last executing test programs: 1.061467485s ago: executing program 1 (id=106): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x400) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000440)={0x0, &(0x7f0000000380)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r0, 0xc06864a1, &(0x7f00000004c0)={0x0, 0x0, r1, 0x0}) ioctl$DRM_IOCTL_MODE_DIRTYFB(r0, 0xc01864b1, &(0x7f0000000300)={r2, 0xdd, 0x6, 0x0, 0x0}) 967.177848ms ago: executing program 0 (id=107): r0 = socket$kcm(0x2, 0x3, 0x106) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0) r2 = syz_usb_connect(0x0, 0x47, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000540)={{0x14}, [@NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x160b, 0x0, 0x0, {0x2, 0x0, 0x8}, [@NFTA_RULE_EXPRESSIONS={0x44, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @osf={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0x4}]}}}, {0x28, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_NAT_TYPE={0x8}, @NFTA_NAT_REG_ADDR_MIN={0x8, 0x3, 0x1, 0x0, 0x14}, @NFTA_NAT_FAMILY={0x8, 0x2, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x98}, 0x1, 0x0, 0x0, 0x850}, 0x4040080) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000000)={'veth0\x00', &(0x7f0000000080)=@ethtool_cmd={0x4e, 0x40, 0x3, 0x2, 0x6, 0x4c, 0x4, 0xb, 0x6, 0x0, 0x9, 0x10001, 0xaff0, 0xa8, 0xa8, 0x5, [0xb, 0x8]}}) sendmsg$inet(r0, &(0x7f0000000040)={&(0x7f0000000380)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000000)=[{&(0x7f0000000080)="fbd2b9ed29d8974a6ce75f08916ac3b4da11bc1a", 0xffeb}], 0x1}, 0x0) 901.031256ms ago: executing program 1 (id=108): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)=0x0) timer_settime(r2, 0x0, &(0x7f0000000000)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl(r0, 0x40480923, 0x0) 745.661392ms ago: executing program 1 (id=109): r0 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=@newqdisc={0x7c, 0x14, 0xf0b, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, {0x4, 0xe}, {0xb, 0x1}, {0x4}}, [@TCA_STAB={0x58, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x40, 0xfc, 0x201, 0xffff0000, 0x0, 0x0, 0x7e}}, {0x4}}, {{0x1c, 0x1, {0x5, 0x14, 0x18, 0x9, 0x1, 0x0, 0x2, 0xa}}, {0x18, 0x2, [0x7f, 0x2, 0x4, 0x7af, 0x2, 0x3, 0x80, 0x80, 0x5, 0x0]}}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x48800}, 0x8090) 648.959518ms ago: executing program 0 (id=110): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) ioctl(r0, 0x80480911, 0x0) 648.764818ms ago: executing program 1 (id=111): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000280)={0x24, r1, 0x1, 0x0, 0x0, {}, [@NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0xffffffffffffffff}]}, 0x24}}, 0x0) 507.343733ms ago: executing program 0 (id=112): r0 = syz_open_procfs(0x0, &(0x7f0000002380)='net/ip_mr_cache\x00') pread64(r0, &(0x7f0000000200)=""/253, 0xfd, 0x100000000001) 428.612132ms ago: executing program 1 (id=113): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000001c0)={{{@in=@private=0xa010101, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x0, 0x20, 0x2001, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0x3fffffffd, 0x80000001, 0x0, 0xffffffffffffffff, 0x40000, 0xffffffff}, {}, 0x0, 0x4}, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0xffffffff, 0x6c}, 0x0, @in6=@loopback, 0x3503, 0x0, 0x3, 0x0, 0xe, 0x4000000, 0x200003}}, 0xe8) ioctl$AUTOFS_IOC_FAIL(r1, 0x9361, 0x9) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8d}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x0, &(0x7f0000000040)}) sched_getattr(0x0, &(0x7f0000000100)={0x38}, 0x38, 0x0) r3 = syz_usb_connect(0x0, 0x3f, &(0x7f00000012c0)=ANY=[@ANYBLOB, @ANYRESHEX], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x4) ioctl$HIDIOCGUSAGE(0xffffffffffffffff, 0x40015b19, &(0x7f0000000000)={0xfffffffe, 0xfffffffe, 0x7, 0xff, 0x1, 