last executing test programs: 5.091572832s ago: executing program 0 (id=2430): timer_getoverrun(0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000540)=ANY=[@ANYRES32=0x0, @ANYRES32, @ANYBLOB='&\x00'/12, @ANYRES32, @ANYBLOB="de6896034bbcb6b7f2b1c08f13ea12f568e87ef55137e9c51acb300b4edd91b1430000dde8c74e5e406c38ef268a449faf90815ace6dddc52cb0d615e995ad59f786e0364789eee5ae6229968a8b188a1f5f0c9c5ce25e0a8639bbc061572b83781ebd7104617ca7f6e45e2cddd81f777a5f5bd885d55bc10b76d87ad6dc7ea6e19ca9891f062c91bc42940cbc35608d8bbe197ba80fb6405c56660c5124d37690fac67816", @ANYRES64=0x0], 0x20) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="9feb0100180000000000000028000000280000000500000003e7bdad5800000000000200000034aa000000000000000f02000000"], &(0x7f00000003c0)=""/143, 0x45, 0x8f, 0x1}, 0x28) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) io_setup(0x4, &(0x7f0000000080)) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x0, &(0x7f0000000040)}) ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, &(0x7f0000001900)={0x2, {0x2, 0x4f00, 0x100, 0x100, 0x1, 0x4000}}) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f1, &(0x7f0000000340)={'ip6tnl0\x00', &(0x7f00000001c0)=@ethtool_cmd={0x0, 0x5, 0x0, 0x0, 0x20, 0x80, 0x3, 0xfc, 0x0, 0x1, 0x0, 0x8, 0x131, 0xff, 0x80, 0x0, [0x0, 0xfffffffe]}}) socket$netlink(0x10, 0x3, 0x2) 4.171297867s ago: executing program 0 (id=2431): r0 = gettid() timer_create(0x7, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)=0x0) timer_settime(r1, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) r2 = socket(0x28, 0x5, 0x0) r3 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r3, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(r3, 0x10000008) connect$vsock_stream(r2, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) recvfrom$inet_nvme(r2, 0x0, 0xfffffffffffffea6, 0x40000002, 0x0, 0x0) 3.430929798s ago: executing program 2 (id=2438): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) r3 = syz_open_dev$loop(&(0x7f0000000000), 0x9, 0xa001) ioctl$BLKIOOPT(r3, 0x1279, &(0x7f0000003980)) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[{@xino_on}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) chdir(&(0x7f0000000100)='./file0\x00') r5 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./bus\x00', 0x0, 0x180) fstat(r5, &(0x7f0000003600)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0xdd008d5803396e68}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000014c0)=@newtfilter={0x490, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0xb, 0xd}, {0x0, 0xf}, {0x7, 0xffe0}}, [@filter_kind_options=@f_basic={{0xa}, {0x450, 0x2, [@TCA_BASIC_POLICE={0x44c, 0x4, [@TCA_POLICE_TBF={0x3c, 0x1, {0x2, 0x6, 0x1, 0x7, 0x7fff, {0x6, 0x1, 0x6, 0xb92, 0x81, 0x9}, {0x9, 0x1, 0x6, 0x100, 0x6}, 0x10000, 0x11e4, 0x3}}, @TCA_POLICE_RATE={0x404, 0x2, [0x6, 0x3, 0xc396, 0x2, 0x2, 0x9, 0x2, 0xfffffff9, 0x8, 0x101, 0xff, 0x9, 0x4, 0x9, 0x0, 0xf, 0x5, 0x4, 0x4a96, 0x4, 0xffffffff, 0x5, 0x1000, 0x2, 0x2, 0x1, 0x6, 0x7, 0x9, 0x68a2, 0x6, 0x7, 0x3, 0x4, 0x7, 0x7ff, 0x2, 0x4, 0xfffffff9, 0x6, 0x7, 0x1, 0x5, 0xffffff7f, 0x6e, 0x0, 0x5, 0x0, 0x3, 0x9674, 0x9, 0x401, 0x7, 0x5, 0x5, 0x101, 0x5, 0x6, 0xa8e, 0xfe, 0xa9, 0x60, 0x80000001, 0x5, 0x1, 0x401, 0x800, 0x9, 0x6, 0x6, 0x9, 0x0, 0x2, 0xc32, 0x92ae, 0xfffffff8, 0x9, 0x1, 0x3, 0x77a, 0x7, 0x7, 0x31, 0x9, 0x4, 0x6, 0x5, 0xa58, 0x8, 0xffff, 0x8000, 0x9, 0x6, 0x2, 0x1, 0x0, 0x1, 0x2, 0x0, 0xa, 0xe1f, 0x7, 0xfffffffd, 0x1, 0xc4, 0x2, 0x80000001, 0x28, 0xe, 0xff, 0x4cd2, 0xfffffffa, 0x6e, 0xff, 0x0, 0x2, 0x57c6, 0x8, 0x80000001, 0x7, 0x7, 0x2, 0x3ff, 0xa, 0x5, 0x81a, 0x3, 0x5, 0x3, 0x8, 0x2, 0x9, 0x9, 0x91, 0x9, 0x8, 0x800, 0x2, 0x3, 0x7, 0x4, 0x10, 0xfffffffb, 0xfff, 0xfffffff8, 0x7, 0x1, 0x8, 0x1, 0x6, 0x4000020, 0x2026ee35, 0x0, 0x7fffffff, 0xfffffffc, 0x1, 0x4, 0x6, 0xf, 0x9, 0x1, 0xc, 0x4, 0xc166, 0x6, 0xfffffffa, 0xfffff466, 0x0, 0x0, 0x8, 0x8, 0x6, 0x7fffffff, 0xe5f, 0x5, 0xe0, 0x4, 0xfffffffb, 0x1, 0x247800, 0x0, 0xa6f7, 0x2, 0x5, 0xf, 0x0, 0x9, 0x9, 0x9, 0x2, 0x2, 0xb91, 0x401, 0x73a7, 0x0, 0xa9fd, 0x4, 0x0, 0x10001, 0x0, 0xff, 0xfffffff3, 0x2, 0xb8ec, 0x8, 0x1, 0x8, 0xb, 0x7fff, 0x0, 0xa2a, 0xe, 0x80000001, 0x10000, 0x17c3, 0xfffffffe, 0x1, 0x80000000, 0x8, 0x7e54, 0x2, 0xe6, 0x9, 0x5b, 0x9, 0x5, 0x3, 0x1, 0xd25, 0x3, 0xa, 0x8, 0x0, 0xdd55, 0x6, 0x1, 0x400, 0x4, 0x8, 0xe8, 0x8bef, 0x4, 0x400, 0x2, 0x2, 0x1, 0x6, 0x3fb9, 0x7, 0x5, 0x4, 0x0, 0x62e0, 0x9, 0x4, 0x4]}, @TCA_POLICE_AVRATE={0x8, 0x4, 0xfff}]}]}}, @TCA_RATE={0x6, 0x5, {0x1, 0x2}}, @TCA_RATE={0x6, 0x5, {0x40, 0xb6}}]}, 0x490}, 0x1, 0x0, 0x0, 0x20041090}, 0xd0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000e00)=@bpf_lsm={0x1f, 0x5, &(0x7f0000000000)=ANY=[@ANYRES64=r0], &(0x7f0000000100)='GPL\x00', 0x2, 0xc4, &(0x7f00000002c0)=""/196, 0x0, 0x0, '\x00', r4}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x10, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x0, 0x1, 0x36}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x80) socket$pptp(0x18, 0x1, 0x2) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xab}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x5}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x2b2, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) 3.179143694s ago: executing program 0 (id=2439): bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0}, 0x90) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0xb, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r1, 0x2000000, 0xe, 0x0, &(0x7f0000000600)="c9f7b98600"/14, 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f00000003c0)=0xffffffff80000002, 0x30) syz_usb_connect(0x0, 0x3f, &(0x7f0000000000)=ANY=[], 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) bind$can_raw(0xffffffffffffffff, &(0x7f00000001c0)={0x1d, r2}, 0x10) recvmmsg(0xffffffffffffffff, &(0x7f0000000a00)=[{{0x0, 0x0, 0x0}, 0x2fa}], 0x1, 0x42, 0x0) 2.516962086s ago: executing program 2 (id=2442): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r0, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x2000002, 0x3a, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 2.361276788s ago: executing program 2 (id=2443): r0 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=ANY=[@ANYBLOB="14000000040000000800000006"], 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r0, &(0x7f0000000280), &(0x7f0000000a80)=@udp6}, 0x20) 2.360937183s ago: executing program 2 (id=2444): socket$nl_generic(0x10, 0x3, 0x10) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x40, 0x6) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="0600000004000000040000000f"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000d40)={0xffffffffffffffff, 0xffffffffffffffff}) socket$netlink(0x10, 0x3, 0x2) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000014c0), 0xe8}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, 0x0, 0x4004000) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000680), 0x901800, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000040)={0x3, 0x2, 0x3000, 0x1000, &(0x7f0000feb000/0x1000)=nil}) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xa, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="7b87f20f", @ANYRES64=r7], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) syz_kvm_setup_cpu$x86(r6, r7, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x4, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) 2.080969645s ago: executing program 2 (id=2445): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xb, 0xc, 0x4, 0xc4f, 0x1, 0x1}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000100), 0x6c7, r2}, 0x38) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180), &(0x7f0000000440), 0x23, r2}, 0x38) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000100)=ANY=[@ANYBLOB="b40000001900010000000000000000001d0109004d0011806f9886ff8308eb1d7c03414adb7fa1c790a421ea2a089f6ab00ada4e5605b2e72655b3cc4c48e609000cf5329cb7f1821ec7ecca1db0eb2d7144f29af11fe655838a74d923d12c78e80000004d0010"], 0xb4}, 0x1, 0x0, 0x0, 0x8000}, 0x0) 2.057934553s ago: executing program 2 (id=2446): capset(&(0x7f0000000100)={0x20080522}, 0x0) ioctl$FS_IOC_FIEMAP(0xffffffffffffffff, 0xc020660b, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x80000, 0x4) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_RUN(r0, 0xae80, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x1, &(0x7f0000000240)=0x7) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) r5 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r5, &(0x7f0000002140)={0xa, 0x4e25, 0x1, @mcast2, 0x5}, 0x1c) write$binfmt_misc(r3, &(0x7f0000000000), 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x7151, 0x0) 1.72052373s ago: executing program 3 (id=2459): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xf, 0x4, 0x8, 0xc}, 0x50) write$binfmt_elf32(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="7f454c4604070001040000000000040002000600030000000903000038000104ce0000000e"], 0x58) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)={@multicast1, @local}, 0xc) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000440)={[0x0, 0x100000000, 0x0, 0x7f, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x0, 0x7, 0x0, 0x5, 0x0, 0x2, 0xffffffffffffffff], 0x4000, 0x200}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)={[0x101, 0xaec4, 0x6, 0x4004, 0x2, 0x2, 0xefffffffffffffff, 0x0, 0x0, 0x2000000, 0x20000, 0x1c, 0x0, 0x5, 0x5b9e, 0x7], 0x0, 0x341b82}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.441195033s ago: executing program 3 (id=2463): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_int(r3, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000240)) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000440)={@in6={{0xa, 0x4e23, 0x9, @empty, 0xa}}, 0x0, 0x0, 0x49, 0x0, "c00866fdc25aca6c451dbae34eeb6cc3904fddf83259e584824efe263c8eef3e3a2f4a231e46f2e5d0c491fd99bb68ec8293d502fcfeafa0dec2fac1fd9b716c8a628631f326f2d8d5f495dec117c4d8"}, 0xd8) unshare(0x42000000) 532.347399ms ago: executing program 3 (id=2470): r0 = socket(0x10, 0x80002, 0x0) capset(&(0x7f0000000040)={0x20071026}, &(0x7f00000002c0)={0x6, 0x6, 0x1000002, 0x87, 0xffffffff, 0x3fe}) fsetxattr$trusted_overlay_nlink(r0, &(0x7f0000000200), 0x0, 0x0, 0x0) 471.470959ms ago: executing program 3 (id=2471): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x12, 0x4, &(0x7f00000005c0)=ANY=[@ANYBLOB="18000000010000000000000000000000711808000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @cgroup_sock_addr=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000080)=@generic={0x0, r0}, 0x18) 471.275059ms ago: executing program 3 (id=2472): r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) lseek(r0, 0x851, 0x0) 387.131275ms ago: executing program 3 (id=2473): r0 = syz_usb_connect(0x3, 0x64, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000cb8be7406d04230848390102030109025200010000000009044000000e0100000a240608000b020102000600040007000300390c2402050302", @ANYRESOCT=0x0], 0x0) syz_usb_control_io$lan78xx(r0, &(0x7f0000000400)={0x14, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00032e0000002e033ec60aa846e8650486e243edc1808cda6a87c05c2b055ab3668c4994f3cd8cf6279469d87f33f1c8f791d3"]}, 0x0) 331.297731ms ago: executing program 1 (id=2474): r0 = socket(0x840000000002, 0x3, 0xfa) syz_genetlink_get_family_id$tipc(&(0x7f0000000040), r0) 271.058848ms ago: executing program 1 (id=2475): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000640)=ANY=[@ANYBLOB="840100001000330629bd700000000000fc020000000000000000000000000000ac1e00010000000000000000000000000000000900"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000fffffffd3c000000fc02000000000000000000000000000000000000000000000000000000000000000000000000ff030000000000000000030000000000000000000000000000000000000000000000fcffffffffffffff00000000000000000000000000000000000000000000000007000000000000000000000000000000000000000200000000000000020004000000000000000000880002"], 0x184}}, 0x0) 270.85016ms ago: executing program 1 (id=2476): capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000140)={0x0, 0x40000000, 0x80000804, 0x81, 0xfffffffb, 0xffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x19, 0x6, 0x0, &(0x7f0000000780)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0xe, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 190.933459ms ago: executing program 1 (id=2477): r0 = socket(0xa, 0x3, 0xff) setsockopt$inet6_int(r0, 0x29, 0x5, &(0x7f0000000040)=0xfffffff9, 0x4) syz_emit_ethernet(0x4e, &(0x7f00000001c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa3986dd6c370c8900182b01fe800000000000000000000000000025fe8000000000000000000000000000aaff"], 0x0) recvmmsg(r0, &(0x7f00000008c0)=[{{0x0, 0xffffffffffffff88, 0x0, 0x0, &(0x7f0000000340)=""/12, 0xc}, 0x10000007}], 0x1, 0x100, 0x0) 190.61321ms ago: executing program 1 (id=2478): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xa, 0x4, 0x2, 0x7, 0x12, 0x1}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x9}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r1}, 0xc) 95.243037ms ago: executing program 0 (id=2479): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='attr/current\x00') write$binfmt_script(r0, 0x0, 0x0) 94.973631ms ago: executing program 1 (id=2480): openat(0xffffffffffffff9c, &(0x7f00000002c0)='./cgroup/pids.max\x00', 0xc8442, 0x11) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x593a, &(0x7f0000000240)=0x0) io_submit(r1, 0x2000000000000390, &(0x7f0000001300)=[&(0x7f0000000380)={0x0, 0x0, 0x0, 0x5, 0x6, r0, 0x0}]) 93.667141ms ago: executing program 0 (id=2481): bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x19, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x41000, 0x1c, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x1d, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0a000000070000000080000001"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r0, 0xffffffffffffffff}, &(0x7f00000002c0), &(0x7f0000000280)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000d0039000000000000b4a518110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r2, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 0s ago: executing program 0 (id=2482): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x800000, 0x1, 0x1000, 0x800}, 0x10) mmap(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x3, 0x11, r0, 0x0) pipe2(&(0x7f0000000200)={0x0, 0x0}, 0x0) write(r2, &(0x7f0000000210)="01", 0x1) read(r1, &(0x7f0000800000)=""/8, 0x8) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000280)={'wg0\x00', 0x0}) sendto$packet(r0, 0x0, 0x0, 0x4000010, &(0x7f0000000000)={0x11, 0x10, r4, 0x1, 0x0, 0x0, @multicast}, 0x14) kernel console output (not intermixed with test programs): 344.123684][ T42] audit: type=1326 audit(1786170118.614:311): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11592 comm="syz.3.1977" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 344.132656][ T42] audit: type=1326 audit(1786170118.614:312): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11592 comm="syz.3.1977" exe="/syz-executor" sig=0 arch=40000003 syscall=436 compat=1 ip=0xf701efec code=0x7ffc0000 [ 344.142243][ T42] audit: type=1326 audit(1786170118.624:313): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11592 comm="syz.3.1977" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 344.151896][ T42] audit: type=1326 audit(1786170118.634:314): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11592 comm="syz.3.1977" exe="/syz-executor" sig=0 arch=40000003 syscall=395 compat=1 ip=0xf701efec code=0x7ffc0000 [ 344.183581][T11384] dvb-usb: bulk message failed: -22 (1/0) [ 344.185966][T11384] dvb-usb: error while querying for an remote control event. [ 344.300135][ T42] audit: type=1326 audit(1786170118.794:315): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11592 comm="syz.3.1977" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 344.308797][ T42] audit: type=1326 audit(1786170118.794:316): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11592 comm="syz.3.1977" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 344.343584][T11384] dvb-usb: bulk message failed: -22 (1/0) [ 344.345466][T11384] dvb-usb: error while querying for an remote control event. [ 344.386000][T11589] uhci_hcd 0000:00:1d.0: UHCI Host Controller [ 344.411617][T11589] uhci_hcd 0000:00:1d.0: new USB bus registered, assigned bus number 1 [ 344.423714][T11589] uhci_hcd 0000:00:1d.0: detected 2 ports [ 344.426280][T11589] uhci_hcd 0000:00:1d.0: irq 16, io port 0x0000c0e0 [ 344.433370][T11589] usb usb1: New USB device found, idVendor=1d6b, idProduct=0001, bcdDevice= 7.02 [ 344.437172][T11589] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 344.442222][T11589] usb usb1: Product: UHCI Host Controller [ 344.444435][T11589] usb usb1: Manufacturer: Linux syzkaller uhci_hcd [ 344.447913][T11589] usb usb1: SerialNumber: 0000:00:1d.0 [ 344.479800][T11589] hub 1-0:1.0: USB hub found [ 344.495867][T11589] hub 1-0:1.0: 2 ports