last executing test programs: 33.511016201s ago: executing program 0 (id=2558): r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0xd0f, 0x70bd2c, 0x0, {0x60, 0x0, 0x0, r2, {0x0, 0xa}, {0xffff, 0xffff}, {0xd, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x6, 0x0, 0x6}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0xc084}, 0x44080) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000580)=@newqdisc={0x2c, 0x24, 0xd0f, 0x70bd2c, 0x0, {0x60, 0x0, 0x0, r2, {0x0, 0x2}, {0x0, 0xa}, {0x1, 0xc}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x55}, 0x4000) 32.921742948s ago: executing program 0 (id=2562): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r1, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r1, 0x3) accept4(r1, 0x0, 0x0, 0x800) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB], 0x16) syz_open_dev$tty1(0xc, 0x4, 0x2) close_range(r0, 0xffffffffffffffff, 0x0) 32.041138969s ago: executing program 0 (id=2567): openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000100)) r1 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) ioctl$SNDRV_PCM_IOCTL_SYNC_PTR(r1, 0xc0884123, &(0x7f0000000280)={0x0, "728d0a484585ec93a59baeb6831b8ef110181595fe49bc4ac10b67b1b99eeeaa18e15a525115cc71983456358ceb7e1a6f926168ce0c3c2b0f3513a5f2674185", {0x800000000000004, 0x50000000000}}) 32.04096368s ago: executing program 0 (id=2568): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x128}, 0x4004000) r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x80101) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000440)={0x53, 0xfffffffffffffffe, 0xe6, 0x80, @buffer={0x310, 0x1003, &(0x7f00000014c0)=""/4099}, &(0x7f0000000080)="a7013d8bc6a47b07282009fe4e7d0900760cc8d74bdcc4ebd80aaa503d63a757ac359e7f9cc9858d8daf43fff436c705bc7e656458475b9ef8867bd850057f52264f00822f4b9d111413a7066e48f72d99802f00a8cfbb286a6ef7cf536b56481ca7a81fd26170728bb05607578f8feebc92e60ebf7d7ae3987b233e5d794fd55012ada4a5680bec56ff06a45d955b4ec514dd062bdf713a2b6421a9e164a1f686b39a81706f02000000a53110f9641e1e9f63719b6568409496a128dd27d7a1a471d961080000000000000072d0cedbbd909263fc834e43b3fdc8e8af48c5a70059abfe0e31", 0x0, 0x1, 0xe, 0xffffffffffffffff, 0x0}) 31.921083273s ago: executing program 0 (id=2569): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x0, 0x0) r1 = dup(r0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) read$ptp(r1, &(0x7f00000001c0)=""/207, 0xcf) 31.739317432s ago: executing program 0 (id=2574): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r1, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r1, 0x3) accept4(r1, 0x0, 0x0, 0x800) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e1301"], 0x16) syz_open_dev$tty1(0xc, 0x4, 0x2) close_range(r0, 0xffffffffffffffff, 0x0) 16.433397142s ago: executing program 32 (id=2574): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r1, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r1, 0x3) accept4(r1, 0x0, 0x0, 0x800) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e1301"], 0x16) syz_open_dev$tty1(0xc, 0x4, 0x2) close_range(r0, 0xffffffffffffffff, 0x0) 5.189117504s ago: executing program 4 (id=2837): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./tracing\x00', &(0x7f0000000200)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracing/events/sched/filter\x00', 0x1, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_SETTRIGGER(r1, 0x40045010, &(0x7f00000000c0)=0x8001) write$dsp(r1, &(0x7f0000000080)="9a", 0x1) close(r1) sched_setscheduler(0x0, 0x2, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) write(r0, &(0x7f0000000400)='(o', 0x2) 4.361113123s ago: executing program 4 (id=2849): socket$key(0xf, 0x3, 0x2) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_create(0x6, &(0x7f00000001c0)={0x0, 0x2d, 0x1}, &(0x7f0000000140)=0x0) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r2, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r2, 0x0, r3, 0x0, 0x8000f28, 0x5) r4 = getpid() r5 = syz_pidfd_open(r4, 0x0) setns(r5, 0x24020000) r6 = open_tree(0xffffffffffffff9c, 0x0, 0x9801) unshare(0x2c020400) move_mount(r6, 0x0, 0xffffffffffffff9c, 0x0, 0x75) sendmmsg$inet(r2, &(0x7f0000003240)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000e80)="2389", 0x2}], 0x1}}], 0x1, 0x4040040) bind$inet(r0, 0x0, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x20008001, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) accept4(r0, 0x0, 0x0, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x200000000000000, 0x0, 0xd1}, 0xc000) 3.807291954s ago: executing program 4 (id=2858): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) write$rfkill(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$MSR(0x0, 0x0, 0x0) bind$can_j1939(0xffffffffffffffff, 0x0, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x17a) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./dev/mtdblock0\x00', &(0x7f00000002c0)='romfs\x00', 0x23000000, 0x0) 3.730664601s ago: executing program 4 (id=2860): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./tracing\x00', &(0x7f0000000200)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracing/events/sched/filter\x00', 0x1, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_SETTRIGGER(r1, 0x40045010, &(0x7f00000000c0)=0x8001) write$dsp(r1, &(0x7f0000000080)="9a", 0x1) close(r1) sched_setscheduler(0x0, 0x2, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) write(r0, &(0x7f0000000400)='(o', 0x2) 3.639025545s ago: executing program 3 (id=2862): mkdir(&(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000140)='./config/cluster/mycluster\x00', 0x1ff) mkdir(&(0x7f0000000180)='./config/cluster/mycluster/node/mynode\x00', 0x1ff) close(0xffffffffffffffff) r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/cluster/mycluster/node/mynode/num\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='0', 0x1) 3.550478955s ago: executing program 3 (id=2863): socket$key(0xf, 0x3, 0x2) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_create(0x6, &(0x7f00000001c0)={0x0, 0x2d, 0x1}, &(0x7f0000000140)=0x0) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r2, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r2, 0x0, r3, 0x0, 0x8000f28, 0x5) r4 = getpid() r5 = syz_pidfd_open(r4, 0x0) setns(r5, 0x24020000) r6 = open_tree(0xffffffffffffff9c, 0x0, 0x9801) unshare(0x2c020400) move_mount(r6, 0x0, 0xffffffffffffff9c, 0x0, 0x75) sendmmsg$inet(r2, &(0x7f0000003240)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000e80)="2389", 0x2}], 0x1}}], 0x1, 0x4040040) bind$inet(r0, 0x0, 0x0) listen(r0, 0x5) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x20008001, 0x0, 0x0) accept4(r0, 0x0, 0x0, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x200000000000000, 0x0, 0xd1}, 0xc000) 3.069365984s ago: executing program 4 (id=2866): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000700)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000740)={0x2c, &(0x7f0000000980)=ANY=[@ANYBLOB="00000001000000090090"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000600), 0x6828, 0x0) syz_usb_connect(0x1, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000"], 0x0) ioctl$EVIOCGKEYCODE_V2(r1, 0x80284504, &(0x7f0000000000)=""/147) 3.003385164s ago: executing program 1 (id=2868): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000100)={0x1, "ff0f000000000000f5a72d866b0000000000f0ffdefe00"}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x5, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000002380)={r1, 0x0, 0x2d, 0x0, @val=@netfilter={0x2, 0x4, 0x600, 0x1}}, 0x20) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x20008010}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x200280d0}, 0x40) sendmsg$NFT_BATCH(r2, &(0x7f0000001940)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELSET={0x2c, 0xb, 0xa, 0x5, 0x0, 0x0, {0xa, 0x0, 0x9}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x54}, 0x1, 0x0, 0x0, 0x40091}, 0x24004844) r3 = socket(0x840000000002, 0x3, 0xff) sendmsg$inet(r3, &(0x7f0000000900)={&(0x7f00000006c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x3f}}, 0x10, &(0x7f00000034c0)=[{&(0x7f00000004c0)="9745010000002024010000ac0a3324491fbb00000098894633120b55", 0x1c}, {&(0x7f0000000500)="e07ecb0f5d6d7afc", 0x8}], 0x2}, 0x24004804) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r6 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x103000, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r6, 0xc0184800, &(0x7f0000000100)={0x4, r5, 0x80000}) ioctl$DMA_BUF_SET_NAME_A(r7, 0x40086203, &(0x7f00000001c0)='\x02\x00\x00\x00\x05\x00\x00\x00-control\x00') r8 = landlock_create_ruleset(&(0x7f0000000040)={0x2, 0x3, 0x3}, 0x18, 0x0) r9 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) uname(&(0x7f0000000300)=""/7) ioctl$vim2m_VIDIOC_REQBUFS(r9, 0xc0145608, &(0x7f0000000000)={0x6, 0x1, 0x1, 0x0, 0x3}) ioctl$vim2m_VIDIOC_STREAMOFF(r9, 0xc0205647, 0x0) landlock_restrict_self(r8, 0xb) ioctl$DMA_BUF_IOCTL_SYNC(r7, 0x40086200, &(0x7f0000000540)=0x1) close_range(r5, r6, 0x0) 2.577041759s ago: executing program 3 (id=2872): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x10) r3 = getpid() syz_pidfd_open(r3, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x169802, 0x0) r5 = dup(r4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x13, r5, 0x0) ioctl$BLKROSET(r4, 0x125d, &(0x7f0000000000)=0x1000000010) ioctl$BLKRRPART(r5, 0x125f, 0x0) r6 = semget$private(0x0, 0x6, 0x3b1) semctl$GETZCNT(r6, 0x0, 0xf, 0x0) r7 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r7, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) r8 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r8, 0x0, 0x0) getsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x8, 0x0, 0x0) syz_open_procfs(0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) 2.520535328s ago: executing program 2 (id=2874): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./tracing\x00', &(0x7f0000000200)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracing/events/sched/filter\x00', 0x1, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_SETTRIGGER(r1, 0x40045010, &(0x7f00000000c0)=0x8001) write$dsp(r1, &(0x7f0000000080)="9a", 0x1) close(r1) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x5) r2 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) write(r0, &(0x7f0000000400)='(o', 0x2) 2.253306573s ago: executing program 1 (id=2875): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000100)={0x1, "ff0f000000000000f5a72d866b0000000000f0ffdefe00"}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x5, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000002380)={r1, 0x0, 0x2d, 0x0, @val=@netfilter={0x2, 0x4, 0x600, 0x1}}, 0x20) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x20008010}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x200280d0}, 0x40) sendmsg$NFT_BATCH(r2, &(0x7f0000001940)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELSET={0x2c, 0xb, 0xa, 0x5, 0x0, 0x0, {0xa, 0x0, 0x9}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x54}, 0x1, 0x0, 0x0, 0x40091}, 0x24004844) r3 = socket(0x840000000002, 0x3, 0xff) sendmsg$inet(r3, &(0x7f0000000900)={&(0x7f00000006c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x3f}}, 0x10, &(0x7f00000034c0)=[{&(0x7f00000004c0)="9745010000002024010000ac0a3324491fbb00000098894633120b55", 0x1c}, {&(0x7f0000000500)="e07ecb0f5d6d7afc", 0x8}], 0x2}, 0x24004804) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r6 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x103000, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r6, 0xc0184800, &(0x7f0000000100)={0x4, r5, 0x80000}) ioctl$DMA_BUF_SET_NAME_A(r7, 0x40086203, &(0x7f00000001c0)='\x02\x00\x00\x00\x05\x00\x00\x00-control\x00') r8 = landlock_create_ruleset(&(0x7f0000000040)={0x2, 0x3, 0x3}, 0x18, 0x0) r9 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) uname(&(0x7f0000000300)=""/7) ioctl$vim2m_VIDIOC_REQBUFS(r9, 0xc0145608, &(0x7f0000000000)={0x6, 0x1, 0x1, 0x0, 0x3}) ioctl$vim2m_VIDIOC_STREAMOFF(r9, 0xc0205647, 0x0) landlock_restrict_self(r8, 0xb) ioctl$DMA_BUF_IOCTL_SYNC(r7, 0x40086200, &(0x7f0000000540)=0x1) close_range(r5, r6, 0x0) 2.152536642s ago: executing program 3 (id=2876): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) sendmsg$inet6(r1, &(0x7f0000000800)={&(0x7f00000001c0)={0xa, 0x4e24, 0x8, @ipv4={'\x00', '\xff\xff', @loopback}, 0x4}, 0x1c, &(0x7f0000000200)=[{&(0x7f0000000240)='\b', 0x1}], 0x1}, 0x4048043) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='dummy0\x00', 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet(0x2, 0x2, 0x0) socket(0x10, 0x3, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(0xffffffffffffffff, &(0x7f0000000180)={0x4, 0x8, 0xfa00, {0xffffffffffffffff, 0x4}}, 0x39fab) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000340)={0x0, @in6={{0xa, 0x4e24, 0x4, @empty, 0x3}}, 0x800, 0x6, 0xffff1891, 0x0, 0xb23be0fbe66397b6, 0x9, 0x1b}, 0x9c) 2.070499421s ago: executing program 3 (id=2877): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x128}, 0x4004000) r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x80101) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000440)={0x53, 0xfffffffffffffffe, 0x104, 0x80, @buffer={0x310, 0x1003, &(0x7f00000014c0)=""/4099}, &(0x7f0000000080)="a7013d8bc6a47b07282009fe4e7d0900760cc8d74bdcc4ebd80aaa503d63a757ac359e7f9cc9858d8daf43fff436c705bc7e656458475b9ef8867bd850057f52264f00822f4b9d111413a7066e48f72d99802f00a8cfbb286a6ef7cf536b56481ca7a81fd26170728bb05607578f8feebc92e60ebf7d7ae3987b233e5d794fd55012ada4a5680bec56ff06a45d955b4ec514dd062bdf713a2b6421a9e164a1f686b39a81706f02000000a53110f9641e1e9f63719b6568409496a128dd27d7a1a471d961080000000000000072d0cedbbd909263fc834e43b3fdc8e8af48c5a70059abfe0e318cd0a6d4d19508014eb56a174d95e4014927ff7b34bb7f5668beb810c024", 0x0, 0x1, 0xe, 0xffffffffffffffff, 0x0}) 2.070269676s ago: executing program 3 (id=2878): socketpair$unix(0x1, 0x3, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x10002, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_ublk_setup_io_uring(0x2262, &(0x7f0000000240)={0x0, 0xd58c, 0x80, 0x2, 0x30b}, &(0x7f0000000140)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000980)=@IORING_OP_TIMEOUT={0xb, 0x12, 0x0, 0x0, 0xffffffffffffffff, &(0x7f00000000c0), 0x1, 0x40, 0x1}) eventfd2(0x7, 0x1) io_uring_register$IORING_REGISTER_EVENTFD(r0, 0x4, 0x0, 0x1) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f00000003c0)={0x2e, 0x5, 0x21, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x68ba, 0x0, 0x0, 0x10}}}, 0x0) 1.906038084s ago: executing program 2 (id=2879): r0 = socket$nl_route(0x10, 0x3, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f0000000140), &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x2210088, &(0x7f0000000580)=ANY=[@ANYBLOB="74f5026e733d76697274696f2c70726976706f72742c646972656374696f2c63616368653d6c6f6f73652c6d73697a653d307830303030303030303030303031303030"]) chdir(&(0x7f0000000100)='./file0\x00') r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='blkio.throttle.io_service_bytes\x00', 0x275a, 0x0) ftruncate(r1, 0x4a8e) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write$FUSE_INTERRUPT(r1, &(0x7f00000028c0)={0x10, 0xfffffffffffffff5}, 0x8e4a) mremap(&(0x7f0000064000/0x3000)=nil, 0x3000, 0x600000, 0x3, &(0x7f0000a00000/0x600000)=nil) mlock(&(0x7f00007d8000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r3 = accept4(r1, &(0x7f0000000280)=@vsock={0x28, 0x0, 0x0, @host}, &(0x7f0000000340)=0x80, 0x80800) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xc, &(0x7f0000000100)=@framed={{0x18, 0x2, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x5}, [@call={0x85, 0x0, 0x0, 0x2c}, @printk={@lu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x6}}]}, &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x46, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x8c, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r3, 0x84009422, &(0x7f0000000680)={0x0, 0x0, {}, {0x0, @usage, 0x0}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000a80)={r5, 0x4, 0x9}) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={[{@nfs_export_on}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x0, 0x2100, 0x0, &(0x7f0000000100), 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) listen(r6, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r6, 0x0, r7, 0x0, 0xf3a, 0x0) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r7, 0x800442d2, &(0x7f0000000080)={0x2, &(0x7f0000000040)=[{}, {0x0, 0x0, 0x0, @broadcast}]}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="480000001000010029bd7000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="8db20200211a0008140003006e65756465082fa1fc3000000000009114001680100001800c000300810000008b0f0000"], 0x48}, 0x1, 0x0, 0x0, 0xc1}, 0x48880) 1.630606447s ago: executing program 2 (id=2880): syz_emit_vhci(&(0x7f0000000000)=@HCI_EVENT_PKT={0x4, @hci_ev_disconn_complete={{0x5, 0x4}, {0x5, 0xc9, 0x7}}}, 0x7) getsockopt$CAN_RAW_FILTER(0xffffffffffffffff, 0x65, 0x7, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x4004000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x0) 1.51488281s ago: executing program 1 (id=2881): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000100)={0x1, "ff0f000000000000f5a72d866b0000000000f0ffdefe00"}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x5, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000002380)={r1, 0x0, 0x2d, 0x0, @val=@netfilter={0x2, 0x4, 0x600, 0x1}}, 0x20) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x20008010}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff274"], 0x84}, 0x1, 0x0, 0x0, 0x200280d0}, 0x40) sendmsg$NFT_BATCH(r2, &(0x7f0000001940)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELSET={0x2c, 0xb, 0xa, 0x5, 0x0, 0x0, {0xa, 0x0, 0x9}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x54}, 0x1, 0x0, 0x0, 0x40091}, 0x24004844) r3 = socket(0x840000000002, 0x3, 0xff) sendmsg$inet(r3, &(0x7f0000000900)={&(0x7f00000006c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x3f}}, 0x10, &(0x7f00000034c0)=[{&(0x7f00000004c0)="9745010000002024010000ac0a3324491fbb00000098894633120b55", 0x1c}, {&(0x7f0000000500)="e07ecb0f5d6d7afc", 0x8}], 0x2}, 0x24004804) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r6 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x103000, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r6, 0xc0184800, &(0x7f0000000100)={0x4, r5, 0x80000}) ioctl$DMA_BUF_SET_NAME_A(r7, 0x40086203, &(0x7f00000001c0)='\x02\x00\x00\x00\x05\x00\x00\x00-control\x00') r8 = landlock_create_ruleset(&(0x7f0000000040)={0x2, 0x3, 0x3}, 0x18, 0x0) r9 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) uname(&(0x7f0000000300)=""/7) ioctl$vim2m_VIDIOC_REQBUFS(r9, 0xc0145608, &(0x7f0000000000)={0x6, 0x1, 0x1, 0x0, 0x3}) ioctl$vim2m_VIDIOC_STREAMOFF(r9, 0xc0205647, 0x0) landlock_restrict_self(r8, 0xb) ioctl$DMA_BUF_IOCTL_SYNC(r7, 0x40086200, &(0x7f0000000540)=0x1) close_range(r5, r6, 0x0) sendmsg$NFT_MSG_GETFLOWTABLE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="2c00aed74365010300000010000000000a0000070c000000001f9ceafe00000a0900010073797a3100064a"], 0x2c}}, 0x48011) 1.407632911s ago: executing program 2 (id=2882): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x3, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e20, @empty}, 0x10) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000780)=[{{&(0x7f0000000140)={0x2, 0x4e20, @local}, 0x10, 0x0}}], 0x1, 0x0) syz_emit_ethernet(0x32, &(0x7f00000006c0)={@multicast, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x11, 