0, 0x69}]}, 0x10) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000100)="88", 0xfdef}], 0x1) 2.398817161s ago: executing program 3 (id=10637): syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) r0 = syz_io_uring_setup(0x49a, &(0x7f00000000c0)={0x0, 0x79af, 0x3180, 0x8000, 0x40024e}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x40, 0x4007, @fd_index=0x3, 0x6, 0x0, 0x0, 0x2, 0x1}) io_uring_enter(r0, 0x627, 0x4c1, 0x43, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000000), 0x200, 0x102) 2.281415697s ago: executing program 1 (id=10638): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000000c0)={0x1b, 0x0, 0x0, 0x800000, 0x4, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1, 0x0, 0x0, @void, @value, @void, @value}, 0x50) 1.761919557s ago: executing program 6 (id=10639): syz_usb_connect(0x5, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000050cb5340450c10108e492940a80909021b00090000000009040002010035040009058dff86"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) writev(r0, &(0x7f00000004c0)=[{&(0x7f00000003c0)='7', 0x1}], 0x1) timer_create(0x0, &(0x7f0000000680)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000100)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) 822.202052ms ago: executing program 1 (id=10640): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={0x0}}, 0x20000050) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x12, 0x0, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000008004"]) 549.846569ms ago: executing program 1 (id=10641): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x2101, 0x0) write$binfmt_aout(r0, &(0x7f0000000240)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x3, 0x0, 0x0, "0062ba7d82000000000000000000f7fffeff00"}) r1 = syz_open_pts(r0, 0x101302) r2 = dup3(r1, r0, 0x0) write$binfmt_script(r2, 0x0, 0x0) 521.762134ms ago: executing program 3 (id=10642): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@RTM_NEWMDB={0x38, 0x55, 0x1e5, 0x0, 0x0, {0x7, r2}, [@MDBA_SET_ENTRY={0x20, 0x1, {r4, 0x1, 0x0, 0x4, {@ip4=@broadcast}}}]}, 0x38}}, 0x20044050) 396.274179ms ago: executing program 5 (id=10643): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000b80)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000006dc0)=[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}], 0x1, 0x44810) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) 125.536995ms ago: executing program 3 (id=10644): syz_clone(0x100, 0x0, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r1, 0x5452, &(0x7f0000000040)=0x8001) r2 = getpgid(0x0) fcntl$setownex(r1, 0xf, &(0x7f0000000140)={0x2, r2}) sendmmsg$unix(r0, &(0x7f0000006c40)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000300)="11", 0x1}], 0x1}}], 0x1, 0x40015) 0s ago: executing program 5 (id=10645): r0 = socket$inet6(0xa, 0x1, 0x84) bind$inet6(r0, &(0x7f0000ed3fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) shutdown(r0, 0x0) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000040)={0x1, 0xffffffff}, 0x8) sendto$inet6(r0, &(0x7f0000000100)="bc", 0x1, 0x0, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @loopback, 0x1}, 0x1c) close(r0) kernel console output (not intermixed with test programs): ce. Setting the MTU to 1560 would solve the problem. [ 900.730199][T27745] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 901.117945][T27745] hsr_slave_0: entered promiscuous mode [ 901.146414][T27745] hsr_slave_1: entered promiscuous mode [ 901.181793][T27745] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 901.201834][T27745] Cannot create hsr debugfs directory [ 901.319392][T27908] sctp: [Deprecated]: syz.6.9371 (pid 27908) Use of struct sctp_assoc_value in delayed_ack socket option. [ 901.319392][T27908] Use struct sctp_sack_info instead [ 901.844335][T19292] Bluetooth: hci2: command tx timeout [ 902.196678][T27745] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 902.234723][T27745] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 902.265542][T27745] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 902.279437][T27745] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 902.315883][T27934] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9381'. [ 902.821401][T27745] 8021q: adding VLAN 0 to HW filter on device bond0 [ 902.898304][T27745] 8021q: adding VLAN 0 to HW filter on device team0 [ 902.986916][T13657] bridge0: port 1(bridge_slave_0) entered blocking state [ 902.994361][T13657] bridge0: port 1(bridge_slave_0) entered forwarding state [ 903.021381][T13657] bridge0: port 2(bridge_slave_1) entered blocking state [ 903.028651][T13657] bridge0: port 2(bridge_slave_1) entered forwarding state [ 903.332483][T27745] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 903.568259][T27745] veth0_vlan: entered promiscuous mode [ 903.596280][T27745] veth1_vlan: entered promiscuous mode [ 903.759609][T27745] veth0_macvtap: entered promiscuous mode [ 903.791690][T27745] veth1_macvtap: entered promiscuous mode [ 903.883577][T27745] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 903.912310][T27745] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 903.924614][T24077] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 903.940487][T27745] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 903.952866][T27745] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 903.971155][T27745] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 903.997233][T27745] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 904.104379][T24077] usb 7-1: Using ep0 maxpacket: 8 [ 904.111881][T24077] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 904.120809][T24077] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 904.170219][T27998] bond1 (unregistering): Released all slaves [ 904.181295][T24077] usb 7-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 904.218328][T24077] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 904.232570][T24077] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 904.337175][T24077] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 904.351876][T24077] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 904.366030][T24077] usb 7-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 904.379137][T24077] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 904.396085][T24077] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 904.445244][T24077] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 904.504785][T24077] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 904.554451][T24077] usb 7-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 904.598834][T24077] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 904.641768][ T2989] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 904.647687][T24077] usb 7-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 904.693079][ T2989] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 904.741282][T24077] usb 7-1: string descriptor 0 read error: -22 [ 904.765193][T24077] usb 7-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 904.784855][T28012] loop6: detected capacity change from 0 to 63 [ 904.801812][T24077] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 904.804729][ T2989] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 904.821079][T28012] buffer_io_error: 26 callbacks suppressed [ 904.821101][T28012] Buffer I/O error on dev loop6, logical block 0, async page read [ 904.858265][ T2989] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 904.871500][T28012] Buffer I/O error on dev loop6, logical block 1, async page read [ 904.886095][T24077] adutux 7-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 904.931648][T28012] Buffer I/O error on dev loop6, logical block 2, async page read [ 904.979220][T28012] Buffer I/O error on dev loop6, logical block 3, async page read [ 905.010055][ T5939] Buffer I/O error on dev loop6, logical block 0, async page read [ 905.040563][ T5939] Buffer I/O error on dev loop6, logical block 1, async page read [ 905.063506][ T5939] Buffer I/O error on dev loop6, logical block 2, async page read [ 905.086474][ T5939] Buffer I/O error on dev loop6, logical block 3, async page read [ 905.102648][T28012] Buffer I/O error on dev loop6, logical block 0, async page read [ 905.121703][T28012] Buffer I/O error on dev loop6, logical block 1, async page read [ 905.274104][T24179] usb 7-1: USB disconnect, device number 9 [ 905.390068][T28029] loop3: detected capacity change from 0 to 1 [ 905.450798][T28029] Dev loop3: unable to read RDB block 1 [ 905.471515][T28029] loop3: unable to read partition table [ 905.492048][T28029] loop3: partition table beyond EOD, truncated [ 905.509995][T28029] loop_reread_partitions: partition scan of loop3 (被x ) failed (rc=-5) [ 905.725942][T28041] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9414'. [ 905.998705][T24179] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 906.173972][T24179] usb 6-1: Using ep0 maxpacket: 32 [ 906.190636][T24179] usb 6-1: config index 0 descriptor too short (expected 35577, got 27) [ 906.218479][T24179] usb 6-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 906.240698][T24179] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 906.273764][T24179] usb 6-1: config 1 has no interface number 0 [ 906.292158][T24179] usb 6-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 906.345347][T24179] usb 6-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 906.403615][T24179] usb 6-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 906.433814][T24179] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 906.441008][T28064] syzkaller1: entered promiscuous mode [ 906.452124][T28064] syzkaller1: entered allmulticast mode [ 906.482232][T24179] snd_usb_pod 6-1:1.1: Line 6 Pocket POD found [ 906.666472][T28070] vxcan1: tx address claim with different name [ 906.689959][T24179] snd_usb_pod 6-1:1.1: Line 6 Pocket POD now attached [ 907.177097][T24077] usb 6-1: USB disconnect, device number 20 [ 907.193620][T24077] snd_usb_pod 6-1:1.1: Line 6 Pocket POD now disconnected [ 907.245939][T25685] usb 7-1: new full-speed USB device number 10 using dummy_hcd [ 907.435284][T25685] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 907.469756][T25685] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 907.512183][T25685] usb 7-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 907.531525][T25685] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 907.561974][T25685] usb 7-1: config 0 descriptor?? [ 907.732189][T28102] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9435'. [ 907.895620][ T5845] usb 2-1: new high-speed USB device number 101 using dummy_hcd [ 908.066573][ T5845] usb 2-1: config 0 has an invalid interface number: 101 but max is 0 [ 908.084882][ T5845] usb 2-1: config 0 has no interface number 0 [ 908.091103][ T5845] usb 2-1: config 0 interface 101 altsetting 0 endpoint 0x9 has an invalid bInterval 0, changing to 7 [ 908.137417][ T5845] usb 2-1: config 0 interface 101 altsetting 0 endpoint 0x9 has invalid maxpacket 2007, setting to 1024 [ 908.170079][ T5845] usb 2-1: New USB device found, idVendor=093a, idProduct=2623, bcdDevice=b2.14 [ 908.197200][ T5845] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 908.209937][ T5845] usb 2-1: Product: syz [ 908.220562][ T5845] usb 2-1: Manufacturer: syz [ 908.226675][T25685] usb 7-1: language id specifier not provided by device, defaulting to English [ 908.241268][ T5845] usb 2-1: SerialNumber: syz [ 908.256069][ T5845] usb 2-1: config 0 descriptor?? [ 908.283220][ T5845] gspca_main: gspca_pac7302-2.14.0 probing 093a:2623 [ 908.429090][T25685] uclogic 0003:256C:006D.0091: failed retrieving Huion firmware version: -71 [ 908.464559][T25685] uclogic 0003:256C:006D.0091: failed probing parameters: -71 [ 908.478822][T25685] uclogic 0003:256C:006D.0091: probe with driver uclogic failed with error -71 [ 908.518855][T25685] usb 7-1: USB disconnect, device number 10 [ 908.761092][T28126] input: syz1 as /devices/virtual/input/input86 [ 909.103391][ T5845] input: gspca_pac7302 as /devices/platform/dummy_hcd.1/usb2/2-1/input/input87 [ 909.361571][ T5845] usb 2-1: USB disconnect, device number 101 [ 910.759497][T24172] usb 7-1: new full-speed USB device number 11 using dummy_hcd [ 910.820505][T28181] netlink: 24 bytes leftover after parsing attributes in process `syz.1.9456'. [ 910.882601][T28181] netlink: 24 bytes leftover after parsing attributes in process `syz.1.9456'. [ 910.926427][T24172] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 910.948835][T24172] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 910.997506][T24172] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 911.036360][T24172] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 911.313058][T24172] usb 7-1: GET_CAPABILITIES returned 0 [ 911.335217][T28188] input: syz1 as /devices/virtual/input/input88 [ 911.339923][T24172] usbtmc 7-1:16.0: can't read capabilities [ 911.517629][T24172] usb 7-1: USB disconnect, device number 11 [ 911.734684][T28201] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9461'. [ 912.053887][ T30] audit: type=1326 audit(1749914176.208:4047): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28207 comm="syz.7.9463" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f37d2f8e929 code=0x0 [ 912.401929][ T30] audit: type=1326 audit(1749914176.558:4048): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28224 comm="syz.1.9470" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fc44e58e929 code=0x0 [ 912.672620][T28234] netlink: 8 bytes leftover after parsing attributes in process `syz.6.9473'. [ 913.736896][T28271] bond0: entered promiscuous mode [ 913.742138][T28271] bond_slave_0: entered promiscuous mode [ 913.748833][T28271] bond_slave_1: entered promiscuous mode [ 913.755626][T28271] netdevsim netdevsim5 netdevsim0: entered promiscuous mode [ 915.039268][T28304] No memory to map [ 915.454341][T28319] sctp: [Deprecated]: syz.6.9503 (pid 28319) Use of struct sctp_assoc_value in delayed_ack socket option. [ 915.454341][T28319] Use struct sctp_sack_info instead [ 915.556550][T28323] (unnamed net_device) (uninitialized): ARP target 1.0.0.0 is already present [ 915.607454][T28323] (unnamed net_device) (uninitialized): option arp_ip_target: invalid value (1) [ 915.854149][T25685] IPVS: starting estimator thread 0... [ 915.860270][T28326] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 915.974180][T28333] IPVS: using max 23 ests per chain, 55200 per kthread [ 915.974685][ T5845] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 916.119208][T28343] tipc: Started in network mode [ 916.138218][T28343] tipc: Node identity 7a400000ff7f0000403a002d00002d4, cluster identity 4711 [ 916.154425][ T5845] usb 7-1: Using ep0 maxpacket: 8 [ 916.162586][ T5845] usb 7-1: config 179 has an invalid interface number: 65 but max is 0 [ 916.191423][ T5845] usb 7-1: config 179 has no interface number 0 [ 916.198531][ T5845] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 916.210513][ T5845] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 916.242899][ T5845] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 916.259670][ T5845] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 916.264088][T24172] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 916.282649][ T5845] usb 7-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 916.301904][ T5845] usb 7-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 916.312004][ T5845] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 916.337159][T28328] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 916.471686][T24172] usb 6-1: Using ep0 maxpacket: 8 [ 916.479687][T24172] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 916.499753][T24172] usb 6-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 916.516740][T24172] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 916.542568][T24172] usb 6-1: config 0 descriptor?? [ 916.578488][T24172] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 916.621413][ T5845] input: Generic X-Box pad as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:179.65/input/input89 [ 916.800766][ T5845] usb 7-1: USB disconnect, device number 12 [ 916.800831][ C1] xpad 7-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 916.815143][ C1] xpad 7-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 916.848969][ T5845] xpad 7-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 917.735492][T28383] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 917.774051][ T30] audit: type=1800 audit(1749914181.928:4049): pid=28372 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.9524" name="SYSV00000000" dev="tmpfs" ino=4 res=0 errno=0 [ 917.830309][T24172] gspca_vc032x: reg_w err -71 [ 917.845109][T24172] vc032x 6-1:0.0: probe with driver vc032x failed with error -71 [ 917.856173][T24172] usb 6-1: USB disconnect, device number 21 [ 918.171606][T28393] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 918.699329][T28414] netdevsim netdevsim7: loading /lib/firmware/. failed with error -22 [ 918.744848][T28414] netdevsim netdevsim7: Direct firmware load for . failed with error -22 [ 918.753351][T28414] netdevsim netdevsim7: Falling back to sysfs fallback for: . [ 919.088691][ T30] audit: type=1326 audit(1749914183.248:4050): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28415 comm="syz.5.9540" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f638392ab19 code=0x7ffc0000 [ 919.139361][ T30] audit: type=1326 audit(1749914183.248:4051): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28415 