detected [ 344.503576][T11384] dvb-usb: bulk message failed: -22 (1/0) [ 344.510173][T11384] dvb-usb: error while querying for an remote control event. [ 344.686664][T11384] dvb-usb: bulk message failed: -22 (1/0) [ 344.688832][T11384] dvb-usb: error while querying for an remote control event. [ 344.853529][T11384] dvb-usb: bulk message failed: -22 (1/0) [ 344.871195][T11384] dvb-usb: error while querying for an remote control event. [ 344.886330][T11604] uhci_hcd 0000:00:1d.0: remove, state 4 [ 344.891360][T11604] usb usb1: USB disconnect, device number 1 [ 344.920763][T11604] uhci_hcd 0000:00:1d.0: USB bus 1 deregistered [ 345.033849][T11384] dvb-usb: bulk message failed: -22 (1/0) [ 345.039616][T11384] dvb-usb: error while querying for an remote control event. [ 345.060057][T11384] usb 5-1: USB disconnect, device number 21 [ 345.112402][T11384] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I successfully deinitialized and disconnected. [ 345.153009][T11606] binder: 11603:11606 ioctl 400c620e 80000440 returned -22 [ 345.391262][T11605] uhci_hcd 0000:00:1d.0: UHCI Host Controller [ 345.397793][T11605] uhci_hcd 0000:00:1d.0: new USB bus registered, assigned bus number 1 [ 345.403169][T11605] uhci_hcd 0000:00:1d.0: detected 2 ports [ 345.405935][T11605] uhci_hcd 0000:00:1d.0: irq 16, io port 0x0000c0e0 [ 345.449630][T11605] usb usb1: New USB device found, idVendor=1d6b, idProduct=0001, bcdDevice= 7.02 [ 345.455141][T11605] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 345.460140][T11605] usb usb1: Product: UHCI Host Controller [ 345.462818][T11605] usb usb1: Manufacturer: Linux syzkaller uhci_hcd [ 345.465827][T11605] usb usb1: SerialNumber: 0000:00:1d.0 [ 345.543951][T11605] hub 1-0:1.0: USB hub found [ 345.549662][T11605] hub 1-0:1.0: 2 ports detected [ 345.683717][T11384] usb 8-1: new high-speed USB device number 15 using dummy_hcd [ 345.843861][T11384] usb 8-1: Using ep0 maxpacket: 32 [ 345.850232][T11384] usb 8-1: unable to get BOS descriptor or descriptor too short [ 345.855056][T11384] usb 8-1: config 14 has an invalid interface number: 57 but max is 1 [ 345.857721][T11384] usb 8-1: config 14 has an invalid interface number: 228 but max is 1 [ 345.860342][T11384] usb 8-1: config 14 has no interface number 0 [ 345.862357][T11384] usb 8-1: config 14 has no interface number 1 [ 345.865152][T11384] usb 8-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 345.868712][T11384] usb 8-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 345.872996][T11384] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 345.878498][T11384] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 345.882335][T11384] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 345.886551][T11384] usb 8-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 345.891569][T11384] usb 8-1: config 14 interface 57 has no altsetting 0 [ 345.894553][T11384] usb 8-1: config 14 interface 228 has no altsetting 0 [ 345.901407][T11384] usb 8-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 345.908090][T11384] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 345.912978][T11384] usb 8-1: Product: syz [ 345.914830][T11384] usb 8-1: Manufacturer: syz [ 345.916343][T11384] usb 8-1: SerialNumber: syz [ 345.943568][ T5840] usb 7-1: new high-speed USB device number 21 using dummy_hcd [ 346.094072][ T5840] usb 7-1: Using ep0 maxpacket: 32 [ 346.101019][ T5840] usb 7-1: unable to get BOS descriptor or descriptor too short [ 346.107159][ T5840] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 346.111148][ T5840] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 346.115288][ T5840] usb 7-1: config 14 has no interface number 0 [ 346.118199][ T5840] usb 7-1: config 14 has no interface number 1 [ 346.120838][ T5840] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 346.126692][ T5840] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 346.131444][ T5840] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 346.137124][ T5840] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 346.142109][ T5840] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 346.145780][ T5840] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 346.151520][ T5840] usb 7-1: config 14 interface 57 has no altsetting 0 [ 346.154270][ T5840] usb 7-1: config 14 interface 228 has no altsetting 0 [ 346.159787][ T5840] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 346.164061][ T5840] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 346.167354][ T5840] usb 7-1: Product: syz [ 346.169045][ T5840] usb 7-1: Manufacturer: syz [ 346.170781][ T5840] usb 7-1: SerialNumber: syz [ 346.344215][T11384] legousbtower 8-1:14.57: interrupt endpoints not found [ 346.601241][ T5840] legousbtower 7-1:14.57: interrupt endpoints not found [ 346.871765][T11384] legousbtower 8-1:14.228: get version request failed: -71 [ 346.876747][T11384] legousbtower 8-1:14.228: probe with driver legousbtower failed with error -71 [ 346.887247][T11384] usb 8-1: USB disconnect, device number 15 [ 347.173734][ T5807] usb 5-1: new full-speed USB device number 22 using dummy_hcd [ 347.185160][ T5840] legousbtower 7-1:14.228: get version request failed: -71 [ 347.188377][ T5840] legousbtower 7-1:14.228: probe with driver legousbtower failed with error -71 [ 347.206531][ T5840] usb 7-1: USB disconnect, device number 21 [ 347.335289][ T5807] usb 5-1: config 0 has an invalid interface number: 205 but max is 0 [ 347.338276][ T5807] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 347.341935][ T5807] usb 5-1: config 0 has no interface number 0 [ 347.344878][ T5807] usb 5-1: config 0 interface 205 has no altsetting 0 [ 347.349854][ T5807] usb 5-1: New USB device found, idVendor=1822, idProduct=3202, bcdDevice=13.4a [ 347.353094][ T5807] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 347.355882][ T5807] usb 5-1: Product: syz [ 347.357434][ T5807] usb 5-1: Manufacturer: syz [ 347.359120][ T5807] usb 5-1: SerialNumber: syz [ 347.364885][ T5807] usb 5-1: config 0 descriptor?? [ 347.370133][ T5807] dvb-usb: found a 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' in warm state. [ 347.374842][ T5807] dvb-usb: bulk message failed: -22 (3/0) [ 347.397087][ T5807] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 347.401430][ T5807] dvbdev: DVB: registering new adapter (TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device) [ 347.406136][ T5807] usb 5-1: media controller created [ 347.409659][ T5807] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 347.417602][ T5807] dvb-usb: bulk message failed: -22 (6/0) [ 347.420281][ T5807] dvb-usb: no frontend was attached by 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' [ 347.427447][ T5807] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb5/5-1/input/input27 [ 347.434067][ T5807] dvb-usb: schedule remote query interval to 150 msecs. [ 347.437994][ T5807] dvb-usb: bulk message failed: -22 (3/0) [ 347.453602][ T5807] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device successfully initialized and connected. [ 347.593555][ T5807] dvb-usb: bulk message failed: -22 (1/0) [ 347.595822][ T5807] dvb-usb: error while querying for an remote control event. [ 347.753556][ T5807] dvb-usb: bulk message failed: -22 (1/0) [ 347.759228][ T5807] dvb-usb: error while querying for an remote control event. [ 347.787415][T11648] random: crng reseeded on system resumption [ 347.881236][T11651] netlink: 'syz.2.1992': attribute type 1 has an invalid length. [ 347.912134][T11651] 8021q: adding VLAN 0 to HW filter on device bond2 [ 347.923620][ T5807] dvb-usb: bulk message failed: -22 (1/0) [ 347.929418][ T5807] dvb-usb: error while querying for an remote control event. [ 347.949401][T11651] bond2: (slave dummy0): making interface the new active one [ 347.958330][T11651] bond2: (slave dummy0): Enslaving as an active interface with an up link [ 348.093597][ T5807] dvb-usb: bulk message failed: -22 (1/0) [ 348.096729][ T5807] dvb-usb: error while querying for an remote control event. [ 348.254063][ T5807] dvb-usb: bulk message failed: -22 (1/0) [ 348.256969][ T5807] dvb-usb: error while querying for an remote control event. [ 348.413579][ T5807] dvb-usb: bulk message failed: -22 (1/0) [ 348.418540][ T5807] dvb-usb: error while querying for an remote control event. [ 348.465250][T11659] jffs2: notice: (11659) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 348.477984][T11659] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1995'. [ 348.559780][T11662] overlayfs: failed to resolve './file0': -2 [ 348.587270][ T5807] dvb-usb: bulk message failed: -22 (1/0) [ 348.589222][ T5807] dvb-usb: error while querying for an remote control event. [ 348.744236][ T102] dvb-usb: bulk message failed: -22 (1/0) [ 348.746970][ T102] dvb-usb: error while querying for an remote control event. [ 348.913567][ T102] dvb-usb: bulk message failed: -22 (1/0) [ 348.913938][T11384] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 348.915971][ T5807] usb 8-1: new high-speed USB device number 16 using dummy_hcd [ 348.922607][ T102] dvb-usb: error while querying for an remote control event. [ 349.083561][T11384] usb 7-1: Using ep0 maxpacket: 32 [ 349.083591][ T102] dvb-usb: bulk message failed: -22 (1/0) [ 349.088606][ T5807] usb 8-1: Using ep0 maxpacket: 32 [ 349.090758][T11384] usb 7-1: unable to get BOS descriptor or descriptor too short [ 349.091728][T11384] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 349.094296][ T102] dvb-usb: error while querying for an remote control event. [ 349.100922][T11384] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 349.107205][T11384] usb 7-1: config 14 has no interface number 0 [ 349.108307][ T5807] usb 8-1: unable to get BOS descriptor or descriptor too short [ 349.110032][T11384] usb 7-1: config 14 has no interface number 1 [ 349.117977][T11384] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 349.119264][ T5807] usb 8-1: config 14 has an invalid interface number: 57 but max is 1 [ 349.122709][T11384] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 349.126354][ T5807] usb 8-1: config 14 has an invalid interface number: 228 but max is 1 [ 349.132459][T11384] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 349.138780][ T5807] usb 8-1: config 14 has no interface number 0 [ 349.139786][T11384] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 349.142233][ T5807] usb 8-1: config 14 has no interface number 1 [ 349.148015][T11384] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 349.150070][ T5807] usb 8-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 349.155027][T11384] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 349.159191][ T5807] usb 8-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 349.165175][T11384] usb 7-1: config 14 interface 57 has no altsetting 0 [ 349.169832][ T5807] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 349.172754][T11384] usb 7-1: config 14 interface 228 has no altsetting 0 [ 349.175483][T11384] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 349.177596][ T5807] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 349.180722][T11384] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 349.184157][ T5807] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 349.189365][T11384] usb 7-1: Product: syz [ 349.192416][ T5807] usb 8-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 349.197244][T11384] usb 7-1: Manufacturer: syz [ 349.198806][ T5807] usb 8-1: config 14 interface 57 has no altsetting 0 [ 349.204480][T11384] usb 7-1: SerialNumber: syz [ 349.206363][ T5807] usb 8-1: config 14 interface 228 has no altsetting 0 [ 349.216234][ T5807] usb 8-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 349.220310][ T5807] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 349.224231][ T5807] usb 8-1: Product: syz [ 349.226091][ T5807] usb 8-1: Manufacturer: syz [ 349.228191][ T5807] usb 8-1: SerialNumber: syz [ 349.253774][ T102] dvb-usb: bulk message failed: -22 (1/0) [ 349.256999][ T102] dvb-usb: error while querying for an remote control event. [ 349.414655][ T102] dvb-usb: bulk message failed: -22 (1/0) [ 349.417320][ T102] dvb-usb: error while querying for an remote control event. [ 349.573766][ T102] dvb-usb: bulk message failed: -22 (1/0) [ 349.576811][ T102] dvb-usb: error while querying for an remote control event. [ 349.637792][T11384] legousbtower 7-1:14.57: interrupt endpoints not found [ 349.653886][ T5807] legousbtower 8-1:14.57: interrupt endpoints not found [ 349.743606][ T102] dvb-usb: bulk message failed: -22 (1/0) [ 349.746325][ T102] dvb-usb: error while querying for an remote control event. [ 349.863010][ T102] usb 5-1: USB disconnect, device number 22 [ 349.909616][ T102] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I successfully deinitialized and disconnected. [ 350.074247][T11672] nvme_tcp: malformed address passed: 127.0.0.1:44.0 [ 350.123997][ T5807] legousbtower 8-1:14.228: LEGO USB Tower firmware version is 175.69 build 32768 [ 350.139371][ T5807] legousbtower 8-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 350.146652][T11684] x_tables: duplicate underflow at hook 1 [ 350.179146][T11384] legousbtower 7-1:14.228: get version request failed: -71 [ 350.182549][T11384] legousbtower 7-1:14.228: probe with driver legousbtower failed with error -71 [ 350.194145][T11384] usb 7-1: USB disconnect, device number 22 [ 350.730439][T11689] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(1) [ 350.898880][ T5812] usb 8-1: USB disconnect, device number 16 [ 350.917691][ T5812] legousbtower 8-1:14.228: LEGO USB Tower #-160 now disconnected [ 351.016133][T11696] jffs2: notice: (11696) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 351.803401][T11711] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 351.853739][ T5807] usb 8-1: new full-speed USB device number 17 using dummy_hcd [ 351.872169][T11713] loop0: detected capacity change from 0 to 32768 [ 351.876834][T11713] device-mapper: ioctl: name not supplied when creating device [ 351.973793][T11719] /dev/sg0: Can't lookup blockdev [ 352.005868][ T5807] usb 8-1: config 0 has an invalid interface number: 205 but max is 0 [ 352.010684][ T5807] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 352.022135][ T5807] usb 8-1: config 0 has no interface number 0 [ 352.025928][ T5807] usb 8-1: config 0 interface 205 has no altsetting 0 [ 352.043072][ T5807] usb 8-1: New USB device found, idVendor=1822, idProduct=3202, bcdDevice=13.4a [ 352.047143][ T5807] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 352.050449][ T5807] usb 8-1: Product: syz [ 352.052210][ T5807] usb 8-1: Manufacturer: syz [ 352.054891][ T5807] usb 8-1: SerialNumber: syz [ 352.070621][ T5807] usb 8-1: config 0 descriptor?? [ 352.082950][ T5807] dvb-usb: found a 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' in warm state. [ 352.102151][ T5807] dvb-usb: bulk message failed: -22 (3/0) [ 352.130696][ T5807] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 352.135198][ T5807] dvbdev: DVB: registering new adapter (TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device) [ 352.140774][ T5807] usb 8-1: media controller created [ 352.151533][ T5807] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 352.165042][ T5807] dvb-usb: bulk message failed: -22 (6/0) [ 352.169408][ T5807] dvb-usb: no frontend was attached by 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' [ 352.176010][T11724] x_tables: duplicate underflow at hook 1 [ 352.181895][ T5807] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb8/8-1/input/input28 [ 352.189993][ T5807] dvb-usb: schedule remote query interval to 150 msecs. [ 352.193124][ T5807] dvb-usb: bulk message failed: -22 (3/0) [ 352.213543][ T5807] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device successfully initialized and connected. [ 352.343558][ T5807] dvb-usb: bulk message failed: -22 (1/0) [ 352.346779][ T5807] dvb-usb: error while querying for an remote control event. [ 352.503576][ T5807] dvb-usb: bulk message failed: -22 (1/0) [ 352.506113][ T5807] dvb-usb: error while querying for an remote control event. [ 352.619004][T11739] jffs2: notice: (11739) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 352.626095][T11384] usb 7-1: new high-speed USB device number 23 using dummy_hcd [ 352.641587][T11739] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2021'. [ 352.663617][ T5807] dvb-usb: bulk message failed: -22 (1/0) [ 352.666440][ T5807] dvb-usb: error while querying for an remote control event. [ 352.794840][T11384] usb 7-1: Using ep0 maxpacket: 32 [ 352.799785][T11384] usb 7-1: unable to get BOS descriptor or descriptor too short [ 352.804789][T11384] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 352.808681][T11384] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 352.812158][T11384] usb 7-1: config 14 has no interface number 0 [ 352.817735][T11384] usb 7-1: config 14 has no