last executing test programs: 8.311332295s ago: executing program 2 (id=2006): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x5, 0x4, 0x8, 0xc}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_DELETE_BATCH(0x1b, &(0x7f0000000240)={&(0x7f0000000180)="484a1e9f0a296a1edda568735b175adba4a3682cabf4e8373bb7e7daf0dce87850ec769df0796230b08ed89fce6abe202dec401a3a8e7b87d7eaa3fda0984550f74589859ef7a5f516a584fa15cfcb2e45c1bb2c33905d9b03fec894fdb285c03c99a80e1e8f4a0401b76c6328d378f237ee3370dd0d60ffabbca116eb882e12e042b371f637108a6b2bbb5fd7e8464ed528b333bf1d959d3b92511f72de2f6990a0e22652b82e3d17a4bbe4fa89a8e783fe4ceec3d0bb", &(0x7f0000000300)=""/137, &(0x7f00000003c0), 0x0, 0x1, r0}, 0x38) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f00000007c0)="d8000000180081064e81f782db4cb904021d080006007c09e8fe55a10a0015000500142603600e1208000f0000000401a80016002000014004000000035c1f61c1d60008000000000000fb8000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cee0090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db7010000", 0x9a}], 0x1}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x20, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000001"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000700)="ef16", 0x0}, 0x50) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)={0x20, 0x40, 0x107, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0x4, 0x1}, @nested={0x4, 0x2}]}, 0x20}}, 0xc000) bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) sendmsg$IPVS_CMD_GET_DEST(r1, &(0x7f0000000600)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x10805}, 0x44049) r3 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r4, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r5, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 8.247685602s ago: executing program 2 (id=2008): r0 = syz_open_dev$loop(&(0x7f0000000100), 0xf01c, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000400)={'#! ', './file1/../file0', [], 0xa, "521299a432289bd6a32f695c2f61ba693bea0aa53f5db534de379d0418026c1f265a707f7b5008ab99f2c9a997ad07bea398ccfcdc48da03fd070a"}, 0x4f) write$UHID_INPUT(r1, &(0x7f0000001800)={0x8, {"dc5d3b0169633d3eba3eab3c09167be55101d4af4b22a373236464d2dbfaa84399b77bd438a54364a7ebc5bdaab4f9decb7c044318cd59a0af8279bcab35dd7daf7a0ceb381df2c32eff45b13e2c8f40e1895355bf6f165200cb1ca41a155730ee2e9f83183f9fafe029d0401b0770618254a8b2dc87b630072b1e2de160d1afed51b74c14b71ec1b226a324482d14ad586b1a4ce80e458fe45244c01eddeddf3564af838d6d5324f8a77023d6eb7aa14397a0e1413ea1c3dfdf063a35b709e627f36fe403ee3117365be5017682f53595f28543062c740a94a794312f5cebc315044b8ea000a5d0f27812ab0ce149d11e6f6f7620c5f3e250bf67d13a1ca39dbb7b8b5a31e3d7ba7ebe5849a7a09b61fc9f2cfc54b89e9cd0105bca49483ce55e0187ce2ad692a18219d881057c838587b915337169ee054655f26a04df913a658fccbf4def6aad750ca4796b74d322c67e9d4ee6a530a22dcc35db850b424d6ec9f62495b9f9fd2b000feadd57d26dbd505798c208d91eb0aab0fd97537631b8bf81ce0e2241c4272be4ff69b390e4485d574146b76d1fdbf7fc5334906805534cdae1e47240af7761a18fc8bd0a694be47529da98bc0f98eb7db3fc4a74cbb6e486f4de90fbf2452e72c2e1dca44543ad9ad094b8bc861e0000814662d1b350339e3a510d459c6f83aabd5fd3dcb38224056d761e7df9b482b9905f1e2135c1929be328ecdb69c007a3efd548502c83106f6df1ab1178fac499eda92ad4373155227ec2df150c919d322ecb3ea37e659285f18a3e2f79b59900ca438df3a1381380a12d3ad7678e0a8d3bdfb40651389b4ac8c66138d442d70eafdc2df8b080028006b124e4ebe0d9883ef100f1934e42794146382c1d628fd2ebe5859b6c243824903d056d800975675bb1913142adbc039a9c68c2f146a0e8903447313f5e5549905f397a9b1f21a93b80c4d04a8ea7a29a50fbc5407a9305bba420edf898ea678d6879489c39692c99bbb38b9196fafaaf87b2796eadc21466af5a10281e6a808748969d29efb444c99a4cb2111732a792dbca4376a125a68f7cdac065cc6173dc21caafba48c742d9a7df2f771ff2f5725b22c247d4e0c6106f9f5f6929b69929ab37e9a9b326ce618bb702b883b12026f1300f21f2c7440cac8c5f1210a78aa067211d2827f5dcc7578252c2ccc3f67bab9d1bb6939b21b550788ef550acfed4bf50c0b4fb3ca4d2872ee64f95d611a317d9daaf373a10d868680b2226396c95fa2b0ab4d6fce06c3b42cb97d17a7b5089061537fdeb1a53040869f7befca330358fdba86754fc2e46c2113e1484cb37534af8f0408a7ee313778dab49f08229964298f847ea66c4ec319f64b6a12da585bc59e82e0263c507b397d3efee3b4066f4d25566aa1549f6185f6375f84b65fa8945148b90430c86a5b6fdf58d5c812b98d9dc621fd9a3d9f1a577495356516d1cbcf5e8bb8923b54b247225b9c3892b18a9e137f3620c734052af9dc8f1ea36f0d4592d5ee32e35676a84dc891f97456f2ac3a4ab58a42bcdc221a4ac8bb28d428add2fcbe5b110a8afd5d23b31e827bd16167b2d88cae024afc04a722ac0b4d45c52512e6b6f102aac4be21bc89ce246539048370553665b0a4336a6db99d0d19399be6437bf21419304331b4342b2c1db580f0c9bf681fdb8e9fa3e025454197bbc82ef93ee2f385660818ec5127080675a8013766469afe3b1e36e81bf2f04c3a26eaf4517551e734d21ba3bc90e48aea0891792970c39f3f528397e9b7ae190f1760fe5960dc763ee0a17939c60bfcac0a8914be82c749e4fe85dcc3cfa733413468fb8941085e8c4d6e0b6d1e62e20da58440facd640ddbb6c1f694b3ca48757a34c5a11668368711a1d4f3a81d31ac30d71277d7ae77882b6841cfa6289e6cce84a3ad57eeb328f831888ac7d3cfcd3a472a48d903f20cec8c8ae8d0bea04ebf7413ef7693f8ed876e49bd5f89d7e1078208ff62712e330fc0341b9ccf26845578d44b1e0c66d1bebc14742baedfabb8e9a2c8f42730360c72997efe0ce786ff330c2eb6e0ff20896f813c2a515ce76f805c11a1c1588eb369231ddeb4a2f9f9591ecdecc74d20aeb50047beb3ab89a9e4e1b805a20b645c79d0bc5d0247fab8ba46a97a07630b1f1cb69b42b568af746733d2c581f057873d64fe6e659b00b4a26745f5fba1fe7406a86b007936c7cfdac53a4c5b0ea9f6604863c8e3f174eddbb09175f6e13cda9a860cf400ef9ed02b895502ac6e6de6a658249c3c6e8a653517eae2231e56e0f120547923c6549ebc1ed14c623637ce3d96af5c93a32e58e2d9659d8b5b145888b52d9a5b5cb3cdf594eb137bcef2ba068cfd2c6ccf7ab6e5b4ec55e9197bfb91c9b8729f7b50cf0b0326f7ea3e712c77674d48545ca2a86744c3c38f149d69cf811beacf7e5f49c7bfba20f1dcf3d7bc0b9c796016820a46495d244c9606a06fe2e14233eda78d69ae4523ad7b708b0c7ead44d7fd376fed60e3cc2ee25e9600adfbe87ac7c8fb8269aec9459602af0f420becda6120ce7d9626c65ae7f860639e8bf664eb4301ec18add0e436c0356c12ab6b4ca35da2b43c4a8c239fd0b59a2ce94843cdfa1667053165053633b062844dbb0d00070fde74fa3178eb5f1f5fd02e2088d8690379f39ab22c080cdcb29d700bac74fabd8a356fe99afe83a5d99aa5024e9158a299eda6c99b6701e64f1d68e7e2c0c6e88396bb535a02d0948f0a250a6e090041c96d9c9acd6134d44d516fd1010c39e572b86b05bb1326a2a4f23f11181186f9c2a01dc7b58c0129f4b851ca9b1e3dc35db7364e29ef646211796b1651511e041345abce427fa5d6e48b8fb078c8432061a4cc518a8f2a2caf709a5c1473a62112a6650afc64eec12f8f9c08cff1b6fbf7a1209fc8661f62303b7c5d49c1d0b32a9f37e81ed9ab6193816d40995ed49c10b9f5752e04d57535a3d16f06c65d32846c31ec9787ec4a965679eb804e86b45d007f38d8104550770dc6f313bc846e43a14a8c21d0628c744e3e83cb998d1b7acfe996541a8c03852dadf9326444c582b481cae844e4f3fe3d638903b38f24633b63adbad841ac6c4c1169d781a0e271e8a967b1c7e986fcb3a66168e86e3559a44fcfa92452260491da9397659af60453f4cd4be2d15439445ec2b4366a79d3283da912d9d499df1242bd1741d2735848caa21d2c997aff0e95c7e5cc0803c90fab84e7be7b37909d0e2f3bc9974e3388acb6800baba183ecc8eea8c71c0d65d669e41f99ceae523b7a6b772f3b8ebba1d2127ccc3ddb7ddcb4ec73cbdc26fc87c3848e258a0b5484d3a13e40ec4e4a65dd92f09e9fe1e3e2f8b96c4e363aa3683860dee62dfcf8823ee4a3593a092e0bd9c4cedacf44a272faa164447b01f46a7795642a40c61b0034a37f0e9b792428a0ddcd144fe8263088eaac8016f8f1cd30b55ac90a8f10d785b7570dd9e639a4a068d3fe98a420b9f72e79de817f676c2a224300d749571ad43f49d1fbe838f4566bc7b5f104c384ad87189213152b644d9fcbdf98bafeee569d640ce9045779f1d90024c023a7480a358dee276fba139c14b4fdb12885240903d0e61dc161659a68f62c92b899007e0f2b65bf0a069e9e57c9b6ae50a3b30dd1003fb0eead73ae2f6010b3b356b4060579a4f29935e1f00c01d12e5f44e8e3163d81dfef7ca8560604240c7e96e4454c6971614df306c768121abb3f628e3f1d2d026f58d1087334c5bdb74d7c949b0ee66a4531ba4e9b922aee3d0f802ed034734507a5913c52966f1f8bd4577840de0253aabc23299dced2a299859c07af9fb0f9c29b6533b9d84d471390d59ab315f5ddb226f6b8dd7889295f0fb1f7bd1adafe4cc520a1e84bf2a59d5b9795aeafc8d6fd66a8228aba8653b98622617ddfeb5d6795c9bd2f35d4a0c386e862675a50e3314c3fbb17aca151c13c7fc8b1d1b72ed0a958537b5ddc9e74bddc2b9571ec3f2b7775b125338d4852a75a63941564c65bb36dfb6bea4aab1ae7a4f285c2177aa98406eb2cc10934aa92d5a9612d4455c84ad200841d289b5c2d5deab0d8e2459598ef183d3dc47f6bad0b9513710600cfa4d69fcd5763cdcc4f2c2b7cd7d4491fd52f4aec82ce846c0988f6f0123e21e900d39c61085e68c9badc350b44004f6c042d64b0d0cbf91ad0592b198f1eeea1e52200bc8e6d62848d6884b10bdde72466039da488be6b340c23148f666f2fe6e032c07dac43586df182aca9116f4600313fa8375c76337ba86bdc391dae6450218f58f047ced64befc6bb5c2a60024669630a6279fedf2fe45e7e19ce582ad96ae0d023eb9b39f5f1e666e73bb038ae38157275be5eb3e7cbc8b05adf53e817646bdc2cfce98e5d162bf7faaca787db8717ab8b27b9e35609c5fb9fe9def07f010df8b43cf5c96851eadfdeff0b7bc5826e7e15490ae9c3d14166ee81bef007070e7981235a673804ad89943ee6b51ac63364f7870e121e6ff23a0c7d179527cd58dd7a4ca37247c2bd9efc79b720bb1ee2d39862e98cb81e93cf5b48d5d02ee8ac737ab504c867a1c49e678300803c94fbe978dea918a1e71b9791ee1e4d30056e86c26a4675a8b090be2365c0b451a13ece52a89a7057fe2052e11c6666eb916d823ea66bf217c3219cba3b714910734b2d27c2fa586bd7f7664b0d1422adabad2ce2afc10270057f11940fac1a51d023ce48bd04ea39b7f99381b239fd0ddeea0dce7863ec1f8f61775013b6414ecf86e686a340a3148f87a9d7d60a1f2da53436d16fc88d6a4e7c3d55e0dd004cbecc15a5558eb705d82aacb1862ddc251dd5d9cbf1d78f97900ce6e8dab0ea678cb823bd1e7bbd1e927841af08f5427878c19f4f322228f9b36287fc13e7c1293ea875ae73815e052d6c2ebc40df8f7b9d1f76e0b10e35aa160944983d8e6b790df0d9b13f3460657336d81f7d83c0350324b930ec9c7557ce12887f76372e126f504b0980fea27f31a780c05187b9b5353dafc6b101543b24332b96e15bc26b19062e52fa9f86d260ee3a3bc92a133e328407bb85357ee5c45cb87228f44888b14941b5911b050e9319fe88033f830a8490917a9c0572ebbc5492b4e1083a2e3d77215a34abef947b5b9a950e780662de18873e55899c92db3ad3d437e8407890afa6b0c04ef861b8b0100000000000000ef001409f84b8ec4f01d861cecc143a805b981ab5cf5b605057b63cb2c84ec358e510a69cd8c33a8a62fe4680d0c980145cc709157832bfaef261cb0466c237376ca2944ce9affffd4b1dc7cc9511da0b34bffb9ac216fb8cf7c6572d95627787720d1ba67c6512fcdb16f6329e9668681c404efebad559f81f05971b5efb6b4cca97ad0346753cc0a40a877242d8a808c602b03dc962cee38e646cb18abb079c70d357c30738a70f55cd3c5956a83a1bfcd6649dd765f16bfe968066345df7380bbc0c16b3b5af513d6458c791343952f33a051c5d711c1f35af1b47f3db9bbfb5c7c636b3a2b52805d606479879be0b404a28ade5649a3185e0f85a85fc15cd824671c2befdd0da509597c87d869f0bd7ad163ad93ca28fc0c4025eccaafe385ec3fc06c54ebcd7b07b6c7e0197c5b9ef886159a1585ae45248f865be760db6f5bc8f868fc6aefd04e34ecb51159e4cdcc2214b42b1ca9caec13ba3e1b2e7a3c736977b226213d265c2873195122a9b448088c8b50edd549be41c38ab176807b75e7267f86e400", 0x1000}}, 0x1006) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc5e3ed1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbf508598948224ad54afac11d875397bdb22d0000b420a9a93c5240f45f819e01177d3d458dd4992861ac000000000000000000000000f000", "90011265406c7f6032805875cedf4700000300"}}) 8.095257721s ago: executing program 2 (id=2010): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000000)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = getpid() write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x3, 0x80000000, 0x20000006, 0x4d, 0x6, 0x5d, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x3, 0x0, 0x8, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x28, 0xd, 0x7, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x242, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x8c, 0x1000, 0xffff, 0x0, 0x5, 0x4, 0x8008, 0x400, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x2008004, 0x5, 0xfffffff3, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2c0, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f2e, 0xd, 0x4e2, 0x2, 0x4, 0xb, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0x81, 0x48c93690, 0x42, 0x3], [0x7, 0x408, 0x7, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xf, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xca, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x3c484551], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x93a, 0x5, 0x6, 0x0, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x101, 0x10000, 0x2000004, 0x7fff, 0xffff, 0xa620, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x4, 0xc8, 0xfffffff9, 0xfffff000, 0x10000, 0x0, 0x7e, 0x100, 0x9602, 0x7, 0xaf, 0x5, 0x6, 0x226, 0x5, 0x4, 0x8, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb3e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) io_uring_setup(0x3450, &(0x7f0000000080)={0x0, 0x1539, 0x0, 0x2}) r4 = syz_pidfd_open(r3, 0x0) setns(r4, 0x24020000) syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) 7.88698292s ago: executing program 4 (id=2013): getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x101}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = memfd_create(&(0x7f0000000580)='\x103q}2\x9a\xce\xaf\x03\xdfyR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7R\x94\xaf\xbb\xdcM\x90k\xd6\x05\r\x84\x87\x1e?\x10\x95SWFO{\x1f\x1b!\xd5\x991D\x1c\b\x8c`\xeaSA\x90m\xb6&\xd0\xf1\xb3\xed:\x82\xbd\xe3i|B\xe2ar\x04R%[k\x0f\xfdV\xacL\x1f\x9d\x00\x00\xc5\xb8$\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\r\xd6h\x80\x8fQ|\xf5d\x10\x10\xd7\t\x00\x00\x00\x00\x00\x00\x00<\xfeeS\xb2l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfaa\xd3\xf1\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7~x\xb8vo\xe6\x15@\xc9\"CY\x11\xb9u\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D4E^7%8\x94y\x90\xf0l\xa0\'L%\xd4\xda\xee\x81\x98\xcc\xfd\xa2\x89$\x9by\xf1\xbb\x01\xb7\xcd\xbf\x99\x1f\x90@b\x03\xb3\xe0CfU\x16{\xbey\xa1cs\x96U\x11\xdb*\xdf\xcdG\xc7z\x85\x8aE\xf7\xd5\x9dAj\xe3\xfb\xc4\xa0\x14\x87\x19\x17\xed\xd1\x185%Q%\x81\xfaK\x82\xec=\xa3\xb8~\xb6O\xbd\x19*\xdb\x1c\x10\xa4\x8dI\xbd\xc1\xceG\xd0h\xa1\xab:dP\xb6\xa0BR\xbe\x03\xac\xd9\x87\x00@\x80\x94\xd88\xc9\x03\x86P\x8d\x12\\\xf9\x00T\x8f\xcc\x7fF\xb5\xea\xa6\xc1\x9d\xac\x89\xc9\xa1tuJw\xee\x1a\xe73\xa8\xadS\xd1\x11#d\xc2\xcfdj\x9ec\x93vw\x85\r|\xf0\xa6\xd5K\x90*_3\x89\v\xab\x04ih\x12\x93\xc5m\x8f~{\xe5\x85\xa5g\x00\x00\x00\xe45Q\xab%\xa8[\xf3\x17\x94\xf8\xdfq\xff\xd2?\xafW\xde\x1bW]\x1f\aaV\xc5\xc82*\xc7\xc5\"C}L\x10e\xc6\x90\xc0\xf9z\xb6+/d\x86\xf2\xbe\xc9:u\t\\e\x05)\xe4\xd2\xc4\x1a\xc9\xac\xdb\x925\x02\x94@\xa2\xe1\xee\x16\xb4\x98\xff\x0f\xbb\xb2\x81\xcf\x13g6l\xcc\xc8\x02\v\xa2\xb2\xf6\xbf@d\xcecC\x9fVz\xf4\x14\xa5\x8b|\xe1\xc0\xfa3X\xf4\xd9L\xe6\x8f\x9dy\x0fX.\xc5EQ\xd1/\xa1\xd0\x03>\xf0\x90\x13B\xe2\x97\x8b\"\xf7\"\xecX\x92\xab\xbc^\xb2\x80@\xcc+\xbbp\xdc|N\xd3[=G\xb2\xe1\x9c\xc5\x81y\x84\xef\xacQ\x01\xdd\xe7<\xb8\xf1Hn\x86\xa6\xe3\x18N\x19\"[-\xdb\xef\xc3\xe0\xa8}9q\x92~}M\xceA\xe1)\a\xf0p\xa3\x8dkCvo\x85N(\xdd%DP\x88FW\xb5\x97\xe7\xb8}\xb6/\x95\xb0\xb9\xc9\xb1=\ac\x91\x1d,\xd2\xf5g\xfd\x97X\x1e[\x84\x7f\bO\x16\x84\xefa\xd1\xb3\xf7\\g`\x026\x1f\x89/\x01l\xc1%\xda\xa1:\x99\xf1,\x86f\xe1\xb6\x83\x06\xdd\x91{x\xa1P\xd7\x1d\xa9c\xde\x7f\x8fJ\xae\xf1\xc3\x81@\x1e\x93\xaed-X\xd2\xa7e\xa0\xb3\x16*\xa5\xb1\xd3\x8d\xa4\xf2\xe5\xa2\xe7A\x19\xf4\xa92ok\xf2\xd2\xc74\t*\xb67{#J\x1b\'\xbb\x9b\x99\xda^\x1e\xf6\x03\x9316\xb5T\xbb\xb2\x93\x1b\xfaj\x00\xe8i\x85\xd2\x05!\x87Q\xe5\xbdZ\xcc\x98\xcbY]0\xf7\fl!\x00<', 0x0) ftruncate(r3, 0x800799c) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) connect$inet6(r4, &(0x7f00000002c0)={0xa, 0x4e20, 0xffffffff, @mcast2, 0x9}, 0x1c) sendfile(r4, r3, 0x0, 0xfeff) 7.654449424s ago: executing program 3 (id=2014): socket$inet_sctp(0x2, 0x1, 0x84) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='numa_maps\x00') r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000440)={'batadv0\x00', 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r8, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$BATADV_CMD_SET_MESH(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000023c0)={0x24, r4, 0x1, 0x4070bd28, 0x1, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x20}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}]}, 0x24}}, 0x18) openat$mice(0xffffffffffffff9c, &(0x7f0000000100), 0x53d040) ioctl$SNDRV_TIMER_IOCTL_CREATE(r2, 0xc02054a5, 0x0) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, 0x0, 0x0) syz_open_dev$MSR(&(0x7f0000000000), 0xff, 0x0) bind$bt_hci(r0, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r0, 0x400448e6, &(0x7f0000000380)='G') 6.7785252s ago: executing program 2 (id=2015): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x5, 0x4, 0x8, 0xc}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_DELETE_BATCH(0x1b, &(0x7f0000000240)={&(0x7f0000000180)="484a1e9f0a296a1edda568735b175adba4a3682cabf4e8373bb7e7daf0dce87850ec769df0796230b08ed89fce6abe202dec401a3a8e7b87d7eaa3fda0984550f74589859ef7a5f516a584fa15cfcb2e45c1bb2c33905d9b03fec894fdb285c03c99a80e1e8f4a0401b76c6328d378f237ee3370dd0d60ffabbca116eb882e12e042b371f637108a6b2bbb5fd7e8464ed528b333bf1d959d3b92511f72de2f6990a0e22652b82e3d17a4bbe4fa89a8e783fe4ceec3d0bb", &(0x7f0000000300)=""/137, &(0x7f00000003c0), 0x0, 0x1, r0}, 0x38) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f00000007c0)="d8000000180081064e81f782db4cb904021d080006007c09e8fe55a10a0015000500142603600e1208000f0000000401a80016002000014004000000035c1f61c1d60008000000000000fb8000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cee0090000001fb791643a5ee4ce1b14d6d930dfe1d9d3", 0x7c}], 0x1}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x20, 0x3, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000700)="ef16", 0x0}, 0x50) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)={0x20, 0x40, 0x107, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0x4, 0x1}, @nested={0x4, 0x2}]}, 0x20}}, 0xc000) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) sendmsg$IPVS_CMD_GET_DEST(r1, &(0x7f0000000600)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16, @ANYBLOB="00022cbd7000fddbdf25080000000c00028005000d0001"], 0x20}, 0x1, 0x0, 0x0, 0x10805}, 0x44049) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r5, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r6, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 6.718742268s ago: executing program 4 (id=2017): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, 0x0, 0x8000) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000001a40)=""/102392, 0x18ff8) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f00000002c0)='tmpfs\x00', 0x0, &(0x7f0000000300)='usrquota') 6.418648888s ago: executing program 0 (id=2018): r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_PREPARE_BUF(r0, 0xc058565d, &(0x7f0000001340)=@userptr={0x6, 0xa, 0x4, 0x2000, 0x6, {0x0, 0x2710}, {0x4, 0xc, 0xd2, 0x9, 0x77, 0x0, "0080ca4f"}, 0xff, 0x2, {0x0}}) r1 = add_key$fscrypt_v1(&(0x7f0000000000), 0x0, 0x0, 0x0, 0xfffffffffffffffe) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) keyctl$unlink(0x9, r1, 0x0) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='devices.list\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000100), 0x208e24b) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, &(0x7f0000000180)=0xdc39) recvfrom$inet_nvme(r3, &(0x7f00000001c0)=""/251, 0xfb, 0x40000000, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) syz_emit_vhci(&(0x7f0000000000)=@HCI_EVENT_PKT={0x4, @inquiry_info_with_rssi={{0x22, 0xf}, {0x1, [{@any, 0x1, 0x8, "f6e84e", 0x5, 0x6}]}}}, 0x12) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) socket(0x1d, 0x3, 0x1) syz_emit_ethernet(0x3e, &(0x7f0000000040)=ANY=[], 0x0) 6.417589578s ago: executing program 3 (id=2019): ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, &(0x7f00000000c0)="ff", 0x1, 0xffffffffffffffff) r3 = add_key$keyring(&(0x7f0000000540), &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_MOVE(0x1e, r2, 0xffffffffffffffff, r3, 0x0) 4.981586642s ago: executing program 2 (id=2021): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_wait_time\x00', 0x275a, 0x0) write$cgroup_int(r0, &(0x7f0000000000), 0xffffff6a) ioctl$FS_IOC_RESVSP(r0, 0x4030582b, &(0x7f00000001c0)={0x1100, 0x2, 0xffffffffffffffff, 0x9}) 4.352490116s ago: executing program 4 (id=2022): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) sendmsg$sock(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000008c0)=[{0x0}, {&(0x7f0000001400)="12b5ca8883a72c61be64d1809e4e551c8fcc795bacbc79d1a786c09a1861dfb427e430bee5b00ac73434620f11a914ef7cf7658efc365a26b43990993f60d4ffeb9cc31d7d5fc06ba7c3a4d828f40fca355cff79686f12971618904dc7d09e85e7a5f9194c4cae7983ee20f6c522b89ecc73c43438aad7dd15ff4738f5e4e1b7713142e7ff6cfc1b6cf7baba9ebf3b471cd0a72011fef02b46e280ad7a8c42d24bfb2ffe1518bc0fea207ec37a9e388c9dea8124df3f50a75f03df8d30d7b3b73e274042a52c058e1d85ef3b420b4dfce815cff6265e625a61b6fca9699edaadd192a3ae60c765260d1cbfb21f0cc30d8128b3783867b85873de07b02635d5573f9e578094a3ce6efbf44818daef38e14005a360909d226d7e13a86f6c83b6aaf615b6a2642d17bc2c56b8b0f8209e20ec1e0f58b0486493e511ab0a45b44a87340a9052ef5fba93c83753f1b101a744407f54d052188087c1cf43de80fd7bd5f3ce8585b5499959e6c3f5e17ae837d7c5627abb604947ad9906d641658f01464f48244182de8d5a8d037403ad4a964e2124177771a84806cda0682d58743928d2d16d83fd8b706a9669ac7605e8d857ac586dc2eda90715951c21bd116ade52f03cd61f3874aaefa77da678450228eb476d84bf175564a215e1683ced4bb9adba5daed835c6b38b61b213834aca56b86259784addb8601d26a42ad637ee296cd4382aaa7c1eaa5cbfa3a7177390bc646916aeb885d2dd43fc5b2dbbd2d184ba6cc6a439b95b5d814a8582405635b5c6bdb41c24af7a10bbd264eb2308a800a09705ac7856a7ac993cb4d88fea4cd1d5cf9e82e10c4badb996f4c0d5fd5866baf90a07d8777f793feb9250e22dd5190aa26c2a31412f1b41e0a65d0e435a9c5ebbf5205f6c6a117ce1fb16e8eb797e7d3eb5d62178dc0441941e9cb464814982ebe54195d73113efc971799121683f6e85d24ad6f21023868327b67446a36ebffda572b90f9b228a03b612e7e0ca09aac6b5710fc90f51c0efefb69b5d26ba9a1d8954832b1370d099d09c07fb2893d57d617ec0d626f1f96ee1608e0f8d9ca1b491578d639ac74b3ea568a474707ac756555d0ae9cdc609609e30d7ef2648fb8baa5854e58b60fac9ec9670c620ce6dcf3bbcca971cb5bf37462febde30e3865960627ceb15a11dd891160a2fcbb682c94a7de4e00fff20774364ffc4bfa31173261f1684dbbaa9addf0d9bc4", 0x36d}, {&(0x7f0000000680)}, {&(0x7f00000006c0)}, {0x0}], 0x5}, 0x800) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {0x0}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 4.089601954s ago: executing program 0 (id=2025): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = open(&(0x7f0000000140)='./file1\x00', 0x145142, 0x0) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f0000000400)={0x18, 0x0, {0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 'lo\x00'}}, 0x1e) ftruncate(r0, 0x2007ffa) sendfile(r1, r0, 0x0, 0x7ffff000) 4.085835923s ago: executing program 4 (id=2026): openat$vmci(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x10d, &(0x7f0000000380)={0x0, 0x0, 0x80, 0x0, 0x4000}, &(0x7f0000000340)=0x0, &(0x7f0000000240)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000440)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_SHUTDOWN={0x22, 0x9}) io_uring_enter(r0, 0x3516, 0x0, 0x0, 0x0, 0x0) r3 = openat$userio(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) readv(r3, &(0x7f0000000340)=[{&(0x7f00000003c0)=""/79, 0x4f}], 0x1) write$USERIO_CMD_SET_PORT_TYPE(r3, &(0x7f0000000040)={0x1, 0x6}, 0x2) write$USERIO_CMD_REGISTER(r3, &(0x7f0000000100), 0x2) 3.771382141s ago: executing program 0 (id=2027): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x141, 0x48, 0x13, 0x44, 0x20, 0x424, 0x7500, 0x69ee, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xb8, 0x7, 0x2, 0x96, 0xd1, 0xca, 0x0, [], [{{0x9, 0x5, 0x6, 0x2, 0x200, 0xd, 0x0, 0x6}}, {{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, &(0x7f00000003c0)={0x0, 0x17, 0x4, "abe763a8"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000740)={0x44, &(0x7f0000000180)=ANY=[@ANYBLOB="601004"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) 3.462269069s ago: executing program 4 (id=2028): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x60008090) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB], 0xc0}}, 0x0) syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000002300)={0x0, 0x0, &(0x7f00000022c0)={&(0x7f0000002280)={0x14, 0x7, 0x6, 0x5, 0x0, 0x0, {0xa, 0x0, 0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x40000) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{0x0}, {0x0}], 0x2) bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e21, 0x0, @empty}, 0x1c) rseq(&(0x7f0000000400), 0x20, 0x0, 0x0) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="041817aaaaaa"], 0x1a) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f00000011c0)=ANY=[@ANYBLOB='dyn']) chmod(&(0x7f0000000180)='./file0/file0\x00', 0x44) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000200)=0xd) 3.400946486s ago: executing program 2 (id=2029): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) syz_usb_connect(0x2, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000041436120410e5150e8d5000000010902f98a5c01000000090401"], 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000340)={'wlan0\x00'}) socket(0xa, 0x3, 0x3a) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.current\x00', 0x275a, 0x0) lseek(r1, 0x7fffffffffffffff, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB], 0x48) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102400, 0x19000) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f00000083c0)={{0x1}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(0xffffffffffffffff, 0x40505412, &(0x7f00000000c0)={0x6, 0x9dc8, 0x0, 0x0, 0xf}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) 3.312362979s ago: executing program 4 (id=2030): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000600)={{0x12, 0x1, 0x0, 0x35, 0xff, 0xaa, 0x20, 0xccd, 0x10af, 0x384e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x59, 0x2, 0x1, 0x9b, 0x1e, 0x2a, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000640)={0x3, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f00000004c0)={0x34, &(0x7f0000000280)={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0x0}) 3.21348722s ago: executing program 3 (id=2031): r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0x2, 0x2) ioctl$vim2m_VIDIOC_EXPBUF(r0, 0xc0405668, &(0x7f0000000100)={0x1, 0x3, 0x2, 0x84000}) 2.959276939s ago: executing program 3 (id=2032): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x208}, 0x0) r2 = memfd_create(&(0x7f0000000380)='\x103q}2\x9a\xce\xaf\x03\xdfyR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7R\x94\xaf\xbb\xdcM\x90k\xd6\x05\r\x84\x87\x1e?\x10\x95SWFO{\x1f\x1b!\xd5\x991D\x1c\b\x8c`\xeaSA\x90m\xb6&\xd0\xf1\xb3\xed:\x82\xbd\xe3i|BL\x1f\x9d\x00\x00\xc5\xb8$\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\r\xd6h\x80\x8fQ|\xf5d\x10\x10\xd7\t\x00\x00\x00\x00\x00\x00\x00<\xfeeS\xb2l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfaa\xd3\xf1\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7~x\xb8vo\xe6\x15@\xc9\"CY\x11\xb9u\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D4E^7%8\x94y\x90\xf0l\xa0\'L%\xd4\xda\xee\x81\x98\xcc\xfd\xa2\x89$\x9by\xf1\xbb\x01\xb7\xcd\xbf\x99\x1f\x90@b\x03\xb3\xe0CfU\x16{\xbey\xa1cs\x96U\x11\xdb*\xdf\xcdG\xc7z\x85\x8aE\xf7\xd5\x9dAj\xe3\xfb\xc4\xa0\x14\x87\x19\x17\xed\xd1\x185%Q%\x81\xfaK\x82\xec=\xa3\xb8~\xb6O\xbd\x19*\xdb\x1c\x10\xa4\x8dIl\xc1\xceG\xd0h\xa1\xab:dP\xb6\xa0BR\xbe\x03\xac\xd9\x87\x00@\x80\x94\xd88\xc9\x03\x97\x17r\x85#\x7f\x8cu\x8f\xcc\x7fF\xb5\xea\xa6\xc1\x9d\xac\x89\xc9\xa1tuJw\xee\x1a\xe73\xa8\xadS\xd1\x11#d\xc2\xcfdj\x9ec\x93\xd5K\x90*_3\x89\v\xab\x04ih\x12\x93\xc5m\x8f~{\xe5\x85\xa5g\x00\x00\x00\xe45Q\xab%\xa8[\xf3\x17\x94\xf8\xdfq\xff\xd2?\xafW\xde\x1bW]\x1f\aaV\xc5\xc82*\xc7\xc5\"C}L\x10e\xc6\x90\xc0\xf9z\xb6+/d\x86\xf2\xbe\xc9:u\t\\e\x05)\xe4\xd2\xc4\x1a\xc9\xac\xdb\x925\x02\x94@\xa2\xe1\xee\x16\xb4\x98\xff\x0f\xbb\xb2\x81\xcf\x13g6l\xcc\xc8\x02\v\xa2\xb2\xf6\xbf@d\xcecC\x9fVz\xf4\x14\xa5\x8b|\xe1\xc0\xfa3X\xf4\xd9L\xe6\x8f\x9dy\x0fX.\xc5EQ\xd1/\xa1\xd0\x03>\xf0\x90\x13B\xe2\x97\x8b!\xf7\"\xecX\x92\xab\xbc^\xb2\x80@\xcc+\xbbp\xdc|N\xd3[=G\xb2\xe1\x9c\xc5\x81y\x84\xef\xacQ\x01\xdd\xe7<\xb8\xf1Hn\x86\xa6\xe3\x18N\x19\"[-\xdb\xef\xc3\xe0\xa8}', 0x0) ftruncate(r2, 0x7d) fanotify_init(0x8, 0x80000) r3 = dup(r2) sendfile(r3, r2, 0x0, 0x3) r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r4, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r4, 0x4008af03, &(0x7f0000000940)) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresgid(&(0x7f00000006c0), &(0x7f0000000700), &(0x7f00000008c0)) r5 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) r6 = ioctl$LOOP_CTL_GET_FREE(r5, 0x4c82) ioctl$LOOP_CTL_REMOVE(r5, 0x4c81, r6) 2.630311723s ago: executing program 1 (id=2033): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, 0x0, 0x8000) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000001a40)=""/102392, 0x18ff8) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f00000002c0)='tmpfs\x00', 0x0, &(0x7f0000000300)='usrquota') 1.76060484s ago: executing program 1 (id=2034): socket$nl_rdma(0x10, 0x3, 0x14) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x24004004) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32=r3], 0x90}}, 0x0) 1.571340793s ago: executing program 1 (id=2035): socketpair$unix(0x1, 0x1, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001180)=[{{0x0, 0x0, 0x0}, 0x180241cb}], 0x1, 0x2001, 0x0) 1.416553992s ago: executing program 1 (id=2036): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) sendmsg$sock(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000008c0)=[{0x0}, {&(0x7f0000001400)="12b5ca8883a72c61be64d1809e4e551c8fcc795bacbc79d1a786c09a1861dfb427e430bee5b00ac73434620f11a914ef7cf7658efc365a26b43990993f60d4ffeb9cc31d7d5fc06ba7c3a4d828f40fca355cff79686f12971618904dc7d09e85e7a5f9194c4cae7983ee20f6c522b89ecc73c43438aad7dd15ff4738f5e4e1b7713142e7ff6cfc1b6cf7baba9ebf3b471cd0a72011fef02b46e280ad7a8c42d24bfb2ffe1518bc0fea207ec37a9e388c9dea8124df3f50a75f03df8d30d7b3b73e274042a52c058e1d85ef3b420b4dfce815cff6265e625a61b6fca9699edaadd192a3ae60c765260d1cbfb21f0cc30d8128b3783867b85873de07b02635d5573f9e578094a3ce6efbf44818daef38e14005a360909d226d7e13a86f6c83b6aaf615b6a2642d17bc2c56b8b0f8209e20ec1e0f58b0486493e511ab0a45b44a87340a9052ef5fba93c83753f1b101a744407f54d052188087c1cf43de80fd7bd5f3ce8585b5499959e6c3f5e17ae837d7c5627abb604947ad9906d641658f01464f48244182de8d5a8d037403ad4a964e2124177771a84806cda0682d58743928d2d16d83fd8b706a9669ac7605e8d857ac586dc2eda90715951c21bd116ade52f03cd61f3874aaefa77da678450228eb476d84bf175564a215e1683ced4bb9adba5daed835c6b38b61b213834aca56b86259784addb8601d26a42ad637ee296cd4382aaa7c1eaa5cbfa3a7177390bc646916aeb885d2dd43fc5b2dbbd2d184ba6cc6a439b95b5d814a8582405635b5c6bdb41c24af7a10bbd264eb2308a800a09705ac7856a7ac993cb4d88fea4cd1d5cf9e82e10c4badb996f4c0d5fd5866baf90a07d8777f793feb9250e22dd5190aa26c2a31412f1b41e0a65d0e435a9c5ebbf5205f6c6a117ce1fb16e8eb797e7d3eb5d62178dc0441941e9cb464814982ebe54195d73113efc971799121683f6e85d24ad6f21023868327b67446a36ebffda572b90f9b228a03b612e7e0ca09aac6b5710fc90f51c0efefb69b5d26ba9a1d8954832b1370d099d09c07fb2893d57d617ec0d626f1f96ee1608e0f8d9ca1b491578d639ac74b3ea568a474707ac756555d0ae9cdc609609e30d7ef2648fb8baa5854e58b60fac9ec9670c620ce6dcf3bbcca971cb5bf37462febde30e3865960627ceb15a11dd891160a2fcbb682c94a7de4e00fff20774364ffc4bfa31173261f1684dbbaa9addf0d9bc4", 0x36d}, {&(0x7f0000000680)}, {&(0x7f00000006c0)}, {0x0}], 0x5}, 0x800) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {0x0}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 1.414615111s ago: executing program 0 (id=2037): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) setreuid(0xffffffffffffffff, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$inet_int(r1, 0x0, 0x22, &(0x7f0000000040)=0x1, 0x4) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4008090) prctl$PR_SET_NAME(0xf, &(0x7f0000000000)='[[-\\\x8d%\xbc+\x00') r3 = socket$inet6(0xa, 0x80002, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$sock_inet_SIOCGARP(0xffffffffffffffff, 0x8954, &(0x7f0000000240)={{0x2, 0x4e24, @empty}, {0x1}, 0x0, {0x2, 0x4e22, @empty}, 'lo\x00'}) connect$inet6(r3, &(0x7f0000002140)={0xa, 0x4e28, 0x80000000, @mcast2, 0x5}, 0x1c) sendmmsg$inet6(r3, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) 1.240033627s ago: executing program 1 (id=2038): getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x101}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = memfd_create(&(0x7f0000000580)='\x103q}2\x9a\xce\xaf\x03\xdfyR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7R\x94\xaf\xbb\xdcM\x90k\xd6\x05\r\x84\x87\x1e?\x10\x95SWFO{\x1f\x1b!\xd5\x991D\x1c\b\x8c`\xeaSA\x90m\xb6&\xd0\xf1\xb3\xed:\x82\xbd\xe3i|B\xe2ar\x04R%[k\x0f\xfdV\xacL\x1f\x9d\x00\x00\xc5\xb8$\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\r\xd6h\x80\x8fQ|\xf5d\x10\x10\xd7\t\x00\x00\x00\x00\x00\x00\x00<\xfeeS\xb2l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfaa\xd3\xf1\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7~x\xb8vo\xe6\x15@\xc9\"CY\x11\xb9u\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D4E^7%8\x94y\x90\xf0l\xa0\'L%\xd4\xda\xee\x81\x98\xcc\xfd\xa2\x89$\x9by\xf1\xbb\x01\xb7\xcd\xbf\x99\x1f\x90@b\x03\xb3\xe0CfU\x16{\xbey\xa1cs\x96U\x11\xdb*\xdf\xcdG\xc7z\x85\x8aE\xf7\xd5\x9dAj\xe3\xfb\xc4\xa0\x14\x87\x19\x17\xed\xd1\x185%Q%\x81\xfaK\x82\xec=\xa3\xb8~\xb6O\xbd\x19*\xdb\x1c\x10\xa4\x8dI\xbd\xc1\xceG\xd0h\xa1\xab:dP\xb6\xa0BR\xbe\x03\xac\xd9\x87\x00@\x80\x94\xd88\xc9\x03\x86P\x8d\x12\\\xf9\x00T\x8f\xcc\x7fF\xb5\xea\xa6\xc1\x9d\xac\x89\xc9\xa1tuJw\xee\x1a\xe73\xa8\xadS\xd1\x11#d\xc2\xcfdj\x9ec\x93vw\x85\r|\xf0\xa6\xd5K\x90*_3\x89\v\xab\x04ih\x12\x93\xc5m\x8f~{\xe5\x85\xa5g\x00\x00\x00\xe45Q\xab%\xa8[\xf3\x17\x94\xf8\xdfq\xff\xd2?\xafW\xde\x1bW]\x1f\aaV\xc5\xc82*\xc7\xc5\"C}L\x10e\xc6\x90\xc0\xf9z\xb6+/d\x86\xf2\xbe\xc9:u\t\\e\x05)\xe4\xd2\xc4\x1a\xc9\xac\xdb\x925\x02\x94@\xa2\xe1\xee\x16\xb4\x98\xff\x0f\xbb\xb2\x81\xcf\x13g6l\xcc\xc8\x02\v\xa2\xb2\xf6\xbf@d\xcecC\x9fVz\xf4\x14\xa5\x8b|\xe1\xc0\xfa3X\xf4\xd9L\xe6\x8f\x9dy\x0fX.\xc5EQ\xd1/\xa1\xd0\x03>\xf0\x90\x13B\xe2\x97\x8b\"\xf7\"\xecX\x92\xab\xbc^\xb2\x80@\xcc+\xbbp\xdc|N\xd3[=G\xb2\xe1\x9c\xc5\x81y\x84\xef\xacQ\x01\xdd\xe7<\xb8\xf1Hn\x86\xa6\xe3\x18N\x19\"[-\xdb\xef\xc3\xe0\xa8}9q\x92~}M\xceA\xe1)\a\xf0p\xa3\x8dkCvo\x85N(\xdd%DP\x88FW\xb5\x97\xe7\xb8}\xb6/\x95\xb0\xb9\xc9\xb1=\ac\x91\x1d,\xd2\xf5g\xfd\x97X\x1e[\x84\x7f\bO\x16\x84\xefa\xd1\xb3\xf7\\g`\x026\x1f\x89/\x01l\xc1%\xda\xa1:\x99\xf1,\x86f\xe1\xb6\x83\x06\xdd\x91{x\xa1P\xd7\x1d\xa9c\xde\x7f\x8fJ\xae\xf1\xc3\x81@\x1e\x93\xaed-X\xd2\xa7e\xa0\xb3\x16*\xa5\xb1\xd3\x8d\xa4\xf2\xe5\xa2\xe7A\x19\xf4\xa92ok\xf2\xd2\xc74\t*\xb67{#J\x1b\'\xbb\x9b\x99\xda^\x1e\xf6\x03\x9316\xb5T\xbb\xb2\x93\x1b\xfaj\x00\xe8i\x85\xd2\x05!\x87Q\xe5\xbdZ\xcc\x98\xcbY]0\xf7\fl!\x00<', 0x0) ftruncate(r3, 0x800799c) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) connect$inet6(r4, &(0x7f00000002c0)={0xa, 0x4e20, 0xffffffff, @mcast2, 0x9}, 0x1c) sendfile(r4, r3, 0x0, 0xfeff) 780.610215ms ago: executing program 3 (id=2039): open$dir(&(0x7f0000000040)='./file0\x00', 0x208600, 0x140) mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) statx(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x800, 0xf0cb2f4a0c2cfc5d, 0x0) write$FUSE_INIT(r0, &(0x7f0000001200)={0x50, 0x0, 0x0, {0x7, 0x2d, 0x0, 0x0, 0x0, 0x0, 0x8fa}}, 0x50) read$FUSE(r0, &(0x7f0000004340)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r0, &(0x7f0000000200)={0x10, 0xffffffffffffffda, r1}, 0x10) 694.306668ms ago: executing program 3 (id=2040): mkdirat(0xffffffffffffff9c, 0x0, 0x108) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() getrlimit(0x2, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prlimit64(0x0, 0xd, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@ipv6_newnexthop={0x20, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x25dfdbff, {}, [@NHA_OIF={0x8, 0x5, r5}]}, 0x20}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=@newnexthop={0x38, 0x68, 0x1, 0x100003, 0x7ffffffd, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x15}]}, @NHA_RES_GROUP={0xc, 0xc, 0x0, 0x1, [@NHA_RES_GROUP_BUCKETS={0x6, 0x1, 0x3fd4}]}, @NHA_GROUP_TYPE={0x6, 0x3, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x4008018}, 0x4000080) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) 430.379556ms ago: executing program 0 (id=2041): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x60008090) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB], 0xc0}}, 0x0) syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000002300)={0x0, 0x0, &(0x7f00000022c0)={&(0x7f0000002280)={0x14, 0x7, 0x6, 0x5, 0x0, 0x0, {0xa, 0x0, 0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x40000) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)}, {0x0}], 0x2) bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e21, 0x0, @empty}, 0x1c) rseq(&(0x7f0000000400), 0x20, 0x0, 0x0) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="041817aaaaaa"], 0x1a) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f00000011c0)=ANY=[@ANYBLOB='dyn']) chmod(&(0x7f0000000180)='./file0/file0\x00', 0x44) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000200)=0xd) 257.839221ms ago: executing program 1 (id=2042): ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, &(0x7f00000000c0)="ff", 0x1, 0xffffffffffffffff) r3 = add_key$keyring(&(0x7f0000000540), &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_MOVE(0x1e, r2, 0xffffffffffffffff, r3, 0x0) 0s ago: executing program 0 (id=2043): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000004c0)=ANY=[@ANYBLOB="1201410130f56920ac05190272f00102030109021b000120001000090455070103490200090582030004"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000000)=ANY=[@ANYBLOB="f6ffd1"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x43, &(0x7f00000000c0)) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x44, &(0x7f0000000640)={[{0x11, 0x4e00, "6f0e6f86ad440bcce8389b95a9ec359906"}, {0x25, 0x4e00, "c508dda9a1626fd2e13a427eaf3560a5b11eb351f40eddb13edc497be6493fb1d897119a44"}]}) kernel console output (not intermixed with test programs): 93 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='¸' [ 258.443831][ T4319] usb 4-1: new full-speed USB device number 11 using dummy_hcd [ 258.658958][ T4319] usb 4-1: config index 0 descriptor too short (expected 35577, got 27) [ 258.674666][ T4319] usb 4-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 258.815500][ T4319] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 258.832236][ T4319] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 258.843660][ T4319] usb 4-1: config 1 has no interface number 0 [ 258.850221][ T4319] usb 4-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 258.889638][ T4319] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 258.961650][ T4319] snd_usb_pod 4-1:1.1: Line 6 Pocket POD found [ 259.177128][ T6417] loop0: detected capacity change from 0 to 16 [ 259.185412][ T6417] erofs: (device loop0): mounted with root inode @ nid 36. [ 259.196809][ T6417] syz.0.614: attempt to access beyond end of device [ 259.196809][ T6417] loop0: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 259.212613][ T6417] syz.0.614: attempt to access beyond end of device [ 259.212613][ T6417] loop0: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 259.226401][ T6417] erofs: (device loop0): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 259.237606][ T27] audit: type=1800 audit(1772231772.964:26): pid=6417 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.614" name="file2" dev="loop0" ino=89 res=0 errno=0 [ 259.273004][ T6417] erofs: (device loop0): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 259.284355][ T6417] erofs: (device loop0): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 259.778718][ T4319] snd_usb_pod 4-1:1.1: set_interface failed [ 259.791571][ T4319] snd_usb_pod 4-1:1.1: Line 6 Pocket POD now disconnected [ 259.844091][ T4319] snd_usb_pod: probe of 4-1:1.1 failed with error -71 [ 259.926316][ T4319] usb 4-1: USB disconnect, device number 11 [ 260.316784][ T6432] loop0: detected capacity change from 0 to 16 [ 260.548730][ T6432] erofs: (device loop0): mounted with root inode @ nid 36. [ 260.573939][ T6432] syz.0.625: attempt to access beyond end of device [ 260.573939][ T6432] loop0: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 260.608115][ T6432] syz.0.625: attempt to access beyond end of device [ 260.608115][ T6432] loop0: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 260.625789][ T6432] erofs: (device loop0): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 260.650051][ T6432] erofs: (device loop0): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 260.664218][ T6432] erofs: (device loop0): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 260.680234][ T27] audit: type=1800 audit(1772231774.364:27): pid=6432 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.625" name="file2" dev="loop0" ino=89 res=0 errno=0 [ 261.436689][ T6438] loop0: detected capacity change from 0 to 1024 [ 261.489948][ T6446] loop4: detected capacity change from 0 to 16 [ 261.499192][ T6446] erofs: (device loop4): mounted with root inode @ nid 36. [ 261.508314][ T6446] syz.4.630: attempt to access beyond end of device [ 261.508314][ T6446] loop4: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 261.526744][ T6446] syz.4.630: attempt to access beyond end of device [ 261.526744][ T6446] loop4: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 261.540623][ T6446] erofs: (device loop4): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 261.552041][ T27] audit: type=1800 audit(1772231775.284:28): pid=6446 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.630" name="file2" dev="loop4" ino=89 res=0 errno=0 [ 261.571837][ T6446] erofs: (device loop4): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 261.582886][ T6446] erofs: (device loop4): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 261.624032][ T6445] netlink: 20 bytes leftover after parsing attributes in process `syz.1.632'. [ 261.814801][ T6448] netlink: 20 bytes leftover after parsing attributes in process `syz.1.632'. [ 262.147239][ T6459] loop1: detected capacity change from 0 to 16 [ 262.187527][ T6459] erofs: (device loop1): mounted with root inode @ nid 36. [ 262.197510][ T6459] syz.1.635: attempt to access beyond end of device [ 262.197510][ T6459] loop1: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 262.212818][ T6459] syz.1.635: attempt to access beyond end of device [ 262.212818][ T6459] loop1: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 262.227822][ T6459] erofs: (device loop1): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 262.238996][ T27] audit: type=1800 audit(1772231775.974:29): pid=6459 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.635" name="file2" dev="loop1" ino=89 res=0 errno=0 [ 262.259889][ T6459] erofs: (device loop1): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 262.271550][ T6459] erofs: (device loop1): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 262.350914][ T6463] netlink: 92 bytes leftover after parsing attributes in process `syz.3.637'. [ 262.361566][ T6463] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 263.494869][ T6476] loop2: detected capacity change from 0 to 16 [ 264.641234][ T6476] erofs: (device loop2): mounted with root inode @ nid 36. [ 264.653220][ T6476] syz.2.641: attempt to access beyond end of device [ 264.653220][ T6476] loop2: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 264.828965][ T27] audit: type=1800 audit(1772231778.544:30): pid=6476 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.641" name="file2" dev="loop2" ino=89 res=0 errno=0 [ 267.412770][ T6511] loop2: detected capacity change from 0 to 16 [ 267.428325][ T6511] erofs: (device loop2): mounted with root inode @ nid 36. [ 267.439278][ T6511] syz.2.649: attempt to access beyond end of device [ 267.439278][ T6511] loop2: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 267.457066][ T6511] syz.2.649: attempt to access beyond end of device [ 267.457066][ T6511] loop2: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 267.471015][ T6511] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 267.482302][ T27] audit: type=1800 audit(1772231781.204:31): pid=6511 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.649" name="file2" dev="loop2" ino=89 res=0 errno=0 [ 267.503572][ T6511] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 267.514882][ T6511] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 267.602921][ T6519] loop1: detected capacity change from 0 to 16 [ 267.612095][ T6519] erofs: (device loop1): mounted with root inode @ nid 36. [ 267.622255][ T6519] syz.1.653: attempt to access beyond end of device [ 267.622255][ T6519] loop1: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 267.780661][ T6519] syz.1.653: attempt to access beyond end of device [ 267.780661][ T6519] loop1: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 267.795506][ T6519] erofs: (device loop1): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 267.865012][ T27] audit: type=1800 audit(1772231781.534:32): pid=6519 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.653" name="file2" dev="loop1" ino=89 res=0 errno=0 [ 270.776819][ T6549] loop2: detected capacity change from 0 to 1024 [ 270.804562][ T6553] capability: warning: `syz.3.663' uses 32-bit capabilities (legacy support in use) [ 270.820306][ T6553] program syz.3.663 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 270.863912][ T6551] netlink: 28 bytes leftover after parsing attributes in process `syz.1.661'. [ 270.932908][ T6551] netlink: 28 bytes leftover after parsing attributes in process `syz.1.661'. [ 271.015825][ T6551] device erspan0 entered promiscuous mode [ 271.034055][ T6551] device gretap0 entered promiscuous mode [ 271.047697][ T6551] debugfs: Directory 'hsr1' with parent 'hsr' already present! [ 271.056047][ T6551] Cannot create hsr debugfs directory [ 271.078871][ T4463] IPv6: ADDRCONF(NETDEV_CHANGE): hsr1: link becomes ready [ 271.142733][ T6563] loop3: detected capacity change from 0 to 16 [ 271.160567][ T6563] erofs: (device loop3): mounted with root inode @ nid 36. [ 271.181244][ T6563] syz.3.666: attempt to access beyond end of device [ 271.181244][ T6563] loop3: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 271.200697][ T6563] syz.3.666: attempt to access beyond end of device [ 271.200697][ T6563] loop3: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 271.215645][ T6563] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 271.233928][ T6563] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 271.245559][ T6563] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 271.283642][ T27] audit: type=1800 audit(1772231784.954:33): pid=6563 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.666" name="file2" dev="loop3" ino=89 res=0 errno=0 [ 271.913574][ T7] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 272.055389][ T6569] loop1: detected capacity change from 0 to 16 [ 272.070860][ T6569] erofs: (device loop1): mounted with root inode @ nid 36. [ 272.081492][ T6569] syz.1.667: attempt to access beyond end of device [ 272.081492][ T6569] loop1: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 272.102373][ T6569] syz.1.667: attempt to access beyond end of device [ 272.102373][ T6569] loop1: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 272.109297][ T7] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 272.116332][ T6569] erofs: (device loop1): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 272.137272][ T27] audit: type=1800 audit(1772231785.864:34): pid=6569 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.667" name="file2" dev="loop1" ino=89 res=0 errno=0 [ 272.191077][ T7] usb 1-1: config 0 interface 0 has no altsetting 0 [ 272.218421][ T7] usb 1-1: New USB device found, idVendor=04fc, idProduct=05d8, bcdDevice= 0.00 [ 272.239054][ T7] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 272.269095][ T7] usb 1-1: config 0 descriptor?? [ 272.314674][ T6567] team0 (unregistering): Port device team_slave_0 removed [ 272.345383][ T6567] team0 (unregistering): Failed to send options change via netlink (err -105) [ 272.362017][ T6567] team0 (unregistering): Failed to send port change of device team_slave_1 via netlink (err -105) [ 272.380767][ T6567] team0 (unregistering): Port device team_slave_1 removed [ 272.688062][ T7] sunplus 0003:04FC:05D8.0002: unknown main item tag 0x0 [ 272.701890][ T7] sunplus 0003:04FC:05D8.0002: unknown main item tag 0x0 [ 272.724647][ T7] sunplus 0003:04FC:05D8.0002: unknown main item tag 0x0 [ 272.749884][ T7] sunplus 0003:04FC:05D8.0002: unknown main item tag 0x0 [ 272.772883][ T7] sunplus 0003:04FC:05D8.0002: unknown main item tag 0x0 [ 272.822334][ T7] sunplus 0003:04FC:05D8.0002: unknown main item tag 0x0 [ 272.848664][ T7] sunplus 0003:04FC:05D8.0002: unknown main item tag 0x0 [ 273.525637][ T7] sunplus 0003:04FC:05D8.0002: unknown main item tag 0x0 [ 273.532812][ T7] sunplus 0003:04FC:05D8.0002: unknown main item tag 0x0 [ 273.540673][ T7] sunplus 0003:04FC:05D8.0002: unknown main item tag 0x0 [ 273.547905][ T7] sunplus 0003:04FC:05D8.0002: unknown main item tag 0x0 [ 273.585864][ T7] sunplus 0003:04FC:05D8.0002: hidraw0: USB HID v0.05 Device [HID 04fc:05d8] on usb-dummy_hcd.0-1/input0 [ 273.651516][ T7] usb 1-1: USB disconnect, device number 9 [ 273.901863][ T6577] fido_id[6577]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 275.931025][ T6599] netlink: 28 bytes leftover after parsing attributes in process `syz.4.678'. [ 275.941193][ T6599] netlink: 28 bytes leftover after parsing attributes in process `syz.4.678'. [ 275.989543][ T6599] device erspan0 entered promiscuous mode [ 276.185431][ T6599] device gretap0 entered promiscuous mode [ 276.193770][ T6599] debugfs: Directory 'hsr1' with parent 'hsr' already present! [ 276.213741][ T6599] Cannot create hsr debugfs directory [ 276.221091][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr1: link becomes ready [ 277.144904][ T6610] loop2: detected capacity change from 0 to 16 [ 277.198515][ T6610] erofs: (device loop2): mounted with root inode @ nid 36. [ 277.207997][ T6610] syz.2.680: attempt to access beyond end of device [ 277.207997][ T6610] loop2: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 277.393645][ T27] audit: type=1800 audit(1772231791.104:35): pid=6610 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.680" name="file2" dev="loop2" ino=89 res=0 errno=0 [ 278.248796][ T6627] loop2: detected capacity change from 0 to 16 [ 278.257510][ T6627] erofs: (device loop2): mounted with root inode @ nid 36. [ 278.267425][ T6627] syz.2.684: attempt to access beyond end of device [ 278.267425][ T6627] loop2: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 278.284273][ T6627] syz.2.684: attempt to access beyond end of device [ 278.284273][ T6627] loop2: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 278.298901][ T6627] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 278.311163][ T27] audit: type=1800 audit(1772231792.034:36): pid=6627 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.684" name="file2" dev="loop2" ino=89 res=0 errno=0 [ 278.331100][ T6627] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 278.342445][ T6627] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 282.831899][ T6666] loop2: detected capacity change from 0 to 16 [ 282.842636][ T6666] erofs: (device loop2): mounted with root inode @ nid 36. [ 282.857309][ T6666] syz.2.695: attempt to access beyond end of device [ 282.857309][ T6666] loop2: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 282.874592][ T6666] syz.2.695: attempt to access beyond end of device [ 282.874592][ T6666] loop2: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 282.889027][ T6666] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 282.905767][ T6666] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 282.917435][ T6666] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 282.931499][ T27] audit: type=1800 audit(1772231796.624:37): pid=6666 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.695" name="file2" dev="loop2" ino=89 res=0 errno=0 [ 287.692796][ T6713] loop3: detected capacity change from 0 to 16 [ 287.820853][ T6713] erofs: (device loop3): mounted with root inode @ nid 36. [ 287.830658][ T6713] syz.3.708: attempt to access beyond end of device [ 287.830658][ T6713] loop3: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 287.847640][ T6713] syz.3.708: attempt to access beyond end of device [ 287.847640][ T6713] loop3: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 289.391799][ T6713] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 289.404896][ T6713] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 289.416124][ T6713] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 289.428380][ T27] audit: type=1800 audit(1772231803.134:38): pid=6713 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.708" name="file2" dev="loop3" ino=89 res=0 errno=0 [ 291.033755][ T4319] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 291.235174][ T4319] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 291.245348][ T4319] usb 2-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xBA, skipping [ 291.258346][ T4319] usb 2-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 291.267929][ T4319] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 291.276048][ T4319] usb 2-1: Product: syz [ 291.280458][ T4319] usb 2-1: Manufacturer: syz [ 291.285154][ T4319] usb 2-1: SerialNumber: syz [ 291.292366][ T4319] usb 2-1: config 0 descriptor?? [ 291.337939][ T6738] device hsr0 entered promiscuous mode [ 291.391423][ T6738] netlink: 4 bytes leftover after parsing attributes in process `syz.3.718'. [ 291.466555][ T6735] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 291.474886][ T6735] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 291.483136][ T4319] usb 2-1: ucan: probing device on interface #0 [ 291.489891][ T4319] usb 2-1: ucan: invalid EP count (1) [ 291.495471][ T4319] usb 2-1: ucan: probe failed; try to update the device firmware [ 292.314901][ T6738] device hsr_slave_0 left promiscuous mode [ 292.346781][ T6738] device hsr_slave_1 left promiscuous mode [ 294.630971][ T6774] loop3: detected capacity change from 0 to 16 [ 294.639734][ T6774] erofs: (device loop3): mounted with root inode @ nid 36. [ 294.649431][ T6774] syz.3.723: attempt to access beyond end of device [ 294.649431][ T6774] loop3: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 294.701953][ T6774] syz.3.723: attempt to access beyond end of device [ 294.701953][ T6774] loop3: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 294.715822][ T6774] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 294.727179][ T27] audit: type=1800 audit(1772231808.454:39): pid=6774 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.723" name="file2" dev="loop3" ino=89 res=0 errno=0 [ 294.728651][ T6774] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 294.759390][ T6774] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 295.008225][ T125] usb 2-1: USB disconnect, device number 14 [ 299.864080][ T6823] loop3: detected capacity change from 0 to 16 [ 299.878479][ T6823] erofs: (device loop3): mounted with root inode @ nid 36. [ 299.888130][ T6823] syz.3.739: attempt to access beyond end of device [ 299.888130][ T6823] loop3: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 299.904157][ T6823] syz.3.739: attempt to access beyond end of device [ 299.904157][ T6823] loop3: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 299.917990][ T6823] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 299.930961][ T6823] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 299.942071][ T6823] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 299.966841][ T27] audit: type=1800 audit(1772231813.664:40): pid=6823 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.739" name="file2" dev="loop3" ino=89 res=0 errno=0 [ 305.965968][ T4282] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 307.051093][ T6873] loop2: detected capacity change from 0 to 16 [ 307.074303][ T6873] erofs: (device loop2): mounted with root inode @ nid 36. [ 307.090619][ T6873] syz.2.751: attempt to access beyond end of device [ 307.090619][ T6873] loop2: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 307.150335][ T6873] syz.2.751: attempt to access beyond end of device [ 307.150335][ T6873] loop2: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 307.164559][ T6873] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 307.193769][ T27] audit: type=1800 audit(1772231820.904:41): pid=6873 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.751" name="file2" dev="loop2" ino=89 res=0 errno=0 [ 307.445528][ T4282] usb 2-1: Using ep0 maxpacket: 16 [ 308.020460][ T4282] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 308.088161][ T4282] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 308.196065][ T4282] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 308.281688][ T4282] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 308.345815][ T6884] loop3: detected capacity change from 0 to 16 [ 308.359019][ T6884] erofs: (device loop3): mounted with root inode @ nid 36. [ 308.379222][ T6884] syz.3.754: attempt to access beyond end of device [ 308.379222][ T6884] loop3: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 308.427298][ T6884] syz.3.754: attempt to access beyond end of device [ 308.427298][ T6884] loop3: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 308.441630][ T6884] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 308.460515][ T6884] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 308.472585][ T6884] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 308.488905][ T27] audit: type=1800 audit(1772231822.174:42): pid=6884 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.754" name="file2" dev="loop3" ino=89 res=0 errno=0 [ 308.779334][ T4282] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 309.068865][ T4282] usb 2-1: string descriptor 0 read error: -71 [ 309.075416][ T4282] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 309.084705][ T4282] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 309.154502][ T4282] usb 2-1: config 0 descriptor?? [ 309.195920][ T4282] usb 2-1: can't set config #0, error -71 [ 309.247453][ T4282] usb 2-1: USB disconnect, device number 15 [ 312.669213][ T6926] loop4: detected capacity change from 0 to 16 [ 312.689405][ T6926] erofs: (device loop4): mounted with root inode @ nid 36. [ 312.706672][ T6926] syz.4.765: attempt to access beyond end of device [ 312.706672][ T6926] loop4: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 312.781827][ T6926] syz.4.765: attempt to access beyond end of device [ 312.781827][ T6926] loop4: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 312.798079][ T6926] erofs: (device loop4): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 312.818152][ T27] audit: type=1800 audit(1772231826.534:43): pid=6926 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.765" name="file2" dev="loop4" ino=89 res=0 errno=0 [ 313.393856][ T4319] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 313.603801][ T4319] usb 3-1: Using ep0 maxpacket: 8 [ 313.635815][ T4319] usb 3-1: config 0 interface 0 altsetting 144 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 313.653637][ T4319] usb 3-1: config 0 interface 0 altsetting 144 endpoint 0x81 has invalid wMaxPacketSize 0 [ 313.667240][ T4319] usb 3-1: config 0 interface 0 has no altsetting 0 [ 313.675868][ T4319] usb 3-1: New USB device found, idVendor=6666, idProduct=8804, bcdDevice= 0.00 [ 313.687169][ T4319] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 313.734789][ T4319] usb 3-1: config 0 descriptor?? [ 314.311171][ T4319] smartjoyplus 0003:6666:8804.0003: item fetching failed at offset 2/5 [ 314.332019][ T4319] smartjoyplus 0003:6666:8804.0003: parse failed [ 314.396123][ T4319] smartjoyplus: probe of 0003:6666:8804.0003 failed with error -22 [ 314.413579][ T950] usb 1-1: new full-speed USB device number 10 using dummy_hcd [ 314.605439][ T950] usb 1-1: config index 0 descriptor too short (expected 35577, got 27) [ 314.621685][ T950] usb 1-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 314.632764][ T950] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 314.655700][ T950] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 314.671124][ T950] usb 1-1: config 1 has no interface number 0 [ 314.681856][ T950] usb 1-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 314.698459][ T950] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 314.741264][ T950] snd_usb_pod 1-1:1.1: Line 6 Pocket POD found [ 314.948597][ T4319] usb 3-1: USB disconnect, device number 8 [ 315.442916][ T950] snd_usb_pod 1-1:1.1: set_interface failed [ 315.450950][ T950] snd_usb_pod 1-1:1.1: Line 6 Pocket POD now disconnected [ 315.467209][ T950] snd_usb_pod: probe of 1-1:1.1 failed with error -71 [ 315.495623][ T950] usb 1-1: USB disconnect, device number 10 [ 315.589770][ T6965] loop4: detected capacity change from 0 to 16 [ 315.607348][ T6965] erofs: (device loop4): mounted with root inode @ nid 36. [ 315.624080][ T6965] syz.4.780: attempt to access beyond end of device [ 315.624080][ T6965] loop4: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 315.688045][ T6965] syz.4.780: attempt to access beyond end of device [ 315.688045][ T6965] loop4: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 315.703251][ T6965] erofs: (device loop4): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 315.721522][ T27] audit: type=1800 audit(1772231829.444:44): pid=6965 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.780" name="file2" dev="loop4" ino=89 res=0 errno=0 [ 317.286182][ T1273] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.304898][ T1273] ieee802154 phy1 wpan1: encryption failed: -22 [ 321.282938][ T7010] loop4: detected capacity change from 0 to 16 [ 321.291451][ T7010] erofs: (device loop4): mounted with root inode @ nid 36. [ 321.303251][ T7010] syz.4.794: attempt to access beyond end of device [ 321.303251][ T7010] loop4: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 321.554527][ T7010] syz.4.794: attempt to access beyond end of device [ 321.554527][ T7010] loop4: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 321.570033][ T7010] erofs: (device loop4): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 321.585810][ T27] audit: type=1800 audit(1772231835.314:45): pid=7010 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.794" name="file2" dev="loop4" ino=89 res=0 errno=0 [ 322.510944][ T7] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 322.802353][ T7] usb 5-1: Using ep0 maxpacket: 32 [ 323.416034][ T7] usb 5-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 323.433217][ T7] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 323.443716][ T7] usb 5-1: config 0 descriptor?? [ 325.738128][ T7] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 325.807117][ T7] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 325.859153][ T7] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 325.879034][ T7] usb 5-1: media controller created [ 325.931454][ T7] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 326.051741][ T7052] loop3: detected capacity change from 0 to 16 [ 326.142509][ T7052] erofs: (device loop3): mounted with root inode @ nid 36. [ 326.159510][ T7052] syz.3.808: attempt to access beyond end of device [ 326.159510][ T7052] loop3: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 326.217604][ T7052] syz.3.808: attempt to access beyond end of device [ 326.217604][ T7052] loop3: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 326.232266][ T7052] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 326.363980][ T27] audit: type=1800 audit(1772231839.974:46): pid=7052 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.808" name="file2" dev="loop3" ino=89 res=0 errno=0 [ 326.982791][ T7] DVB: Unable to find symbol dib7000p_attach() [ 326.989582][ T7] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 327.343639][ T7] rc_core: IR keymap rc-dib0700-rc5 not found [ 327.350032][ T7] Registered IR keymap rc-empty [ 327.355780][ T7] dvb-usb: could not initialize remote control. [ 327.364542][ T7] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 327.374417][ T7068] netlink: 'syz.3.813': attribute type 33 has an invalid length. [ 327.382338][ T7068] netlink: 152 bytes leftover after parsing attributes in process `syz.3.813'. [ 327.410313][ T7] usb 5-1: USB disconnect, device number 16 [ 327.569212][ T7] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 327.581260][ T7074] netlink: 28 bytes leftover after parsing attributes in process `syz.2.816'. [ 327.639276][ T7074] netlink: 28 bytes leftover after parsing attributes in process `syz.2.816'. [ 331.672215][ T7117] loop2: detected capacity change from 0 to 16 [ 331.714442][ T7116] netlink: 'syz.3.831': attribute type 33 has an invalid length. [ 331.722302][ T7116] netlink: 152 bytes leftover after parsing attributes in process `syz.3.831'. [ 331.781546][ T7117] erofs: (device loop2): mounted with root inode @ nid 36. [ 331.796437][ T7117] syz.2.829: attempt to access beyond end of device [ 331.796437][ T7117] loop2: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 331.825908][ T7117] syz.2.829: attempt to access beyond end of device [ 331.825908][ T7117] loop2: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 331.840910][ T7117] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 331.859089][ T7117] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 331.870788][ T7117] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 331.884930][ T27] audit: type=1800 audit(1772231845.574:47): pid=7117 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.829" name="file2" dev="loop2" ino=89 res=0 errno=0 [ 332.622380][ T7125] netlink: 28 bytes leftover after parsing attributes in process `syz.3.833'. [ 332.653359][ T7125] netlink: 28 bytes leftover after parsing attributes in process `syz.3.833'. [ 336.761168][ T4282] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 338.013561][ T4282] usb 5-1: Using ep0 maxpacket: 32 [ 338.020801][ T4282] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 338.046441][ T4282] usb 5-1: config 0 has no interface number 0 [ 338.073228][ T4282] usb 5-1: config 0 interface 184 has no altsetting 0 [ 338.121248][ T4282] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 338.172764][ T4282] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 338.182893][ T4282] usb 5-1: Product: syz [ 338.187862][ T4282] usb 5-1: Manufacturer: syz [ 338.192642][ T4282] usb 5-1: SerialNumber: syz [ 338.209191][ T4282] usb 5-1: config 0 descriptor?? [ 338.222135][ T7185] netlink: 28 bytes leftover after parsing attributes in process `syz.2.852'. [ 338.430121][ T7188] loop1: detected capacity change from 0 to 16 [ 338.442546][ T7185] netlink: 28 bytes leftover after parsing attributes in process `syz.2.852'. [ 338.742858][ T7188] erofs: (device loop1): mounted with root inode @ nid 36. [ 338.772911][ T7188] syz.1.854: attempt to access beyond end of device [ 338.772911][ T7188] loop1: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 339.484292][ T27] audit: type=1800 audit(1772231853.184:48): pid=7188 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.854" name="file2" dev="loop1" ino=89 res=0 errno=0 [ 339.556291][ T4282] smsc75xx v1.0.0 [ 339.612243][ T4282] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -71 [ 339.627648][ T4282] smsc75xx: probe of 5-1:0.184 failed with error -71 [ 339.640407][ T4282] usb 5-1: USB disconnect, device number 17 [ 343.342233][ T7233] netlink: 28 bytes leftover after parsing attributes in process `syz.1.868'. [ 343.416008][ T7235] loop2: detected capacity change from 0 to 16 [ 343.452608][ T7235] erofs: (device loop2): mounted with root inode @ nid 36. [ 343.468358][ T7235] syz.2.866: attempt to access beyond end of device [ 343.468358][ T7235] loop2: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 343.485793][ T7233] netlink: 28 bytes leftover after parsing attributes in process `syz.1.868'. [ 343.518058][ T7235] syz.2.866: attempt to access beyond end of device [ 343.518058][ T7235] loop2: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 343.532381][ T7235] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 343.550303][ T7235] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 343.562341][ T7235] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 343.633814][ T27] audit: type=1800 audit(1772231857.274:49): pid=7235 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.866" name="file2" dev="loop2" ino=89 res=0 errno=0 [ 343.655390][ T26] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 343.893575][ T26] usb 5-1: Using ep0 maxpacket: 32 [ 343.906717][ T26] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 344.148645][ T26] usb 5-1: config 0 has no interface number 0 [ 344.155424][ T26] usb 5-1: config 0 interface 184 has no altsetting 0 [ 344.176604][ T26] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 344.199088][ T26] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 344.222179][ T26] usb 5-1: Product: syz [ 344.233549][ T26] usb 5-1: Manufacturer: syz [ 344.238455][ T26] usb 5-1: SerialNumber: syz [ 344.260379][ T26] usb 5-1: config 0 descriptor?? [ 344.275869][ T26] smsc75xx v1.0.0 [ 345.028041][ T7252] netlink: 'syz.3.874': attribute type 33 has an invalid length. [ 345.035921][ T7252] netlink: 152 bytes leftover after parsing attributes in process `syz.3.874'. [ 345.047685][ T7] usb 1-1: new full-speed USB device number 11 using dummy_hcd [ 345.363099][ T26] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 345.374370][ T26] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -32 [ 345.384791][ T26] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 345.395242][ T26] smsc75xx: probe of 5-1:0.184 failed with error -32 [ 345.410933][ T7] usb 1-1: config index 0 descriptor too short (expected 35577, got 27) [ 345.452261][ T7] usb 1-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 345.461919][ T7] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 345.479652][ T7] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 345.489179][ T7] usb 1-1: config 1 has no interface number 0 [ 345.500750][ T7] usb 1-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 345.896056][ T7] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 345.910798][ T7] snd_usb_pod 1-1:1.1: Line 6 Pocket POD found [ 347.325445][ T7] snd_usb_pod 1-1:1.1: set_interface failed [ 347.335308][ T4318] usb 5-1: USB disconnect, device number 18 [ 347.336848][ T7] snd_usb_pod 1-1:1.1: Line 6 Pocket POD now disconnected [ 347.349226][ T7] snd_usb_pod: probe of 1-1:1.1 failed with error -71 [ 347.357822][ T7] usb 1-1: USB disconnect, device number 11 [ 347.590274][ T7279] loop2: detected capacity change from 0 to 16 [ 347.600719][ T7279] erofs: (device loop2): mounted with root inode @ nid 36. [ 347.611396][ T7279] syz.2.880: attempt to access beyond end of device [ 347.611396][ T7279] loop2: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 347.629396][ T7279] syz.2.880: attempt to access beyond end of device [ 347.629396][ T7279] loop2: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 347.643575][ T7279] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 347.656411][ T7279] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 347.667708][ T7279] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 347.682885][ T27] audit: type=1800 audit(1772231861.384:50): pid=7279 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.880" name="file2" dev="loop2" ino=89 res=0 errno=0 [ 348.083726][ T4318] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 348.301873][ T7281] netlink: 28 bytes leftover after parsing attributes in process `syz.1.883'. [ 348.313572][ T7281] netlink: 28 bytes leftover after parsing attributes in process `syz.1.883'. [ 350.667543][ T4318] usb 5-1: Using ep0 maxpacket: 8 [ 350.762392][ T4318] usb 5-1: device descriptor read/all, error -71 [ 351.049751][ T7295] netlink: 'syz.3.888': attribute type 33 has an invalid length. [ 351.057785][ T7295] netlink: 152 bytes leftover after parsing attributes in process `syz.3.888'. [ 351.230045][ T7297] loop2: detected capacity change from 0 to 16 [ 351.267264][ T7297] erofs: (device loop2): mounted with root inode @ nid 36. [ 351.283551][ T7297] syz.2.886: attempt to access beyond end of device [ 351.283551][ T7297] loop2: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 351.318336][ T7297] syz.2.886: attempt to access beyond end of device [ 351.318336][ T7297] loop2: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 351.333743][ T7297] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 351.352048][ T7297] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 351.363527][ T7297] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 351.403612][ T27] audit: type=1800 audit(1772231865.074:51): pid=7297 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.886" name="file2" dev="loop2" ino=89 res=0 errno=0 [ 353.223572][ T22] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 353.423586][ T22] usb 3-1: Using ep0 maxpacket: 32 [ 353.482892][ T22] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 353.618477][ T22] usb 3-1: config 0 has no interface number 0 [ 353.634060][ T22] usb 3-1: config 0 interface 184 has no altsetting 0 [ 353.702829][ T22] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 354.585573][ T22] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 354.594625][ T22] usb 3-1: Product: syz [ 354.598895][ T22] usb 3-1: Manufacturer: syz [ 354.603601][ T22] usb 3-1: SerialNumber: syz [ 354.617879][ T22] usb 3-1: config 0 descriptor?? [ 354.629018][ T22] smsc75xx v1.0.0 [ 354.672919][ T7331] Bluetooth: MGMT ver 1.22 [ 355.253693][ T22] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 355.291837][ T22] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -32 [ 355.740339][ T22] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 355.757545][ T22] smsc75xx: probe of 3-1:0.184 failed with error -32 [ 356.634400][ T4316] usb 3-1: USB disconnect, device number 9 [ 356.744439][ T7354] netlink: 28 bytes leftover after parsing attributes in process `syz.4.902'. [ 356.781094][ T7354] netlink: 28 bytes leftover after parsing attributes in process `syz.4.902'. [ 358.239429][ T7373] loop2: detected capacity change from 0 to 16 [ 358.569492][ T7373] erofs: (device loop2): mounted with root inode @ nid 36. [ 358.585253][ T7373] syz.2.907: attempt to access beyond end of device [ 358.585253][ T7373] loop2: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 358.612946][ T7373] syz.2.907: attempt to access beyond end of device [ 358.612946][ T7373] loop2: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 358.627384][ T7373] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 358.645011][ T7373] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 358.656563][ T7373] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 358.672492][ T27] audit: type=1800 audit(1772231872.364:52): pid=7373 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.907" name="file2" dev="loop2" ino=89 res=0 errno=0 [ 361.969134][ T7] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 363.639352][ T4316] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 363.676011][ T7] usb 5-1: Using ep0 maxpacket: 32 [ 364.655828][ T4316] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 365.600474][ T4316] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 365.727055][ T7] usb 5-1: device descriptor read/all, error -71 [ 365.785479][ T4316] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 365.963195][ T4316] usb 4-1: string descriptor 0 read error: -71 [ 366.035867][ T4316] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 366.887108][ T4316] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 366.923397][ T4316] usb 4-1: can't set config #1, error -71 [ 366.930673][ T4316] usb 4-1: USB disconnect, device number 12 [ 369.520112][ T7450] loop3: detected capacity change from 0 to 16 [ 369.543939][ T7450] erofs: (device loop3): mounted with root inode @ nid 36. [ 369.560817][ T7450] syz.3.931: attempt to access beyond end of device [ 369.560817][ T7450] loop3: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 370.223605][ T7450] syz.3.931: attempt to access beyond end of device [ 370.223605][ T7450] loop3: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 370.241281][ T7450] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 370.361014][ T27] audit: type=1800 audit(1772231883.984:53): pid=7450 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.931" name="file2" dev="loop3" ino=89 res=0 errno=0 [ 376.196423][ T7501] loop1: detected capacity change from 0 to 16 [ 377.049205][ T7501] erofs: (device loop1): mounted with root inode @ nid 36. [ 377.069389][ T7496] syz.1.944: attempt to access beyond end of device [ 377.069389][ T7496] loop1: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 377.085617][ T7496] syz.1.944: attempt to access beyond end of device [ 377.085617][ T7496] loop1: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 377.101654][ T7496] erofs: (device loop1): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 377.115017][ T7496] erofs: (device loop1): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 377.128499][ T7496] erofs: (device loop1): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 377.146615][ T27] audit: type=1800 audit(1772231890.844:54): pid=7496 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.944" name="file2" dev="loop1" ino=89 res=0 errno=0 [ 377.378233][ T7512] netlink: 'syz.1.951': attribute type 13 has an invalid length. [ 377.409010][ T7512] gretap0: refused to change device tx_queue_len [ 377.419155][ T4282] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 377.434108][ T7512] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 377.603671][ T4282] usb 3-1: Using ep0 maxpacket: 8 [ 377.610935][ T4282] usb 3-1: config 0 interface 0 altsetting 144 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 377.680777][ T4282] usb 3-1: config 0 interface 0 altsetting 144 endpoint 0x81 has invalid wMaxPacketSize 0 [ 377.796982][ T4282] usb 3-1: config 0 interface 0 has no altsetting 0 [ 377.813640][ T4282] usb 3-1: New USB device found, idVendor=6666, idProduct=8804, bcdDevice= 0.00 [ 377.917812][ T4282] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 378.085077][ T4282] usb 3-1: config 0 descriptor?? [ 378.729828][ T4282] usbhid 3-1:0.0: can't add hid device: -71 [ 378.753679][ T4282] usbhid: probe of 3-1:0.0 failed with error -71 [ 378.776346][ T1273] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.784247][ T1273] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.837356][ T4282] usb 3-1: USB disconnect, device number 10 [ 380.214294][ T7542] device syzkaller0 entered promiscuous mode [ 380.368752][ T7550] loop4: detected capacity change from 0 to 16 [ 380.382020][ T7550] erofs: (device loop4): mounted with root inode @ nid 36. [ 380.397746][ T7550] syz.4.961: attempt to access beyond end of device [ 380.397746][ T7550] loop4: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 380.425024][ T7550] syz.4.961: attempt to access beyond end of device [ 380.425024][ T7550] loop4: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 380.440274][ T7550] erofs: (device loop4): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 380.460459][ T7550] erofs: (device loop4): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 380.472708][ T7550] erofs: (device loop4): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 380.543547][ T27] audit: type=1800 audit(1772231894.184:55): pid=7550 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.961" name="file2" dev="loop4" ino=89 res=0 errno=0 [ 382.973550][ T26] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 383.773308][ T7599] loop3: detected capacity change from 0 to 16 [ 383.784187][ T26] usb 1-1: Using ep0 maxpacket: 32 [ 383.796079][ T26] usb 1-1: config 0 has an invalid interface number: 184 but max is 0 [ 383.805264][ T26] usb 1-1: config 0 has no interface number 0 [ 383.811566][ T26] usb 1-1: config 0 interface 184 has no altsetting 0 [ 383.886173][ T7599] erofs: (device loop3): mounted with root inode @ nid 36. [ 383.941777][ T7599] syz.3.978: attempt to access beyond end of device [ 383.941777][ T7599] loop3: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 383.960774][ T26] usb 1-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 384.018453][ T26] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 384.027339][ T26] usb 1-1: Product: syz [ 384.031679][ T26] usb 1-1: Manufacturer: syz [ 384.036475][ T26] usb 1-1: SerialNumber: syz [ 384.049389][ T26] usb 1-1: config 0 descriptor?? [ 384.065273][ T26] smsc75xx v1.0.0 [ 384.401861][ T7599] syz.3.978: attempt to access beyond end of device [ 384.401861][ T7599] loop3: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 384.416433][ T7599] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 384.434647][ T27] audit: type=1800 audit(1772231898.154:56): pid=7599 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.978" name="file2" dev="loop3" ino=89 res=0 errno=0 [ 384.723564][ T7605] netlink: 76 bytes leftover after parsing attributes in process `syz.3.981'. [ 384.857922][ T26] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 384.903909][ T26] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -32 [ 384.944163][ T26] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 384.984151][ T26] smsc75xx: probe of 1-1:0.184 failed with error -32 [ 386.937081][ T4316] usb 1-1: USB disconnect, device number 12 [ 387.300841][ T7641] loop1: detected capacity change from 0 to 16 [ 387.320434][ T7641] erofs: (device loop1): mounted with root inode @ nid 36. [ 387.337286][ T7641] syz.1.991: attempt to access beyond end of device [ 387.337286][ T7641] loop1: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 387.363966][ T7641] syz.1.991: attempt to access beyond end of device [ 387.363966][ T7641] loop1: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 387.378822][ T7641] erofs: (device loop1): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 387.396776][ T7641] erofs: (device loop1): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 387.408876][ T7641] erofs: (device loop1): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 387.473957][ T27] audit: type=1800 audit(1772231901.114:57): pid=7641 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.991" name="file2" dev="loop1" ino=89 res=0 errno=0 [ 388.437539][ T7657] netlink: 'syz.4.999': attribute type 33 has an invalid length. [ 388.445525][ T7657] netlink: 152 bytes leftover after parsing attributes in process `syz.4.999'. [ 389.583969][ T7678] netlink: 76 bytes leftover after parsing attributes in process `syz.1.1008'. [ 389.863702][ T22] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 390.123861][ T22] usb 5-1: Using ep0 maxpacket: 8 [ 390.141583][ T22] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 390.370101][ T22] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 390.391770][ T22] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 390.412309][ T22] usb 5-1: config 0 descriptor?? [ 391.280744][ T22] iowarrior 5-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 391.295032][ T22] usb 5-1: USB disconnect, device number 23 [ 392.888740][ T7714] netlink: 76 bytes leftover after parsing attributes in process `syz.4.1019'. [ 394.475680][ T7744] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1028'. [ 394.587117][ T7744] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1028'. [ 395.250447][ T7750] netlink: 76 bytes leftover after parsing attributes in process `syz.0.1031'. [ 397.373623][ T5670] usb 1-1: new full-speed USB device number 13 using dummy_hcd [ 397.756371][ T5670] usb 1-1: config index 0 descriptor too short (expected 35577, got 27) [ 397.843910][ T4316] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 398.234193][ T5670] usb 1-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 398.243314][ T5670] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 398.253950][ T5670] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 398.323517][ T5670] usb 1-1: config 1 has no interface number 0 [ 398.330828][ T5670] usb 1-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 398.341741][ T5670] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 398.566857][ T4316] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 398.575698][ T5670] snd_usb_pod 1-1:1.1: Line 6 Pocket POD found [ 398.588055][ T4316] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 398.630626][ T4316] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 398.659989][ T4316] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 398.823049][ T5670] snd_usb_pod 1-1:1.1: set_interface failed [ 398.830543][ T5670] snd_usb_pod 1-1:1.1: Line 6 Pocket POD now disconnected [ 398.839226][ T5670] snd_usb_pod: probe of 1-1:1.1 failed with error -71 [ 398.849112][ T5670] usb 1-1: USB disconnect, device number 13 [ 398.864298][ T4316] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 398.888229][ T4316] usb 3-1: config 0 descriptor?? [ 400.420079][ T7825] loop3: detected capacity change from 0 to 16 [ 400.456400][ T7825] erofs: (device loop3): mounted with root inode @ nid 36. [ 400.472952][ T7825] syz.3.1058: attempt to access beyond end of device [ 400.472952][ T7825] loop3: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 400.492533][ T7825] syz.3.1058: attempt to access beyond end of device [ 400.492533][ T7825] loop3: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 400.509233][ T7825] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 400.529389][ T7825] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 400.541367][ T7825] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 400.557723][ T27] audit: type=1800 audit(1772231914.254:58): pid=7825 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1058" name="file2" dev="loop3" ino=89 res=0 errno=0 [ 401.044346][ T4316] usbhid 3-1:0.0: can't add hid device: -71 [ 401.051002][ T4316] usbhid: probe of 3-1:0.0 failed with error -71 [ 401.065672][ T4316] usb 3-1: USB disconnect, device number 11 [ 403.040761][ T7860] loop2: detected capacity change from 0 to 16 [ 403.084395][ T7860] erofs: (device loop2): mounted with root inode @ nid 36. [ 403.102738][ T7860] syz.2.1070: attempt to access beyond end of device [ 403.102738][ T7860] loop2: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 403.131028][ T7860] syz.2.1070: attempt to access beyond end of device [ 403.131028][ T7860] loop2: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 403.146576][ T7860] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 403.166586][ T7860] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 403.179505][ T7860] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 403.195778][ T27] audit: type=1800 audit(1772231916.894:59): pid=7860 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1070" name="file2" dev="loop2" ino=89 res=0 errno=0 [ 405.308977][ T4282] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 405.518342][ T4282] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 405.545622][ T4282] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 405.563249][ T7891] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1083'. [ 405.603835][ T7891] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1083'. [ 405.623880][ T4282] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 405.979249][ T4282] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 406.005808][ T4282] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 406.825056][ T4282] usb 4-1: config 0 descriptor?? [ 409.216543][ T4282] usb 4-1: can't set config #0, error -71 [ 409.275728][ T4282] usb 4-1: USB disconnect, device number 13 [ 410.891090][ T7940] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1098'. [ 410.913536][ T7940] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1098'. [ 410.988423][ T7942] loop2: detected capacity change from 0 to 16 [ 411.001088][ T7942] erofs: (device loop2): mounted with root inode @ nid 36. [ 411.017599][ T7942] syz.2.1100: attempt to access beyond end of device [ 411.017599][ T7942] loop2: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 411.039370][ T7942] syz.2.1100: attempt to access beyond end of device [ 411.039370][ T7942] loop2: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 411.054731][ T7942] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 411.072842][ T7942] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 411.086219][ T7942] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 411.101084][ T27] audit: type=1800 audit(1772231924.794:60): pid=7942 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1100" name="file2" dev="loop2" ino=89 res=0 errno=0 [ 411.216509][ T4318] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 411.449852][ T4318] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 411.607638][ T4318] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 411.767384][ T4318] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 411.786956][ T4318] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 411.797841][ T4318] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 411.866386][ T4318] usb 4-1: config 0 descriptor?? [ 413.051087][ T7978] loop2: detected capacity change from 0 to 16 [ 413.660919][ T7978] erofs: (device loop2): mounted with root inode @ nid 36. [ 413.678331][ T7978] syz.2.1115: attempt to access beyond end of device [ 413.678331][ T7978] loop2: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 413.706767][ T7978] syz.2.1115: attempt to access beyond end of device [ 413.706767][ T7978] loop2: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 413.721709][ T7978] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 413.740837][ T7978] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 413.753103][ T7978] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 413.768589][ T27] audit: type=1800 audit(1772231927.464:61): pid=7978 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1115" name="file2" dev="loop2" ino=89 res=0 errno=0 [ 413.964411][ T4318] usbhid 4-1:0.0: can't add hid device: -71 [ 413.972071][ T4318] usbhid: probe of 4-1:0.0 failed with error -71 [ 414.043691][ T4318] usb 4-1: USB disconnect, device number 14 [ 416.785987][ T8020] loop3: detected capacity change from 0 to 16 [ 418.429495][ T8020] erofs: (device loop3): mounted with root inode @ nid 36. [ 418.447022][ T8017] syz.3.1129: attempt to access beyond end of device [ 418.447022][ T8017] loop3: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 419.145157][ T8017] syz.3.1129: attempt to access beyond end of device [ 419.145157][ T8017] loop3: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 419.161813][ T8017] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 419.175374][ T27] audit: type=1800 audit(1772231932.904:62): pid=8017 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1129" name="file2" dev="loop3" ino=89 res=0 errno=0 [ 423.279695][ T8095] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 423.323952][ T8095] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 423.355834][ T8095] Bluetooth: hci0: Suspend notifier action (1) failed: -4 [ 423.371641][ T8095] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 423.390693][ T8095] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 423.414396][ T8095] Bluetooth: hci2: Suspend notifier action (1) failed: -4 [ 423.438193][ T8095] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 423.456589][ T8095] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 423.476071][ T8095] Bluetooth: hci1: Suspend notifier action (1) failed: -4 [ 423.491403][ T8095] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 423.499327][ T8095] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 423.562412][ T8095] Bluetooth: hci3: Suspend notifier action (1) failed: -4 [ 423.622648][ T8095] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 423.640592][ T8095] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 423.649026][ T8095] Bluetooth: hci4: Suspend notifier action (1) failed: -4 [ 424.053883][ T4282] usb 2-1: new full-speed USB device number 16 using dummy_hcd [ 424.265289][ T8133] netlink: 'syz.4.1168': attribute type 33 has an invalid length. [ 424.273652][ T8133] netlink: 152 bytes leftover after parsing attributes in process `syz.4.1168'. [ 424.445574][ T4282] usb 2-1: config index 0 descriptor too short (expected 35577, got 27) [ 424.461664][ T4282] usb 2-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 424.596534][ T4282] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 424.607255][ T4282] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 424.616537][ T4282] usb 2-1: config 1 has no interface number 0 [ 424.752760][ T4282] usb 2-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 424.770033][ T4282] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 425.155883][ T4282] snd_usb_pod 2-1:1.1: Line 6 Pocket POD found [ 425.324335][ T4277] Bluetooth: hci0: command 0x0c1a tx timeout [ 425.413683][ T4277] Bluetooth: hci2: command 0x0c1a tx timeout [ 425.483599][ T4277] Bluetooth: hci1: command 0x0c1a tx timeout [ 425.576834][ T4277] Bluetooth: hci3: command 0x0c1a tx timeout [ 425.643888][ T4277] Bluetooth: hci4: command 0x0c1a tx timeout [ 425.846902][ T4282] snd_usb_pod 2-1:1.1: set_interface failed [ 425.862924][ T4282] snd_usb_pod 2-1:1.1: Line 6 Pocket POD now disconnected [ 425.870842][ T4282] snd_usb_pod: probe of 2-1:1.1 failed with error -71 [ 425.888392][ T4282] usb 2-1: USB disconnect, device number 16 [ 427.497975][ T4277] Bluetooth: hci0: command 0x0406 tx timeout [ 427.505837][ T4277] Bluetooth: hci2: command 0x0406 tx timeout [ 427.563673][ T4286] Bluetooth: hci1: command 0x0406 tx timeout [ 427.644298][ T4286] Bluetooth: hci3: command 0x0406 tx timeout [ 427.723642][ T4277] Bluetooth: hci4: command 0x0406 tx timeout [ 429.714309][ T4316] usb 3-1: new full-speed USB device number 12 using dummy_hcd [ 429.928611][ T4316] usb 3-1: config index 0 descriptor too short (expected 35577, got 27) [ 430.034104][ T8220] loop3: detected capacity change from 0 to 16 [ 430.081299][ T8220] erofs: (device loop3): mounted with root inode @ nid 36. [ 430.096944][ T8220] syz.3.1199: attempt to access beyond end of device [ 430.096944][ T8220] loop3: rw=524288, sector=1056, nr_sectors = 16 limit=16 [ 430.117619][ T8220] syz.3.1199: attempt to access beyond end of device [ 430.117619][ T8220] loop3: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 430.133003][ T8220] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 430.150511][ T8220] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 430.163690][ T8220] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 430.179322][ T27] audit: type=1800 audit(1772231943.874:63): pid=8220 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1199" name="file2" dev="loop3" ino=89 res=0 errno=0 [ 430.203963][ T4316] usb 3-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 430.228004][ T4316] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 430.433720][ T4316] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 430.445358][ T4316] usb 3-1: config 1 has no interface number 0 [ 430.453828][ T4316] usb 3-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 430.489206][ T4316] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 430.961719][ T4316] snd_usb_pod 3-1:1.1: Line 6 Pocket POD found [ 430.988458][ T8222] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1200'. [ 431.014173][ T8222] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1200'. [ 431.649875][ T4316] snd_usb_pod 3-1:1.1: set_interface failed [ 432.158320][ T4316] snd_usb_pod 3-1:1.1: Line 6 Pocket POD now disconnected [ 432.166555][ T4316] snd_usb_pod: probe of 3-1:1.1 failed with error -71 [ 432.175711][ T4316] usb 3-1: USB disconnect, device number 12 [ 436.943681][ T4316] usb 5-1: new full-speed USB device number 24 using dummy_hcd [ 437.223831][ T4316] usb 5-1: config index 0 descriptor too short (expected 35577, got 27) [ 437.368310][ T4316] usb 5-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 438.111371][ T4316] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 438.982671][ T4316] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 438.994227][ T4316] usb 5-1: config 1 has no interface number 0 [ 439.001845][ T4316] usb 5-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 439.011976][ T4316] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 439.040718][ T4316] snd_usb_pod 5-1:1.1: Line 6 Pocket POD found [ 439.204762][ T8289] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1223'. [ 439.217898][ T4316] snd_usb_pod 5-1:1.1: set_interface failed [ 439.226528][ T4316] snd_usb_pod 5-1:1.1: Line 6 Pocket POD now disconnected [ 439.235055][ T4316] snd_usb_pod: probe of 5-1:1.1 failed with error -71 [ 439.248636][ T4316] usb 5-1: USB disconnect, device number 24 [ 439.258189][ T8289] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1223'. [ 440.144050][ T1273] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.150885][ T1273] ieee802154 phy1 wpan1: encryption failed: -22 [ 442.775999][ T4320] usb 3-1: new full-speed USB device number 13 using dummy_hcd [ 444.418951][ T4320] usb 3-1: config index 0 descriptor too short (expected 35577, got 27) [ 444.502143][ T4320] usb 3-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 444.573594][ T4320] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 444.620292][ T4320] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 444.701009][ T4320] usb 3-1: config 1 has no interface number 0 [ 444.756048][ T4320] usb 3-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 444.788460][ T4320] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 444.947691][ T4320] snd_usb_pod 3-1:1.1: Line 6 Pocket POD found [ 445.084823][ T7] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 445.293046][ T4320] snd_usb_pod 3-1:1.1: set_interface failed [ 446.043468][ T7] usb 1-1: Using ep0 maxpacket: 8 [ 446.058623][ T4320] snd_usb_pod 3-1:1.1: Line 6 Pocket POD now disconnected [ 446.066978][ T7] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 446.079703][ T4320] snd_usb_pod: probe of 3-1:1.1 failed with error -71 [ 446.087662][ T7] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 446.122132][ T4320] usb 3-1: USB disconnect, device number 13 [ 446.154821][ T7] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 446.175166][ T7] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 446.345254][ T7] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 446.357001][ T7] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 447.018883][ T7] usb 1-1: GET_CAPABILITIES returned 0 [ 447.025181][ T7] usbtmc 1-1:16.0: can't read capabilities [ 447.048988][ T7] usb 1-1: USB disconnect, device number 14 [ 449.623559][ T7] usb 5-1: new full-speed USB device number 25 using dummy_hcd [ 449.825406][ T7] usb 5-1: config index 0 descriptor too short (expected 35577, got 27) [ 449.838913][ T7] usb 5-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 449.860095][ T7] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 449.889749][ T7] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 449.910917][ T7] usb 5-1: config 1 has no interface number 0 [ 449.931302][ T7] usb 5-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 449.951933][ T7] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 449.990345][ T7] snd_usb_pod 5-1:1.1: Line 6 Pocket POD found [ 450.702254][ T7] snd_usb_pod 5-1:1.1: set_interface failed [ 450.715091][ T7] snd_usb_pod 5-1:1.1: Line 6 Pocket POD now disconnected [ 450.722901][ T7] snd_usb_pod: probe of 5-1:1.1 failed with error -71 [ 450.748712][ T8410] netlink: 'syz.3.1260': attribute type 33 has an invalid length. [ 450.778081][ T7] usb 5-1: USB disconnect, device number 25 [ 450.862728][ T8410] netlink: 152 bytes leftover after parsing attributes in process `syz.3.1260'. [ 453.948360][ T8457] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 453.948360][ T8457] program syz.1.1276 not setting count and/or reply_len properly [ 454.876371][ T5670] usb 4-1: new full-speed USB device number 15 using dummy_hcd [ 455.905999][ T5670] usb 4-1: config index 0 descriptor too short (expected 35577, got 27) [ 456.580784][ T5670] usb 4-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 456.591222][ T5670] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 456.602388][ T5670] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 456.613128][ T5670] usb 4-1: config 1 has no interface number 0 [ 456.621394][ T5670] usb 4-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 456.630976][ T5670] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 456.653759][ T5670] snd_usb_pod 4-1:1.1: Line 6 Pocket POD found [ 458.491449][ T8492] netlink: 'syz.1.1287': attribute type 4 has an invalid length. [ 460.573581][ T4282] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 460.783490][ T4282] usb 1-1: Using ep0 maxpacket: 32 [ 461.119371][ T5670] snd_usb_pod 4-1:1.1: set_interface failed [ 461.172558][ T5670] snd_usb_pod 4-1:1.1: Line 6 Pocket POD now disconnected [ 461.531152][ T5670] snd_usb_pod: probe of 4-1:1.1 failed with error -71 [ 461.544762][ T4282] usb 1-1: config 0 has an invalid interface number: 184 but max is 0 [ 461.550979][ T5670] usb 4-1: USB disconnect, device number 15 [ 461.583535][ T4282] usb 1-1: config 0 has no interface number 0 [ 461.591342][ T4282] usb 1-1: config 0 interface 184 has no altsetting 0 [ 461.642686][ T4282] usb 1-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 461.668919][ T4282] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 462.543104][ T4282] usb 1-1: Product: syz [ 462.547570][ T4282] usb 1-1: Manufacturer: syz [ 462.552518][ T4282] usb 1-1: SerialNumber: syz [ 462.560356][ T4282] usb 1-1: config 0 descriptor?? [ 462.576828][ T4282] smsc75xx v1.0.0 [ 463.168235][ T4282] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 463.202749][ T4282] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -32 [ 463.239582][ T4282] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 463.270128][ T4282] smsc75xx: probe of 1-1:0.184 failed with error -32 [ 464.479435][ T7] usb 1-1: USB disconnect, device number 15 [ 466.678379][ T8568] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 466.678379][ T8568] The task syz.4.1310 (8568) triggered the difference, watch for misbehavior. [ 467.501607][ T8563] netlink: 'syz.1.1308': attribute type 33 has an invalid length. [ 467.615931][ T8563] netlink: 152 bytes leftover after parsing attributes in process `syz.1.1308'. [ 468.913475][ T5826] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 468.922822][ T4282] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 469.123590][ T4282] usb 1-1: Using ep0 maxpacket: 32 [ 469.131310][ T5826] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 469.822412][ T5826] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 469.832816][ T5826] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 469.847107][ T5826] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 469.856833][ T5826] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 469.865222][ T4282] usb 1-1: config 0 has an invalid interface number: 184 but max is 0 [ 469.875703][ T5826] usb 4-1: config 0 descriptor?? [ 469.882551][ T4282] usb 1-1: config 0 has no interface number 0 [ 469.889028][ T4282] usb 1-1: config 0 interface 184 has no altsetting 0 [ 469.983617][ T5826] usb 4-1: can't set config #0, error -71 [ 469.990542][ T4282] usb 1-1: string descriptor 0 read error: -71 [ 470.002605][ T5826] usb 4-1: USB disconnect, device number 16 [ 470.009071][ T4282] usb 1-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 470.036031][ T4282] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 470.046790][ T4282] usb 1-1: config 0 descriptor?? [ 470.065169][ T4282] usb 1-1: can't set config #0, error -71 [ 470.090287][ T4282] usb 1-1: USB disconnect, device number 16 [ 471.885642][ T4318] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 472.108587][ T4318] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 472.189134][ T4318] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 472.312905][ T4318] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 472.483687][ T4318] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 472.512767][ T4318] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 472.569910][ T4318] usb 2-1: config 0 descriptor?? [ 473.263988][ T125] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 473.398097][ T4318] plantronics 0003:047F:FFFF.0004: No inputs registered, leaving [ 473.571661][ T4318] plantronics 0003:047F:FFFF.0004: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 473.643476][ T125] usb 4-1: Using ep0 maxpacket: 32 [ 473.700133][ T125] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 473.712888][ T125] usb 4-1: config 0 has no interface number 0 [ 473.722729][ T125] usb 4-1: config 0 interface 184 has no altsetting 0 [ 473.739603][ T125] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 473.805704][ T125] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 473.893516][ T125] usb 4-1: Product: syz [ 473.899304][ T125] usb 4-1: Manufacturer: syz [ 473.914641][ T125] usb 4-1: SerialNumber: syz [ 473.921484][ T125] usb 4-1: config 0 descriptor?? [ 473.929137][ T125] smsc75xx v1.0.0 [ 474.500764][ T125] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 474.521350][ T125] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -32 [ 474.544583][ T125] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 474.566286][ T125] smsc75xx: probe of 4-1:0.184 failed with error -32 [ 474.953546][ T7] usb 2-1: reset high-speed USB device number 17 using dummy_hcd [ 475.343111][ T8653] netlink: 'syz.4.1338': attribute type 33 has an invalid length. [ 475.351610][ T8653] netlink: 152 bytes leftover after parsing attributes in process `syz.4.1338'. [ 476.131954][ T5826] usb 4-1: USB disconnect, device number 17 [ 476.336757][ T4282] usb 2-1: USB disconnect, device number 17 [ 480.236285][ T8700] netlink: 'syz.4.1352': attribute type 33 has an invalid length. [ 480.244295][ T8700] netlink: 152 bytes leftover after parsing attributes in process `syz.4.1352'. [ 481.893499][ T4282] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 482.213616][ T4282] usb 3-1: Using ep0 maxpacket: 32 [ 483.326670][ T4282] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 483.353455][ T4282] usb 3-1: config 0 has no interface number 0 [ 483.359644][ T4282] usb 3-1: config 0 interface 184 has no altsetting 0 [ 483.395542][ T4282] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 483.430911][ T4282] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 484.318571][ T4282] usb 3-1: Product: syz [ 484.323032][ T4282] usb 3-1: Manufacturer: syz [ 484.418543][ T4282] usb 3-1: SerialNumber: syz [ 484.460326][ T4282] usb 3-1: config 0 descriptor?? [ 484.500361][ T4282] usb 3-1: can't set config #0, error -71 [ 484.546682][ T4282] usb 3-1: USB disconnect, device number 14 [ 486.543498][ T4282] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 487.678574][ T4282] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 487.719334][ T4282] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 488.960435][ T4282] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 488.973636][ T4282] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 488.983956][ T4282] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 489.007082][ T4282] usb 4-1: config 0 descriptor?? [ 489.228284][ T4282] usbhid 4-1:0.0: can't add hid device: -71 [ 489.263664][ T4282] usbhid: probe of 4-1:0.0 failed with error -71 [ 489.292150][ T4282] usb 4-1: USB disconnect, device number 18 [ 489.389321][ T8796] netlink: 'syz.3.1382': attribute type 4 has an invalid length. [ 490.758653][ T8818] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1387'. [ 490.779953][ T8818] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1387'. [ 496.996125][ T8886] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 496.996125][ T8886] program syz.2.1411 not setting count and/or reply_len properly [ 498.638200][ T8898] netlink: 'syz.1.1416': attribute type 4 has an invalid length. [ 500.633495][ T8385] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 500.837283][ T8385] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 501.367636][ T8385] usb 1-1: New USB device found, idVendor=044f, idProduct=b65d, bcdDevice= 0.00 [ 501.387397][ T8385] usb 1-1: New USB device strings: Mfr=6, Product=0, SerialNumber=0 [ 501.406024][ T8385] usb 1-1: Manufacturer: syz [ 501.424773][ T8385] usb 1-1: config 0 descriptor?? [ 501.577298][ T1273] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.584043][ T1273] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.320298][ T8927] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1425'. [ 502.339850][ T8927] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1425'. [ 502.533717][ T125] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 505.424423][ T125] usb 3-1: device descriptor read/all, error -71 [ 505.520956][ T8385] usbhid 1-1:0.0: can't add hid device: -71 [ 505.539113][ T8385] usbhid: probe of 1-1:0.0 failed with error -71 [ 505.589843][ T8385] usb 1-1: USB disconnect, device number 17 [ 508.570155][ T8972] netlink: 'syz.3.1436': attribute type 33 has an invalid length. [ 508.578281][ T8972] netlink: 152 bytes leftover after parsing attributes in process `syz.3.1436'. [ 509.888439][ T8980] netlink: 'syz.3.1438': attribute type 4 has an invalid length. [ 511.282389][ T4286] Bluetooth: hci1: unknown advertising packet type: 0x75 [ 511.282463][ T4286] Bluetooth: hci1: Malformed LE Event: 0x02 [ 515.048341][ T9015] netlink: 'syz.0.1449': attribute type 4 has an invalid length. [ 517.198378][ T9043] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 517.198378][ T9043] program syz.1.1451 not setting count and/or reply_len properly [ 523.711143][ T9112] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1477'. [ 523.779091][ T9112] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1477'. [ 528.641670][ T9165] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1490'. [ 528.673476][ T9165] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1490'. [ 529.686228][ T9194] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 529.686228][ T9194] program syz.2.1499 not setting count and/or reply_len properly [ 531.384783][ T4286] Bluetooth: hci4: command 0x0405 tx timeout [ 531.499539][ T9204] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1503'. [ 531.544548][ T9204] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1503'. [ 532.641137][ T5826] libceph: connect (1)[c::]:6789 error -101 [ 532.748556][ T5826] libceph: mon0 (1)[c::]:6789 connect error [ 532.834931][ T9212] ceph: No mds server is up or the cluster is laggy [ 532.848284][ T14] libceph: connect (1)[c::]:6789 error -101 [ 532.882657][ T14] libceph: mon0 (1)[c::]:6789 connect error [ 533.271791][ T5826] libceph: connect (1)[c::]:6789 error -101 [ 533.313211][ T5826] libceph: mon0 (1)[c::]:6789 connect error [ 534.093555][ T14] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 534.432996][ T9238] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 534.432996][ T9238] program syz.0.1511 not setting count and/or reply_len properly [ 534.456930][ T9237] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 534.456930][ T9237] program syz.2.1512 not setting count and/or reply_len properly [ 534.574132][ T14] usb 4-1: Using ep0 maxpacket: 8 [ 534.582275][ T14] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 534.605957][ T14] usb 4-1: config 0 interface 0 altsetting 144 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 534.713656][ T14] usb 4-1: config 0 interface 0 has no altsetting 0 [ 534.721075][ T14] usb 4-1: New USB device found, idVendor=6666, idProduct=8804, bcdDevice= 0.00 [ 534.821131][ T14] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 534.840563][ T14] usb 4-1: config 0 descriptor?? [ 534.860561][ T14] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 535.050993][ T9248] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1515'. [ 535.219251][ T9248] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1515'. [ 537.165249][ T14] usb 4-1: USB disconnect, device number 19 [ 537.238186][ T9276] netlink: 'syz.3.1526': attribute type 12 has an invalid length. [ 537.537245][ T9281] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 537.537245][ T9281] program syz.0.1525 not setting count and/or reply_len properly [ 542.743630][ T14] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 542.983510][ T14] usb 1-1: Using ep0 maxpacket: 32 [ 542.991335][ T14] usb 1-1: config 0 has an invalid interface number: 184 but max is 0 [ 543.037164][ T14] usb 1-1: config 0 has no interface number 0 [ 543.053935][ T14] usb 1-1: config 0 interface 184 has no altsetting 0 [ 543.825854][ T14] usb 1-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 543.893564][ T14] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 543.901703][ T14] usb 1-1: Product: syz [ 543.933495][ T14] usb 1-1: Manufacturer: syz [ 543.947967][ T14] usb 1-1: SerialNumber: syz [ 543.998169][ T14] usb 1-1: config 0 descriptor?? [ 544.045568][ T14] smsc75xx v1.0.0 [ 544.082000][ T9335] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 544.082000][ T9335] program syz.2.1542 not setting count and/or reply_len properly [ 544.316075][ T9344] netlink: 'syz.4.1543': attribute type 33 has an invalid length. [ 544.324480][ T9344] netlink: 152 bytes leftover after parsing attributes in process `syz.4.1543'. [ 544.935287][ T14] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 544.955262][ T14] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -61 [ 544.965935][ T14] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 545.010053][ T14] smsc75xx: probe of 1-1:0.184 failed with error -61 [ 546.398775][ T14] usb 1-1: USB disconnect, device number 18 [ 547.647087][ T9387] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 547.647087][ T9387] program syz.0.1556 not setting count and/or reply_len properly [ 550.294392][ T9401] netlink: 'syz.4.1559': attribute type 4 has an invalid length. [ 550.805018][ T9405] netlink: 'syz.4.1559': attribute type 4 has an invalid length. [ 551.043451][ T22] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 551.683456][ T22] usb 4-1: Using ep0 maxpacket: 32 [ 551.696533][ T22] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 551.696564][ T22] usb 4-1: config 0 has no interface number 0 [ 551.696598][ T22] usb 4-1: config 0 interface 184 has no altsetting 0 [ 551.699640][ T22] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 551.699670][ T22] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 551.699750][ T22] usb 4-1: Product: syz [ 551.699765][ T22] usb 4-1: Manufacturer: syz [ 551.699778][ T22] usb 4-1: SerialNumber: syz [ 551.718228][ T22] usb 4-1: config 0 descriptor?? [ 551.737095][ T22] smsc75xx v1.0.0 [ 552.140749][ T9433] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1568'. [ 552.141282][ T22] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 552.205830][ T9433] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1568'. [ 552.222354][ T22] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -61 [ 552.270815][ T22] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 552.301834][ T22] smsc75xx: probe of 4-1:0.184 failed with error -61 [ 555.115921][ T9457] netlink: 'syz.2.1572': attribute type 4 has an invalid length. [ 555.762631][ T5826] usb 4-1: USB disconnect, device number 20 [ 558.325286][ T9484] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1575'. [ 560.485816][ T125] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 560.713471][ T125] usb 3-1: Using ep0 maxpacket: 32 [ 560.725008][ T125] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 560.779152][ T125] usb 3-1: config 0 has no interface number 0 [ 560.806779][ T125] usb 3-1: config 0 interface 184 has no altsetting 0 [ 560.825536][ T125] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 560.863408][ T125] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 560.872878][ T125] usb 3-1: Product: syz [ 560.893640][ T14] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 560.898395][ T125] usb 3-1: Manufacturer: syz [ 560.913454][ T125] usb 3-1: SerialNumber: syz [ 560.936484][ T125] usb 3-1: config 0 descriptor?? [ 560.960354][ T125] smsc75xx v1.0.0 [ 561.095324][ T14] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 561.118317][ T14] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 561.146763][ T14] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 561.204296][ T14] usb 1-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 561.217070][ T14] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 561.236347][ T14] usb 1-1: Product: syz [ 561.240563][ T14] usb 1-1: Manufacturer: syz [ 561.263894][ T14] usb 1-1: SerialNumber: syz [ 561.278407][ T14] usb 1-1: config 0 descriptor?? [ 561.295788][ T14] adutux 1-1:0.0: interrupt endpoints not found [ 561.380744][ T125] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 562.412741][ T125] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -61 [ 562.516545][ T125] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 562.621706][ T125] smsc75xx: probe of 3-1:0.184 failed with error -61 [ 562.809548][ T14] usb 1-1: USB disconnect, device number 19 [ 563.006407][ T1273] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.013625][ T1273] ieee802154 phy1 wpan1: encryption failed: -22 [ 565.089131][ T4316] usb 3-1: USB disconnect, device number 17 [ 565.343094][ T9544] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 565.343094][ T9544] program syz.1.1598 not setting count and/or reply_len properly [ 568.890688][ T9570] overlayfs: overlapping lowerdir path [ 571.446726][ T125] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 571.661210][ T125] usb 4-1: Using ep0 maxpacket: 8 [ 571.684749][ T125] usb 4-1: config 0 interface 0 altsetting 144 endpoint 0x81 has invalid wMaxPacketSize 0 [ 571.738674][ T125] usb 4-1: config 0 interface 0 has no altsetting 0 [ 571.864603][ T125] usb 4-1: New USB device found, idVendor=6666, idProduct=8804, bcdDevice= 0.00 [ 572.023873][ T125] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 572.270760][ T125] usb 4-1: config 0 descriptor?? [ 572.365919][ T125] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 572.733626][ T125] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 572.933481][ T125] usb 2-1: Using ep0 maxpacket: 32 [ 572.955668][ T125] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 573.053851][ T125] usb 2-1: config 0 has no interface number 0 [ 573.244944][ T125] usb 2-1: config 0 interface 184 has no altsetting 0 [ 573.266662][ T125] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 573.276474][ T125] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 573.360350][ T9618] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 573.360350][ T9618] program syz.4.1617 not setting count and/or reply_len properly [ 573.388934][ T125] usb 2-1: Product: syz [ 573.398298][ T125] usb 2-1: Manufacturer: syz [ 573.403029][ T125] usb 2-1: SerialNumber: syz [ 573.425959][ T125] usb 2-1: config 0 descriptor?? [ 573.505436][ T125] smsc75xx v1.0.0 [ 573.672842][ T14] usb 4-1: USB disconnect, device number 21 [ 573.923534][ T125] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 573.973550][ T125] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -61 [ 574.137361][ T125] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 574.193505][ T125] smsc75xx: probe of 2-1:0.184 failed with error -61 [ 574.321866][ T9634] netlink: 244 bytes leftover after parsing attributes in process `syz.0.1627'. [ 575.927931][ T125] usb 2-1: USB disconnect, device number 18 [ 578.575604][ T9659] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1635'. [ 578.880912][ T9665] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 578.880912][ T9665] program syz.3.1638 not setting count and/or reply_len properly [ 579.430105][ T9679] netlink: 244 bytes leftover after parsing attributes in process `syz.0.1640'. [ 579.723056][ T5826] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 580.055479][ T5826] usb 3-1: Using ep0 maxpacket: 32 [ 580.075553][ T5826] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 580.118731][ T5826] usb 3-1: config 0 has no interface number 0 [ 580.143501][ T5826] usb 3-1: config 0 interface 184 has no altsetting 0 [ 580.215665][ T5826] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 580.253011][ T5826] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 580.291511][ T5826] usb 3-1: Product: syz [ 580.319459][ T5826] usb 3-1: Manufacturer: syz [ 580.352635][ T5826] usb 3-1: SerialNumber: syz [ 580.405963][ T5826] usb 3-1: config 0 descriptor?? [ 580.457542][ T5826] smsc75xx v1.0.0 [ 581.443998][ T5826] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 581.456575][ T5826] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 581.467846][ T5826] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 581.479780][ T5826] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -32 [ 581.490242][ T5826] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 581.516516][ T5826] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 581.548663][ T5826] smsc75xx: probe of 3-1:0.184 failed with error -32 [ 582.659604][ T9717] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1653'. [ 583.730416][ T4317] usb 3-1: USB disconnect, device number 18 [ 583.973577][ T22] usb 4-1: new full-speed USB device number 22 using dummy_hcd [ 584.199948][ T22] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 584.747128][ T22] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 584.811430][ T22] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 584.845394][ T22] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 585.958923][ T22] usb 4-1: usb_control_msg returned -32 [ 585.972925][ T9739] ksmbd: Unknown IPC event: 4, ignore. [ 587.310493][ T22] usbtmc 4-1:16.0: can't read capabilities [ 588.134720][ T4316] libceph: connect (1)[c::]:6789 error -101 [ 588.142087][ T4316] libceph: mon0 (1)[c::]:6789 connect error [ 588.190719][ T4316] libceph: connect (1)[c::]:6789 error -101 [ 588.216088][ T4316] libceph: mon0 (1)[c::]:6789 connect error [ 588.496331][ T4316] libceph: connect (1)[c::]:6789 error -101 [ 588.508897][ T4316] libceph: mon0 (1)[c::]:6789 connect error [ 589.294418][ T14] libceph: connect (1)[c::]:6789 error -101 [ 589.303465][ T9750] ceph: No mds server is up or the cluster is laggy [ 589.303549][ T14] libceph: mon0 (1)[c::]:6789 connect error [ 589.402581][ T22] usb 4-1: USB disconnect, device number 22 [ 589.933520][ T22] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 590.124399][ T22] usb 4-1: device descriptor read/64, error -71 [ 590.403702][ T22] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 590.618602][ T22] usb 4-1: device descriptor read/64, error -71 [ 590.786201][ T9792] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 590.786201][ T9792] program syz.2.1680 not setting count and/or reply_len properly [ 590.814177][ T22] usb usb4-port1: attempt power cycle [ 591.233407][ T22] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 591.284102][ T22] usb 4-1: device descriptor read/8, error -71 [ 591.623466][ T22] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 591.675385][ T22] usb 4-1: device descriptor read/8, error -71 [ 591.794264][ T22] usb usb4-port1: unable to enumerate USB device [ 594.094202][ T9819] netlink: 'syz.0.1688': attribute type 4 has an invalid length. [ 594.122480][ T9819] netlink: 'syz.0.1688': attribute type 4 has an invalid length. [ 597.020291][ T9845] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1691'. [ 597.577281][ T9853] netlink: 'syz.2.1697': attribute type 4 has an invalid length. [ 599.830896][ T9874] PKCS7: Unknown OID: [4] 2.19.13055.1334505.0.0.0.0 [ 599.838666][ T9874] PKCS7: Only support pkcs7_signedData type [ 600.992364][ T4317] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 601.273480][ T4317] usb 5-1: Using ep0 maxpacket: 16 [ 601.421275][ T4317] usb 5-1: config 0 has an invalid interface number: 213 but max is 0 [ 601.900019][ T4317] usb 5-1: config 0 has no interface number 0 [ 601.909046][ T4317] usb 5-1: New USB device found, idVendor=413c, idProduct=81d2, bcdDevice=25.e8 [ 601.918641][ T4317] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 601.927013][ T4317] usb 5-1: Product: syz [ 601.931323][ T4317] usb 5-1: Manufacturer: syz [ 601.936482][ T4317] usb 5-1: SerialNumber: syz [ 602.001540][ T9875] process 'syz.3.1704' launched './file1' with NULL argv: empty string added [ 602.024217][ T4317] usb 5-1: config 0 descriptor?? [ 602.445639][ T26] usb 5-1: USB disconnect, device number 26 [ 603.113648][ T4317] usb 3-1: new full-speed USB device number 19 using dummy_hcd [ 603.336083][ T4317] usb 3-1: config index 0 descriptor too short (expected 35577, got 27) [ 603.391705][ T4317] usb 3-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 603.575470][ T4317] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 603.764548][ T4317] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 603.855051][ T4317] usb 3-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 603.953423][ T4317] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 604.631874][ T4315] usb 3-1: USB disconnect, device number 19 [ 605.081729][ T9927] netlink: 'syz.4.1719': attribute type 4 has an invalid length. [ 605.141745][ T9927] netlink: 'syz.4.1719': attribute type 4 has an invalid length. [ 608.433585][ T9961] netlink: 'syz.2.1730': attribute type 4 has an invalid length. [ 610.176006][ T9970] netlink: 'syz.3.1734': attribute type 4 has an invalid length. [ 610.233692][ T9971] netlink: 'syz.3.1734': attribute type 4 has an invalid length. [ 613.019740][T10002] netlink: 'syz.3.1743': attribute type 4 has an invalid length. [ 615.683465][ T14] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 615.953582][ T26] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 616.419842][ T26] usb 1-1: Using ep0 maxpacket: 8 [ 616.467404][ T26] usb 1-1: config 0 interface 0 altsetting 144 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 616.573488][ T26] usb 1-1: config 0 interface 0 altsetting 144 endpoint 0x81 has invalid wMaxPacketSize 0 [ 616.600582][ T14] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 616.616939][ T14] usb 3-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 616.630768][ T14] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 616.645815][ T14] usb 3-1: config 1 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 616.805227][ T26] usb 1-1: config 0 interface 0 has no altsetting 0 [ 616.811902][ T26] usb 1-1: New USB device found, idVendor=6666, idProduct=8804, bcdDevice= 0.00 [ 616.831207][ T26] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 616.842545][ T14] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 616.849182][ T26] usb 1-1: config 0 descriptor?? [ 617.420868][ T14] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 617.429354][ T14] usb 3-1: Product: syz [ 617.536939][ T26] usbhid 1-1:0.0: can't add hid device: -71 [ 617.571096][ T26] usbhid: probe of 1-1:0.0 failed with error -71 [ 617.577910][ T14] usb 3-1: Manufacturer: syz [ 617.598973][T10020] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 617.609348][ T14] cdc_wdm 3-1:1.0: skipping garbage [ 617.615870][ T26] usb 1-1: USB disconnect, device number 20 [ 617.615944][ T14] cdc_wdm 3-1:1.0: skipping garbage [ 617.640444][ T14] cdc_wdm: probe of 3-1:1.0 failed with error -22 [ 617.902600][ T22] usb 3-1: USB disconnect, device number 20 [ 620.185249][ T14] libceph: connect (1)[c::]:6789 error -101 [ 620.191608][ T14] libceph: mon0 (1)[c::]:6789 connect error [ 620.346007][ T14] libceph: connect (1)[c::]:6789 error -101 [ 620.444287][ T14] libceph: mon0 (1)[c::]:6789 connect error [ 620.455403][T10075] ceph: No mds server is up or the cluster is laggy [ 620.687994][T10074] PKCS7: Unknown OID: [4] 2.19.13055.1334505.0.0.0.0 [ 620.709051][T10074] PKCS7: Only support pkcs7_signedData type [ 622.983611][ T14] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 623.090893][T10112] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1772'. [ 623.965100][ T14] usb 1-1: Using ep0 maxpacket: 8 [ 623.984161][ T14] usb 1-1: config 0 interface 0 altsetting 144 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 624.050377][ T14] usb 1-1: config 0 interface 0 altsetting 144 endpoint 0x81 has invalid wMaxPacketSize 0 [ 624.091010][ T14] usb 1-1: config 0 interface 0 has no altsetting 0 [ 624.139074][ T14] usb 1-1: New USB device found, idVendor=6666, idProduct=8804, bcdDevice= 0.00 [ 624.162092][ T14] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 624.282084][ T14] usb 1-1: config 0 descriptor?? [ 624.448440][ T1273] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.455077][ T1273] ieee802154 phy1 wpan1: encryption failed: -22 [ 625.350234][ T14] usbhid 1-1:0.0: can't add hid device: -71 [ 625.373645][ T14] usbhid: probe of 1-1:0.0 failed with error -71 [ 625.517992][ T14] usb 1-1: USB disconnect, device number 21 [ 627.509953][T10130] ceph: No mds server is up or the cluster is laggy [ 630.023410][ T22] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 630.229592][ T22] usb 2-1: Using ep0 maxpacket: 8 [ 630.305668][ T22] usb 2-1: config 0 interface 0 altsetting 144 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 630.317020][ T22] usb 2-1: config 0 interface 0 altsetting 144 endpoint 0x81 has invalid wMaxPacketSize 0 [ 630.328112][ T22] usb 2-1: config 0 interface 0 has no altsetting 0 [ 630.504159][ T22] usb 2-1: New USB device found, idVendor=6666, idProduct=8804, bcdDevice= 0.00 [ 630.513260][ T22] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 630.655288][ T22] usb 2-1: config 0 descriptor?? [ 631.275008][ T22] usbhid 2-1:0.0: can't add hid device: -71 [ 631.282253][ T22] usbhid: probe of 2-1:0.0 failed with error -71 [ 631.356193][ T22] usb 2-1: USB disconnect, device number 19 [ 636.382196][T10242] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1811'. [ 637.403437][ T4315] usb 3-1: new full-speed USB device number 21 using dummy_hcd [ 637.615151][ T4315] usb 3-1: config index 0 descriptor too short (expected 35577, got 27) [ 637.633614][ T4315] usb 3-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 637.642355][ T4315] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 637.686453][ T4315] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 637.713630][ T4315] usb 3-1: config 1 has no interface number 0 [ 637.720010][ T4315] usb 3-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 637.778256][ T4315] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 637.812382][ T4315] snd_usb_pod 3-1:1.1: Line 6 Pocket POD found [ 639.815613][ T4315] snd_usb_pod 3-1:1.1: set_interface failed [ 639.821744][ T4315] snd_usb_pod 3-1:1.1: Line 6 Pocket POD now disconnected [ 639.831480][ T4315] snd_usb_pod: probe of 3-1:1.1 failed with error -71 [ 639.847241][ T4315] usb 3-1: USB disconnect, device number 21 [ 644.693382][ T4315] usb 5-1: new full-speed USB device number 27 using dummy_hcd [ 644.702410][T10321] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 644.702410][T10321] program syz.2.1834 not setting count and/or reply_len properly [ 644.917139][ T4315] usb 5-1: config index 0 descriptor too short (expected 35577, got 27) [ 644.943430][ T4315] usb 5-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 644.982606][ T4315] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 645.020574][ T4315] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 645.046920][ T4315] usb 5-1: config 1 has no interface number 0 [ 645.069313][ T4315] usb 5-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 645.109547][ T4315] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 645.176608][ T4315] snd_usb_pod 5-1:1.1: Line 6 Pocket POD found [ 645.815400][ T4315] snd_usb_pod 5-1:1.1: set_interface failed [ 645.843858][ T4315] snd_usb_pod 5-1:1.1: Line 6 Pocket POD now disconnected [ 645.851153][ T4315] snd_usb_pod: probe of 5-1:1.1 failed with error -71 [ 645.965509][ T4315] usb 5-1: USB disconnect, device number 27 [ 648.383770][T10355] tmpfs: Unknown parameter 'usrquota' [ 649.944276][ T125] usb 5-1: new full-speed USB device number 28 using dummy_hcd [ 650.181423][ T125] usb 5-1: config index 0 descriptor too short (expected 35577, got 27) [ 650.230459][ T125] usb 5-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 650.381440][ T125] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 650.560443][ T125] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 650.705734][ T125] usb 5-1: config 1 has no interface number 0 [ 650.842959][ T125] usb 5-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 650.852542][ T125] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 650.876821][ T125] snd_usb_pod 5-1:1.1: Line 6 Pocket POD found [ 651.621997][ T125] snd_usb_pod 5-1:1.1: set_interface failed [ 651.681668][ T125] snd_usb_pod 5-1:1.1: Line 6 Pocket POD now disconnected [ 651.821895][ T125] snd_usb_pod: probe of 5-1:1.1 failed with error -71 [ 651.863607][ T125] usb 5-1: USB disconnect, device number 28 [ 653.601078][T10401] netlink: 'syz.4.1859': attribute type 4 has an invalid length. [ 654.220516][T10403] netlink: 'syz.4.1859': attribute type 4 has an invalid length. [ 656.680685][T10434] netlink: 'syz.2.1865': attribute type 33 has an invalid length. [ 656.689252][T10434] netlink: 152 bytes leftover after parsing attributes in process `syz.2.1865'. [ 657.113378][ T4316] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 657.305072][ T4316] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 657.325561][ T4316] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 657.388300][ T4316] usb 4-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 657.419557][ T4316] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 657.444239][ T4316] usb 4-1: Product: syz [ 657.456680][ T4316] usb 4-1: Manufacturer: syz [ 657.470586][ T4316] usb 4-1: SerialNumber: syz [ 657.562912][ T4316] usb 4-1: config 0 descriptor?? [ 657.588007][ T4316] adutux 4-1:0.0: interrupt endpoints not found [ 657.959267][ T4316] usb 4-1: USB disconnect, device number 27 [ 659.602762][T10474] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1884'. [ 659.606295][ T4316] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 659.611966][T10474] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1884'. [ 659.819420][ T4316] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 659.847399][ T4316] usb 2-1: New USB device found, idVendor=044f, idProduct=b65d, bcdDevice= 0.00 [ 659.867760][ T4316] usb 2-1: New USB device strings: Mfr=6, Product=0, SerialNumber=0 [ 659.902327][ T4316] usb 2-1: Manufacturer: syz [ 659.939557][ T4316] usb 2-1: config 0 descriptor?? [ 659.959842][ T125] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 660.166119][ T125] usb 3-1: Using ep0 maxpacket: 32 [ 660.174832][ T125] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 660.190572][ T125] usb 3-1: config 0 has no interface number 0 [ 660.197369][ T125] usb 3-1: config 0 interface 184 has no altsetting 0 [ 660.214842][ T125] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 660.803389][ T125] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 660.811436][ T125] usb 3-1: Product: syz [ 660.823366][ T125] usb 3-1: Manufacturer: syz [ 660.907966][ T125] usb 3-1: SerialNumber: syz [ 660.927377][ T125] usb 3-1: config 0 descriptor?? [ 660.935760][ T125] smsc75xx v1.0.0 [ 661.028672][ T4316] hid-thrustmaster 0003:044F:B65D.0005: unknown main item tag 0x0 [ 661.109417][ T4316] hid-thrustmaster 0003:044F:B65D.0005: unknown main item tag 0x0 [ 661.209362][ T4316] hid-thrustmaster 0003:044F:B65D.0005: unknown main item tag 0x0 [ 661.720644][T10490] netlink: 'syz.4.1890': attribute type 4 has an invalid length. [ 662.357107][ T4316] hid-thrustmaster 0003:044F:B65D.0005: unknown main item tag 0x0 [ 662.365864][ T4316] hid-thrustmaster 0003:044F:B65D.0005: unknown main item tag 0x0 [ 662.380767][ T4316] hid-thrustmaster 0003:044F:B65D.0005: hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.1-1/input0 [ 662.393479][ T4316] hid-thrustmaster 0003:044F:B65D.0005: Wrong number of endpoints? [ 662.442957][T10492] netlink: 'syz.4.1890': attribute type 4 has an invalid length. [ 662.524413][ C0] hid-thrustmaster 0003:044F:B65D.0005: URB to get model id failed with error -71 [ 662.534340][ T6758] usb 2-1: USB disconnect, device number 20 [ 662.605546][ T125] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -71 [ 662.654029][ T125] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 662.680836][ T125] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 662.732944][ T125] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 662.753575][ T125] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 662.768400][T10494] fido_id[10494]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 662.789164][ T125] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 662.873595][ T125] smsc75xx: probe of 3-1:0.184 failed with error -71 [ 662.953084][ T125] usb 3-1: USB disconnect, device number 22 [ 664.153575][ T26] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 664.847172][ T26] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 664.879810][ T26] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 664.955659][ T26] usb 5-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 664.976849][ T26] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 664.985616][ T26] usb 5-1: Product: syz [ 664.991401][ T26] usb 5-1: Manufacturer: syz [ 664.996537][ T26] usb 5-1: SerialNumber: syz [ 665.020265][ T26] usb 5-1: config 0 descriptor?? [ 665.031790][ T26] adutux 5-1:0.0: interrupt endpoints not found [ 665.606745][T10538] netlink: 'syz.3.1904': attribute type 4 has an invalid length. [ 665.648003][T10538] netlink: 'syz.3.1904': attribute type 4 has an invalid length. [ 666.318810][ T125] usb 5-1: USB disconnect, device number 29 [ 666.323440][ T6758] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 666.523495][ T6758] usb 1-1: Using ep0 maxpacket: 32 [ 666.530731][ T6758] usb 1-1: config 0 has an invalid interface number: 184 but max is 0 [ 666.563546][ T6758] usb 1-1: config 0 has no interface number 0 [ 666.569706][ T6758] usb 1-1: config 0 interface 184 has no altsetting 0 [ 666.595940][ T6758] usb 1-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 666.615996][ T6758] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 666.633852][ T6758] usb 1-1: Product: syz [ 666.638164][ T6758] usb 1-1: Manufacturer: syz [ 666.642770][ T6758] usb 1-1: SerialNumber: syz [ 666.665111][ T6758] usb 1-1: config 0 descriptor?? [ 666.672172][ T6758] smsc75xx v1.0.0 [ 666.853548][ T125] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 667.519444][ T6758] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -61 [ 667.567950][ T6758] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 667.735395][ T6758] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 667.778620][ T6758] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -32 [ 667.829946][ T6758] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 667.870129][ T6758] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 667.935553][ T6758] smsc75xx: probe of 1-1:0.184 failed with error -32 [ 668.157668][ T125] usb 3-1: Using ep0 maxpacket: 8 [ 668.164999][ T125] usb 3-1: config 0 interface 0 altsetting 144 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 668.188808][ T125] usb 3-1: config 0 interface 0 altsetting 144 endpoint 0x81 has invalid wMaxPacketSize 0 [ 668.357195][ T125] usb 3-1: config 0 interface 0 has no altsetting 0 [ 668.364733][ T125] usb 3-1: New USB device found, idVendor=6666, idProduct=8804, bcdDevice= 0.00 [ 668.374570][ T125] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 668.394836][ T125] usb 3-1: config 0 descriptor?? [ 669.057276][ T6758] usb 1-1: USB disconnect, device number 22 [ 669.696365][T10580] netlink: 'syz.0.1916': attribute type 4 has an invalid length. [ 670.317180][T10582] netlink: 'syz.0.1916': attribute type 4 has an invalid length. [ 670.495638][ T125] usbhid 3-1:0.0: can't add hid device: -71 [ 670.504125][ T125] usbhid: probe of 3-1:0.0 failed with error -71 [ 670.542924][ T125] usb 3-1: USB disconnect, device number 23 [ 672.102525][T10601] tmpfs: Unknown parameter 'usrquota' [ 672.793564][ T22] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 672.883623][ T4316] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 673.013478][ T22] usb 5-1: Using ep0 maxpacket: 32 [ 673.022055][ T22] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 673.045633][ T22] usb 5-1: config 0 has no interface number 0 [ 673.062761][ T22] usb 5-1: config 0 interface 184 has no altsetting 0 [ 673.073376][ T4316] usb 4-1: Using ep0 maxpacket: 32 [ 673.081976][ T4316] usb 4-1: config 32 has an invalid interface number: 85 but max is 0 [ 673.091009][ T4316] usb 4-1: config 32 has no interface number 0 [ 673.097354][ T22] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 673.106757][ T4316] usb 4-1: config 32 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 673.117266][ T22] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 673.126078][ T4316] usb 4-1: config 32 interface 85 has no altsetting 0 [ 673.144627][ T4316] usb 4-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 673.151049][ T22] usb 5-1: Product: syz [ 673.158039][ T4316] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 673.166269][ T22] usb 5-1: Manufacturer: syz [ 673.166291][ T22] usb 5-1: SerialNumber: syz [ 673.176298][ T4316] usb 4-1: Product: syz [ 673.180562][ T4316] usb 4-1: Manufacturer: syz [ 673.185569][ T4316] usb 4-1: SerialNumber: syz [ 673.200753][ T22] usb 5-1: config 0 descriptor?? [ 673.226930][ T22] smsc75xx v1.0.0 [ 673.827183][ T22] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -61 [ 673.844228][ T22] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 