comm="syz.5.9540" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f638398e929 code=0x7ffc0000 [ 919.553886][ T30] audit: type=1326 audit(1749914183.248:4052): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28415 comm="syz.5.9540" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f638398e929 code=0x7ffc0000 [ 919.663119][ T30] audit: type=1326 audit(1749914183.278:4053): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28415 comm="syz.5.9540" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f638392ab19 code=0x7ffc0000 [ 919.756409][ T30] audit: type=1326 audit(1749914183.278:4054): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28415 comm="syz.5.9540" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f638398e929 code=0x7ffc0000 [ 919.953130][ T30] audit: type=1326 audit(1749914183.278:4055): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28415 comm="syz.5.9540" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f638398e929 code=0x7ffc0000 [ 920.091753][ T30] audit: type=1326 audit(1749914183.278:4056): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28415 comm="syz.5.9540" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f638398e929 code=0x7ffc0000 [ 920.242256][ T30] audit: type=1326 audit(1749914183.278:4057): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28415 comm="syz.5.9540" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f638392ab19 code=0x7ffc0000 [ 920.330612][ T30] audit: type=1326 audit(1749914183.278:4058): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28415 comm="syz.5.9540" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f638398e929 code=0x7ffc0000 [ 920.356845][T28448] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 920.691471][T28462] loop6: detected capacity change from 0 to 7 [ 920.720936][T28463] ip6tnl1: entered promiscuous mode [ 920.753991][T28462] Dev loop6: unable to read RDB block 7 [ 920.783750][T28462] loop6: unable to read partition table [ 920.789718][T28462] loop6: partition table beyond EOD, truncated [ 920.823797][T28462] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 921.322087][T28478] netlink: 4 bytes leftover after parsing attributes in process `syz.5.9559'. [ 921.408917][T28480] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 921.447306][T28480] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 921.688558][T28486] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 921.774523][T28488] ptrace attach of "./syz-executor exec"[27745] was attempted by ""[28488] [ 923.351624][T28530] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 923.580889][T28521] bridge0: port 2(bridge_slave_1) entered disabled state [ 923.588838][T28521] bridge0: port 1(bridge_slave_0) entered disabled state [ 924.604802][T28558] all: renamed from bridge_slave_0 [ 924.694276][T24172] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 924.864016][T24172] usb 6-1: Using ep0 maxpacket: 32 [ 924.876190][T24172] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 924.935092][T24172] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 924.964100][T24172] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 924.986450][T24172] usb 6-1: Product: syz [ 924.990693][T24172] usb 6-1: Manufacturer: syz [ 925.007734][T24172] usb 6-1: SerialNumber: syz [ 925.046253][T24172] usb 6-1: config 0 descriptor?? [ 925.053111][T28551] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 925.191454][T28577] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 925.388660][T24172] usb 6-1: USB disconnect, device number 22 [ 925.836468][T24175] usb 4-1: new high-speed USB device number 93 using dummy_hcd [ 926.042502][T24175] usb 4-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 926.076557][T24175] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 926.108562][T24175] usb 4-1: config 0 descriptor?? [ 926.140574][T24175] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 926.559425][T24175] cpia1 4-1:0.0: unexpected state after lo power cmd: 00 [ 926.967425][T24175] cpia1 4-1:0.0: only firmware version 1 is supported (got: 0) [ 927.217711][ T5928] usb 4-1: USB disconnect, device number 93 [ 927.288788][T28632] input: syz1 as /devices/virtual/input/input90 [ 927.354105][ T5845] usb 2-1: new high-speed USB device number 102 using dummy_hcd [ 927.524708][ T5845] usb 2-1: Using ep0 maxpacket: 8 [ 927.583583][ T5845] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 927.627167][ T5845] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 927.668724][ T5845] usb 2-1: Product: syz [ 927.679113][ T5845] usb 2-1: Manufacturer: syz [ 927.726307][ T5845] usb 2-1: SerialNumber: syz [ 927.760655][ T5845] usb 2-1: config 0 descriptor?? [ 927.991869][ T5845] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 928.084161][ T5928] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 928.446281][ T5928] usb 7-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 928.474403][ T5928] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 928.501273][ T5845] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 928.550955][ T5928] usb 7-1: config 0 descriptor?? [ 928.573525][ T5845] usb 2-1: USB disconnect, device number 102 [ 928.644192][ T5928] cp210x 7-1:0.0: cp210x converter detected [ 928.997304][ T5928] cp210x 7-1:0.0: failed to get vendor val 0x0010 size 3: -32 [ 929.087745][ T5928] usb 7-1: cp210x converter now attached to ttyUSB0 [ 929.878970][T28686] input: syz1 as /devices/virtual/input/input91 [ 930.194615][T24175] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 930.263835][T24179] usb 2-1: new high-speed USB device number 103 using dummy_hcd [ 930.393781][T24175] usb 6-1: Using ep0 maxpacket: 32 [ 930.418065][T24175] usb 6-1: config 0 has an invalid interface number: 132 but max is 0 [ 930.433726][T24175] usb 6-1: config 0 has no interface number 0 [ 930.444031][T24175] usb 6-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 930.469277][T24175] usb 6-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 930.489038][T24175] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 930.507591][T24175] usb 6-1: Product: syz [ 930.529976][T24175] usb 6-1: Manufacturer: syz [ 930.542543][T24175] usb 6-1: SerialNumber: syz [ 930.549564][T24179] usb 2-1: Using ep0 maxpacket: 8 [ 930.564575][T24179] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 930.583030][T24175] usb 6-1: config 0 descriptor?? [ 930.601345][T24175] em28xx 6-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 930.617933][T24179] usb 2-1: config 179 has no interface number 0 [ 930.646821][T24179] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 930.664614][T24175] em28xx 6-1:0.132: Video interface 132 found: [ 930.724561][T24179] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 930.787351][T24179] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 930.849935][T24179] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 930.886568][T24179] usb 2-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 930.935788][T24179] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 930.984249][T24179] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 931.013488][T28692] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 931.042611][T24175] em28xx 6-1:0.132: unknown em28xx chip ID (0) [ 931.488261][T24179] input: Generic X-Box pad as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:179.65/input/input92 [ 931.667870][ C0] xpad 2-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 931.667875][ T5845] usb 2-1: USB disconnect, device number 103 [ 931.683115][ T5845] xpad 2-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 931.703579][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.710130][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 932.170601][T24175] em28xx 6-1:0.132: failed to trigger read from i2c address 0xa0 (error=-5) [ 932.204213][T24175] em28xx 6-1:0.132: board has no eeprom [ 932.214628][T28689] em28xx 6-1:0.132: failed to trigger write to i2c address 0x28 (error=-5) [ 932.310753][T24175] em28xx 6-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 932.348072][T24175] em28xx 6-1:0.132: analog set to bulk mode. [ 932.374828][T24179] em28xx 6-1:0.132: Registering V4L2 extension [ 932.415914][T24175] usb 6-1: USB disconnect, device number 23 [ 932.451552][T24175] em28xx 6-1:0.132: Disconnecting em28xx [ 932.617786][T28731] loop6: detected capacity change from 0 to 524287999 [ 932.668901][T28731] blk_print_req_error: 10 callbacks suppressed [ 932.668923][T28731] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 932.756551][T28731] buffer_io_error: 26 callbacks suppressed [ 932.756574][T28731] Buffer I/O error on dev loop6, logical block 0, async page read [ 932.831928][T24179] em28xx 6-1:0.132: Config register raw data: 0xffffffed [ 932.872797][T28731] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 932.893213][T24179] em28xx 6-1:0.132: AC97 chip type couldn't be determined [ 932.950656][T24179] em28xx 6-1:0.132: No AC97 audio processor [ 932.954295][T28731] Buffer I/O error on dev loop6, logical block 0, async page read [ 933.009046][T24179] usb 6-1: Decoder not found [ 933.035726][T24179] em28xx 6-1:0.132: failed to create media graph [ 933.044766][T28731] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 933.062535][T24179] em28xx 6-1:0.132: V4L2 device video103 deregistered [ 933.103396][T24179] em28xx 6-1:0.132: Remote control support is not available for this card. [ 933.144547][T24175] em28xx 6-1:0.132: Closing input extension [ 933.180537][T28731] Buffer I/O error on dev loop6, logical block 0, async page read [ 933.214793][T24175] em28xx 6-1:0.132: Freeing device [ 933.240445][T28731] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 933.330180][T28731] Buffer I/O error on dev loop6, logical block 0, async page read [ 933.415881][T28731] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 933.475720][T28731] Buffer I/O error on dev loop6, logical block 0, async page read [ 933.519054][T28731] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 933.604938][T28731] Buffer I/O error on dev loop6, logical block 0, async page read [ 933.613038][T28731] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 933.634181][T24175] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 933.696170][T28731] Buffer I/O error on dev loop6, logical block 0, async page read [ 933.769988][T28731] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 933.814313][T28731] Buffer I/O error on dev loop6, logical block 0, async page read [ 933.844101][T24175] usb 6-1: Using ep0 maxpacket: 32 [ 933.883852][T28731] ldm_validate_partition_table(): Disk read failed. [ 933.885112][T24175] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 933.891863][T24175] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 933.953500][T24175] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 934.011103][T28731] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 934.061247][T24175] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 934.085755][T24175] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 934.108752][T28731] Buffer I/O error on dev loop6, logical block 0, async page read [ 934.133825][T24175] usb 6-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 934.154901][T24175] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 934.212904][T24175] usb 6-1: Product: syz [ 934.223079][T24175] usb 6-1: Manufacturer: syz [ 934.223359][T28731] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 934.236842][T24175] usb 6-1: SerialNumber: syz [ 934.303886][T24175] usb 6-1: config 0 descriptor?? [ 934.374459][T28731] Buffer I/O error on dev loop6, logical block 0, async page read [ 934.419706][T28731] Dev loop6: unable to read RDB block 0 [ 934.479458][T28731] loop6: unable to read partition table [ 934.557631][T28731] loop_reread_partitions: partition scan of loop6 ( 6tPΪŔA8*V^3c) failed (rc=-5) [ 934.733882][T24175] iforce 6-1:0.0: usb_submit_urb failed: -32 [ 934.742549][T24175] input input93: Device does not respond to id packet M [ 934.798872][T24175] iforce 6-1:0.0: usb_submit_urb failed: -32 [ 934.824240][T24175] input input93: Device does not respond to id packet P [ 935.032890][T24175] iforce 6-1:0.0: usb_submit_urb failed: -71 [ 935.052118][T24175] input input93: Device does not respond to id packet N [ 935.072777][T24175] iforce 6-1:0.0: usb_submit_urb failed: -71 [ 935.093818][T24175] iforce 6-1:0.0: usb_submit_urb failed: -71 [ 935.108981][T24175] iforce 6-1:0.0: usb_submit_urb failed: -71 [ 935.124812][T24175] iforce 6-1:0.0: usb_submit_urb failed: -71 [ 935.147264][T24175] input: Unknown I-Force Device [%04x:%04x] as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/input/input93 [ 935.229171][T24175] usb 6-1: USB disconnect, device number 24 [ 935.518980][T28801] kernel read not supported for file /eth0 (pid: 28801 comm: syz.7.9664) [ 935.559844][ T30] kauditd_printk_skb: 85 callbacks suppressed [ 935.559864][ T30] audit: type=1800 audit(1749914199.718:4144): pid=28801 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.9664" name="eth0" dev="mqueue" ino=113224 res=0 errno=0 [ 936.036608][T28818] ip6gre1: entered allmulticast mode [ 936.543311][T28838] ALSA: mixer_oss: invalid OSS volume '1' [ 936.573973][T28838] ALSA: mixer_oss: invalid OSS volume 'Ip6InAddrErrors' [ 936.581098][T28838] ALSA: mixer_oss: invalid OSS volume 'Ip6InUnknownProtos' [ 936.632369][T28838] ALSA: mixer_oss: invalid OSS volume 'Ip6InTruncatedPkts' [ 936.653909][T28838] ALSA: mixer_oss: invalid OSS volume 'Ip6InDiscards' [ 936.679398][T28838] ALSA: mixer_oss: invalid OSS volume 'Ip6InDelivers' [ 936.746123][T28850] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 936.815175][T28850] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 937.144269][T25685] usb 7-1: USB disconnect, device number 13 [ 937.146696][T28860] netlink: 'syz.7.9682': attribute type 4 has an invalid length. [ 937.161477][T25685] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 937.212817][T25685] cp210x 7-1:0.0: device disconnected [ 939.113976][T24179] usb 7-1: new high-speed USB device number 14 using dummy_hcd [ 939.287107][T24179] usb 7-1: Using ep0 maxpacket: 32 [ 939.313245][T24179] usb 7-1: config 0 has an invalid interface number: 235 but max is 0 [ 939.338933][T24179] usb 7-1: config 0 has no interface number 0 [ 939.376353][T24179] usb 7-1: New USB device found, idVendor=085a, idProduct=0009, bcdDevice=a3.47 [ 939.431654][T24179] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 939.460176][T24179] usb 7-1: Product: syz [ 939.471653][T24179] usb 7-1: Manufacturer: syz [ 939.498485][T24179] usb 7-1: SerialNumber: syz [ 939.547844][T24179] usb 7-1: config 0 descriptor?? [ 939.664516][ T5928] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 939.824522][ T5928] usb 6-1: Using ep0 maxpacket: 16 [ 939.833198][ T5928] usb 6-1: config 0 has an invalid interface number: 217 but max is 0 [ 939.868807][T24179] kaweth 7-1:0.235: Firmware present in device. [ 939.877833][ T5928] usb 6-1: config 0 has no interface number 0 [ 939.903092][ T5928] usb 6-1: New USB device found, idVendor=17e9, idProduct=0d52, bcdDevice=9b.89 [ 939.925809][ T5928] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 939.943574][ T5928] usb 6-1: Product: syz [ 939.957116][ T5928] usb 6-1: Manufacturer: syz [ 939.962051][ T5928] usb 6-1: SerialNumber: syz [ 939.978146][ T5928] usb 6-1: config 0 descriptor?? [ 940.015181][T24179] kaweth 7-1:0.235: Statistics collection: 0 [ 940.027217][T28923] : renamed from bond0 [ 940.041516][T24179] kaweth 7-1:0.235: Multicast filter limit: 0 [ 940.060619][T24179] kaweth 7-1:0.235: MTU: 0 [ 940.077794][T24179] kaweth 7-1:0.235: Read MAC address 00:00:00:00:00:00 [ 940.241942][ T5928] udl 6-1:0.217: [drm] Unrecognized vendor firmware descriptor [ 940.267402][ T5928] [drm:udl_init] *ERROR* Selecting channel failed [ 940.307782][ T5928] [drm] Initialized udl 0.0.1 for 6-1:0.217 on minor 2 [ 940.320545][ T5928] [drm] Initialized udl on minor 2 [ 940.330316][ T5928] udl 6-1:0.217: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 940.343317][ T5928] udl 6-1:0.217: [drm] Cannot find any crtc or sizes [ 940.353400][T25685] udl 6-1:0.217: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 940.366876][ T5928] usb 6-1: USB disconnect, device number 25 [ 940.376092][T25685] udl 6-1:0.217: [drm] Cannot find any crtc or sizes [ 940.439553][T24175] usb 4-1: new full-speed USB device number 94 using dummy_hcd [ 940.608580][T24175] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 940.625579][T24179] kaweth 7-1:0.235: kaweth interface created at eth9 [ 940.641913][T24175] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 940.665774][T24175] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 940.675124][T24175] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 940.838238][T24179] usb 7-1: USB disconnect, device number 14 [ 940.947894][T24175] usb 4-1: usb_control_msg returned -32 [ 940.955117][T24175] usbtmc 4-1:16.0: can't read capabilities [ 943.114178][T24175] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 943.237810][T24179] usb 4-1: USB disconnect, device number 94 [ 943.245930][T29000] netlink: 'syz.6.9722': attribute type 1 has an invalid length. [ 943.331408][T24175] usb 2-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 943.401969][T24175] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 943.418049][T29003] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 