0x0, @initdev={0xac, 0x1e, 0xfe, 0x0}, @empty=0xe0000001}, {0x4e22, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x1, 0x1, 0x9}}}}}}}, 0x0) 1.220769759s ago: executing program 2 (id=2883): syz_usb_connect(0x1, 0x36, &(0x7f00000004c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a8230820090400bc6435fb4d00090503034d00", @ANYRES32], &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) pwritev(r0, &(0x7f00000000c0)=[{&(0x7f0000000040)='W', 0x1}], 0x1, 0x8000, 0x7) close(r0) 1.216305781s ago: executing program 1 (id=2884): ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, 0x0) socket$inet6(0xa, 0x80002, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./trace\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/trace_pipe\x00', 0x800, 0x0) close(r3) 190.710474ms ago: executing program 1 (id=2885): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00'}) r1 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50}, 0x48008) 119.997735ms ago: executing program 1 (id=2886): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000580)=[@in={0x2, 0x4e21, @local}], 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000400)={0x0, 0x3}, 0x8) sendmsg$inet_sctp(r0, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f0000000280)=[{&(0x7f0000000380)='N', 0x1}], 0x1, 0x0, 0x0, 0x804c040}, 0x1) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000240)={0x0, 0x80000001, 0x30}, 0xc) write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000001c0)=ANY=[], 0x32600) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(0xffffffffffffffff, &(0x7f0000000000)={0x4, 0x8, 0xfa00, {0xffffffffffffffff, 0x8}}, 0x10) 310.332µs ago: executing program 2 (id=2887): r0 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r0, &(0x7f0000000000)={&(0x7f0000000080)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x39}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) readahead(0xffffffffffffffff, 0xd9, 0x8) syz_emit_ethernet(0xae, &(0x7f00000000c0)=ANY=[@ANYRESOCT], 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r1, 0x40085112, &(0x7f0000000080)=@x={0x94, 0x6, "85fcff401fbf"}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, 0x0) ioctl$TUNSETLINK(r2, 0x400454cd, 0x304) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mknod(0x0, 0x20, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x80) mount(0x0, 0x0, 0x0, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/devices/system/cpu/cpu1/online\x00', 0x1, 0x0) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)={0x0, 0xc, 0x5}) clock_adjtime(0x0, &(0x7f00000001c0)={0x8b8b, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffd, 0xe00, 0x8, 0x0, 0x6, 0x0, 0x3, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x1000000004, 0x0, 0xffffffffffffff20, 0x0, 0x1, 0x0, 0x0, 0x10}) write(r3, &(0x7f0000000100)='0', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/devices/system/cpu/cpu1/online\x00', 0x1, 0x0) write(r4, &(0x7f0000000100)='1', 0x1) r5 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r5, r5) setpgid(0x0, r5) wait4(r5, &(0x7f0000000140), 0x8, &(0x7f00000002c0)) ioctl$FS_IOC_GETFSLABEL(r1, 0x81009431, &(0x7f00000001c0)) socket$unix(0x1, 0x2, 0x0) 0s ago: executing program 4 (id=2888): socket$key(0xf, 0x3, 0x2) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_create(0x6, &(0x7f00000001c0)={0x0, 0x2d, 0x1}, &(0x7f0000000140)=0x0) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r2, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r2, 0x0, r3, 0x0, 0x8000f28, 0x5) r4 = getpid() r5 = syz_pidfd_open(r4, 0x0) setns(r5, 0x24020000) r6 = open_tree(0xffffffffffffff9c, 0x0, 0x9801) unshare(0x2c020400) move_mount(r6, 0x0, 0xffffffffffffff9c, 0x0, 0x75) sendmmsg$inet(r2, &(0x7f0000003240)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000e80)="2389", 0x2}], 0x1}}], 0x1, 0x4040040) bind$inet(r0, 0x0, 0x0) listen(r0, 0x5) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x20008001, 0x0, 0x0) accept4(r0, 0x0, 0x0, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x200000000000000, 0x0, 0xd1}, 0xc000) kernel console output (not intermixed with test programs): [ 230.469209][ T3261] usb 7-1: new high-speed USB device number 32 using dummy_hcd [ 230.650295][ T3261] usb 7-1: Using ep0 maxpacket: 16 [ 230.652622][ T3261] usb 7-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 230.658855][ T3261] usb 7-1: config 0 has an invalid interface number: 255 but max is 0 [ 230.662028][ T3261] usb 7-1: config 0 has no interface number 0 [ 230.672193][ T3261] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 230.676389][ T3261] usb 7-1: Product: syz [ 230.677709][ T3261] usb 7-1: Manufacturer: syz [ 230.689159][ T3261] usb 7-1: SerialNumber: syz [ 230.692220][ T3261] usb 7-1: config 0 descriptor?? [ 230.695591][ T3261] visor 7-1:0.255: Sony Clie 3.5 converter detected [ 231.104162][ T3261] usb 7-1: Sony Clie 3.5 converter now attached to ttyUSB0 [ 231.222600][T11177] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 231.304086][ T3261] usb 7-1: USB disconnect, device number 32 [ 231.313528][ T3261] clie_3.5 ttyUSB0: Sony Clie 3.5 converter now disconnected from ttyUSB0 [ 231.317109][ T3261] visor 7-1:0.255: device disconnected [ 231.759344][ T1479] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 231.909227][ T1479] usb 5-1: Using ep0 maxpacket: 16 [ 232.163710][ T1479] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 232.583405][T11204] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 232.713346][ T1479] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 232.716743][ T1479] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 232.720174][ T1479] usb 5-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 232.723489][ T1479] usb 5-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 232.728230][ T1479] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 232.730972][ T1479] usb 5-1: SerialNumber: syz [ 232.739412][ T1479] hub 5-1:1.0: bad descriptor, ignoring hub [ 232.741535][ T1479] hub 5-1:1.0: probe with driver hub failed with error -5 [ 232.744350][ T1479] cdc_ether 5-1:1.0: probe with driver cdc_ether failed with error -22 [ 232.832512][ T42] kauditd_printk_skb: 674 callbacks suppressed [ 232.832526][ T42] audit: type=1326 audit(1787233339.869:59549): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11212 comm="syz.1.2052" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7f42fec code=0x7ffc0000 [ 232.850797][ T42] audit: type=1326 audit(1787233339.869:59550): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11212 comm="syz.1.2052" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7f43017 code=0x7ffc0000 [ 232.859403][ T42] audit: type=1326 audit(1787233339.869:59551): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11212 comm="syz.1.2052" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7f42fec code=0x7ffc0000 [ 232.879298][ T42] audit: type=1326 audit(1787233339.869:59552): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11212 comm="syz.1.2052" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7f43017 code=0x7ffc0000 [ 232.887924][ T42] audit: type=1326 audit(1787233339.869:59553): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11212 comm="syz.1.2052" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7f42fec code=0x7ffc0000 [ 232.896915][ T42] audit: type=1326 audit(1787233339.869:59554): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11212 comm="syz.1.2052" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7f43017 code=0x7ffc0000 [ 232.910638][ T42] audit: type=1326 audit(1787233339.869:59555): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11212 comm="syz.1.2052" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7f42fec code=0x7ffc0000 [ 232.929687][ T42] audit: type=1326 audit(1787233339.869:59556): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11212 comm="syz.1.2052" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7f43017 code=0x7ffc0000 [ 232.939625][ T42] audit: type=1326 audit(1787233339.869:59557): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11212 comm="syz.1.2052" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7f42fec code=0x7ffc0000 [ 232.946328][ T42] audit: type=1326 audit(1787233339.869:59558): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11212 comm="syz.1.2052" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7f43017 code=0x7ffc0000 [ 233.049453][ T5880] usb 5-1: USB disconnect, device number 22 [ 233.162503][T11217] netlink: 'syz.3.2053': attribute type 3 has an invalid length. [ 233.519193][ T5880] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 233.679428][ T5880] usb 6-1: Using ep0 maxpacket: 8 [ 233.684651][ T5880] usb 6-1: unable to get BOS descriptor or descriptor too short [ 233.687093][ T5880] usb 6-1: New USB device found, idVendor=0582, idProduct=008d, bcdDevice= 0.40 [ 233.696667][ T5880] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 248, changing to 7 [ 233.710470][ T5880] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 233.713717][ T5880] usb 6-1: Product: syz [ 233.715177][ T5880] usb 6-1: Manufacturer: syz [ 233.717405][ T5880] usb 6-1: SerialNumber: syz [ 233.770833][T11240] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 233.942159][T11225] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 233.954542][T11225] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 234.195084][T11244] kAFS: unable to lookup cell 'syz1' [ 234.325854][T11254] mmap: syz.0.2067 (11254) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 234.460699][T11268] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2072'. [ 234.464594][T11268] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2072'. [ 234.468317][T11268] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2072'. [ 234.508437][ T5880] snd-ua101 6-1:1.1: invalid format type [ 234.514186][ T5880] snd-ua101 6-1:1.0: invalid num_altsetting [ 234.526024][ T5880] usb 6-1: USB disconnect, device number 25 [ 234.546367][T11274] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 234.746436][ T61] usb 8-1: USB disconnect, device number 14 [ 234.798122][ T5731] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 234.812030][ T5731] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 234.816407][ T5731] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 234.822306][ T5731] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 234.825616][ T5731] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 235.255477][T11283] bridge0: port 1(bridge_slave_0) entered blocking state [ 235.259327][T11283] bridge0: port 1(bridge_slave_0) entered disabled state [ 235.264977][T11283] bridge_slave_0: entered allmulticast mode [ 235.267840][T11283] bridge_slave_0: entered promiscuous mode [ 235.280243][T11283] bridge0: port 2(bridge_slave_1) entered blocking state [ 235.284545][T11283] bridge0: port 2(bridge_slave_1) entered disabled state [ 235.289808][T11283] bridge_slave_1: entered allmulticast mode [ 235.301809][T11283] bridge_slave_1: entered promiscuous mode [ 235.377965][T11283] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 235.383061][T11283] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 235.439451][T11283] team0: Port device team_slave_0 added [ 235.447123][T11283] team0: Port device team_slave_1 added [ 235.510352][T11283] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 235.516420][T11283] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 235.529269][T11283] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 235.557793][T11283] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 235.568636][T11283] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 235.578911][T11283] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 235.680712][T11283] hsr_slave_0: entered promiscuous mode [ 235.684165][T11283] hsr_slave_1: entered promiscuous mode [ 235.686516][T11283] debugfs: 'hsr0' already exists in 'hsr' [ 235.691452][T11283] Cannot create hsr debugfs directory [ 235.831364][ T61] usb 7-1: new high-speed USB device number 33 using dummy_hcd [ 235.989215][ T61] usb 7-1: Using ep0 maxpacket: 16 [ 236.001974][ T61] usb 7-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 236.020128][ T61] usb 7-1: config 0 has an invalid descriptor of length 55, skipping remainder of the config [ 236.029529][ T61] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 236.033630][ T61] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 236.038624][ T61] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 236.045843][T11283] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 236.053284][ T61] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 236.059337][ T61] usb 7-1: Product: syz [ 236.069218][ T61] usb 7-1: Manufacturer: syz [ 236.070856][ T61] usb 7-1: SerialNumber: syz [ 236.091915][ T61] usb 7-1: config 0 descriptor?? [ 236.126475][T11283] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 236.207412][T11283] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 236.303286][T11283] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 236.307847][ T61] appledisplay: Apple Cinema Display connected [ 236.459632][ T5879] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 236.508472][ T5880] usb 7-1: USB disconnect, device number 33 [ 236.508556][ C1] usb 7-1: appledisplay_complete - usb_submit_urb failed with result -19 [ 236.508850][T11283] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 236.519446][T11283] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 236.520600][ T5880] appledisplay: Apple Cinema Display disconnected [ 236.523283][T11283] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 236.532513][T11283] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 236.535386][T11283] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 236.540842][T11283] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 236.543653][T11283] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 236.547648][T11283] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 236.596019][T11283] 8021q: adding VLAN 0 to HW filter on device bond0 [ 236.608604][T11283] 8021q: adding VLAN 0 to HW filter on device team0 [ 236.614060][ T631] bridge0: port 1(bridge_slave_0) entered blocking state [ 236.616524][ T631] bridge0: port 1(bridge_slave_0) entered forwarding state [ 236.626575][ T631] bridge0: port 2(bridge_slave_1) entered blocking state [ 236.628968][ T631] bridge0: port 2(bridge_slave_1) entered forwarding state [ 236.649653][ T5879] usb 5-1: Using ep0 maxpacket: 8 [ 236.657122][ T5879] usb 5-1: New USB device found, idVendor=058f, idProduct=9410, bcdDevice= 0.00 [ 236.662131][ T5879] usb 5-1: config index 0 descriptor too short (expected 51748, got 36) [ 236.668514][ T5879] usb 5-1: config 58 has too many interfaces: 138, using maximum allowed: 32 [ 236.672992][ T5879] usb 5-1: config 58 has an invalid descriptor of length 201, skipping remainder of the config [ 236.676552][ T5879] usb 5-1: config 58 has 0 interfaces, different from the descriptor's value: 138 [ 236.681017][ T5879] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 236.882396][T11283] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 236.915250][T11283] veth0_vlan: entered promiscuous mode [ 236.919295][ T5731] Bluetooth: hci4: command tx timeout [ 236.922864][T11283] veth1_vlan: entered promiscuous mode [ 236.941201][T11283] veth0_macvtap: entered promiscuous mode [ 236.947090][T11283] veth1_macvtap: entered promiscuous mode [ 236.957875][T11283] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 236.974783][T11283] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 237.014613][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 237.025555][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 237.040425][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 237.094446][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 237.099478][ T5879] usb 5-1: string descriptor 0 read error: -71 [ 237.103565][ T5879] usb 5-1: USB disconnect, device number 23 [ 237.105323][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 237.128991][T11341] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 237.132243][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 237.132258][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 237.133031][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 237.460473][ T61] usb 8-1: new high-speed USB device number 15 using dummy_hcd [ 237.619694][ T61] usb 8-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 237.622842][ T61] usb 8-1: no configurations [ 237.624443][ T61] usb 8-1: can't read configurations, error -22 [ 237.759280][ T61] usb 8-1: new high-speed USB device number 16 using dummy_hcd [ 237.869258][ T10] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 237.929544][ T61] usb 8-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 237.932700][ T61] usb 8-1: no configurations [ 237.934258][ T61] usb 8-1: can't read configurations, error -22 [ 237.937526][ T61] usb usb8-port1: attempt power cycle [ 238.019240][ T10] usb 6-1: Using ep0 maxpacket: 16 [ 238.025712][ T10] usb 6-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 238.033283][ T10] usb 6-1: config 0 has an invalid interface number: 255 but max is 0 [ 238.035992][ T10] usb 6-1: config 0 has no interface number 0 [ 238.046266][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 238.048878][ T10] usb 6-1: Product: syz [ 238.059238][ T10] usb 6-1: Manufacturer: syz [ 238.060807][ T10] usb 6-1: SerialNumber: syz [ 238.065804][ T10] usb 6-1: config 0 descriptor?? [ 238.072720][ T10] visor 6-1:0.255: Sony Clie 3.5 converter detected [ 238.299338][ T61] usb 8-1: new high-speed USB device number 17 using dummy_hcd [ 238.340269][ T61] usb 8-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 238.349446][ T61] usb 8-1: no configurations [ 238.353548][ T61] usb 8-1: can't read configurations, error -22 [ 238.486120][ T10] usb 6-1: Sony Clie 3.5 converter now attached to ttyUSB0 [ 238.492930][ T61] usb 8-1: new high-speed USB device number 18 using dummy_hcd [ 238.531068][ T61] usb 8-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 238.539315][ T61] usb 8-1: no configurations [ 238.540800][ T61] usb 8-1: can't read configurations, error -22 [ 238.543052][ T61] usb usb8-port1: unable to enumerate USB device [ 238.595823][T11358] netlink: 'syz.0.2090': attribute type 8 has an invalid length. [ 238.684752][ T50] usb 6-1: USB disconnect, device number 26 [ 238.703919][ T50] clie_3.5 ttyUSB0: Sony Clie 3.5 converter now disconnected from ttyUSB0 [ 238.714634][ T50] visor 6-1:0.255: device disconnected [ 238.793323][ T42] kauditd_printk_skb: 475 callbacks suppressed [ 238.793336][ T42] audit: type=1326 audit(1787233345.829:60034): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11359 comm="syz.0.2091" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7f55fec code=0x7ffc0000 [ 238.803095][ T42] audit: type=1326 audit(1787233345.839:60035): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11359 comm="syz.0.2091" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7f56017 code=0x7ffc0000 [ 238.818482][ T42] audit: type=1326 audit(1787233345.839:60036): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11359 comm="syz.0.2091" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f55fec code=0x7ffc0000 [ 238.830200][ T42] audit: type=1326 audit(1787233345.839:60037): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11359 