last executing test programs: 3m15.694570518s ago: executing program 3 (id=1180): r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r0) r1 = syz_clone(0x2008400, 0x0, 0x0, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000080)='proc\x00', 0x189, 0x0) r2 = syz_open_procfs(r1, &(0x7f0000000100)='map_files\x00') fchdir(r2) setuid(0xee00) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x80) getdents(r3, 0x0, 0x0) 3m15.298162579s ago: executing program 3 (id=1183): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="020000000400000006000000050001000010"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1803000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r1, 0x2000000, 0xe, 0x0, &(0x7f00000004c0)="630b008646dc3f0adf33c9f7b986", 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2}, 0x50) 3m15.075737855s ago: executing program 3 (id=1185): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000000082295"], &(0x7f0000000040)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000100001000000000000dfff000000000a20000000000a01020000000000000000010000000900010073797a30000000006c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000004000038008000140000000002c0003801400010067656e65766530000000000000000000140001006c6f0000000000000000000000000000080002"], 0xb4}}, 0x0) 3m14.743832011s ago: executing program 3 (id=1188): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mkdir(&(0x7f0000000280)='./file0/file1\x00', 0xb) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000140)='./file0/file0\x00', &(0x7f0000000180)='./file0/file1\x00', 0x0, 0x2243005, 0x0) 3m14.611262014s ago: executing program 3 (id=1189): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2c, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffe3a}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r1, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000900)=@newqdisc={0x40, 0x24, 0xf0b, 0x70bd2c, 0x25dfdbfe, {0x0, 0x0, 0x12, 0x0, {}, {0xffff, 0xffff}, {0x2, 0x3}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x7fff, 0xb, 0x4}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x4008810) 3m12.820037967s ago: executing program 3 (id=1204): r0 = syz_open_dev$vim2m(&(0x7f0000005680), 0xf019, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f00000002c0)={0x1, 0x1, 0x80, "268100ba7af9819e79b0589a5b8c480000000001001100001c536c1500", 0x33363248}) 3m12.234361244s ago: executing program 32 (id=1204): r0 = syz_open_dev$vim2m(&(0x7f0000005680), 0xf019, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f00000002c0)={0x1, 0x1, 0x80, "268100ba7af9819e79b0589a5b8c480000000001001100001c536c1500", 0x33363248}) 34.523664061s ago: executing program 1 (id=2575): r0 = socket$packet(0x11, 0x2, 0x300) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@bloom_filter={0x1e, 0x0, 0x1, 0x7, 0x0, 0x1}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000180)=r2, 0x4) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="180000000200000000"], 0x0}, 0x94) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xb68, 0x4, &(0x7f0000000000)='%', 0x0, 0xd01, 0x80040000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 12.024814216s ago: executing program 0 (id=2628): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x80000007, 0x1}, 0x1c) r3 = syz_io_uring_setup(0x110, 0x0, &(0x7f0000000040), &(0x7f0000000280)) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) bpf$MAP_DELETE_BATCH(0x18, &(0x7f0000000000)={0x0, &(0x7f00000004c0)=""/233, &(0x7f00000001c0), &(0x7f0000000240), 0x6}, 0x38) io_uring_enter(r3, 0x1f85, 0x40110a, 0x4d, 0x0, 0xa6) recvmmsg$unix(r2, &(0x7f00000007c0)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000005c0)=""/227, 0xe3}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x40000000, 0x0) sendmmsg(r2, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) 8.923041969s ago: executing program 0 (id=2636): socket$can_bcm(0x1d, 0x2, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './bus\x00'}, 0x6e) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) r4 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r4, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x22}}, 0x10, 0x0}, 0x300440f1) setsockopt$sock_attach_bpf(r4, 0x1, 0x12, &(0x7f0000000500)=r4, 0x4) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000100)={'bridge_slave_0\x00', &(0x7f0000000280)=@ethtool_stats={0x1d, 0x1, [0x1]}}) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_DELETE(r7, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x0) r8 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x800) getdents64(0xffffffffffffffff, &(0x7f0000000fc0)=""/224, 0xe0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000180)=@IORING_OP_READV=@pass_iovec={0x1, 0x40, 0x0, @fd=r8, 0x73b, &(0x7f0000000500)=[{0x0}], 0x1, 0x0, 0x1}) io_uring_enter(0xffffffffffffffff, 0x567, 0xa9ea, 0x5, 0x0, 0x0) sendfile(r5, r6, 0x0, 0x201f00) socket(0x23, 0x6, 0x2007a30) socket$nl_generic(0x10, 0x3, 0x10) 7.614302346s ago: executing program 5 (id=2637): connect$unix(0xffffffffffffffff, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f00000005c0)="0f0013c441fc5a9b31aacf330f3235001000000f3066ba2100ec66baf80cb8402a2484ef66bafc0c66edc4a1f5fbf1f3450f2a89040000006642f4c4e21dbf7939b805000000b97499008c0f01c148b804000000000000000f23c00f21f835020004000f23f8", 0xffffffffffffffd5}], 0x1, 0xe8, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000001680)=[{&(0x7f0000000240)="e7736a", 0x3}], 0x1) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) sendmsg$NL80211_CMD_GET_MPATH(0xffffffffffffffff, &(0x7f0000000040)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4008801}, 0x41) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 7.147862847s ago: executing program 5 (id=2638): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f00000005c0), 0x10) recvmmsg(r0, &(0x7f0000001d80)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000000)=""/31, 0x1f}, {0x0}], 0x2}, 0xd}], 0x1, 0x10022, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0], 0x48}}, 0x0) 6.607978611s ago: executing program 2 (id=2639): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'lo\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x90) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) 6.581940379s ago: executing program 0 (id=2640): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xd) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x6, &(0x7f0000006680)) socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x800, 0xffffffff, 0xbfdffffc}, &(0x7f0000000000), &(0x7f0000000280)) io_uring_enter(r3, 0x47f6, 0x0, 0x2, 0x0, 0x300) syz_io_uring_setup(0x3ab0, &(0x7f0000000200)={0x0, 0xeeaf, 0x1000, 0x3, 0x16e, 0x0, r3}, &(0x7f0000000280), &(0x7f00000002c0)) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) r4 = fsopen(&(0x7f0000000340)='omfs\x00', 0x1) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r5, 0x3ba0, &(0x7f0000000380)={0x48, 0x16, 0x0, 0x0, 0xe160, 0x0, 0x0}) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f00000001c0)='source', &(0x7f0000000100)='%\xff:2\x82|\x9a\xe0\xadA\xde\xd5\x03\x00\x00\x00\xb7\xe5\xee:\xb5\x0e\xec\xe5\xdc\xe5\x8d?\x16BE\x8b\xe8)\xa9H\x99\x10\x02q\xf7\xd3\xc5*\x15\xdf_\xb2_`\x92|\x7f\xff9\xf7o$e&1\xfd\xea\xb0\xb0', 0x0) r6 = userfaultfd(0x1) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f00000000c0)) r7 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x20080, 0x0) r8 = dup2(r7, r7) ioctl$SNDCTL_DSP_SPEED(r8, 0xc0045002, &(0x7f00000001c0)=0x2) read$FUSE(r8, &(0x7f00000063c0)={0x2020}, 0x2020) 6.48551748s ago: executing program 2 (id=2642): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$rdma_cm(0xffffff9c, &(0x7f00000004c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0xfe37) rt_sigpending(0x0, 0x0) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/address_bits', 0x70000, 0x0) r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000006a80), 0x1, 0x0) write$vga_arbiter(r4, &(0x7f0000000000)=ANY=[@ANYBLOB="546f636b206d656d10"], 0x6) pipe(0x0) getsockopt$CAN_RAW_FILTER(r3, 0x65, 0x1, &(0x7f0000000240)=[{}, {}], &(0x7f0000000300)=0x10) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) r5 = syz_io_uring_setup(0x88d, &(0x7f00000005c0)={0x0, 0x1423, 0x0, 0x2, 0xbfdffffc}, &(0x7f0000000200)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_open_dev$vim2m(0x0, 0x2, 0x2) r8 = syz_open_dev$sndpcmp(&(0x7f0000000000), 0x0, 0x0) close_range(r8, 0xffffffffffffffff, 0x0) r9 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x2, 0x400) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r9, 0xc1105517, &(0x7f0000000340)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x6, 0x20, 0x4, 0x0, 0x0, 0x0, 'syz1\x00', 0x0}) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r9, 0xc1105518, &(0x7f0000000040)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa7, 0x1, 0x8000000000000000, 0x0, 0xfffffffffffffffe, 0xb, 0x0, 0x6, 0x0, 0xfffffffd, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x4, 0x4, 0x0, 0x0, 0xfffffffffffffffc, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x8, 0x0, 0x0, 0x4, 0x0, 0x2000100, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0xfffffffd, 0x8, 0x7, 0x4, 0x800000, 0x0, 0x101, 0x1, 0xd721, 0x0, 0x4, 0x0, 0x0, 0x1, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x58, 0x4, 0x0, 0x3, 0x4000000, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000006fd]}) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x11, 0x0, @fd, 0x0, 0x0, 0x0, {0x40}}) io_uring_enter(r5, 0x75fa, 0xe475, 0x0, 0x0, 0x0) 6.394528648s ago: executing program 4 (id=2643): open(&(0x7f0000000140)='./file1\x00', 0x60142, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file1\x00', &(0x7f0000000140), 0x2, &(0x7f0000002400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f00000000c0)='./file1\x00', 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f00000065c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(0xffffffffffffffff, &(0x7f0000002240)={0x10, 0xffffffffffffffda, r0}, 0x10) 6.324095455s ago: executing program 4 (id=2644): r0 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x0, 0x0, 0x0) 5.987702635s ago: executing program 5 (id=2645): fcntl$lock(0xffffffffffffffff, 0x24, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000a00)={'syz1\x00', {0x9, 0x7, 0x3, 0x5}, 0x3f, [0x9, 0x2, 0x18, 0x2, 0x2, 0x400, 0x80400000, 0x0, 0x8, 0x0, 0x6, 0xe237, 0xfffffffb, 0x39, 0x747d5e13, 0x800, 0xfffffb9a, 0xfffffffe, 0x0, 0xfffffffb, 0x2004, 0x3, 0x0, 0xf250, 0x83, 0x4800, 0x300000, 0x7, 0xe, 0x4623f, 0x0, 0x10001, 0x1ff, 0x8003, 0x0, 0x3, 0xd, 0x3, 0xba55, 0x8da8, 0x4, 0x200, 0x2, 0x4, 0xe, 0x4, 0x2, 0x6f, 0x8, 0x9, 0x1, 0x8001, 0x6, 0x2, 0x9, 0xfffbffff, 0x4, 0x6, 0x1000, 0x5, 0x3d, 0x8, 0xa, 0x5], [0x1, 0x1e, 0x3, 0x8000, 0xfffffffd, 0x3, 0x0, 0x25, 0x7, 0xfffffffc, 0x8, 0x7fff, 0x72c, 0x1c32, 0x3, 0x6, 0x10000, 0x400, 0x7ffd, 0x3, 0x1, 0xf, 0x5, 0x0, 0x981, 0x4, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x1000001, 0x10, 0xfffffff9, 0xfffffffd, 0x7, 0x1, 0xffffffff, 0x6, 0x8, 0x800, 0x7, 0x6, 0x96, 0xfffffff9, 0x2, 0x0, 0x2, 0x411, 0xc, 0x3, 0x4, 0x9, 0xe, 0x5, 0x7, 0x6, 0x2, 0x1, 0x1, 0x8, 0x7, 0x200, 0x3], [0x401, 0x4d, 0xffff, 0xcd3, 0x7, 0x1f, 0x404, 0x4, 0x4008, 0xc, 0x7, 0x9, 0xe8b, 0x5, 0x80000001, 0x8, 0x3f92, 0x1000, 0x0, 0x10, 0x1, 0xfffffff9, 0x0, 0x1000, 0x3, 0x5, 0x4, 0x5, 0x200003, 0x2, 0x5, 0x80, 0x9, 0x8001, 0x10000, 0x0, 0x7, 0x400004, 0x3, 0x6d7e, 0x3, 0x8, 0x3, 0xbf23, 0x6, 0x9, 0x956, 0x0, 0x3ff, 0xe, 0x6, 0x100fffd, 0x2005, 0x400, 0x4, 0xea, 0x9, 0x20000005, 0x3, 0xd9, 0x0, 0x7d, 0x5d7, 0x5], [0x108e, 0xffff, 0x7, 0x3, 0x88, 0x2, 0x4000000, 0x4, 0x4c, 0x2, 0x763, 0xb, 0x402, 0x1, 0x9, 0x4001000, 0x7f, 0x5, 0x3fa6, 0x4, 0x0, 0x5, 0x6, 0x4, 0xe47, 0x4, 0x3, 0x4, 0x2, 0x2851, 0x7, 0x20000001, 0x5, 0x5, 0xa80a, 0x65f413f9, 0x4, 0x20006, 0x8a5, 0x86, 0x44, 0x409, 0x3, 0x4, 0x4, 0x10, 0xe, 0xffffffff, 0x7fff, 0xffff8a33, 0xfffffff9, 0x401, 0x3, 0x200, 0x7, 0x4edf, 0xfffffffd, 0xa, 0xe, 0x2, 0xf, 0xf, 0x136, 0x7fffffff]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) ioctl$UI_DEV_DESTROY(r0, 0x5502) 5.412016598s ago: executing program 4 (id=2646): syz_usb_connect(0x5, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110010928fc10ac059102254301020301090212000100004000090484000003e102"], 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80082) syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) 4.985556255s ago: executing program 5 (id=2647): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = epoll_create(0x4) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000280)={0x2001}) 4.503827413s ago: executing program 5 (id=2648): ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x13) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) read(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0xa2, &(0x7f0000000000)={@link_local, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "010120", 0x6c, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, [{0x0, 0xa, "a78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96489269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af1802"}, {}, {0x1, 0x1, "fe906d17efe3"}]}}}}}}, 0x0) sendmsg$rds(0xffffffffffffffff, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) syz_io_uring_setup(0x1248, &(0x7f0000000200)={0x0, 0xd5a1, 0x1, 0x40000002, 0xb8}, &(0x7f0000000400), &(0x7f00000001c0)) 4.413851693s ago: executing program 5 (id=2649): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes256\x00'}, 0x58) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000040)=0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r3 = dup(r2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r3, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r4 = socket$kcm(0x29, 0x5, 0x0) syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000780)=@gettfilter={0x2c, 0x2e, 0x400, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xe, 0x7}, {0x3, 0x8}, {0x9, 0x61af5a3e09aa3ecb}}, [{0x8, 0xb, 0x6}]}, 0x2c}, 0x1, 0x0, 0x0, 0x54}, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000007e40)=[{0x0, 0x0, &(0x7f0000003740)=[{&(0x7f00000000c0)="4789d3aefc1a4d03345aed327be33c", 0xf}], 0x1, 0x0, 0x0, 0x20000000}], 0x1, 0x20040894) r5 = socket$kcm(0x10, 0x2, 0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0xa, 0x0, 0x0, 0x7fff0000}]}) keyctl$describe(0x6, 0x0, &(0x7f0000000340)=""/100, 0x64) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20010840) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)}, 0x0) write$cgroup_pressure(r4, &(0x7f0000000140)={'full'}, 0xfffffdef) sendmmsg(r4, &(0x7f0000001a40), 0x0, 0x40044) syz_usb_connect(0x0, 0x24, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x3, r1, 0x2, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT={0xb, 0x22, 0x0, 0x0, 0x4000, &(0x7f00000001c0)={0x0, 0x989680}, 0x1, 0x12}) 3.905137334s ago: executing program 2 (id=2650): bind$alg(0xffffffffffffffff, &(0x7f0000000640)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha256)\x00'}, 0x58) r0 = accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) poll(0x0, 0x0, 0xfa) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f00000001c0)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) read$FUSE(r0, 0x0, 0x0) 3.472290681s ago: executing program 4 (id=2651): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000011c0)={0x1f, 0x11, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000ffffffff000000000000000085000000a8000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b705000000000000850000007300000095"], &(0x7f0000000b00)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) r3 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r2}, 0x8) close(r3) socketpair(0x1, 0x1, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 3.20899369s ago: executing program 0 (id=2652): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @synproxy={{0xd}, @val={0x4}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) sendmsg$NFNL_MSG_CTHELPER_DEL(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000480)={0x20, 0x2, 0x9, 0x101, 0x0, 0x0, {0xa, 0x0, 0x7}, [@NFCTH_NAME={0x9, 0x1, 'syz1\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x404c840}, 0x10000000) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd6317ce22000000000000000000000000000000007fffffff0001000000000071273fa79d93014b8e3381b6"], 0xfdef) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 2.847855863s ago: executing program 4 (id=2653): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x90}, 0x40c0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000300000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540", @ANYRESOCT], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) 2.677826822s ago: executing program 0 (id=2654): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f00000005c0), 0x10) recvmmsg(r0, &(0x7f0000001d80)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000000)=""/31, 0x1f}, {0x0}], 0x2}, 0xd}], 0x1, 0x10022, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x2710], 0x48}}, 0x0) 2.670268893s ago: executing program 4 (id=2655): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes256\x00'}, 0x58) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000040)=0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r3 = dup(r2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r3, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r4 = socket$kcm(0x29, 0x5, 0x0) syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000780)=@gettfilter={0x2c, 0x2e, 0x400, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xe, 0x7}, {0x3, 0x8}, {0x9, 0x61af5a3e09aa3ecb}}, [{0x8, 0xb, 0x6}]}, 0x2c}, 0x1, 0x0, 0x0, 0x54}, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000007e40)=[{0x0, 0x0, &(0x7f0000003740)=[{&(0x7f00000000c0)="4789d3aefc1a4d03345aed327be33c", 0xf}], 0x1, 0x0, 0x0, 0x20000000}], 0x1, 0x20040894) r5 = socket$kcm(0x10, 0x2, 0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0xa, 0x0, 0x0, 0x7fff0000}]}) keyctl$describe(0x6, 0x0, &(0x7f0000000340)=""/100, 0x64) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20010840) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)}, 0x0) write$cgroup_pressure(r4, &(0x7f0000000140)={'full'}, 0xfffffdef) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r3, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x20000400}, 0xc, &(0x7f0000000580)={&(0x7f0000000600)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="200029bd7000ffdbdf2503000000050002000600000005000200050000000500020002000000b17a30e9858745781d256a151a9a41f9f3694428ea1ca37b44b0748fc0a90163443f0438c50fad4e55fc76f39ce915315d0be762d779511ad34ec49f97109c441b2f1b8919224df87a4742a023f016bb4fa76cc9a57217ead1964b42439cff5961a456df1caa32d9ae8d719815d078d378425252443f15949b2fcd9435ed85b1aef98859d7c5bd0170853e55a200618ff2b0c4c119146361b8c7383f36cb512e9468e7434dd711491355b68b2abf663e0d7fff1e7058013d8815ef50bc17b1f34796fe9f9dbc12f39957f04a8aa0dd284e801acc26da0a2bf577e7c3f93c38914238ac81b664d0ef97cf2f910c"], 0x2c}, 0x1, 0x0, 