last executing test programs: 14.594974515s ago: executing program 2 (id=1455): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4040000) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_MSG_GETSETELEM(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)={0x14, 0xd, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0xfffe}}, 0x14}, 0x1, 0x0, 0x0, 0x4044840}, 0x8000) r3 = socket$inet(0xa, 0x801, 0x84) listen(r3, 0x8) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r4, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newsa={0x13c, 0x10, 0x7, 0x0, 0x0, {{@in6=@mcast2, @in=@rand_addr=0x64010100, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x2, 0x0, 0xee00}, {@in6=@empty, 0x0, 0x2b}, @in6=@private0, {0x0, 0x0, 0x6, 0x0, 0x200000000, 0x0, 0x0, 0xfffffffffffffffc}, {0x0, 0x200000, 0x7}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x40, 0x70}, [@algo_aead={0x4c, 0x12, {{'morus1280-sse2\x00'}, 0x0, 0xa0}}]}, 0x13c}}, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)={0x80, 0x0, 0x2, 0x401, 0x0, 0x0, {0xa, 0x0, 0x7}, [@CTA_EXPECT_MASK={0x30, 0x3, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x2a}}, {0x14, 0x4, @loopback}}}]}, @CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x3e}}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @multicast2}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x20008004}, 0x4) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) write$binfmt_script(r4, &(0x7f0000000200), 0xfffffd9d) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00003, 0x8) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) madvise(&(0x7f00009c0000/0x1000)=nil, 0x1000, 0xc) 12.413359749s ago: executing program 2 (id=1459): r0 = socket$inet6_udp(0xa, 0x2, 0x0) mmap(&(0x7f00005b7000/0x1000)=nil, 0x1000, 0x2000009, 0x1010, r0, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22, 0x8000, @private0={0xfc, 0x0, '\x00', 0x1}, 0x9}, 0x1c) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, 0x0, 0x1d2) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, 0x0, 0x40) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r3 = socket$can_j1939(0x1d, 0x2, 0x7) setsockopt(r3, 0x6b, 0xffff, 0x0, 0x0) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mkdirat(0xffffffffffffff9c, 0x0, 0x1) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) r4 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) write$sysctl(r4, &(0x7f0000000580)='1\x00', 0x2) write$sysctl(r4, &(0x7f00000000c0)='2\x00', 0x2) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xcc}}, 0x0) 11.182930575s ago: executing program 1 (id=1460): syz_open_dev$loop(&(0x7f0000000100), 0xf01c, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc_mnt\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc_mnt/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000003c0)={{{@in=@empty, @in6=@private1}}, {{@in6=@local}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xffffffffffffffdf) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x40, &(0x7f0000000240)={0x3, 0x0, 0x7, 0x7d, 0x10000, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x8, 0x0, 0xf, 0x80000006, 0xb06c}, 0x0, 0x0) write(r0, &(0x7f0000000200)='nfsd 127.0.0.1 99999999', 0x17) r3 = openat$nci(0xffffffffffffff9c, &(0x7f00000008c0), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r3, 0x0, &(0x7f00000000c0)=0x0) sendmsg$nl_xfrm(r0, &(0x7f00000007c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000780)={&(0x7f0000000900)=ANY=[], 0x270}, 0x1, 0x0, 0x0, 0x2000c110}, 0xa45fed0062aa2040) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_DEV_UP(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000", @ANYRES16, @ANYBLOB="0100230100003402000002000000080001", @ANYRES32=r4], 0x1c}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, 0x0) 10.955875045s ago: executing program 2 (id=1462): syz_usb_connect(0x6, 0x371, &(0x7f0000001980)=ANY=[], 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) setrlimit(0x8, &(0x7f0000000100)={0x7ff, 0x401}) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) mkdir(&(0x7f0000000540)='./sys\x00', 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x48885) getpid() socket$netlink(0x10, 0x3, 0x12) mkdirat(0xffffffffffffffff, &(0x7f0000000400)='./sys/bus/pci/rescan\x00', 0x1f7) r1 = syz_open_dev$usbfs(0x0, 0x80, 0x113201) read$usbfs(r1, &(0x7f0000000600)=""/234, 0xea) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r2, &(0x7f00000000c0)='1\x00', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)="3100d90daaa91f198d99db922334963f621e49a6ca0b870113948d1bd6e243e5da22cf2ba7bca0e3865eaa6666cca12e329a784c6e63a08e7d57f2e2a6fa1f85d8a30f16645140e37208d917f43c0e86486bb3e9fd67f758c7f029fcbacd68c67fd996ba190681103b5cb8dbd189543ac4d64867e39469625a900852b3220d4788d9f52245fb79fec8cffbcf9a5d9764a4d5c3af2d283279ca35f820d073a1f7a0e134b89c8a9433c78e6698004ab5f3584de90135190d323bf6d75843821518979868ae7c7734c0", 0xc8) 9.678600951s ago: executing program 3 (id=1464): r0 = syz_open_dev$media(0x0, 0x6, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={0x0, 0x4000, 0x800, 0xc5, 0x2}, 0x1c) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./security\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./security\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./security/ima/policy\x00', 0x1, 0x0) write(r1, &(0x7f0000000100)='measure', 0x7) close(r1) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x10002, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x8010) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x80102, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = eventfd2(0xe5c, 0x80000) r5 = eventfd(0x0) dup3(r4, r5, 0x0) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000140)={r5, 0x6, 0x2, r4}) 7.718937644s ago: executing program 0 (id=1465): r0 = socket$nl_route(0x10, 0x3, 0x0) open_by_handle_at(r0, &(0x7f0000000000)=@orangefs_parent={0x28, 0x2, {{"66aea8f615f44155093443da4feb05a7", 0xaf8f}, {"9999373d99425dd09b0f4db922a68910", 0x4}}}, 0x202000) openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/devices.allow\x00', 0x2, 0x48) socket(0x11, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$kvm(0xffffffffffffff9c, &(0x7f0000001300), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) connect$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty, 0xa, 0x4}, 0x20) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) openat$nvme_fabrics(0xffffff9c, &(0x7f0000000000), 0x80081, 0x0) socket$inet6(0xa, 0x1, 0x0) close(0x4) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="66b80e010f00d0b0060f21a20f01c40f009b2700000066b80c008ee00f3235008000000f30b80e0000000f23d80f21f835800000a00f23f8c9b9490300000f60b932c00a00b9730200000f32328fe858b660002fb90d090000b800680000ba000000000f30", 0x65}], 0x1, 0x0, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)) ioctl$KVM_RUN(r3, 0xae80, 0x0) 7.368552473s ago: executing program 1 (id=1466): r0 = socket$nl_route(0x10, 0x3, 0x0) open_by_handle_at(r0, &(0x7f0000000000)=@orangefs_parent={0x28, 0x2, {{"66aea8f615f44155093443da4feb05a7", 0xaf8f}, {"9999373d99425dd09b0f4db922a68910", 0x4}}}, 0x202000) openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/devices.allow\x00', 0x2, 0x48) socket(0x11, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$kvm(0xffffffffffffff9c, &(0x7f0000001300), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) connect$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty, 0xa, 0x4}, 0x20) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) openat$nvme_fabrics(0xffffff9c, &(0x7f0000000000), 0x80081, 0x0) socket$inet6(0xa, 0x1, 0x0) close(0x4) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="66b80e010f00d0b0060f21a20f01c40f009b2700000066b80c008ee00f3235008000000f30b80e0000000f23d80f21f835800000a00f23f8c9b9490300000f60b932c00a00b9730200000f32328fe858b660002fb90d090000b800680000ba000000000f30", 0x65}], 0x1, 0x0, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)) ioctl$KVM_RUN(r3, 0xae80, 0x0) 7.368151967s ago: executing program 3 (id=1467): r0 = socket$nl_route(0x10, 0x3, 0x0) open_by_handle_at(r0, &(0x7f0000000000)=@orangefs_parent={0x28, 0x2, {{"66aea8f615f44155093443da4feb05a7", 0xaf8f}, {"9999373d99425dd09b0f4db922a68910", 0x4}}}, 0x202000) openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/devices.allow\x00', 0x2, 0x48) socket(0x11, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) connect$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty, 0xa, 0x4}, 0x20) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000280)={'pimreg1\x00', &(0x7f0000000100)=@ethtool_rxfh_indir={0x39, 0x2, [0xd1, 0x8b]}}) openat$nvme_fabrics(0xffffff9c, &(0x7f0000000000), 0x80081, 0x0) socket$inet6(0xa, 0x1, 0x0) close(0x4) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="66b80e010f00d0b0060f21a20f01c40f009b2700000066b80c008ee00f3235008000000f30b80e0000000f23d80f21f835800000a00f23f8c9b9490300000f60b932c00a00b9730200000f32328fe858b660002fb90d090000b800680000ba000000000f30", 0x65}], 0x1, 0x0, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)) ioctl$KVM_RUN(r3, 0xae80, 0x0) 6.06205894s ago: executing program 0 (id=1468): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[@ANYRES32, @ANYRESOCT=0x0, @ANYRESOCT=0x0], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') init_module(&(0x7f0000000d40)=ANY=[], 0xa99, &(0x7f0000001800)='GPL\x00') r3 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r3, &(0x7f0000000d00)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, 0xfffffffc}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000400)="b8", 0x1}], 0x1, 0x0, 0x0, 0xff000000}}, {{&(0x7f0000000080)={0xa, 0x4e20, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}, 0x45af}, 0x1c, &(0x7f0000000580)=[{&(0x7f0000000340)="01", 0x1}], 0x1b6}}], 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)='debugfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) open_tree(0xffffffffffffff9c, &(0x7f0000003040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0x81100) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/bus/input/handlers\x00', 0x0, 0x0) syz_clone3(&(0x7f0000000080)={0x2a694b000, &(0x7f0000000040), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, {r4}}, 0x58) 5.957877149s ago: executing program 1 (id=1469): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000005ec0), 0xffffffffffffffff) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000005f00)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r2, &(0x7f0000006000)={0x0, 0x0, &(0x7f0000005fc0)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002dbd0600ffdbdb252100000008000300", @ANYRES32=r5], 0x44}}, 0x0) sendmsg$NL80211_CMD_SET_MCAST_RATE(r0, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x68, r1, 0x200, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x1, 0x34}}}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x5a}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x168}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x37}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0xa}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0xf0}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x3c}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x1e0}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x168}]}, 0x68}, 0x1, 0x0, 0x0, 0x24000800}, 0x11) r6 = syz_usb_connect(0x5, 0x58, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x8e, 0x3a, 0xc6, 0x20, 0x694, 0x1, 0x7813, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x46, 0x2, 0xe, 0x6, 0x10, 0x3, "", [{{0x9, 0x4, 0x39, 0xd8, 0x1, 0x1a, 0xda, 0xa8, 0x8, [], [{{0x9, 0x5, 0x8, 0x10, 0x20, 0x7, 0x9, 0x80}}]}}, {{0x9, 0x4, 0xe4, 0x5, 0x3, 0xb9, 0x56, 0xda, 0x2, [], [{{0x9, 0x5, 0x8, 0x0, 0x400, 0x1, 0x12, 0xfc}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x7, 0x3, 0x9a, [@generic={0x7, 0x5, "d15b89f26d"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x40, 0x7a, 0xa, 0x84}}]}}]}}]}}, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x67) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) mount$binderfs(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='max=']) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='devpts\x00', 0x0, &(0x7f0000000100)) syz_usb_control_io$hid(r6, &(0x7f0000000bc0)={0x14, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0003040000000403"], 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r6, &(0x7f00000011c0)={0x24, 0x0, &(0x7f0000001040)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r6, &(0x7f0000001600)={0x24, 0x0, &(0x7f0000001540)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x44a}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r6, 0x0, &(0x7f0000000500)={0x18, &(0x7f0000000300)=ANY=[@ANYBLOB='@\b\b'], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r6, 0x0, &(0x7f0000002280)={0x84, &(0x7f0000001e00)={0x20, 0xd, 0x4, "348b35e5"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) writev(r7, &(0x7f0000000540)=[{0x0}, {&(0x7f00000000c0)="2abcd13ec37d94689c9dc5cae099", 0xe}, {0x0, 0xe00}, {0x0}], 0x4) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, 0x15, 0x301, 0x0, 0x0, {0xb}}, 0x14}}, 0x0) 5.948481584s ago: executing program 2 (id=1470): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000005ec0), 0xffffffffffffffff) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000005f00)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r2, &(0x7f0000006000)={0x0, 0x0, &(0x7f0000005fc0)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002dbd0600ffdbdb252100000008000300", @ANYRES32=r5, @ANYBLOB="0600eb00000800000400ec000a00060008021100000100000600f70000ff00"], 0x44}}, 0x0) sendmsg$NL80211_CMD_SET_MCAST_RATE(r0, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x68, r1, 0x200, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x1, 0x34}}}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x5a}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x168}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x37}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0xa}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0xf0}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x3c}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x1e0}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x168}]}, 0x68}, 0x1, 0x0, 0x0, 0x24000800}, 0x11) r6 = syz_usb_connect(0x5, 0x58, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x8e, 0x3a, 0xc6, 0x20, 0x694, 0x1, 0x7813, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x46, 0x2, 0xe, 0x6, 0x10, 0x3, "", [{{0x9, 0x4, 0x39, 0xd8, 0x1, 0x1a, 0xda, 0xa8, 0x8, [], [{{0x9, 0x5, 0x8, 0x10, 0x20, 0x7, 0x9, 0x80}}]}}, {{0x9, 0x4, 0xe4, 0x5, 0x3, 0xb9, 0x56, 0xda, 0x2, [], [{{0x9, 0x5, 0x8, 0x0, 0x400, 0x1, 0x12, 0xfc}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x7, 0x3, 0x9a, [@generic={0x7, 0x5, "d15b89f26d"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x40, 0x7a, 0xa, 0x84}}]}}]}}]}}, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x67) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) mount$binderfs(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='max=']) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='devpts\x00', 0x0, &(0x7f0000000100)) syz_usb_control_io$hid(r6, &(0x7f0000000bc0)={0x14, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0003040000000403"], 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r6, &(0x7f00000011c0)={0x24, 0x0, &(0x7f0000001040)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r6, &(0x7f0000001600)={0x24, 0x0, &(0x7f0000001540)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x44a}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r6, 0x0, &(0x7f0000000500)={0x18, &(0x7f0000000300)=ANY=[@ANYBLOB='@\b\b'], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r6, 0x0, &(0x7f0000002280)={0x84, &(0x7f0000001e00)={0x20, 0xd, 0x4, "348b35e5"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) writev(r7, &(0x7f0000000540)=[{0x0}, {&(0x7f00000000c0)="2abcd13ec37d94689c9dc5cae099", 0xe}, {0x0, 0xe00}, {0x0}], 0x4) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, 0x15, 0x301, 0x0, 0x0, {0xb}}, 0x14}}, 0x0) 5.808600749s ago: executing program 3 (id=1471): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) openat$hpet(0xffffffffffffff9c, &(0x7f0000000440), 0x101180, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000840), 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet6_tcp(0xa, 0x1, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe, 0x0, 0x0, 0x10}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000040)={0x0, 0x10c1, 0x10, 0xfffffffd, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x8842, 0x3, 0x92, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc81d, 0x20, 0x1, 0x80003ab}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93e8, 0x2000, 0x4003bfff, 0x1c}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x723642762b6db36e, 0x1, 0x100026d}}], 0x1, 0x0, 0x0) 4.820283537s ago: executing program 0 (id=1472): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000005ec0), 0xffffffffffffffff) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000005f00)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r2, &(0x7f0000006000)={0x0, 0x0, &(0x7f0000005fc0)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002dbd0600ffdbdb252100000008000300", @ANYRES32=r5, @ANYBLOB="0600eb00000800000400ec000a00060008021100000100000600f70000ff00000800"], 0x44}}, 0x0) sendmsg$NL80211_CMD_SET_MCAST_RATE(r0, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x68, r1, 0x200, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x1, 0x34}}}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x5a}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x168}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x37}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0xa}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0xf0}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x3c}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x1e0}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x168}]}, 0x68}, 0x1, 0x0, 0x0, 0x24000800}, 0x11) r6 = syz_usb_connect(0x5, 0x58, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x8e, 0x3a, 0xc6, 0x20, 0x694, 0x1, 0x7813, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x46, 0x2, 0xe, 0x6, 0x10, 0x3, "", [{{0x9, 0x4, 0x39, 0xd8, 0x1, 0x1a, 0xda, 0xa8, 0x8, [], [{{0x9, 0x5, 0x8, 0x10, 0x20, 0x7, 0x9, 0x80}}]}}, {{0x9, 0x4, 0xe4, 0x5, 0x3, 0xb9, 0x56, 0xda, 0x2, [], [{{0x9, 0x5, 0x8, 0x0, 0x400, 0x1, 0x12, 0xfc}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x7, 0x3, 0x9a, [@generic={0x7, 0x5, "d15b89f26d"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x40, 0x7a, 0xa, 0x84}}]}}]}}]}}, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x67) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) mount$binderfs(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='max=']) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='devpts\x00', 0x0, &(0x7f0000000100)) syz_usb_control_io$hid(r6, &(0x7f0000000bc0)={0x14, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0003040000000403"], 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r6, &(0x7f00000011c0)={0x24, 0x0, &(0x7f0000001040)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r6, &(0x7f0000001600)={0x24, 0x0, &(0x7f0000001540)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x44a}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r6, 