last executing test programs: 1.441329693s ago: executing program 1 (id=2): r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, 0x0, 0x0) getsockopt$netlink(r0, 0x10e, 0x9, &(0x7f0000000680)=""/4110, &(0x7f0000000080)=0x100e) 1.391001805s ago: executing program 1 (id=6): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x33, &(0x7f0000000000)=0x5, 0x4) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x24008051, &(0x7f00000001c0)={0xa, 0x2, 0x3ff, @loopback, 0xffffff1e}, 0x1c) 1.359699045s ago: executing program 1 (id=7): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0x44, 0x10, 0x5, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1, 0x1}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @batadv={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BATADV_ALGO_NAME={0xd, 0x1, 'BATMAN_IV'}]}}}]}, 0x44}}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newlink={0x3c, 0x10, 0x5, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1, 0x1}, [@IFLA_IFNAME={0x14, 0x3, 'veth0\x00'}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x3c}}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000500)={'veth1\x00', 0x0}) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000700)="ffffffffffff0011223344554305000f32000000000100112233445500112233445500ff0000", 0x26, 0x0, &(0x7f0000000800)={0x11, 0x300, r3, 0x1, 0x0, 0x6, @broadcast}, 0x14) sendmsg$nl_route(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="3400000011000500"/20, @ANYRES32=0x0, @ANYBLOB="000000000000fc00140003007665746830000e000000000000000000b8f92a400ba679e2972999dc8b0350d3243167ddc9c4855b5c725a545b16297a03ff202c0d3ef6d4cdf6d2a213ebda1908940e4eee81a9fdd336eb88eab3f7d8fa8382472bc9dcd1fe99c6cb15bbe6cec6a4d76c6c2adc797a40fdcee79f24cb3d9949855c8c947d3ef6564d371eba7c9d1d1318b3b946d259ef88bf2b1227cd9740071973c254b076e897e08f19334acc82c4e982d7d4ada9dc2a36698d93678c560b3de28b640224a4733730ce750c6d0d78056fccd81fbd1c19d8363ced6a423bae4c33005736d51cb91de2ff5c855139e4eea7804882ddf3cee986fc93114d4fcfcf4b44254527457581f66255fdb7641778f7b640cb5c1d41e3d0d228bc0dc18b139a0c51c6c72c158336d832311c3cf123c98a13739b145326656c90b77b841c7c41897113990631b4d783d51a0aeab9c60edb8e2c133f45ada25e1bf863c7f3"], 0x34}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000980)=@dellink={0x34, 0x11, 0x5, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'batadv0\x00'}]}, 0x34}}, 0x0) 1.245546899s ago: executing program 3 (id=4): pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x129c81, 0x0) write$binfmt_aout(r1, &(0x7f00000001c0)=ANY=[], 0xff2e) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000000c0)={0x0, 0x5, 0x400007f, 0x4000006, 0x3, "42341f9b1000007e4f00"}) r2 = syz_open_pts(r1, 0x60300) dup3(r2, r1, 0x0) sched_setscheduler(0x0, 0x5, &(0x7f00000024c0)) splice(r1, 0x0, r0, 0x0, 0x7ffff000, 0x0) 1.222540399s ago: executing program 2 (id=3): syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000280)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0, &(0x7f0000000180)={[{@grpid}, {@mblk_io_submit}, {@nodioread_nolock}, {@test_dummy_encryption}, {@init_itable_val={'init_itable', 0x3d, 0x1}}, {@nodelalloc}, {@minixdf}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x40}}]}, 0x4, 0xbaf, &(0x7f00000017c0)="$eJzs3M1rXFUbAPDn3ny2zftO+vIi1k0jIi2o07SSYotgKxU3LgTdCg3ppIRMP0giNWkWE/0HRF0LbgS1KF3YdTcKbt1o3VpcCEVioyCikTsfSWxmkrSd5Ibk94Mz95w5d+Z5nrlM7j0wNwHsWgPZQxpxICLOJhGF+vNpRHRXe70Rldp+C/OzI7/Pz44ksbj42i9JJBFxd352pPFeSX27rz7ojYhvX0zif++sjjs5PTM+XC6XJurjI1MXLh+ZnJ55ZuzC8PnS+dLFo8efGzo2dHzwxFDbav3jx1M3fnv85Z8qf37617Vf3/84iVPRV59bWUe7DMTA0meyUmdEDLc7WE466vWsrDPpXOdF6SYnBQBAS+mKa7hHohAdsXzxVoivvss1OQAAAKAtFjsiFgEAAIAdLrH+BwAAgB2u8TuAu/OzI42W7y8Sttad0xHRX6t/od5qM51RqW57oysi9t5NYuVtrUntZQ9tICJu/3Dii6zFJt2HvJbKXEQ82uz4J9X6+6t3ca+uP42IwTbEH7hnvN3qf7q7df2n2hA/7/oB2J1unq6dyFaf/9Kl659ocv7rbHLuehB5n/8a138Lq67/luvvaHH99+oGY1z95MMrreay+p+/8dLnjZbFz7YPVdR9uDMX8Vhns/qTpfqTFvWf3WCMwt9XSq3m8q5/8aOIQ9G8/oZk7f9PdGR0rFwarD02jTH3zdBnreLnXX92/Pe2qH+94395gzHeOHPmequ59etPf+5OXq/2uuvPvDU8NTVxNKI7eWX188fqN7S30Nin8R5Z/YefWPv736z+LESl/jlka4G5+jYbv31PzBeuXf1yrfqztV+ex//cAx7/dzcY48mv3zvcam7l+jdrWfzbSW0tDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANaUT0RZIWl/ppWixG7IuI/8fetHxpcuqp0UtvXjyXzUX0R1c6OlYuDUZEoTZOsvHRan95fOye8bMRsT8iPijsqY6LI5fK5/IuHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgCX7IqIvkrQYEWlELBTStFjMOysAAACg7frzTgAAAADYdNb/AAAAsPNZ/wMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALDJ9h+8eSuJiMrJPdWW6a7PdeWaGbDZ0rwTAHLTkXcCQG46804AyM19rvFdLsAOlKwz39typqftuQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwfR06cPNWEhGVk3uqLdNdn+tq+oqDW5gdsJnSvBMActOx1mTn1uUBbD1fcdi9mq/xgd0kWWe+d3mfyr9nejYtJwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC2n75qS9JiRKTVfpoWixH/iYj+6EpGx8qlwYj4b0R8X+jqycY9eScNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABA201Oz4wPl8ulCR0dnXw7yfZIo9bJ+y8TAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB5mJyeGR8ul0sTk3lnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAORtcnpmfLhcLk1soHP9fnZe0cm7RgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8vNPAAAA///5ZQ4Q") openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x0, 