0x0, 0x4008801}, 0xc0) sendmmsg(r4, &(0x7f0000001a40), 0x0, 0x40044) syz_usb_connect(0x0, 0x24, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x3, r1, 0x2, 0x0) r6 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r6, &(0x7f0000000040)={0x28, 0x0, 0x2710, @host}, 0x10) connect$vsock_stream(r6, &(0x7f0000000300)={0x28, 0x0, 0xffffffff}, 0x10) 2.009961588s ago: executing program 1 (id=2578): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_CONNECT(r0, 0x0, 0x0) 1.735841816s ago: executing program 1 (id=2656): fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000a00)={'syz1\x00', {0x9, 0x7, 0x3, 0x5}, 0x3f, [0x9, 0x2, 0x18, 0x2, 0x2, 0x400, 0x80400000, 0x0, 0x8, 0x0, 0x6, 0xe237, 0xfffffffb, 0x39, 0x747d5e13, 0x800, 0xfffffb9a, 0xfffffffe, 0x0, 0xfffffffb, 0x2004, 0x3, 0x0, 0xf250, 0x83, 0x4800, 0x300000, 0x7, 0xe, 0x4623f, 0x0, 0x10001, 0x1ff, 0x8003, 0x0, 0x3, 0xd, 0x3, 0xba55, 0x8da8, 0x4, 0x200, 0x2, 0x4, 0xe, 0x4, 0x2, 0x6f, 0x8, 0x9, 0x1, 0x8001, 0x6, 0x2, 0x9, 0xfffbffff, 0x4, 0x6, 0x1000, 0x5, 0x3d, 0x8, 0xa, 0x5], [0x1, 0x1e, 0x3, 0x8000, 0xfffffffd, 0x3, 0x0, 0x25, 0x7, 0xfffffffc, 0x8, 0x7fff, 0x72c, 0x1c32, 0x3, 0x6, 0x10000, 0x400, 0x7ffd, 0x3, 0x1, 0xf, 0x5, 0x0, 0x981, 0x4, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x1000001, 0x10, 0xfffffff9, 0xfffffffd, 0x7, 0x1, 0xffffffff, 0x6, 0x8, 0x800, 0x7, 0x6, 0x96, 0xfffffff9, 0x2, 0x0, 0x2, 0x411, 0xc, 0x3, 0x4, 0x9, 0xe, 0x5, 0x7, 0x6, 0x2, 0x1, 0x1, 0x8, 0x7, 0x200, 0x3], [0x401, 0x4d, 0xffff, 0xcd3, 0x7, 0x1f, 0x404, 0x4, 0x4008, 0xc, 0x7, 0x9, 0xe8b, 0x5, 0x80000001, 0x8, 0x3f92, 0x1000, 0x0, 0x10, 0x1, 0xfffffff9, 0x0, 0x1000, 0x3, 0x5, 0x4, 0x5, 0x200003, 0x2, 0x5, 0x80, 0x9, 0x8001, 0x10000, 0x0, 0x7, 0x400004, 0x3, 0x6d7e, 0x3, 0x8, 0x3, 0xbf23, 0x6, 0x9, 0x956, 0x0, 0x3ff, 0xe, 0x6, 0x100fffd, 0x2005, 0x400, 0x4, 0xea, 0x9, 0x20000005, 0x3, 0xd9, 0x0, 0x7d, 0x5d7, 0x5], [0x108e, 0xffff, 0x7, 0x3, 0x88, 0x2, 0x4000000, 0x4, 0x4c, 0x2, 0x763, 0xb, 0x402, 0x1, 0x9, 0x4001000, 0x7f, 0x5, 0x3fa6, 0x4, 0x0, 0x5, 0x6, 0x4, 0xe47, 0x4, 0x3, 0x4, 0x2, 0x2851, 0x7, 0x20000001, 0x5, 0x5, 0xa80a, 0x65f413f9, 0x4, 0x20006, 0x8a5, 0x86, 0x44, 0x409, 0x3, 0x4, 0x4, 0x10, 0xe, 0xffffffff, 0x7fff, 0xffff8a33, 0xfffffff9, 0x401, 0x3, 0x200, 0x7, 0x4edf, 0xfffffffd, 0xa, 0xe, 0x2, 0xf, 0xf, 0x136, 0x7fffffff]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) ioctl$UI_DEV_DESTROY(r0, 0x5502) 1.559364813s ago: executing program 0 (id=2657): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$rdma_cm(0xffffff9c, &(0x7f00000004c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0xfe37) rt_sigpending(0x0, 0x0) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/address_bits', 0x70000, 0x0) r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000006a80), 0x1, 0x0) write$vga_arbiter(r4, &(0x7f0000000000)=ANY=[@ANYBLOB="546f636b206d656d10"], 0x6) pipe(0x0) getsockopt$CAN_RAW_FILTER(r3, 0x65, 0x1, &(0x7f0000000240)=[{}, {}], &(0x7f0000000300)=0x10) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) r5 = syz_io_uring_setup(0x88d, &(0x7f00000005c0)={0x0, 0x1423, 0x0, 0x2, 0xbfdffffc}, &(0x7f0000000200)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000000040)=0x2) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x11, 0x0, @fd, 0x0, 0x0, 0x0, {0x40}}) syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) io_uring_enter(r5, 0x75fa, 0xe475, 0x0, 0x0, 0x0) 1.515209004s ago: executing program 1 (id=2658): socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000000)={@my=0x0}) syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0x93fd, 0x0, 0x2, 0x2e9}, 0x0, 0x0) socket(0x400000000010, 0x3, 0x0) socket$alg(0x26, 0x5, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x6, 0xfffffffffffffffd, 0x9, 0x40, 0x2, 0xd}, 0x0, &(0x7f0000000680)={0x7ff, 0x7, 0x5, 0x7, 0xffffffffffffff22, 0x2, 0x5, 0x8}, 0x0, 0x0) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r0, 0x7ab, &(0x7f0000000280)={&(0x7f0000000780)={{@my=0x0}, {@my=0x0, 0x800000}, 0x400, "884fbe2726aa0a32f3e65f909acda971a093228292456e0332e6c11577b514f0bb8db731789d860e9589c4cbdd60b7a851a8a3c55ada2f90c51a69bf4a5c3e32296535dc838ef00dc18a32a79118dc858628f741f107552021e5a81d38e4374a8a717a7ca9015083cfff5d16156ef9cabf4f60c0da46870a10bf520cc5abcf9e3a437761ea75776763139fadd55c46daf5338870951822f6a803ccfbab9c3f507672d7c39ea9ccf81d9bc2b4649e7b44ed9fd7cb9bd389240cd41c415113d1caac4536f05c07e596d6addad2a4d27ba21a3b655753c508caedcc812ca235a7cd1686426b208bdecf8a4265ba8f6824aa60306e2d623481eed301b6dc21041fa8b6592be00bb74de1989a45a5aa32c189e9f5a5bb878281d0129afcfb8410cd1fa5acd080993d2d084213130a9b8d517d13251e6605a03d9b8faf507e820205a1f471af7b261419e79e09c547f7c10fd3f1ad876f59fdcc5e07d0ff4dee6ea2e3856616a352d648b9b5261b6263020fc3ae8eb404bc25703b3d3b83172d07ff22907d6631d226c8247c92c1826ff814590dfe8c7fc54dfb265e906f756846546316b20e0105e2a5355a210b2b7f5db61d8f90bb783b41ce368233bd08044e9283531fffe49e3d305ecfb16075a047557f57bb7baf8babfc02975ad0d60ed8de9cb8adc9f667bc6826cbea8e260e4bff28a5ec19d38d1fc019db3cfaf310e764d78619cb27fb17af05a0e8ae831ce8413721e71138e62cc4ad8e7974d1506b4fb581c549a3dd7b7ef44ac37201aa3bce6f37f648d781bcb4f329fd45ffa640f1b04efb38a36e0ed0e2abcb07e4ad88ae3edfb6d840d75340204243d0e1c1c3139823b0d5ad196430bf4566619a1a97df4376a7e9a9e9c1d97b9f773c921778f2cb5165c02da1423305c502076177e4af50cb3343c10b01b78e3fe5520bdfae2b3dbe42db0f0eb55bbcb19038018d45ccdb8b0df400085a02c61b033f430fb6a7408e090c65798bc49d35e049d276fd1952d2b3dfd92a2548411e21be26216fe68fc3cf1c6625031260153708a53255b3d3d0411d5f0e8ab2102a97e539c34e9c769a7dafb87c5918deb59ef05e928c2c52775de467fa843cbcdabc290097eeb2ee7c58d86e3fccc39a5b694c18a4cc0d6af1e61d9c69e6466bc0cbef15365109e4f67a6268625f8c3f358fb7d567cbea52e1bc289bd8effda4e362a729e8cd3064970b97e3f72535d9ba88e97a14834cfd8dc86b5d2f9b35425a4162e6abe8b785ef462883e716c91b8eb281d81f68f606f16fcbc5cddfdec3b515818a647d86a4c17bae6ad525e95598052c49cdee821ceb45b2350dda13628db0dd266f30285241a2b147d65113b8ed3665a3451f7a56cf430ec98aeac702d9b9f776d97520a9d039e5b2fff34ac4d4e0a32e1f35c8f38e4f4fe1b3212a70f185ad71ec86b8c9"}, 0x418}) 1.392795991s ago: executing program 2 (id=2659): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000000c0)={0x25000, 0x9000}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000200)={0xdddd0000, 0x103000}) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r1, 0x4010ae68, &(0x7f0000000040)={0xfffffffffffff001, 0x10000}) 823.181156ms ago: executing program 1 (id=2660): landlock_create_ruleset(&(0x7f0000000140)={0x0, 0x3, 0x6}, 0xfffffffffffffeae, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDFONTOP_SET(r0, 0x4b72, &(0x7f0000000500)={0x4, 0xfffffffb, 0x3, 0x60, 0x5c, 0x0}) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) sendmmsg$inet(r1, &(0x7f0000000b00)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000}}, {{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000800)="d3948fce447ef0e7ce2c9fb33e6d8dc20b24a5ad79e0b872c37a19ffef633feb1d792a604188631824e9f3cee46bf10f1201be80410e47fea7513326379c317254b05a453981f29c85d70b22be88ea40873cb5553343ad63d41b3a8a6fcd55019aef60cfae997dd4c31fe8409b1a4b5d4de5d7028ead003d5b805f2e31901d06", 0x80}], 0x1}}], 0x2, 0x44000) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080), 0x105101, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x7, 0x4, 0x8, 0x8}, 0x48) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000100)={r2, 0x0, 0x0}, 0x20) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x50032, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="680000001000010028bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="68c5000000000000140003006e657464657673696d3000000000000034001680300001802c000c80140001"], 0x68}, 0x1, 0x0, 0x0, 0x1}, 0x200088c4) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000000) socket$caif_seqpacket(0x25, 0x5, 0x3) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, 0x0, 0x51) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) 373.259559ms ago: executing program 1 (id=2661): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xd) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x6, &(0x7f0000006680)) socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x800, 0xffffffff, 0xbfdffffc}, &(0x7f0000000000), &(0x7f0000000280)) io_uring_enter(r3, 0x47f6, 0x0, 0x2, 0x0, 0x300) syz_io_uring_setup(0x3ab0, &(0x7f0000000200)={0x0, 0xeeaf, 0x1000, 0x3, 0x16e, 0x0, r3}, &(0x7f0000000280), &(0x7f00000002c0)) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) r4 = fsopen(&(0x7f0000000340)='omfs\x00', 0x1) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r5, 0x3ba0, &(0x7f0000000380)={0x48, 0x16, 0x0, 0x0, 0xe160, 0x0, 0x0}) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f00000001c0)='source', &(0x7f0000000100)='%\xff:2\x82|\x9a\xe0\xadA\xde\xd5\x03\x00\x00\x00\xb7\xe5\xee:\xb5\x0e\xec\xe5\xdc\xe5\x8d?\x16BE\x8b\xe8)\xa9H\x99\x10\x02q\xf7\xd3\xc5*\x15\xdf_\xb2_`\x92|\x7f\xff9\xf7o$e&1\xfd\xea\xb0\xb0', 0x0) r6 = userfaultfd(0x1) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f00000000c0)) ioctl$SNDCTL_DSP_CHANNELS(0xffffffffffffffff, 0xc0045006, &(0x7f0000000180)=0x6f) r7 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$SNDCTL_DSP_SPEED(r7, 0xc0045002, &(0x7f00000001c0)=0x2) read$FUSE(r7, &(0x7f00000063c0)={0x2020}, 0x2020) 313.415859ms ago: executing program 2 (id=2662): r0 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x0, 0x0, 0x0) 0s ago: executing program 2 (id=2663): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes256\x00'}, 0x58) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000040)=0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r3 = dup(r2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r3, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r4 = socket$kcm(0x29, 0x5, 0x0) syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000780)=@gettfilter={0x2c, 0x2e, 0x400, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xe, 0x7}, {0x3, 0x8}, {0x9, 0x61af5a3e09aa3ecb}}, [{0x8, 0xb, 0x6}]}, 0x2c}, 0x1, 0x0, 0x0, 0x54}, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000007e40)=[{0x0, 0x0, &(0x7f0000003740)=[{&(0x7f00000000c0)="4789d3aefc1a4d03345aed327be33c", 0xf}], 0x1, 0x0, 0x0, 0x20000000}], 0x1, 0x20040894) socket$kcm(0x10, 0x2, 0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0xa, 0x0, 0x0, 0x7fff0000}]}) keyctl$describe(0x6, 0x0, &(0x7f0000000340)=""/100, 0x64) write$cgroup_pressure(r4, &(0x7f0000000140)={'full'}, 0xfffffdef) sendmmsg(r4, &(0x7f0000001a40), 0x0, 0x40044) syz_usb_connect(0x0, 0x24, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x3, r1, 0x2, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TIMEOUT={0xb, 0x22, 0x0, 0x0, 0x4000, &(0x7f00000001c0)={0x0, 0x989680}, 0x1, 0x12}) kernel console output (not intermixed with test programs): use nl80211 [ 147.703628][ T7432] Zero length message leads to an empty skb [ 151.939484][ T7545] netlink: 'syz.1.646': attribute type 28 has an invalid length. [ 151.939506][ T7545] netlink: 4 bytes leftover after parsing attributes in process `syz.1.646'. [ 154.523459][ T7601] netlink: 156 bytes leftover after parsing attributes in process `syz.2.671'. [ 154.523746][ T7601] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 156.013146][ T7670] netlink: 68 bytes leftover after parsing attributes in process `syz.3.681'. [ 157.698603][ T7716] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 157.715558][ T7717] netlink: 14 bytes leftover after parsing attributes in process `syz.1.702'. [ 157.761899][ T7716] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 157.924230][ T7717] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 158.046218][ T7717] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 158.141211][ T7717] bond0 (unregistering): Released all slaves [ 158.292591][ T5803] syz1: Port: 1 Link DOWN [ 159.258017][ T7759] netlink: 16 bytes leftover after parsing attributes in process `syz.2.720'. [ 159.376459][ T7761] netlink: 12 bytes leftover after parsing attributes in process `syz.1.721'. [ 160.778606][ T7807] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 161.461542][ T7831] netlink: 'syz.0.752': attribute type 2 has an invalid length. [ 161.461570][ T7831] tipc: Started in network mode [ 161.461584][ T7831] tipc: Node identity 1340008, cluster identity 4711 [ 161.461593][ T7831] tipc: Node number set to 20185096 [ 162.299383][ T7863] netlink: 16 bytes leftover after parsing attributes in process `syz.3.755'. [ 172.954590][ T7871] netlink: 'syz.0.769': attribute type 2 has an invalid length. [ 173.213977][ T7917] netlink: 56 bytes leftover after parsing attributes in process `syz.0.790'. [ 173.951720][ T7951] netlink: 56 bytes leftover after parsing attributes in process `syz.1.805'. [ 174.162629][ T7962] netlink: 12 bytes leftover after parsing attributes in process `syz.3.810'. [ 176.200219][ T8029] netlink: 'syz.1.835': attribute type 28 has an invalid length. [ 176.200241][ T8029] netlink: 4 bytes leftover after parsing attributes in process `syz.1.835'. [ 178.215088][ T8110] netlink: 32 bytes leftover after parsing attributes in process `syz.0.854'. [ 178.321761][ T8105] netlink: 40 bytes leftover after parsing attributes in process `syz.0.854'. [ 181.543058][ T5850] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 181.720050][ T5850] usb 1-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 181.720079][ T5850] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 181.720095][ T5850] usb 1-1: Product: syz [ 181.720107][ T5850] usb 1-1: Manufacturer: syz [ 181.720119][ T5850] usb 1-1: SerialNumber: syz [ 181.786285][ T8229] 9p: Bad value for 'rfdno' [ 182.051014][ T5883] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 182.144421][ T8217] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 182.188131][ T5850] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 182.188166][ T5850] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPROTO [ 182.190115][ T5850] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 182.190153][ T5850] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 182.191024][ T5850] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 182.249994][ T5883] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 182.250015][ T5883] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 182.250036][ T5883] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 182.250047][ T5883] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 182.309204][ T8234] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 182.327242][ T5883] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 182.357171][ T5850] lan78xx 1-1:1.0: probe with driver lan78xx failed with error -71 [ 182.406102][ T8240] netlink: 32 bytes leftover after parsing attributes in process `syz.1.890'. [ 182.409006][ T8240] netlink: 40 bytes leftover after parsing attributes in process `syz.1.890'. [ 182.418917][ T8245] netlink: 68 bytes leftover after parsing attributes in process `syz.2.892'. [ 182.712375][ T8249] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 182.733701][ T8249] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 182.737168][ T5850] usb 1-1: USB disconnect, device number 2 [ 182.955466][ T8252] netlink: 4 bytes leftover after parsing attributes in process `syz.3.893'. [ 183.075572][ T5883] usb 5-1: USB disconnect, device number 3 [ 183.412986][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 183.713689][ T8287] netlink: 68 bytes leftover after parsing attributes in process `syz.2.898'. [ 184.903156][ T8310] netlink: 68 bytes leftover after parsing attributes in process `syz.3.908'. [ 185.253155][ T5803] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 185.415312][ T5803] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 185.415417][ T5803] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 185.415453][ T5803] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 185.415472][ T5803] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 185.479615][ T8317] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 185.506084][ T5803] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 185.693123][ T8343] netlink: 68 bytes leftover after parsing attributes in process `syz.0.918'. [ 185.816310][ T8317] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 185.818057][ T8317] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 185.861996][ T5886] usb 5-1: USB disconnect, device number 4 [ 186.775577][ T8387] netlink: 68 bytes leftover after parsing attributes in process `syz.4.929'. [ 187.450087][ T8411] netlink: 156 bytes leftover after parsing attributes in process `syz.1.939'. [ 187.450122][ T8411] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 188.033852][ T8429] Illegal XDP return value 90233392 on prog (id 42) dev N/A, expect packet loss! [ 189.658145][ T8481] netlink: 136 bytes leftover after parsing attributes in process `syz.3.967'. [ 190.723553][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 190.883056][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 191.263170][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 192.082838][ T37] kauditd_printk_skb: 236 callbacks suppressed [ 192.082855][ T37] audit: type=1326 audit(1773066283.177:249): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8537 comm="syz.2.988" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f91108dc799 code=0x0 [ 192.428255][ T8545] kvm: kvm [8543]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc1) = 0xfff600000000 [ 192.575582][ T8558] netlink: 12 bytes leftover after parsing attributes in process `syz.3.993'. [ 192.770190][ T8566] process 'syz.0.997' launched '/dev/fd/4' with NULL argv: empty string added [ 194.501872][ T1319] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.504576][ T1319] ieee802154 phy1 wpan1: encryption failed: -22 [ 195.213493][ T8620] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1009'. [ 195.853952][ T8635] netlink: 'syz.0.1014': attribute type 2 has an invalid length. [ 196.626094][ T8651] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1022'. [ 197.285377][ T8660] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1026'. [ 197.290429][ T8660] bridge0: port 2(bridge_slave_1) entered disabled state [ 197.302873][ T8660] bridge0: port 1(bridge_slave_0) entered disabled state [ 197.351700][ T8661] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1026'. [ 197.722992][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 197.951828][ T8679] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1033'. [ 199.132162][ T8711] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1047'. [ 201.475247][ T8754] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1060'. [ 202.061121][ T5816] Bluetooth: hci2: command 0x0406 tx timeout [ 202.061163][ T5816] Bluetooth: hci0: command 0x0406 tx timeout [ 202.062380][ T5816] Bluetooth: hci1: command 0x0406 tx timeout [ 202.068168][ T5816] Bluetooth: hci3: command 0x0405 tx timeout [ 202.068264][ T5816] Bluetooth: hci4: command 0x0406 tx timeout [ 