last executing test programs: 829.966504ms ago: executing program 0 (id=1924): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = userfaultfd(0x80800) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x60}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f00000000c0)={&(0x7f00002b9000/0x400000)=nil, &(0x7f0000045000/0x4000)=nil, 0x400000, 0x1, 0x2}) 823.919087ms ago: executing program 3 (id=1925): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000002080)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe) 771.793848ms ago: executing program 0 (id=1926): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x2d}}, 0x10) sendmmsg$inet(r0, &(0x7f0000000e80)=[{{&(0x7f0000000100)={0x2, 0x4e26, @multicast1}, 0x10, 0x0}}], 0x1, 0x40080a0) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000080)=0x3, 0x4) sendmmsg$inet(r0, &(0x7f0000001a40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40012) 771.572647ms ago: executing program 0 (id=1927): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="ac00000000010505000000faff0000000a0000003c0002802c00018014000300ff01000000000000000000000000000114000400ff02000000000000009d0000000000010c00028005000100000000003c0001800c00028005000100000000002c00018014000300ff0200000000000000000000000000011400040000000000000000000000ffffac1e00010800074000000001180006801400040000000000000000000000000000000001"], 0xac}}, 0x0) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="c00000000001050500000000000000000a0000003c0002802c00018014000300ff01000000000000000000000000000114000400000000000000000000000000000000010c00028005000100000000003c0001800c00028005000100000000002c00018014000300ff0200000000000000000000000000011400040000000000000000000000ffffffffffff080007400000000d2c0006c0"], 0xc0}}, 0x0) 771.473352ms ago: executing program 3 (id=1928): bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x1, 0x2, 0x4, 0x9}, 0x50) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x3, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)="180c4552", 0x4) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000400)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x800000000000208, 0x0, 0x0, 0x2, 0xc, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100000000020000ffffffffff00", "2809e8dbe108598948224ad54afac11d875397bd3c5240f45f819e01177d2d458dd4992861ac00", "90be8b1c55080000000c547d03d8a0f4bd00", [0x0, 0x6]}}) 684.29528ms ago: executing program 0 (id=1929): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='0x0104\n', 0x7) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/bcdUSB\x00', 0x1, 0x0) write(r2, 0x0, 0x0) write(r0, &(0x7f0000000b40), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x1, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/strings/0x409/product\x00', 0x1, 0x0) write(r3, &(0x7f0000000480), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x1, 0x0) write(r4, &(0x7f0000000840)='8\n', 0x2) 683.883198ms ago: executing program 3 (id=1931): r0 = syz_clone(0x100000, 0x0, 0x0, 0x0, 0x0, 0x0) get_robust_list(r0, 0x0, 0x0) 628.069246ms ago: executing program 0 (id=1933): semget(0x3, 0x3, 0x2b0) semget(0x3, 0x4, 0x486) 592.352985ms ago: executing program 0 (id=1935): timerfd_create(0x0, 0x0) syz_usb_connect$uac1(0x2, 0x72, &(0x7f0000001a80)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x20, 0x9e8, 0x21, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x60, 0x3, 0x1, 0xa, 0x50, 0x41, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x63df, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0x80, 0x7, 0x7, {0x7, 0x25, 0x1, 0x0, 0x7f, 0x9}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x24, 0x8, 0x5, {0x7, 0x25, 0x1, 0x8, 0xf7, 0x7}}}}}}}}]}}, &(0x7f0000001e00)={0x0, 0x0, 0x0, 0x0}) 582.616306ms ago: executing program 3 (id=1936): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000011540)=ANY=[@ANYBLOB="bf16000000000000b7070000000100004070000000800000500000000000000095000000000000002ba728041598fbd30cb599e83d24a3aa81d36bb3019c13bd23212fb56fa54f2641d8b02c3815e79c1414eb07eae6f0711e6bd917487960717142fa9ea4318123f602000000000080de89e661168c1886d0d4dd4f204e345c65c26e278ef5b915395b19284a1a4bc72fbc1626e3a2a2ad358061d0ae0209e62f51ee988e6ea604ce974a22a550d6f97080980400003e05df3ceb9f1feae5737ecaa80a666963c474c2a100c788b277beee1cbf9b0a4d3881dcc7b1b85f3c3d44aeaccd3641110bec4e90a6341965c39e4b3431abe802f5ab3e89cf6c662ed4048d3b3e22278d00ce00000000d3a02762c2951257b85802189d74005d2a1bcf9436e192e23fd255985bf31b714f000bcab6fcd610f25f5888000000003f11afc9bd08c6ebfbb89432fb465bc52f49129b9b6150e320c9901de2ebb9000000018e3095c4c5c7a156cec33a667dccaff950ca1e5efdd4c968dacf81baa3a509b1041d06f6b0097c430481824a3f4fddd3c643f630ba175d876defd3541772f26e27c44cfdb2d85d6d29983e830a9cdd79837b3468e8c67a571d0a017c100344c52a6f387a1340bdc8889464f90cc4cd1f570dd39877dfb2ff1ae66e1ce917474b2e650ae630afd014a337ac5d58bcb5e51723257c872c5255f20100000000000000f041b665ab21372c8d8b7bac5b5c784d20a4a24d8dbd75062e1daef9dead619cc6e7baa72707157791c3d2a286ffb8d35452bb5d36c2a8682bf7ecbd53f950ef4709ec01e230d2f53594ef4839c6130c4c13a0cca84b9935f771fd49e480cd9d48aeb12b1d6acabd38a817bcd222614d1f62734d679039a97d2b74f9e8e997ccd314000f7477137f4e8e7025123e783df8b8a17e3aa9fe1f662aef87a065b03cfb65b4dfe4f1b56e1f23128d743753a1de172d683d5892ce9414a1d98ea93e3d35dbb6c23b90cf36e83b8a434a97d09343d7f83079ccb02e69c584146056d125cfa788237874dd42dae334bda042819a2aa24dba1c25be2794448b4f63483026b5e34d44705b76ef29241adab0dd7d68bf975e02069f6f2425e1bc97a3d588085f16bef63a06578d4f5de7bfb6aaa75f16996d536256c02284cb1d3a6fb8cae87691fae365a70c3fc69e1565bba8dd8a8c7049f798abe646f738bebd69413afc9d8a5edd7aaa000000000000001e6c2f2a287c5278a218dbfaffffff00a14db5cfa6819eb1d39c48cfdc80d215c9e16e0c4736c819363154cca4e2f89800d18c89d7f46f679df6c9e2952ae1ebfd0ca88368ee6ce139e8b5822c22cf2e9dde943d34c432e1001171792c65986146666a5490928441f47e0fe5eac41824ca1fd0eb71aa243c88d5480efd8329d9a733d8f9ffffff5f912ac4e34bf6ea8a86da707b03bddb491ba0cc98f6be92c50008a2b50025419d1476c73132ca7ca26ce8a7e3ffb700f09e157f9b844051f1a642aca9ff98c9036471ccff0522903e7bcf62e18f7696bbc280b95e8e0d6fd5644b0ebde3a95b06548862de809d3dae3cccf109f7c78e8479a345e800000000000000000000009455bf417627ce723a5d9103706aba69239500bb82f6b5a3ddc0bd9856712945b70c75ce5b722578820820d010d7a3cffc99fc647d0b82ef26ab708c0b19ed144be51c3b398f0e6bb7a30006000000cba12953d58cff0f0378740fe6662f377b97d8e7cdb047acd083d3cd3856476a60a49ad127ba6570bafc2bbcf9ee721fd9cb467ff071e5604fbf0491245c0000007d932d7a64de4c4aa433fc0840aff7c47da3a4c6966d0000000000000000f6bfbae29e8a6e2a889f6ef6869d82d6bd73eb76b65c7a35a54a4a6b8ad4600e3a972a0bb5971a5f16590b0a03dafa3fd1118765cc8ab9fccf3b51c41a339f200f2fa33006910a679a9ae0187b4d750c4bd244cb0cbfd23b265f4d4da448a7a0d19c5e43eae50a31609dfa2dde267551467eb6475293dd7012cc449009981f22820e57a0eff234ccfe21d7a2302e000669753d3c3432cc14ee1abe724adb6b5431befedd3e22971118f0e21aed1823cb7dde8212a8531bd9691dd4cc6a370e9eb56b3d790b98f2bd0db1e5de6a146597b2cbb7103040d2a39d7965d34df524b760ab92efcce7dd1574052c735935bf6a752c015c7f5ffee9ff66e5dd2866b15b6e0d17618cb1f5c1ee4b05ebf1445ea110f499f840a5c965443d725556351ee25fe09f69494b053678dcadcf02e063dff2fa4bef1ac3bbbebe6c74d71ec3b23e29895eff1d1017024fe3e8cc759b05785adc346b7ffd05963f92c1d0d7d90ba878ad89e490f3e29ac51d30632869a534418f916bf6fe8167827a8e6c8f8b391c822805cb0adf1b8bd6947ff208753eb0d208ce14f7b206b2e02c21e963abc5ceb735c1b3c46b0a843de52a903375dfb663a8d8ee9c2b2705c1a81d9d3b9656b219c8cd99c9cafcd0d0540884d97aecb19983fc6af29ab44a82aff9cba921192c665b877af6539bdb1b567f481ba07982e7ad758f4e1eac69e7e88a63960975f490e161e371ec8534791e3b61c685d900a9c0839208356b53750e76fcc3c2d1bddcbd83897921414d0c02e8188f3df79ea2a5c5444004830e6cb227ca1bdafb977c00000000003a417193b8c5d793687335a930867094fd6a78218218e04b705ec62f1608cb569b81914e68f175b392af6bc4fd2121d7fd276af2c97a441b56e7a0687d98b8e76d8d0d231e4fe00be1de76bd19cc12e2bd938eb681ed6bc951c1b4f7c51af59eea4d40c6000000000200778a677b72786311153271a3313da02645e11761699e4d04ac86dd14ff7b9a10d3fa74696fe3953a5b7706bf5d1faba4b18808d9cb0e9db696dec4e0820ee4028d7225a2c9c427cf64cbde6fba056b2006b7a37c1181070000005e235cd302f3b4071ee5237ada986b9e5e3144bf479f277f10656ad3744037ccc9c63685a6f1109d2ea73773d3635f61497f1fa1ea4a16f601800bf3e59141fbf05a96113320c445f9ba8504000000000000004fbd99ccefb7c09269dd2c5c25e56e169ac15980f3f85f7ca36dd5950ef5b64fd46f123311829534a82940994199b3cf7a8fabea9930952f5da9b909c1946e55289f668c423fcbb31ae91864c882313151741a67538c9689dc8ecc9903c7041e5c0704e2fa55a756487517a7445cbd9e3f5175e41c00000000000000000000000000bf98efd587fffe326f474b0b089c017b16c0062cbce96f5adebec52a79f9363909842f79c50a1520be46d87003137e4c5031f00123e812a5e37cd52c9eb7336281cb8c6ce9934b157d7875a70eaf103cb3d99e3568c51cd1eab8a26b232ac46bf0ab829c26dab637538b2eb1420d812d2b80c777710ba0f18e4661681aa218d9ba54023ab4305d77eb15611ae2545835e9d30e9f6d4fb43a291c69545a1eea0f8720431132d89f99bf6c5cb060da70cbb59d0a000000000034d083fc37d2449f72de0cbea4bc1dc89c136cdbc504f849d5502d77a95c7bfff4cd9c03058d0d4d07ea64824f1acf2b39389f675f39d01719cdbab3f1ce10609c8d7b3e37cb99b41da5e485a441b6a103549f55ab09dc98767763d1f2fafd45bb7d2b40050d1f8292f4d9ec6d0000000000003932062290c7536fdd55b06023437e9e2072daf7f5d82f6f1b5b89a41134f4dc2e65bb11272fdf8c8141f41d6160b3d8b6ecd16d14267f61b4881adee7f07f3d6af5ae79e16fe2c3f55ac7a6392d2e1d9b4286b6c3e1f5a76b85ed6e1f0000c67e6c5fcdc8c39381be4799b8cb2d08b8262c807dd755e22b801162381aa9d1af2bbc9cfd497585337eac408b8475b47a392a10cae349160f128e5f873a58064eb400c36a90624f6aed398a215e9ce64522ab249f67c38a656d32ecff5cdb2b039c4abf349d2c0f88a42e9189bbfa7f5cf35b6e7ef8f9d33163b7ea87550fb1ba334c83e3aec4714c9c4ca3ecb04f2720237615a28bf310b58ffa2a103216fdcc8c2d8f5d55e5e7ebf147105272aaae56e86d856b3cf79a3f7306436762dd1a08ce873e07cebc7892ec6f9f696da38feed3dc0001500e34adae1ba89a32bad2af9030f840f1ba4664f35547cdadd5cbacc59352c290f55d971b65953533668c25f21d8d62d849e9058eaa97c63491568887548f668cdbca2abf01a361a0b64d8b523e669da350e3ec7445dfbf366b0b3bc5e76824a1e43eaaeca70db90f2fa39596443447671933079a24fe3681ad9ac361f71ac279a688f10a1cc4df1112105edebc5e3bbc394c8305ab129ca2dfb9b7c5e9d097bd01b495cccefddce569117f7f5d6a6270ff0f0f4c371029ca8489571b55841bf3dd003bc81460fcfcbb616c2070237881afdb314cecd1623f3e55ab8b7627fa1be349145a8d6313cbc790eefe2020138e82fb9d351be4ddcbcc9bc048dd3db5828d16baec6e07a007f0030f34ea3cfd524d6fa1d45da5641d6c94e1d3ae7fba1c85035d2a60ef0a96e0d96aa1c60019f73ae0aa6113cd66ef26b5777337c26e1461405d86fdf091edd526f25cada439bb3609ed5c35ab60a539ade786bd6004d0ea3edbd6c4da0d8e8be8c771c8c8a0b07d9859e04adb18964dcce9bce546074c26dffbc2df372a016e8c845d4257000000000000000000000000000000000000f29657697d9c2b132b2dc2f5ea5122836582a7e85fe2bc166f17aefd9d861de0191f5277d4a3b5afb6f23d9eea2459f7844606e1202768d83c24cc791bde44a448022bbfa571fe029a7b2d5152639ee283894ab6168992ff0acc01b39a078f285ce615351f262019586eb9447bb3eaffd7b53d8f37ca6c5f1027dd5b7592996c8a7789ba108979cc9ad07ed86682843e2eaa855dd01443ee6ffde1811f10039d5d14458177096e15cc4d8f2582a1bea5cc98d992f3de7d1cdfb24384b9f10f615c87c441dc970ec896a5af6bf69b50a244bc138a1cae9868c3079bafe69769000000000000000000e99b63029d219cd3545a8426b56554a9f265d3557eefb3602894507c256cb8ee9ebadfecb6afeb84ba757bfa8d00a5af0dd6aa1e8144ef8ef04410d52204c335408941b8eccc5c734cc6a05247142ed647f89bcb5c043acfb382b9cc918bc3cdc368983157851cdf678800aa7eb2a6cbc12c7ae23bc88b8f10223ab2a093429f3f6965bc5af0114cf6f246bae0b04bec8e30b6772b8950f32e87beda060f9af2a0ccd4a8eab8e395ee3628eb976b7fff835e6c1bdc4a6e00acd0fe63ba8425b21845db903b38c80148e6aa497dbf0e2baf938d3ecbd433527602d89f10aca419ff54e47354194f75e343d4c75227448530b0d8d59b9f94a3fa0ca9210177926c58ef46dcd09e79c343d35aa954d12f89410c47ac29c881f8a6bda8dd40df0d1e5881338d2c5a01bf1ee6b28169fef18df13c759e767d3442ae6598106496f42b73074bb804e8763915c3e04400ad44e9f3130e904062d204d385c026722a094255db1572d66e7a4917bba2a0f6a1a57482cdb4070de8dd60fd65dacb9ec5003fb1cca05ce1c9f924cc2ec45e8d5adf7c89e3b0b8da35c1aa7fbbee6f839a8f05294a6c02281afb7601252611583408f1"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffe89}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000010000000000000000000000711206000000000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, @cgroup_sock_addr=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x19}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0), 0x48) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r0, &(0x7f0000000000), &(0x7f0000000040)=""/73}, 0x70) 531.841047ms ago: executing program 1 (id=1938): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x17, 0x0, 0x0, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x9}, 0x94) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x1c1842, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000100)={'syzkaller0\x00', 0x7101}) write$cgroup_devices(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="1e03372a8d3af3a987a04d4a828e0000000000335c19c4"], 0xffdd) 457.561125ms ago: executing program 3 (id=1939): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x1c1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4801}) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x0) 457.302024ms ago: executing program 1 (id=1941): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r0, 0xc004743e, 0x110c230000) ioctl$TUNSETOFFLOAD(r0, 0x40047451, 0xf0ff1f00000000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000024000000080000000b"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000240)={{r2, 0xffffffffffffffff}, &(0x7f0000000180), &(0x7f00000001c0)=r1}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000001ac0)={r3, &(0x7f0000000a00)='@', &(0x7f0000001a00)=""/156}, 0x20) 400.222586ms ago: executing program 3 (id=1943): syz_open_dev$sndpcmc(0x0, 0x0, 0x2) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448cb, 0x0) syz_emit_vhci(&(0x7f0000000000)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x0, 0x2, 0x4}}, 0x9) ioctl$TUNDETACHFILTER(0xffffffffffffffff, 0x401054d6, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bind$netlink(0xffffffffffffffff, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfd, 0x9ea8bb2a1f4897b}, 0xc) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) recvmmsg(r1, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}, 0xf29d}], 0x1a000, 0x40010102, 0x0) 400.022246ms ago: executing program 2 (id=1944): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="10000000040000000800000005"], 0x50) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x2, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000007996b9ac61108e000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0), 0x48) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r0, &(0x7f0000000000), &(0x7f0000000040)=""/73}, 0x70) 324.301217ms ago: executing program 1 (id=1945): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000002c0), 0x1) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000300)={0x1, 0x0, 0x0, 'queue1\x00'}) write$sndseq(r0, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000040)={0x3e3, @time={0x8}, 0xff, {0x0, 0x4}}) 324.133871ms ago: executing program 2 (id=1946): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000e00)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000000)={0x0, &(0x7f0000000100)}) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x2, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="1b"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) ioctl$SIOCSIFHWADDR(r0, 0x8946, &(0x7f0000000040)={'veth0_vlan\x00', @random='\x00\x00\x00\x00\x00 '}) 257.672801ms ago: executing program 1 (id=1947): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000400)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f00000006c0)="3b000000010001", 0x7) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000000)='7', 0x1) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0}, 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0600000004000000040000000001000000000000", @ANYRES32=0x0, @ANYBLOB="0000008000000000067c09ff000000fc0000000000000069000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000180)={r2, &(0x7f0000000140), 0x0}, 0x20) pselect6(0x0, 0x0, 0x0, &(0x7f00000003c0)={0x8, 0x9, 0x8001, 0x5, 0x0, 0x2, 0x6, 0x9}, &(0x7f0000000400), 0x0) 247.872893ms ago: executing program 1 (id=1948): close(0x3) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="02000000040000000400000001"], 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x1, 0x6, 0x8, 0x8, 0x40}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000010000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000000500000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f00000001c0)={r1, 0xffffffffffffffff, 0x60000000}, 0xc) 189.359421ms ago: executing program 2 (id=1949): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000780)={0x1, &(0x7f00000001c0)=[{0x15, 0x8, 0x0, 0x3}]}) 189.181855ms ago: executing program 1 (id=1950): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') setgroups(0x0, 0x0) mprotect(&(0x7f0000936000/0x2000)=nil, 0x2000, 0xa) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100), 0x28041, 0x0) write$dsp(r1, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) r2 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004057a213200100000000010902200001010080fa0904000002ff00000007"], 0x0) syz_usb_ep_write(r2, 0x81, 0xe, &(0x7f0000000200)="0e00000000000000000000020000") ioctl$SNDCTL_DSP_SYNC(r1, 0x5001, 0x0) ioctl$SNDCTL_DSP_STEREO(r1, 0xc0045003, &(0x7f0000000040)=0x1) read$FUSE(r0, &(0x7f0000001180)={0x2020}, 0x2020) 64.160937ms ago: executing program 2 (id=1951): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000750000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000e00000095"], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000007"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb7"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r0}, 0xc) 64.006222ms ago: executing program 2 (id=1952): mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x3) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000100)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000001c0), 0x12) 0s ago: executing program 2 (id=1953): syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_mr_vif\x00') mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x24}, 