interface number 1 [ 352.820549][T11384] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 352.823647][ T5807] dvb-usb: bulk message failed: -22 (1/0) [ 352.825389][T11384] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 352.827836][ T5807] dvb-usb: error while querying for an remote control event. [ 352.832453][T11384] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 352.844414][T11384] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 352.849325][T11384] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 352.855468][T11384] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 352.860986][T11384] usb 7-1: config 14 interface 57 has no altsetting 0 [ 352.864292][T11384] usb 7-1: config 14 interface 228 has no altsetting 0 [ 352.870137][T11384] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 352.874389][T11384] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 352.877830][T11384] usb 7-1: Product: syz [ 352.879769][T11384] usb 7-1: Manufacturer: syz [ 352.881876][T11384] usb 7-1: SerialNumber: syz [ 352.994149][ T5807] dvb-usb: bulk message failed: -22 (1/0) [ 352.999310][ T5807] dvb-usb: error while querying for an remote control event. [ 353.163764][ T5807] dvb-usb: bulk message failed: -22 (1/0) [ 353.166020][ T5807] dvb-usb: error while querying for an remote control event. [ 353.323664][ T5807] dvb-usb: bulk message failed: -22 (1/0) [ 353.326448][ T5807] dvb-usb: error while querying for an remote control event. [ 353.358475][T11384] legousbtower 7-1:14.57: interrupt endpoints not found [ 353.483716][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 353.485627][ T10] dvb-usb: error while querying for an remote control event. [ 353.653921][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 353.658471][ T10] dvb-usb: error while querying for an remote control event. [ 353.800784][T11384] legousbtower 7-1:14.228: LEGO USB Tower firmware version is 175.69 build 32768 [ 353.808063][T11384] legousbtower 7-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 353.823600][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 353.828462][ T10] dvb-usb: error while querying for an remote control event. [ 354.003616][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 354.006056][ T10] dvb-usb: error while querying for an remote control event. [ 354.163660][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 354.169486][ T10] dvb-usb: error while querying for an remote control event. [ 354.341682][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 354.348114][ T10] dvb-usb: error while querying for an remote control event. [ 354.513739][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 354.523527][ T10] dvb-usb: error while querying for an remote control event. [ 354.577314][T11384] usb 7-1: USB disconnect, device number 23 [ 354.605943][T11384] legousbtower 7-1:14.228: LEGO USB Tower #-160 now disconnected [ 354.627322][ T5840] usb 8-1: USB disconnect, device number 17 [ 354.654534][ T5840] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I successfully deinitialized and disconnected. [ 354.929606][T11758] binder: 11756:11758 ioctl 400c620e 80000440 returned -22 [ 354.983036][T11763] FAULT_INJECTION: forcing a failure. [ 354.983036][T11763] name failslab, interval 1, probability 0, space 0, times 0 [ 354.991662][T11763] CPU: 2 UID: 0 PID: 11763 Comm: syz.1.2027 Tainted: G L syzkaller #0 PREEMPT(full) [ 354.991694][T11763] Tainted: [L]=SOFTLOCKUP [ 354.991703][T11763] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 354.991715][T11763] Call Trace: [ 354.991738][T11763] [ 354.991748][T11763] dump_stack_lvl+0x100/0x190 [ 354.991777][T11763] should_fail_ex.cold+0x5/0xa [ 354.991803][T11763] should_failslab+0xc2/0x120 [ 354.991831][T11763] __kmalloc_cache_noprof+0x91/0x6c0 [ 354.991856][T11763] ? nf_tables_newtable+0xd0a/0x1a90 [ 354.991888][T11763] nf_tables_newtable+0xd0a/0x1a90 [ 354.991922][T11763] ? __pfx_nf_tables_newtable+0x10/0x10 [ 354.991955][T11763] ? __nla_parse+0x40/0x60 [ 354.991983][T11763] nfnetlink_rcv_batch+0x1410/0x2880 [ 354.992026][T11763] ? __pfx_nfnetlink_rcv_batch+0x10/0x10 [ 354.992053][T11763] ? find_held_lock+0x2b/0x80 [ 354.992081][T11763] ? __local_bh_enable_ip+0x9e/0x120 [ 354.992105][T11763] ? lockdep_hardirqs_on+0x78/0x100 [ 354.992132][T11763] ? __dev_queue_xmit+0xa12/0x4970 [ 354.992190][T11763] ? __nla_parse+0x40/0x60 [ 354.992216][T11763] nfnetlink_rcv+0x3bd/0x440 [ 354.992244][T11763] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 354.992277][T11763] netlink_unicast+0x585/0x850 [ 354.992325][T11763] ? __pfx_netlink_unicast+0x10/0x10 [ 354.992355][T11763] netlink_sendmsg+0x8b0/0xda0 [ 354.992382][T11763] ? __pfx_netlink_sendmsg+0x10/0x10 [ 354.992409][T11763] ? apparmor_socket_sendmsg+0x15b/0x270 [ 354.992436][T11763] ____sys_sendmsg+0xa4d/0xbe0 [ 354.992457][T11763] ? __pfx_netlink_sendmsg+0x10/0x10 [ 354.992481][T11763] ? __pfx_____sys_sendmsg+0x10/0x10 [ 354.992514][T11763] ___sys_sendmsg+0x190/0x1e0 [ 354.992538][T11763] ? __pfx____sys_sendmsg+0x10/0x10 [ 354.992573][T11763] ? find_held_lock+0x2b/0x80 [ 354.992619][T11763] __sys_sendmsg+0x160/0x210 [ 354.992646][T11763] ? __pfx___sys_sendmsg+0x10/0x10 [ 354.992681][T11763] ? __pfx_ksys_write+0x10/0x10 [ 354.992708][T11763] __do_fast_syscall_32+0xe7/0x970 [ 354.992749][T11763] ? lockdep_hardirqs_on+0x78/0x100 [ 354.992779][T11763] do_fast_syscall_32+0x32/0x70 [ 354.992807][T11763] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 354.992831][T11763] RIP: 0023:0xf705efec [ 354.992854][T11763] Code: Unable to access opcode bytes at 0xf705efc2. [ 354.992864][T11763] RSP: 002b:00000000f544d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 354.992885][T11763] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800000c0 [ 354.992898][T11763] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 354.992909][T11763] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 354.992920][T11763] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 354.992930][T11763] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 354.992960][T11763] [ 355.167625][T11748] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 355.277173][T11769] /dev/sg0: Can't lookup blockdev [ 355.298723][T11769] usb usb8: usbfs: interface 0 claimed by hub while 'syz.1.2028' sets config #0 [ 355.930196][T11772] jffs2: notice: (11772) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 355.950193][T11772] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2030'. [ 356.150801][T11776] x_tables: duplicate underflow at hook 1 [ 356.196954][T11777] FAULT_INJECTION: forcing a failure. [ 356.196954][T11777] name failslab, interval 1, probability 0, space 0, times 0 [ 356.218746][T11777] CPU: 1 UID: 0 PID: 11777 Comm: syz.1.2031 Tainted: G L syzkaller #0 PREEMPT(full) [ 356.218779][T11777] Tainted: [L]=SOFTLOCKUP [ 356.218786][T11777] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 356.218796][T11777] Call Trace: [ 356.218803][T11777] [ 356.218810][T11777] dump_stack_lvl+0x100/0x190 [ 356.218839][T11777] should_fail_ex.cold+0x5/0xa [ 356.218861][T11777] should_failslab+0xc2/0x120 [ 356.218886][T11777] __kmalloc_noprof+0xfc/0x820 [ 356.218909][T11777] ? genl_family_rcv_msg_attrs_parse.isra.0+0x100/0x2f0 [ 356.218939][T11777] genl_family_rcv_msg_attrs_parse.isra.0+0x100/0x2f0 [ 356.218969][T11777] genl_family_rcv_msg_doit+0xc7/0x300 [ 356.218994][T11777] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 356.219016][T11777] ? genl_get_cmd+0x3e7/0x760 [ 356.219043][T11777] ? bpf_lsm_capable+0x9/0x10 [ 356.219063][T11777] ? security_capable+0x80/0x260 [ 356.219109][T11777] ? ns_capable+0xd2/0xf0 [ 356.219138][T11777] genl_rcv_msg+0x560/0x800 [ 356.219165][T11777] ? __pfx_genl_rcv_msg+0x10/0x10 [ 356.219188][T11777] ? __pfx_tipc_nl_node_set_link+0x10/0x10 [ 356.219227][T11777] netlink_rcv_skb+0x159/0x420 [ 356.219248][T11777] ? __pfx_genl_rcv_msg+0x10/0x10 [ 356.219271][T11777] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 356.219308][T11777] ? netlink_deliver_tap+0x1ae/0xcc0 [ 356.219332][T11777] genl_rcv+0x28/0x40 [ 356.219351][T11777] netlink_unicast+0x585/0x850 [ 356.219375][T11777] ? __pfx_netlink_unicast+0x10/0x10 [ 356.219403][T11777] netlink_sendmsg+0x8b0/0xda0 [ 356.219427][T11777] ? __pfx_netlink_sendmsg+0x10/0x10 [ 356.219451][T11777] ? apparmor_socket_sendmsg+0x15b/0x270 [ 356.219476][T11777] ____sys_sendmsg+0xa4d/0xbe0 [ 356.219505][T11777] ? __pfx_netlink_sendmsg+0x10/0x10 [ 356.219527][T11777] ? __pfx_____sys_sendmsg+0x10/0x10 [ 356.219558][T11777] ___sys_sendmsg+0x190/0x1e0 [ 356.219580][T11777] ? __pfx____sys_sendmsg+0x10/0x10 [ 356.219611][T11777] ? find_held_lock+0x2b/0x80 [ 356.219651][T11777] __sys_sendmsg+0x160/0x210 [ 356.219677][T11777] ? __pfx___sys_sendmsg+0x10/0x10 [ 356.219709][T11777] ? __pfx_ksys_write+0x10/0x10 [ 356.219734][T11777] __do_fast_syscall_32+0xe7/0x970 [ 356.219759][T11777] ? lockdep_hardirqs_on+0x78/0x100 [ 356.219785][T11777] do_fast_syscall_32+0x32/0x70 [ 356.219810][T11777] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 356.219831][T11777] RIP: 0023:0xf705efec [ 356.219852][T11777] Code: Unable to access opcode bytes at 0xf705efc2. [ 356.219860][T11777] RSP: 002b:00000000f544d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 356.219879][T11777] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000540 [ 356.219890][T11777] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 356.219901][T11777] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 356.219911][T11777] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 356.219921][T11777] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 356.219944][T11777] [ 356.366957][T11780] tipc: Enabled bearer , priority 0 [ 356.371375][T11780] syzkaller0: entered promiscuous mode [ 356.374879][T11780] syzkaller0: entered allmulticast mode [ 356.385266][T11780] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 356.407472][T11780] syzkaller0: MTU too low for tipc bearer [ 356.409902][T11780] tipc: Disabling bearer [ 356.719266][T11784] binder: 11783:11784 ioctl 400c620e 80000440 returned -22 [ 356.933786][ T41] usb 7-1: new high-speed USB device number 24 using dummy_hcd [ 357.002651][T11793] /dev/sg0: Can't lookup blockdev [ 357.009251][T11793] usb usb8: usbfs: interface 0 claimed by hub while 'syz.1.2038' sets config #0 [ 357.033159][T11795] jffs2: notice: (11795) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 357.045865][T11795] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2039'. [ 357.183815][ T41] usb 7-1: Using ep0 maxpacket: 32 [ 357.195461][ T41] usb 7-1: unable to get BOS descriptor or descriptor too short [ 357.201708][ T41] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 357.205633][ T41] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 357.208918][ T41] usb 7-1: config 14 has no interface number 0 [ 357.211376][ T41] usb 7-1: config 14 has no interface number 1 [ 357.213919][ T41] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 357.217951][ T41] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 357.222224][ T41] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 357.226338][ T41] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 357.230849][ T41] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 357.234545][ T41] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 357.238772][ T41] usb 7-1: config 14 interface 57 has no altsetting 0 [ 357.240973][ T41] usb 7-1: config 14 interface 228 has no altsetting 0 [ 357.249266][ T41] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 357.252685][ T41] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 357.255823][ T41] usb 7-1: Product: syz [ 357.257645][ T41] usb 7-1: Manufacturer: syz [ 357.259778][ T41] usb 7-1: SerialNumber: syz [ 357.373544][T11384] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 357.533582][T11384] usb 5-1: Using ep0 maxpacket: 32 [ 357.537891][T11384] usb 5-1: unable to get BOS descriptor or descriptor too short [ 357.542003][T11384] usb 5-1: config 14 has an invalid interface number: 57 but max is 1 [ 357.545704][T11384] usb 5-1: config 14 has an invalid interface number: 228 but max is 1 [ 357.548447][T11384] usb 5-1: config 14 has no interface number 0 [ 357.550426][T11384] usb 5-1: config 14 has no interface number 1 [ 357.552393][T11384] usb 5-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 357.555940][T11384] usb 5-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 357.559739][T11384] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 357.564864][T11384] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 357.568887][T11384] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 357.572846][T11384] usb 5-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 357.577775][T11384] usb 5-1: config 14 interface 57 has no altsetting 0 [ 357.580528][T11384] usb 5-1: config 14 interface 228 has no altsetting 0 [ 357.588314][T11384] usb 5-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 357.591863][T11384] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 357.595298][T11384] usb 5-1: Product: syz [ 357.596767][T11384] usb 5-1: Manufacturer: syz [ 357.598500][T11384] usb 5-1: SerialNumber: syz [ 357.720344][ T41] legousbtower 7-1:14.57: interrupt endpoints not found [ 358.028976][T11384] legousbtower 5-1:14.57: interrupt endpoints not found [ 358.212647][ T41] legousbtower 7-1:14.228: get version request failed: -71 [ 358.217264][ T41] legousbtower 7-1:14.228: probe with driver legousbtower failed with error -71 [ 358.231164][ T41] usb 7-1: USB disconnect, device number 24 [ 358.541837][T11805] syz.3.2042 (11805): drop_caches: 2 [ 358.637823][T11384] legousbtower 5-1:14.228: get version request failed: -71 [ 358.643960][T11384] legousbtower 5-1:14.228: probe with driver legousbtower failed with error -71 [ 358.655060][T11384] usb 5-1: USB disconnect, device number 23 [ 358.802598][T11820] pim6reg: entered allmulticast mode [ 358.878566][T11818] pim6reg: left allmulticast mode [ 359.393975][T11829] jffs2: notice: (11829) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 359.399438][T11825] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2046'. [ 359.412396][T11829] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2048'. [ 359.487977][T11833] /dev/sg0: Can't lookup blockdev [ 359.492521][T11833] usb usb8: usbfs: interface 0 claimed by hub while 'syz.0.2049' sets config #0 [ 359.622064][T11835] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2050'. [ 359.769485][T11838] x_tables: duplicate underflow at hook 1 [ 359.788878][T11842] device-mapper: ioctl: Invalid data size in the ioctl structure: 0 [ 359.941087][T11847] tipc: Enabled bearer , priority 0 [ 359.991643][T11847] syzkaller0: entered promiscuous mode [ 359.998704][T11847] syzkaller0: entered allmulticast mode [ 360.011612][T11847] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 360.244560][T11849] syzkaller0: MTU too low for tipc bearer [ 360.248347][T11849] tipc: Disabling bearer [ 360.658760][T11858] jffs2: notice: (11858) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 360.671684][T11858] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2057'. [ 360.722863][T11862] /dev/sg0: Can't lookup blockdev [ 360.723580][ T5812] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 360.735588][T11862] usb usb8: usbfs: interface 0 claimed by hub while 'syz.1.2058' sets config #0 [ 360.764935][T11856] usb251xb serial8250: supply vdd not found, using dummy regulator [ 360.790559][T11856] usb251xb serial8250: hub is put in default configuration. [ 360.793817][T11856] usb251xb serial8250: Hub probed successfully [ 360.806850][T11865] usb usb8: usbfs: process 11865 (syz.3.2059) did not claim interface 0 before use [ 360.873543][ T5812] usb 5-1: Using ep0 maxpacket: 32 [ 360.877799][ T5812] usb 5-1: unable to get BOS descriptor or descriptor too short [ 360.880413][T11870] device-mapper: ioctl: Invalid data size in the ioctl structure: 0 [ 360.882008][ T5812] usb 5-1: config 14 has an invalid interface number: 57 but max is 1 [ 360.887671][ T5812] usb 5-1: config 14 has an invalid interface number: 228 but max is 1 [ 360.890689][ T5812] usb 5-1: config 14 has no interface number 0 [ 360.893143][ T5812] usb 5-1: config 14 has no interface number 1 [ 360.895387][ T5812] usb 5-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 360.898723][ T5812] usb 5-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 360.902420][ T5812] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 360.907537][ T5812] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 360.912074][ T5812] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 360.916665][ T5812] usb 5-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 360.921518][ T5812] usb 5-1: config 14 interface 57 has no altsetting 0 [ 360.925311][ T5812] usb 5-1: config 14 interface 228 has no altsetting 0 [ 360.929954][ T5812] usb 