comm="syz.0.2091" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f55fec code=0x7ffc0000 [ 238.849334][ T42] audit: type=1326 audit(1787233345.839:60038): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11359 comm="syz.0.2091" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f55fec code=0x7ffc0000 [ 238.858562][ T42] audit: type=1326 audit(1787233345.839:60039): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11359 comm="syz.0.2091" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f55fec code=0x7ffc0000 [ 238.871986][ T42] audit: type=1326 audit(1787233345.839:60040): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11359 comm="syz.0.2091" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f55fec code=0x7ffc0000 [ 238.889445][ T42] audit: type=1326 audit(1787233345.849:60041): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11359 comm="syz.0.2091" exe="/syz-executor" sig=0 arch=40000003 syscall=122 compat=1 ip=0xf7f55fec code=0x7ffc0000 [ 238.909211][ T42] audit: type=1326 audit(1787233345.849:60042): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11359 comm="syz.0.2091" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f55fec code=0x7ffc0000 [ 238.916630][ T42] audit: type=1326 audit(1787233345.849:60043): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11359 comm="syz.0.2091" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f55fec code=0x7ffc0000 [ 238.999754][ T5731] Bluetooth: hci4: command tx timeout [ 239.115607][T11363] netlink: 'syz.0.2093': attribute type 2 has an invalid length. [ 239.118391][T11363] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2093'. [ 239.298801][T11370] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 240.389345][ T3261] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 240.549213][ T3261] usb 6-1: Using ep0 maxpacket: 16 [ 240.551530][ T3261] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 240.555763][ T3261] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 240.559234][ T3261] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 240.562884][ T3261] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 240.566596][ T3261] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 240.574006][ T3261] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 240.577390][ T3261] usb 6-1: SerialNumber: syz [ 240.586537][ T3261] hub 6-1:1.0: bad descriptor, ignoring hub [ 240.588545][ T3261] hub 6-1:1.0: probe with driver hub failed with error -5 [ 240.595064][ T3261] cdc_ether 6-1:1.0: probe with driver cdc_ether failed with error -22 [ 240.610428][ T61] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 240.759254][ T61] usb 5-1: Using ep0 maxpacket: 32 [ 240.763208][ T61] usb 5-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 240.768082][ T61] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 240.772924][ T61] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 240.777822][ T61] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 240.782584][ T61] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 240.789476][ T61] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 240.793050][ T61] usb 5-1: Product: syz [ 240.795286][ T61] usb 5-1: Manufacturer: syz [ 240.797275][ T61] usb 5-1: SerialNumber: syz [ 240.807272][ T61] usb 5-1: config 0 descriptor?? [ 240.810764][T11425] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 240.818484][ T61] input: Generic X-Box pad as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/input/input8 [ 240.992887][T11396] raw-gadget.1 gadget.1: fail, usb_ep_set_wedge returned -11 [ 241.080342][ T5731] Bluetooth: hci4: command tx timeout [ 241.099502][ T3261] usb 6-1: USB disconnect, device number 27 [ 241.197933][ T5824] usb 5-1: USB disconnect, device number 24 [ 241.197941][ C0] xpad 5-1:0.0: xpad_irq_out - usb_submit_urb failed with result -19 [ 241.459982][T11445] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2127'. [ 242.992187][T11502] nbd0: detected capacity change from 0 to 127 [ 243.021813][T11503] block nbd0: NBD_DISCONNECT [ 243.061076][T11503] block nbd0: Disconnected due to user request. [ 243.075406][T11503] block nbd0: shutting down sockets [ 243.111047][ C0] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 243.114210][ C0] Buffer I/O error on dev nbd0, logical block 0, async page read [ 243.116627][ C0] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 3 prio class 2 [ 243.119628][ C0] Buffer I/O error on dev nbd0, logical block 1, async page read [ 243.122218][ C0] Buffer I/O error on dev nbd0, logical block 2, async page read [ 243.124665][ C0] Buffer I/O error on dev nbd0, logical block 3, async page read [ 243.127263][ T35] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 243.131313][ T35] Buffer I/O error on dev nbd0, logical block 0, async page read [ 243.134007][ T35] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 243.138374][ T35] Buffer I/O error on dev nbd0, logical block 1, async page read [ 243.141051][ T35] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 243.144036][ T35] Buffer I/O error on dev nbd0, logical block 2, async page read [ 243.146542][ T35] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 243.149559][ T35] Buffer I/O error on dev nbd0, logical block 3, async page read [ 243.152473][ T35] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 243.155423][ T35] Buffer I/O error on dev nbd0, logical block 0, async page read [ 243.157882][ T35] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 243.160883][ T35] Buffer I/O error on dev nbd0, logical block 1, async page read [ 243.161337][ T5731] Bluetooth: hci4: command tx timeout [ 243.163343][ T35] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 243.168116][ T35] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 243.171983][ T5745] ldm_validate_partition_table(): Disk read failed. [ 243.175107][ T5745] Dev nbd0: unable to read RDB block 0 [ 243.177640][ T5745] nbd0: unable to read partition table [ 243.197808][ T5745] ldm_validate_partition_table(): Disk read failed. [ 243.201533][ T5745] Dev nbd0: unable to read RDB block 0 [ 243.204900][ T5745] nbd0: unable to read partition table [ 243.387047][T11529] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2154'. [ 243.402249][T11529] 8021q: adding VLAN 0 to HW filter on device bond2 [ 243.429026][T11529] 8021q: adding VLAN 0 to HW filter on device bond0 [ 243.433877][T11532] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2160'. [ 243.434229][T11529] bond2: (slave bond0): Enslaving as an active interface with an up link [ 243.491741][T11536] loop5: detected capacity change from 0 to 4095 [ 244.613386][T11596] bridge0: port 3(netdevsim0) entered blocking state [ 244.615825][T11596] bridge0: port 3(netdevsim0) entered disabled state [ 244.618452][T11596] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 244.626560][T11596] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 244.629564][T11596] bridge0: port 3(netdevsim0) entered blocking state [ 244.631865][T11596] bridge0: port 3(netdevsim0) entered forwarding state [ 244.829255][ T1479] usb 8-1: new low-speed USB device number 19 using dummy_hcd [ 244.984538][ T1479] usb 8-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 244.990695][ T1479] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 244.993117][ T1479] usb 8-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 244.996640][ T1479] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 245.000786][ T1479] usb 8-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 245.004315][ T1479] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 245.007747][ T1479] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 245.011891][ T1479] usb 8-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 245.016084][ T1479] usb 8-1: config 168 interface 0 has no altsetting 0 [ 245.019029][ T1479] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 245.021632][ T1479] usb 8-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 245.025199][ T1479] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 245.028589][ T1479] usb 8-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 245.032567][ T1479] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 245.036365][ T1479] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 245.040059][ T1479] usb 8-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 245.044277][ T1479] usb 8-1: config 168 interface 0 has no altsetting 0 [ 245.048476][ T1479] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 245.051221][ T1479] usb 8-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 245.054613][ T1479] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 245.058067][ T1479] usb 8-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 245.061970][ T1479] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 245.065449][ T1479] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 245.068931][ T1479] usb 8-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 245.074211][ T1479] usb 8-1: config 168 interface 0 has no altsetting 0 [ 245.080160][ T1479] usb 8-1: string descriptor 0 read error: -22 [ 245.082114][ T1479] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 245.095056][ T1479] adutux 8-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 245.745124][T11635] gadgetfs: bound to dummy_udc driver [ 245.829798][ T1479] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 245.979823][ T1479] usb 6-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 245.985782][ T1479] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 245.988616][ T1479] usb 6-1: Product: syz [ 245.990669][ T1479] usb 6-1: Manufacturer: syz [ 245.992326][ T1479] usb 6-1: SerialNumber: syz [ 246.404575][ T1479] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 246.409544][ T1479] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 247.323990][ T50] usb 8-1: USB disconnect, device number 19 [ 247.622837][ T1479] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 247.827877][ T1479] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x00001004. ret = -EPROTO [ 247.832730][ T1479] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x0000011c. ret = -EPROTO [ 247.836606][ T1479] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 247.840466][ T1479] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 247.850819][ T1479] lan78xx 6-1:1.0: probe with driver lan78xx failed with error -71 [ 247.864382][ T1479] usb 6-1: USB disconnect, device number 28 [ 248.173410][ T42] kauditd_printk_skb: 1656 callbacks suppressed [ 248.173424][ T42] audit: type=1326 audit(1787233354.214:61700): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11689 comm="syz.0.2218" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f55fec code=0x7ffc0000 [ 248.184263][ T42] audit: type=1326 audit(1787233354.224:61701): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11689 comm="syz.0.2218" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f55fec code=0x7ffc0000 [ 248.191766][ T42] audit: type=1326 audit(1787233354.224:61702): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11689 comm="syz.0.2218" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f55fec code=0x7ffc0000 [ 248.198686][ T42] audit: type=1326 audit(1787233354.224:61703): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11689 comm="syz.0.2218" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f55fec code=0x7ffc0000 [ 248.205624][ T42] audit: type=1326 audit(1787233354.234:61704): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11689 comm="syz.0.2218" exe="/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf71574eb code=0x7ffc0000 [ 248.214734][ T42] audit: type=1326 audit(1787233354.234:61705): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11689 comm="syz.0.2218" exe="/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf71574eb code=0x7ffc0000 [ 248.222226][ T42] audit: type=1326 audit(1787233354.234:61706): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11689 comm="syz.0.2218" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f55fec code=0x7ffc0000 [ 248.228981][ T42] audit: type=1326 audit(1787233354.234:61707): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11689 comm="syz.0.2218" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f55fec code=0x7ffc0000 [ 248.236507][ T42] audit: type=1326 audit(1787233354.234:61708): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11689 comm="syz.0.2218" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f55fec code=0x7ffc0000 [ 248.243429][ T42] audit: type=1326 audit(1787233354.234:61709): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11689 comm="syz.0.2218" exe="/syz-executor" sig=0 arch=40000003 syscall=133 compat=1 ip=0xf7f55fec code=0x7ffc0000 [ 248.437770][T11696] VFS: Can't find a romfs filesystem on dev mtdblock0. [ 248.437770][T11696] [ 248.619282][ T3261] usb 6-1: new low-speed USB device number 29 using dummy_hcd [ 248.774549][ T3261] usb 6-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 248.779884][ T3261] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 248.782998][ T3261] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 248.787813][ T3261] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 248.793367][ T3261] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 248.798229][ T3261] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 248.803191][ T3261] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 248.807911][ T3261] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 248.813713][ T3261] usb 6-1: config 168 interface 0 has no altsetting 0 [ 248.818141][ T3261] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 248.821564][ T3261] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 248.826142][ T3261] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 248.830589][ T3261] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 248.835390][ T3261] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 248.844116][ T3261] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 248.848655][ T3261] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 248.854091][ T3261] usb 6-1: config 168 interface 0 has no altsetting 0 [ 248.857566][ T3261] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 248.860450][ T3261] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 248.864759][ T3261] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 248.868858][ T3261] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 248.873297][ T3261] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 248.877045][ T3261] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 248.881958][ T3261] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 248.886105][ T3261] usb 6-1: config 168 interface 0 has no altsetting 0 [ 248.891395][ T3261] usb 6-1: string descriptor 0 read error: -22 [ 248.894265][ T3261] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 248.906294][ T3261] adutux 6-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 250.049417][ T3261] usb 7-1: new full-speed USB device number 34 using dummy_hcd [ 250.203593][ T3261] usb 7-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 250.209365][ C2] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 250.212113][ T3261] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 250.215181][ T3261] usb 7-1: Product: syz [ 250.216594][ T3261] usb 7-1: Manufacturer: syz [ 250.218216][ T3261] usb 7-1: SerialNumber: syz [ 250.221858][ T3261] usb 7-1: config 0 descriptor?? [ 250.427698][ T3261] usb 7-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 251.160698][ T9] usb 6-1: USB disconnect, device number 29 [ 251.699551][T11763] jffs2: notice: (11763) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 251.721821][ T5824] usb 8-1: new high-speed USB device number 20 using dummy_hcd [ 251.839435][ T3261] dvb_usb_rtl28xxu 7-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 251.847123][ T3261] usb 7-1: USB disconnect, device number 34 [ 251.881744][ T5824] usb 8-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 251.887644][ T5824] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 251.895953][ T5824] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 251.899357][ T5824] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 251.903761][ T5824] usb 8-1: config 0 descriptor?? [ 252.317127][ T5824] cm6533_jd 0003:0D8C:0022.0009: unknown main item tag 0x0 [ 252.319590][ T5824] cm6533_jd 0003:0D8C:0022.0009: unknown main item tag 0x0 [ 252.324106][ T5824] input: HID 0d8c:0022 as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/0003:0D8C:0022.0009/input/input9 [ 252.354978][ T5824] cm6533_jd 0003:0D8C:0022.0009: input,hiddev0,hidraw1: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.3-1/input0 [ 252.520960][T11761] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 252.524309][T11761] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 252.540451][ T5824] usb 8-1: USB disconnect, device number 20 [ 252.649228][ T1479] usb 7-1: new low-speed USB device number 35 using dummy_hcd [ 252.800116][ T1479] usb 7-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 252.805392][ T1479] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 252.808737][ T1479] usb 7-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 252.813604][ T1479] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 252.818165][ T1479] usb 7-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 252.823247][ T1479] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 252.827914][ T1479] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 252.832735][ T1479] usb 7-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 252.838391][ T1479] usb 7-1: config 168 interface 0 has no altsetting 0 [ 252.842512][ T1479] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 252.845779][ T1479] usb 7-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 252.849457][ T1479] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 252.852962][ T1479] usb 7-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 252.856686][ T1479] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 252.861378][ T1479] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 252.865058][ T1479] usb 7-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 252.869548][ T1479] usb 7-1: config 168 interface 0 has no altsetting 0 [ 252.872775][ T1479] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 252.875326][ T1479] usb 7-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 252.879017][ T1479] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 252.883181][ T1479] usb 7-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 252.888472][ T1479] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 252.892459][ T1479] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 252.896583][ T1479] usb 7-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 252.901163][ T1479] usb 7-1: config 168 interface 0 has no altsetting 0 [ 252.905760][ T1479] usb 7-1: string descriptor 0 read error: -22 [ 252.907866][ T1479] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 252.918463][ T1479] adutux 7-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 253.079064][T11787] jffs2: notice: (11787) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 253.119353][ T61] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 253.130647][ T9] usb 7-1: USB disconnect, device number 35 [ 253.272030][ T61] usb 5-1: unable to get BOS descriptor