0x1, 0x0, 0x0, 0xc004}, 0x4000) sendmsg$NL80211_CMD_ABORT_SCAN(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000280)={0x20, 0x0, 0x800, 0x703d2b, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x7, 0x2c}}}}}, 0x20}}, 0xac95a87afeb8ee1e) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./trace/events/sched/sched_switch/trigger\x00', 0x302, 0x0) write(r0, 0x0, 0x0) 0s ago: executing program 2 (id=1954): recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfdef) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x6, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000fdffffde18000000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r0}, 0xc) kernel console output (not intermixed with test programs): 0 R15: 0000000000000000 [ 57.447453][ T6278] [ 57.510266][ T6282] netlink: 70 bytes leftover after parsing attributes in process `syz.1.127'. [ 57.875600][ T6293] netlink: 20 bytes leftover after parsing attributes in process `syz.3.123'. [ 57.879437][ T6292] ptrace attach of "/syz-executor exec"[5737] was attempted by "/syz-executor exec"[6292] [ 57.963484][ T6129] block nbd64: NBD_DISCONNECT [ 58.148511][ T6129] udevd[6129]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 59.972038][ T6320] netlink: 70 bytes leftover after parsing attributes in process `syz.1.137'. [ 60.302039][ T6324] can0: slcan on ttyS3. [ 60.386979][ T6324] can0 (unregistered): slcan off ttyS3. [ 61.970900][ T6357] Invalid ELF header type: 3 != 1 [ 61.972342][ T6357] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 61.981344][ T6357] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 62.813662][ T6376] netlink: 70 bytes leftover after parsing attributes in process `syz.3.158'. [ 63.290308][ T6385] binder: 6384:6385 ioctl c0306201 80000080 returned -14 [ 63.294793][ T6385] binder: 6384:6385 ioctl c0306201 800003c0 returned -14 [ 63.365232][ T6396] netlink: 70 bytes leftover after parsing attributes in process `syz.1.167'. [ 63.424308][ T6402] netlink: 4 bytes leftover after parsing attributes in process `syz.3.168'. [ 63.474839][ T6400] Zero length message leads to an empty skb [ 63.526702][ T6403] Invalid ELF header type: 3 != 1 [ 64.687647][ T6426] binder: 6424:6426 ioctl c0306201 80000080 returned -14 [ 64.699712][ T6426] binder: 6424:6426 ioctl c0306201 800003c0 returned -14 [ 64.839379][ T6430] netlink: 70 bytes leftover after parsing attributes in process `syz.2.177'. [ 65.155828][ T6441] Invalid ELF header type: 3 != 1 [ 65.157325][ T6441] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 65.166466][ T6441] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 65.404225][ T5742] Bluetooth: hci3: command 0x2016 tx timeout [ 66.206806][ T6466] netlink: 'syz.0.189': attribute type 1 has an invalid length. [ 66.222589][ T6466] 8021q: adding VLAN 0 to HW filter on device bond1 [ 66.269140][ T6466] bond1: (slave dummy0): Enslaving as a backup interface with an up link [ 66.326161][ T5817] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 66.402731][ T6478] binder: 6477:6478 ioctl c0306201 80000080 returned -14 [ 66.403618][ T6478] binder: BINDER_SET_CONTEXT_MGR already set [ 66.403625][ T6478] binder: 6477:6478 ioctl 4018620d 80004a80 returned -16 [ 66.403740][ T6478] binder: 6477:6478 ioctl c0306201 800003c0 returned -14 [ 66.435051][ T12] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 66.492891][ T6480] Invalid ELF header type: 3 != 1 [ 66.758672][ T6494] netlink: 4 bytes leftover after parsing attributes in process `syz.0.200'. [ 66.758738][ T6494] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 66.776169][ T6494] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 67.623761][ T6530] binder: 6527:6530 ioctl c0306201 800003c0 returned -14 [ 68.646888][ T6562] binder: 6560:6562 ioctl c0306201 800003c0 returned -14 [ 68.804271][ T50] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 68.974124][ T50] usb 5-1: Using ep0 maxpacket: 8 [ 68.974916][ T50] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 68.976474][ T50] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 68.976492][ T50] usb 5-1: config 0 has no interface number 0 [ 68.976520][ T50] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 68.976544][ T50] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 68.976561][ T50] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 68.976578][ T50] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 68.976606][ T50] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 68.984758][ T50] usb 5-1: config 0 descriptor?? [ 68.999688][ T50] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 69.242807][ T1478] usb 5-1: USB disconnect, device number 3 [ 69.242836][ C2] ldusb 5-1:0.55: usb_submit_urb failed (-19) [ 69.250226][ T1478] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 69.564840][ T5752] Bluetooth: hci3: command 0x2016 tx timeout [ 69.906027][ T6591] ALSA: mixer_oss: invalid OSS volume '' [ 69.906693][ T6591] ALSA: mixer_oss: invalid OSS volume '' [ 70.105824][ T6599] netlink: 'syz.0.241': attribute type 3 has an invalid length. [ 70.255188][ T6605] Driver unsupported XDP return value 0 on prog (id 14) dev N/A, expect packet loss! [ 70.574152][ T853] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 70.724139][ T853] usb 6-1: Using ep0 maxpacket: 8 [ 70.724634][ T853] usb 6-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 70.725416][ T853] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 70.725427][ T853] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 70.725446][ T853] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 100, changing to 10 [ 70.725460][ T853] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 24936, setting to 1024 [ 70.725478][ T853] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 70.728933][ T853] hub 6-1:1.0: bad descriptor, ignoring hub [ 70.728945][ T853] hub 6-1:1.0: probe with driver hub failed with error -5 [ 70.729227][ T853] cdc_wdm 6-1:1.0: skipping garbage [ 70.729234][ T853] cdc_wdm 6-1:1.0: skipping garbage [ 70.737661][ T853] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 70.737672][ T853] cdc_wdm 6-1:1.0: Unknown control protocol [ 70.850376][ T3378] cfg80211: failed to load regulatory.db [ 70.851134][ T1438] ieee802154 phy0 wpan0: encryption failed: -22 [ 70.851190][ T1438] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.045894][ T853] usb 6-1: USB disconnect, device number 4 [ 71.331799][ T6632] netlink: 'syz.3.257': attribute type 3 has an invalid length. [ 71.493903][ T6644] netlink: 70 bytes leftover after parsing attributes in process `syz.1.261'. [ 71.602783][ T6652] netlink: 'syz.2.266': attribute type 3 has an invalid length. [ 71.951222][ T6668] netlink: 8 bytes leftover after parsing attributes in process `syz.2.272'. [ 72.085917][ T6676] netlink: 12 bytes leftover after parsing attributes in process `syz.2.272'. [ 72.085942][ T6676] netlink: 20 bytes leftover after parsing attributes in process `syz.2.272'. [ 72.089314][ T6670] ALSA: mixer_oss: invalid OSS volume '' [ 72.305160][ T6685] vlan0: entered promiscuous mode [ 72.948167][ T6703] FAULT_INJECTION: forcing a failure. [ 72.948167][ T6703] name fail_futex, interval 1, probability 0, space 0, times 0 [ 72.948190][ T6703] CPU: 2 UID: 0 PID: 6703 Comm: syz.2.286 Not tainted syzkaller #0 PREEMPT(full) [ 72.948204][ T6703] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 72.948211][ T6703] Call Trace: [ 72.948215][ T6703] [ 72.948220][ T6703] dump_stack_lvl+0x100/0x190 [ 72.948240][ T6703] should_fail_ex.cold+0x5/0xa [ 72.948254][ T6703] get_futex_key+0x1d0/0x14f0 [ 72.948276][ T6703] ? __pfx_get_futex_key+0x10/0x10 [ 72.948293][ T6703] ? __pfx___resched_curr+0x10/0x10 [ 72.948314][ T6703] futex_wait_setup+0x91/0x540 [ 72.948332][ T6703] __futex_wait+0x19f/0x300 [ 72.948347][ T6703] ? __pfx___futex_wait+0x10/0x10 [ 72.948360][ T6703] ? __pfx_try_to_wake_up+0x10/0x10 [ 72.948376][ T6703] ? futex_hash+0x311/0x400 [ 72.948395][ T6703] ? __pfx_futex_wake_mark+0x10/0x10 [ 72.948412][ T6703] ? find_held_lock+0x2b/0x80 [ 72.948445][ T6703] ? futex_wake+0x4ea/0x5e0 [ 72.948464][ T6703] futex_wait+0xe6/0x370 [ 72.948479][ T6703] ? __pfx_futex_wait+0x10/0x10 [ 72.948497][ T6703] ? __pfx_do_fcntl+0x10/0x10 [ 72.948514][ T6703] ? __fget_files+0x215/0x3d0 [ 72.948531][ T6703] do_futex+0x265/0x440 [ 72.948544][ T6703] ? __pfx_do_futex+0x10/0x10 [ 72.948556][ T6703] ? fput+0x7c/0x100 [ 72.948572][ T6703] ? do_compat_fcntl64+0x232/0x720 [ 72.948591][ T6703] __ia32_sys_futex_time32+0x2f4/0x470 [ 72.948607][ T6703] ? fput+0x7c/0x100 [ 72.948624][ T6703] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 72.948637][ T6703] ? ksys_write+0x1ac/0x250 [ 72.948654][ T6703] __do_fast_syscall_32+0x13a/0x8b0 [ 72.948669][ T6703] do_fast_syscall_32+0x32/0x70 [ 72.948682][ T6703] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 72.948696][ T6703] RIP: 0023:0xf702efec [ 72.948709][ T6703] Code: Unable to access opcode bytes at 0xf702efc2. [ 72.948714][ T6703] RSP: 002b:00000000f541d5bc EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 72.948726][ T6703] RAX: ffffffffffffffda RBX: 00000000f7424f88 RCX: 0000000000000080 [ 72.948734][ T6703] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f7424f8c [ 72.948741][ T6703] RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 [ 72.948748][ T6703] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 72.948754][ T6703] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 72.948767][ T6703] [ 73.030599][ T6705] binder: 6704:6705 ioctl c0306201 80000080 returned -14 [ 73.034221][ T6705] binder: 6704:6705 ioctl c0306201 800003c0 returned -14 [ 73.078763][ T6707] netlink: 'syz.0.289': attribute type 3 has an invalid length. [ 73.148622][ T6711] FAULT_INJECTION: forcing a failure. [ 73.148622][ T6711] name failslab, interval 1, probability 0, space 0, times 0 [ 73.148653][ T6711] CPU: 3 UID: 0 PID: 6711 Comm: syz.2.291 Not tainted syzkaller #0 PREEMPT(full) [ 73.148677][ T6711] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 73.148690][ T6711] Call Trace: [ 73.148697][ T6711] [ 73.148705][ T6711] dump_stack_lvl+0x100/0x190 [ 73.148736][ T6711] should_fail_ex.cold+0x5/0xa [ 73.148762][ T6711] should_failslab+0xc2/0x120 [ 73.148814][ T6711] __kmalloc_noprof+0xfc/0x840 [ 73.148840][ T6711] ? public_key_verify_signature+0x2ab/0x910 [ 73.148872][ T6711] public_key_verify_signature+0x2ab/0x910 [ 73.148901][ T6711] ? __pfx_public_key_verify_signature+0x10/0x10 [ 73.148939][ T6711] ? asymmetric_key_generate_id+0x7e/0x180 [ 73.148965][ T6711] x509_check_for_self_signed+0x325/0x510 [ 73.148994][ T6711] x509_cert_parse+0x60c/0x910 [ 73.149021][ T6711] x509_key_preparse+0x65/0x9c0 [ 73.149051][ T6711] asymmetric_key_preparse+0xce/0x1d0 [ 73.149071][ T6711] ? __pfx_asymmetric_key_preparse+0x10/0x10 [ 73.149093][ T6711] __key_create_or_update+0x463/0xe30 [ 73.149118][ T6711] ? __pfx___key_create_or_update+0x10/0x10 [ 73.149141][ T6711] ? lookup_user_key+0x3f3/0x1300 [ 73.149179][ T6711] ? __pfx_lookup_user_key_possessed+0x10/0x10 [ 73.149214][ T6711] key_create_or_update+0x42/0x60 [ 73.149237][ T6711] __do_sys_add_key+0x2e8/0x460 [ 73.149261][ T6711] ? __pfx___do_sys_add_key+0x10/0x10 [ 73.149295][ T6711] __do_fast_syscall_32+0x13a/0x8b0 [ 73.149322][ T6711] do_fast_syscall_32+0x32/0x70 [ 73.149344][ T6711] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 73.149367][ T6711] RIP: 0023:0xf702efec [ 73.149390][ T6711] Code: Unable to access opcode bytes at 0xf702efc2. [ 73.149398][ T6711] RSP: 002b:00000000f541d50c EFLAGS: 00000292 ORIG_RAX: 000000000000011e [ 73.149418][ T6711] RAX: ffffffffffffffda RBX: 0000000080000000 RCX: 0000000000000000 [ 73.149430][ T6711] RDX: 0000000080000200 RSI: 0000000000000559 RDI: 00000000ffffffff [ 73.149443][ T6711] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 73.149455][ T6711] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 73.149473][ T6711] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 73.149500][ T6711] [ 73.307615][ T6715] Invalid ELF header type: 3 != 1 [ 73.542259][ T6734] netlink: 4 bytes leftover after parsing attributes in process `syz.2.296'. [ 74.656648][ T43] audit: type=1804 audit(1790235216.661:2): pid=6752 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.303" name="/newroot/85/file0" dev="tmpfs" ino=474 res=1 errno=0 [ 74.850860][ T6763] netlink: 4 bytes leftover after parsing attributes in process `syz.1.309'. [ 74.880995][ T6766] netlink: 'syz.0.310': attribute type 3 has an invalid length. [ 75.055546][ T6775] binder: 6774:6775 ioctl c0306201 80000080 returned -14 [ 75.062554][ T6775] binder: 6774:6775 ioctl c0306201 800003c0 returned -14 [ 75.251225][ T6783] netlink: 32 bytes leftover after parsing attributes in process `syz.0.316'. [ 75.309452][ T6785] netlink: 70 bytes leftover after parsing attributes in process `syz.0.318'. [ 75.355439][ T6789] netlink: 'syz.0.319': attribute type 3 has an invalid length. [ 75.682841][ T6808] netlink: 'syz.3.328': attribute type 3 has an invalid length. [ 76.127779][ T6822] busy [ 76.553223][ T6826] Invalid ELF header type: 3 != 1 [ 76.763688][ T6839] netlink: 'syz.3.339': attribute type 3 has an invalid length. [ 76.829392][ T6847] binder: 6846:6847 ioctl c0306201 80000080 returned -14 [ 76.835044][ T6847] binder: 6846:6847 ioctl c0306201 800003c0 returned -14 [ 76.841527][ T6848] netlink: 4 bytes leftover after parsing attributes in process `syz.2.340'. [ 76.907555][ T6850] FAULT_INJECTION: forcing a failure. [ 76.907555][ T6850] name failslab, interval 1, probability 0, space 0, times 0 [ 76.907586][ T6850] CPU: 3 UID: 0 PID: 6850 Comm: syz.1.344 Not tainted syzkaller #0 PREEMPT(full) [ 76.907609][ T6850] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 76.907621][ T6850] Call Trace: [ 76.907628][ T6850] [ 76.907636][ T6850] dump_stack_lvl+0x100/0x190 [ 76.907669][ T6850] should_fail_ex.cold+0x5/0xa [ 76.907696][ T6850] should_failslab+0xc2/0x120 [ 76.907723][ T6850] kmem_cache_alloc_noprof+0x92/0x6a0 [ 76.907769][ T6850] ? anon_vma_clone+0x2b3/0xca0 [ 76.907805][ T6850] anon_vma_clone+0x2b3/0xca0 [ 76.907847][ T6850] anon_vma_fork+0x1bb/0x6a0 [ 76.907880][ T6850] dup_mmap+0x10e6/0x2370 [ 76.907918][ T6850] ? __pfx_dup_mmap+0x10/0x10 [ 76.907942][ T6850] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 76.907973][ T6850] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 76.908006][ T6850] ? __lock_acquire+0x5c0/0x1f40 [ 76.908044][ T6850] ? lock_acquire+0x1d1/0x380 [ 76.908070][ T6850] ? copy_process+0x4806/0x8370 [ 76.908099][ T6850] copy_process+0x4811/0x8370 [ 76.908135][ T6850] ? __pfx_copy_process+0x10/0x10 [ 76.908154][ T6850] ? futex_wake+0x4ea/0x5e0 [ 76.908188][ T6850] kernel_clone+0x176/0x9d0 [ 76.908209][ T6850] ? __pfx_kernel_clone+0x10/0x10 [ 76.908233][ T6850] ? ksys_write+0x190/0x250 [ 76.908262][ T6850] __do_compat_sys_ia32_clone+0xd4/0x120 [ 76.908294][ T6850] ? __pfx___do_compat_sys_ia32_clone+0x10/0x10 [ 76.908320][ T6850] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 76.908364][ T6850] __do_fast_syscall_32+0x13a/0x8b0 [ 76.908391][ T6850] do_fast_syscall_32+0x32/0x70 [ 76.908413][ T6850] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 76.908437][ T6850] RIP: 0023:0xf70aefec [ 76.908460][ T6850] Code: Unable to access opcode bytes at 0xf70aefc2. [ 76.908468][ T6850] RSP: 002b:00000000f549d4bc EFLAGS: 00000206 ORIG_RAX: 0000000000000078 [ 76.908488][ T6850] RAX: ffffffffffffffda RBX: 0000000088206000 RCX: 0000000000000000 [ 76.908500][ T6850] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 76.908511][ T6850] RBP: 00000000f549d5ec R08: 0000000000000000 R09: 0000000000000000 [ 76.908523][ T6850] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 76.908534][ T6850] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 76.908560][ T6850] [ 77.745291][ T6876] binder: 6875:6876 ioctl c0306201 80000080 returned -14 [ 77.746439][ T6876] binder: 6875:6876 ioctl c0306201 800003c0 returned -14 [ 77.895593][ T6881] netlink: 'syz.2.354': attribute type 3 has an invalid length. [ 78.141794][ T6895] hpfs: hpfs_map_sector(): read error [ 78.230145][ T6897] netlink: 28 bytes leftover after parsing attributes in process `syz.0.360'. [ 78.490497][ T6905] netlink: 4 bytes leftover after parsing attributes in process `syz.3.363'. [ 78.846243][ T5742] Bluetooth: hci2: command tx timeout [ 78.963650][ T6909] netlink: 4 bytes leftover after parsing attributes in process `syz.2.365'. [ 79.059442][ T6915] binder: 6914:6915 ioctl 4018620d 0 returned -22 [ 79.060173][ T6915] binder: 6914:6915 ioctl c0306201 80000080 returned -14 [ 79.063001][ T6915] binder: 6914:6915 ioctl c0306201 800003c0 returned -14 [ 79.145242][ T6921] netlink: 'syz.2.370': attribute type 3 has an invalid length. [ 79.623666][ T6949] netlink: 'syz.2.379': attribute type 3 has an invalid length. [ 79.704360][ T5742] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:66' [ 79.704375][ T5742] CPU: 3 UID: 0 PID: 5742 Comm: kworker/u34:2 Not tainted syzkaller #0 PREEMPT(full) [ 79.704391][ T5742] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 79.704399][ T5742] Workqueue: hci3 hci_rx_work [ 79.704420][ T5742] Call Trace: [ 79.704425][ T5742] [ 79.704430][ T5742] dump_stack_lvl+0x100/0x190 [ 79.704448][ T5742] sysfs_warn_dup.cold+0x1c/0x28 [ 79.704466][ T5742] sysfs_create_dir_ns+0x24b/0x2b0 [ 79.704481][ T5742] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 79.704495][ T5742] ? find_held_lock+0x2b/0x80 [ 79.704508][ T5742] ? kobject_add_internal+0x25f/0x930 [ 79.704523][ T5742] ? kobject_add_internal+0x25f/0x930 [ 79.704539][ T5742] ? do_raw_spin_unlock+0x145/0x1e0 [ 79.704552][ T5742] kobject_add_internal+0x2c8/0x930 [ 79.704571][ T5742] kobject_add+0x16a/0x1e0 [ 79.704587][ T5742] ? __pfx_kobject_add+0x10/0x10 [ 79.704601][ T5742] ? class_to_subsys+0x10f/0x150 [ 79.704615][ T5742] ? kobject_put+0xb9/0x640 [ 79.704629][ T5742] ? _raw_spin_unlock+0x28/0x50 [ 79.704651][ T5742] device_add+0x294/0x1970 [ 79.704677][ T5742] ? __pfx_dev_set_name+0x10/0x10 [ 79.704691][ T5742] ? __pfx_device_add+0x10/0x10 [ 79.704702][ T5742] ? mgmt_send_event_skb+0x2fb/0x460 [ 79.704723][ T5742] hci_conn_add_sysfs+0x1a3/0x260 [ 79.704735][ T5742] le_conn_complete_evt+0x122f/0x2130 [ 79.704774][ T5742] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 79.704793][ T5742] ? hci_event_packet+0x186/0xcd0 [ 79.704814][ T5742] hci_le_conn_complete_evt+0x23c/0x3a0 [ 79.704831][ T5742] ? skb_pull_data+0x15f/0x1e0 [ 79.704847][ T5742] hci_le_meta_evt+0x34a/0x5f0 [ 79.704865][ T5742] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 79.704885][ T5742] hci_event_packet+0x51c/0xcd0 [ 79.704903][ T5742] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 79.704920][ T5742] ? __pfx_hci_event_packet+0x10/0x10 [ 79.704939][ T5742] ? lockdep_hardirqs_on+0x7d/0x110 [ 79.704954][ T5742] hci_rx_work+0x451/0xfc0 [ 79.704972][ T5742] process_one_work+0xac7/0x1b10 [ 79.704994][ T5742] ? __pfx_process_one_work+0x10/0x10 [ 79.705009][ T5742] ? lock_acquire+0x1d1/0x380 [ 79.705029][ T5742] ? __pfx_hci_rx_work+0x10/0x10 [ 79.705046][ T5742] worker_thread+0x5ef/0xe50 [ 79.705066][ T5742] ? kthread+0x13a/0x450 [ 79.705077][ T5742] ? __pfx_worker_thread+0x10/0x10 [ 79.705090][ T5742] kthread+0x373/0x450 [ 79.705103][ T5742] ? __pfx_kthread+0x10/0x10 [ 79.705116][ T5742] ret_from_fork+0x730/0xd60 [ 79.705128][ T5742] ? __pfx_ret_from_fork+0x10/0x10 [ 79.705152][ T5742] ? native_load_gs_index+0x1e/0xc0 [ 79.705168][ T5742] ? __switch_to+0x800/0x10f0 [ 79.705182][ T5742] ? __pfx_kthread+0x10/0x10 [ 79.705196][ T5742] ret_from_fork_asm+0x1a/0x30 [ 79.705214][ T5742] [ 79.706729][ T5742] kobject: kobject_add_internal failed for hci3:66 with -EEXIST, don't try to register things with the same name in the same directory. [ 79.706752][ T5742] Bluetooth: hci3: failed to register connection device [ 79.761174][ T6959] netlink: 4 bytes leftover after parsing attributes in process `syz.3.383'. [ 80.157218][ T6963] ptrace attach of "/syz-executor exec"[6964] was attempted by "/syz-executor exec"[6963] [ 80.450436][ T5742] Bluetooth: hci3: command tx timeout [ 80.638938][ T6977] netlink: 'syz.0.389': attribute type 3 has an invalid length. [ 80.789452][ T6992] hsr0: entered allmulticast mode [ 80.789466][ T6992] hsr_slave_0: entered allmulticast mode [ 80.789476][ T6992] hsr_slave_1: entered allmulticast mode [ 80.790883][ T6992] hsr0: left allmulticast mode [ 80.790893][ T6992] hsr_slave_0: left allmulticast mode [ 80.790924][ T6992] hsr_slave_1: left allmulticast mode [ 80.912863][ T7003] netlink: 'syz.3.401': attribute type 3 has an invalid length. [ 80.925797][ T5742] Bluetooth: hci2: command 0x0406 tx timeout [ 81.148086][ T7020] netlink: 70 bytes leftover after parsing attributes in process `syz.2.408'. [ 81.320838][ T7030] netlink: 'syz.0.412': attribute type 3 has an invalid length. [ 81.720917][ T7055] netlink: 4 bytes leftover after parsing attributes in process `syz.0.420'. [ 82.535149][ T5752] Bluetooth: hci3: command 0x2016 tx timeout [ 82.624662][ T7096] netlink: 4 bytes leftover after parsing attributes in process `syz.3.434'. [ 82.668653][ T7098] netlink: 70 bytes leftover after parsing attributes in process `syz.2.436'. [ 82.697310][ T7100] binder: 7099:7100 ioctl c0306201 0 returned -14 [ 82.698586][ T7100] binder: 7099:7100 ioctl c0306201 800003c0 returned -14 [ 82.994134][ T2329] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 83.164854][ T2329] usb 7-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 83.167647][ T2329] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 83.167667][ T2329] usb 7-1: Product: syz [ 83.167679][ T2329] usb 7-1: Manufacturer: syz [ 83.167690][ T2329] usb 7-1: SerialNumber: syz [ 83.171661][ T2329] usb 7-1: config 0 descriptor?? [ 83.578097][ T2329] usb 7-1: Firmware: major: 58, minor: 44, hardware type: UNKNOWN (24) [ 83.779214][ T2329] usb 7-1: failed to fetch extended address, random address set [ 83.779246][ T2329] usb 7-1: atusb_probe: initialization failed, error = -524 [ 83.779466][ T2329] atusb 7-1:0.0: probe with driver atusb failed with error -524 [ 83.790036][ T2329] usb 7-1: USB disconnect, device number 3 [ 83.823558][ T7118] netlink: 'syz.3.444': attribute type 16 has an invalid length. [ 83.823574][ T7118] netlink: 'syz.3.444': attribute type 17 has an invalid length. [ 83.841008][ T7118] A link change request failed with some changes committed already. Interface teql0 may have been left with an inconsistent configuration, please check. [ 84.614126][ T5752] Bluetooth: hci3: command tx timeout [ 84.691099][ T7135] netlink: 70 bytes leftover after parsing attributes in process `syz.2.451'. [ 85.364174][ T1478] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 85.514315][ T1478] usb 7-1: Using ep0 maxpacket: 8 [ 85.515109][ T1478] usb 7-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 85.516212][ T1478] usb 7-1: config 0 has an invalid interface number: 55 but max is 0 [ 85.516230][ T1478] usb 7-1: config 0 has no interface number 0 [ 85.516267][ T1478] usb 7-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 85.516284][ T1478] usb 7-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 85.516301][ T1478] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 85.516320][ T1478] usb 7-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 85.516348][ T1478] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 85.555943][ T1478] usb 7-1: config 0 descriptor?? [ 85.570541][ T1478] ldusb 7-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 86.250413][ T7164] netlink: 70 bytes leftover after parsing attributes in process `syz.1.462'. [ 86.657514][ T7177] Invalid ELF header type: 3 != 1 [ 86.660526][ T7177] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 86.673651][ T7177] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 86.695228][ T5752] Bluetooth: hci3: command 0x0406 tx timeout [ 87.790600][ T7213] netlink: 70 bytes leftover after parsing attributes in process `syz.3.482'. [ 87.812827][ T3378] usb 7-1: USB disconnect, device number 4 [ 87.815678][ T3378] ldusb 7-1:0.55: LD USB Device #0 now disconnected [ 87.957831][ T7221] binder: 7218:7221 ioctl c0306201 800003c0 returned -14 [ 88.083127][ T7232] netlink: 70 bytes leftover after parsing attributes in process `syz.0.491'. [ 88.202648][ T7244] binder: 7243:7244 ioctl c0306201 800003c0 returned -14 [ 88.765159][ T5753] Bluetooth: hci3: command 0x0406 tx timeout [ 89.925611][ T7285] netlink: 70 bytes leftover after parsing attributes in process `syz.2.513'. [ 90.677321][ T7303] netlink: 70 bytes leftover after parsing attributes in process `syz.3.522'. [ 90.855077][ T5753] Bluetooth: hci3: command 0x0406 tx timeout [ 91.038414][ T7320] netlink: 4 bytes leftover after parsing attributes in process `syz.0.529'. [ 92.684202][ T1478] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 92.850836][ T1478] usb 5-1: New USB device found, idVendor=a257, idProduct=2013, bcdDevice= 0.01 [ 92.858143][ T1478] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 93.006553][ T5752] Bluetooth: hci0: command tx timeout [ 93.074351][ T1478] dln2 5-1:1.0: USB write failed: -110 [ 93.074370][ T1478] dln2 5-1:1.0: failed to initialize hardware [ 93.076993][ T1478] dln2 5-1:1.0: probe with driver dln2 failed with error -110 [ 93.309226][ T1478] usb 5-1: USB disconnect, device number 4 [ 93.994043][ C2] Adjusting tsc more than 11% (7259339 vs 7162548) [ 94.358320][ T43] audit: type=1326 audit(1790235236.404:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7386 comm="syz.1.555" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 94.359462][ T43] audit: type=1326 audit(1790235236.404:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7386 comm="syz.1.555" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 94.360642][ T43] audit: type=1326 audit(1790235236.416:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7386 comm="syz.1.555" exe="/syz-executor" sig=0 arch=40000003 syscall=386 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 94.360878][ T43] audit: type=1326 audit(1790235236.416:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7386 comm="syz.1.555" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 94.361057][ T43] audit: type=1326 audit(1790235236.416:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7386 comm="syz.1.555" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 94.361533][ T43] audit: type=1326 audit(1790235236.416:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7386 comm="syz.1.555" exe="/syz-executor" sig=0 arch=40000003 syscall=363 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 94.361645][ T43] audit: type=1326 audit(1790235236.416:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7386 comm="syz.1.555" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 94.361768][ T43] audit: type=1326 audit(1790235236.416:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7386 comm="syz.1.555" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 94.361986][ T43] audit: type=1326 audit(1790235236.416:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7386 comm="syz.1.555" exe="/syz-executor" sig=0 arch=40000003 syscall=3 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 94.362178][ T43] audit: type=1326 audit(1790235236.416:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7386 comm="syz.1.555" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 94.965102][ T5752] Bluetooth: hci0: command 0x0406 tx timeout [ 95.474884][ T7425] Invalid ELF header type: 3 != 1 [ 95.751625][ T7433] ptrace attach of "/syz-executor exec"[5736] was attempted by "/syz-executor exec"[7433] [ 95.947189][ T7440] netlink: 4 bytes leftover after parsing attributes in process `syz.0.571'. [ 96.083134][ T7444] netlink: 'syz.1.573': attribute type 3 has an invalid length. [ 96.083154][ T7444] netlink: 16 bytes leftover after parsing attributes in process `syz.1.573'. [ 96.573093][ T7459] syz.1.579 uses obsolete (PF_INET,SOCK_PACKET) [ 96.654687][ T7463] netlink: 1752 bytes leftover after parsing attributes in process `syz.3.582'. [ 96.710104][ T7466] netlink: 'syz.1.583': attribute type 3 has an invalid length. [ 96.710124][ T7466] netlink: 16 bytes leftover after parsing attributes in process `syz.1.583'. [ 97.077888][ T7488] netlink: 8 bytes leftover after parsing attributes in process `syz.0.594'. [ 97.130553][ T7493] netlink: 'syz.3.593': attribute type 3 has an invalid length. [ 97.130571][ T7493] netlink: 16 bytes leftover after parsing attributes in process `syz.3.593'. [ 97.739116][ T7514] netlink: 72 bytes leftover after parsing attributes in process `syz.3.603'. [ 97.794779][ T5752] Bluetooth: hci0: command 0x0406 tx timeout [ 98.222838][ T7523] netlink: 'syz.2.606': attribute type 3 has an invalid length. [ 98.222853][ T7523] netlink: 16 bytes leftover after parsing attributes in process `syz.2.606'. [ 98.293574][ T7525] binder: 7524:7525 ioctl c0306201 80000080 returned -14 [ 98.297812][ T7525] binder: 7524:7525 ioctl 4018620d 0 returned -22 [ 98.297998][ T7525] binder: 7524:7525 ioctl c0306201 800003c0 returned -14 [ 98.619154][ T7534] FAULT_INJECTION: forcing a failure. [ 98.619154][ T7534] name failslab, interval 1, probability 0, space 0, times 0 [ 98.619176][ T7534] CPU: 3 UID: 0 PID: 7534 Comm: syz.2.611 Not tainted syzkaller #0 PREEMPT(full) [ 98.619196][ T7534] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 98.619206][ T7534] Call Trace: [ 98.619212][ T7534] [ 98.619221][ T7534] dump_stack_lvl+0x100/0x190 [ 98.619252][ T7534] should_fail_ex.cold+0x5/0xa [ 98.619283][ T7534] should_failslab+0xc2/0x120 [ 98.619300][ T7534] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 98.619317][ T7534] ? copy_process+0x6a2/0x8370 [ 98.619331][ T7534] copy_process+0x6a2/0x8370 [ 98.619343][ T7534] ? __pfx___futex_wait+0x10/0x10 [ 98.619357][ T7534] ? __pfx_try_to_wake_up+0x10/0x10 [ 98.619373][ T7534] ? futex_hash+0x311/0x400 [ 98.619394][ T7534] ? __pfx_copy_process+0x10/0x10 [ 98.619405][ T7534] ? futex_wake+0x4ea/0x5e0 [ 98.619423][ T7534] kernel_clone+0x176/0x9d0 [ 98.619435][ T7534] ? __pfx_kernel_clone+0x10/0x10 [ 98.619449][ T7534] ? ksys_write+0x190/0x250 [ 98.619469][ T7534] __do_compat_sys_ia32_clone+0xd4/0x120 [ 98.619488][ T7534] ? __pfx___do_compat_sys_ia32_clone+0x10/0x10 [ 98.619505][ T7534] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 98.619530][ T7534] __do_fast_syscall_32+0x13a/0x8b0 [ 98.619547][ T7534] do_fast_syscall_32+0x32/0x70 [ 98.619560][ T7534] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 98.619574][ T7534] RIP: 0023:0xf702efec [ 98.619588][ T7534] Code: Unable to access opcode bytes at 0xf702efc2. [ 98.619593][ T7534] RSP: 002b:00000000f541d4bc EFLAGS: 00000206 ORIG_RAX: 0000000000000078 [ 98.619605][ T7534] RAX: ffffffffffffffda RBX: 0000000088206000 RCX: 0000000000000000 [ 98.619612][ T7534] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 98.619618][ T7534] RBP: 00000000f541d5ec R08: 0000000000000000 R09: 0000000000000000 [ 98.619625][ T7534] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 98.619631][ T7534] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 98.619644][ T7534] [ 98.702421][ T7535] netlink: 1752 bytes leftover after parsing attributes in process `syz.0.610'. [ 98.886826][ T7545] binder: 7543:7545 ioctl c0306201 80000080 returned -14 [ 98.888815][ T7545] binder: 7543:7545 ioctl c0306201 0 returned -14 [ 98.893656][ T7546] jffs2: notice: (7546) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 99.158527][ T7572] netlink: 16 bytes leftover after parsing attributes in process `syz.1.624'. [ 99.172487][ T7572] IPv6: sit1: Disabled Multicast RS [ 99.173158][ T7572] sit1: entered allmulticast mode [ 99.431624][ T7578] binder: 7577:7578 ioctl c0306201 80000080 returned -14 [ 99.434845][ T7578] binder: 7577:7578 ioctl c0306201 0 returned -14 [ 99.722445][ T50] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 99.868706][ T50] usb 6-1: Using ep0 maxpacket: 8 [ 99.869150][ T50] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 99.870030][ T50] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 99.870046][ T50] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 99.870057][ T50] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 99.870068][ T50] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 99.870087][ T50] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 100.072100][ T50] usb 6-1: GET_CAPABILITIES returned 0 [ 100.072125][ T50] usbtmc 6-1:16.0: can't read capabilities [ 100.243573][ T7599] binder: 7598:7599 ioctl c0306201 80000080 returned -14 [ 100.254694][ T7599] binder: 7598:7599 ioctl c0306201 0 returned -14 [ 100.286540][ T50] usb 6-1: USB disconnect, device number 5 [ 101.848884][ T5752] Bluetooth: hci0: command 0x0406 tx timeout [ 101.862154][ T7630] fuse: Bad value for 'fd' [ 101.998549][ T7632] __nla_validate_parse: 2 callbacks suppressed [ 101.998567][ T7632] netlink: 70 bytes leftover after parsing attributes in process `syz.3.646'. [ 102.195866][ T7641] netlink: 'syz.2.651': attribute type 3 has an invalid length. [ 102.195880][ T7641] netlink: 16 bytes leftover after parsing attributes in process `syz.2.651'. [ 102.524742][ T7657] netlink: 70 bytes leftover after parsing attributes in process `syz.3.657'. [ 102.805089][ T7667] netlink: 'syz.2.661': attribute type 3 has an invalid length. [ 102.805105][ T7667] netlink: 16 bytes leftover after parsing attributes in process `syz.2.661'. [ 103.161337][ T50] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 103.319699][ T50] usb 7-1: Using ep0 maxpacket: 8 [ 103.320233][ T50] usb 7-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 103.321079][ T50] usb 7-1: config 0 has an invalid interface number: 55 but max is 0 [ 103.321093][ T50] usb 7-1: config 0 has no interface number 0 [ 103.321109][ T50] usb 7-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 103.321120][ T50] usb 7-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 103.321132][ T50] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 103.321144][ T50] usb 7-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 103.321162][ T50] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 103.323807][ T50] usb 7-1: config 0 descriptor?? [ 103.359695][ T50] ldusb 7-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 103.409746][ T7681] netlink: 4 bytes leftover after parsing attributes in process `syz.1.665'. [ 104.548390][ T7699] netlink: 60 bytes leftover after parsing attributes in process `syz.3.674'. [ 104.554868][ T7699] netlink: 60 bytes leftover after parsing attributes in process `syz.3.674'. [ 104.555360][ T7699] netlink: 60 bytes leftover after parsing attributes in process `syz.3.674'. [ 105.405722][ T5752] Bluetooth: hci1: command 0x2016 tx timeout [ 105.565295][ T10] usb 7-1: USB disconnect, device number 5 [ 105.569077][ T10] ldusb 7-1:0.55: LD USB Device #0 now disconnected [ 105.692189][ T7751] netlink: 70 bytes leftover after parsing attributes in process `syz.3.695'. [ 105.724480][ T7753] syzkaller0: entered promiscuous mode [ 105.724497][ T7753] syzkaller0: entered allmulticast mode [ 106.109319][ T7760] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.698'. [ 107.026907][ T50] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 107.043808][ T7793] netlink: 'syz.0.711': attribute type 3 has an invalid length. [ 107.177121][ T50] usb 6-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 107.181559][ T50] usb 6-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 107.181583][ T50] usb 6-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 107.181595][ T50] usb 6-1: config 1 interface 0 altsetting 127 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 107.181608][ T50] usb 6-1: config 1 interface 0 has no altsetting 0 [ 107.183976][ T50] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 107.183990][ T50] usb 6-1: Product: syz [ 107.183997][ T50] usb 6-1: Manufacturer: syz [ 107.184004][ T50] usb 6-1: SerialNumber: syz [ 107.187868][ T7771] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 107.187968][ T7771] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 107.338573][ T7807] netlink: 70 bytes leftover after parsing attributes in process `syz.2.717'. [ 107.400857][ T50] rtl8150 6-1:1.0: couldn't find required endpoints [ 107.400964][ T50] rtl8150 6-1:1.0: probe with driver rtl8150 failed with error -5 [ 107.403267][ T50] usb 6-1: USB disconnect, device number 6 [ 107.433031][ T7814] netlink: 'syz.2.720': attribute type 3 has an invalid length. [ 107.522457][ T7822] fuse: Bad value for 'fd' [ 107.530860][ T7824] binder: 7823:7824 ioctl c0306201 80000080 returned -14 [ 107.532272][ T7824] binder: 7823:7824 ioctl c0306201 800003c0 returned -14 [ 107.558677][ T7831] netlink: 4 bytes leftover after parsing attributes in process `syz.2.726'. [ 107.750502][ T7851] binder: 7850:7851 ioctl c0306201 80000080 returned -14 [ 107.751742][ T7851] binder: 7850:7851 ioctl c0306201 800003c0 returned -14 [ 107.779192][ T7853] netlink: 4 bytes leftover after parsing attributes in process `syz.0.736'. [ 107.947988][ T1478] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 108.114404][ T1478] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 1.00 [ 108.130431][ T1478] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 108.161398][ T1478] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 108.161422][ T1478] usb 7-1: Product: syz [ 108.161433][ T1478] usb 7-1: Manufacturer: syz [ 108.161443][ T1478] usb 7-1: SerialNumber: syz [ 108.193542][ T1478] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 108.193560][ T1478] cdc_wdm 7-1:1.0: Unknown control protocol [ 108.233229][ T35] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 108.383711][ T35] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 108.385125][ T35] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 108.385160][ T35] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 108.387521][ T35] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 108.387542][ T35] usb 6-1: Product: syz [ 108.387555][ T35] usb 6-1: Manufacturer: syz [ 108.387568][ T35] usb 6-1: SerialNumber: syz [ 108.392496][ T35] cdc_mbim 6-1:1.0: skipping garbage [ 108.403966][ T7874] netlink: 4 bytes leftover after parsing attributes in process `syz.0.743'. [ 108.573604][ T7876] Invalid ELF header magic: != ELF [ 108.606062][ T7859] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 108.738018][ T5825] usb 7-1: USB disconnect, device number 6 [ 109.208378][ T7859] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 109.209574][ T35] cdc_mbim 6-1:1.0: setting tx_max = 16384 [ 109.210593][ T35] cdc_mbim 6-1:1.0: cdc-wdm0: USB WDM device [ 109.218257][ T35] wwan wwan0: port wwan0mbim0 attached [ 109.226712][ T35] cdc_mbim 6-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.1-1, CDC MBIM, 06:3e:63:4a:2d:ce [ 109.410534][ T1478] usb 6-1: USB disconnect, device number 7 [ 109.411408][ T1478] cdc_mbim 6-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.1-1, CDC MBIM [ 109.506325][ T1478] wwan wwan0: port wwan0mbim0 disconnected [ 109.551956][ T5742] Bluetooth: hci1: command 0x2016 tx timeout [ 109.707768][ T7895] syz.0.750 (7895) used greatest stack depth: 19256 bytes left [ 109.743669][ T7911] netlink: 200 bytes leftover after parsing attributes in process `syz.0.753'. [ 109.743689][ T7911] netlink: 200 bytes leftover after parsing attributes in process `syz.0.753'. [ 109.778558][ T7913] fuse: Bad value for 'fd' [ 109.873102][ T7919] netlink: 70 bytes leftover after parsing attributes in process `syz.0.757'. [ 109.972983][ T7926] netlink: 1624 bytes leftover after parsing attributes in process `syz.3.760'. [ 110.169940][ T7943] binder: 7942:7943 ioctl c0306201 80000080 returned -14 [ 110.172161][ T7943] binder: 7942:7943 ioctl c0306201 800003c0 returned -14 [ 110.300573][ T7950] kvm: emulating exchange as write [ 110.349353][ T5752] Bluetooth: hci0: command 0x0406 tx timeout [ 110.360473][ T7958] netlink: 44 bytes leftover after parsing attributes in process `syz.3.775'. [ 110.531184][ T7967] binder: 7966:7967 ioctl c0306201 80000080 returned -14 [ 110.533044][ T7967] binder: 7966:7967 ioctl c0306201 800003c0 returned -14 [ 111.684022][ T7997] netlink: 4 bytes leftover after parsing attributes in process `syz.2.788'. [ 112.725950][ T8029] netlink: 1092 bytes leftover after parsing attributes in process `syz.0.803'. [ 113.112288][ T8065] Invalid ELF header type: 3 != 1 [ 113.191448][ T8075] netlink: 1092 bytes leftover after parsing attributes in process `syz.3.821'. [ 113.669980][ T8095] netlink: 1092 bytes leftover after parsing attributes in process `syz.3.830'. [ 113.706614][ T5752] Bluetooth: hci2: command 0x0406 tx timeout [ 113.924340][ T8104] tipc: Started in network mode [ 113.924357][ T8104] tipc: Node identity ac1414aa, cluster identity 4711 [ 113.925714][ T8104] tipc: New replicast peer: 172.20.20.187 [ 113.926112][ T8104] tipc: Enabled bearer , priority 10 [ 113.981012][ T8107] raw_sendmsg: syz.3.834 forgot to set AF_INET. Fix it! [ 114.005290][ T8109] netlink: 4 bytes leftover after parsing attributes in process `syz.3.835'. [ 114.507673][ T5753] Bluetooth: hci0: command 0x0406 tx timeout [ 114.541476][ T8122] Invalid ELF header type: 3 != 1 [ 114.827686][ T8129] netlink: 1624 bytes leftover after parsing attributes in process `syz.0.841'. [ 114.957298][ T1036] tipc: Node number set to 2886997162 [ 115.563637][ T8150] netlink: 1624 bytes leftover after parsing attributes in process `syz.1.850'. [ 116.592698][ T8181] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 116.592716][ T8181] IPv6: NLM_F_CREATE should be set when creating new route [ 116.592751][ T8181] IPv6: NLM_F_CREATE should be set when creating new route [ 117.875835][ T5742] Bluetooth: hci2: command 0x0406 tx timeout [ 118.113805][ T8208] netlink: 4 bytes leftover after parsing attributes in process `syz.2.867'. [ 118.143355][ T8210] devpts: Bad value for 'max' [ 119.288969][ T8228] Invalid ELF header type: 3 != 1 [ 119.817384][ T5742] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:66' [ 119.817402][ T5742] CPU: 1 UID: 0 PID: 5742 Comm: kworker/u34:2 Not tainted syzkaller #0 PREEMPT(full) [ 119.817418][ T5742] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 119.817426][ T5742] Workqueue: hci2 hci_rx_work [ 119.817445][ T5742] Call Trace: [ 119.817449][ T5742] [ 119.817454][ T5742] dump_stack_lvl+0x100/0x190 [ 119.817471][ T5742] sysfs_warn_dup.cold+0x1c/0x28 [ 119.817489][ T5742] sysfs_create_dir_ns+0x24b/0x2b0 [ 119.817505][ T5742] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 119.817519][ T5742] ? find_held_lock+0x2b/0x80 [ 119.817531][ T5742] ? kobject_add_internal+0x25f/0x930 [ 119.817547][ T5742] ? kobject_add_internal+0x25f/0x930 [ 119.817562][ T5742] ? do_raw_spin_unlock+0x145/0x1e0 [ 119.817575][ T5742] kobject_add_internal+0x2c8/0x930 [ 119.817593][ T5742] kobject_add+0x16a/0x1e0 [ 119.817608][ T5742] ? __pfx_kobject_add+0x10/0x10 [ 119.817623][ T5742] ? class_to_subsys+0x10f/0x150 [ 119.817638][ T5742] ? kobject_put+0xb9/0x640 [ 119.817651][ T5742] ? _raw_spin_unlock+0x28/0x50 [ 119.817671][ T5742] device_add+0x294/0x1970 [ 119.817683][ T5742] ? __pfx_dev_set_name+0x10/0x10 [ 119.817697][ T5742] ? __pfx_device_add+0x10/0x10 [ 119.817710][ T5742] ? mgmt_send_event_skb+0x2fb/0x460 [ 119.817732][ T5742] hci_conn_add_sysfs+0x1a3/0x260 [ 119.817744][ T5742] le_conn_complete_evt+0x122f/0x2130 [ 119.817765][ T5742] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 119.817780][ T5742] ? hci_event_packet+0x186/0xcd0 [ 119.817799][ T5742] hci_le_conn_complete_evt+0x23c/0x3a0 [ 119.817816][ T5742] ? skb_pull_data+0x15f/0x1e0 [ 119.817831][ T5742] hci_le_meta_evt+0x34a/0x5f0 [ 119.817848][ T5742] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 119.817867][ T5742] hci_event_packet+0x51c/0xcd0 [ 119.817883][ T5742] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 119.817900][ T5742] ? __pfx_hci_event_packet+0x10/0x10 [ 119.817919][ T5742] ? lockdep_hardirqs_on+0x7d/0x110 [ 119.817934][ T5742] hci_rx_work+0x451/0xfc0 [ 119.817951][ T5742] process_one_work+0xac7/0x1b10 [ 119.817972][ T5742] ? __pfx_process_one_work+0x10/0x10 [ 119.817987][ T5742] ? lock_acquire+0x1d1/0x380 [ 119.818008][ T5742] ? __pfx_hci_rx_work+0x10/0x10 [ 119.818025][ T5742] worker_thread+0x5ef/0xe50 [ 119.818045][ T5742] ? kthread+0x13a/0x450 [ 119.818056][ T5742] ? __pfx_worker_thread+0x10/0x10 [ 119.818070][ T5742] kthread+0x373/0x450 [ 119.818099][ T5742] ? __pfx_kthread+0x10/0x10 [ 119.818115][ T5742] ret_from_fork+0x730/0xd60 [ 119.818127][ T5742] ? __pfx_ret_from_fork+0x10/0x10 [ 119.818138][ T5742] ? native_load_gs_index+0x1e/0xc0 [ 119.818153][ T5742] ? __switch_to+0x800/0x10f0 [ 119.818168][ T5742] ? __pfx_kthread+0x10/0x10 [ 119.818182][ T5742] ret_from_fork_asm+0x1a/0x30 [ 119.818203][ T5742] [ 119.818244][ T5742] kobject: kobject_add_internal failed for hci2:66 with -EEXIST, don't try to register things with the same name in the same directory. [ 119.818262][ T5742] Bluetooth: hci2: failed to register connection device [ 119.870112][ T8251] netlink: 4 bytes leftover after parsing attributes in process `syz.2.888'. [ 119.963041][ T8253] netlink: 48 bytes leftover after parsing attributes in process `syz.3.890'. [ 120.105143][ T5742] Bluetooth: hci2: command 0x0406 tx timeout [ 120.514048][ T8273] Invalid ELF header type: 3 != 1 [ 121.118230][ T8295] serio: Serial port ptm0 [ 121.231305][ T8298] netlink: 4 bytes leftover after parsing attributes in process `syz.1.907'. [ 121.245916][ T8298] bond0: (slave bond_slave_0): Releasing backup interface [ 121.606984][ T8307] overlayfs: missing 'workdir' [ 121.697341][ T8311] netlink: 24 bytes leftover after parsing attributes in process `syz.0.913'. [ 121.921228][ T8317] netlink: 32 bytes leftover after parsing attributes in process `syz.2.917'. [ 122.014962][ T5825] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 122.167635][ T8338] fuse: Bad value for 'fd' [ 122.175816][ T5825] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 122.176848][ T5825] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 122.176871][ T5825] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 122.176889][ T5825] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 122.176920][ T5825] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 122.179063][ T5825] usb 5-1: config 0 descriptor?? [ 122.185471][ T5742] Bluetooth: hci2: command 0x0406 tx timeout [ 122.271610][ T8342] netlink: 4 bytes leftover after parsing attributes in process `syz.1.927'. [ 122.590609][ T5825] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 122.590640][ T5825] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 122.590652][ T5825] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 122.590666][ T5825] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 122.590678][ T5825] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 122.590689][ T5825] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 122.590701][ T5825] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 122.590712][ T5825] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 122.590724][ T5825] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 122.590735][ T5825] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 122.600345][ T5825] plantronics 0003:047F:FFFF.0002: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 122.859836][ T5825] usb 5-1: USB disconnect, device number 5 [ 122.949362][ T8378] netlink: 16 bytes leftover after parsing attributes in process `syz.2.942'. [ 123.029267][ T8381] netlink: 4 bytes leftover after parsing attributes in process `syz.2.943'. [ 123.623532][ T8386] netlink: 1688 bytes leftover after parsing attributes in process `syz.1.945'. [ 123.742672][ T8392] netlink: 16 bytes leftover after parsing attributes in process `syz.1.948'. [ 124.025193][ T8398] netlink: 16 bytes leftover after parsing attributes in process `syz.2.951'. [ 124.264871][ T5742] Bluetooth: hci2: command 0x0406 tx timeout [ 124.356916][ T8419] netlink: 4 bytes leftover after parsing attributes in process `syz.2.959'. [ 124.675440][ T8425] netlink: 16046 bytes leftover after parsing attributes in process `syz.0.962'. [ 124.748140][ T8428] netlink: 9286 bytes leftover after parsing attributes in process `syz.0.963'. [ 124.783945][ T8432] netlink: 64859 bytes leftover after parsing attributes in process `syz.0.965'. [ 125.198525][ T8450] netlink: 'syz.0.973': attribute type 29 has an invalid length. [ 125.337774][ T8454] serio: Serial port ptm0 [ 125.547381][ T8463] netlink: 'syz.2.978': attribute type 2 has an invalid length. [ 125.547401][ T8463] netlink: 'syz.2.978': attribute type 8 has an invalid length. [ 125.547412][ T8463] netlink: 132 bytes leftover after parsing attributes in process `syz.2.978'. [ 125.548180][ T8464] netlink: 'syz.0.977': attribute type 10 has an invalid length. [ 125.624070][ T8464] team0: Device gre0 is of different type [ 126.008911][ T8479] netlink: 70 bytes leftover after parsing attributes in process `syz.0.984'. [ 126.344847][ T5742] Bluetooth: hci2: command 0x0406 tx timeout [ 126.874565][ T8499] netlink: 8 bytes leftover after parsing attributes in process `syz.2.993'. [ 128.534842][ T5841] usb 7-1: new full-speed USB device number 7 using dummy_hcd [ 128.686055][ T5841] usb 7-1: not running at top speed; connect to a high speed hub [ 128.686083][ T5841] usb 7-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 128.688894][ T5841] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 128.688943][ T5841] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 128.704689][ T5841] uvcvideo 7-1:1.0: Found UVC 1.00 device (046d:0825) [ 128.706001][ T5841] uvcvideo 7-1:1.0: No streaming interface found for terminal 32770. [ 128.902623][ T5841] usb 7-1: USB disconnect, device number 7 [ 129.594861][ T2329] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 129.745646][ T2329] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 129.746972][ T2329] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 129.747009][ T2329] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 129.749201][ T2329] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 129.749229][ T2329] usb 6-1: Product: syz [ 129.749241][ T2329] usb 6-1: Manufacturer: syz [ 129.749253][ T2329] usb 6-1: SerialNumber: syz [ 129.754463][ T2329] cdc_mbim 6-1:1.0: skipping garbage [ 129.839548][ T8635] FAULT_INJECTION: forcing a failure. [ 129.839548][ T8635] name failslab, interval 1, probability 0, space 0, times 0 [ 129.839568][ T8635] CPU: 2 UID: 0 PID: 8635 Comm: syz.0.1051 Not tainted syzkaller #0 PREEMPT(full) [ 129.839582][ T8635] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 129.839588][ T8635] Call Trace: [ 129.839593][ T8635] [ 129.839598][ T8635] dump_stack_lvl+0x100/0x190 [ 129.839617][ T8635] should_fail_ex.cold+0x5/0xa [ 129.839634][ T8635] should_failslab+0xc2/0x120 [ 129.839651][ T8635] kmem_cache_alloc_noprof+0x92/0x6a0 [ 129.839666][ T8635] ? vm_area_dup+0x27/0x9d0 [ 129.839686][ T8635] vm_area_dup+0x27/0x9d0 [ 129.839703][ T8635] __split_vma+0x19c/0x1de0 [ 129.839718][ T8635] ? lock_acquire+0x1d1/0x380 [ 129.839734][ T8635] ? __pfx___split_vma+0x10/0x10 [ 129.839755][ T8635] ? find_held_lock+0x2b/0x80 [ 129.839767][ T8635] ? is_bpf_text_address+0x8a/0x1a0 [ 129.839784][ T8635] ? is_bpf_text_address+0x8a/0x1a0 [ 129.839801][ T8635] vms_gather_munmap_vmas+0x1d2/0x1720 [ 129.839816][ T8635] ? __pfx_vms_gather_munmap_vmas+0x10/0x10 [ 129.839826][ T8635] ? mtree_range_walk+0x72b/0xb70 [ 129.839850][ T8635] ? mas_walk+0x260/0x310 [ 129.839864][ T8635] __mmap_region+0x4cc/0x32e0 [ 129.839876][ T8635] ? __lock_acquire+0x5c0/0x1f40 [ 129.839892][ T8635] ? __pfx___mmap_region+0x10/0x10 [ 129.839911][ T8635] ? find_held_lock+0x2b/0x80 [ 129.839924][ T8635] ? process_measurement+0x4c8/0x2350 [ 129.839939][ T8635] ? process_measurement+0x4c8/0x2350 [ 129.839954][ T8635] ? down_write+0x146/0x1f0 [ 129.839968][ T8635] ? __css_rstat_updated+0x1ce/0x590 [ 129.839994][ T8635] ? __lock_acquire+0x5c0/0x1f40 [ 129.840010][ T8635] ? __lock_acquire+0x5c0/0x1f40 [ 129.840030][ T8635] ? lock_acquire+0x1d1/0x380 [ 129.840045][ T8635] ? finish_task_switch.isra.0+0x149/0x10d0 [ 129.840062][ T8635] ? find_held_lock+0x2b/0x80 [ 129.840093][ T8635] ? find_held_lock+0x2b/0x80 [ 129.840107][ T8635] mmap_region+0x3db/0x6d0 [ 129.840121][ T8635] ? __pfx_mmap_region+0x10/0x10 [ 129.840132][ T8635] ? rcu_is_watching+0x13/0xc0 [ 129.840144][ T8635] ? apparmor_capable+0x1d7/0x4d0 [ 129.840162][ T8635] ? bpf_lsm_capable+0x9/0x10 [ 129.840171][ T8635] ? security_capable+0x80/0x260 [ 129.840188][ T8635] do_mmap+0x12c7/0x1c30 [ 129.840206][ T8635] ? lock_acquire+0x1d1/0x380 [ 129.840229][ T8635] ? __pfx_do_mmap+0x10/0x10 [ 129.840245][ T8635] ? __pfx___might_resched+0x10/0x10 [ 129.840261][ T8635] ? futex_wait+0x11e/0x370 [ 129.840278][ T8635] ? __pfx_down_write_killable+0x10/0x10 [ 129.840295][ T8635] vm_mmap_pgoff+0x28d/0x470 [ 129.840313][ T8635] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 129.840328][ T8635] ? __pfx_do_futex+0x10/0x10 [ 129.840345][ T8635] ksys_mmap_pgoff+0xe4/0x610 [ 129.840361][ T8635] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 129.840375][ T8635] ? ksys_write+0x1ac/0x250 [ 129.840388][ T8635] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 129.840407][ T8635] __do_fast_syscall_32+0x13a/0x8b0 [ 129.840422][ T8635] do_fast_syscall_32+0x32/0x70 [ 129.840434][ T8635] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 129.840449][ T8635] RIP: 0023:0xf709efec [ 129.840463][ T8635] Code: Unable to access opcode bytes at 0xf709efc2. [ 129.840468][ T8635] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 00000000000000c0 [ 129.840480][ T8635] RAX: ffffffffffffffda RBX: 0000000080001000 RCX: 0000000000c00000 [ 129.840487][ T8635] RDX: 0000000000000000 RSI: 0000000000003032 RDI: 00000000ffffffff [ 129.840494][ T8635] RBP: 0000000001000000 R08: 0000000000000000 R09: 0000000000000000 [ 129.840500][ T8635] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 129.840507][ T8635] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 129.840736][ T8635] [ 129.956156][ T8628] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 130.170205][ T8642] __nla_validate_parse: 2 callbacks suppressed [ 130.170217][ T8642] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1054'. [ 130.534954][ T1036] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 130.558608][ T8628] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 130.559860][ T2329] cdc_mbim 6-1:1.0: setting tx_max = 16384 [ 130.562032][ T2329] cdc_mbim 6-1:1.0: cdc-wdm0: USB WDM device [ 130.565311][ T2329] wwan wwan0: port wwan0mbim0 attached [ 130.569682][ T2329] cdc_mbim 6-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.1-1, CDC MBIM, 76:6d:da:68:d3:8e [ 130.696791][ T1036] usb 7-1: Using ep0 maxpacket: 32 [ 130.697415][ T1036] usb 7-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 130.698401][ T1036] usb 7-1: config 0 has an invalid interface number: 184 but max is 0 [ 130.698419][ T1036] usb 7-1: config 0 has no interface number 0 [ 130.698450][ T1036] usb 7-1: config 0 interface 184 has no altsetting 0 [ 130.700277][ T1036] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 130.700296][ T1036] usb 7-1: Product: syz [ 130.700307][ T1036] usb 7-1: Manufacturer: syz [ 130.700319][ T1036] usb 7-1: SerialNumber: syz [ 130.702560][ T1036] usb 7-1: config 0 descriptor?? [ 130.767112][ T2329] usb 6-1: USB disconnect, device number 8 [ 130.769723][ T2329] cdc_mbim 6-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.1-1, CDC MBIM [ 130.845125][ T2329] wwan wwan0: port wwan0mbim0 disconnected [ 130.940997][ T8672] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1063'. [ 131.313102][ T1036] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 131.313130][ T1036] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 131.785930][ T1438] ieee802154 phy0 wpan0: encryption failed: -22 [ 131.785962][ T1438] ieee802154 phy1 wpan1: encryption failed: -22 [ 131.839991][ T8695] netlink: 70 bytes leftover after parsing attributes in process `syz.0.1073'. [ 132.119027][ T1036] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -71 [ 132.119049][ T1036] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -71 [ 132.119060][ T1036] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 132.119333][ T1036] smsc75xx 7-1:0.184: probe with driver smsc75xx failed with error -71 [ 132.124545][ T1036] usb 7-1: USB disconnect, device number 8 [ 132.219101][ T8711] Invalid ELF header type: 3 != 1 [ 132.345822][ T8719] netlink: 52 bytes leftover after parsing attributes in process `syz.1.1081'. [ 132.369987][ T8719] bridge0: port 2(bridge_slave_1) entered disabled state [ 132.934981][ T8737] veth0_to_bond: entered promiscuous mode [ 132.936923][ T8737] macsec1: entered promiscuous mode [ 132.937053][ T8737] macsec1: entered allmulticast mode [ 132.937062][ T8737] veth0_to_bond: entered allmulticast mode [ 133.098221][ T8752] syzkaller0: entered promiscuous mode [ 133.098238][ T8752] syzkaller0: entered allmulticast mode [ 133.525675][ T8762] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1099'. [ 133.525700][ T8762] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1099'. [ 133.560780][ T8763] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1098'. [ 135.318137][ T8795] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1111'. [ 135.319503][ T8795] bridge0: port 2(bridge_slave_1) entered disabled state [ 135.439954][ T8811] input: syz1 as /devices/virtual/input/input8 [ 136.570986][ T8836] netlink: 70 bytes leftover after parsing attributes in process `syz.3.1129'. [ 136.659840][ T8842] fuse: fd is not a fuse device [ 137.577874][ T8865] syzkaller0: entered promiscuous mode [ 137.577899][ T8865] syzkaller0: entered allmulticast mode [ 138.148089][ T8888] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1146'. [ 139.170178][ T8915] Invalid ELF header type: 3 != 1 [ 139.494883][ T50] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 139.645495][ T50] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 139.646418][ T50] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 139.646439][ T50] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 139.646456][ T50] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 139.646485][ T50] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 139.647952][ T50] usb 5-1: config 0 descriptor?? [ 139.900582][ T8933] FAULT_INJECTION: forcing a failure. [ 139.900582][ T8933] name failslab, interval 1, probability 0, space 0, times 0 [ 139.900611][ T8933] CPU: 0 UID: 0 PID: 8933 Comm: syz.1.1164 Not tainted syzkaller #0 PREEMPT(full) [ 139.900632][ T8933] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 139.900643][ T8933] Call Trace: [ 139.900650][ T8933] [ 139.900657][ T8933] dump_stack_lvl+0x100/0x190 [ 139.900686][ T8933] should_fail_ex.cold+0x5/0xa [ 139.900712][ T8933] should_failslab+0xc2/0x120 [ 139.900740][ T8933] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 139.900766][ T8933] ? kasprintf+0xc7/0x100 [ 139.900797][ T8933] kvasprintf+0xbc/0x150 [ 139.900822][ T8933] ? __pfx_kvasprintf+0x10/0x10 [ 139.900845][ T8933] ? futex_unqueue+0x133/0x2c0 [ 139.900865][ T8933] ? look_up_lock_class+0x55/0x120 [ 139.900886][ T8933] ? register_lock_class+0x3f/0x7b0 [ 139.900917][ T8933] kasprintf+0xc7/0x100 [ 139.900942][ T8933] ? __pfx_kasprintf+0x10/0x10 [ 139.900981][ T8933] logfc+0x11c/0x4e0 [ 139.901004][ T8933] ? lock_acquire+0x1d1/0x380 [ 139.901029][ T8933] ? __do_sys_fsconfig+0x4e1/0xcb0 [ 139.901058][ T8933] ? __pfx_logfc+0x10/0x10 [ 139.901087][ T8933] ? trace_contention_end+0x126/0x160 [ 139.901116][ T8933] ? __mutex_lock+0x26c/0x1bd0 [ 139.901136][ T8933] ? __do_sys_fsconfig+0x4e1/0xcb0 [ 139.901170][ T8933] get_tree_bdev_flags+0x4b0/0x620 [ 139.901189][ T8933] ? __pfx_exfat_fill_super+0x10/0x10 [ 139.901213][ T8933] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 139.901238][ T8933] ? bpf_lsm_capable+0x9/0x10 [ 139.901253][ T8933] ? security_capable+0x80/0x260 [ 139.901281][ T8933] vfs_get_tree+0x92/0x320 [ 139.901310][ T8933] vfs_cmd_create+0xd7/0x2a0 [ 139.901340][ T8933] __do_sys_fsconfig+0x55a/0xcb0 [ 139.901391][ T8933] ? __pfx___do_sys_fsconfig+0x10/0x10 [ 139.901422][ T8933] ? xfd_validate_state+0x129/0x190 [ 139.901463][ T8933] __do_fast_syscall_32+0x13a/0x8b0 [ 139.901493][ T8933] do_fast_syscall_32+0x32/0x70 [ 139.901514][ T8933] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 139.901538][ T8933] RIP: 0023:0xf70aefec [ 139.901560][ T8933] Code: Unable to access opcode bytes at 0xf70aefc2. [ 139.901569][ T8933] RSP: 002b:00000000f549d50c EFLAGS: 00000292 ORIG_RAX: 00000000000001af [ 139.901588][ T8933] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000006 [ 139.901599][ T8933] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 139.901610][ T8933] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 139.901621][ T8933] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 139.901633][ T8933] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 139.901658][ T8933] [ 140.104779][ T5742] Bluetooth: hci2: command 0x0406 tx timeout [ 140.125579][ T50] usbhid 5-1:0.0: can't add hid device: -71 [ 140.125630][ T50] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 140.127144][ T50] usb 5-1: USB disconnect, device number 6 [ 140.770906][ T8961] netlink: 392 bytes leftover after parsing attributes in process `syz.0.1175'. [ 141.000126][ T8985] fuse: Bad value for 'fd' [ 141.225081][ T853] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 141.374940][ T853] usb 6-1: Using ep0 maxpacket: 16 [ 141.375398][ T853] usb 6-1: New USB device found, idVendor=0d8c, idProduct=0102, bcdDevice= 0.40 [ 141.377724][ T853] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 141.377737][ T853] usb 6-1: Product: syz [ 141.377744][ T853] usb 6-1: Manufacturer: syz [ 141.377752][ T853] usb 6-1: SerialNumber: syz [ 141.792359][ T853] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 141.793069][ T853] usb 6-1: USB disconnect, device number 9 [ 142.029772][ T9031] netlink: 70 bytes leftover after parsing attributes in process `syz.3.1199'. [ 142.295380][ T853] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 142.464961][ T853] usb 7-1: Using ep0 maxpacket: 32 [ 142.465444][ T853] usb 7-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=33.f9 [ 142.466210][ T853] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 255, changing to 11 [ 142.466225][ T853] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x88 has invalid maxpacket 59391, setting to 1024 [ 142.467712][ T853] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 142.467724][ T853] usb 7-1: Product: syz [ 142.467731][ T853] usb 7-1: Manufacturer: syz [ 142.467738][ T853] usb 7-1: SerialNumber: syz [ 142.469116][ T853] usb 7-1: config 0 descriptor?? [ 142.469574][ T9032] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 142.474521][ T853] input: KB Gear Tablet as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/input/input10 [ 142.721318][ T853] usb 7-1: USB disconnect, device number 9 [ 142.786284][ T43] audit: type=1326 audit(1790235291.300:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9057 comm="syz.3.1209" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 142.786440][ T43] audit: type=1326 audit(1790235291.300:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9057 comm="syz.3.1209" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 142.787558][ T43] audit: type=1326 audit(1790235291.300:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9057 comm="syz.3.1209" exe="/syz-executor" sig=0 arch=40000003 syscall=156 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 142.787659][ T43] audit: type=1326 audit(1790235291.300:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9057 comm="syz.3.1209" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 142.787763][ T43] audit: type=1326 audit(1790235291.300:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9057 comm="syz.3.1209" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 143.433155][ T9079] trusted_key: encrypted_key: insufficient parameters specified [ 143.568919][ T9088] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1213'. [ 143.749689][ T9096] netlink: 1092 bytes leftover after parsing attributes in process `syz.3.1221'. [ 143.803390][ T9100] netlink: 70 bytes leftover after parsing attributes in process `syz.3.1223'. [ 143.852409][ T9104] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1225'. [ 144.226147][ T5742] Bluetooth: hci2: command 0x0406 tx timeout [ 144.234297][ T9128] syz.1.1231 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 145.168370][ T9169] netlink: 592 bytes leftover after parsing attributes in process `syz.1.1247'. [ 145.892906][ T1478] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 146.037323][ T1478] usb 6-1: New USB device found, idVendor=a257, idProduct=2013, bcdDevice= 0.01 [ 146.038290][ T1478] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 146.255278][ T1478] dln2 6-1:1.0: USB write failed: -110 [ 146.255297][ T1478] dln2 6-1:1.0: failed to initialize hardware [ 146.258004][ T1478] dln2 6-1:1.0: probe with driver dln2 failed with error -110 [ 146.440015][ T50] usb 6-1: USB disconnect, device number 10 [ 146.650332][ T9199] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1257'. [ 147.387051][ T9258] syz_tun: entered allmulticast mode [ 147.404532][ T9258] syz_tun: left allmulticast mode [ 147.438018][ T9255] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1267'. [ 148.129499][ T9270] device-mapper: ioctl: name not supplied when creating device [ 148.356631][ T9284] netlink: 70 bytes leftover after parsing attributes in process `syz.3.1292'. [ 148.762792][ T9300] tipc: Started in network mode [ 148.762811][ T9300] tipc: Node identity aaaaaaaaaaaa, cluster identity 4711 [ 148.764111][ T9300] tipc: Enabled bearer , priority 0 [ 149.011617][ T9312] syz_tun: entered allmulticast mode [ 149.079392][ T9315] device-mapper: ioctl: name not supplied when creating device [ 149.230899][ T9323] random: crng reseeded on system resumption [ 149.259873][ T9323] Restarting kernel threads ... [ 149.269534][ T9323] Done restarting kernel threads. [ 149.712674][ T853] tipc: Node number set to 43690 [ 149.721743][ T9330] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1312'. [ 150.172655][ T9349] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1318'. [ 150.974108][ T43] audit: type=1326 audit(1790235497.856:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9359 comm="syz.1.1324" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 150.974285][ T43] audit: type=1326 audit(1790235497.856:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9359 comm="syz.1.1324" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 150.974857][ T43] audit: type=1326 audit(1790235497.856:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9359 comm="syz.1.1324" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 150.976791][ T43] audit: type=1326 audit(1790235497.856:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9359 comm="syz.1.1324" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 150.976896][ T43] audit: type=1326 audit(1790235497.856:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9359 comm="syz.1.1324" exe="/syz-executor" sig=0 arch=40000003 syscall=288 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 150.977023][ T43] audit: type=1326 audit(1790235497.856:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9359 comm="syz.1.1324" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 150.977492][ T43] audit: type=1326 audit(1790235497.856:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9359 comm="syz.1.1324" exe="/syz-executor" sig=0 arch=40000003 syscall=436 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 150.977516][ T43] audit: type=1326 audit(1790235497.856:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9359 comm="syz.1.1324" exe="/syz-executor" sig=0 arch=40000003 syscall=252 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 151.594285][ T9392] netlink: 70 bytes leftover after parsing attributes in process `syz.3.1334'. [ 151.642268][ T9394] 9p: Bad value for 'rfdno' [ 152.081886][ T9408] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1340'. [ 152.654828][ T9427] Invalid ELF header type: 3 != 1 [ 153.401376][ T9423] gre0: left promiscuous mode [ 153.401399][ T9423] gre0: left allmulticast mode [ 153.455834][ T5752] Bluetooth: hci3: unexpected event for opcode 0x1003 [ 153.583920][ T9423] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 153.600764][ T9423] macsec1: left promiscuous mode [ 153.600854][ T9423] macsec1: left allmulticast mode [ 153.600862][ T9423] veth0_to_bond: left allmulticast mode [ 154.838444][ T9481] random: crng reseeded on system resumption [ 154.892362][ T9481] Restarting kernel threads ... [ 154.894607][ T9481] Done restarting kernel threads. [ 155.010457][ T9484] binder: 9475:9484 ioctl c0306201 0 returned -14 [ 155.809329][ T5752] Bluetooth: hci3: command 0x0406 tx timeout [ 156.106765][ T43] audit: type=1326 audit(1790235503.231:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9495 comm="syz.0.1369" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 156.106819][ T43] audit: type=1326 audit(1790235503.241:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9495 comm="syz.0.1369" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 156.127786][ T43] audit: type=1326 audit(1790235503.262:28): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9495 comm="syz.0.1369" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 156.127832][ T43] audit: type=1326 audit(1790235503.262:29): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9495 comm="syz.0.1369" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 156.132375][ T43] audit: type=1326 audit(1790235503.262:30): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9495 comm="syz.0.1369" exe="/syz-executor" sig=0 arch=40000003 syscall=374 compat=1 ip=0xf709efec code=0x7ffc0000 [ 156.132457][ T43] audit: type=1326 audit(1790235503.262:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9495 comm="syz.0.1369" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 156.132494][ T43] audit: type=1326 audit(1790235503.262:33): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9495 comm="syz.0.1369" exe="/syz-executor" sig=0 arch=40000003 syscall=436 compat=1 ip=0xf709efec code=0x7ffc0000 [ 156.132527][ T43] audit: type=1326 audit(1790235503.262:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9495 comm="syz.0.1369" exe="/syz-executor" sig=0 arch=40000003 syscall=252 compat=1 ip=0xf709efec code=0x7ffc0000 [ 156.141495][ T43] audit: type=1326 audit(1790235503.262:32): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9495 comm="syz.0.1369" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 157.230005][ T9504] syz_tun: entered allmulticast mode [ 158.666116][ T9485] syz.1.1363 (9485) used greatest stack depth: 18528 bytes left [ 158.717161][ T5751] Bluetooth: hci1: command 0x2016 tx timeout [ 158.717204][ T5751] Bluetooth: hci2: command 0x0406 tx timeout [ 158.717205][ T5100] Bluetooth: hci3: command 0x0406 tx timeout [ 158.927834][ T9525] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1380'. [ 159.393358][ T7396] syz_tun (unregistering): left allmulticast mode [ 159.741155][ T5817] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 159.821007][ T5817] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 159.902350][ T5817] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 160.013026][ T5817] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 160.250445][ T5817] bridge_slave_1: left allmulticast mode [ 160.250480][ T5817] bridge_slave_1: left promiscuous mode [ 160.251150][ T5817] bridge0: port 2(bridge_slave_1) entered disabled state [ 160.275589][ T5817] bridge_slave_0: left allmulticast mode [ 160.275608][ T5817] bridge_slave_0: left promiscuous mode [ 160.277855][ T5817] bridge0: port 1(bridge_slave_0) entered disabled state [ 160.384000][ T5752] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 160.388463][ T5752] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 160.389464][ T5752] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 160.396135][ T5752] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 160.397025][ T5752] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 160.600583][ T6258] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 160.600812][ T5817] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 160.605050][ T5817] bond0 (unregistering): Released all slaves [ 160.637984][ T5454] 8021q: adding VLAN 0 to HW filter on device eth2 [ 160.743348][ T6258] usb 7-1: Using ep0 maxpacket: 16 [ 160.744971][ T6258] usb 7-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 160.749166][ T6258] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 160.749187][ T6258] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 160.751305][ T6258] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 160.751326][ T6258] usb 7-1: Product: syz [ 160.751338][ T6258] usb 7-1: Manufacturer: syz [ 160.751349][ T6258] usb 7-1: SerialNumber: syz [ 160.757396][ T5817] tipc: Disabling bearer [ 160.757795][ T5817] tipc: Left network mode [ 160.765957][ T6258] usb 7-1: config 0 descriptor?? [ 161.025224][ T5454] 8021q: adding VLAN 0 to HW filter on device eth3 [ 161.366958][ T5817] hsr_slave_0: left promiscuous mode [ 161.373748][ T5817] hsr_slave_1: left promiscuous mode [ 161.374198][ T5817] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 161.374219][ T5817] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 161.405349][ T5817] veth1_macvtap: left promiscuous mode [ 161.406163][ T5817] veth0_macvtap: left promiscuous mode [ 161.406264][ T5817] veth1_vlan: left promiscuous mode [ 161.406322][ T5817] veth0_vlan: left promiscuous mode [ 161.798156][ T5817] team0 (unregistering): Port device team_slave_1 removed [ 161.837505][ T5817] team0 (unregistering): Port device team_slave_0 removed [ 161.981070][ T5454] 8021q: adding VLAN 0 to HW filter on device eth4 [ 162.078550][ T43] audit: type=1326 audit(1790235509.519:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9605 comm="syz.3.1400" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 162.078601][ T43] audit: type=1326 audit(1790235509.519:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9605 comm="syz.3.1400" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 162.079098][ T43] audit: type=1326 audit(1790235509.519:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9605 comm="syz.3.1400" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 162.080656][ T43] audit: type=1326 audit(1790235509.519:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9605 comm="syz.3.1400" exe="/syz-executor" sig=0 arch=40000003 syscall=365 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 162.080693][ T43] audit: type=1326 audit(1790235509.519:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9605 comm="syz.3.1400" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 162.080726][ T43] audit: type=1326 audit(1790235509.519:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9605 comm="syz.3.1400" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 162.080757][ T43] audit: type=1326 audit(1790235509.519:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9605 comm="syz.3.1400" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 162.081542][ T43] audit: type=1326 audit(1790235509.519:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9605 comm="syz.3.1400" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 162.081729][ T43] audit: type=1326 audit(1790235509.519:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9605 comm="syz.3.1400" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 162.082594][ T43] audit: type=1326 audit(1790235509.519:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9605 comm="syz.3.1400" exe="/syz-executor" sig=0 arch=40000003 syscall=286 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 162.363221][ T5752] Bluetooth: hci1: command tx timeout [ 162.376595][ T9545] bridge0: port 1(bridge_slave_0) entered blocking state [ 162.376753][ T9545] bridge0: port 1(bridge_slave_0) entered disabled state [ 162.376830][ T9545] bridge_slave_0: entered allmulticast mode [ 162.379708][ T9545] bridge_slave_0: entered promiscuous mode [ 162.389021][ T9545] bridge0: port 2(bridge_slave_1) entered blocking state [ 162.389508][ T9545] bridge0: port 2(bridge_slave_1) entered disabled state [ 162.389623][ T9545] bridge_slave_1: entered allmulticast mode [ 162.398157][ T9545] bridge_slave_1: entered promiscuous mode [ 162.415277][ T9617] fuse: fd is not a fuse device [ 162.594914][ T9545] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 162.596864][ T5454] 8021q: adding VLAN 0 to HW filter on device eth5 [ 162.610500][ T9545] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 162.686816][ T9545] team0: Port device team_slave_0 added [ 162.690063][ T9545] team0: Port device team_slave_1 added [ 162.726470][ T9545] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 162.726482][ T9545] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 162.726499][ T9545] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 162.727961][ T9545] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 162.727973][ T9545] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 162.727993][ T9545] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 162.774408][ T9545] hsr_slave_0: entered promiscuous mode [ 162.782165][ T9545] hsr_slave_1: entered promiscuous mode [ 162.786798][ T9545] debugfs: 'hsr0' already exists in 'hsr' [ 162.786813][ T9545] Cannot create hsr debugfs directory [ 163.108846][ T9634] bridge1: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 163.238974][ T5825] usb 7-1: USB disconnect, device number 10 [ 163.335065][ T9648] capability: warning: `syz.3.1409' uses 32-bit capabilities (legacy support in use) [ 163.437230][ T9655] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1410'. [ 163.437794][ T9655] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1410'. [ 164.353888][ T5752] Bluetooth: hci1: command tx timeout [ 164.655102][ T9545] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 164.707155][ T9545] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 164.708101][ T9545] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 164.727635][ T9545] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 164.728301][ T9545] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 164.763614][ T9545] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 164.776901][ T9545] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 164.800384][ T9545] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 164.931276][ T9708] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1418'. [ 165.047412][ T9545] 8021q: adding VLAN 0 to HW filter on device bond0 [ 165.076277][ T9545] 8021q: adding VLAN 0 to HW filter on device team0 [ 165.089792][ T1162] bridge0: port 1(bridge_slave_0) entered blocking state [ 165.089883][ T1162] bridge0: port 1(bridge_slave_0) entered forwarding state [ 165.099420][ T1162] bridge0: port 2(bridge_slave_1) entered blocking state [ 165.099480][ T1162] bridge0: port 2(bridge_slave_1) entered forwarding state [ 165.174257][ T6563] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 165.317815][ T6563] usb 5-1: Using ep0 maxpacket: 32 [ 165.320869][ T6563] usb 5-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 165.323521][ T6563] usb 5-1: config 0 has an invalid interface number: 188 but max is 0 [ 165.323536][ T6563] usb 5-1: config 0 has no interface number 0 [ 165.323556][ T6563] usb 5-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 165.345862][ T6563] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 165.345877][ T6563] usb 5-1: Product: syz [ 165.345885][ T6563] usb 5-1: Manufacturer: syz [ 165.345892][ T6563] usb 5-1: SerialNumber: syz [ 165.347854][ T6563] usb 5-1: config 0 descriptor?? [ 165.348985][ T9711] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 165.547059][ T9711] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 165.628873][ T9545] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 165.672741][ T9545] veth0_vlan: entered promiscuous mode [ 165.682860][ T9545] veth1_vlan: entered promiscuous mode [ 165.707970][ T9545] veth0_macvtap: entered promiscuous mode [ 165.714475][ T9545] veth1_macvtap: entered promiscuous mode [ 165.727242][ T9545] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 165.734468][ T9545] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 165.763277][ T5817] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 165.763307][ T5817] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 165.763325][ T5817] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 165.763343][ T5817] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 165.786331][ T1161] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 165.786348][ T1161] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 165.827672][ T1161] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 165.827694][ T1161] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 166.325250][ T5753] Bluetooth: hci1: command tx timeout [ 166.576371][ T9777] Bluetooth: MGMT ver 1.23 [ 166.783701][ T5752] Bluetooth: hci3: command 0x0406 tx timeout [ 166.893330][ T6563] asix 5-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 166.893494][ T6563] asix 5-1:0.188: probe with driver asix failed with error -71 [ 166.920251][ T6563] usb 5-1: USB disconnect, device number 7 [ 167.065537][ T9789] netlink: 'syz.3.1431': attribute type 4 has an invalid length. [ 167.224886][ T43] kauditd_printk_skb: 14 callbacks suppressed [ 167.224903][ T43] audit: type=1326 audit(1790235514.915:59): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9796 comm="syz.3.1435" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 167.225049][ T43] audit: type=1326 audit(1790235514.915:60): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9796 comm="syz.3.1435" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 167.226609][ T43] audit: type=1326 audit(1790235514.915:61): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9796 comm="syz.3.1435" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 167.226653][ T43] audit: type=1326 audit(1790235514.915:62): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9796 comm="syz.3.1435" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 167.226688][ T43] audit: type=1326 audit(1790235514.915:63): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9796 comm="syz.3.1435" exe="/syz-executor" sig=0 arch=40000003 syscall=286 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 167.226724][ T43] audit: type=1326 audit(1790235514.915:64): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9796 comm="syz.3.1435" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 167.226760][ T43] audit: type=1326 audit(1790235514.915:65): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9796 comm="syz.3.1435" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 167.227120][ T43] audit: type=1326 audit(1790235514.915:66): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9796 comm="syz.3.1435" exe="/syz-executor" sig=0 arch=40000003 syscall=436 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 167.227324][ T43] audit: type=1326 audit(1790235514.915:67): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9796 comm="syz.3.1435" exe="/syz-executor" sig=0 arch=40000003 syscall=252 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 167.560453][ T9812] binder_alloc: binder_alloc_mmap_handler: 9811 80ffe000-81000000 already mapped failed -16 [ 168.316251][ T5753] Bluetooth: hci1: command tx timeout [ 168.516097][ T6563] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 168.612448][ T853] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 168.659678][ T6563] usb 7-1: New USB device found, idVendor=0596, idProduct=0001, bcdDevice= 1.00 [ 168.660628][ T6563] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 168.755038][ T853] usb 5-1: New USB device found, idVendor=a257, idProduct=2013, bcdDevice= 0.01 [ 168.755799][ T853] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 168.763860][ T5753] Bluetooth: hci3: command 0x0406 tx timeout [ 168.857500][ T9852] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1460'. [ 168.942479][ T9856] bridge0: port 3(wlan1) entered blocking state [ 168.942548][ T9856] bridge0: port 3(wlan1) entered disabled state [ 168.942732][ T9856] mac80211_hwsim hwsim11 wlan1: entered allmulticast mode [ 168.944164][ T9856] mac80211_hwsim hwsim11 wlan1: entered promiscuous mode [ 168.945309][ T9856] bridge0: port 3(wlan1) entered blocking state [ 168.945375][ T9856] bridge0: port 3(wlan1) entered forwarding state [ 168.955113][ T853] dln2 5-1:1.0: USB write failed: -110 [ 168.955129][ T853] dln2 5-1:1.0: failed to initialize hardware [ 168.960425][ T853] dln2 5-1:1.0: probe with driver dln2 failed with error -110 [ 168.969595][ T9856] bridge0: port 3(wlan1) entered disabled state [ 168.973109][ T9856] mac80211_hwsim hwsim11 wlan1 (unregistering): left allmulticast mode [ 168.973127][ T9856] mac80211_hwsim hwsim11 wlan1 (unregistering): left promiscuous mode [ 168.973820][ T9856] bridge0: port 3(wlan1) entered disabled state [ 169.206339][ T3378] usb 5-1: USB disconnect, device number 8 [ 169.627589][ T9869] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 169.627798][ T9869] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 169.860196][ T9879] netlink: 272 bytes leftover after parsing attributes in process `syz.2.1452'. [ 170.066312][ T9887] netlink: 52 bytes leftover after parsing attributes in process `syz.1.1474'. [ 170.345115][ T3378] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 170.488755][ T3378] usb 5-1: New USB device found, idVendor=a257, idProduct=2013, bcdDevice= 0.01 [ 170.490355][ T3378] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 170.697655][ T3378] dln2 5-1:1.0: USB write failed: -110 [ 170.697682][ T3378] dln2 5-1:1.0: failed to initialize hardware [ 170.700653][ T3378] dln2 5-1:1.0: probe with driver dln2 failed with error -110 [ 170.936854][ T35] usb 5-1: USB disconnect, device number 9 [ 171.021475][ T853] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 171.151951][ T6563] usbtouchscreen 7-1:1.0: Failed to read FW rev: -71 [ 171.152152][ T6563] usbtouchscreen 7-1:1.0: probe with driver usbtouchscreen failed with error -71 [ 171.154239][ T6563] usb 7-1: USB disconnect, device number 11 [ 171.184086][ T853] usb 6-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 171.185321][ T853] usb 6-1: config 220 has an invalid interface number: 76 but max is 2 [ 171.185343][ T853] usb 6-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 171.185357][ T853] usb 6-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 171.185373][ T853] usb 6-1: config 220 has no interface number 2 [ 171.185418][ T853] usb 6-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 171.185440][ T853] usb 6-1: config 220 interface 0 has no altsetting 0 [ 171.185455][ T853] usb 6-1: config 220 interface 76 has no altsetting 0 [ 171.185468][ T853] usb 6-1: config 220 interface 1 has no altsetting 0 [ 171.187494][ T853] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 171.187513][ T853] usb 6-1: Product: syz [ 171.187524][ T853] usb 6-1: Manufacturer: syz [ 171.187537][ T853] usb 6-1: SerialNumber: syz [ 171.387430][ T853] uvcvideo 6-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 171.387450][ T853] uvcvideo 6-1:220.0: No valid video chain found. [ 171.387475][ T853] usb 6-1: selecting invalid altsetting 0 [ 171.399276][ T853] usb 6-1: selecting invalid altsetting 0 [ 171.399292][ T853] usbtest 6-1:220.1: probe with driver usbtest failed with error -22 [ 171.400224][ T853] usb 6-1: USB disconnect, device number 11 [ 171.667003][ T9936] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1497'. [ 171.667044][ T9936] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1497'. [ 171.669258][ T1036] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 171.821702][ T1036] usb 7-1: Using ep0 maxpacket: 16 [ 171.822907][ T1036] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 171.823784][ T1036] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 171.823801][ T1036] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 171.823832][ T1036] usb 7-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 171.825404][ T1036] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 171.825416][ T1036] usb 7-1: Product: syz [ 171.825424][ T1036] usb 7-1: Manufacturer: syz [ 171.825431][ T1036] usb 7-1: SerialNumber: syz [ 171.941987][ T9947] kvm: requested 51961 ns i8254 timer period limited to 200000 ns [ 171.946313][ T9947] kvm: requested 8380 ns i8254 timer period limited to 200000 ns [ 171.967820][ T9947] kvm: requested 74590 ns i8254 timer period limited to 200000 ns [ 171.968757][ T9947] kvm: requested 151695 ns i8254 timer period limited to 200000 ns [ 171.969735][ T9947] kvm: requested 14247 ns i8254 timer period limited to 200000 ns [ 171.975428][ T9947] kvm: requested 25142 ns i8254 timer period limited to 200000 ns [ 171.978363][ T9947] kvm: requested 81295 ns i8254 timer period limited to 200000 ns [ 171.999434][ T9947] kvm: requested 177676 ns i8254 timer period limited to 200000 ns [ 172.043482][ T1036] cdc_ncm 7-1:1.0: CDC Union missing and no IAD found [ 172.043505][ T1036] cdc_ncm 7-1:1.0: bind() failure [ 172.047806][ T1036] usb 7-1: USB disconnect, device number 12 [ 172.307922][ T9967] Invalid ELF header type: 3 != 1 [ 172.312750][ T9967] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 172.344580][ T9967] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 172.486577][ T43] audit: type=1326 audit(1790235520.437:68): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9975 comm="syz.3.1512" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 172.486791][ T43] audit: type=1326 audit(1790235520.437:69): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9975 comm="syz.3.1512" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 172.487387][ T43] audit: type=1326 audit(1790235520.437:70): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9975 comm="syz.3.1512" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 172.487629][ T43] audit: type=1326 audit(1790235520.437:71): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9975 comm="syz.3.1512" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 172.487668][ T43] audit: type=1326 audit(1790235520.437:72): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9975 comm="syz.3.1512" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 172.487873][ T43] audit: type=1326 audit(1790235520.437:73): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9975 comm="syz.3.1512" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 172.497329][ T43] audit: type=1326 audit(1790235520.437:74): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9975 comm="syz.3.1512" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 172.535965][ T43] audit: type=1326 audit(1790235520.437:75): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9975 comm="syz.3.1512" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 172.536184][ T43] audit: type=1326 audit(1790235520.500:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9975 comm="syz.3.1512" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 172.536604][ T43] audit: type=1326 audit(1790235520.500:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9975 comm="syz.3.1512" exe="/syz-executor" sig=0 arch=40000003 syscall=365 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 173.373073][T10002] capability: warning: `syz.2.1522' uses deprecated v2 capabilities in a way that may be insecure [ 173.380010][T10002] Bluetooth: MGMT ver 1.23 [ 174.641049][ T35] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 174.787689][ T35] usb 5-1: unable to get BOS descriptor or descriptor too short [ 174.787714][ T35] usb 5-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 174.788709][ T35] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 174.788729][ T35] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 174.788764][ T35] usb 5-1: too many endpoints for config 1 interface 1 altsetting 76: 188, using maximum allowed: 30 [ 174.788793][ T35] usb 5-1: config 1 interface 1 altsetting 76 has 0 endpoint descriptors, different from the interface descriptor's value: 188 [ 174.788881][ T35] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 174.788903][ T35] usb 5-1: config 1 interface 1 has no altsetting 0 [ 174.830348][ T35] usb 5-1: string descriptor 0 read error: -22 [ 174.830453][ T35] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 175.682993][T10083] ptrace attach of "/syz-executor exec"[9545] was attempted by "/syz-executor exec"[10083] [ 175.853902][ T35] usb 5-1: 2:0: failed to get current value for ch 1 (-71) [ 175.859772][ T35] usb 5-1: Warning! Unlikely small volume range (=207), linear volume or custom curve? [ 175.859786][ T35] usb 5-1: [2] FU [Speaker Playback Volume] ch = 1, val = 0/207/1 [ 176.124134][ T35] usb 5-1: USB disconnect, device number 10 [ 176.215873][ T5752] Bluetooth: hci3: unexpected event for opcode 0x0c23 [ 176.665710][T10109] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1558'. [ 177.021962][T10127] syz_tun: entered allmulticast mode [ 177.435589][T10145] Invalid ELF header type: 3 != 1 [ 177.898791][ T5825] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 177.965553][ T2329] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 177.994041][ T5752] Bluetooth: hci2: command 0x0406 tx timeout [ 178.118724][ T5825] usb 5-1: New USB device found, idVendor=056a, idProduct=00ed, bcdDevice= 0.00 [ 178.119839][ T5825] usb 5-1: config 0 interface 0 altsetting 129 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 178.119866][ T5825] usb 5-1: config 0 interface 0 has no altsetting 0 [ 178.119892][ T5825] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 178.122771][ T5825] usb 5-1: config 0 descriptor?? [ 178.185042][ T2329] usb 6-1: New USB device found, idVendor=04d8, idProduct=f372, bcdDevice= 0.00 [ 178.186062][ T2329] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 254, changing to 11 [ 178.186079][ T2329] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 178.186098][ T2329] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 178.191350][ T2329] usb 6-1: config 0 descriptor?? [ 178.287738][T10173] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1585'. [ 178.578266][ T2329] hid (null): global environment stack underflow [ 178.590415][ T2329] hid_parser_main: 5 callbacks suppressed [ 178.590430][ T2329] hid-led 0003:04D8:F372.0004: unknown main item tag 0x0 [ 178.590444][ T2329] hid-led 0003:04D8:F372.0004: global environment stack underflow [ 178.590451][ T2329] hid-led 0003:04D8:F372.0004: item 0 4 1 11 parsing failed [ 178.590743][ T2329] hid-led 0003:04D8:F372.0004: probe with driver hid-led failed with error -22 [ 178.596363][ T5752] Bluetooth: hci0: command 0x0406 tx timeout [ 178.702757][ T853] usb 5-1: USB disconnect, device number 11 [ 178.768929][ T6258] usb 6-1: USB disconnect, device number 12 [ 178.994218][ T2329] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 179.002922][ T5753] Bluetooth: hci3: unexpected event for opcode 0x0c23 [ 179.137099][ T2329] usb 7-1: Using ep0 maxpacket: 16 [ 179.140119][ T5753] Bluetooth: hci2: Malformed LE Event: 0x0d [ 179.141417][ T2329] usb 7-1: unable to get BOS descriptor or descriptor too short [ 179.141440][ T2329] usb 7-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice=6e.00 [ 179.141459][ T2329] usb 7-1: too many configurations: 216, using maximum allowed: 8 [ 179.142065][ T2329] usb 7-1: unable to read config index 0 descriptor/start: -71 [ 179.142082][ T2329] usb 7-1: can't read configurations, error -71 [ 180.783522][T10221] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1603'. [ 181.016476][T10225] synth uevent: /bus/acpi: unknown uevent action string [ 181.133549][ T5753] Bluetooth: hci0: unexpected event for opcode 0x2005 [ 181.381427][T10243] fuse: fd is not a fuse device [ 181.656803][T10260] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1619'. [ 181.657748][T10260] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1619'. [ 181.693447][T10264] Bluetooth: hci0: invalid length 0, exp 2 for type 8 [ 182.004440][ T5841] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 182.045571][T10284] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1630'. [ 182.046416][T10284] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1630'. [ 182.124628][T10287] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1631'. [ 182.147214][ T5841] usb 6-1: Using ep0 maxpacket: 32 [ 182.148024][ T5841] usb 6-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 182.149152][ T5841] usb 6-1: config 0 has an invalid interface number: 188 but max is 0 [ 182.149172][ T5841] usb 6-1: config 0 has no interface number 0 [ 182.149208][ T5841] usb 6-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 182.151480][ T5841] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 182.151500][ T5841] usb 6-1: Product: syz [ 182.151512][ T5841] usb 6-1: Manufacturer: syz [ 182.151527][ T5841] usb 6-1: SerialNumber: syz [ 182.154282][ T5841] usb 6-1: config 0 descriptor?? [ 182.155136][T10274] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 182.369662][T10274] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 182.374852][ T5841] asix 6-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 182.375034][ T5841] asix 6-1:0.188: probe with driver asix failed with error -71 [ 182.382275][ T5841] usb 6-1: USB disconnect, device number 13 [ 182.709259][ T5752] Bluetooth: hci1: command 0x2016 tx timeout [ 182.719284][T10319] Device name cannot be null; rc = [-22] [ 182.918773][ T6258] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 183.061614][ T6258] usb 5-1: Using ep0 maxpacket: 16 [ 183.064927][ T6258] usb 5-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 183.067249][ T6258] usb 5-1: config 0 has an invalid interface number: 34 but max is 0 [ 183.067262][ T6258] usb 5-1: config 0 has no interface number 0 [ 183.067280][ T6258] usb 5-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 183.067291][ T6258] usb 5-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 183.069045][ T6258] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 183.069057][ T6258] usb 5-1: Product: syz [ 183.069064][ T6258] usb 5-1: Manufacturer: syz [ 183.069072][ T6258] usb 5-1: SerialNumber: syz [ 183.076039][ T6258] usb 5-1: config 0 descriptor?? [ 183.077538][T10317] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 183.077591][T10317] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 183.271199][T10317] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 183.271257][T10317] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 183.464849][ T6258] asix 5-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 183.660661][ T6258] asix 5-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 183.660680][ T6258] asix 5-1:0.34 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffe0 [ 183.660787][ T6258] asix 5-1:0.34: probe with driver asix failed with error -32 [ 183.805738][T10356] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1661'. [ 183.806386][T10356] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1661'. [ 184.004698][ T5742] Bluetooth: hci2: command 0x0406 tx timeout [ 184.797704][T10384] input: syz1 as /devices/virtual/input/input13 [ 184.975396][ T5742] Bluetooth: hci3: unexpected event for opcode 0x2005 [ 185.249211][T10415] netlink: 'syz.2.1687': attribute type 4 has an invalid length. [ 185.256418][T10415] netlink: 'syz.2.1687': attribute type 4 has an invalid length. [ 185.303403][T10417] Bluetooth: hci0: invalid length 0, exp 2 for type 20 [ 185.533128][T10431] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1695'. [ 185.535120][ T1478] usb 5-1: USB disconnect, device number 12 [ 185.776489][ T1036] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 185.919362][ T1036] usb 6-1: Using ep0 maxpacket: 16 [ 185.926450][ T1036] usb 6-1: unable to get BOS descriptor or descriptor too short [ 185.926476][ T1036] usb 6-1: New USB device found, idVendor=1477, idProduct=1026, bcdDevice= 0.40 [ 185.927523][ T1036] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 185.927552][ T1036] usb 6-1: can't read configurations, error -71 [ 186.231968][T10448] fuse: fd is not a fuse device [ 186.681329][ T5752] Bluetooth: hci1: command 0x2016 tx timeout [ 187.054063][T10490] binder: 10489:10490 unknown command 1074815763 [ 187.054078][T10490] binder: 10489:10490 ioctl c0306201 800008c0 returned -22 [ 187.426807][T10507] syzkaller0: entered promiscuous mode [ 187.426823][T10507] syzkaller0: entered allmulticast mode [ 187.490441][T10509] netlink: 'syz.2.1723': attribute type 4 has an invalid length. [ 187.976901][ T5742] Bluetooth: hci2: command 0x0406 tx timeout [ 188.013001][T10528] fuse: fd is not a fuse device [ 188.511666][T10546] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1738'. [ 188.512563][T10546] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1738'. [ 189.649584][T10615] fuse: fd is not a fuse device [ 189.672387][ T5825] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 189.816660][ T5825] usb 7-1: New USB device found, idVendor=0a5c, idProduct=21e8, bcdDevice= 1.00 [ 189.817402][ T5825] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 189.817428][ T5825] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 189.817440][ T5825] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 189.817458][ T5825] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 189.819291][T10604] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 189.819346][T10604] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 190.034536][ T853] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 190.136289][ T5742] Bluetooth: hci4: Opcode 0x0c03 failed: -71 [ 190.136936][ T1478] usb 7-1: USB disconnect, device number 15 [ 190.177957][ T853] usb 5-1: New USB device found, idVendor=056a, idProduct=0307, bcdDevice= 0.00 [ 190.178876][ T853] usb 5-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 167, changing to 11 [ 190.178901][ T853] usb 5-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 190.178921][ T853] usb 5-1: config 0 interface 0 has no altsetting 0 [ 190.178944][ T853] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 190.180810][ T853] usb 5-1: config 0 descriptor?? [ 190.399312][T10633] netlink: 'syz.1.1774': attribute type 4 has an invalid length. [ 190.449332][T10635] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1775'. [ 190.762834][ T5848] usb 5-1: USB disconnect, device number 13 [ 190.809625][ T5753] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 190.812262][ T5753] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 190.812860][ T5753] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 190.813317][ T5753] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 190.813602][ T5753] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 190.864519][ T1438] ieee802154 phy0 wpan0: encryption failed: -22 [ 190.864568][ T1438] ieee802154 phy1 wpan1: encryption failed: -22 [ 190.938985][T10071] tipc: Resetting bearer [ 190.962778][T10071] syz_tun (unregistering): left allmulticast mode [ 190.963535][T10071] tipc: Disabling bearer [ 191.145691][ T5592] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 191.205429][ T5592] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 191.283300][ T5592] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 191.300401][T10648] bridge0: port 1(bridge_slave_0) entered blocking state [ 191.300470][T10648] bridge0: port 1(bridge_slave_0) entered disabled state [ 191.300526][T10648] bridge_slave_0: entered allmulticast mode [ 191.301327][T10648] bridge_slave_0: entered promiscuous mode [ 191.302543][T10648] bridge0: port 2(bridge_slave_1) entered blocking state [ 191.302608][T10648] bridge0: port 2(bridge_slave_1) entered disabled state [ 191.302662][T10648] bridge_slave_1: entered allmulticast mode [ 191.303364][T10648] bridge_slave_1: entered promiscuous mode [ 191.315993][T10648] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 191.317340][T10648] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 191.329453][T10648] team0: Port device team_slave_0 added [ 191.330771][T10648] team0: Port device team_slave_1 added [ 191.345676][T10648] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 191.345687][T10648] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 191.345701][T10648] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 191.346500][T10648] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 191.346508][T10648] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 191.346520][T10648] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 191.379368][ T5592] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 191.393317][T10648] hsr_slave_0: entered promiscuous mode [ 191.393870][T10648] hsr_slave_1: entered promiscuous mode [ 191.394196][T10648] debugfs: 'hsr0' already exists in 'hsr' [ 191.394247][T10648] Cannot create hsr debugfs directory [ 191.610832][ T5592] bridge_slave_1: left allmulticast mode [ 191.610855][ T5592] bridge_slave_1: left promiscuous mode [ 191.611019][ T5592] bridge0: port 2(bridge_slave_1) entered disabled state [ 191.627785][ T5592] bridge_slave_0: left allmulticast mode [ 191.627928][ T5592] bridge_slave_0: left promiscuous mode [ 191.628058][ T5592] bridge0: port 1(bridge_slave_0) entered disabled state [ 191.758665][ T5592] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 191.762946][ T5592] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 191.763775][ T5592] bond0 (unregistering): Released all slaves [ 191.847848][ T5592] tipc: Left network mode [ 192.066576][ T5454] 8021q: adding VLAN 0 to HW filter on device eth2 [ 192.178551][ T5592] hsr_slave_0: left promiscuous mode [ 192.179295][ T5592] hsr_slave_1: left promiscuous mode [ 192.179921][ T5592] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 192.179937][ T5592] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 192.196418][ T5592] veth1_macvtap: left promiscuous mode [ 192.196459][ T5592] veth0_macvtap: left promiscuous mode [ 192.200593][ T5592] veth1_vlan: left promiscuous mode [ 192.200659][ T5592] veth0_vlan: left promiscuous mode [ 192.506447][ T5592] team0 (unregistering): Port device team_slave_1 removed [ 192.513772][ T5592] team0 (unregistering): Port device team_slave_0 removed [ 192.770204][ T5742] Bluetooth: hci4: command tx timeout [ 192.870312][T10648] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 192.872630][T10648] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 192.878849][T10648] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 192.887987][T10648] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 192.888471][T10648] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 192.897467][T10648] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 192.900603][T10648] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 192.910356][T10648] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 193.035882][T10648] 8021q: adding VLAN 0 to HW filter on device bond0 [ 193.050643][T10648] 8021q: adding VLAN 0 to HW filter on device team0 [ 193.058597][ T9749] bridge0: port 1(bridge_slave_0) entered blocking state [ 193.058651][ T9749] bridge0: port 1(bridge_slave_0) entered forwarding state [ 193.062366][ T9749] bridge0: port 2(bridge_slave_1) entered blocking state [ 193.062438][ T9749] bridge0: port 2(bridge_slave_1) entered forwarding state [ 193.093041][T10648] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 193.394519][T10648] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 193.454780][T10648] veth0_vlan: entered promiscuous mode [ 193.466229][T10648] veth1_vlan: entered promiscuous mode [ 193.487773][T10648] veth0_macvtap: entered promiscuous mode [ 193.490545][T10648] veth1_macvtap: entered promiscuous mode [ 193.505571][T10648] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 193.512077][T10648] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 193.622752][ T38] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 193.622768][ T38] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 