0x0, &(0x7f0000000500)={0x18, &(0x7f0000000300)=ANY=[@ANYBLOB='@\b\b'], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r6, 0x0, &(0x7f0000002280)={0x84, &(0x7f0000001e00)={0x20, 0xd, 0x4, "348b35e5"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) writev(r7, &(0x7f0000000540)=[{0x0}, {&(0x7f00000000c0)="2abcd13ec37d94689c9dc5cae099", 0xe}, {0x0, 0xe00}, {0x0}], 0x4) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, 0x15, 0x301, 0x0, 0x0, {0xb}}, 0x14}}, 0x0) 3.888924912s ago: executing program 3 (id=1473): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, 0x0) chdir(&(0x7f0000000100)='./bus\x00') open(&(0x7f0000000780)='./bus\x00', 0x14507e, 0x0) munmap(&(0x7f0000001000/0x2000)=nil, 0x2000) r0 = socket$inet_sctp(0x2, 0x1, 0x84) pipe2(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r3, 0x0, r2, 0x0, 0x1, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_RINGS_GET(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000440)={0x2c, r5, 0x309, 0x70bd29, 0x25dfdbfb, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x800}, 0x8000) fcntl$setpipe(r2, 0x408, 0x7) close_range(r0, 0xffffffffffffffff, 0x0) r6 = shmget$private(0x0, 0x2000, 0x88, &(0x7f0000001000/0x2000)=nil) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) bind$pptp(r1, &(0x7f00000002c0)={0x18, 0x2, {0x2, @broadcast}}, 0x1e) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010029bd7000fddbdf250200000008000300", @ANYRES32=r8, @ANYBLOB="0c0099004100000023000000080026006c090000080027000309"], 0x40}}, 0x10) shmat(r6, &(0x7f0000001000/0x3000)=nil, 0x9000) shmctl$IPC_INFO(r6, 0x3, &(0x7f0000000200)=""/188) msync(&(0x7f0000000000/0x9000)=nil, 0x9000, 0x2) openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/cgroup.procs\x00', 0x20280, 0xa) 3.445974623s ago: executing program 3 (id=1474): socket$kcm(0x2b, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x8, 0x8ab5, 0x10001, 0x20000000, 0x100, 0x4, 0x63dd1ea1, 0x1}, 0x0, 0x0, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000e306000000000000000000000085000000200000009500000000000000"], &(0x7f0000000600)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000100)={0x3ff8, 0x0, 0x0, 0x4}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_buf(r0, 0x6, 0xd, 0x0, 0x0) getsockopt$inet6_mptcp_buf(r0, 0x11c, 0x2, &(0x7f0000000100)=""/222, &(0x7f0000000000)=0x3ff8) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) r1 = syz_open_dev$evdev(&(0x7f0000000040), 0x20000000000, 0x840) syz_usb_disconnect(r1) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000740)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300042e010203010902120001000000"], 0x0) ioctl$EVIOCRMFF(r1, 0x550c, 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, &(0x7f0000000800)='rp_size=0\x00') ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vlan0\x00', 0x0}) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=@newqdisc={0x90, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x60, 0x2, {{0x1, [], 0x0, [0x1, 0x5, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}, [@TCA_MQPRIO_SHAPER={0x6}]}}}]}, 0x90}}, 0x20000000) r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff) r6 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev/mtdblock0\x00', 0x8800, 0x0) sendfile(r5, r6, 0x0, 0x10000) 2.51656397s ago: executing program 1 (id=1475): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r0, 0x0, 0x0) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xc, 0x100008f}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000003c0)=@deltclass={0x44, 0x29, 0x10, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xf, 0x6}, {0x1, 0x4}, {0xc, 0xa}}, [@TCA_RATE={0x6, 0x5, {0xe, 0x8}}, @TCA_RATE={0x6, 0x5, {0xff, 0x2}}, @TCA_RATE={0x6, 0x5, {0xff}}, @tclass_kind_options=@c_mq={0x7}]}, 0x44}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) syz_open_dev$video(&(0x7f0000000280), 0x101, 0xab02) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r2, 0x400452c8, &(0x7f0000000100)) openat$fuse(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$FS_IOC_GETFSLABEL(r2, 0x800452d3, &(0x7f0000000100)) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='quota,grpquota_block_hardlimit=3']) chdir(&(0x7f0000000100)='./file0\x00') r3 = creat(&(0x7f0000000100)='./file0\x00', 0x59) quotactl_fd$Q_GETNEXTQUOTA(r3, 0xffffffff80000901, 0x0, &(0x7f0000000500)) 2.102459327s ago: executing program 2 (id=1476): r0 = socket(0x40000000015, 0x5, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000000)=0x1, 0x4) bind$inet(r0, &(0x7f00008a5ff0)={0x2, 0x0, @loopback}, 0x10) recvmmsg(r0, &(0x7f0000002680)=[{{0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x40}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001e40)=""/162, 0xa2}, 0x4}], 0x2, 0x60010000, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) sendto$inet6(r0, &(0x7f0000000540), 0x0, 0x40, 0x0, 0x0) ioctl$KVM_IRQ_LINE(r2, 0x4008ae61, &(0x7f0000000100)={0xe, 0x1}) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x5, 0x7, 0x4, 0x81, 0x5, 0xf9, 0x40, 0x42, 0x8, 0x0, 0xc, 0x0, 0xfb, 0x4, 0xfc, 0x2}}) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2, 0x0, @loopback}, 0x10) mount(&(0x7f0000000000)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000240)='./cgroup\x00', 0x0, 0x2200010, &(0x7f00000000c0)='discard') mmap$IORING_OFF_SQ_RING(0x0, 0x7f, 0x4, 0x10, 0xffffffffffffffff, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/rescan\x00', 0x1, 0x0) write(r3, &(0x7f0000000300)='1', 0x1) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000580)={{{@in=@empty, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000540)=0xe4) ioctl$KVM_SET_PIT2(r2, 0x4070aea0, &(0x7f00000004c0)={[{0xbf98, 0x3, 0x64, 0x0, 0x2, 0x80, 0x5b, 0x1, 0x8, 0x8, 0x7, 0x5, 0x4}, {0x4d84, 0x1, 0x6, 0x4, 0x8, 0xa, 0xe, 0x3, 0x8, 0x2, 0x68, 0xb, 0x613}, {0x7, 0x7, 0x8, 0x5, 0x7, 0x9, 0x3, 0xd8, 0x4, 0x2a, 0xe, 0x6, 0x800}], 0x81}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000002c0)={0x0, 0x0, 0x0}, &(0x7f0000000300)=0xc) lchown(&(0x7f0000000080)='./cgroup/file0\x00', r4, r5) r6 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x2f) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000140)={0x10000, 0x2, 0x2, 0x2000, &(0x7f0000ffc000/0x2000)=nil}) socket$nl_generic(0x10, 0x3, 0x10) 1.56585513s ago: executing program 0 (id=1477): r0 = socket(0x40000000015, 0x5, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000000)=0x1, 0x4) bind$inet(r0, &(0x7f00008a5ff0)={0x2, 0x0, @loopback}, 0x10) recvmmsg(r0, &(0x7f0000002680)=[{{0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x40}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001e40)=""/162, 0xa2}, 0x4}], 0x2, 0x60010000, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) sendto$inet6(r0, &(0x7f0000000540), 0x0, 0x40, 0x0, 0x0) ioctl$KVM_IRQ_LINE(r2, 0x4008ae61, &(0x7f0000000100)={0xe, 0x1}) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x5, 0x7, 0x4, 0x81, 0x5, 0xf9, 0x40, 0x42, 0x8, 0x0, 0xc, 0x0, 0xfb, 0x4, 0xfc, 0x2}}) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2, 0x0, @loopback}, 0x10) mount(&(0x7f0000000000)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000240)='./cgroup\x00', &(0x7f0000000040)='jfs\x00', 0x2200010, &(0x7f00000000c0)='discard') mmap$IORING_OFF_SQ_RING(0x0, 0x7f, 0x4, 0x10, 0xffffffffffffffff, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/rescan\x00', 0x1, 0x0) write(r3, 0x0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000580)={{{@in=@empty, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000540)=0xe4) ioctl$KVM_SET_PIT2(r2, 0x4070aea0, &(0x7f00000004c0)={[{0xbf98, 0x3, 0x64, 0x0, 0x2, 0x80, 0x5b, 0x1, 0x8, 0x8, 0x7, 0x5, 0x4}, {0x4d84, 0x1, 0x6, 0x4, 0x8, 0xa, 0xe, 0x3, 0x8, 0x2, 0x68, 0xb, 0x613}, {0x7, 0x7, 0x8, 0x5, 0x7, 0x9, 0x3, 0xd8, 0x4, 0x2a, 0xe, 0x6, 0x800}], 0x81}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000002c0)={0x0, 0x0, 0x0}, &(0x7f0000000300)=0xc) lchown(&(0x7f0000000080)='./cgroup/file0\x00', r4, r5) r6 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x2f) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000140)={0x10000, 0x2, 0x2, 0x2000, &(0x7f0000ffc000/0x2000)=nil}) socket$nl_generic(0x10, 0x3, 0x10) 1.305407479s ago: executing program 2 (id=1478): r0 = socket$nl_route(0x10, 0x3, 0x0) open_by_handle_at(r0, &(0x7f0000000000)=@orangefs_parent={0x28, 0x2, {{"66aea8f615f44155093443da4feb05a7", 0xaf8f}, {"9999373d99425dd09b0f4db922a68910", 0x4}}}, 0x202000) openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/devices.allow\x00', 0x2, 0x48) socket(0x11, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$kvm(0xffffffffffffff9c, &(0x7f0000001300), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) connect$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty, 0xa, 0x4}, 0x20) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) openat$nvme_fabrics(0xffffff9c, &(0x7f0000000000), 0x80081, 0x0) socket$inet6(0xa, 0x1, 0x0) close(0x4) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="66b80e010f00d0b0060f21a20f01c40f009b2700000066b80c008ee00f3235008000000f30b80e0000000f23d80f21f835800000a00f23f8c9b9490300000f60b932c00a00b9730200000f32328fe858b660002fb90d090000b800680000ba000000000f30", 0x65}], 0x1, 0x0, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)) ioctl$KVM_RUN(r3, 0xae80, 0x0) 1.250111511s ago: executing program 1 (id=1479): r0 = socket$nl_route(0x10, 0x3, 0x0) open_by_handle_at(r0, &(0x7f0000000000)=@orangefs_parent={0x28, 0x2, {{"66aea8f615f44155093443da4feb05a7", 0xaf8f}, {"9999373d99425dd09b0f4db922a68910", 0x4}}}, 0x202000) openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/devices.allow\x00', 0x2, 0x48) socket(0x11, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) connect$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty, 0xa, 0x4}, 0x20) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000280)={'pimreg1\x00', &(0x7f0000000100)=@ethtool_rxfh_indir={0x39, 0x2, [0xd1, 0x8b]}}) openat$nvme_fabrics(0xffffff9c, &(0x7f0000000000), 0x80081, 0x0) socket$inet6(0xa, 0x1, 0x0) close(0x4) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="66b80e010f00d0b0060f21a20f01c40f009b2700000066b80c008ee00f3235008000000f30b80e0000000f23d80f21f835800000a00f23f8c9b9490300000f60b932c00a00b9730200000f32328fe858b660002fb90d090000b800680000ba000000000f30", 0x65}], 0x1, 0x0, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)) ioctl$KVM_RUN(r3, 0xae80, 0x0) 1.0000895s ago: executing program 0 (id=1480): r0 = openat$vmci(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x1, 0x9) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000200)={@cgroup=r2, 0x1f, 0x0, 0x50d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = add_key(&(0x7f0000000000)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffc) add_key(&(0x7f0000000dc0)='asymmetric\x00', 0x0, &(0x7f0000000840)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2072656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d767802319dc2879db7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479d01000000010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f05934470758f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56", 0x54e, r4) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, &(0x7f0000000080)={{@hyper, 0x2}, @any, 0x0, 0x0, 0x2, 0x6, 0x9a6, 0x10001, 0x8}) r5 = add_key$user(&(0x7f0000000400), 0x0, &(0x7f0000000480), 0x0, 0xffffffffffffffff) keyctl$dh_compute(0x17, &(0x7f0000000480)={r5}, &(0x7f0000000680)=""/195, 0xc3, &(0x7f0000000000)={&(0x7f00000004c0)={'hmac(sha1)\x00'}}) syz_ublk_setup_io_uring(0x1d, 0x0, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(0xffffffffffffffff, r6, r7, r8, &(0x7f0000000200)={0x2e, 0x6, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x17d}}}, &(0x7f0000000480)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000f00)={r3, 0xe0, &(0x7f0000000e00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000500), 0x0, 0xcc, &(0x7f0000000540)=[{}, {}], 0x10, 0x10, &(0x7f0000000580), &(0x7f0000000600), 0x8, 0xc2, 0x8, 0x0, 0x0}}, 0x10) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000f40)=ANY=[@ANYBLOB="1b000000000200"/18, @ANYRES32=r2, @ANYRES32, @ANYBLOB="0300000002000000000000000000"], 0x50) syz_open_dev$vim2m(0x0, 0xb, 0x2) syz_ublk_setup_queues(r11, r9, &(0x7f00000002c0)={0x0, 0xfb87, 0x800, 0x3, 0x32c}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xcf00, 0x200, 0x6, 0x15e, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x8, 0x1, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf90f, 0x1, 0x1, 0x121, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x1, 0x82, 0x387}}], 0x1, &(0x7f0000000340)={0x2e, 0x50, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0xd3, 0x0, 0x0}}, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000340)={{0x2, 0x3, 0xf3b, 0x2, 0x13fffffc}}) 765.306816ms ago: executing program 0 (id=1481): socket$kcm(0x29, 0x5, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000000c0)={0x0, &(0x7f0000000100)}) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x24000000) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[], 0x44}}, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000180)) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$MRT6_DEL_MIF(r1, 0x29, 0x43, 0x0, 0x0) r2 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2) setns(0xc9, 0x4000000) memfd_create(&(0x7f0000000080)=']^#\x00', 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f00000000c0)={0xb, 0x1, 0x4, 0x0, 0x7}) ioctl$vim2m_VIDIOC_STREAMOFF(r2, 0x40045612, &(0x7f0000000000)=0x1) r3 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) ppoll(&(0x7f0000000100)=[{r2, 0x1004}], 0x1, 0x0, 0x0, 0x0) ioctl$vim2m_VIDIOC_S_CTRL(r3, 0xc008561c, &(0x7f0000000040)={0xf0f046}) link(0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000280)={0x14, 0x0, 0x0, 0x0, 0x0}, 0x0) r4 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$HIDIOCSFLAG(r4, 0x4004480f, &(0x7f0000000140)=0x2) 98.868504ms ago: executing program 3 (id=1482): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/acm.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/acm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/acm.usb0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r0, &(0x7f0000000740)='dummy_udc.0', 0xb) mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000900)='./dev\x00', &(0x7f0000000940)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./dev/ttyGS0\x00', 0x2, 0x0) write(r1, &(0x7f0000000a00)='t', 0x1) close(r1) r2 = landlock_create_ruleset(&(0x7f0000000240)={0x1fff}, 0x18, 0x0) r3 = landlock_create_ruleset(&(0x7f0000000080)={0xf4da, 0x1, 0x3}, 0x18, 0x0) landlock_restrict_self(r3, 0x0) landlock_restrict_self(r2, 0x0) r4 = syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) inotify_add_watch(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0xc58) tkill(r4, 0x34) futex(&(0x7f0000000080), 0x5, 0x0, 0x0, &(0x7f0000000200), 0x14fffffd) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r5, &(0x7f0000002fc0)=[{{&(0x7f0000000100)={0xa, 0x4e20, 0x2, @empty, 0xfffffffe}, 0x1c, 0x0}}], 0x1, 0x20080058) writev(r5, &(0x7f0000000480)=[{&(0x7f0000000000)='d', 0x1}], 0x1) 0s ago: executing program 1 (id=1483): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0xe0042, 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r1, 0xfffffffc) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) gettid() mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r3 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r3, &(0x7f0000000200)={0xa, 0xf3, 0x14, @mcast1, 0x9}, 0x1c) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x41, &(0x7f0000000280)=0x655e, 0x4) r4 = dup2(r3, r3) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000001c0)={0x1, &(0x7f0000000140)=[{0x61, 0x7, 0x0, 0x8000}]}) recvmmsg(r4, &(0x7f00000020c0)=[{{0x0, 0x0, 0x0}, 0x3ff}], 0x1, 0x2000, 0x0) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/set_event\x00', 0x2, 0x0) write(r5, &(0x7f0000000300)='!:*', 0x3) pipe(&(0x7f0000000000)={0xffffffffffffffff}) readv(r6, &(0x7f0000000080)=[{&(0x7f0000000400)=""/124, 0x7c}], 0x1) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r7, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) socket$kcm(0x29, 0x2, 0x0) sendmsg$MPTCP_PM_CMD_DEL_ADDR(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c6bc135", @ANYRES16=r2, @ANYBLOB="070000000000000000000200000014000180060001000200000008000300ac1414aa"], 0x28}}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x22200, 0x0) kernel console output (not intermixed with test programs): [T11071] Node 1 DMA32: 497*4kB (ME) 1325*8kB (UME) 822*16kB (UME) 394*32kB (UME) 107*64kB (UME) 56*128kB (UME) 29*256kB (UME) 22*512kB (UM) 12*1024kB (M) 12*2048kB (UM) 0*4096kB = 107916kB [ 539.202655][T11071] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 539.202670][T11071] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 539.202685][T11071] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 539.202699][T11071] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 539.202715][T11071] 19542 total pagecache pages [ 539.202722][T11071] 885 pages in swap cache [ 539.202729][T11071] Free swap = 61072kB [ 539.202736][T11071] Total swap = 124996kB [ 539.202742][T11071] 524155 pages RAM [ 539.202748][T11071] 0 pages HighMem/MovableOnly [ 539.202754][T11071] 212121 pages reserved [ 539.202759][T11071] 0 pages cma reserved [ 539.429739][ T5866] usb usb38-port1: unable to enumerate USB device [ 541.121223][T11095] veth0: entered promiscuous mode [ 541.196621][ T43] audit: type=1326 audit(1789000979.804:1610): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11090 comm="syz.2.1215" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf708efec code=0x7ffc0000 [ 541.196664][ T43] audit: type=1326 audit(1789000979.804:1611): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11090 comm="syz.2.1215" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf708efec code=0x7ffc0000 [ 541.608349][ T3380] usb 6-1: new low-speed USB device number 35 using dummy_hcd [ 541.789047][ T3380] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 541.791274][ T3380] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 541.791297][ T3380] usb 6-1: config 0 has no interface number 0 [ 541.791327][ T3380] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 541.791348][ T3380] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 541.791378][ T3380] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 541.793610][ T3380] usb 6-1: config 0 descriptor?? [ 541.794248][T11098] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 541.841255][ T3380] iowarrior 6-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 541.942415][T11095] veth0: left promiscuous mode [ 542.017828][ T10] usb 7-1: new high-speed USB device number 47 using dummy_hcd [ 542.197870][ T10] usb 7-1: Using ep0 maxpacket: 32 [ 542.200249][ T10] usb 7-1: unable to get BOS descriptor or descriptor too short [ 542.200292][ T10] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 542.201277][ T10] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 542.201301][ T10] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 542.201319][ T10] usb 7-1: config 14 has no interface number 0 [ 542.201334][ T10] usb 7-1: config 14 has no interface number 1 [ 542.201383][ T10] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 542.201407][ T10] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 542.201430][ T10] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 542.201454][ T10] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 542.201478][ T10] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 542.201502][ T10] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 542.201526][ T10] usb 7-1: config 14 interface 57 has no altsetting 0 [ 542.201546][ T10] usb 7-1: config 14 interface 228 has no altsetting 0 [ 542.203648][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 542.203669][ T10] usb 7-1: Product: syz [ 542.203683][ T10] usb 7-1: Manufacturer: syz [ 542.203698][ T10] usb 7-1: SerialNumber: syz [ 542.936440][ T10] legousbtower 7-1:14.57: interrupt endpoints not found [ 543.361804][ T10] legousbtower 7-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 543.363025][ T10] legousbtower 7-1:14.228: LEGO USB Tower #-159 now attached to major 180 minor 1 [ 543.915777][ T43] audit: type=1326 audit(1789000982.534:1612): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11111 comm="syz.3.1220" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 543.920297][ T43] audit: type=1326 audit(1789000982.544:1613): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11111 comm="syz.3.1220" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 543.920442][ T43] audit: type=1326 audit(1789000982.544:1614): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11111 comm="syz.3.1220" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 543.920609][ T43] audit: type=1326 audit(1789000982.544:1615): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11111 comm="syz.3.1220" exe="/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 543.920975][ T43] audit: type=1326 audit(1789000982.544:1616): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11111 comm="syz.3.1220" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 543.921249][ T43] audit: type=1326 audit(1789000982.544:1617): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11111 comm="syz.3.1220" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 544.155080][T11115] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1221'. [ 544.411106][ T7184] usb 6-1: USB disconnect, device number 35 [ 544.459772][ T5866] usb 5-1: new full-speed USB device number 55 using dummy_hcd [ 544.529836][T11117] tipc: Enabled bearer , priority 6 [ 544.638607][ T5866] usb 5-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 544.639913][ T5866] usb 5-1: config 0 has an invalid interface number: 8 but max is 0 [ 544.639933][ T5866] usb 5-1: config 0 has no interface number 0 [ 544.639963][ T5866] usb 5-1: config 0 interface 8 altsetting 0 has an endpoint descriptor with address 0x9F, changing to 0x8F [ 544.639983][ T5866] usb 5-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid maxpacket 35380, setting to 64 [ 544.641599][ T5866] usb 5-1: New USB device strings: Mfr=0, Product=28, SerialNumber=3 [ 544.641619][ T5866] usb 5-1: Product: syz [ 544.641630][ T5866] usb 5-1: SerialNumber: syz [ 544.643918][ T5866] usb 5-1: config 0 descriptor?? [ 544.658238][T11115] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 544.661177][ T5866] cm109 5-1:0.8: invalid payload size 64, expected 4 [ 544.663984][ T5866] input: CM109 USB driver as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.8/input/input11 [ 545.086795][ T3380] usb 7-1: USB disconnect, device number 47 [ 545.092775][ T3380] legousbtower 7-1:14.228: LEGO USB Tower #-159 now disconnected [ 545.120038][ T7301] usb 5-1: USB disconnect, device number 55 [ 545.133186][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 545.133216][ C1] cm109 5-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 545.245988][ T7301] cm109 5-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 545.441783][T11128] netlink: 'syz.2.1224': attribute type 1 has an invalid length. [ 545.570335][T11124] JFS: discard option not supported on device [ 545.570533][T11124] Mount JFS Failure: -5 [ 545.570543][T11124] jfs_mount failed w/return code = -5 [ 545.574188][T11131] gretap1: entered promiscuous mode [ 545.701844][T11128] 8021q: adding VLAN 0 to HW filter on device bond3 [ 546.036114][T11129] 8021q: adding VLAN 0 to HW filter on device bond3 [ 546.036619][T11129] bond3: (slave gre1): The slave device specified does not support setting the MAC address [ 546.037221][T11129] bond3: (slave gre1): Error -95 calling set_mac_address [ 546.320747][T11139] netlink: 'syz.0.1227': attribute type 1 has an invalid length. [ 546.465185][ T7301] usb 8-1: new high-speed USB device number 45 using dummy_hcd [ 546.499609][T11125] bond0 (unregistering): Released all slaves [ 546.617823][ T7301] usb 8-1: Using ep0 maxpacket: 32 [ 546.620502][ T7301] usb 8-1: unable to get BOS descriptor or descriptor too short [ 546.620544][ T7301] usb 8-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 546.621986][ T7301] usb 8-1: config 14 has an invalid interface number: 57 but max is 1 [ 546.622009][ T7301] usb 8-1: config 14 has an invalid interface number: 228 but max is 1 [ 546.622024][ T7301] usb 8-1: config 14 has no interface number 0 [ 546.622037][ T7301] usb 8-1: config 14 has no interface number 1 [ 546.622081][ T7301] usb 8-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 546.622100][ T7301] usb 8-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 546.622120][ T7301] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 546.622140][ T7301] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 546.622161][ T7301] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 546.622180][ T7301] usb 8-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 546.622200][ T7301] usb 8-1: config 14 interface 57 has no altsetting 0 [ 546.622215][ T7301] usb 8-1: config 14 interface 228 has no altsetting 0 [ 546.624677][T11134] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 546.625997][ T7301] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 546.626018][ T7301] usb 8-1: Product: syz [ 546.626030][ T7301] usb 8-1: Manufacturer: syz [ 546.626041][ T7301] usb 8-1: SerialNumber: syz [ 546.644927][T11128] bond3 (unregistering): Released all slaves [ 547.054660][ T7301] legousbtower 8-1:14.57: interrupt endpoints not found [ 547.259322][T11147] JFS: discard option not supported on device [ 547.259542][T11147] Mount JFS Failure: -5 [ 547.259551][T11147] jfs_mount failed w/return code = -5 [ 547.465327][ T7301] legousbtower 8-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 547.470841][ T7301] legousbtower 8-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 547.497867][ T3380] usb 7-1: new high-speed USB device number 48 using dummy_hcd [ 547.601443][T11159] /dev/nullb0: Can't open blockdev [ 547.667836][ T3380] usb 7-1: Using ep0 maxpacket: 32 [ 547.728360][ T3380] usb 7-1: unable to get BOS descriptor or descriptor too short [ 547.728401][ T3380] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 547.730854][ T3380] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 547.730880][ T3380] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 547.730896][ T3380] usb 7-1: config 14 has no interface number 0 [ 547.730910][ T3380] usb 7-1: config 14 has no interface number 1 [ 547.730958][ T3380] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 547.730977][ T3380] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 547.730998][ T3380] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 547.731019][ T3380] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 547.731041][ T3380] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 547.731062][ T3380] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 547.731082][ T3380] usb 7-1: config 14 interface 57 has no altsetting 0 [ 547.731097][ T3380] usb 7-1: config 14 interface 228 has no altsetting 0 [ 547.736877][ T3380] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 547.736904][ T3380] usb 7-1: Product: syz [ 547.736917][ T3380] usb 7-1: Manufacturer: syz [ 547.736931][ T3380] usb 7-1: SerialNumber: syz [ 548.183633][T11168] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1232'. [ 548.238980][ T3380] legousbtower 7-1:14.57: interrupt endpoints not found [ 548.272148][ T7301] usb 8-1: USB disconnect, device number 45 [ 548.299931][ T7301] legousbtower 8-1:14.228: LEGO USB Tower #-160 now disconnected [ 548.689153][ T3380] legousbtower 7-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 548.690467][ T3380] legousbtower 7-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 549.509345][ T3380] usb 7-1: USB disconnect, device number 48 [ 549.515535][ T3380] legousbtower 7-1:14.228: LEGO USB Tower #-160 now disconnected [ 549.797427][T11177] JFS: discard option not supported on device [ 549.799425][T11176] 9pnet_virtio: no channels available for device 127.0.0.1 [ 549.820200][T11177] Mount JFS Failure: -5 [ 549.820216][T11177] jfs_mount failed w/return code = -5 [ 549.830900][T11176] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 550.350291][ T43] audit: type=1326 audit(1789000988.974:1618): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11180 comm="syz.0.1236" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 550.350541][ T43] audit: type=1326 audit(1789000988.974:1619): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11180 comm="syz.0.1236" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 550.351470][ T43] audit: type=1326 audit(1789000988.974:1620): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11180 comm="syz.0.1236" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 550.351772][ T43] audit: type=1326 audit(1789000988.974:1621): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11180 comm="syz.0.1236" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 550.352445][ T43] audit: type=1326 audit(1789000988.974:1622): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11180 comm="syz.0.1236" exe="/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf706efec code=0x7ffc0000 [ 550.353123][ T43] audit: type=1326 audit(1789000988.974:1623): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11180 comm="syz.0.1236" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 550.353612][ T43] audit: type=1326 audit(1789000988.974:1624): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11180 comm="syz.0.1236" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf706efec code=0x7ffc0000 [ 550.388948][T11185] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1235'. [ 550.390051][T11185] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1235'. [ 550.391135][T11185] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1235'. [ 550.391743][T11185] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1235'. [ 550.394384][T11185] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1235'. [ 550.394523][T11185] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1235'. [ 550.415056][T11186] netlink: 'syz.1.1238': attribute type 3 has an invalid length. [ 550.442990][T11186] FAULT_INJECTION: forcing a failure. [ 550.442990][T11186] name failslab, interval 1, probability 0, space 0, times 0 [ 550.443023][T11186] CPU: 3 UID: 0 PID: 11186 Comm: syz.1.1238 Tainted: G L syzkaller #0 PREEMPT(full) [ 550.443050][T11186] Tainted: [L]=SOFTLOCKUP [ 550.443058][T11186] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 550.443070][T11186] Call Trace: [ 550.443078][T11186] [ 550.443087][T11186] dump_stack_lvl+0x100/0x190 [ 550.443120][T11186] should_fail_ex.cold+0x5/0xa [ 550.443151][T11186] should_failslab+0xc2/0x120 [ 550.443180][T11186] __kmalloc_noprof+0xfc/0x840 [ 550.443205][T11186] ? kvm_io_bus_register_dev+0x1d2/0x710 [ 550.443235][T11186] kvm_io_bus_register_dev+0x1d2/0x710 [ 550.443265][T11186] kvm_pic_init+0x22f/0x380 [ 550.443298][T11186] kvm_arch_vm_ioctl+0xec4/0x18d0 [ 550.443318][T11186] ? is_bpf_text_address+0x94/0x1a0 [ 550.443354][T11186] ? __pfx_kvm_arch_vm_ioctl+0x10/0x10 [ 550.443387][T11186] ? __kernel_text_address+0xd/0x30 [ 550.443414][T11186] ? unwind_get_return_address+0x59/0xa0 [ 550.443445][T11186] ? __lock_acquire+0x5c0/0x1f40 [ 550.443480][T11186] ? tomoyo_check_open_permission+0x1a2/0x3c0 [ 550.443515][T11186] ? look_up_lock_class+0x55/0x120 [ 550.443547][T11186] ? register_lock_class+0x3f/0x7b0 [ 550.443576][T11186] ? find_held_lock+0x2b/0x80 [ 550.443597][T11186] ? ima_match_policy+0x8c4/0x23f0 [ 550.443635][T11186] ? __lock_acquire+0x5c0/0x1f40 [ 550.443682][T11186] ? __lock_acquire+0x5c0/0x1f40 [ 550.443717][T11186] ? __lock_acquire+0x5c0/0x1f40 [ 550.443749][T11186] ? lock_acquire+0x1d1/0x380 [ 550.443776][T11186] ? unwind_next_frame+0xbd/0x2090 [ 550.443805][T11186] ? lock_acquire+0x1d1/0x380 [ 550.443830][T11186] ? is_bpf_text_address+0x25/0x1a0 [ 550.443859][T11186] ? find_held_lock+0x2b/0x80 [ 550.443880][T11186] ? is_bpf_text_address+0x8a/0x1a0 [ 550.443908][T11186] ? is_bpf_text_address+0x8a/0x1a0 [ 550.443936][T11186] ? bpf_ksym_find+0x124/0x1c0 [ 550.443959][T11186] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 550.443987][T11186] ? is_bpf_text_address+0x94/0x1a0 [ 550.444016][T11186] ? kernel_text_address+0x8d/0x100 [ 550.444035][T11186] ? __pfx_widen_string+0x10/0x10 [ 550.444058][T11186] ? __kernel_text_address+0xd/0x30 [ 550.444084][T11186] ? unwind_get_return_address+0x59/0xa0 [ 550.444114][T11186] kvm_vm_ioctl+0x167d/0x42d0 [ 550.444139][T11186] ? tomoyo_path_number_perm+0x46d/0x580 [ 550.444174][T11186] ? stack_trace_save+0x8e/0xc0 [ 550.444200][T11186] ? __pfx_stack_trace_save+0x10/0x10 [ 550.444252][T11186] ? __pfx_kvm_vm_ioctl+0x10/0x10 [ 550.444269][T11186] ? __lock_acquire+0x5c0/0x1f40 [ 550.444298][T11186] ? tomoyo_path_number_perm+0x46d/0x580 [ 550.444333][T11186] ? kasan_save_stack+0x3f/0x50 [ 550.444357][T11186] ? kasan_save_stack+0x30/0x50 [ 550.444379][T11186] ? kasan_save_track+0x14/0x30 [ 550.444401][T11186] ? kasan_save_free_info+0x3b/0x70 [ 550.444458][T11186] ? __kasan_slab_free+0x5f/0x80 [ 550.444484][T11186] ? kfree+0x22b/0x6d0 [ 550.444514][T11186] ? tomoyo_path_number_perm+0x46d/0x580 [ 550.444544][T11186] ? security_file_ioctl_compat+0xd3/0x230 [ 550.444574][T11186] ? __ia32_compat_sys_ioctl+0xc2/0x360 [ 550.444608][T11186] ? __do_fast_syscall_32+0x13a/0x8b0 [ 550.444639][T11186] ? kvm_arch_vm_compat_ioctl+0x2d0/0x470 [ 550.444671][T11186] ? __pfx_kvm_arch_vm_compat_ioctl+0x10/0x10 [ 550.444759][T11186] ? kasan_quarantine_put+0x104/0x240 [ 550.444784][T11186] ? lockdep_hardirqs_on+0x7d/0x110 [ 550.444810][T11186] ? find_held_lock+0x2b/0x80 [ 550.444828][T11186] ? tomoyo_path_number_perm+0x28f/0x580 [ 550.444851][T11186] ? tomoyo_path_number_perm+0x28f/0x580 [ 550.444881][T11186] ? tomoyo_path_number_perm+0x188/0x580 [ 550.444913][T11186] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 550.444939][T11186] ? futex_wait+0x11e/0x370 [ 550.444966][T11186] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 550.444994][T11186] ? do_vfs_ioctl+0x226/0x13e0 [ 550.445023][T11186] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 550.445053][T11186] kvm_vm_compat_ioctl+0x2f7/0x3f0 [ 550.445071][T11186] ? __pfx_kvm_vm_compat_ioctl+0x10/0x10 [ 550.445088][T11186] ? __fget_files+0x34/0x3d0 [ 550.445110][T11186] ? find_held_lock+0x2b/0x80 [ 550.445128][T11186] ? __fget_files+0x215/0x3d0 [ 550.445147][T11186] ? hook_file_ioctl_common+0x140/0x440 [ 550.445180][T11186] ? __fget_files+0x21f/0x3d0 [ 550.445207][T11186] ? __pfx_kvm_vm_compat_ioctl+0x10/0x10 [ 550.445228][T11186] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 550.445263][T11186] __do_fast_syscall_32+0x13a/0x8b0 [ 550.445295][T11186] do_fast_syscall_32+0x32/0x70 [ 550.445328][T11186] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 550.445354][T11186] RIP: 0023:0xf703efec [ 550.445377][T11186] Code: Unable to access opcode bytes at 0xf703efc2. [ 550.445386][T11186] RSP: 002b:00000000f542d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 550.445407][T11186] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 000000000000ae60 [ 550.445419][T11186] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 550.445432][T11186] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 550.445445][T11186] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 550.445459][T11186] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 550.445489][T11186] [ 550.667925][ T3380] usb 8-1: new high-speed USB device number 46 using dummy_hcd [ 550.857294][ T3380] usb 8-1: Using ep0 maxpacket: 16 [ 550.860593][ T3380] usb 8-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 550.885733][ T3380] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 550.885770][ T3380] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 550.885793][ T3380] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 550.885813][ T3380] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 550.885829][ T3380] usb 8-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 550.887324][ T3380] usb 8-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 550.887346][ T3380] usb 8-1: Manufacturer: syz [ 550.889657][ T3380] usb 8-1: config 0 descriptor?? [ 551.258987][ T3380] rc_core: IR keymap rc-hauppauge not found [ 551.259039][ T3380] Registered IR keymap rc-empty [ 551.259146][ T3380] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 551.307153][ T3380] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 551.319066][ T3380] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/rc/rc0 [ 551.345582][ T3380] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/rc/rc0/input12 [ 551.458603][ T3380] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 551.491650][ T3380] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 551.526069][ T3380] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 551.541149][ T3380] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 551.579768][ T3380] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 551.588257][ T3380] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 551.618707][ T3380] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 551.637991][ T3380] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 551.658080][ T3380] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 551.685056][ T3380] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 551.703604][ T3380] mceusb 8-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 551.703628][ T3380] mceusb 8-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 551.988959][ T10] usb 8-1: USB disconnect, device number 46 [ 552.478289][ T3380] usb 5-1: new high-speed USB device number 56 using dummy_hcd [ 552.679367][ T3380] usb 5-1: Using ep0 maxpacket: 32 [ 552.682966][ T3380] usb 5-1: unable to get BOS descriptor or descriptor too short [ 552.683008][ T3380] usb 5-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 552.685119][ T3380] usb 5-1: config 14 has an invalid interface number: 57 but max is 1 [ 552.685141][ T3380] usb 5-1: config 14 has an invalid interface number: 228 but max is 1 [ 552.685156][ T3380] usb 5-1: config 14 has no interface number 0 [ 552.685168][ T3380] usb 5-1: config 14 has no interface number 1 [ 552.685212][ T3380] usb 5-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 552.685233][ T3380] usb 5-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 552.685254][ T3380] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 552.685274][ T3380] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 552.685306][ T3380] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 552.685324][ T3380] usb 