or descriptor too short [ 253.274990][ T61] usb 5-1: New USB device found, idVendor=05ac, idProduct=0263, bcdDevice=9d.cd [ 253.278927][ T61] usb 5-1: config 3 has an invalid interface number: 151 but max is 0 [ 253.282390][ T61] usb 5-1: config 3 has no interface number 0 [ 253.287599][ T61] usb 5-1: config 3 interface 151 has no altsetting 0 [ 253.293980][ T61] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 253.297593][ T61] usb 5-1: Product: syz [ 253.298930][ T61] usb 5-1: Manufacturer: syz [ 253.304806][ T61] usb 5-1: SerialNumber: syz [ 253.518673][ T61] input: bcm5974 as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:3.151/input/input10 [ 253.525170][ T5128] bcm5974 5-1:3.151: could not read from device [ 253.529542][ T5128] bcm5974 5-1:3.151: could not read from device [ 253.531122][ T61] usb 5-1: USB disconnect, device number 25 [ 254.164282][T11812] netlink: 'syz.1.2266': attribute type 4 has an invalid length. [ 254.733885][T11826] VFS: Can't find a romfs filesystem on dev mtdblock0. [ 254.733885][T11826] [ 254.779277][ T1479] usb 5-1: new low-speed USB device number 26 using dummy_hcd [ 254.930158][ T1479] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 254.938761][ T1479] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 254.946568][ T1479] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 254.955765][ T1479] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 254.967130][ T1479] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 254.978528][ T1479] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 254.983124][ T1479] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 254.986859][ T1479] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 254.991619][ T1479] usb 5-1: config 168 interface 0 has no altsetting 0 [ 254.995029][ T1479] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 254.997756][ T1479] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 255.001879][ T1479] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 255.005688][ T1479] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 255.010000][ T1479] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 255.013770][ T1479] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 255.017481][ T1479] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 255.022395][ T1479] usb 5-1: config 168 interface 0 has no altsetting 0 [ 255.025872][ T1479] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 255.028830][ T1479] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 255.033094][ T1479] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 255.036742][ T1479] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 255.041060][ T1479] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 255.044920][ T1479] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 255.048784][ T1479] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 255.053918][ T1479] usb 5-1: config 168 interface 0 has no altsetting 0 [ 255.058788][ T1479] usb 5-1: string descriptor 0 read error: -22 [ 255.061287][ T1479] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 255.082906][ T1479] adutux 5-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 255.281046][ T1479] usb 5-1: USB disconnect, device number 26 [ 255.330797][ T1432] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.333016][ T1432] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.636566][T11852] ªªªªªª: renamed from vlan0 (while UP) [ 256.072933][T11867] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2284'. [ 256.076548][T11867] netlink: 277 bytes leftover after parsing attributes in process `syz.1.2284'. [ 256.081051][T11867] netlink: 277 bytes leftover after parsing attributes in process `syz.1.2284'. [ 256.201017][ T3261] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 256.359284][ T3261] usb 5-1: Using ep0 maxpacket: 32 [ 256.362055][ T3261] usb 5-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 256.367048][ T3261] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 256.373374][ T3261] usb 5-1: config 0 descriptor?? [ 256.377846][ T3261] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 256.518419][ T42] kauditd_printk_skb: 1689 callbacks suppressed [ 256.518440][ T42] audit: type=1326 audit(1787233362.554:63399): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11875 comm="syz.3.2285" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 256.528047][ T42] audit: type=1326 audit(1787233362.554:63400): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11875 comm="syz.3.2285" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 256.535232][ T42] audit: type=1326 audit(1787233362.554:63401): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11875 comm="syz.3.2285" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 256.542552][ T42] audit: type=1326 audit(1787233362.554:63402): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11875 comm="syz.3.2285" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7fa5017 code=0x7ffc0000 [ 256.549621][ T42] audit: type=1326 audit(1787233362.554:63403): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11875 comm="syz.3.2285" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 256.589274][ T42] audit: type=1326 audit(1787233362.554:63404): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11875 comm="syz.3.2285" exe="/syz-executor" sig=0 arch=40000003 syscall=122 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 256.596679][ T42] audit: type=1326 audit(1787233362.554:63405): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11875 comm="syz.3.2285" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 256.605757][ T42] audit: type=1326 audit(1787233362.554:63406): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11875 comm="syz.3.2285" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 256.614736][ T42] audit: type=1326 audit(1787233362.554:63407): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11875 comm="syz.3.2285" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 256.621810][ T42] audit: type=1326 audit(1787233362.564:63408): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11875 comm="syz.3.2285" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7fa5017 code=0x7ffc0000 [ 256.810582][T11887] netlink: 72 bytes leftover after parsing attributes in process `syz.2.2290'. [ 257.201553][ T3261] gspca_vc032x: reg_w err -71 [ 257.206242][ T3261] gspca_vc032x: I2c Bus Busy Wait 00 [ 257.211010][ T3261] gspca_vc032x: I2c Bus Busy Wait 00 [ 257.213173][ T3261] gspca_vc032x: I2c Bus Busy Wait 00 [ 257.217966][ T3261] gspca_vc032x: I2c Bus Busy Wait 00 [ 257.220498][ T3261] gspca_vc032x: I2c Bus Busy Wait 00 [ 257.222247][ T3261] gspca_vc032x: I2c Bus Busy Wait 00 [ 257.223950][ T3261] gspca_vc032x: I2c Bus Busy Wait 00 [ 257.228244][ T3261] gspca_vc032x: I2c Bus Busy Wait 00 [ 257.230220][ T3261] gspca_vc032x: I2c Bus Busy Wait 00 [ 257.234420][ T3261] gspca_vc032x: I2c Bus Busy Wait 00 [ 257.236333][ T3261] gspca_vc032x: I2c Bus Busy Wait 00 [ 257.238037][ T3261] gspca_vc032x: I2c Bus Busy Wait 00 [ 257.240409][ T3261] gspca_vc032x: I2c Bus Busy Wait 00 [ 257.242110][ T3261] gspca_vc032x: I2c Bus Busy Wait 00 [ 257.243857][ T3261] gspca_vc032x: I2c Bus Busy Wait 00 [ 257.245511][ T3261] gspca_vc032x: I2c Bus Busy Wait 00 [ 257.247440][ T3261] gspca_vc032x: I2c Bus Busy Wait 00 [ 257.249652][ T3261] gspca_vc032x: I2c Bus Busy Wait 00 [ 257.251364][ T3261] gspca_vc032x: Unknown sensor... [ 257.253034][ T3261] vc032x 5-1:0.0: probe with driver vc032x failed with error -22 [ 257.256277][ T3261] usb 5-1: USB disconnect, device number 27 [ 257.303276][T11898] jffs2: notice: (11898) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 258.009319][ T61] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 258.179187][ T61] usb 5-1: Using ep0 maxpacket: 16 [ 258.181428][ T61] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 258.185317][ T61] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 258.188812][ T61] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 258.193709][ T61] usb 5-1: config 0 descriptor?? [ 258.611853][ T61] mcp2221 0003:04D8:00DD.000A: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.0-1/input0 [ 258.676633][ T64] Bluetooth: hci4: Ignoring HCI_Connection_Complete for existing connection [ 258.804911][ C1] usb 5-1: input irq status -75 received [ 259.010091][ T61] usb 5-1: USB disconnect, device number 28 [ 259.487426][T11950] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2314'. [ 260.093638][T11971] program syz.0.2321 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 260.236093][T11975] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2323'. [ 260.549753][ T5880] usb 5-1: new full-speed USB device number 29 using dummy_hcd [ 260.700625][ T5880] usb 5-1: not running at top speed; connect to a high speed hub [ 260.704206][ T5880] usb 5-1: New USB device found, idVendor=16c0, idProduct=05df, bcdDevice=a2.76 [ 260.709373][ T5880] usb 5-1: config 5 has an invalid interface number: 32 but max is 0 [ 260.712005][ T5880] usb 5-1: config 5 has no interface number 0 [ 260.713977][ T5880] usb 5-1: config 5 interface 32 has no altsetting 0 [ 260.718723][ T5880] usb 5-1: string descriptor 0 read error: -22 [ 260.720791][ T5880] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 260.933723][ T5880] usb 5-1: USB disconnect, device number 29 [ 261.419232][ T5880] usb 7-1: new high-speed USB device number 36 using dummy_hcd [ 261.519383][T11997] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2332'. [ 261.601056][ T5880] usb 7-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 261.605034][ T5880] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 261.608567][ T5880] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 261.614553][ T5880] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 261.619991][ T5880] usb 7-1: config 0 descriptor?? [ 261.719286][ T1479] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 261.870878][ T1479] usb 5-1: unable to get BOS descriptor or descriptor too short [ 261.873477][ T1479] usb 5-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 261.877123][ T1479] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7 [ 261.882130][ T1479] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 261.884665][ T1479] usb 5-1: Product: syz [ 261.885988][ T1479] usb 5-1: Manufacturer: syz [ 261.887493][ T1479] usb 5-1: SerialNumber: syz [ 262.031944][ T5880] cm6533_jd 0003:0D8C:0022.000B: unknown main item tag 0x0 [ 262.034381][ T5880] cm6533_jd 0003:0D8C:0022.000B: unknown main item tag 0x0 [ 262.039308][ T5880] input: HID 0d8c:0022 as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/0003:0D8C:0022.000B/input/input11 [ 262.061214][ T5880] cm6533_jd 0003:0D8C:0022.000B: input,hiddev0,hidraw1: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.2-1/input0 [ 262.102021][ T1479] usb 5-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 262.236170][ T50] usb 7-1: USB disconnect, device number 36 [ 262.305051][ T1479] usb 5-1: 2:1 : unknown format tag 0x4 is detected. processed as MPEG. [ 262.307806][ T1479] usb 5-1: found format II with max.bitrate = 4, frame size=7372 [ 262.410386][T12018] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2341'. [ 262.445212][ T42] kauditd_printk_skb: 1009 callbacks suppressed [ 262.445251][ T42] audit: type=1326 audit(1787233368.484:64418): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12019 comm="syz.3.2342" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 262.456220][ T42] audit: type=1326 audit(1787233368.484:64419): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12019 comm="syz.3.2342" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 262.463233][ T42] audit: type=1326 audit(1787233368.494:64420): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12019 comm="syz.3.2342" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 262.470149][ T42] audit: type=1326 audit(1787233368.494:64421): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12019 comm="syz.3.2342" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 262.477398][ T42] audit: type=1326 audit(1787233368.494:64422): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12019 comm="syz.3.2342" exe="/syz-executor" sig=0 arch=40000003 syscall=331 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 262.484251][ T42] audit: type=1326 audit(1787233368.494:64423): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12019 comm="syz.3.2342" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 262.491264][ T42] audit: type=1326 audit(1787233368.494:64424): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12019 comm="syz.3.2342" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 262.498057][ T42] audit: type=1326 audit(1787233368.494:64425): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12019 comm="syz.3.2342" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 262.501907][ T64] Bluetooth: hci4: Ignoring HCI_Connection_Complete for existing connection [ 262.507249][ T42] audit: type=1326 audit(1787233368.494:64426): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12019 comm="syz.3.2342" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 262.514902][ T42] audit: type=1326 audit(1787233368.494:64427): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12019 comm="syz.3.2342" exe="/syz-executor" sig=0 arch=40000003 syscall=432 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 262.714571][ T1479] usb 5-1: parse_audio_format_rates_v2v3(): unable to retrieve sample rate range (clock 0) [ 262.755297][ T1479] usb 5-1: USB disconnect, device number 30 [ 262.805550][ T5745] udevd[5745]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 262.832631][T12040] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2347'. [ 262.849814][ T64] Bluetooth: hci4: command 0x0406 tx timeout [ 263.110947][T12045] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2348'. [ 263.760564][ T9] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 263.929302][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 263.933384][ T9] usb 5-1: New USB device found, idVendor=05ac, idProduct=0244, bcdDevice= 0.00 [ 263.939250][ T9] usb 5-1: too many configurations: 123, using maximum allowed: 8 [ 263.942998][ T9] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 263.950241][ T9] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 263.957464][ T9] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 263.962098][ T9] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 263.969271][ T9] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 263.976333][ T9] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 263.983508][ T9] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 263.988070][ T9] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 263.995451][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=45 [ 264.000687][ T9] usb 5-1: SerialNumber: syz [ 264.003773][ T9] usb 5-1: config 0 descriptor?? [ 264.010326][ T9] input: bcm5974 as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/input/input12 [ 264.214186][ T5128] bcm5974 5-1:0.0: could not read from device [ 264.221271][ T5128] bcm5974 5-1:0.0: could not read from device [ 264.222532][ T9] usb 5-1: USB disconnect, device number 31 [ 264.226995][ T5128] bcm5974 5-1:0.0: could not read from device [ 264.545339][ T5731] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 264.624651][T12079] netlink: 'syz.1.2363': attribute type 3 has an invalid length. [ 264.628416][T12079] netlink: 'syz.1.2363': attribute type 3 has an invalid length. [ 264.670791][T12080] VFS: Can't find a romfs filesystem on dev mtdblock0. [ 264.670791][T12080] [ 264.778096][T12091] netlink: 'syz.1.2367': attribute type 49 has an invalid length. [ 264.785548][T12091] bond0: (slave bond_slave_0): Releasing backup interface [ 264.855342][T12091] bond_slave_0: entered promiscuous mode [ 264.857336][T12091] bond_slave_0: entered allmulticast mode [ 264.885714][T12095] jffs2: notice: (12095) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 265.120288][ T1479] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 265.269213][ T1479] usb 6-1: Using ep0 maxpacket: 8 [ 265.271647][ T1479] usb 6-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 265.275526][ T1479] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 265.498872][ T1479] usb 6-1: string descriptor 0 read error: -71 [ 265.504521][ T1479] pvrusb2: Hardware description: Terratec Grabster AV400 [ 265.507085][ T1479] pvrusb2: ********** [ 265.510478][ T1479] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 265.516786][ T1479] pvrusb2: Important functionality might not be entirely working. [ 265.519701][ T1479] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 265.525685][ T1479] pvrusb2: ********** [ 265.531749][ T2507] pvrusb2: Invalid write control endpoint [ 265.535322][ T1479] usb 6-1: USB disconnect, device number 30 [ 265.698192][ T2507] pvrusb2: Invalid write control endpoint [ 265.700629][ T2507] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 265.706625][ T2507] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 265.709587][ T2507] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 265.712773][ T2507] pvrusb2: Device being rendered inoperable [ 265.716490][T12116] netlink: 96 bytes leftover after parsing attributes in process `syz.3.2373'. [ 265.719189][ T2507] cx25840 2-0044: Unable to detect h/w, assuming cx23887 [ 265.722137][ T2507] cx25840 2-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 265.722605][T12116] netlink: 96 bytes leftover after parsing attributes in process `syz.3.2373'. [ 265.737108][ T2507] pvrusb2: Attached sub-driver cx25840 [ 265.741627][ T2507] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 265.746566][ T2507] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 266.106192][T12132] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2380'. [ 266.199853][ T1479] usb 7-1: new high-speed USB device number 37 using dummy_hcd [ 266.349717][ T1479] usb 7-1: New USB device found, idVendor=1199, idProduct=b000, bcdDevice= 0.00 [ 266.353649][ T1479] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 266.356980][ T1479] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 266.369292][ T3261] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 266.539911][ T3261] usb 6-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 266.545440][ T3261] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 266.548037][ T3261] usb 6-1: Product: syz [ 266.549671][ T3261] usb 6-1: Manufacturer: syz [ 266.551208][ T3261] usb 6-1: SerialNumber: syz [ 266.564885][ T5824] usb 7-1: USB disconnect, device number 37 [ 266.870199][T12144] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2385'. [ 267.002101][ T3261] rtl8150 6-1:1.0: couldn't reset the device [ 267.004263][ T3261] rtl8150 6-1:1.0: probe with driver rtl8150 failed with error -5 [ 267.011504][ T3261] usb 6-1: USB disconnect, device number 31 [ 267.469207][ T5837] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 267.619187][ T5837] usb 5-1: Using ep0 maxpacket: 16 [ 267.621645][ T5837] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 267.625811][ T5837] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 267.629244][ T5837] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 267.633001][ T5837] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 267.636482][ T5837] usb 