0x28) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r3, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='sysfs\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:00.0/driver_override\x00', 0x1, 0x0) write(r4, &(0x7f0000000200)='xhcihcd\x00', 0x8) close(r4) syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file0\x00', 0x1000410, &(0x7f0000000440)={[{@grpid}, {@grpquota}]}, 0x4, 0x4eb, &(0x7f0000000540)="$eJzs3c9vVFsdAPDvnXZoKQMFZaFGBRFFQ5j+ABqCC2GjMYTESFy5gNoOTdMZpum0SCuLsnRvIokr/RPcuTBh5cKdO925wYUJKnkv9CVvMS/3zqUd2g7te7Qd6Hw+ye2955xhvufMcM6Ze2B6AuhZZyNiNSKORMS9iBjO85P8iButI33cq5ePp9ZePp5Kotm8878kK0/zou3PpI7lzzkYET/7ccQvk61xG8src5PVamUhT48s1uZHGssrl2YLec74xNjE6LXLV8f3rK1nan968aPZWz//y5+/8fzvq9//dVqt0m+OZ2Xt7dhLraYXo9SW1x8Rt/YjWJf0539/+PCkve1LEXEu6//D0Ze9mwDAYdZsDkdzuD0NABx26f1/KZJCOV8LKEWhUC631vBOx1ChWm8sXhyuLz2YjmwN62QUC/dnq5XRfK3wZBSTND2WXW+kxzelL0fEqYj47cDRLF2eqlenu/nBBwB62LFN8//HA635HwA45Aa7XQEA4MCZ/wGg95j/AaD3fI7537cDAeCQcP8PAL3H/A8AvWfH+f/JwdQDADgQP719Oz2aa/nvv55+uLz0g9LDS9OVxly5tjRVnqovzJdn6vWZaqU81Wzu9HzVen1+7Mp6srG8crdWX3qweHe2NjlTuVsp7nN7AICdnTrz7J9JRKxeP5od0baXg7kaDrdCtysAdE1ftysAdI3v80Dv2sU9vmUAOOS22aL3DR3/i9BTm7/Ch+rCV63/Q6+y/g+964ut//9wz+sBHDzr/9C7ms3Env8A0GOs8QPv9O//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0KNK2ZEUytle4Kvpz0K5HHE8Ik5GMbk/W62MRsSJiPjHQHEgTY91u9IAwDsq/CfJ9/+6MHy+tLn0SPLJQHaOiF/9/s7vHk0uLi6Mpfn/X89ffJrnjx/pRgMAgHY3tma15un83HYj/+rl46nXx0FW8cXN1uaiady1/GiV9Ed/dh6MYkQMfZTk6Zb080rfHsRffRIRX9lo/6O2CKVsDaS18+nm+Gns4/sQf+P13xy/8Eb8QlaWnovZa/HlPagL9JpnN1vjZN730i6W979CnM3O2/f/wWyEenevx7+1LeNfYX3869sSP8n6/Nn19Ntr8uLKX3+yJbM53Cp7EvG1/u3iJ+vxkw7j7/ldtvFfX//muU5lzT9EXIjt47fUsmF2ZLE2P9JYXrk0W5ucqcxUHoyPT4xNjF67fHV8JFujbv3823Yx/nv94olO8dP2D3WIP7hD+7+zy/b/8dN7v/jWW+J/79vbv/+n3xI/nRO/u8v4k0M3Om7fncaf7tD+nd7/i7uM//zfK9O7fCgAcAAayytzk9VqZWGHi/Sz5k6PcfFhXsRqxHtQDRfv1UW3RyZgv210+m7XBAAAAAAAAAAAAAAA6KSxvDI3EPv7daJutxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDD67MAAAD//w/PzvM=") mount$bind(0x0, &(0x7f0000000340)='sysfs\x00', 0x0, 0x1080021, 0x0) quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f00000000c0)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000000)={0x101, 0x7, 0x5, 0x0, 0x1, 0x8, 0x3, 0x3, 0x4040c407}) r5 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/drivers/xhci_hcd/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000380)="303030303a26303a30302e302c030d0d6264f30100b94fc254dd955d6f5547571c5a8cfed4e26c00000080000000009b6587e981032802aa6cd6c12d9ba38c", 0x12) close(r5) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x300) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000002780)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) 1.154042661s ago: executing program 1 (id=8): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000040)=0x2563, 0x4) sendto$inet(r0, &(0x7f0000000100)="1ce0", 0xffeb, 0x0, &(0x7f0000001100)={0x2, 0x0, @private}, 0x10) recvmmsg(r0, &(0x7f0000003ac0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) 1.153926951s ago: executing program 3 (id=9): r0 = socket(0x400000000010, 0x3, 0x0) sendmsg$DEVLINK_CMD_RATE_GET(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={0xfffffffffffffffd}, 0x1, 0x0, 0x0, 0x4000}, 0x20040080) 1.153812071s ago: executing program 1 (id=10): r0 = syz_usb_connect(0x2, 0x58, &(0x7f0000000080)={{0x12, 0x1, 0x310, 0x8e, 0x3a, 0xc6, 0x20, 0x694, 0x1, 0x7813, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x46, 0x2, 0xe, 0x6, 0x10, 0x3, "", [{{0x9, 0x4, 0x39, 0xd8, 0x1, 0x1a, 0xda, 0xa8, 0x8, [], [{{0x9, 0x5, 0x8, 0x10, 0x20, 0x7, 0x9, 0x80}}]}}, {{0x9, 0x4, 0xe4, 0x5, 0x3, 0xb9, 0x56, 0xda, 0x2, [], [{{0x9, 0x5, 0x8, 0x0, 0x400, 0x1, 0x12, 0xfc}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x7, 0x3, 0x9a, [@generic={0x7, 0x5, "d15b89f26d"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x40, 0x7a, 0xa, 0x84}}]}}]}}]}}, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, &(0x7f0000000bc0)={0x24, 0x0, &(0x7f0000000b00)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1c01}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000011c0)={0x24, 0x0, &(0x7f0000001040)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001600)={0x24, 0x0, &(0x7f0000000540)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000440)={0x1c, &(0x7f0000000300)={0x40, 0x16, 0xb, "364c4583333fd306ef8b2e"}, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f00000001c0)=ANY=[@ANYBLOB='@\b\b'], 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r1, 0x0, 0x0) 1.114684422s ago: executing program 3 (id=11): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@multicast1, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x4f}, {}, {0x0, 0x0, 