last executing test programs: 11.878921374s ago: executing program 1 (id=2357): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(0xffffffffffffffff, 0xc0945662, &(0x7f0000000240)={0x9, 0x0, '\x00', {0x0, @bt={0x800000, 0x7c, 0x1, 0x3, 0x5, 0xa, 0x3, 0x1, 0x800, 0x208a, 0x1, 0xea, 0x100, 0x4, 0x12, 0xb, {0x3ff, 0x401}, 0x3, 0x80}}}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000040)=0x4) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000080)={0x4, 0xbde, 0x0, &(0x7f0000000180)}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x7, 0x8, 0xc5, 0x0, 0x6, 0x9, 0x4, 0x6, 0x1, 0xf8, 0x0, 0x1, 0x0, 0x3, 0x6, 0x6, 0x9, 0x4, 0xfe, '\x00', 0x4, 0x4}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 11.69064749s ago: executing program 1 (id=2360): openat$nullb(0xffffffffffffff9c, 0x0, 0x169802, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000200)=0x10002000005) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x7, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x400000000001, 0x0, 0x1, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f000001a400)=""/102384, 0x18ff0) mprotect(&(0x7f0000a80000/0x3000)=nil, 0x3000, 0x0) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000080), 0x40, 0x0) read$FUSE(r3, &(0x7f0000000540)={0x2020}, 0xfffffccf) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) socket$phonet(0x23, 0x2, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000e, 0x8010, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) connect$unix(0xffffffffffffffff, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x40001}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b40)={{0x14}, [@NFT_MSG_NEWSET={0x30, 0x12, 0xa, 0x9, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}], {0x14}}, 0x58}}, 0x0) sendmsg$NFT_MSG_GETOBJ(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000540)={0x20, 0x15, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x1}, [@NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x20000001}, 0x2004880c) 10.42628251s ago: executing program 1 (id=2361): r0 = dup(0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000001700)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x1}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x40000) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@ipv6_newnexthop={0x24, 0x68, 0x309, 0x0, 0x9fff, {}, [@NHA_FDB={0x4}, @NHA_ID={0x8, 0x1, 0x1}]}, 0x24}}, 0x0) read(0xffffffffffffffff, 0x0, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)={0x68, r4, 0x1, 0x70bd28, 0x25dfdbfc, {}, [@TIPC_NLA_NODE={0x54, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x14, 0x3, "322d73352e2100000000000000436384"}, @TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "9ea2d328893918792a5ca222a6ad61b1143aa3a6"}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x806}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) r5 = userfaultfd(0x80001) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r5, 0xc020aa07, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1, 0x2}) socket$netlink(0x10, 0x3, 0xc) r6 = syz_open_dev$evdev(&(0x7f00000000c0), 0x3, 0x40) syz_usb_disconnect(r6) write$P9_RWSTAT(r0, &(0x7f0000000040)={0x7, 0x7f, 0x2}, 0x7) 7.353566898s ago: executing program 1 (id=2375): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff00000000000109022400010000000009040000150300000009214000000122"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000300)={0x14, &(0x7f0000000100)={0x20, 0x24, 0x16, {0x16, 0xc, "fcedfa253d8043e925819d25a1c63ac62b23c698"}}, 0x0, 0x0, 0x0}, 0x0) 4.358976693s ago: executing program 2 (id=2391): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000fc0), 0x0, 0x0, 0x0}) pselect6(0x40, &(0x7f0000000100)={0x2, 0x0, 0xfffffffffffffff8, 0x0, 0x1, 0x10}, 0x0, &(0x7f0000000240)={0x1f, 0xc, 0x715, 0x8000000000000000, 0x0, 0x80000000000000, 0x800, 0x20000}, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 4.294955735s ago: executing program 3 (id=2392): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x439, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @gretap={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_IFLAGS={0x6, 0x2, 0xc34f}]}}}]}, 0x3c}}, 0x0) 4.173471028s ago: executing program 3 (id=2393): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(0xffffffffffffffff, 0xc0945662, &(0x7f0000000240)={0x9, 0x0, '\x00', {0x0, @bt={0x800000, 0x7c, 0x1, 0x3, 0x5, 0xa, 0x3, 0x1, 0x800, 0x208a, 0x1, 0xea, 0x100, 0x4, 0x12, 0xb, {0x3ff, 0x401}, 0x3, 0x80}}}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000040)=0x4) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000080)={0x4, 0xbde, 0x0, &(0x7f0000000180)="a1984ec3aec3fc2e025f90eda6dbc903939aac644fd36f1e65174cae030c42cbacc392851a695f247112e91f059460a2c031929dc0515ac7cd20775ff9da9c2b6cb48968dcd6d8d982c492932c572f084d3af58650d207eec0794b3e47c5678c36b99eed61e1dbac68ce8a79aa21a51202018bdc4a51489844f785887083841d65c129992bbe", 0x0, 0x86}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x7, 0x8, 0xc5, 0x0, 0x6, 0x9, 0x4, 0x6, 0x1, 0xf8, 0x0, 0x1, 0x0, 0x3, 0x6, 0x6, 0x9, 0x4, 0xfe, '\x00', 0x4, 0x4}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 4.000191444s ago: executing program 1 (id=2394): socket$can_bcm(0x1d, 0x2, 0x2) bind$netlink(0xffffffffffffffff, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) keyctl$session_to_parent(0x12) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) stat(0x0, 0x0) socket$nl_audit(0x10, 0x3, 0x9) syz_usb_connect(0x2, 0x9a2, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d0241710d8050a81b892000000010902900902000000000904"], 0x0) r0 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000040)={&(0x7f0000000140)=[{0x7, 0x8000, 0x0, &(0x7f0000000080)}, {0x7, 0x2100, 0x0, &(0x7f0000000180)}], 0x2}) socket$inet_icmp_raw(0x2, 0x3, 0x1) unshare(0x400) 3.912452996s ago: executing program 3 (id=2395): openat$nullb(0xffffffffffffff9c, 0x0, 0x169802, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000200)=0x10002000005) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x7, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x400000000001, 0x0, 0x1, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f000001a400)=""/102384, 0x18ff0) mprotect(&(0x7f0000a80000/0x3000)=nil, 0x3000, 0x0) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000080), 0x40, 0x0) read$FUSE(r3, &(0x7f0000000540)={0x2020}, 0xfffffccf) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) socket$phonet(0x23, 0x2, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000e, 0x8010, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) connect$unix(0xffffffffffffffff, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x40001}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b40)={{0x14}, [@NFT_MSG_NEWSET={0x34, 0x12, 0xa, 0x9, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}], {0x14}}, 0x5c}}, 0x0) sendmsg$NFT_MSG_GETOBJ(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000540)={0x20, 0x15, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x1}, [@NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x20000001}, 0x2004880c) 2.669683566s ago: executing program 3 (id=2396): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) socket$alg(0x26, 0x5, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) futex_waitv(&(0x7f0000002d40)=[{0x7, 0x0, 0x2}], 0x1, 0x0, 0x0, 0x1) 2.622514698s ago: executing program 2 (id=2397): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x2d1, 0x200, 0x3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x48040}, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x10}, 0x0) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r4, &(0x7f0000000000)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r6, 0x28}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000180)="27030200084014000e00002fb96dffff1144ee163cddcb000000800000827600000000000000", 0x26}, {&(0x7f0000000780)="f058050000007f8f", 0x300}], 0x2}, 0x5) 2.590847328s ago: executing program 0 (id=2398): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_WINDOW(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x30, r1, 0x1, 0x70bd2b, 0x25dfdbfc, {{}, {0x0, 0x4108}, {0x14, 0x18, {0x1ff, @bearer=@udp='udp:syz2\x00'}}}}, 0x30}, 0x1, 0x0, 0x0, 0x4001}, 0x14) 2.445690573s ago: executing program 0 (id=2399): r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfbffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff2}, {0xffff, 0xffff}, {0xa, 0x7}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000440)=@newtfilter={0x38, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0x7, 0x5}, {}, {0x7, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20040000}, 0x800) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) socket$igmp(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r6 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r6, &(0x7f00000000c0)={&(0x7f0000000180)=@xdp={0x2c, 0x7, r7, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000140)='\r', 0x1}], 0x1}, 0x4) 2.376844325s ago: executing program 2 (id=2400): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0xe) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x94) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f00000000c0)) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r3) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000040}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_DEL(r7, &(0x7f00000005c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1000}, 0xc, 0x0}, 0x4) ioctl$HIDIOCAPPLICATION(r1, 0x4802, 0x1) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01020000000000000000010000000900010073797a300000000044000000030a01010000000000000000010000040900030073797a32000000001400048008000140000000020800014000000000100008800c00014000000000000003ab280000000c0a01020000000000000000"], 0xb4}}, 0x0) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000380)={0x0, 0x6, 0x9, 0x2ba, 0x7ff, 0x4, 0xe070, 0x8001, {0x0, @in6={{0xa, 0x4e22, 0x2, @mcast1, 0x3b}}, 0x3, 0x3246, 0x3, 0x5eb8d735, 0x8}}, &(0x7f0000000440)=0xb0) sendmsg$NL80211_CMD_CONNECT(r6, 0x0, 0x0) r9 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$PPPIOCSFLAGS1(r2, 0x40047459, &(0x7f0000000280)=0x5010c02) ioctl$EVIOCGPROP(r9, 0x40047438, &(0x7f0000000180)=""/246) ioctl$PPPIOCSFLAGS1(r9, 0x4004743a, &(0x7f0000000300)) pwritev(r2, &(0x7f00000002c0)=[{&(0x7f0000000140)="000f", 0x2}], 0x1, 0x20000002, 0x100000) 2.074959985s ago: executing program 0 (id=2401): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000680)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x4c, r1, 0x1, 0x70bd28, 0x25dfdbfd, {{}, {@void, @val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x8, 0x30}}}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'syzkaller0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x4}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x81}, 0x24044884) 1.886866541s ago: executing program 2 (id=2402): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x439, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @gretap={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_IFLAGS={0x6, 0x2, 0xc34f}]}}}]}, 0x3c}}, 0x0) 1.834447602s ago: executing program 0 (id=2403): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(0xffffffffffffffff, 0xc0945662, &(0x7f0000000240)={0x9, 0x0, '\x00', {0x0, @bt={0x800000, 0x7c, 0x1, 0x3, 0x5, 0xa, 0x3, 0x1, 0x800, 0x208a, 0x1, 0xea, 0x100, 0x4, 0x12, 0xb, {0x3ff, 0x401}, 0x3, 0x80}}}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000040)=0x4) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000080)={0x4, 0xbde, 0x0, &(0x7f0000000180)="a1984ec3aec3fc2e025f90eda6dbc903939aac644fd36f1e65174cae030c42cbacc392851a695f247112e91f059460a2c031929dc0515ac7cd20775ff9da9c2b6cb48968dcd6d8d982c492932c572f084d3af58650d207eec0794b3e47c5678c36b99eed61e1dbac68ce8a79aa21a51202018bdc4a51489844f785887083841d65c129992bbe", 0x0, 0x86}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x7, 0x8, 0xc5, 0x0, 0x6, 0x9, 0x4, 0x6, 0x1, 0xf8, 0x0, 0x1, 0x0, 0x3, 0x6, 0x6, 0x9, 0x4, 0xfe, '\x00', 0x4, 0x4}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.693482717s ago: executing program 2 (id=2404): openat$nullb(0xffffffffffffff9c, 0x0, 0x169802, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000200)=0x10002000005) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x7, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x400000000001, 0x0, 0x1, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f000001a400)=""/102384, 0x18ff0) mprotect(&(0x7f0000a80000/0x3000)=nil, 0x3000, 0x0) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000080), 0x40, 0x0) read$FUSE(r3, &(0x7f0000000540)={0x2020}, 0xfffffccf) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) socket$phonet(0x23, 0x2, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000e, 0x8010, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) connect$unix(0xffffffffffffffff, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x40001}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b40)={{0x14}, [@NFT_MSG_NEWSET={0x34, 0x12, 0xa, 0x9, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}], {0x14}}, 0x5c}}, 0x0) sendmsg$NFT_MSG_GETOBJ(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000540)={0x20, 0x15, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x1}, [@NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x20000001}, 0x2004880c) 396.529498ms ago: executing program 2 (id=2405): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000fc0), 0x0, 0x0, 0x0}) pselect6(0x40, &(0x7f0000000100)={0x2, 0x0, 0xfffffffffffffff8, 0x0, 0x1, 0x10}, 0x0, &(0x7f0000000240)={0x1f, 0xc, 0x715, 0x8000000000000000, 0x0, 0x80000000000000, 0x800, 0x20000}, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 287.744432ms ago: executing program 3 (id=2406): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r1, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) r3 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r3, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x3, 0xfffffffd}}, 0x10) bind$tipc(r2, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) bind$tipc(r2, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x2, {0x42, 0x1, 0x3}}, 0x10) r4 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x1}, 0x10) r5 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r5, &(0x7f0000000380)={&(0x7f0000000140)=@nameseq={0x1e, 0x1, 0x2, {0x42, 0x3, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000884}, 0x4) 173.487455ms ago: executing program 0 (id=2407): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000d00)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f0000005240)=[{{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000180)="a6", 0x1}], 0x1, &(0x7f0000005140)=[@rights={{0x14, 0x1, 0x1, [r1]}}], 0x18, 0x10}}], 0x1, 0x0) recvfrom$unix(r1, &(0x7f0000000080)=""/16, 0x10, 0x0, 0x0, 0x0) 79.010218ms ago: executing program 3 (id=2408): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x2d1, 0x200, 0x3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x48040}, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x10}, 0x0) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r4, &(0x7f0000000000)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r6, 0x28}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000180)="27030200084014000e00002fb96dffff1144ee163cddcb000000800000827600000000000000", 0x26}, {&(0x7f0000000780)="f058050000007f8f", 0x300}], 0x2}, 0x5) 43.908999ms ago: executing program 0 (id=2409): r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfbffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff2}, {0xffff, 0xffff}, {0xa, 0x7}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000440)=@newtfilter={0x38, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0x7, 0x5}, {}, {0x7, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20040000}, 0x800) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) socket$igmp(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r6 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r6, &(0x7f00000000c0)={&(0x7f0000000180)=@xdp={0x2c, 0x7, r7, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000140)='\r', 0x1}], 0x1}, 0x4) 0s ago: executing program 1 (id=2410): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0xe) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x94) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f00000000c0)) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r3) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000040}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_DEL(r7, &(0x7f00000005c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1000}, 0xc, 0x0}, 0x4) ioctl$HIDIOCAPPLICATION(r1, 0x4802, 