193.673667][ T5816] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 193.673895][ T5816] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 193.673914][ T5816] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 193.673935][ T5816] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 193.681694][ T38] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 193.681714][ T38] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 194.033383][T10758] netlink: 'syz.2.1804': attribute type 4 has an invalid length. [ 194.241128][T10759] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 194.749765][ T5742] Bluetooth: hci4: command tx timeout [ 195.045082][ T6563] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 195.088526][T10780] netlink: 'syz.0.1813': attribute type 4 has an invalid length. [ 195.138981][T10783] zram0: detected capacity change from 0 to 8 [ 195.188563][ T6563] usb 7-1: New USB device found, idVendor=a257, idProduct=2013, bcdDevice= 0.01 [ 195.189344][ T6563] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 195.189357][ T6563] usb 7-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 195.189373][ T6563] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 195.318797][T10791] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1817'. [ 195.660465][T10798] Invalid ELF header type: 3 != 1 [ 196.389280][T10814] netlink: 588 bytes leftover after parsing attributes in process `syz.3.1825'. [ 196.389297][T10814] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1825'. [ 196.618880][T10827] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1828'. [ 196.627537][T10827] bridge0: port 2(bridge_slave_1) entered disabled state [ 196.638298][T10827] bridge_slave_1 (unregistering): left allmulticast mode [ 196.638314][T10827] bridge_slave_1 (unregistering): left promiscuous mode [ 196.638353][T10827] bridge0: port 2(bridge_slave_1) entered disabled state [ 196.732302][ T5742] Bluetooth: hci4: command tx timeout [ 196.780098][T10833] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1831'. [ 196.783813][T10833] bond0: (slave bond_slave_0): Releasing backup interface [ 196.849819][T10833] bond_slave_0: entered promiscuous mode [ 196.849835][T10833] bond_slave_0: entered allmulticast mode [ 197.636120][ T1036] usb 7-1: USB disconnect, device number 16 [ 197.714181][T10865] configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() [ 197.716854][T10865] configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP [ 197.731931][T10865] udc dummy_udc.0: failed to start g1: -22 [ 197.731950][T10865] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 197.746012][T10865] UDC core: g1: couldn't find an available UDC or it's busy [ 198.712218][ T5742] Bluetooth: hci4: command tx timeout [ 198.912971][T10882] netlink: 'syz.2.1845': attribute type 4 has an invalid length. [ 199.712338][ T50] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 199.856627][ T50] usb 8-1: New USB device found, idVendor=a257, idProduct=2013, bcdDevice= 0.01 [ 199.857553][ T50] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 199.857566][ T50] usb 8-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 199.857583][ T50] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 200.046057][T10907] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(7.0.0), cmd(10) [ 200.047303][ T43] kauditd_printk_skb: 32 callbacks suppressed [ 200.047325][ T43] audit: type=1326 audit(1790235549.380:110): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10904 comm="syz.0.1853" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf709efec code=0x0 [ 201.470588][T10930] UDC core: g1: couldn't find an available UDC or it's busy [ 201.491761][T10932] binder: 10931:10932 ioctl c018620c 80000240 returned -22 [ 201.572550][T10936] netlink: 'syz.2.1863': attribute type 4 has an invalid length. [ 202.305975][ T50] usb 8-1: USB disconnect, device number 3 [ 203.256819][ T2329] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 203.427810][ T2329] usb 6-1: New USB device found, idVendor=a257, idProduct=2013, bcdDevice= 0.01 [ 203.429728][ T2329] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 203.429750][ T2329] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 203.429780][ T2329] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 203.954128][T10991] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1882'. [ 203.954146][T10991] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1882'. [ 204.247520][T10998] Invalid ELF header type: 3 != 1 [ 204.252453][T10998] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 204.276898][T10998] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 204.543429][T11004] configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() [ 204.543471][T11004] configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP [ 204.543538][T11004] udc dummy_udc.0: failed to start g1: -22 [ 204.543550][T11004] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 204.549331][T11004] UDC core: g1: couldn't find an available UDC or it's busy [ 204.656094][ T5742] Bluetooth: hci2: command 0x0406 tx timeout [ 205.357360][T11018] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1891'. [ 205.830175][T11045] Invalid ELF header type: 3 != 1 [ 205.858015][ T50] usb 6-1: USB disconnect, device number 16 [ 206.949324][T11081] syzkaller0: entered promiscuous mode [ 206.949341][T11081] syzkaller0: entered allmulticast mode [ 206.987782][T11081] syzkaller0: tun_net_xmit 1280 [ 206.987852][T11081] syzkaller0: create flow: hash 3318805410 index 0 [ 207.858784][ T5742] Bluetooth: hci1: command tx timeout [ 208.487757][T11092] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1918'. [ 208.506083][T11080] syzkaller0 (unregistered): delete flow: hash 3318805410 index 0 [ 208.600907][T11122] loop3: detected capacity change from 0 to 7 [ 208.611843][T11122] Dev loop3: unable to read RDB block 7 [ 208.611874][T11122] loop3: unable to read partition table [ 208.612015][T11122] loop3: partition table beyond EOD, truncated [ 208.612049][T11122] loop_reread_partitions: partition scan of loop3 (þ被xü—ŸÑà– ) failed (rc=-5) [ 208.628308][ T5742] Bluetooth: hci2: command 0x0406 tx timeout [ 209.077515][T11172] FAULT_INJECTION: forcing a failure. [ 209.077515][T11172] name failslab, interval 1, probability 0, space 0, times 0 [ 209.077537][T11172] CPU: 1 UID: 0 PID: 11172 Comm: syz.1.1947 Not tainted syzkaller #0 PREEMPT(full) [ 209.077550][T11172] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 209.077557][T11172] Call Trace: [ 209.077561][T11172] [ 209.077565][T11172] dump_stack_lvl+0x100/0x190 [ 209.077585][T11172] should_fail_ex.cold+0x5/0xa [ 209.077603][T11172] should_failslab+0xc2/0x120 [ 209.077621][T11172] kmem_cache_alloc_noprof+0x92/0x6a0 [ 209.077635][T11172] ? radix_tree_node_alloc.constprop.0+0x81/0x360 [ 209.077657][T11172] radix_tree_node_alloc.constprop.0+0x81/0x360 [ 209.077678][T11172] idr_get_free+0x52e/0xa00 [ 209.077701][T11172] idr_alloc_u32+0x1ac/0x320 [ 209.077714][T11172] ? __pfx_idr_alloc_u32+0x10/0x10 [ 209.077727][T11172] ? lock_acquire+0x1d1/0x380 [ 209.077743][T11172] ? __radix_tree_preload+0x7c/0x820 [ 209.077775][T11172] idr_alloc_cyclic+0x10b/0x230 [ 209.077791][T11172] ? __pfx_idr_alloc_cyclic+0x10/0x10 [ 209.077802][T11172] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 209.077814][T11172] ? kfree+0x1e5/0x6d0 [ 209.077826][T11172] map_create+0x1698/0x30d0 [ 209.077850][T11172] ? __pfx_map_create+0x10/0x10 [ 209.077869][T11172] ? lock_acquire+0x1d1/0x380 [ 209.077885][T11172] ? __might_fault+0xc5/0x140 [ 209.077898][T11172] ? __might_fault+0xc5/0x140 [ 209.077914][T11172] __sys_bpf+0x12a0/0x4a30 [ 209.077932][T11172] ? __pfx___sys_bpf+0x10/0x10 [ 209.077944][T11172] ? find_held_lock+0x2b/0x80 [ 209.077956][T11172] ? futex_wake+0x4ea/0x5e0 [ 209.077979][T11172] ? rcu_read_lock_any_held+0x6a/0x90 [ 209.077993][T11172] ? find_held_lock+0x2b/0x80 [ 209.078005][T11172] ? ksys_write+0x190/0x250 [ 209.078017][T11172] ? ksys_write+0x190/0x250 [ 209.078036][T11172] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 209.078049][T11172] ? __ia32_sys_futex_time32+0x2fd/0x470 [ 209.078063][T11172] ? fput+0x7c/0x100 [ 209.078077][T11172] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 209.078090][T11172] ? ksys_write+0x1ac/0x250 [ 209.078104][T11172] ? __ia32_sys_bpf+0xcc/0x170 [ 209.078116][T11172] __ia32_sys_bpf+0xcc/0x170 [ 209.078129][T11172] ? __do_fast_syscall_32+0xb3/0x8b0 [ 209.078143][T11172] __do_fast_syscall_32+0x13a/0x8b0 [ 209.078155][T11172] ? lockdep_hardirqs_on+0x7d/0x110 [ 209.078167][T11172] do_fast_syscall_32+0x32/0x70 [ 209.078180][T11172] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 209.078195][T11172] RIP: 0023:0xf7fb2fec [ 209.078208][T11172] Code: Unable to access opcode bytes at 0xf7fb2fc2. [ 209.078214][T11172] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 209.078227][T11172] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080000740 [ 209.078235][T11172] RDX: 0000000000000050 RSI: 0000000000000000 RDI: 0000000000000000 [ 209.078243][T11172] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 209.078250][T11172] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 209.078259][T11172] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 209.078274][T11172] [ 209.390664][T11187] [ 209.393573][T11187] ============================= [ 209.395338][T11187] WARNING: suspicious RCU usage [ 209.396938][T11187] syzkaller #0 Not tainted [ 209.399030][T11187] ----------------------------- [ 209.400993][T11187] kernel/events/callchain.c:163 suspicious rcu_dereference_check() usage! [ 209.403979][T11187] [ 209.403979][T11187] other info that might help us debug this: [ 209.403979][T11187] [ 209.407501][T11187] [ 209.407501][T11187] rcu_scheduler_active = 2, debug_locks = 1 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 209.410472][T11187] locks held by syz.2.1954/11187: 1, last CPU#0: [ 209.412997][T11187] #0: ffffffff8edeb4f8 (rcu_tasks_trace_srcu_struct){....}-{0:0}, at: bpf_prog_test_run_syscall+0x301/0xb30 [ 209.416763][T11187] [ 209.416763][T11187] stack backtrace: [ 209.418614][T11187] CPU: 0 UID: 0 PID: 11187 Comm: syz.2.1954 Not tainted syzkaller #0 PREEMPT(full) [ 209.421551][T11187] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 209.424874][T11187] Call Trace: [ 209.426040][T11187] [ 209.427273][T11187] dump_stack_lvl+0x100/0x190 [ 209.428607][ T50] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 209.431215][T11187] lockdep_rcu_suspicious.cold+0x4f/0xb2 [ 209.433079][T11187] get_callchain_entry+0x278/0x3f0 [ 209.434748][T11187] get_perf_callchain+0x2d6/0x9c0 [ 209.436443][T11187] ? finish_task_switch.isra.0+0x240/0x10d0 [ 209.438371][T11187] ? __pfx_get_perf_callchain+0x10/0x10 [ 209.440486][T11187] ? finish_task_switch.isra.0+0x2c2/0x10d0 [ 209.442897][T11187] ? rcu_is_watching+0x13/0xc0 [ 209.444914][T11187] __bpf_get_stack+0x34a/0x7f0 [ 209.446995][T11187] ? __pfx___bpf_get_stack+0x10/0x10 [ 209.449227][T11187] bpf_get_stack_raw_tp+0x1dd/0x280 [ 209.451312][T11187] bpf_prog_42db8cfdf50901c9+0x46/0x4e [ 209.453665][T11187] bpf_prog_test_run_syscall+0x4ba/0xb30 [ 209.456193][T11187] ? __pfx_bpf_prog_test_run_syscall+0x10/0x10 [ 209.458938][T11187] ? fput+0x7c/0x100 [ 209.460676][T11187] ? __bpf_prog_get+0x97/0x290 [ 209.462742][T11187] ? __pfx_bpf_prog_test_run_syscall+0x10/0x10 [ 209.465284][T11187] __sys_bpf+0x2265/0x4a30 [ 209.467173][T11187] ? __pfx___sys_bpf+0x10/0x10 [ 209.468975][T11187] ? find_held_lock+0x2b/0x80 [ 209.470940][T11187] ? futex_wake+0x4ea/0x5e0 [ 209.472688][T11187] ? find_held_lock+0x2b/0x80 [ 209.474416][T11187] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 209.476522][T11187] ? xfd_validate_state+0x129/0x190 [ 209.478541][T11187] ? __ia32_sys_bpf+0xcc/0x170 [ 209.480514][T11187] __ia32_sys_bpf+0xcc/0x170 [ 209.482418][T11187] ? __do_fast_syscall_32+0xb3/0x8b0 [ 209.484722][T11187] __do_fast_syscall_32+0x13a/0x8b0 [ 209.487012][T11187] do_fast_syscall_32+0x32/0x70 [ 209.489120][T11187] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 209.491301][T11187] RIP: 0023:0xf702efec [ 209.492638][T11187] Code: Unable to access opcode bytes at 0xf702efc2. [ 209.494770][T11187] RSP: 002b:00000000f541d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 209.497386][T11187] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 00000000800004c0 [ 209.499990][T11187] RDX: 000000000000000c RSI: 0000000000000000 RDI: 0000000000000000 [ 209.502555][T11187] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 209.505345][T11187] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 209.508080][T11187] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 209.510744][T11187] [ 209.593501][ T50] usb 6-1: device descriptor read/all, error -71 [ 209.749893][T11142] syz_tun (unregistering): left allmulticast mode [ 209.918644][ T5817] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 210.008235][ T5817] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 210.116004][ T5817] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 210.180346][ T5817] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 210.270748][ T5817] bridge_slave_0: left allmulticast mode [ 210.270776][ T5817] bridge_slave_0: left promiscuous mode [ 210.270947][ T5817] bridge0: port 1(bridge_slave_0) entered disabled state [ 210.384747][ T5817] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 210.386263][ T5817] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 210.387090][ T5817] bond0 (unregistering): Released all slaves [ 210.395362][ T5817] bond1 (unregistering): (slave dummy0): Removing an active aggregator [ 210.395882][ T5817] bond1 (unregistering): (slave dummy0): Releasing backup interface [ 210.409333][ T5817] bond1 (unregistering): Released all slaves [ 210.586501][ T5454] 8021q: adding VLAN 0 to HW filter on device eth2 [ 210.650524][ T5817] hsr_slave_0: left promiscuous mode [ 210.651231][ T5817] hsr_slave_1: left promiscuous mode [ 210.653674][ T5817] veth1_macvtap: left promiscuous mode [ 210.653723][ T5817] veth0_macvtap: left promiscuous mode [ 210.653800][ T5817] veth1_vlan: left promiscuous mode [ 210.768884][ T5817] team0 (unregistering): Port device team_slave_1 removed [ 210.777554][ T5817] team0 (unregistering): Port device team_slave_0 removed [ 210.855922][ T5454] 8021q: adding VLAN 0 to HW filter on device eth3 [ 211.070009][ T5454] 8021q: adding VLAN 0 to HW filter on device eth4 [ 211.246843][ T5454] 8021q: adding VLAN 0 to HW filter on device eth5 [ 211.279793][ T5817] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 211.367581][ T5817] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 211.444299][ T5817] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 211.514062][ T5817] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 211.674352][ T5817] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 211.747545][ T5817] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 211.849268][ T5817] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 211.854133][ T5454] 8021q: adding VLAN 0 to HW filter on device eth6 [ 211.891145][ T5817] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 212.033184][ T5817] bridge_slave_1: left allmulticast mode [ 212.033202][ T5817] bridge_slave_1: left promiscuous mode [ 212.033859][ T5817] bridge0: port 2(bridge_slave_1) entered disabled state [ 212.035593][ T5817] bridge_slave_0: left allmulticast mode [ 212.035606][ T5817] bridge_slave_0: left promiscuous mode [ 212.035712][ T5817] bridge0: port 1(bridge_slave_0) entered disabled state [ 212.047592][ T5817] bridge_slave_1: left allmulticast mode [ 212.047608][ T5817] bridge_slave_1: left promiscuous mode [ 212.047707][ T5817] bridge0: port 2(bridge_slave_1) entered disabled state [ 212.056025][ T5817] bridge_slave_0: left allmulticast mode [ 212.056042][ T5817] bridge_slave_0: left promiscuous mode [ 212.056129][ T5817] bridge0: port 1(bridge_slave_0) entered disabled state [ 212.170788][ T5817] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 212.171864][ T5817] bond0 (unregistering): Released all slaves [ 212.233376][ T5817] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 212.234848][ T5817] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 212.235668][ T5817] bond0 (unregistering): Released all slaves [ 212.240581][ T5454] 8021q: adding VLAN 0 to HW filter on device eth7 [ 212.411048][ T5454] 8021q: adding VLAN 0 to HW filter on device eth8 [ 212.578432][ T5817] hsr_slave_0: left promiscuous mode [ 212.579331][ T5817] hsr_slave_1: left promiscuous mode [ 212.580056][ T5817] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 212.580072][ T5817] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 212.591897][ T5817] hsr_slave_0: left promiscuous mode [ 212.592624][ T5817] hsr_slave_1: left promiscuous mode [ 212.593344][ T5817] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 212.593361][ T5817] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 212.608954][ T5817] veth1_macvtap: left promiscuous mode [ 212.609020][ T5817] veth0_macvtap: left promiscuous mode [ 212.609107][ T5817] veth1_vlan: left promiscuous mode [ 212.609159][ T5817] veth0_vlan: left promiscuous mode [ 212.617610][ T5817] veth1_macvtap: left promiscuous mode [ 212.617722][ T5817] veth0_macvtap: left promiscuous mode [ 212.617812][ T5817] veth1_vlan: left promiscuous mode [ 212.617885][ T5817] veth0_vlan: left promiscuous mode [ 212.816979][ T5817] team0 (unregistering): Port device team_slave_1 removed [ 212.825693][ T5817] team0 (unregistering): Port device team_slave_0 removed [ 213.005089][ T5817] team0 (unregistering): Port device team_slave_1 removed [ 213.018558][ T5817] team0 (unregistering): Port device team_slave_0 removed [ 213.088576][ T5454] 8021q: adding VLAN 0 to HW filter on device eth9 [ 213.281574][ T5454] 8021q: adding VLAN 0 to HW filter on device eth10 [ 213.446338][ T5454] 8021q: adding VLAN 0 to HW filter on device eth11 [ 213.615832][ T5454] 8021q: adding VLAN 0 to HW filter on device eth12 [ 213.780531][ T5454] 8021q: adding VLAN 0 to HW filter on device eth13