last executing test programs: 7.262003469s ago: executing program 2 (id=3882): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0xffff, 0x2, 0x0, {0xa, 0x0, 0xfffffffe, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x400}}}, 0x32) socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @broadcast}, 0x2, 0x9800, 0xfffffffd}}, 0x2e) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) ioctl$PPPIOCATTCHAN(r3, 0x40047438, &(0x7f0000000500)=0x2) ioctl$PPPIOCBRIDGECHAN(r3, 0x40047435, 0x0) 7.087412742s ago: executing program 2 (id=3886): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000009c0)=ANY=[@ANYBLOB="120100003a982a08cd0ca310a223010203010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x44, &(0x7f00000004c0)={0x40, 0x8, 0x6, "a61623bea283"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) rename(0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000680)={0x1c, &(0x7f0000000140)=ANY=[@ANYBLOB="0003860000009817ead5d05e9cb31c3911d86f77068bea851f25ec89bd0312ee363aea849a70"], 0x0, 0x0}) ioctl$DRM_IOCTL_GET_CAP(0xffffffffffffffff, 0xc010640c, &(0x7f0000000100)={0x15}) 3.383816758s ago: executing program 2 (id=3918): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000240)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}, 0x10) sendmmsg$inet(r1, &(0x7f0000000c80)=[{{&(0x7f0000000800)={0x2, 0x6e23, @multicast1}, 0x10, 0x0}}, {{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f00000016c0)="3f4b69fa1e476e770e6bababe4d8b2e82a9d3756a0b3d4ce21aec6ad55972ac0addce367586f1e77587a41e6e4bfdb77c71b7f9f56cafa44958372e132375a584dcc19c1c2f72f8a2051c31821a8b27b4f1f597e5d131d5668a1fd91255b2922f05cf45e5e65d7e7d33d4d40800a6418193bb92445be48b1e76f1ecc757a76ab18e7e92855f21fa35cab707155914b20f7aa81baafb3cdf116700cffbd51c6c8221c8a2ab91c32b9cf26acb0562651cecb0e0b48ead69b81672fd3b3aca1c2a704fd6ecc77c0e9ddd9ff34d4640a8e27cf7f12bd2a1374b6eb3892ea6e5c97aa14e1062ef7e1d874159b7044d7ad1aa143d245cf97bac3083dc1ab5eb8c5eee4bf120b130060349951421155f75ffdd5b26aeb3286175ea29a16652c94dd15a9e72a53186a816a47cdd355aef7ea3b2f3eb85888e5c3528ccce3c364cb8a77e0dac9316ff9c1f044e9a2258ea9d0713dd6d5cd8a8afa7d37ee5fe6d82986ee99ca16bb76574eb5d3743d815bcdcf81773a6a184a937e3b4e6b9f49621b767e56277652b90e8e336c9ed1fde4608806ec5520cd734858b7fa29d3a43fbd41610179043118793b34c973ddffbd506128d79abfe6bee94b0312d4de997aa7c6af8364944dbd8e7b1a56e1d97cd3b62d023b532a2847b74808ed9c24aad818dac5f97087d90532b502c8e8ad25aecb7a3a5981218a68ff72ef96c87dc14ae656b579a72982ccea4d6d35cea497f5f4413eabccac2206a2ea4c55dc1b3d9ec5e6eb78b757cb9119b7962a33b7fe08d3b89a92ad0e96db2ebeffca227792a63818bc1b82c367ea4cd0491c28fe1e3343520d0600000000000000dd3415e3824556c6b18840d0ecd1f8728ca29a0bcbb0dc6f1836016c5c2a2c1cd6813bebd6f3f88f2e541dd271b9b1f693c9ad852d21f6ed4571a615a88308d3c9f011b3301cbbe154b8a1ff91b077e2d74becebc5e870bcb120d3828f2c96919c69716f25187a8318348f1e4424c033d64f211e1a850bdfc9421eb9937bd72d02c6ffa5f24e2dd91b223c537d39d6ec65990d95ff6a64fbbcffa71838f4ade2ff91425d760b4b4484312cbfbd742e187037258088b3716ca285cfd464a2584496b7e942a93a799ac78cc7255411efa1a9540ebbf7ca14f5a58e6e8163c5a26c646a63ae74b33d8dbc0632156692bb695478e5b3c570447a14a99594740190b6b4e5ade5408e9516b00167dfb30f45d2f57e0e81a6373d6a080bca56a0825342442be4cdfd454da3a023c456ba8ec3e90e0c6d63c3623f25725ba2e60b6a93c1ec41d5829b188cbda572a4842c5fe417031a9ea2aa45d48efaa704034cd86de33b78f2d5d798578f5e2df634677af1491c6b0582984b786ab96b9c6926a26b97979df24f9d771d84de322485b9adbc2d80808b0de63811b70fbd82e9a5b80572065a77cc14eb39d83b05df12f53be8178fff6a2aa02fd201e4cc86aff44e1f82bd72ad0d8edd7baf2b9e493dbab95c51411e049f15a6e26ff24782f9d7c0c1731d87e4c9c4f7d53eed3165e5c1c0f80eeea7b884001d143455432a9c52a21c4e7ec6d7950f8fe07af8833b2f7df2b4a6a0c026ef9ce3535bfafdc17de535a93cdca86d0c3ccc8739eee9e3b71ff49c2985751a25d19bb45730fa4970ce370954d3dca02db962e1afded9106ba5e4ec4e9e8b456f65f9da", 0x4ae}, {&(0x7f00000011c0)="16f0552ef6a84aebe40f9dcb437a8bc22f8c5fe9398b9f5d2b65218cf898f05e89ae02ab4f16de08671f04db60d8189bdefdc3189b8f1ecece7b1bc5d8fece2e7cc168fdffb56ac79f67a0da40e8a501fc", 0x51}], 0x2}}, {{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000a80)="af4fcbc69fc8236193a5db61cdc0290ad092e969dff4bc0b0fa752cf3ed6e756c7f331f97aed1b89911d0cec759d81b076677b50f213e6a9196fcdcefd4c562141ef3cefe4b0f75f8586d98ff9f18edc0113a54b4d2983bd7ef97f6478d2dd4921d5438d9517c2452ae54dc4d3e07310769420b1565fab3f29d44d7a667689cbbd2a1180ba5b9ea31708fbaf5bb1c7d35ebf2c32f2cef0d0d63b45b8441da5d3754cea06000000ffae1f", 0xaa}], 0x1}}], 0x3, 0x24048844) sendto$inet(r1, 0x0, 0x0, 0x32000800, 0x0, 0x0) 3.146399712s ago: executing program 2 (id=3924): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)}, 0x0) 2.887272886s ago: executing program 2 (id=3927): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x406, r0) setsockopt$inet_int(r1, 0x0, 0x16, 0x0, 0x0) 2.702554829s ago: executing program 2 (id=3931): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a7c000000060a0b"], 0xa4}}, 0x0) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000") 2.683279799s ago: executing program 3 (id=3932): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_IOVA_RANGES(r0, 0x3b84, &(0x7f0000000100)={0x20, r1, 0x0, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r0, 0x3b82, 0x0) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, 0x0) ioctl$IOMMU_IOAS_UNMAP$ALL(r0, 0x3b86, &(0x7f0000000280)={0x18, r1}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f00000002c0)={0x28, 0x7, r1, 0x0, &(0x7f0000000300)='LLLLLLLLLLLLLLLLLL', 0x12, 0x2}) ioctl$IOMMU_IOAS_UNMAP(r0, 0x3b86, &(0x7f0000000340)={0x18, r1, 0x2, 0x1c}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000380)={0x28, 0x7, r1, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000}) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000400)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, 0x0) ioctl$IOMMU_IOAS_COPY(r0, 0x3b83, &(0x7f00000004c0)={0x28, 0x7, r2, r1, 0x1c, 0x3, 0x2}) ioctl$IOMMU_IOAS_UNMAP(r0, 0x3b86, &(0x7f0000000500)={0x18, r2, 0x3, 0x1c}) ioctl$IOMMU_DESTROY$ioas(r0, 0x3b80, &(0x7f0000000540)={0x8, r2}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r0, 0x3b87, &(0x7f0000000600)={0x18, 0x1, 0x1, 0x0, r1}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r0, 0x3b82, &(0x7f0000000640)={0x18, r1, 0x0, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &(0x7f00000006c0)={0x48, 0x1, r1, 0x0, 0x1000, 0x2000}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000740)={0x48, 0x2, r1, 0x0, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f00000007c0)={0x28, 0x7, r1, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1004000}) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000800)={0x48, 0x3, r3, 0x0, 0x1004000, 0x1000, &(0x7f0000ffc000)}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000a00)={0x28, 0x7, r1, 0x0, &(0x7f00000a0000)='LLLLLLLLLLLLLLLLLLLLLLLLLLLL', 0x1000}) ioctl$IOMMU_TEST_OP_ACCESS_RW(r0, 0x3ba0, &(0x7f0000000ac0)={0x48, 0x8, 0xffffffffffffffff, 0x0, 0x0, 0x10, &(0x7f0000000b40)='LLLLLLLLLLLLLLLLLLLLLLLLLLLL'}) close(0xffffffffffffffff) 2.391007354s ago: executing program 3 (id=3936): r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000340)) 2.128581508s ago: executing program 3 (id=3940): write$USERIO_CMD_SET_PORT_TYPE(0xffffffffffffffff, &(0x7f0000000100)={0x1, 0x5}, 0x2) write$USERIO_CMD_REGISTER(0xffffffffffffffff, &(0x7f00000000c0), 0x2) sync() write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x2}, 0x2) 1.914900721s ago: executing program 3 (id=3942): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_SET(r1, &(0x7f0000001800)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x12f4}, 0x1, 0x0, 0x0, 0x4044010}, 0x0) recvmsg$kcm(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000600)=""/4081, 0xff1}], 0x1}, 0x1) 1.697004024s ago: executing program 3 (id=3943): r0 = socket$inet6(0xa, 0x80802, 0x0) sendmmsg$inet6(r0, &(0x7f00000029c0)=[{{&(0x7f0000000100)={0xa, 0x4e22, 0x6, @mcast2, 0x7}, 0x1c, 0x0}}, {{0x0, 0x0, &(0x7f0000001380)=[{&(0x7f00000012c0)="1ce02c7a", 0x4}], 0x1}}, {{0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000f80)="6b274824673ee5bf3f0fe815bd0af2e1742c4ce17a46140cfe4fad0ba7136f5fd8ac170c558d4c9102db67982679510429fc022cc47215b4680d02e99f9764db675b4e0e6f9b142370a074b7f5a67ac9153199171788de9ae00ba17efa2f507741372c32e7f6392d31fa965229bc999015658f7df32cc497275a1b53d561dcd8ef3a87dc6c519e13ada4c92206e437744996315da587d8463376911ad9430a9bbb198531addee842f7fa71a68e38a220f05196603e21e4c2399c3f44b8587cce170ac373c1a8e0ca8246c95f0685564fa0e0c1e05afbc75287634ed72831a3adbfcdcf40ad", 0xe5}, {&(0x7f0000000640)="1eec494bf43d5ec38b3ab8ddadc97046694372b987f376f8c1a61cef1abc6dc12761ccdf4bc066d8cd8766cd8d935e602884fe9e61a6668c8584fbc0f2bbcef07894c0a974d6f973f0aab66f6343da905e4ba1e504af199cecd5982bdb8a0b1d873e5664c6", 0x65}, {&(0x7f00000006c0)="b7cc36e0aaf6a9bf8551ece4d19dc5dd0d5dd69922c84d7cb0f7d6b10f7c592241d459f42ce87f04d9fd3e6a278e74a18bae75da0aa646fdeed2a5de99918194b68ecc0e6ad7a8cec7160ccaa503f50e189f413208b3cd26495a3fe6d428331800b93f98edbde3e01e45643bc290b7fed4df42", 0x73}, {&(0x7f0000000740)="5c52d8ca93a700034bb48ff6e63ee24ecf60793133f510684c17e7bab28b906b51e4d41f594db1b96ef24b149f115abe1cec037510fc4be686730d46dc2858e5b275334a1d812434bab0a2ddb15d99c37c6f2a02d282a4edeeb725cb608055411d2846f19c23eb6685eb5ffb51ad6c2ef6178de2807ee6f1d0755e70d4af5f22af4ca4414865c847aa7a696d2622935f1b6bc3329d3bcd068f1d9b00f09d1e8fb6e8ce6e66aaefc47f390a5a3f51df37d44bcc5d027ec47edb31cf58e1af81797982e0409565e478929e9d8ddb394d1f5bae0af0bb4476fd6ce8ef059c3caa7ffa196e", 0xe3}, {&(0x7f0000000840)='q', 0x1}, {&(0x7f0000000880)="3fb1b758bae64eae31ea", 0xa}, {&(0x7f00000008c0)="24a0754f2ceb268f27eb14dab5988df75b20cd64635d", 0x16}, {&(0x7f0000000900)="7a83adf31e6809dcdb3aef17d3528f81617d05425439da48dc95ae1818571368b1845b66393391bb552a0bd1464cef430114e6751b9f34ed0676c4a3a61a4a3ca7ec11728ed6d9a102d1ba65507206798dffb6f362d907fa3c8e98e7acbb7b1c93a58c95c9c4548e1444b92e3bffa66c931504d62e75bc45b55bb0164e8278d068188f17facf593f406c21855c41de012142cc9011e9fb33de5ca401ce7d317cefde6dcc0cc850555005be051a310cae284de08c077754bdf2cbdb85c845f35c09d8cd81259915fd157e7336b8b7c4583de2ed615582ef287124b425e54732543e7f6a5b21a09f36fdda68164bd92108", 0xf0}, {&(0x7f0000000a00)}, {&(0x7f0000000ac0)="d2e3f6045b714b459f12b6d6eaeb0428048223be4ea536d009eff82ed541b0010fb2875f02c5b530610bed692433503caf352867a2a8ad1915e7eee1c0777eec9a594c16dfc30114", 0x48}], 0xa}}, {{0x0, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000cc0)="8fc0e4b9d46333fc392482cf72f95bf5e7fed5f2d8a93950b9503fb33cb6c2782a3b73d40e236bb55f44a99bf333b52253df4a8523c3ba1ee9c03d61a286a5d7515dcefd187435d3ed8d309ea52fdabfd83f0da5b40767", 0x57}], 0x1}}, {{0x0, 0x0, &(0x7f0000002840)=[{&(0x7f00000013c0)="5e33e8541d04766be73fe093", 0xc}, {0x0}], 0x2}}], 0x5, 0x1c000) 1.543511507s ago: executing program 3 (id=3945): r0 = syz_usb_connect(0x5, 0x1cb, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 1.059309694s ago: executing program 1 (id=3951): write$USERIO_CMD_SET_PORT_TYPE(0xffffffffffffffff, &(0x7f0000000100)={0x1, 0x5}, 0x2) write$USERIO_CMD_REGISTER(0xffffffffffffffff, &(0x7f00000000c0), 0x2) sync() write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x2}, 0x2) 1.028047314s ago: executing program 1 (id=3952): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 908.836566ms ago: executing program 0 (id=3953): r0 = socket$inet6(0xa, 0x80802, 0x0) sendmmsg$inet6(r0, &(0x7f00000029c0)=[{{&(0x7f0000000100)={0xa, 0x4e22, 0x6, @mcast2, 0x7}, 0x1c, 0x0}}, {{0x0, 0x0, &(0x7f0000001380)=[{&(0x7f00000012c0)="1ce02c7a", 0x4}], 0x1}}, {{0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000f80)="6b274824673ee5bf3f0fe815bd0af2e1742c4ce17a46140cfe4fad0ba7136f5fd8ac170c558d4c9102db67982679510429fc022cc47215b4680d02e99f9764db675b4e0e6f9b142370a074b7f5a67ac9153199171788de9ae00ba17efa2f507741372c32e7f6392d31fa965229bc999015658f7df32cc497275a1b53d561dcd8ef3a87dc6c519e13ada4c92206e437744996315da587d8463376911ad9430a9bbb198531addee842f7fa71a68e38a220f05196603e21e4c2399c3f44b8587cce170ac373c1a8e0ca8246c95f0685564fa0e0c1e05afbc75287634ed72831a3adbfcdcf40ad", 0xe5}, {&(0x7f0000000640)="1eec494bf43d5ec38b3ab8ddadc97046694372b987f376f8c1a61cef1abc6dc12761ccdf4bc066d8cd8766cd8d935e602884fe9e61a6668c8584fbc0f2bbcef07894c0a974d6f973f0aab66f6343da905e4ba1e504af199cecd5982bdb8a0b1d873e5664c6", 0x65}, {&(0x7f00000006c0)="b7cc36e0aaf6a9bf8551ece4d19dc5dd0d5dd69922c84d7cb0f7d6b10f7c592241d459f42ce87f04d9fd3e6a278e74a18bae75da0aa646fdeed2a5de99918194b68ecc0e6ad7a8cec7160ccaa503f50e189f413208b3cd26495a3fe6d428331800b93f98edbde3e01e45643bc290b7fed4df42", 0x73}, {&(0x7f0000000740)="5c52d8ca93a700034bb48ff6e63ee24ecf60793133f510684c17e7bab28b906b51e4d41f594db1b96ef24b149f115abe1cec037510fc4be686730d46dc2858e5b275334a1d812434bab0a2ddb15d99c37c6f2a02d282a4edeeb725cb608055411d2846f19c23eb6685eb5ffb51ad6c2ef6178de2807ee6f1d0755e70d4af5f22af4ca4414865c847aa7a696d2622935f1b6bc3329d3bcd068f1d9b00f09d1e8fb6e8ce6e66aaefc47f390a5a3f51df37d44bcc5d027ec47edb31cf58e1af81797982e0409565e478929e9d8ddb394d1f5bae0af0bb4476fd6ce8ef059c3caa7ffa196e", 0xe3}, {&(0x7f0000000840)='q', 0x1}, {&(0x7f0000000880)="3fb1b758bae64eae31ea", 0xa}, {&(0x7f00000008c0)="24a0754f2ceb268f27eb14dab5988df75b20cd64635d", 0x16}, {&(0x7f0000000900)="7a83adf31e6809dcdb3aef17d3528f81617d05425439da48dc95ae1818571368b1845b66393391bb552a0bd1464cef430114e6751b9f34ed0676c4a3a61a4a3ca7ec11728ed6d9a102d1ba65507206798dffb6f362d907fa3c8e98e7acbb7b1c93a58c95c9c4548e1444b92e3bffa66c931504d62e75bc45b55bb0164e8278d068188f17facf593f406c21855c41de012142cc9011e9fb33de5ca401ce7d317cefde6dcc0cc850555005be051a310cae284de08c077754bdf2cbdb85c845f35c09d8cd81259915fd157e7336b8b7c4583de2ed615582ef287124b425e54732543e7f6a5b21a09f36fdda68164bd92108", 0xf0}, {&(0x7f0000000a00)="089be9b56f47e149a921180e0e2bc411191fbf1b6cfcac7cd93e67dc65ee685652d1b7fa8a7192c8bc263d29384f2993110df93dcf56f535ef4b200be18efadf9a4d0e5cc4d455e34b693309d324205a4ab1de", 0x53}, {&(0x7f0000000ac0)="d2e3f6045b714b459f12b6d6eaeb0428048223be4ea536d009eff82ed541b0010fb2875f02c5b530610bed692433503caf352867a2a8ad1915e7eee1c0777eec9a594c16dfc30114", 0x48}], 0xa}}, {{0x0, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000cc0)="8fc0e4b9d46333fc392482cf72f95bf5e7fed5f2d8a93950b9503fb33cb6c2782a3b73d40e236bb55f44a99bf333b52253df4a8523c3ba1ee9c03d61a286a5d7515dcefd187435d3ed8d309ea52fdabfd83f0da5b40767", 0x57}], 0x1}}, {{0x0, 0x0, &(0x7f0000002840)=[{&(0x7f00000013c0)="5e33e8541d04766be73fe093", 0xc}, {0x0}], 0x2}}], 0x5, 0x1c000) 782.628068ms ago: executing program 1 (id=3954): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi4\x00', 0x8200, 0x0) ioctl$COMEDI_INSN(r0, 0x8028640c, &(0x7f0000000080)={0xc000002, 0x0, 0x0, 0x0, 0x4000003}) 780.125468ms ago: executing program 0 (id=3955): socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000040)) sendmsg$BATADV_CMD_SET_HARDIF(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x24}, 0x1, 0x0, 0x0, 0x40800}, 0x20000040) 669.9614ms ago: executing program 0 (id=3956): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0xfffc}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @fib={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_FIB_RESULT={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_FIB_FLAGS={0x8, 0x3, 0x1, 0x0, 0xd}, @NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0x9}]}}}]}, @NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xc8}, 0x1, 0x0, 0x0, 0x240048d1}, 0x0) 577.273261ms ago: executing program 1 (id=3957): r0 = openat$autofs(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) r1 = open(&(0x7f0000000000)='.