5-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 552.685343][ T3380] usb 5-1: config 14 interface 57 has no altsetting 0 [ 552.685357][ T3380] usb 5-1: config 14 interface 228 has no altsetting 0 [ 552.687216][ T3380] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 552.687238][ T3380] usb 5-1: Product: syz [ 552.687250][ T3380] usb 5-1: Manufacturer: syz [ 552.687264][ T3380] usb 5-1: SerialNumber: syz [ 553.280217][ T3380] legousbtower 5-1:14.57: interrupt endpoints not found [ 553.688952][ T7184] usb 7-1: new high-speed USB device number 49 using dummy_hcd [ 553.735917][ T3380] legousbtower 5-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 553.755754][ T3380] legousbtower 5-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 553.852967][ T7184] usb 7-1: Using ep0 maxpacket: 32 [ 553.863992][ T7184] usb 7-1: unable to get BOS descriptor or descriptor too short [ 553.864036][ T7184] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 553.901518][ T7184] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 553.901545][ T7184] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 553.901562][ T7184] usb 7-1: config 14 has no interface number 0 [ 553.901576][ T7184] usb 7-1: config 14 has no interface number 1 [ 553.901623][ T7184] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 553.901643][ T7184] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 553.901663][ T7184] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 553.901685][ T7184] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 553.901706][ T7184] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 553.901728][ T7184] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 553.901750][ T7184] usb 7-1: config 14 interface 57 has no altsetting 0 [ 553.901766][ T7184] usb 7-1: config 14 interface 228 has no altsetting 0 [ 553.963063][ T7184] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 553.963085][ T7184] usb 7-1: Product: syz [ 553.963099][ T7184] usb 7-1: Manufacturer: syz [ 553.963111][ T7184] usb 7-1: SerialNumber: syz [ 554.397302][ T7184] legousbtower 7-1:14.57: interrupt endpoints not found [ 554.417903][T11231] JFS: discard option not supported on device [ 554.418137][T11231] Mount JFS Failure: -5 [ 554.418149][T11231] jfs_mount failed w/return code = -5 [ 554.566887][ T10] usb 5-1: USB disconnect, device number 56 [ 554.573649][ T10] legousbtower 5-1:14.228: LEGO USB Tower #-160 now disconnected [ 554.811480][ T7184] legousbtower 7-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 554.815729][ T7184] legousbtower 7-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 555.268974][ T7184] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 555.427903][ T7184] usb 6-1: Using ep0 maxpacket: 32 [ 555.439213][ T7184] usb 6-1: unable to get BOS descriptor or descriptor too short [ 555.439254][ T7184] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 555.440900][ T7184] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 555.440923][ T7184] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 555.440940][ T7184] usb 6-1: config 14 has no interface number 0 [ 555.440954][ T7184] usb 6-1: config 14 has no interface number 1 [ 555.441002][ T7184] usb 6-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 555.441022][ T7184] usb 6-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 555.441043][ T7184] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 555.441066][ T7184] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 555.441089][ T7184] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 555.441112][ T7184] usb 6-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 555.441135][ T7184] usb 6-1: config 14 interface 57 has no altsetting 0 [ 555.441150][ T7184] usb 6-1: config 14 interface 228 has no altsetting 0 [ 555.466254][ T7184] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 555.466280][ T7184] usb 6-1: Product: syz [ 555.466293][ T7184] usb 6-1: Manufacturer: syz [ 555.466305][ T7184] usb 6-1: SerialNumber: syz [ 555.618015][ T7301] usb 7-1: USB disconnect, device number 49 [ 555.625610][ T7301] legousbtower 7-1:14.228: LEGO USB Tower #-160 now disconnected [ 555.655786][ T43] audit: type=1326 audit(1789000994.284:1625): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11238 comm="syz.0.1249" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 555.656079][ T43] audit: type=1326 audit(1789000994.284:1626): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11238 comm="syz.0.1249" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 555.958466][ T7184] legousbtower 6-1:14.57: interrupt endpoints not found [ 556.344446][ T7184] legousbtower 6-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 556.346024][ T7184] legousbtower 6-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 556.595875][T11246] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 556.595900][T11246] overlayfs: failed to set xattr on upper [ 556.595907][T11246] overlayfs: ...falling back to redirect_dir=nofollow. [ 556.595915][T11246] overlayfs: ...falling back to metacopy=off. [ 556.595923][T11246] overlayfs: ...falling back to index=off. [ 556.595931][T11246] overlayfs: ...falling back to uuid=null. [ 557.100709][ T7301] usb 6-1: USB disconnect, device number 36 [ 557.107278][ T7301] legousbtower 6-1:14.228: LEGO USB Tower #-160 now disconnected [ 557.935722][T11265] jffs2: notice: (11265) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 559.039473][T11278] /dev/nullb0: Can't open blockdev [ 559.374201][ T7224] usb 7-1: new high-speed USB device number 50 using dummy_hcd [ 559.528220][ T7224] usb 7-1: Using ep0 maxpacket: 32 [ 559.531788][ T7224] usb 7-1: unable to get BOS descriptor or descriptor too short [ 559.531824][ T7224] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 559.608533][ T7224] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 559.608559][ T7224] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 559.608574][ T7224] usb 7-1: config 14 has no interface number 0 [ 559.608585][ T7224] usb 7-1: config 14 has no interface number 1 [ 559.608627][ T7224] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 559.608678][ T7224] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 559.608696][ T7224] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 559.608714][ T7224] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 559.608740][ T7224] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 559.608759][ T7224] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 559.608778][ T7224] usb 7-1: config 14 interface 57 has no altsetting 0 [ 559.608792][ T7224] usb 7-1: config 14 interface 228 has no altsetting 0 [ 559.610820][ T7224] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 559.610842][ T7224] usb 7-1: Product: syz [ 559.610853][ T7224] usb 7-1: Manufacturer: syz [ 559.610865][ T7224] usb 7-1: SerialNumber: syz [ 559.782828][T11279] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1255'. [ 559.838235][ T7184] usb 5-1: new high-speed USB device number 57 using dummy_hcd [ 559.993019][ T7184] usb 5-1: Using ep0 maxpacket: 32 [ 559.995190][ T7184] usb 5-1: unable to get BOS descriptor or descriptor too short [ 559.995229][ T7184] usb 5-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 559.996375][ T7184] usb 5-1: config 14 has an invalid interface number: 57 but max is 1 [ 559.996396][ T7184] usb 5-1: config 14 has an invalid interface number: 228 but max is 1 [ 559.996413][ T7184] usb 5-1: config 14 has no interface number 0 [ 559.996426][ T7184] usb 5-1: config 14 has no interface number 1 [ 559.996471][ T7184] usb 5-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 559.996495][ T7184] usb 5-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 559.996518][ T7184] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 559.996541][ T7184] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 559.996563][ T7184] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 559.996585][ T7184] usb 5-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 559.996608][ T7184] usb 5-1: config 14 interface 57 has no altsetting 0 [ 559.996623][ T7184] usb 5-1: config 14 interface 228 has no altsetting 0 [ 560.081144][ T7184] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 560.081167][ T7184] usb 5-1: Product: syz [ 560.081179][ T7184] usb 5-1: Manufacturer: syz [ 560.081194][ T7184] usb 5-1: SerialNumber: syz [ 560.175024][ T7224] legousbtower 7-1:14.57: interrupt endpoints not found [ 560.536714][ T7184] legousbtower 5-1:14.57: interrupt endpoints not found [ 560.638124][ T7224] legousbtower 7-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 560.639642][ T7224] legousbtower 7-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 560.968205][ T7184] legousbtower 5-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 560.969420][ T7184] legousbtower 5-1:14.228: LEGO USB Tower #-159 now attached to major 180 minor 1 [ 561.279953][T11291] JFS: discard option not supported on device [ 561.280142][T11291] Mount JFS Failure: -5 [ 561.280153][T11291] jfs_mount failed w/return code = -5 [ 561.371363][ T43] audit: type=1326 audit(1789000999.994:1627): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11288 comm="syz.1.1261" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 561.377154][ T43] audit: type=1326 audit(1789000999.994:1628): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11288 comm="syz.1.1261" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 561.378161][ T43] audit: type=1326 audit(1789001000.004:1629): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11288 comm="syz.1.1261" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 561.378207][ T43] audit: type=1326 audit(1789001000.004:1630): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11288 comm="syz.1.1261" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 561.378315][ T43] audit: type=1326 audit(1789001000.004:1631): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11288 comm="syz.1.1261" exe="/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf703efec code=0x7ffc0000 [ 561.378737][ T43] audit: type=1326 audit(1789001000.004:1632): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11288 comm="syz.1.1261" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 561.379011][ T43] audit: type=1326 audit(1789001000.004:1633): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11288 comm="syz.1.1261" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf703efec code=0x7ffc0000 [ 561.404893][ T7224] usb 7-1: USB disconnect, device number 50 [ 561.410683][ T7224] legousbtower 7-1:14.228: LEGO USB Tower #-160 now disconnected [ 562.119563][T11295] tipc: Enabling of bearer rejected, failed to enable media [ 562.550540][T11306] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1265'. [ 562.551862][T11306] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1265'. [ 562.552760][T11306] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1265'. [ 562.744412][ T10] usb 5-1: USB disconnect, device number 57 [ 562.847464][ T10] legousbtower 5-1:14.228: LEGO USB Tower #-159 now disconnected [ 566.064689][T11323] /dev/nullb0: Can't open blockdev [ 566.263932][T11325] JFS: discard option not supported on device [ 566.264131][T11325] Mount JFS Failure: -5 [ 566.264171][T11325] jfs_mount failed w/return code = -5 [ 566.614609][T11328] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1269'. [ 566.804218][T11313] bond1 (unregistering): Released all slaves [ 566.952153][ T7301] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 567.048816][T11335] JFS: discard option not supported on device [ 567.049032][T11335] Mount JFS Failure: -5 [ 567.049042][T11335] jfs_mount failed w/return code = -5 [ 567.129205][ T7301] usb 6-1: Using ep0 maxpacket: 32 [ 567.131271][ T7301] usb 6-1: unable to get BOS descriptor or descriptor too short [ 567.131312][ T7301] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 567.132192][ T7301] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 567.132209][ T7301] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 567.132222][ T7301] usb 6-1: config 14 has no interface number 0 [ 567.132232][ T7301] usb 6-1: config 14 has no interface number 1 [ 567.132270][ T7301] usb 6-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 567.132290][ T7301] usb 6-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 567.132307][ T7301] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 567.132330][ T7301] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 567.132352][ T7301] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 567.132371][ T7301] usb 6-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 567.132389][ T7301] usb 6-1: config 14 interface 57 has no altsetting 0 [ 567.132405][ T7301] usb 6-1: config 14 interface 228 has no altsetting 0 [ 567.134469][ T7301] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 567.134491][ T7301] usb 6-1: Product: syz [ 567.134506][ T7301] usb 6-1: Manufacturer: syz [ 567.134518][ T7301] usb 6-1: SerialNumber: syz [ 567.642382][ T7301] legousbtower 6-1:14.57: interrupt endpoints not found [ 567.798100][T11341] netlink: 'syz.2.1273': attribute type 10 has an invalid length. [ 567.801056][T11341] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 567.802769][T11341] netdevsim netdevsim2 netdevsim1: entered promiscuous mode [ 567.803237][T11341] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 568.059959][ T7301] legousbtower 6-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 568.061431][ T7301] legousbtower 6-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 568.217971][ T3380] usb 5-1: new high-speed USB device number 58 using dummy_hcd [ 568.377894][ T3380] usb 5-1: Using ep0 maxpacket: 16 [ 568.379745][ T3380] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 568.381701][ T3380] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 568.381743][ T3380] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 568.381764][ T3380] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 568.381780][ T3380] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 568.381796][ T3380] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 568.382933][ T3380] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 568.382954][ T3380] usb 5-1: Manufacturer: syz [ 568.413455][ T3380] usb 5-1: config 0 descriptor?? [ 568.959869][ T7184] usb 6-1: USB disconnect, device number 37 [ 568.988487][ T7184] legousbtower 6-1:14.228: LEGO USB Tower #-160 now disconnected [ 569.047906][ T3380] rc_core: IR keymap rc-hauppauge not found [ 569.047925][ T3380] Registered IR keymap rc-empty [ 569.048146][ T3380] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 569.078373][ T3380] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 569.099499][ T3380] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/rc/rc0 [ 569.101265][ T3380] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/rc/rc0/input13 [ 569.182401][ T3380] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 569.215176][ T3380] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 569.239943][ T3380] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 569.258851][ T3380] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 569.277928][ T3380] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 569.308024][ T3380] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 569.330472][ T3380] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 569.362303][ T3380] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 569.385373][ T3380] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 569.398223][ T3380] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 569.426300][ T3380] mceusb 5-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 569.426322][ T3380] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 569.933162][ T7301] usb 5-1: USB disconnect, device number 58 [ 570.140304][ T3380] usb 6-1: new high-speed USB device number 38 using dummy_hcd [ 570.288414][ T3380] usb 6-1: Using ep0 maxpacket: 32 [ 570.290883][ T3380] usb 6-1: unable to get BOS descriptor or descriptor too short [ 570.290925][ T3380] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 570.292064][ T3380] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 570.292088][ T3380] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 570.292106][ T3380] usb 6-1: config 14 has no interface number 0 [ 570.292119][ T3380] usb 6-1: config 14 has no interface number 1 [ 570.292166][ T3380] usb 6-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 570.292185][ T3380] usb 6-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 570.292205][ T3380] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 570.292225][ T3380] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 570.292246][ T3380] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 570.292267][ T3380] usb 6-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 570.292287][ T3380] usb 6-1: config 14 interface 57 has no altsetting 0 [ 570.292300][ T3380] usb 6-1: config 14 interface 228 has no altsetting 0 [ 570.294847][ T3380] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 570.294869][ T3380] usb 6-1: Product: syz [ 570.294881][ T3380] usb 6-1: Manufacturer: syz [ 570.294893][ T3380] usb 6-1: SerialNumber: syz [ 570.744993][ T3380] legousbtower 6-1:14.57: interrupt endpoints not found [ 571.189873][ T7301] usb 5-1: new high-speed USB device number 59 using dummy_hcd [ 571.279915][ T3380] legousbtower 6-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 571.419088][ T3380] legousbtower 6-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 571.494169][ T43] audit: type=1326 audit(1789001010.124:1634): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11367 comm="syz.2.1280" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf708efec code=0x7ffc0000 [ 571.528264][ T7301] usb 5-1: Using ep0 maxpacket: 32 [ 571.540628][ T43] audit: type=1326 audit(1789001010.124:1635): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11367 comm="syz.2.1280" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf708efec code=0x7ffc0000 [ 571.566187][ T7301] usb 5-1: unable to get BOS descriptor or descriptor too short [ 571.566227][ T7301] usb 5-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 571.582770][ T7301] usb 5-1: config 14 has an invalid interface number: 57 but max is 1 [ 571.582795][ T7301] usb 5-1: config 14 has an invalid interface number: 228 but max is 1 [ 571.582811][ T7301] usb 5-1: config 14 has no interface number 0 [ 571.582824][ T7301] usb 5-1: config 14 has no interface number 1 [ 571.582875][ T7301] usb 5-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 571.582895][ T7301] usb 5-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 571.582917][ T7301] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 571.582938][ T7301] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 571.582960][ T7301] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 571.582981][ T7301] usb 5-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 571.583003][ T7301] usb 5-1: config 14 interface 57 has no altsetting 0 [ 571.583017][ T7301] usb 5-1: config 14 interface 228 has no altsetting 0 [ 571.601718][ T7301] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 571.601936][ T7301] usb 5-1: Product: syz [ 571.601950][ T7301] usb 5-1: Manufacturer: syz [ 571.601961][ T7301] usb 5-1: SerialNumber: syz [ 571.717879][ T43] audit: type=1326 audit(1789001010.314:1636): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11371 comm="syz.3.1281" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 571.717940][ T43] audit: type=1326 audit(1789001010.314:1637): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11371 comm="syz.3.1281" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 571.717977][ T43] audit: type=1326 audit(1789001010.314:1638): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11371 comm="syz.3.1281" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 571.718013][ T43] audit: type=1326 audit(1789001010.314:1639): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11371 comm="syz.3.1281" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 571.718049][ T43] audit: type=1326 audit(1789001010.314:1640): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11371 comm="syz.3.1281" exe="/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 571.718086][ T43] audit: type=1326 audit(1789001010.314:1641): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11371 comm="syz.3.1281" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 571.718122][ T43] audit: type=1326 audit(1789001010.314:1642): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11371 comm="syz.3.1281" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 572.041863][ T7301] legousbtower 5-1:14.57: interrupt endpoints not found [ 572.047170][ T10] usb 6-1: USB disconnect, device number 38 [ 572.070880][ T10] legousbtower 6-1:14.228: LEGO USB Tower #-160 now disconnected [ 572.152991][ T43] audit: type=1326 audit(1789001010.764:1643): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11375 comm="syz.2.1282" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf708efec code=0x7ffc0000 [ 572.466314][ T7301] legousbtower 5-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 572.468210][ T7301] legousbtower 5-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 573.100349][T11388] msr: Write to unrecognized MSR 0x1a0 by syz.3.1284 (pid: 11388), tainting CPU_OUT_OF_SPEC. [ 573.100419][T11388] msr: See https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/about for details. [ 573.272396][ T2334] usb 5-1: USB disconnect, device number 59 [ 573.309339][ T2334] legousbtower 5-1:14.228: LEGO USB Tower #-160 now disconnected [ 574.526232][ T1438] ieee802154 phy0 wpan0: encryption failed: -22 [ 574.526351][ T1438] ieee802154 phy1 wpan1: encryption failed: -22 [ 576.462707][ T5765] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 576.464554][T11416] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 576.559150][T11417] JFS: discard option not supported on device [ 576.559366][T11417] Mount JFS Failure: -5 [ 576.559378][T11417] jfs_mount failed w/return code = -5 [ 576.630096][T11419] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1292'. [ 576.869073][ T7301] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 576.973802][T11422] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 576.983120][T11422] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 577.028115][ T7301] usb 5-1: Using ep0 maxpacket: 32 [ 577.030625][ T7301] usb 5-1: unable to get BOS descriptor or descriptor too short [ 577.030662][ T7301] usb 5-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 577.032841][ T7301] usb 5-1: config 14 has an invalid interface number: 57 but max is 1 [ 577.032863][ T7301] usb 5-1: config 14 has an invalid interface number: 228 but max is 1 [ 577.032878][ T7301] usb 5-1: config 14 has no interface number 0 [ 577.032891][ T7301] usb 5-1: config 14 has no interface number 1 [ 577.032934][ T7301] usb 5-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 577.032952][ T7301] usb 5-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 577.032971][ T7301] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 577.032993][ T7301] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 577.033015][ T7301] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 577.033037][ T7301] usb 5-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 577.033059][ T7301] usb 5-1: config 14 interface 57 has no altsetting 0 [ 577.033073][ T7301] usb 5-1: config 14 interface 228 has no altsetting 0 [ 577.036138][ T7301] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 577.036158][ T7301] usb 5-1: Product: syz [ 577.036169][ T7301] usb 5-1: Manufacturer: syz [ 577.036181][ T7301] usb 5-1: SerialNumber: syz [ 577.359755][T11422] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 577.359829][T11422] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 577.501208][ T7301] legousbtower 5-1:14.57: interrupt endpoints not found [ 577.532240][T11422] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 577.921594][ T7301] legousbtower 5-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 577.923126][ T7301] legousbtower 5-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 578.521389][T11442] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1295'. [ 578.741104][ C3] usb 5-1: tower_interrupt_in_callback: usb_submit_urb failed (-1) [ 578.816315][ T5866] usb 5-1: USB disconnect, device number 60 [ 578.921010][ T5767] Bluetooth: hci1: command 0x0406 tx timeout [ 579.152150][ T5866] legousbtower 5-1:14.228: LEGO USB Tower #-160 now disconnected [ 579.302011][T11448] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 579.388858][ T5767] Bluetooth: hci2: command 0x0406 tx timeout [ 579.555848][ T5767] Bluetooth: hci3: command 0x0406 tx timeout [ 580.745703][ T43] kauditd_printk_skb: 4 callbacks suppressed [ 580.745721][ T43] audit: type=1326 audit(1789001019.374:1648): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11456 comm="syz.1.1301" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 580.749988][ T43] audit: type=1326 audit(1789001019.374:1649): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11456 comm="syz.1.1301" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 580.772055][ T43] audit: type=1326 audit(1789001019.394:1650): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11456 comm="syz.1.1301" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 580.772097][ T43] audit: type=1326 audit(1789001019.394:1651): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11456 comm="syz.1.1301" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 580.772297][ T43] audit: type=1326 audit(1789001019.394:1652): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11456 comm="syz.1.1301" exe="/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf703efec code=0x7ffc0000 [ 580.773285][ T43] audit: type=1326 audit(1789001019.394:1653): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11456 comm="syz.1.1301" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 580.773655][ T43] audit: type=1326 audit(1789001019.394:1654): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11456 comm="syz.1.1301" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf703efec code=0x7ffc0000 [ 580.773809][ T43] audit: type=1326 audit(1789001019.394:1655): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11456 comm="syz.1.1301" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 580.774151][ T43] audit: type=1326 audit(1789001019.394:1656): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11456 comm="syz.1.1301" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 580.962057][ T43] audit: type=1326 audit(1789001019.584:1657): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11465 comm="syz.3.1303" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 580.999425][ T5767] Bluetooth: hci1: command 0x0406 tx timeout [ 581.473989][ T5767] Bluetooth: hci2: command 0x0406 tx timeout [ 581.492290][T11464] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1302'. [ 583.133038][ T5866] usb 5-1: new high-speed USB device number 61 using dummy_hcd [ 583.288805][ T5866] usb 5-1: New USB device found, idVendor=0711, idProduct=0550, bcdDevice= 0.00 [ 583.292628][ T5866] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 583.292662][ T5866] usb 5-1: Product: syz [ 583.292679][ T5866] usb 5-1: Manufacturer: syz [ 583.292697][ T5866] usb 5-1: SerialNumber: syz [ 583.317978][ T5866] usb 5-1: USB2VGA dongle found at address 61 [ 583.323626][ T5866] usb 5-1: Allocated 8 output buffers [ 583.881875][T11489] netlink: 'syz.0.1307': attribute type 30 has an invalid length. [ 584.899828][ T5866] usb 5-1: Failed to early initialize device [ 584.909813][ T5866] usb 5-1: USB disconnect, device number 61 [ 585.717848][ T2334] usb 6-1: new high-speed USB device number 39 using dummy_hcd [ 585.788654][ T43] kauditd_printk_skb: 80 callbacks suppressed [ 585.788674][ T43] audit: type=1326 audit(1789001024.414:1738): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11511 comm="syz.1.1311" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf703efec code=0x7ffc0000 [ 585.909121][ T43] audit: type=1326 audit(1789001024.534:1739): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11511 comm="syz.1.1311" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf703efec code=0x7ffc0000 [ 585.909632][ T2334] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 585.909980][ T43] audit: type=1326 audit(1789001024.534:1740): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11511 comm="syz.1.1311" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf703efec code=0x7ffc0000 [ 585.910342][ T43] audit: type=1326 audit(1789001024.534:1741): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11511 comm="syz.1.1311" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf703efec code=0x7ffc0000 [ 585.911186][ T43] audit: type=1326 audit(1789001024.534:1742): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11511 comm="syz.1.1311" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf703efec code=0x7ffc0000 [ 585.911617][ T43] audit: type=1326 audit(1789001024.534:1743): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11511 comm="syz.1.1311" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf703efec code=0x7ffc0000 [ 585.912571][ T43] audit: type=1326 audit(1789001024.534:1744): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11511 comm="syz.1.1311" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf703efec code=0x7ffc0000 [ 585.913009][ T43] audit: type=1326 audit(1789001024.534:1745): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11511 comm="syz.1.1311" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf703efec code=0x7ffc0000 [ 585.913738][ T43] audit: type=1326 audit(1789001024.534:1746): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11511 comm="syz.1.1311" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf703efec code=0x7ffc0000 [ 585.914189][ T43] audit: type=1326 audit(1789001024.534:1747): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11511 comm="syz.1.1311" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf703efec code=0x7ffc0000 [ 585.916970][ T2334] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 585.916989][ T2334] usb 6-1: Product: syz [ 585.917000][ T2334] usb 6-1: Manufacturer: syz [ 585.917011][ T2334] usb 6-1: SerialNumber: syz [ 586.266135][T11532] /dev/nullb0: Can't open blockdev [ 586.412857][ T7184] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 586.760680][T11537] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1315'. [ 587.148707][T11512] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 587.148854][T11512] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 587.152362][T11512] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 587.490866][ T7184] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 587.491225][ T7184] ath9k_htc: Failed to initialize the device [ 587.607622][ T7184] usb 6-1: ath9k_htc: USB layer deinitialized [ 588.023781][ T2334] usb 6-1: USB disconnect, device number 39 [ 588.737849][T11551] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 589.239782][ T5767] Bluetooth: hci2: command 0x0406 tx timeout [ 589.239818][ T5767] Bluetooth: hci1: command 0x0406 tx timeout [ 589.239873][ T5765] Bluetooth: hci3: command 0x0406 tx timeout [ 589.374057][ T10] libceph: connect (1)[c::]:6789 error -101 [ 589.374401][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 589.431914][T11560] ceph: No mds server is up or the cluster is laggy [ 589.687259][ T10] libceph: connect (1)[c::]:6789 error -101 [ 589.687390][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 590.710041][T11574] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 590.710248][T11574] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 590.710425][T11574] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 590.935803][ T43] kauditd_printk_skb: 67 callbacks suppressed [ 590.935823][ T43] audit: type=1326 audit(1789001029.554:1815): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11575 comm="syz.1.1327" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 590.936290][ T43] audit: type=1326 audit(1789001029.554:1816): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11575 comm="syz.1.1327" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 592.041298][T11592] /dev/nullb0: Can't open blockdev [ 592.747957][T11412] Bluetooth: hci3: command 0x0406 tx timeout [ 592.747995][T11412] Bluetooth: hci2: command 0x0406 tx timeout [ 592.748016][T11412] Bluetooth: hci1: command 0x0406 tx timeout [ 592.791611][T11600] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1331'. [ 593.214049][T11603] i2c i2c-0: new_device: Instantiated device rt1719 at 0x49 [ 593.323934][T11605] wusb3801 0-004a: supply vbus not found, using dummy regulator [ 593.489368][T11605] i2c i2c-0: new_device: Instantiated device wusb3801 at 0x4a [ 594.151386][ T43] audit: type=1326 audit(1789001032.774:1817): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11608 comm="syz.3.1336" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 594.151560][ T43] audit: type=1326 audit(1789001032.774:1818): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11608 comm="syz.3.1336" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 594.393739][T11611] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 595.031678][T11625] jffs2: notice: (11625) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 595.148694][ T43] audit: type=1326 audit(1789001033.764:1819): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11622 comm="syz.3.1339" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 595.173660][ T43] audit: type=1326 audit(1789001033.804:1820): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11622 comm="syz.3.1339" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 595.246538][T11632] ip6gretap0: entered promiscuous mode [ 597.445985][ T43] audit: type=1326 audit(1789001036.064:1821): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11650 comm="syz.3.1346" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 597.446035][ T43] audit: type=1326 audit(1789001036.064:1822): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11650 comm="syz.3.1346" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 597.446069][ T43] audit: type=1326 audit(1789001036.064:1823): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11650 comm="syz.3.1346" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 597.446102][ T43] audit: type=1326 audit(1789001036.064:1824): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11650 comm="syz.3.1346" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 597.446135][ T43] audit: type=1326 audit(1789001036.064:1825): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11650 comm="syz.3.1346" exe="/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 597.446171][ T43] audit: type=1326 audit(1789001036.064:1826): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11650 comm="syz.3.1346" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 597.446204][ T43] audit: type=1326 audit(1789001036.064:1827): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11650 comm="syz.3.1346" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 598.291951][ T7301] usb 5-1: new full-speed USB device number 62 using dummy_hcd [ 598.443221][T11665] ip6t_rt: too many addresses specified [ 598.463083][ T7301] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 598.464132][ T7301] usb 5-1: config 0 has an invalid descriptor of length 121, skipping remainder of the config [ 598.464173][ T7301] usb 5-1: config 0 interface 0 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 598.464200][ T7301] usb 5-1: config 0 interface 0 has no altsetting 0 [ 598.466892][ T7301] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 598.466913][ T7301] usb 5-1: Product: syz [ 598.466925][ T7301] usb 5-1: Manufacturer: syz [ 598.466936][ T7301] usb 5-1: SerialNumber: syz [ 598.579412][T11670] jffs2: notice: (11670) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 598.717850][ T7301] usb 5-1: config 0 descriptor?? [ 599.545700][ T7301] snd-usb-audio 5-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 599.594950][ T5954] udevd[5954]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 599.800891][T11693] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1352'. [ 600.113768][ T2334] usb 6-1: new high-speed USB device number 40 using dummy_hcd [ 600.287915][ T2334] usb 6-1: Using ep0 maxpacket: 32 [ 600.290357][ T2334] usb 6-1: unable to get BOS descriptor or descriptor too short [ 600.290395][ T2334] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 600.291408][ T2334] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 600.291429][ T2334] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 600.291446][ T2334] usb 6-1: config 14 has no interface number 0 [ 600.291460][ T2334] usb 6-1: config 14 has no interface number 1 [ 600.291505][ T2334] usb 6-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 600.291525][ T2334] usb 6-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 600.291546][ T2334] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 600.291567][ T2334] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 600.291590][ T2334] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 600.291611][ T2334] usb 6-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 600.291631][ T2334] usb 6-1: config 14 interface 57 has no altsetting 0 [ 600.291645][ T2334] usb 6-1: config 14 interface 228 has no altsetting 0 [ 600.314760][ T2334] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 600.314785][ T2334] usb 6-1: Product: syz [ 600.314796][ T2334] usb 6-1: Manufacturer: syz [ 600.314806][ T2334] usb 6-1: SerialNumber: syz [ 600.593900][ T57] usb 5-1: USB disconnect, device number 62 [ 600.802739][ T2334] legousbtower 6-1:14.57: interrupt endpoints not found [ 601.212224][ T2334] legousbtower 6-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 601.252247][ T2334] legousbtower 6-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 601.452879][ T43] audit: type=1326 audit(1789001040.074:1828): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11719 comm="syz.0.1358" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 601.452934][ T43] audit: type=1326 audit(1789001040.074:1829): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11719 comm="syz.0.1358" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 601.452977][ T43] audit: type=1326 audit(1789001040.074:1830): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11719 