5-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 360.933625][ T5812] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 360.936788][ T5812] usb 5-1: Product: syz [ 360.938499][ T5812] usb 5-1: Manufacturer: syz [ 360.940385][ T5812] usb 5-1: SerialNumber: syz [ 361.103551][ T5840] usb 7-1: new high-speed USB device number 25 using dummy_hcd [ 361.256762][ T5840] usb 7-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 361.260584][ T5840] usb 7-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 361.265054][ T5840] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 361.268680][ T5840] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 361.273336][ T5840] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 361.282651][ T5840] usb 7-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 361.286266][ T5840] usb 7-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 361.289493][ T5840] usb 7-1: Product: syz [ 361.291485][ T5840] usb 7-1: Manufacturer: syz [ 361.299677][ T5840] cdc_wdm 7-1:1.0: skipping garbage [ 361.302542][ T5840] cdc_wdm 7-1:1.0: skipping garbage [ 361.308051][ T5840] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 361.310677][ T5840] cdc_wdm 7-1:1.0: Unknown control protocol [ 361.358333][ T5812] legousbtower 5-1:14.57: interrupt endpoints not found [ 361.555033][T11877] jffs2: notice: (11877) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 361.567683][ T42] audit: type=1800 audit(1786170136.044:317): pid=11877 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2063" name="file0" dev="overlay" ino=3202 res=0 errno=0 [ 361.711493][T11881] tipc: Started in network mode [ 361.716886][T11881] tipc: Node identity 0e2b9faa89b2, cluster identity 7 [ 361.723784][T11881] tipc: Enabled bearer , priority 0 [ 361.728230][T11881] syzkaller0: entered promiscuous mode [ 361.730927][T11881] syzkaller0: entered allmulticast mode [ 361.739997][T11881] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 361.764931][T11880] tipc: Resetting bearer [ 361.809737][T11880] tipc: Disabling bearer [ 361.882061][T11883] uhci_hcd 0000:00:1d.0: remove, state 4 [ 361.885891][T11883] usb usb1: USB disconnect, device number 1 [ 361.929550][T11883] uhci_hcd 0000:00:1d.0: USB bus 1 deregistered [ 361.941471][ T5812] legousbtower 5-1:14.228: get version request failed: -71 [ 361.968094][ T5812] legousbtower 5-1:14.228: probe with driver legousbtower failed with error -71 [ 361.997432][T11888] binder: 11882:11888 ioctl 400c620e 80000440 returned -22 [ 361.997838][ T5812] usb 5-1: USB disconnect, device number 24 [ 362.222814][T11885] uhci_hcd 0000:00:1d.0: UHCI Host Controller [ 362.227868][T11885] uhci_hcd 0000:00:1d.0: new USB bus registered, assigned bus number 1 [ 362.231688][T11885] uhci_hcd 0000:00:1d.0: detected 2 ports [ 362.235355][T11885] uhci_hcd 0000:00:1d.0: irq 16, io port 0x0000c0e0 [ 362.244200][T11885] usb usb1: New USB device found, idVendor=1d6b, idProduct=0001, bcdDevice= 7.02 [ 362.248204][T11885] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 362.251841][T11885] usb usb1: Product: UHCI Host Controller [ 362.254476][T11885] usb usb1: Manufacturer: Linux syzkaller uhci_hcd [ 362.257362][T11885] usb usb1: SerialNumber: 0000:00:1d.0 [ 362.267190][T11885] hub 1-0:1.0: USB hub found [ 362.269737][T11885] hub 1-0:1.0: 2 ports detected [ 362.437173][T11893] jffs2: notice: (11893) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 362.448961][T11893] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2067'. [ 362.598238][T11898] /dev/sg0: Can't lookup blockdev [ 362.604924][T11898] usb usb8: usbfs: interface 0 claimed by hub while 'syz.0.2069' sets config #0 [ 363.587132][ T41] usb 7-1: USB disconnect, device number 25 [ 363.730704][ T5738] Bluetooth: hci2: unexpected event for opcode 0x1004 [ 363.901466][T11919] FAULT_INJECTION: forcing a failure. [ 363.901466][T11919] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 363.907419][T11919] CPU: 2 UID: 0 PID: 11919 Comm: syz.1.2074 Tainted: G L syzkaller #0 PREEMPT(full) [ 363.907440][T11919] Tainted: [L]=SOFTLOCKUP [ 363.907444][T11919] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 363.907452][T11919] Call Trace: [ 363.907457][T11919] [ 363.907463][T11919] dump_stack_lvl+0x100/0x190 [ 363.907483][T11919] should_fail_ex.cold+0x5/0xa [ 363.907497][T11919] strncpy_from_user+0x3b/0x2d0 [ 363.907523][T11919] do_getname+0x78/0x390 [ 363.907541][T11919] user_path_at+0x26/0x60 [ 363.907552][T11919] __ia32_sys_mount+0x1fb/0x310 [ 363.907569][T11919] ? __pfx___ia32_sys_mount+0x10/0x10 [ 363.907583][T11919] ? ksys_write+0x1ac/0x250 [ 363.907594][T11919] ? __pfx_ksys_write+0x10/0x10 [ 363.907607][T11919] __do_fast_syscall_32+0xe7/0x970 [ 363.907626][T11919] ? lockdep_hardirqs_on+0x78/0x100 [ 363.907643][T11919] do_fast_syscall_32+0x32/0x70 [ 363.907660][T11919] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 363.907675][T11919] RIP: 0023:0xf705efec [ 363.907690][T11919] Code: Unable to access opcode bytes at 0xf705efc2. [ 363.907696][T11919] RSP: 002b:00000000f544d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 [ 363.907708][T11919] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000800000c0 [ 363.907715][T11919] RDX: 0000000080000280 RSI: 0000000000000000 RDI: 00000000800002c0 [ 363.907721][T11919] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 363.907728][T11919] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 363.907735][T11919] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 363.907748][T11919] [ 364.043202][T11924] jffs2: notice: (11924) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 364.048142][T11925] loop0: detected capacity change from 0 to 32768 [ 364.058932][T11924] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2076'. [ 364.098235][T11925] device-mapper: ioctl: Invalid ioctl structure: name mypo, dev f801 [ 364.136105][T11929] /dev/sg0: Can't lookup blockdev [ 364.145447][T11929] usb usb8: usbfs: interface 0 claimed by hub while 'syz.0.2078' sets config #0 [ 364.350840][T11931] uhci_hcd 0000:00:1d.0: remove, state 4 [ 364.352639][T11931] usb usb1: USB disconnect, device number 1 [ 364.386244][T11931] uhci_hcd 0000:00:1d.0: USB bus 1 deregistered [ 364.469348][T11939] binder: 11930:11939 ioctl 400c620e 80000440 returned -22 [ 364.603294][T11935] uhci_hcd 0000:00:1d.0: UHCI Host Controller [ 364.616771][T11935] uhci_hcd 0000:00:1d.0: new USB bus registered, assigned bus number 1 [ 364.618598][T11942] binder: 11936:11942 ioctl 400c620e 80000440 returned -22 [ 364.627382][T11935] uhci_hcd 0000:00:1d.0: detected 2 ports [ 364.635916][T11935] uhci_hcd 0000:00:1d.0: irq 16, io port 0x0000c0e0 [ 364.642999][T11935] usb usb1: New USB device found, idVendor=1d6b, idProduct=0001, bcdDevice= 7.02 [ 364.646389][T11935] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 364.649454][T11935] usb usb1: Product: UHCI Host Controller [ 364.651934][T11935] usb usb1: Manufacturer: Linux syzkaller uhci_hcd [ 364.655156][T11935] usb usb1: SerialNumber: 0000:00:1d.0 [ 364.669268][T11935] hub 1-0:1.0: USB hub found [ 364.674623][T11935] hub 1-0:1.0: 2 ports detected [ 364.708354][T11938] uhci_hcd 0000:00:1d.0: remove, state 4 [ 364.710382][T11938] usb usb1: USB disconnect, device number 1 [ 364.729424][T11938] uhci_hcd 0000:00:1d.0: USB bus 1 deregistered [ 364.824123][T11946] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2084'. [ 364.914638][T11937] uhci_hcd 0000:00:1d.0: UHCI Host Controller [ 364.920505][T11937] uhci_hcd 0000:00:1d.0: new USB bus registered, assigned bus number 1 [ 364.935612][T11937] uhci_hcd 0000:00:1d.0: detected 2 ports [ 364.943357][T11937] uhci_hcd 0000:00:1d.0: irq 16, io port 0x0000c0e0 [ 364.958552][T11954] jffs2: notice: (11954) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 364.959293][T11937] usb usb1: New USB device found, idVendor=1d6b, idProduct=0001, bcdDevice= 7.02 [ 364.969532][T11954] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2086'. [ 364.973549][T11937] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 364.992456][T11937] usb usb1: Product: UHCI Host Controller [ 365.003551][T11937] usb usb1: Manufacturer: Linux syzkaller uhci_hcd [ 365.007117][T11937] usb usb1: SerialNumber: 0000:00:1d.0 [ 365.022830][T11937] hub 1-0:1.0: USB hub found [ 365.028553][T11937] hub 1-0:1.0: 2 ports detected [ 365.259370][T11967] FAULT_INJECTION: forcing a failure. [ 365.259370][T11967] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 365.264295][T11967] CPU: 3 UID: 0 PID: 11967 Comm: syz.0.2092 Tainted: G L syzkaller #0 PREEMPT(full) [ 365.264325][T11967] Tainted: [L]=SOFTLOCKUP [ 365.264331][T11967] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 365.264341][T11967] Call Trace: [ 365.264347][T11967] [ 365.264355][T11967] dump_stack_lvl+0x100/0x190 [ 365.264377][T11967] should_fail_ex.cold+0x5/0xa [ 365.264392][T11967] strncpy_from_user+0x3b/0x2d0 [ 365.264411][T11967] do_getname+0x78/0x390 [ 365.264428][T11967] user_path_at+0x26/0x60 [ 365.264439][T11967] __ia32_sys_mount+0x1fb/0x310 [ 365.264454][T11967] ? __pfx___ia32_sys_mount+0x10/0x10 [ 365.264468][T11967] ? ksys_write+0x1ac/0x250 [ 365.264480][T11967] ? __pfx_ksys_write+0x10/0x10 [ 365.264493][T11967] __do_fast_syscall_32+0xe7/0x970 [ 365.264511][T11967] ? lockdep_hardirqs_on+0x78/0x100 [ 365.264528][T11967] do_fast_syscall_32+0x32/0x70 [ 365.264545][T11967] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 365.264560][T11967] RIP: 0023:0xf7f45fec [ 365.264575][T11967] Code: Unable to access opcode bytes at 0xf7f45fc2. [ 365.264580][T11967] RSP: 002b:00000000f540650c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 [ 365.264592][T11967] RAX: ffffffffffffffda RBX: 0000000080000000 RCX: 0000000080000040 [ 365.264599][T11967] RDX: 0000000080000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 365.264606][T11967] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 365.264612][T11967] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 365.264619][T11967] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 365.264632][T11967] [ 365.307411][T11970] xt_CT: No such helper "pptp" [ 365.377708][T11384] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 365.409456][T11977] jffs2: notice: (11977) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 365.421979][T11977] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2095'. [ 365.543583][T11384] usb 6-1: Using ep0 maxpacket: 32 [ 365.552202][T11384] usb 6-1: unable to get BOS descriptor or descriptor too short [ 365.559560][T11384] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 365.563951][T11384] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 365.569824][T11384] usb 6-1: config 14 has no interface number 0 [ 365.571843][T11384] usb 6-1: config 14 has no interface number 1 [ 365.574525][T11384] usb 6-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 365.578371][T11384] usb 6-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 365.582845][T11384] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 365.587252][T11384] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 365.592029][T11384] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 365.595845][T11384] usb 6-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 365.600472][T11384] usb 6-1: config 14 interface 57 has no altsetting 0 [ 365.603008][T11384] usb 6-1: config 14 interface 228 has no altsetting 0 [ 365.611134][T11384] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 365.615010][T11384] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 365.621088][T11384] usb 6-1: Product: syz [ 365.622420][T11384] usb 6-1: Manufacturer: syz [ 365.624246][T11384] usb 6-1: SerialNumber: syz [ 365.923602][ T5840] usb 5-1: new full-speed USB device number 25 using dummy_hcd [ 366.036650][T11384] legousbtower 6-1:14.57: interrupt endpoints not found [ 366.097721][ T5840] usb 5-1: config 0 has an invalid interface number: 205 but max is 0 [ 366.101502][ T5840] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 366.106243][ T5840] usb 5-1: config 0 has no interface number 0 [ 366.111271][ T5840] usb 5-1: config 0 interface 205 has no altsetting 0 [ 366.118515][ T5840] usb 5-1: New USB device found, idVendor=1822, idProduct=3202, bcdDevice=13.4a [ 366.122211][ T5840] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 366.127182][ T5840] usb 5-1: Product: syz [ 366.128755][ T5840] usb 5-1: Manufacturer: syz [ 366.130308][ T5840] usb 5-1: SerialNumber: syz [ 366.152684][ T5840] usb 5-1: config 0 descriptor?? [ 366.165527][ T5840] dvb-usb: found a 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' in warm state. [ 366.170717][ T5840] dvb-usb: bulk message failed: -22 (3/0) [ 366.198453][ T5840] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 366.203542][ T5840] dvbdev: DVB: registering new adapter (TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device) [ 366.208151][ T5840] usb 5-1: media controller created [ 366.213339][ T5840] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 366.226769][ T5840] dvb-usb: bulk message failed: -22 (6/0) [ 366.229414][ T5840] dvb-usb: no frontend was attached by 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' [ 366.244099][ T5840] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb5/5-1/input/input29 [ 366.253076][ T5840] dvb-usb: schedule remote query interval to 150 msecs. [ 366.256711][ T5840] dvb-usb: bulk message failed: -22 (3/0) [ 366.283720][ T5840] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device successfully initialized and connected. [ 366.423763][ T5840] dvb-usb: bulk message failed: -22 (1/0) [ 366.426463][ T5840] dvb-usb: error while querying for an remote control event. [ 366.549853][T11384] legousbtower 6-1:14.228: LEGO USB Tower firmware version is 175.69 build 32768 [ 366.556433][T11384] legousbtower 6-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 366.585093][T11384] dvb-usb: bulk message failed: -22 (1/0) [ 366.588131][T11384] dvb-usb: error while querying for an remote control event. [ 366.743586][T11384] dvb-usb: bulk message failed: -22 (1/0) [ 366.746677][T11384] dvb-usb: error while querying for an remote control event. [ 366.903660][T11384] dvb-usb: bulk message failed: -22 (1/0) [ 366.908020][T11384] dvb-usb: error while querying for an remote control event. [ 367.064742][T11384] dvb-usb: bulk message failed: -22 (1/0) [ 367.069475][T11384] dvb-usb: error while querying for an remote control event. [ 367.234007][T11384] dvb-usb: bulk message failed: -22 (1/0) [ 367.235875][T11384] dvb-usb: error while querying for an remote control event. [ 367.315666][ T5898] usb 6-1: USB disconnect, device number 20 [ 367.328221][ T5898] legousbtower 6-1:14.228: LEGO USB Tower #-160 now disconnected [ 367.395206][T11384] dvb-usb: bulk message failed: -22 (1/0) [ 367.401252][T11384] dvb-usb: error while querying for an remote control event. [ 367.446657][T12005] jffs2: notice: (12005) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 367.463574][T12005] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2104'. [ 367.563669][T11384] dvb-usb: bulk message failed: -22 (1/0) [ 367.567560][T11384] dvb-usb: error while querying for an remote control event. [ 367.652469][T12012] device-mapper: ioctl: Invalid data size in the ioctl structure: 108 [ 367.724138][T11384] dvb-usb: bulk message failed: -22 (1/0) [ 367.726325][T11384] dvb-usb: error while querying for an remote control event. [ 367.813682][ T5738] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 367.824163][ T5738] Bluetooth: hci2: Injecting HCI hardware error event [ 367.833376][ T5738] Bluetooth: hci2: hardware error 0x00 [ 367.898955][T11384] dvb-usb: bulk message failed: -22 (1/0) [ 367.901002][T11384] dvb-usb: error while querying for an remote control event. [ 368.064145][T11384] dvb-usb: bulk message failed: -22 (1/0) [ 368.066851][T11384] dvb-usb: error while querying for an remote control event. [ 368.234012][T11384] dvb-usb: bulk message failed: -22 (1/0) [ 368.237970][T11384] dvb-usb: error while querying for an remote control event. [ 368.403771][T11384] dvb-usb: bulk message failed: -22 (1/0) [ 368.418435][T11384] dvb-usb: error while querying for an remote control event. [ 368.571281][T12019] uhci_hcd 0000:00:1d.0: remove, state 4 [ 368.577620][T12019] usb usb1: USB disconnect, device number 1 [ 368.593817][T11384] dvb-usb: bulk message failed: -22 (1/0) [ 368.596460][T11384] dvb-usb: error while querying for an remote control event. [ 368.612805][ T5898] usb 5-1: USB disconnect, device number 25 [ 368.650364][T12019] uhci_hcd 0000:00:1d.0: USB bus 1 deregistered [ 368.735726][T12024] binder: 12018:12024 ioctl 400c620e 80000440 returned -22 [ 368.747706][ T5898] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I successfully deinitialized and disconnected. [ 368.825283][T12026] tipc: Enabled bearer , priority 0 [ 368.834329][T12026] syzkaller0: entered promiscuous mode [ 