0xe06}}, {{@in6=@mcast2, 0x404d3, 0x2b}, 0x0, @in=@empty, 0x0, 0x0, 0x0, 0x20}}, 0xe4) r1 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="0212000002"], 0x10}}, 0x0) close(r0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)={0x2, 0x13, 0x0, 0xe, 0x2, 0x0, 0x0, 0x25dfdbf8}, 0x10}}, 0x4000050) 1.080003113s ago: executing program 3 (id=12): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f00005f5000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="02052002040000000000000000000000020007"], 0x20}}, 0x0) 983.936445ms ago: executing program 3 (id=13): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'bond0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3c0000001000ffff27bd7000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="37ec000000000000140012800b0001006970766c616e00000400028008000500", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x0) r4 = socket(0x11, 0x2, 0x10001) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000000)={'bond0\x00', &(0x7f0000000180)=@ethtool_sfeatures={0x3b, 0x2, [{0xae9, 0x8}, {0xfffffff6, 0x2}]}}) syz_open_dev$evdev(&(0x7f0000000100), 0x2, 0x183242) syz_usb_connect$uac3(0x3, 0x9d, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201100100000040f80600b0400001020301090281000301ffc010080b0002010130070904000000010130000a2401101d000700000013240300010601043303"], 0x0) io_uring_setup(0x3ce6, &(0x7f0000000000)={0x0, 0x8c4f, 0x4, 0x1, 0x35e}) 930.519207ms ago: executing program 0 (id=1): r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x18) r1 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) sendfile(r1, r0, 0x0, 0x3a) 912.416627ms ago: executing program 4 (id=5): r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000e131f8104c1302007eac0102030109021b0001000000000904000001098b7500090583", @ANYRES8], 0x0) syz_open_dev$evdev(&(0x7f0000000000), 0x6f1022e4, 0x101) syz_usb_disconnect(r0) syz_usb_connect(0x0, 0x52, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) 858.068478ms ago: executing program 0 (id=14): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0xa, &(0x7f00000000c0)=0x5, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10) 857.956489ms ago: executing program 0 (id=15): prlimit64(0x0, 0xe, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x2]}, 0x8, 0x0) read$FUSE(r0, &(0x7f0000001b40)={0x2020}, 0x205c) r1 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x1, 0xa) fchdir(r2) r3 = open(&(0x7f0000000080)='./bus\x00', 0x1031c2, 0x0) ftruncate(r3, 0x2007ffb) r4 = open(0x0, 0x0, 0x0) fcntl$setsig(r4, 0xa, 0x21) openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x88882, 0x0) 19.37224ms ago: executing program 0 (id=16): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x1d}}, 0x1}, 0x1c) setsockopt$sock_int(r0, 0x1, 0xa, &(0x7f0000000000)=0x4, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) writev(r0, &(0x7f0000001540)=[{&(0x7f0000000300)='.', 0x1}], 0x1) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000280)={&(0x7f0000811000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0}, &(0x7f00000002c0)=0x40) 0s ago: executing program 0 (id=17): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) ioctl$PPPIOCGL2TPSTATS(r0, 0x80487436, &(0x7f00000001c0)="e65387e1") kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 14.858059][ T30] kauditd_printk_skb: 26 callbacks suppressed [ 14.858075][ T30] audit: type=1400 audit(1785920793.219:59): avc: denied { transition } for pid=223 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.869357][ T30] audit: type=1400 audit(1785920793.219:60): avc: denied { noatsecure } for pid=223 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.877207][ T30] audit: type=1400 audit(1785920793.229:61): avc: denied { write } for pid=223 comm="sh" path="pipe:[13943]" dev="pipefs" ino=13943 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 14.898352][ T30] audit: type=1400 audit(1785920793.229:62): avc: denied { rlimitinh } for pid=223 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.917865][ T30] audit: type=1400 audit(1785920793.229:63): avc: denied { siginh } for pid=223 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 16.124892][ T230] sshd-session (230) used greatest stack depth: 21952 bytes left Warning: Permanently added '10.128.1.4' (ED25519) to the list of known hosts. [ 22.553986][ T30] audit: type=1400 audit(1785920800.909:64): avc: denied { mounton } for pid=277 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.557741][ T277] cgroup: Unknown subsys name 'net' [ 22.576669][ T30] audit: type=1400 audit(1785920800.909:65): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.604013][ T30] audit: type=1400 audit(1785920800.939:66): avc: denied { unmount } for pid=277 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.604525][ T277] cgroup: Unknown subsys name 'devices' [ 22.748601][ T277] cgroup: Unknown subsys name 'hugetlb' [ 22.754270][ T277] cgroup: Unknown subsys name 'rlimit' [ 22.865228][ T30] audit: type=1400 audit(1785920801.219:67): avc: denied { setattr } for pid=277 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.888435][ T30] audit: type=1400 audit(1785920801.219:68): avc: denied { mounton } for pid=277 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.913190][ T30] audit: type=1400 audit(1785920801.219:69): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.941111][ T279] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 22.949981][ T30] audit: type=1400 audit(1785920801.309:70): avc: denied { relabelto } for pid=279 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.975452][ T30] audit: type=1400 audit(1785920801.309:71): avc: denied { write } for pid=279 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 23.049294][ T30] audit: type=1400 audit(1785920801.409:72): avc: denied { read } for pid=277 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.050607][ T277] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.074961][ T30] audit: type=1400 audit(1785920801.409:73): avc: denied { open } for pid=277 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.644509][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.651631][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.659401][ T285] device bridge_slave_0 entered promiscuous mode [ 23.667031][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.674091][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.681878][ T285] device bridge_slave_1 entered promiscuous mode [ 23.783376][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.790474][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.797904][ T287] device bridge_slave_0 entered promiscuous mode [ 23.804950][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.812036][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.819517][ T287] device bridge_slave_1 entered promiscuous mode [ 23.834794][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.841913][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.849404][ T286] device bridge_slave_0 entered promiscuous mode [ 23.869957][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.877053][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.884390][ T286] device bridge_slave_1 entered promiscuous mode [ 23.901785][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.908909][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.916356][ T290] device bridge_slave_0 entered promiscuous mode [ 23.924779][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.932018][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.939516][ T290] device bridge_slave_1 entered promiscuous mode [ 23.977727][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.984795][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.992290][ T289] device bridge_slave_0 entered promiscuous mode [ 24.001815][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.009034][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.016589][ T289] device bridge_slave_1 entered promiscuous mode [ 24.086101][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.093202][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.100536][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.107595][ T285] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.184489][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.193256][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.201973][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.209898][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.246864][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.256761][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.263837][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.288931][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.296735][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.304908][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.311981][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.319754][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.328410][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.336734][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.360722][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.369380][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.376420][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.384025][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.392220][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.421731][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.436623][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.448128][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.472758][ T285] device veth0_vlan entered promiscuous mode [ 