0x2}) r4 = io_uring_setup(0x4051, &(0x7f0000000800)={0x0, 0xa87, 0x0, 0x1, 0x38}) io_uring_register$IORING_REGISTER_FILES2(r4, 0xd, &(0x7f0000000140)={0x62, 0x1, 0x0, 0x0, &(0x7f00000001c0)}, 0x20) ioctl$KVM_SIGNAL_MSI(r1, 0x4020aea5, &(0x7f00000000c0)={0x763bf26aa405d86c, 0x100000, 0xfffffffd, 0x1, 0x9}) 349.350702ms ago: executing program 0 (id=114): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a3100000000050001"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) r1 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl(r1, 0x3b76, 0x0) 348.912752ms ago: executing program 1 (id=115): r0 = syz_open_dev$mtd(&(0x7f00000000c0), 0x260c, 0xa02) setns(0xc9, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000004c0)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/drivers/ata_generic/new_id\x00', 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='0000:00:03.0\x00', 0xd) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:03.0/driver_override\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='ata_generic\x00', 0xc) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/ata_generic/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000140)='0000:00:03.0\x00', 0xd) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000003c0)=ANY=[@ANYBLOB="0086e2f51fece6a460e0fccedf376bb8601ad8c63f213d6d7947ed3254cf66f39f7cecc4f46c19f26566ce3b99a76d99321590909dd702a148948036beede8c257491d8efb42ff3c0ce0c654c903949a69e85de209", @ANYRES16=r5, @ANYBLOB="000100000000fcdbdf253900000008000300", @ANYRES32=r6, @ANYBLOB="0c005a800800038004000100"], 0x28}}, 0x0) ioctl$MEMWRITE(r0, 0xc0304d18, &(0x7f0000000180)={0x10080000001ff, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r7 = socket$inet(0x2, 0x2, 0x1) r8 = openat$autofs(0xffffff9c, &(0x7f0000000080), 0x900, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r8, 0xc0189375, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r7}, './file0\x00'}) r9 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) write$UHID_CREATE(r9, &(0x7f00000006c0)={0x0, {'syz1\x00', 'syz1\x00', 'syz1\x00', &(0x7f0000000500)=""/8, 0x8, 0x65de, 0x0, 0x1, 0x10, 0x2}}, 0x11c) readv(r9, &(0x7f0000000440)=[{&(0x7f00000002c0)=""/197, 0xc5}], 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./upper\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./lower2\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./upper\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./work\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mnt\x00', 0x1ff) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000480)='./mnt/dir1\x00', 0x0, 0x0, 0x0) 178.589932ms ago: executing program 0 (id=116): file_getattr(0xffffffffffffffff, 0x0, 0x0, 0x3f, 0x800) 0s ago: executing program 0 (id=117): r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) mount$tmpfs(0x0, &(0x7f0000000540)='./cgroup\x00', &(0x7f0000000580), 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB='mpol=interleave=r']) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f0000000000)=0x3fe) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f0000000340)={{0xfffffffe, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x6, 0x2, 0x19, 0x0, 0x0, 0x1, 'syz1\x00', 0x0}) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:9698' (ED25519) to the list of known hosts. syzkaller login: [ 999.789852][ T3381] cgroup: Unknown subsys name 'net' [ 999.973203][ T3381] cgroup: Unknown subsys name 'cpuset' [ 999.996391][ T3381] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 1000.397389][ T3381] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 1008.280361][ T3388] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1008.337114][ T3388] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1008.423657][ T3390] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1008.437797][ T3390] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1009.228530][ T3390] hsr_slave_0: entered promiscuous mode [ 1009.235541][ T3390] hsr_slave_1: entered promiscuous mode [ 1009.470669][ T3388] hsr_slave_0: entered promiscuous mode [ 1009.474058][ T3388] hsr_slave_1: entered promiscuous mode [ 1009.478769][ T3388] debugfs: 'hsr0' already exists in 'hsr' [ 1009.480417][ T3388] Cannot create hsr debugfs directory [ 1010.201237][ T3390] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1010.229295][ T3390] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1010.242461][ T3390] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1010.258828][ T3390] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1010.275925][ T3390] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1010.290269][ T3390] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1010.309039][ T3390] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1010.320394][ T3390] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1010.415365][ T3388] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1010.427311][ T3388] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1010.432919][ T3388] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1010.444025][ T3388] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1010.449522][ T3388] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1010.459235][ T3388] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1010.462586][ T3388] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1010.479441][ T3388] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1011.225872][ T3388] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1011.240232][ T3390] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1013.833930][ T3390] veth0_vlan: entered promiscuous mode [ 1013.881472][ T3390] veth1_vlan: entered promiscuous mode [ 1014.006321][ T3388] veth0_vlan: entered promiscuous mode [ 1014.068537][ T3388] veth1_vlan: entered promiscuous mode [ 1014.116241][ T3390] veth0_macvtap: entered promiscuous mode [ 1014.146594][ T3390] veth1_macvtap: entered promiscuous mode [ 1014.274119][ T3388] veth0_macvtap: entered promiscuous mode [ 1014.322339][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1014.323041][ T3367] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1014.332958][ T3388] veth1_macvtap: entered promiscuous mode [ 1014.375676][ T3481] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1014.376745][ T3481] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1014.569220][ T3481] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1014.570374][ T3481] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1014.571055][ T3481] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1014.571189][ T3481] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1014.653347][ T3390] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 1019.675444][ T3587] ======================================================= [ 1019.675444][ T3587] WARNING: The mand mount option has been deprecated and [ 1019.675444][ T3587] and is ignored by this kernel. Remove the mand [ 1019.675444][ T3587] option from the mount to silence this warning. [ 1019.675444][ T3587] ======================================================= [ 1024.151740][ T3608] capability: warning: `syz.1.27' uses deprecated v2 capabilities in a way that may be insecure [ 1024.651488][ T3610] netlink: 44 bytes leftover after parsing attributes in process `syz.1.28'. [ 1031.459528][ T3641] binder: 3640:3641 got reply transaction with no transaction stack [ 1031.461364][ T3641] binder: 3640:3641 transaction reply to 0:0 failed 1/29201/-71, code 0 size 0-0 line 3155 [ 1031.469985][ T3555] binder: undelivered TRANSACTION_ERROR: 29201 [ 1032.644018][ T3657] faux_driver vkms: [drm] Unknown color mode 6; guessing