comm="syz.0.1358" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 601.474253][T11723] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1357'. [ 601.626629][T11723] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1357'. [ 601.638790][T11723] netlink: 280 bytes leftover after parsing attributes in process `syz.3.1357'. [ 601.977033][ C3] usb 6-1: tower_interrupt_in_callback: usb_submit_urb failed (-1) [ 601.978840][ T10] usb 6-1: USB disconnect, device number 40 [ 602.026047][ T10] legousbtower 6-1:14.228: LEGO USB Tower #-160 now disconnected [ 603.997884][T11769] ubi0: attaching mtd0 [ 604.001491][T11769] ubi0: scanning is finished [ 604.001534][T11769] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 604.220155][ T10] usb 6-1: new high-speed USB device number 41 using dummy_hcd [ 604.231475][T11769] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 604.387815][ T10] usb 6-1: Using ep0 maxpacket: 32 [ 604.390085][ T10] usb 6-1: unable to get BOS descriptor or descriptor too short [ 604.390123][ T10] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 604.391069][ T10] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 604.391089][ T10] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 604.391106][ T10] usb 6-1: config 14 has no interface number 0 [ 604.391120][ T10] usb 6-1: config 14 has no interface number 1 [ 604.391166][ T10] usb 6-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 604.391184][ T10] usb 6-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 604.391201][ T10] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 604.391222][ T10] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 604.391244][ T10] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 604.391264][ T10] usb 6-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 604.391286][ T10] usb 6-1: config 14 interface 57 has no altsetting 0 [ 604.391300][ T10] usb 6-1: config 14 interface 228 has no altsetting 0 [ 604.395713][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 604.395740][ T10] usb 6-1: Product: syz [ 604.395753][ T10] usb 6-1: Manufacturer: syz [ 604.395766][ T10] usb 6-1: SerialNumber: syz [ 604.937255][ T10] legousbtower 6-1:14.57: interrupt endpoints not found [ 605.048363][T11778] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1367'. [ 605.222405][T11781] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1368'. [ 605.372987][ T10] legousbtower 6-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 605.428039][ T10] legousbtower 6-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 605.616646][T11788] syzkaller1: entered promiscuous mode [ 605.616669][T11788] syzkaller1: entered allmulticast mode [ 606.118544][T11795] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1370'. [ 606.158375][ T7224] usb 6-1: USB disconnect, device number 41 [ 606.162682][ T7224] legousbtower 6-1:14.228: LEGO USB Tower #-160 now disconnected [ 606.367938][ T10] usb 7-1: new high-speed USB device number 51 using dummy_hcd [ 606.538458][ T10] usb 7-1: Using ep0 maxpacket: 32 [ 606.540292][ T10] usb 7-1: unable to get BOS descriptor or descriptor too short [ 606.540324][ T10] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 606.541244][ T10] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 606.541260][ T10] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 606.541273][ T10] usb 7-1: config 14 has no interface number 0 [ 606.541285][ T10] usb 7-1: config 14 has no interface number 1 [ 606.541321][ T10] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 606.541337][ T10] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 606.541354][ T10] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 606.541370][ T10] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 606.541388][ T10] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 606.541405][ T10] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 606.541423][ T10] usb 7-1: config 14 interface 57 has no altsetting 0 [ 606.541435][ T10] usb 7-1: config 14 interface 228 has no altsetting 0 [ 606.570937][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 606.570961][ T10] usb 7-1: Product: syz [ 606.570973][ T10] usb 7-1: Manufacturer: syz [ 606.570986][ T10] usb 7-1: SerialNumber: syz [ 606.739263][ T43] kauditd_printk_skb: 7 callbacks suppressed [ 606.739281][ T43] audit: type=1326 audit(1789001045.364:1838): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11801 comm="syz.0.1373" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 606.739430][ T43] audit: type=1326 audit(1789001045.364:1839): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11801 comm="syz.0.1373" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 606.765497][ T43] audit: type=1326 audit(1789001045.384:1840): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11801 comm="syz.0.1373" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 606.765598][ T43] audit: type=1326 audit(1789001045.384:1841): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11801 comm="syz.0.1373" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 606.765638][ T43] audit: type=1326 audit(1789001045.384:1842): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11801 comm="syz.0.1373" exe="/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf706efec code=0x7ffc0000 [ 606.765674][ T43] audit: type=1326 audit(1789001045.384:1843): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11801 comm="syz.0.1373" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 606.765770][ T43] audit: type=1326 audit(1789001045.384:1844): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11801 comm="syz.0.1373" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 606.765811][ T43] audit: type=1326 audit(1789001045.384:1845): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11801 comm="syz.0.1373" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf706efec code=0x7ffc0000 [ 606.765848][ T43] audit: type=1326 audit(1789001045.384:1846): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11801 comm="syz.0.1373" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 606.765937][ T43] audit: type=1326 audit(1789001045.384:1847): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11801 comm="syz.0.1373" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 607.015991][ T10] legousbtower 7-1:14.57: interrupt endpoints not found [ 607.421821][ T10] legousbtower 7-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 607.423155][ T10] legousbtower 7-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 607.750836][ T10] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 607.994357][ T10] usb 6-1: unable to get BOS descriptor or descriptor too short [ 607.994401][ T10] usb 6-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 607.995305][ T10] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 607.995323][ T10] usb 6-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 607.995363][ T10] usb 6-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 607.997254][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 607.997274][ T10] usb 6-1: Product: syz [ 607.997286][ T10] usb 6-1: Manufacturer: syz [ 607.997298][ T10] usb 6-1: SerialNumber: syz [ 608.274598][ T2334] usb 7-1: USB disconnect, device number 51 [ 608.318519][ T2334] legousbtower 7-1:14.228: LEGO USB Tower #-160 now disconnected [ 609.347929][ T10] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 609.351148][ T10] usb 6-1: USB disconnect, device number 42 [ 609.390652][T11843] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1380'. [ 609.478505][ T5954] udevd[5954]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb6/6-1/6-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 611.207856][ T3380] usb 6-1: new high-speed USB device number 43 using dummy_hcd [ 611.367927][ T3380] usb 6-1: Using ep0 maxpacket: 8 [ 611.368630][ T3380] usb 6-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 611.370258][ T3380] usb 6-1: config 179 has an invalid interface number: 65 but max is 0 [ 611.370278][ T3380] usb 6-1: config 179 has no interface number 0 [ 611.370308][ T3380] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 611.370330][ T3380] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 611.370351][ T3380] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 611.370370][ T3380] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 611.370390][ T3380] usb 6-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 611.370421][ T3380] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 611.374677][T11866] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 611.808715][ T7301] usb 7-1: new full-speed USB device number 52 using dummy_hcd [ 611.889203][T11866] syzkaller1: entered promiscuous mode [ 611.889228][T11866] syzkaller1: entered allmulticast mode [ 611.986448][T11866] wg2 speed is unknown, defaulting to 1000 [ 612.035189][ T7301] usb 7-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 612.041648][ T7301] usb 7-1: config 0 has an invalid descriptor of length 121, skipping remainder of the config [ 612.041706][ T7301] usb 7-1: config 0 interface 0 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 612.041729][ T7301] usb 7-1: config 0 interface 0 has no altsetting 0 [ 612.095464][ T7301] usb 7-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 612.095588][ T7301] usb 7-1: Product: syz [ 612.095601][ T7301] usb 7-1: Manufacturer: syz [ 612.095613][ T7301] usb 7-1: SerialNumber: syz [ 612.100443][ T7301] usb 7-1: config 0 descriptor?? [ 613.786563][ T7301] snd-usb-audio 7-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 613.798883][ T7301] usb 7-1: USB disconnect, device number 52 [ 613.839865][ T5954] udevd[5954]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 614.056158][T11866] lo speed is unknown, defaulting to 1000 [ 614.129907][T11883] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1390'. [ 614.131387][T11883] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1390'. [ 614.131692][T11883] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1390'. [ 614.134743][T11883] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1390'. [ 614.135076][T11883] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1390'. [ 614.912649][ T7301] usb 7-1: new high-speed USB device number 53 using dummy_hcd [ 615.094878][ T43] kauditd_printk_skb: 21 callbacks suppressed [ 615.094895][ T43] audit: type=1326 audit(1789001053.704:1869): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11884 comm="syz.3.1391" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 615.095293][ T43] audit: type=1326 audit(1789001053.704:1870): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11884 comm="syz.3.1391" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 615.188150][ T7301] usb 7-1: Using ep0 maxpacket: 32 [ 615.210474][ T7301] usb 7-1: unable to get BOS descriptor or descriptor too short [ 615.210606][ T7301] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 615.213592][ T7301] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 615.213615][ T7301] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 615.213724][ T7301] usb 7-1: config 14 has no interface number 0 [ 615.213738][ T7301] usb 7-1: config 14 has no interface number 1 [ 615.213782][ T7301] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 615.213800][ T7301] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 615.213819][ T7301] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 615.213927][ T7301] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 615.213948][ T7301] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 615.213974][ T7301] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 615.213994][ T7301] usb 7-1: config 14 interface 57 has no altsetting 0 [ 615.214008][ T7301] usb 7-1: config 14 interface 228 has no altsetting 0 [ 615.302255][ T7301] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 615.302372][ T7301] usb 7-1: Product: syz [ 615.302385][ T7301] usb 7-1: Manufacturer: syz [ 615.302395][ T7301] usb 7-1: SerialNumber: syz [ 615.518322][T11892] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1393'. [ 615.815757][ T7301] legousbtower 7-1:14.57: interrupt endpoints not found [ 616.208748][T11897] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1394'. [ 616.273591][ T7301] legousbtower 7-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 616.325545][ T7301] legousbtower 7-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 617.052248][ T57] usb 7-1: USB disconnect, device number 53 [ 617.077336][ T57] legousbtower 7-1:14.228: LEGO USB Tower #-160 now disconnected [ 617.131597][T11901] Mount JFS Failure: -5 [ 617.131615][T11901] jfs_mount failed w/return code = -5 [ 617.301555][ T7301] usb 6-1: USB disconnect, device number 43 [ 617.301661][ C2] xpad 6-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 617.301698][ C2] xpad 6-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 617.613877][ T43] audit: type=1326 audit(1789001056.234:1871): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11902 comm="syz.3.1397" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 617.613931][ T43] audit: type=1326 audit(1789001056.234:1872): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11902 comm="syz.3.1397" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 619.110392][T11932] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1405'. [ 619.384631][ T7301] usb 6-1: new high-speed USB device number 44 using dummy_hcd [ 619.548754][ T7301] usb 6-1: Using ep0 maxpacket: 32 [ 619.562168][ T7301] usb 6-1: unable to get BOS descriptor or descriptor too short [ 619.562209][ T7301] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 619.563175][ T7301] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 619.563196][ T7301] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 619.563213][ T7301] usb 6-1: config 14 has no interface number 0 [ 619.563227][ T7301] usb 6-1: config 14 has no interface number 1 [ 619.563274][ T7301] usb 6-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 619.563294][ T7301] usb 6-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 619.563315][ T7301] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 619.563337][ T7301] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 619.563359][ T7301] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 619.563380][ T7301] usb 6-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 619.563402][ T7301] usb 6-1: config 14 interface 57 has no altsetting 0 [ 619.563417][ T7301] usb 6-1: config 14 interface 228 has no altsetting 0 [ 619.629626][ T7301] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 619.629651][ T7301] usb 6-1: Product: syz [ 619.629664][ T7301] usb 6-1: Manufacturer: syz [ 619.629677][ T7301] usb 6-1: SerialNumber: syz [ 619.793895][T11937] Mount JFS Failure: -5 [ 619.793913][T11937] jfs_mount failed w/return code = -5 [ 620.109627][ T7301] legousbtower 6-1:14.57: interrupt endpoints not found [ 620.522003][ T3380] usb 7-1: new high-speed USB device number 54 using dummy_hcd [ 620.537276][ T7301] legousbtower 6-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 620.564412][ T7301] legousbtower 6-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 620.687833][ T3380] usb 7-1: Using ep0 maxpacket: 32 [ 620.689871][ T3380] usb 7-1: unable to get BOS descriptor or descriptor too short [ 620.689906][ T3380] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 620.690851][ T3380] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 620.690872][ T3380] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 620.690888][ T3380] usb 7-1: config 14 has no interface number 0 [ 620.690901][ T3380] usb 7-1: config 14 has no interface number 1 [ 620.690948][ T3380] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 620.690967][ T3380] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 620.690986][ T3380] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 620.691005][ T3380] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 620.691026][ T3380] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 620.691045][ T3380] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 620.691065][ T3380] usb 7-1: config 14 interface 57 has no altsetting 0 [ 620.691080][ T3380] usb 7-1: config 14 interface 228 has no altsetting 0 [ 620.692897][ T3380] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 620.692916][ T3380] usb 7-1: Product: syz [ 620.692926][ T3380] usb 7-1: Manufacturer: syz [ 620.692936][ T3380] usb 7-1: SerialNumber: syz [ 621.119888][ T3380] legousbtower 7-1:14.57: interrupt endpoints not found [ 621.305682][ T57] usb 6-1: USB disconnect, device number 44 [ 621.331555][ T57] legousbtower 6-1:14.228: LEGO USB Tower #-160 now disconnected [ 621.526691][ T3380] legousbtower 7-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 621.528145][ T3380] legousbtower 7-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 621.624830][ T43] audit: type=1326 audit(1789001060.244:1873): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11951 comm="syz.3.1410" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 621.638652][ T43] audit: type=1326 audit(1789001060.264:1874): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11951 comm="syz.3.1410" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 621.638744][ T43] audit: type=1326 audit(1789001060.264:1875): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11951 comm="syz.3.1410" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 621.641276][ T43] audit: type=1326 audit(1789001060.264:1876): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11951 comm="syz.3.1410" exe="/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 621.641319][ T43] audit: type=1326 audit(1789001060.264:1877): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11951 comm="syz.3.1410" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 621.641353][ T43] audit: type=1326 audit(1789001060.264:1878): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11951 comm="syz.3.1410" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 621.641386][ T43] audit: type=1326 audit(1789001060.264:1879): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11951 comm="syz.3.1410" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 621.641419][ T43] audit: type=1326 audit(1789001060.264:1880): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11951 comm="syz.3.1410" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 621.641452][ T43] audit: type=1326 audit(1789001060.264:1881): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11951 comm="syz.3.1410" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 622.005120][T11959] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1412'. [ 622.287437][ T2334] usb 7-1: USB disconnect, device number 54 [ 622.322667][ T2334] legousbtower 7-1:14.228: LEGO USB Tower #-160 now disconnected [ 622.338517][ T43] audit: type=1326 audit(1789001060.954:1882): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11962 comm="syz.3.1413" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 622.629826][ T5852] usb 6-1: new high-speed USB device number 45 using dummy_hcd [ 622.807803][ T5852] usb 6-1: Using ep0 maxpacket: 32 [ 622.810509][ T5852] usb 6-1: unable to get BOS descriptor or descriptor too short [ 622.810558][ T5852] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 622.815188][ T5852] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 622.815213][ T5852] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 622.815230][ T5852] usb 6-1: config 14 has no interface number 0 [ 622.815241][ T5852] usb 6-1: config 14 has no interface number 1 [ 622.815287][ T5852] usb 6-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 622.815305][ T5852] usb 6-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 622.815326][ T5852] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 622.815346][ T5852] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 622.815368][ T5852] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 622.815388][ T5852] usb 6-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 622.815409][ T5852] usb 6-1: config 14 interface 57 has no altsetting 0 [ 622.815425][ T5852] usb 6-1: config 14 interface 228 has no altsetting 0 [ 622.826331][ T5852] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 622.826352][ T5852] usb 6-1: Product: syz [ 622.826362][ T5852] usb 6-1: Manufacturer: syz [ 622.826372][ T5852] usb 6-1: SerialNumber: syz [ 623.166112][T11972] Mount JFS Failure: -5 [ 623.166127][T11972] jfs_mount failed w/return code = -5 [ 623.281646][ T5852] legousbtower 6-1:14.57: interrupt endpoints not found [ 623.656315][ T5852] legousbtower 6-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 623.680983][ T5852] legousbtower 6-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 624.253288][T11979] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1418'. [ 624.421482][ T30] usb 6-1: USB disconnect, device number 45 [ 624.426957][ T30] legousbtower 6-1:14.228: LEGO USB Tower #-160 now disconnected [ 624.493370][ T5866] usb 8-1: new high-speed USB device number 47 using dummy_hcd [ 624.678500][ T5866] usb 8-1: Using ep0 maxpacket: 32 [ 624.681781][ T5866] usb 8-1: unable to get BOS descriptor or descriptor too short [ 624.681823][ T5866] usb 8-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 624.683106][ T5866] usb 8-1: config 14 has an invalid interface number: 57 but max is 1 [ 624.683129][ T5866] usb 8-1: config 14 has an invalid interface number: 228 but max is 1 [ 624.683145][ T5866] usb 8-1: config 14 has no interface number 0 [ 624.683159][ T5866] usb 8-1: config 14 has no interface number 1 [ 624.683204][ T5866] usb 8-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 624.683223][ T5866] usb 8-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 624.683244][ T5866] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 624.683289][ T5866] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 624.683311][ T5866] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 624.683332][ T5866] usb 8-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 624.683352][ T5866] usb 8-1: config 14 interface 57 has no altsetting 0 [ 624.683367][ T5866] usb 8-1: config 14 interface 228 has no altsetting 0 [ 624.686807][ T5866] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 624.686827][ T5866] usb 8-1: Product: syz [ 624.686838][ T5866] usb 8-1: Manufacturer: syz [ 624.686849][ T5866] usb 8-1: SerialNumber: syz [ 624.952393][ T5852] usb 7-1: new high-speed USB device number 55 using dummy_hcd [ 625.109403][ T5852] usb 7-1: New USB device found, idVendor=055f, idProduct=c630, bcdDevice=b6.ac [ 625.109987][ T5852] usb 7-1: config 0 has no interfaces? [ 625.119222][ T5852] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 625.119246][ T5852] usb 7-1: Product: syz [ 625.119258][ T5852] usb 7-1: Manufacturer: syz [ 625.119271][ T5852] usb 7-1: SerialNumber: syz [ 625.121439][ T5852] usb 7-1: config 0 descriptor?? [ 625.133675][ T5866] legousbtower 8-1:14.57: interrupt endpoints not found [ 625.477213][T11983] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 625.548129][ T5866] legousbtower 8-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 625.549887][ T5866] legousbtower 8-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 626.357961][ T5852] usb 8-1: USB disconnect, device number 47 [ 626.398784][ T5852] legousbtower 8-1:14.228: LEGO USB Tower #-160 now disconnected [ 626.661732][T11995] UDC core: g1: couldn't find an available UDC or it's busy [ 627.348058][ T10] usb 8-1: new high-speed USB device number 48 using dummy_hcd [ 627.528945][ T10] usb 8-1: unable to get BOS descriptor or descriptor too short [ 627.528983][ T10] usb 8-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 627.529941][ T10] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 627.529957][ T10] usb 8-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 627.529992][ T10] usb 8-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 627.531920][ T10] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 627.531936][ T10] usb 8-1: Product: syz [ 627.531946][ T10] usb 8-1: Manufacturer: syz [ 627.531956][ T10] usb 8-1: SerialNumber: syz [ 627.932320][ T5852] usb 7-1: USB disconnect, device number 55 [ 628.344038][ T10] snd-usb-audio 8-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 628.347118][ T10] usb 8-1: USB disconnect, device number 48 [ 628.418718][ T5954] udevd[5954]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb8/8-1/8-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 629.616753][T12027] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1428'. [ 629.897941][ T57] usb 8-1: new high-speed USB device number 49 using dummy_hcd [ 630.087760][ T57] usb 8-1: Using ep0 maxpacket: 32 [ 630.091154][ T57] usb 8-1: unable to get BOS descriptor or descriptor too short [ 630.091196][ T57] usb 8-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 630.092556][ T57] usb 8-1: config 14 has an invalid interface number: 57 but max is 1 [ 630.092578][ T57] usb 8-1: config 14 has an invalid interface number: 228 but max is 1 [ 630.092595][ T57] usb 8-1: config 14 has no interface number 0 [ 630.092609][ T57] usb 8-1: config 14 has no interface number 1 [ 630.092656][ T57] usb 8-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 630.092676][ T57] usb 8-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 630.092697][ T57] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 630.092718][ T57] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 630.092740][ T57] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 630.092762][ T57] usb 8-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 630.092784][ T57] usb 8-1: config 14 interface 57 has no altsetting 0 [ 630.092801][ T57] usb 8-1: config 14 interface 228 has no altsetting 0 [ 630.105839][ T57] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 630.105861][ T57] usb 8-1: Product: syz [ 630.105872][ T57] usb 8-1: Manufacturer: syz [ 630.105884][ T57] usb 8-1: SerialNumber: syz [ 630.536421][ T57] legousbtower 8-1:14.57: interrupt endpoints not found [ 630.599295][ T5852] usb 7-1: new high-speed USB device number 56 using dummy_hcd [ 630.798643][ T5852] usb 7-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 630.799656][ T5852] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 135 [ 630.878040][ T5852] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 630.878064][ T5852] usb 7-1: Product: syz [ 630.878098][ T5852] usb 7-1: Manufacturer: syz [ 630.878112][ T5852] usb 7-1: SerialNumber: syz [ 630.902672][T12032] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 630.941486][ T57] legousbtower 8-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 630.945737][ T57] legousbtower 8-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 631.480602][ T5852] usblp 7-1:1.0: usblp1: USB Bidirectional printer dev 56 if 0 alt 0 proto 2 vid 0x0711 pid 0x0900 [ 631.694422][ T5852] usb 7-1: USB disconnect, device number 56 [ 631.709008][ T5852] usblp1: removed [ 631.711232][ T57] usb 8-1: USB disconnect, device number 49 [ 631.801680][ T57] legousbtower 8-1:14.228: LEGO USB Tower #-160 now disconnected [ 632.200133][T12052] openvswitch: netlink: Unexpected mask (mask=200440, allowed=10048) [ 632.466324][T12056] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1435'. [ 632.469079][T12052] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1434'. [ 632.717619][T12058] netlink: 'syz.1.1436': attribute type 4 has an invalid length. [ 632.717637][T12058] netlink: 17 bytes leftover after parsing attributes in process `syz.1.1436'. [ 633.218977][ T5866] usb 7-1: new high-speed USB device number 57 using dummy_hcd [ 633.376865][ T5866] usb 7-1: unable to get BOS descriptor or descriptor too short [ 633.376905][ T5866] usb 7-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 633.422506][ T5866] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 633.422522][ T5866] usb 7-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 633.422548][ T5866] usb 7-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 633.425586][ T5866] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 633.425607][ T5866] usb 7-1: Product: syz [ 633.425617][ T5866] usb 7-1: Manufacturer: syz [ 633.425626][ T5866] usb 7-1: SerialNumber: syz [ 633.588752][T12064] jffs2: notice: (12064) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 634.077925][ T57] usb 6-1: new high-speed USB device number 46 using dummy_hcd [ 634.247837][ T57] usb 6-1: Using ep0 maxpacket: 32 [ 634.250123][ T57] usb 6-1: unable to get BOS descriptor or descriptor too short [ 634.250163][ T57] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 634.251077][ T57] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 634.251096][ T57] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 634.251110][ T57] usb 6-1: config 14 has no interface number 0 [ 634.251122][ T57] usb 6-1: config 14 has no interface number 1 [ 634.251167][ T57] usb 6-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 634.251187][ T57] usb 6-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 634.251206][ T57] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 634.251224][ T57] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 634.251243][ T57] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 634.251261][ T57] usb 6-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 634.251279][ T57] usb 6-1: config 14 interface 57 has no altsetting 0 [ 634.251292][ T57] usb 6-1: config 14 interface 228 has no altsetting 0 [ 634.261749][ T57] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 634.261768][ T57] usb 6-1: Product: syz [ 634.261779][ T57] usb 6-1: Manufacturer: syz [ 634.261789][ T57] usb 6-1: SerialNumber: syz [ 634.593851][ T5866] snd-usb-audio 7-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 634.653107][ T5954] udevd[5954]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb7/7-1/7-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 634.665901][ T5866] usb 7-1: USB disconnect, device number 57 [ 634.914833][ T57] legousbtower 6-1:14.57: interrupt endpoints not found [ 635.350357][ T57] legousbtower 6-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 635.352065][ T57] legousbtower 6-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 635.898739][ T1438] ieee802154 phy0 wpan0: encryption failed: -22 [ 635.898781][ T1438] ieee802154 phy1 wpan1: encryption failed: -22 [ 636.171229][ C0] usb 6-1: tower_interrupt_in_callback: usb_submit_urb failed (-1) [ 636.173483][ T10] usb 6-1: USB disconnect, device number 46 [ 636.233847][ T10] legousbtower 6-1:14.228: LEGO USB Tower #-160 now disconnected [ 636.804525][T12090] netlink: 'syz.0.1445': attribute type 11 has an invalid length. [ 636.894241][T12090] bond2: option ad_actor_sys_prio: invalid value (0) [ 636.894266][T12090] bond2: option ad_actor_sys_prio: allowed values 1 - 65535 [ 636.953425][T12090] bond2 (unregistering): Released all slaves [ 637.026206][T12099] can: request_module (can-proto-3) failed. [ 637.061951][T12104] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1444'. [ 637.111331][T12102] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1442'. [ 637.479088][ T43] kauditd_printk_skb: 17 callbacks suppressed [ 637.479109][ T43] audit: type=1326 audit(1789001076.084:1900): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12089 comm="syz.2.1443" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf708efec code=0x7ffc0000 [ 637.479299][ T43] audit: type=1326 audit(1789001076.104:1901): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12089 comm="syz.2.1443" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf708efec code=0x7ffc0000 [ 638.379261][ T43] audit: type=1326 audit(1789001077.004:1902): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12089 comm="syz.2.1443" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf708efec code=0x7ffc0000 [ 638.379295][ T43] audit: type=1326 audit(1789001077.004:1903): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12089 comm="syz.2.1443" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf708efec code=0x7ffc0000 [ 638.379316][ T43] audit: type=1326 audit(1789001077.004:1904): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12089 comm="syz.2.1443" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf708efec code=0x7ffc0000 [ 638.380446][ T43] audit: type=1326 audit(1789001077.004:1905): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12089 comm="syz.2.1443" exe="/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf71c75ab code=0x7ffc0000 [ 638.380474][ T43] audit: type=1326 audit(1789001077.004:1906): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12089 comm="syz.2.1443" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf708efec code=0x7ffc0000 [ 638.380502][ T43] audit: type=1326 audit(1789001077.004:1907): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12089 comm="syz.2.1443" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf708efec code=0x7ffc0000 [ 638.382388][ T43] audit: type=1326 audit(1789001077.004:1908): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12089 comm="syz.2.1443" exe="/syz-executor" sig=0 arch=40000003 syscall=333 compat=1 ip=0xf708efec code=0x7ffc0000 [ 638.382434][ T43] audit: type=1326 audit(1789001077.004:1909): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12089 comm="syz.2.1443" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf708efec code=0x7ffc0000 [ 638.788064][T12104] bridge_slave_1: left allmulticast mode [ 638.788094][T12104] bridge_slave_1: left promiscuous mode [ 638.788343][T12104] bridge0: port 2(bridge_slave_1) entered disabled state [ 638.851404][T12104] bridge_slave_0: left allmulticast mode [ 638.851429][T12104] bridge_slave_0: left promiscuous mode [ 638.851597][T12104] bridge0: port 1(bridge_slave_0) entered disabled state [ 639.937303][T12125] JFS: discard option not supported on device [ 639.937537][T12125] Mount JFS Failure: -5 [ 639.937549][T12125] jfs_mount failed w/return code = -5 [ 640.375735][T12133] jffs2: notice: (12133) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 641.433681][T12146] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1454'. [ 641.746828][ T57] usb 6-1: new high-speed USB device number 47 using dummy_hcd [ 641.927791][ T57] usb 6-1: Using ep0 maxpacket: 32 [ 641.930326][ T57] usb 6-1: unable to get BOS descriptor or descriptor too short [ 641.930364][ T57] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 641.931367][ T57] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 641.931382][ T57] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 641.931420][ T57] usb 6-1: config 14 has no interface number 0 [ 641.931853][ T57] usb 6-1: config 14 has no interface number 1 [ 641.931898][ T57] usb 6-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 641.931916][ T57] usb 6-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 641.931934][ T57] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 641.931952][ T57] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 641.931971][ T57] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 641.932000][ T57] usb 6-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 641.932019][ T57] usb 6-1: config 14 interface 57 has no altsetting 0 [ 641.932032][ T57] usb 6-1: config 14 interface 228 has no altsetting 0 [ 641.934414][ T57] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 641.934434][ T57] usb 6-1: Product: syz [ 641.934447][ T57] usb 6-1: Manufacturer: syz [ 641.934460][ T57] usb 6-1: SerialNumber: syz [ 641.943548][T12155] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1455'. [ 642.454285][T12155] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1455'. [ 642.478805][ T57] legousbtower 6-1:14.57: interrupt endpoints not found [ 642.862013][ T57] legousbtower 6-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 642.863773][ T57] legousbtower 6-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 643.441047][T12166] jffs2: notice: (12166) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 643.655787][ T57] usb 6-1: USB disconnect, device number 47 [ 643.661287][ T57] legousbtower 6-1:14.228: LEGO USB Tower #-160 now disconnected [ 645.203132][T12186] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1463'. [ 645.225313][T12187] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 645.276555][T12188] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 645.312519][T12188] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 645.312688][T12188] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 645.313063][T12188] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 645.317313][T12188] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 645.423735][T12188] pci 0000:00:01.0: Adding to iommu group 1 [ 645.468100][T12188] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 645.468121][T12188] pci 0000:00:01.0: vgaarb: bridge control possible [ 645.468133][T12188] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 645.605970][T12188] pci 0000:00:1d.0: [8086:2934] type 00 class 0x0c0300 conventional PCI endpoint [ 645.610260][T12188] pci 0000:00:1d.0: BAR 4 [io 0xc0e0-0xc0ff] [ 645.707953][T12188] pci 0000:00:1d.0: Adding to iommu group 7 [ 645.712877][T12188] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 645.713032][T12188] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 645.713173][T12188] pci 0000:00:1d.0: BAR 4 [io 0x2000-0x201f]: assigned [ 645.757203][T12188] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 646.032838][T12188] [drm] Found bochs VGA, ID 0xb0c5. [ 646.033450][T12188] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 646.468770][T12188] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 647.766461][T12188] Console: switching to colour frame buffer device 160x50 [ 647.841729][T12188] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 648.134990][T12198] ima: policy update completed [ 648.141310][ T43] kauditd_printk_skb: 9 callbacks suppressed [ 648.141331][ T43] audit: type=1807 audit(1789001086.754:1919): action=measure res=1 [ 648.141364][ T43] audit: type=1802 audit(1789001086.754:1920): pid=12198 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=completed comm="syz.3.1464" res=1 errno=0 [ 648.266566][ T43] audit: type=1800 audit(1789001086.884:1921): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=34429 res=0 errno=0 [ 648.333949][ T43] audit: type=1800 audit(1789001086.954:1922): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=34452 res=0 errno=0 [ 648.344297][ T43] audit: type=1800 audit(1789001086.964:1923): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15406 res=0 errno=0 [ 648.522735][ T43] audit: type=1800 