202.197783][ T8755] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1063'. [ 204.061281][ T8785] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1074'. [ 204.073038][ T5803] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 204.152368][ T8788] netlink: 'syz.4.1075': attribute type 2 has an invalid length. [ 204.152389][ T8788] tipc: Started in network mode [ 204.152402][ T8788] tipc: Node identity 1340008, cluster identity 4711 [ 204.152412][ T8788] tipc: Node number set to 20185096 [ 204.223291][ T5803] usb 1-1: Using ep0 maxpacket: 8 [ 204.229349][ T5803] usb 1-1: config 0 has an invalid interface number: 138 but max is 0 [ 204.229375][ T5803] usb 1-1: config 0 has no interface number 0 [ 204.229403][ T5803] usb 1-1: too many endpoints for config 0 interface 138 altsetting 143: 95, using maximum allowed: 30 [ 204.229437][ T5803] usb 1-1: config 0 interface 138 altsetting 143 has 0 endpoint descriptors, different from the interface descriptor's value: 95 [ 204.229461][ T5803] usb 1-1: config 0 interface 138 has no altsetting 0 [ 204.231885][ T5803] usb 1-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 204.231911][ T5803] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 204.231929][ T5803] usb 1-1: Product: syz [ 204.231941][ T5803] usb 1-1: Manufacturer: syz [ 204.231953][ T5803] usb 1-1: SerialNumber: syz [ 204.234180][ T8794] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1078'. [ 204.253983][ T5803] usb 1-1: config 0 descriptor?? [ 204.488361][ T5803] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 204.513083][ T5803] gspca_sonixj: reg_w1 err -71 [ 204.513192][ T5803] sonixj 1-1:0.138: probe with driver sonixj failed with error -71 [ 204.602247][ T5803] usb 1-1: USB disconnect, device number 3 [ 205.759021][ T8818] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1087'. [ 206.663387][ T8822] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.1088'. [ 206.707885][ T8826] netlink: 'syz.4.1089': attribute type 2 has an invalid length. [ 207.173071][ T31] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 207.176285][ T8840] IPv6: NLM_F_CREATE should be specified when creating new route [ 207.179354][ T8840] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1095'. [ 207.505801][ T31] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 207.505836][ T31] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 207.505872][ T31] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 207.505893][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 208.181802][ T8830] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 208.377054][ T31] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 208.431053][ T8830] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 208.441126][ T8830] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 208.579808][ T31] usb 3-1: USB disconnect, device number 3 [ 208.645825][ T8853] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1099'. [ 208.663972][ T7912] udevd[7912]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 208.905595][ T8853] 8021q: adding VLAN 0 to HW filter on device bond1 [ 208.948771][ T8856] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 208.948848][ T8858] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.1101'. [ 209.008318][ T13] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 209.168281][ T13] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 211.053196][ T5803] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 211.204915][ T5803] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 211.204948][ T5803] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 211.204981][ T5803] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 211.205000][ T5803] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 211.257865][ T8893] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 211.283677][ T5803] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 211.489328][ T8893] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 211.515259][ T8893] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 211.579380][ T5887] usb 2-1: USB disconnect, device number 3 [ 215.355184][ T8970] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1146'. [ 215.444290][ T8970] 8021q: adding VLAN 0 to HW filter on device bond0 [ 215.492095][ T8979] bond0: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 215.543149][ T68] bond0: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 215.676085][ T68] bond0: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 215.723057][ T5876] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 215.877690][ T5876] usb 4-1: config 0 has an invalid interface number: 152 but max is 3 [ 215.877717][ T5876] usb 4-1: config 0 has an invalid interface number: 188 but max is 3 [ 215.877735][ T5876] usb 4-1: config 0 has an invalid interface number: 36 but max is 3 [ 215.877753][ T5876] usb 4-1: config 0 contains an unexpected descriptor of type 0x2, skipping [ 215.877769][ T5876] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 215.877866][ T5876] usb 4-1: config 0 has 3 interfaces, different from the descriptor's value: 4 [ 215.877884][ T5876] usb 4-1: config 0 has no interface number 0 [ 215.877898][ T5876] usb 4-1: config 0 has no interface number 1 [ 215.877912][ T5876] usb 4-1: config 0 has no interface number 2 [ 215.877976][ T5876] usb 4-1: config 0 interface 152 altsetting 159 endpoint 0x3 has invalid maxpacket 1023, setting to 64 [ 215.878001][ T5876] usb 4-1: config 0 interface 152 altsetting 159 has an invalid descriptor for endpoint zero, skipping [ 215.878021][ T5876] usb 4-1: config 0 interface 152 altsetting 159 has an invalid descriptor for endpoint zero, skipping [ 215.878041][ T5876] usb 4-1: config 0 interface 152 altsetting 159 endpoint 0x4 has invalid maxpacket 536, setting to 64 [ 215.878062][ T5876] usb 4-1: config 0 interface 152 altsetting 159 has a duplicate endpoint with address 0x3, skipping [ 215.878082][ T5876] usb 4-1: config 0 interface 152 altsetting 159 has a duplicate endpoint with address 0xD, skipping [ 215.878114][ T5876] usb 4-1: config 0 interface 188 altsetting 0 endpoint 0x8 has invalid maxpacket 1128, setting to 64 [ 215.878136][ T5876] usb 4-1: config 0 interface 188 altsetting 0 endpoint 0xE has invalid maxpacket 1023, setting to 64 [ 215.878272][ T5876] usb 4-1: config 0 interface 188 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 215.878291][ T5876] usb 4-1: config 0 interface 188 altsetting 0 has a duplicate endpoint with address 0xD, skipping [ 215.878311][ T5876] usb 4-1: config 0 interface 188 altsetting 0 has a duplicate endpoint with address 0xE, skipping [ 215.878331][ T5876] usb 4-1: config 0 interface 188 altsetting 0 has a duplicate endpoint with address 0x3, skipping [ 215.878364][ T5876] usb 4-1: config 0 interface 36 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 215.878382][ T5876] usb 4-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0x8, skipping [ 215.878400][ T5876] usb 4-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0x2, skipping [ 215.878421][ T5876] usb 4-1: config 0 interface 36 altsetting 0 endpoint 0x7 has invalid maxpacket 1023, setting to 64 [ 215.878443][ T5876] usb 4-1: config 0 interface 36 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 215.878462][ T5876] usb 4-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0x3, skipping [ 215.878480][ T5876] usb 4-1: config 0 interface 36 altsetting 0 has an endpoint descriptor with address 0x49, changing to 0x9 [ 215.878500][ T5876] usb 4-1: config 0 interface 36 altsetting 0 endpoint 0x9 has invalid maxpacket 25842, setting to 1024 [ 215.878523][ T5876] usb 4-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0xE, skipping [ 215.878541][ T5876] usb 4-1: config 0 interface 36 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 215.878563][ T5876] usb 4-1: config 0 interface 36 altsetting 0 has 10 endpoint descriptors, different from the interface descriptor's value: 16 [ 215.878584][ T5876] usb 4-1: config 0 interface 152 has no altsetting 0 [ 215.945886][ T5876] usb 4-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=e7.6d [ 215.945915][ T5876] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 215.945933][ T5876] usb 4-1: Product: syz [ 215.945946][ T5876] usb 4-1: Manufacturer: syz [ 215.945958][ T5876] usb 4-1: SerialNumber: syz [ 216.569635][ T5876] usb 4-1: config 0 descriptor?? [ 216.986419][ T8982] Invalid option length (0) for dns_resolver key [ 217.016563][ T5876] f81534 4-1:0.152: required endpoints missing [ 217.898209][ T8982] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 217.898767][ T8982] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 217.899907][ T8982] capability: warning: `syz.3.1150' uses 32-bit capabilities (legacy support in use) [ 217.900109][ T8982] capability: warning: `syz.3.1150' uses deprecated v2 capabilities in a way that may be insecure [ 217.946764][ T5876] f81534 4-1:0.188: required endpoints missing [ 217.972885][ T5876] f81534 4-1:0.36: required endpoints missing [ 217.991428][ T5876] usb 4-1: USB disconnect, device number 2 [ 219.884684][ T9032] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1165'. [ 222.683089][ T5876] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 222.848849][ T5876] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 222.848882][ T5876] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 222.848919][ T5876] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 222.848940][ T5876] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 222.989154][ T9105] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 223.015887][ T5876] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 223.583482][ T5876] usb 5-1: USB disconnect, device number 5 [ 224.429939][ T68] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 224.548181][ T9149] netlink: 188 bytes leftover after parsing attributes in process `syz.1.1214'. [ 224.578740][ T60] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 224.593372][ T60] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 224.599086][ T60] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 224.614408][ T60] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 224.621507][ T60] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 226.596848][ T68] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 227.200410][ T60] Bluetooth: hci3: command tx timeout [ 227.417476][ T9176] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1223'. [ 227.664424][ T9186] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1227'. [ 227.818320][ T68] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 228.034640][ T9186] bond0: option mode: unable to set because the bond device has slaves [ 229.273252][ T60] Bluetooth: hci3: command tx timeout [ 229.350842][ T68] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 229.550495][ T9221] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1241'. [ 229.598042][ T9221] 8021q: adding VLAN 0 to HW filter on device bond1 [ 230.134063][ T9145] chnl_net:caif_netlink_parms(): no params data found [ 231.353159][ T60] Bluetooth: hci3: command tx timeout [ 231.411335][ T68] bridge_slave_1: left allmulticast mode [ 231.411533][ T68] bridge_slave_1: left promiscuous mode [ 231.454759][ T68] bridge0: port 2(bridge_slave_1) entered disabled state [ 231.537321][ T68] bridge_slave_0: left allmulticast mode [ 231.537350][ T68] bridge_slave_0: left promiscuous mode [ 231.538355][ T68] bridge0: port 1(bridge_slave_0) entered disabled state [ 233.432979][ T60] Bluetooth: hci3: command tx timeout [ 233.588131][ T68] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 233.680016][ T68] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 233.698298][ T68] bond0 (unregistering): Released all slaves [ 234.057144][ T9145] bridge0: port 1(bridge_slave_0) entered blocking state [ 234.057271][ T9145] bridge0: port 1(bridge_slave_0) entered disabled state [ 234.057485][ T9145] bridge_slave_0: entered allmulticast mode [ 234.059916][ T9145] bridge_slave_0: entered promiscuous mode [ 234.095340][ T9145] bridge0: port 2(bridge_slave_1) entered blocking state [ 234.095531][ T9145] bridge0: port 2(bridge_slave_1) entered disabled state [ 234.095755][ T9145] bridge_slave_1: entered allmulticast mode [ 234.127549][ T9145] bridge_slave_1: entered promiscuous mode [ 234.434347][ T9145] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 234.454121][ T9145] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 234.887557][ T9316] input: syz1 as /devices/virtual/input/input5 [ 235.072961][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 235.102954][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 235.313074][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 235.592962][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 235.881996][ T9329] Invalid logical block size (8192) [ 236.007986][ T9319] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 236.085291][ T9145] team0: Port device team_slave_0 added [ 236.115525][ T9145] team0: Port device team_slave_1 added [ 236.680857][ T9145] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 236.680873][ T9145] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 236.680896][ T9145] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 236.773105][ T9349] macvlan1: entered promiscuous mode [ 236.807288][ T9351] veth1_vlan: entered allmulticast mode [ 236.811982][ T9145] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 236.811999][ T9145] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 236.812031][ T9145] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 237.343077][ T68] hsr_slave_0: left promiscuous mode [ 237.383503][ T68] hsr_slave_1: left promiscuous mode [ 237.385215][ T68] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 237.385294][ T68] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 237.448997][ T68] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 237.449016][ T68] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 237.545075][ T5887] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 237.585006][ T68] veth1_macvtap: left promiscuous mode [ 237.585163][ T68] veth0_macvtap: left promiscuous mode [ 237.585316][ T68] veth1_vlan: left promiscuous mode [ 237.585484][ T68] veth0_vlan: left promiscuous mode [ 237.695067][ T5887] usb 1-1: config 0 has an invalid interface number: 152 but max is 3 [ 237.695095][ T5887] usb 1-1: config 0 has an invalid interface number: 188 but max is 3 [ 237.695113][ T5887] usb 1-1: config 0 has an invalid interface number: 36 but max is 3 [ 237.695130][ T5887] usb 1-1: config 0 contains an unexpected descriptor of type 0x2, skipping [ 237.695146][ T5887] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 237.695161][ T5887] usb 1-1: config 0 has 3 interfaces, different from the descriptor's value: 4 [ 237.695177][ T5887] usb 1-1: config 0 has no interface number 0 [ 237.695190][ T5887] usb 1-1: config 0 has no interface number 1 [ 237.695203][ T5887] usb 1-1: config 0 has no interface number 2 [ 237.695247][ T5887] usb 1-1: config 0 interface 152 altsetting 159 endpoint 0x3 has invalid maxpacket 1023, setting to 64 [ 237.695260][ T5887] usb 1-1: config 0 interface 152 altsetting 159 has an invalid descriptor for endpoint zero, skipping [ 237.695271][ T5887] usb 1-1: config 0 interface 152 altsetting 159 has an invalid descriptor for endpoint zero, skipping [ 237.695281][ T5887] usb 1-1: config 0 interface 152 altsetting 159 endpoint 0x4 has invalid maxpacket 536, setting to 64 [ 237.695293][ T5887] usb 1-1: config 0 interface 152 altsetting 159 has a duplicate endpoint with address 0x3, skipping [ 237.695304][ T5887] usb 1-1: config 0 interface 152 altsetting 159 has a duplicate endpoint with address 0xD, skipping [ 237.695321][ T5887] usb 1-1: config 0 interface 188 altsetting 0 endpoint 0x8 has invalid maxpacket 1128, setting to 64 [ 237.695333][ T5887] usb 1-1: config 0 interface 188 altsetting 0 endpoint 0xE has invalid maxpacket 1023, setting to 64 [ 237.695345][ T5887] usb 1-1: config 0 interface 188 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 237.695354][ T5887] usb 1-1: config 0 interface 188 altsetting 0 has a duplicate endpoint with address 0xD, skipping [ 237.695365][ T5887] usb 1-1: config 0 interface 188 altsetting 0 has a duplicate endpoint with address 0xE, skipping [ 237.695375][ T5887] usb 1-1: config 0 interface 188 altsetting 0 has a duplicate endpoint with address 0x3, skipping [ 237.695392][ T5887] usb 1-1: config 0 interface 36 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 237.695402][ T5887] usb 1-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0x8, skipping [ 237.695412][ T5887] usb 1-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0x2, skipping [ 237.695422][ T5887] usb 1-1: config 0 interface 36 altsetting 0 endpoint 0x7 has invalid maxpacket 1023, setting to 64 [ 237.695434][ T5887] usb 1-1: config 0 interface 36 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 237.695443][ T5887] usb 1-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0x3, skipping [ 237.695453][ T5887] usb 1-1: config 0 interface 36 altsetting 0 has an endpoint descriptor with address 0x49, changing to 0x9 [ 237.695464][ T5887] usb 1-1: config 0 interface 36 altsetting 0 endpoint 0x9 has invalid maxpacket 25842, setting to 1024 [ 237.695490][ T5887] usb 1-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0xE, skipping [ 237.695502][ T5887] usb 1-1: config 0 interface 36 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 237.695513][ T5887] usb 1-1: config 0 interface 36 altsetting 0 has 10 endpoint descriptors, different from the interface descriptor's value: 16 [ 237.695526][ T5887] usb 1-1: config 0 interface 152 has no altsetting 0 [ 237.697816][ T5887] usb 1-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=e7.6d [ 237.697843][ T5887] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 237.697859][ T5887] usb 1-1: Product: syz [ 237.697870][ T5887] usb 1-1: Manufacturer: syz [ 237.697881][ T5887] usb 1-1: SerialNumber: syz [ 237.818897][ T5887] usb 1-1: config 0 descriptor?? [ 238.112311][ T9372] Invalid option length (0) for dns_resolver key [ 238.158073][ T5887] f81534 1-1:0.152: required endpoints missing [ 238.362397][ T9372] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 238.372637][ T9372] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 238.410074][ T5887] f81534 1-1:0.188: required endpoints missing [ 238.421203][ T5887] f81534 1-1:0.36: required endpoints missing [ 238.433296][ T5887] usb 1-1: USB disconnect, device number 4 [ 238.854009][ T68] team0 (unregistering): Port device team_slave_1 removed [ 238.885023][ T68] team0 (unregistering): Port device team_slave_0 removed [ 239.294931][ T9383] veth1_vlan: entered allmulticast mode [ 239.311913][ T9384] macvlan1: entered promiscuous mode [ 239.312041][ T9384] macvlan1: entered allmulticast mode [ 