5-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 267.641938][ T5837] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 267.644662][ T5837] usb 5-1: SerialNumber: syz [ 267.660045][ T64] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 267.660624][ T5837] hub 5-1:1.0: bad descriptor, ignoring hub [ 267.670671][ T5837] hub 5-1:1.0: probe with driver hub failed with error -5 [ 267.674630][ T5837] cdc_ether 5-1:1.0: probe with driver cdc_ether failed with error -22 [ 267.890397][T12182] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2401'. [ 268.062478][T12154] raw-gadget.0 gadget.0: fail, usb_ep_set_wedge returned -11 [ 268.169520][ T1479] usb 5-1: USB disconnect, device number 32 [ 268.655672][T12203] /dev/sg0: Can't lookup blockdev [ 268.732103][ T42] kauditd_printk_skb: 442 callbacks suppressed [ 268.732119][ T42] audit: type=1326 audit(1787233374.774:64870): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12205 comm="syz.2.2409" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf706efec code=0x7ffc0000 [ 268.742100][ T42] audit: type=1326 audit(1787233374.784:64871): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12205 comm="syz.2.2409" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf706f017 code=0x7ffc0000 [ 268.749530][ T42] audit: type=1326 audit(1787233374.784:64872): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12205 comm="syz.2.2409" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 268.770409][ T42] audit: type=1326 audit(1787233374.784:64873): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12205 comm="syz.2.2409" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 268.777597][ T42] audit: type=1326 audit(1787233374.794:64874): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12205 comm="syz.2.2409" exe="/syz-executor" sig=0 arch=40000003 syscall=122 compat=1 ip=0xf706efec code=0x7ffc0000 [ 268.786453][ T42] audit: type=1326 audit(1787233374.794:64875): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12205 comm="syz.2.2409" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 268.793909][ T42] audit: type=1326 audit(1787233374.794:64876): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12205 comm="syz.2.2409" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 268.796897][T12212] tmpfs: Unknown parameter 'smackfshat' [ 268.802879][ T42] audit: type=1326 audit(1787233374.794:64877): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12205 comm="syz.2.2409" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf706efec code=0x7ffc0000 [ 268.811298][ T42] audit: type=1326 audit(1787233374.814:64878): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12205 comm="syz.2.2409" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 268.818900][ T42] audit: type=1326 audit(1787233374.814:64879): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12205 comm="syz.2.2409" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 268.822261][T12213] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2412'. [ 268.994142][T12224] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2418'. [ 269.111168][T12233] jffs2: notice: (12233) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 269.130356][ T5731] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 270.221587][T12265] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2432'. [ 272.418035][T12310] VFS: Can't find a romfs filesystem on dev mtdblock0. [ 272.418035][T12310] [ 273.149255][T12330] wg2 speed is unknown, defaulting to 1000 [ 273.165968][T12330] wg2 speed is unknown, defaulting to 1000 [ 273.174943][T12330] wg2 speed is unknown, defaulting to 1000 [ 273.185685][T12330] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 273.190874][T12330] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 273.197384][T12330] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 273.213992][T12330] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 273.224102][T12330] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 273.299241][T12330] wg2 speed is unknown, defaulting to 1000 [ 273.306411][T12330] wg2 speed is unknown, defaulting to 1000 [ 273.314852][T12330] wg2 speed is unknown, defaulting to 1000 [ 273.328472][T12330] wg2 speed is unknown, defaulting to 1000 [ 273.342557][T12330] wg2 speed is unknown, defaulting to 1000 [ 274.333643][T12350] jffs2: notice: (12350) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 275.311177][T12374] VFS: Can't find a romfs filesystem on dev mtdblock0. [ 275.311177][T12374] [ 276.130723][T12385] siw: device registration error -23 [ 276.255940][T12391] overlayfs: failed to resolve './bus': -2 [ 276.583813][T12398] futex_wake_op: syz.1.2475 tries to shift op by -1; fix this program [ 276.718947][T12405] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2475'. [ 277.021808][T12413] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2478'. [ 277.310898][T12423] jffs2: notice: (12423) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 277.378016][T12431] MTD: Couldn't look up './dev/mtdblock0': -2 [ 277.556845][T12447] jffs2: notice: (12447) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 278.059234][ T5837] usb 5-1: new low-speed USB device number 33 using dummy_hcd [ 278.199426][ T5837] usb 5-1: device descriptor read/64, error -71 [ 278.449193][ T5837] usb 5-1: new low-speed USB device number 34 using dummy_hcd [ 278.499247][ T3261] usb 7-1: new high-speed USB device number 38 using dummy_hcd [ 278.579234][ T5837] usb 5-1: device descriptor read/64, error -71 [ 278.614685][T12480] jffs2: notice: (12480) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 278.659685][ T3261] usb 7-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 278.664218][ T3261] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 278.668579][ T3261] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 278.672863][ T3261] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 278.679433][ T3261] usb 7-1: config 0 descriptor?? [ 278.689713][ T5837] usb usb5-port1: attempt power cycle [ 278.815163][T12490] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2509'. [ 278.913801][T12494] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2511'. [ 278.968993][T12496] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2512'. [ 279.029404][ T5837] usb 5-1: new low-speed USB device number 35 using dummy_hcd [ 279.049891][ T5837] usb 5-1: device descriptor read/8, error -71 [ 279.052853][ T5731] Bluetooth: hci4: ACL packet for unknown connection handle 201 [ 279.093570][ T3261] cm6533_jd 0003:0D8C:0022.000C: unknown main item tag 0x0 [ 279.096118][ T3261] cm6533_jd 0003:0D8C:0022.000C: unknown main item tag 0x0 [ 279.105007][ T3261] input: HID 0d8c:0022 as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/0003:0D8C:0022.000C/input/input13 [ 279.135711][ T3261] cm6533_jd 0003:0D8C:0022.000C: input,hiddev0,hidraw1: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.2-1/input0 [ 279.294336][T12473] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 279.297465][T12473] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 279.306761][ T9] usb 7-1: USB disconnect, device number 38 [ 279.309935][ T5837] usb 5-1: new low-speed USB device number 36 using dummy_hcd [ 279.331154][ T5837] usb 5-1: device descriptor read/8, error -71 [ 279.376582][T12513] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2520'. [ 279.439560][ T5837] usb usb5-port1: unable to enumerate USB device [ 279.495473][T12518] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2522'. [ 279.791456][T12528] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2527'. [ 279.886544][ T64] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 279.899834][ T64] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 279.905256][ T64] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 279.909374][ T64] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 279.912787][ T64] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 280.019730][T12543] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2530'. [ 280.047379][T12543] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2530'. [ 280.140628][T12533] wg2 speed is unknown, defaulting to 1000 [ 280.279888][T12533] bridge0: port 1(bridge_slave_0) entered blocking state [ 280.282332][T12533] bridge0: port 1(bridge_slave_0) entered disabled state [ 280.284712][T12533] bridge_slave_0: entered allmulticast mode [ 280.288479][T12533] bridge_slave_0: entered promiscuous mode [ 280.293413][T12533] bridge0: port 2(bridge_slave_1) entered blocking state [ 280.295970][T12533] bridge0: port 2(bridge_slave_1) entered disabled state [ 280.298303][T12533] bridge_slave_1: entered allmulticast mode [ 280.302265][T12533] bridge_slave_1: entered promiscuous mode [ 280.317795][T12533] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 280.322463][T12533] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 280.338372][T12533] team0: Port device team_slave_0 added [ 280.341790][T12533] team0: Port device team_slave_1 added [ 280.355310][T12533] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 280.357495][T12533] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 280.365829][T12533] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 280.370234][T12533] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 280.372431][T12533] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 280.380404][T12533] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 280.403024][T12533] hsr_slave_0: entered promiscuous mode [ 280.405312][T12533] hsr_slave_1: entered promiscuous mode [ 280.407390][T12533] debugfs: 'hsr0' already exists in 'hsr' [ 280.409595][T12533] Cannot create hsr debugfs directory [ 280.504986][T12533] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 280.581843][T12533] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 280.678717][T12533] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 280.754461][T12533] bridge0: port 3(netdevsim0) entered disabled state [ 280.771210][T12533] netdevsim netdevsim1 netdevsim0 (unregistering): left allmulticast mode [ 280.775142][T12533] netdevsim netdevsim1 netdevsim0 (unregistering): left promiscuous mode [ 280.783266][T12533] bridge0: port 3(netdevsim0) entered disabled state [ 280.792818][T12533] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 280.865921][ T42] kauditd_printk_skb: 1086 callbacks suppressed [ 280.865934][ T42] audit: type=1326 audit(1787233386.904:65966): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12558 comm="syz.0.2532" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f55fec code=0x7ffc0000 [ 280.884721][ T42] audit: type=1326 audit(1787233386.914:65967): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12558 comm="syz.0.2532" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7f55fec code=0x7ffc0000 [ 280.894764][ T42] audit: type=1326 audit(1787233386.914:65968): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12558 comm="syz.0.2532" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7f56017 code=0x7ffc0000 [ 280.903626][ T42] audit: type=1326 audit(1787233386.914:65969): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12558 comm="syz.0.2532" exe="/syz-executor" sig=0 arch=40000003 syscall=122 compat=1 ip=0xf7f55fec code=0x7ffc0000 [ 280.912310][ T42] audit: type=1326 audit(1787233386.914:65970): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12558 comm="syz.0.2532" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7f55fec code=0x7ffc0000 [ 280.920369][ T42] audit: type=1326 audit(1787233386.914:65971): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12558 comm="syz.0.2532" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7f56017 code=0x7ffc0000 [ 280.928316][ T42] audit: type=1326 audit(1787233386.914:65972): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12558 comm="syz.0.2532" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f55fec code=0x7ffc0000 [ 280.931118][T12533] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 280.936807][ T42] audit: type=1326 audit(1787233386.914:65973): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12558 comm="syz.0.2532" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7f55fec code=0x7ffc0000 [ 280.946491][ T42] audit: type=1326 audit(1787233386.914:65974): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12558 comm="syz.0.2532" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7f56017 code=0x7ffc0000 [ 280.949485][T12533] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 280.954734][ T42] audit: type=1326 audit(1787233386.914:65975): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12558 comm="syz.0.2532" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7f55fec code=0x7ffc0000 [ 280.969027][T12533] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 280.978807][T12533] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 280.983062][T12533] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 280.990645][T12533] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 280.994520][T12533] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 281.010155][T12533] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 281.031389][T12533] bridge0: port 2(bridge_slave_1) entered blocking state [ 281.034576][T12533] bridge0: port 2(bridge_slave_1) entered forwarding state [ 281.037540][T12533] bridge0: port 1(bridge_slave_0) entered blocking state [ 281.041301][T12533] bridge0: port 1(bridge_slave_0) entered forwarding state [ 281.073222][T12533] 8021q: adding VLAN 0 to HW filter on device bond0 [ 281.082788][ T36] bridge0: port 1(bridge_slave_0) entered disabled state [ 281.087218][ T36] bridge0: port 2(bridge_slave_1) entered disabled state [ 281.111309][T12533] 8021q: adding VLAN 0 to HW filter on device team0 [ 281.117211][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 281.120056][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 281.128985][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 281.131880][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 281.311735][T12581] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 281.405439][T12533] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 281.434530][T12533] veth0_vlan: entered promiscuous mode [ 281.439751][T12533] veth1_vlan: entered promiscuous mode [ 281.454598][T12533] veth0_macvtap: entered promiscuous mode [ 281.458542][T12533] veth1_macvtap: entered promiscuous mode [ 281.466752][T12533] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 281.474503][T12533] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 281.550311][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 281.553183][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 281.556441][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 281.559536][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 281.594107][ T108] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 281.596642][ T108] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 281.614728][ T108] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 281.617797][ T108] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 281.927255][ T64] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 281.937113][ T64] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 281.939225][ T5807] usb 6-1: new low-speed USB device number 32 using dummy_hcd [ 281.943230][ T64] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 281.947183][ T64] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 281.950599][ T64] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 281.959888][ T64] Bluetooth: hci3: command tx timeout [ 282.018523][T12602] __nla_validate_parse: 1 callbacks suppressed [ 282.018536][T12602] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2541'. [ 282.069470][ T5807] usb 6-1: device descriptor read/64, error -71 [ 282.088004][T12609] dummy_hcd dummy_hcd.0: remove, state 4 [ 282.093541][T12609] usb usb5: USB disconnect, device number 1 [ 282.135591][T12609] dummy_hcd dummy_hcd.0: stopped [ 282.137783][T12609] dummy_hcd dummy_hcd.0: USB bus 5 deregistered [ 282.200806][T12597] wg2 speed is unknown, defaulting to 1000 [ 282.254816][ T13] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 282.321398][ T5807] usb 6-1: new low-speed USB device number 33 using dummy_hcd [ 282.363573][ T13] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 282.459238][ T5807] usb 6-1: device descriptor read/64, error -71 [ 282.465891][ T13] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 282.478585][T12597] bridge0: port 1(bridge_slave_0) entered blocking state [ 282.481468][T12597] bridge0: port 1(bridge_slave_0) entered disabled state [ 282.483939][T12597] bridge_slave_0: entered allmulticast mode [ 282.487879][T12597] bridge_slave_0: entered promiscuous mode [ 282.493388][T12597] bridge0: port 2(bridge_slave_1) entered blocking state [ 282.495940][T12597] bridge0: port 2(bridge_slave_1) entered disabled state [ 282.498306][T12597] bridge_slave_1: entered allmulticast mode [ 282.501050][T12597] bridge_slave_1: entered promiscuous mode [ 282.516356][T12597] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 282.521506][T12597] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 282.538957][T12597] team0: Port device team_slave_0 added [ 282.542583][T12597] team0: Port device team_slave_1 added [ 282.570882][ T5807] usb usb6-port1: attempt power cycle [ 282.586227][ T13] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 282.612098][T12597] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 282.618279][T12597] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 282.629275][T12597] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 282.634675][T12597] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 282.637054][T12597] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 282.646080][T12597] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 282.673716][T12597] hsr_slave_0: entered promiscuous mode [ 282.676282][T12597] hsr_slave_1: entered promiscuous mode [ 282.678763][T12597] debugfs: 'hsr0' already exists in 'hsr' [ 282.680813][T12597] Cannot create hsr debugfs directory [ 282.838835][ T13] bridge_slave_1: left allmulticast mode [ 282.841785][ T13] bridge_slave_1: left promiscuous mode [ 282.847470][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 282.855386][ T13] bridge_slave_0: left allmulticast mode [ 282.857310][ T13] bridge_slave_0: left promiscuous mode [ 282.860800][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 282.929880][ T5807] usb 6-1: new low-speed USB device number 34 using dummy_hcd [ 282.960030][ T5807] usb 6-1: device descriptor read/8, error -71 [ 283.038742][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 283.048414][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 283.052781][ T13] bond0 (unregistering): Released all slaves [ 283.059027][ T13] bond1 (unregistering): Released all slaves [ 283.066698][ T13] bond2 (unregistering): Released all slaves [ 283.222060][ T5807] usb 6-1: new low-speed USB device number 35 using dummy_hcd [ 283.253237][ T5807] usb 6-1: device descriptor read/8, error -71 [ 283.369486][ T5807] usb usb6-port1: unable to enumerate USB device [ 283.438853][ T5445] 8021q: adding VLAN 0 to HW filter on device eth2 [ 283.646488][T12665] jffs2: notice: (12665) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 283.781632][ T13] hsr_slave_0: left promiscuous mode [ 283.789345][ T13] hsr_slave_1: left promiscuous mode [ 