audit(1789001087.144:1924): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15406 res=0 errno=0 [ 648.578386][T12188] pci 0000:00:1d.0: quirk_usb_early_handoff+0x0/0x1360 took 656867 usecs [ 648.758810][ T43] audit: type=1800 audit(1789001087.384:1925): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=4812 res=0 errno=0 [ 648.885155][T12188] uhci_hcd 0000:00:1d.0: UHCI Host Controller [ 648.885746][ T43] audit: type=1326 audit(1789001087.494:1926): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12205 comm="syz.3.1467" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 648.885795][ T43] audit: type=1326 audit(1789001087.494:1927): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12205 comm="syz.3.1467" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 648.888653][ T43] audit: type=1326 audit(1789001087.514:1928): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12202 comm="syz.0.1465" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x7ffc0000 [ 649.072024][T12188] uhci_hcd 0000:00:1d.0: new USB bus registered, assigned bus number 2 [ 649.072314][T12188] uhci_hcd 0000:00:1d.0: detected 2 ports [ 649.162569][T12188] uhci_hcd 0000:00:1d.0: irq 16, io port 0x00002000 [ 649.228012][T12188] usb usb2: New USB device found, idVendor=1d6b, idProduct=0001, bcdDevice= 7.03 [ 649.232684][T12188] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 649.232709][T12188] usb usb2: Product: UHCI Host Controller [ 649.232722][T12188] usb usb2: Manufacturer: Linux syzkaller uhci_hcd [ 649.232736][T12188] usb usb2: SerialNumber: 0000:00:1d.0 [ 649.304999][T12203] kvm [12202]: vcpu0, guest rIP: 0x1a3 Unhandled WRMSR(0xc1) = 0x8000 [ 649.529588][T12188] hub 2-0:1.0: USB hub found [ 649.573585][T12212] kvm [12204]: vcpu0, guest rIP: 0x1a3 Unhandled WRMSR(0xc1) = 0x8000 [ 649.741407][T12188] hub 2-0:1.0: 2 ports detected [ 650.065391][T12188] syz.2.1462 (12188) used greatest stack depth: 19312 bytes left [ 650.239945][T12217] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1470'. [ 650.443174][T12222] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1469'. [ 650.490800][ T7301] usb 7-1: new high-speed USB device number 58 using dummy_hcd [ 650.612101][T12223] Invalid ELF header magic: != ELF [ 650.717781][ T5431] usb 6-1: new high-speed USB device number 48 using dummy_hcd [ 650.872663][ T5431] usb 6-1: Using ep0 maxpacket: 32 [ 650.876064][ T5431] usb 6-1: unable to get BOS descriptor or descriptor too short [ 650.876107][ T5431] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 650.877250][ T5431] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 650.877277][ T5431] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 650.877293][ T5431] usb 6-1: config 14 has no interface number 0 [ 650.877308][ T5431] usb 6-1: config 14 has no interface number 1 [ 650.877355][ T5431] usb 6-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 650.877375][ T5431] usb 6-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 650.877396][ T5431] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 650.877417][ T5431] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 650.877440][ T5431] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 650.877461][ T5431] usb 6-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 650.877483][ T5431] usb 6-1: config 14 interface 57 has no altsetting 0 [ 650.877499][ T5431] usb 6-1: config 14 interface 228 has no altsetting 0 [ 651.073886][ T5431] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 651.073913][ T5431] usb 6-1: Product: syz [ 651.073925][ T5431] usb 6-1: Manufacturer: syz [ 651.073937][ T5431] usb 6-1: SerialNumber: syz [ 651.247859][ T7301] usb 7-1: Using ep0 maxpacket: 32 [ 651.250142][ T7301] usb 7-1: unable to get BOS descriptor or descriptor too short [ 651.250186][ T7301] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 651.251170][ T7301] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 651.251191][ T7301] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 651.251210][ T7301] usb 7-1: config 14 has no interface number 0 [ 651.251224][ T7301] usb 7-1: config 14 has no interface number 1 [ 651.251279][ T7301] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 651.251300][ T7301] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 651.251323][ T7301] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 651.251346][ T7301] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 651.251369][ T7301] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 651.251392][ T7301] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 651.251415][ T7301] usb 7-1: config 14 interface 57 has no altsetting 0 [ 651.251431][ T7301] usb 7-1: config 14 interface 228 has no altsetting 0 [ 651.254020][ T7301] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 651.254041][ T7301] usb 7-1: Product: syz [ 651.254055][ T7301] usb 7-1: Manufacturer: syz [ 651.254067][ T7301] usb 7-1: SerialNumber: syz [ 651.635851][ T5431] legousbtower 6-1:14.57: interrupt endpoints not found [ 651.669853][ T7301] legousbtower 7-1:14.57: interrupt endpoints not found [ 652.062026][ T5431] legousbtower 6-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 652.063432][ T5431] legousbtower 6-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 652.083930][ T7301] legousbtower 7-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 652.094942][ T7301] legousbtower 7-1:14.228: LEGO USB Tower #-159 now attached to major 180 minor 1 [ 652.111629][T12157] syz.3.1456 (12157) used greatest stack depth: 17336 bytes left [ 652.474497][T12228] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1473'. [ 652.855525][ T57] usb 6-1: USB disconnect, device number 48 [ 652.880727][ T57] legousbtower 6-1:14.228: LEGO USB Tower #-160 now disconnected [ 653.248179][ T7301] usb 8-1: new high-speed USB device number 50 using dummy_hcd [ 653.397883][ T7301] usb 8-1: Using ep0 maxpacket: 8 [ 653.398549][ T7301] usb 8-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 653.399513][ T7301] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 653.399528][ T7301] usb 8-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 653.413954][ T7301] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 653.413973][ T7301] usb 8-1: Product: syz [ 653.413983][ T7301] usb 8-1: Manufacturer: syz [ 653.413992][ T7301] usb 8-1: SerialNumber: syz [ 653.415689][ T7301] usb 8-1: config 0 descriptor?? [ 653.444579][ T43] kauditd_printk_skb: 52 callbacks suppressed [ 653.444596][ T43] audit: type=1800 audit(1789001092.064:1981): pid=12149 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=205930 res=0 errno=0 [ 653.445684][ T43] audit: type=1800 audit(1789001092.074:1982): pid=12149 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="descriptors" dev="sysfs" ino=205962 res=0 errno=0 [ 653.446376][ T43] audit: type=1800 audit(1789001092.074:1983): pid=12149 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="idVendor" dev="sysfs" ino=205937 res=0 errno=0 [ 653.447012][ T43] audit: type=1800 audit(1789001092.074:1984): pid=12149 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="idProduct" dev="sysfs" ino=205938 res=0 errno=0 [ 653.447592][ T43] audit: type=1800 audit(1789001092.074:1985): pid=12149 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="manufacturer" dev="sysfs" ino=205959 res=0 errno=0 [ 653.454872][ T43] audit: type=1800 audit(1789001092.074:1986): pid=12149 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="product" dev="sysfs" ino=205960 res=0 errno=0 [ 653.455645][ T43] audit: type=1800 audit(1789001092.074:1987): pid=12149 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="bcdDevice" dev="sysfs" ino=205939 res=0 errno=0 [ 653.456267][ T43] audit: type=1800 audit(1789001092.074:1988): pid=12149 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="serial" dev="sysfs" ino=205961 res=0 errno=0 [ 653.845331][ T5431] usb 7-1: USB disconnect, device number 58 [ 653.884459][ T5431] legousbtower 7-1:14.228: LEGO USB Tower #-159 now disconnected [ 653.998093][T12240] jffs2: notice: (12240) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 654.498419][ T43] audit: type=1800 audit(1789001093.124:1989): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15406 res=0 errno=0 [ 654.697285][T12247] JFS: discard option not supported on device [ 654.697504][T12247] Mount JFS Failure: -5 [ 654.697514][T12247] jfs_mount failed w/return code = -5 [ 654.912883][ T43] audit: type=1326 audit(1789001093.534:1990): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12248 comm="syz.2.1478" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf708efec code=0x7ffc0000 [ 655.082005][T12249] kvm [12248]: vcpu0, guest rIP: 0x1a3 Unhandled WRMSR(0xc1) = 0x8000 [ 655.837233][ T5431] usb 8-1: USB disconnect, device number 50 [ 656.174609][T12264] [ 656.175739][T12264] ====================================================== [ 656.179388][T12264] WARNING: possible circular locking dependency detected [ 656.193234][T12264] syzkaller #0 Tainted: G L [ 656.196129][T12264] ------------------------------------------------------ [ 656.199695][T12264] syz.3.1482/12264 is trying to acquire lock: [ 656.202576][T12264] ffff88801fcd2070 (&p->frag_sem){.+.+}-{4:4}, at: __configfs_open_file+0xe8/0x9c0 [ 656.207412][T12264] [ 656.207412][T12264] but task is already holding lock: [ 656.210938][T12264] ffff88804e30a588 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: process_measurement+0x5ab/0x2350 [ 656.216844][T12264] [ 656.216844][T12264] which lock already depends on the new lock. [ 656.216844][T12264] [ 656.221837][T12264] [ 656.221837][T12264] the existing dependency chain (in reverse order) is: [ 656.230096][T12264] [ 656.230096][T12264] -> #3 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}: [ 656.234349][T12264] lock_acquire+0x1d1/0x380 [ 656.236800][T12264] __mutex_lock+0x1a4/0x1bd0 [ 656.239155][T12264] process_measurement+0x5ab/0x2350 [ 656.241550][T12264] ima_file_check+0xcc/0x120 [ 656.277704][T12264] security_file_post_open+0xc4/0x210 [ 656.281232][T12264] path_openat+0x5cd/0x2440 [ 656.285051][T12264] do_file_open+0x20e/0x430 [ 656.287777][T12264] do_sys_openat2+0x10f/0x1e0 [ 656.289794][T12264] __x64_sys_openat+0x12d/0x210 [ 656.291817][T12264] do_syscall_64+0x121/0x770 [ 656.303897][T12264] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 656.309133][T12264] [ 656.309133][T12264] -> #2 (sb_writers#5){.+.+}-{0:0}: [ 656.312409][T12264] lock_acquire+0x1d1/0x380 [ 656.316905][T12264] mnt_want_write+0x6f/0x420 [ 656.319663][T12264] lookup_open+0x150/0x1990 [ 656.322338][T12264] path_openat+0xa2c/0x2440 [ 656.325312][T12264] do_file_open+0x20e/0x430 [ 656.328808][T12264] file_open_name+0x1c3/0x3e0 [ 656.334184][T12264] filp_open+0x2e/0x50 [ 656.341341][T12264] nvmet_file_ns_enable+0x95/0x420 [ 656.349721][T12264] nvmet_ns_enable+0x43b/0x650 [ 656.357023][T12264] nvmet_ns_enable_store+0x11e/0x160 [ 656.360715][T12264] configfs_write_iter+0x302/0x4e0 [ 656.364305][T12264] vfs_write+0x6af/0x1050 [ 656.367090][T12264] ksys_write+0x12a/0x250 [ 656.369092][T12264] __do_fast_syscall_32+0x13a/0x8b0 [ 656.371603][T12264] do_fast_syscall_32+0x32/0x70 [ 656.373967][T12264] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 656.377739][T12264] [ 656.377739][T12264] -> #1 (&subsys->lock){+.+.}-{4:4}: [ 656.380817][T12264] lock_acquire+0x1d1/0x380 [ 656.383217][T12264] __mutex_lock+0x1a4/0x1bd0 [ 656.386940][T12264] nvmet_ns_buffered_io_store+0xc0/0x1e0 [ 656.389418][T12264] configfs_write_iter+0x302/0x4e0 [ 656.391615][T12264] vfs_write+0x6af/0x1050 [ 656.393649][T12264] ksys_write+0x12a/0x250 [ 656.395884][T12264] __do_fast_syscall_32+0x13a/0x8b0 [ 656.398528][T12264] do_fast_syscall_32+0x32/0x70 [ 656.400820][T12264] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 656.403713][T12264] [ 656.403713][T12264] -> #0 (&p->frag_sem){.+.+}-{4:4}: [ 656.407402][T12264] check_prev_add+0xeb/0xe60 [ 656.410807][T12264] __lock_acquire+0x1528/0x1f40 [ 656.415524][T12264] lock_acquire+0x1d1/0x380 [ 656.418940][T12264] down_read+0x99/0x4c0 [ 656.421940][T12264] __configfs_open_file+0xe8/0x9c0 [ 656.433063][T12264] do_dentry_open+0x6ab/0x14d0 [ 656.445184][T12264] vfs_open+0x82/0x3f0 [ 656.447097][T12264] dentry_open+0x71/0xd0 [ 656.448930][T12264] ima_calc_file_hash+0xe1/0x380 [ 656.450992][T12264] ima_collect_measurement+0x94f/0xb30 [ 656.453204][T12264] process_measurement+0xdfe/0x2350 [ 656.469586][T12264] ima_file_check+0xcc/0x120 [ 656.472410][T12264] security_file_post_open+0xc4/0x210 [ 656.475670][T12264] path_openat+0x5cd/0x2440 [ 656.478790][T12264] do_file_open+0x20e/0x430 [ 656.482203][T12264] do_sys_openat2+0x10f/0x1e0 [ 656.490952][T12264] __ia32_compat_sys_openat+0x12d/0x210 [ 656.494109][T12264] __do_fast_syscall_32+0x13a/0x8b0 [ 656.502913][T12264] do_fast_syscall_32+0x32/0x70 [ 656.517314][T12264] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 656.520126][T12264] [ 656.520126][T12264] other info that might help us debug this: [ 656.520126][T12264] [ 656.524602][T12264] Chain exists of: [ 656.524602][T12264] &p->frag_sem --> sb_writers#5 --> &ima_iint_mutex_key[depth] [ 656.524602][T12264] [ 656.533493][T12264] Possible unsafe locking scenario: [ 656.533493][T12264] [ 656.549119][T12264] CPU0 CPU1 [ 656.551134][T12264] ---- ---- [ 656.553366][T12264] lock(&ima_iint_mutex_key[depth]); [ 656.562875][T12264] lock(sb_writers#5); [ 656.567854][T12264] lock(&ima_iint_mutex_key[depth]); [ 656.577767][T12264] rlock(&p->frag_sem); [ 656.582464][T12264] [ 656.582464][T12264] *** DEADLOCK *** [ 656.582464][T12264] [ 656.587951][T12264] locks held by syz.3.1482/12264: 1, last CPU#2: [ 656.592006][T12264] #0: ffff88804e30a588 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: process_measurement+0x5ab/0x2350 [ 656.598785][T12264] [ 656.598785][T12264] stack backtrace: [ 656.601212][T12264] CPU: 2 UID: 0 PID: 12264 Comm: syz.3.1482 Tainted: G L syzkaller #0 PREEMPT(full) [ 656.605856][T12264] Tainted: [L]=SOFTLOCKUP [ 656.607718][T12264] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 656.611731][T12264] Call Trace: [ 656.613206][T12264] [ 656.614563][T12264] dump_stack_lvl+0x100/0x190 [ 656.616700][T12264] print_circular_bug.cold+0x178/0x1be [ 656.619712][T12264] check_noncircular+0x146/0x160 [ 656.622003][T12264] ? kasan_save_stack+0x30/0x50 [ 656.624076][T12264] ? process_measurement+0xdfe/0x2350 [ 656.626811][T12264] check_prev_add+0xeb/0xe60 [ 656.628958][T12264] ? do_fast_syscall_32+0x32/0x70 [ 656.631198][T12264] __lock_acquire+0x1528/0x1f40 [ 656.633370][T12264] lock_acquire+0x1d1/0x380 [ 656.635223][T12264] ? __configfs_open_file+0xe8/0x9c0 [ 656.637411][T12264] ? __pfx___might_resched+0x10/0x10 [ 656.639545][T12264] down_read+0x99/0x4c0 [ 656.641221][T12264] ? __configfs_open_file+0xe8/0x9c0 [ 656.643472][T12264] ? __pfx_down_read+0x10/0x10 [ 656.645554][T12264] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 656.648695][T12264] ? __configfs_open_file+0xcb/0x9c0 [ 656.652681][T12264] __configfs_open_file+0xe8/0x9c0 [ 656.655611][T12264] do_dentry_open+0x6ab/0x14d0 [ 656.658301][T12264] ? __pfx_configfs_open_file+0x10/0x10 [ 656.661448][T12264] vfs_open+0x82/0x3f0 [ 656.664008][T12264] dentry_open+0x71/0xd0 [ 656.665983][T12264] ima_calc_file_hash+0xe1/0x380 [ 656.667936][T12264] ima_collect_measurement+0x94f/0xb30 [ 656.670315][T12264] ? __pfx_ima_collect_measurement+0x10/0x10 [ 656.673058][T12264] ? process_measurement+0x5ab/0x2350 [ 656.675273][T12264] ? is_bad_inode+0xd/0x40 [ 656.677644][T12264] ? xattr_resolve_name+0x27d/0x3f0 [ 656.681182][T12264] ? vfs_getxattr_alloc+0xec/0x350 [ 656.684841][T12264] ? ima_get_hash_algo+0x241/0x400 [ 656.688318][T12264] ? __pfx_ima_get_hash_algo+0x10/0x10 [ 656.691782][T12264] ? process_measurement+0xdfe/0x2350 [ 656.694853][T12264] process_measurement+0xdfe/0x2350 [ 656.697702][T12264] ? __pfx_process_measurement+0x10/0x10 [ 656.700165][T12264] ? lock_acquire+0x1d1/0x380 [ 656.702828][T12264] ? __configfs_open_file+0x6ca/0x9c0 [ 656.705982][T12264] ima_file_check+0xcc/0x120 [ 656.707920][T12264] ? __pfx_ima_file_check+0x10/0x10 [ 656.710108][T12264] security_file_post_open+0xc4/0x210 [ 656.712519][T12264] path_openat+0x5cd/0x2440 [ 656.714198][T12264] ? __pfx_path_openat+0x10/0x10 [ 656.716024][T12264] do_file_open+0x20e/0x430 [ 656.717913][T12264] ? __pfx_do_file_open+0x10/0x10 [ 656.719781][T12264] ? _raw_spin_unlock+0x28/0x50 [ 656.722230][T12264] ? alloc_fd+0x471/0x7a0 [ 656.725210][T12264] do_sys_openat2+0x10f/0x1e0 [ 656.729214][T12264] ? __pfx_do_sys_openat2+0x10/0x10 [ 656.733319][T12264] __ia32_compat_sys_openat+0x12d/0x210 [ 656.735888][T12264] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 656.738852][T12264] __do_fast_syscall_32+0x13a/0x8b0 [ 656.741459][T12264] do_fast_syscall_32+0x32/0x70 [ 656.744074][T12264] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 656.748045][T12264] RIP: 0023:0xf6ffefec [ 656.751230][T12264] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 656.754767][T12264] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 656.760057][T12264] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000700 [ 656.766706][T12264] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 656.771760][T12264] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 656.777190][T12264] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 656.780611][T12264] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 656.783846][T12264] [ 656.816765][T12277] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1485'. [ 656.845876][T12271] nbd0: detected capacity change from 0 to 63 [ 657.092682][ T10] usb 6-1: new high-speed USB device number 49 using dummy_hcd [ 657.248168][ T10] usb 6-1: Using ep0 maxpacket: 32 [ 657.250638][ T10] usb 6-1: unable to get BOS descriptor or descriptor too short [ 657.250670][ T10] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 657.251653][ T10] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 657.251675][ T10] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 657.251691][ T10] usb 6-1: config 14 has no interface number 0 [ 657.251704][ T10] usb 6-1: config 14 has no interface number 1 [ 657.251736][ T10] usb 6-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 657.251755][ T10] usb 6-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 657.251775][ T10] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 657.251796][ T10] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 657.251817][ T10] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 657.251838][ T10] usb 6-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 657.251859][ T10] usb 6-1: config 14 interface 57 has no altsetting 0 [ 657.251874][ T10] usb 6-1: config 14 interface 228 has no altsetting 0 [ 657.253934][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 657.253954][ T10] usb 6-1: Product: syz [ 657.253966][ T10] usb 6-1: Manufacturer: syz [ 657.253979][ T10] usb 6-1: SerialNumber: syz [ 657.749395][ T10] legousbtower 6-1:14.57: interrupt endpoints not found [ 658.161543][ T10] legousbtower 6-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 658.178437][ T10] legousbtower 6-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 658.921267][ T7301] usb 6-1: USB disconnect, device number 49 [ 658.926147][ T7301] legousbtower 6-1:14.228: LEGO USB Tower #-160 now disconnected [ 659.118961][ T68] block nbd0: Receive control failed (result -104)