\x00', 0x0, 0x244) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r0, 0xc0189379, &(0x7f0000000200)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8, 0x12, r0, 0x12b32000) creat(&(0x7f00000000c0)='./file0\x00', 0x6) 575.993301ms ago: executing program 0 (id=3958): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$IPSET_CMD_RENAME(r1, 0x0, 0xc890) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="5800000010001fff000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="0000000008440000300012800b00010067656e6576650000200002801400070000000000000000000000000000000001050004000100000008000a00", @ANYRES32=r2], 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x80, 0x2, 0x27e}, &(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000140)) r3 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r3, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet6_mreq(r1, 0x29, 0x15, 0x0, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket(0x10, 0x803, 0x2) sendmsg$nl_route(r5, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) sendmsg$TIPC_CMD_RESET_LINK_STATS(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(r5, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendto$packet(r4, &(0x7f0000000180), 0x0, 0x840, &(0x7f00000000c0)={0x11, 0x86dd, r6, 0x1, 0x2, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2eaaaac15ca67ef2}}, 0x14) 460.661093ms ago: executing program 1 (id=3959): r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000340)) 192.924177ms ago: executing program 0 (id=3960): r0 = openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x5}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) sync() write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000000)={0x2, 0x2}, 0x2) 92.319539ms ago: executing program 1 (id=3961): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000e00)={0xa4, 0x0, 0x100, 0x70bd27, 0x25dfdbfe, {}, [@TIPC_NLA_MON={0x34, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6}]}, @TIPC_NLA_MON={0x24, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xe5}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xb}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7fff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3}]}, @TIPC_NLA_LINK={0x38, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x4}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xc728}]}, @TIPC_NLA_LINK_PROP={0x4}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x8000}, 0x2000c880) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 0s ago: executing program 0 (id=3962): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): 1939_tp_rxtimer: 0xffff88802ef25400: rx timeout, send abort [ 683.060244][T12818] trusted_key: encrypted_key: keyword 'new' not allowed when called from .update method [ 683.386239][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802ef25400: abort rx timeout. Force session deactivation [ 684.166317][T12845] netlink: 'syz.2.2315': attribute type 2 has an invalid length. [ 685.759664][T12864] trusted_key: encrypted_key: keyword 'new' not allowed when called from .update method [ 686.193472][T12872] netlink: 'syz.3.2325': attribute type 2 has an invalid length. [ 686.214887][ T1289] ieee802154 phy0 wpan0: encryption failed: -22 [ 686.221651][ T1289] ieee802154 phy1 wpan1: encryption failed: -22 [ 688.893397][T12924] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2348'. [ 688.910043][T12924] team0: Unable to change to the same mode the team is in [ 689.178352][T12939] syz_tun: entered allmulticast mode [ 689.201444][T12935] syz_tun: left allmulticast mode [ 689.366866][T12948] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2361'. [ 689.396627][T12948] team0: Unable to change to the same mode the team is in [ 690.285579][T12967] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2371'. [ 690.400413][T12971] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 690.419510][T12971] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 690.442888][T12971] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 690.469364][T12971] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 690.491299][T12971] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 690.510453][T12971] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 691.775067][ T2936] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 691.794906][ T2936] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 691.865574][T12987] syz_tun: entered allmulticast mode [ 691.916783][T12983] syz_tun: left allmulticast mode [ 691.964566][ T2936] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 691.988808][ T2936] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 692.208758][ T2936] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 692.220170][ T2936] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 692.286067][T12999] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2380'. [ 692.337188][ T2936] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 692.354156][ T2936] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 692.533952][T12968] chnl_net:caif_netlink_parms(): no params data found [ 692.599406][ T5785] Bluetooth: hci4: command tx timeout [ 692.735896][T13013] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 692.936759][T12968] bridge0: port 1(bridge_slave_0) entered blocking state [ 692.949479][T12968] bridge0: port 1(bridge_slave_0) entered disabled state [ 692.967441][T12968] bridge_slave_0: entered allmulticast mode [ 692.988830][T12968] bridge_slave_0: entered promiscuous mode [ 693.018315][T12968] bridge0: port 2(bridge_slave_1) entered blocking state [ 693.039002][T12968] bridge0: port 2(bridge_slave_1) entered disabled state [ 693.053507][T12968] bridge_slave_1: entered allmulticast mode [ 693.082998][T12968] bridge_slave_1: entered promiscuous mode [ 693.247353][T12968] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 693.346086][T12968] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 693.357349][T13029] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 693.505570][T12968] team0: Port device team_slave_0 added [ 693.587430][T12968] team0: Port device team_slave_1 added [ 693.843431][T12968] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 693.868680][T12968] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 693.919646][T12968] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 693.943501][T13042] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2391'. [ 694.160333][T12968] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 694.187176][T12968] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 694.258208][T12968] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 695.173141][T13048] bridge_slave_0: left allmulticast mode [ 695.178880][T13048] bridge_slave_0: left promiscuous mode [ 695.201359][T13048] bridge0: port 1(bridge_slave_0) entered disabled state [ 695.220494][T13048] bridge_slave_1: left allmulticast mode [ 695.226224][T13048] bridge_slave_1: left promiscuous mode [ 695.233227][ T5785] Bluetooth: hci4: command tx timeout [ 695.245166][T13048] bridge0: port 2(bridge_slave_1) entered disabled state [ 695.257003][T13048] vlan2: left promiscuous mode [ 695.269260][T13048] geneve0: left promiscuous mode [ 695.285662][T13048] bond2: (slave veth0_to_bond): Releasing backup interface [ 695.316359][T13048] bond0: (slave bond_slave_0): Releasing backup interface [ 695.338214][T13048] bond0: (slave bond_slave_1): Releasing backup interface [ 695.405762][T13048] team0: Port device team_slave_0 removed [ 695.437731][T13048] team0: Port device team_slave_1 removed [ 695.461158][T13048] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 695.468859][T13048] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 695.478163][T13048] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 695.488755][T13048] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 695.506728][T13048] vlan2: left allmulticast mode [ 695.512890][T13048] geneve0: left allmulticast mode [ 695.518189][T13048] bridge0: port 3(vlan2) entered disabled state [ 695.531491][T13048] bond1: (slave geneve2): Releasing backup interface [ 695.844581][T13061] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 695.937285][T13061] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 695.996041][T13054] macvtap1: entered promiscuous mode [ 696.003091][T13054] vlan0: entered promiscuous mode [ 696.017454][T13054] vlan0: left promiscuous mode [ 696.095394][T13067] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2398'. [ 696.116008][T13069] team0: Unable to change to the same mode the team is in [ 696.148726][T13053] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 696.181810][T12968] hsr_slave_0: entered promiscuous mode [ 696.197807][T12968] hsr_slave_1: entered promiscuous mode [ 696.224358][T12968] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 696.239243][T12968] Cannot create hsr debugfs directory [ 696.460546][ T2936] hsr_slave_0: left promiscuous mode [ 696.472099][ T2936] hsr_slave_1: left promiscuous mode [ 696.572916][ T2936] veth1_macvtap: left promiscuous mode [ 696.589812][ T2936] veth1_vlan: left promiscuous mode [ 696.595572][ T2936] veth0_vlan: left promiscuous mode [ 697.239414][ T5785] Bluetooth: hci4: command tx timeout [ 697.340844][ T2936] bond5 (unregistering): Released all slaves [ 697.800709][ T2936] bond4 (unregistering): Released all slaves [ 699.041599][ T2936] bond3 (unregistering): Released all slaves [ 699.287958][ T2936] bond2 (unregistering): Released all slaves [ 699.323926][ T5785] Bluetooth: hci4: command tx timeout [ 699.448135][ T2936] bond1 (unregistering): Released all slaves [ 700.615049][ T2936] bond0 (unregistering): Released all slaves [ 700.752301][T13084] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2402'. [ 700.814329][T13104] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2407'. [ 700.857521][T13105] team0: Unable to change to the same mode the team is in [ 700.879836][T13107] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2408'. [ 701.275641][T13122] netlink: 'syz.2.2410': attribute type 2 has an invalid length. [ 701.303933][T13128] netlink: 'syz.2.2410': attribute type 2 has an invalid length. [ 701.327237][T13128] netlink: 1347 bytes leftover after parsing attributes in process `syz.2.2410'. [ 701.924679][T13146] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2416'. [ 702.066420][T13142] 8021q: adding VLAN 0 to HW filter on device bond0 [ 702.088314][T13142] 8021q: adding VLAN 0 to HW filter on device team0 [ 702.121446][T13142] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 702.144787][T13148] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2417'. [ 702.163068][T13146] team0: Mode changed to "activebackup" [ 702.591291][T13158] vlan0: entered promiscuous mode [ 702.823876][T13170] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2425'. [ 702.868875][T13170] team0: Unable to change to the same mode the team is in [ 703.030967][T13176] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2427'. [ 703.086293][T12968] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 703.133933][T12968] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 703.177569][T12968] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 703.219257][T12968] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 703.421420][T13191] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2432'. [ 703.513695][T12968] 8021q: adding VLAN 0 to HW filter on device bond0 [ 703.592784][T12968] 8021q: adding VLAN 0 to HW filter on device team0 [ 703.644047][ T2936] bridge0: port 1(bridge_slave_0) entered blocking state [ 703.651362][ T2936] bridge0: port 1(bridge_slave_0) entered forwarding state [ 703.711998][ T2936] bridge0: port 2(bridge_slave_1) entered blocking state [ 703.719293][ T2936] bridge0: port 2(bridge_slave_1) entered forwarding state [ 703.736867][T13200] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2435'. [ 703.765699][T13200] team0: Unable to change to the same mode the team is in [ 704.500194][T12968] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 704.697885][ C1] vcan0: j1939_tp_rxtimer: 0xffff88801d74ec00: rx timeout, send abort [ 704.703044][T12968] veth0_vlan: entered promiscuous mode [ 704.756638][T12968] veth1_vlan: entered promiscuous mode [ 704.819993][T13239] team0: Unable to change to the same mode the team is in [ 704.892156][T12968] veth0_macvtap: entered promiscuous mode [ 704.943271][T12968] veth1_macvtap: entered promiscuous mode [ 705.024663][T12968] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 705.044689][T12968] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 705.093347][T12968] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 705.113526][T12968] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 705.139313][T12968] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 705.157060][T12968] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 705.206339][ C1] vcan0: j1939_tp_rxtimer: 0xffff88801d74ec00: abort rx timeout. Force session deactivation [ 705.430364][ T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 705.438292][ T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 705.561801][ T994] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 705.586143][ T994] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 705.824273][ C0] vcan0: j1939_tp_rxtimer: 0xffff888074819800: rx timeout, send abort [ 706.156740][T13270] __nla_validate_parse: 3 callbacks suppressed [ 706.156762][T13270] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2455'. [ 706.224291][T13272] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2456'. [ 706.250632][T13270] team0: No ports can be present during mode change [ 706.332614][ C0] vcan0: j1939_tp_rxtimer: 0xffff888074819800: abort rx timeout. Force session deactivation [ 706.796590][T13285] 8021q: adding VLAN 0 to HW filter on device bond9 [ 706.924181][T13289] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 706.957564][T13289] bond9: (slave macvlan2): Enslaving as a backup interface with a down link [ 706.968484][T13288] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 707.047443][T12971] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 707.058360][T12971] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 707.067567][T12971] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 707.102969][T12971] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 707.110925][T12971] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 707.118372][T12971] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 707.226513][T13288] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 707.256460][ C0] vcan0: j1939_tp_rxtimer: 0xffff88807ea75800: rx timeout, send abort [ 707.568175][ T2936] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 707.604710][T13306] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2465'. [ 707.632349][T13311] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2466'. [ 707.712506][ T2936] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 707.743433][T13311] team0: Unable to change to the same mode the team is in [ 707.764792][ C0] vcan0: j1939_tp_rxtimer: 0xffff88807ea75800: abort rx timeout. Force session deactivation [ 707.888831][ T2936] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 708.063993][ T2936] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 708.174961][T13294] chnl_net:caif_netlink_parms(): no params data found [ 708.215904][T13333] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2472'. [ 708.252804][T13333] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 708.261782][T13333] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 708.270614][T13333] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 708.280468][T13333] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 708.593194][T13294] bridge0: port 1(bridge_slave_0) entered blocking state [ 708.609733][T13294] bridge0: port 1(bridge_slave_0) entered disabled state [ 708.628281][T13294] bridge_slave_0: entered allmulticast mode [ 708.652865][T13294] bridge_slave_0: entered promiscuous mode [ 708.752587][T13294] bridge0: port 2(bridge_slave_1) entered blocking state [ 708.787909][T13294] bridge0: port 2(bridge_slave_1) entered disabled state [ 708.801507][T13294] bridge_slave_1: entered allmulticast mode [ 708.824880][T13294] bridge_slave_1: entered promiscuous mode [ 708.832816][T13351] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2476'. [ 708.888777][T13351] team0: Unable to change to the same mode the team is in [ 708.925215][T13294] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 709.070387][ C1] vcan0: j1939_tp_rxtimer: 0xffff888025040800: rx timeout, send abort [ 709.116363][T13294] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 709.163910][T12971] Bluetooth: hci0: command tx timeout [ 709.225486][T13294] team0: Port device team_slave_0 added [ 709.312014][T13294] team0: Port device team_slave_1 added [ 709.470158][T13294] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 709.477200][T13294] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 709.527054][T13294] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 709.570514][ C1] vcan0: j1939_tp_rxtimer: 0xffff888025040400: rx timeout, send abort [ 709.578913][ C1] vcan0: j1939_tp_rxtimer: 0xffff888025040800: abort rx timeout. Force session deactivation [ 709.621085][T13294] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 709.628124][T13294] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 709.712718][T13294] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 709.944053][T13387] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2484'. [ 709.971951][T13294] hsr_slave_0: entered promiscuous mode [ 709.989737][T13294] hsr_slave_1: entered promiscuous mode [ 710.078838][ C1] vcan0: j1939_tp_rxtimer: 0xffff888025040400: abort rx timeout. Force session deactivation [ 710.647384][ T2936] hsr_slave_0: left promiscuous mode [ 710.661541][ T2936] hsr_slave_1: left promiscuous mode [ 711.087284][ T2936] bond3 (unregistering): Released all slaves [ 711.166424][ T2936] bond2 (unregistering): (slave geneve2): Releasing backup interface [ 711.252771][T12971] Bluetooth: hci0: command tx timeout [ 711.412091][ T2936] bond2 (unregistering): Released all slaves [ 712.387323][ T2936] bond1 (unregistering): Released all slaves [ 713.327076][T12971] Bluetooth: hci0: command tx timeout [ 713.774991][ T2936] bond0 (unregistering): Released all slaves [ 714.090018][T13423] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2494'. [ 714.387608][T13438] batman_adv: batadv0: Adding interface: wlan0 [ 714.409848][T13438] batman_adv: batadv0: The MTU of interface wlan0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 714.504044][T13438] batman_adv: batadv0: Interface activated: wlan0 [ 714.738360][ T2936] IPVS: stop unused estimator thread 0... [ 714.983878][T13294] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 715.013050][T13294] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 715.053807][T13294] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 715.090287][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802100fc00: rx timeout, send abort [ 715.102766][T13294] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 715.265768][T13459] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2502'. [ 715.357715][T13294] 8021q: adding VLAN 0 to HW filter on device bond0 [ 715.399359][T12971] Bluetooth: hci0: command tx timeout [ 715.428515][T13294] 8021q: adding VLAN 0 to HW filter on device team0 [ 715.444328][T13444] loop1: detected capacity change from 0 to 32768 [ 715.497264][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 715.504569][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 715.555220][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 715.562518][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 715.590412][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802100f000: rx timeout, send abort [ 715.598804][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802100fc00: abort rx timeout. Force session deactivation [ 715.847417][T13294] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 715.858603][T13294] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 716.098775][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802100f000: abort rx timeout. Force