368.840767][T12026] syzkaller0: entered allmulticast mode [ 368.854593][T12026] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 368.896913][T12020] uhci_hcd 0000:00:1d.0: UHCI Host Controller [ 368.905452][T12020] uhci_hcd 0000:00:1d.0: new USB bus registered, assigned bus number 1 [ 368.906237][T12025] tipc: Resetting bearer [ 368.911454][T12020] uhci_hcd 0000:00:1d.0: detected 2 ports [ 368.916584][T12020] uhci_hcd 0000:00:1d.0: irq 16, io port 0x0000c0e0 [ 368.924001][T12020] usb usb1: New USB device found, idVendor=1d6b, idProduct=0001, bcdDevice= 7.02 [ 368.937229][T12020] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 368.940387][T12020] usb usb1: Product: UHCI Host Controller [ 368.941444][T12025] tipc: Disabling bearer [ 368.946002][T12030] CIFS: Attempting to mount //127.0.0.1/share [ 368.947968][T12020] usb usb1: Manufacturer: Linux syzkaller uhci_hcd [ 368.947983][T12020] usb usb1: SerialNumber: 0000:00:1d.0 [ 368.957647][T12020] hub 1-0:1.0: USB hub found [ 368.959438][T12020] hub 1-0:1.0: 2 ports detected [ 368.978526][T12030] CIFS: VFS: Error connecting to socket. Aborting operation. [ 368.981697][T12030] CIFS: VFS: cifs_mount failed w/return code = -101 [ 369.054399][T12034] jffs2: notice: (12034) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 369.463544][ T5898] usb 7-1: new high-speed USB device number 26 using dummy_hcd [ 369.633558][ T5898] usb 7-1: Using ep0 maxpacket: 32 [ 369.641830][ T5898] usb 7-1: unable to get BOS descriptor or descriptor too short [ 369.654988][ T5898] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 369.658558][ T5898] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 369.661865][ T5898] usb 7-1: config 14 has no interface number 0 [ 369.673534][ T5898] usb 7-1: config 14 has no interface number 1 [ 369.676082][ T5898] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 369.680314][ T5898] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 369.693590][ T5898] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 369.703794][ T5898] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 369.708611][ T5898] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 369.713222][ T5898] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 369.719210][ T5898] usb 7-1: config 14 interface 57 has no altsetting 0 [ 369.725680][ T5898] usb 7-1: config 14 interface 228 has no altsetting 0 [ 369.733340][ T5898] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 369.743490][ T5898] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 369.746899][ T5898] usb 7-1: Product: syz [ 369.748670][ T5898] usb 7-1: Manufacturer: syz [ 369.750620][ T5898] usb 7-1: SerialNumber: syz [ 369.963728][ T5738] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 370.107284][ T5447] 8021q: adding VLAN 0 to HW filter on device bond1 [ 370.148514][T12059] loop0: detected capacity change from 0 to 32768 [ 370.170860][ T5898] legousbtower 7-1:14.57: interrupt endpoints not found [ 370.191953][T12059] device-mapper: ioctl: populate_table: no targets specified [ 370.498653][T12074] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2122'. [ 370.501649][T12074] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2122'. [ 370.518150][ T13] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 370.526277][ T13] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 370.532491][ T13] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 370.542900][ T13] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 370.547184][T12074] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2122'. [ 370.685798][ T5898] legousbtower 7-1:14.228: LEGO USB Tower firmware version is 175.69 build 32768 [ 370.694650][ T5898] legousbtower 7-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 370.885952][T12085] jffs2: notice: (12085) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 371.447171][ T5840] usb 7-1: USB disconnect, device number 26 [ 371.458982][ T5840] legousbtower 7-1:14.228: LEGO USB Tower #-160 now disconnected [ 371.994034][T12100] loop0: detected capacity change from 0 to 32768 [ 372.028515][T12100] device-mapper: ioctl: populate_table: no targets specified [ 372.293165][T12115] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2131'. [ 372.297326][T12115] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2131'. [ 372.310876][T12115] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2131'. [ 372.460246][T12120] uhci_hcd 0000:00:1d.0: remove, state 4 [ 372.462204][T12120] usb usb1: USB disconnect, device number 1 [ 372.502228][T12120] uhci_hcd 0000:00:1d.0: USB bus 1 deregistered [ 372.565798][T12119] binder: 12118:12119 ioctl 400c620e 80000440 returned -22 [ 372.593611][ T102] usb 7-1: new high-speed USB device number 27 using dummy_hcd [ 372.658088][T12121] uhci_hcd 0000:00:1d.0: UHCI Host Controller [ 372.664768][T12121] uhci_hcd 0000:00:1d.0: new USB bus registered, assigned bus number 1 [ 372.671510][T12121] uhci_hcd 0000:00:1d.0: detected 2 ports [ 372.674683][T12121] uhci_hcd 0000:00:1d.0: irq 16, io port 0x0000c0e0 [ 372.680403][T12121] usb usb1: New USB device found, idVendor=1d6b, idProduct=0001, bcdDevice= 7.02 [ 372.684415][T12121] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 372.687153][T12121] usb usb1: Product: UHCI Host Controller [ 372.689294][T12121] usb usb1: Manufacturer: Linux syzkaller uhci_hcd [ 372.692123][T12121] usb usb1: SerialNumber: 0000:00:1d.0 [ 372.704591][T12121] hub 1-0:1.0: USB hub found [ 372.706495][T12121] hub 1-0:1.0: 2 ports detected [ 372.753639][ T102] usb 7-1: Using ep0 maxpacket: 32 [ 372.759636][ T102] usb 7-1: unable to get BOS descriptor or descriptor too short [ 372.767279][ T102] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 372.774603][ T102] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 372.779026][ T102] usb 7-1: config 14 has no interface number 0 [ 372.786062][ T102] usb 7-1: config 14 has no interface number 1 [ 372.789368][ T102] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 372.794550][ T102] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 372.800600][ T102] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 372.814450][ T102] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 372.824758][ T102] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 372.833988][ T102] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 372.845460][ T102] usb 7-1: config 14 interface 57 has no altsetting 0 [ 372.849205][ T102] usb 7-1: config 14 interface 228 has no altsetting 0 [ 372.858450][ T102] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 372.862492][ T102] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 372.866595][ T102] usb 7-1: Product: syz [ 372.868601][ T102] usb 7-1: Manufacturer: syz [ 372.870995][ T102] usb 7-1: SerialNumber: syz [ 372.887934][T12123] loop0: detected capacity change from 0 to 32768 [ 373.097332][T12129] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2133'. [ 373.119132][T12129] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2133'. [ 373.317845][ T102] legousbtower 7-1:14.57: interrupt endpoints not found [ 373.331538][T12127] FAULT_INJECTION: forcing a failure. [ 373.331538][T12127] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 373.338178][T12127] CPU: 2 UID: 0 PID: 12127 Comm: syz.1.2135 Tainted: G L syzkaller #0 PREEMPT(full) [ 373.338208][T12127] Tainted: [L]=SOFTLOCKUP [ 373.338214][T12127] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 373.338225][T12127] Call Trace: [ 373.338232][T12127] [ 373.338239][T12127] dump_stack_lvl+0x100/0x190 [ 373.338265][T12127] should_fail_ex.cold+0x5/0xa [ 373.338286][T12127] _copy_from_user+0x2e/0xd0 [ 373.338328][T12127] bpf_test_init.isra.0+0xaf/0x100 [ 373.338359][T12127] bpf_prog_test_run_skb+0x497/0x3540 [ 373.338383][T12127] ? find_held_lock+0x2b/0x80 [ 373.338406][T12127] ? __fget_files+0x211/0x3d0 [ 373.338429][T12127] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 373.338451][T12127] ? fput+0x79/0x100 [ 373.338479][T12127] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 373.338498][T12127] __sys_bpf+0x2a12/0x4e80 [ 373.338525][T12127] ? __pfx___sys_bpf+0x10/0x10 [ 373.338545][T12127] ? find_held_lock+0x2b/0x80 [ 373.338565][T12127] ? get_pid_task+0xfc/0x250 [ 373.338587][T12127] ? get_pid_task+0xfc/0x250 [ 373.338615][T12127] ? proc_fail_nth_write+0x9f/0x220 [ 373.338648][T12127] ? find_held_lock+0x2b/0x80 [ 373.338675][T12127] ? rcu_read_lock_any_held+0x6a/0xa0 [ 373.338698][T12127] ? find_held_lock+0x2b/0x80 [ 373.338719][T12127] ? ksys_write+0x190/0x250 [ 373.338736][T12127] ? ksys_write+0x190/0x250 [ 373.338767][T12127] ? fput+0x79/0x100 [ 373.338789][T12127] ? __ia32_sys_bpf+0xcc/0x170 [ 373.338808][T12127] __ia32_sys_bpf+0xcc/0x170 [ 373.338828][T12127] ? __do_fast_syscall_32+0x98/0x970 [ 373.338858][T12127] __do_fast_syscall_32+0xe7/0x970 [ 373.338881][T12127] ? lockdep_hardirqs_on+0x78/0x100 [ 373.338905][T12127] do_fast_syscall_32+0x32/0x70 [ 373.338930][T12127] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 373.338952][T12127] RIP: 0023:0xf705efec [ 373.338974][T12127] Code: Unable to access opcode bytes at 0xf705efc2. [ 373.338982][T12127] RSP: 002b:00000000f544d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 373.339001][T12127] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 0000000080000640 [ 373.339010][T12127] RDX: 0000000000000024 RSI: 0000000000000000 RDI: 0000000000000000 [ 373.339019][T12127] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 373.339029][T12127] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 373.339039][T12127] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 373.339062][T12127] [ 374.016727][ T102] legousbtower 7-1:14.228: LEGO USB Tower firmware version is 175.69 build 32768 [ 374.093959][ T102] legousbtower 7-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 374.585247][T12146] program syz.1.2138 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 374.588717][T12147] x_tables: duplicate underflow at hook 1 [ 375.789907][ T102] usb 7-1: USB disconnect, device number 27 [ 375.814142][ T102] legousbtower 7-1:14.228: LEGO USB Tower #-160 now disconnected [ 376.338334][ T42] audit: type=1326 audit(1786170150.834:318): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12176 comm="syz.2.2147" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 376.347825][ T42] audit: type=1326 audit(1786170150.844:319): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12176 comm="syz.2.2147" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 376.361081][ T42] audit: type=1326 audit(1786170150.854:320): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12176 comm="syz.2.2147" exe="/syz-executor" sig=0 arch=40000003 syscall=150 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 376.385930][ T42] audit: type=1326 audit(1786170150.854:321): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12176 comm="syz.2.2147" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 376.414888][ T42] audit: type=1326 audit(1786170150.854:322): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12176 comm="syz.2.2147" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 376.443062][ T42] audit: type=1326 audit(1786170150.854:323): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12176 comm="syz.2.2147" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 376.469954][ T42] audit: type=1326 audit(1786170150.854:324): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12176 comm="syz.2.2147" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 376.478049][ T42] audit: type=1326 audit(1786170150.854:325): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12176 comm="syz.2.2147" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 376.487036][ T42] audit: type=1326 audit(1786170150.854:326): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12176 comm="syz.2.2147" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 376.495315][ T42] audit: type=1326 audit(1786170150.854:327): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12176 comm="syz.2.2147" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 376.543554][ T5840] usb 5-1: new full-speed USB device number 26 using dummy_hcd [ 376.647724][T12192] x_tables: duplicate underflow at hook 1 [ 376.695650][ T5840] usb 5-1: config 0 has an invalid interface number: 205 but max is 0 [ 376.699456][ T5840] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 376.703746][ T5840] usb 5-1: config 0 has no interface number 0 [ 376.707363][ T5840] usb 5-1: config 0 interface 205 has no altsetting 0 [ 376.719221][ T5840] usb 5-1: New USB device found, idVendor=1822, idProduct=3202, bcdDevice=13.4a [ 376.723165][ T5840] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 376.727425][ T5840] usb 5-1: Product: syz [ 376.729156][ T5840] usb 5-1: Manufacturer: syz [ 376.730995][ T5840] usb 5-1: SerialNumber: syz [ 376.738278][ T5840] usb 5-1: config 0 descriptor?? [ 376.751391][ T5840] dvb-usb: found a 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' in warm state. [ 376.757299][ T5840] dvb-usb: bulk message failed: -22 (3/0) [ 376.777291][ T5840] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 376.781749][ T5840] dvbdev: DVB: registering new adapter (TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device) [ 376.788408][ T5840] usb 5-1: media controller created [ 376.792389][ T5840] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 376.805648][ T5840] dvb-usb: bulk message failed: -22 (6/0) [ 376.808860][ T5840] dvb-usb: no frontend was attached by 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' [ 376.819643][ T5840] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb5/5-1/input/input30 [ 376.828874][ T5840] dvb-usb: schedule remote query interval to 150 msecs. [ 376.832937][ T5840] dvb-usb: bulk message failed: -22 (3/0) [ 376.863531][ T5840] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device successfully initialized and connected. [ 376.983529][ T5840] dvb-usb: bulk message failed: -22 (1/0) [ 376.986881][ T5840] dvb-usb: error while querying for an remote control event. [ 377.153556][ T5840] dvb-usb: bulk message failed: -22 (1/0) [ 377.157417][ T5840] dvb-usb: error while querying for an remote control event. [ 377.323539][ T5840] dvb-usb: bulk message failed: -22 (1/0) [ 377.327463][ T5840] dvb-usb: error while querying for an remote control event. [ 377.483558][ T5840] dvb-usb: bulk message failed: -22 (1/0) [ 377.485723][ T5840] dvb-usb: error while querying for an remote control event. [ 377.569063][T12206] tipc: Started in network mode [ 377.570977][T12206] tipc: Node identity b26a4b040ea8, cluster identity 4711 [ 377.573771][T12206] tipc: Enabled bearer , priority 0 [ 377.576938][T12206] syzkaller0: entered promiscuous mode [ 377.579522][T12206] syzkaller0: entered allmulticast mode [ 377.590210][T12206] syzkaller0: MTU too low for tipc bearer [ 377.592805][T12206] tipc: Disabling bearer [ 377.663764][ T5840] dvb-usb: bulk message failed: -22 (1/0) [ 377.667698][ T5840] dvb-usb: error while querying for an remote control event. [ 377.823695][ T5840] dvb-usb: bulk message failed: -22 (1/0) [ 377.826349][ T5840] dvb-usb: error while querying for an remote control event. [ 377.872788][T12208] uhci_hcd 0000:00:1d.0: remove, state 4 [ 377.875297][T12208] usb usb1: USB disconnect, device number 1 [ 377.981711][T12213] binder: 12207:12213 ioctl 400c620e 80000440 returned -22 [ 377.984538][ T5840] dvb-usb: bulk message failed: -22 (1/0) [ 377.987770][ T5840] dvb-usb: error while querying for an remote control event. [ 377.997243][T12208] uhci_hcd 0000:00:1d.0: USB bus 1 deregistered [ 378.143753][ T5840] dvb-usb: bulk message failed: -22 (1/0) [ 378.148468][ T5840] dvb-usb: error while querying for an remote control event. [ 378.173866][T12209] uhci_hcd 0000:00:1d.0: UHCI Host Controller [ 378.179548][T12209] uhci_hcd 0000:00:1d.0: new USB bus registered, assigned bus number 1 [ 378.189264][T12209] uhci_hcd 0000:00:1d.0: detected 2 ports [ 378.192236][T12209] uhci_hcd 0000:00:1d.0: irq 16, io port 0x0000c0e0 [ 378.198499][T12209] usb usb1: New USB device found, idVendor=1d6b, idProduct=0001, bcdDevice= 7.02 [ 378.202366][T12209] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 378.205342][ T1434] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.208894][ T1434] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.217058][T12209] usb usb1: Product: UHCI Host Controller [ 378.222776][T12209] usb usb1: Manufacturer: Linux syzkaller uhci_hcd [ 378.225438][T12209] usb usb1: SerialNumber: 0000:00:1d.0 [ 378.260461][T12209] hub 1-0:1.0: USB hub found [ 378.262990][T12209] hub 1-0:1.0: 2 ports detected [ 378.305048][ T5840] dvb-usb: bulk message failed: -22 (1/0) [ 378.309859][ T5840] dvb-usb: error while querying for an remote control event. [ 378.477993][T11384] dvb-usb: bulk message failed: -22 (1/0) [ 378.480706][T11384] dvb-usb: error while