239.688633][ T9145] hsr_slave_0: entered promiscuous mode [ 239.689439][ T9145] hsr_slave_1: entered promiscuous mode [ 239.689931][ T9145] debugfs: 'hsr0' already exists in 'hsr' [ 239.689946][ T9145] Cannot create hsr debugfs directory [ 239.794747][ T5886] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 240.083075][ T9402] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 240.118286][ T5886] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 240.118315][ T5886] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 240.118333][ T5886] usb 5-1: Product: syz [ 240.118345][ T5886] usb 5-1: Manufacturer: syz [ 240.118357][ T5886] usb 5-1: SerialNumber: syz [ 240.657372][ T9420] netlink: 'syz.2.1309': attribute type 2 has an invalid length. [ 240.690327][ T5886] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 240.690386][ T5886] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPROTO [ 240.690804][ T5886] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 240.690849][ T5886] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 240.691572][ T5886] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 240.790875][ T5886] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -71 [ 240.870806][ T5886] usb 5-1: USB disconnect, device number 6 [ 241.807149][ T9145] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 241.845245][ T9145] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 241.883773][ T9145] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 241.927087][ T9145] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 242.317136][ T9145] 8021q: adding VLAN 0 to HW filter on device bond0 [ 242.433878][ T9145] 8021q: adding VLAN 0 to HW filter on device team0 [ 242.450079][ T3487] bridge0: port 1(bridge_slave_0) entered blocking state [ 242.456165][ T3487] bridge0: port 1(bridge_slave_0) entered forwarding state [ 242.478184][ T3508] bridge0: port 2(bridge_slave_1) entered blocking state [ 242.482570][ T3508] bridge0: port 2(bridge_slave_1) entered forwarding state [ 242.668208][ T9480] netlink: 'syz.1.1321': attribute type 2 has an invalid length. [ 243.013668][ T9489] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1324'. [ 243.543893][ T9496] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1323'. [ 244.262776][ T9145] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 244.293307][ T5886] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 244.485928][ T5886] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 244.485956][ T5886] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 244.485973][ T5886] usb 2-1: Product: syz [ 244.485985][ T5886] usb 2-1: Manufacturer: syz [ 244.485998][ T5886] usb 2-1: SerialNumber: syz [ 244.650098][ T9515] netlink: 'syz.4.1329': attribute type 1 has an invalid length. [ 244.872189][ T9515] 8021q: adding VLAN 0 to HW filter on device bond1 [ 245.005625][ T5886] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 245.005681][ T5886] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPROTO [ 245.006106][ T5886] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 245.006154][ T5886] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 245.006939][ T5886] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 245.097214][ T5886] lan78xx 2-1:1.0: probe with driver lan78xx failed with error -71 [ 245.120953][ T5886] usb 2-1: USB disconnect, device number 4 [ 245.230539][ T60] Bluetooth: Frame is too long (len 74, expected len 4) [ 245.341309][ T9145] veth0_vlan: entered promiscuous mode [ 245.385395][ T9145] veth1_vlan: entered promiscuous mode [ 245.464305][ T9145] veth0_macvtap: entered promiscuous mode [ 245.492109][ T9145] veth1_macvtap: entered promiscuous mode [ 245.573731][ T9145] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 245.603702][ T9145] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 245.656072][ T8280] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 245.683150][ T8280] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 245.693208][ T8280] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 245.722734][ T68] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 245.723471][ T9539] netlink: 'syz.1.1334': attribute type 2 has an invalid length. [ 245.781157][ T9544] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1335'. [ 245.880493][ T9544] : entered promiscuous mode [ 246.135604][ T3508] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 246.135636][ T3508] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 246.532971][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 246.791836][ T9555] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 246.966383][ T1553] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 246.966404][ T1553] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 247.094347][ T9564] Invalid logical block size (8192) [ 247.786377][ T9579] netlink: 'syz.2.1345': attribute type 2 has an invalid length. [ 247.786409][ T9579] tipc: Started in network mode [ 247.786422][ T9579] tipc: Node identity 1340008, cluster identity 4711 [ 247.786433][ T9579] tipc: Node number set to 20185096 [ 248.475299][ T9597] overlayfs: failed to resolve './file0': -2 [ 250.424143][ T9614] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1352'. [ 255.758169][ T1319] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.758234][ T1319] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.054868][ T9775] netlink: 136 bytes leftover after parsing attributes in process `syz.0.1408'. [ 256.455597][ T9787] binder: BINDER_SET_CONTEXT_MGR already set [ 256.455612][ T9787] binder: 9786:9787 ioctl 4018620d 200000004a80 returned -16 [ 257.595534][ T9817] fuse: Bad value for 'fd' [ 261.156293][ T9876] fuse: Bad value for 'user_id' [ 261.156313][ T9876] fuse: Bad value for 'user_id' [ 261.253060][ T5886] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 261.405839][ T5886] usb 5-1: config 0 has an invalid interface number: 152 but max is 3 [ 261.405865][ T5886] usb 5-1: config 0 has an invalid interface number: 188 but max is 3 [ 261.405883][ T5886] usb 5-1: config 0 has an invalid interface number: 36 but max is 3 [ 261.405902][ T5886] usb 5-1: config 0 contains an unexpected descriptor of type 0x2, skipping [ 261.405918][ T5886] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 261.405939][ T5886] usb 5-1: config 0 has 3 interfaces, different from the descriptor's value: 4 [ 261.405964][ T5886] usb 5-1: config 0 has no interface number 0 [ 261.405978][ T5886] usb 5-1: config 0 has no interface number 1 [ 261.405992][ T5886] usb 5-1: config 0 has no interface number 2 [ 261.406057][ T5886] usb 5-1: config 0 interface 152 altsetting 159 endpoint 0x3 has invalid maxpacket 1023, setting to 64 [ 261.406082][ T5886] usb 5-1: config 0 interface 152 altsetting 159 has an invalid descriptor for endpoint zero, skipping [ 261.406102][ T5886] usb 5-1: config 0 interface 152 altsetting 159 has an invalid descriptor for endpoint zero, skipping [ 261.406121][ T5886] usb 5-1: config 0 interface 152 altsetting 159 endpoint 0x4 has invalid maxpacket 536, setting to 64 [ 261.406144][ T5886] usb 5-1: config 0 interface 152 altsetting 159 has a duplicate endpoint with address 0x3, skipping [ 261.406165][ T5886] usb 5-1: config 0 interface 152 altsetting 159 has a duplicate endpoint with address 0xD, skipping [ 261.406199][ T5886] usb 5-1: config 0 interface 188 altsetting 0 endpoint 0x8 has invalid maxpacket 1128, setting to 64 [ 261.406222][ T5886] usb 5-1: config 0 interface 188 altsetting 0 endpoint 0xE has invalid maxpacket 1023, setting to 64 [ 261.406245][ T5886] usb 5-1: config 0 interface 188 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 261.406263][ T5886] usb 5-1: config 0 interface 188 altsetting 0 has a duplicate endpoint with address 0xD, skipping [ 261.406282][ T5886] usb 5-1: config 0 interface 188 altsetting 0 has a duplicate endpoint with address 0xE, skipping [ 261.406301][ T5886] usb 5-1: config 0 interface 188 altsetting 0 has a duplicate endpoint with address 0x3, skipping [ 261.406344][ T5886] usb 5-1: config 0 interface 36 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 261.406363][ T5886] usb 5-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0x8, skipping [ 261.406382][ T5886] usb 5-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0x2, skipping [ 261.406402][ T5886] usb 5-1: config 0 interface 36 altsetting 0 endpoint 0x7 has invalid maxpacket 1023, setting to 64 [ 261.406424][ T5886] usb 5-1: config 0 interface 36 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 261.406443][ T5886] usb 5-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0x3, skipping [ 261.406463][ T5886] usb 5-1: config 0 interface 36 altsetting 0 has an endpoint descriptor with address 0x49, changing to 0x9 [ 261.406486][ T5886] usb 5-1: config 0 interface 36 altsetting 0 endpoint 0x9 has invalid maxpacket 25842, setting to 1024 [ 261.406509][ T5886] usb 5-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0xE, skipping [ 261.406530][ T5886] usb 5-1: config 0 interface 36 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 261.406552][ T5886] usb 5-1: config 0 interface 36 altsetting 0 has 10 endpoint descriptors, different from the interface descriptor's value: 16 [ 261.406575][ T5886] usb 5-1: config 0 interface 152 has no altsetting 0 [ 261.409797][ T5886] usb 5-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=e7.6d [ 261.409824][ T5886] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 261.409841][ T5886] usb 5-1: Product: syz [ 261.409854][ T5886] usb 5-1: Manufacturer: syz [ 261.409866][ T5886] usb 5-1: SerialNumber: syz [ 262.571859][ T5886] usb 5-1: config 0 descriptor?? [ 262.873602][ T9872] Invalid option length (0) for dns_resolver key [ 263.013987][ T5886] f81534 5-1:0.152: required endpoints missing [ 263.457975][ T9872] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 263.479564][ T9872] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 263.610644][ T5886] f81534 5-1:0.188: required endpoints missing [ 263.628937][ T5886] f81534 5-1:0.36: required endpoints missing [ 263.674495][ T5886] usb 5-1: USB disconnect, device number 7 [ 263.899521][ T9907] netlink: 'syz.1.1444': attribute type 4 has an invalid length. [ 263.959933][ T9905] netlink: 'syz.1.1444': attribute type 4 has an invalid length. [ 266.003081][ T5886] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 266.155395][ T5886] usb 5-1: config 0 has an invalid interface number: 152 but max is 3 [ 266.155423][ T5886] usb 5-1: config 0 has an invalid interface number: 188 but max is 3 [ 266.155441][ T5886] usb 5-1: config 0 has an invalid interface number: 36 but max is 3 [ 266.155512][ T5886] usb 5-1: config 0 contains an unexpected descriptor of type 0x2, skipping [ 266.155529][ T5886] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 266.155544][ T5886] usb 5-1: config 0 has 3 interfaces, different from the descriptor's value: 4 [ 266.155562][ T5886] usb 5-1: config 0 has no interface number 0 [ 266.155576][ T5886] usb 5-1: config 0 has no interface number 1 [ 266.155590][ T5886] usb 5-1: config 0 has no interface number 2 [ 266.155655][ T5886] usb 5-1: config 0 interface 152 altsetting 159 endpoint 0x3 has invalid maxpacket 1023, setting to 64 [ 266.155688][ T5886] usb 5-1: config 0 interface 152 altsetting 159 has an invalid descriptor for endpoint zero, skipping [ 266.155707][ T5886] usb 5-1: config 0 interface 152 altsetting 159 has an invalid descriptor for endpoint zero, skipping [ 266.155726][ T5886] usb 5-1: config 0 interface 152 altsetting 159 endpoint 0x4 has invalid maxpacket 536, setting to 64 [ 266.155749][ T5886] usb 5-1: config 0 interface 152 altsetting 159 has a duplicate endpoint with address 0x3, skipping [ 266.155770][ T5886] usb 5-1: config 0 interface 152 altsetting 159 has a duplicate endpoint with address 0xD, skipping [ 266.155901][ T5886] usb 5-1: config 0 interface 188 altsetting 0 endpoint 0x8 has invalid maxpacket 1128, setting to 64 [ 266.155926][ T5886] usb 5-1: config 0 interface 188 altsetting 0 endpoint 0xE has invalid maxpacket 1023, setting to 64 [ 266.155949][ T5886] usb 5-1: config 0 interface 188 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 266.155968][ T5886] usb 5-1: config 0 interface 188 altsetting 0 has a duplicate endpoint with address 0xD, skipping [ 266.155988][ T5886] usb 5-1: config 0 interface 188 altsetting 0 has a duplicate endpoint with address 0xE, skipping [ 266.156006][ T5886] usb 5-1: config 0 interface 188 altsetting 0 has a duplicate endpoint with address 0x3, skipping [ 266.156050][ T5886] usb 5-1: config 0 interface 36 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 266.156068][ T5886] usb 5-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0x8, skipping [ 266.156088][ T5886] usb 5-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0x2, skipping [ 266.156108][ T5886] usb 5-1: config 0 interface 36 altsetting 0 endpoint 0x7 has invalid maxpacket 1023, setting to 64 [ 266.156131][ T5886] usb 5-1: config 0 interface 36 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 266.156150][ T5886] usb 5-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0x3, skipping [ 266.156169][ T5886] usb 5-1: config 0 interface 36 altsetting 0 has an endpoint descriptor with address 0x49, changing to 0x9 [ 266.156191][ T5886] usb 5-1: config 0 interface 36 altsetting 0 endpoint 0x9 has invalid maxpacket 25842, setting to 1024 [ 266.156213][ T5886] usb 5-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0xE, skipping [ 266.156232][ T5886] usb 5-1: config 0 interface 36 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 266.156253][ T5886] usb 5-1: config 0 interface 36 altsetting 0 has 10 endpoint descriptors, different from the interface descriptor's value: 16 [ 266.156276][ T5886] usb 5-1: config 0 interface 152 has no altsetting 0 [ 266.162017][ T5886] usb 5-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=e7.6d [ 266.162044][ T5886] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 266.162061][ T5886] usb 5-1: Product: syz [ 266.162074][ T5886] usb 5-1: Manufacturer: syz [ 266.162086][ T5886] usb 5-1: SerialNumber: syz [ 266.552405][ T5886] usb 5-1: config 0 descriptor?? [ 266.794363][ T9944] Invalid option length (0) for dns_resolver key [ 266.866173][ T5886] f81534 5-1:0.152: required endpoints missing [ 267.071568][ T9979] binder: BINDER_SET_CONTEXT_MGR already set [ 267.071585][ T9979] binder: 9977:9979 ioctl 4018620d 200000004a80 returned -16 [ 267.220791][ T9944] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 267.221292][ T9944] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 267.242238][ T5886] f81534 5-1:0.188: required endpoints missing [ 267.288119][ T5886] f81534 5-1:0.36: required endpoints missing [ 267.357470][ T5886] usb 5-1: USB disconnect, device number 8 [ 268.684886][T10031] Invalid logical block size (8192) [ 269.163102][ T31] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 269.345498][ T31] usb 6-1: config 0 has an invalid interface number: 152 but max is 3 [ 269.345527][ T31] usb 6-1: config 0 has an invalid interface number: 188 but max is 3 [ 269.345545][ T31] usb 6-1: config 0 has an invalid interface number: 36 but max is 3 [ 269.345562][ T31] usb 6-1: config 0 contains an unexpected descriptor of type 0x2, skipping [ 269.345580][ T31] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 269.345597][ T31] usb 6-1: config 0 has 3 interfaces, different from the descriptor's value: 4 [ 269.345615][ T31] usb 6-1: config 0 has no interface number 0 [ 269.345629][ T31] usb 6-1: config 0 has no interface number 1 [ 269.345643][ T31] usb 6-1: config 0 has no interface number 2 [ 269.345715][ T31] usb 6-1: config 0 interface 152 altsetting 159 endpoint 0x3 has invalid maxpacket 1023, setting to 64 [ 269.345741][ T31] usb 6-1: config 0 interface 152 altsetting 159 has an invalid descriptor for endpoint zero, skipping [ 269.345761][ T31] usb 6-1: config 0 interface 152 altsetting 159 has an invalid descriptor for endpoint zero, skipping [ 269.345781][ T31] usb 6-1: config 0 interface 152 altsetting 159 endpoint 0x4 has invalid maxpacket 536, setting to 64 [ 269.345804][ T31] usb 6-1: config 0 interface 152 altsetting 159 has a duplicate endpoint with address 0x3, skipping [ 269.345825][ T31] usb 6-1: config 0 interface 152 altsetting 159 has a duplicate endpoint with address 0xD, skipping [ 269.345863][ T31] usb 6-1: config 0 interface 188 altsetting 0 endpoint 0x8 has invalid maxpacket 1128, setting to 64 [ 269.345887][ T31] usb 6-1: config 0 interface 188 altsetting 0 endpoint 0xE has invalid maxpacket 1023, setting to 64 [ 269.345908][ T31] usb 6-1: config 0 interface 188 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 269.345926][ T31] usb 6-1: config 0 interface 188 altsetting 0 has a duplicate endpoint with address 0xD, skipping [ 269.345946][ T31] usb 6-1: config 0 interface 188 altsetting 0 has a duplicate endpoint with address 0xE, skipping [ 269.345964][ T31] usb 6-1: config 0 interface 188 altsetting 0 has a duplicate endpoint with address 0x3, skipping [ 269.346008][ T31] usb 6-1: config 0 interface 36 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 269.346027][ T31] usb 6-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0x8, skipping [ 269.346046][ T31] usb 6-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0x2, skipping [ 269.346065][ T31] usb 6-1: config 0 interface 36 altsetting 0 endpoint 0x7 has invalid maxpacket 1023, setting to 64 [ 269.346087][ T31] usb 6-1: config 0 interface 36 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 269.346105][ T31] usb 6-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0x3, skipping [ 269.346125][ T31] usb 6-1: config 0 interface 36 altsetting 0 has an endpoint descriptor with address 0x49, changing to 0x9 [ 269.346147][ T31] usb 6-1: config 0 interface 36 altsetting 0 endpoint 0x9 has invalid maxpacket 25842, setting to 1024 [ 269.346170][ T31] usb 6-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0xE, skipping [ 269.346190][ T31] usb 6-1: config 0 interface 36 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 269.346211][ T31] usb 6-1: config 0 interface 36 altsetting 0 has 10 endpoint descriptors, different from the interface descriptor's value: 16 [ 269.346235][ T31] usb 6-1: config 0 interface 152 has no altsetting 0 [ 269.348889][ T31] usb 6-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=e7.6d [ 269.348914][ T31] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 269.348932][ T31] usb 6-1: Product: syz [ 269.348944][ T31] usb 6-1: Manufacturer: syz [ 269.348957][ T31] usb 6-1: SerialNumber: syz [ 269.358575][ T31] usb 6-1: config 0 descriptor?? [ 269.591381][T10035] Invalid option length (0) for dns_resolver key [ 269.646547][ T31] f81534 6-1:0.152: required endpoints missing [ 269.863289][T10035] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 269.865728][T10035] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 