session deactivation [ 716.829682][T13469] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2504'. [ 717.082172][T13469] 8021q: adding VLAN 0 to HW filter on device bond6 [ 717.235449][T13480] team0: Unable to change to the same mode the team is in [ 717.528773][T13294] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 717.691426][T13294] veth0_vlan: entered promiscuous mode [ 717.741001][T13495] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2510'. [ 717.778247][T13294] veth1_vlan: entered promiscuous mode [ 717.882490][T13294] veth0_macvtap: entered promiscuous mode [ 717.921806][T13294] veth1_macvtap: entered promiscuous mode [ 717.993849][T13294] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 718.043700][T13294] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 718.069211][T13294] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 718.091494][T13294] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 718.118125][T13294] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 718.149279][T13294] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 718.179207][T13294] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 718.198188][T13294] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 718.898886][T13294] batman_adv: The newly added mac address (08:02:11:00:00:00) already exists on: wlan0 [ 718.937615][T13294] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 718.994196][ T2936] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 719.027096][ T2936] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 719.048112][T13524] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2515'. [ 719.175115][T13524] 8021q: adding VLAN 0 to HW filter on device bond10 [ 719.326575][ T994] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 719.355165][ T994] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 720.682269][T13547] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2520'. [ 720.855087][T13552] batman_adv: batadv0: Adding interface: dummy0 [ 720.861748][T13552] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 720.887925][T13552] batman_adv: batadv0: Interface activated: dummy0 [ 720.926982][T13552] batadv0: mtu less than device minimum [ 720.978445][T13552] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 720.991626][T13552] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 721.004306][T13552] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 721.016977][T13552] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 721.029679][T13552] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 721.042451][T13552] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 721.055077][T13552] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 721.067766][T13552] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 721.080480][T13552] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 721.143205][T13549] can: request_module (can-proto-0) failed. [ 721.448807][T13568] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 721.458354][T13568] netdevsim netdevsim3 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 721.467578][T13568] netdevsim netdevsim3 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 721.476610][T13568] netdevsim netdevsim3 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 721.889606][T13577] syzkaller0: entered promiscuous mode [ 721.925267][T13577] syzkaller0: entered allmulticast mode [ 722.170854][ T5785] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 722.183886][ T5785] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 722.209366][ T5785] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 722.238593][ T5785] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 722.250119][ T5785] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 722.259714][ T5785] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 722.975583][T13586] chnl_net:caif_netlink_parms(): no params data found [ 723.284789][T13586] bridge0: port 1(bridge_slave_0) entered blocking state [ 723.310516][T13586] bridge0: port 1(bridge_slave_0) entered disabled state [ 723.325774][T13586] bridge_slave_0: entered allmulticast mode [ 723.341139][T13586] bridge_slave_0: entered promiscuous mode [ 723.360325][T13586] bridge0: port 2(bridge_slave_1) entered blocking state [ 723.367639][T13586] bridge0: port 2(bridge_slave_1) entered disabled state [ 723.370558][T13630] ksmbd: Unknown IPC event: 6, ignore. [ 723.385207][T13586] bridge_slave_1: entered allmulticast mode [ 723.393993][T13586] bridge_slave_1: entered promiscuous mode [ 723.480736][T13586] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 723.501186][T13586] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 723.545978][T13586] team0: Port device team_slave_0 added [ 723.573094][T13586] team0: Port device team_slave_1 added [ 723.657519][T13586] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 723.683097][T13586] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 723.714181][T13586] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 723.726688][T13637] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2547'. [ 723.739600][T13637] netlink: 1371 bytes leftover after parsing attributes in process `syz.1.2547'. [ 723.750906][T13586] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 723.760451][T13586] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 723.817844][T13586] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 723.897020][T13641] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2550'. [ 724.136771][T13586] hsr_slave_0: entered promiscuous mode [ 724.152064][T13586] hsr_slave_1: entered promiscuous mode [ 724.161650][T13586] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 724.182273][T13586] Cannot create hsr debugfs directory [ 724.359496][ T5785] Bluetooth: hci2: command tx timeout [ 724.717558][T13586] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 724.736555][T13586] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 724.764318][T13661] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2558'. [ 724.774952][T13663] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2559'. [ 724.797206][T13664] netlink: 1371 bytes leftover after parsing attributes in process `syz.0.2558'. [ 724.900266][T13586] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 724.910923][T13586] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 725.054955][T13586] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 725.065392][T13586] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 725.194889][T13676] netlink: 260 bytes leftover after parsing attributes in process `syz.3.2564'. [ 725.211850][T13586] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 725.232816][T13586] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 725.513557][T13686] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2569'. [ 725.551345][T13688] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2570'. [ 725.614259][T13586] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 725.635442][T13586] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 725.670316][T13586] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 725.689892][T13586] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 725.884495][T13586] 8021q: adding VLAN 0 to HW filter on device bond0 [ 725.942098][T13586] 8021q: adding VLAN 0 to HW filter on device team0 [ 726.048235][ T8555] bridge0: port 1(bridge_slave_0) entered blocking state [ 726.055535][ T8555] bridge0: port 1(bridge_slave_0) entered forwarding state [ 726.075060][ T8555] bridge0: port 2(bridge_slave_1) entered blocking state [ 726.082356][ T8555] bridge0: port 2(bridge_slave_1) entered forwarding state [ 726.350276][T13707] __nla_validate_parse: 1 callbacks suppressed [ 726.350296][T13707] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2578'. [ 726.417668][T13707] netlink: 1355 bytes leftover after parsing attributes in process `syz.1.2578'. [ 726.439309][ T5785] Bluetooth: hci2: command tx timeout [ 726.520444][T13710] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2580'. [ 726.768556][T13586] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 726.907053][T13586] veth0_vlan: entered promiscuous mode [ 726.948212][T13586] veth1_vlan: entered promiscuous mode [ 727.048900][T13586] veth0_macvtap: entered promiscuous mode [ 727.074206][T13586] veth1_macvtap: entered promiscuous mode [ 727.138253][T13586] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 727.160084][T13586] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 727.192177][T13586] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 727.250408][T13586] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 727.270161][T13586] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 727.285499][T13586] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 727.317140][T13586] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 727.356118][T13586] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 727.430005][T13586] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 727.460996][T13586] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 727.470544][T13586] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 727.479570][T13586] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 728.430504][T13728] netlink: 'syz.0.2586': attribute type 29 has an invalid length. [ 728.505540][T13728] netlink: 'syz.0.2586': attribute type 29 has an invalid length. [ 728.521644][ T5785] Bluetooth: hci2: command tx timeout [ 728.550623][T13729] netlink: 'syz.0.2586': attribute type 29 has an invalid length. [ 728.607653][T13586] batman_adv: The newly added mac address (08:02:11:00:00:00) already exists on: wlan0 [ 728.624390][T13586] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 728.637908][T13728] netlink: 'syz.0.2586': attribute type 29 has an invalid length. [ 728.694624][ T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 728.741635][ T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 728.832136][ T2936] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 728.843752][ T2936] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 728.941364][T13732] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 729.024497][T13735] netlink: 'syz.3.2589': attribute type 46 has an invalid length. [ 729.038283][T13735] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2589'. [ 729.060747][T13733] syzkaller0: entered promiscuous mode [ 729.078496][T13733] syzkaller0: entered allmulticast mode [ 729.258407][T13742] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2590'. [ 729.267516][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880306d3400: rx timeout, send abort [ 729.764065][ C0] vcan0: j1939_tp_rxtimer: 0xffff88803014b800: rx timeout, send abort [ 729.772492][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880306d3400: abort rx timeout. Force session deactivation [ 729.871991][T12971] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 729.885494][T12971] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 729.895438][T12971] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 729.906033][T12971] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 729.915310][T12971] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 729.924709][T12971] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 730.214825][T13752] chnl_net:caif_netlink_parms(): no params data found [ 730.266124][ C0] vcan0: j1939_tp_rxtimer: 0xffff88803014ac00: rx timeout, send abort [ 730.274781][ C0] vcan0: j1939_tp_rxtimer: 0xffff88803014b800: abort rx timeout. Force session deactivation [ 730.364418][T13752] bridge0: port 1(bridge_slave_0) entered blocking state [ 730.380227][T13752] bridge0: port 1(bridge_slave_0) entered disabled state [ 730.387725][T13752] bridge_slave_0: entered allmulticast mode [ 730.398038][T13752] bridge_slave_0: entered promiscuous mode [ 730.409772][T13752] bridge0: port 2(bridge_slave_1) entered blocking state [ 730.417119][T13752] bridge0: port 2(bridge_slave_1) entered disabled state [ 730.424667][T13752] bridge_slave_1: entered allmulticast mode [ 730.432661][T13752] bridge_slave_1: entered promiscuous mode [ 730.473353][T13752] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 730.503340][T13752] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 730.563401][T13755] loop0: detected capacity change from 0 to 32768 [ 730.599277][ T5785] Bluetooth: hci2: command tx timeout [ 730.625941][T13752] team0: Port device team_slave_0 added [ 730.666105][T13752] team0: Port device team_slave_1 added [ 730.774450][ C0] vcan0: j1939_tp_rxtimer: 0xffff88803014ac00: abort rx timeout. Force session deactivation [ 730.945430][T13752] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 731.810019][T13752] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 731.960308][T13752] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 732.002645][T13768] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 732.029169][T13752] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 732.039455][ T5785] Bluetooth: hci3: command tx timeout [ 732.072582][T13752] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 732.114369][T13752] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 732.385574][T13752] hsr_slave_0: entered promiscuous mode [ 732.425822][T13752] hsr_slave_1: entered promiscuous mode [ 732.455067][T13752] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 732.468873][T13752] Cannot create hsr debugfs directory [ 732.532962][T13776] syzkaller0: entered promiscuous mode [ 732.538540][T13776] syzkaller0: entered allmulticast mode [ 732.883283][T13785] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2604'. [ 732.964116][T13786] netlink: 1355 bytes leftover after parsing attributes in process `syz.0.2604'. [ 733.202716][ C0] vcan0: j1939_tp_rxtimer: 0xffff888025bc5000: rx timeout, send abort [ 733.383503][T13795] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2608'. [ 733.405066][T13796] team0: No ports can be present during mode change [ 733.564958][T13798] netlink: 'syz.2.2609': attribute type 16 has an invalid length. [ 733.702845][ C0] vcan0: j1939_tp_rxtimer: 0xffff888025bc5400: rx timeout, send abort [ 733.711401][ C0] vcan0: j1939_tp_rxtimer: 0xffff888025bc5000: abort rx timeout. Force session deactivation [ 733.889019][T13807] netlink: 1347 bytes leftover after parsing attributes in process `syz.0.2614'. [ 734.021249][T13752] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 734.048328][T13752] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 734.071696][T13752] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 734.091321][T13752] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 734.121150][ T5785] Bluetooth: hci3: command tx timeout [ 734.204958][ C0] vcan0: j1939_tp_rxtimer: 0xffff888025bc6400: rx timeout, send abort [ 734.214697][ C0] vcan0: j1939_tp_rxtimer: 0xffff888025bc5400: abort rx timeout. Force session deactivation [ 734.290501][T13752] 8021q: adding VLAN 0 to HW filter on device bond0 [ 734.301017][T13815] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2617'. [ 734.327557][T13817] netlink: 'syz.2.2616': attribute type 64 has an invalid length. [ 734.337277][T13817] net_ratelimit: 10 callbacks suppressed [ 734.337294][T13817] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 734.361825][T13815] team0: No ports can be present during mode change [ 734.377297][T13752] 8021q: adding VLAN 0 to HW filter on device team0 [ 734.406592][ T8555] bridge0: port 1(bridge_slave_0) entered blocking state [ 734.413874][ T8555] bridge0: port 1(bridge_slave_0) entered forwarding state [ 734.461614][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 734.468903][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 734.558241][T13821] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2618'. [ 734.713293][ C0] vcan0: j1939_tp_rxtimer: 0xffff888025bc6400: abort rx timeout. Force session deactivation [ 734.879067][T13830] netlink: 1347 bytes leftover after parsing attributes in process `syz.1.2622'. [ 735.167190][T13752] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 735.333672][T13844] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2627'. [ 735.369299][T13845] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2626'. [ 735.387073][T13752] veth0_vlan: entered promiscuous mode [ 735.417940][T13752] veth1_vlan: entered promiscuous mode [ 735.445038][T13845] team0: No ports can be present during mode change [ 735.563050][T13752] veth0_macvtap: entered promiscuous mode [ 735.598428][T13752] veth1_macvtap: entered promiscuous mode [ 735.638008][T13752] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 735.679219][T13752] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 735.701659][T13752] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 735.729426][T13752] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 735.748715][T13752] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 735.778030][T13752] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 735.789239][T13752] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 735.808746][T13752] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 735.828802][T13752] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 735.839279][T13752] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 735.841023][ C1] vcan0: j1939_tp_rxtimer: 0xffff88806017a800: rx timeout, send abort [ 735.865587][T13752] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 735.887579][T13752] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 735.931310][T13855] netlink: 1347 bytes leftover after parsing attributes in process `syz.1.2632'. [ 735.942393][T13752] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 735.953086][T13752] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 735.963134][T13752] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 735.975339][T13752] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 736.093913][T13752] batman_adv: The newly added mac address (08:02:11:00:00:00) already exists on: wlan0 [ 736.105289][T13752] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 736.124238][ T2984] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 736.143216][ T2984] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 736.178631][ T2936] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 736.187000][ T2936] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 736.199294][ T5785] Bluetooth: hci3: command tx timeout [ 736.341120][ C1] vcan0: j1939_tp_rxtimer: 0xffff88806017ac00: rx timeout, send abort [ 736.358078][ C1] vcan0: j1939_tp_rxtimer: 0xffff88806017a800: abort rx timeout. Force session deactivation [ 736.670622][T13870] team0: No ports can be present during mode change [ 736.842435][ C1] vcan0: j1939_tp_rxtimer: 0xffff88806017b000: rx timeout, send abort [ 736.853574][ C1] vcan0: j1939_tp_rxtimer: 0xffff88806017ac00: abort rx timeout. Force session deactivation [ 737.350812][ C1] vcan0: j1939_tp_rxtimer: 0xffff88806017b000: abort rx timeout. Force session deactivation [ 737.393016][T13893] team0: No ports can be present during mode change [ 737.919517][T13911] __nla_validate_parse: 5 callbacks suppressed [ 737.919536][T13911] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2657'. [ 738.023504][T13917] netlink: 'syz.1.2659': attribute type 1 has an invalid length. [ 738.031621][T13915] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2660'. [ 738.043120][T13917] netlink: 'syz.1.2659': attribute type 2 has an invalid length. [ 738.075290][T13915] team0: No ports can be present during mode change [ 738.210256][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807df5fc00: rx timeout, send abort [ 738.238466][T13923] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2670'. [ 738.258041][T13923] team0: No ports can be present during mode change [ 738.281676][ T5785] Bluetooth: hci3: command tx timeout [ 738.333933][T13925] netlink: 'syz.3.2663': attribute type 39 has an invalid length. [ 738.464708][T13929] netlink: 1347 bytes leftover after parsing attributes in process `syz.1.2665'. [ 738.701062][T13933] syzkaller0: entered promiscuous mode [ 738.706844][T13933] syzkaller0: entered allmulticast mode [ 738.710509][ C1] vcan0: j1939_tp_rxtimer: 0xffff88801ef35800: rx timeout, send abort [ 738.724067][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807df5fc00: abort rx timeout. Force session deactivation [ 739.040041][T13937] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2669'. [ 739.212640][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802e81f000: rx timeout, send abort [ 739.221256][ C1] vcan0: j1939_tp_rxtimer: 0xffff88801ef35800: abort rx timeout. Force session deactivation [ 739.552704][T13945] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2674'. [ 739.681273][T13947] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2675'. [ 739.693744][T13947] netlink: 1015 bytes leftover after parsing attributes in process `syz.1.2675'. [ 739.720981][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802e81f000: abort rx timeout. Force session deactivation [ 739.914627][T13950] syzkaller0: entered promiscuous mode [ 739.929247][T13950] syzkaller0: entered allmulticast mode [ 740.111709][T13955] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2679'. [ 740.222419][T13957] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2680'. [ 740.818101][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802eda0400: rx timeout, send abort [ 740.824121][T13980] syzkaller0: entered promiscuous mode [ 740.832300][T13980] syzkaller0: entered allmulticast mode [ 741.318264][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805adc1800: rx timeout, send abort [ 741.327157][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802eda0400: abort rx timeout. Force session deactivation [ 741.661693][T14005] syzkaller0: entered promiscuous mode [ 741.667872][T14005] syzkaller0: entered allmulticast mode [ 741.819598][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805b376000: rx timeout, send abort [ 741.828252][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805adc1800: abort rx timeout. Force session deactivation [ 742.327903][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805b376000: abort rx timeout. Force session deactivation [ 742.564087][T14033] syzkaller0: entered promiscuous mode [ 742.593068][T14033] syzkaller0: entered allmulticast mode [ 742.932341][T14048] __nla_validate_parse: 20 callbacks suppressed [ 742.932359][T14048] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2723'. [ 743.164161][T14055] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2726'. [ 743.322241][ C1] vcan0: j1939_tp_rxtimer: 0xffff888062c83c00: rx timeout, send abort [ 743.418429][T14065] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2731'. [ 743.574735][T14069] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2734'. [ 743.585406][T14071] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2733'. [ 743.770618][T14076] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2737'. [ 743.823365][ C1] vcan0: j1939_tp_rxtimer: 0xffff888062c83400: rx timeout, send abort [ 743.831887][ C1] vcan0: j1939_tp_rxtimer: 0xffff888062c83c00: abort rx timeout. Force session deactivation [ 743.975127][T14080] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2738'. [ 744.305328][T14091] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2742'. [ 744.329392][ C1] vcan0: j1939_tp_rxtimer: 0xffff888062c83000: rx timeout, send abort [ 744.337991][ C1] vcan0: j1939_tp_rxtimer: 0xffff888062c83400: abort rx timeout. Force session deactivation [ 744.355960][T14092] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2744'. [ 744.590928][T14100] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2748'. [ 744.837716][ C1] vcan0: j1939_tp_rxtimer: 0xffff888062c83000: abort rx timeout. Force session deactivation [ 745.726090][ C0] vcan0: j1939_tp_rxtimer: 0xffff888067b73400: rx timeout, send abort [ 746.226205][ C0] vcan0: j1939_tp_rxtimer: 0xffff888067b73000: rx timeout, send abort [ 746.234695][ C0] vcan0: j1939_tp_rxtimer: 0xffff888067b73400: abort rx timeout. Force session deactivation [ 746.489304][T14151] syzkaller0: entered promiscuous mode [ 746.507337][T14151] syzkaller0: entered allmulticast mode [ 746.728893][ C0] vcan0: j1939_tp_rxtimer: 0xffff888067b71800: rx timeout, send abort [ 746.737599][ C0] vcan0: j1939_tp_rxtimer: 0xffff888067b73000: abort rx timeout. Force session deactivation [ 747.237286][ C0] vcan0: j1939_tp_rxtimer: 0xffff888067b71800: abort rx timeout. Force session deactivation [ 747.275322][T14173] syzkaller0: entered promiscuous mode [ 747.291875][T14173] syzkaller0: entered allmulticast mode [ 747.656715][ T1289] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.663277][ T1289] ieee802154 phy1 wpan1: encryption failed: -22 [ 748.232891][T14202] __nla_validate_parse: 15 callbacks suppressed [ 748.232910][T14202] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2797'. [ 748.287051][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802f419000: rx timeout, send abort [ 748.395683][T14207] syzkaller0: entered promiscuous mode [ 748.408726][T14207] syzkaller0: entered allmulticast mode [ 748.427075][T14209] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2800'. [ 748.575818][T14213] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2802'. [ 748.738441][T14220] netlink: 'syz.1.2805': attribute type 2 has an invalid length. [ 748.787172][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802f419800: rx timeout, send abort [ 748.795580][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802f419000: abort rx timeout. Force session deactivation [ 749.054022][T14230] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2809'. [ 749.144405][T14232] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2811'. [ 749.207023][T14234] syzkaller0: entered promiscuous mode [ 749.213854][T14234] syzkaller0: entered allmulticast mode [ 749.288364][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805b70cc00: rx timeout, send abort [ 749.297003][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802f419800: abort rx timeout. Force session deactivation [ 749.796744][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805b70cc00: abort rx timeout. Force session deactivation [ 749.966541][T14250] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2820'. [ 750.108644][T14253] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2821'. [ 750.291113][T14257] syzkaller0: entered promiscuous mode [ 750.296680][T14257] syzkaller0: entered allmulticast mode [ 750.751988][T14275] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2831'. [ 750.983681][T14279] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2833'. [ 751.431206][T14289] syzkaller0: entered promiscuous mode [ 751.456270][T14289] syzkaller0: entered allmulticast mode [ 751.633622][T14297] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2842'. [ 752.616280][T14320] syzkaller0: entered promiscuous mode [ 752.621991][T14320] syzkaller0: entered allmulticast mode [ 753.570729][T14336] __nla_validate_parse: 6 callbacks suppressed [ 753.570758][T14336] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2862'. [ 753.605663][T14340] netlink: 'syz.1.2863': attribute type 46 has an invalid length. [ 753.812132][T14347] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2866'. [ 753.826452][T14345] syzkaller0: entered promiscuous mode [ 753.834221][T14345] syzkaller0: entered allmulticast mode [ 753.846394][T14346] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2865'. [ 753.857931][T14347] netlink: 339 bytes leftover after parsing attributes in process `syz.2.2866'. [ 754.359917][T14364] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2875'. [ 754.422498][T14364] 8021q: adding VLAN 0 to HW filter on device bond1 [ 754.430522][T14365] netlink: 'syz.2.2873': attribute type 46 has an invalid length. [ 754.459247][T14364] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 754.550891][T14368] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2876'. [ 754.657636][T14370] netlink: 'syz.3.2879': attribute type 1 has an invalid length. [ 754.684075][T14370] netlink: 'syz.3.2879': attribute type 2 has an invalid length. [ 754.704374][T14374] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2877'. [ 754.717444][T14374] netlink: 347 bytes leftover after parsing attributes in process `syz.2.2877'. [ 755.136842][T14386] netlink: 'syz.3.2885': attribute type 46 has an invalid length. [ 755.220704][T14390] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2887'. [ 755.240755][T14389] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2886'. [ 755.408535][T14389] 8021q: adding VLAN 0 to HW filter on device bond1 [ 755.933395][T14413] netlink: 'syz.3.2897': attribute type 46 has an invalid length. [ 756.643426][T14423] 8021q: adding VLAN 0 to HW filter on device bond1 [ 757.043240][T14435] netlink: 'syz.2.2907': attribute type 46 has an invalid length. [ 757.293158][T14443] netlink: 'syz.0.2911': attribute type 2 has an invalid length. [ 757.316477][T14443] netlink: 'syz.0.2911': attribute type 2 has an invalid length. [ 757.698245][T14455] 8021q: adding VLAN 0 to HW filter on device bond2 [ 757.948341][T14465] netlink: 'syz.3.2921': attribute type 46 has an invalid length. [ 758.030135][T14467] netlink: 'syz.0.2922': attribute type 29 has an invalid length. [ 758.648972][T14483] 8021q: adding VLAN 0 to HW filter on device bond2 [ 758.669667][T14482] __nla_validate_parse: 12 callbacks suppressed [ 758.669685][T14482] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2929'. [ 758.691037][T14486] team0: Device hsr0 is up. Set it down before adding it as a team port [ 758.897188][T14490] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2932'. [ 758.954577][T14494] netlink: 67 bytes leftover after parsing attributes in process `syz.0.2933'. [ 759.450776][T14506] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2941'. [ 759.668509][T14515] validate_nla: 8 callbacks suppressed [ 759.668526][T14515] netlink: 'syz.0.2944': attribute type 2 has an invalid length. [ 759.706592][T14515] netlink: 'syz.0.2944': attribute type 2 has an invalid length. [ 759.722890][T14515] netlink: 67 bytes leftover after parsing attributes in process `syz.0.2944'. [ 759.743921][T14513] syzkaller0: entered promiscuous mode [ 759.750132][T14513] syzkaller0: entered allmulticast mode [ 759.915601][T14518] netlink: 'syz.0.2946': attribute type 46 has an invalid length. [ 759.936001][T14518] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2946'. [ 760.629749][T14536] netlink: 'syz.0.2955': attribute type 2 has an invalid length. [ 760.638414][T14538] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2956'. [ 760.663602][T14536] netlink: 'syz.0.2955': attribute type 2 has an invalid length. [ 760.709599][T14536] netlink: 67 bytes leftover after parsing attributes in process `syz.0.2955'. [ 760.718698][T14538] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2956'. [ 760.751324][T14539] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2956'. [ 760.787445][T14542] netlink: 'syz.1.2958': attribute type 46 has an invalid length. [ 761.038263][T14550] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 761.563668][T14556] 8021q: adding VLAN 0 to HW filter on device bond3 [ 761.852231][T14566] netlink: 'syz.1.2967': attribute type 2 has an invalid length. [ 761.915991][T14566] netlink: 'syz.1.2967': attribute type 2 has an invalid length. [ 762.590880][T14581] syzkaller0: entered promiscuous mode [ 762.596445][T14581] syzkaller0: entered allmulticast mode [ 762.842061][T14592] netlink: 'syz.3.2978': attribute type 2 has an invalid length. [ 762.882512][T14592] netlink: 'syz.3.2978': attribute type 2 has an invalid length. [ 764.283425][T14639] __nla_validate_parse: 8 callbacks suppressed [ 764.283442][T14639] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3001'. [ 764.757519][T14649] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3007'. [ 765.416892][T14673] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3018'. [ 765.769241][T12378] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 765.979509][T12378] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 766.002186][T12378] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 766.027424][T12378] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 766.053081][T12378] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 766.067582][T14695] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3028'. [ 766.080919][T12378] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 766.093206][T14693] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3027'. [ 766.138230][T12378] usb 1-1: config 0 descriptor?? [ 766.211746][T12385] page_pool_release_retry() stalled pool shutdown 1 inflight 60 sec [ 766.289358][T14693] 8021q: adding VLAN 0 to HW filter on device bond4 [ 766.400043][T14706] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 766.604287][T12378] plantronics 0003:047F:FFFF.0001: No inputs registered, leaving [ 766.637622][T12378] plantronics 0003:047F:FFFF.0001: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 766.827365][T12385] usb 1-1: USB disconnect, device number 3 [ 766.904542][T14718] NILFS (loop1): device size too small [ 766.923839][T14712] fido_id[14712]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/1-1/report_descriptor': No such file or directory [ 767.190841][T14726] validate_nla: 2 callbacks suppressed [ 767.190860][T14726] netlink: 'syz.1.3038': attribute type 46 has an invalid length. [ 767.226694][T14728] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3040'. [ 767.283940][T14728] 8021q: adding VLAN 0 to HW filter on device bond1 [ 767.929274][T14751] netlink: 'syz.3.3049': attribute type 46 has an invalid length. [ 768.037504][T14756] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3052'. [ 768.173506][T14756] 8021q: adding VLAN 0 to HW filter on device bond5 [ 768.213254][T14764] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3054'. [ 768.289190][T12378] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 768.489639][T12378] usb 1-1: Using ep0 maxpacket: 8 [ 768.509769][T12378] usb 1-1: config 179 has an invalid interface number: 65 but max is 0 [ 768.528528][T12378] usb 1-1: config 179 has no interface number 0 [ 768.548832][T12378] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 768.583204][T12378] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 768.625175][T12378] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 768.642858][T12378] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 768.661156][T12378] usb 1-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 768.684007][T12378] usb 1-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 768.695544][T12378] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 768.710557][T14757] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 768.727500][T14778] netlink: 'syz.3.3061': attribute type 46 has an invalid length. [ 769.000591][T12378] input: Generic X-Box pad as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:179.65/input/input5 [ 769.177457][T14757] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 769.200410][T14757] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 769.263894][T14757] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 769.308503][T14757] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 769.361614][T12462] usb 1-1: USB disconnect, device number 4 [ 769.361680][ C1] xpad 1-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 769.372707][T14792] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3066'. [ 769.376292][ C1] xpad 1-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 769.400744][T12378] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 769.414226][T12462] xpad 1-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 769.555585][T14792] 