last executing test programs: 5m17.451375091s ago: executing program 1 (id=74): r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffff0040da0b528120000000000109022700010100a0320904000003ffff0000070581020002000705020200020007058303400004"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x5, 0x4, '\x00\x00\x00L'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x5, 0x4, '\x00\x00\x00L'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x5, 0x4, '\x00\x00\x00L'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x5, 0x4, '\x00\x00\x00L'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x5, 0x4, '\x00\x00\x00L'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x5, 0x4, '\x00\x00\x00L'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x5, 0x4, '\x00\x00\x00L'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x5, 0x4, '\x00\x00\x00L'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x5, 0x4, '\x00\x00\x00L'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x5, 0x4, '\x00\x00\x00L'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000500)={'syzkaller0\x00', &(0x7f0000000400)=@ethtool_gstrings={0x1b, 0x1, 0x20, '\x00'/32}}) 4m50.565138407s ago: executing program 1 (id=77): r0 = syz_usb_connect(0x3, 0x60, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040402004c600010102000109024e0001010080fa090400000200000000070502020002000705810200020009040001020000000007050202000200070581020002000904000202000000000705020200020007058102000200"], 0x0) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000100)='}\x00') nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) 4m30.883592637s ago: executing program 1 (id=79): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='0x17b3\n\x00', 0x7) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='0x0004\n\x00', 0x7) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/strings/0x409/manufacturer\x00', 0x1, 0x0) write(r2, &(0x7f0000000280)='ACME\n\x00', 0x5) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/strings/0x409/product\x00', 0x1, 0x0) write(r3, &(0x7f0000000300)='ACMESynth\n\x00', 0xa) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/midi2.usb0/ep.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/midi2.usb0/ep.1/block.0\x00', 0x1ff) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/configs/c.1/midi2.usb0\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f0000000680)='dummy_udc.0\n\x00', 0xc) close(r4) 3m49.521026333s ago: executing program 1 (id=81): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x1ff) write(r0, &(0x7f0000000600)='0x1d6b\x00', 0x7) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x1ff) write(r1, &(0x7f0000000800)='0x0104\x00', 0x7) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/configs/c1.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./config/usb_gadget/g1/functions/hid.usb0/subclass\x00', 0x1, 0x1ff) write(r2, &(0x7f0000000c00)='1\x00', 0x2) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000d00)='./config/usb_gadget/g1/functions/hid.usb0/protocol\x00', 0x1, 0x1ff) write(r3, &(0x7f0000000e00)='1\x00', 0x2) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x1, 0x1ff) write(r4, &(0x7f0000001000)='8\x00', 0x2) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000001100)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x1, 0x1ff) write(r5, &(0x7f0000001200)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f) close(r5) symlinkat(&(0x7f0000001300)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000001400)='./config/usb_gadget/g1/configs/c1.1/hid.usb0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./dev\x00', 0x1ff) mount(&(0x7f0000002100)=@filename='none\x00', &(0x7f0000002200)='./dev\x00', &(0x7f0000002300)='devtmpfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000001600)='dummy_udc.0\x00', 0xc) close(0xffffffffffffffff) nanosleep(&(0x7f0000001700)={0x1}, 0x0) read(0xffffffffffffffff, &(0x7f0000002500), 0x64) 3m20.539145406s ago: executing program 1 (id=83): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./tracing\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) r0 = syz_create_resource$binfmt(&(0x7f0000000400)='./file0\x00') r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x241, 0x1ff) write$binfmt_elf64(r1, &(0x7f0000000500)={{0x7f, 0x45, 0x4c, 0x46, 0x2, 0x1, 0x1, 0x0, 0x0, 0x2, 0x3e, 0x1, 0x100, 0x40, 0x0, 0x0, 0x40, 0x38, 0x1}, [{0x1, 0x5, 0x0, 0x0, 0x0, 0x1000, 0x1000, 0x1000}], "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000048bc0000020000070000e800000000c300"/288}, 0x198) close$binfmt(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./tracing/uprobe_events\x00', 0x1, 0x0) write(r2, &(0x7f0000000700)='p:myevent ./file0:0x10a\x00', 0x17) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./tracing/events/uprobes/myevent/enable\x00', 0x1, 0x0) write(r3, &(0x7f0000000900)='1\x00', 0x1) close(r3) mmap(&(0x7f0000020000/0x1000)=nil, 0x1000, 0x3, 0x132, 0xffffffffffffffff, 0x0) 2m54.764232319s ago: executing program 1 (id=85): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000040)={&(0x7f0000000000), 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x38, 0x1403, 0x1, 0x70bd2d, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) 2m33.996677855s ago: executing program 0 (id=87): mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x0, 0x0) 2m19.064021051s ago: executing program 0 (id=88): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x1ff) write(r0, &(0x7f0000000600)='0x1d6b\x00', 0x7) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x1ff) write(r1, &(0x7f0000000800)='0x0104\x00', 0x7) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/configs/c1.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./config/usb_gadget/g1/functions/hid.usb0/subclass\x00', 0x1, 0x1ff) write(r2, &(0x7f0000000c00)='1\x00', 0x2) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000d00)='./config/usb_gadget/g1/functions/hid.usb0/protocol\x00', 0x1, 0x1ff) write(r3, &(0x7f0000000e00)='1\x00', 0x2) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x1, 0x1ff) write(r4, &(0x7f0000001000)='8\x00', 0x2) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000001100)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x1, 0x1ff) write(r5, &(0x7f0000001200)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f) close(r5) symlinkat(&(0x7f0000001300)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000001400)='./config/usb_gadget/g1/configs/c1.1/hid.usb0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./dev\x00', 0x1ff) mount(&(0x7f0000002100)=@filename='none\x00', &(0x7f0000002200)='./dev\x00', &(0x7f0000002300)='devtmpfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000001600)='dummy_udc.0\x00', 0xc) close(0xffffffffffffffff) nanosleep(&(0x7f0000001700)={0x1}, 0x0) read(0xffffffffffffffff, &(0x7f0000002500), 0x64) 2m8.995169468s ago: executing