0x1) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01020000000000000000010000000900010073797a300000000044000000030a01010000000000000000010000040900030073797a32000000001400048008000140000000020800014000000000100008800c00014000000000000003ab280000000c0a01020000000000000000"], 0xb4}}, 0x0) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000380)={0x0, 0x6, 0x9, 0x2ba, 0x7ff, 0x4, 0xe070, 0x8001, {0x0, @in6={{0xa, 0x4e22, 0x2, @mcast1, 0x3b}}, 0x3, 0x3246, 0x3, 0x5eb8d735, 0x8}}, &(0x7f0000000440)=0xb0) sendmsg$NL80211_CMD_CONNECT(r6, 0x0, 0x0) r9 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$PPPIOCSFLAGS1(r2, 0x40047459, &(0x7f0000000280)=0x5010c02) ioctl$EVIOCGPROP(r9, 0x40047438, &(0x7f0000000180)=""/246) ioctl$PPPIOCSFLAGS1(r9, 0x4004743a, &(0x7f0000000300)) pwritev(r2, &(0x7f00000002c0)=[{&(0x7f0000000140)="000f", 0x2}], 0x1, 0x20000002, 0x100000) kernel console output (not intermixed with test programs): [ 498.262495][ T5812] usb 2-1: config 4 has no interface number 0 [ 498.269983][ T5812] usb 2-1: config 4 interface 55 has no altsetting 0 [ 498.279616][ T5812] usb 2-1: New USB device found, idVendor=08ca, idProduct=0111, bcdDevice=2f.cb [ 498.289721][ T5812] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 498.297900][ T5812] usb 2-1: Product: syz [ 498.302124][ T5812] usb 2-1: Manufacturer: syz [ 498.306735][ T5812] usb 2-1: SerialNumber: syz [ 498.745971][T10957] netlink: 148 bytes leftover after parsing attributes in process `syz.1.1518'. [ 498.802026][T10957] netlink: 148 bytes leftover after parsing attributes in process `syz.1.1518'. [ 499.590747][T10949] syzkaller0: entered promiscuous mode [ 499.596496][T10949] syzkaller0: entered allmulticast mode [ 499.604831][T10953] tipc: Enabled bearer , priority 0 [ 499.611876][T10937] tipc: Resetting bearer [ 499.653811][T10937] tipc: Disabling bearer [ 499.995297][T10982] kvm: pic: non byte read [ 499.999775][T10982] kvm: pic: non byte read [ 500.039130][ T969] IPVS: starting estimator thread 0... [ 500.149367][T10987] IPVS: using max 23 ests per chain, 55200 per kthread [ 500.923695][ T5812] gspca_main: mr97310a-2.14.0 probing 08ca:0111 [ 500.941002][ T5812] gspca_mr97310a: reg write [21] error -22 [ 500.951041][ T5812] mr97310a: probe of 2-1:4.55 failed with error -22 [ 500.966376][ T5812] usb 2-1: USB disconnect, device number 36 [ 500.981397][T11004] syzkaller0: entered promiscuous mode [ 500.988456][T11004] syzkaller0: entered allmulticast mode [ 500.999203][T11004] tipc: Enabled bearer , priority 0 [ 501.008744][T11003] tipc: Resetting bearer [ 501.026862][ T788] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 501.036057][T11003] tipc: Disabling bearer [ 501.113234][ T5830] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 501.232369][ T788] usb 3-1: Using ep0 maxpacket: 8 [ 501.239006][ T788] usb 3-1: config 0 interface 0 altsetting 15 endpoint 0x81 has an invalid bInterval 33, changing to 9 [ 501.250858][ T788] usb 3-1: config 0 interface 0 altsetting 15 endpoint 0x81 has invalid maxpacket 1056, setting to 1024 [ 501.262142][ T788] usb 3-1: config 0 interface 0 has no altsetting 0 [ 501.268813][ T788] usb 3-1: New USB device found, idVendor=046d, idProduct=c20a, bcdDevice= 0.00 [ 501.278292][ T788] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 501.289959][ T788] usb 3-1: config 0 descriptor?? [ 501.295607][T10994] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 501.319158][ T5830] usb 4-1: Using ep0 maxpacket: 16 [ 501.326480][ T5830] usb 4-1: unable to get BOS descriptor or descriptor too short [ 501.335672][ T5830] usb 4-1: config 4 has an invalid interface number: 55 but max is 0 [ 501.343904][ T5830] usb 4-1: config 4 has no interface number 0 [ 501.350015][ T5830] usb 4-1: config 4 interface 55 has no altsetting 0 [ 501.359065][ T5830] usb 4-1: New USB device found, idVendor=08ca, idProduct=0111, bcdDevice=2f.cb [ 501.368317][ T5830] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 501.376386][ T5830] usb 4-1: Product: syz [ 501.380586][ T5830] usb 4-1: Manufacturer: syz [ 501.385295][ T5830] usb 4-1: SerialNumber: syz [ 501.600810][ T5812] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 501.757699][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 501.769446][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 501.781756][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 501.798895][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 501.809064][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 501.816253][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 501.826453][ T5812] usb 2-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xE8, skipping [ 501.838064][ T5812] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xA has an invalid bInterval 0, changing to 7 [ 501.914311][ T5812] usb 2-1: New USB device found, idVendor=1781, idProduct=0938, bcdDevice=9b.49 [ 501.925903][ T5812] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 501.934222][ T5812] usb 2-1: Product: syz [ 501.942841][ T5812] usb 2-1: Manufacturer: syz [ 501.948062][ T5812] usb 2-1: SerialNumber: syz [ 501.967997][ T5812] usb 2-1: config 0 descriptor?? [ 502.098566][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.110517][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.117771][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.130496][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.141560][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.149440][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.156693][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.163948][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.171102][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.178459][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.185781][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.192929][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.202401][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.221942][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.230911][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.238124][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.245416][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.256741][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.264041][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.271251][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.282819][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.290382][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.298099][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.305771][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.312978][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.320684][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.328738][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.335971][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.343807][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.351286][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.364264][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.386189][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.394111][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.401843][ T788] logitech 0003:046D:C20A.000E: unknown main item tag 0x0 [ 502.423648][ T788] logitech 0003:046D:C20A.000E: hidraw0: USB HID v8.0c Device [HID 046d:c20a] on usb-dummy_hcd.2-1/input0 [ 502.445610][ T788] logitech 0003:046D:C20A.000E: no inputs found [ 502.470235][ T788] usb 3-1: USB disconnect, device number 42 [ 502.575982][T11017] fido_id[11017]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 503.071061][T11025] kvm: pic: non byte read [ 503.075755][T11025] kvm: pic: non byte read [ 503.994531][ T788] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 504.036694][ T5830] gspca_main: mr97310a-2.14.0 probing 08ca:0111 [ 504.052094][ T5830] gspca_mr97310a: reg write [21] error -22 [ 504.064330][ T5830] mr97310a: probe of 4-1:4.55 failed with error -22 [ 504.076204][ T5830] usb 4-1: USB disconnect, device number 27 [ 504.189547][ T788] usb 1-1: Using ep0 maxpacket: 16 [ 504.269364][ T788] usb 1-1: unable to get BOS descriptor or descriptor too short [ 504.387960][ T788] usb 1-1: config 4 has an invalid interface number: 55 but max is 0 [ 504.397871][ T788] usb 1-1: config 4 has no interface number 0 [ 504.404174][ T788] usb 1-1: config 4 interface 55 has no altsetting 0 [ 504.414230][ T788] usb 1-1: New USB device found, idVendor=08ca, idProduct=0111, bcdDevice=2f.cb [ 504.423763][ T788] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 504.440688][ T788] usb 1-1: Product: syz [ 504.450855][ T788] usb 1-1: Manufacturer: syz [ 504.456191][ T788] usb 1-1: SerialNumber: syz [ 504.655614][ T5812] usb 2-1: USB disconnect, device number 37 [ 504.742325][T11048] syzkaller0: entered promiscuous mode [ 504.768658][T11048] syzkaller0: entered allmulticast mode [ 504.916930][T11031] netlink: 148 bytes leftover after parsing attributes in process `syz.0.1542'. [ 504.947958][T11056] kvm: pic: non byte read [ 504.952391][T11056] kvm: pic: non byte read [ 504.995253][T11060] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 505.085531][T11031] netlink: 148 bytes leftover after parsing attributes in process `syz.0.1542'. [ 505.711556][T11080] syzkaller0: entered promiscuous mode [ 505.717822][T11080] syzkaller0: entered allmulticast mode [ 506.059712][T11084] syzkaller0: entered promiscuous mode [ 506.072334][T11084] syzkaller0: entered allmulticast mode [ 506.689424][T11097] mac80211_hwsim hwsim9 wlan1: entered allmulticast mode [ 506.856049][T11102] syzkaller0: entered promiscuous mode [ 506.861769][T11102] syzkaller0: entered allmulticast mode [ 507.012644][ T788] gspca_main: mr97310a-2.14.0 probing 08ca:0111 [ 507.046520][ T788] gspca_mr97310a: reg write [21] error -22 [ 507.061128][ T788] mr97310a: probe of 1-1:4.55 failed with error -22 [ 507.081838][ T788] usb 1-1: USB disconnect, device number 34 [ 507.319981][ T5812] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 507.634630][ T5812] usb 2-1: config index 0 descriptor too short (expected 45, got 36) [ 507.643296][ T5812] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 507.679440][ T5812] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 507.692588][ T5812] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 507.701771][ T5812] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 507.763540][ T5812] usb 2-1: config 0 descriptor?? [ 507.777374][ T5812] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 508.551124][ T5812] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 508.785361][ T5812] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 508.796823][ T5812] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 508.810390][ T5812] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 508.823616][ T5812] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 508.837763][ T5812] usb 1-1: config 0 descriptor?? [ 508.847562][ T5812] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 509.287387][T11077] Set syz1 is full, maxelem 65536 reached [ 509.358573][T11140] syzkaller0: entered promiscuous mode [ 509.364113][T11140] syzkaller0: entered allmulticast mode [ 509.778710][ T5830] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 509.835282][T11144] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 509.844221][T11144] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 509.986857][ T5830] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 64, changing to 7 [ 509.998191][ T5830] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 250, changing to 7 [ 510.016777][ T5830] usb 4-1: New USB device found, idVendor=2a39, idProduct=3fd4, bcdDevice= 0.40 [ 510.038673][ T5830] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 510.050350][ T5830] usb 4-1: Product: syz [ 510.059468][ T5830] usb 4-1: Manufacturer: syz [ 510.070838][ T5830] usb 4-1: SerialNumber: syz [ 510.175760][T11150] syzkaller0: entered promiscuous mode [ 510.182796][T11150] syzkaller0: entered allmulticast mode [ 510.312059][ T788] usb 2-1: USB disconnect, device number 38 [ 510.348765][ T5830] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 510.368129][ T5830] usb 4-1: unit 6 not found! [ 510.397792][T11152] tipc: Enabled bearer , priority 0 [ 510.419390][T11152] syzkaller0: entered promiscuous mode [ 510.431637][ T5830] usb 4-1: USB disconnect, device number 28 [ 510.447675][T11152] syzkaller0: entered allmulticast mode [ 510.476291][ T5766] udevd[5766]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 510.491181][T11152] tipc: Resetting bearer [ 510.534939][T11151] tipc: Resetting bearer [ 510.574268][T11151] tipc: Disabling bearer [ 510.627694][T11157] syzkaller0: entered promiscuous mode [ 510.633207][T11157] syzkaller0: entered allmulticast mode [ 511.296374][ T5812] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 511.486043][ T969] usb 1-1: USB disconnect, device number 35 [ 511.508395][ T5812] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 511.529830][ T5812] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 511.540299][ T5812] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 511.579369][ T5812] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 511.603806][ T5812] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 511.614884][ T5812] usb 4-1: config 0 descriptor?? [ 512.079437][ T5812] plantronics 0003:047F:FFFF.000F: unknown main item tag 0x4 [ 512.088342][ T5812] plantronics 0003:047F:FFFF.000F: No inputs registered, leaving [ 512.103331][ T5812] plantronics 0003:047F:FFFF.000F: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 512.911300][T11186] syzkaller0: entered promiscuous mode [ 512.916921][T11186] syzkaller0: entered allmulticast mode [ 513.430755][ T788] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 513.675316][ T788] usb 1-1: config 0 has too many interfaces: 253, using maximum allowed: 32 [ 513.711272][ T788] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 253 [ 513.744050][ T788] usb 1-1: New USB device found, idVendor=055f, idProduct=c630, bcdDevice=b6.ac [ 513.753126][ T788] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 513.769313][ T788] usb 1-1: Product: syz [ 513.773585][ T788] usb 1-1: Manufacturer: syz [ 513.778428][ T788] usb 1-1: SerialNumber: syz [ 513.795560][ T788] usb 1-1: config 0 descriptor?? [ 513.813420][ T788] gspca_main: sunplus-2.14.0 probing 055f:c630 [ 514.111519][ T5812] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 514.341572][ T5844] usb 4-1: USB disconnect, device number 29 [ 514.387242][ T5812] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 64, changing to 7 [ 514.423602][T11206] syzkaller0: entered promiscuous mode [ 514.431872][T11206] syzkaller0: entered allmulticast mode [ 514.467267][ T5812] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 250, changing to 7 [ 514.497773][ T5812] usb 2-1: New USB device found, idVendor=2a39, idProduct=3fd4, bcdDevice= 0.40 [ 514.527864][ T5812] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 514.540255][ T5812] usb 2-1: Product: syz [ 514.570240][ T5812] usb 2-1: Manufacturer: syz [ 514.587956][ T5812] usb 2-1: SerialNumber: syz [ 514.849104][ T5812] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 514.861599][ T5812] usb 2-1: unit 6 not found! [ 514.926143][ T5812] usb 2-1: USB disconnect, device number 39 [ 515.056130][ T5762] udevd[5762]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 515.189297][ T969] usb 1-1: USB disconnect, device number 36 [ 517.067648][T11241] erspan0: left allmulticast mode [ 517.075407][T11241] erspan0: left promiscuous mode [ 517.080679][T11241] bridge1: port 1(erspan0) entered disabled state [ 517.097523][T11241] bond0: (slave syz_tun): Releasing backup interface [ 517.111658][T11241] bridge_slave_0: left allmulticast mode [ 517.117913][T11241] bridge_slave_0: left promiscuous mode [ 517.145056][T11241] bridge0: port 1(bridge_slave_0) entered disabled state [ 517.179570][T11241] bridge_slave_1: left allmulticast mode [ 517.185273][T11241] bridge_slave_1: left promiscuous mode [ 517.210800][T11241] bridge0: port 2(bridge_slave_1) entered disabled state [ 517.242625][T11241] bond0: (slave bond_slave_0): Releasing backup interface [ 517.280331][T11241] bond0: (slave bond_slave_1): Releasing backup interface [ 517.335777][T11241] team0: Port device team_slave_0 removed [ 517.370288][T11241] team0: Port device team_slave_1 removed [ 517.391721][T11241] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 517.411923][T11241] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 517.431824][T11241] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 