24.479868][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.488010][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.496068][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.503844][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.512229][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.520591][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.528310][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.535787][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.544181][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.551274][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.558758][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.567039][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.574082][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.581790][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.589994][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.597272][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.604660][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.612974][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.620046][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.627498][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.635433][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.644012][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.651929][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.660990][ T286] device veth0_vlan entered promiscuous mode [ 24.667421][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.675565][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.694135][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.702762][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.711187][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.718267][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.725826][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.734327][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.742632][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.749696][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.757330][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.765427][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.773693][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.785429][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.793656][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.802747][ T285] device veth1_macvtap entered promiscuous mode [ 24.819800][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.827516][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.835541][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.843825][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.852232][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.860390][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.868579][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.891234][ T286] device veth1_macvtap entered promiscuous mode [ 24.899174][ T289] device veth0_vlan entered promiscuous mode [ 24.906692][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.915085][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.924309][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.932731][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.941293][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.949820][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.958289][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.966405][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.974722][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.982413][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.990378][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.998631][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.006083][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.027979][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.036345][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.045135][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.045297][ T285] request_module fs-gadgetfs succeeded, but still no fs? [ 25.055262][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.069688][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.078072][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.092392][ T289] device veth1_macvtap entered promiscuous mode [ 25.104104][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.112945][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.122250][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.130273][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.141145][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.153645][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.167777][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.176224][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.190255][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.209320][ T290] device veth0_vlan entered promiscuous mode [ 25.225959][ T287] device veth0_vlan entered