8021q: adding VLAN 0 to HW filter on device bond2 [ 769.589917][T12378] usb 4-1: Using ep0 maxpacket: 16 [ 769.600305][T12378] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 769.623938][T12378] usb 4-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice=c2.87 [ 769.642445][T12378] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 769.664271][T12378] usb 4-1: Product: syz [ 769.668542][T12378] usb 4-1: Manufacturer: syz [ 769.686054][T12378] usb 4-1: SerialNumber: syz [ 769.712378][T12378] usb 4-1: config 0 descriptor?? [ 769.757934][T12378] port100 4-1:0.0: NFC: Could not find bulk-in or bulk-out endpoint [ 769.978626][T12385] usb 4-1: USB disconnect, device number 2 [ 770.486775][T14814] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3073'. [ 770.788523][T14825] netlink: 'syz.3.3076': attribute type 2 has an invalid length. [ 770.812370][T14826] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3075'. [ 770.896416][T14826] 8021q: adding VLAN 0 to HW filter on device bond6 [ 770.905706][T14825] netlink: 'syz.3.3076': attribute type 2 has an invalid length. [ 770.930189][T14825] netlink: 67 bytes leftover after parsing attributes in process `syz.3.3076'. [ 771.229923][T14840] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3083'. [ 771.723602][T14859] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3090'. [ 771.786587][T14859] 8021q: adding VLAN 0 to HW filter on device bond3 [ 771.977691][T14870] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3094'. [ 771.988942][T14872] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.3093'. [ 772.015891][T14867] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.3093'. [ 772.616156][T14891] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3103'. [ 772.718694][T14891] 8021q: adding VLAN 0 to HW filter on device bond2 [ 773.156467][T14911] overlayfs: failed to clone upperpath [ 773.193623][T14911] overlayfs: failed to clone upperpath [ 773.657625][T14926] 8021q: adding VLAN 0 to HW filter on device bond4 [ 773.665884][T14927] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 774.497024][T14964] __nla_validate_parse: 2 callbacks suppressed [ 774.497044][T14964] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3128'. [ 774.556344][T14964] 8021q: adding VLAN 0 to HW filter on device bond3 [ 774.578610][T14964] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3128'. [ 774.599356][T12462] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 774.831700][T12462] usb 4-1: unable to get BOS descriptor or descriptor too short [ 774.858298][T12462] usb 4-1: not running at top speed; connect to a high speed hub [ 774.900166][T12462] usb 4-1: config 5 has an invalid interface number: 152 but max is 0 [ 774.908421][T12462] usb 4-1: config 5 has no interface number 0 [ 774.931449][T12462] usb 4-1: config 5 interface 152 has no altsetting 0 [ 774.976668][T12462] usb 4-1: string descriptor 0 read error: -22 [ 774.989302][T12462] usb 4-1: New USB device found, idVendor=0fd9, idProduct=002c, bcdDevice=f5.2e [ 775.024805][T12462] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 775.100808][T12462] as10x_usb: device has been detected [ 775.120281][T12462] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT Deluxe) [ 775.217311][T12462] usb 4-1: DVB: registering adapter 1 frontend 0 (Elgato EyeTV DTT Deluxe)... [ 775.403959][T12462] as10x_usb: error during firmware upload part1 [ 775.425611][T14997] capability: warning: `syz.1.3141' uses 32-bit capabilities (legacy support in use) [ 775.436448][T12462] Registered device Elgato EyeTV DTT Deluxe [ 775.451111][T14997] program syz.1.3141 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 775.484198][T14998] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3140'. [ 775.510007][T12462] usb 4-1: USB disconnect, device number 3 [ 775.647772][T12462] Unregistered device Elgato EyeTV DTT Deluxe [ 775.675191][T14998] 8021q: adding VLAN 0 to HW filter on device bond7 [ 775.689615][T12462] as10x_usb: device has been disconnected [ 775.727171][T15001] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3140'. [ 776.273663][T15023] netlink: 'syz.2.3150': attribute type 2 has an invalid length. [ 776.306318][T15023] netlink: 'syz.2.3150': attribute type 2 has an invalid length. [ 776.322905][T15023] netlink: 1347 bytes leftover after parsing attributes in process `syz.2.3150'. [ 776.355112][T15025] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3152'. [ 776.498614][T15025] 8021q: adding VLAN 0 to HW filter on device bond3 [ 776.558194][T15028] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3152'. [ 776.781235][T15041] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3158'. [ 777.033971][T15049] netlink: 'syz.2.3162': attribute type 2 has an invalid length. [ 777.054811][T15049] netlink: 'syz.2.3162': attribute type 2 has an invalid length. [ 777.081177][T15049] netlink: 1347 bytes leftover after parsing attributes in process `syz.2.3162'. [ 777.270847][T15057] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3166'. [ 777.386217][T15057] 8021q: adding VLAN 0 to HW filter on device bond5 [ 777.872591][T15080] netlink: 'syz.2.3176': attribute type 2 has an invalid length. [ 777.884858][T15080] netlink: 'syz.2.3176': attribute type 2 has an invalid length. [ 778.286420][T15091] 8021q: adding VLAN 0 to HW filter on device bond4 [ 778.649830][T15109] netlink: 'syz.1.3189': attribute type 2 has an invalid length. [ 779.027985][T15124] 8021q: adding VLAN 0 to HW filter on device bond5 [ 779.768608][T15147] __nla_validate_parse: 7 callbacks suppressed [ 779.768627][T15147] netlink: 52 bytes leftover after parsing attributes in process `syz.1.3206'. [ 779.928564][T15153] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3210'. [ 780.062078][T15133] loop2: detected capacity change from 0 to 32768 [ 780.131775][T15153] 8021q: adding VLAN 0 to HW filter on device bond6 [ 780.140096][T15155] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3210'. [ 780.171813][T15155] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3210'. [ 781.879374][T15177] netlink: 52 bytes leftover after parsing attributes in process `syz.1.3219'. [ 782.862750][T15210] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3230'. [ 783.496741][T15202] loop1: detected capacity change from 0 to 32768 [ 783.837089][T15232] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3239'. [ 785.339274][T12462] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 785.571714][T12462] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 785.606100][T12462] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 785.629159][T12462] usb 1-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 785.656014][T12462] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 785.691673][T12462] usb 1-1: config 0 descriptor?? [ 785.717413][T15257] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3250'. [ 785.829487][T12385] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 786.029355][T12385] usb 4-1: Using ep0 maxpacket: 16 [ 786.038967][T12385] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 786.053024][T12385] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 786.081378][T12385] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 786.095760][T12385] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 786.113233][T12462] playstation 0003:054C:0DF2.0002: unknown main item tag 0x0 [ 786.119508][T12385] usb 4-1: Product: syz [ 786.134975][T12385] usb 4-1: Manufacturer: syz [ 786.136353][T12462] playstation 0003:054C:0DF2.0002: unknown main item tag 0x0 [ 786.155219][T12462] playstation 0003:054C:0DF2.0002: unknown main item tag 0x0 [ 786.157492][T12385] usb 4-1: SerialNumber: syz [ 786.167259][T12462] playstation 0003:054C:0DF2.0002: unknown main item tag 0x0 [ 786.167333][T12462] playstation 0003:054C:0DF2.0002: unknown main item tag 0x0 [ 786.204439][T12462] playstation 0003:054C:0DF2.0002: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.0-1/input0 [ 786.308371][T12462] playstation 0003:054C:0DF2.0002: Invalid byte count transferred, expected 20 got 0 [ 786.338699][T12462] playstation 0003:054C:0DF2.0002: Failed to retrieve DualSense pairing info: -22 [ 786.348597][T12462] playstation 0003:054C:0DF2.0002: Failed to get MAC address from DualSense [ 786.366803][T12462] playstation 0003:054C:0DF2.0002: Failed to create dualsense. [ 786.389436][T12462] playstation: probe of 0003:054C:0DF2.0002 failed with error -22 [ 786.435501][T12385] usb 4-1: 0:2 : does not exist [ 786.460429][T12385] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 786.530076][T12462] usb 1-1: USB disconnect, device number 5 [ 786.576117][T12385] usb 4-1: USB disconnect, device number 4 [ 786.663558][T13428] udevd[13428]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 786.830055][T15267] loop2: detected capacity change from 0 to 32768 [ 788.763464][T15288] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3263'. [ 788.794224][T15288] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3263'. [ 788.821018][T15288] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3263'. [ 789.779229][T12378] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 789.981812][T15305] loop0: detected capacity change from 0 to 32768 [ 789.989236][T12378] usb 3-1: Using ep0 maxpacket: 32 [ 790.019693][T12378] usb 3-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 790.034554][T12378] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 790.063059][T12378] usb 3-1: Product: syz [ 790.077623][T12378] usb 3-1: Manufacturer: syz [ 790.095037][T12378] usb 3-1: SerialNumber: syz [ 790.103746][T12462] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 790.116100][T12378] usb 3-1: config 0 descriptor?? [ 790.124167][T12462] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 790.132273][T12462] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 790.143572][T12378] dvb-usb: found a 'Pinnacle 450e DVB-S USB2.0' in warm state. [ 790.161723][T12462] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 790.172385][T12378] dvb-usb: bulk message failed: -22 (4/0) [ 790.178663][T12378] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 790.189179][T12462] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 790.197491][T12462] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 790.244728][T12378] dvb-usb: bulk message failed: -22 (5/0) [ 790.262864][T12462] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 790.289539][T12378] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 790.323523][T12462] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 790.371700][T12462] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 790.392355][T12378] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 790.402907][T12462] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 790.417448][T12462] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 790.441409][T12378] dvbdev: DVB: registering new adapter (Pinnacle 450e DVB-S USB2.0) [ 790.474838][T12462] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 791.518256][ T5817] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 791.527379][T12378] usb 3-1: media controller created [ 791.533177][T12462] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 791.548278][T12462] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 791.567472][T12462] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 791.582604][T12378] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 791.591159][T12462] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 791.598686][T12462] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 791.615899][T12462] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 791.638739][T12462] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 791.646657][T12462] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 791.654199][T12462] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 791.661710][T12462] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 791.669199][T12462] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 791.677073][T12462] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 791.684665][T12462] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 791.694188][T12462] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 791.705273][T12378] usb 3-1: selecting invalid altsetting 3 [ 791.714888][T12462] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 791.729828][ T5817] usb 2-1: Using ep0 maxpacket: 16 [ 791.735999][T12378] ttusb2: set interface to alts=3 failed [ 791.766305][T12462] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 791.774928][ T5817] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 250, changing to 7 [ 791.804294][ T5817] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 210, changing to 7 [ 791.816288][T12462] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 791.870823][T12462] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 791.878715][T12462] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 791.887952][T12378] DVB: Unable to find symbol tda10086_attach() [ 791.902488][ T5817] usb 2-1: New USB device found, idVendor=047f, idProduct=c010, bcdDevice= 0.40 [ 791.919393][T12378] dvb-usb: no frontend was attached by 'Pinnacle 450e DVB-S USB2.0' [ 791.927630][ T5817] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 791.939747][T12462] hid-generic 0000:0000:0000.0003: hidraw0: HID v0.04 Device [syz1] on syz1 [ 791.952452][ T5817] usb 2-1: Product: syz [ 791.958830][T12378] dvb-usb: bulk message failed: -22 (4/0) [ 791.985277][ T5817] usb 2-1: Manufacturer: syz [ 791.999146][T12378] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 792.020153][ T5817] usb 2-1: SerialNumber: syz [ 792.049441][T12378] dvb-usb: bulk message failed: -22 (5/0) [ 792.069274][T12378] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 792.103900][T12378] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully initialized and connected. [ 792.157617][T12378] usb 3-1: USB disconnect, device number 2 [ 792.268159][T15332] fido_id[15332]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 792.356245][T12378] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully deinitialized and disconnected. [ 792.470107][ T5817] snd-usb-audio: probe of 2-1:1.0 failed with error -71 [ 792.496078][ T5817] usb 2-1: USB disconnect, device number 2 [ 792.936574][T12378] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 793.129301][T12378] usb 1-1: Using ep0 maxpacket: 16 [ 793.151089][T12378] usb 1-1: config 0 has an invalid interface number: 34 but max is 0 [ 793.175208][T12378] usb 1-1: config 0 has no interface number 0 [ 793.199183][T12378] usb 1-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 793.220490][T12378] usb 1-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 793.241277][T12378] usb 1-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 793.259216][T12378] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 793.278295][T12378] usb 1-1: Product: syz [ 793.288411][T12378] usb 1-1: Manufacturer: syz [ 793.298535][T12378] usb 1-1: SerialNumber: syz [ 793.315065][T12378] usb 1-1: config 0 descriptor?? [ 793.330058][T15346] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 793.337386][T15346] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 793.584952][T15346] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 793.592818][T15346] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 793.728030][T15356] loop2: detected capacity change from 0 to 32768 [ 793.959013][T15372] autofs4:pid:15372:autofs_fill_super: called with bogus options [ 795.342634][T12378] asix 1-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 795.367220][T12378] asix: probe of 1-1:0.34 failed with error -71 [ 795.384871][T12378] usb 1-1: USB disconnect, device number 6 [ 796.873720][T15407] loop0: detected capacity change from 0 to 32768 [ 797.218782][T15419] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3315'. [ 798.896842][T15441] input: syz1 as /devices/virtual/input/input6 [ 799.293926][ T786] batman_adv: batadv0: Interface deactivated: wlan0 [ 799.868621][T15473] syzkaller0: entered promiscuous mode [ 799.884528][T15473] syzkaller0: entered allmulticast mode [ 799.898815][ T5817] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 800.129133][ T5817] usb 1-1: Using ep0 maxpacket: 16 [ 800.138065][ T5817] usb 1-1: config 0 has an invalid descriptor of length 67, skipping remainder of the config [ 800.163889][ T5817] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 800.204760][ T5817] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x88 has invalid maxpacket 52208, setting to 1024 [ 800.239814][ T5817] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x88 has invalid maxpacket 1024 [ 800.289294][ T5817] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 800.377310][ T5817] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 800.409876][ T5817] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 800.418014][ T5817] usb 1-1: Manufacturer: syz [ 800.440002][ T5817] usb 1-1: config 0 descriptor?? [ 800.673621][ T5817] usb 1-1: USB disconnect, device number 7 [ 800.673622][T15490] syzkaller0: entered promiscuous mode [ 800.719500][T15490] syzkaller0: entered allmulticast mode [ 801.671855][T15528] syzkaller0: entered promiscuous mode [ 801.677448][T15528] syzkaller0: entered allmulticast mode [ 802.364321][ T28] audit: type=1326 audit(1782360705.497:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15551 comm="syz.1.3355" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fbfd319ce59 code=0x0 [ 802.617541][T15565] input: syz0 as /devices/virtual/input/input7 [ 802.831792][T15571] syzkaller0: entered promiscuous mode [ 802.837379][T15571] syzkaller0: entered allmulticast mode [ 803.368492][T15585] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3366'. [ 803.442128][T15585] 8021q: adding VLAN 0 to HW filter on device bond8 [ 803.749304][ T5817] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 