querying for an remote control event. [ 378.594743][T12220] jffs2: notice: (12220) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 378.643620][T11384] dvb-usb: bulk message failed: -22 (1/0) [ 378.645897][T11384] dvb-usb: error while querying for an remote control event. [ 378.673585][ T5840] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 378.803809][T11384] dvb-usb: bulk message failed: -22 (1/0) [ 378.806518][T11384] dvb-usb: error while querying for an remote control event. [ 378.844049][ T5840] usb 6-1: Using ep0 maxpacket: 32 [ 378.848501][ T5840] usb 6-1: unable to get BOS descriptor or descriptor too short [ 378.852895][ T5840] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 378.855779][ T5840] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 378.858681][ T5840] usb 6-1: config 14 has no interface number 0 [ 378.860808][ T5840] usb 6-1: config 14 has no interface number 1 [ 378.863179][ T5840] usb 6-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 378.867346][ T5840] usb 6-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 378.871427][ T5840] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 378.875955][ T5840] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 378.879488][ T5840] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 378.882935][ T5840] usb 6-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 378.888453][ T5840] usb 6-1: config 14 interface 57 has no altsetting 0 [ 378.890865][ T5840] usb 6-1: config 14 interface 228 has no altsetting 0 [ 378.895855][ T5840] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 378.899596][ T5840] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 378.902535][ T5840] usb 6-1: Product: syz [ 378.904539][ T5840] usb 6-1: Manufacturer: syz [ 378.906387][ T5840] usb 6-1: SerialNumber: syz [ 378.964174][T11384] dvb-usb: bulk message failed: -22 (1/0) [ 378.968652][T11384] dvb-usb: error while querying for an remote control event. [ 379.103111][ T102] usb 5-1: USB disconnect, device number 26 [ 379.134937][ T102] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I successfully deinitialized and disconnected. [ 379.333934][ T5840] legousbtower 6-1:14.57: interrupt endpoints not found [ 379.740866][ T5840] legousbtower 6-1:14.228: get version request failed: -71 [ 379.746064][ T5840] legousbtower 6-1:14.228: probe with driver legousbtower failed with error -71 [ 379.768354][ T5840] usb 6-1: USB disconnect, device number 21 [ 379.778160][T12239] tipc: Enabled bearer , priority 0 [ 379.784228][ T102] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 379.798306][T12239] syzkaller0: entered promiscuous mode [ 379.800508][T12239] syzkaller0: entered allmulticast mode [ 379.815740][T12239] syzkaller0: MTU too low for tipc bearer [ 379.818135][T12239] tipc: Disabling bearer [ 379.953566][ T102] usb 5-1: Using ep0 maxpacket: 32 [ 379.957917][ T102] usb 5-1: config 0 has no interfaces? [ 379.960811][ T102] usb 5-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 379.968348][ T102] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 379.980911][ T102] usb 5-1: config 0 descriptor?? [ 380.051327][T12249] jffs2: notice: (12249) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 380.323856][ T102] usb 5-1: USB disconnect, device number 27 [ 380.338549][T12254] uhci_hcd 0000:00:1d.0: remove, state 4 [ 380.346146][T12254] usb usb1: USB disconnect, device number 1 [ 380.372383][T12254] uhci_hcd 0000:00:1d.0: USB bus 1 deregistered [ 380.458738][T12262] binder: 12252:12262 ioctl 400c620e 80000440 returned -22 [ 380.533235][T12257] uhci_hcd 0000:00:1d.0: UHCI Host Controller [ 380.537842][T12257] uhci_hcd 0000:00:1d.0: new USB bus registered, assigned bus number 1 [ 380.547219][T12257] uhci_hcd 0000:00:1d.0: detected 2 ports [ 380.550303][T12257] uhci_hcd 0000:00:1d.0: irq 16, io port 0x0000c0e0 [ 380.555472][T12257] usb usb1: New USB device found, idVendor=1d6b, idProduct=0001, bcdDevice= 7.02 [ 380.559096][T12257] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 380.561971][T12257] usb usb1: Product: UHCI Host Controller [ 380.564663][T12257] usb usb1: Manufacturer: Linux syzkaller uhci_hcd [ 380.567209][T12257] usb usb1: SerialNumber: 0000:00:1d.0 [ 380.576930][T12257] hub 1-0:1.0: USB hub found [ 380.578895][T12257] hub 1-0:1.0: 2 ports detected [ 380.756935][T12265] uhci_hcd 0000:00:1d.0: remove, state 4 [ 380.759139][T12265] usb usb1: USB disconnect, device number 1 [ 380.894767][T12265] uhci_hcd 0000:00:1d.0: USB bus 1 deregistered [ 380.953391][T12268] binder: 12263:12268 ioctl 400c620e 80000440 returned -22 [ 381.160433][T12264] uhci_hcd 0000:00:1d.0: UHCI Host Controller [ 381.169836][T12264] uhci_hcd 0000:00:1d.0: new USB bus registered, assigned bus number 1 [ 381.180336][T12264] uhci_hcd 0000:00:1d.0: detected 2 ports [ 381.199585][T12264] uhci_hcd 0000:00:1d.0: irq 16, io port 0x0000c0e0 [ 381.228894][T12264] usb usb1: New USB device found, idVendor=1d6b, idProduct=0001, bcdDevice= 7.02 [ 381.234207][T12264] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 381.240123][T12264] usb usb1: Product: UHCI Host Controller [ 381.248460][T12264] usb usb1: Manufacturer: Linux syzkaller uhci_hcd [ 381.263535][T12264] usb usb1: SerialNumber: 0000:00:1d.0 [ 381.303780][T12264] hub 1-0:1.0: USB hub found [ 381.306489][T12264] hub 1-0:1.0: 2 ports detected [ 381.472228][T12277] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2176'. [ 381.830950][T12291] jffs2: notice: (12291) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 382.677444][T12330] libceph: resolve '.‹R¯HÖe'ì»Ë /Ïâµüë1ýC¸ £~—1W–쯑ë¨eþxEA®ÁþeSb{~Rð' (ret=-3): failed [ 382.684640][T12333] /dev/sg0: Can't lookup blockdev [ 382.688065][T12333] usb usb8: usbfs: interface 0 claimed by hub while 'syz.1.2181' sets config #0 [ 383.788224][T12358] tipc: Enabling of bearer rejected, failed to enable media [ 383.805196][ T42] kauditd_printk_skb: 121 callbacks suppressed [ 383.805217][ T42] audit: type=1400 audit(1786170158.294:449): apparmor="DENIED" operation="stack_onexec" class="file" info="label not found" error=-2 profile="unconfined" name="\%-^&{*" pid=12359 comm="syz.2.2190" [ 383.946504][T12367] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2191'. [ 383.967745][T12367] netlink: 'syz.1.2191': attribute type 1 has an invalid length. [ 383.972150][T12367] netlink: 756 bytes leftover after parsing attributes in process `syz.1.2191'. [ 384.232864][T12376] pim6reg: entered allmulticast mode [ 384.263748][T11384] usb 6-1: new full-speed USB device number 22 using dummy_hcd [ 384.321599][T12378] x_tables: duplicate underflow at hook 1 [ 384.334218][T12373] pim6reg: left allmulticast mode [ 384.410059][T11384] usb 6-1: device descriptor read/64, error -71 [ 384.653674][T11384] usb 6-1: new full-speed USB device number 23 using dummy_hcd [ 384.800120][T11384] usb 6-1: device descriptor read/64, error -71 [ 384.891630][T12393] binder: 12390:12393 ioctl 400c620e 0 returned -14 [ 384.930593][T11384] usb usb6-port1: attempt power cycle [ 385.333622][T11384] usb 6-1: new full-speed USB device number 24 using dummy_hcd [ 385.354678][T11384] usb 6-1: device descriptor read/8, error -71 [ 385.593581][T11384] usb 6-1: new full-speed USB device number 25 using dummy_hcd [ 385.614030][T11384] usb 6-1: device descriptor read/8, error -71 [ 385.726125][T11384] usb usb6-port1: unable to enumerate USB device [ 385.872094][T12397] new mount options do not match the existing superblock, will be ignored [ 385.892268][T12398] FAULT_INJECTION: forcing a failure. [ 385.892268][T12398] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 385.896877][T12398] CPU: 0 UID: 0 PID: 12398 Comm: syz.2.2200 Tainted: G L syzkaller #0 PREEMPT(full) [ 385.896897][T12398] Tainted: [L]=SOFTLOCKUP [ 385.896902][T12398] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 385.896909][T12398] Call Trace: [ 385.896914][T12398] [ 385.896920][T12398] dump_stack_lvl+0x100/0x190 [ 385.896940][T12398] should_fail_ex.cold+0x5/0xa [ 385.896953][T12398] _copy_from_user+0x2e/0xd0 [ 385.896973][T12398] memdup_user+0x6b/0xe0 [ 385.896988][T12398] strndup_user+0x78/0xe0 [ 385.897003][T12398] __ia32_sys_fsopen+0xa0/0x230 [ 385.897021][T12398] __do_fast_syscall_32+0xe7/0x970 [ 385.897040][T12398] ? lockdep_hardirqs_on+0x78/0x100 [ 385.897057][T12398] do_fast_syscall_32+0x32/0x70 [ 385.897074][T12398] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 385.897089][T12398] RIP: 0023:0xf6feefec [ 385.897103][T12398] Code: Unable to access opcode bytes at 0xf6feefc2. [ 385.897109][T12398] RSP: 002b:00000000f53bc50c EFLAGS: 00000292 ORIG_RAX: 00000000000001ae [ 385.897121][T12398] RAX: ffffffffffffffda RBX: 0000000080000100 RCX: 0000000000000000 [ 385.897128][T12398] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 385.897134][T12398] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 385.897141][T12398] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 385.897148][T12398] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 385.897161][T12398] [ 385.938721][T12400] binder: 12396:12400 ioctl 400c620e 0 returned -14 [ 385.941082][T12398] binder: 12394:12398 ioctl 400c620e 0 returned -14 [ 387.503640][ T102] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 387.653592][ T102] usb 6-1: Using ep0 maxpacket: 32 [ 387.658597][ T102] usb 6-1: unable to get BOS descriptor or descriptor too short [ 387.662723][ T102] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 387.666426][ T102] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 387.669949][ T102] usb 6-1: config 14 has no interface number 0 [ 387.672541][ T102] usb 6-1: config 14 has no interface number 1 [ 387.675345][ T102] usb 6-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 387.679740][ T102] usb 6-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 387.684962][ T102] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 387.689521][ T102] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 387.694771][ T102] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 387.699227][ T102] usb 6-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 387.704921][ T102] usb 6-1: config 14 interface 57 has no altsetting 0 [ 387.707799][ T102] usb 6-1: config 14 interface 228 has no altsetting 0 [ 387.712418][ T102] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 387.717685][ T102] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 387.720930][ T102] usb 6-1: Product: syz [ 387.722691][ T102] usb 6-1: Manufacturer: syz [ 387.726298][ T102] usb 6-1: SerialNumber: syz [ 387.863315][T12417] tipc: Enabled bearer , priority 0 [ 387.868340][T12417] syzkaller0: entered promiscuous mode [ 387.870219][T12417] syzkaller0: entered allmulticast mode [ 387.883103][T12417] syzkaller0: MTU too low for tipc bearer [ 387.885878][T12417] tipc: Disabling bearer [ 388.157704][ T102] legousbtower 6-1:14.57: interrupt endpoints not found [ 388.430511][T12440] netlink: 352 bytes leftover after parsing attributes in process `syz.2.2218'. [ 388.558279][T12443] wg2 speed is unknown, defaulting to 1000 [ 388.707280][ T102] legousbtower 6-1:14.228: get version request failed: -71 [ 388.718143][ T102] legousbtower 6-1:14.228: probe with driver legousbtower failed with error -71 [ 388.741891][ T102] usb 6-1: USB disconnect, device number 26 [ 388.812266][T12463] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2226'. [ 388.829804][T12463] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2226'. [ 389.093056][T12471] oom_control is deprecated and will be removed. Please report your usecase to linux-mm-@kvack.org if you depend on this functionality. [ 390.053071][T12498] veth3: entered promiscuous mode [ 390.055393][T12498] veth3: entered allmulticast mode [ 390.251564][T12511] overlayfs: option "index=on" is useless in a non-upper mount, ignore [ 390.257392][T12511] overlayfs: missing 'lowerdir' [ 390.563627][ T5812] usb 7-1: new high-speed USB device number 28 using dummy_hcd [ 390.723530][ T5812] usb 7-1: Using ep0 maxpacket: 16 [ 390.727969][ T5812] usb 7-1: unable to get BOS descriptor or descriptor too short [ 390.732644][ T5812] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 390.737196][ T5812] usb 7-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 390.741223][ T5812] usb 7-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 390.752775][ T5812] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.32 [ 390.757028][ T5812] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 390.760522][ T5812] usb 7-1: Product: syz [ 390.762435][ T5812] usb 7-1: Manufacturer: syz [ 390.764634][ T5812] usb 7-1: SerialNumber: syz [ 391.007177][ T5812] usb 7-1: 0:2 : does not exist [ 391.092831][ T5812] usb-storage 7-1:1.1: USB Mass Storage device detected [ 391.161807][ T5812] usb 7-1: USB disconnect, device number 28 [ 391.186295][ T6046] udevd[6046]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 392.253537][ T41] usb 5-1: new full-speed USB device number 28 using dummy_hcd [ 392.416079][ T41] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 392.433666][ T41] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1056, setting to 64 [ 392.437702][ T41] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 254 [ 392.442849][ T41] usb 5-1: New USB device found, idVendor=044f, idProduct=b65d, bcdDevice= 0.00 [ 392.450103][ T41] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 392.468017][ T41] usb 5-1: config 0 descriptor?? [ 392.471017][T12555] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 392.894402][ T41] hid-thrustmaster 0003:044F:B65D.0002: ignoring exceeding usage max [ 392.904517][ T41] hid-thrustmaster 0003:044F:B65D.0002: unknown main item tag 0x4 [ 392.955312][ T41] hid-thrustmaster 0003:044F:B65D.0002: hidraw1: USB HID v0.01 Device [HID 044f:b65d] on usb-dummy_hcd.0-1/input0 [ 393.093085][ T41] hid-thrustmaster 0003:044F:B65D.0002: setup data couldn't be sent [ 393.097109][ C1] hid-thrustmaster 0003:044F:B65D.0002: URB to get model id failed with error -71 [ 393.110305][ T41] usb 5-1: USB disconnect, device number 28 [ 394.560707][T12619] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2268'. [ 396.913627][ T41] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 397.075566][ T41] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 397.083133][ T41] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 397.095350][ T41] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 397.107216][ T41] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 397.115682][ T41] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 397.121228][ T41] usb 6-1: Product: syz [ 397.123142][ T41] usb 6-1: Manufacturer: syz [ 397.125113][ T41] usb 6-1: SerialNumber: syz [ 397.351567][ T41] usblp 6-1:1.0: usblp0: USB Unidirectional printer dev 27 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 397.555528][ T41] usb 6-1: USB disconnect, device number 27 [ 397.578665][ T41] usblp0: removed [ 398.250162][ T5748] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 398.261028][ T5748] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 398.264768][ T5748] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 398.276075][ T5748] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 398.280932][ T5748] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 398.698786][T12707] wg2 speed is unknown, defaulting to 1000 [ 398.903857][ T13] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 399.238571][ T13] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 399.286299][T12742] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2315'. [ 399.349336][T12744] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2315'. [ 399.374421][ T13] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 399.397307][T12707] bridge0: port 1(bridge_slave_0) entered blocking state [ 399.400360][T12707] bridge0: port 1(bridge_slave_0) entered disabled state [ 399.403345][T12707] bridge_slave_0: entered allmulticast mode [ 399.410615][T12707] bridge_slave_0: entered promiscuous mode [ 400.382009][ T5738] Bluetooth: hci4: command tx timeout [ 402.443581][ T5738] Bluetooth: hci4: command tx timeout [ 402.494526][T12742] bridge0: port 2(bridge_slave_1) entered disabled state [ 402.497015][T12742] bridge0: port 1(bridge_slave_0) entered disabled state [ 402.559470][T12742] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 402.568801][T12742] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 402.828794][T12707] bridge0: port 2(bridge_slave_1) entered blocking state [ 402.831788][T12707] bridge0: port 2(bridge_slave_1) entered disabled state [ 402.835278][T12707] bridge_slave_1: entered allmulticast mode [ 402.839482][T12707] bridge_slave_1: entered promiscuous mode [ 402.920943][ T13] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 402.940502][T12707] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 402.947451][T12707] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 