283.801462][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 283.803899][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 283.813303][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 283.819319][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 283.846700][ T13] veth1_macvtap: left promiscuous mode [ 283.860331][ T13] veth0_macvtap: left promiscuous mode [ 283.862331][ T13] veth1_vlan: left promiscuous mode [ 283.864180][ T13] veth0_vlan: left promiscuous mode [ 283.960126][ T5731] Bluetooth: hci1: command tx timeout [ 284.039430][ T5731] Bluetooth: hci3: command tx timeout [ 284.120215][ T13] team0 (unregistering): Port device team_slave_1 removed [ 284.142523][ T13] team0 (unregistering): Port device team_slave_0 removed [ 284.443071][T12597] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 284.476226][T12597] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 284.479315][T12597] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 284.486018][T12597] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 284.489785][T12597] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 284.515157][T12597] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 284.518259][T12597] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 284.539363][T12597] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 284.660595][T12597] 8021q: adding VLAN 0 to HW filter on device bond0 [ 284.681050][T12597] 8021q: adding VLAN 0 to HW filter on device team0 [ 284.691632][ T108] bridge0: port 1(bridge_slave_0) entered blocking state [ 284.694594][ T108] bridge0: port 1(bridge_slave_0) entered forwarding state [ 284.715054][ T108] bridge0: port 2(bridge_slave_1) entered blocking state [ 284.717529][ T108] bridge0: port 2(bridge_slave_1) entered forwarding state [ 284.930129][ T5731] Bluetooth: hci4: command 0x0406 tx timeout [ 285.141757][T12597] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 285.183529][T12597] veth0_vlan: entered promiscuous mode [ 285.190351][T12597] veth1_vlan: entered promiscuous mode [ 285.211481][T12597] veth0_macvtap: entered promiscuous mode [ 285.216296][T12597] veth1_macvtap: entered promiscuous mode [ 285.227357][T12597] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 285.238330][T12597] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 285.320662][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 285.324133][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 285.342049][ T37] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 285.344681][ T37] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 285.359267][ T5808] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 285.368530][ T5808] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 285.373547][ T5808] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 285.380550][ T5808] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 285.412380][T12725] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2540'. [ 285.482107][T12729] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2571'. [ 285.776114][T12740] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2577'. [ 286.041839][ T5731] Bluetooth: hci1: command tx timeout [ 286.089252][ T3261] usb 7-1: new high-speed USB device number 39 using dummy_hcd [ 286.119460][ T5731] Bluetooth: hci3: command tx timeout [ 286.450426][ T3261] usb 7-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 286.454417][ T3261] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 286.457719][ T3261] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 286.462127][ T3261] usb 7-1: config 0 descriptor?? [ 286.465531][ T3261] pwc: Askey VC010 type 2 USB webcam detected. [ 286.875184][ T3261] pwc: recv_control_msg error -71 req 02 val 2b00 [ 286.879773][ T3261] pwc: recv_control_msg error -71 req 02 val 2700 [ 286.882222][ T3261] pwc: recv_control_msg error -71 req 02 val 2c00 [ 286.884476][ T3261] pwc: recv_control_msg error -71 req 04 val 1000 [ 286.886697][ T3261] pwc: recv_control_msg error -71 req 04 val 1300 [ 286.889409][ T3261] pwc: recv_control_msg error -71 req 04 val 1400 [ 286.892492][ T3261] pwc: recv_control_msg error -71 req 02 val 2000 [ 286.895555][ T3261] pwc: recv_control_msg error -71 req 02 val 2100 [ 286.898284][ T3261] pwc: recv_control_msg error -71 req 04 val 1500 [ 286.901474][ T3261] pwc: recv_control_msg error -71 req 02 val 2500 [ 286.904703][ T3261] pwc: recv_control_msg error -71 req 02 val 2400 [ 286.907797][ T3261] pwc: recv_control_msg error -71 req 02 val 2600 [ 286.911176][ T3261] pwc: recv_control_msg error -71 req 02 val 2900 [ 286.914509][ T3261] pwc: recv_control_msg error -71 req 02 val 2800 [ 286.917805][ T3261] pwc: recv_control_msg error -71 req 04 val 1100 [ 286.921588][ T3261] pwc: recv_control_msg error -71 req 04 val 1200 [ 286.936847][ T3261] pwc: Registered as video103. [ 286.944250][ T3261] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb7/7-1/input/input14 [ 286.961165][ T3261] usb 7-1: USB disconnect, device number 39 [ 287.453292][T12769] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2587'. [ 287.463055][T12769] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2587'. [ 287.485633][ T42] kauditd_printk_skb: 2725 callbacks suppressed [ 287.485655][ T42] audit: type=1326 audit(1787233392.525:68701): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12770 comm="syz.2.2588" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 287.507804][ T42] audit: type=1326 audit(1787233392.525:68702): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12770 comm="syz.2.2588" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 287.520504][ T42] audit: type=1326 audit(1787233392.525:68703): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12770 comm="syz.2.2588" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf6fef017 code=0x7ffc0000 [ 287.529411][ T42] audit: type=1326 audit(1787233392.525:68704): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12770 comm="syz.2.2588" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 287.537138][ T42] audit: type=1326 audit(1787233392.525:68705): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12770 comm="syz.2.2588" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf6fef017 code=0x7ffc0000 [ 287.546200][ T42] audit: type=1326 audit(1787233392.525:68706): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12770 comm="syz.2.2588" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 287.555225][ T42] audit: type=1326 audit(1787233392.525:68707): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12770 comm="syz.2.2588" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf6fef017 code=0x7ffc0000 [ 287.564198][ T42] audit: type=1326 audit(1787233392.525:68708): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12770 comm="syz.2.2588" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 287.576965][ T42] audit: type=1326 audit(1787233392.525:68709): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12770 comm="syz.2.2588" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf6fef017 code=0x7ffc0000 [ 287.583873][ T42] audit: type=1326 audit(1787233392.525:68710): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12770 comm="syz.2.2588" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 287.682074][ T5731] Bluetooth: hci4: SCO packet for unknown connection handle 0 [ 288.119226][ T5731] Bluetooth: hci1: command 0x040f tx timeout [ 288.199326][ T64] Bluetooth: hci3: command tx timeout [ 288.829958][T12811] netlink: 3 bytes leftover after parsing attributes in process `syz.3.2605'. [ 289.719336][ T64] Bluetooth: hci4: command 0x2016 tx timeout [ 289.903268][ T64] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 289.912593][ T64] CPU: 2 UID: 0 PID: 64 Comm: kworker/u34:0 Tainted: G L syzkaller #0 PREEMPT(full) [ 289.912631][ T64] Tainted: [L]=SOFTLOCKUP [ 289.912639][ T64] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 289.912654][ T64] Workqueue: hci3 hci_rx_work [ 289.912696][ T64] Call Trace: [ 289.912704][ T64] [ 289.912714][ T64] dump_stack_lvl+0x100/0x190 [ 289.912744][ T64] sysfs_warn_dup.cold+0x1c/0x28 [ 289.912778][ T64] sysfs_create_dir_ns+0x24b/0x2b0 [ 289.912817][ T64] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 289.912844][ T64] ? find_held_lock+0x2b/0x80 [ 289.912877][ T64] ? kobject_add_internal+0x25f/0x930 [ 289.912905][ T64] ? kobject_add_internal+0x25f/0x930 [ 289.912948][ T64] ? do_raw_spin_unlock+0x145/0x1e0 [ 289.912976][ T64] kobject_add_internal+0x2c8/0x930 [ 289.913004][ T64] kobject_add+0x16a/0x1e0 [ 289.913030][ T64] ? __pfx_kobject_add+0x10/0x10 [ 289.913053][ T64] ? class_to_subsys+0x10f/0x150 [ 289.913091][ T64] ? kobject_put+0xb9/0x640 [ 289.913111][ T64] ? _raw_spin_unlock+0x28/0x50 [ 289.913146][ T64] device_add+0x294/0x1970 [ 289.913178][ T64] ? __pfx_dev_set_name+0x10/0x10 [ 289.913200][ T64] ? __pfx_device_add+0x10/0x10 [ 289.913246][ T64] ? mgmt_send_event_skb+0x2fb/0x460 [ 289.913283][ T64] hci_conn_add_sysfs+0x1a3/0x260 [ 289.913316][ T64] le_conn_complete_evt+0x11eb/0x1f60 [ 289.913351][ T64] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 289.913378][ T64] ? hci_event_packet+0x186/0xcd0 [ 289.913411][ T64] hci_le_conn_complete_evt+0x23c/0x3a0 [ 289.913440][ T64] ? skb_pull_data+0x15f/0x1e0 [ 289.913472][ T64] hci_le_meta_evt+0x34a/0x5f0 [ 289.913501][ T64] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 289.913532][ T64] hci_event_packet+0x51c/0xcd0 [ 289.913560][ T64] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 289.913589][ T64] ? __pfx_hci_event_packet+0x10/0x10 [ 289.913619][ T64] ? kcov_remote_start+0x387/0x670 [ 289.913639][ T64] ? lockdep_hardirqs_on+0x7d/0x110 [ 289.913676][ T64] hci_rx_work+0x451/0xfc0 [ 289.913714][ T64] process_one_work+0xa23/0x1940 [ 289.913761][ T64] ? __pfx_process_one_work+0x10/0x10 [ 289.913805][ T64] ? __pfx_hci_rx_work+0x10/0x10 [ 289.913840][ T64] worker_thread+0x5ef/0xe50 [ 289.913883][ T64] ? kthread+0x13a/0x450 [ 289.913913][ T64] ? __pfx_worker_thread+0x10/0x10 [ 289.913944][ T64] kthread+0x373/0x450 [ 289.913975][ T64] ? __pfx_kthread+0x10/0x10 [ 289.914006][ T64] ret_from_fork+0x730/0xd60 [ 289.914034][ T64] ? __pfx_ret_from_fork+0x10/0x10 [ 289.914060][ T64] ? __switch_to+0x800/0x10f0 [ 289.914082][ T64] ? __pfx_kthread+0x10/0x10 [ 289.914111][ T64] ret_from_fork_asm+0x1a/0x30 [ 289.914185][ T64] [ 289.914761][ T64] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 289.927751][T12843] fuse: Bad value for 'fd' [ 289.928114][ T64] Bluetooth: hci3: failed to register connection device [ 290.199629][ T64] Bluetooth: hci1: command 0x040f tx timeout [ 290.812160][T12873] syzkaller0: tun_chr_ioctl cmd 35108 [ 290.814403][T12873] syzkaller0: tun_chr_ioctl cmd 1074812118 [ 291.051700][T12886] fuse: Bad value for 'fd' [ 291.089979][T12889] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2635'. [ 291.559216][ T5817] usb 6-1: new low-speed USB device number 36 using dummy_hcd [ 291.720667][ T5817] usb 6-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 291.726463][ T5817] usb 6-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 291.733776][ T5817] usb 6-1: config 168 has 0 interfaces, different from the descriptor's value: 1 [ 291.739324][ T5817] usb 6-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 291.743270][ T5817] usb 6-1: config 168 has 0 interfaces, different from the descriptor's value: 1 [ 291.750015][ T5817] usb 6-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 291.753598][ T5817] usb 6-1: config 168 has 0 interfaces, different from the descriptor's value: 1 [ 291.760723][ T5817] usb 6-1: string descriptor 0 read error: -22 [ 291.762814][ T5817] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 291.770514][ T5817] usb 6-1: rejected 3 configurations due to insufficient available bus power [ 291.777674][ T5817] usb 6-1: no configuration chosen from 3 choices [ 291.809237][ T5731] Bluetooth: hci4: command 0x2016 tx timeout [ 292.040374][ T64] Bluetooth: hci3: command 0x2016 tx timeout [ 292.236575][T12913] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2646'. [ 292.279541][ T5736] Bluetooth: hci1: command 0x040f tx timeout [ 292.490782][ T42] kauditd_printk_skb: 1941 callbacks suppressed [ 292.490802][ T42] audit: type=1326 audit(1787233396.535:70652): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12904 comm="syz.2.2642" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf6fef017 code=0x7ffc0000 [ 292.503403][ T42] audit: type=1326 audit(1787233396.535:70653): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12904 comm="syz.2.2642" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 292.513342][ T42] audit: type=1326 audit(1787233396.535:70654): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12904 comm="syz.2.2642" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 292.523112][ T42] audit: type=1326 audit(1787233396.535:70655): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12904 comm="syz.2.2642" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf6fef017 code=0x7ffc0000 [ 292.532795][ T42] audit: type=1326 audit(1787233396.535:70656): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12904 comm="syz.2.2642" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 292.542583][ T42] audit: type=1326 audit(1787233396.535:70657): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12904 comm="syz.2.2642" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 292.552161][ T42] audit: type=1326 audit(1787233396.535:70658): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12904 comm="syz.2.2642" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf6fef017 code=0x7ffc0000 [ 292.561854][ T42] audit: type=1326 audit(1787233396.535:70659): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12904 comm="syz.2.2642" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 292.571525][ T42] audit: type=1326 audit(1787233396.535:70660): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12904 comm="syz.2.2642" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf6fef017 code=0x7ffc0000 [ 292.581663][ T42] audit: type=1326 audit(1787233396.535:70661): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12904 comm="syz.2.2642" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 292.660311][T12922] FAULT_INJECTION: forcing a failure. [ 292.660311][T12922] name fail_futex, interval 1, probability 0, space 0, times 1 [ 292.665478][T12922] CPU: 2 UID: 0 PID: 12922 Comm: syz.2.2650 Tainted: G L syzkaller #0 PREEMPT(full) [ 292.665508][T12922] Tainted: [L]=SOFTLOCKUP [ 292.665514][T12922] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 292.665527][T12922] Call Trace: [ 292.665535][T12922] [ 292.665545][T12922] dump_stack_lvl+0x100/0x190 [ 292.665575][T12922] should_fail_ex.cold+0x5/0xa [ 292.665600][T12922] get_futex_key+0x1d0/0x14f0 [ 292.665630][T12922] ? __pfx_get_futex_key+0x10/0x10 [ 292.665647][T12922] ? ttwu_queue_wakelist+0x2fd/0x450 [ 292.665670][T12922] ? __smp_call_single_queue+0x17e/0x450 [ 292.665690][T12922] ? __pfx___smp_call_single_queue+0x10/0x10 [ 292.665712][T12922] futex_wait_setup+0x91/0x540 [ 292.665744][T12922] __futex_wait+0x19f/0x300 [ 292.665772][T12922] ? __pfx___futex_wait+0x10/0x10 [ 292.665795][T12922] ? __pfx_try_to_wake_up+0x10/0x10 [ 292.665814][T12922] ? futex_hash+0x311/0x400 [ 292.665836][T12922] ? __pfx_futex_wake_mark+0x10/0x10 [ 292.665865][T12922] ? find_held_lock+0x2b/0x80 [ 292.665887][T12922] ? futex_wake+0x4ea/0x5e0 [ 292.665917][T12922] futex_wait+0xe6/0x370 [ 292.665942][T12922] ? __pfx_futex_wait+0x10/0x10 [ 292.665971][T12922] ? rcu_read_lock_any_held+0x6a/0x90 [ 292.665994][T12922] ? find_held_lock+0x2b/0x80 [ 292.666016][T12922] ? ksys_write+0x190/0x250 [ 292.666052][T12922] ? ksys_write+0x190/0x250 [ 292.666078][T12922] do_futex+0x265/0x440 [ 292.666102][T12922] ? __pfx_do_futex+0x10/0x10 [ 292.666152][T12922] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 292.666189][T12922] __ia32_sys_futex_time32+0x2f4/0x470 [ 292.666217][T12922] ? fput+0x7c/0x100 [ 292.666240][T12922] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 292.666264][T12922] ? ksys_write+0x1ac/0x250 [ 292.666283][T12922] ? __pfx_ksys_write+0x10/0x10 [ 292.666310][T12922] __do_fast_syscall_32+0x13a/0x8b0 [ 292.666331][T12922] do_fast_syscall_32+0x32/0x70 [ 292.666348][T12922] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 292.666371][T12922] RIP: 0023:0xf6feefec [ 292.666406][T12922] Code: Unable to access opcode bytes at 0xf6feefc2. [ 292.666414][T12922] RSP: 002b:00000000f53dd5bc EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 292.666436][T12922] RAX: ffffffffffffffda RBX: 00000000f73e4f88 RCX: 0000000000000080 [ 292.666479][T12922] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f73e4f8c [ 292.666493][T12922] RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 [ 292.666506][T12922] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 292.666516][T12922] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 292.666538][T12922] [ 293.879557][ T5736] Bluetooth: hci4: command 0x2016 tx timeout [ 294.119577][ T5731] Bluetooth: hci3: command 0x2016 tx timeout [ 294.305207][ T3261] usb 6-1: USB disconnect, device number 36 [ 294.359578][ T5731] Bluetooth: hci1: command 0x040f tx timeout [ 294.549221][T12964] VFS: Can't find a romfs filesystem on dev mtdblock0. [ 294.549221][T12964] [ 294.839445][ T5807] usb 7-1: new high-speed USB device number 40 using dummy_hcd [ 295.000032][ T5807] usb 7-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 295.005072][ T5807] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 295.012410][ T5807] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 295.017728][ T5807] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 295.024208][ T5807] usb 7-1: config 0 descriptor?? [ 295.148705][T12985] 9pnet_virtio: no channels available for device syz [ 295.153406][T12985] overlay: ./file0 is not a directory [ 295.401348][T13003] futex_wake_op: syz.3.2686 tries to shift op by 144; fix this program [ 295.452361][T12972] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 295.456309][T12972] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 295.466819][ T5807] usbhid 7-1:0.0: can't add hid device: -71 [ 295.471387][ T5807] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 295.483576][ T5807] usb 7-1: USB disconnect, device number 40 [ 295.959315][ T5731] Bluetooth: hci4: command 0x2016 tx timeout [ 296.247173][T13026] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2694'. [ 297.007016][T13040] 9pnet_virtio: no channels available for device syz [ 297.010636][T13040] overlay: ./file0 is not a directory [ 297.040647][T13050] fuse: Bad value for 'fd' [ 297.226425][T13059] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2707'. [ 297.318891][T13061] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2708'. [ 297.578297][T13067] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off. [ 297.903680][T13076] smpboot: CPU 1 is now offline [ 297.954262][T13076] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 298.271471][T13084] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2716'. [ 298.284619][ T42] kauditd_printk_skb: 2194 callbacks suppressed [ 298.284633][ T42] audit: type=1326 audit(1787233402.325:72856): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13083 comm="syz.3.2716" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 298.305446][ T42] audit: type=1326 