803.818049][T15604] syzkaller0: entered promiscuous mode [ 803.823950][T15604] syzkaller0: entered allmulticast mode [ 803.969385][ T5817] usb 1-1: Using ep0 maxpacket: 32 [ 803.983950][ T5817] usb 1-1: config 0 has an invalid interface number: 196 but max is 0 [ 804.010321][ T5817] usb 1-1: config 0 has no interface number 0 [ 804.016544][ T5817] usb 1-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 804.059369][ T5817] usb 1-1: config 0 interface 196 has no altsetting 0 [ 804.087161][ T5817] usb 1-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 804.101108][ T5817] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 804.116890][ T5817] usb 1-1: Product: syz [ 804.129381][ T5817] usb 1-1: Manufacturer: syz [ 804.139656][ T5817] usb 1-1: SerialNumber: syz [ 804.180464][ T5817] usb 1-1: config 0 descriptor?? [ 804.191383][T15589] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 804.249510][ T786] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 804.259893][T15615] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 804.451556][ T786] usb 4-1: config 0 interface 0 altsetting 255 has an invalid endpoint with address 0xFF, skipping [ 804.482888][ T786] usb 4-1: config 0 interface 0 has no altsetting 0 [ 804.516308][ T786] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 804.549423][ T786] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 804.579316][ T786] usb 4-1: Product: syz [ 804.600500][ T786] usb 4-1: Manufacturer: syz [ 804.606266][T15626] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3380'. [ 804.619531][ T786] usb 4-1: SerialNumber: syz [ 804.640512][ T786] usb 4-1: config 0 descriptor?? [ 804.726855][ T786] snd-usb-audio: probe of 4-1:0.0 failed with error -22 [ 804.747533][T15626] 8021q: adding VLAN 0 to HW filter on device bond9 [ 804.848468][T15335] udevd[15335]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 804.897469][ T786] usb 4-1: USB disconnect, device number 5 [ 804.937027][ T5817] ipheth 1-1:0.196: ipheth_get_macaddr: usb_control_msg: -71 [ 804.965286][ T5817] ipheth: probe of 1-1:0.196 failed with error -71 [ 805.011950][ T5817] usb 1-1: USB disconnect, device number 8 [ 805.430100][T15649] syzkaller0: entered promiscuous mode [ 805.435792][T15649] syzkaller0: entered allmulticast mode [ 805.559278][T12386] page_pool_release_retry() stalled pool shutdown 1 inflight 60 sec [ 805.679577][ T786] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 805.774720][T15658] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 805.929250][ T786] usb 3-1: Using ep0 maxpacket: 16 [ 805.967914][ T786] usb 3-1: config 0 has an invalid descriptor of length 67, skipping remainder of the config [ 806.005063][ T786] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 806.036985][ T786] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x88 has invalid maxpacket 52208, setting to 1024 [ 806.065575][ T786] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x88 has invalid maxpacket 1024 [ 806.096801][ T786] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 806.142748][ T786] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 806.171489][ T786] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 806.190103][ T786] usb 3-1: Manufacturer: syz [ 806.205730][ T786] usb 3-1: config 0 descriptor?? [ 806.239239][T12462] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 806.439239][T12462] usb 1-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 806.475697][T12462] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 806.485851][T12462] usb 1-1: Product: syz [ 806.489601][ T786] usb 3-1: USB disconnect, device number 3 [ 806.493888][T12462] usb 1-1: Manufacturer: syz [ 806.511058][T12462] usb 1-1: SerialNumber: syz [ 806.607152][T15683] syzkaller0: entered promiscuous mode [ 806.612943][T15683] syzkaller0: entered allmulticast mode [ 806.763729][T12462] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -71 [ 806.802828][T12462] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -71 [ 806.831660][T12462] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -71 [ 806.889228][T12462] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 806.914463][T12462] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 806.948837][T12462] lan78xx: probe of 1-1:1.0 failed with error -71 [ 806.981256][T12462] usb 1-1: USB disconnect, device number 9 [ 807.190598][ T786] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 807.389233][ T786] usb 2-1: Using ep0 maxpacket: 8 [ 807.405534][ T786] usb 2-1: config 0 has an invalid interface number: 224 but max is 0 [ 807.427517][ T786] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 807.444083][ T786] usb 2-1: config 0 has no interface number 0 [ 807.457675][ T786] usb 2-1: New USB device found, idVendor=05e1, idProduct=0893, bcdDevice=fd.5b [ 807.476792][ T786] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 807.488205][ T786] usb 2-1: Product: syz [ 807.494466][ T786] usb 2-1: Manufacturer: syz [ 807.500239][ T786] usb 2-1: SerialNumber: syz [ 807.508626][ T786] usb 2-1: config 0 descriptor?? [ 807.520484][ T786] gspca_main: stk014-2.14.0 probing 05e1:0893 [ 807.527006][ T786] usb 2-1: selecting invalid altsetting 1 [ 807.661241][T15715] syzkaller0: entered promiscuous mode [ 807.666954][T15715] syzkaller0: entered allmulticast mode [ 807.744082][ T786] gspca_stk014: reg_r err -71 [ 807.755081][ T786] stk014: probe of 2-1:0.224 failed with error -71 [ 807.770357][ T786] usb 2-1: USB disconnect, device number 3 [ 808.042734][T15726] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 808.356893][T15736] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3417'. [ 808.462466][T15736] 8021q: adding VLAN 0 to HW filter on device bond10 [ 808.483951][T15740] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3417'. [ 808.653469][T15749] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 809.099917][ T1289] ieee802154 phy0 wpan0: encryption failed: -22 [ 809.106312][ T1289] ieee802154 phy1 wpan1: encryption failed: -22 [ 809.241655][T12378] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 809.272306][T15775] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3432'. [ 809.304425][T15775] 8021q: adding VLAN 0 to HW filter on device bond11 [ 809.312480][T15774] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 809.326168][T15775] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3432'. [ 809.335609][T12385] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 809.429567][T12378] usb 4-1: Using ep0 maxpacket: 8 [ 809.469762][T12378] usb 4-1: config 0 has an invalid interface number: 224 but max is 0 [ 809.478021][T12378] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 809.504947][T12378] usb 4-1: config 0 has no interface number 0 [ 809.522568][T12378] usb 4-1: New USB device found, idVendor=05e1, idProduct=0893, bcdDevice=fd.5b [ 809.525850][T12385] usb 1-1: Using ep0 maxpacket: 16 [ 809.536516][T12378] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 809.546212][T12378] usb 4-1: Product: syz [ 809.550782][T12378] usb 4-1: Manufacturer: syz [ 809.555435][T12378] usb 4-1: SerialNumber: syz [ 809.566533][T12385] usb 1-1: config 64 has an invalid interface number: 182 but max is 0 [ 809.572774][T12378] usb 4-1: config 0 descriptor?? [ 809.586641][T12385] usb 1-1: config 64 has no interface number 0 [ 809.597048][T12378] gspca_main: stk014-2.14.0 probing 05e1:0893 [ 809.599460][T12385] usb 1-1: config 64 interface 182 has no altsetting 0 [ 809.622310][T12378] usb 4-1: selecting invalid altsetting 1 [ 809.641288][T12385] usb 1-1: New USB device found, idVendor=03eb, idProduct=3a7e, bcdDevice=b5.63 [ 809.669387][T12385] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 809.685192][T12385] usb 1-1: Product: syz [ 809.696827][T12385] usb 1-1: Manufacturer: syz [ 809.706082][T12385] usb 1-1: SerialNumber: syz [ 809.837733][T12378] gspca_stk014: reg_r err -71 [ 809.843186][T12378] stk014: probe of 4-1:0.224 failed with error -71 [ 809.875856][T12378] usb 4-1: USB disconnect, device number 6 [ 810.011058][T12385] usb 1-1: USB disconnect, device number 10 [ 810.163248][T15796] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 810.264368][T15799] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3444'. [ 810.299338][T15799] 8021q: adding VLAN 0 to HW filter on device bond12 [ 810.316568][T15799] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3444'. [ 810.867997][T15816] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 810.968870][T15818] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3453'. [ 811.072870][T15818] 8021q: adding VLAN 0 to HW filter on device bond7 [ 811.105996][T15822] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3453'. [ 811.269339][T12378] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 811.479414][T12378] usb 3-1: Using ep0 maxpacket: 32 [ 811.488209][T12378] usb 3-1: config 0 has an invalid interface number: 67 but max is 0 [ 811.517189][T12378] usb 3-1: config 0 has no interface number 0 [ 811.530304][T12378] usb 3-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 811.540718][T12378] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 811.548764][T12378] usb 3-1: Product: syz [ 811.569882][T12378] usb 3-1: Manufacturer: syz [ 811.584884][T12378] usb 3-1: SerialNumber: syz [ 811.615914][T12378] usb 3-1: config 0 descriptor?? [ 811.631081][T12378] smsc95xx v2.0.0 [ 811.917912][T15857] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3466'. [ 811.994800][T15857] 8021q: adding VLAN 0 to HW filter on device bond4 [ 812.014800][T15861] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3466'. [ 812.049218][T12385] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 812.269365][T12385] usb 2-1: Using ep0 maxpacket: 32 [ 812.276909][T12385] usb 2-1: config 0 has an invalid interface number: 196 but max is 0 [ 812.299197][T12385] usb 2-1: config 0 has no interface number 0 [ 812.311571][T12385] usb 2-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 812.335126][T12385] usb 2-1: config 0 interface 196 has no altsetting 0 [ 812.347201][T12385] usb 2-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 812.369221][T12385] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 812.387682][T12385] usb 2-1: Product: syz [ 812.397802][T12385] usb 2-1: Manufacturer: syz [ 812.430998][T12385] usb 2-1: SerialNumber: syz [ 812.439496][T12385] usb 2-1: config 0 descriptor?? [ 812.445344][T15853] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 812.856780][T12378] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000030: -71 [ 812.897943][T12378] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Error writing E2P_CMD [ 812.922199][T12378] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 812.949360][T12378] smsc95xx: probe of 3-1:0.67 failed with error -71 [ 812.974984][T12378] usb 3-1: USB disconnect, device number 4 [ 813.039364][T12385] ipheth 2-1:0.196: ipheth_get_macaddr: usb_control_msg: -71 [ 813.062244][T12385] ipheth: probe of 2-1:0.196 failed with error -71 [ 813.107252][T12385] usb 2-1: USB disconnect, device number 4 [ 813.267012][T15882] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 813.423777][T15888] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3476'. [ 813.558493][T15888] 8021q: adding VLAN 0 to HW filter on device bond8 [ 813.568206][T15893] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3476'. [ 813.857519][T15907] netlink: 'syz.3.3485': attribute type 1 has an invalid length. [ 813.878284][T15907] netlink: 'syz.3.3485': attribute type 2 has an invalid length. [ 814.020788][T15909] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 814.363899][T15925] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3493'. [ 814.415830][T15925] 8021q: adding VLAN 0 to HW filter on device bond13 [ 814.464545][T15925] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3493'. [ 814.728184][T15938] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 815.189227][T12378] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 815.221507][T15959] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3507'. [ 815.289928][T15959] 8021q: adding VLAN 0 to HW filter on device bond5 [ 815.309581][T15961] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3507'. [ 815.379176][T12378] usb 4-1: Using ep0 maxpacket: 16 [ 815.389851][T12378] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 815.409901][T12378] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 815.423822][T12378] usb 4-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 815.434610][T12378] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 815.449972][T12378] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 815.459535][T12378] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 815.467617][T12378] usb 4-1: Manufacturer: syz [ 815.500766][T12378] usb 4-1: config 0 descriptor?? [ 815.658866][T15971] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 815.736167][T12378] usb 4-1: USB disconnect, device number 7 [ 816.080212][T15985] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3519'. [ 816.155448][T15985] 8021q: adding VLAN 0 to HW filter on device bond14 [ 816.170659][T15987] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3519'. [ 816.690107][ T5817] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 816.788268][T16010] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3531'. [ 816.830508][T16010] 8021q: adding VLAN 0 to HW filter on device bond15 [ 816.854389][T16010] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3531'. [ 816.889507][ T5817] usb 2-1: Using ep0 maxpacket: 32 [ 816.918143][ T5817] usb 2-1: config 0 has an invalid interface number: 196 but max is 0 [ 816.930818][ T5817] usb 2-1: config 0 has no interface number 0 [ 816.937111][ T5817] usb 2-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 816.947997][ T5817] usb 2-1: config 0 interface 196 has no altsetting 0 [ 816.959273][ T5817] usb 2-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 816.980325][ T5817] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 816.988498][ T5817] usb 2-1: Product: syz [ 817.003128][ T5817] usb 2-1: Manufacturer: syz [ 817.007829][ T5817] usb 2-1: SerialNumber: syz [ 817.032350][ T5817] usb 2-1: config 0 descriptor?? [ 817.056318][T15996] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 817.579447][ T5817] ipheth 2-1:0.196: ipheth_get_macaddr: usb_control_msg: -71 [ 817.587220][ T5817] ipheth: probe of 2-1:0.196 failed with error -71 [ 817.607695][ T5817] usb 2-1: USB disconnect, device number 5 [ 817.720802][T16034] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3541'. [ 817.755384][T16034] 8021q: adding VLAN 0 to HW filter on device bond9 [ 818.914763][T16072] netlink: 'syz.0.3559': attribute type 21 has an invalid length. [ 819.039636][ T786] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 819.249472][ T786] usb 3-1: Using ep0 maxpacket: 32 [ 819.261416][ T786] usb 3-1: config 0 has an invalid interface number: 196 but max is 0 [ 819.276844][ T786] usb 3-1: config 0 has no interface number 0 [ 819.283458][ T786] usb 3-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 819.294166][ T786] usb 3-1: config 0 interface 196 has no altsetting 0 [ 819.312009][ T786] usb 3-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 819.329594][T12378] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 819.331887][ T786] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 819.353367][ T786] usb 3-1: Product: syz [ 819.357710][ T786] usb 3-1: Manufacturer: syz [ 819.364164][ T786] usb 3-1: SerialNumber: syz [ 819.386600][ T786] usb 3-1: config 0 descriptor?? [ 819.400747][T16068] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 819.530605][T12378] usb 2-1: Using ep0 maxpacket: 16 [ 819.534802][T12378] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 819.534843][T12378] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 819.534897][T12378] usb 2-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 819.534921][T12378] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 819.538354][T12378] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 819.538390][T12378] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 819.538414][T12378] usb 2-1: Manufacturer: syz [ 819.542257][T12378] usb 2-1: config 0 descriptor?? [ 819.636675][ T786] ipheth 3-1:0.196: ipheth_get_macaddr: usb_control_msg: -71 [ 819.636839][ T786] ipheth: probe of 3-1:0.196 failed with error -71 [ 819.646311][ T786] usb 3-1: USB disconnect, device number 5 [ 819.772162][T12378] usb 2-1: USB disconnect, device number 6 [ 821.099544][ T5819] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 821.113157][T16131] syzkaller0: entered promiscuous mode [ 821.118722][T16131] syzkaller0: entered allmulticast mode [ 821.259346][ T786] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 821.279269][ T5819] usb 3-1: Using ep0 maxpacket: 32 [ 821.289728][ T5819] usb 3-1: config 0 has an invalid interface number: 196 but max is 0 [ 821.297978][ T5819] usb 3-1: config 0 has no interface number 0 [ 821.304781][ T5819] usb 3-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 821.315481][ T5819] usb 3-1: config 0 interface 196 has no altsetting 0 [ 821.340330][ T5819] usb 3-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 821.357527][ T5819] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 821.367312][ T5819] usb 3-1: Product: syz [ 821.372122][ T5819] usb 3-1: Manufacturer: syz [ 821.376790][ T5819] usb 3-1: SerialNumber: syz [ 821.391418][ T5819] usb 3-1: config 0 descriptor?? [ 821.398168][T16123] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 821.457189][ T786] usb 2-1: Using ep0 maxpacket: 16 [ 821.464627][ T786] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 821.509294][ T786] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 821.539882][ T786] usb 2-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 821.562685][ T786] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 821.587385][ T786] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 821.608479][ T786] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 821.630086][ T786] usb 2-1: Manufacturer: syz [ 821.640488][ T5819] ipheth 3-1:0.196: ipheth_get_macaddr: usb_control_msg: -71 [ 821.649273][ T786] usb 2-1: config 0 descriptor?? [ 821.668545][ T5819] ipheth: probe of 3-1:0.196 failed with error -71 [ 821.697835][ T5819] usb 3-1: USB disconnect, device number 6 [ 821.862490][T12462] usb 2-1: USB disconnect, device number 7 [ 822.036803][T16151] syzkaller0: entered promiscuous mode [ 822.044755][T16151] syzkaller0: entered allmulticast mode [ 822.594723][T16167] __nla_validate_parse: 3 callbacks suppressed [ 822.594741][T16167] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3601'. [ 822.743006][T16171] syzkaller0: entered promiscuous mode [ 822.757734][T16171] syzkaller0: entered allmulticast mode [ 823.280680][ T786] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 823.480087][ T786] usb 2-1: Using ep0 maxpacket: 32 [ 823.519885][ T786] usb 2-1: config 0 has an invalid interface number: 196 but max is 0 [ 823.528481][ T786] usb 2-1: config 0 has no interface number 0 [ 823.540297][ T786] usb 2-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 823.557058][ T786] usb 2-1: config 0 interface 196 has no altsetting 0 [ 823.568609][ T786] usb 2-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 823.588475][ T786] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 823.602174][ T786] usb 2-1: Product: syz [ 823.608575][ T786] usb 2-1: Manufacturer: syz [ 823.618682][ T786] usb 2-1: SerialNumber: syz [ 823.641232][ T786] usb 2-1: config 0 descriptor?? [ 823.648043][T16179] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 823.908176][ T786] ipheth 2-1:0.196: ipheth_get_macaddr: usb_control_msg: -71 [ 823.920303][ T786] ipheth: probe of 2-1:0.196 failed with error -71 [ 823.936335][ T786] usb 2-1: USB disconnect, device number 8 [ 826.120471][ T5817] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 826.319209][ T5817] usb 2-1: Using ep0 maxpacket: 16 [ 826.345456][ T5817] usb 2-1: config 0 has an invalid descriptor of length 46, skipping remainder of the config [ 826.370840][ T5817] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 826.398362][ T5817] usb 2-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xFA, skipping [ 826.415855][ T5817] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 826.427554][T16284] syzkaller0: entered promiscuous mode [ 826.440273][ T5817] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 826.452806][T16284] syzkaller0: entered allmulticast mode [ 826.457889][ T5817] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 826.471507][ T5817] usb 2-1: Manufacturer: syz [ 826.487707][ T5817] usb 2-1: config 0 descriptor?? [ 826.715972][ T5817] usb 2-1: USB disconnect, device number 9 [ 826.969977][T16301] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3661'. [ 827.015820][T16301] 8021q: adding VLAN 0 to HW filter on device bond6 [ 827.383421][T16315] syzkaller0: entered promiscuous mode [ 827.395863][T16315] syzkaller0: entered allmulticast mode [ 828.008648][T16336] sg_write: data in/out 360512/136 bytes for SCSI command 0x0-- guessing data in; [ 828.008648][T16336] program syz.1.3677 not setting count and/or reply_len properly [ 828.211630][T16345] syzkaller0: entered promiscuous mode [ 828.217318][T16345] syzkaller0: entered allmulticast mode [ 828.239187][T12385] usb 1-1: new full-speed USB device number 11 using dummy_hcd [ 828.259178][ T786] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 828.449798][T12385] usb 1-1: New USB device found, idVendor=13d3, idProduct=3224, bcdDevice=cb.0d [ 828.459355][ T786] usb 4-1: Using ep0 maxpacket: 16 [ 828.467399][T12385] usb 1-1: New USB device strings: Mfr=1, Product=12, SerialNumber=3 [ 828.480051][ T786] usb 4-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xF3, skipping [ 828.490976][T12385] usb 1-1: Product: syz [ 828.495190][T12385] usb 1-1: Manufacturer: syz [ 828.500517][T12385] usb 1-1: SerialNumber: syz [ 828.508238][ T786] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 828.520087][ T786] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 828.543854][T12385] dvb-usb: found a 'DigitalNow TinyUSB 2 DVB-t Receiver' in warm state. [ 828.557572][ T786] usb 4-1: Product: syz [ 828.563310][ T786] usb 4-1: Manufacturer: syz [ 828.570676][ T786] usb 4-1: SerialNumber: syz [ 828.585776][ T786] usb 4-1: config 0 descriptor?? [ 828.968451][T12385] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 828.989793][T12385] dvb-usb: DigitalNow TinyUSB 2 DVB-t Receiver error while loading driver (-19) [ 829.107204][T16366] syzkaller0: entered promiscuous mode [ 829.118622][T16366] syzkaller0: entered allmulticast mode [ 829.195482][T12385] usb 1-1: USB disconnect, device number 11 [ 829.855286][T16393] syzkaller0: entered promiscuous mode [ 829.868647][T16393] syzkaller0: entered allmulticast mode [ 830.398861][T16415] ieee802154 phy0 wpan0: encryption failed: -22 [ 830.764177][T16426] syzkaller0: entered promiscuous mode [ 830.779211][T16426] syzkaller0: entered allmulticast mode [ 831.068525][ T5817] usb 4-1: USB disconnect, device number 8 [ 831.169244][T16440] ieee802154 phy0 wpan0: encryption failed: -22 [ 831.505968][T16452] syzkaller0: entered promiscuous mode [ 831.518926][T16452] syzkaller0: entered allmulticast mode [ 831.683861][T16460] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3732'. [ 831.771057][T16464] ieee802154 phy0 wpan0: encryption failed: -22 [ 831.874306][T16460] 8021q: adding VLAN 0 to HW filter on device bond10 [ 832.358430][T16487] syzkaller0: entered promiscuous mode [ 832.359964][ T5817] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 832.378163][T16487] syzkaller0: entered allmulticast mode [ 832.559255][ T5817] usb 4-1: Using ep0 maxpacket: 32 [ 832.580332][ T5817] usb 4-1: config 0 has an invalid interface number: 196 but max is 0 [ 832.620174][ T5817] usb 4-1: config 0 has no interface number 0 [ 832.629978][ T5817] usb 4-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 832.659118][ T5817] usb 4-1: config 0 interface 196 has no altsetting 0 [ 832.678961][ T5817] usb 4-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 832.690093][T16497] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3747'. [ 832.700072][ T5817] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 832.708139][ T5817] usb 4-1: Product: syz [ 832.719170][ T5817] usb 4-1: Manufacturer: syz [ 832.729402][ T5817] usb 4-1: SerialNumber: syz [ 832.742803][ T5817] usb 4-1: config 0 descriptor?? [ 832.750192][T16478] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 832.784788][T16497] 8021q: adding VLAN 0 to HW filter on device bond7 [ 833.231924][T12462] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 833.274749][ T5817] ipheth 4-1:0.196: ipheth_get_macaddr: usb_control_msg: -71 [ 833.286533][ T5817] ipheth: probe of 4-1:0.196 failed with error -71 [ 833.298977][ T5817] usb 4-1: USB disconnect, device number 9 [ 833.439448][T12462] usb 1-1: Using ep0 maxpacket: 16 [ 833.458928][T12462] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 833.471354][T12462] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 833.480373][T12385] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 833.495334][T12462] usb 1-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 833.506536][T12462] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 833.528234][T12462] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 833.537831][T12462] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 833.549121][T12462] usb 1-1: Manufacturer: syz [ 833.568850][T12462] usb 1-1: config 0 descriptor?? [ 833.634062][T16522] syzkaller0: entered promiscuous mode [ 833.641698][T16522] syzkaller0: entered allmulticast mode [ 833.683889][T12385] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 833.718344][T12385] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 833.729796][T12385] usb 2-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 833.739012][T12385] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 833.751244][T12385] usb 2-1: config 0 descriptor?? [ 833.825722][ T5817] usb 1-1: USB disconnect, device number 12 [ 833.955800][T16528] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3758'. [ 833.998822][T16528] 8021q: adding VLAN 0 to HW filter on device bond16 [ 834.173473][T12385] cp2112 0003:10C4:EA90.0004: unknown main item tag 0x0 [ 834.181617][T12385] cp2112 0003:10C4:EA90.0004: unknown main item tag 0x0 [ 834.188647][T12385] cp2112 0003:10C4:EA90.0004: unknown main item tag 0x0 [ 834.196662][T12385] cp2112 0003:10C4:EA90.0004: unknown main item tag 0x0 [ 834.204163][T12385] cp2112 0003:10C4:EA90.0004: unknown main item tag 0x0 [ 834.211661][T12385] cp2112 0003:10C4:EA90.0004: unknown main item tag 0x0 [ 834.218696][T12385] cp2112 0003:10C4:EA90.0004: unknown main item tag 0x0 [ 834.231634][T12385] cp2112 0003:10C4:EA90.0004: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.1-1/input0 [ 834.373512][T12385] cp2112 0003:10C4:EA90.0004: Part Number: 0x00 Device Version: 0x00 [ 834.994302][T16513] cp2112 0003:10C4:EA90.0004: Error starting transaction: -38 [ 835.031146][T12385] cp2112 0003:10C4:EA90.0004: error reading lock byte: -71 [ 835.082395][T12385] usb 2-1: USB disconnect, device number 10 [ 835.111190][T16549] netlink: 104 bytes leftover after parsing attributes in process `syz.3.3764'. [ 835.391496][T16555] syzkaller0: entered promiscuous mode [ 835.401089][T16555] syzkaller0: entered allmulticast mode [ 835.419691][T16557] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3768'. [ 835.472432][T16557] 8021q: adding VLAN 0 to HW filter on device bond17 [ 836.137462][T16581] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3777'. [ 836.189821][T16581] 8021q: adding VLAN 0 to HW filter on device bond11 [ 836.216624][T16586] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3778'. [ 836.397420][T16590] syzkaller0: entered promiscuous mode [ 836.416781][T16590] syzkaller0: entered allmulticast mode [ 836.879720][T16609] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3787'. [ 837.006922][T16609] 8021q: adding VLAN 0 to HW filter on device bond8 [ 837.219439][T16619] syzkaller0: entered promiscuous mode [ 837.235785][T16619] syzkaller0: entered allmulticast mode [ 837.629496][ T5817] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 837.869454][ T5817] usb 1-1: Using ep0 maxpacket: 16 [ 837.884451][ T5817] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 837.907370][ T5817] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 837.939427][ T5817] usb 1-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 837.973427][ T5817] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 837.995734][T16639] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3801'. [ 838.008177][ T5817] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 838.022338][ T5817] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 838.034288][ T5817] usb 1-1: Manufacturer: syz [ 838.070749][ T5817] usb 1-1: config 0 descriptor?? [ 838.089229][T16639] 8021q: adding VLAN 0 to HW filter on device bond12 [ 838.157901][T16648] syzkaller0: entered promiscuous mode [ 838.163858][T16648] syzkaller0: entered allmulticast mode [ 838.312158][ T5817] usb 1-1: USB disconnect, device number 13 [ 838.990455][T16673] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3813'. [ 839.098247][T16673] 8021q: adding VLAN 0 to HW filter on device bond18 [ 840.149618][T16711] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3825'. [ 840.206960][T16711] 8021q: adding VLAN 0 to HW filter on device bond9 [ 840.951916][T16734] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3836'. [ 841.073759][T16734] 8021q: adding VLAN 0 to HW filter on device bond13 [ 841.636143][T16751] sctp: [Deprecated]: syz.2.3843 (pid 16751) Use of int in max_burst socket option. [ 841.636143][T16751] Use struct sctp_assoc_value instead [ 841.659815][T12386] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 841.871228][T12386] usb 4-1: Using ep0 maxpacket: 32 [ 841.893310][T12386] usb 4-1: config 0 has an invalid interface number: 196 but max is 0 [ 841.908547][T12386] usb 4-1: config 0 has no interface number 0 [ 841.925769][T12386] usb 4-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 841.959381][T12386] usb 4-1: config 0 interface 196 has no altsetting 0 [ 841.974256][T12386] usb 4-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 841.983688][T12386] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 842.007329][T12386] usb 4-1: Product: syz [ 842.024530][T12386] usb 4-1: Manufacturer: syz [ 842.043089][T12386] usb 4-1: SerialNumber: syz [ 842.057012][T12386] usb 4-1: config 0 descriptor?? [ 842.080694][T16745] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 842.310292][T16764] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3848'. [ 842.427865][T16764] 8021q: adding VLAN 0 to HW filter on device bond19 [ 842.596619][T12386] ipheth 4-1:0.196: ipheth_get_macaddr: usb_control_msg: -71 [ 842.610500][T12386] ipheth: probe of 4-1:0.196 failed with error -71 [ 842.631885][T12386] usb 4-1: USB disconnect, device number 10 [ 843.700018][T16790] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3859'. [ 844.059273][T12385] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 844.193355][T12386] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 844.259218][T12385] usb 4-1: Using ep0 maxpacket: 32 [ 844.266906][T12385] usb 4-1: config 0 has an invalid interface number: 196 but max is 0 [ 844.276994][T12385] usb 4-1: config 0 has no interface number 0 [ 844.288116][T12385] usb 4-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 844.301524][T16810] misc userio: The device must be registered before sending interrupts [ 844.317607][T12385] usb 4-1: config 0 interface 196 has no altsetting 0 [ 844.333481][T12385] usb 4-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 844.353031][T12385] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 844.371557][T12385] usb 4-1: Product: syz [ 844.379220][T12385] usb 4-1: Manufacturer: syz [ 844.383931][T12385] usb 4-1: SerialNumber: syz [ 844.402262][T12386] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 844.414326][T12385] usb 4-1: config 0 descriptor?? [ 844.423678][T12386] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 844.459502][T16794] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 844.472530][T12386] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 844.501584][T12386] usb 3-1: config 0 descriptor?? [ 844.514949][T12386] pwc: Askey VC010 type 2 USB webcam detected. [ 844.852357][T16817] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3869'. [ 844.931982][T12386] pwc: recv_control_msg error -32 req 02 val 2b00 [ 844.952431][T12386] pwc: recv_control_msg error -32 req 02 val 2700 [ 844.962846][T12386] pwc: recv_control_msg error -32 req 02 val 2c00 [ 844.981469][T12386] pwc: recv_control_msg error -32 req 04 val 1000 [ 844.999760][T12386] pwc: recv_control_msg error -32 req 04 val 1300 [ 845.009519][T12386] pwc: recv_control_msg error -32 req 04 val 1400 [ 845.018894][T12386] pwc: recv_control_msg error -32 req 02 val 2000 [ 845.031404][T16817] 8021q: adding VLAN 0 to HW filter on device bond6 [ 845.073166][T12385] ipheth 4-1:0.196: ipheth_get_macaddr: usb_control_msg: -71 [ 845.088357][T12385] ipheth: probe of 4-1:0.196 failed with error -71 [ 845.109993][T12385] usb 4-1: USB disconnect, device number 11 [ 845.229236][T12386] pwc: recv_control_msg error -71 req 04 val 1500 [ 845.249264][T12386] pwc: recv_control_msg error -71 req 02 val 2500 [ 845.266946][T12386] pwc: recv_control_msg error -71 req 02 val 2400 [ 845.284473][T12386] pwc: recv_control_msg error -71 req 02 val 2600 [ 845.299660][T12386] pwc: recv_control_msg error -71 req 02 val 2900 [ 845.316844][T12386] pwc: recv_control_msg error -71 req 02 val 2800 [ 845.331005][T12386] pwc: recv_control_msg error -71 req 04 val 1100 [ 845.348289][T12386] pwc: recv_control_msg error -71 req 04 val 1200 [ 845.429961][T12386] pwc: Registered as video103. [ 845.456604][T12386] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input11 [ 845.509858][T12386] usb 3-1: USB disconnect, device number 7 [ 845.853894][T16833] misc userio: The device must be registered before sending interrupts [ 845.909757][T16835] syzkaller0: entered promiscuous mode [ 845.934298][T16835] syzkaller0: entered allmulticast mode [ 845.964331][T16839] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3878'. [ 846.026865][T16839] 8021q: adding VLAN 0 to HW filter on device bond20 [ 846.072665][T16842] Bluetooth: MGMT ver 1.22 [ 846.587154][T16861] misc userio: The device must be registered before sending interrupts [ 846.719188][T12385] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 846.763446][T16866] syzkaller0: entered promiscuous mode [ 846.781534][T16866] syzkaller0: entered allmulticast mode [ 846.867073][T16868] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3890'. [ 846.935788][T12385] usb 3-1: Using ep0 maxpacket: 8 [ 846.948721][T16868] 8021q: adding VLAN 0 to HW filter on device bond7 [ 846.968666][T12385] usb 3-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 846.978053][T12385] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 846.986321][T12385] usb 3-1: Product: syz [ 846.991015][T12385] usb 3-1: Manufacturer: syz [ 846.995691][T12385] usb 3-1: SerialNumber: syz [ 847.012182][T12385] usb 3-1: config 0 descriptor?? [ 847.226993][T12385] usb 3-1: dvb_usb_v2: found a 'Terratec H7' in warm state [ 847.703743][T16887] misc userio: No port type given on /dev/userio [ 847.722405][T16887] misc userio: The device must be registered before sending interrupts [ 847.819478][T12361] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 847.840740][T16891] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3900'. [ 