269.914943][ T31] f81534 6-1:0.188: required endpoints missing [ 270.003322][ T31] f81534 6-1:0.36: required endpoints missing [ 270.024317][ T31] usb 6-1: USB disconnect, device number 2 [ 271.271874][T10085] binder: BINDER_SET_CONTEXT_MGR already set [ 271.271884][T10085] binder: 10083:10085 ioctl 4018620d 200000004a80 returned -16 [ 275.368091][T10141] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 275.423181][ T7659] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 275.534744][ T7662] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 277.429768][T10172] fuse: Unknown parameter 'grou00000000000000000000' [ 278.240182][T10186] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1531'. [ 278.948508][T10208] fuse: Unknown parameter 'grou00000000000000000000' [ 280.013595][T10244] fuse: Bad value for 'fd' [ 280.774607][T10257] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1545'. [ 281.382630][ T37] audit: type=1326 audit(1773066372.477:250): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=_ pid=10267 comm="syz.1.1550" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f2447a0c799 code=0x0 [ 281.876464][T10280] fuse: Bad value for 'fd' [ 282.342790][T10292] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1558'. [ 282.493799][T10296] fuse: Invalid rootmode [ 283.463119][ T5850] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 283.614901][ T5850] usb 5-1: config 0 has an invalid interface number: 152 but max is 3 [ 283.614928][ T5850] usb 5-1: config 0 has an invalid interface number: 188 but max is 3 [ 283.614946][ T5850] usb 5-1: config 0 has an invalid interface number: 36 but max is 3 [ 283.614963][ T5850] usb 5-1: config 0 contains an unexpected descriptor of type 0x2, skipping [ 283.614978][ T5850] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 283.614995][ T5850] usb 5-1: config 0 has 3 interfaces, different from the descriptor's value: 4 [ 283.615013][ T5850] usb 5-1: config 0 has no interface number 0 [ 283.615025][ T5850] usb 5-1: config 0 has no interface number 1 [ 283.615039][ T5850] usb 5-1: config 0 has no interface number 2 [ 283.615099][ T5850] usb 5-1: config 0 interface 152 altsetting 159 endpoint 0x3 has invalid maxpacket 1023, setting to 64 [ 283.615124][ T5850] usb 5-1: config 0 interface 152 altsetting 159 has an invalid descriptor for endpoint zero, skipping [ 283.615143][ T5850] usb 5-1: config 0 interface 152 altsetting 159 has an invalid descriptor for endpoint zero, skipping [ 283.615162][ T5850] usb 5-1: config 0 interface 152 altsetting 159 endpoint 0x4 has invalid maxpacket 536, setting to 64 [ 283.615184][ T5850] usb 5-1: config 0 interface 152 altsetting 159 has a duplicate endpoint with address 0x3, skipping [ 283.615204][ T5850] usb 5-1: config 0 interface 152 altsetting 159 has a duplicate endpoint with address 0xD, skipping [ 283.615237][ T5850] usb 5-1: config 0 interface 188 altsetting 0 endpoint 0x8 has invalid maxpacket 1128, setting to 64 [ 283.615260][ T5850] usb 5-1: config 0 interface 188 altsetting 0 endpoint 0xE has invalid maxpacket 1023, setting to 64 [ 283.615282][ T5850] usb 5-1: config 0 interface 188 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 283.615299][ T5850] usb 5-1: config 0 interface 188 altsetting 0 has a duplicate endpoint with address 0xD, skipping [ 283.615319][ T5850] usb 5-1: config 0 interface 188 altsetting 0 has a duplicate endpoint with address 0xE, skipping [ 283.615337][ T5850] usb 5-1: config 0 interface 188 altsetting 0 has a duplicate endpoint with address 0x3, skipping [ 283.615369][ T5850] usb 5-1: config 0 interface 36 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 283.615386][ T5850] usb 5-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0x8, skipping [ 283.615405][ T5850] usb 5-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0x2, skipping [ 283.615424][ T5850] usb 5-1: config 0 interface 36 altsetting 0 endpoint 0x7 has invalid maxpacket 1023, setting to 64 [ 283.615446][ T5850] usb 5-1: config 0 interface 36 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 283.615465][ T5850] usb 5-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0x3, skipping [ 283.615484][ T5850] usb 5-1: config 0 interface 36 altsetting 0 has an endpoint descriptor with address 0x49, changing to 0x9 [ 283.615505][ T5850] usb 5-1: config 0 interface 36 altsetting 0 endpoint 0x9 has invalid maxpacket 25842, setting to 1024 [ 283.615528][ T5850] usb 5-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0xE, skipping [ 283.615546][ T5850] usb 5-1: config 0 interface 36 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 283.615567][ T5850] usb 5-1: config 0 interface 36 altsetting 0 has 10 endpoint descriptors, different from the interface descriptor's value: 16 [ 283.615590][ T5850] usb 5-1: config 0 interface 152 has no altsetting 0 [ 283.618223][ T5850] usb 5-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=e7.6d [ 283.618248][ T5850] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 283.618263][ T5850] usb 5-1: Product: syz [ 283.618274][ T5850] usb 5-1: Manufacturer: syz [ 283.618286][ T5850] usb 5-1: SerialNumber: syz [ 283.670475][T10322] netlink: 148 bytes leftover after parsing attributes in process `syz.2.1570'. [ 283.803050][ T5850] usb 5-1: config 0 descriptor?? [ 284.036560][T10313] Invalid option length (0) for dns_resolver key [ 284.087484][ T5850] f81534 5-1:0.152: required endpoints missing [ 284.295262][T10313] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 284.297102][T10313] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 284.318807][ T5850] f81534 5-1:0.188: required endpoints missing [ 284.351824][ T5850] f81534 5-1:0.36: required endpoints missing [ 284.392861][ T5850] usb 5-1: USB disconnect, device number 9 [ 286.365556][T10375] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1588'. [ 286.625039][ T37] audit: type=1326 audit(1773066377.727:251): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=_ pid=10376 comm="syz.4.1590" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fb6e675c799 code=0x0 [ 287.665262][T10398] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1597'. [ 287.855986][T10403] netlink: 'syz.1.1598': attribute type 4 has an invalid length. [ 287.856008][T10403] netlink: 164 bytes leftover after parsing attributes in process `syz.1.1598'. [ 288.963030][ T5876] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 289.234765][ T5876] usb 2-1: Using ep0 maxpacket: 8 [ 289.253162][ T5876] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 289.253178][ T5876] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 289.255121][ T5876] usb 2-1: New USB device found, idVendor=0e41, idProduct=4142, bcdDevice=d4.6e [ 289.255139][ T5876] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 289.255149][ T5876] usb 2-1: Product: syz [ 289.255156][ T5876] usb 2-1: Manufacturer: syz [ 289.255163][ T5876] usb 2-1: SerialNumber: syz [ 289.295647][ T5876] usb 2-1: config 0 descriptor?? [ 289.733067][ T5876] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 289.887513][ T5876] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 289.887541][ T5876] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 289.887558][ T5876] usb 3-1: Product: syz [ 289.887571][ T5876] usb 3-1: Manufacturer: syz [ 289.887583][ T5876] usb 3-1: SerialNumber: syz [ 289.949588][ T5876] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 290.003995][T10415] Option '[¢ yò$ [ 290.003995][T10415] ÿø>ÖÚŽœáTkõ­­SÆ@SœV•ÿfhJ' to dns_resolver key: bad/missing value [ 290.191115][ T5883] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 290.634128][T10426] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1604'. [ 291.342894][T10440] netlink: 'syz.0.1610': attribute type 4 has an invalid length. [ 291.349210][ T5883] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 291.351699][ T5883] ath9k_htc: Failed to initialize the device [ 291.379603][T10440] netlink: 164 bytes leftover after parsing attributes in process `syz.0.1610'. [ 291.417349][ T5883] usb 3-1: ath9k_htc: USB layer deinitialized [ 291.659791][ T5876] usb 2-1: USB disconnect, device number 5 [ 292.106266][ T5876] usb 3-1: USB disconnect, device number 4 [ 292.221589][T10449] fuse: Unknown parameter 'group_i00000000000000000000' [ 292.715608][T10458] cgroup: fork rejected by pids controller in /syz2 [ 293.170868][T10754] overlayfs: missing 'lowerdir' [ 293.912158][T10768] fuse: Unknown parameter 'group_id00000000000000000000' [ 294.195311][T10777] fuse: Unknown parameter 'user_i00000000000000000000' [ 294.603077][ T5801] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 294.753242][ T5801] usb 1-1: Using ep0 maxpacket: 8 [ 294.755053][ T5801] usb 1-1: config 0 has an invalid interface number: 138 but max is 0 [ 294.755076][ T5801] usb 1-1: config 0 has no interface number 0 [ 294.755105][ T5801] usb 1-1: too many endpoints for config 0 interface 138 altsetting 143: 95, using maximum allowed: 30 [ 294.755141][ T5801] usb 1-1: config 0 interface 138 altsetting 143 has 0 endpoint descriptors, different from the interface descriptor's value: 95 [ 294.755154][ T5801] usb 1-1: config 0 interface 138 has no altsetting 0 [ 294.757553][ T5801] usb 1-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 294.757568][ T5801] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 294.757578][ T5801] usb 1-1: Product: syz [ 294.757585][ T5801] usb 1-1: Manufacturer: syz [ 294.757592][ T5801] usb 1-1: SerialNumber: syz [ 294.856754][ T5801] usb 1-1: config 0 descriptor?? [ 295.079806][ T5801] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 295.082616][ T5801] gspca_sonixj: reg_w1 err -71 [ 295.082707][ T5801] sonixj 1-1:0.138: probe with driver sonixj failed with error -71 [ 295.119278][ T5801] usb 1-1: USB disconnect, device number 5 [ 295.223636][T10807] fuse: Unknown parameter 'group_id00000000000000000000' [ 295.881451][T10829] fuse: Unknown parameter 'group_id00000000000000000000' [ 296.180719][T10839] syzkaller0: entered promiscuous mode [ 296.180742][T10839] syzkaller0: entered allmulticast mode [ 296.327546][T10844] netlink: 'syz.5.1656': attribute type 10 has an invalid length. [ 296.571701][T10844] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 296.605662][T10849] 8021q: adding VLAN 0 to HW filter on device bond1 [ 296.628001][T10851] bond_slave_0: entered promiscuous mode [ 296.628084][T10851] bond_slave_1: entered promiscuous mode [ 296.628201][T10851] syz_tun: entered promiscuous mode [ 296.630195][T10851] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 296.630888][T10851] bond1: (slave macvlan2): unknown ethtool speed (30000) for port 1 (set it to 0) [ 296.630908][T10851] bond1: (slave macvlan2): speed changed to 0 on port 1 [ 296.636274][T10851] bond1: (slave macvlan2): Enslaving as a backup interface with an up link [ 296.643112][ T5850] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 296.793578][ T5850] usb 1-1: Using ep0 maxpacket: 8 [ 296.795298][ T5850] usb 1-1: config 0 has an invalid interface number: 138 but max is 0 [ 296.795321][ T5850] usb 1-1: config 0 has no interface number 0 [ 296.795346][ T5850] usb 1-1: too many endpoints for config 0 interface 138 altsetting 143: 95, using maximum allowed: 30 [ 296.795366][ T5850] usb 1-1: config 0 interface 138 altsetting 143 has 0 endpoint descriptors, different from the interface descriptor's value: 95 [ 296.795379][ T5850] usb 1-1: config 0 interface 138 has no altsetting 0 [ 296.797511][ T5850] usb 1-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 296.797535][ T5850] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 296.797550][ T5850] usb 1-1: Product: syz [ 296.797563][ T5850] usb 1-1: Manufacturer: syz [ 296.797575][ T5850] usb 1-1: SerialNumber: syz [ 296.824979][ T5850] usb 1-1: config 0 descriptor?? [ 296.929305][T10858] fuse: Bad value for 'user_id' [ 296.929325][T10858] fuse: Bad value for 'user_id' [ 297.044889][ T5850] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 297.048658][ T5850] gspca_sonixj: reg_w1 err -71 [ 297.048749][ T5850] sonixj 1-1:0.138: probe with driver sonixj failed with error -71 [ 297.076670][ T5850] usb 1-1: USB disconnect, device number 6 [ 297.172640][T10861] cgroup: fork rejected by pids controller in /syz5 [ 297.308974][T10995] TCP: TCP_TX_DELAY enabled [ 297.950729][T11340] fuse: Bad value for 'user_id' [ 297.950749][T11340] fuse: Bad value for 'user_id' [ 298.336083][T11352] overlayfs: missing 'lowerdir' [ 298.642559][ T37] audit: type=1326 audit(1773066389.737:252): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=_ pid=11362 comm="syz.1.1686" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f2447a0c799 code=0x0 [ 298.743091][ T5850] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 298.894323][ T5850] usb 1-1: Using ep0 maxpacket: 8 [ 298.896037][ T5850] usb 1-1: config 0 has an invalid interface number: 138 but max is 0 [ 298.896060][ T5850] usb 1-1: config 0 has no interface number 0 [ 298.896087][ T5850] usb 1-1: too many endpoints for config 0 interface 138 altsetting 143: 95, using maximum allowed: 30 [ 298.896133][ T5850] usb 1-1: config 0 interface 138 altsetting 143 has 0 endpoint descriptors, different from the interface descriptor's value: 95 [ 298.896157][ T5850] usb 1-1: config 0 interface 138 has no altsetting 0 [ 298.898438][ T5850] usb 1-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 298.898463][ T5850] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 298.898480][ T5850] usb 1-1: Product: syz [ 298.898493][ T5850] usb 1-1: Manufacturer: syz [ 298.898505][ T5850] usb 1-1: SerialNumber: syz [ 298.926428][ T5850] usb 1-1: config 0 descriptor?? [ 299.020892][T11375] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 299.020946][T11375] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 299.135509][ T5850] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 299.140667][ T5850] gspca_sonixj: reg_w1 err -71 [ 299.140755][ T5850] sonixj 1-1:0.138: probe with driver sonixj failed with error -71 [ 299.183137][ T5850] usb 1-1: USB disconnect, device number 7 [ 299.602355][T11394] binder: BINDER_SET_CONTEXT_MGR already set [ 299.602366][T11394] binder: 11393:11394 ioctl 4018620d 200000004a80 returned -16 [ 301.193235][ T5887] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 301.353008][ T5887] usb 2-1: Using ep0 maxpacket: 8 [ 301.354941][ T5887] usb 2-1: config 0 has an invalid interface number: 138 but max is 0 [ 301.354964][ T5887] usb 2-1: config 0 has no interface number 0 [ 301.354991][ T5887] usb 2-1: too many endpoints for config 0 interface 138 altsetting 143: 95, using maximum allowed: 30 [ 301.355026][ T5887] usb 2-1: config 0 interface 138 altsetting 143 has 0 endpoint descriptors, different from the interface descriptor's value: 95 [ 301.355088][ T5887] usb 2-1: config 0 interface 138 has no altsetting 0 [ 301.364408][ T5887] usb 2-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 301.364434][ T5887] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 301.364451][ T5887] usb 2-1: Product: syz [ 301.364464][ T5887] usb 2-1: Manufacturer: syz [ 301.364475][ T5887] usb 2-1: SerialNumber: syz [ 301.376743][ T5887] usb 2-1: config 0 descriptor?? [ 302.783771][T11448] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1719'. [ 302.791012][T11448] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 303.980573][ T5887] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 303.981061][ T5887] gspca_sonixj: reg_w1 err -71 [ 303.981142][ T5887] sonixj 2-1:0.138: probe with driver sonixj failed with error -71 [ 303.984801][ T5887] usb 2-1: USB disconnect, device number 6 [ 304.487815][T11450] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1718'. [ 305.169327][T11490] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1729'. [ 305.425983][ T5887] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 305.583176][ T5887] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 305.583204][ T5887] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 305.583222][ T5887] usb 5-1: Product: syz [ 305.583235][ T5887] usb 5-1: Manufacturer: syz [ 305.583247][ T5887] usb 5-1: SerialNumber: syz [ 305.633108][ T5850] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 305.923556][ T5850] usb 2-1: Using ep0 maxpacket: 8 [ 305.925480][ T5850] usb 2-1: config 0 has an invalid interface number: 138 but max is 0 [ 305.925511][ T5850] usb 2-1: config 0 has no interface number 0 [ 305.925540][ T5850] usb 2-1: too many endpoints for config 0 interface 138 altsetting 143: 95, using maximum allowed: 30 [ 305.925606][ T5850] usb 2-1: config 0 interface 138 altsetting 143 has 0 endpoint descriptors, different from the interface descriptor's value: 95 [ 305.925620][ T5850] usb 2-1: config 0 interface 138 has no altsetting 0 [ 305.929801][ T5850] usb 2-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 305.929816][ T5850] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 305.929826][ T5850] usb 2-1: Product: syz [ 305.929833][ T5850] usb 2-1: Manufacturer: syz [ 305.929839][ T5850] usb 2-1: SerialNumber: syz [ 306.046853][ T5850] usb 2-1: config 0 descriptor?? [ 306.277505][ T5850] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 306.278235][ T5850] gspca_sonixj: reg_w1 err -71 [ 306.278369][ T5850] sonixj 2-1:0.138: probe with driver sonixj failed with error -71 [ 306.327602][ T5850] usb 2-1: USB disconnect, device number 7 [ 306.421186][T11503] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 306.483185][ T5887] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 306.483237][ T5887] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPROTO [ 306.483629][ T5887] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 306.483671][ T5887] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 306.484296][ T5887] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 306.554937][ T5887] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -71 [ 306.592640][ T5887] usb 5-1: USB disconnect, device number 10 [ 307.828592][T11546] input: syz1 as /devices/virtual/input/input6 [ 307.973033][ T5883] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 308.131270][ T5883] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 308.131301][ T5883] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 308.131321][ T5883] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 308.131357][ T5883] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 308.131377][ T5883] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 308.161577][ T5883] usb 2-1: config 0 descriptor?? [ 308.626766][ T5883] plantronics 0003:047F:FFFF.0004: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 308.996040][ T31] usb 2-1: USB disconnect, device number 8 [ 309.025871][T11578] fido_id[11578]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/2-1/report_descriptor': No such file or directory [ 309.214515][T11584] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1769'. [ 