audit(1787233402.325:72857): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13083 comm="syz.3.2716" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7fa5017 code=0x7ffc0000 [ 298.322212][ T42] audit: type=1326 audit(1787233402.325:72858): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13083 comm="syz.3.2716" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 298.332534][ T42] audit: type=1326 audit(1787233402.325:72859): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13083 comm="syz.3.2716" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 298.339815][ T42] audit: type=1326 audit(1787233402.325:72860): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13083 comm="syz.3.2716" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 298.346498][ T42] audit: type=1326 audit(1787233402.325:72861): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13083 comm="syz.3.2716" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 298.353273][ T42] audit: type=1326 audit(1787233402.325:72862): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13083 comm="syz.3.2716" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 298.360001][ T42] audit: type=1326 audit(1787233402.325:72863): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13083 comm="syz.3.2716" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7fa5017 code=0x7ffc0000 [ 298.366766][ T42] audit: type=1326 audit(1787233402.325:72864): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13083 comm="syz.3.2716" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 298.373765][ T42] audit: type=1326 audit(1787233402.325:72865): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13083 comm="syz.3.2716" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa4fec code=0x7ffc0000 [ 298.520993][T13092] smpboot: CPU 1 is now offline [ 298.578518][T13092] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 298.684275][T13094] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off. [ 298.689013][T13094] overlayfs: failed to clone lowerpath [ 298.744564][T13097] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2721'. [ 298.793167][T13099] futex_wake_op: syz.1.2722 tries to shift op by 144; fix this program [ 299.768936][T13109] smpboot: CPU 1 is now offline [ 299.803052][T13109] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 300.107907][T13123] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2731'. [ 300.421709][T13131] futex_wake_op: syz.2.2734 tries to shift op by 144; fix this program [ 300.953507][ T64] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 300.961826][ T64] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 300.968694][ T64] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 300.973396][ T64] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 300.978484][ T64] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 301.203893][T13148] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2739'. [ 301.287237][T13138] wg2 speed is unknown, defaulting to 1000 [ 301.376909][T13148] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2739'. [ 301.446435][T13162] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2740'. [ 301.476441][T13148] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2739'. [ 301.561958][T13138] bridge0: port 1(bridge_slave_0) entered blocking state [ 301.564512][T13138] bridge0: port 1(bridge_slave_0) entered disabled state [ 301.568479][T13138] bridge_slave_0: entered allmulticast mode [ 301.576158][T13138] bridge_slave_0: entered promiscuous mode [ 301.583449][T13138] bridge0: port 2(bridge_slave_1) entered blocking state [ 301.588888][T13166] smpboot: CPU 1 is now offline [ 301.593339][T13138] bridge0: port 2(bridge_slave_1) entered disabled state [ 301.597891][T13138] bridge_slave_1: entered allmulticast mode [ 301.604503][T13138] bridge_slave_1: entered promiscuous mode [ 301.615545][T13166] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 301.654176][T13138] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 301.660591][T13138] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 301.688625][T13138] team0: Port device team_slave_0 added [ 301.694257][T13138] team0: Port device team_slave_1 added [ 301.817670][T13138] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 301.828196][T13138] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 301.839850][T13138] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 301.846428][T13138] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 301.849658][T13138] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 301.852424][T13171] fuse: fd is not a fuse device [ 301.857982][T13138] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 301.936480][T13138] hsr_slave_0: entered promiscuous mode [ 301.938936][T13138] hsr_slave_1: entered promiscuous mode [ 302.130004][T13138] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 302.135917][T13138] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 302.138706][T13138] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 302.149734][T13138] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 302.153608][T13138] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 302.159060][T13138] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 302.162807][T13138] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 302.168921][T13138] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 302.200646][T13138] bridge0: port 2(bridge_slave_1) entered blocking state [ 302.203839][T13138] bridge0: port 2(bridge_slave_1) entered forwarding state [ 302.206870][T13138] bridge0: port 1(bridge_slave_0) entered blocking state [ 302.209520][T13138] bridge0: port 1(bridge_slave_0) entered forwarding state [ 302.247804][T13138] 8021q: adding VLAN 0 to HW filter on device bond0 [ 302.257941][ T176] bridge0: port 1(bridge_slave_0) entered disabled state [ 302.263143][ T176] bridge0: port 2(bridge_slave_1) entered disabled state [ 302.282385][T13138] 8021q: adding VLAN 0 to HW filter on device team0 [ 302.293811][ T176] bridge0: port 1(bridge_slave_0) entered blocking state [ 302.296628][ T176] bridge0: port 1(bridge_slave_0) entered forwarding state [ 302.308424][ T176] bridge0: port 2(bridge_slave_1) entered blocking state [ 302.310866][ T176] bridge0: port 2(bridge_slave_1) entered forwarding state [ 302.598269][T13138] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 302.792509][T13138] veth0_vlan: entered promiscuous mode [ 302.800581][T13138] veth1_vlan: entered promiscuous mode [ 302.820538][T13138] veth0_macvtap: entered promiscuous mode [ 302.826982][T13138] veth1_macvtap: entered promiscuous mode [ 302.840877][T13138] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 302.848705][T13138] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 302.870676][ T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 302.875441][ T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 302.925253][ T631] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 302.931367][ T631] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 302.933698][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 302.967778][ T176] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 302.971112][ T176] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 302.979430][ T5808] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 302.999321][ T5731] Bluetooth: hci2: command tx timeout [ 303.848585][T13238] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2755'. [ 304.312055][T13258] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2765'. [ 305.051164][T13263] VFS: Can't find a romfs filesystem on dev mtdblock0. [ 305.051164][T13263] [ 305.079884][ T5731] Bluetooth: hci2: command tx timeout [ 305.122634][T13267] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2769'. [ 305.272806][T13275] futex_wake_op: syz.2.2773 tries to shift op by 144; fix this program [ 306.049341][ T5879] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 306.189207][ T5879] usb 9-1: device descriptor read/64, error -71 [ 306.452621][ T5879] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 306.589238][ T5879] usb 9-1: device descriptor read/64, error -71 [ 306.711150][ T5879] usb usb9-port1: attempt power cycle [ 307.059192][ T5879] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 307.089810][ T5879] usb 9-1: device descriptor read/8, error -71 [ 307.159684][ T5731] Bluetooth: hci2: command tx timeout [ 307.339188][ T5879] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 307.360505][ T5879] usb 9-1: device descriptor read/8, error -71 [ 307.469507][ T5879] usb usb9-port1: unable to enumerate USB device [ 307.747242][T13318] futex_wake_op: syz.3.2791 tries to shift op by 144; fix this program [ 308.972524][T13337] fuse: Bad value for 'fd' [ 309.056008][T13342] futex_wake_op: syz.1.2800 tries to shift op by 144; fix this program [ 309.249253][ T5731] Bluetooth: hci2: command tx timeout [ 310.036860][T13369] sctp: [Deprecated]: syz.1.2811 (pid 13369) Use of struct sctp_assoc_value in delayed_ack socket option. [ 310.036860][T13369] Use struct sctp_sack_info instead [ 310.044193][T13369] sctp: [Deprecated]: syz.1.2811 (pid 13369) Use of struct sctp_assoc_value in delayed_ack socket option. [ 310.044193][T13369] Use struct sctp_sack_info instead [ 310.557034][T13384] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2818'. [ 310.890559][T13399] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2824'. [ 311.146605][T13406] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2826'. [ 311.443869][T13415] futex_wake_op: syz.1.2829 tries to shift op by 144; fix this program [ 312.000473][T13431] sctp: [Deprecated]: syz.4.2834 (pid 13431) Use of struct sctp_assoc_value in delayed_ack socket option. [ 312.000473][T13431] Use struct sctp_sack_info instead [ 312.006716][T13431] sctp: [Deprecated]: syz.4.2834 (pid 13431) Use of struct sctp_assoc_value in delayed_ack socket option. [ 312.006716][T13431] Use struct sctp_sack_info instead [ 312.037800][T13433] sctp: [Deprecated]: syz.3.2836 (pid 13433) Use of struct sctp_assoc_value in delayed_ack socket option. [ 312.037800][T13433] Use struct sctp_sack_info instead [ 312.043721][T13433] sctp: [Deprecated]: syz.3.2836 (pid 13433) Use of struct sctp_assoc_value in delayed_ack socket option. [ 312.043721][T13433] Use struct sctp_sack_info instead [ 312.204795][T13446] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2841'. [ 312.529307][T13458] futex_wake_op: syz.2.2845 tries to shift op by 144; fix this program [ 312.672174][T13461] sctp: [Deprecated]: syz.2.2846 (pid 13461) Use of struct sctp_assoc_value in delayed_ack socket option. [ 312.672174][T13461] Use struct sctp_sack_info instead [ 312.682842][T13461] sctp: [Deprecated]: syz.2.2846 (pid 13461) Use of struct sctp_assoc_value in delayed_ack socket option. [ 312.682842][T13461] Use struct sctp_sack_info instead [ 312.757470][T13463] sctp: [Deprecated]: syz.2.2847 (pid 13463) Use of struct sctp_assoc_value in delayed_ack socket option. [ 312.757470][T13463] Use struct sctp_sack_info instead [ 312.764751][T13463] sctp: [Deprecated]: syz.2.2847 (pid 13463) Use of struct sctp_assoc_value in delayed_ack socket option. [ 312.764751][T13463] Use struct sctp_sack_info instead [ 312.847378][T13467] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2856'. [ 313.110825][ T42] kauditd_printk_skb: 1403 callbacks suppressed [ 313.110838][ T42] audit: type=1326 audit(1787233417.155:74269): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13468 comm="syz.2.2851" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 313.133716][ T42] audit: type=1326 audit(1787233417.155:74270): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13468 comm="syz.2.2851" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 313.147982][ T42] audit: type=1326 audit(1787233417.165:74271): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13468 comm="syz.2.2851" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 313.162566][ T42] audit: type=1326 audit(1787233417.165:74272): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13468 comm="syz.2.2851" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf6fef017 code=0x7ffc0000 [ 313.179849][ T42] audit: type=1326 audit(1787233417.165:74273): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13468 comm="syz.2.2851" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 313.199188][ T42] audit: type=1326 audit(1787233417.165:74274): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13468 comm="syz.2.2851" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf6fef017 code=0x7ffc0000 [ 313.211726][ T42] audit: type=1326 audit(1787233417.165:74275): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13468 comm="syz.2.2851" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 313.226763][ T42] audit: type=1326 audit(1787233417.165:74276): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13468 comm="syz.2.2851" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf6fef017 code=0x7ffc0000 [ 313.235669][ T42] audit: type=1326 audit(1787233417.165:74277): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13468 comm="syz.2.2851" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 313.243006][ T42] audit: type=1326 audit(1787233417.165:74278): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13468 comm="syz.2.2851" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf6fef017 code=0x7ffc0000 [ 313.466275][T13490] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2859'. [ 313.924547][T13504] fuse: Bad value for 'fd' [ 314.459207][ T5837] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 314.586439][T13518] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2870'. [ 314.609249][ T5837] usb 9-1: device descriptor read/64, error -71 [ 314.671982][T13524] fuse: Bad value for 'fd' [ 314.869245][ T5837] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 315.009169][ T5837] usb 9-1: device descriptor read/64, error -71 [ 315.119399][ T5837] usb usb9-port1: attempt power cycle [ 315.469191][ T5837] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 315.499788][ T5837] usb 9-1: device descriptor read/8, error -71 [ 315.503875][T13540] 9pnet_virtio: no channels available for device syz [ 315.506605][T13540] overlay: ./file0 is not a directory [ 315.739315][ T5837] usb 9-1: new high-speed USB device number 9 using dummy_hcd [ 315.769844][ T5837] usb 9-1: device descriptor read/8, error -71 [ 315.889336][ T5837] usb usb9-port1: unable to enumerate USB device [ 316.249198][ T24] usb 7-1: new low-speed USB device number 41 using dummy_hcd [ 316.399956][ T24] usb 7-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 316.404002][ T24] usb 7-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 316.407521][ T24] usb 7-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 316.411470][ T24] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 316.415341][ T24] usb 7-1: config 168 interface 0 altsetting 188 has 1 endpoint descriptor, different from the interface descriptor's value: 100 [ 316.420335][ T24] usb 7-1: config 168 interface 0 has no altsetting 0 [ 316.423875][ T24] usb 7-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 316.427426][ T24] usb 7-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 316.431361][ T24] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 316.435341][ T24] usb 7-1: config 168 interface 0 altsetting 188 has 1 endpoint descriptor, different from the interface descriptor's value: 100 [ 316.440477][ T24] usb 7-1: config 168 interface 0 has no altsetting 0 [ 316.443806][ T24] usb 7-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 316.447253][ T24] usb 7-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 316.451256][ T24] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 316.454900][ T24] usb 7-1: config 168 interface 0 altsetting 188 has 1 endpoint descriptor, different from the interface descriptor's value: 100 [ 316.459818][ T24] usb 7-1: config 168 interface 0 has no altsetting 0 [ 316.464545][ T24] usb 7-1: string descriptor 0 read error: -22 [ 316.466540][ T24] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 316.477143][ T24] adutux 7-1:168.0: interrupt endpoints not found [ 316.683754][ T24] usb 7-1: USB disconnect, device number 41 [ 316.763215][ T1432] ieee802154 phy0 wpan0: encryption failed: -22 [ 316.765884][ T1432] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.361297][T13562] smpboot: CPU 1 is now offline [ 317.384629][T13562] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 317.390162][T13537] ------------[ cut here ]------------ [ 317.392088][T13537] [ 317.392096][T13537] ====================================================== [ 317.392102][T13537] WARNING: possible circular locking dependency detected [ 317.392112][T13537] syzkaller #0 Tainted: G L [ 317.392121][T13537] ------------------------------------------------------ [ 317.392126][T13537] syz.3.2878/13537 is trying to acquire lock: [ 317.392134][T13537] ffffffff8ecf5200 (console_owner){-.-.}-{0:0}, at: console_lock_spinning_enable+0x61/0x80 [ 317.392195][T13537] [ 317.392195][T13537] but task is already holding lock: [ 317.392200][T13537] ffff88802b23b820 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x88/0x140 [ 317.392247][T13537] [ 317.392247][T13537] which lock already depends on the new lock. [ 317.392247][T13537] [ 317.392253][T13537] [ 317.392253][T13537] the existing dependency chain (in reverse order) is: [ 317.392258][T13537] [ 317.392258][T13537] -> #4 (&rq->__lock){-.-.}-{2:2}: [ 317.392293][T13537] lock_acquire+0x1b9/0x370 [ 317.392312][T13537] _raw_spin_lock_nested+0x31/0x40 [ 317.392336][T13537] raw_spin_rq_lock_nested+0x2c/0x140 [ 317.392360][T13537] _task_rq_lock+0xcf/0x500 [ 317.392380][T13537] cgroup_move_task+0x81/0x320 [ 317.392406][T13537] css_set_move_task+0x285/0x600 [ 317.392425][T13537] cgroup_post_fork+0x1f9/0x9a0 [ 317.392441][T13537] copy_process+0x64da/0x8370 [ 317.392463][T13537] kernel_clone+0x176/0x9d0 [ 317.392484][T13537] rest_init+0xa3/0x2e0 [ 317.392503][T13537] start_kernel+0x48e/0x490 [ 317.392562][T13537] x86_64_start_reservations+0x24/0x30 [ 317.392580][T13537] x86_64_start_kernel+0x12b/0x130 [ 317.392599][T13537] common_startup_64+0x13e/0x158 [ 317.392630][T13537] [ 317.392630][T13537] -> #3 (&p->pi_lock){-.-.}-{2:2}: [ 317.392654][T13537] lock_acquire+0x1b9/0x370 [ 317.392669][T13537] _raw_spin_lock_irq_disable+0x5e/0x90 [ 317.392690][T13537] try_to_wake_up+0xc1/0x1c90 [ 317.392829][T13537] __wake_up_common+0x135/0x1f0 [ 317.392846][T13537] __wake_up+0x31/0x60 [ 317.392877][T13537] tty_port_default_wakeup+0x47/0x60 [ 317.392922][T13537] serial8250_tx_chars+0x68f/0x860 [ 317.392953][T13537] serial8250_handle_irq_locked+0x770/0x9a0 [ 317.392976][T13537] serial8250_handle_irq.part.0+0xb4/0x530 [ 317.393000][T13537] serial8250_default_handle_irq+0xc2/0x280 [ 317.393023][T13537] serial8250_interrupt+0xf8/0x1b0 [ 317.393049][T13537] __handle_irq_event_percpu+0x232/0x880 [ 317.393071][T13537] handle_irq_event+0xab/0x1e0 [ 317.393093][T13537] handle_edge_irq+0x34c/0x950 [ 317.393113][T13537] __common_interrupt+0xd8/0x2f0 [ 317.393133][T13537] common_interrupt+0xb9/0xe0 [ 317.393152][T13537] asm_common_interrupt+0x26/0x40 [ 317.393170][T13537] pv_native_safe_halt+0xf/0x20 [ 317.393194][T13537] default_idle+0x9/0x10 [ 317.393210][T13537] default_idle_call+0x6c/0xb0 [ 317.393227][T13537] do_idle+0x3ae/0x5b0 [ 317.393246][T13537] cpu_startup_entry+0x4f/0x60 [ 317.393266][T13537] start_secondary+0x21d/0x2d0 [ 317.393286][T13537] common_startup_64+0x13e/0x158 [ 317.393311][T13537] [ 317.393311][T13537] -> #2 (&tty->write_wait){-...