buffer size. [ 1032.699382][ T3657] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1032.704116][ T3657] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1033.434050][ T3668] syz_tun: entered allmulticast mode [ 1033.815637][ T3555] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 1033.985525][ T3555] usb 1-1: Using ep0 maxpacket: 16 [ 1033.989549][ T3555] usb 1-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 1033.997465][ T3555] usb 1-1: config 0 has an invalid interface number: 132 but max is 0 [ 1033.997792][ T3555] usb 1-1: config 0 has no interface number 0 [ 1034.009736][ T3555] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1034.010055][ T3555] usb 1-1: Product: syz [ 1034.010309][ T3555] usb 1-1: Manufacturer: syz [ 1034.010435][ T3555] usb 1-1: SerialNumber: syz [ 1034.022823][ T3555] usb 1-1: config 0 descriptor?? [ 1034.041282][ T3555] hub 1-1:0.132: bad descriptor, ignoring hub [ 1034.042216][ T3555] hub 1-1:0.132: probe with driver hub failed with error -5 [ 1034.060714][ T3555] usbhid 1-1:0.132: couldn't find an input interrupt endpoint [ 1034.555453][ T3555] usb 1-1: reset high-speed USB device number 2 using dummy_hcd [ 1034.559838][ T3555] usb 1-1: device reset changed ep0 maxpacket size! [ 1034.566012][ T3555] usb 1-1: USB disconnect, device number 2 [ 1034.865559][ T3555] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 1035.019532][ T3555] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1035.026194][ T3555] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1035.027003][ T3555] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1035.027204][ T3555] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1035.027471][ T3555] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1035.027657][ T3555] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1035.044219][ T3555] usb 1-1: config 0 descriptor?? [ 1035.547709][ T3555] usbhid 1-1:0.0: can't add hid device: -71 [ 1035.548617][ T3555] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 1035.569351][ T3555] usb 1-1: USB disconnect, device number 3 [ 1035.739061][ T3681] netlink: 32 bytes leftover after parsing attributes in process `syz.0.54'. [ 1035.740023][ T3681] Zero length message leads to an empty skb [ 1035.983471][ T3685] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1035.986723][ T3685] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1037.389764][ T3702] netlink: 40 bytes leftover after parsing attributes in process `syz.0.65'. [ 1040.745723][ T3725] syz_tun: entered allmulticast mode [ 1040.850377][ T3727] netlink: 182 bytes leftover after parsing attributes in process `syz.1.74'. [ 1041.220130][ T3366] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 1041.419293][ T3366] usb 1-1: New USB device found, idVendor=05f3, idProduct=0240, bcdDevice=1b.24 [ 1041.435429][ T3366] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1041.437187][ T3366] usb 1-1: config 0 has no interfaces? [ 1041.469505][ T3366] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1041.469851][ T3366] usb 1-1: Product: syz [ 1041.470122][ T3366] usb 1-1: Manufacturer: syz [ 1041.470234][ T3366] usb 1-1: SerialNumber: syz [ 1041.481820][ T3366] usb 1-1: config 0 descriptor?? [ 1041.698584][ T3729] RDS: rds_bind could not find a transport for f305:4002:241b:102:301:902:1b00:0, load rds_tcp or rds_rdma? [ 1041.707551][ T3382] usb 1-1: USB disconnect, device number 4 [ 1042.001394][ T2154] bond0: (slave bond_slave_0): interface is now down [ 1042.002063][ T2154] bond0: (slave bond_slave_1): interface is now down [ 1042.016983][ T2154] bond0: (slave bond_slave_0): interface is now down [ 1042.017424][ T2154] bond0: (slave bond_slave_1): interface is now down [ 1042.041054][ T2154] bond0: (slave bond_slave_0): interface is now down [ 1042.041397][ T2154] bond0: (slave