673.956295][ T4316] appletouch 4-1:32.85: Geyser mode initialized. [ 674.041300][ T22] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 674.095922][ T4316] input: appletouch as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:32.85/input/input8 [ 674.110742][ C0] appletouch 4-1:32.85: appletouch: OVERFLOW with data length 64, actual length is 64 [ 674.696779][ T22] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -32 [ 674.850376][ T22] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 674.907952][ T22] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 674.936867][ T22] smsc75xx: probe of 5-1:0.184 failed with error -32 [ 675.482522][T10635] netlink: 'syz.0.1936': attribute type 4 has an invalid length. [ 676.139051][ T125] usb 4-1: USB disconnect, device number 28 [ 676.139066][ C0] appletouch 4-1:32.85: atp_complete: usb_submit_urb failed with result -19 [ 676.149724][ T22] usb 5-1: USB disconnect, device number 30 [ 676.328097][ T125] appletouch 4-1:32.85: input: appletouch disconnected [ 677.246346][T10657] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 677.246346][T10657] program syz.3.1939 not setting count and/or reply_len properly [ 679.886780][ T5826] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 680.793431][ T5826] usb 1-1: Using ep0 maxpacket: 32 [ 680.891673][ T5826] usb 1-1: config 32 has an invalid interface number: 85 but max is 0 [ 680.933427][ T5826] usb 1-1: config 32 has no interface number 0 [ 680.939677][ T5826] usb 1-1: config 32 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 680.967178][ T5826] usb 1-1: config 32 interface 85 has no altsetting 0 [ 681.003955][ T5826] usb 1-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 681.027423][ T5826] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 681.036547][ T5826] usb 1-1: Product: syz [ 681.040934][ T5826] usb 1-1: Manufacturer: syz [ 681.045769][ T5826] usb 1-1: SerialNumber: syz [ 681.833875][ T5826] appletouch 1-1:32.85: Geyser mode initialized. [ 681.855260][T10709] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 681.855260][T10709] program syz.2.1956 not setting count and/or reply_len properly [ 681.874050][ T5826] input: appletouch as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:32.85/input/input9 [ 681.886361][ C0] appletouch 1-1:32.85: appletouch: OVERFLOW with data length 64, actual length is 64 [ 682.101383][ T6758] usb 1-1: USB disconnect, device number 23 [ 682.140460][ T6758] appletouch 1-1:32.85: input: appletouch disconnected [ 682.887628][T10720] PKCS7: Unknown OID: [4] 2.19.13055.1334505.0.0.0.0 [ 683.237644][T10720] PKCS7: Only support pkcs7_signedData type [ 684.746368][T10758] device syzkaller0 entered promiscuous mode [ 685.035471][ T4316] usb 4-1: new full-speed USB device number 29 using dummy_hcd [ 685.235172][ T4316] usb 4-1: config index 0 descriptor too short (expected 35577, got 27) [ 685.256553][ T4316] usb 4-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 685.302573][ T4316] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 685.342792][ T4316] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 685.368126][ T4316] usb 4-1: config 1 has no interface number 0 [ 685.379974][ T4316] usb 4-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 685.390269][ T4316] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 685.450426][ T4316] snd_usb_pod 4-1:1.1: Line 6 Pocket POD found [ 685.897747][ T1273] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.904793][ T1273] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.410194][ T4316] snd_usb_pod 4-1:1.1: set_interface failed [ 686.420639][ T4316] snd_usb_pod 4-1:1.1: Line 6 Pocket POD now disconnected [ 686.456624][ T4316] snd_usb_pod: probe of 4-1:1.1 failed with error -71 [ 686.511164][ T4316] usb 4-1: USB disconnect, device number 29 [ 686.715388][T10794] PKCS7: Unknown OID: [4] 2.19.13055.1334505.0.0.0.0 [ 686.750610][T10794] PKCS7: Only support pkcs7_signedData type [ 689.443477][ T5826] usb 1-1: new full-speed USB device number 24 using dummy_hcd [ 689.638021][ T5826] usb 1-1: config index 0 descriptor too short (expected 35577, got 27) [ 689.651142][T10862] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2011'. [ 689.663399][ T5826] usb 1-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 689.689449][ T5826] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 689.710304][ T5826] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 689.745550][ T5826] usb 1-1: config 1 has no interface number 0 [ 689.761919][ T5826] usb 1-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 689.789556][ T5826] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 690.001415][ T5826] snd_usb_pod 1-1:1.1: Line 6 Pocket POD found [ 690.884070][ T5826] snd_usb_pod 1-1:1.1: set_interface failed [ 690.891275][ T5826] snd_usb_pod 1-1:1.1: Line 6 Pocket POD now disconnected [ 690.898991][ T5826] snd_usb_pod: probe of 1-1:1.1 failed with error -71 [ 690.907352][ T5826] usb 1-1: USB disconnect, device number 24 [ 691.111623][T10882] tmpfs: Unknown parameter 'usrquota' [ 694.253471][ T125] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 694.453545][ T125] usb 1-1: Using ep0 maxpacket: 32 [ 694.460746][ T125] usb 1-1: config 0 has an invalid interface number: 184 but max is 0 [ 694.474688][ T125] usb 1-1: config 0 has no interface number 0 [ 694.480863][ T125] usb 1-1: config 0 interface 184 has no altsetting 0 [ 694.506240][ T125] usb 1-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 694.537915][ T125] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 694.556645][ T125] usb 1-1: Product: syz [ 694.560893][ T125] usb 1-1: Manufacturer: syz [ 694.576875][ T125] usb 1-1: SerialNumber: syz [ 694.594415][ T125] usb 1-1: config 0 descriptor?? [ 694.611834][ T125] smsc75xx v1.0.0 [ 694.753454][ T26] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 694.943591][ T26] usb 5-1: Using ep0 maxpacket: 32 [ 694.954251][ T26] usb 5-1: config 0 has an invalid interface number: 89 but max is 0 [ 694.969849][ T26] usb 5-1: config 0 has no interface number 0 [ 694.993821][ T26] usb 5-1: config 0 interface 89 has no altsetting 0 [ 695.021354][ T26] usb 5-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 695.053607][ T26] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 695.063569][ T22] usb 3-1: new full-speed USB device number 24 using dummy_hcd [ 695.088442][ T26] usb 5-1: Product: syz [ 695.103437][ T26] usb 5-1: Manufacturer: syz [ 695.108190][ T26] usb 5-1: SerialNumber: syz [ 695.171319][ T26] usb 5-1: config 0 descriptor?? [ 695.188654][T10932] tmpfs: Unknown parameter 'usrquota' [ 695.285167][ T22] usb 3-1: config index 0 descriptor too short (expected 35577, got 27) [ 695.319403][ T22] usb 3-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 695.342188][ T26] em28xx 5-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 695.394014][ T22] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 695.414913][ T26] em28xx 5-1:0.89: Video interface 89 found: bulk [ 695.496700][ T22] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 695.550865][ T22] usb 3-1: config 1 has no interface number 0 [ 695.597099][ T22] usb 3-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 695.632794][ T125] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 695.675895][ T22] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 695.675949][ T125] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 695.698571][ T125] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 695.750621][ T125] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 695.799586][ T125] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 695.823418][ T125] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 695.835672][ T22] snd_usb_pod 3-1:1.1: Line 6 Pocket POD found [ 695.861643][ T125] smsc75xx: probe of 1-1:0.184 failed with error -71 [ 695.916934][ T125] usb 1-1: USB disconnect, device number 25 [ 695.948821][ T26] em28xx 5-1:0.89: unknown em28xx chip ID (0) [ 696.993210][ T26] em28xx 5-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 697.021068][ T26] em28xx 5-1:0.89: board has no eeprom [ 697.103405][ T26] em28xx 5-1:0.89: Identified as Terratec Grabby (card=67) [ 697.115532][ T26] em28xx 5-1:0.89: analog set to bulk mode. [ 697.130799][ T4317] em28xx 5-1:0.89: Registering V4L2 extension [ 697.150457][ T26] usb 5-1: USB disconnect, device number 31 [ 697.244111][ T26] em28xx 5-1:0.89: Disconnecting em28xx [ 697.429891][ T4317] em28xx 5-1:0.89: Config register raw data: 0xffffffed [ 697.442130][ T4317] em28xx 5-1:0.89: AC97 chip type couldn't be determined [ 697.475130][ T4317] em28xx 5-1:0.89: No AC97 audio processor [ 697.650217][ T4317] usb 5-1: Decoder not found [ 697.681286][ T4317] em28xx 5-1:0.89: failed to create media graph [ 697.731228][ T4317] em28xx 5-1:0.89: V4L2 device video103 deregistered [ 697.782630][T10958] ================================================================== [ 697.790744][T10958] BUG: KASAN: use-after-free in v4l2_fh_open+0xc6/0x430 [ 697.797840][T10958] Read of size 8 at addr ffff88807529c738 by task v4l_id/10958 [ 697.805671][T10958] [ 697.808078][T10958] CPU: 1 PID: 10958 Comm: v4l_id Not tainted syzkaller #0 [ 697.815295][T10958] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 697.825379][T10958] Call Trace: [ 697.828780][T10958] [ 697.831729][T10958] dump_stack_lvl+0x188/0x24e [ 697.836439][T10958] ? __lock_acquire+0x7d10/0x7d10 [ 697.841521][T10958] ? show_regs_print_info+0x12/0x12 [ 697.846829][T10958] ? load_image+0x400/0x400 [ 697.851523][T10958] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 697.858754][T10958] ? __virt_addr_valid+0x188/0x540 [ 697.864029][T10958] ? __virt_addr_valid+0x465/0x540 [ 697.869245][T10958] ? v4l2_fh_open+0xc6/0x430 [ 697.873858][T10958] print_report+0xa8/0x210 [ 697.878460][T10958] kasan_report+0x10b/0x140 [ 697.882994][T10958] ? v4l2_fh_open+0xc6/0x430 [ 697.887587][T10958] v4l2_fh_open+0xc6/0x430 [ 697.892007][T10958] em28xx_v4l2_open+0x152/0x990 [ 697.896844][T10958] ? __lock_acquire+0x7d10/0x7d10 [ 697.901874][T10958] v4l2_open+0x20b/0x360 [ 697.906116][T10958] chrdev_open+0x5c5/0x6a0 [ 697.910623][T10958] ? cd_forget+0x160/0x160 [ 697.915063][T10958] ? fsnotify_perm+0x39b/0x550 [ 697.920039][T10958] ? cd_forget+0x160/0x160 [ 697.924473][T10958] do_dentry_open+0x7e9/0x10d0 [ 697.929238][T10958] path_openat+0x2635/0x2ee0 [ 697.933918][T10958] ? verify_lock_unused+0x140/0x140 [ 697.939110][T10958] ? do_syscall_64+0x4c/0xa0 [ 697.943700][T10958] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 697.949858][T10958] ? do_filp_open+0x430/0x430 [ 697.954529][T10958] do_filp_open+0x1f1/0x430 [ 697.959041][T10958] ? vfs_tmpfile+0x480/0x480 [ 697.963649][T10958] ? _raw_spin_unlock+0x24/0x40 [ 697.968505][T10958] ? alloc_fd+0x58f/0x630 [ 697.972887][T10958] do_sys_openat2+0x150/0x4b0 [ 697.977561][T10958] ? up_read+0x20/0x20 [ 697.981622][T10958] ? do_faccessat+0x73f/0xa10 [ 697.986388][T10958] ? kmem_cache_free+0xf7/0x290 [ 697.991430][T10958] ? do_sys_open+0xe0/0xe0 [ 697.995865][T10958] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 698.001942][T10958] ? lock_chain_count+0x20/0x20 [ 698.006790][T10958] __x64_sys_openat+0x135/0x160 [ 698.011758][T10958] do_syscall_64+0x4c/0xa0 [ 698.016444][T10958] ? clear_bhb_loop+0x60/0xb0 [ 698.021220][T10958] ? clear_bhb_loop+0x60/0xb0 [ 698.025977][T10958] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 698.031870][T10958] RIP: 0033:0x7fa2c76a7407 [ 698.036302][T10958] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 698.055993][T10958] RSP: 002b:00007fff1b4ab580 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 698.064661][T10958] RAX: ffffffffffffffda RBX: 00007fa2c7de7880 RCX: 00007fa2c76a7407 [ 698.072634][T10958] RDX: 0000000000000000 RSI: 00007fff1b4acf1c RDI: ffffffffffffff9c [ 698.080600][T10958] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 698.088572][T10958] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 698.096615][T10958] R13: 00007fff1b4ab7d0 R14: 00007fa2c7f46000 R15: 000055badf2b84d8 [ 698.104601][T10958] [ 698.107623][T10958] [ 698.109954][T10958] Allocated by task 4317: [ 698.114301][T10958] kasan_set_track+0x4b/0x70 [ 698.118898][T10958] __kasan_kmalloc+0x8e/0xa0 [ 698.123494][T10958] em28xx_v4l2_init+0x107/0x2e70 [ 698.128645][T10958] em28xx_init_extension+0x118/0x1b0 [ 698.134025][T10958] process_one_work+0x8a2/0x1160 [ 698.138960][T10958] worker_thread+0xaa2/0x1270 [ 698.143627][T10958] kthread+0x29d/0x330 [ 698.147683][T10958] ret_from_fork+0x1f/0x30 [ 698.152091][T10958] [ 698.154454][T10958] Freed by task 4317: [ 698.158417][T10958] kasan_set_track+0x4b/0x70 [ 698.162998][T10958] kasan_save_free_info+0x2d/0x50 [ 698.168016][T10958] ____kasan_slab_free+0x126/0x1e0 [ 698.173127][T10958] slab_free_freelist_hook+0x131/0x1a0 [ 698.178666][T10958] __kmem_cache_free+0xb6/0x1f0 [ 698.183514][T10958] em28xx_v4l2_init+0x166c/0x2e70 [ 698.188527][T10958] em28xx_init_extension+0x118/0x1b0 [ 698.193806][T10958] process_one_work+0x8a2/0x1160 [ 698.198831][T10958] worker_thread+0xaa2/0x1270 [ 698.203498][T10958] kthread+0x29d/0x330 [ 698.207561][T10958] ret_from_fork+0x1f/0x30 [ 698.211969][T10958] [ 698.214376][T10958] The buggy address belongs to the object at ffff88807529c000 [ 698.214376][T10958] which belongs to the cache kmalloc-8k of size 8192 [ 698.228518][T10958] The buggy address is located 1848 bytes inside of [ 698.228518][T10958] 8192-byte region [ffff88807529c000, ffff88807529e000) [ 698.243348][T10958] [ 698.245757][T10958] The buggy address belongs to the physical page: [ 698.252171][T10958] page:ffffea0001d4a600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x75298 [ 698.262415][T10958] head:ffffea0001d4a600 order:3 compound_mapcount:0 compound_pincount:0 [ 698.270768][T10958] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 698.278780][T10958] raw: 00fff00000010200 dead000000000100 dead000000000122 ffff888017442280 [ 698.287447][T10958] raw: 0000000000000000 0000000080020002 00000001ffffffff 0000000000000000 [ 698.296025][T10958] page dumped because: kasan: bad access detected [ 698.302524][T10958] page_owner tracks the page as allocated [ 698.308221][T10958] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d28c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 10257, tgid 10256 (syz.4.1816), ts 637724263988, free_ts 613839258295 [ 698.332696][T10958] post_alloc_hook+0x173/0x1a0 [ 698.337458][T10958] get_page_from_freelist+0x1a1e/0x1ab0 [ 698.343086][T10958] __alloc_pages+0x1ec/0x4f0 [ 698.347756][T10958] alloc_slab_page+0x5d/0x160 [ 698.352429][T10958] new_slab+0x87/0x2c0 [ 698.356502][T10958] ___slab_alloc+0xbc6/0x1240 [ 698.361176][T10958] __kmem_cache_alloc_node+0x1a0/0x260 [ 698.366630][T10958] __kmalloc_node_track_caller+0x9e/0x230 [ 698.372349][T10958] __alloc_skb+0x22a/0x7e0 [ 698.376759][T10958] netlink_dump+0x1a5/0xd00 [ 698.381347][T10958] netlink_recvmsg+0x68f/0xe00 [ 698.386103][T10958] ____sys_recvmsg+0x2cb/0x5e0 [ 698.390864][T10958] ___sys_recvmsg+0x212/0x590 [ 698.395537][T10958] do_recvmmsg+0x393/0x870 [ 698.399985][T10958] __x64_sys_recvmmsg+0x1b4/0x250 [ 698.405793][T10958] do_syscall_64+0x4c/0xa0 [ 698.410204][T10958] page last free stack trace: [ 698.414940][T10958] free_unref_page_prepare+0x8b4/0x9a0 [ 698.420396][T10958] free_unref_page+0x2e/0x3f0 [ 698.425065][T10958] __unfreeze_partials+0x1a5/0x200 [ 698.430171][T10958] put_cpu_partial+0x17c/0x250 [ 698.434929][T10958] qlist_free_all+0x76/0xe0 [ 698.439422][T10958] kasan_quarantine_reduce+0x144/0x160 [ 698.444868][T10958] __kasan_slab_alloc+0x1e/0x80 [ 698.449710][T10958] slab_post_alloc_hook+0x4b/0x480 [ 698.454995][T10958] kmem_cache_alloc+0x123/0x2f0 [ 698.459836][T10958] getname_flags+0xb7/0x500 [ 698.464332][T10958] user_path_at_empty+0x28/0x60 [ 698.469436][T10958] __x64_sys_umount+0xf9/0x170 [ 698.474199][T10958] do_syscall_64+0x4c/0xa0 [ 698.478694][T10958] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 698.484671][T10958] [ 698.486981][T10958] Memory state around the buggy address: [ 698.492599][T10958] ffff88807529c600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 698.500656][T10958] ffff88807529c680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 698.508725][T10958] >ffff88807529c700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 698.516807][T10958] ^ [ 698.522683][T10958] ffff88807529c780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 698.530917][T10958] ffff88807529c800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 698.539225][T10958] ================================================================== [ 698.559489][ T4317] em28xx 5-1:0.89: Registering snapshot button... [ 698.615303][T10958] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 698.622549][T10958] CPU: 0 PID: 10958 Comm: v4l_id Not tainted syzkaller #0 [ 698.629761][T10958] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 698.633839][ T4317] input: em28xx snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.89/input/input11 [ 698.650320][T10958] Call Trace: [ 698.653612][T10958] [ 698.656644][T10958] dump_stack_lvl+0x188/0x24e [ 698.661348][T10958] ? memcpy+0x3c/0x60 [ 698.663738][ T4317] em28xx 5-1:0.89: Remote control support is not available for this card. [ 698.664100][ T26] em28xx 5-1:0.89: Closing input extension [ 698.665659][ T26] em28xx 5-1:0.89: Deregistering snapshot button [ 698.686397][T10958] ? show_regs_print_info+0x12/0x12 [ 698.691726][T10958] ? load_image+0x400/0x400 [ 698.697028][T10958] panic+0x2e5/0x730 [ 698.701292][T10958] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 698.707477][T10958] ? bpf_jit_dump+0xd0/0xd0 [ 698.712092][T10958] ? _raw_spin_unlock_irqrestore+0x10d/0x120 [ 698.718476][T10958] ? _raw_spin_unlock+0x40/0x40 [ 698.723354][T10958] check_panic_on_warn+0x80/0xa0 [ 698.728317][T10958] ? v4l2_fh_open+0xc6/0x430 [ 698.733113][T10958] end_report+0x66/0x110 [ 698.737385][T10958] kasan_report+0x118/0x140 [ 698.742002][T10958] ? v4l2_fh_open+0xc6/0x430 [ 698.746624][T10958] v4l2_fh_open+0xc6/0x430 [ 698.751075][T10958] em28xx_v4l2_open+0x152/0x990 [ 698.755947][T10958] ? __lock_acquire+0x7d10/0x7d10 [ 698.761264][T10958] v4l2_open+0x20b/0x360 [ 698.765705][T10958] chrdev_open+0x5c5/0x6a0 [ 698.770166][T10958] ? cd_forget+0x160/0x160 [ 698.775688][T10958] ? fsnotify_perm+0x39b/0x550 [ 698.780485][T10958] ? cd_forget+0x160/0x160 [ 698.784929][T10958] do_dentry_open+0x7e9/0x10d0 [ 698.789718][T10958] path_openat+0x2635/0x2ee0 [ 698.794332][T10958] ? verify_lock_unused+0x140/0x140 [ 698.799557][T10958] ? do_syscall_64+0x4c/0xa0 [ 698.804176][T10958] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 698.810276][T10958] ? do_filp_open+0x430/0x430 [ 698.814983][T10958] do_filp_open+0x1f1/0x430 [ 698.819507][T10958] ? vfs_tmpfile+0x480/0x480 [ 698.824138][T10958] ? _raw_spin_unlock+0x24/0x40 [ 698.829222][T10958] ? alloc_fd+0x58f/0x630 [ 698.833585][T10958] do_sys_openat2+0x150/0x4b0 [ 698.838436][T10958] ? up_read+0x20/0x20 [ 698.842526][T10958] ? do_faccessat+0x73f/0xa10 [ 698.847317][T10958] ? kmem_cache_free+0xf7/0x290 [ 698.852288][T10958] ? do_sys_open+0xe0/0xe0 [ 698.856823][T10958] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 698.862854][T10958] ? lock_chain_count+0x20/0x20 [ 698.867747][T10958] __x64_sys_openat+0x135/0x160 [ 698.872633][T10958] do_syscall_64+0x4c/0xa0 [ 698.877073][T10958] ? clear_bhb_loop+0x60/0xb0 [ 698.881782][T10958] ? clear_bhb_loop+0x60/0xb0 [ 698.886483][T10958] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 698.892405][T10958] RIP: 0033:0x7fa2c76a7407 [ 698.896976][T10958] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 698.916603][T10958] RSP: 002b:00007fff1b4ab580 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 698.925036][T10958] RAX: ffffffffffffffda RBX: 00007fa2c7de7880 RCX: 00007fa2c76a7407 [ 698.933120][T10958] RDX: 0000000000000000 RSI: 00007fff1b4acf1c RDI: ffffffffffffff9c [ 698.941113][T10958] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 698.949118][T10958] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 698.957112][T10958] R13: 00007fff1b4ab7d0 R14: 00007fa2c7f46000 R15: 000055badf2b84d8 [ 698.965206][T10958] [ 698.968614][T10958] Kernel Offset: disabled [ 698.972934][T10958] Rebooting in 86400 seconds..