402.996687][T12707] team0: Port device team_slave_0 added [ 403.001516][T12707] team0: Port device team_slave_1 added [ 403.040163][T12707] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 403.046932][T12707] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 403.065180][T12707] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 403.110938][T12707] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 403.113986][T12707] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 403.124448][T12707] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 403.193503][ T50] usb 7-1: new high-speed USB device number 29 using dummy_hcd [ 403.197744][ T13] bridge_slave_1: left allmulticast mode [ 403.200254][ T13] bridge_slave_1: left promiscuous mode [ 403.207543][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 403.216362][ T13] bridge_slave_0: left allmulticast mode [ 403.219488][ T13] bridge_slave_0: left promiscuous mode [ 403.221524][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 403.236259][ T13] pim6reg99999999: left allmulticast mode [ 403.353583][ T50] usb 7-1: Using ep0 maxpacket: 32 [ 403.356842][ T50] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 403.360676][ T50] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 403.365039][ T50] usb 7-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 403.368295][ T50] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 403.375037][ T50] usb 7-1: config 0 descriptor?? [ 403.387497][ T50] hub 7-1:0.0: USB hub found [ 403.499129][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 403.507775][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 403.512426][ T13] bond0 (unregistering): Released all slaves [ 403.530302][T12707] hsr_slave_0: entered promiscuous mode [ 403.533111][T12707] hsr_slave_1: entered promiscuous mode [ 403.538426][T12707] debugfs: 'hsr0' already exists in 'hsr' [ 403.540254][T12707] Cannot create hsr debugfs directory [ 403.594618][T11979] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 403.597428][ T50] hub 7-1:0.0: 1 port detected [ 403.607968][T11979] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 403.673843][ T13] tipc: Left network mode [ 403.674564][ T12] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 403.690357][ T12] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 403.699424][ T12] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 403.707443][ T12] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 403.737325][ T12] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 403.740522][ T12] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 403.959416][T12772] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 403.966595][T12772] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 404.047455][T12789] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 404.055861][T12789] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 404.100911][ T5447] 8021q: adding VLAN 0 to HW filter on device eth2 [ 404.208350][ T50] hub 7-1:0.0: hub_hub_status failed (err = -71) [ 404.210900][T12797] pci 0000:00:00.0: [8086:29c0] type 00 class 0x060000 conventional PCI endpoint [ 404.217784][ T50] hub 7-1:0.0: config failed, can't get hub status (err -71) [ 404.240053][ T50] usbhid 7-1:0.0: can't add hid device: -71 [ 404.241848][T12797] pci 0000:00:00.0: Adding to iommu group 0 [ 404.245648][ T50] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 404.280464][ T50] usb 7-1: USB disconnect, device number 29 [ 404.282988][T12801] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2332'. [ 404.287543][T12801] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2332'. [ 404.533612][ T5738] Bluetooth: hci4: command tx timeout [ 404.611233][ T13] hsr_slave_0: left promiscuous mode [ 404.615082][ T13] hsr_slave_1: left promiscuous mode [ 404.617999][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 404.620860][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 404.625492][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 404.628481][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 404.656853][ T13] veth1_macvtap: left promiscuous mode [ 404.659946][ T13] veth0_macvtap: left promiscuous mode [ 404.662452][ T13] veth1_vlan: left promiscuous mode [ 404.978557][ T13] team0 (unregistering): Port device team_slave_1 removed [ 405.008609][ T13] team0 (unregistering): Port device team_slave_0 removed [ 405.175673][T12707] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 405.181622][T12707] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 405.186119][T12707] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 405.199963][T12707] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 405.203296][T12707] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 405.210394][T12707] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 405.213323][T12707] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 405.220736][T12707] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 405.296156][T12707] 8021q: adding VLAN 0 to HW filter on device bond0 [ 405.317509][T12707] 8021q: adding VLAN 0 to HW filter on device team0 [ 405.338843][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 405.341082][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 405.362583][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 405.364927][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 405.474286][T12844] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2340'. [ 405.680507][T12707] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 405.712947][T12707] veth0_vlan: entered promiscuous mode [ 405.721333][T12707] veth1_vlan: entered promiscuous mode [ 405.753329][T12707] veth0_macvtap: entered promiscuous mode [ 405.762225][T12707] veth1_macvtap: entered promiscuous mode [ 405.776971][T12707] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 405.785396][T12707] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 405.833740][T11979] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 405.842084][T11979] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 405.864425][ T1156] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 405.867665][ T1156] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 405.903162][ T48] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 405.907290][ T48] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 405.924609][T11979] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 405.930895][T11979] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 406.011265][T12869] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2347'. [ 406.258585][T12877] binder: 12876:12877 ioctl c0306201 80000080 returned -14 [ 406.603828][ T5738] Bluetooth: hci4: command tx timeout [ 406.640602][T12887] tipc: Can't bind to reserved service type 2 [ 406.912583][ T5748] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 406.922875][ T5748] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 406.930422][ T5748] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 406.938646][ T5748] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 406.941463][ T5748] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 407.338292][ T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 407.342922][ T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 407.347656][ T42] audit: type=1326 audit(2000000002.989:450): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12920 comm="syz.2.2365" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 407.354410][ T42] audit: type=1326 audit(2000000002.989:451): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12920 comm="syz.2.2365" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 407.361047][ T42] audit: type=1326 audit(2000000002.999:452): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12920 comm="syz.2.2365" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 407.369255][T12891] wg2 speed is unknown, defaulting to 1000 [ 407.369424][ T42] audit: type=1326 audit(2000000002.999:453): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12920 comm="syz.2.2365" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 407.385118][ T42] audit: type=1326 audit(2000000002.999:454): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12920 comm="syz.2.2365" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 407.391841][ T42] audit: type=1326 audit(2000000002.999:455): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12920 comm="syz.2.2365" exe="/syz-executor" sig=0 arch=40000003 syscall=434 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 407.403690][ T42] audit: type=1326 audit(2000000002.999:456): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12920 comm="syz.2.2365" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 407.415331][ T42] audit: type=1326 audit(2000000002.999:457): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12920 comm="syz.2.2365" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 407.422177][ T42] audit: type=1326 audit(2000000002.999:458): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12920 comm="syz.2.2365" exe="/syz-executor" sig=0 arch=40000003 syscall=346 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 407.428923][ T42] audit: type=1326 audit(2000000002.999:459): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12920 comm="syz.2.2365" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 407.504658][ T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 407.508126][ T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 407.621836][ T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 407.625071][ T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 407.737546][ T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 407.740968][ T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 407.789182][T12891] bridge0: port 1(bridge_slave_0) entered blocking state [ 407.791563][T12891] bridge0: port 1(bridge_slave_0) entered disabled state [ 407.794488][T12891] bridge_slave_0: entered allmulticast mode [ 407.797341][T12891] bridge_slave_0: entered promiscuous mode [ 407.802828][T12891] bridge0: port 2(bridge_slave_1) entered blocking state [ 407.809011][T12891] bridge0: port 2(bridge_slave_1) entered disabled state [ 407.811449][T12891] bridge_slave_1: entered allmulticast mode [ 407.814424][T12891] bridge_slave_1: entered promiscuous mode [ 407.847102][T12891] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 407.863340][T12891] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 407.935674][T12891] team0: Port device team_slave_0 added [ 407.939422][T12891] team0: Port device team_slave_1 added [ 407.979787][T12891] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 407.987295][T12891] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 407.995772][T12891] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 408.000033][T12891] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 408.002219][T12891] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 408.011206][T12891] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 408.065916][ T13] bridge_slave_1: left allmulticast mode [ 408.068370][ T13] bridge_slave_1: left promiscuous mode [ 408.070807][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 408.077559][ T13] bridge_slave_0: left allmulticast mode [ 408.079884][ T13] bridge_slave_0: left promiscuous mode [ 408.082243][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 408.236106][ T13] bond1 (unregistering): (slave ipip0): Releasing backup interface [ 408.238836][ T13] ipip0 (unregistering): left promiscuous mode [ 408.265218][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 408.270261][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 408.280392][ T13] bond0 (unregistering): Released all slaves [ 408.285475][ T13] bond1 (unregistering): Released all slaves [ 408.295742][T12891] hsr_slave_0: entered promiscuous mode [ 408.298013][T12891] hsr_slave_1: entered promiscuous mode [ 408.389623][ T13] tipc: Disabling bearer [ 408.418554][ T13] tipc: Left network mode [ 408.420235][T12963] netlink: 'syz.3.2377': attribute type 1 has an invalid length. [ 408.423268][T12963] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2377'. [ 408.519087][ T5447] 8021q: adding VLAN 0 to HW filter on device eth2 [ 408.817542][ T5447] 8021q: adding VLAN 0 to HW filter on device eth3 [ 409.010715][ T5738] Bluetooth: hci1: command tx timeout [ 409.061280][T13004] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2391'. [ 409.097936][ T13] hsr_slave_0: left promiscuous mode [ 409.101516][ T13] hsr_slave_1: left promiscuous mode [ 409.105059][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 409.107626][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 409.119571][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 409.127492][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 409.142677][ T13] veth1_macvtap: left promiscuous mode [ 409.144973][ T13] veth0_macvtap: left promiscuous mode [ 409.147141][ T13] veth1_vlan: left promiscuous mode [ 409.149209][ T13] veth0_vlan: left promiscuous mode [ 409.395392][ T13] team0 (unregistering): Port device team_slave_1 removed [ 409.406716][ T13] team0 (unregistering): Port device team_slave_0 removed [ 409.852603][T12891] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 409.864341][T12891] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 409.868800][T12891] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 409.888392][T12891] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 409.892428][T12891] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 409.927182][T12891] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 409.931084][T12891] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 409.943564][T12891] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 410.002699][T12891] 8021q: adding VLAN 0 to HW filter on device bond0 [ 410.014816][T12891] 8021q: adding VLAN 0 to HW filter on device team0 [ 410.020271][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 410.022665][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 410.031954][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 410.034313][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 410.038578][ T13] IPVS: stop unused estimator thread 0... [ 410.442235][T12891] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 410.473955][T12891] veth0_vlan: entered promiscuous mode [ 410.479883][T12891] veth1_vlan: entered promiscuous mode [ 410.500771][T12891] veth0_macvtap: entered promiscuous mode [ 410.507189][T12891] veth1_macvtap: entered promiscuous mode [ 410.522386][T12891] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 410.529404][T12891] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 410.586492][ T81] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 410.590501][ T81] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 410.609513][ T81] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 410.613518][ T81] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 410.653540][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 410.661836][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 410.683951][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 410.686787][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 410.736324][T13074] netlink: 76 bytes leftover after parsing attributes in process `syz.0.2403'. [ 410.987926][T13082] A link change request failed with some changes committed already. Interface nicv may have been left with an inconsistent configuration, please check. [ 410.997027][ T5812] wg2 speed is unknown, defaulting to 1000 [ 411.094346][ T5738] Bluetooth: hci1: command tx timeout [ 411.251510][ T5748] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 411.257858][ T5748] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 411.262162][ T5748] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 411.265898][ T5748] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 411.268891][ T5748] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 411.652470][T13094] wg2 speed is unknown, defaulting to 1000 [ 411.826671][ T12] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 412.018077][ T12] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 412.565656][T13131] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2421'. [ 412.574880][T13131] netlink: 91 bytes leftover after parsing attributes in process `syz.2.2421'. [ 413.163623][ T5738] Bluetooth: hci1: command tx timeout [ 413.323732][ T5738] Bluetooth: hci3: command tx timeout [ 414.791831][ T12] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 414.912825][T13094] bridge0: port 1(bridge_slave_0) entered blocking state [ 414.917526][T13094] bridge0: port 1(bridge_slave_0) entered disabled state [ 414.920498][T13094] bridge_slave_0: entered allmulticast mode [ 414.924311][T13094] bridge_slave_0: entered promiscuous mode [ 