943.462538][T24175] usb 2-1: config 0 descriptor?? [ 943.468063][T29004] bond1: entered allmulticast mode [ 943.509049][T29004] 8021q: adding VLAN 0 to HW filter on device bond1 [ 943.518176][T24175] cp210x 2-1:0.0: cp210x converter detected [ 943.954993][T24175] cp210x 2-1:0.0: failed to get vendor val 0x0010 size 3: -32 [ 943.998118][T24175] usb 2-1: cp210x converter now attached to ttyUSB0 [ 944.047104][T29016] netlink: 28 bytes leftover after parsing attributes in process `syz.6.9727'. [ 944.058006][T29016] netlink: 'syz.6.9727': attribute type 7 has an invalid length. [ 944.070594][T29016] netlink: 'syz.6.9727': attribute type 8 has an invalid length. [ 944.078466][T29016] netlink: 4 bytes leftover after parsing attributes in process `syz.6.9727'. [ 944.210284][T24175] usb 2-1: USB disconnect, device number 104 [ 944.241087][T24175] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 944.279348][T24175] cp210x 2-1:0.0: device disconnected [ 944.576708][T19292] Bluetooth: hci4: Unknown advertising packet type: 0x75 [ 944.576786][T19292] Bluetooth: hci4: Unknown advertising packet type: 0x20 [ 944.586477][T19292] Bluetooth: hci4: Malformed LE Event: 0x0d [ 944.978553][ T30] audit: type=1326 audit(1749914209.138:4145): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29044 comm="syz.1.9738" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fc44e52ab19 code=0x7ffc0000 [ 945.039000][ T30] audit: type=1326 audit(1749914209.138:4146): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29044 comm="syz.1.9738" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fc44e52ab19 code=0x7ffc0000 [ 945.282126][ T30] audit: type=1326 audit(1749914209.138:4147): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29044 comm="syz.1.9738" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fc44e52ab19 code=0x7ffc0000 [ 945.392144][ T30] audit: type=1326 audit(1749914209.138:4148): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29044 comm="syz.1.9738" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fc44e52ab19 code=0x7ffc0000 [ 945.461473][ T30] audit: type=1326 audit(1749914209.138:4149): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29044 comm="syz.1.9738" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fc44e52ab19 code=0x7ffc0000 [ 945.485373][ T30] audit: type=1326 audit(1749914209.138:4150): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29044 comm="syz.1.9738" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fc44e52ab19 code=0x7ffc0000 [ 945.520471][ T30] audit: type=1326 audit(1749914209.138:4151): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29044 comm="syz.1.9738" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fc44e52ab19 code=0x7ffc0000 [ 945.554653][ T30] audit: type=1326 audit(1749914209.138:4152): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29044 comm="syz.1.9738" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fc44e52ab19 code=0x7ffc0000 [ 945.578447][ T30] audit: type=1326 audit(1749914209.138:4153): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29044 comm="syz.1.9738" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fc44e52ab19 code=0x7ffc0000 [ 945.617613][ T30] audit: type=1326 audit(1749914209.138:4154): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29044 comm="syz.1.9738" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fc44e52ab19 code=0x7ffc0000 [ 946.973870][T24175] usb 2-1: new high-speed USB device number 105 using dummy_hcd [ 947.176342][T24175] usb 2-1: Using ep0 maxpacket: 16 [ 947.188943][T24175] usb 2-1: config 0 has an invalid interface number: 41 but max is 0 [ 947.215295][T24175] usb 2-1: config 0 has no interface number 0 [ 947.223610][T24175] usb 2-1: too many endpoints for config 0 interface 41 altsetting 2: 171, using maximum allowed: 30 [ 947.282791][T24175] usb 2-1: config 0 interface 41 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 947.324715][T24175] usb 2-1: config 0 interface 41 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 947.387029][T24175] usb 2-1: config 0 interface 41 altsetting 2 has 2 endpoint descriptors, different from the interface descriptor's value: 171 [ 947.447986][T24175] usb 2-1: config 0 interface 41 has no altsetting 0 [ 947.468624][T24175] usb 2-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 947.493713][T24175] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 947.501800][T24175] usb 2-1: Product: syz [ 947.539210][T24175] usb 2-1: Manufacturer: syz [ 947.550592][T24175] usb 2-1: SerialNumber: syz [ 947.575854][T24175] usb 2-1: config 0 descriptor?? [ 947.584273][T29078] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 947.593975][T29078] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 947.825593][T29078] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 947.833015][T29078] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 948.404413][ T5928] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 948.522758][T24175] CoreChips 2-1:0.41 (unnamed net_device) (uninitialized): sr_get_phy_addr : Error reading PHYID register:ffffffe0 [ 948.567612][ T5928] usb 7-1: config 0 has an invalid interface number: 117 but max is 0 [ 948.582922][ T5928] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 948.603625][ T5928] usb 7-1: config 0 has no interface number 0 [ 948.624225][ T5928] usb 7-1: too many endpoints for config 0 interface 117 altsetting 0: 239, using maximum allowed: 30 [ 948.642388][ T5928] usb 7-1: config 0 interface 117 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 239 [ 948.665695][ T5928] usb 7-1: New USB device found, idVendor=0742, idProduct=2009, bcdDevice=61.46 [ 948.680885][ T5928] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 948.690476][ T5928] usb 7-1: Product: syz [ 948.698665][ T5928] usb 7-1: Manufacturer: syz [ 948.707677][ T5928] usb 7-1: SerialNumber: syz [ 948.725284][ T5928] usb 7-1: config 0 descriptor?? [ 948.747681][ T5928] HFC-S_USB 7-1:0.117: probe with driver HFC-S_USB failed with error -5 [ 948.757475][T24175] CoreChips 2-1:0.41 (unnamed net_device) (uninitialized): Failed to send software reset:ffffffb9 [ 948.789202][T24175] CoreChips 2-1:0.41 (unnamed net_device) (uninitialized): Failed to power down PHY : -71 [ 948.820895][T24175] CoreChips 2-1:0.41: probe with driver CoreChips failed with error -71 [ 948.868469][T24175] usb 2-1: USB disconnect, device number 105 [ 948.876407][T29106] veth0_to_bond: entered promiscuous mode [ 948.917077][T29106] veth0_to_bond: left promiscuous mode [ 949.226985][T24175] usb 7-1: USB disconnect, device number 15 [ 949.427836][T29122] input: syz0 as /devices/virtual/input/input94 [ 949.560293][T29125] ALSA: seq fatal error: cannot create timer (-16) [ 950.381523][T29144] input: syz1 as /devices/virtual/input/input95 [ 950.473845][T24176] usb 2-1: new full-speed USB device number 106 using dummy_hcd [ 950.698452][T24176] usb 2-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 950.708377][T24176] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 950.745270][T24176] usb 2-1: config 0 descriptor?? [ 951.002398][T24176] udl 2-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 951.087105][T24176] [drm] Initialized udl 0.0.1 for 2-1:0.0 on minor 2 [ 951.131495][T24176] [drm] Initialized udl on minor 2 [ 951.441019][T29160] netlink: 'syz.6.9786': attribute type 4 has an invalid length. [ 951.447727][T24176] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 1 failed err ffffffb9 [ 951.474969][T24176] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 951.492891][T24175] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 951.509894][T24176] usb 2-1: USB disconnect, device number 106 [ 951.524214][T24175] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 951.915739][T29174] loop7: detected capacity change from 0 to 16384 [ 951.973071][ T30] kauditd_printk_skb: 920 callbacks suppressed [ 951.973092][ T30] audit: type=1326 audit(1749914216.128:5075): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29172 comm="syz.5.9793" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f638392ab19 code=0x7ffc0000 [ 952.084253][ T30] audit: type=1326 audit(1749914216.128:5076): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29172 comm="syz.5.9793" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f638398e929 code=0x7ffc0000 [ 952.292658][ T30] audit: type=1326 audit(1749914216.128:5077): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29172 comm="syz.5.9793" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f638392ab19 code=0x7ffc0000 [ 952.497852][ T30] audit: type=1326 audit(1749914216.168:5078): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29172 comm="syz.5.9793" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f638392ab19 code=0x7ffc0000 [ 952.562261][ T30] audit: type=1326 audit(1749914216.168:5079): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29172 comm="syz.5.9793" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f638392ab19 code=0x7ffc0000 [ 952.631494][ T30] audit: type=1326 audit(1749914216.168:5080): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29172 comm="syz.5.9793" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f638392ab19 code=0x7ffc0000 [ 952.744358][ T30] audit: type=1326 audit(1749914216.168:5081): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29172 comm="syz.5.9793" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f638392ab19 code=0x7ffc0000 [ 952.893411][ T30] audit: type=1326 audit(1749914216.168:5082): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29172 comm="syz.5.9793" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f638392ab19 code=0x7ffc0000 [ 953.020400][ T30] audit: type=1326 audit(1749914216.168:5083): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29172 comm="syz.5.9793" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f638392ab19 code=0x7ffc0000 [ 953.175908][ T30] audit: type=1326 audit(1749914216.168:5084): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29172 comm="syz.5.9793" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f638392ab19 code=0x7ffc0000 [ 953.857897][T29203] bridge0: port 3(syz_tun) entered blocking state [ 953.866425][T29203] bridge0: port 3(syz_tun) entered disabled state [ 953.873485][T29203] syz_tun: entered allmulticast mode [ 953.886257][T29203] syz_tun: entered promiscuous mode [ 953.894805][T29203] bridge0: port 3(syz_tun) entered blocking state [ 953.902099][T29203] bridge0: port 3(syz_tun) entered forwarding state [ 954.338445][T29216] input: syz0 as /devices/virtual/input/input96 [ 955.272278][T29245] netlink: 'syz.7.9823': attribute type 13 has an invalid length. [ 955.519009][T29245] bridge0: port 3(syz_tun) entered disabled state [ 955.551356][T29245] bridge0: port 2(bridge_slave_1) entered disabled state [ 955.559334][T29245] bridge0: port 1(bridge_slave_0) entered disabled state [ 956.005342][T29245] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 956.089310][T29245] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 956.461717][T29245] netdevsim netdevsim7 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 956.482755][T29245] netdevsim netdevsim7 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 956.517461][T29245] netdevsim netdevsim7 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 956.533316][T29245] netdevsim netdevsim7 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 956.612040][T29285] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9838'. [ 956.743321][T29279] syzkaller1: entered promiscuous mode [ 956.756856][T29279] syzkaller1: entered allmulticast mode [ 956.774735][T29285] bridge0: port 3(batadv0) entered disabled state [ 956.793278][T29285] bridge_slave_0: left allmulticast mode [ 956.810812][T29285] bridge_slave_0: left promiscuous mode [ 956.826142][T29285] bridge0: port 1(bridge_slave_0) entered disabled state [ 956.859094][T29285] bridge_slave_1: left promiscuous mode [ 956.865930][T29285] bridge0: port 2(bridge_slave_1) entered disabled state [ 956.889190][T29285] : (slave bond_slave_0): Releasing backup interface [ 956.900819][T29285] : (slave bond_slave_1): Releasing backup interface [ 956.913396][T29285] team0: Port device team_slave_1 removed [ 956.921906][T29285] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 956.932124][T29285] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 957.374712][ T5928] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 957.534332][ T5928] usb 6-1: Using ep0 maxpacket: 32 [ 957.552203][ T5928] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 957.669543][ T5928] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 957.693342][ T5928] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 957.714345][ T5928] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 957.736371][ T5928] usb 6-1: config 0 descriptor?? [ 957.756109][ T5928] hub 6-1:0.0: USB hub found [ 957.953432][ T5928] hub 6-1:0.0: 1 port detected [ 958.575969][ T5928] hub 6-1:0.0: activate --> -90 [ 958.994870][ T5845] usb 6-1: USB disconnect, device number 26 [ 959.238351][ T5928] usb 6-1-port1: config error [ 959.329294][T29346] input: syz0 as /devices/virtual/input/input97 [ 959.841683][T29360] vlan2: entered allmulticast mode [ 959.856841][T29360] macvtap0: entered allmulticast mode [ 960.769375][T29380] netlink: 4 bytes leftover after parsing attributes in process `syz.7.9879'. [ 960.790949][T29380] syz_tun: left allmulticast mode [ 960.803018][T29380] syz_tun: left promiscuous mode [ 960.812335][T29380] bridge0: port 3(syz_tun) entered disabled state [ 960.841996][T29380] bridge_slave_0: left allmulticast mode [ 960.854283][T29380] bridge_slave_0: left promiscuous mode [ 960.884877][T29380] bridge0: port 1(bridge_slave_0) entered disabled state [ 960.917319][T29380] bridge_slave_1: left allmulticast mode [ 960.923040][T29380] bridge_slave_1: left promiscuous mode [ 960.958414][T29380] bridge0: port 2(bridge_slave_1) entered disabled state [ 960.994989][T29380] bond0: (slave bond_slave_0): Releasing backup interface [ 961.025773][T29380] bond0: (slave bond_slave_1): Releasing backup interface [ 961.065832][T29380] team0: Port device team_slave_0 removed [ 961.079111][T29380] team0: Port device team_slave_1 removed [ 961.088727][T29380] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 961.101521][T29380] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 961.363823][T19292] Bluetooth: hci3: command 0x0406 tx timeout [ 961.364193][ T5928] Bluetooth: hci3: Opcode 0x0c1a failed: -110 [ 961.384207][ T5928] Bluetooth: hci3: Error when powering off device on rfkill (-110) [ 963.291639][T29445] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 963.301518][T29445] syzkaller1: Refused to change device type [ 963.524396][ T5928] Bluetooth: hci4: Opcode 0x0c1a failed: -110 [ 963.530631][ T5928] Bluetooth: hci4: Error when powering off device on rfkill (-110) [ 963.534390][ T5839] Bluetooth: hci4: command 0x0c1a tx timeout [ 964.394403][T24077] usb 4-1: new high-speed USB device number 95 using dummy_hcd [ 964.554431][T24077] usb 4-1: Using ep0 maxpacket: 32 [ 964.562465][T24077] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 964.574303][T24077] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 964.586050][T24077] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 964.595214][T24077] usb 4-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 964.603579][T24077] usb 4-1: Product: syz [ 964.608529][T24077] usb 4-1: Manufacturer: syz [ 964.623266][T24077] hub 4-1:4.0: USB hub found [ 964.834228][T24077] hub 4-1:4.0: 2 ports detected [ 965.447549][T24077] usb 4-1: USB disconnect, device number 95 [ 965.684379][T19292] Bluetooth: hci2: command 0x0c1a tx timeout [ 965.684404][ T5928] Bluetooth: hci2: Opcode 0x0c1a failed: -110 [ 965.700957][ T5928] Bluetooth: hci2: Error when powering off device on rfkill (-110) [ 966.219718][T29487] netlink: 4 bytes leftover after parsing attributes in process `syz.5.9921'. [ 966.247888][T29487] netlink: 4 bytes leftover after parsing attributes in process `syz.5.9921'. [ 966.544315][ T5928] usb 2-1: new high-speed USB device number 107 using dummy_hcd [ 966.643907][T24172] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 966.704304][ T5928] usb 2-1: Using ep0 maxpacket: 32 [ 966.718677][ T5928] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 966.741433][ T5928] usb 2-1: config 0 has no interface number 0 [ 966.776843][ T5928] usb 2-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 966.799616][ T5928] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 966.808469][ T5928] usb 2-1: Product: syz [ 966.812784][ T5928] usb 2-1: Manufacturer: syz [ 966.818146][ T5928] usb 2-1: SerialNumber: syz [ 966.823891][T24172] usb 6-1: Using ep0 maxpacket: 16 [ 966.830395][ T5928] usb 2-1: config 0 descriptor?? [ 966.849121][T24172] usb 6-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=9c.15 [ 966.849842][ T5928] usb 2-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 966.868660][ T5928] usb 2-1: selecting invalid altsetting 1 [ 966.870692][T24172] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 966.875590][ T5928] usb 2-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 966.885829][T24172] usb 6-1: Product: syz [ 966.901181][T24172] usb 6-1: Manufacturer: syz [ 966.908699][ T5928] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 966.910708][T24172] usb 6-1: SerialNumber: syz [ 966.926902][ T5928] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 