}-{3:3}: [ 317.393335][T13537] lock_acquire+0x1b9/0x370 [ 317.393367][T13537] _raw_spin_lock_irqsave+0x3a/0x60 [ 317.393389][T13537] __wake_up+0x1c/0x60 [ 317.393411][T13537] tty_port_default_wakeup+0x47/0x60 [ 317.393433][T13537] serial8250_tx_chars+0x68f/0x860 [ 317.393453][T13537] __start_tx+0x3e4/0x490 [ 317.393474][T13537] serial8250_start_tx+0x368/0x540 [ 317.393495][T13537] __uart_start+0x295/0x510 [ 317.393512][T13537] uart_write+0x211/0xb20 [ 317.393531][T13537] n_tty_write+0x431/0x1160 [ 317.393555][T13537] file_tty_write.isra.0+0x4d2/0x890 [ 317.393574][T13537] redirected_tty_write+0xd4/0x120 [ 317.393593][T13537] vfs_write+0x6af/0x1050 [ 317.393614][T13537] ksys_write+0x12a/0x250 [ 317.393629][T13537] do_syscall_64+0x121/0x770 [ 317.393653][T13537] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 317.393671][T13537] [ 317.393671][T13537] -> #1 (&port_lock_key){-.-.}-{3:3}: [ 317.393694][T13537] lock_acquire+0x1b9/0x370 [ 317.393712][T13537] _raw_spin_lock_irqsave+0x3a/0x60 [ 317.393733][T13537] serial8250_console_write+0x177/0x1a50 [ 317.393758][T13537] console_flush_one_record+0x790/0xe50 [ 317.393781][T13537] console_unlock+0x103/0x260 [ 317.393802][T13537] vprintk_emit+0x407/0x6b0 [ 317.393822][T13537] _printk+0xcf/0x110 [ 317.393835][T13537] register_console.cold+0xc0/0x248 [ 317.393853][T13537] univ8250_console_init+0x6f/0x80 [ 317.393886][T13537] console_init+0x3d5/0x5b0 [ 317.393910][T13537] start_kernel+0x314/0x490 [ 317.393929][T13537] x86_64_start_reservations+0x24/0x30 [ 317.393954][T13537] x86_64_start_kernel+0x12b/0x130 [ 317.393970][T13537] common_startup_64+0x13e/0x158 [ 317.393993][T13537] [ 317.393993][T13537] -> #0 (console_owner){-.-.}-{0:0}: [ 317.394039][T13537] check_prev_add+0xeb/0xe60 [ 317.394057][T13537] __lock_acquire+0x1492/0x1ec0 [ 317.394075][T13537] lock_acquire+0x1b9/0x370 [ 317.394090][T13537] console_lock_spinning_enable+0x72/0x80 [ 317.394228][T13537] console_flush_one_record+0x739/0xe50 [ 317.394251][T13537] console_unlock+0x103/0x260 [ 317.394272][T13537] vprintk_emit+0x407/0x6b0 [ 317.394294][T13537] _printk+0xcf/0x110 [ 317.394309][T13537] __report_bug.cold+0x34/0x141 [ 317.394328][T13537] report_bug+0xb3/0x220 [ 317.394348][T13537] handle_bug+0x16a/0x2a0 [ 317.394362][T13537] exc_invalid_op+0x17/0x50 [ 317.394377][T13537] asm_exc_invalid_op+0x1a/0x20 [ 317.394394][T13537] update_rq_clock+0x40a/0xd20 [ 317.394414][T13537] __schedule+0x1e2d/0x6740 [ 317.394436][T13537] preempt_schedule_common+0x3c/0xb0 [ 317.394458][T13537] preempt_schedule_thunk+0x16/0x40 [ 317.394484][T13537] _raw_spin_unlock+0x3e/0x50 [ 317.394505][T13537] __zap_vma_range+0x16f5/0x4a40 [ 317.394531][T13537] unmap_vmas+0x299/0x5f0 [ 317.394545][T13537] exit_mmap+0x1ef/0xa00 [ 317.394562][T13537] __mmput+0x12a/0x410 [ 317.394581][T13537] mmput+0x67/0x80 [ 317.394599][T13537] do_exit+0x8b1/0x2ae0 [ 317.394622][T13537] do_group_exit+0xd5/0x2a0 [ 317.394646][T13537] get_signal+0x1ec7/0x21e0 [ 317.394667][T13537] arch_do_signal_or_restart+0x91/0x7a0 [ 317.394685][T13537] exit_to_user_mode_loop+0x139/0x700 [ 317.394704][T13537] __do_fast_syscall_32+0x59f/0x8b0 [ 317.394720][T13537] do_fast_syscall_32+0x32/0x70 [ 317.394735][T13537] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 317.394752][T13537] [ 317.394752][T13537] other info that might help us debug this: [ 317.394752][T13537] [ 317.394758][T13537] Chain exists of: [ 317.394758][T13537] console_owner --> &p->pi_lock --> &rq->__lock [ 317.394758][T13537] [ 317.394784][T13537] Possible unsafe locking scenario: [ 317.394784][T13537] [ 317.394788][T13537] CPU0 CPU1 [ 317.394794][T13537] ---- ---- [ 317.394798][T13537] lock(&rq->__lock); [ 317.394808][T13537] lock(&p->pi_lock); [ 317.394820][T13537] lock(&rq->__lock); [ 317.394833][T13537] lock(console_owner); [ 317.394843][T13537] [ 317.394843][T13537] *** DEADLOCK *** [ 317.394843][T13537] [ 317.394847][T13537] locks held by syz.3.2878/13537: 5, last CPU#0: [ 317.394861][T13537] #0: ffff888022995cf8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x124/0xa00 [ 317.394908][T13537] #1: ffffffff8ede9280 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x2f/0x310 [ 317.394956][T13537] #2: ffff88802b23b820 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x88/0x140 [ 317.394999][T13537] #3: ffffffff8edd5640 (console_lock){+.+.}-{0:0}, at: _printk+0xcf/0x110 [ 317.395034][T13537] #4: ffffffff8edd56b8 (console_srcu){....}-{0:0}, at: console_flush_one_record+0xfd/0xe50 [ 317.395080][T13537] [ 317.395080][T13537] stack backtrace: [ 317.395094][T13537] CPU: 0 UID: 0 PID: 13537 Comm: syz.3.2878 Tainted: G L syzkaller #0 PREEMPT(full) [ 317.395120][T13537] Tainted: [L]=SOFTLOCKUP [ 317.395127][T13537] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 317.395137][T13537] Call Trace: [ 317.395143][T13537] [ 317.395150][T13537] dump_stack_lvl+0x100/0x190 [ 317.395171][T13537] print_circular_bug.cold+0x178/0x1be [ 317.395199][T13537] check_noncircular+0x146/0x160 [ 317.395219][T13537] check_prev_add+0xeb/0xe60 [ 317.395239][T13537] __lock_acquire+0x1492/0x1ec0 [ 317.395262][T13537] lock_acquire+0x1b9/0x370 [ 317.395278][T13537] ? console_lock_spinning_enable+0x61/0x80 [ 317.395301][T13537] ? console_lock_spinning_enable+0x4a/0x80 [ 317.395326][T13537] console_lock_spinning_enable+0x72/0x80 [ 317.395346][T13537] ? console_lock_spinning_enable+0x61/0x80 [ 317.395369][T13537] console_flush_one_record+0x739/0xe50 [ 317.395396][T13537] ? __pfx_console_flush_one_record+0x10/0x10 [ 317.395424][T13537] ? is_printk_cpu_sync_owner+0x32/0x40 [ 317.395451][T13537] console_unlock+0x103/0x260 [ 317.395475][T13537] ? __pfx_console_unlock+0x10/0x10 [ 317.395611][T13537] ? do_raw_spin_unlock+0x145/0x1e0 [ 317.395634][T13537] ? _printk+0xcf/0x110 [ 317.395653][T13537] vprintk_emit+0x407/0x6b0 [ 317.395678][T13537] ? __pfx_vprintk_emit+0x10/0x10 [ 317.395703][T13537] ? post_alloc_hook+0xed/0x120 [ 317.395727][T13537] _printk+0xcf/0x110 [ 317.395744][T13537] ? __pfx__printk+0x10/0x10 [ 317.395763][T13537] ? __report_bug.cold+0x24/0x141 [ 317.395784][T13537] __report_bug.cold+0x34/0x141 [ 317.395800][T13537] ? update_rq_clock+0x40a/0xd20 [ 317.395823][T13537] ? __pfx___report_bug+0x10/0x10 [ 317.395848][T13537] ? rcu_is_watching+0x13/0xc0 [ 317.395877][T13537] ? trace_mm_page_alloc+0x164/0x1c0 [ 317.395896][T13537] ? __lock_acquire+0x4c5/0x1ec0 [ 317.395916][T13537] ? update_rq_clock+0x40a/0xd20 [ 317.395938][T13537] report_bug+0xb3/0x220 [ 317.395963][T13537] ? update_rq_clock+0x40a/0xd20 [ 317.395984][T13537] handle_bug+0x16a/0x2a0 [ 317.396000][T13537] exc_invalid_op+0x17/0x50 [ 317.396017][T13537] asm_exc_invalid_op+0x1a/0x20 [ 317.396036][T13537] RIP: 0010:update_rq_clock+0x40a/0xd20 [ 317.396059][T13537] Code: ab c8 0b 00 00 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e 41 5f e9 58 c1 ea 09 a8 04 0f 84 df fc ff ff 90 0f 0b 90 e9 d6 fc ff ff 90 <0f> 0b 90 e9 92 fc ff ff 4c 8d 83 c0 0b 00 00 48 b8 00 00 00 00 00 [ 317.396078][T13537] RSP: 0000:ffffc9000d0ff308 EFLAGS: 00010046 [ 317.396092][T13537] RAX: 0000000000000000 RBX: ffff88802b33b7c0 RCX: 0000000000000001 [ 317.396104][T13537] RDX: 0000000000000046 RSI: ffffffff8e38e012 RDI: ffffffff8c603680 [ 317.396115][T13537] RBP: ffffc9000d0ff4b0 R08: 0000000000000001 R09: 0000000000000001 [ 317.396127][T13537] R10: ffffffff91429cd7 R11: 0000000000000000 R12: ffffffff9142ce64 [ 317.396139][T13537] R13: ffff88802b33c6a0 R14: ffff88801c754b00 R15: ffff88802b23c358 [ 317.396157][T13537] ? update_rq_clock+0x9c/0xd20 [ 317.396180][T13537] __schedule+0x1e2d/0x6740 [ 317.396210][T13537] ? __pfx___schedule+0x10/0x10 [ 317.396234][T13537] ? page_table_check_clear+0x300/0x540 [ 317.396261][T13537] ? preempt_schedule_thunk+0x16/0x40 [ 317.396288][T13537] preempt_schedule_common+0x3c/0xb0 [ 317.396314][T13537] preempt_schedule_thunk+0x16/0x40 [ 317.396344][T13537] _raw_spin_unlock+0x3e/0x50 [ 317.396366][T13537] __zap_vma_range+0x16f5/0x4a40 [ 317.396400][T13537] ? __pfx___zap_vma_range+0x10/0x10 [ 317.396430][T13537] ? find_held_lock+0x2b/0x80 [ 317.396458][T13537] unmap_vmas+0x299/0x5f0 [ 317.396476][T13537] ? __pfx_unmap_vmas+0x10/0x10 [ 317.396494][T13537] ? mas_next_slot+0x10a3/0x1960 [ 317.396518][T13537] exit_mmap+0x1ef/0xa00 [ 317.396537][T13537] ? __pfx_exit_mmap+0x10/0x10 [ 317.396554][T13537] ? rcu_is_watching+0x13/0xc0 [ 317.396577][T13537] ? find_held_lock+0x2b/0x80 [ 317.396601][T13537] ? uprobe_clear_state+0x5f/0x250 [ 317.396625][T13537] ? __mutex_unlock_slowpath+0x35d/0x930 [ 317.396659][T13537] __mmput+0x12a/0x410 [ 317.396681][T13537] mmput+0x67/0x80 [ 317.396702][T13537] do_exit+0x8b1/0x2ae0 [ 317.396729][T13537] ? __pfx_do_exit+0x10/0x10 [ 317.396754][T13537] ? do_raw_spin_lock+0x128/0x260 [ 317.396777][T13537] ? find_held_lock+0x2b/0x80 [ 317.396800][T13537] ? get_signal+0x7e0/0x21e0 [ 317.396823][T13537] do_group_exit+0xd5/0x2a0 [ 317.396849][T13537] get_signal+0x1ec7/0x21e0 [ 317.396992][T13537] ? __pfx_get_signal+0x10/0x10 [ 317.397015][T13537] ? fput+0x7c/0x100 [ 317.397042][T13537] arch_do_signal_or_restart+0x91/0x7a0 [ 317.397062][T13537] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 317.397086][T13537] ? xfd_validate_state+0x129/0x190 [ 317.397110][T13537] exit_to_user_mode_loop+0x139/0x700 [ 317.397127][T13537] ? rcu_is_watching+0x13/0xc0 [ 317.397148][T13537] __do_fast_syscall_32+0x59f/0x8b0 [ 317.397166][T13537] do_fast_syscall_32+0x32/0x70 [ 317.397184][T13537] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 317.397207][T13537] RIP: 0023:0xf7fa4fec [ 317.397221][T13537] Code: Unable to access opcode bytes at 0xf7fa4fc2. [ 317.397229][T13537] RSP: 002b:00000000f54664ac EFLAGS: 00000282 ORIG_RAX: 00000000000001aa [ 317.397245][T13537] RAX: 0000000000000001 RBX: 0000000000000003 RCX: 0000000000000001 [ 317.397256][T13537] RDX: 0000000000000001 RSI: 0000000000000001 RDI: 0000000000000000 [ 317.397266][T13537] RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000 [ 317.397277][T13537] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 317.397287][T13537] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 317.397301][T13537] [ 317.847346][T13537] debug_locks && !(lock_is_held(&(__rq_lockp(rq))->dep_map) != 0) [ 317.847358][T13537] WARNING: kernel/sched/sched.h:1644 at update_rq_clock+0x40a/0xd20, CPU#0: syz.3.2878/13537 [ 317.852978][T13537] Modules linked in: [ 317.854240][T13537] CPU: 0 UID: 0 PID: 13537 Comm: syz.3.2878 Tainted: G L syzkaller #0 PREEMPT(full) [ 317.857574][T13537] Tainted: [L]=SOFTLOCKUP [ 317.858969][T13537] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 317.862141][T13537] RIP: 0010:update_rq_clock+0x40a/0xd20 [ 317.863954][T13537] Code: ab c8 0b 00 00 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e 41 5f e9 58 c1 ea 09 a8 04 0f 84 df fc ff ff 90 0f 0b 90 e9 d6 fc ff ff 90 <0f> 0b 90 e9 92 fc ff ff 4c 8d 83 c0 0b 00 00 48 b8 00 00 00 00 00 [ 317.870040][T13537] RSP: 0000:ffffc9000d0ff308 EFLAGS: 00010046 [ 317.871966][T13537] RAX: 0000000000000000 RBX: ffff88802b33b7c0 RCX: 0000000000000001 [ 317.874425][T13537] RDX: 0000000000000046 RSI: ffffffff8e38e012 RDI: ffffffff8c603680 [ 317.876874][T13537] RBP: ffffc9000d0ff4b0 R08: 0000000000000001 R09: 0000000000000001 [ 317.879359][T13537] R10: ffffffff91429cd7 R11: 0000000000000000 R12: ffffffff9142ce64 [ 317.881822][T13537] R13: ffff88802b33c6a0 R14: ffff88801c754b00 R15: ffff88802b23c358 [ 317.884297][T13537] FS: 0000000000000000(0000) GS:ffff8880969cf000(0000) knlGS:0000000000000000 [ 317.887058][T13537] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 317.889139][T13537] CR2: 00000000f5466bac CR3: 0000000042f62000 CR4: 0000000000352ef0 [ 317.891656][T13537] Call Trace: [ 317.892762][T13537] [ 317.893730][T13537] __schedule+0x1e2d/0x6740 [ 317.895190][T13537] ? __pfx___schedule+0x10/0x10 [ 317.896720][T13537] ? page_table_check_clear+0x300/0x540 [ 317.898483][T13537] ? preempt_schedule_thunk+0x16/0x40 [ 317.900217][T13537] preempt_schedule_common+0x3c/0xb0 [ 317.901919][T13537] preempt_schedule_thunk+0x16/0x40 [ 317.903552][T13537] _raw_spin_unlock+0x3e/0x50 [ 317.905064][T13537] __zap_vma_range+0x16f5/0x4a40 [ 317.906656][T13537] ? __pfx___zap_vma_range+0x10/0x10 [ 317.908314][T13537] ? find_held_lock+0x2b/0x80 [ 317.909796][T13537] unmap_vmas+0x299/0x5f0 [ 317.911196][T13537] ? __pfx_unmap_vmas+0x10/0x10 [ 317.912730][T13537] ? mas_next_slot+0x10a3/0x1960 [ 317.914269][T13537] exit_mmap+0x1ef/0xa00 [ 317.915579][T13537] ? __pfx_exit_mmap+0x10/0x10 [ 317.917088][T13537] ? rcu_is_watching+0x13/0xc0 [ 317.918549][T13537] ? find_held_lock+0x2b/0x80 [ 317.920015][T13537] ? uprobe_clear_state+0x5f/0x250 [ 317.921597][T13537] ? __mutex_unlock_slowpath+0x35d/0x930 [ 317.923355][T13537] __mmput+0x12a/0x410 [ 317.924641][T13537] mmput+0x67/0x80 [ 317.925793][T13537] do_exit+0x8b1/0x2ae0 [ 317.927087][T13537] ? __pfx_do_exit+0x10/0x10 [ 317.928511][T13537] ? do_raw_spin_lock+0x128/0x260 [ 317.930083][T13537] ? find_held_lock+0x2b/0x80 [ 317.931581][T13537] ? get_signal+0x7e0/0x21e0 [ 317.933064][T13537] do_group_exit+0xd5/0x2a0 [ 317.934520][T13537] get_signal+0x1ec7/0x21e0 [ 317.935931][T13537] ? __pfx_get_signal+0x10/0x10 [ 317.937427][T13537] ? fput+0x7c/0x100 [ 317.938676][T13537] arch_do_signal_or_restart+0x91/0x7a0 [ 317.940432][T13537] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 317.942405][T13537] ? xfd_validate_state+0x129/0x190 [ 317.944050][T13537] exit_to_user_mode_loop+0x139/0x700 [ 317.945726][T13537] ? rcu_is_watching+0x13/0xc0 [ 317.947300][T13537] __do_fast_syscall_32+0x59f/0x8b0 [ 317.948939][T13537] do_fast_syscall_32+0x32/0x70 [ 317.950540][T13537] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 317.952623][T13537] RIP: 0023:0xf7fa4fec [ 317.953923][T13537] Code: Unable to access opcode bytes at 0xf7fa4fc2. [ 317.955995][T13537] RSP: 002b:00000000f54664ac EFLAGS: 00000282 ORIG_RAX: 00000000000001aa [ 317.958599][T13537] RAX: 0000000000000001 RBX: 0000000000000003 RCX: 0000000000000001 [ 317.961177][T13537] RDX: 0000000000000001 RSI: 0000000000000001 RDI: 0000000000000000 [ 317.963578][T13537] RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000 [ 317.965946][T13537] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 317.968290][T13537] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 317.970627][T13537] [ 317.971602][T13537] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 317.973838][T13537] CPU: 0 UID: 0 PID: 13537 Comm: syz.3.2878 Tainted: G L syzkaller #0 PREEMPT(full) [ 317.977016][T13537] Tainted: [L]=SOFTLOCKUP [ 317.978353][T13537] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 317.981352][T13537] Call Trace: [ 317.982491][T13537] [ 317.983414][T13537] dump_stack_lvl+0x100/0x190 [ 317.984839][T13537] vpanic+0x553/0x970 [ 317.986076][T13537] ? __pfx_vpanic+0x10/0x10 [ 317.987436][T13537] ? lock_release+0x24d/0x310 [ 317.988863][T13537] panic+0xd1/0xe0 [ 317.990005][T13537] ? __pfx_panic+0x10/0x10 [ 317.991430][T13537] check_panic_on_warn.cold+0x19/0x34 [ 317.993065][T13537] ? update_rq_clock+0x40a/0xd20 [ 317.994567][T13537] __warn.cold+0x191/0x318 [ 317.995922][T13537] __report_bug+0x30f/0x440 [ 317.997317][T13537] ? update_rq_clock+0x40a/0xd20 [ 317.998818][T13537] ? __pfx___report_bug+0x10/0x10 [ 318.000385][T13537] ? rcu_is_watching+0x13/0xc0 [ 318.001927][T13537] ? trace_mm_page_alloc+0x164/0x1c0 [ 318.003535][T13537] ? __lock_acquire+0x4c5/0x1ec0 [ 318.005185][T13537] ? update_rq_clock+0x40a/0xd20 [ 318.006720][T13537] report_bug+0xb3/0x220 [ 318.008007][T13537] ? update_rq_clock+0x40a/0xd20 [ 318.009516][T13537] handle_bug+0x16a/0x2a0 [ 318.010845][T13537] exc_invalid_op+0x17/0x50 [ 318.012276][T13537] asm_exc_invalid_op+0x1a/0x20 [ 318.013761][T13537] RIP: 0010:update_rq_clock+0x40a/0xd20 [ 318.015435][T13537] Code: ab c8 0b 00 00 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e 41 5f e9 58 c1 ea 09 a8 04 0f 84 df fc ff ff 90 0f 0b 90 e9 d6 fc ff ff 90 <0f> 0b 90 e9 92 fc ff ff 4c 8d 83 c0 0b 00 00 48 b8 00 00 00 00 00 [ 318.021164][T13537] RSP: 0000:ffffc9000d0ff308 EFLAGS: 00010046 [ 318.023085][T13537] RAX: 0000000000000000 RBX: ffff88802b33b7c0 RCX: 0000000000000001 [ 318.025458][T13537] RDX: 0000000000000046 RSI: ffffffff8e38e012 RDI: ffffffff8c603680 [ 318.027823][T13537] RBP: ffffc9000d0ff4b0 R08: 0000000000000001 R09: 0000000000000001 [ 318.030216][T13537] R10: ffffffff91429cd7 R11: 0000000000000000 R12: ffffffff9142ce64 [ 318.032617][T13537] R13: ffff88802b33c6a0 R14: ffff88801c754b00 R15: ffff88802b23c358 [ 318.034987][T13537] ? update_rq_clock+0x9c/0xd20 [ 318.036447][T13537] __schedule+0x1e2d/0x6740 [ 318.037917][T13537] ? __pfx___schedule+0x10/0x10 [ 318.039491][T13537] ? page_table_check_clear+0x300/0x540 [ 318.041176][T13537] ? preempt_schedule_thunk+0x16/0x40 [ 318.042820][T13537] preempt_schedule_common+0x3c/0xb0 [ 318.044423][T13537] preempt_schedule_thunk+0x16/0x40 [ 318.046126][T13537] _raw_spin_unlock+0x3e/0x50 [ 318.047550][T13537] __zap_vma_range+0x16f5/0x4a40 [ 318.049119][T13537] ? __pfx___zap_vma_range+0x10/0x10 [ 318.050745][T13537] ? find_held_lock+0x2b/0x80 [ 318.052252][T13537] unmap_vmas+0x299/0x5f0 [ 318.053592][T13537] ? __pfx_unmap_vmas+0x10/0x10 [ 318.055333][T13537] ? mas_next_slot+0x10a3/0x1960 [ 318.056895][T13537] exit_mmap+0x1ef/0xa00 [ 318.058315][T13537] ? __pfx_exit_mmap+0x10/0x10 [ 318.059766][T13537] ? rcu_is_watching+0x13/0xc0 [ 318.061244][T13537] ? find_held_lock+0x2b/0x80 [ 318.062692][T13537] ? uprobe_clear_state+0x5f/0x250 [ 318.064261][T13537] ? __mutex_unlock_slowpath+0x35d/0x930 [ 318.065960][T13537] __mmput+0x12a/0x410 [ 318.067226][T13537] mmput+0x67/0x80 [ 318.068358][T13537] do_exit+0x8b1/0x2ae0 [ 318.069709][T13537] ? __pfx_do_exit+0x10/0x10 [ 318.071157][T13537] ? do_raw_spin_lock+0x128/0x260 [ 318.072741][T13537] ? find_held_lock+0x2b/0x80 [ 318.074312][T13537] ? get_signal+0x7e0/0x21e0 [ 318.075727][T13537] do_group_exit+0xd5/0x2a0 [ 318.077242][T13537] get_signal+0x1ec7/0x21e0 [ 318.078637][T13537] ? __pfx_get_signal+0x10/0x10 [ 318.080168][T13537] ? fput+0x7c/0x100 [ 318.081528][T13537] arch_do_signal_or_restart+0x91/0x7a0 [ 318.083282][T13537] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 318.085212][T13537] ? xfd_validate_state+0x129/0x190 [ 318.086844][T13537] exit_to_user_mode_loop+0x139/0x700 [ 318.088518][T13537] ? rcu_is_watching+0x13/0xc0 [ 318.090112][T13537] __do_fast_syscall_32+0x59f/0x8b0 [ 318.091657][T13537] do_fast_syscall_32+0x32/0x70 [ 318.093172][T13537] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 318.095126][T13537] RIP: 0023:0xf7fa4fec [ 318.096413][T13537] Code: Unable to access opcode bytes at 0xf7fa4fc2. [ 318.098501][T13537] RSP: 002b:00000000f54664ac EFLAGS: 00000282 ORIG_RAX: 00000000000001aa [ 318.101179][T13537] RAX: 0000000000000001 RBX: 0000000000000003 RCX: 0000000000000001 [ 318.103580][T13537] RDX: 0000000000000001 RSI: 0000000000000001 RDI: 0000000000000000 [ 318.105938][T13537] RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000 [ 318.108438][T13537] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 318.110805][T13537] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 318.113415][T13537] [ 319.188364][T13537] Shutting down cpus with NMI [ 319.191140][T13537] Kernel Offset: disabled [ 319.192927][T13537] Rebooting in 86400 seconds..