promiscuous mode [ 25.232565][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.241269][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.249654][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.258081][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.266190][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.274135][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.281661][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.289226][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.318295][ T290] device veth1_macvtap entered promiscuous mode [ 25.325396][ T287] device veth1_macvtap entered promiscuous mode [ 25.367049][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.375300][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.395036][ T322] loop2: detected capacity change from 0 to 4096 [ 25.403531][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.411867][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.420327][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.429777][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.450649][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.459184][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.473469][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.491900][ T322] EXT4-fs (loop2): Ignoring removed mblk_io_submit option [ 25.500686][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.509379][ T322] EXT4-fs (loop2): Test dummy encryption mode enabled [ 25.527377][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.535718][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.551785][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.561345][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.563636][ T322] EXT4-fs (loop2): mounted filesystem without journal. Opts: grpid,mblk_io_submit,nodioread_nolock,test_dummy_encryption,init_itable=0x0000000000000001,nodelalloc,minixdf,debug_want_extra_isize=0x0000000000000040,,errors=continue. Quota mode: writeback. [ 25.706536][ T305] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 26.506713][ T351] fscrypt (loop2): Error allocating 'cts(cbc(aes))' transform: -4 [ 26.556597][ T305] usb 2-1: unable to get BOS descriptor or descriptor too short [ 26.571512][ T357] ================================================================== [ 26.579620][ T357] BUG: KASAN: use-after-free in pppol2tp_sock_to_session+0x1a0/0x1b0 [ 26.587737][ T357] Read of size 4 at addr ffff88812bf22800 by task syz.0.17/357 [ 26.595301][ T357] [ 26.597674][ T357] CPU: 1 PID: 357 Comm: syz.0.17 Not tainted syzkaller #0 [ 26.604806][ T357] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 26.614916][ T357] Call Trace: [ 26.618409][ T357] [ 26.621360][ T357] __dump_stack+0x21/0x30 [ 26.625721][ T357] dump_stack_lvl+0x110/0x170 [ 26.630420][ T357] ? show_regs_print_info+0x20/0x20 [ 26.635643][ T357] ? load_image+0x3f0/0x3f0 [ 26.640192][ T357] ? __local_bh_enable_ip+0x58/0x80 [ 26.645418][ T357] print_address_description+0x7f/0x2c0 [ 26.651009][ T357] ? pppol2tp_sock_to_session+0x1a0/0x1b0 [ 26.656811][ T357] kasan_report+0x10f/0x150 [ 26.661344][ T357] ? pppol2tp_sock_to_session+0x1a0/0x1b0 [ 26.667093][ T357] __asan_report_load4_noabort+0x14/0x20 [ 26.672749][ T357] pppol2tp_sock_to_session+0x1a0/0x1b0 [ 26.678322][ T357] pppol2tp_release+0x150/0x2b0 [ 26.683196][ T357] sock_close+0xb8/0x200 [ 26.687466][ T357] ? sock_mmap+0xa0/0xa0 [ 26.691734][ T357] __fput+0x22b/0x900 [ 26.695756][ T357] ____fput+0x15/0x20 [ 26.699758][ T357] task_work_run+0x127/0x190 [ 26.704370][ T357] exit_to_user_mode_loop+0xd0/0xe0 [ 26.709589][ T357] exit_to_user_mode_prepare+0x87/0xd0 [ 26.715079][ T357] syscall_exit_to_user_mode+0x1a/0x30 [ 26.720558][ T357] do_syscall_64+0x58/0xa0 [ 26.724995][ T357] ? clear_bhb_loop+0x50/0xa0 [ 26.729716][ T357] ? clear_bhb_loop+0x50/0xa0 [ 26.734419][ T357] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 26.740343][ T357] RIP: 0033:0x7f70d1573019 [ 26.744782][ T357] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 26.764413][ T357] RSP: 002b:00007ffe37518228 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 26.772865][ T357] RAX: 0000000000000000 RBX: 00007ffe37518310 RCX: 00007f70d1573019 [ 26.780863][ T357] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 26.788855][ T357] RBP: 00000000000067b8 R08: 0000000000000001 R09: 0000000000000000 [ 26.796846][ T357] R10: 0000001b2d820000 R11: 0000000000000246 R12: 00007ffe37518350 [ 26.804857][ T357] R13: 00007f70d17fafac R14: 00000000000067ec R15: 00007f70d17fafa0 [ 26.812854][ T357] [ 26.815898][ T357] [ 26.818233][ T357] Allocated by task 358: [ 26.822484][ T357] __kasan_kmalloc+0xd4/0x100 [ 26.827184][ T357] __kmalloc+0x13d/0x2c0 [ 26.831450][ T357] l2tp_session_create+0x39/0xb60 [ 26.836494][ T357] pppol2tp_connect+0xbf5/0x1640 [ 26.841456][ T357] __sys_connect+0x3cb/0x450 [ 26.846239][ T357] __x64_sys_connect+0x7a/0x90 [ 26.851022][ T357] x64_sys_call+0x7c/0x9a0 [ 26.855457][ T357] do_syscall_64+0x4c/0xa0 [ 26.859895][ T357] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 26.865842][ T357] [ 26.868189][ T357] Freed by task 306: [ 26.872101][ T357] kasan_set_track+0x4a/0x70 [ 26.876718][ T357] kasan_set_free_info+0x23/0x40 [ 26.881693][ T357] ____kasan_slab_free+0x125/0x160 [ 26.886824][ T357] __kasan_slab_free+0x11/0x20 [ 26.891605][ T357] slab_free_freelist_hook+0xc2/0x190 [ 26.896998][ T357] kfree+0xc4/0x270 [ 26.900829][ T357] l2tp_session_put+0xaf/0x1a0 [ 26.905613][ T357] l2tp_session_delete+0x3a9/0x4a0 [ 26.910747][ T357] l2tp_tunnel_del_work+0x180/0x3d0 [ 26.915966][ T357] process_one_work+0x6c8/0xbb0 [ 26.920838][ T357] worker_thread+0xaa0/0x1250 [ 26.925539][ T357] kthread+0x3f5/0x4f0 [ 26.929632][ T357] ret_from_fork+0x1f/0x30 [ 26.934080][ T357] [ 26.936414][ T357] The buggy address belongs to the object at ffff88812bf22800 [ 26.936414][ T357] which belongs to the cache kmalloc-512 of size 512 [ 26.950488][ T357] The buggy address is located 0 bytes inside of [ 26.950488][ T357] 512-byte region [ffff88812bf22800, ffff88812bf22a00) [ 26.963611][ T357] The buggy address belongs to the page: [ 26.969275][ T357] page:ffffea0004afc800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12bf20 [ 26.979622][ T357] head:ffffea0004afc800 order:2 compound_mapcount:0 compound_pincount:0 [ 26.987976][ T357] flags: 0x4000000000010200(slab|head|zone=1) [ 26.994080][ T357] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 [ 27.003046][ T357] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 27.012038][ T357] page dumped because: kasan: bad access detected [ 27.018828][ T357] page_owner tracks the page as allocated [ 27.024992][ T357] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x152a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 340, ts 26546805841, free_ts 0 [ 27.042815][ T357] post_alloc_hook+0x192/0x1b0 [ 27.047619][ T357] prep_new_page+0x1c/0x110 [ 27.052168][ T357] get_page_from_freelist+0x2c3a/0x2cd0 [ 27.057785][ T357] __alloc_pages+0x1a2/0x460 [ 27.062414][ T357] new_slab+0xa0/0x4d0 [ 27.066513][ T357] ___slab_alloc+0x3ac/0x840 [ 27.071144][ T357] __slab_alloc+0x49/0x90 [ 27.075514][ T357] __kmalloc+0x16a/0x2c0 [ 27.076760][ T6] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 27.079794][ T357] ___neigh_create+0x6fb/0x1c50 [ 27.092124][ T357] __neigh_create+0x31/0x40 [ 27.096640][ T357] ip6_finish_output2+0xae3/0x1790 [ 27.101774][ T357] __ip6_finish_output+0x621/0x7e0 [ 27.106911][ T357] ip6_finish_output+0x31/0x220 [ 27.111796][ T357] ip6_output+0x1fa/0x410 [ 27.116236][ T357] ndisc_send_skb+0x7f6/0xcf0 [ 27.120916][ T357] ndisc_send_ns+0x879/0xb10 [ 27.125517][ T357] page_owner free stack trace missing [ 27.130898][ T357] [ 27.133223][ T357] Memory state around the buggy address: [ 27.138855][ T357] ffff88812bf22700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.146923][ T357] ffff88812bf22780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.154984][ T357] >ffff88812bf22800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.163046][ T357] ^ [ 27.167116][ T357] ffff88812bf22880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.175472][ T357] ffff88812bf22900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.183698][ T357] ================================================================== [ 27.191771][ T357] Disabling lock debugging due to kernel taint [ 27.196861][ T20] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 27.208771][ T357] ------------[ cut here ]------------ [ 27.214410][ T357] WARNING: CPU: 0 PID: 357 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 27.225042][ T305] usb 2-1: not running at top speed; connect to a high speed hub [ 27.229400][ T357] Modules linked in: [ 27.237128][ T357] CPU: 0 PID: 357 Comm: syz.0.17 Tainted: G B syzkaller #0 [ 27.246000][ T357] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 27.256256][ T357] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 27.262881][ T357] Code: 5d c3 e8 9c 83 0b fd be 02 00 00 00 eb 0a e8 90 83 0b fd be 01 00 00 00 4c 89 f7 e8 33 02 f2 fd e9 0f ff ff ff e8 79 83 0b fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 68 83 0b fd 4c 89 f7 be 03 [ 27.283540][ T357] RSP: 0018:ffffc900080e7d10 EFLAGS: 00010293 [ 27.292121][ T357] RAX: ffffffff845e3367 RBX: ffff8881105b7000 RCX: ffff88811039a780 [ 27.300610][ T357] RDX: 0000000000000000 RSI: 000000000ca1f720 RDI: 000000000c04eb7d [ 27.306884][ T305] usb 2-1: config 14 has an invalid interface number: 57 but max is 1 [ 27.309181][ T357] RBP: ffffc900080e7d30 R08: 0000000000000003 R09: 0000000000000004 [ 27.318355][ T305] usb 2-1: config 14 has an invalid interface number: 228 but max is 1 [ 27.325140][ T357] R10: dffffc0000000000 R11: fffffbfff0e18e4c R12: dffffc0000000000 [ 27.335778][ T305] usb 2-1: config 14 has no