program 32 (id=85): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000040)={&(0x7f0000000000), 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x38, 0x1403, 0x1, 0x70bd2d, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) 1m48.282389756s ago: executing program 0 (id=90): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/devices/system/machinecheck/machinecheck0/bank0/threshold_limit\x00', 0x1, 0x0) write(r0, &(0x7f00000001c0)='10\n\x00', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/devices/system/machinecheck/machinecheck0/bank1/threshold_limit\x00', 0x1, 0x0) write(r1, &(0x7f0000000280)='10\n\x00', 0x3) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/devices/system/machinecheck/machinecheck0/bank2/threshold_limit\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='10\n\x00', 0x3) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/devices/system/machinecheck/machinecheck0/bank3/threshold_limit\x00', 0x1, 0x0) write(r3, &(0x7f0000000400)='10\n\x00', 0x3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/devices/system/machinecheck/machinecheck0/bank4/threshold_limit\x00', 0x1, 0x0) write(r4, &(0x7f00000004c0)='10\n\x00', 0x3) r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/devices/system/machinecheck/machinecheck0/bank4/dram/threshold_limit\x00', 0x1, 0x0) write(r5, &(0x7f0000000580)='10\n\x00', 0x3) r6 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./sys/devices/system/machinecheck/machinecheck0/bank4/insn_fetch/threshold_limit\x00', 0x1, 0x0) write(r6, &(0x7f0000000640)='10\n\x00', 0x3) r7 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./sys/devices/system/machinecheck/machinecheck0/bank5/threshold_limit\x00', 0x1, 0x0) write(r7, &(0x7f0000000700)='10\n\x00', 0x3) 1m14.27809066s ago: executing program 0 (id=91): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ed) mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000200)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./debug/tracing/events/x86_fpu/x86_fpu_xstate_check_failed/enable\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='1\x00', 0x1) rt_sigaction(0xa, &(0x7f0000000000)={&(0x7f0000000100)="c3", 0x4000004, &(0x7f0000000200)="48c7c00f0000000f05"}, 0x0, 0x8, 0x0) r1 = getpid() tkill(r1, 0xa) 34.165205364s ago: executing program 0 (id=92): syz_usb_connect(0x2, 0x4e, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000401107500500000102030109023c0001010080fa0904000006ffffff0007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x81b6, 0xb485) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x2, 0x0) pread64(r0, &(0x7f0000000400)=""/2, 0x2, 0xd000) 0s ago: executing program 0 (id=93): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./config\x00', &(0x7f0000000240)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000000)='dummy_udc.0\n', 0xc) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r1, &(0x7f0000000040)='0x1d6b', 0x6) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r2, &(0x7f0000000080)='0x0104', 0x6) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000200)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/configs/c.1/uac2.usb0\x00') kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:29134' (ED25519) to the list of known hosts. syzkaller login: [ 623.768607][ T3218] cgroup: Unknown subsys name 'net' [ 624.669903][ T3218] cgroup: Unknown subsys name 'cpuset' [ 624.918895][ T3218] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 724.305890][ T3218] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 958.637515][ T3231] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 959.899879][ T3231] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 960.272901][ T3229] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 961.609113][ T3229] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 982.860092][ T3231] hsr_slave_0: entered promiscuous mode [ 983.003073][ T3231] hsr_slave_1: entered promiscuous mode [ 986.164104][ T3229] hsr_slave_0: entered promiscuous mode [ 986.280182][ T3229] hsr_slave_1: entered promiscuous mode [ 986.400207][ T3229] debugfs: 'hsr0' already exists in 'hsr' [ 986.418659][ T3229] Cannot create hsr debugfs directory [ 1006.838740][ T3231] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1007.378688][ T3231] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1007.468835][ T3231] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1007.782184][ T3231] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1007.867948][ T3231] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1008.054530][ T3231] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1008.524978][ T3231] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1008.729592][ T3231] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1011.255450][ T3229] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1011.935436][ T3229] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1012.048046][ T3229] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1012.198839][ T3229] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1012.415461][ T3229] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1012.587749][ T3229] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1013.379134][ T3229] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1013.662385][ T3229] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1035.855512][ T3231] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1045.844514][ T3229] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1167.304352][ T3231] veth0_vlan: entered promiscuous mode [ 1170.323755][ T3231] veth1_vlan: entered promiscuous mode [ 1175.774144][ T3231] veth0_macvtap: entered promiscuous mode [ 1177.605446][ T3231] veth1_macvtap: entered promiscuous mode [ 1180.836501][ T3229] veth0_vlan: entered promiscuous mode [ 1182.895687][ T3229] veth1_vlan: entered promiscuous mode [ 1186.508401][ T154] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1186.540374][ T154] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1186.826938][ T3345] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1186.918705][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1192.491959][ T3229] veth0_macvtap: entered promiscuous mode [ 1193.806631][ T3229] veth1_macvtap: entered promiscuous mode [ 1200.315677][ T3231] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 1201.494224][ T3234] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1202.609965][ T3786] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1203.459756][ T154] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1203.517024][ T154] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1241.055469][ T24] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 1247.417921][ T24] usb 1-1: device descriptor read/all, error -110 [ 1247.797004][ T24] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 1248.467478][ T24] usb 1-1: device descriptor read/64, error -32 [ 1248.714590][ T24] usb usb1-port1: attempt power cycle [ 1249.355811][ T24] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 1249.881920][ C1] raw-gadget.0 gadget.0: ignoring, device is not running [ 1249.929774][ T24] usb 1-1: device descriptor read/8, error -32 [ 1303.049949][ T3879] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 1312.142316][ T3882] md: pers->run() failed ... [ 1317.219064][ T9] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 1319.558448][ T9] usb 2-1: New USB device found, idVendor=0bda, idProduct=8157, bcdDevice= 0.00 [ 1319.566618][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1320.726151][ T9] r8152-cfgselector 2-1: Unknown version 0x0000 [ 1327.480330][ T9] r8152-cfgselector 2-1: Unknown version 0x0000 [ 1329.529250][ T3750] r8152-cfgselector 2-1: USB disconnect, device number 2 [ 1352.420587][ T3911] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 1355.930692][ T3906] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 1356.484941][ T3906] usb 1-1: Using ep0 maxpacket: 32 [ 1357.014346][ T3906] usb 1-1: config index 0 descriptor too short (expected 18, got 11) [ 1357.020249][ T3906] usb 1-1: config 0 has an invalid descriptor of length 9, skipping remainder of the config [ 1357.031818][ T3906] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1357.042142][ T3906] usb 1-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 1357.049463][ T3906] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1358.115856][ T3906] usb 1-1: config 0 descriptor?? [ 1366.800557][ T3215] usb 1-1: USB disconnect, device number 6 [ 1398.745943][ T3847] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 1400.142361][ T3847] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 1400.145180][ T3847] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [ 1402.328162][ T3847] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.00 [ 1402.330064][ T3847] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 1402.340419][ T3847] usb 1-1: Product: syz [ 1402.346919][ T3847] usb 1-1: Manufacturer: syz [ 1403.310661][ T3935] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1403.385238][ T3935] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1404.368272][ T3847] garmin_gps 1-1:1.0: Garmin GPS usb/tty converter detected [ 1405.899400][ T3847] usb 1-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 1414.805978][ T3215] usb 1-1: USB disconnect, device number 7 [ 1416.018949][ T3215] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 1416.172739][ T3215] garmin_gps 1-1:1.0: device disconnected [ 1418.199808][ T3950] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 1423.228786][ T3765] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 1423.594954][ T3765] usb 1-1: Using ep0 maxpacket: 8 [ 1425.297355][ T3765] usb 1-1: config 0 has an invalid interface number: 143 but max is 0 [ 1425.306288][ T3765] usb 1-1: config 0 has no interface number 0 [ 1425.309015][ T3765] usb 1-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 1425.329622][ T3765] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1425.744862][ T3765] usb 1-1: config 0 descriptor?? [ 1426.425968][ T3765] viperboard 1-1:0.143: version 0.00 found at bus 001 address 008 [ 1427.890672][ T3765] viperboard-i2c viperboard-i2c.1.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 1427.933064][ T3765] viperboard-i2c viperboard-i2c.1.auto: probe with driver viperboard-i2c failed with error -5 [ 1441.105275][ T3847] usb 1-1: USB disconnect, device number 8 [ 1473.847361][ T4011] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 1478.786735][ T4014] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 1492.519400][ T4020] nvmet: adding nsid 1 to subsystem test_subsystem [ 1501.769178][ T3345] nvmet: Created nvm controller 1 for subsystem test_subsystem for NQN nqn.2014-08.org.nvmexpress:uuid:304117df-b61e-4f60-866c-f830cb1d1901. [ 1503.526175][ T4022] nvme nvme0: creating 2 I/O queues. [ 1506.228500][ T4022] nvme nvme0: new ctrl: "test_subsystem" [ 1507.588069][ T3851] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 1508.257767][ T3851] usb 1-1: config 1 has an invalid interface number: 4 but max is 0 [ 1508.259199][ T3851] usb 1-1: config 1 has no interface number 0 [ 1508.407686][ T3851] usb 1-1: New USB device found, idVendor=05c6, idProduct=9215, bcdDevice= 0.00 [ 1508.413957][ T3851] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 1508.416059][ T3851] usb 1-1: Product: syz [ 1508.416991][ T3851] usb 1-1: Manufacturer: syz [ 1515.069246][ T3851] qmi_wwan 1-1:1.4: probe with driver qmi_wwan failed with error -110 [ 1516.417997][ T9] usb 1-1: USB disconnect, device number 9 [ 1528.905300][ T4057] md: array md0 already has disks! [ 1529.496381][ T4057] md: could not open device unknown-block(1,0). [ 1529.499941][ T4057] md: error, md_import_device() returned -16 [ 1530.086588][ T4057] md: could not open device unknown-block(1,1). [ 1530.089984][ T4057] md: error, md_import_device() returned -16 [ 1537.143326][ T3906] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 1537.444969][ T3906] usb 1-1: Using ep0 maxpacket: 8 [ 1537.742475][ T3906] usb 1-1: config 0 has an invalid interface number: 143 but max is 0 [ 1537.754313][ T3906] usb 1-1: config 0 has no interface number 0 [ 1537.776249][ T3906] usb 1-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 1537.778791][ T3906] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1538.398930][ T3906] usb 1-1: config 0 descriptor?? [ 1539.185556][ T3906] viperboard 1-1:0.143: version 0.00 found at bus 001 address 010 [ 1541.138224][ T3906] viperboard-i2c viperboard-i2c.1.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 1541.145688][ T3906] viperboard-i2c viperboard-i2c.1.auto: probe with driver viperboard-i2c failed with error -5 [ 1542.450117][ T3860] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 1543.053135][ T3860] usb 2-1: not running at top speed; connect to a high speed hub [ 1543.202865][ T3860] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 1543.205467][ T3860] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 256, setting to 64 [ 1543.728221][ T3860] usb 2-1: New USB device found, idVendor=0403, idProduct=6001, bcdDevice= 6.00 [ 1543.737094][ T3860] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1543.744087][ T3860] usb 2-1: Product: syz [ 1543.750389][ T3860] usb 2-1: Manufacturer: syz [ 1543.765236][ T3860] usb 2-1: SerialNumber: syz [ 1543.995837][ T3851] usb 1-1: USB disconnect, device number 10 [ 1544.373394][ T4080] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 1545.944042][ T4080] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 1546.599652][ T3860] ftdi_sio 2-1:1.0: FTDI USB Serial Device converter detected [ 1546.741564][ T3860] usb 2-1: Detected FT232R [ 1551.858051][ T3860] ftdi_sio ttyUSB0: Unable to read latency timer: -110 [ 1551.888974][ T3860] ftdi_sio ttyUSB0: Unable to write latency timer: -32 [ 1551.930293][ T3860] ftdi_sio 2-1:1.0: GPIO initialisation failed: -32 [ 1552.190299][ T3860] usb 2-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 1555.322802][ T3215] usb 2-1: USB disconnect, device number 3 [ 1556.240370][ T3215] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 1556.425530][ T3215] ftdi_sio 2-1:1.0: device disconnected [ 1562.372838][ T3860] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 1562.933264][ T3860] usb 1-1: New USB device found, idVendor=8086, idProduct=0b63, bcdDevice= 0.00 [ 1562.944782][ T3860] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1564.647684][ T3860] ljca 1-1:1.0: probe with driver ljca failed with error -110 [ 1583.640103][ T3750] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 1583.762406][ T24] usb 1-1: USB disconnect, device number 11 [ 1587.916593][ T3750] usb 2-1: New USB device found, idVendor=3412, idProduct=7856, bcdDevice= 1.00 [ 1587.924118][ T3750] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1587.940388][ T3750] usb 2-1: Product: syz [ 1587.970482][ T3750] usb 2-1: Manufacturer: syz [ 1588.007295][ T3750] usb 2-1: SerialNumber: syz [ 1594.397450][ T3750] usb 2-1: can't set config #1, error -110 [ 1594.905610][ T3750] usb 2-1: USB disconnect, device number 4 [ 1597.014567][ T3750] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 1597.466476][ T3750] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 1597.480681][ T3750] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 1597.492468][ T3750] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.00 [ 1597.495509][ T3750] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1598.056764][ T4154] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1598.092702][ T4154] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1598.502321][ T3750] garmin_gps 1-1:1.0: Garmin GPS usb/tty converter detected [ 1599.344897][ T3750] usb 1-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 1606.995189][ T9] usb 1-1: USB disconnect, device number 12 [ 1607.824081][ T9] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 1608.060252][ T9] garmin_gps 1-1:1.0: device disconnected [ 1627.649807][ T3209] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 1628.378906][ T3209] usb 2-1: Using ep0 maxpacket: 8 [ 1628.940254][ T3209] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 256 [ 1628.958069][ T3209] usb 2-1: New USB device found, idVendor=0403, idProduct=8372, bcdDevice= 1.00 [ 1628.970492][ T3209] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1630.297252][ T4194] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1630.700239][ T3209] ftdi_sio 2-1:1.0: FTDI USB Serial Device converter detected [ 1630.829848][ T3209] usb 2-1: Detected SIO [ 1630.947235][ T3209] usb 2-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 1636.226173][ T3847] usb 1-1: new full-speed USB device number 13 using dummy_hcd [ 1639.296081][ T4206] ftdi_sio ttyUSB0: ftdi_set_termios FAILED to set databits/stopbits/parity [ 1639.493541][ T4206] ftdi_sio ttyUSB0: ftdi_set_termios urb failed to set baudrate [ 1639.519117][ T4206] ftdi_sio ttyUSB0: failed to set flow control: -32 [ 1641.875913][ T3847] usb 1-1: unable to read config index 0 descriptor/start: -32 [ 1641.877962][ T3847] usb 1-1: chopping to 0 config(s) [ 1641.879828][ T3847] usb 1-1: can't read configurations, error -32 [ 1642.182346][ T3847] usb 1-1: new full-speed USB device number 14 using dummy_hcd [ 1642.468469][ T3847] usb 1-1: device descriptor read/64, error -32 [ 1642.624312][ T3847] usb usb1-port1: attempt power cycle [ 1644.820312][ T4206] ftdi_sio ttyUSB0: failed to get modem status: -32 [ 1644.839284][ T4206] ftdi_sio ttyUSB0: error from flowcontrol urb [ 1645.775832][ T3847] usb 2-1: USB disconnect, device number 5 [ 1646.322922][ T3847] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 1646.397049][ T3847] ftdi_sio 2-1:1.0: device disconnected [ 1655.449712][ T3226] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 1655.822848][ T3226] usb 1-1: Using ep0 maxpacket: 8 [ 1656.234433][ T3226] usb 1-1: config 0 has an invalid interface number: 143 but max is 0 [ 1656.239293][ T3226] usb 1-1: config 0 has no interface number 0 [ 1656.240621][ T3226] usb 1-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 1656.252035][ T3226] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1656.658600][ T3226] usb 1-1: config 0 descriptor?? [ 1657.173549][ T3226] viperboard 1-1:0.143: version 0.00 found at bus 001 address 016 [ 1658.446482][ T3226] viperboard-i2c viperboard-i2c.1.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 1658.456801][ T3226] viperboard-i2c viperboard-i2c.1.auto: probe with driver viperboard-i2c failed with error -5 [ 1660.490780][ T3851] usb 1-1: USB disconnect, device number 16 [ 1665.052749][ T4266] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 1668.885456][ T4266] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 1669.819568][ T4266] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 1678.144317][ T3851] usb 1-1: new full-speed USB device number 17 using dummy_hcd [ 1684.332356][ T3851] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1684.430497][ T3851] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 1684.437110][ T3851] usb 1-1: can't read configurations, error -71 [ 1690.596128][ T4149] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 1691.792275][ T4149] usb 2-1: New USB device found, idVendor=55aa, idProduct=a103, bcdDevice= 0.00 [ 1691.794517][ T4149] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1693.077903][ T4149] ums-sddr55 2-1:1.0: USB Mass Storage device detected [ 1693.607392][ T4149] ums-sddr55 2-1:1.0: This device (55aa,a103,0000 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 1693.607392][ T4149] Please send a copy of this message to and [ 1693.803773][ T4149] scsi host0: usb-storage 2-1:1.0 [ 1696.413931][ T4041] scsi 0:0:0:0: Direct-Access Sandisk ImageMate SDDR55 0000 PQ: 0 ANSI: 0 [ 1698.387521][ T4041] sd 0:0:0:0: Attached scsi generic sg0 type 0 [ 1702.708100][ T3851] usb 2-1: USB disconnect, device number 6 [ 1703.084543][ T3234] sd 0:0:0:0: [sda] Read Capacity(10) failed: Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK [ 1703.090010][ T3234] sd 0:0:0:0: [sda] Sense not available. [ 1703.129556][ T3234] sd 0:0:0:0: [sda] 0 512-byte logical blocks: (0 B/0 B) [ 1703.145274][ T3234] sd 0:0:0:0: [sda] 0-byte physical blocks [ 1703.184112][ T3234] sd 0:0:0:0: [sda] Write Protect is off [ 1703.228533][ T3234] sd 0:0:0:0: [sda] Asking for cache data failed [ 1703.241999][ T3234] sd 0:0:0:0: [sda] Assuming drive cache: write through [ 1707.853226][ T3234] sd 0:0:0:0: [sda] Attached SCSI removable disk [ 1715.246382][ T3851] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 1716.868080][ T3851] usb 2-1: config index 0 descriptor too short (expected 274, got 18) [ 1716.883013][ T3851] usb 2-1: config 0 has an invalid descriptor of length 191, skipping remainder of the config [ 1716.899795][ T3851] usb 2-1: config 0 has no interfaces? [ 1716.918241][ T3851] usb 2-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 1716.932696][ T3851] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1717.200345][ T3851] usb 2-1: config 0 descriptor?? [ 1719.986646][ T3848] usb 2-1: USB disconnect, device number 7 [ 1734.526011][ T3209] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 1736.082817][ T3209] usb 2-1: New USB device found, idVendor=0403, idProduct=c631, bcdDevice= 1.00 [ 1736.094106][ T3209] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1737.365752][ T3209] i2c-tiny-usb 2-1:1.0: version 1.00 found at bus 002 address 008 [ 1739.443855][ T3209] (null): error -EIO: failure setting delay to 10us [ 1739.450296][ T3209] i2c-tiny-usb 2-1:1.0: probe with driver i2c-tiny-usb failed with error -5 [ 1740.473505][ T3209] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 1742.623622][ T3209] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 5 [ 1742.637472][ T3209] usb 1-1: config 1 has no interface number 0 [ 1742.658486][ T3209] usb 1-1: New USB device found, idVendor=2c7c, idProduct=0125, bcdDevice= 0.00 [ 1742.670783][ T3209] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1749.498333][ T3209] qmi_wwan 1-1:1.4: probe with driver qmi_wwan failed with error -110 [ 1752.353799][ T3848] usb 1-1: USB disconnect, device number 19 [ 1754.278703][ T3860] usb 2-1: USB disconnect, device number 8 [ 1764.056834][ T3860] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 1765.090457][ T3860] usb 2-1: New USB device found, idVendor=040a, idProduct=0002, bcdDevice= 1.00 [ 1765.096122][ T3860] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1765.097868][ T3860] usb 2-1: Product: syz [ 1765.099335][ T3860] usb 2-1: Manufacturer: syz [ 1765.100706][ T3860] usb 2-1: SerialNumber: syz [ 1771.467169][ T4149] usb 2-1: USB disconnect, device number 9 [ 1783.673200][ T3209] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 1783.695589][ C1] raw-gadget.0 gadget.1: ignoring, device is not running [ 1784.085020][ T3209] usb 2-1: device descriptor read/64, error -32 [ 1784.778982][ T3209] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 1786.166511][ T3209] usb 2-1: New USB device found, idVendor=1286, idProduct=1fa4, bcdDevice= 1.00 [ 1786.170228][ T3209] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1786.179116][ T3209] usb 2-1: Product: syz [ 1786.192724][ T3209] usb 2-1: Manufacturer: syz [ 1786.199237][ T3209] usb 2-1: SerialNumber: syz [ 1789.594504][ T3209] mvusb_mdio 2-1:1.0: probe with driver mvusb_mdio failed with error -5 [ 1791.154353][ T3209] usb 2-1: USB disconnect, device number 11 [ 1795.703338][ T4149] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 1795.963317][ T4149] usb 1-1: Using ep0 maxpacket: 8 [ 1796.282146][ T4149] usb 1-1: config 0 has an invalid interface number: 143 but max is 0 [ 1796.283981][ T4149] usb 1-1: config 0 has no interface number 0 [ 1796.285374][ T4149] usb 1-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 1796.286506][ T4149] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1796.465087][ T4149] usb 1-1: config 0 descriptor?? [ 1796.766400][ T4149] viperboard 1-1:0.143: version 0.00 found at bus 001 address 020 [ 1797.522325][ T4149] viperboard-i2c viperboard-i2c.1.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 1797.527026][ T4149] viperboard-i2c viperboard-i2c.1.auto: probe with driver viperboard-i2c failed with error -5 [ 1801.993571][ T4424] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1802.050372][ T4424] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1803.641626][ T4149] usb 1-1: USB disconnect, device number 20 [ 1803.653697][ T3750] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 1803.974320][ T3750] usb 2-1: Using ep0 maxpacket: 8 [ 1804.264971][ T3750] usb 2-1: config 0 has an invalid interface number: 143 but max is 0 [ 1804.276534][ T3750] usb 2-1: config 0 has no interface number 0 [ 1804.305151][ T3750] usb 2-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 1804.319666][ T3750] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1804.700491][ T3750] usb 2-1: config 0 descriptor?? [ 1806.048711][ T3750] viperboard 2-1:0.143: version 0.00 found at bus 002 address 012 [ 1808.523880][ T3750] viperboard-i2c viperboard-i2c.2.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 1808.545583][ T3750] viperboard-i2c viperboard-i2c.2.auto: probe with driver viperboard-i2c failed with error -5 [ 1813.756480][ T3851] usb 2-1: USB disconnect, device number 12 [ 1822.824402][ T3215] usb 1-1: new low-speed USB device number 21 using dummy_hcd [ 1823.399687][ T3215] usb 1-1: Invalid ep0 maxpacket: 64 [ 1823.915136][ T3215] usb 1-1: new low-speed USB device number 22 using dummy_hcd [ 1824.317460][ T3215] usb 1-1: Invalid ep0 maxpacket: 64 [ 1824.346595][ T3215] usb usb1-port1: attempt power cycle [ 1824.975375][ T3215] usb 1-1: new low-speed USB device number 23 using dummy_hcd [ 1825.068969][ T3215] usb 1-1: Invalid ep0 maxpacket: 64 [ 1825.336136][ T3215] usb 1-1: new low-speed USB device number 24 using dummy_hcd [ 1825.489276][ T3215] usb 1-1: Invalid ep0 maxpacket: 64 [ 1825.526238][ T3215] usb usb1-port1: unable to enumerate USB device [ 1859.416934][ T3215] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 1859.804440][ T3215] usb 1-1: Using ep0 maxpacket: 8 [ 1859.932800][ T3215] usb 1-1: config 0 has an invalid interface number: 143 but max is 0 [ 1859.936827][ T3215] usb 1-1: config 0 has no interface number 0 [ 1859.950532][ T3215] usb 1-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 1859.960243][ T3215] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1860.077355][ T3215] usb 1-1: config 0 descriptor?? [ 1860.599723][ T3215] viperboard 1-1:0.143: version 0.00 found at bus 001 address 025 [ 1861.649785][ T3215] viperboard-i2c viperboard-i2c.1.