966.947129][T24172] usb 6-1: config 0 descriptor?? [ 966.951268][ T5928] usb 2-1: media controller created [ 966.963495][T24172] ssu100 6-1:0.0: Quatech SSU-100 USB to Serial Driver converter detected [ 967.010609][ T5928] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 967.592807][T29499] netlink: 4 bytes leftover after parsing attributes in process `syz.6.9926'. [ 967.695375][T29499] bridge_slave_0: left allmulticast mode [ 967.701149][T29499] bridge_slave_0: left promiscuous mode [ 967.714767][T29499] bridge0: port 1(bridge_slave_0) entered disabled state [ 967.740587][T29499] bridge_slave_1: left allmulticast mode [ 967.750449][T29499] bridge_slave_1: left promiscuous mode [ 967.760557][T29499] bridge0: port 2(bridge_slave_1) entered disabled state [ 967.781218][T24172] ssu100 6-1:0.0: probe with driver ssu100 failed with error -71 [ 967.822056][T24172] usb 6-1: USB disconnect, device number 27 [ 967.839041][T29499] bond0: (slave bond_slave_0): Releasing backup interface [ 967.917648][T29499] bond0: (slave bond_slave_1): Releasing backup interface [ 967.959559][ T30] kauditd_printk_skb: 148 callbacks suppressed [ 967.959581][ T30] audit: type=1326 audit(1749914232.118:5233): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29507 comm="syz.3.9930" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f5aa978e929 code=0x0 [ 968.022206][T29499] team0: Port device team_slave_0 removed [ 968.085967][ T5928] usb 2-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 968.086705][T29499] team0: Port device team_slave_1 removed [ 968.093573][ T5928] zl10353_read_register: readreg error (reg=127, ret==-110) [ 968.117009][ T5928] usb 2-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 968.160339][T29499] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 968.178563][T29499] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 968.195570][T29499] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 968.203257][T29499] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 968.219922][ T5928] usb 2-1: USB disconnect, device number 107 [ 968.519988][T29520] netlink: 8 bytes leftover after parsing attributes in process `syz.5.9935'. [ 968.903215][T29536] netlink: 'syz.3.9941': attribute type 1 has an invalid length. [ 969.070638][T29536] 8021q: adding VLAN 0 to HW filter on device bond0 [ 969.081151][T29542] kAFS: unable to lookup cell '.,' [ 969.119677][T29538] bond0: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 969.301963][T29551] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9945'. [ 969.334750][T29551] bond0: (slave bond_slave_0): Releasing backup interface [ 969.375285][T29551] bond_slave_0: left promiscuous mode [ 969.424729][T29551] bond0: (slave bond_slave_1): Releasing backup interface [ 969.458978][T29551] bond_slave_1: left promiscuous mode [ 969.480066][T29551] team0: Port device team_slave_0 removed [ 969.497685][T29551] team0: Port device team_slave_1 removed [ 969.505946][T29551] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 969.530131][T29551] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 969.561013][T29551] team0: Port device macvlan0 removed [ 970.753857][T24172] usb 2-1: new high-speed USB device number 108 using dummy_hcd [ 970.871436][T29593] input: syz1 as /devices/virtual/input/input98 [ 970.924181][T24172] usb 2-1: Using ep0 maxpacket: 32 [ 970.962760][T24172] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 971.003434][T24172] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 971.071168][T24172] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2ced, bcdDevice= 0.00 [ 971.095773][T24172] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 971.174386][T24172] usb 2-1: config 0 descriptor?? [ 971.618032][T24172] kone 0003:1E7D:2CED.0092: unknown main item tag 0x0 [ 971.653694][T24172] kone 0003:1E7D:2CED.0092: unknown main item tag 0x0 [ 971.691540][T24172] kone 0003:1E7D:2CED.0092: hidraw0: USB HID v0.00 Device [HID 1e7d:2ced] on usb-dummy_hcd.1-1/input0 [ 971.805900][T29582] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 971.824390][T29582] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 971.884182][T24172] kone 0003:1E7D:2CED.0092: couldn't init struct kone_device [ 971.922502][T24172] kone 0003:1E7D:2CED.0092: couldn't install mouse [ 971.958135][T29616] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 971.968396][T24172] kone 0003:1E7D:2CED.0092: probe with driver kone failed with error -5 [ 972.025069][T24172] usb 2-1: USB disconnect, device number 108 [ 972.350483][T29631] netlink: 'syz.5.9977': attribute type 3 has an invalid length. [ 972.358713][T29631] netlink: 199824 bytes leftover after parsing attributes in process `syz.5.9977'. [ 972.816613][ T30] audit: type=1326 audit(1749914236.978:5234): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29637 comm="syz.5.9980" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f638392ab19 code=0x7ffc0000 [ 972.843913][T24175] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 972.869639][ T30] audit: type=1326 audit(1749914236.978:5235): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29637 comm="syz.5.9980" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f638398e929 code=0x7ffc0000 [ 972.898586][ T30] audit: type=1326 audit(1749914236.978:5236): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29637 comm="syz.5.9980" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f638392ab19 code=0x7ffc0000 [ 972.921555][ T30] audit: type=1326 audit(1749914236.978:5237): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29637 comm="syz.5.9980" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f638392ab19 code=0x7ffc0000 [ 972.944476][ T30] audit: type=1326 audit(1749914236.978:5238): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29637 comm="syz.5.9980" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f638398e929 code=0x7ffc0000 [ 973.030933][ T30] audit: type=1326 audit(1749914237.008:5239): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29637 comm="syz.5.9980" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f638392ab19 code=0x7ffc0000 [ 973.095262][ T30] audit: type=1326 audit(1749914237.008:5240): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29637 comm="syz.5.9980" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f638392ab19 code=0x7ffc0000 [ 973.128103][T24175] usb 7-1: Using ep0 maxpacket: 32 [ 973.164060][T24175] usb 7-1: config 0 has an invalid interface number: 51 but max is 0 [ 973.172209][T24175] usb 7-1: config 0 has no interface number 0 [ 973.190735][T24175] usb 7-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 973.203016][T24175] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 973.223115][T24175] usb 7-1: Product: syz [ 973.236010][T24175] usb 7-1: Manufacturer: syz [ 973.240975][T24175] usb 7-1: SerialNumber: syz [ 973.274250][ T30] audit: type=1326 audit(1749914237.018:5241): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29637 comm="syz.5.9980" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f638392ab19 code=0x7ffc0000 [ 973.294739][T24175] usb 7-1: config 0 descriptor?? [ 973.367710][T24175] quatech2 7-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 973.414332][ T30] audit: type=1326 audit(1749914237.018:5242): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29637 comm="syz.5.9980" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f638392ab19 code=0x7ffc0000 [ 973.473253][ T30] audit: type=1326 audit(1749914237.018:5243): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29637 comm="syz.5.9980" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f638392ab19 code=0x7ffc0000 [ 973.554311][ T30] audit: type=1326 audit(1749914237.018:5244): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29637 comm="syz.5.9980" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f638398e929 code=0x7ffc0000 [ 973.581477][ T30] audit: type=1326 audit(1749914237.018:5245): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29637 comm="syz.5.9980" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f638398e929 code=0x7ffc0000 [ 973.609225][ T30] audit: type=1326 audit(1749914237.018:5246): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29637 comm="syz.5.9980" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f638392ab19 code=0x7ffc0000 [ 973.635025][ T30] audit: type=1326 audit(1749914237.018:5247): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29637 comm="syz.5.9980" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f638398e929 code=0x7ffc0000 [ 973.696556][ T30] audit: type=1326 audit(1749914237.018:5248): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29637 comm="syz.5.9980" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f638398e929 code=0x7ffc0000 [ 973.708379][T29640] veth1_macvtap: left promiscuous mode [ 973.860614][T29640] veth1_macvtap: entered promiscuous mode [ 973.909184][T24175] usb 7-1: qt2_attach - failed to power on unit: -71 [ 973.927496][T24175] quatech2 7-1:0.51: probe with driver quatech2 failed with error -71 [ 973.944280][T24175] usb 7-1: USB disconnect, device number 16 [ 973.972402][T29664] loop7: detected capacity change from 0 to 16384 [ 974.221101][T29669] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9992'. [ 974.231890][T29669] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9992'. [ 974.825789][ T49] veth1_macvtap: left promiscuous mode [ 974.904166][T24179] usb 7-1: new high-speed USB device number 17 using dummy_hcd [ 975.067452][T24179] usb 7-1: Using ep0 maxpacket: 16 [ 975.091099][T24179] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 975.107070][T24179] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 975.121258][T24179] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 975.145716][T24179] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 975.171780][T24179] usb 7-1: Product: syz [ 975.180322][T24179] usb 7-1: Manufacturer: syz [ 975.189090][T24179] usb 7-1: SerialNumber: syz [ 975.394551][ T43] usb 2-1: new high-speed USB device number 109 using dummy_hcd [ 975.564426][ T43] usb 2-1: Using ep0 maxpacket: 16 [ 975.573149][ T43] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 975.588722][ T43] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 975.601953][ T43] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 975.616889][ T43] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 975.626594][ T43] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 975.638199][T24179] usb 7-1: cannot find UAC_HEADER [ 975.654495][ T43] usb 2-1: Product: syz [ 975.659008][ T43] usb 2-1: Manufacturer: syz [ 975.664348][ T43] usb 2-1: SerialNumber: syz [ 975.682621][T24179] snd-usb-audio 7-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 975.702588][T24179] usb 7-1: USB disconnect, device number 17 [ 975.729069][ T5939] udevd[5939]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 976.092591][ T43] usb 2-1: 0:2 : does not exist [ 976.524744][T29720] gre0: entered allmulticast mode [ 976.563092][T29720] pimreg: entered allmulticast mode [ 976.628573][T29723] pimreg: left allmulticast mode [ 976.634469][T25685] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 976.799538][ T43] usb 2-1: USB disconnect, device number 109 [ 976.801283][T29717] gre0: left allmulticast mode [ 976.806183][T25685] usb 6-1: Using ep0 maxpacket: 8 [ 976.838154][T25685] usb 6-1: config 179 has an invalid interface number: 65 but max is 0 [ 976.869448][T25685] usb 6-1: config 179 has no interface number 0 [ 976.885063][T25685] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 976.889923][ T5939] udevd[5939]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 976.904160][T25685] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 976.975689][T25685] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 20, changing to 8 [ 977.014633][T25685] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 57696, setting to 1024 [ 977.028892][T25685] usb 6-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 977.069936][T25685] usb 6-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 977.094184][T25685] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 977.126430][T29715] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 977.538783][T25685] input: Generic X-Box pad as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:179.65/input/input99 [ 977.663232][T29744] vivid-002: disconnect [ 977.671316][T29743] vivid-002: reconnect [ 977.725734][T29746] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 977.777355][T29715] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 977.779538][T29748] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 977.814955][T29715] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 978.090788][ T5928] usb 6-1: USB disconnect, device number 28 [ 978.090857][ C1] xpad 6-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 978.105192][ C1] xpad 6-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 978.129919][ T5928] xpad 6-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 978.243282][ T30] kauditd_printk_skb: 89 callbacks suppressed [ 978.243304][ T30] audit: type=1326 audit(1749914242.398:5338): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29756 comm="syz.1.10033" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc44e58e929 code=0x0 [ 978.826225][ T30] audit: type=1326 audit(1749914242.988:5339): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29777 comm="syz.5.10041" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f638398e929 code=0x0 [ 979.043998][T24172] usb 4-1: new high-speed USB device number 96 using dummy_hcd [ 979.198946][T29789] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 979.219779][T24172] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 979.249337][T24172] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 979.273904][T24172] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 979.300291][T24172] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 979.344982][T29776] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 979.381876][T24172] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 979.609960][T24172] usb 4-1: USB disconnect, device number 96 [ 980.193772][T24172] usb 2-1: new high-speed USB device number 110 using dummy_hcd [ 980.367420][T24172] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 980.398546][T24172] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 980.428933][T24172] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 980.492249][T24172] usb 2-1: config 0 descriptor?? [ 980.694341][ T5928] usb 4-1: new low-speed USB device number 97 using dummy_hcd [ 980.791710][T24172] usbhid 2-1:0.0: can't add hid device: -71 [ 980.809474][T24172] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 980.839829][T24172] usb 2-1: USB disconnect, device number 110 [ 980.881727][ T5928] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 980.902377][ T5928] usb 4-1: config 0 has no interface number 0 [ 980.931429][ T5928] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 980.960839][ T5928] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 981.014511][ T5928] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 981.026303][ T5928] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 981.038659][ T5928] usb 4-1: config 0 descriptor?? [ 981.047561][T29829] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 981.102714][ T5928] iowarrior 4-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 981.154832][ T43] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 981.320297][ T43] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 981.352344][ T43] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 981.374244][T24172] usb 2-1: new high-speed USB device number 111 using dummy_hcd [ 981.379537][ C1] iowarrior 4-1:0.1: iowarrior_callback - usb_submit_urb failed with result -19 [ 981.409210][ T5928] usb 4-1: USB disconnect, device number 97 [ 981.428503][ T43] usb 6-1: New USB device found, idVendor=1e7d, idProduct=2d50, bcdDevice= 0.00 [ 981.463493][ T43] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 981.512323][ T43] usb 6-1: config 0 descriptor?? [ 981.567834][T24172] usb 2-1: Using ep0 maxpacket: 32 [ 981.579097][T24172] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 981.603712][T24172] usb 2-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 0.40 [ 981.612848][T24172] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 981.667325][T24172] usb 2-1: config 0 descriptor?? [ 981.681775][T24172] ldusb 2-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 981.705471][T24172] ldusb 2-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 981.910036][T24179] usb 2-1: USB disconnect, device number 111 [ 981.916286][ C0] ldusb 2-1:0.0: usb_submit_urb failed (-19) [ 981.941516][T24179] ldusb 2-1:0.0: LD USB Device #0 now disconnected [ 981.972641][ T43] kovaplus 0003:1E7D:2D50.0093: hidraw0: USB HID v0.00 Device [HID 1e7d:2d50] on usb-dummy_hcd.5-1/input0 [ 982.130544][T29812] ldusb: No device or device unplugged -19 [ 982.734489][T29869] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 982.774358][ T43] kovaplus 0003:1E7D:2D50.0093: couldn't init struct kovaplus_device [ 982.791244][ T43] kovaplus 0003:1E7D:2D50.0093: couldn't install mouse [ 982.807809][ T43] kovaplus 0003:1E7D:2D50.0093: probe with driver kovaplus failed with error -71 [ 982.839662][ T43] usb 6-1: USB disconnect, device number 29 [ 983.316665][T29889] input: syz1 as /devices/virtual/input/input100 [ 983.374061][ T30] audit: type=1326 audit(1749914247.528:5340): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29890 comm="syz.1.10085" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fc44e52ab19 code=0x7ffc0000 [ 983.468798][ T30] audit: type=1326 audit(1749914247.528:5341): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29890 comm="syz.1.10085" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fc44e52ab19 code=0x7ffc0000 [ 983.507809][ T30] audit: type=1326 audit(1749914247.528:5342): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29890 comm="syz.1.10085" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc44e58e929 code=0x7ffc0000 [ 983.561259][ T30] audit: type=1326 audit(1749914247.528:5343): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29890 comm="syz.1.10085" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fc44e52ab19 code=0x7ffc0000 [ 983.694312][ T30] audit: type=1326 audit(1749914247.528:5344): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29890 comm="syz.1.10085" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc44e58e929 code=0x7ffc0000 [ 983.791411][ T30] audit: type=1326 audit(1749914247.528:5345): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29890 comm="syz.1.10085" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc44e58e929 code=0x7ffc0000 [ 983.974272][ T30] audit: type=1326 audit(1749914247.528:5346): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29890 comm="syz.1.10085" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc44e58e929 code=0x7ffc0000 [ 984.055651][ T30] audit: type=1326 audit(1749914247.558:5347): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29890 comm="syz.1.10085" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fc44e52ab19 code=0x7ffc0000 [ 984.198918][ T30] audit: type=1326 audit(1749914247.558:5348): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29890 comm="syz.1.10085" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fc44e52ab19 code=0x7ffc0000 [ 984.214389][T29913] netlink: 'syz.5.10094': attribute type 10 has an invalid length. [ 984.250176][ T30] audit: type=1326 audit(1749914247.558:5349): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29890 comm="syz.1.10085" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc44e58e929 code=0x7ffc0000 [ 984.285899][T29913] syz_tun: entered promiscuous mode [ 984.311916][T29913] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 984.650340][T29923] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 984.772068][T29930] program syz.6.10102 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 984.798361][T29932] netlink: 12 bytes leftover after parsing attributes in process `syz.5.10103'. [ 984.854261][ T43] usb 4-1: new full-speed USB device number 98 using dummy_hcd [ 984.866241][T29932] 8021q: adding VLAN 0 to HW filter on device bond1 [ 984.957556][T29934] 8021q: adding VLAN 0 to HW filter on device bond1 [ 984.994835][T29934] bond1: (slave vcan1): The slave device specified does not support setting the MAC address [ 985.036684][ T43] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 985.064619][T29934] bond1: (slave vcan1): Error -95 calling set_mac_address [ 985.082235][ T43] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 985.114290][ T43] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 985.149238][ T43] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 985.222309][ T43] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 985.250003][ T43] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 985.275166][ T43] usb 4-1: Manufacturer: syz [ 985.320386][ T43] usb 4-1: config 0 descriptor?? [ 985.696170][ T43] rc_core: IR keymap rc-hauppauge not found [ 985.704338][ T43] Registered IR keymap rc-empty [ 985.712943][ T43] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 985.744478][ T43] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 985.788082][ T43] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 985.827746][ T43] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input101 [ 985.861114][ T43] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 985.897419][ T43] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 985.925141][ T43] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 985.944451][ T43] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 985.974493][ T43] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 985.994700][ T43] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 986.014267][ T43] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 986.034436][ T43] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 986.054236][ T43] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 986.075477][ T43] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 986.101265][ T43] mceusb 4-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 986.112622][ T43] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 986.141492][ T43] usb 4-1: USB disconnect, device number 98 [ 986.195691][T25685] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 986.336556][T29956] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 986.372296][T25685] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 986.404423][T25685] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 986.448589][T25685] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 986.463222][T25685] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 986.490234][T25685] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 986.512901][T25685] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 986.524330][T25685] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 986.532376][T25685] usb 6-1: Product: syz [ 986.552278][T25685] usb 6-1: Manufacturer: syz [ 986.572913][T25685] cdc_wdm 6-1:1.0: skipping garbage [ 986.583072][T25685] cdc_wdm 6-1:1.0: skipping garbage [ 986.615395][T25685] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 986.638434][T25685] cdc_wdm 6-1:1.0: Unknown control protocol [ 987.214298][ T43] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 987.361102][T25685] usb 6-1: USB disconnect, device number 30 [ 987.386866][ T43] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 987.421139][ T43] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 987.450580][ T43] usb 4-1: Product: syz [ 987.457608][ T43] usb 4-1: Manufacturer: syz [ 987.462261][ T43] usb 4-1: SerialNumber: syz [ 987.616343][T29975] netlink: 16 bytes leftover after parsing attributes in process `syz.5.10120'. [ 987.644290][T29975] netlink: 16 bytes leftover after parsing attributes in process `syz.5.10120'. [ 988.520585][ T43] cdc_ncm 4-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 988.528748][ T43] cdc_ncm 4-1:1.0: dwNtbInMaxSize=8 is too small. Using 2048 [ 988.545272][ T43] cdc_ncm 4-1:1.0: setting rx_max = 2048 [ 988.587566][T30002] netlink: 24 bytes leftover after parsing attributes in process `syz.1.10133'. [ 988.754485][ T43] cdc_ncm 4-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.3-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 988.791061][ T43] usb 4-1: USB disconnect, device number 99 [ 989.025794][ T43] cdc_ncm 4-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.3-1, CDC NCM (NO ZLP) [ 989.802496][T30025] lo: entered allmulticast mode [ 989.831340][T30023] lo: left allmulticast mode [ 989.959246][T30027] syzkaller1: entered promiscuous mode [ 990.004344][T30027] syzkaller1: entered allmulticast mode [ 992.570821][T30093] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 992.947044][T30107] team0: entered promiscuous mode [ 992.954923][T30107] batadv_slave_0: entered promiscuous mode [ 992.961608][T30105] batadv_slave_0: left promiscuous mode [ 992.978332][T30105] team0: left promiscuous mode [ 993.124345][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 993.144140][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 993.150512][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 994.066155][T24179] usb 7-1: new full-speed USB device number 18 using dummy_hcd [ 994.257862][T24179] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 994.275531][T24179] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 994.292756][T24179] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 994.320232][T24179] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 994.333471][T24179] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 994.359997][T24179] usb 7-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 994.379884][T24179] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 994.401279][T24179] usb 7-1: Product: syz [ 994.423701][T24179] usb 7-1: Manufacturer: syz [ 994.428566][T24179] usb 7-1: SerialNumber: syz [ 994.449662][T24179] usb 7-1: config 0 descriptor?? [ 994.556361][T24175] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 994.670883][T24179] radio-si470x 7-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 994.683681][T24179] radio-si470x 7-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 994.736201][T24175] usb 6-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 994.748055][T24175] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 994.761197][T24175] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 994.771739][T24175] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 994.787893][T24175] usb 6-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 994.797735][T24175] usb 6-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 994.807210][T24175] usb 6-1: Manufacturer: syz [ 994.817134][T24175] usb 6-1: config 0 descriptor?? [ 994.880064][T24179] radio-si470x 7-1:0.0: software version 0, hardware version 0 [ 994.893940][T24179] radio-si470x 7-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 994.923932][T24179] radio-si470x 7-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 995.081194][T24179] radio-si470x 7-1:0.0: submitting int urb failed (-90) [ 995.241487][T24175] appleir 0003:05AC:8243.0094: unknown main item tag 0x0 [ 995.264926][T24175] appleir 0003:05AC:8243.0094: No inputs registered, leaving [ 995.295040][T24175] appleir 0003:05AC:8243.0094: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.5-1/input0 [ 995.674459][T24175] usb 4-1: new high-speed USB device number 100 using dummy_hcd [ 995.687488][T24179] radio-si470x 7-1:0.0: si470x_set_report: usb_control_msg returned -71 [ 995.706808][T24179] radio-si470x 7-1:0.0: probe with driver radio-si470x failed with error -22 [ 995.754355][T24179] usb 7-1: USB disconnect, device number 18 [ 995.869858][T24175] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 995.896114][T24175] usb 4-1: config 1 has no interface number 0 [ 995.909441][T30170] netlink: 212376 bytes leftover after parsing attributes in process `syz.7.10203'. [ 995.924162][T24175] usb 4-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 995.944819][T24175] usb 4-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 995.963806][T24175] usb 4-1: config 1 interface 1 altsetting 1 has an endpoint descriptor with address 0x61, changing to 0x1 [ 995.983690][T24175] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 996.011485][T24175] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 996.053844][T24175] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 996.072695][T24175] usb 4-1: Product: syz [ 996.084817][T24175] usb 4-1: Manufacturer: syz [ 996.089994][T24175] usb 4-1: SerialNumber: syz [ 996.793272][T30182] binder: 30179:30182 ioctl c0306201 200000001a80 returned -14 [ 996.921547][T24175] cdc_ncm 4-1:1.1: bind() failure [ 997.124523][T24175] usb 4-1: USB disconnect, device number 100 [ 997.706044][T24077] usb 6-1: USB disconnect, device number 31 [ 998.230274][T30223] loop6: detected capacity change from 0 to 7 [ 998.275719][ T30] kauditd_printk_skb: 202 callbacks suppressed [ 998.275742][ T30] audit: type=1326 audit(1749914262.438:5552): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30224 comm="syz.5.10226" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f638398e929 code=0x0 [ 998.349992][T30223] Dev loop6: unable to read RDB block 7 [ 998.391806][T30223] loop6: AHDI p3 p4 [ 998.419947][T30223] loop6: partition table partially beyond EOD, truncated [ 998.475650][T30223] loop6: p3 start 1869967406 is beyond EOD, truncated [ 1000.033988][T24175] usb 7-1: new high-speed USB device number 19 using dummy_hcd [ 1000.187398][T24175] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1000.203873][T24175] usb 7-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1000.221537][T24175] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1000.239594][T24175] usb 7-1: config 0 descriptor?? [ 1000.714720][T24175] keytouch 0003:0926:3333.0095: fixing up Keytouch IEC report descriptor [ 1000.760197][T24175] input: HID 0926:3333 as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/0003:0926:3333.0095/input/input102 [ 1000.950259][T24175] keytouch 0003:0926:3333.0095: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.6-1/input0 [ 1001.571090][T24175] usb 7-1: USB disconnect, device number 19 [ 1002.352340][T30316] netlink: 'syz.7.10262': attribute type 1 has an invalid length. [ 1002.426342][T30316] bond1: entered promiscuous mode [ 1002.431578][T30316] bond1: entered allmulticast mode [ 1002.508870][T30319] bond1: (slave erspan1): making interface the new active one [ 1002.546293][T30319] erspan1: entered promiscuous mode [ 1002.551861][T30319] erspan1: entered allmulticast mode [ 1002.565560][T24077] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 1002.599162][T30319] bond1: (slave erspan1): Enslaving as an active interface with an up link [ 1002.631526][T30323] input: syz0 as /devices/virtual/input/input103 [ 1002.729395][T24077] usb 7-1: Using ep0 maxpacket: 32 [ 1002.762301][T24077] usb 7-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 1002.789491][T24077] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1002.819777][T24077] usb 7-1: config 0 descriptor?? [ 1002.843518][T24077] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 1003.482571][T30348] syzkaller1: entered promiscuous mode [ 1003.496573][T30348] syzkaller1: entered allmulticast mode [ 1003.593472][T30354] netlink: 28 bytes leftover after parsing attributes in process `syz.7.10278'. [ 1004.014288][T25685] usb 4-1: new high-speed USB device number 101 using dummy_hcd [ 1004.058710][T24077] gspca_nw80x: reg_w err -71 [ 1004.079537][T24077] nw80x 7-1:0.0: probe with driver nw80x failed with error -71 [ 1004.091780][T24077] usb 7-1: USB disconnect, device number 20 [ 1004.188264][T25685] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1004.214585][T25685] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1004.233531][T25685] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1004.264460][T25685] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1004.274515][T25685] usb 4-1: SerialNumber: syz [ 1004.333961][T24176] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 1004.397277][T30371] netlink: 4 bytes leftover after parsing attributes in process `syz.7.10286'. [ 1004.435117][T30371] netdevsim netdevsim7 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1004.445370][T30371] netdevsim netdevsim7 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1004.454868][T30371] netdevsim netdevsim7 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1004.463714][T30371] netdevsim netdevsim7 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1004.477336][T30371] vxlan0: entered promiscuous mode [ 1004.503901][T24176] usb 6-1: Using ep0 maxpacket: 8 [ 1004.511338][T24176] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 1004.525596][T24176] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1004.531233][T25685] usb 4-1: 0:2 : does not exist [ 1004.543730][T24176] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1004.560911][T25685] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 1004.565658][T24176] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1004.583856][T24176] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1004.606860][T25685] usb 4-1: 5:0: failed to get current value for ch 1 (-22) [ 1004.613752][T24176] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1004.633553][T24176] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1004.642611][T25685] usb 4-1: 5:0: failed to get current value for ch 16 (-22) [ 1004.709210][T25685] usb 4-1: USB disconnect, device number 101 [ 1004.807950][ T5939] udevd[5939]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1004.930424][T24176] usb 6-1: usb_control_msg returned -32 [ 1004.940011][T24176] usbtmc 6-1:16.0: can't read capabilities [ 1005.399873][T30383] usbtmc 6-1:16.0: usb_control_msg returned -32 [ 1005.518053][T30391] loop7: detected capacity change from 0 to 16384 [ 1005.536768][T24176] usb 6-1: USB disconnect, device number 32 [ 1005.924719][T25685] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 1006.086345][T25685] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1006.114858][T25685] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1006.138293][T25685] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1006.170759][T25685] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.33 [ 1006.181429][T25685] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1006.203259][T25685] usb 4-1: Product: syz [ 1006.215436][T25685] usb 4-1: Manufacturer: syz [ 1006.225372][T25685] usb 4-1: SerialNumber: syz [ 1006.256827][T25685] cdc_ncm 4-1:1.0: CDC Union missing and no IAD found [ 1006.290218][T25685] cdc_ncm 4-1:1.0: bind() failure [ 