517.451087][T11241] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 517.723348][T11263] input: syz1 as /devices/virtual/input/input31 [ 518.349187][T11275] syzkaller0: entered promiscuous mode [ 518.367930][T11275] syzkaller0: entered allmulticast mode [ 518.509345][ T5830] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 518.726788][ T5830] usb 2-1: config 0 has too many interfaces: 253, using maximum allowed: 32 [ 518.769865][ T5830] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 253 [ 518.900812][ T5830] usb 2-1: New USB device found, idVendor=055f, idProduct=c630, bcdDevice=b6.ac [ 518.912691][ T5830] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 518.920987][ T5830] usb 2-1: Product: syz [ 518.942617][ T5830] usb 2-1: Manufacturer: syz [ 518.964559][ T5830] usb 2-1: SerialNumber: syz [ 519.005735][ T5830] usb 2-1: config 0 descriptor?? [ 519.028760][ T5830] gspca_main: sunplus-2.14.0 probing 055f:c630 [ 520.370752][ T5830] usb 2-1: USB disconnect, device number 40 [ 521.027370][T11300] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1620'. [ 521.111498][T11300] 8021q: adding VLAN 0 to HW filter on device bond1 [ 521.130511][T11304] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1620'. [ 521.189704][T11304] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1620'. [ 521.235022][T11304] 8021q: adding VLAN 0 to HW filter on device bond0 [ 522.456250][T11304] bond1: (slave bond0): Enslaving as an active interface with an up link [ 522.514256][T11300] netlink: 'syz.1.1620': attribute type 10 has an invalid length. [ 522.535275][T11300] bridge0: port 1(bridge_slave_0) entered disabled state [ 522.591417][T11300] bridge0: port 1(bridge_slave_0) entered blocking state [ 522.598627][T11300] bridge0: port 1(bridge_slave_0) entered forwarding state [ 522.615482][T11300] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 522.778052][T11322] syzkaller0: entered promiscuous mode [ 522.786006][T11322] syzkaller0: entered allmulticast mode [ 522.960565][T11329] netlink: 'syz.2.1629': attribute type 72 has an invalid length. [ 522.968742][T11329] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1629'. [ 524.410406][T11336] syzkaller0: entered promiscuous mode [ 524.438167][T11336] syzkaller0: entered allmulticast mode [ 524.933377][T11360] netlink: 'syz.1.1639': attribute type 72 has an invalid length. [ 524.954326][T11360] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1639'. [ 525.447830][T11359] kvm: pic: non byte read [ 525.452255][T11359] kvm: pic: non byte read [ 525.807356][T11376] syzkaller0: entered promiscuous mode [ 525.813234][T11376] syzkaller0: entered allmulticast mode [ 526.323946][T11392] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1651'. [ 526.371205][T11392] mac80211_hwsim hwsim7 wlan1: entered allmulticast mode [ 526.418947][T11396] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1652'. [ 526.449078][T11396] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 526.456839][T11396] IPv6: NLM_F_CREATE should be set when creating new route [ 526.533739][T11400] syzkaller0: entered promiscuous mode [ 526.540832][T11400] syzkaller0: entered allmulticast mode [ 527.029603][T11423] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1665'. [ 527.053239][T11423] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 527.060554][T11423] IPv6: NLM_F_CREATE should be set when creating new route [ 527.433701][T11436] syzkaller0: entered promiscuous mode [ 527.439959][T11436] syzkaller0: entered allmulticast mode [ 527.806991][T11445] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1675'. [ 527.816595][T11445] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 527.823831][T11445] IPv6: NLM_F_CREATE should be set when creating new route [ 527.943921][ T969] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 528.163227][ T969] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 528.185640][ T969] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 528.220158][ T969] usb 2-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 528.230673][ T969] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 528.262272][ T969] usb 2-1: config 0 descriptor?? [ 528.281059][ T969] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 528.301733][T11460] syzkaller0: entered promiscuous mode [ 528.307255][T11460] syzkaller0: entered allmulticast mode [ 528.644533][T11472] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1685'. [ 528.658980][T11472] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 528.793410][T11478] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1687'. [ 528.981869][T11487] syzkaller0: entered promiscuous mode [ 528.987718][T11487] syzkaller0: entered allmulticast mode [ 529.809797][T11509] syzkaller0: entered promiscuous mode [ 529.832698][T11509] syzkaller0: entered allmulticast mode [ 529.849586][T11509] tipc: Enabled bearer , priority 0 [ 529.885736][T11508] tipc: Resetting bearer [ 529.928860][T11508] tipc: Disabling bearer [ 530.122077][T11513] syzkaller0: entered promiscuous mode [ 530.130063][T11513] syzkaller0: entered allmulticast mode [ 530.451162][T11522] syzkaller0: entered promiscuous mode [ 530.474794][T11522] syzkaller0: entered allmulticast mode [ 530.738907][T11532] syzkaller0: entered promiscuous mode [ 530.749220][T11532] syzkaller0: entered allmulticast mode [ 530.768241][T11532] tipc: Enabled bearer , priority 0 [ 530.777908][T11531] tipc: Resetting bearer [ 530.828983][T11531] tipc: Disabling bearer [ 530.928593][ T788] usb 2-1: USB disconnect, device number 41 [ 530.947897][T11537] syzkaller0: entered promiscuous mode [ 530.953454][T11537] syzkaller0: entered allmulticast mode [ 531.611273][T11557] syzkaller0: entered promiscuous mode [ 531.627144][T11557] syzkaller0: entered allmulticast mode [ 531.956741][T11565] syzkaller0: entered promiscuous mode [ 531.966403][T11565] syzkaller0: entered allmulticast mode [ 532.309068][ T788] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 532.506847][ T788] usb 4-1: config 0 has too many interfaces: 253, using maximum allowed: 32 [ 532.521100][ T788] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 253 [ 532.541014][ T788] usb 4-1: New USB device found, idVendor=055f, idProduct=c630, bcdDevice=b6.ac [ 532.550207][ T788] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 532.560770][ T788] usb 4-1: Product: syz [ 532.565437][ T788] usb 4-1: Manufacturer: syz [ 532.571633][ T788] usb 4-1: SerialNumber: syz [ 532.581131][ T788] usb 4-1: config 0 descriptor?? [ 532.599651][ T788] gspca_main: sunplus-2.14.0 probing 055f:c630 [ 532.701696][T11573] syzkaller0: entered promiscuous mode [ 532.707241][T11573] syzkaller0: entered allmulticast mode [ 533.275655][T11585] syzkaller0: entered promiscuous mode [ 533.281191][T11585] syzkaller0: entered allmulticast mode [ 533.876607][T11601] kvm: pic: non byte read [ 533.883562][T11601] kvm: pic: non byte read [ 534.104748][ T788] usb 4-1: USB disconnect, device number 30 [ 535.049872][T11612] syzkaller0: entered promiscuous mode [ 535.071537][T11612] syzkaller0: entered allmulticast mode [ 535.190120][T11618] syzkaller0: entered promiscuous mode [ 535.201217][T11618] syzkaller0: entered allmulticast mode [ 535.732883][ T5830] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 535.941319][ T1283] ieee802154 phy0 wpan0: encryption failed: -22 [ 535.947786][ T1283] ieee802154 phy1 wpan1: encryption failed: -22 [ 535.961810][ T5830] usb 3-1: config 0 has too many interfaces: 253, using maximum allowed: 32 [ 535.970905][ T5830] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 253 [ 535.982986][ T5830] usb 3-1: New USB device found, idVendor=055f, idProduct=c630, bcdDevice=b6.ac [ 535.992273][ T5830] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 536.000362][ T5830] usb 3-1: Product: syz [ 536.004779][ T5830] usb 3-1: Manufacturer: syz [ 536.009400][ T5830] usb 3-1: SerialNumber: syz [ 536.017547][ T5830] usb 3-1: config 0 descriptor?? [ 536.026280][ T5830] gspca_main: sunplus-2.14.0 probing 055f:c630 [ 536.464137][T11652] syzkaller0: entered promiscuous mode [ 536.470014][T11652] syzkaller0: entered allmulticast mode [ 537.356732][ T969] usb 3-1: USB disconnect, device number 43 [ 538.108750][T11684] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1761'. [ 539.089235][ T5812] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 539.317289][ T5812] usb 2-1: Using ep0 maxpacket: 32 [ 539.326213][ T5812] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 539.336841][ T5812] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 539.401359][ T5812] usb 2-1: config 0 descriptor?? [ 539.666361][ T5812] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 539.694235][ T5812] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 539.719656][ T5812] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 539.746118][ T5812] usb 2-1: media controller created [ 539.792654][ T5812] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 539.935172][T11704] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1767'. [ 539.970231][T11704] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 540.000412][T11704] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 540.603989][ T5812] az6027: usb out operation failed. (-71) [ 540.618098][ T5812] az6027: usb out operation failed. (-71) [ 540.623919][ T5812] stb0899_attach: Driver disabled by Kconfig [ 540.630125][ T5812] az6027: no front-end attached [ 540.630125][ T5812] [ 540.638299][ T5812] az6027: usb out operation failed. (-71) [ 540.649683][ T5812] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 540.746675][ T5812] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input32 [ 540.773806][ T5812] dvb-usb: schedule remote query interval to 400 msecs. [ 540.781305][ T5812] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 540.811688][ T5812] usb 2-1: USB disconnect, device number 42 [ 540.986071][ T5812] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 541.212847][ T788] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 541.418665][ T788] usb 4-1: Using ep0 maxpacket: 16 [ 541.451617][ T788] usb 4-1: unable to get BOS descriptor or descriptor too short [ 541.471121][ T788] usb 4-1: config 4 has an invalid interface number: 55 but max is 0 [ 541.480717][ T788] usb 4-1: config 4 has no interface number 0 [ 541.489128][ T788] usb 4-1: config 4 interface 55 has no altsetting 0 [ 541.503752][ T788] usb 4-1: New USB device found, idVendor=08ca, idProduct=0111, bcdDevice=2f.cb [ 541.530380][ T788] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 541.545394][ T788] usb 4-1: Product: syz [ 541.550070][ T788] usb 4-1: Manufacturer: syz [ 541.554968][ T788] usb 4-1: SerialNumber: syz [ 541.561272][T11725] syzkaller0: entered promiscuous mode [ 541.600513][T11725] syzkaller0: entered allmulticast mode [ 543.804962][ T788] gspca_main: mr97310a-2.14.0 probing 08ca:0111 [ 543.811266][ T788] gspca_mr97310a: reg write [21] error -22 [ 543.828747][ T788] mr97310a: probe of 4-1:4.55 failed with error -22 [ 543.842107][ T788] usb 4-1: USB disconnect, device number 31 [ 543.981591][T11760] syzkaller0: entered promiscuous mode [ 543.988934][T11760] syzkaller0: entered allmulticast mode [ 545.833813][T11791] syzkaller0: entered promiscuous mode [ 545.840069][T11791] syzkaller0: entered allmulticast mode [ 545.946422][ T788] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 545.974096][T11793] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1794'. [ 546.152157][ T788] usb 1-1: Using ep0 maxpacket: 16 [ 546.159305][ T788] usb 1-1: unable to get BOS descriptor or descriptor too short [ 546.169163][ T788] usb 1-1: config 4 has an invalid interface number: 55 but max is 0 [ 546.177587][ T788] usb 1-1: config 4 has no interface number 0 [ 546.184117][ T788] usb 1-1: config 4 interface 55 has no altsetting 0 [ 546.195317][ T788] usb 1-1: New USB device found, idVendor=08ca, idProduct=0111, bcdDevice=2f.cb [ 546.205557][ T788] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 546.215034][ T788] usb 1-1: Product: syz [ 546.223328][ T788] usb 1-1: Manufacturer: syz [ 546.230450][ T788] usb 1-1: SerialNumber: syz [ 546.347267][ T5830] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 546.630498][ T5830] usb 3-1: config 0 has too many interfaces: 253, using maximum allowed: 32 [ 546.697776][ T5830] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 253 [ 546.800566][ T5830] usb 3-1: New USB device found, idVendor=055f, idProduct=c630, bcdDevice=b6.ac [ 546.819648][ T5830] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 546.849878][ T5830] usb 3-1: Product: syz [ 546.854261][ T5830] usb 3-1: Manufacturer: syz [ 546.915573][ T5830] usb 3-1: SerialNumber: syz [ 546.956931][ T5830] usb 3-1: config 0 descriptor?? [ 546.989742][ T5830] gspca_main: sunplus-2.14.0 probing 055f:c630 [ 547.174676][ T788] gspca_main: mr97310a-2.14.0 probing 08ca:0111 [ 547.187690][ T788] gspca_mr97310a: reg write [21] error -22 [ 547.194355][ T788] mr97310a: probe of 1-1:4.55 failed with error -22 [ 547.204808][ T788] usb 1-1: USB disconnect, device number 37 [ 547.387129][ T5844] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 547.594799][ T5844] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 547.614986][ T5844] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 547.646414][ T5844] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 547.669102][ T5844] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 547.683221][ T5844] usb 4-1: config 0 descriptor?? [ 547.694601][ T5844] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 547.819281][T11822] syzkaller0: entered promiscuous mode [ 547.824918][T11822] syzkaller0: entered allmulticast mode [ 547.899690][T11824] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1803'. [ 548.319617][ T5830] usb 3-1: USB disconnect, device number 44 [ 548.677368][T11834] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 548.686067][T11834] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 550.407073][ T5830] usb 4-1: USB disconnect, device number 32 [ 551.980504][T11868] syzkaller0: entered promiscuous mode [ 551.987604][T11868] syzkaller0: entered allmulticast mode [ 553.993413][ T5812] usb 2-1: new full-speed USB device number 43 using dummy_hcd [ 554.239068][ T5812] usb 2-1: config 0 interface 0 altsetting 251 endpoint 0x9 has an invalid bInterval 39, changing to 4 [ 554.282918][ T5812] usb 2-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid maxpacket 15380, setting to 1023 [ 554.308703][ T5812] usb 2-1: config 0 interface 0 has no altsetting 0 [ 554.323716][ T5812] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 554.377014][ T5812] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 554.407344][ T5812] usb 2-1: Product: syz [ 554.434128][ T5812] usb 2-1: Manufacturer: syz [ 554.447440][ T5812] usb 2-1: SerialNumber: syz [ 554.460637][ T5812] usb 2-1: config 0 descriptor?? [ 554.476134][ T5812] usb 2-1: selecting invalid altsetting 0 [ 554.783323][ T5830] usb 2-1: USB disconnect, device number 43 [ 555.402631][ T5844] usb 1-1: new full-speed USB device number 38 using dummy_hcd [ 555.610322][ T5844] usb 1-1: no configurations [ 555.614974][ T5844] usb 1-1: can't read configurations, error -22 [ 555.814486][ T5844] usb 1-1: new full-speed USB device number 39 using dummy_hcd [ 555.987552][ T5812] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 556.023822][ T5844] usb 1-1: no configurations [ 556.028507][ T5844] usb 1-1: can't read configurations, error -22 [ 556.035212][ T5844] usb usb1-port1: attempt power cycle [ 556.184190][ T5812] usb 2-1: config index 0 descriptor too short (expected 45, got 36) [ 556.192349][ T5812] usb 2-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 556.202880][ T5812] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 556.216206][ T5812] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 556.225272][ T5812] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 556.235283][ T5812] usb 2-1: config 0 descriptor?? [ 556.244151][ T5812] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 556.496860][ T5844] usb 1-1: new full-speed USB device number 40 using dummy_hcd [ 556.541112][ T5844] usb 1-1: no configurations [ 556.545722][ T5844] usb 1-1: can't read configurations, error -22 [ 556.713412][ T5844] usb 1-1: new full-speed USB device number 41 using dummy_hcd [ 556.747038][ T5844] usb 1-1: no configurations [ 556.751695][ T5844] usb 1-1: can't read configurations, error -22 [ 556.758591][ T5844] usb usb1-port1: unable to enumerate USB device [ 557.341613][ T28] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 557.572373][ T28] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 557.590459][ T28] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 557.607347][ T28] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 557.620876][ T28] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 557.633997][ T28] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 557.659651][ T28] usb 4-1: config 0 descriptor?? [ 558.107441][ T28] usbhid 4-1:0.0: can't add hid device: -71 [ 558.118790][ T28] usbhid: probe of 4-1:0.0 failed with error -71 [ 558.129170][ T28] usb 4-1: USB disconnect, device number 33 [ 559.175488][ T5812] usb 2-1: USB disconnect, device number 44 [ 559.231287][T12029] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1854'. [ 559.272420][T12029] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 559.294009][T12036] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1854'. [ 559.341139][T12036] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 560.482872][ T5812] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 560.882818][T12071] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1870'. [ 560.896277][ T5812] usb 3-1: config index 0 descriptor too short (expected 45, got 36) [ 560.905498][T12071] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1870'. [ 560.915650][ T5812] usb 3-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 560.930360][ T5812] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 560.965391][ T5812] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 561.086110][ T5812] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 561.139960][ T5812] usb 3-1: config 0 descriptor?? [ 561.173624][ T5812] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 561.847740][ T5844] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 562.086091][ T5844] usb 4-1: Using ep0 maxpacket: 16 [ 562.115915][ T5844] usb 4-1: unable to get BOS descriptor or descriptor too short [ 562.127812][ T5844] usb 4-1: config 4 has an invalid interface number: 55 but max is 0 [ 562.136327][ T5844] usb 4-1: config 4 has no interface number 0 [ 562.142751][ T5844] usb 4-1: config 4 interface 55 has no altsetting 0 [ 562.154254][ T5844] usb 4-1: New USB device found, idVendor=08ca, idProduct=0111, bcdDevice=2f.cb [ 562.163537][ T5844] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 562.171571][ T5844] usb 4-1: Product: syz [ 562.175945][ T5844] usb 4-1: Manufacturer: syz [ 562.183375][ T5844] usb 4-1: SerialNumber: syz [ 562.483183][T12099] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 562.649207][ T5812] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 562.844097][ T5812] usb 2-1: Using ep0 maxpacket: 8 [ 562.851116][ T5812] usb 2-1: config 0 has no interfaces? [ 562.856815][ T5812] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 562.868700][ T5812] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 562.879861][ T5812] usb 2-1: config 0 descriptor?? [ 563.074904][T12103] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1880'. [ 563.084991][T12103] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1880'. [ 563.116247][ T5812] usb 2-1: USB disconnect, device number 45 [ 563.335339][T12110] netlink: 'syz.0.1883': attribute type 9 has an invalid length. [ 563.348522][T12110] macvlan2: entered promiscuous mode [ 563.355425][T12110] macvlan2: entered allmulticast mode [ 563.381552][ T5812] usb 3-1: USB disconnect, device number 45 [ 564.000904][T12123] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1889'. [ 564.013797][T12123] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1889'. [ 564.138923][T12127] netlink: 384 bytes leftover after parsing attributes in process `syz.1.1890'. [ 564.793915][ T5830] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 564.814250][ T5844] gspca_main: mr97310a-2.14.0 probing 08ca:0111 [ 564.837686][ T5844] gspca_mr97310a: reg write [21] error -22 [ 564.843613][ T5844] mr97310a: probe of 4-1:4.55 failed with error -22 [ 564.864265][ T5844] usb 4-1: USB disconnect, device number 34 [ 564.944901][T12138] netlink: 'syz.3.1894': attribute type 9 has an invalid length. [ 564.974663][T12138] macvlan2: entered promiscuous mode [ 564.980901][T12138] macvlan2: entered allmulticast mode [ 565.024851][ T5830] usb 2-1: config index 0 descriptor too short (expected 45, got 36) [ 565.054248][ T5830] usb 2-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 565.080202][ T5830] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 565.094864][ T5830] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 565.105018][ T5830] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 565.130217][T12143] syzkaller0: entered promiscuous mode [ 565.138132][ T5830] usb 2-1: config 0 descriptor?? [ 565.138139][T12143] syzkaller0: entered allmulticast mode [ 565.164622][ T5830] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 565.496109][T12159] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1904'. [ 565.999889][T12179] syzkaller0: entered promiscuous mode [ 566.006301][T12179] syzkaller0: entered allmulticast mode [ 566.445534][T12189] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1913'. [ 566.718700][T12200] syzkaller0: entered promiscuous mode [ 566.724422][T12200] syzkaller0: entered allmulticast mode [ 567.013261][T12213] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1922'. [ 567.801993][ T5830] usb 2-1: USB disconnect, device number 46 [ 567.871595][T12233] syzkaller0: entered promiscuous mode [ 567.878135][T12233] syzkaller0: entered allmulticast mode [ 567.928967][T12235] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1931'. [ 567.998771][T12237] netlink: 384 bytes leftover after parsing attributes in process `syz.2.1932'. [ 569.456264][T12263] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1940'. [ 569.477901][T12261] netlink: 84 bytes leftover after parsing attributes in process `syz.0.1939'. [ 569.600455][T12266] syzkaller0: entered promiscuous mode [ 569.606048][T12266] syzkaller0: entered allmulticast mode [ 569.701109][ T5830] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 569.940707][ T5830] usb 2-1: config index 0 descriptor too short (expected 45, got 36) [ 569.958008][ T5830] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 569.972156][ T5830] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 569.986753][ T5830] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 570.002068][ T5830] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 570.018757][ T5830] usb 2-1: config 0 descriptor?? [ 570.040232][ T5830] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 570.355884][T12287] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1949'. [ 570.781687][T12294] syzkaller0: entered promiscuous mode [ 570.790753][T12294] syzkaller0: entered allmulticast mode [ 571.466381][ T28] usb 4-1: new full-speed USB device number 35 using dummy_hcd [ 571.487344][T12311] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1958'. [ 571.717244][ T28] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 571.729342][ T28] usb 4-1: config 0 has no interfaces? [ 571.734825][ T28] usb 4-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 571.743994][ T28] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 571.755055][ T28] usb 4-1: config 0 descriptor?? [ 571.950362][T12320] syzkaller0: entered promiscuous mode [ 571.955931][T12320] syzkaller0: entered allmulticast mode [ 572.365212][T12333] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1967'. [ 572.534217][ T5830] usb 4-1: USB disconnect, device number 35 [ 572.646073][ T5844] usb 2-1: USB disconnect, device number 47 [ 573.621914][ T788] usb 2-1: new full-speed USB device number 48 using dummy_hcd [ 573.853721][ T788] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 573.888298][ T788] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 2 [ 573.907240][ T788] usb 2-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 573.919518][ T788] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 573.930086][ T788] usb 2-1: config 0 descriptor?? [ 574.391053][ T28] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 574.502439][ T788] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 574.589712][ T28] usb 4-1: config index 0 descriptor too short (expected 45, got 36) [ 574.599196][ T28] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 574.609449][ T28] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 574.623046][ T28] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 574.632132][ T28] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 574.642405][ T28] usb 4-1: config 0 descriptor?? [ 574.651765][ T28] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 574.679314][T12389] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 574.712132][ T788] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 574.722403][ T788] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 574.735398][ T788] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 574.744552][ T788] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 574.755163][ T5844] usb 2-1: USB disconnect, device number 48 [ 574.764981][ T788] usb 3-1: config 0 descriptor?? [ 574.786713][ T788] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 576.838927][T12387] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 576.839084][ T5782] Bluetooth: hci0: command 0x0406 tx timeout [ 576.853035][T12387] Bluetooth: hci0: Opcode 0x0406 failed: -110 [ 577.354888][ T28] usb 4-1: USB disconnect, device number 36 [ 577.817059][T12387] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 577.823041][T12387] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 577.831732][T12387] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 577.837850][T12387] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 577.931523][ T5812] usb 3-1: USB disconnect, device number 46 [ 578.399150][ T28] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 578.485664][ T5812] usb 3-1: new full-speed USB device number 47 using dummy_hcd [ 578.606225][ T28] usb 2-1: config index 0 descriptor too short (expected 45, got 36) [ 578.614457][ T28] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 578.624723][ T28] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 578.638261][ T28] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 578.647322][ T28] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 578.657708][ T28] usb 2-1: config 0 descriptor?? [ 578.666293][ T28] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 578.704645][ T5812] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 578.714859][ T5812] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 2 [ 578.724032][ T5812] usb 3-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 578.733082][ T5812] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 578.743148][ T5812] usb 3-1: config 0 descriptor?? [ 578.810454][ T969] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 579.020207][ T969] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 579.030597][ T969] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 579.044190][ T969] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 579.053400][ T969] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 579.063792][ T969] usb 4-1: config 0 descriptor?? [ 579.079749][ T969] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 579.096286][ T5782] Bluetooth: hci3: command 0x0406 tx timeout [ 579.102350][ T5782] Bluetooth: hci0: command 0x0406 tx timeout [ 579.521908][ T5844] usb 3-1: USB disconnect, device number 47 [ 579.951921][T12461] netlink: 384 bytes leftover after parsing attributes in process `syz.0.2013'. [ 580.056048][ T5782] Bluetooth: hci2: command 0x0406 tx timeout [ 580.057774][T12462] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 580.078455][T12462] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 581.345719][ T5782] Bluetooth: hci3: command 0x0406 tx timeout [ 581.370370][ T5844] usb 2-1: USB disconnect, device number 49 [ 581.615845][ T969] usb 1-1: new full-speed USB device number 42 using dummy_hcd [ 581.766668][ T5812] usb 4-1: USB disconnect, device number 37 [ 581.814414][ T969] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 581.828018][ T969] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 2 [ 581.837768][ T969] usb 1-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 581.847281][ T969] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 581.858102][ T969] usb 1-1: config 0 descriptor?? [ 582.301081][ T5782] Bluetooth: hci2: command 0x0406 tx timeout [ 582.444924][T12518] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2030'. [ 582.526911][ T5844] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 582.679610][ T788] usb 1-1: USB disconnect, device number 42 [ 582.743945][ T5844] usb 3-1: config index 0 descriptor too short (expected 45, got 36) [ 582.757361][ T5844] usb 3-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 582.768483][ T5844] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 582.782240][ T5844] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 582.791649][ T5844] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 582.802932][ T5844] usb 3-1: config 0 descriptor?? [ 582.819640][ T5844] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 583.348892][ T788] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 583.508372][T12550] syzkaller0: entered promiscuous mode [ 583.515312][T12550] syzkaller0: entered allmulticast mode [ 583.556665][ T788] usb 1-1: config 0 has too many interfaces: 253, using maximum allowed: 32 [ 583.566303][ T788] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 253 [ 583.578263][ T788] usb 1-1: New USB device found, idVendor=055f, idProduct=c630, bcdDevice=b6.ac [ 583.598066][ T788] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 583.617138][ T788] usb 1-1: Product: syz [ 583.621560][ T788] usb 1-1: Manufacturer: syz [ 583.626573][ T788] usb 1-1: SerialNumber: syz [ 583.663776][ T788] usb 1-1: config 0 descriptor?? [ 583.678414][ T788] gspca_main: sunplus-2.14.0 probing 055f:c630 [ 584.372439][T12570] netlink: 68 bytes leftover after parsing attributes in process `syz.1.2049'. [ 585.001352][ T5812] usb 1-1: USB disconnect, device number 43 [ 585.099909][T12578] syzkaller0: entered promiscuous mode [ 585.108324][T12578] syzkaller0: entered allmulticast mode [ 586.480871][ T5844] usb 3-1: USB disconnect, device number 48 [ 587.132160][T12603] syzkaller0: entered promiscuous mode [ 587.137776][T12603] syzkaller0: entered allmulticast mode [ 588.527463][ T5844] usb 1-1: new full-speed USB device number 44 using dummy_hcd [ 588.853709][ T5844] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 588.873297][ T5844] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 2 [ 588.893624][ T5844] usb 1-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 588.945901][ T5844] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 588.957327][ T5844] usb 1-1: config 0 descriptor?? [ 589.361020][ T5812] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 589.599989][ T5812] usb 3-1: config index 0 descriptor too short (expected 45, got 36) [ 589.624628][ T5812] usb 3-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 589.698039][ T5812] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 589.723992][ T969] usb 4-1: new full-speed USB device number 38 using dummy_hcd [ 589.826324][ T5812] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 589.928767][ T5812] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 590.137253][ T5812] usb 3-1: config 0 descriptor?? [ 590.182094][ T969] usb 4-1: unable to get BOS descriptor or descriptor too short [ 590.276742][ T969] usb 4-1: not running at top speed; connect to a high speed hub [ 590.354949][ T5812] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 590.402104][ T969] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 590.436003][ T28] usb 1-1: USB disconnect, device number 44 [ 590.455261][ T969] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 590.484297][ T969] usb 4-1: New USB device found, idVendor=1235, idProduct=8213, bcdDevice=e7.3f [ 590.493678][ T969] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 590.509016][ T969] usb 4-1: Product: syz [ 590.513221][ T969] usb 4-1: Manufacturer: syz [ 590.517906][ T969] usb 4-1: SerialNumber: syz [ 590.809659][T12631] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 590.820588][T12631] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 590.847998][ T969] usb 4-1: Focusrite Scarlett Gen 3 Mixer Driver enabled (pid=0x8213); report any issues to g@b4.vu [ 590.860530][ T969] usb 4-1: Error initialising Scarlett Gen 3 Mixer Driver: -22 [ 590.881261][ T969] snd-usb-audio: probe of 