interface number 0 [ 27.342022][ T357] R13: dffffc0000000000 R14: 000000000ca1f720 R15: ffff88812bf22800 [ 27.348677][ T305] usb 2-1: config 14 has no interface number 1 [ 27.356234][ T357] FS: 0000555587bde500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 27.362643][ T305] usb 2-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 27.372482][ T357] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.382541][ T305] usb 2-1: config 14 interface 228 altsetting 5 has an invalid endpoint with address 0xD1, skipping [ 27.389465][ T357] CR2: 00007ffd93b5edb0 CR3: 000000012a160000 CR4: 00000000003506b0 [ 27.400036][ T305] usb 2-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 27.407903][ T357] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 27.421130][ T305] usb 2-1: config 14 interface 57 has no altsetting 0 [ 27.429826][ T357] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 27.436150][ T305] usb 2-1: config 14 interface 228 has no altsetting 0 [ 27.444252][ T357] Call Trace: [ 27.453926][ T357] [ 27.457126][ T357] pppol2tp_release+0x150/0x2b0 [ 27.462024][ T357] sock_close+0xb8/0x200 [ 27.466283][ T357] ? sock_mmap+0xa0/0xa0 [ 27.470646][ T357] __fput+0x22b/0x900 [ 27.474674][ T357] ____fput+0x15/0x20 [ 27.478835][ T357] task_work_run+0x127/0x190 [ 27.483563][ T357] exit_to_user_mode_loop+0xd0/0xe0 [ 27.488908][ T357] exit_to_user_mode_prepare+0x87/0xd0 [ 27.494532][ T357] syscall_exit_to_user_mode+0x1a/0x30 [ 27.500320][ T357] do_syscall_64+0x58/0xa0 [ 27.504783][ T357] ? clear_bhb_loop+0x50/0xa0 [ 27.509607][ T357] ? clear_bhb_loop+0x50/0xa0 [ 27.514314][ T357] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 27.520356][ T357] RIP: 0033:0x7f70d1573019 [ 27.524814][ T357] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 27.544681][ T357] RSP: 002b:00007ffe37518228 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 27.553381][ T357] RAX: 0000000000000000 RBX: 00007ffe37518310 RCX: 00007f70d1573019 [ 27.561630][ T357] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 27.562136][ T6] usb 4-1: config 1 has an invalid descriptor of length 116, skipping remainder of the config [ 27.570747][ T357] RBP: 00000000000067b8 R08: 0000000000000001 R09: 0000000000000000 [ 27.580140][ T6] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 27.589965][ T357] R10: 0000001b2d820000 R11: 0000000000000246 R12: 00007ffe37518350 [ 27.605017][ T357] R13: 00007f70d17fafac R14: 00000000000067ec R15: 00007f70d17fafa0 [ 27.613191][ T305] usb 2-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 27.613230][ T357] [ 27.622342][ T305] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.622363][ T305] usb 2-1: Product: syz [ 27.622377][ T305] usb 2-1: Manufacturer: syz [ 27.622391][ T305] usb 2-1: SerialNumber: syz [ 27.627788][ T357] ---[ end trace bd60e1987a9d24fd ]--- [ 27.653781][ T20] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 27.664872][ T20] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 27.786635][ T6] usb 4-1: New USB device found, idVendor=06f8, idProduct=b000, bcdDevice= 0.40 [ 27.795701][ T6] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.803808][ T6] usb 4-1: Product: syz [ 27.808010][ T6] usb 4-1: Manufacturer: syz [ 27.812607][ T6] usb 4-1: SerialNumber: syz [ 27.836629][ T20] usb 5-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ac.7e [ 27.845731][ T20] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.853794][ T20] usb 5-1: Product: syz [ 27.858086][ T20] usb 5-1: Manufacturer: syz [ 27.862696][ T20] usb 5-1: SerialNumber: syz [ 27.869417][ T20] usb 5-1: config 0 descriptor?? [ 27.907876][ T20] hub 5-1:0.0: bad descriptor, ignoring hub [ 27.913817][ T20] hub: probe of 5-1:0.0 failed with error -5 [ 28.176605][ T6] usb 4-1: 0:1 : does not exist [ 28.181601][ T6] usb 4-1: unit 4 not found! [ 28.186229][ T6] usb 4-1: unit 51 not found! [ 28.193343][ T6] usb 4-1: USB disconnect, device number 2 [ 28.227021][ T39] usb 5-1: USB disconnect, device number 2 [ 28.397048][ T360] udevd[360]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 28.576543][ T39] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 28.826527][ T39] usb 5-1: Using ep0 maxpacket: 16 [ 28.946606][ T39] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 28.957587][ T39] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 29.126591][ T39] usb 5-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ac.7e [ 29.135663][ T39] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.143723][ T39] usb 5-1: Product: syz [ 29.147931][ T39] usb 5-1: Manufacturer: syz [ 29.152525][ T39] usb 5-1: SerialNumber: syz [ 29.157816][ T39] usb 5-1: config 0 descriptor?? [ 29.196872][ T39] hub 5-1:0.0: bad descriptor, ignoring hub [ 29.202852][ T39] hub: probe of 5-1:0.0 failed with error -5 [ 29.436610][ T39] usb 5-1: USB disconnect, device number 3 [ 30.239409][ T6] usb 2-1: USB disconnect, device number 2