847.920065][T16891] 8021q: adding VLAN 0 to HW filter on device bond10 [ 848.045823][T12361] usb 4-1: Using ep0 maxpacket: 16 [ 848.101185][T12361] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 848.135015][T12361] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 848.160780][T12361] usb 4-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 848.189095][T12361] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 848.218641][T12361] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 848.229967][T12361] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 848.238048][T12361] usb 4-1: Manufacturer: syz [ 848.260380][T12361] usb 4-1: config 0 descriptor?? [ 848.475778][T12462] usb 4-1: USB disconnect, device number 12 [ 848.555005][T16911] misc userio: No port type given on /dev/userio [ 848.577445][T16911] misc userio: The device must be registered before sending interrupts [ 848.689202][T12361] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 848.869225][T12361] usb 2-1: Using ep0 maxpacket: 32 [ 848.885288][T12361] usb 2-1: config 0 has an invalid interface number: 196 but max is 0 [ 848.894030][T12361] usb 2-1: config 0 has no interface number 0 [ 848.908974][T12361] usb 2-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 848.926152][T12361] usb 2-1: config 0 interface 196 has no altsetting 0 [ 848.936042][T12361] usb 2-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 848.945560][T12361] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 848.958263][T12361] usb 2-1: Product: syz [ 848.965821][T12361] usb 2-1: Manufacturer: syz [ 848.972942][T12361] usb 2-1: SerialNumber: syz [ 848.987486][T12361] usb 2-1: config 0 descriptor?? [ 849.009569][T16909] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 849.112390][T16917] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3910'. [ 849.128362][T12385] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 849.150201][T12385] dvbdev: DVB: registering new adapter (Terratec H7) [ 849.157058][T12385] usb 3-1: media controller created [ 849.206118][T12385] usb 3-1: dvb_usb_v2: MAC address: 98:17:ea:d5:d0:5e [ 849.247045][T16917] 8021q: adding VLAN 0 to HW filter on device bond14 [ 849.360035][T12385] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 849.534679][T12385] DVB: Unable to find symbol drxk_attach() [ 849.610678][T12361] ipheth 2-1:0.196: ipheth_get_macaddr: usb_control_msg: -71 [ 849.658090][T12361] ipheth: probe of 2-1:0.196 failed with error -71 [ 849.680639][T12385] dvb_usb_az6007: probe of 3-1:0.0 failed with error -22 [ 849.689471][T12361] usb 2-1: USB disconnect, device number 11 [ 849.706822][T12385] usb 3-1: USB disconnect, device number 8 [ 849.951011][T16939] misc userio: No port type given on /dev/userio [ 849.998785][T16939] misc userio: The device must be registered before sending interrupts [ 850.195780][T16943] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3920'. [ 850.311018][T16943] 8021q: adding VLAN 0 to HW filter on device bond8 [ 850.925500][T16974] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 850.957621][T16977] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3934'. [ 850.994017][T16977] 8021q: adding VLAN 0 to HW filter on device bond11 [ 851.169243][T12385] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 851.371459][T12385] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 851.393150][T12385] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 851.414596][T12385] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 851.430530][T12385] usb 3-1: config 0 descriptor?? [ 851.681372][T12385] usbhid 3-1:0.0: can't add hid device: -71 [ 851.705603][T12385] usbhid: probe of 3-1:0.0 failed with error -71 [ 851.739467][T12385] usb 3-1: USB disconnect, device number 9 [ 852.098626][T17007] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3946'. [ 852.183626][T17007] 8021q: adding VLAN 0 to HW filter on device bond9 [ 852.259184][T12361] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 852.266957][T12385] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 852.462133][T12361] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 852.482630][T12361] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 852.492788][T12385] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 852.515894][T12385] usb 3-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 852.529229][T12361] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 852.549743][T12385] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 852.569332][T12361] usb 4-1: config 0 descriptor?? [ 852.586038][T12361] pwc: Askey VC010 type 2 USB webcam detected. [ 852.593683][T12385] usb 3-1: config 0 descriptor?? [ 852.975355][T17032] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3958'. [ 853.010167][T12361] pwc: recv_control_msg error -32 req 02 val 2b00 [ 853.019888][T12361] pwc: recv_control_msg error -32 req 02 val 2700 [ 853.032144][T12361] pwc: recv_control_msg error -32 req 02 val 2c00 [ 853.040251][T12361] pwc: recv_control_msg error -32 req 04 val 1000 [ 853.047889][T12361] pwc: recv_control_msg error -32 req 04 val 1300 [ 853.055966][T12361] pwc: recv_control_msg error -32 req 04 val 1400 [ 853.064154][T12361] pwc: recv_control_msg error -32 req 02 val 2000 [ 853.075749][T12361] pwc: recv_control_msg error -71 req 02 val 2100 [ 853.091363][T12361] pwc: recv_control_msg error -71 req 04 val 1500 [ 853.113492][T12361] pwc: recv_control_msg error -71 req 02 val 2500 [ 853.129870][T17032] 8021q: adding VLAN 0 to HW filter on device bond12 [ 853.137463][T12361] pwc: recv_control_msg error -71 req 02 val 2400 [ 853.159923][T12361] pwc: recv_control_msg error -71 req 02 val 2600 [ 853.177486][T12361] pwc: recv_control_msg error -71 req 02 val 2900 [ 853.185352][T12361] pwc: recv_control_msg error -71 req 02 val 2800 [ 853.205470][T12361] pwc: recv_control_msg error -71 req 04 val 1100 [ 853.230352][T12361] pwc: recv_control_msg error -71 req 04 val 1200 [ 853.258768][T12361] pwc: Registered as video103. [ 853.280317][T12361] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input13 [ 853.328335][T12361] usb 4-1: USB disconnect, device number 13 [ 853.421436][T12385] aiptek 3-1:0.0: Aiptek using 400 ms programming speed [ 853.457330][T12385] input: Aiptek as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input12 [ 853.504532][ C0] ================================================================================ [ 853.513908][ C0] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31 [ 853.522567][ C0] index 2825 is out of range for type 'const int[34]' [ 853.529391][ C0] CPU: 0 PID: 12361 Comm: kworker/0:9 Not tainted syzkaller #0 [ 853.537089][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 853.547205][ C0] Workqueue: usb_hub_wq hub_event [ 853.552332][ C0] Call Trace: [ 853.555658][ C0] [ 853.558547][ C0] dump_stack_lvl+0x18c/0x250 [ 853.563298][ C0] ? show_regs_print_info+0x20/0x20 [ 853.568573][ C0] ? load_image+0x420/0x420 [ 853.573157][ C0] ubsan_epilogue+0xa/0x30 [ 853.577638][ C0] __ubsan_handle_out_of_bounds+0xe3/0xf0 [ 853.583442][ C0] aiptek_irq+0x1eb8/0x2920 [ 853.588047][ C0] ? kcov_remote_start+0x8a/0x7e0 [ 853.593144][ C0] ? usb_anchor_suspend_wakeups+0x36/0x40 [ 853.598945][ C0] __usb_hcd_giveback_urb+0x35d/0x520 [ 853.604404][ C0] dummy_timer+0xa40/0x3420 [ 853.609035][ C0] ? dummy_free_streams+0x520/0x520 [ 853.614316][ C0] ? dummy_free_streams+0x520/0x520 [ 853.619580][ C0] __hrtimer_run_queues+0x525/0xc10 [ 853.624883][ C0] ? hrtimer_interrupt+0x980/0x980 [ 853.630057][ C0] ? read_tsc+0x9/0x20 [ 853.634205][ C0] hrtimer_run_softirq+0x177/0x290 [ 853.639401][ C0] handle_softirqs+0x27d/0x820 [ 853.644232][ C0] ? read_tsc+0x9/0x20 [ 853.648369][ C0] ? ktime_get+0x24b/0x280 [ 853.652864][ C0] ? __irq_exit_rcu+0xd3/0x190 [ 853.657705][ C0] ? do_softirq+0x1a0/0x1a0 [ 853.662275][ C0] ? irqtime_account_irq+0xb6/0x1c0 [ 853.667554][ C0] __irq_exit_rcu+0xd3/0x190 [ 853.672246][ C0] ? irq_exit_rcu+0x20/0x20 [ 853.676829][ C0] irq_exit_rcu+0x9/0x20 [ 853.681224][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 853.686934][ C0] [ 853.689926][ C0] [ 853.692911][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 853.698980][ C0] RIP: 0010:finish_task_switch+0x267/0x8f0 [ 853.704870][ C0] Code: 26 09 85 c0 0f 84 30 01 00 00 48 85 db 0f 85 4f 01 00 00 0f 1f 44 00 00 4c 89 e7 e8 93 3b 30 09 e8 7e 0b 30 00 fb 4c 8b 65 b8 <49> 8d bc 24 f8 15 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84 c0 [ 853.724547][ C0] RSP: 0018:ffffc90005036d00 EFLAGS: 00000286 [ 853.730687][ C0] RAX: f6ab4c13a3044700 RBX: 0000000000000000 RCX: f6ab4c13a3044700 [ 853.738722][ C0] RDX: dffffc0000000000 RSI: ffffffff8acacb60 RDI: ffffffff8b1c7be0 [ 853.746800][ C0] RBP: ffffc90005036d50 R08: ffffffff911bc50f R09: 1ffffffff22378a1 [ 853.754839][ C0] R10: dffffc0000000000 R11: fffffbfff22378a2 R12: ffff888018f1da00 [ 853.762887][ C0] R13: 1ffff110171c79a9 R14: dffffc0000000000 R15: ffff8880b8e3cd48 [ 853.770964][ C0] __schedule+0x15b6/0x4660 [ 853.775573][ C0] ? mark_lock+0x94/0x320 [ 853.779970][ C0] ? asan.module_dtor+0x20/0x20 [ 853.784886][ C0] ? __lock_acquire+0x7d80/0x7d80 [ 853.789984][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 853.795256][ C0] schedule+0xbd/0x170 [ 853.799472][ C0] schedule_preempt_disabled+0x13/0x20 [ 853.804998][ C0] rwsem_down_write_slowpath+0xc3f/0x1020 [ 853.810796][ C0] ? rwsem_down_write_slowpath+0x81b/0x1020 [ 853.816788][ C0] ? rwsem_down_read_slowpath+0x880/0x880 [ 853.822609][ C0] ? read_lock_is_recursive+0x20/0x20 [ 853.828055][ C0] ? wake_up_q+0xca/0x100 [ 853.832474][ C0] ? rwsem_wake+0xeb/0x130 [ 853.836956][ C0] ? rwsem_spin_on_owner+0x2a0/0x2a0 [ 853.842510][ C0] down_write+0x1b9/0x200 [ 853.846948][ C0] ? down_read_killable+0x340/0x340 [ 853.852231][ C0] kernfs_remove_by_name_ns+0x7c/0x150 [ 853.857771][ C0] sysfs_remove_group+0x101/0x290 [ 853.862873][ C0] sysfs_remove_groups+0x54/0xa0 [ 853.867883][ C0] device_remove_attrs+0x1fb/0x280 [ 853.873062][ C0] ? fw_devlink_unblock_consumers+0x250/0x250 [ 853.879204][ C0] ? up_write+0x1be/0x410 [ 853.883596][ C0] ? kernfs_remove_by_name_ns+0x117/0x150 [ 853.889391][ C0] device_del+0x517/0x910 [ 853.893802][ C0] ? kill_device+0x160/0x160 [ 853.898473][ C0] ? __input_unregister_device+0x4a5/0x5f0 [ 853.904338][ C0] input_unregister_device+0x9b/0xf0 [ 853.909684][ C0] usb_pwc_disconnect+0x123/0x160 [ 853.914784][ C0] usb_unbind_interface+0x207/0x870 [ 853.920049][ C0] ? kernfs_remove_by_name_ns+0x117/0x150 [ 853.925844][ C0] ? usb_driver_release_interface+0x1c0/0x1c0 [ 853.931992][ C0] device_release_driver_internal+0x458/0x6f0 [ 853.938147][ C0] bus_remove_device+0x43b/0x520 [ 853.943171][ C0] ? bus_probe_device+0x260/0x260 [ 853.948260][ C0] ? up_write+0x1be/0x410 [ 853.952673][ C0] ? kernfs_remove_by_name_ns+0x117/0x150 [ 853.958487][ C0] device_del+0x51f/0x910 [ 853.962899][ C0] ? kill_device+0x160/0x160 [ 853.967554][ C0] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 853.973605][ C0] ? usb_disconnect+0xfc/0x8a0 [ 853.978440][ C0] ? __lock_acquire+0x7d80/0x7d80 [ 853.983535][ C0] ? mutex_lock_nested+0x20/0x20 [ 853.988546][ C0] ? _raw_spin_lock_irq+0xbb/0xf0 [ 853.993656][ C0] usb_disable_device+0x3ee/0x8a0 [ 853.998804][ C0] usb_disconnect+0x340/0x8a0 [ 854.003572][ C0] hub_event+0x1d69/0x4a80 [ 854.008112][ C0] ? hub_post_resume+0x120/0x120 [ 854.013127][ C0] ? read_lock_is_recursive+0x20/0x20 [ 854.018574][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 854.023840][ C0] ? process_scheduled_works+0x975/0x1600 [ 854.029629][ C0] ? process_scheduled_works+0x975/0x1600 [ 854.035415][ C0] process_scheduled_works+0xa60/0x1600 [ 854.041056][ C0] ? worker_attach_to_pool+0x370/0x370 [ 854.046592][ C0] ? assign_work+0x3cc/0x5d0 [ 854.051262][ C0] worker_thread+0xa5e/0xfe0 [ 854.055953][ C0] kthread+0x2fa/0x390 [ 854.060088][ C0] ? pr_cont_work+0x550/0x550 [ 854.064830][ C0] ? kthread_blkcg+0xd0/0xd0 [ 854.069480][ C0] ret_from_fork+0x48/0x80 [ 854.073961][ C0] ? kthread_blkcg+0xd0/0xd0 [ 854.078612][ C0] ret_from_fork_asm+0x11/0x20 [ 854.083458][ C0] [ 854.086532][ C0] ================================================================================ [ 854.095873][ C0] Kernel panic - not syncing: UBSAN: panic_on_warn set ... [ 854.103146][ C0] CPU: 0 PID: 12361 Comm: kworker/0:9 Not tainted syzkaller #0 [ 854.110739][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 854.120845][ C0] Workqueue: usb_hub_wq hub_event [ 854.125938][ C0] Call Trace: [ 854.129261][ C0] [ 854.132148][ C0] dump_stack_lvl+0x18c/0x250 [ 854.136893][ C0] ? show_regs_print_info+0x20/0x20 [ 854.142147][ C0] ? load_image+0x420/0x420 [ 854.146718][ C0] panic+0x2ca/0x720 [ 854.150696][ C0] ? bpf_jit_dump+0xd0/0xd0 [ 854.155283][ C0] check_panic_on_warn+0x84/0xa0 [ 854.160285][ C0] __ubsan_handle_out_of_bounds+0xe3/0xf0 [ 854.166086][ C0] aiptek_irq+0x1eb8/0x2920 [ 854.170659][ C0] ? kcov_remote_start+0x8a/0x7e0 [ 854.175739][ C0] ? usb_anchor_suspend_wakeups+0x36/0x40 [ 854.181523][ C0] __usb_hcd_giveback_urb+0x35d/0x520 [ 854.186965][ C0] dummy_timer+0xa40/0x3420 [ 854.191584][ C0] ? dummy_free_streams+0x520/0x520 [ 854.196838][ C0] ? dummy_free_streams+0x520/0x520 [ 854.202125][ C0] __hrtimer_run_queues+0x525/0xc10 [ 854.207410][ C0] ? hrtimer_interrupt+0x980/0x980 [ 854.212574][ C0] ? read_tsc+0x9/0x20 [ 854.216712][ C0] hrtimer_run_softirq+0x177/0x290 [ 854.221883][ C0] handle_softirqs+0x27d/0x820 [ 854.226700][ C0] ? read_tsc+0x9/0x20 [ 854.230821][ C0] ? ktime_get+0x24b/0x280 [ 854.235304][ C0] ? __irq_exit_rcu+0xd3/0x190 [ 854.240133][ C0] ? do_softirq+0x1a0/0x1a0 [ 854.244691][ C0] ? irqtime_account_irq+0xb6/0x1c0 [ 854.249953][ C0] __irq_exit_rcu+0xd3/0x190 [ 854.254605][ C0] ? irq_exit_rcu+0x20/0x20 [ 854.259171][ C0] irq_exit_rcu+0x9/0x20 [ 854.263471][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 854.269174][ C0] [ 854.272163][ C0] [ 854.275145][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 854.281246][ C0] RIP: 0010:finish_task_switch+0x267/0x8f0 [ 854.287116][ C0] Code: 26 09 85 c0 0f 84 30 01 00 00 48 85 db 0f 85 4f 01 00 00 0f 1f 44 00 00 4c 89 e7 e8 93 3b 30 09 e8 7e 0b 30 00 fb 4c 8b 65 b8 <49> 8d bc 24 f8 15 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84 c0 [ 854.306789][ C0] RSP: 0018:ffffc90005036d00 EFLAGS: 00000286 [ 854.312941][ C0] RAX: f6ab4c13a3044700 RBX: 0000000000000000 RCX: f6ab4c13a3044700 [ 854.321099][ C0] RDX: dffffc0000000000 RSI: ffffffff8acacb60 RDI: ffffffff8b1c7be0 [ 854.329140][ C0] RBP: ffffc90005036d50 R08: ffffffff911bc50f R09: 1ffffffff22378a1 [ 854.337217][ C0] R10: dffffc0000000000 R11: fffffbfff22378a2 R12: ffff888018f1da00 [ 854.345294][ C0] R13: 1ffff110171c79a9 R14: dffffc0000000000 R15: ffff8880b8e3cd48 [ 854.353371][ C0] __schedule+0x15b6/0x4660 [ 854.357975][ C0] ? mark_lock+0x94/0x320 [ 854.362375][ C0] ? asan.module_dtor+0x20/0x20 [ 854.367303][ C0] ? __lock_acquire+0x7d80/0x7d80 [ 854.372414][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 854.377704][ C0] schedule+0xbd/0x170 [ 854.381861][ C0] schedule_preempt_disabled+0x13/0x20 [ 854.387425][ C0] rwsem_down_write_slowpath+0xc3f/0x1020 [ 854.393237][ C0] ? rwsem_down_write_slowpath+0x81b/0x1020 [ 854.399239][ C0] ? rwsem_down_read_slowpath+0x880/0x880 [ 854.405050][ C0] ? read_lock_is_recursive+0x20/0x20 [ 854.410494][ C0] ? wake_up_q+0xca/0x100 [ 854.414913][ C0] ? rwsem_wake+0xeb/0x130 [ 854.419406][ C0] ? rwsem_spin_on_owner+0x2a0/0x2a0 [ 854.424772][ C0] down_write+0x1b9/0x200 [ 854.429178][ C0] ? down_read_killable+0x340/0x340 [ 854.434508][ C0] kernfs_remove_by_name_ns+0x7c/0x150 [ 854.440068][ C0] sysfs_remove_group+0x101/0x290 [ 854.445423][ C0] sysfs_remove_groups+0x54/0xa0 [ 854.450426][ C0] device_remove_attrs+0x1fb/0x280 [ 854.455624][ C0] ? fw_devlink_unblock_consumers+0x250/0x250 [ 854.461863][ C0] ? up_write+0x1be/0x410 [ 854.466273][ C0] ? kernfs_remove_by_name_ns+0x117/0x150 [ 854.472094][ C0] device_del+0x517/0x910 [ 854.476542][ C0] ? kill_device+0x160/0x160 [ 854.481226][ C0] ? __input_unregister_device+0x4a5/0x5f0 [ 854.487122][ C0] input_unregister_device+0x9b/0xf0 [ 854.492498][ C0] usb_pwc_disconnect+0x123/0x160 [ 854.497620][ C0] usb_unbind_interface+0x207/0x870 [ 854.502898][ C0] ? kernfs_remove_by_name_ns+0x117/0x150 [ 854.508707][ C0] ? usb_driver_release_interface+0x1c0/0x1c0 [ 854.514848][ C0] device_release_driver_internal+0x458/0x6f0 [ 854.521006][ C0] bus_remove_device+0x43b/0x520 [ 854.526124][ C0] ? bus_probe_device+0x260/0x260 [ 854.531226][ C0] ? up_write+0x1be/0x410 [ 854.535649][ C0] ? kernfs_remove_by_name_ns+0x117/0x150 [ 854.541466][ C0] device_del+0x51f/0x910 [ 854.545897][ C0] ? kill_device+0x160/0x160 [ 854.550579][ C0] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 854.556634][ C0] ? usb_disconnect+0xfc/0x8a0 [ 854.561476][ C0] ? __lock_acquire+0x7d80/0x7d80 [ 854.566576][ C0] ? mutex_lock_nested+0x20/0x20 [ 854.571592][ C0] ? _raw_spin_lock_irq+0xbb/0xf0 [ 854.576712][ C0] usb_disable_device+0x3ee/0x8a0 [ 854.581831][ C0] usb_disconnect+0x340/0x8a0 [ 854.586601][ C0] hub_event+0x1d69/0x4a80 [ 854.591162][ C0] ? hub_post_resume+0x120/0x120 [ 854.596188][ C0] ? read_lock_is_recursive+0x20/0x20 [ 854.601653][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 854.606941][ C0] ? process_scheduled_works+0x975/0x1600 [ 854.612758][ C0] ? process_scheduled_works+0x975/0x1600 [ 854.618572][ C0] process_scheduled_works+0xa60/0x1600 [ 854.624246][ C0] ? worker_attach_to_pool+0x370/0x370 [ 854.629799][ C0] ? assign_work+0x3cc/0x5d0 [ 854.634479][ C0] worker_thread+0xa5e/0xfe0 [ 854.639178][ C0] kthread+0x2fa/0x390 [ 854.643323][ C0] ? pr_cont_work+0x550/0x550 [ 854.648094][ C0] ? kthread_blkcg+0xd0/0xd0 [ 854.652762][ C0] ret_from_fork+0x48/0x80 [ 854.657257][ C0] ? kthread_blkcg+0xd0/0xd0 [ 854.661932][ C0] ret_from_fork_asm+0x11/0x20 [ 854.666799][ C0] [ 854.670455][ C0] Kernel Offset: disabled [ 854.674809][ C0] Rebooting in 86400 seconds..