1006.781717][T30421] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1006.870931][T30426] input: syz0 as /devices/virtual/input/input104 [ 1007.245728][ T30] audit: type=1326 audit(1749914271.408:5553): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30440 comm="syz.1.10315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc44e58e929 code=0x7ffc0000 [ 1007.295938][ T30] audit: type=1326 audit(1749914271.408:5554): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30440 comm="syz.1.10315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc44e58e929 code=0x7ffc0000 [ 1007.324240][ T30] audit: type=1326 audit(1749914271.438:5555): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30440 comm="syz.1.10315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7fc44e58e929 code=0x7ffc0000 [ 1007.372572][ T30] audit: type=1326 audit(1749914271.438:5556): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30440 comm="syz.1.10315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc44e58e929 code=0x7ffc0000 [ 1007.445323][ T30] audit: type=1326 audit(1749914271.438:5557): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30440 comm="syz.1.10315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc44e58e929 code=0x7ffc0000 [ 1007.522807][ T30] audit: type=1326 audit(1749914271.448:5558): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30440 comm="syz.1.10315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=222 compat=0 ip=0x7fc44e58e929 code=0x7ffc0000 [ 1007.603886][ T30] audit: type=1326 audit(1749914271.448:5559): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30440 comm="syz.1.10315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc44e58e929 code=0x7ffc0000 [ 1007.667316][ T30] audit: type=1326 audit(1749914271.448:5560): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30440 comm="syz.1.10315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc44e58e929 code=0x7ffc0000 [ 1007.729230][ T30] audit: type=1326 audit(1749914271.478:5561): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30440 comm="syz.1.10315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=223 compat=0 ip=0x7fc44e58e929 code=0x7ffc0000 [ 1007.831532][ T30] audit: type=1326 audit(1749914271.478:5562): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30440 comm="syz.1.10315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fc44e52ab19 code=0x7ffc0000 [ 1008.362008][T30450] pim6reg1: entered promiscuous mode [ 1008.383728][T30450] pim6reg1: entered allmulticast mode [ 1008.686233][T24179] usb 4-1: USB disconnect, device number 102 [ 1009.338623][T30481] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(3) [ 1009.345319][T30481] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 1009.371713][T30481] vhci_hcd vhci_hcd.0: Device attached [ 1009.386215][T30483] vhci_hcd: connection closed [ 1009.400150][T13657] vhci_hcd: stop threads [ 1009.413114][T13657] vhci_hcd: release socket [ 1009.440204][T13657] vhci_hcd: disconnect device [ 1010.765311][T25685] usb 2-1: new high-speed USB device number 112 using dummy_hcd [ 1010.976130][T25685] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1011.000176][T25685] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1011.022655][T25685] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1011.058558][T25685] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1011.076660][T25685] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1011.135448][T25685] usb 2-1: config 0 descriptor?? [ 1011.573523][T25685] plantronics 0003:047F:FFFF.0096: No inputs registered, leaving [ 1011.621621][T25685] plantronics 0003:047F:FFFF.0096: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 1011.916522][T30524] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1011.928436][T30524] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1013.509172][T24176] usb 7-1: new high-speed USB device number 21 using dummy_hcd [ 1013.655218][T24179] usb 2-1: USB disconnect, device number 112 [ 1013.674358][T24176] usb 7-1: Using ep0 maxpacket: 32 [ 1013.692818][T24176] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1013.721339][T24176] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1013.734333][T24176] usb 7-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1013.749890][T24176] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1013.770024][T24176] usb 7-1: config 0 descriptor?? [ 1013.781051][T24176] hub 7-1:0.0: USB hub found [ 1013.833945][T24172] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 1013.984234][T24176] hub 7-1:0.0: 1 port detected [ 1013.999864][T24172] usb 6-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 1014.023690][T24172] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1014.052790][T24172] usb 6-1: config 0 descriptor?? [ 1014.598369][T24176] hub 7-1:0.0: activate --> -90 [ 1014.816063][ T30] kauditd_printk_skb: 176 callbacks suppressed [ 1014.816084][ T30] audit: type=1326 audit(1749914278.978:5739): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30574 comm="syz.3.10369" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5aa978e929 code=0x7ffc0000 [ 1014.887715][ T30] audit: type=1326 audit(1749914278.978:5740): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30574 comm="syz.3.10369" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5aa978e929 code=0x7ffc0000 [ 1014.913010][ T30] audit: type=1326 audit(1749914279.018:5741): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30574 comm="syz.3.10369" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f5aa978e929 code=0x7ffc0000 [ 1014.937594][ T30] audit: type=1326 audit(1749914279.018:5742): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30574 comm="syz.3.10369" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5aa978e929 code=0x7ffc0000 [ 1015.010417][ T30] audit: type=1326 audit(1749914279.018:5743): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30574 comm="syz.3.10369" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5aa978e929 code=0x7ffc0000 [ 1015.016720][T24077] usb 7-1: USB disconnect, device number 21 [ 1015.044569][ T30] audit: type=1326 audit(1749914279.028:5744): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30574 comm="syz.3.10369" exe="/root/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7f5aa978d197 code=0x7ffc0000 [ 1015.129871][ T30] audit: type=1326 audit(1749914279.028:5745): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30574 comm="syz.3.10369" exe="/root/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7f5aa97900ca code=0x7ffc0000 [ 1015.175300][ T30] audit: type=1326 audit(1749914279.028:5746): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30574 comm="syz.3.10369" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f5aa978d290 code=0x7ffc0000 [ 1015.198881][ T30] audit: type=1326 audit(1749914279.098:5747): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30574 comm="syz.3.10369" exe="/root/syz-executor" sig=0 arch=c000003e syscall=80 compat=0 ip=0x7f5aa978d677 code=0x7ffc0000 [ 1015.222878][ T30] audit: type=1326 audit(1749914279.118:5748): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30574 comm="syz.3.10369" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5aa978e929 code=0x7ffc0000 [ 1015.291249][T24172] usb 6-1: Cannot set autoneg [ 1015.304028][T24172] MOSCHIP usb-ethernet driver 6-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 1015.326700][T24172] usb 6-1: USB disconnect, device number 33 [ 1016.540132][T30619] netlink: 4 bytes leftover after parsing attributes in process `syz.6.10384'. [ 1016.576120][T24172] usb 2-1: new high-speed USB device number 113 using dummy_hcd [ 1016.581677][T30619] netdevsim netdevsim6 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1016.592899][T30619] netdevsim netdevsim6 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1016.602136][T30619] netdevsim netdevsim6 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1016.611493][T30619] netdevsim netdevsim6 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1016.622940][T30619] vxlan0: entered promiscuous mode [ 1016.736059][T24172] usb 2-1: config 1 interface 1 altsetting 1 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1016.758278][T24172] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1016.790910][T24172] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1016.801893][T24172] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1016.813733][T24172] usb 2-1: Product: syz [ 1016.818002][T24172] usb 2-1: Manufacturer: syz [ 1016.833665][T24172] usb 2-1: SerialNumber: syz [ 1016.934102][T24176] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 1017.047913][T30611] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1017.113788][T24176] usb 4-1: Using ep0 maxpacket: 8 [ 1017.121690][T24176] usb 4-1: config 0 has an invalid interface number: 55 but max is 0 [ 1017.130353][T24176] usb 4-1: config 0 has no interface number 0 [ 1017.137063][T24176] usb 4-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1017.148070][T24176] usb 4-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1017.162527][T24176] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1017.173803][T24176] usb 4-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1017.186969][T24176] usb 4-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1017.196306][T24176] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1017.208890][T24176] usb 4-1: config 0 descriptor?? [ 1017.230879][T24176] ldusb 4-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1017.412045][T30629] netlink: 44 bytes leftover after parsing attributes in process `syz.6.10390'. [ 1017.672089][T30611] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1017.911072][T24172] cdc_ncm 2-1:1.0: bind() failure [ 1018.003937][T24172] cdc_ncm 2-1:1.1: probe with driver cdc_ncm failed with error -71 [ 1018.038056][T24172] cdc_mbim 2-1:1.1: probe with driver cdc_mbim failed with error -71 [ 1018.094388][T24172] usbtest 2-1:1.1: probe with driver usbtest failed with error -71 [ 1018.158473][T24172] usb 2-1: USB disconnect, device number 113 [ 1018.549644][T30644] netlink: 112 bytes leftover after parsing attributes in process `syz.7.10396'. [ 1018.769566][T24172] usb 4-1: USB disconnect, device number 103 [ 1018.769668][ C1] ldusb 4-1:0.55: usb_submit_urb failed (-19) [ 1018.793036][T24172] ldusb 4-1:0.55: LD USB Device #0 now disconnected [ 1018.858249][T30649] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1019.698599][T30678] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10409'. [ 1021.719704][T30731] usb usb8: usbfs: process 30731 (syz.5.10431) did not claim interface 0 before use [ 1021.974340][T24175] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 1022.053188][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 1022.053209][ T30] audit: type=1326 audit(1749914286.208:5750): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30740 comm="syz.5.10436" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f638398e929 code=0x7fc00000 [ 1022.186204][ T30] audit: type=1326 audit(1749914286.308:5751): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30740 comm="syz.5.10436" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f63839858e7 code=0x7fc00000 [ 1022.228172][T24175] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 1022.237462][T24175] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1022.267987][T24175] usb 4-1: config 0 descriptor?? [ 1022.273099][ T30] audit: type=1326 audit(1749914286.308:5752): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30740 comm="syz.5.10436" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f638392ab19 code=0x7fc00000 [ 1022.315588][T24175] cp210x 4-1:0.0: cp210x converter detected [ 1022.350708][ T30] audit: type=1326 audit(1749914286.308:5753): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30740 comm="syz.5.10436" exe="/root/syz-executor" sig=0 arch=c000003e syscall=13 compat=0 ip=0x7f638392abdf code=0x7fc00000 [ 1022.423812][ T30] audit: type=1326 audit(1749914286.308:5754): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30740 comm="syz.5.10436" exe="/root/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7f638398e929 code=0x7fc00000 [ 1022.735759][T24175] cp210x 4-1:0.0: failed to get vendor val 0x0010 size 3: -32 [ 1022.767416][T24175] usb 4-1: cp210x converter now attached to ttyUSB0 [ 1022.966565][ T43] usb 4-1: USB disconnect, device number 104 [ 1022.982592][ T43] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 1023.009743][ T43] cp210x 4-1:0.0: device disconnected [ 1024.735845][T30787] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1024.984320][ T43] usb 4-1: new full-speed USB device number 105 using dummy_hcd [ 1025.146598][ T43] usb 4-1: config 0 has an invalid interface number: 128 but max is 0 [ 1025.155935][ T43] usb 4-1: config 0 has no interface number 0 [ 1025.165601][ T43] usb 4-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 1025.175220][ T43] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1025.183322][ T43] usb 4-1: Product: syz [ 1025.187988][ T43] usb 4-1: Manufacturer: syz [ 1025.192685][ T43] usb 4-1: SerialNumber: syz [ 1025.201707][ T43] usb 4-1: config 0 descriptor?? [ 1025.630742][T30806] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1025.646922][ T43] usb 4-1: Firmware: major: 217, minor: 65, hardware type: UNKNOWN (194) [ 1025.857990][ T43] usb 4-1: Firmware: build  [ 1026.066502][ T43] usb 4-1: failed to fetch extended address, random address set [ 1026.100106][ T43] usb 4-1: atusb_probe: initialization failed, error = -524 [ 1026.130611][ T43] atusb 4-1:0.128: probe with driver atusb failed with error -524 [ 1026.189602][ T43] usb 4-1: USB disconnect, device number 105 [ 1026.643909][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1026.842272][ C0] hrtimer: interrupt took 53376 ns [ 1026.849540][T24175] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 1026.864815][ T30] audit: type=1326 audit(1749914291.028:5755): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30828 comm="syz.1.10471" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc44e58e929 code=0x0 [ 1026.960556][T30837] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1027.040492][T24175] usb 6-1: config 0 has no interfaces? [ 1027.053468][T24175] usb 6-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 1027.073514][T24175] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1027.091988][T24175] usb 6-1: Product: syz [ 1027.101025][T24175] usb 6-1: Manufacturer: syz [ 1027.127247][T24175] usb 6-1: SerialNumber: syz [ 1027.150465][T24175] usb 6-1: config 0 descriptor?? [ 1027.518381][ T43] usb 6-1: USB disconnect, device number 34 [ 1027.683957][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1028.035170][T30862] netlink: 104 bytes leftover after parsing attributes in process `syz.1.10484'. [ 1028.550863][T24077] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 1028.624202][T25685] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 1028.715849][T24077] usb 6-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 1028.725690][T24077] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1028.754563][T24077] usb 6-1: config 0 descriptor?? [ 1028.765380][T24077] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 1028.790912][T25685] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1028.824243][T25685] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1028.843752][T25685] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1028.884266][T25685] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1028.901807][T25685] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1028.916539][T25685] usb 4-1: config 0 descriptor?? [ 1029.172454][T24077] cpia1 6-1:0.0: unexpected state after lo power cmd: 01 [ 1029.355225][T25685] plantronics 0003:047F:FFFF.0097: unknown main item tag 0x0 [ 1029.374741][T25685] plantronics 0003:047F:FFFF.0097: No inputs registered, leaving [ 1029.408911][T25685] plantronics 0003:047F:FFFF.0097: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 1029.787209][T24077] gspca_cpia1: usb_control_msg 05, error -71 [ 1029.823546][T24077] cpia1 6-1:0.0: unexpected systemstate: 01 [ 1029.852365][T24077] usb 6-1: USB disconnect, device number 35 [ 1030.354576][T30913] netlink: 12 bytes leftover after parsing attributes in process `syz.6.10504'. [ 1031.324249][T24172] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 1031.427738][T30944] atomic_op ffff88807c294998 conn xmit_atomic 0000000000000000 [ 1031.462742][T24175] usb 4-1: USB disconnect, device number 106 [ 1031.503939][T24172] usb 7-1: Using ep0 maxpacket: 16 [ 1031.514572][T24172] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1031.534949][T24172] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1031.560647][T24172] usb 7-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1031.574933][T24172] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1031.592914][T24172] usb 7-1: Product: syz [ 1031.599694][T24172] usb 7-1: Manufacturer: syz [ 1031.610128][T24172] usb 7-1: SerialNumber: syz [ 1031.627980][T24172] usb 7-1: config 0 descriptor?? [ 1031.648901][T24172] em28xx 7-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1031.660272][T24172] em28xx 7-1:0.0: Audio interface 0 found (Vendor Class) [ 1031.933875][T24175] usb 4-1: new high-speed USB device number 107 using dummy_hcd [ 1032.124413][T24175] usb 4-1: Using ep0 maxpacket: 8 [ 1032.134938][T24175] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 