4-1:1.0 failed with error -22 [ 590.893484][ T969] usb 4-1: USB disconnect, device number 38 [ 590.905857][ T5844] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 590.923929][ T5766] udevd[5766]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 591.140748][ T5844] usb 2-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 591.149870][ T5844] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 591.159866][ T5844] usb 2-1: config 0 descriptor?? [ 591.388932][ T5844] [drm] vendor descriptor length:6 data:06 5f 00 00 00 00 00 00 00 00 00 [ 591.407755][ T5844] [drm:udl_init] *ERROR* Unrecognized vendor firmware descriptor [ 591.643321][ T5844] [drm:udl_init] *ERROR* Selecting channel failed [ 591.782331][ T5844] [drm] Initialized udl 0.0.1 20120220 for 2-1:0.0 on minor 2 [ 591.820239][ T5844] [drm] Initialized udl on minor 2 [ 591.829800][ T5844] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 591.913868][ T5844] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 591.943695][ T788] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 591.958476][ T5844] usb 2-1: USB disconnect, device number 50 [ 591.971773][ T788] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 592.187790][ T5830] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 592.371828][ T969] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 592.395331][ T5830] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 64, changing to 7 [ 592.408105][ T5830] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 250, changing to 7 [ 592.423503][ T5830] usb 1-1: New USB device found, idVendor=2a39, idProduct=3fd4, bcdDevice= 0.40 [ 592.426512][ T28] usb 3-1: USB disconnect, device number 49 [ 592.432906][ T5830] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 592.476937][ T5830] usb 1-1: Product: syz [ 592.490977][ T5830] usb 1-1: Manufacturer: syz [ 592.506143][ T5830] usb 1-1: SerialNumber: syz [ 592.566831][ T969] usb 4-1: Using ep0 maxpacket: 32 [ 592.583791][ T969] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 592.612795][ T969] usb 4-1: config 0 has no interfaces? [ 592.619532][ T969] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 592.643604][ T969] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 592.655439][ T969] usb 4-1: config 0 descriptor?? [ 592.754287][ T5830] usb 1-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 592.761479][ T5830] usb 1-1: unit 6 not found! [ 592.766443][ T5830] usb 1-1: unit 2 not found! [ 592.783654][ T5830] usb 1-1: USB disconnect, device number 45 [ 592.891784][ T5812] usb 2-1: new full-speed USB device number 51 using dummy_hcd [ 593.091042][ T5812] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 593.101232][ T5812] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 2 [ 593.110344][ T5812] usb 2-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 593.119558][ T5812] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 593.129307][ T5812] usb 2-1: config 0 descriptor?? [ 593.575266][ T5812] usb 4-1: USB disconnect, device number 39 [ 594.052777][ T5830] usb 2-1: USB disconnect, device number 51 [ 594.418581][T12696] syzkaller0: entered promiscuous mode [ 594.428138][ T969] IPVS: starting estimator thread 0... [ 594.443117][T12696] syzkaller0: entered allmulticast mode [ 594.495312][T12701] gretap1: entered promiscuous mode [ 594.529000][T12699] IPVS: using max 22 ests per chain, 52800 per kthread [ 594.538746][ T5844] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 594.756372][ T5844] usb 4-1: config index 0 descriptor too short (expected 45, got 36) [ 594.764539][ T5844] usb 4-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 594.778047][ T5844] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 594.791936][ T5844] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 594.801078][ T5844] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 594.811714][ T5844] usb 4-1: config 0 descriptor?? [ 594.820748][ T5844] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 594.939052][ T5830] usb 2-1: new full-speed USB device number 52 using dummy_hcd [ 595.146964][ T5830] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 595.157453][ T5830] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 595.166420][ T5830] usb 2-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 595.175537][ T5830] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 595.186536][ T5830] usb 2-1: config 0 descriptor?? [ 595.195069][ T5830] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 595.202383][ T5830] dvb-usb: bulk message failed: -22 (3/0) [ 595.210450][ T5830] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 595.219612][ T5830] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 595.226722][ T5830] usb 2-1: media controller created [ 595.233151][ T5830] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 595.247421][ T5830] dvb-usb: bulk message failed: -22 (6/0) [ 595.253483][ T5830] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 595.262231][ T5830] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input34 [ 595.275180][ T5830] dvb-usb: schedule remote query interval to 150 msecs. [ 595.282152][ T5830] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 595.451422][ T5830] dvb-usb: bulk message failed: -22 (1/0) [ 595.457654][ T5830] dvb-usb: error while querying for an remote control event. [ 595.632377][ T5830] dvb-usb: bulk message failed: -22 (1/0) [ 595.638176][ T5830] dvb-usb: error while querying for an remote control event. [ 595.849248][ T5830] dvb-usb: bulk message failed: -22 (1/0) [ 595.877860][ T5830] dvb-usb: error while querying for an remote control event. [ 595.907043][T12728] syzkaller0: entered promiscuous mode [ 595.912760][T12728] syzkaller0: entered allmulticast mode [ 595.914722][T12730] input: syz1 as /devices/virtual/input/input35 [ 595.998219][ T5830] usb 2-1: USB disconnect, device number 52 [ 596.036315][ T5830] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 596.668438][T12751] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2113'. [ 596.986370][ T969] usb 3-1: new full-speed USB device number 50 using dummy_hcd [ 597.184190][ T969] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 597.219959][ T969] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 597.249799][ T969] usb 3-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 597.274807][ T969] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 597.305371][ T969] usb 3-1: config 0 descriptor?? [ 597.339706][ T969] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 597.356911][ T969] dvb-usb: bulk message failed: -22 (3/0) [ 597.388150][ T969] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 597.424341][ T969] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 597.447683][ T969] usb 3-1: media controller created [ 597.477909][ T5830] usb 4-1: USB disconnect, device number 40 [ 597.490002][ T969] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 597.531336][ T969] dvb-usb: bulk message failed: -22 (6/0) [ 597.537426][ T969] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 597.555331][ T969] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input36 [ 597.612005][ T969] dvb-usb: schedule remote query interval to 150 msecs. [ 597.635714][ T969] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 597.809532][ T969] dvb-usb: bulk message failed: -22 (1/0) [ 597.815318][ T969] dvb-usb: error while querying for an remote control event. [ 598.013423][ T969] dvb-usb: bulk message failed: -22 (1/0) [ 598.036773][ T969] dvb-usb: error while querying for an remote control event. [ 598.148398][ T5844] usb 3-1: USB disconnect, device number 50 [ 598.243917][ T5844] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 598.312661][T12783] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2126'. [ 598.351159][ T5830] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 598.628058][ T5830] usb 4-1: Using ep0 maxpacket: 32 [ 598.704719][ T5830] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 598.791241][ T5830] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 598.903497][ T969] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 598.907606][ T5830] usb 4-1: config 0 descriptor?? [ 599.277109][ T5830] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 599.344067][ T5830] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 599.481280][ T5830] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 599.528457][ T5830] usb 4-1: media controller created [ 599.560313][T12781] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2124'. [ 599.598793][ T5830] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 599.698806][ T5830] az6027: usb out operation failed. (-71) [ 599.710989][ T5830] az6027: usb out operation failed. (-71) [ 599.718529][ T5830] stb0899_attach: Driver disabled by Kconfig [ 599.724552][ T5830] az6027: no front-end attached [ 599.724552][ T5830] [ 599.732505][ T5830] az6027: usb out operation failed. (-71) [ 599.737583][ T969] usb 3-1: Using ep0 maxpacket: 16 [ 599.742643][ T5830] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 599.752762][ T969] usb 3-1: unable to get BOS descriptor or descriptor too short [ 599.753954][ T5830] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input37 [ 599.779156][ T5830] dvb-usb: schedule remote query interval to 400 msecs. [ 599.786585][ T5830] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 599.810013][ T5830] usb 4-1: USB disconnect, device number 41 [ 599.817105][ T969] usb 3-1: config 4 has an invalid interface number: 55 but max is 0 [ 599.834527][ T969] usb 3-1: config 4 has no interface number 0 [ 599.840844][ T969] usb 3-1: config 4 interface 55 has no altsetting 0 [ 599.854610][ T969] usb 3-1: New USB device found, idVendor=08ca, idProduct=0111, bcdDevice=2f.cb [ 599.865310][ T969] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 599.875557][ T969] usb 3-1: Product: syz [ 599.880948][ T969] usb 3-1: Manufacturer: syz [ 599.885651][ T969] usb 3-1: SerialNumber: syz [ 599.902223][ T5830] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 600.105831][ T5812] usb 1-1: new full-speed USB device number 46 using dummy_hcd [ 600.184358][T12791] netlink: 148 bytes leftover after parsing attributes in process `syz.2.2130'. [ 600.224236][T12791] netlink: 148 bytes leftover after parsing attributes in process `syz.2.2130'. [ 600.239538][T12805] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 600.327841][ T5812] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 600.339680][ T5812] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 600.353876][ T5812] usb 1-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 600.364427][ T5812] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 600.917617][T12808] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2134'. [ 601.970120][ T5812] usb 1-1: config 0 descriptor?? [ 601.990323][ T5812] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 602.001454][ T5812] dvb-usb: bulk message failed: -22 (3/0) [ 602.013986][ T5812] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 602.023753][ T5812] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 602.031986][ T5812] usb 1-1: media controller created [ 602.043204][ T969] gspca_main: mr97310a-2.14.0 probing 08ca:0111 [ 602.051231][ T5812] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 602.061463][ T969] gspca_mr97310a: reg write [21] error -22 [ 602.071336][ T5812] dvb-usb: bulk message failed: -22 (6/0) [ 602.077464][ T969] mr97310a: probe of 3-1:4.55 failed with error -22 [ 602.086683][ T5812] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 602.109470][ T969] usb 3-1: USB disconnect, device number 51 [ 602.119904][ T5812] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input38 [ 602.148895][ T5812] dvb-usb: schedule remote query interval to 150 msecs. [ 602.170024][ T5812] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 602.240741][T12811] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2136'. [ 602.316560][T12813] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2137'. [ 602.337169][ T28] dvb-usb: bulk message failed: -22 (1/0) [ 602.343033][ T28] dvb-usb: error while querying for an remote control event. [ 602.510734][ T1283] ieee802154 phy0 wpan0: encryption failed: -22 [ 602.517265][ T1283] ieee802154 phy1 wpan1: encryption failed: -22 [ 602.543008][ T28] dvb-usb: bulk message failed: -22 (1/0) [ 603.306681][ T28] dvb-usb: error while querying for an remote control event. [ 603.461407][ T28] usb 1-1: USB disconnect, device number 46 [ 603.589316][ T28] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 604.348307][T12830] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2143'. [ 605.987713][ T28] usb 2-1: new full-speed USB device number 53 using dummy_hcd [ 606.399519][ T28] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 606.418307][T12845] syz.3.2148: vmalloc error: size 16777216, failed to allocated page array size 32768, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=syz3,mems_allowed=0-1 [ 606.437236][T12845] CPU: 0 PID: 12845 Comm: syz.3.2148 Not tainted syzkaller #0 [ 606.444734][T12845] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 606.453802][ T28] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 606.454809][T12845] Call Trace: [ 606.463710][ T28] usb 2-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 606.466915][T12845] [ 606.466925][T12845] dump_stack_lvl+0x18c/0x250 [ 606.466961][T12845] ? show_regs_print_info+0x20/0x20 [ 606.466981][T12845] ? load_image+0x420/0x420 [ 606.467002][T12845] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 606.467024][T12845] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 606.467050][T12845] warn_alloc+0x246/0x340 [ 606.467081][T12845] ? zone_watermark_ok_safe+0x230/0x230 [ 606.467113][T12845] ? _raw_spin_unlock+0x28/0x40 [ 606.467148][T12845] __vmalloc_node_range+0x662/0x1330 [ 606.526321][T12845] ? __alloc_pages+0xae/0x460 [ 606.531008][T12845] ? free_vm_area+0x50/0x50 [ 606.535531][T12845] ? packet_set_ring+0x720/0x23f0 [ 606.540560][T12845] vzalloc+0x79/0x90 [ 606.544469][T12845] ? packet_set_ring+0x720/0x23f0 [ 606.549522][T12845] packet_set_ring+0x720/0x23f0 [ 606.554389][T12845] ? packet_mmap+0x510/0x510 [ 606.558978][T12845] ? __lock_acquire+0x7d40/0x7d40 [ 606.564001][T12845] ? __local_bh_enable_ip+0x13a/0x1c0 [ 606.569369][T12845] ? lockdep_hardirqs_on+0x98/0x150 [ 606.574575][T12845] ? __might_fault+0xaa/0x120 [ 606.579251][T12845] ? __might_fault+0xc6/0x120 [ 606.583937][T12845] ? __might_fault+0xaa/0x120 [ 606.588634][T12845] ? _copy_from_user+0xa5/0xe0 [ 606.593419][T12845] packet_setsockopt+0xdb0/0x1500 [ 606.598458][T12845] ? packet_ioctl+0x340/0x340 [ 606.603143][T12845] ? aa_sk_perm+0x83c/0x970 [ 606.607645][T12845] ? __fget_files+0x28/0x4b0 [ 606.612245][T12845] ? aa_af_perm+0x330/0x330 [ 606.616763][T12845] ? __fget_files+0x28/0x4b0 [ 606.621366][T12845] ? __fget_files+0x28/0x4b0 [ 606.626250][T12845] ? aa_sock_opt_perm+0x74/0x100 [ 606.631200][T12845] ? bpf_lsm_socket_setsockopt+0x9/0x10 [ 606.636753][T12845] ? security_socket_setsockopt+0x7e/0xa0 [ 606.642565][T12845] ? packet_ioctl+0x340/0x340 [ 606.647244][T12845] do_sock_setsockopt+0x175/0x1a0 [ 606.652268][T12845] ? __fdget+0x180/0x210 [ 606.656529][T12845] __x64_sys_setsockopt+0x182/0x200 [ 606.661744][T12845] do_syscall_64+0x55/0xb0 [ 606.666162][T12845] ? clear_bhb_loop+0x40/0x90 [ 606.670833][T12845] ? clear_bhb_loop+0x40/0x90 [ 606.675525][T12845] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 606.681420][T12845] RIP: 0033:0x7fac5819ce59 [ 606.685851][T12845] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 606.705457][T12845] RSP: 002b:00007fac563d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 606.713872][T12845] RAX: ffffffffffffffda RBX: 00007fac58416090 RCX: 00007fac5819ce59 [ 606.721841][T12845] RDX: 0000000000000005 RSI: 0000000000000107 RDI: 0000000000000003 [ 606.729812][T12845] RBP: 00007fac58232d6f R08: 000000000000001c R09: 0000000000000000 [ 606.737781][T12845] R10: 00002000000000c0 R11: 0000000000000246 R12: 0000000000000000 [ 606.745749][T12845] R13: 00007fac58416128 R14: 00007fac58416090 R15: 00007ffc9cc31408 [ 606.753727][T12845] [ 606.779456][ T28] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 606.801687][ T28] usb 2-1: config 0 descriptor?? [ 606.810272][ T28] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 606.833468][ T28] dvb-usb: bulk message failed: -22 (3/0) [ 606.859469][ T28] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 606.876864][T12845] Mem-Info: [ 606.880897][ T28] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 606.888819][T12845] active_anon:7917 inactive_anon:0 