414.930861][T13094] bridge0: port 2(bridge_slave_1) entered blocking state [ 414.934314][T13094] bridge0: port 2(bridge_slave_1) entered disabled state [ 414.937397][T13094] bridge_slave_1: entered allmulticast mode [ 414.941415][T13094] bridge_slave_1: entered promiscuous mode [ 414.974720][T13094] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 415.050998][ T12] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 415.092368][T13094] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 415.124395][T13094] team0: Port device team_slave_0 added [ 415.129952][T13094] team0: Port device team_slave_1 added [ 415.145869][T13094] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 415.148208][T13094] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 415.156833][T13094] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 415.162671][T13094] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 415.165872][T13094] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 415.174934][T13094] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 415.210439][T13094] hsr_slave_0: entered promiscuous mode [ 415.212874][T13094] hsr_slave_1: entered promiscuous mode [ 415.215589][T13094] debugfs: 'hsr0' already exists in 'hsr' [ 415.217462][T13094] Cannot create hsr debugfs directory [ 415.243682][ T5738] Bluetooth: hci1: command tx timeout [ 415.405515][ T5738] Bluetooth: hci3: command tx timeout [ 415.497862][ T12] bridge_slave_1: left allmulticast mode [ 415.499712][ T12] bridge_slave_1: left promiscuous mode [ 415.508294][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 415.517852][ T12] bridge_slave_0: left allmulticast mode [ 415.520186][ T12] bridge_slave_0: left promiscuous mode [ 415.522183][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 415.742937][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 415.758841][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 415.778096][ T12] bond0 (unregistering): Released all slaves [ 415.786349][ T12] bond1 (unregistering): Released all slaves [ 415.806418][ T50] wg2 speed is unknown, defaulting to 1000 [ 415.808375][ T50] syz2: Port: 1 Link DOWN [ 415.811123][ T50] wg2 speed is unknown, defaulting to 1000 [ 415.947683][ T12] tipc: Left network mode [ 416.347987][ T5447] 8021q: adding VLAN 0 to HW filter on device eth2 [ 416.539444][ T12] hsr_slave_0: left promiscuous mode [ 416.544132][ T12] hsr_slave_1: left promiscuous mode [ 416.546257][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 416.550764][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 416.561523][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 416.565986][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 416.598691][ T12] veth1_macvtap: left promiscuous mode [ 416.607726][ T12] veth0_macvtap: left promiscuous mode [ 416.614005][ T12] veth1_vlan: left promiscuous mode [ 416.624114][ T12] veth0_vlan: left promiscuous mode [ 417.051977][ T12] team0 (unregistering): Port device team_slave_1 removed [ 417.071133][ T12] team0 (unregistering): Port device team_slave_0 removed [ 417.109730][ T1157] smc: removing ib device syz2 [ 417.292393][ T1157] smbdirect: ib_dev[syz2] removed [ 417.498681][ T5738] Bluetooth: hci3: command tx timeout [ 417.613900][T13211] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 417.761061][T13094] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 417.785631][T13094] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 417.795906][T13094] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 417.832141][T13094] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 417.841305][T13094] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 417.856754][T13094] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 417.863606][T13094] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 417.889507][T13094] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 417.992455][T13094] 8021q: adding VLAN 0 to HW filter on device bond0 [ 418.014545][T13094] 8021q: adding VLAN 0 to HW filter on device team0 [ 418.033864][ T1156] bridge0: port 1(bridge_slave_0) entered blocking state [ 418.036553][ T1156] bridge0: port 1(bridge_slave_0) entered forwarding state [ 418.044745][T11384] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 418.076125][ T39] bridge0: port 2(bridge_slave_1) entered blocking state [ 418.078448][ T39] bridge0: port 2(bridge_slave_1) entered forwarding state [ 418.174317][T11384] usb 5-1: device descriptor read/64, error -71 [ 418.441589][T11384] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 418.480218][T13094] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 418.512622][T13094] veth0_vlan: entered promiscuous mode [ 418.527737][T13094] veth1_vlan: entered promiscuous mode [ 418.559628][T13094] veth0_macvtap: entered promiscuous mode [ 418.567314][T13094] veth1_macvtap: entered promiscuous mode [ 418.573975][T11384] usb 5-1: device descriptor read/64, error -71 [ 418.583795][T13094] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 418.596882][T13094] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 418.684721][T12765] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 418.685069][T11384] usb usb5-port1: attempt power cycle [ 418.714265][ T1156] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 418.721067][ T1156] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 418.775679][ T39] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 418.779033][ T39] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 418.803680][T12765] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 418.806642][T12765] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 418.810046][T12765] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 418.906938][T13255] netlink: 144 bytes leftover after parsing attributes in process `syz.1.2449'. [ 418.909824][T13255] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2449'. [ 419.034317][T11384] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 419.054206][T11384] usb 5-1: device descriptor read/8, error -71 [ 419.314403][T11384] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 419.354274][T11384] usb 5-1: device descriptor read/8, error -71 [ 419.477662][T11384] usb usb5-port1: unable to enumerate USB device [ 419.573680][ T5738] Bluetooth: hci3: command tx timeout [ 419.838568][ T5748] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 419.846439][ T5748] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 419.857115][ T5748] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 419.865308][ T5748] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 419.868916][ T5748] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 420.369355][T13302] bridge0: port 1(bridge_slave_0) entered blocking state [ 420.371757][T13302] bridge0: port 1(bridge_slave_0) entered disabled state [ 420.379195][T13302] bridge_slave_0: entered allmulticast mode [ 420.382205][T13302] bridge_slave_0: entered promiscuous mode [ 420.392297][T13302] bridge0: port 2(bridge_slave_1) entered blocking state [ 420.395784][T13302] bridge0: port 2(bridge_slave_1) entered disabled state [ 420.398829][T13302] bridge_slave_1: entered allmulticast mode [ 420.402681][T13302] bridge_slave_1: entered promiscuous mode [ 420.411821][T13324] binder: 13323:13324 ioctl 4018620d 0 returned -22 [ 420.442311][T13302] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 420.492289][T13302] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 420.518421][T13302] team0: Port device team_slave_0 added [ 420.522822][T13302] team0: Port device team_slave_1 added [ 420.551467][T13302] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 420.554266][T13302] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 420.565663][T13302] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 420.570418][T13302] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 420.573075][T13302] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 420.578351][T13330] netlink: 152 bytes leftover after parsing attributes in process `syz.1.2475'. [ 420.582648][T13302] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 420.621215][T13302] hsr_slave_0: entered promiscuous mode [ 420.625552][T13302] hsr_slave_1: entered promiscuous mode [ 420.628470][T13302] debugfs: 'hsr0' already exists in 'hsr' [ 420.631937][T13302] Cannot create hsr debugfs directory [ 420.694318][ T9] usb 8-1: new high-speed USB device number 18 using dummy_hcd [ 420.848891][ T9] usb 8-1: config 0 has an invalid interface number: 64 but max is 0 [ 420.852364][ T9] usb 8-1: config 0 has an invalid descriptor of length 48, skipping remainder of the config [ 420.856814][ T9] usb 8-1: config 0 has no interface number 0 [ 420.861207][ T9] usb 8-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice=39.48 [ 420.864366][ T9] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 420.867025][ T9] usb 8-1: Product: syz [ 420.868375][ T9] usb 8-1: Manufacturer: syz [ 420.869908][ T9] usb 8-1: SerialNumber: syz [ 420.873288][ T9] usb 8-1: config 0 descriptor?? [ 420.895141][T13345] ------------[ cut here ]------------ [ 420.898751][T13345] skb_assert_len [ 420.900322][T13345] WARNING: ./include/linux/skbuff.h:2753 at __dev_queue_xmit+0x21bc/0x4970, CPU#3: syz.0.2482/13345 [ 420.904605][T13345] Modules linked in: SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 420.907851][T13345] CPU: 3 UID: 0 PID: 13345 Comm: syz.0.2482 Tainted: G L syzkaller #0 PREEMPT(full) [ 420.911558][T13345] Tainted: [L]=SOFTLOCKUP [ 420.913040][T13345] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 420.917050][T13345] RIP: 0010:__dev_queue_xmit+0x21c3/0x4970 [ 420.919172][T13345] Code: 41 b8 01 00 00 00 31 d2 31 f6 48 89 df e8 95 7f f8 ff e9 b3 e0 ff ff e8 cb 55 7f f8 48 8d 3d 14 3a a6 07 48 c7 c6 e0 6f 16 8d <67> 48 0f b9 3a 44 0f b6 25 f1 1e 7f 07 31 ff 44 89 e6 e8 b6 4f 7f [ 420.926882][T13345] RSP: 0000:ffffc900068c7820 EFLAGS: 00010287 [ 420.929286][T13345] RAX: 0000000000000199 RBX: ffff888025a9ab40 RCX: ffffc90007a32000 [ 420.932103][T13345] RDX: 0000000000080000 RSI: ffffffff8d166fe0 RDI: ffffffff9130a550 [ 420.934686][T13345] RBP: ffff888025a9ab50 R08: 0000000000000005 R09: 0000000000000000 [ 420.936863][T13345] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88806641d6c0 [ 420.939036][T13345] R13: 0000000000000000 R14: 0000000000000000 R15: ffff888025a9abf4 [ 420.941732][T13345] FS: 0000000000000000(0000) GS:ffff888096ef3000(0063) knlGS:00000000f547db40 [ 420.945398][T13345] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 420.948159][T13345] CR2: 00000000f72aea06 CR3: 0000000064151000 CR4: 0000000000352ef0 [ 420.950825][T13345] Call Trace: [ 420.951949][T13345] [ 420.952933][T13345] ? __alloc_skb+0x4e9/0x710 [ 420.954537][T13345] ? __alloc_skb+0x5b7/0x710 [ 420.956037][T13345] ? __pfx___alloc_skb+0x10/0x10 [ 420.957633][T13345] ? __pfx___dev_queue_xmit+0x10/0x10 [ 420.959340][T13345] ? sock_alloc_send_pskb+0x751/0x980 [ 420.961061][T13345] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 420.963745][T13345] ? packet_parse_headers+0x5ab/0x810 [ 420.965450][T13345] ? __asan_memset+0x23/0x50 [ 420.967005][T13345] ? packet_parse_headers+0x5b7/0x810 [ 420.968738][T13345] ? packet_parse_headers+0x2b4/0x810 [ 420.970472][T13345] ? __pfx_packet_parse_headers+0x10/0x10 [ 420.972317][T13345] packet_xmit+0x243/0x310 [ 420.973811][T13345] packet_sendmsg+0x28d6/0x4eb0 [ 420.975426][T13345] ? __pfx_packet_sendmsg+0x10/0x10 [ 420.977335][T13345] ? __might_fault+0xc5/0x140 [ 420.979039][T13345] ? apparmor_socket_sendmsg+0x15b/0x270 [ 420.981241][T13345] __sys_sendto+0x48b/0x4e0 [ 420.983017][T13345] ? __pfx_packet_sendmsg+0x10/0x10 [ 420.985380][T13345] ? __pfx___sys_sendto+0x10/0x10 [ 420.987033][T13345] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 420.989253][T13345] __ia32_sys_sendto+0xdd/0x1b0 [ 420.991239][T13345] ? __do_fast_syscall_32+0x98/0x970 [ 420.993537][T13345] ? lockdep_hardirqs_on+0x78/0x100 [ 420.995677][T13345] __do_fast_syscall_32+0xe7/0x970 [ 420.997686][T13345] do_fast_syscall_32+0x32/0x70 [ 420.999849][T13345] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 421.002043][T13345] RIP: 0023:0xf708efec [ 421.003391][T13345] Code: Unable to access opcode bytes at 0xf708efc2. [ 421.005930][T13345] RSP: 002b:00000000f547d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000171 [ 421.009192][T13345] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 [ 421.012467][T13345] RDX: 0000000000000000 RSI: 0000000004000010 RDI: 0000000080000000 [ 421.015867][T13345] RBP: 0000000000000014 R08: 0000000000000000 R09: 0000000000000000 [ 421.018861][T13345] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 421.021575][T13345] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 421.024167][T13345] [ 421.025169][T13345] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 421.027859][T13345] CPU: 3 UID: 0 PID: 13345 Comm: syz.0.2482 Tainted: G L syzkaller #0 PREEMPT(full) [ 421.032092][T13345] Tainted: [L]=SOFTLOCKUP [ 421.033825][T13345] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 421.037754][T13345] Call Trace: [ 421.039077][T13345] [ 421.040265][T13345] dump_stack_lvl+0x100/0x190 [ 421.042131][T13345] vpanic+0x552/0x970 [ 421.043769][T13345] ? __pfx_vpanic+0x10/0x10 [ 421.045586][T13345] panic+0xd1/0xe0 [ 421.047092][T13345] ? __pfx_panic+0x10/0x10 [ 421.048790][T13345] check_panic_on_warn.cold+0x19/0x34 [ 421.050893][T13345] ? __dev_queue_xmit+0x21bc/0x4970 [ 421.052623][T13345] __warn.cold+0x191/0x318 [ 421.054093][T13345] __report_bug+0x30f/0x440 [ 421.055565][T13345] ? __dev_queue_xmit+0x21bc/0x4970 [ 421.057241][T13345] ? __pfx___report_bug+0x10/0x10 [ 421.058858][T13345] ? __pfx___skb_flow_dissect+0x10/0x10 [ 421.060647][T13345] report_bug_entry+0xe1/0x290 [ 421.062186][T13345] ? __dev_queue_xmit+0x21c3/0x4970 [ 421.063867][T13345] handle_bug+0x1cd/0x2a0 [ 421.065353][T13345] exc_invalid_op+0x17/0x50 [ 421.067436][T13345] asm_exc_invalid_op+0x1a/0x20 [ 421.069201][T13345] RIP: 0010:__dev_queue_xmit+0x21c3/0x4970 [ 421.071529][T13345] Code: 41 b8 01 00 00 00 31 d2 31 f6 48 89 df e8 95 7f f8 ff e9 b3 e0 ff ff e8 cb 55 7f f8 48 8d 3d 14 3a a6 07 48 c7 c6 e0 6f 16 8d <67> 48 0f b9 3a 44 0f b6 25 f1 1e 7f 07 31 ff 44 89 e6 e8 b6 4f 7f [ 421.078442][T13345] RSP: 0000:ffffc900068c7820 EFLAGS: 00010287 [ 421.080931][T13345] RAX: 0000000000000199 RBX: ffff888025a9ab40 RCX: ffffc90007a32000 [ 421.084393][T13345] RDX: 0000000000080000 RSI: ffffffff8d166fe0 RDI: ffffffff9130a550 [ 421.088086][T13345] RBP: ffff888025a9ab50 R08: 0000000000000005 R09: 0000000000000000 [ 421.091141][T13345] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88806641d6c0 [ 421.094382][T13345] R13: 0000000000000000 R14: 0000000000000000 R15: ffff888025a9abf4 [ 421.097311][T13345] ? __alloc_skb+0x4e9/0x710 [ 421.099058][T13345] ? __alloc_skb+0x5b7/0x710 [ 421.100549][T13345] ? __pfx___alloc_skb+0x10/0x10 [ 421.102158][T13345] ? __pfx___dev_queue_xmit+0x10/0x10 [ 421.103884][T13345] ? sock_alloc_send_pskb+0x751/0x980 [ 421.105605][T13345] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 421.107342][T13345] ? packet_parse_headers+0x5ab/0x810 [ 421.109097][T13345] ? __asan_memset+0x23/0x50 [ 421.110572][T13345] ? packet_parse_headers+0x5b7/0x810 [ 421.112294][T13345] ? packet_parse_headers+0x2b4/0x810 [ 421.114029][T13345] ? __pfx_packet_parse_headers+0x10/0x10 [ 421.115822][T13345] packet_xmit+0x243/0x310 [ 421.117248][T13345] packet_sendmsg+0x28d6/0x4eb0 [ 421.118806][T13345] ? __pfx_packet_sendmsg+0x10/0x10 [ 421.120612][T13345] ? __might_fault+0xc5/0x140 [ 421.122188][T13345] ? apparmor_socket_sendmsg+0x15b/0x270 [ 421.124035][T13345] __sys_sendto+0x48b/0x4e0 [ 421.125491][T13345] ? __pfx_packet_sendmsg+0x10/0x10 [ 421.127152][T13345] ? __pfx___sys_sendto+0x10/0x10 [ 421.128767][T13345] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 421.130669][T13345] __ia32_sys_sendto+0xdd/0x1b0 [ 421.132253][T13345] ? __do_fast_syscall_32+0x98/0x970 [ 421.133894][T13345] ? lockdep_hardirqs_on+0x78/0x100 [ 421.135552][T13345] __do_fast_syscall_32+0xe7/0x970 [ 421.137230][T13345] do_fast_syscall_32+0x32/0x70 [ 421.138782][T13345] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 421.140787][T13345] RIP: 0023:0xf708efec [ 421.142106][T13345] Code: Unable to access opcode bytes at 0xf708efc2. [ 421.144181][T13345] RSP: 002b:00000000f547d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000171 [ 421.147449][T13345] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 [ 421.151784][T13345] RDX: 0000000000000000 RSI: 0000000004000010 RDI: 0000000080000000 [ 421.154278][T13345] RBP: 0000000000000014 R08: 0000000000000000 R09: 0000000000000000 [ 421.156764][T13345] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 421.159228][T13345] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 421.161788][T13345] [ 421.163460][T13345] Kernel Offset: disabled [ 421.164845][T13345] Rebooting in 86400 seconds..