1032.143260][T24175] usb 4-1: config 179 has no interface number 0 [ 1032.157816][T24175] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1032.174289][T24175] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1032.185646][T24175] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1032.197123][T24175] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1032.208713][T24175] usb 4-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1032.230384][T24175] usb 4-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1032.239962][T24175] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1032.254825][T30948] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 1032.265090][T24172] em28xx 7-1:0.0: unknown em28xx chip ID (0) [ 1032.285788][T24172] em28xx 7-1:0.0: Config register raw data: 0x6c [ 1032.292342][T24172] em28xx 7-1:0.0: I2S Audio (1 sample rate(s)) [ 1032.302634][T24172] em28xx 7-1:0.0: No AC97 audio processor [ 1032.454404][T24077] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 1032.500664][T24175] input: Generic X-Box pad as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:179.65/input/input106 [ 1032.604675][T24077] usb 6-1: Using ep0 maxpacket: 32 [ 1032.611579][T24077] usb 6-1: config 0 has an invalid interface number: 51 but max is 0 [ 1032.620918][T24077] usb 6-1: config 0 has no interface number 0 [ 1032.632022][T24077] usb 6-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1032.642074][T24077] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1032.650969][T24077] usb 6-1: Product: syz [ 1032.656095][T24077] usb 6-1: Manufacturer: syz [ 1032.660729][T24077] usb 6-1: SerialNumber: syz [ 1032.674950][T24077] usb 6-1: config 0 descriptor?? [ 1032.684763][T24077] quatech2 6-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1032.703357][T24172] usb 7-1: USB disconnect, device number 22 [ 1032.908214][T30948] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1032.944706][T30948] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1033.056133][T30963] ALSA: seq fatal error: cannot create timer (-22) [ 1033.128209][T30959] veth1_vlan: left promiscuous mode [ 1033.173283][T25685] usb 4-1: USB disconnect, device number 107 [ 1033.173337][ C0] xpad 4-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1033.187862][ C0] xpad 4-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1033.212825][T24077] usb 6-1: qt2_attach - failed to power on unit: -71 [ 1033.233431][T24077] quatech2 6-1:0.51: probe with driver quatech2 failed with error -71 [ 1033.372995][T24077] usb 6-1: USB disconnect, device number 36 [ 1033.960361][T30991] input: syz0 as /devices/virtual/input/input107 [ 1034.066486][T30997] netlink: 'syz.6.10539': attribute type 10 has an invalid length. [ 1034.130624][T30997] syz_tun: entered promiscuous mode [ 1034.166622][T30997] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 1035.164352][T31032] netlink: 4 bytes leftover after parsing attributes in process `syz.7.10555'. [ 1035.201444][T31032] hsr_slave_0: left promiscuous mode [ 1035.234304][T31032] hsr_slave_1: left promiscuous mode [ 1035.457030][T24175] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 1035.511618][ T30] audit: type=1326 audit(1749914299.668:5756): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31041 comm="syz.3.10559" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f5aa978e929 code=0x0 [ 1035.638706][T24175] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1035.658430][T24175] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1035.681452][T24175] usb 6-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1035.691519][T24175] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1035.701662][T24175] usb 6-1: SerialNumber: syz [ 1035.944924][T24175] usb 6-1: 0:2 : does not exist [ 1036.010764][T24175] usb 6-1: USB disconnect, device number 37 [ 1036.075810][ T5939] udevd[5939]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1036.324604][T24077] usb 2-1: new high-speed USB device number 114 using dummy_hcd [ 1036.484284][T24077] usb 2-1: Using ep0 maxpacket: 32 [ 1036.510526][T24077] usb 2-1: config 0 has an invalid interface number: 132 but max is 0 [ 1036.552035][T24077] usb 2-1: config 0 has no interface number 0 [ 1036.563482][T24077] usb 2-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1036.597076][T24077] usb 2-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 1036.617126][T24077] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1036.619347][T31069] netlink: 8 bytes leftover after parsing attributes in process `syz.6.10570'. [ 1036.640594][T24077] usb 2-1: Product: syz [ 1036.657616][T24077] usb 2-1: Manufacturer: syz [ 1036.854210][T24077] usb 2-1: SerialNumber: syz [ 1036.921516][T31074] netlink: 12 bytes leftover after parsing attributes in process `syz.5.10573'. [ 1036.935198][T24077] usb 2-1: config 0 descriptor?? [ 1036.978487][T24077] em28xx 2-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 1037.016653][T24077] em28xx 2-1:0.132: Video interface 132 found: [ 1037.042237][T31074] netlink: 4 bytes leftover after parsing attributes in process `syz.5.10573'. [ 1037.377148][T24077] em28xx 2-1:0.132: unknown em28xx chip ID (0) [ 1038.527042][T31102] netlink: 140 bytes leftover after parsing attributes in process `syz.6.10582'. [ 1038.566924][T24077] em28xx 2-1:0.132: failed to trigger read from i2c address 0xa0 (error=-5) [ 1038.599732][T24077] em28xx 2-1:0.132: board has no eeprom [ 1038.604835][T31060] em28xx 2-1:0.132: failed to trigger read from i2c address 0xfe (error=-5) [ 1038.664367][T24077] em28xx 2-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 1038.672307][T24077] em28xx 2-1:0.132: analog set to bulk mode. [ 1038.706447][T25685] em28xx 2-1:0.132: Registering V4L2 extension [ 1038.785119][T31111] veth0: entered promiscuous mode [ 1038.786929][T24077] usb 2-1: USB disconnect, device number 114 [ 1038.794438][T31112] trusted_key: syz.7.10585 sent an empty control message without MSG_MORE. [ 1038.826498][T31110] veth0: left promiscuous mode [ 1038.833389][T24077] em28xx 2-1:0.132: Disconnecting em28xx [ 1038.907471][T31116] binder: 31114:31116 ioctl c0306201 2000000001c0 returned -22 [ 1039.243310][T25685] em28xx 2-1:0.132: Config register raw data: 0xffffffed [ 1039.278498][T25685] em28xx 2-1:0.132: AC97 chip type couldn't be determined [ 1039.326249][T25685] em28xx 2-1:0.132: No AC97 audio processor [ 1039.355407][T25685] usb 2-1: Decoder not found [ 1039.360052][T25685] em28xx 2-1:0.132: failed to create media graph [ 1039.400071][T25685] em28xx 2-1:0.132: V4L2 device video103 deregistered [ 1039.440906][T25685] em28xx 2-1:0.132: Remote control support is not available for this card. [ 1039.486440][T24077] em28xx 2-1:0.132: Closing input extension [ 1039.510641][T24077] em28xx 2-1:0.132: Freeing device [ 1041.450822][T31162] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1042.059313][T31182] netlink: 'syz.1.10612': attribute type 1 has an invalid length. [ 1042.233061][T31182] bond1: (slave vti1): The slave device specified does not support setting the MAC address [ 1042.314384][T31182] bond1: (slave vti1): Setting fail_over_mac to active for active-backup mode [ 1042.342875][T31182] bond1: (slave vti1): making interface the new active one [ 1042.358211][T31182] bond1: (slave vti1): Enslaving as an active interface with an up link [ 1042.976028][ T2968] netdevsim netdevsim7 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1043.242594][ T2968] netdevsim netdevsim7 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1043.445550][ T2968] netdevsim netdevsim7 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1043.830039][ T2968] netdevsim netdevsim7 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1044.087186][ T30] audit: type=1326 audit(1749914308.238:5757): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31212 comm="syz.5.10627" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f638398e929 code=0x7fc00000 [ 1044.134178][T24077] usb 7-1: new high-speed USB device number 23 using dummy_hcd [ 1044.334307][T24077] usb 7-1: Using ep0 maxpacket: 8 [ 1044.377439][T24077] usb 7-1: config 179 has an invalid interface number: 65 but max is 0 [ 1044.420078][T24077] usb 7-1: config 179 has no interface number 0 [ 1044.437345][T24077] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1044.484428][T24077] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1044.534270][T24077] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1044.576576][T24077] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1044.614380][T24077] usb 7-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1044.649377][ T30] audit: type=1326 audit(1749914308.808:5758): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31212 comm="syz.5.10627" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f638398e929 code=0x7fc00000 [ 1044.709090][T24077] usb 7-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1044.744328][T24077] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1044.807157][T31215] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1044.927023][ T5839] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1044.944257][ T5839] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1044.955098][ T5839] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1044.963383][ T5839] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1044.972080][ T5839] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1045.102896][T19292] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1045.157647][T19292] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1045.174834][T19292] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1045.213490][T19292] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1045.245450][T19292] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1045.321602][T24077] input: Generic X-Box pad as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:179.65/input/input108 [ 1045.564491][ T2968] bond1 (unregistering): (slave erspan1): Releasing active interface [ 1045.572683][ T2968] erspan1 (unregistering): left promiscuous mode [ 1045.604766][T24175] usb 7-1: USB disconnect, device number 23 [ 1045.604790][ C1] xpad 7-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1045.614028][ T2968] erspan1 (unregistering): left allmulticast mode [ 1045.619251][ C1] xpad 7-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1045.656151][T24175] xpad 7-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 1046.024355][T31245] netlink: 44 bytes leftover after parsing attributes in process `syz.5.10632'. [ 1046.320998][T31252] netlink: 16 bytes leftover after parsing attributes in process `syz.3.10634'. [ 1047.454491][ T5839] Bluetooth: hci2: command tx timeout [ 1047.693889][T24179] usb 7-1: new high-speed USB device number 24 using dummy_hcd [ 1047.905267][T24179] usb 7-1: too many configurations: 9, using maximum allowed: 8 [ 1047.948931][T24179] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1047.978663][T24179] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1048.027757][T24179] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1048.066065][T24179] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1048.075722][T24179] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1048.104167][T24179] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1048.115568][T24179] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1048.126824][T24179] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1048.146675][ T2968] bond0 (unregistering): Released all slaves [ 1048.168723][T24179] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1048.171877][ T2968] bond1 (unregistering): Released all slaves [ 1048.185378][T24179] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1048.196977][T24179] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1048.228581][T24179] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1048.246780][T31243] netlink: 4 bytes leftover after parsing attributes in process `syz.5.10632'. [ 1048.271516][T24179] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1048.324354][T24179] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1048.404634][T24179] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1048.421787][ T2968] tipc: Left network mode [ 1048.489994][T24179] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1048.551989][T24179] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1048.603913][T24179] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1048.657765][T24179] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1048.689924][T24179] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1048.729477][T24179] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1048.760507][T24179] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1048.789108][T24179] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1048.807188][T24179] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1048.817435][T24179] usb 7-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 1048.840751][T24179] usb 7-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 1048.863033][T24179] usb 7-1: Product: syz [ 1048.868301][T24179] usb 7-1: Manufacturer: syz [ 1048.892599][T24179] usb 7-1: SerialNumber: syz [ 1048.948012][T24179] usb 7-1: config 0 descriptor?? [ 1049.055514][T24179] yurex 7-1:0.0: USB YUREX device now attached to Yurex #0 [ 1049.189756][T31281] [ 1049.192161][T31281] ===================================================== [ 1049.199126][T31281] WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected [ 1049.206612][T31281] 6.16.0-rc1-syzkaller-00203-g4774cfe3543a #0 Not tainted [ 1049.213751][T31281] ----------------------------------------------------- [ 1049.220715][T31281] syz.3.10644/31281 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire: [ 1049.228543][T31281] ffffffff8de0c058 (tasklist_lock){.+.+}-{3:3}, at: send_sigurg+0x12b/0x420 [ 1049.237280][T31281] [ 1049.237280][T31281] and this task is already holding: [ 1049.244646][T31281] ffff888024ee2aa0 (&f_owner->lock){....}-{3:3}, at: send_sigurg+0x55/0x420 [ 1049.253368][T31281] which would create a new lock dependency: [ 1049.259267][T31281] (&f_owner->lock){....}-{3:3} -> (tasklist_lock){.+.+}-{3:3} [ 1049.266867][T31281] [ 1049.266867][T31281] but this new dependency connects a SOFTIRQ-irq-safe lock: [ 1049.276321][T31281] (&client->buffer_lock){..-.}-{3:3} [ 1049.276349][T31281] [ 1049.276349][T31281] ... which became SOFTIRQ-irq-safe at: [ 1049.289421][T31281] lock_acquire+0x120/0x360 [ 1049.294029][T31281] _raw_spin_lock+0x2e/0x40 [ 1049.298627][T31281] evdev_pass_values+0xb9/0xbd0 [ 1049.303584][T31281] evdev_events+0x1e6/0x340 [ 1049.308281][T31281] input_pass_values+0x285/0x890 [ 1049.313312][T31281] input_event_dispose+0x3e5/0x6b0 [ 1049.318524][T31281] input_event+0x8c/0xc0 [ 1049.322955][T31281] hidinput_hid_event+0x12d7/0x1c90 [ 1049.328253][T31281] hid_process_event+0x4be/0x620 [ 1049.333319][T31281] hid_report_raw_event+0xe91/0x16d0 [ 1049.338701][T31281] hid_input_report+0x43e/0x520 [ 1049.343649][T31281] hid_irq_in+0x47e/0x6d0 [ 1049.348084][T31281] __usb_hcd_giveback_urb+0x41a/0x690 [ 1049.353555][T31281] dummy_timer+0x862/0x4550 [ 1049.358152][T31281] __hrtimer_run_queues+0x52c/0xc60 [ 1049.363451][T31281] hrtimer_run_softirq+0x187/0x2b0 [ 1049.368655][T31281] handle_softirqs+0x286/0x870 [ 1049.373525][T31281] __irq_exit_rcu+0xca/0x1f0 [ 1049.378218][T31281] irq_exit_rcu+0x9/0x30 [ 1049.382564][T31281] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 1049.388298][T31281] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1049.394370][T31281] prepend_path+0x2b4/0x970 [ 1049.398975][T31281] d_absolute_path+0xa1/0x140 [ 1049.403753][T31281] tomoyo_realpath_from_path+0x2c8/0x5d0 [ 1049.409502][T31281] tomoyo_check_open_permission+0x1c1/0x3b0 [ 1049.415496][T31281] security_file_open+0xb1/0x270 [ 1049.420532][T31281] do_dentry_open+0x35e/0x1970 [ 1049.425390][T31281] vfs_open+0x3b/0x340 [ 1049.429554][T31281] path_openat+0x2ee5/0x3830 [ 1049.434241][T31281] do_filp_open+0x1fa/0x410 [ 1049.438849][T31281] do_sys_openat2+0x121/0x1c0 [ 1049.443623][T31281] __x64_sys_openat+0x138/0x170 [ 1049.448578][T31281] do_syscall_64+0xfa/0x3b0 [ 1049.453176][T31281] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1049.459159][T31281] [ 1049.459159][T31281] to a SOFTIRQ-irq-unsafe lock: [ 1049.466178][T31281] (tasklist_lock){.+.+}-{3:3} [ 1049.466205][T31281] [ 1049.466205][T31281] ... which became SOFTIRQ-irq-unsafe at: [ 1049.478862][T31281] ... [ 1049.478870][T31281] lock_acquire+0x120/0x360 [ 1049.486085][T31281] _raw_read_lock+0x36/0x50 [ 1049.490690][T31281] __do_wait+0xde/0x740 [ 1049.494946][T31281] do_wait+0x1f8/0x520 [ 1049.499109][T31281] kernel_wait+0xab/0x170 [ 1049.503535][T31281] call_usermodehelper_exec_work+0xbe/0x230 [ 1049.509527][T31281] process_scheduled_works+0xae1/0x17b0 [ 1049.515174][T31281] worker_thread+0x8a0/0xda0 [ 1049.519856][T31281] kthread+0x70e/0x8a0 [ 1049.524018][T31281] ret_from_fork+0x3fc/0x770 [ 1049.528705][T31281] ret_from_fork_asm+0x1a/0x30 [ 1049.533564][T31281] [ 1049.533564][T31281] other info that might help us debug this: [ 1049.533564][T31281] [ 1049.543807][T31281] Chain exists of: [ 1049.543807][T31281] &client->buffer_lock --> &f_owner->lock --> tasklist_lock [ 1049.543807][T31281] [ 1049.557050][T31281] Possible interrupt unsafe locking scenario: [ 1049.557050][T31281] [ 1049.565373][T31281] CPU0 CPU1 [ 1049.570741][T31281] ---- ---- [ 1049.576106][T31281] lock(tasklist_lock); [ 1049.580359][T31281] local_irq_disable(); [ 1049.587118][T31281] lock(&client->buffer_lock); [ 1049.594496][T31281] lock(&f_owner->lock); [ 1049.601370][T31281] [ 1049.604837][T31281] lock(&client->buffer_lock); [ 1049.609888][T31281] [ 1049.609888][T31281] *** DEADLOCK *** [ 1049.609888][T31281] [ 1049.618043][T31281] 2 locks held by syz.3.10644/31281: [ 1049.623337][T31281] #0: ffff88807b623840 (&u->lock){+.