isolated_anon:0 [ 606.888819][T12845] active_file:17222 inactive_file:40163 isolated_file:0 [ 606.888819][T12845] unevictable:768 dirty:146 writeback:0 [ 606.888819][T12845] slab_reclaimable:10545 slab_unreclaimable:97085 [ 606.888819][T12845] mapped:26139 shmem:3719 pagetables:630 [ 606.888819][T12845] sec_pagetables:0 bounce:0 [ 606.888819][T12845] kernel_misc_reclaimable:0 [ 606.888819][T12845] free:1315831 free_pcp:13666 free_cma:0 [ 606.934042][ C1] vkms_vblank_simulate: vblank timer overrun [ 606.941954][ T28] usb 2-1: media controller created [ 606.948846][ T28] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 606.972195][ T28] dvb-usb: bulk message failed: -22 (6/0) [ 606.984151][ T28] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 606.992958][T12845] Node 0 active_anon:24968kB inactive_anon:0kB active_file:68888kB inactive_file:160448kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:104556kB dirty:584kB writeback:0kB shmem:6440kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:11144kB pagetables:2620kB sec_pagetables:0kB all_unreclaimable? no [ 607.025332][ C1] vkms_vblank_simulate: vblank timer overrun [ 607.033150][ T28] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input39 [ 607.047490][ T28] dvb-usb: schedule remote query interval to 150 msecs. [ 607.067143][ T28] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 607.136669][T12845] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 607.166918][ C1] vkms_vblank_simulate: vblank timer overrun [ 607.206183][T12845] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 607.233435][ T28] dvb-usb: bulk message failed: -22 (1/0) [ 607.233504][ T28] dvb-usb: error while querying for an remote control event. [ 607.247567][T12845] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 607.253759][T12845] Node 0 DMA32 free:1354404kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:22420kB inactive_anon:0kB active_file:68888kB inactive_file:159624kB unevictable:1536kB writepending:584kB present:3129332kB managed:2586928kB mlocked:0kB bounce:0kB free_pcp:41088kB local_pcp:19668kB free_cma:0kB [ 607.285759][T12845] lowmem_reserve[]: 0 0 0 0 0 [ 607.291241][T12845] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:48kB inactive_anon:0kB active_file:0kB inactive_file:824kB unevictable:0kB writepending:0kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 607.343846][T12845] lowmem_reserve[]: 0 0 0 0 0 [ 607.358173][T12845] Node 1 Normal free:3902664kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:12508kB local_pcp:4608kB free_cma:0kB [ 607.406505][ T28] dvb-usb: bulk message failed: -22 (1/0) [ 607.412314][ T28] dvb-usb: error while querying for an remote control event. [ 607.424613][T12860] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2146'. [ 607.445390][T12845] lowmem_reserve[]: 0 0 0 0 0 [ 607.456292][T12845] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 607.509085][T12845] Node 0 DMA32: 1169*4kB (ME) 906*8kB (ME) 787*16kB (UME) 651*32kB (UME) 261*64kB (UME) 80*128kB (UME) 69*256kB (UM) 74*512kB (UME) 24*1024kB (UM) 5*2048kB (UM) 296*4096kB (M) = 1375076kB [ 607.555103][T12845] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 607.569182][T12845] Node 1 Normal: 200*4kB (UME) 53*8kB (UME) 38*16kB (UME) 151*32kB (UME) 51*64kB (UME) 10*128kB (UME) 1*256kB (M) 2*512kB (ME) 1*1024kB (M) 1*2048kB (E) 949*4096kB (UM) = 3902664kB [ 607.587867][T12845] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 607.597657][ T28] dvb-usb: bulk message failed: -22 (1/0) [ 607.603781][ T28] dvb-usb: error while querying for an remote control event. [ 607.611248][T12845] Node 0 hugepages_total=2 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 607.624608][T12845] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 608.214732][T12868] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2155'. [ 608.833062][T12845] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 608.867673][T12845] 77083 total pagecache pages [ 608.877045][T12845] 0 pages in swap cache [ 608.885085][ T28] dvb-usb: bulk message failed: -22 (1/0) [ 608.894862][T12845] Free swap = 124456kB [ 608.903414][ T28] dvb-usb: error while querying for an remote control event. [ 608.909982][T12845] Total swap = 124996kB [ 608.921672][T12845] 2097051 pages RAM [ 608.935010][T12845] 0 pages HighMem/MovableOnly [ 608.942176][T12845] 416933 pages reserved [ 608.952077][ T28] usb 2-1: USB disconnect, device number 53 [ 608.955002][T12845] 0 pages cma reserved [ 609.078501][ T28] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 610.146476][T12888] binder: 12887:12888 ioctl 4018620d 0 returned -22 [ 610.266236][ T5830] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 610.605670][ T5830] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 610.629536][ T5830] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 610.724461][ T5830] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 610.743490][ T5830] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 610.759279][ T5830] usb 1-1: config 0 descriptor?? [ 610.770304][ T5830] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 612.786911][T12912] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 612.816413][T12912] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 613.118152][T12921] binder: 12920:12921 ioctl 4018620d 0 returned -22 [ 614.847136][ T28] usb 1-1: USB disconnect, device number 47 [ 616.691927][T12958] binder: 12957:12958 ioctl 4018620d 0 returned -22 [ 617.306986][ T5844] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 617.523452][ T5844] usb 4-1: Using ep0 maxpacket: 32 [ 617.540858][ T5844] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 617.559808][ T5844] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 617.587437][ T5844] usb 4-1: config 0 descriptor?? [ 619.008251][ T5844] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 619.025809][ T5844] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 619.040226][ T5844] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 619.040718][T12991] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2195'. [ 619.047687][ T5844] usb 4-1: media controller created [ 619.120964][ T5844] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 619.344530][ T5844] az6027: usb out operation failed. (-71) [ 619.361766][ T5844] az6027: usb out operation failed. (-71) [ 619.375861][ T5844] stb0899_attach: Driver disabled by Kconfig [ 619.382274][ T5844] az6027: no front-end attached [ 619.382274][ T5844] [ 619.403366][ T5844] az6027: usb out operation failed. (-71) [ 619.424556][ T5844] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 619.460880][ T5844] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input40 [ 619.527796][ T5844] dvb-usb: schedule remote query interval to 400 msecs. [ 619.534807][ T5844] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 619.599018][ T5844] usb 4-1: USB disconnect, device number 42 [ 619.712215][ T5844] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 621.041310][T13029] tipc: Enabling of bearer rejected, failed to enable media [ 622.902843][T13053] syzkaller0: entered promiscuous mode [ 622.909639][T13053] syzkaller0: entered allmulticast mode [ 623.362622][T13063] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2208'. [ 624.188957][T13075] binder: BINDER_SET_CONTEXT_MGR already set [ 624.195468][T13075] binder: 13074:13075 ioctl 4018620d 200000004a80 returned -16 [ 624.207597][T13075] binder: 13074:13075 ioctl c0306201 0 returned -14 [ 626.367015][T13084] syzkaller0: entered promiscuous mode [ 626.405134][T13084] syzkaller0: entered allmulticast mode [ 626.698185][ T28] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 626.893053][ T28] usb 3-1: device descriptor read/64, error -71 [ 627.158558][T13102] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2226'. [ 627.167935][T13101] tipc: Enabling of bearer rejected, failed to enable media [ 627.185566][ T28] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 627.212027][T13104] syzkaller0: entered promiscuous mode [ 627.217569][T13104] syzkaller0: entered allmulticast mode [ 627.348080][ T28] usb 3-1: device descriptor read/64, error -71 [ 628.714564][ T28] usb usb3-port1: attempt power cycle [ 629.173373][ T28] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 629.216438][ T28] usb 3-1: device descriptor read/8, error -71 [ 629.525364][ T28] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 629.580171][ T28] usb 3-1: device descriptor read/8, error -71 [ 629.709603][ T28] usb usb3-port1: unable to enumerate USB device [ 631.359907][T13152] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2235'. [ 633.298837][ T28] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 633.468705][ T28] usb 4-1: device descriptor read/64, error -71 [ 633.682087][T13177] tipc: Enabled bearer , priority 0 [ 633.691295][T13177] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 633.729942][T13176] tipc: Disabling bearer [ 633.757365][ T27] kauditd_printk_skb: 54 callbacks suppressed [ 633.757397][ T27] audit: type=1326 audit(1781370548.280:94): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13180 comm="syz.0.2245" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd35fb9ce59 code=0x7ffc0000 [ 633.760770][ T28] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 633.768040][ T27] audit: type=1326 audit(1781370548.280:95): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13180 comm="syz.0.2245" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd35fb9ce59 code=0x7ffc0000 [ 633.878669][ T27] audit: type=1326 audit(1781370548.280:96): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13180 comm="syz.0.2245" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=28 compat=0 ip=0x7fd35fb9ce59 code=0x7ffc0000 [ 633.916424][ T27] audit: type=1326 audit(1781370548.317:97): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13180 comm="syz.0.2245" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd35fb9ce59 code=0x7ffc0000 [ 633.949368][ T27] audit: type=1326 audit(1781370548.317:98): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13180 comm="syz.0.2245" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd35fb9ce59 code=0x7ffc0000 [ 635.200067][ T27] audit: type=1326 audit(1781370548.317:99): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13180 comm="syz.0.2245" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=425 compat=0 ip=0x7fd35fb9ce59 code=0x7ffc0000 [ 635.234733][ T28] usb 4-1: device descriptor read/64, error -71 [ 635.273262][ T27] audit: type=1326 audit(1781370548.317:100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13180 comm="syz.0.2245" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd35fb9ce59 code=0x7ffc0000 [ 635.298668][ T27] audit: type=1326 audit(1781370548.317:101): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13180 comm="syz.0.2245" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd35fb9ce59 code=0x7ffc0000 [ 635.324231][ T27] audit: type=1326 audit(1781370548.317:102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13180 comm="syz.0.2245" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=427 compat=0 ip=0x7fd35fb9ce59 code=0x7ffc0000 [ 635.385555][ T28] usb usb4-port1: attempt power cycle [ 635.395068][ T27] audit: type=1326 audit(1781370548.317:103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13180 comm="syz.0.2245" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd35fb9ce59 code=0x7ffc0000 [ 635.959498][ T28] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 636.027167][ T28] usb 4-1: device descriptor read/8, error -71 [ 636.254513][T13200] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2248'. [ 636.337511][ T28] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 636.502531][T13206] tipc: Enabled bearer , priority 0 [ 636.515267][T13206] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 637.780151][ T28] usb 4-1: device not accepting address 46, error -71 [ 637.803276][T13205] tipc: Disabling bearer [ 637.812047][ T28] usb usb4-port1: unable to enumerate USB device [ 637.840205][ T5830] tipc: Node number set to 1486325711 [ 638.021637][T13217] syzkaller0: entered promiscuous mode [ 638.027509][T13217] syzkaller0: entered allmulticast mode [ 638.381143][T13226] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2263'. [ 639.723084][ T5844] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 639.950646][ T5844] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 639.988061][ T5844] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 640.010475][ T5844] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 640.055439][ T5844] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 640.084186][ T5844] usb 2-1: config 0 descriptor?? [ 640.362027][T12443] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 640.372770][T12443] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 640.384741][T12443] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 640.394817][T12443] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 640.413585][T12443] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 640.421115][T12443] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 640.498020][ T5844] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 640.613841][T13241] chnl_net:caif_netlink_parms(): no params data found [ 640.699892][T13241] bridge0: port 1(bridge_slave_0) entered blocking state [ 640.725813][ T5844] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 640.736271][T13241] bridge0: port 1(bridge_slave_0) entered disabled state [ 640.743446][T13241] bridge_slave_0: entered allmulticast mode [ 640.750555][ T5844] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 640.756444][T13241] bridge_slave_0: entered promiscuous mode [ 640.767851][ T5844] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 640.773188][T13241] bridge0: port 2(bridge_slave_1) entered blocking state [ 640.780948][ T5844] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 640.786705][T13241] bridge0: port 2(bridge_slave_1) entered disabled state [ 640.802843][T13241] bridge_slave_1: entered allmulticast mode [ 640.810100][T13241] bridge_slave_1: entered promiscuous mode [ 640.810441][ T5844] usb 4-1: config 0 descriptor?? [ 640.837568][ T5844] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 640.842716][T13241] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 640.858280][T13241] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 640.947248][T13241] team0: Port device team_slave_0 added [ 640.956925][T13241] team0: Port device team_slave_1 added [ 641.004784][T13241] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 641.012145][T13241] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 641.039884][T13241] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 641.053507][T13241] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 641.060550][T13241] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 641.087466][T13241] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 641.156271][T13241] hsr_slave_0: entered promiscuous mode [ 641.164264][T13241] hsr_slave_1: entered promiscuous mode [ 641.175881][T13241] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 641.184083][T13241] Cannot create hsr debugfs directory [ 641.392863][T13241] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 641.491047][T13241] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 641.593041][T13241] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 641.623368][ T5844] usb 2-1: USB disconnect, device number 54 [ 641.747661][T13241] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 641.836229][T13263] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 641.849076][T13263] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 641.952367][T13241] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 641.970903][T13241] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 641.984333][T13241] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 642.008437][T13241] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 642.089822][T13268] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2274'. [ 642.140807][T13241] 8021q: adding VLAN 0 to HW filter on device bond0 [ 642.156350][ T5844] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 642.167010][T13241] 8021q: adding VLAN 0 to HW filter on device team0 [ 642.184239][ T1124] bridge0: port 1(bridge_slave_0) entered blocking state [ 642.192274][ T1124] bridge0: port 1(bridge_slave_0) entered forwarding state [ 642.205380][ T1124] bridge0: port 2(bridge_slave_1) entered blocking state [ 642.212568][ T1124] bridge0: port 2(bridge_slave_1) entered forwarding state [ 