bond_slave_1): interface is now down [ 1042.053973][ T2154] bond0: now running without any active interface! [ 1042.620673][ T3752] netlink: 'syz.0.85': attribute type 1 has an invalid length. [ 1047.865943][ T3817] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1047.870163][ T3817] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1048.199358][ T3822] EXT4-fs (vda): shut down requested (2) [ 1048.200946][ T3822] Aborting journal on device vda-8. [ 1048.399467][ T3388] syz_tun (unregistering): left allmulticast mode [ 1048.530923][ T3822] Internal error: synchronous external abort: 0000000096000050 [#1] SMP [ 1048.533175][ T3822] Modules linked in: [ 1048.535271][ T3822] CPU: 1 UID: 0 PID: 3822 Comm: syz.1.115 Tainted: G M syzkaller #0 PREEMPT [ 1048.536264][ T3822] Tainted: [M]=MACHINE_CHECK [ 1048.536641][ T3822] Hardware name: linux,dummy-virt (DT) [ 1048.537283][ T3822] pstate: 414020c9 (nZcv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 1048.537822][ T3822] pc : ata_sff_freeze+0x7c/0x90 [ 1048.538894][ T3822] lr : ata_eh_freeze_port+0x34/0x5c [ 1048.539277][ T3822] sp : ffff80008a8e3960 [ 1048.539643][ T3822] x29: ffff80008a8e3960 x28: f2f0000005b7d500 x27: 0000000000000000 [ 1048.540412][ T3822] x26: 0000000000000001 x25: ffff800081f4bcc0 x24: ffff80008279aa48 [ 1048.540951][ T3822] x23: 0000000000000000 x22: 0000000000000000 x21: f2f000000be88000 [ 1048.541484][ T3822] x20: 0000000000000000 x19: f2f000000be88000 x18: 00000000ffffffff [ 1048.542029][ T3822] x17: 0000000000000000 x16: 0000000000000000 x15: f2f000000be8a3f6 [ 1048.542613][ T3822] x14: 0000000000000000 x13: 000000000006e6d0 x12: 0000000000004308 [ 1048.543182][ T3822] x11: fff000000314a808 x10: ffff800082ea0000 x9 : 0000000000000000 [ 1048.543722][ T3822] x8 : f6f000000bd23000 x7 : ffffc1ffc02f4880 x6 : ffffc1ffc02f4880 [ 1048.544252][ T3822] x5 : 0000240000000000 x4 : 01ffe40000000000 x3 : ffff800082d46be8 [ 1048.544962][ T3822] x2 : 0000000000000000 x1 : 000000000000000a x0 : ffff80008a90b002 [ 1048.545688][ T3822] Call trace: [ 1048.546275][ T3822] ata_sff_freeze+0x7c/0x90 (P) [ 1048.546868][ T3822] ata_eh_freeze_port+0x34/0x5c [ 1048.547248][ T3822] ata_host_start+0x13c/0x228 [ 1048.547605][ T3822] ata_pci_sff_activate_host+0x50/0x340 [ 1048.548022][ T3822] ata_pci_init_one+0x19c/0x1d4 [ 1048.548441][ T3822] ata_pci_bmdma_init_one+0x14/0x20 [ 1048.548848][ T3822] ata_generic_init_one+0xc4/0x1ac [ 1048.549193][ T3822] local_pci_probe+0x40/0xa8 [ 1048.549526][ T3822] pci_device_probe+0xd8/0x288 [ 1048.549869][ T3822] really_probe+0xbc/0x2bc [ 1048.550195][ T3822] __driver_probe_device+0x11c/0x184 [ 1048.550598][ T3822] device_driver_attach+0x48/0xac [ 1048.550961][ T3822] bind_store+0x7c/0xd8 [ 1048.551313][ T3822] drv_attr_store+0x24/0x40 [ 1048.551643][ T3822] sysfs_kf_write+0x7c/0x98 [ 1048.551992][ T3822] kernfs_fop_write_iter+0x138/0x200 [ 1048.552341][ T3822] vfs_write+0x244/0x36c [ 1048.552659][ T3822] ksys_write+0x70/0x108 [ 1048.553018][ T3822] __arm64_sys_write+0x18/0x24 [ 1048.553351][ T3822] invoke_syscall+0x54/0x10c [ 1048.553737][ T3822] el0_svc_common.constprop.0+0x40/0xe0 [ 1048.554167][ T3822] do_el0_svc+0x1c/0x34 [ 1048.554649][ T3822] el0_svc+0x38/0x1fc [ 1048.555035][ T3822] el0t_64_sync_handler+0xa0/0xe4 [ 1048.555506][ T3822] el0t_64_sync+0x1a4/0x1a8 [ 1048.556307][ T3822] Code: d65f03c0 f9404800 b4fffe60 d50332bf (39000001) [ 1048.557365][ T3822] ---[ end trace 0000000000000000 ]--- [ 1048.558418][ T3822] Kernel panic - not syncing: synchronous external abort: Fatal exception [ 1048.559323][ T3822] SMP: stopping secondary CPUs [ 1048.560543][ T3822] Kernel Offset: disabled [ 1048.560865][ T3822] CPU features: 0x00000000,0034660b,f7c68f01,2afff73f [ 1048.561942][ T3822] Memory Limit: none [ 1048.563192][ T3822] Rebooting in 86400 seconds..