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 1861.684874][ T3215] viperboard-i2c viperboard-i2c.1.auto: probe with driver viperboard-i2c failed with error -5 [ 1869.856309][ T3848] usb 1-1: USB disconnect, device number 25 [ 1878.766568][ T3847] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 1879.519895][ T3847] usb 2-1: New USB device found, idVendor=0bda, idProduct=8152, bcdDevice= 0.20 [ 1879.522663][ T3847] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1879.778810][ T3847] r8152-cfgselector 2-1: Unknown version 0x0000 [ 1881.188378][ T3847] r8152-cfgselector 2-1: reset high-speed USB device number 13 using dummy_hcd [ 1881.563556][ T3847] r8152-cfgselector 2-1: device descriptor read/64, error -32 [ 1881.947538][ T3847] r8152-cfgselector 2-1: reset high-speed USB device number 13 using dummy_hcd [ 1882.268547][ T3847] r8152-cfgselector 2-1: device descriptor read/64, error -32 [ 1882.649280][ T3847] r8152-cfgselector 2-1: reset high-speed USB device number 13 using dummy_hcd [ 1887.937516][ T3847] r8152-cfgselector 2-1: device descriptor read/8, error -110 [ 1888.345014][ T3847] r8152-cfgselector 2-1: reset high-speed USB device number 13 using dummy_hcd [ 1888.437257][ T3847] r8152-cfgselector 2-1: device descriptor read/8, error -32 [ 1888.672478][ T3847] r8152 2-1:1.0: USB reset failed, errno=-19 [ 1890.185661][ T3847] r8152-cfgselector 2-1: USB disconnect, device number 13 [ 1900.313997][ T817] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 1901.035826][ T817] usb 2-1: New USB device found, idVendor=2040, idProduct=c604, bcdDevice= 1.00 [ 1901.037425][ T817] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 1901.038691][ T817] usb 2-1: Product: syz [ 1901.039734][ T817] usb 2-1: Manufacturer: syz [ 1909.519442][ T3860] usb 2-1: USB disconnect, device number 14 [ 1913.653129][ T4273] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 1913.949213][ T4273] usb 1-1: Using ep0 maxpacket: 8 [ 1914.150757][ T4273] usb 1-1: config 0 has an invalid interface number: 143 but max is 0 [ 1914.163540][ T4273] usb 1-1: config 0 has no interface number 0 [ 1914.174488][ T4273] usb 1-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 1914.175933][ T4273] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1914.528058][ T4273] usb 1-1: config 0 descriptor?? [ 1915.264972][ T4273] viperboard 1-1:0.143: version 0.00 found at bus 001 address 026 [ 1916.769616][ T4273] viperboard-i2c viperboard-i2c.1.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 1916.784744][ T4273] viperboard-i2c viperboard-i2c.1.auto: probe with driver viperboard-i2c failed with error -5 [ 1918.145661][ T4273] usb 1-1: USB disconnect, device number 26 [ 1923.598846][ T3847] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 1924.258748][ T3847] usb 1-1: config index 0 descriptor too short (expected 32, got 18) [ 1924.266948][ T3847] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1924.275304][ T3847] usb 1-1: New USB device found, idVendor=03f0, idProduct=0207, bcdDevice= 0.01 [ 1924.279363][ T3847] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1925.737545][ T3847] ums-usbat 1-1:1.0: USB Mass Storage device detected [ 1926.626832][ T3847] ums-usbat 1-1:1.0: This device (03f0,0207,0001 S 05 P 80) has unneeded SubClass and Protocol entries in unusual_devs.h (kernel syzkaller) [ 1926.626832][ T3847] Please send a copy of this message to and [ 1929.707919][ T3215] usb 1-1: USB disconnect, device number 27 [ 1940.199476][ T4655] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1940.709833][ T4655] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1940.744008][ T3215] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 1941.249831][ T3215] usb 1-1: Dual-Role OTG device on HNP port [ 1941.286351][ T3215] usb 1-1: New USB device found, idVendor=17b3, idProduct=0004, bcdDevice= 7.02 [ 1941.295236][ T3215] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1941.303177][ T3215] usb 1-1: Product: ACMESynth [ 1941.312473][ T3215] usb 1-1: Manufacturer: ACME [ 1996.194610][ T4702] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1996.915992][ T4702] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2022.138635][ T4710] lo speed is unknown, defaulting to 1000 [ 2025.138948][ T4710] lo speed is unknown, defaulting to 1000 [ 2028.196642][ T4710] lo speed is unknown, defaulting to 1000 [ 2073.570666][ T4710] infiniband syz0: set active [ 2073.593989][ T4710] infiniband syz0: added lo [ 2073.947981][ T3750] lo speed is unknown, defaulting to 1000 [ 2074.229507][ T4710] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 2074.716938][ T4710] infiniband syz0: Couldn't open port 1 [ 2081.497502][ T4710] RDS/IB: syz0: added [ 2081.585519][ T4710] smc: adding ib device syz0 with port count 1 [ 2081.636258][ T4710] smc: ib device syz0 port 1 has no pnetid [ 2081.742741][ T3215] lo speed is unknown, defaulting to 1000 [ 2082.085601][ T4710] lo speed is unknown, defaulting to 1000 [ 2134.143128][ T4732] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 2155.508017][ T4710] lo speed is unknown, defaulting to 1000 [ 2166.358411][ T4742] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2166.797300][ T4742] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2208.793376][ T9] usb 1-1: USB disconnect, device number 28 [ 2217.060564][ T9] ================================================================== [ 2217.062789][ T9] BUG: KASAN: slab-use-after-free in snd_usb_midi_v2_free+0x524/0x6ec [ 2217.065831][ T9] Write of size 8 at addr ffffaf8032c9e350 by task kworker/0:0/9 [ 2217.067307][ T9] [ 2217.069908][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT [ 2217.070613][ T9] Hardware name: riscv-virtio,qemu (DT) [ 2217.071290][ T9] Workqueue: usb_hub_wq hub_event [ 2217.072305][ T9] Call Trace: [ 2217.072780][ T9] [] dump_backtrace+0x2e/0x3c [ 2217.073516][ T9] [] show_stack+0x30/0x3c [ 2217.074045][ T9] [] dump_stack_lvl+0x114/0x1aa [ 2217.074841][ T9] [] print_report+0x27a/0x592 [ 2217.075500][ T9] [] kasan_report+0xf0/0x26c [ 2217.076055][ T9] [] __asan_report_store8_noabort+0x12/0x1a [ 2217.076660][ T9] [] snd_usb_midi_v2_free+0x524/0x6ec [ 2217.077260][ T9] [] snd_usb_midi_v2_free_all+0x70/0xd0 [ 2217.077923][ T9] [] snd_usb_audio_free+0x3e/0x10a [ 2217.078464][ T9] [] release_card_device+0x98/0x1be [ 2217.079095][ T9] [] device_release+0xb4/0x24a [ 2217.079664][ T9] [] kobject_put+0x20a/0x5de [ 2217.080293][ T9] [] put_device+0x28/0x3a [ 2217.080844][ T9] [] snd_card_free_when_closed+0x30/0x42 [ 2217.081489][ T9] [] usb_audio_disconnect+0x1d8/0x5cc [ 2217.082014][ T9] [] usb_unbind_interface+0x18a/0x812 [ 2217.082844][ T9] [] device_remove+0x11a/0x15c [ 2217.083613][ T9] [] device_release_driver_internal+0x3ca/0x554 [ 2217.084179][ T9] [] device_release_driver+0x1e/0x28 [ 2217.084701][ T9] [] bus_remove_device+0x284/0x518 [ 2217.085453][ T9] [] device_del+0x312/0x870 [ 2217.086090][ T9] [] usb_disable_device+0x2d2/0x718 [ 2217.086858][ T9] [] usb_disconnect+0x27c/0x89e [ 2217.087448][ T9] [] hub_event+0x1b82/0x4a62 [ 2217.088041][ T9] [] process_one_work+0x90a/0x20a0 [ 2217.088810][ T9] [] worker_thread+0x532/0xcaa [ 2217.089560][ T9] [] kthread+0x312/0x438 [ 2217.090266][ T9] [] ret_from_fork_kernel+0x94/0xef6 [ 2217.090903][ T9] [] ret_from_fork_kernel_asm+0x16/0x18 [ 2217.091771][ T9] [ 2217.110067][ T9] Allocated by task 3215: [ 2217.111019][ T9] stack_trace_save+0xa0/0xd2 [ 2217.111722][ T9] kasan_save_stack+0x3e/0x66 [ 2217.112816][ T9] kasan_save_track+0x16/0x28 [ 2217.114236][ T9] kasan_save_alloc_info+0x30/0x3e [ 2217.115238][ T9] __kasan_kmalloc+0xa0/0xa6 [ 2217.116007][ T9] __kmalloc_cache_noprof+0x258/0x676 [ 2217.116658][ T9] snd_ump_endpoint_new+0x98/0x3fe [ 2217.117538][ T9] create_midi2_ump+0x286/0x7f8 [ 2217.118592][ T9] snd_usb_midi_v2_create+0x10be/0x3fce [ 2217.119640][ T9] snd_usb_create_stream.isra.0+0x334/0x4ee [ 2217.120846][ T9] usb_audio_probe+0xf86/0x330e [ 2217.121487][ T9] usb_probe_interface+0x2bc/0x916 [ 2217.122247][ T9] really_probe+0x222/0xa8e [ 2217.123249][ T9] __driver_probe_device+0x1d6/0x43e [ 2217.124327][ T9] driver_probe_device+0x5e/0x162 [ 2217.125338][ T9] __device_attach_driver+0x1c2/0x30a [ 2217.126012][ T9] bus_for_each_drv+0x142/0x1dc [ 2217.126882][ T9] __device_attach+0x1c4/0x490 [ 2217.127469][ T9] device_initial_probe+0xb2/0xc8 [ 2217.128320][ T9] bus_probe_device+0x50/0x146 [ 2217.129053][ T9] device_add+0x1150/0x1880 [ 2217.129812][ T9] usb_set_configuration+0xe92/0x196e [ 2217.130904][ T9] usb_generic_driver_probe+0x9e/0x11a [ 2217.132259][ T9] usb_probe_device+0xd4/0x378 [ 2217.133634][ T9] really_probe+0x222/0xa8e [ 2217.134695][ T9] __driver_probe_device+0x1d6/0x43e [ 2217.135783][ T9] driver_probe_device+0x5e/0x162 [ 2217.136809][ T9] __device_attach_driver+0x1c2/0x30a [ 2217.137882][ T9] bus_for_each_drv+0x142/0x1dc [ 2217.139182][ T9] __device_attach+0x1c4/0x490 [ 2217.140225][ T9] device_initial_probe+0xb2/0xc8 [ 2217.141254][ T9] bus_probe_device+0x50/0x146 [ 2217.142572][ T9] device_add+0x1150/0x1880 [ 2217.143738][ T9] usb_new_device+0x8e6/0x169a [ 2217.144820][ T9] hub_event+0x2c1a/0x4a62 [ 2217.145904][ T9] process_one_work+0x90a/0x20a0 [ 2217.147201][ T9] worker_thread+0x532/0xcaa [ 2217.148462][ T9] kthread+0x312/0x438 [ 2217.149643][ T9] ret_from_fork_kernel+0x94/0xef6 [ 2217.150807][ T9] ret_from_fork_kernel_asm+0x16/0x18 [ 2217.152059][ T9] [ 2217.152720][ T9] Freed by task 9: [ 2217.153499][ T9] stack_trace_save+0xa0/0xd2 [ 2217.154644][ T9] kasan_save_stack+0x3e/0x66 [ 2217.155921][ T9] kasan_save_track+0x16/0x28 [ 2217.157286][ T9] kasan_save_free_info+0x40/0x5a [ 2217.158463][ T9] __kasan_slab_free+0x5e/0x7e [ 2217.159771][ T9] kfree+0x298/0x76c [ 2217.160796][ T9] snd_rawmidi_free.part.0+0x328/0x456 [ 2217.162120][ T9] snd_rawmidi_dev_free+0x3e/0x5c [ 2217.163379][ T9] __snd_device_free+0x182/0x3b8 [ 2217.164628][ T9] snd_device_free_all+0xe0/0x1ec [ 2217.165899][ T9] release_card_device+0x6c/0x1be [ 2217.167159][ T9] device_release+0xb4/0x24a [ 2217.168246][ T9] kobject_put+0x20a/0x5de [ 2217.169554][ T9] put_device+0x28/0x3a [ 2217.170695][ T9] snd_card_free_when_closed+0x30/0x42 [ 2217.171951][ T9] usb_audio_disconnect+0x1d8/0x5cc [ 2217.173188][ T9] usb_unbind_interface+0x18a/0x812 [ 2217.174774][ T9] device_remove+0x11a/0x15c [ 2217.176161][ T9] device_release_driver_internal+0x3ca/0x554 [ 2217.177492][ T9] device_release_driver+0x1e/0x28 [ 2217.178689][ T9] bus_remove_device+0x284/0x518 [ 2217.180058][ T9] device_del+0x312/0x870 [ 2217.181184][ T9] usb_disable_device+0x2d2/0x718 [ 2217.182510][ T9] usb_disconnect+0x27c/0x89e [ 2217.183662][ T9] hub_event+0x1b82/0x4a62 [ 2217.184938][ T9] process_one_work+0x90a/0x20a0 [ 2217.186357][ T9] worker_thread+0x532/0xcaa [ 2217.187659][ T9] kthread+0x312/0x438 [ 2217.188860][ T9] ret_from_fork_kernel+0x94/0xef6 [ 2217.190010][ T9] ret_from_fork_kernel_asm+0x16/0x18 [ 2217.191351][ T9] [ 2217.192107][ T9] The buggy address belongs to the object at ffffaf8032c9e000 [ 2217.192107][ T9] which belongs to the cache kmalloc-4k of size 4096 [ 2217.193717][ T9] The buggy address is located 848 bytes inside of [ 2217.193717][ T9] freed 4096-byte region [ffffaf8032c9e000, ffffaf8032c9f000) [ 2217.195586][ T9] [ 2217.196348][ T9] The buggy address belongs to the physical page: [ 2217.198606][ T9] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xb2c98 [ 2217.200495][ T9] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 2217.202094][ T9] flags: 0x40(head|node=0|zone=0) [ 2217.203932][ T9] page_type: f5(slab) [ 2217.205818][ T9] raw: 0000000000000040 ffffaf8012002140 dead000000000100 dead000000000122 [ 2217.207351][ T9] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 2217.208958][ T9] head: 0000000000000040 ffffaf8012002140 dead000000000100 dead000000000122 [ 2217.210323][ T9] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 2217.211561][ T9] head: 0000000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 2217.212848][ T9] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 2217.214128][ T9] page dumped because: kasan: bad access detected [ 2217.215450][ T9] page_owner tracks the page as allocated [ 2217.216484][ T9] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4041, tgid 4041 (kworker/u8:2), ts 1537260235200, free_ts 1524334740600 [ 2217.218989][ T9] __set_page_owner+0x92/0x4b0 [ 2217.220543][ T9] post_alloc_hook+0xe4/0x1a0 [ 2217.221670][ T9] get_page_from_freelist+0x914/0x395c [ 2217.223050][ T9] __alloc_frozen_pages_noprof+0x224/0x2e40 [ 2217.224254][ T9] new_slab+0x94/0x6be [ 2217.225311][ T9] refill_objects+0x20a/0x3ba [ 2217.226463][ T9] __pcs_replace_empty_main+0x27e/0x5fa [ 2217.227617][ T9] __kmalloc_node_track_caller_noprof+0x5f0/0x8c0 [ 2217.228899][ T9] kmalloc_reserve+0xea/0x344 [ 2217.229956][ T9] __alloc_skb+0x1ba/0x768 [ 2217.231163][ T9] nsim_dev_trap_report_work+0x232/0xbe8 [ 2217.232482][ T9] process_one_work+0x90a/0x20a0 [ 2217.233879][ T9] worker_thread+0x532/0xcaa [ 2217.235252][ T9] kthread+0x312/0x438 [ 2217.236549][ T9] ret_from_fork_kernel+0x94/0xef6 [ 2217.237814][ T9] ret_from_fork_kernel_asm+0x16/0x18 [ 2217.239159][ T9] page last free pid 3231 tgid 3231 stack trace: [ 2217.240194][ T9] __reset_page_owner+0x76/0x1bc [ 2217.241575][ T9] __free_frozen_pages+0x6b0/0x136c [ 2217.242679][ T9] free_frozen_pages+0xe/0x16 [ 2217.243758][ T9] __free_slab+0xda/0x250 [ 2217.244791][ T9] free_slab+0x28/0x16c [ 2217.245832][ T9] __slab_free+0x23c/0x2f8 [ 2217.246906][ T9] ___cache_free+0x94/0xac [ 2217.248023][ T9] qlist_free_all+0x64/0x134 [ 2217.249193][ T9] kasan_quarantine_reduce+0x152/0x1b4 [ 2217.250643][ T9] __kasan_slab_alloc+0x5c/0x82 [ 2217.252003][ T9] __kmalloc_noprof+0x25e/0x8cc [ 2217.253196][ T9] tomoyo_realpath_from_path+0xac/0x5ea [ 2217.254415][ T9] tomoyo_path_perm+0x274/0x442 [ 2217.255518][ T9] tomoyo_path_unlink+0x9c/0xe2 [ 2217.256734][ T9] security_path_unlink+0x168/0x2fc [ 2217.258110][ T9] filename_unlinkat+0x2c6/0x682 [ 2217.259619][ T9] [ 2217.260278][ T9] Memory state around the buggy address: [ 2217.261779][ T9] ffffaf8032c9e200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2217.262984][ T9] ffffaf8032c9e280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2217.264305][ T9] >ffffaf8032c9e300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2217.265456][ T9] ^ [ 2217.266752][ T9] ffffaf8032c9e380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2217.267887][ T9] ffffaf8032c9e400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2217.269218][ T9] ================================================================== SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 2217.771733][ T9] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 2217.774111][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT [ 2217.775606][ T9] Hardware name: riscv-virtio,qemu (DT) [ 2217.776567][ T9] Workqueue: usb_hub_wq hub_event [ 2217.778058][ T9] Call Trace: [ 2217.778818][ T9] [] dump_backtrace+0x2e/0x3c [ 2217.780250][ T9] [] show_stack+0x30/0x3c [ 2217.781519][ T9] [] dump_stack_lvl+0x114/0x1aa [ 2217.783125][ T9] [] dump_stack+0x1c/0x24 [ 2217.784579][ T9] [] vpanic+0x32e/0x75a [ 2217.785818][ T9] [] panic+0xa0/0xa2 [ 2217.787018][ T9] [] check_panic_on_warn+0xc0/0xe4 [ 2217.788391][ T9] [] end_report.part.0+0x4e/0xae [ 2217.789862][ T9] [] kasan_report+0x164/0x26c [ 2217.791208][ T9] [] __asan_report_store8_noabort+0x12/0x1a [ 2217.792601][ T9] [] snd_usb_midi_v2_free+0x524/0x6ec [ 2217.794088][ T9] [] snd_usb_midi_v2_free_all+0x70/0xd0 [ 2217.795469][ T9] [] snd_usb_audio_free+0x3e/0x10a [ 2217.796714][ T9] [] release_card_device+0x98/0x1be [ 2217.798238][ T9] [] device_release+0xb4/0x24a [ 2217.799550][ T9] [] kobject_put+0x20a/0x5de [ 2217.800897][ T9] [] put_device+0x28/0x3a [ 2217.802168][ T9] [] snd_card_free_when_closed+0x30/0x42 [ 2217.803607][ T9] [] usb_audio_disconnect+0x1d8/0x5cc [ 2217.804916][ T9] [] usb_unbind_interface+0x18a/0x812 [ 2217.806574][ T9] [] device_remove+0x11a/0x15c [ 2217.808104][ T9] [] device_release_driver_internal+0x3ca/0x554 [ 2217.809469][ T9] [] device_release_driver+0x1e/0x28 [ 2217.811045][ T9] [] bus_remove_device+0x284/0x518 [ 2217.812660][ T9] [] device_del+0x312/0x870 [ 2217.814003][ T9] [] usb_disable_device+0x2d2/0x718 [ 2217.815570][ T9] [] usb_disconnect+0x27c/0x89e [ 2217.816912][ T9] [] hub_event+0x1b82/0x4a62 [ 2217.818367][ T9] [] process_one_work+0x90a/0x20a0 [ 2217.819920][ T9] [] worker_thread+0x532/0xcaa [ 2217.821424][ T9] [] kthread+0x312/0x438 [ 2217.822828][ T9] [] ret_from_fork_kernel+0x94/0xef6 [ 2217.824241][ T9] [] ret_from_fork_kernel_asm+0x16/0x18 [ 2217.826065][ T9] SMP: stopping secondary CPUs [ 2217.829554][ T9] Rebooting in 86400 seconds.. VM DIAGNOSIS: 10:21:56 Registers: info registers vcpu 0 CPU#0 V = 0 pc ffffffff865478aa mhartid 0000000000000000 mstatus 0000000a000000a0 hstatus 0000000200000000 vsstatus 0000000a00000000 mip 0000000000000220 mie 000000000000022a mideleg 0000000000001666 hideleg 0000000000000000 medeleg 0000000000f4b509 hedeleg 0000000000000000 mtvec 00000000800004f8 stvec ffffffff8654bd48 vstvec 0000000000000000 mepc ffffffff80092d8e sepc ffffffff86547c4e vsepc 0000000000000000 mcause 0000000000000009 scause 8000000000000005 vscause 0000000000000000 mtval 0000000000000000 stval 0000000000000000 htval 0000000000000000 mtval2 0000000000000000 mscratch 0000000080049000 sscratch 0000000000000000 satp 90249000000b7d0e x0/zero 0000000000000000 x1/ra ffffffff81fdacc4 x2/sp ffff8f80000a67a0 x3/gp ffffffff8a4a7c60 x4/tp ffffaf80132dd040 x5/t0 ffff8f80000a6723 x6/t1 0000000004000000 x7/t2 20666f2065746972 x8/s0 ffff8f80000a67d0 x9/s1 ffffffff9186d2c0 x10/a0 ffffffff9186d2c0 x11/a1 ffff8f80000a6890 x12/a2 0000000000100000 x13/a3 ffffffff81fdacba x14/a4 ffff8f800a189000 x15/a5 0000000000100000 x16/a6 0000000000000003 x17/a7 fffffffff1f1f1f1 x18/s2 0000000200000020 x19/s3 ffffffff81fdacc4 x20/s4 0000000000000000 x21/s5 0000000000000000 x22/s6 0000000000000000 x23/s7 ffffffff892253f8 x24/s8 ffff8f80000a6be0 x25/s9 1ffff1f000014d0c x26/s10 0000000000000018 x27/s11 ffff8f80000a6bb0 x28/t3 ffffffff81fec9b6 x29/t4 ffffffff8817ce78 x30/t5 fffffffef111fc39 x31/t6 ffffffff9167b1f7 fcsr 0000000000000000 f0/ft0 0000000000000000 f1/ft1 0000000000000000 f2/ft2 0000000000000000 f3/ft3 0000000000000000 f4/ft4 0000000000000000 f5/ft5 0000000000000000 f6/ft6 0000000000000000 f7/ft7 0000000000000000 f8/fs0 0000000000000000 f9/fs1 0000000000000000 f10/fa0 0000000000000000 f11/fa1 0000000000000000 f12/fa2 0000000000000000 f13/fa3 0000000000000000 f14/fa4 0000000000000000 f15/fa5 0000000000000000 f16/fa6 0000000000000000 f17/fa7 0000000000000000 f18/fs2 0000000000000000 f19/fs3 0000000000000000 f20/fs4 0000000000000000 f21/fs5 0000000000000000 f22/fs6 0000000000000000 f23/fs7 0000000000000000 f24/fs8 0000000000000000 f25/fs9 0000000000000000 f26/fs10 0000000000000000 f27/fs11 0000000000000000 f28/ft8 0000000000000000 f29/ft9 0000000000000000 f30/ft10 0000000000000000 f31/ft11 0000000000000000 info registers vcpu 1 CPU#1 V = 0 pc ffffffff8052d7fa mhartid 0000000000000001 mstatus 0000000a000000a0 hstatus 0000000200000000 vsstatus 0000000a00000000 mip 0000000000000000 mie 000000000000022a mideleg 0000000000001666 hideleg 0000000000000000 medeleg 0000000000f4b509 hedeleg 0000000000000000 mtvec 00000000800004f8 stvec ffffffff8654bd48 vstvec 0000000000000000 mepc ffffffff86548c72 sepc ffffffff86520ca8 vsepc 0000000000000000 mcause 8000000000000003 scause 8000000000000005 vscause 0000000000000000 mtval 0000000000000000 stval 0000000000000000 htval 0000000000000000 mtval2 0000000000000000 mscratch 0000000080047000 sscratch 0000000000000000 satp 902300000009fd2c x0/zero 0000000000000000 x1/ra ffffffff8052d7fa x2/sp ffff8f800be46260 x3/gp ffffffff8a4a7c60 x4/tp ffffaf801be2b580 x5/t0 ffffaf8037db1380 x6/t1 ffffffff8007bc8e x7/t2 ffffffff9187f628 x8/s0 ffff8f800be46360 x9/s1 0000000000000000 x10/a0 0000000000000007 x11/a1 ffffffff8654bd48 x12/a2 0000000000000001 x13/a3 ffffffff8007bdb2 x14/a4 ffff8f80049ba000 x15/a5 ffffaf801be2c580 x16/a6 0000000000000003 x17/a7 0000000041b58ab3 x18/s2 ffff8f800be46470 x19/s3 ffffaf801be2b580 x20/s4 ffff8f800be462e0 x21/s5 0000000000000002 x22/s6 ffffffff80070562 x23/s7 ffff8f800be463a0 x24/s8 ffffffff86547c94 x25/s9 1ffff1f0017c8c50 x26/s10 ffff8f800be46470 x27/s11 ffff8f800be46480 x28/t3 ffffffff8809bec8 x29/t4 fffffffef1140c30 x30/t5 fffffffef1140c31 x31/t6 0000000000000002 fcsr 0000000000000000 f0/ft0 0000000000000000 f1/ft1 0000000000000000 f2/ft2 0000000000000000 f3/ft3 0000000000000000 f4/ft4 0000000000000000 f5/ft5 0000000000000000 f6/ft6 0000000000000000 f7/ft7 0000000000000000 f8/fs0 0000000000000000 f9/fs1 0000000000000000 f10/fa0 0000000000000000 f11/fa1 0000000000000000 f12/fa2 0000000000000000 f13/fa3 0000000000000000 f14/fa4 0000000000000000 f15/fa5 0000000000000000 f16/fa6 0000000000000000 f17/fa7 0000000000000000 f18/fs2 0000000000000000 f19/fs3 0000000000000000 f20/fs4 0000000000000000 f21/fs5 0000000000000000 f22/fs6 0000000000000000 f23/fs7 0000000000000000 f24/fs8 0000000000000000 f25/fs9 0000000000000000 f26/fs10 0000000000000000 f27/fs11 0000000000000000 f28/ft8 0000000000000000 f29/ft9 0000000000000000 f30/ft10 0000000000000000 f31/ft11 0000000000000000