+.}-{3:3}, at: queue_oob+0x187/0x5a0 [ 1049.631895][T31281] #1: ffff888024ee2aa0 (&f_owner->lock){....}-{3:3}, at: send_sigurg+0x55/0x420 [ 1049.641059][T31281] [ 1049.641059][T31281] the dependencies between SOFTIRQ-irq-safe lock and the holding lock: [ 1049.651466][T31281] -> (&client->buffer_lock){..-.}-{3:3} { [ 1049.657390][T31281] IN-SOFTIRQ-W at: [ 1049.661571][T31281] lock_acquire+0x120/0x360 [ 1049.668178][T31281] _raw_spin_lock+0x2e/0x40 [ 1049.674702][T31281] evdev_pass_values+0xb9/0xbd0 [ 1049.681561][T31281] evdev_events+0x1e6/0x340 [ 1049.688069][T31281] input_pass_values+0x285/0x890 [ 1049.695016][T31281] input_event_dispose+0x3e5/0x6b0 [ 1049.702136][T31281] input_event+0x8c/0xc0 [ 1049.708392][T31281] hidinput_hid_event+0x12d7/0x1c90 [ 1049.715610][T31281] hid_process_event+0x4be/0x620 [ 1049.722641][T31281] hid_report_raw_event+0xe91/0x16d0 [ 1049.729926][T31281] hid_input_report+0x43e/0x520 [ 1049.736781][T31281] hid_irq_in+0x47e/0x6d0 [ 1049.743113][T31281] __usb_hcd_giveback_urb+0x41a/0x690 [ 1049.750491][T31281] dummy_timer+0x862/0x4550 [ 1049.757178][T31281] __hrtimer_run_queues+0x52c/0xc60 [ 1049.764392][T31281] hrtimer_run_softirq+0x187/0x2b0 [ 1049.771506][T31281] handle_softirqs+0x286/0x870 [ 1049.778285][T31281] __irq_exit_rcu+0xca/0x1f0 [ 1049.784891][T31281] irq_exit_rcu+0x9/0x30 [ 1049.791181][T31281] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 1049.798829][T31281] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1049.806814][T31281] prepend_path+0x2b4/0x970 [ 1049.813335][T31281] d_absolute_path+0xa1/0x140 [ 1049.820026][T31281] tomoyo_realpath_from_path+0x2c8/0x5d0 [ 1049.827673][T31281] tomoyo_check_open_permission+0x1c1/0x3b0 [ 1049.835577][T31281] security_file_open+0xb1/0x270 [ 1049.842521][T31281] do_dentry_open+0x35e/0x1970 [ 1049.849296][T31281] vfs_open+0x3b/0x340 [ 1049.855380][T31281] path_openat+0x2ee5/0x3830 [ 1049.861984][T31281] do_filp_open+0x1fa/0x410 [ 1049.868583][T31281] do_sys_openat2+0x121/0x1c0 [ 1049.875265][T31281] __x64_sys_openat+0x138/0x170 [ 1049.882127][T31281] do_syscall_64+0xfa/0x3b0 [ 1049.888632][T31281] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1049.896617][T31281] INITIAL USE at: [ 1049.900707][T31281] lock_acquire+0x120/0x360 [ 1049.907132][T31281] _raw_spin_lock+0x2e/0x40 [ 1049.913567][T31281] evdev_pass_values+0xb9/0xbd0 [ 1049.920343][T31281] evdev_events+0x1e6/0x340 [ 1049.926855][T31281] input_pass_values+0x285/0x890 [ 1049.933715][T31281] input_event_dispose+0x330/0x6b0 [ 1049.940760][T31281] input_inject_event+0x1fe/0x320 [ 1049.947708][T31281] evdev_write+0x2fc/0x480 [ 1049.954076][T31281] vfs_write+0x27b/0xa90 [ 1049.960334][T31281] ksys_write+0x145/0x250 [ 1049.966577][T31281] do_syscall_64+0xfa/0x3b0 [ 1049.972996][T31281] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1049.980805][T31281] } [ 1049.983479][T31281] ... key at: [] evdev_open.__key.25+0x0/0x20 [ 1049.991990][T31281] -> (&new->fa_lock){....}-{3:3} { [ 1049.997219][T31281] INITIAL USE at: [ 1050.001206][T31281] lock_acquire+0x120/0x360 [ 1050.007479][T31281] _raw_write_lock_irq+0xa2/0xf0 [ 1050.014169][T31281] fasync_remove_entry+0xf1/0x1c0 [ 1050.020944][T31281] sock_fasync+0x85/0xf0 [ 1050.026938][T31281] __fput+0x89f/0xa70 [ 1050.032665][T31281] task_work_run+0x1d1/0x260 [ 1050.039005][T31281] exit_to_user_mode_loop+0xec/0x110 [ 1050.046039][T31281] do_syscall_64+0x2bd/0x3b0 [ 1050.052370][T31281] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1050.060007][T31281] INITIAL READ USE at: [ 1050.064430][T31281] lock_acquire+0x120/0x360 [ 1050.071118][T31281] _raw_read_lock_irqsave+0xaf/0x100 [ 1050.078597][T31281] kill_fasync+0x199/0x4d0 [ 1050.085287][T31281] sock_wake_async+0x137/0x160 [ 1050.092243][T31281] sk_wake_async+0x184/0x280 [ 1050.099019][T31281] unix_shutdown+0x2f5/0x3f0 [ 1050.105802][T31281] __x64_sys_shutdown+0x13c/0x1a0 [ 1050.113129][T31281] do_syscall_64+0xfa/0x3b0 [ 1050.119830][T31281] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1050.127909][T31281] } [ 1050.130500][T31281] ... key at: [] fasync_insert_entry.__key+0x0/0x20 [ 1050.139365][T31281] ... acquired at: [ 1050.143254][T31281] lock_acquire+0x120/0x360 [ 1050.147943][T31281] _raw_read_lock_irqsave+0xaf/0x100 [ 1050.153413][T31281] kill_fasync+0x199/0x4d0 [ 1050.158018][T31281] evdev_pass_values+0x627/0xbd0 [ 1050.163139][T31281] evdev_events+0x1e6/0x340 [ 1050.167822][T31281] input_pass_values+0x285/0x890 [ 1050.172938][T31281] input_event_dispose+0x330/0x6b0 [ 1050.178240][T31281] input_inject_event+0x1fe/0x320 [ 1050.183453][T31281] evdev_write+0x2fc/0x480 [ 1050.188051][T31281] vfs_write+0x27b/0xa90 [ 1050.192490][T31281] ksys_write+0x145/0x250 [ 1050.196995][T31281] do_syscall_64+0xfa/0x3b0 [ 1050.201678][T31281] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1050.207749][T31281] [ 1050.210075][T31281] -> (&f_owner->lock){....}-{3:3} { [ 1050.215305][T31281] INITIAL USE at: [ 1050.219203][T31281] lock_acquire+0x120/0x360 [ 1050.225288][T31281] _raw_write_lock_irq+0xa2/0xf0 [ 1050.231807][T31281] __f_setown+0x67/0x370 [ 1050.237645][T31281] fcntl_dirnotify+0x3d6/0x690 [ 1050.243988][T31281] do_fcntl+0x6d0/0x1910 [ 1050.249823][T31281] __se_sys_fcntl+0xc8/0x150 [ 1050.256077][T31281] do_syscall_64+0xfa/0x3b0 [ 1050.262149][T31281] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1050.269702][T31281] INITIAL READ USE at: [ 1050.274045][T31281] lock_acquire+0x120/0x360 [ 1050.280583][T31281] _raw_read_lock_irq+0xaa/0xf0 [ 1050.287444][T31281] do_fcntl+0x812/0x1910 [ 1050.293714][T31281] __se_sys_fcntl+0xc8/0x150 [ 1050.300327][T31281] do_syscall_64+0xfa/0x3b0 [ 1050.306836][T31281] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1050.314755][T31281] } [ 1050.317260][T31281] ... key at: [] file_f_owner_allocate.__key+0x0/0x20 [ 1050.326117][T31281] ... acquired at: [ 1050.329928][T31281] lock_acquire+0x120/0x360 [ 1050.334616][T31281] _raw_read_lock_irqsave+0xaf/0x100 [ 1050.340087][T31281] send_sigio+0x38/0x370 [ 1050.344517][T31281] kill_fasync+0x24d/0x4d0 [ 1050.349121][T31281] lease_break_callback+0x26/0x30 [ 1050.354336][T31281] __break_lease+0x6a2/0x1620 [ 1050.359195][T31281] do_dentry_open+0xd62/0x1970 [ 1050.364148][T31281] vfs_open+0x3b/0x340 [ 1050.368536][T31281] path_openat+0x2ee5/0x3830 [ 1050.373353][T31281] do_filp_open+0x1fa/0x410 [ 1050.378055][T31281] do_sys_openat2+0x121/0x1c0 [ 1050.382924][T31281] __x64_sys_openat+0x138/0x170 [ 1050.387959][T31281] do_syscall_64+0xfa/0x3b0 [ 1050.392650][T31281] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1050.398726][T31281] [ 1050.401053][T31281] [ 1050.401053][T31281] the dependencies between the lock to be acquired [ 1050.401063][T31281] and SOFTIRQ-irq-unsafe lock: [ 1050.414607][T31281] -> (tasklist_lock){.+.+}-{3:3} { [ 1050.419773][T31281] HARDIRQ-ON-R at: [ 1050.423776][T31281] lock_acquire+0x120/0x360 [ 1050.429954][T31281] _raw_read_lock+0x36/0x50 [ 1050.436122][T31281] __do_wait+0xde/0x740 [ 1050.441935][T31281] do_wait+0x1f8/0x520 [ 1050.447663][T31281] kernel_wait+0xab/0x170 [ 1050.453664][T31281] call_usermodehelper_exec_work+0xbe/0x230 [ 1050.461252][T31281] process_scheduled_works+0xae1/0x17b0 [ 1050.468467][T31281] worker_thread+0x8a0/0xda0 [ 1050.474982][T31281] kthread+0x70e/0x8a0 [ 1050.480710][T31281] ret_from_fork+0x3fc/0x770 [ 1050.486962][T31281] ret_from_fork_asm+0x1a/0x30 [ 1050.493384][T31281] SOFTIRQ-ON-R at: [ 1050.497372][T31281] lock_acquire+0x120/0x360 [ 1050.503536][T31281] _raw_read_lock+0x36/0x50 [ 1050.509713][T31281] __do_wait+0xde/0x740 [ 1050.515531][T31281] do_wait+0x1f8/0x520 [ 1050.521262][T31281] kernel_wait+0xab/0x170 [ 1050.527251][T31281] call_usermodehelper_exec_work+0xbe/0x230 [ 1050.534814][T31281] process_scheduled_works+0xae1/0x17b0 [ 1050.542027][T31281] worker_thread+0x8a0/0xda0 [ 1050.548356][T31281] kthread+0x70e/0x8a0 [ 1050.554086][T31281] ret_from_fork+0x3fc/0x770 [ 1050.560362][T31281] ret_from_fork_asm+0x1a/0x30 [ 1050.566811][T31281] INITIAL USE at: [ 1050.570806][T31281] lock_acquire+0x120/0x360 [ 1050.576981][T31281] _raw_write_lock_irq+0xa2/0xf0 [ 1050.583505][T31281] copy_process+0x224f/0x3c00 [ 1050.589927][T31281] kernel_clone+0x21e/0x870 [ 1050.596001][T31281] user_mode_thread+0xdd/0x140 [ 1050.602358][T31281] rest_init+0x23/0x300 [ 1050.608110][T31281] start_kernel+0x47d/0x500 [ 1050.614206][T31281] x86_64_start_reservations+0x24/0x30 [ 1050.621283][T31281] x86_64_start_kernel+0x143/0x1c0 [ 1050.628004][T31281] common_startup_64+0x13e/0x147 [ 1050.634528][T31281] INITIAL READ USE at: [ 1050.638865][T31281] lock_acquire+0x120/0x360 [ 1050.645386][T31281] _raw_read_lock+0x36/0x50 [ 1050.651897][T31281] __do_wait+0xde/0x740 [ 1050.658063][T31281] do_wait+0x1f8/0x520 [ 1050.664138][T31281] kernel_wait+0xab/0x170 [ 1050.670479][T31281] call_usermodehelper_exec_work+0xbe/0x230 [ 1050.678473][T31281] process_scheduled_works+0xae1/0x17b0 [ 1050.686030][T31281] worker_thread+0x8a0/0xda0 [ 1050.692621][T31281] kthread+0x70e/0x8a0 [ 1050.698696][T31281] ret_from_fork+0x3fc/0x770 [ 1050.705299][T31281] ret_from_fork_asm+0x1a/0x30 [ 1050.712072][T31281] } [ 1050.714576][T31281] ... key at: [] tasklist_lock+0x18/0x40 [ 1050.722306][T31281] ... acquired at: [ 1050.726112][T31281] lock_acquire+0x120/0x360 [ 1050.730801][T31281] _raw_read_lock+0x36/0x50 [ 1050.735490][T31281] send_sigurg+0x12b/0x420 [ 1050.740095][T31281] sk_send_sigurg+0x6c/0x2e0 [ 1050.744958][T31281] queue_oob+0x490/0x5a0 [ 1050.749382][T31281] unix_stream_sendmsg+0xaf9/0xc90 [ 1050.754673][T31281] __sock_sendmsg+0x21c/0x270 [ 1050.759543][T31281] ____sys_sendmsg+0x52d/0x830 [ 1050.764489][T31281] ___sys_sendmsg+0x21f/0x2a0 [ 1050.769402][T31281] __sys_sendmmsg+0x227/0x430 [ 1050.774263][T31281] __x64_sys_sendmmsg+0xa0/0xc0 [ 1050.779293][T31281] do_syscall_64+0xfa/0x3b0 [ 1050.783975][T31281] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1050.790057][T31281] [ 1050.792385][T31281] [ 1050.792385][T31281] stack backtrace: [ 1050.798281][T31281] CPU: 0 UID: 0 PID: 31281 Comm: syz.3.10644 Not tainted 6.16.0-rc1-syzkaller-00203-g4774cfe3543a #0 PREEMPT(full) [ 1050.798303][T31281] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1050.798313][T31281] Call Trace: [ 1050.798322][T31281] [ 1050.798329][T31281] dump_stack_lvl+0x189/0x250 [ 1050.798358][T31281] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1050.798382][T31281] ? __pfx__printk+0x10/0x10 [ 1050.798402][T31281] validate_chain+0x1f05/0x2140 [ 1050.798425][T31281] __lock_acquire+0xab9/0xd20 [ 1050.798449][T31281] ? send_sigurg+0x12b/0x420 [ 1050.798468][T31281] lock_acquire+0x120/0x360 [ 1050.798490][T31281] ? send_sigurg+0x12b/0x420 [ 1050.798510][T31281] ? _raw_read_lock_irqsave+0xbb/0x100 [ 1050.798535][T31281] _raw_read_lock+0x36/0x50 [ 1050.798556][T31281] ? send_sigurg+0x12b/0x420 [ 1050.798575][T31281] send_sigurg+0x12b/0x420 [ 1050.798596][T31281] sk_send_sigurg+0x6c/0x2e0 [ 1050.798621][T31281] queue_oob+0x490/0x5a0 [ 1050.798643][T31281] ? __pfx_queue_oob+0x10/0x10 [ 1050.798663][T31281] ? __pfx___might_resched+0x10/0x10 [ 1050.798688][T31281] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 1050.798711][T31281] unix_stream_sendmsg+0xaf9/0xc90 [ 1050.798732][T31281] ? aa_sk_perm+0x81e/0x950 [ 1050.798752][T31281] ? __pfx_unix_stream_sendmsg+0x10/0x10 [ 1050.798772][T31281] ? aa_sock_msg_perm+0x94/0x160 [ 1050.798793][T31281] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1050.798812][T31281] ? __pfx_unix_stream_sendmsg+0x10/0x10 [ 1050.798831][T31281] __sock_sendmsg+0x21c/0x270 [ 1050.798855][T31281] ____sys_sendmsg+0x52d/0x830 [ 1050.798876][T31281] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1050.798898][T31281] ? import_iovec+0x74/0xa0 [ 1050.798914][T31281] ___sys_sendmsg+0x21f/0x2a0 [ 1050.798934][T31281] ? __pfx____sys_sendmsg+0x10/0x10 [ 1050.798964][T31281] ? __fget_files+0x2a/0x420 [ 1050.798980][T31281] ? __fget_files+0x3a0/0x420 [ 1050.799000][T31281] __sys_sendmmsg+0x227/0x430 [ 1050.799022][T31281] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1050.799040][T31281] ? do_futex+0x333/0x420 [ 1050.799066][T31281] ? rcu_is_watching+0x15/0xb0 [ 1050.799092][T31281] __x64_sys_sendmmsg+0xa0/0xc0 [ 1050.799112][T31281] do_syscall_64+0xfa/0x3b0 [ 1050.799126][T31281] ? lockdep_hardirqs_on+0x9c/0x150 [ 1050.799148][T31281] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1050.799164][T31281] ? clear_bhb_loop+0x60/0xb0 [ 1050.799181][T31281] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1050.799197][T31281] RIP: 0033:0x7f5aa978e929 [ 1050.799213][T31281] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1050.799227][T31281] RSP: 002b:00007f5aaa6a1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1050.799252][T31281] RAX: ffffffffffffffda RBX: 00007f5aa99b5fa0 RCX: 00007f5aa978e929 [ 1050.799264][T31281] RDX: 0000000000000001 RSI: 0000200000006c40 RDI: 0000000000000003 [ 1050.799275][T31281] RBP: 00007f5aa9810b39 R08: 0000000000000000 R09: 0000000000000000 [ 1050.799285][T31281] R10: 0000000000040015 R11: 0000000000000246 R12: 0000000000000000 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1050.799295][T31281] R13: 0000000000000000 R14: 00007f5aa99b5fa0 R15: 00007f5aa9adfa28 [ 1050.799312][T31281] [ 1051.107678][ T5839] Bluetooth: hci2: command tx timeout [ 1051.239437][T24175] usb 7-1: USB disconnect, device number 24 [ 1051.258483][T24175] yurex 7-1:0.0: USB YUREX #0 now disconnected [ 1053.093293][T26513] bond0: (slave syz_tun): Releasing backup interface [ 1053.130686][T29451] bond0: (slave syz_tun): Releasing backup interface [ 1053.490476][ T2968] IPVS: stop unused estimator thread 0... [ 1053.554635][T22503] netdevsim netdevsim6 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1053.568012][T22503] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1053.599110][T22503] netdevsim netdevsim6 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1053.611525][T22503] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1053.662323][T22503] netdevsim netdevsim6 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1053.675768][T22503] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1053.704663][T22503] netdevsim netdevsim6 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1053.717214][T22503] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1053.810309][T22503] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1053.855950][T22503] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1053.893364][T22503] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1053.966195][T22503] bond0: (slave netdevsim0): Releasing backup interface [ 1053.974368][T22503] netdevsim netdevsim5 netdevsim0 (unregistering): left promiscuous mode [ 1053.985690][T22503] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1054.112920][T22503] bridge_slave_1: left allmulticast mode [ 1054.119155][T22503] bridge_slave_1: left promiscuous mode [ 1054.127035][T22503] bridge0: port 2(bridge_slave_1) entered disabled state [ 1054.136610][T22503] bridge_slave_0: left allmulticast mode [ 1054.142484][T22503] bridge_slave_0: left promiscuous mode [ 1054.148434][T22503] bridge0: port 1(bridge_slave_0) entered disabled state [ 1054.238123][T22503] bond0 (unregistering): Released all slaves [ 1054.482577][T22503] bond0 (unregistering): Released all slaves [ 1054.571819][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 1054.578550][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1054.639414][T22503] bond1 (unregistering): Released all slaves [ 1055.016714][T22503] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1055.025679][T22503] bond_slave_0: left promiscuous mode [ 1055.032361][T22503] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1055.044813][T22503] bond_slave_1: left promiscuous mode [ 1055.050892][T22503] bond0 (unregistering): Released all slaves [ 1055.196246][T22503] bond1 (unregistering): Released all slaves [ 1055.315546][T22503] tipc: Left network mode [ 1055.659244][T22503] hsr_slave_0: left promiscuous mode [ 1055.666740][T22503] hsr_slave_1: left promiscuous mode [ 1055.676768][T22503] hsr_slave_0: left promiscuous mode [ 1055.682753][T22503] hsr_slave_1: left promiscuous mode [ 1055.691258][T22503] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1055.698826][T22503] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1055.708205][T22503] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1055.718785][T22503] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1055.734369][T22503] veth0_macvtap: left promiscuous mode [ 1055.740017][T22503] veth1_vlan: left promiscuous mode [ 1055.755308][T22503] veth0_vlan: left promiscuous mode [ 1055.761313][T22503] veth1_macvtap: left promiscuous mode [ 1055.769490][T22503] veth0_macvtap: left promiscuous mode [ 1056.461798][T22503] team0 (unregistering): Port device team_slave_1 removed [ 1056.495666][T22503] team0 (unregistering): Port device team_slave_0 removed [ 1057.099589][T22503] IPVS: stop unused estimator thread 0... [ 1057.109695][T22503] IPVS: stop unused estimator thread 0...