310.498299][T11648] binder_alloc: 11645: binder_alloc_buf, no vma [ 313.112264][T12239] fuse: Unknown parameter '0x0000000000000003' [ 315.918661][T12363] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1887'. [ 317.190289][ T1319] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.190355][ T1319] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.916643][T12489] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1944'. [ 320.393149][T12508] input: syz1 as /devices/virtual/input/input8 [ 321.183674][T12516] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 321.595391][ T37] audit: type=1326 audit(1773066412.687:253): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12530 comm="syz.2.1966" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f91108dc799 code=0x7ffc0000 [ 321.595437][ T37] audit: type=1326 audit(1773066412.697:254): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12530 comm="syz.2.1966" exe="/root/syz-executor" sig=0 arch=c000003e syscall=122 compat=0 ip=0x7f91108dc799 code=0x7ffc0000 [ 321.595474][ T37] audit: type=1326 audit(1773066412.697:255): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12530 comm="syz.2.1966" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f91108dc799 code=0x7ffc0000 [ 321.595508][ T37] audit: type=1326 audit(1773066412.697:256): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12530 comm="syz.2.1966" exe="/root/syz-executor" sig=0 arch=c000003e syscall=56 compat=0 ip=0x7f91108dc799 code=0x7ffc0000 [ 321.840598][ T37] audit: type=1326 audit(1773066412.917:257): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12530 comm="syz.2.1966" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f91108dc799 code=0x7ffc0000 [ 321.840631][ T37] audit: type=1326 audit(1773066412.917:258): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12530 comm="syz.2.1966" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f91108dc799 code=0x7ffc0000 [ 321.840652][ T37] audit: type=1326 audit(1773066412.917:259): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12547 comm="syz.2.1966" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f911089cfce code=0x7ffc0000 [ 321.862984][ T37] audit: type=1326 audit(1773066412.957:260): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12530 comm="syz.2.1966" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f91108dc799 code=0x7ffc0000 [ 321.863043][ T37] audit: type=1326 audit(1773066412.957:261): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12530 comm="syz.2.1966" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f91108dc799 code=0x7ffc0000 [ 321.863079][ T37] audit: type=1326 audit(1773066412.957:262): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12530 comm="syz.2.1966" exe="/root/syz-executor" sig=0 arch=c000003e syscall=55 compat=0 ip=0x7f91108dc799 code=0x7ffc0000 [ 323.756275][ T5801] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 323.923544][ T5801] usb 6-1: config 0 has an invalid interface number: 152 but max is 3 [ 323.923572][ T5801] usb 6-1: config 0 has an invalid interface number: 188 but max is 3 [ 323.923590][ T5801] usb 6-1: config 0 has an invalid interface number: 36 but max is 3 [ 323.923607][ T5801] usb 6-1: config 0 contains an unexpected descriptor of type 0x2, skipping [ 323.923622][ T5801] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 323.923637][ T5801] usb 6-1: config 0 has 3 interfaces, different from the descriptor's value: 4 [ 323.923655][ T5801] usb 6-1: config 0 has no interface number 0 [ 323.923668][ T5801] usb 6-1: config 0 has no interface number 1 [ 323.923682][ T5801] usb 6-1: config 0 has no interface number 2 [ 323.923748][ T5801] usb 6-1: config 0 interface 152 altsetting 159 endpoint 0x3 has invalid maxpacket 1023, setting to 64 [ 323.923783][ T5801] usb 6-1: config 0 interface 152 altsetting 159 has an invalid descriptor for endpoint zero, skipping [ 323.923803][ T5801] usb 6-1: config 0 interface 152 altsetting 159 has an invalid descriptor for endpoint zero, skipping [ 323.923821][ T5801] usb 6-1: config 0 interface 152 altsetting 159 endpoint 0x4 has invalid maxpacket 536, setting to 64 [ 323.923844][ T5801] usb 6-1: config 0 interface 152 altsetting 159 has a duplicate endpoint with address 0x3, skipping [ 323.923865][ T5801] usb 6-1: config 0 interface 152 altsetting 159 has a duplicate endpoint with address 0xD, skipping [ 323.923898][ T5801] usb 6-1: config 0 interface 188 altsetting 0 endpoint 0x8 has invalid maxpacket 1128, setting to 64 [ 323.923920][ T5801] usb 6-1: config 0 interface 188 altsetting 0 endpoint 0xE has invalid maxpacket 1023, setting to 64 [ 323.923942][ T5801] usb 6-1: config 0 interface 188 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 323.923959][ T5801] usb 6-1: config 0 interface 188 altsetting 0 has a duplicate endpoint with address 0xD, skipping [ 323.923979][ T5801] usb 6-1: config 0 interface 188 altsetting 0 has a duplicate endpoint with address 0xE, skipping [ 323.923997][ T5801] usb 6-1: config 0 interface 188 altsetting 0 has a duplicate endpoint with address 0x3, skipping [ 323.924028][ T5801] usb 6-1: config 0 interface 36 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 323.924046][ T5801] usb 6-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0x8, skipping [ 323.924065][ T5801] usb 6-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0x2, skipping [ 323.924084][ T5801] usb 6-1: config 0 interface 36 altsetting 0 endpoint 0x7 has invalid maxpacket 1023, setting to 64 [ 323.924106][ T5801] usb 6-1: config 0 interface 36 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 323.924125][ T5801] usb 6-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0x3, skipping [ 323.924143][ T5801] usb 6-1: config 0 interface 36 altsetting 0 has an endpoint descriptor with address 0x49, changing to 0x9 [ 323.924165][ T5801] usb 6-1: config 0 interface 36 altsetting 0 endpoint 0x9 has invalid maxpacket 25842, setting to 1024 [ 323.924187][ T5801] usb 6-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0xE, skipping [ 323.924207][ T5801] usb 6-1: config 0 interface 36 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 323.924229][ T5801] usb 6-1: config 0 interface 36 altsetting 0 has 10 endpoint descriptors, different from the interface descriptor's value: 16 [ 323.924251][ T5801] usb 6-1: config 0 interface 152 has no altsetting 0 [ 323.930333][ T5801] usb 6-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=e7.6d [ 323.930361][ T5801] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 323.930378][ T5801] usb 6-1: Product: syz [ 323.930391][ T5801] usb 6-1: Manufacturer: syz [ 323.930404][ T5801] usb 6-1: SerialNumber: syz [ 324.323113][ T5801] usb 6-1: config 0 descriptor?? [ 324.538640][T12587] Invalid option length (0) for dns_resolver key [ 324.598488][ T5801] f81534 6-1:0.152: required endpoints missing [ 325.651087][T12587] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 325.651957][T12587] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 325.701085][ T5801] f81534 6-1:0.188: required endpoints missing [ 325.759301][ T5801] f81534 6-1:0.36: required endpoints missing [ 325.775874][ T5801] usb 6-1: USB disconnect, device number 3 [ 327.028957][T12691] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2038'. [ 328.363148][T12732] netlink: 1004 bytes leftover after parsing attributes in process `syz.2.2057'. [ 331.642665][ T37] kauditd_printk_skb: 18 callbacks suppressed [ 331.642681][ T37] audit: type=1326 audit(1773066422.737:281): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=_ pid=12837 comm="syz.0.2104" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f501c03c799 code=0x0 [ 334.033329][ T5850] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 334.203034][ T5850] usb 6-1: Using ep0 maxpacket: 8 [ 334.209612][ T5850] usb 6-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 334.209639][ T5850] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 334.209656][ T5850] usb 6-1: Product: syz [ 334.209668][ T5850] usb 6-1: Manufacturer: syz [ 334.209674][ T5850] usb 6-1: SerialNumber: syz [ 334.214514][ T5850] usb 6-1: config 0 descriptor?? [ 334.258091][ T5850] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 334.836335][ T5850] gspca_sonixj: reg_w1 err -71 [ 334.836421][ T5850] sonixj 6-1:0.0: probe with driver sonixj failed with error -71 [ 334.852279][ T5850] usb 6-1: USB disconnect, device number 4 [ 335.567601][T12993] input: syz1 as /devices/virtual/input/input9 [ 335.866511][T13002] mmap: syz.0.2179 (13002) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 340.003171][T13107] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2221'. [ 340.343565][T13115] input: syz1 as /devices/virtual/input/input10 [ 340.625323][T13124] overlayfs: missing 'lowerdir' [ 340.804282][T13135] snd_virmidi snd_virmidi.0: control 0:0:0:syz0:0 is already present [ 342.838203][ T37] audit: type=1326 audit(1773066433.927:282): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13170 comm="syz.2.2254" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f91108dc799 code=0x7ffc0000 [ 342.838256][ T37] audit: type=1326 audit(1773066433.927:283): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13170 comm="syz.2.2254" exe="/root/syz-executor" sig=0 arch=c000003e syscall=122 compat=0 ip=0x7f91108dc799 code=0x7ffc0000 [ 342.838293][ T37] audit: type=1326 audit(1773066433.927:284): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13170 comm="syz.2.2254" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f91108dc799 code=0x7ffc0000 [ 342.838328][ T37] audit: type=1326 audit(1773066433.927:285): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13170 comm="syz.2.2254" exe="/root/syz-executor" sig=0 arch=c000003e syscall=56 compat=0 ip=0x7f91108dc799 code=0x7ffc0000 [ 343.102536][ T37] audit: type=1326 audit(1773066434.197:286): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13170 comm="syz.2.2254" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f91108dc799 code=0x7ffc0000 [ 343.102585][ T37] audit: type=1326 audit(1773066434.197:287): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13170 comm="syz.2.2254" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f91108dc799 code=0x7ffc0000 [ 343.218729][ T37] audit: type=1326 audit(1773066434.307:289): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13170 comm="syz.2.2254" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f91108dc799 code=0x7ffc0000 [ 343.223300][ T37] audit: type=1326 audit(1773066434.317:290): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13170 comm="syz.2.2254" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f91108dc799 code=0x7ffc0000 [ 343.223344][ T37] audit: type=1326 audit(1773066434.317:291): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13170 comm="syz.2.2254" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f91108dc799 code=0x7ffc0000 [ 343.223381][ T37] audit: type=1326 audit(1773066434.317:292): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13170 comm="syz.2.2254" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f91108dc799 code=0x7ffc0000 [ 348.923005][ T5850] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 349.127482][ T5850] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 349.127501][ T5850] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 349.127512][ T5850] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 349.127534][ T5850] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 349.127545][ T5850] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 349.130509][ T5850] usb 1-1: config 0 descriptor?? [ 349.578316][ T5850] plantronics 0003:047F:FFFF.0005: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 349.808951][ T5850] usb 1-1: USB disconnect, device number 8 [ 349.983084][ T5810] Bluetooth: hci3: command 0x0405 tx timeout [ 351.151313][T13398] fuse: Bad value for 'fd' [ 351.734558][ T37] kauditd_printk_skb: 11 callbacks suppressed [ 351.734574][ T37] audit: type=1326 audit(1773066442.827:303): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13413 comm="syz.2.2353" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f91108dc799 code=0x7ffc0000 [ 351.734614][ T37] audit: type=1326 audit(1773066442.827:304): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13413 comm="syz.2.2353" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f91108dc799 code=0x7ffc0000 [ 351.734646][ T37] audit: type=1326 audit(1773066442.827:305): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13413 comm="syz.2.2353" exe="/root/syz-executor" sig=0 arch=c000003e syscall=122 compat=0 ip=0x7f91108dc799 code=0x7ffc0000 [ 351.734681][ T37] audit: type=1326 audit(1773066442.827:306): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13413 comm="syz.2.2353" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f91108dc799 code=0x7ffc0000 [ 351.734714][ T37] audit: type=1326 audit(1773066442.837:307): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13413 comm="syz.2.2353" exe="/root/syz-executor" sig=0 arch=c000003e syscall=56 compat=0 ip=0x7f91108dc799 code=0x7ffc0000 [ 351.823586][ T37] audit: type=1326 audit(1773066442.927:308): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13413 comm="syz.2.2353" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f91108dc799 code=0x7ffc0000 [ 351.833005][ T37] audit: type=1326 audit(1773066442.927:309): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13413 comm="syz.2.2353" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f91108dc799 code=0x7ffc0000 [ 352.060983][ T37] audit: type=1326 audit(1773066443.157:310): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13413 comm="syz.2.2353" exe="/root/syz-executor" sig=0 arch=c000003e syscall=55 compat=0 ip=0x7f91108dc799 code=0x7ffc0000 [ 352.061032][ T37] audit: type=1326 audit(1773066443.157:311): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13430 comm="syz.2.2353" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f911089cfce code=0x7ffc0000 [ 352.153693][ T37] audit: type=1326 audit(1773066443.247:312): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13413 comm="syz.2.2353" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f91108dc799 code=0x7ffc0000 [ 353.153563][ T5810] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 353.160847][ T5810] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 353.161946][ T5810] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 353.169076][ T5810] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 353.172641][ T5810] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 353.800132][T13466] input: syz1 as /devices/virtual/input/input12 [ 354.176862][ T5801] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 354.302878][T13449] chnl_net:caif_netlink_parms(): no params data found [ 354.358504][ T5801] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 354.358533][ T5801] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 354.358551][ T5801] usb 6-1: Product: syz [ 354.358563][ T5801] usb 6-1: Manufacturer: syz [ 354.358576][ T5801] usb 6-1: SerialNumber: syz [ 354.578090][ T5801] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 354.641740][ T31] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 355.033488][T13485] cgroup: fork rejected by pids controller in /syz0 [ 355.263025][ T5810] Bluetooth: hci5: command tx timeout [ 355.750961][ T31] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 355.751221][ T31] ath9k_htc: Failed to initialize the device [ 355.830557][ T31] usb 6-1: ath9k_htc: USB layer deinitialized [ 355.980462][ T3508] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 356.899697][ T5850] usb 6-1: USB disconnect, device number 5 [ 356.992733][ T3508] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 357.069372][T13449] bridge0: port 1(bridge_slave_0) entered blocking state [ 357.069567][T13449] bridge0: port 1(bridge_slave_0) entered disabled state [ 357.069795][T13449] bridge_slave_0: entered allmulticast mode [ 357.100181][T13449] bridge_slave_0: entered promiscuous mode [ 357.116817][T13449] bridge0: port 2(bridge_slave_1) entered blocking state [ 357.117009][T13449] bridge0: port 2(bridge_slave_1) entered disabled state [ 357.117202][T13449] bridge_slave_1: entered allmulticast mode [ 357.120724][T13449] bridge_slave_1: entered promiscuous mode [ 357.336780][ T5850] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 357.343110][ T5810] Bluetooth: hci5: command tx timeout [ 357.406930][ T3508] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 357.451327][T13449] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 357.488490][T13449] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 357.526516][ T5850] usb 6-1: config 0 has an invalid interface number: 152 but max is 3 [ 357.526543][ T5850] usb 6-1: config 0 has an invalid interface number: 188 but max is 3 [ 357.526561][ T5850] usb 6-1: config 0 has an invalid interface number: 36 but max is 3 [ 357.526578][ T5850] usb 6-1: config 0 contains an unexpected descriptor of type 0x2, skipping [ 357.526594][ T5850] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 357.526610][ T5850] usb 6-1: config 0 has 3 interfaces, different from the descriptor's value: 4 [ 357.526628][ T5850] usb 6-1: config 0 has no interface number 0 [ 357.526641][ T5850] usb 6-1: config 0 has no interface number 1 [ 357.526655][ T5850] usb 6-1: config 0 has no interface number 2 [ 357.526717][ T5850] usb 6-1: config 0 interface 152 altsetting 159 endpoint 0x3 has invalid maxpacket 1023, setting to 64 [ 357.526741][ T5850] usb 6-1: config 0 interface 152 altsetting 159 has an invalid descriptor for endpoint zero, skipping [ 357.526761][ T5850] usb 6-1: config 0 interface 152 altsetting 159 has an invalid descriptor for endpoint zero, skipping [ 357.526779][ T5850] usb 6-1: config 0 interface 152 altsetting 159 endpoint 0x4 has invalid maxpacket 536, setting to 64 [ 357.526801][ T5850] usb 6-1: config 0 interface 152 altsetting 159 has a duplicate endpoint with address 0x3, skipping [ 357.526821][ T5850] usb 6-1: config 0 interface 152 altsetting 159 has a duplicate endpoint with address 0xD, skipping [ 357.526915][ T5850] usb 6-1: config 0 interface 188 altsetting 0 endpoint 0x8 has invalid maxpacket 1128, setting to 64 [ 357.526938][ T5850] usb 6-1: config 0 interface 188 altsetting 0 endpoint 0xE has invalid maxpacket 1023, setting to 64 [ 357.526961][ T5850] usb 6-1: config 0 interface 188 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 357.526979][ T5850] usb 6-1: config 0 interface 188 altsetting 0 has a duplicate endpoint with address 0xD, skipping [ 357.526999][ T5850] usb 6-1: config 0 interface 188 altsetting 0 has a duplicate endpoint with address 0xE, skipping [ 357.527019][ T5850] usb 6-1: config 0 interface 188 altsetting 0 has a duplicate endpoint with address 0x3, skipping [ 357.527051][ T5850] usb 6-1: config 0 interface 36 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 