643.418312][ T5782] Bluetooth: hci2: command tx timeout [ 643.444935][ T5844] usb 2-1: Using ep0 maxpacket: 16 [ 643.524184][ T5844] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 643.533486][ T5844] usb 2-1: New USB device found, idVendor=0471, idProduct=0327, bcdDevice=61.a4 [ 643.550379][ T28] usb 4-1: USB disconnect, device number 47 [ 643.551668][ T5844] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 643.572618][ T5844] usb 2-1: config 0 descriptor?? [ 643.900087][T13241] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 643.963905][T13241] veth0_vlan: entered promiscuous mode [ 643.982229][T13241] veth1_vlan: entered promiscuous mode [ 644.025628][T13241] veth0_macvtap: entered promiscuous mode [ 644.038393][T13241] veth1_macvtap: entered promiscuous mode [ 644.060772][T13241] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 644.075800][T13241] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 644.087772][T13241] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 644.102687][T13241] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 644.114717][T13241] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 644.132625][T13241] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 644.148265][T13241] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 644.158120][T13241] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 644.177625][T13241] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 644.189289][T13241] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 644.202436][ T28] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 644.217962][T13241] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 644.235754][T13241] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 644.245321][T13241] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 644.256307][T13241] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 644.352911][ T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 644.369988][ T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 644.406528][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 644.416541][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 644.435227][ T28] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 644.457866][ T28] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 644.488516][ T28] usb 4-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 644.510339][ T28] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 644.539499][ T28] usb 4-1: config 0 descriptor?? [ 644.628875][T13291] tipc: Started in network mode [ 644.633809][T13291] tipc: Node identity f202874fed1e, cluster identity 4711 [ 644.642376][T13291] tipc: Enabled bearer , priority 0 [ 644.655518][T13291] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 644.673542][T13293] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2282'. [ 644.688157][T13290] tipc: Disabling bearer [ 644.978287][ T5844] usb 2-1: USB disconnect, device number 55 [ 645.226115][ T28] usbhid 4-1:0.0: can't add hid device: -71 [ 645.243510][ T28] usbhid: probe of 4-1:0.0 failed with error -71 [ 645.253664][ T28] usb 4-1: USB disconnect, device number 48 [ 645.560113][T13315] syzkaller0: entered promiscuous mode [ 645.566937][T13315] syzkaller0: entered allmulticast mode [ 645.591837][T13315] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 645.643616][ T5782] Bluetooth: hci2: command tx timeout [ 645.788663][T13318] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2292'. [ 646.091104][T13325] netlink: 'syz.0.2296': attribute type 12 has an invalid length. [ 646.106279][T13325] netlink: 'syz.0.2296': attribute type 29 has an invalid length. [ 646.141480][T13325] netlink: 148 bytes leftover after parsing attributes in process `syz.0.2296'. [ 646.171781][T13325] netlink: 'syz.0.2296': attribute type 1 has an invalid length. [ 646.186701][T13325] netlink: 'syz.0.2296': attribute type 2 has an invalid length. [ 646.194581][T13325] netlink: 11 bytes leftover after parsing attributes in process `syz.0.2296'. [ 646.207798][T13329] netlink: 'syz.0.2296': attribute type 12 has an invalid length. [ 646.226679][T13329] netlink: 'syz.0.2296': attribute type 29 has an invalid length. [ 646.237335][T13329] netlink: 148 bytes leftover after parsing attributes in process `syz.0.2296'. [ 646.249027][T13329] netlink: 'syz.0.2296': attribute type 1 has an invalid length. [ 646.262980][T13329] netlink: 'syz.0.2296': attribute type 2 has an invalid length. [ 646.270909][T13329] netlink: 11 bytes leftover after parsing attributes in process `syz.0.2296'. [ 646.420692][ T5844] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 646.602503][T12443] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 646.613853][T12443] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 646.623918][T12443] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 646.646590][T12443] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 646.657849][ T5844] usb 4-1: config index 0 descriptor too short (expected 45, got 36) [ 646.668825][T12443] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 646.676508][T12443] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 646.683867][ T5844] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 646.695694][ T5844] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 646.705621][ T5844] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 646.718761][ T5844] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 646.727988][ T5844] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 646.739346][ T5844] usb 4-1: config 0 descriptor?? [ 646.783482][ T7052] bond0: (slave syz_tun): Releasing backup interface [ 646.804473][T13341] syzkaller0: entered promiscuous mode [ 646.809976][T13341] syzkaller0: entered allmulticast mode [ 646.819895][T13338] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 647.037427][T13337] chnl_net:caif_netlink_parms(): no params data found [ 647.115386][T13337] bridge0: port 1(bridge_slave_0) entered blocking state [ 647.122724][T13337] bridge0: port 1(bridge_slave_0) entered disabled state [ 647.130046][T13337] bridge_slave_0: entered allmulticast mode [ 647.137106][T13337] bridge_slave_0: entered promiscuous mode [ 647.145882][T13337] bridge0: port 2(bridge_slave_1) entered blocking state [ 647.153351][T13337] bridge0: port 2(bridge_slave_1) entered disabled state [ 647.160674][T13337] bridge_slave_1: entered allmulticast mode [ 647.168000][T13337] bridge_slave_1: entered promiscuous mode [ 647.199206][T13337] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 647.211158][T13337] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 647.247375][T13337] team0: Port device team_slave_0 added [ 647.255836][T13337] team0: Port device team_slave_1 added [ 647.285100][T13337] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 647.292177][T13337] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 647.319491][T13337] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 647.333372][T13337] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 647.344536][T13337] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 647.374563][T13337] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 647.414887][ T5844] usbhid 4-1:0.0: can't add hid device: -71 [ 647.423207][ T5844] usbhid: probe of 4-1:0.0 failed with error -71 [ 647.427963][T13337] hsr_slave_0: entered promiscuous mode [ 647.434152][ T5844] usb 4-1: USB disconnect, device number 49 [ 647.449029][T13337] hsr_slave_1: entered promiscuous mode [ 647.466599][T13337] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 647.474804][T13337] Cannot create hsr debugfs directory [ 647.637145][T13337] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 647.722194][T13337] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 647.812120][T13337] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 647.855898][ T28] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 647.890264][T13337] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 647.896986][ T5782] Bluetooth: hci2: command tx timeout [ 648.061685][ T28] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 648.078170][ T28] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 648.080650][T13352] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2303'. [ 648.088532][ T28] usb 2-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 648.099976][T13337] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 648.113485][ T28] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 648.115864][ T28] usb 2-1: config 0 descriptor?? [ 648.136934][T13337] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 648.151282][T13337] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 648.163210][T13337] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 648.279989][T13337] 8021q: adding VLAN 0 to HW filter on device bond0 [ 648.305498][T13337] 8021q: adding VLAN 0 to HW filter on device team0 [ 648.327995][T12481] bridge0: port 1(bridge_slave_0) entered blocking state [ 648.335271][T12481] bridge0: port 1(bridge_slave_0) entered forwarding state [ 648.356618][T12481] bridge0: port 2(bridge_slave_1) entered blocking state [ 648.363828][T12481] bridge0: port 2(bridge_slave_1) entered forwarding state [ 648.606043][ T28] cm6533_jd 0003:0D8C:0022.0010: unknown main item tag 0x0 [ 648.621986][ T28] cm6533_jd 0003:0D8C:0022.0010: unknown main item tag 0x0 [ 648.640342][ T28] cm6533_jd 0003:0D8C:0022.0010: unknown main item tag 0x0 [ 648.654409][ T28] cm6533_jd 0003:0D8C:0022.0010: unknown main item tag 0x0 [ 648.673450][ T28] cm6533_jd 0003:0D8C:0022.0010: unknown main item tag 0x0 [ 648.687669][ T28] cm6533_jd 0003:0D8C:0022.0010: No inputs registered, leaving [ 648.717691][ T28] cm6533_jd 0003:0D8C:0022.0010: hiddev0,hidraw0: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.1-1/input0 [ 648.772800][T13337] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 648.844752][ T28] usb 2-1: USB disconnect, device number 56 [ 648.867377][T13337] veth0_vlan: entered promiscuous mode [ 648.918605][T13337] veth1_vlan: entered promiscuous mode [ 648.938115][ T5782] Bluetooth: hci4: command tx timeout [ 648.962984][T13337] veth0_macvtap: entered promiscuous mode [ 648.983320][T13337] veth1_macvtap: entered promiscuous mode [ 649.007613][T13337] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 649.020307][T13337] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 649.042279][T13337] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 649.053744][T13337] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 649.070683][T13337] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 649.082882][T13337] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 649.103411][T13337] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 649.140186][T13337] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 649.157318][T13337] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 649.169743][T13337] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 649.186158][T13337] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 649.197267][T13337] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 649.208215][T13337] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 649.220397][T13337] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 649.235841][T13337] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 649.244891][T13337] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 649.254802][T13337] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 649.265633][T13337] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 649.350870][ T1124] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 649.365174][ T1124] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 649.410554][T12471] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 649.431396][T12471] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 649.900199][ T788] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 649.968610][ T5830] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 650.034520][T13381] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2311'. [ 650.095282][ T788] usb 3-1: Using ep0 maxpacket: 16 [ 650.103299][ T788] usb 3-1: New USB device found, idVendor=0471, idProduct=0327, bcdDevice=61.a4 [ 650.119046][ T788] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 650.139337][ T788] usb 3-1: config 0 descriptor?? [ 650.149918][ T5782] Bluetooth: hci2: command tx timeout [ 650.156981][ T788] gspca_main: sonixj-2.14.0 probing 0471:0327 [ 650.197780][ T5830] usb 4-1: config index 0 descriptor too short (expected 45, got 36) [ 650.206283][ T5830] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 650.217869][ T5830] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 650.228366][ T5830] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 650.246668][ T5830] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 650.262694][ T5830] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 650.275086][ T5830] usb 4-1: config 0 descriptor?? [ 650.600155][ T788] gspca_sonixj: reg_r err -32 [ 650.615678][ T788] sonixj: probe of 3-1:0.0 failed with error -32 [ 650.945601][ T2183] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 650.970195][ T5830] usbhid 4-1:0.0: can't add hid device: -71 [ 650.976488][ T5830] usbhid: probe of 4-1:0.0 failed with error -71 [ 651.010775][ T5830] usb 4-1: USB disconnect, device number 50 [ 651.173116][ T2183] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 651.189170][ T5782] Bluetooth: hci4: command tx timeout [ 651.194234][ T2183] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 651.222515][ T2183] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 651.246037][ T2183] usb 2-1: config 0 descriptor?? [ 651.269381][ T2183] pwc: Askey VC010 type 2 USB webcam detected. [ 651.503319][T13387] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2313'. [ 651.554602][T13387] bridge1: port 1(dummy0) entered blocking state [ 651.580746][T13387] bridge1: port 1(dummy0) entered disabled state [ 651.590966][T13387] dummy0: entered allmulticast mode [ 651.613107][T13387] dummy0: entered promiscuous mode [ 651.647029][T13392] netlink: 'syz.1.2313': attribute type 10 has an invalid length. [ 651.683995][T13392] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2313'. [ 651.711811][T13392] bridge1: port 1(dummy0) entered blocking state [ 651.718243][T13392] bridge1: port 1(dummy0) entered forwarding state [ 651.753619][T13392] dummy0: left allmulticast mode [ 651.758998][T13392] bridge1: port 1(dummy0) entered disabled state [ 651.924886][ T2183] pwc: recv_control_msg error -71 req 02 val 2b00 [ 651.942187][ T2183] pwc: recv_control_msg error -71 req 02 val 2700 [ 651.957325][ T2183] pwc: recv_control_msg error -71 req 02 val 2c00 [ 651.957349][T13394] syzkaller0: entered promiscuous mode [ 651.967673][ T2183] pwc: recv_control_msg error -71 req 04 val 1000 [ 651.976792][ T2183] pwc: recv_control_msg error -71 req 04 val 1300 [ 651.984194][ T2183] pwc: recv_control_msg error -71 req 04 val 1400 [ 651.991740][T13394] syzkaller0: entered allmulticast mode [ 651.992086][ T2183] pwc: recv_control_msg error -71 req 02 val 2000 [ 652.004765][ T2183] pwc: recv_control_msg error -71 req 02 val 2100 [ 652.011822][ T2183] pwc: recv_control_msg error -71 req 04 val 1500 [ 652.019819][ T2183] pwc: recv_control_msg error -71 req 02 val 2500 [ 652.041046][ T2183] pwc: recv_control_msg error -71 req 02 val 2400 [ 652.056081][ T2183] pwc: recv_control_msg error -71 req 02 val 2600 [ 652.067708][ T2183] pwc: recv_control_msg error -71 req 02 val 2900 [ 652.085798][ T2183] pwc: recv_control_msg error -71 req 02 val 2800 [ 652.096879][ T2183] pwc: recv_control_msg error -71 req 04 val 1100 [ 652.118577][ T2183] pwc: recv_control_msg error -71 req 04 val 1200 [ 652.137934][ T2183] pwc: Registered as video103. [ 652.154886][ T2183] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input41 [ 652.203771][ T2183] usb 2-1: USB disconnect, device number 57 [ 652.813902][T13415] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2320'. [ 652.867092][ T5830] usb 3-1: USB disconnect, device number 56 [ 653.447082][ T5782] Bluetooth: hci4: command tx timeout [ 654.113675][ T5830] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 654.343998][ T5830] usb 1-1: config index 0 descriptor too short (expected 45, got 36) [ 654.352336][ T5830] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 654.363869][ T5830] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 654.377974][ T5830] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 654.379488][T13418] netlink: 184 bytes leftover after parsing attributes in process `syz.2.2321'. [ 654.404885][ T5830] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 654.414922][ T5830] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 654.458233][ T5830] usb 1-1: config 0 descriptor?? [ 654.969406][ T5844] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 655.182798][ T5844] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 655.209653][ T5844] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 655.223675][ T5830] usbhid 1-1:0.0: can't add hid device: -71 [ 655.237910][ T5830] usbhid: probe of 1-1:0.0 failed with error -71 [ 655.246058][ T5844] usb 2-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 655.263482][ T5830] usb 1-1: USB disconnect, device number 48 [ 655.270778][ T5844] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 655.306928][ T5844] usb 2-1: config 0 descriptor?? [ 655.322827][T13440] netlink: 'syz.3.2329': attribute type 11 has an invalid length. [ 655.553911][T13440] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 655.614410][T13440] mac80211_hwsim hwsim5 wlan0: entered promiscuous mode [ 655.635290][T13440] mac80211_hwsim hwsim5 wlan0: entered allmulticast mode [ 655.706901][ T5782] Bluetooth: hci4: command tx timeout [ 655.797747][ T5844] cm6533_jd 0003:0D8C:0022.0011: unknown main item tag 0x0 [ 655.805309][ T5844] cm6533_jd 0003:0D8C:0022.0011: unknown main item tag 0x0 [ 655.812557][ T5844] cm6533_jd 0003:0D8C:0022.0011: unknown main item tag 0x0 [ 655.824675][ T5844] cm6533_jd 0003:0D8C:0022.0011: unknown main item tag 0x0 [ 655.839867][ T5844] cm6533_jd 0003:0D8C:0022.0011: unknown main item tag 0x0 [ 655.863146][ T5844] cm6533_jd 0003:0D8C:0022.0011: No inputs registered, leaving [ 655.905548][ T5844] cm6533_jd 0003:0D8C:0022.0011: hiddev0,hidraw0: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.1-1/input0 [ 656.033125][ T5844] usb 2-1: USB disconnect, device number 58 [ 657.968196][T13459] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2334'. [ 658.071226][T13461] syzkaller0: entered promiscuous mode [ 658.077007][T13461] syzkaller0: entered allmulticast mode [ 658.396296][T13466] syzkaller0: entered promiscuous mode [ 658.409633][T13466] syzkaller0: entered allmulticast mode [ 658.425098][T13466] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 658.785001][T13476] binder: BINDER_SET_CONTEXT_MGR already set [ 658.791104][T13476] binder: 13473:13476 ioctl 4018620d 200000004a80 returned -16 [ 660.251133][T13491] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2344'. [ 660.298753][ T5844] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 660.639335][ T5844] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 660.672477][ T5844] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 660.707597][ T5844] usb 1-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 660.729428][ T5844] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 660.763547][ T5844] usb 1-1: config 0 descriptor?? [ 661.240709][ T5844] cm6533_jd 0003:0D8C:0022.0012: unknown main item tag 0x0 [ 661.258786][ T5844] cm6533_jd 0003:0D8C:0022.0012: unknown main item tag 0x0 [ 661.268592][ T5844] cm6533_jd 0003:0D8C:0022.0012: unknown main item tag 0x0 [ 661.290507][ T5844] cm6533_jd 0003:0D8C:0022.0012: No inputs registered, leaving [ 661.307959][ T5844] cm6533_jd 0003:0D8C:0022.0012: hiddev0,hidraw0: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.0-1/input0 [ 661.466555][ T5812] usb 1-1: USB disconnect, device number 49 [ 661.472887][ T969] usb 2-1: new high-speed USB device number 59 using dummy_hcd [ 661.701576][ T969] usb 2-1: config index 0 descriptor too short (expected 45, got 36) [ 661.720331][ T969] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 661.731949][ T969] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 661.761724][ T969] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 661.778671][T13513] Set syz1 is full, maxelem 65536 reached [ 661.793592][ T969] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 661.809668][ T969] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 661.821728][ T969] usb 2-1: config 0 descriptor?? [ 662.096671][ T5812] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 663.954296][ T5812] usb 4-1: config 0 has no interfaces? [ 663.961303][ T969] usbhid 2-1:0.0: can't add hid device: -71 [ 663.998477][ T969] usbhid: probe of 2-1:0.0 failed with error -71 [ 663.998985][ T5812] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 664.071876][ T969] usb 2-1: USB disconnect, device number 59 [ 664.195513][ T5812] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 664.226839][ T5812] usb 4-1: Product: syz [ 664.238927][ T5812] usb 4-1: Manufacturer: syz [ 664.245468][ T5812] usb 4-1: config 0 descriptor?? [ 664.467007][T13527] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2353'. [ 664.483916][ T788] usb 4-1: USB disconnect, device number 51 [ 664.595758][T13529] vlan2: entered promiscuous mode [ 664.601001][T13529] batadv0: entered promiscuous mode [ 666.851989][ T5812] usb 1-1: new full-speed USB device number 50 using dummy_hcd [ 667.076406][ T5812] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 667.097790][ T5812] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 667.119884][ T5812] usb 1-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 667.139894][ T5812] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 667.166973][ T5812] usb 1-1: config 0 descriptor?? [ 667.186978][ T5812] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 667.204266][ T5812] dvb-usb: bulk message failed: -22 (3/0) [ 667.214803][T13554] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2363'. [ 667.221639][ T5812] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 667.243614][ T5812] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 667.255808][ T5812] usb 1-1: media controller created [ 667.263291][ T5812] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 667.276505][ T5812] dvb-usb: bulk message failed: -22 (6/0) [ 667.282383][ T5812] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 667.317434][ T5812] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input42 [ 667.352565][ T5812] dvb-usb: schedule remote query interval to 150 msecs. [ 667.359569][ T5812] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 667.432907][T13544] dvb-usb: bulk message failed: -22 (2/0) [ 667.534300][ T5812] dvb-usb: bulk message failed: -22 (1/0) [ 667.550273][ T5812] dvb-usb: error while querying for an remote control event. [ 667.751079][ T5812] dvb-usb: bulk message failed: -22 (1/0) [ 667.770916][ T5812] dvb-usb: error while querying for an remote control event. [ 667.967857][ T5812] dvb-usb: bulk message failed: -22 (1/0) [ 667.985860][ T5812] dvb-usb: error while querying for an remote control event. [ 668.027110][ T5812] usb 1-1: USB disconnect, device number 50 [ 668.091242][ T5812] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 668.129478][T13576] syzkaller0: entered promiscuous mode [ 668.141854][T13576] syzkaller0: entered allmulticast mode [ 668.262948][ T788] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 668.470244][ T788] usb 3-1: unable to get BOS descriptor or descriptor too short [ 668.522642][ T788] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 668.542336][ T788] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 50, changing to 7 [ 668.571067][ T788] usb 3-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 668.612521][ T788] usb 3-1: New USB device found, idVendor=2b53, idProduct=0024, bcdDevice= 0.40 [ 668.653418][ T788] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 668.661566][ T788] usb 3-1: Product: syz [ 668.665800][ T788] usb 3-1: Manufacturer: syz [ 668.670470][ T788] usb 3-1: SerialNumber: syz [ 668.876611][T13584] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2372'. [ 669.048504][ T1283] ieee802154 phy0 wpan0: encryption failed: -22 [ 669.055005][ T1283] ieee802154 phy1 wpan1: encryption failed: -22 [ 669.775371][ T788] snd-usb-audio: probe of 3-1:1.0 failed with error -22 [ 669.835496][ T788] snd-usb-audio: probe of 3-1:1.1 failed with error -22 [ 669.971588][ T969] usb 2-1: new high-speed USB device number 60 using dummy_hcd [ 669.972801][ T788] snd-usb-audio: probe of 3-1:1.2 failed with error -22 [ 670.026021][ T788] usb 3-1: USB disconnect, device number 57 [ 670.083078][ T5898] udevd[5898]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 670.182180][ T969] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 670.217498][ T969] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 670.241876][ T969] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 670.264215][ T969] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 670.282973][ T969] usb 2-1: config 0 descriptor?? [ 670.296207][ T969] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 670.586775][T13604] syzkaller0: entered promiscuous mode [ 670.592705][T13604] syzkaller0: entered allmulticast mode [ 670.848932][ T788] usb 4-1: new full-speed USB device number 52 using dummy_hcd [ 670.898634][T13609] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2381'. [ 671.067643][ T788] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 671.077958][ T788] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 671.086899][ T788] usb 4-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 671.096030][ T788] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 671.107084][ T788] usb 4-1: config 0 descriptor?? [ 671.118751][ T788] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 671.125492][ T788] dvb-usb: bulk message failed: -22 (3/0) [ 671.141910][ T788] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 671.151127][ T788] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 671.158454][ T788] usb 4-1: media controller created [ 671.165098][ T788] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 671.179550][ T788] dvb-usb: bulk message failed: -22 (6/0) [ 671.188821][ T788] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 671.198049][ T788] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input43 [ 671.211279][ T788] dvb-usb: schedule remote query interval to 150 msecs. [ 671.224117][ T788] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 671.340448][T13602] dvb-usb: bulk message failed: -22 (2/0) [ 671.390442][ T788] dvb-usb: bulk message failed: -22 (1/0) [ 671.396273][ T788] dvb-usb: error while querying for an remote control event. [ 671.574710][ T788] dvb-usb: bulk message failed: -22 (1/0) [ 671.580651][ T788] dvb-usb: error while querying for an remote control event. [ 671.758819][ T788] dvb-usb: bulk message failed: -22 (1/0) [ 671.764734][ T788] dvb-usb: error while querying for an remote control event. [ 671.951654][ T788] dvb-usb: bulk message failed: -22 (1/0) [ 671.960143][ T788] dvb-usb: error while querying for an remote control event. [ 671.972031][ T5830] usb 4-1: USB disconnect, device number 52 [ 672.044703][ T5830] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 672.230048][T13628] mac80211_hwsim hwsim5 syzkaller0: entered promiscuous mode [ 672.239295][T13628] mac80211_hwsim hwsim5 syzkaller0: entered allmulticast mode [ 672.389541][T13634] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2390'. [ 672.942398][ T5830] usb 2-1: USB disconnect, device number 60 [ 674.422299][T13651] syzkaller0: entered promiscuous mode [ 674.438761][T13651] syzkaller0: entered allmulticast mode [ 674.565288][ T5830] usb 2-1: new full-speed USB device number 61 using dummy_hcd [ 674.810263][ T5830] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 674.845917][ T5830] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 674.854898][ T5830] usb 2-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 674.884168][ T5830] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 674.894631][T13657] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2400'. [ 674.918640][ T5830] usb 2-1: config 0 descriptor?? [ 674.944116][ T5830] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 674.966957][ T5830] dvb-usb: bulk message failed: -22 (3/0) [ 674.982341][ T5830] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 675.034956][ T5830] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 675.057873][ T5830] usb 2-1: media controller created [ 675.081963][ T5830] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 675.110748][ T5830] dvb-usb: bulk message failed: -22 (6/0) [ 675.128270][ T5830] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 675.166209][T13644] dvb-usb: bulk message failed: -22 (2/0) [ 675.166657][ T5830] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input44 [ 675.228431][ T5830] dvb-usb: schedule remote query interval to 150 msecs. [ 675.235444][ T5830] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 676.463079][ T788] dvb-usb: bulk message failed: -22 (1/0) [ 676.468884][ T788] dvb-usb: error while querying for an remote control event. [ 676.655008][ T788] dvb-usb: bulk message failed: -22 (1/0) [ 676.687291][ T788] dvb-usb: error while querying for an remote control event. [ 676.849728][ T2183] usb 2-1: USB disconnect, device number 61 [ 677.007896][ T2183] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 677.057119][T13681] [ 677.059534][T13681] ============================= [ 677.064429][T13681] WARNING: suspicious RCU usage [ 677.069495][T13681] syzkaller #0 Not tainted [ 677.073923][T13681] ----------------------------- [ 677.079170][T13681] net/mac80211/iface.c:378 suspicious rcu_dereference_protected() usage! [ 677.087660][T13681] [ 677.087660][T13681] other info that might help us debug this: [ 677.087660][T13681] [ 677.098058][T13681] [ 677.098058][T13681] rcu_scheduler_active = 2, debug_locks = 1 [ 677.106198][T13681] 1 lock held by syz.0.2409/13681: [ 677.111457][T13681] #0: ffffffff8e3c6988 (rtnl_mutex){+.+.}-{3:3}, at: devinet_ioctl+0x30c/0x1c40 [ 677.120764][T13681] [ 677.120764][T13681] stack backtrace: [ 677.126685][T13681] CPU: 0 PID: 13681 Comm: syz.0.2409 Not tainted syzkaller #0 [ 677.134149][T13681] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 677.144206][T13681] Call Trace: [ 677.147486][T13681] [ 677.150415][T13681] dump_stack_lvl+0x18c/0x250 [ 677.155104][T13681] ? show_regs_print_info+0x20/0x20 [ 677.160305][T13681] ? load_image+0x420/0x420 [ 677.164819][T13681] lockdep_rcu_suspicious+0x1e1/0x300 [ 677.170224][T13681] ieee80211_check_concurrent_iface+0x475/0x950 [ 677.176513][T13681] ieee80211_open+0xc1/0x200 [ 677.181113][T13681] __dev_open+0x2cb/0x430 [ 677.185461][T13681] ? dev_open+0x190/0x190 [ 677.189817][T13681] __dev_change_flags+0x211/0x6a0 [ 677.194862][T13681] ? dev_get_flags+0x1c0/0x1c0 [ 677.199632][T13681] ? mutex_lock_nested+0x20/0x20 [ 677.204578][T13681] ? apparmor_capable+0x137/0x1a0 [ 677.209624][T13681] dev_change_flags+0x88/0x1a0 [ 677.214390][T13681] devinet_ioctl+0x95c/0x1c40 [ 677.219090][T13681] ? inet_ifa_byprefix+0x2a0/0x2a0 [ 677.224221][T13681] ? _copy_from_user+0xa5/0xe0 [ 677.229086][T13681] ? get_user_ifreq+0x12b/0x180 [ 677.233941][T13681] inet_ioctl+0x42b/0x560 [ 677.238282][T13681] ? tomoyo_path_number_perm+0x217/0x620 [ 677.243931][T13681] ? inet_shutdown+0x370/0x370 [ 677.248714][T13681] ? slab_free_freelist_hook+0x130/0x1a0 [ 677.254349][T13681] ? tomoyo_path_number_perm+0x500/0x620 [ 677.259980][T13681] ? __kmem_cache_free+0xba/0x1e0 [ 677.265024][T13681] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 677.270487][T13681] sock_do_ioctl+0xfc/0x310 [ 677.274999][T13681] ? sock_show_fdinfo+0xb0/0xb0 [ 677.279902][T13681] sock_ioctl+0x5ba/0x7e0 [ 677.284247][T13681] ? sock_poll+0x3e0/0x3e0 [ 677.288677][T13681] ? bpf_lsm_file_ioctl+0x9/0x10 [ 677.293610][T13681] ? security_file_ioctl+0x80/0xa0 [ 677.298717][T13681] ? sock_poll+0x3e0/0x3e0 [ 677.303130][T13681] __se_sys_ioctl+0xfd/0x170 [ 677.307724][T13681] do_syscall_64+0x55/0xb0 [ 677.312134][T13681] ? clear_bhb_loop+0x40/0x90 [ 677.316804][T13681] ? clear_bhb_loop+0x40/0x90 [ 677.321479][T13681] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 677.327373][T13681] RIP: 0033:0x7f926f79ce59 [ 677.331787][T13681] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 677.351389][T13681] RSP: 002b:00007f92706fb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 677.359804][T13681] RAX: ffffffffffffffda RBX: 00007f926fa15fa0 RCX: 00007f926f79ce59 [ 677.367771][T13681] RDX: 0000200000002280 RSI: 0000000000008914 RDI: 0000000000000007 [ 677.375737][T13681] RBP: 00007f926f832d6f R08: 0000000000000000 R09: 0000000000000000 [ 677.383705][T13681] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 677.391677][T13681] R13: 00007f926fa16038 R14: 00007f926fa15fa0 R15: 00007ffff4819278 [ 677.399659][T13681] [ 677.482942][T13683] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2410'.