357.527069][ T5850] usb 6-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0x8, skipping [ 357.527088][ T5850] usb 6-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0x2, skipping [ 357.527108][ T5850] usb 6-1: config 0 interface 36 altsetting 0 endpoint 0x7 has invalid maxpacket 1023, setting to 64 [ 357.527129][ T5850] usb 6-1: config 0 interface 36 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 357.527148][ T5850] usb 6-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0x3, skipping [ 357.527166][ T5850] usb 6-1: config 0 interface 36 altsetting 0 has an endpoint descriptor with address 0x49, changing to 0x9 [ 357.527188][ T5850] usb 6-1: config 0 interface 36 altsetting 0 endpoint 0x9 has invalid maxpacket 25842, setting to 1024 [ 357.527210][ T5850] usb 6-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0xE, skipping [ 357.527229][ T5850] usb 6-1: config 0 interface 36 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 357.527251][ T5850] usb 6-1: config 0 interface 36 altsetting 0 has 10 endpoint descriptors, different from the interface descriptor's value: 16 [ 357.527275][ T5850] usb 6-1: config 0 interface 152 has no altsetting 0 [ 357.529835][ T5850] usb 6-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=e7.6d [ 357.529861][ T5850] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 357.529884][ T5850] usb 6-1: Product: syz [ 357.529896][ T5850] usb 6-1: Manufacturer: syz [ 357.529908][ T5850] usb 6-1: SerialNumber: syz [ 357.924872][ T5850] usb 6-1: config 0 descriptor?? [ 358.036998][ T3508] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 358.133575][T13587] Invalid option length (0) for dns_resolver key [ 358.175943][ T5850] f81534 6-1:0.152: required endpoints missing [ 358.198326][T13449] team0: Port device team_slave_0 added [ 358.307959][T13449] team0: Port device team_slave_1 added [ 358.377795][T13587] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 358.391931][T13587] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 358.461102][ T5850] f81534 6-1:0.188: required endpoints missing [ 358.510206][ T5850] f81534 6-1:0.36: required endpoints missing [ 358.612844][ T5850] usb 6-1: USB disconnect, device number 6 [ 358.814670][T13449] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 358.814687][T13449] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 358.814712][T13449] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 358.916696][T13449] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 358.916713][T13449] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 358.916737][T13449] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 359.362395][T13449] hsr_slave_0: entered promiscuous mode [ 359.371443][T13449] hsr_slave_1: entered promiscuous mode [ 359.380198][T13449] debugfs: 'hsr0' already exists in 'hsr' [ 359.380217][T13449] Cannot create hsr debugfs directory [ 359.423037][ T5810] Bluetooth: hci5: command tx timeout [ 359.790244][ T3508] bridge_slave_1: left allmulticast mode [ 359.790270][ T3508] bridge_slave_1: left promiscuous mode [ 359.790491][ T3508] bridge0: port 2(bridge_slave_1) entered disabled state [ 360.106795][ T3508] bridge_slave_0: left allmulticast mode [ 360.106825][ T3508] bridge_slave_0: left promiscuous mode [ 360.107067][ T3508] bridge0: port 1(bridge_slave_0) entered disabled state [ 360.225567][T13645] netlink: 40 bytes leftover after parsing attributes in process `syz.5.2418'. [ 360.706739][ T5850] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 360.930442][ T5850] usb 3-1: config 0 has an invalid interface number: 152 but max is 3 [ 360.930461][ T5850] usb 3-1: config 0 has an invalid interface number: 188 but max is 3 [ 360.930471][ T5850] usb 3-1: config 0 has an invalid interface number: 36 but max is 3 [ 360.930481][ T5850] usb 3-1: config 0 contains an unexpected descriptor of type 0x2, skipping [ 360.930490][ T5850] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 360.930499][ T5850] usb 3-1: config 0 has 3 interfaces, different from the descriptor's value: 4 [ 360.930509][ T5850] usb 3-1: config 0 has no interface number 0 [ 360.930516][ T5850] usb 3-1: config 0 has no interface number 1 [ 360.930524][ T5850] usb 3-1: config 0 has no interface number 2 [ 360.930560][ T5850] usb 3-1: config 0 interface 152 altsetting 159 endpoint 0x3 has invalid maxpacket 1023, setting to 64 [ 360.930572][ T5850] usb 3-1: config 0 interface 152 altsetting 159 has an invalid descriptor for endpoint zero, skipping [ 360.930583][ T5850] usb 3-1: config 0 interface 152 altsetting 159 has an invalid descriptor for endpoint zero, skipping [ 360.930593][ T5850] usb 3-1: config 0 interface 152 altsetting 159 endpoint 0x4 has invalid maxpacket 536, setting to 64 [ 360.930606][ T5850] usb 3-1: config 0 interface 152 altsetting 159 has a duplicate endpoint with address 0x3, skipping [ 360.930617][ T5850] usb 3-1: config 0 interface 152 altsetting 159 has a duplicate endpoint with address 0xD, skipping [ 360.930642][ T5850] usb 3-1: config 0 interface 188 altsetting 0 endpoint 0x8 has invalid maxpacket 1128, setting to 64 [ 360.930655][ T5850] usb 3-1: config 0 interface 188 altsetting 0 endpoint 0xE has invalid maxpacket 1023, setting to 64 [ 360.930667][ T5850] usb 3-1: config 0 interface 188 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 360.930677][ T5850] usb 3-1: config 0 interface 188 altsetting 0 has a duplicate endpoint with address 0xD, skipping [ 360.930687][ T5850] usb 3-1: config 0 interface 188 altsetting 0 has a duplicate endpoint with address 0xE, skipping [ 360.930698][ T5850] usb 3-1: config 0 interface 188 altsetting 0 has a duplicate endpoint with address 0x3, skipping [ 360.930722][ T5850] usb 3-1: config 0 interface 36 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 360.930731][ T5850] usb 3-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0x8, skipping [ 360.930742][ T5850] usb 3-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0x2, skipping [ 360.930752][ T5850] usb 3-1: config 0 interface 36 altsetting 0 endpoint 0x7 has invalid maxpacket 1023, setting to 64 [ 360.930763][ T5850] usb 3-1: config 0 interface 36 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 360.930773][ T5850] usb 3-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0x3, skipping [ 360.930783][ T5850] usb 3-1: config 0 interface 36 altsetting 0 has an endpoint descriptor with address 0x49, changing to 0x9 [ 360.930794][ T5850] usb 3-1: config 0 interface 36 altsetting 0 endpoint 0x9 has invalid maxpacket 25842, setting to 1024 [ 360.930807][ T5850] usb 3-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0xE, skipping [ 360.930817][ T5850] usb 3-1: config 0 interface 36 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 360.930828][ T5850] usb 3-1: config 0 interface 36 altsetting 0 has 10 endpoint descriptors, different from the interface descriptor's value: 16 [ 360.930841][ T5850] usb 3-1: config 0 interface 152 has no altsetting 0 [ 360.934046][ T5850] usb 3-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=e7.6d [ 360.934070][ T5850] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 360.934088][ T5850] usb 3-1: Product: syz [ 360.934101][ T5850] usb 3-1: Manufacturer: syz [ 360.934114][ T5850] usb 3-1: SerialNumber: syz [ 360.939047][ T5850] usb 3-1: config 0 descriptor?? [ 361.331223][T13655] Invalid option length (0) for dns_resolver key [ 361.421821][ T5850] f81534 3-1:0.152: required endpoints missing [ 361.503024][ T5810] Bluetooth: hci5: command tx timeout [ 361.596798][T13655] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 361.602197][T13655] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 361.635313][ T5850] f81534 3-1:0.188: required endpoints missing [ 361.699598][ T5850] f81534 3-1:0.36: required endpoints missing [ 361.753240][ T5850] usb 3-1: USB disconnect, device number 5 [ 362.445862][ T3508] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 362.538735][ T3508] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 362.588174][T13686] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 362.588284][T13686] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 362.609256][ T3508] bond0 (unregistering): Released all slaves [ 362.648868][ T3508] bond1 (unregistering): Released all slaves [ 362.885230][T13696] binder: BINDER_SET_CONTEXT_MGR already set [ 362.885243][T13696] binder: 13694:13696 ioctl 4018620d 200000004a80 returned -16 [ 362.978130][ T3508] tipc: Left network mode [ 369.205376][ T5850] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 369.377002][ T5850] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 369.377030][ T5850] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 369.377048][ T5850] usb 6-1: Product: syz [ 369.377060][ T5850] usb 6-1: Manufacturer: syz [ 369.377072][ T5850] usb 6-1: SerialNumber: syz [ 369.515008][ T5850] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 369.640466][ T5850] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 369.933118][ T3508] hsr_slave_0: left promiscuous mode [ 369.974937][ T3508] hsr_slave_1: left promiscuous mode [ 369.977930][ T3508] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 369.977955][ T3508] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 370.025484][ T3508] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 370.025512][ T3508] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 370.115141][ T3508] veth1_macvtap: left promiscuous mode [ 370.115242][ T3508] veth0_macvtap: left promiscuous mode [ 370.117440][ T3508] veth0_vlan: left promiscuous mode [ 370.863203][ T5850] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 370.863448][ T5850] ath9k_htc: Failed to initialize the device [ 370.955063][ T5850] usb 6-1: ath9k_htc: USB layer deinitialized [ 371.955273][ T5850] usb 6-1: USB disconnect, device number 7 [ 372.464298][ T3508] team0 (unregistering): Port device team_slave_1 removed [ 372.544032][ T3508] team0 (unregistering): Port device team_slave_0 removed [ 374.000240][T13449] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 374.130980][T13449] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 374.191186][T13449] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 374.716850][T13449] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 375.245720][T13449] 8021q: adding VLAN 0 to HW filter on device bond0 [ 375.399536][T13449] 8021q: adding VLAN 0 to HW filter on device team0 [ 375.422667][ T1440] bridge0: port 1(bridge_slave_0) entered blocking state [ 375.422791][ T1440] bridge0: port 1(bridge_slave_0) entered forwarding state [ 375.463702][ T7655] bridge0: port 2(bridge_slave_1) entered blocking state [ 375.484203][ T7655] bridge0: port 2(bridge_slave_1) entered forwarding state [ 378.110585][T13449] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 378.642096][ T1319] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.642162][ T1319] ieee802154 phy1 wpan1: encryption failed: -22 [ 380.542587][T13449] veth0_vlan: entered promiscuous mode [ 380.560236][T13449] veth1_vlan: entered promiscuous mode [ 381.108274][T13449] veth0_macvtap: entered promiscuous mode [ 381.121431][T13449] veth1_macvtap: entered promiscuous mode [ 381.141689][T13449] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 381.152260][T13449] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 381.181592][ T1440] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 381.181841][ T1440] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 381.182054][ T1440] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 381.252978][ T1440] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 381.618487][ T57] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 381.618509][ T57] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 381.688049][T14150] fuse: Bad value for 'fd' [ 381.771590][ T7658] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 381.771610][ T7658] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 382.349951][T14167] input: syz1 as /devices/virtual/input/input13 [ 382.870731][ T5803] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 383.098921][ T5803] usb 5-1: Using ep0 maxpacket: 16 [ 383.100812][ T5803] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 383.105369][ T5803] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 383.105394][ T5803] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 383.105412][ T5803] usb 5-1: Product: syz [ 383.105425][ T5803] usb 5-1: Manufacturer: syz [ 383.105439][ T5803] usb 5-1: SerialNumber: syz [ 383.215157][ T5803] usb 5-1: config 0 descriptor?? [ 383.232696][ T5803] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 383.232754][ T5803] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 383.253950][ T60] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 383.274123][ T60] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 383.275396][ T60] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 383.276613][ T60] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 383.286881][ T60] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 383.943555][ T5803] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 384.652486][ T5803] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 384.652507][ T5803] em28xx 5-1:0.0: board has no eeprom [ 385.343232][ T5810] Bluetooth: hci4: command tx timeout [ 385.363240][ T5803] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 385.363330][ T5803] em28xx 5-1:0.0: dvb set to bulk mode. [ 385.365353][ T5801] em28xx 5-1:0.0: Binding DVB extension [ 385.418093][ T5803] usb 5-1: USB disconnect, device number 11 [ 385.446367][ T5803] em28xx 5-1:0.0: Disconnecting em28xx [ 385.969059][ T5801] em28xx 5-1:0.0: Registering input extension [ 385.969660][ T5803] em28xx 5-1:0.0: Closing input extension [ 386.123377][T14208] input: syz1 as /devices/virtual/input/input15 [ 386.296451][ T5803] em28xx 5-1:0.0: Freeing device [ 386.810147][ T5803] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 387.064899][ T7655] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 387.127121][ T5803] usb 5-1: config 0 has an invalid interface number: 152 but max is 3 [ 387.127148][ T5803] usb 5-1: config 0 has an invalid interface number: 188 but max is 3 [ 387.127167][ T5803] usb 5-1: config 0 has an invalid interface number: 36 but max is 3 [ 387.127185][ T5803] usb 5-1: config 0 contains an unexpected descriptor of type 0x2, skipping [ 387.127200][ T5803] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 387.127208][ T5803] usb 5-1: config 0 has 3 interfaces, different from the descriptor's value: 4 [ 387.127218][ T5803] usb 5-1: config 0 has no interface number 0 [ 387.127225][ T5803] usb 5-1: config 0 has no interface number 1 [ 387.127232][ T5803] usb 5-1: config 0 has no interface number 2 [ 387.127268][ T5803] usb 5-1: config 0 interface 152 altsetting 159 endpoint 0x3 has invalid maxpacket 1023, setting to 64 [ 387.127281][ T5803] usb 5-1: config 0 interface 152 altsetting 159 has an invalid descriptor for endpoint zero, skipping [ 387.127291][ T5803] usb 5-1: config 0 interface 152 altsetting 159 has an invalid descriptor for endpoint zero, skipping [ 387.127301][ T5803] usb 5-1: config 0 interface 152 altsetting 159 endpoint 0x4 has invalid maxpacket 536, setting to 64 [ 387.127312][ T5803] usb 5-1: config 0 interface 152 altsetting 159 has a duplicate endpoint with address 0x3, skipping [ 387.127324][ T5803] usb 5-1: config 0 interface 152 altsetting 159 has a duplicate endpoint with address 0xD, skipping [ 387.127341][ T5803] usb 5-1: config 0 interface 188 altsetting 0 endpoint 0x8 has invalid maxpacket 1128, setting to 64 [ 387.127354][ T5803] usb 5-1: config 0 interface 188 altsetting 0 endpoint 0xE has invalid maxpacket 1023, setting to 64 [ 387.127366][ T5803] usb 5-1: config 0 interface 188 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 387.127376][ T5803] usb 5-1: config 0 interface 188 altsetting 0 has a duplicate endpoint with address 0xD, skipping [ 387.127386][ T5803] usb 5-1: config 0 interface 188 altsetting 0 has a duplicate endpoint with address 0xE, skipping [ 387.127396][ T5803] usb 5-1: config 0 interface 188 altsetting 0 has a duplicate endpoint with address 0x3, skipping [ 387.127414][ T5803] usb 5-1: config 0 interface 36 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 387.127423][ T5803] usb 5-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0x8, skipping [ 387.127434][ T5803] usb 5-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0x2, skipping [ 387.127445][ T5803] usb 5-1: config 0 interface 36 altsetting 0 endpoint 0x7 has invalid maxpacket 1023, setting to 64 [ 387.127457][ T5803] usb 5-1: config 0 interface 36 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 387.127467][ T5803] usb 5-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0x3, skipping [ 387.127480][ T5803] usb 5-1: config 0 interface 36 altsetting 0 has an endpoint descriptor with address 0x49, changing to 0x9 [ 387.127500][ T5803] usb 5-1: config 0 interface 36 altsetting 0 endpoint 0x9 has invalid maxpacket 25842, setting to 1024 [ 387.127521][ T5803] usb 5-1: config 0 interface 36 altsetting 0 has a duplicate endpoint with address 0xE, skipping [ 387.127540][ T5803] usb 5-1: config 0 interface 36 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 387.127562][ T5803] usb 5-1: config 0 interface 36 altsetting 0 has 10 endpoint descriptors, different from the interface descriptor's value: 16 [ 387.127583][ T5803] usb 5-1: config 0 interface 152 has no altsetting 0 [ 387.130931][ T5803] usb 5-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=e7.6d [ 387.130948][ T5803] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 387.130958][ T5803] usb 5-1: Product: syz [ 387.130965][ T5803] usb 5-1: Manufacturer: syz [ 387.130971][ T5803] usb 5-1: SerialNumber: syz [ 387.423439][ T5810] Bluetooth: hci4: command tx timeout [ 387.556523][ T5803] usb 5-1: config 0 descriptor?? [ 387.638445][T14175] chnl_net:caif_netlink_parms(): no params data found [ 387.870483][T14216] Invalid option length (0) for dns_resolver key [ 387.905899][ T5803] f81534 5-1:0.152: required endpoints missing [ 388.108914][T14216] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 388.109805][T14216] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 388.133441][ T5803] f81534 5-1:0.188: required endpoints missing [ 388.141774][ T5803] f81534 5-1:0.36: required endpoints missing [ 388.244180][ T5803] usb 5-1: USB disconnect, device number 12 [ 388.515144][ T7655] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 389.233055][ T5887] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 389.319493][ T7655] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 389.393157][ T5887] usb 5-1: Using ep0 maxpacket: 16 [ 389.395555][ T5887] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 389.399327][ T5887] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 389.399353][ T5887] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 389.399370][ T5887] usb 5-1: Product: syz [ 389.399383][ T5887] usb 5-1: Manufacturer: syz [ 389.399396][ T5887] usb 5-1: SerialNumber: syz [ 389.444207][ T5887] usb 5-1: config 0 descriptor?? [ 389.503816][ T5810] Bluetooth: hci4: command tx timeout [ 389.575207][ T5887] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 389.575242][ T5887] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 389.890960][ T7655] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 390.097940][ T5887] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 390.204208][T14175] bridge0: port 1(bridge_slave_0) entered blocking state [ 390.204687][T14175] bridge0: port 1(bridge_slave_0) entered disabled state [ 390.205233][T14175] bridge_slave_0: entered allmulticast mode [ 390.244410][T14175] bridge_slave_0: entered promiscuous mode [ 390.300554][T14175] bridge0: port 2(bridge_slave_1) entered blocking state [ 390.301367][T14175] bridge0: port 2(bridge_slave_1) entered disabled state [ 390.338198][T14175] bridge_slave_1: entered allmulticast mode [ 390.340494][T14175] bridge_slave_1: entered promiscuous mode [ 390.578945][ T5887] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 390.578965][ T5887] em28xx 5-1:0.0: board has no eeprom [ 390.668762][T14175] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 390.673965][ T5887] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 390.673989][ T5887] em28xx 5-1:0.0: dvb set to bulk mode. [ 390.674287][ T10] em28xx 5-1:0.0: Binding DVB extension [ 390.737351][T14175] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 390.740961][ T5887] usb 5-1: USB disconnect, device number 13 [ 390.742116][ T5887] em28xx 5-1:0.0: Disconnecting em28xx [ 390.986389][ T10] em28xx 5-1:0.0: Registering input extension [ 390.987147][ T5887] em28xx 5-1:0.0: Closing input extension [ 391.025393][ T5886] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 391.216640][T14175] team0: Port device team_slave_0 added [ 391.246793][ T5887] em28xx 5-1:0.0: Freeing device [ 391.311828][ T5886] usb 6-1: Using ep0 maxpacket: 16 [ 391.350577][ T5886] usb 6-1: config 0 has an invalid interface number: 132 but max is 0 [ 391.350605][ T5886] usb 6-1: config 0 has no interface number 0 [ 391.373145][ T5886] usb 6-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 391.373162][ T5886] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 391.373172][ T5886] usb 6-1: Product: syz [ 391.373179][ T5886] usb 6-1: Manufacturer: syz [ 391.373186][ T5886] usb 6-1: SerialNumber: syz [ 391.557413][ T5886] usb 6-1: config 0 descriptor?? [ 391.561264][ T5886] hub 6-1:0.132: bad descriptor, ignoring hub [ 391.561300][ T5886] hub 6-1:0.132: probe with driver hub failed with error -5 [ 391.583661][ T5810] Bluetooth: hci4: command tx timeout [ 391.608687][T14175] team0: Port device team_slave_1 added [ 391.710137][ T5886] input: bcm5974 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.132/input/input17 [ 391.867049][T14262] input: syz1 as /devices/virtual/input/input18 [ 391.917381][T14175] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 391.917392][T14175] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 391.917406][T14175] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 391.950714][T14175] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 391.950731][T14175] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 391.950757][T14175] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 392.083227][ T7655] bridge_slave_1: left allmulticast mode [ 392.083246][ T7655] bridge_slave_1: left promiscuous mode [ 392.083390][ T7655] bridge0: port 2(bridge_slave_1) entered disabled state [ 392.126531][ T5886] input: failed to attach handler mousedev to device input17, error: -2 [ 392.164830][ T7655] bridge_slave_0: left allmulticast mode [ 392.166089][ T7655] bridge_slave_0: left promiscuous mode [ 392.166394][ T7655] bridge0: port 1(bridge_slave_0) entered disabled state [ 392.280848][ T5886] usb 6-1: USB disconnect, device number 8 [ 393.872202][ T5850] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 394.424874][ T5850] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 394.424893][ T5850] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 394.424905][ T5850] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 394.424927][ T5850] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 394.424938][ T5850] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 394.427776][ T5850] usb 1-1: config 0 descriptor?? [ 394.584726][ T7655] bond0 (unregistering): (slave ip6gretap1): Removing an active aggregator [ 394.588482][ T7655] bond0 (unregistering): (slave ip6gretap1): Releasing backup interface [ 395.765861][ T5850] usbhid 1-1:0.0: can't add hid device: -71 [ 395.765936][ T5850] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 395.768266][ T5850] usb 1-1: USB disconnect, device number 9 [ 395.892631][ T7655] team0: Port device geneve1 removed [ 396.056399][ T7655] bond0 (unregistering): Released all slaves [ 396.463068][T14175] hsr_slave_0: entered promiscuous mode [ 396.464170][T14175] hsr_slave_1: entered promiscuous mode [ 396.464818][T14175] debugfs: 'hsr0' already exists in 'hsr' [ 396.464836][T14175] Cannot create hsr debugfs directory [ 396.855024][ T5803] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 396.946707][T14882] input: syz1 as /devices/virtual/input/input19 [ 397.023643][T14883] fuse: Bad value for 'fd' [ 397.024030][ T5803] usb 5-1: Using ep0 maxpacket: 16 [ 397.025772][ T5803] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 397.028201][ T5803] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 397.028216][ T5803] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 397.028227][ T5803] usb 5-1: Product: syz [ 397.028233][ T5803] usb 5-1: Manufacturer: syz [ 397.028240][ T5803] usb 5-1: SerialNumber: syz [ 397.335019][ T5803] usb 5-1: config 0 descriptor?? [ 397.460323][ T5803] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 397.460359][ T5803] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 397.977125][ T5803] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 398.401562][ T5803] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 398.401591][ T5803] em28xx 5-1:0.0: board has no eeprom [ 398.663136][ T5803] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 398.663164][ T5803] em28xx 5-1:0.0: dvb set to bulk mode. [ 398.666448][ T5801] em28xx 5-1:0.0: Binding DVB extension [ 398.704456][ T5803] usb 5-1: USB disconnect, device number 14 [ 398.707310][ T5803] em28xx 5-1:0.0: Disconnecting em28xx [ 398.788698][ T5801] em28xx 5-1:0.0: Registering input extension [ 398.788943][ T5803] em28xx 5-1:0.0: Closing input extension [ 398.840398][ T5803] em28xx 5-1:0.0: Freeing device [ 400.443545][ T5801] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 400.604025][ T5801] usb 6-1: Using ep0 maxpacket: 16 [ 400.606416][ T5801] usb 6-1: config 0 has an invalid interface number: 132 but max is 0 [ 400.606441][ T5801] usb 6-1: config 0 has no interface number 0 [ 400.609052][ T5801] usb 6-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 400.609080][ T5801] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 400.609099][ T5801] usb 6-1: Product: syz [ 400.609112][ T5801] usb 6-1: Manufacturer: syz [ 400.609124][ T5801] usb 6-1: SerialNumber: syz [ 400.670842][ T5801] usb 6-1: config 0 descriptor?? [ 400.699731][ T5801] hub 6-1:0.132: bad descriptor, ignoring hub [ 400.699752][ T5801] hub 6-1:0.132: probe with driver hub failed with error -5 [ 400.724372][ T5801] input: bcm5974 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.132/input/input21 [ 400.891161][ T7655] hsr_slave_0: left promiscuous mode [ 400.918408][T14919] binder: 14918:14919 ioctl 4018620d 0 returned -22 [ 400.938150][ T7655] hsr_slave_1: left promiscuous mode [ 400.938755][ T7655] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 400.938770][ T7655] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 401.005678][ T7655] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 401.005697][ T7655] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 401.266393][ T7655] veth1_macvtap: left promiscuous mode [ 401.266452][ T7655] veth0_macvtap: left promiscuous mode [ 401.268441][ T7655] veth0_vlan: left promiscuous mode [ 401.353217][ T5886] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 401.505588][ T5886] usb 1-1: Using ep0 maxpacket: 16 [ 401.517834][ T5886] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 401.523584][ T5886] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 401.523614][ T5886] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 401.523632][ T5886] usb 1-1: Product: syz [ 401.523644][ T5886] usb 1-1: Manufacturer: syz [ 401.523657][ T5886] usb 1-1: SerialNumber: syz [ 401.531784][ T5886] usb 1-1: config 0 descriptor?? [ 401.549223][ T5886] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 401.549255][ T5886] em28xx 1-1:0.0: DVB interface 0 found: bulk [ 402.191996][ T5886] em28xx 1-1:0.0: unknown em28xx chip ID (0) [ 402.649591][ T5886] em28xx 1-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 402.649619][ T5886] em28xx 1-1:0.0: board has no eeprom [ 402.824113][ T5886] em28xx 1-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 402.824130][ T5886] em28xx 1-1:0.0: dvb set to bulk mode. [ 402.824329][ T5990] em28xx 1-1:0.0: Binding DVB extension [ 402.988270][ T5886] usb 1-1: USB disconnect, device number 10 [ 403.028367][ T5886] em28xx 1-1:0.0: Disconnecting em28xx [ 403.217568][ T5990] em28xx 1-1:0.0: Registering input extension [ 403.230937][ T5886] em28xx 1-1:0.0: Closing input extension [ 403.342025][T15116] input: syz1 as /devices/virtual/input/input23 [ 403.678677][ T5886] em28xx 1-1:0.0: Freeing device [ 404.237447][ T7655] team0 (unregistering): Port device team_slave_1 removed [ 404.403555][ T7655] team0 (unregistering): Port device team_slave_0 removed [ 405.551561][ T5151] usb 6-1: reset high-speed USB device number 9 using dummy_hcd [ 405.835030][ T5151] usb 6-1: device firmware changed [ 405.845339][ T5801] usb 6-1: USB disconnect, device number 9 [ 406.263495][ T5801] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 406.450401][ T5801] usb 6-1: Using ep0 maxpacket: 16 [ 406.452139][ T5801] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 406.454546][ T5801] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 406.454571][ T5801] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 406.454589][ T5801] usb 6-1: Product: syz [ 406.454601][ T5801] usb 6-1: Manufacturer: syz [ 406.454614][ T5801] usb 6-1: SerialNumber: syz [ 406.545483][ T5801] usb 6-1: config 0 descriptor?? [ 406.551100][ T5801] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 406.551119][ T5801] em28xx 6-1:0.0: DVB interface 0 found: bulk [ 407.309800][ T5801] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 407.857451][ T5801] em28xx 6-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 407.857481][ T5801] em28xx 6-1:0.0: board has no eeprom [ 407.933007][ T5801] em28xx 6-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 407.933026][ T5801] em28xx 6-1:0.0: dvb set to bulk mode. [ 407.933227][ T31] em28xx 6-1:0.0: Binding DVB extension [ 408.007848][ T5801] usb 6-1: USB disconnect, device number 10 [ 408.056799][ T5801] em28xx 6-1:0.0: Disconnecting em28xx [ 408.336882][ T31] em28xx 6-1:0.0: Registering input extension [ 408.337026][ T5801] em28xx 6-1:0.0: Closing input extension [ 408.356864][ T5801] em28xx 6-1:0.0: Freeing device [ 409.458174][T14175] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 409.503784][T14175] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 409.562491][T14175] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 409.649813][T14175] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 409.969045][T15211] fuse: Bad value for 'fd' [ 410.258562][T14175] 8021q: adding VLAN 0 to HW filter on device bond0 [ 410.964854][T14175] 8021q: adding VLAN 0 to HW filter on device team0 [ 410.998605][ T7659] bridge0: port 1(bridge_slave_0) entered blocking state [ 411.000765][ T7659] bridge0: port 1(bridge_slave_0) entered forwarding state [ 411.057122][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 411.057343][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 411.473068][ T5886] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 411.633522][ T5886] usb 5-1: Using ep0 maxpacket: 16 [ 411.636013][ T5886] usb 5-1: config 0 has an invalid interface number: 132 but max is 0 [ 411.636036][ T5886] usb 5-1: config 0 has no interface number 0 [ 411.638834][ T5886] usb 5-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 411.638861][ T5886] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 411.638878][ T5886] usb 5-1: Product: syz [ 411.638891][ T5886] usb 5-1: Manufacturer: syz [ 411.638903][ T5886] usb 5-1: SerialNumber: syz [ 411.687636][ T5886] usb 5-1: config 0 descriptor?? [ 411.743787][ T5886] hub 5-1:0.132: bad descriptor, ignoring hub [ 411.743824][ T5886] hub 5-1:0.132: probe with driver hub failed with error -5 [ 411.822092][ T5886] input: bcm5974 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.132/input/input25 [ 412.366702][T14175] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 412.674408][T14175] veth0_vlan: entered promiscuous mode [ 412.690888][T14175] veth1_vlan: entered promiscuous mode [ 412.935358][T14175] veth0_macvtap: entered promiscuous mode [ 412.951783][T14175] veth1_macvtap: entered promiscuous mode [ 413.346186][T14175] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 413.436376][T14175] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 413.457800][ T1553] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.457861][ T1553] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.457907][ T1553] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.457938][ T1553] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 414.019125][ T7655] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 414.019140][ T7655] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 414.126842][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 414.126857][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 415.866623][T16014] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 416.080181][ T5801] usb 5-1: USB disconnect, device number 15 [ 416.765845][ T5801] ================================================================== [ 416.765940][ T5801] BUG: KASAN: vmalloc-out-of-bounds in __list_add_valid_or_report+0x4e/0x130 [ 416.766063][ T5801] Read of size 8 at addr ffffc9000e7f1008 by task kworker/1:3/5801 [ 416.766076][ T5801] [ 416.766101][ T5801] CPU: 1 UID: 0 PID: 5801 Comm: kworker/1:3 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 416.766118][ T5801] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 416.766129][ T5801] Workqueue: usb_hub_wq hub_event [ 416.766206][ T5801] Call Trace: [ 416.766216][ T5801] [ 416.766223][ T5801] dump_stack_lvl+0xe8/0x150 [ 416.766301][ T5801] print_report+0xba/0x230 [ 416.766326][ T5801] ? __list_add_valid_or_report+0x4e/0x130 [ 416.766367][ T5801] kasan_report+0x117/0x150 [ 416.766437][ T5801] ? __list_add_valid_or_report+0x4e/0x130 [ 416.766453][ T5801] __list_add_valid_or_report+0x4e/0x130 [ 416.766469][ T5801] kcov_remote_stop+0x457/0x680 [ 416.766504][ T5801] hub_event+0x49d8/0x4f60 [ 416.766540][ T5801] ? __pfx_hub_event+0x10/0x10 [ 416.766569][ T5801] ? process_scheduled_works+0xa25/0x1830 [ 416.766599][ T5801] ? process_scheduled_works+0xa25/0x1830 [ 416.766617][ T5801] process_scheduled_works+0xb02/0x1830 [ 416.766644][ T5801] ? __pfx_process_scheduled_works+0x10/0x10 [ 416.766664][ T5801] ? assign_work+0x3d5/0x5e0 [ 416.766682][ T5801] worker_thread+0xa50/0xfc0 [ 416.766709][ T5801] kthread+0x388/0x470 [ 416.766723][ T5801] ? __pfx_worker_thread+0x10/0x10 [ 416.766740][ T5801] ? __pfx_kthread+0x10/0x10 [ 416.766754][ T5801] ret_from_fork+0x51e/0xb90 [ 416.766785][ T5801] ? __pfx_ret_from_fork+0x10/0x10 [ 416.766802][ T5801] ? __switch_to+0xc7d/0x1450 [ 416.766828][ T5801] ? __pfx_kthread+0x10/0x10 [ 416.766842][ T5801] ret_from_fork_asm+0x1a/0x30 [ 416.766861][ T5801] [ 416.766894][ T5801] [ 416.766898][ T5801] The buggy address belongs to a vmalloc virtual mapping [ 416.766938][ T5801] Memory state around the buggy address: [ 416.766947][ T5801] ffffc9000e7f0f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 416.766956][ T5801] ffffc9000e7f0f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 416.766971][ T5801] >ffffc9000e7f1000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 416.766978][ T5801] ^ [ 416.766986][ T5801] ffffc9000e7f1080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 416.766995][ T5801] ffffc9000e7f1100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 416.767002][ T5801] ================================================================== [ 416.767016][ T5801] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 416.767027][ T5801] CPU: 1 UID: 0 PID: 5801 Comm: kworker/1:3 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 416.767044][ T5801] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 416.767053][ T5801] Workqueue: usb_hub_wq hub_event [ 416.767072][ T5801] Call Trace: [ 416.767077][ T5801] [ 416.767083][ T5801] vpanic+0x56c/0xa60 [ 416.767104][ T5801] ? __pfx_vpanic+0x10/0x10 [ 416.767125][ T5801] panic+0xc5/0xd0 [ 416.767142][ T5801] ? __pfx_panic+0x10/0x10 [ 416.767160][ T5801] ? __list_add_valid_or_report+0x4e/0x130 [ 416.767174][ T5801] ? rcu_is_watching+0x15/0xb0 [ 416.767201][ T5801] ? __list_add_valid_or_report+0x4e/0x130 [ 416.767214][ T5801] check_panic_on_warn+0x89/0xb0 [ 416.767238][ T5801] ? __list_add_valid_or_report+0x4e/0x130 [ 416.767250][ T5801] end_report+0x73/0x180 [ 416.767269][ T5801] ? __list_add_valid_or_report+0x4e/0x130 [ 416.767282][ T5801] kasan_report+0x128/0x150 [ 416.767301][ T5801] ? __list_add_valid_or_report+0x4e/0x130 [ 416.767317][ T5801] __list_add_valid_or_report+0x4e/0x130 [ 416.767332][ T5801] kcov_remote_stop+0x457/0x680 [ 416.767349][ T5801] hub_event+0x49d8/0x4f60 [ 416.767384][ T5801] ? __pfx_hub_event+0x10/0x10 [ 416.767406][ T5801] ? process_scheduled_works+0xa25/0x1830 [ 416.767423][ T5801] ? process_scheduled_works+0xa25/0x1830 [ 416.767441][ T5801] process_scheduled_works+0xb02/0x1830 [ 416.767468][ T5801] ? __pfx_process_scheduled_works+0x10/0x10 [ 416.767488][ T5801] ? assign_work+0x3d5/0x5e0 [ 416.767506][ T5801] worker_thread+0xa50/0xfc0 [ 416.767532][ T5801] kthread+0x388/0x470 [ 416.767545][ T5801] ? __pfx_worker_thread+0x10/0x10 [ 416.767562][ T5801] ? __pfx_kthread+0x10/0x10 [ 416.767576][ T5801] ret_from_fork+0x51e/0xb90 [ 416.767594][ T5801] ? __pfx_ret_from_fork+0x10/0x10 [ 416.767611][ T5801] ? __switch_to+0xc7d/0x1450 [ 416.767628][ T5801] ? __pfx_kthread+0x10/0x10 [ 416.767641][ T5801] ret_from_fork_asm+0x1a/0x30 [ 416.767660][ T5801] [ 416.767928][ T5801] Kernel Offset: disabled