syzkaller login: qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x400000)
qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x190000)
[ 90.680357][ T1028] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1
[ 90.682928][ T1028] ata1: failed to read log page 10h (errno=-5)
[ 90.685046][ T1028] ata1.00: exception Emask 0x1 SAct 0x1d00 SErr 0x0 action 0x0
[ 90.687891][ T1028] ata1.00: irq_stat 0x41000000
[ 90.698843][ T1028] ata1.00: failed command: WRITE FPDMA QUEUED
[ 90.701439][ T1028] ata1.00: cmd 61/00:40:36:01:05/20:00:00:00:00/40 tag 8 ncq dma 4194304 ou
[ 90.701439][ T1028] res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 90.708279][ T1028] ata1.00: status: { DRDY }
[ 90.728751][ T1028] ata1.00: error: { ABRT }
[ 90.730919][ T1028] ata1.00: failed command: WRITE FPDMA QUEUED
[ 90.733652][ T1028] ata1.00: cmd 61/00:50:36:41:05/20:00:00:00:00/40 tag 10 ncq dma 4194304 ou
[ 90.733652][ T1028] res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 90.748617][ T1028] ata1.00: status: { DRDY }
[ 90.750635][ T1028] ata1.00: error: { ABRT }
[ 90.752511][ T1028] ata1.00: failed command: WRITE FPDMA QUEUED
[ 90.754946][ T1028] ata1.00: cmd 61/80:58:36:61:05/0c:00:00:00:00/40 tag 11 ncq dma 1638400 ou
[ 90.754946][ T1028] res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 90.776311][ T1028] ata1.00: status: { DRDY }
[ 90.779390][ T1028] ata1.00: error: { ABRT }
[ 90.784416][ T1028] ata1.00: failed command: WRITE FPDMA QUEUED
[ 90.786856][ T1028] ata1.00: cmd 61/70:60:b6:6d:05/02:00:00:00:00/40 tag 12 ncq dma 319488 out
[ 90.786856][ T1028] res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 90.808692][ T1028] ata1.00: status: { DRDY }
[ 90.810423][ T1028] ata1.00: error: { ABRT }
[ 90.813626][ T1028] ata1.00: configured for UDMA/100
[ 90.817907][ T1028] ata1: EH complete
Warning: Permanently added '[localhost]:61007' (ED25519) to the list of known hosts.
2026/05/21 19:58:27 parsed 1 programs
[ 96.841437][ T5292] cgroup: Unknown subsys name 'net'
[ 96.894344][ T5292] cgroup: Unknown subsys name 'cpuset'
[ 96.900420][ T5292] cgroup: Unknown subsys name 'rlimit'
[ 96.926712][ T48] cfg80211: failed to load regulatory.db
Setting up swapspace version 1, size = 127995904 bytes
[ 98.980485][ T5292] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 104.535602][ T5317] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 105.238344][ T44] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 105.246859][ T44] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 105.252525][ T44] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 105.257420][ T44] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 105.262083][ T44] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 106.052209][ T177] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 106.061797][ T177] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 106.151595][ T177] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 106.155773][ T177] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 112.857719][ T5374] bridge0: port 1(bridge_slave_0) entered blocking state
[ 112.869528][ T5374] bridge0: port 1(bridge_slave_0) entered disabled state
[ 112.872911][ T5374] bridge_slave_0: entered allmulticast mode
[ 112.883133][ T5374] bridge_slave_0: entered promiscuous mode
[ 112.897358][ T5374] bridge0: port 2(bridge_slave_1) entered blocking state
[ 112.909224][ T5374] bridge0: port 2(bridge_slave_1) entered disabled state
[ 112.912378][ T5374] bridge_slave_1: entered allmulticast mode
[ 112.921004][ T5374] bridge_slave_1: entered promiscuous mode
[ 112.979542][ T5374] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 112.993559][ T5374] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 113.060203][ T5374] team0: Port device team_slave_0 added
[ 113.071166][ T5374] team0: Port device team_slave_1 added
[ 113.116234][ T5374] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 113.128792][ T5374] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 113.148700][ T5374] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 113.164114][ T5374] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 113.179054][ T5374] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 113.199190][ T5374] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 113.255208][ T5374] hsr_slave_0: entered promiscuous mode
[ 113.259731][ T5374] hsr_slave_1: entered promiscuous mode
[ 113.432772][ T5374] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 113.448175][ T5374] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 113.453509][ T5374] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 113.461024][ T5374] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 113.464894][ T5374] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 113.472126][ T5374] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 113.476115][ T5374] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 113.487499][ T5374] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 113.523551][ T5374] bridge0: port 2(bridge_slave_1) entered blocking state
[ 113.526732][ T5374] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 113.531012][ T5374] bridge0: port 1(bridge_slave_0) entered blocking state
[ 113.534324][ T5374] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 113.600968][ T5374] 8021q: adding VLAN 0 to HW filter on device bond0
[ 113.623051][ T24] bridge0: port 1(bridge_slave_0) entered disabled state
[ 113.627495][ T24] bridge0: port 2(bridge_slave_1) entered disabled state
[ 113.644564][ T5374] 8021q: adding VLAN 0 to HW filter on device team0
[ 113.656551][ T74] bridge0: port 1(bridge_slave_0) entered blocking state
[ 113.659884][ T74] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 113.675125][ T74] bridge0: port 2(bridge_slave_1) entered blocking state
[ 113.678400][ T74] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 114.095625][ T5374] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 114.151428][ T5374] veth0_vlan: entered promiscuous mode
[ 114.162711][ T5374] veth1_vlan: entered promiscuous mode
[ 114.197411][ T5374] veth0_macvtap: entered promiscuous mode
[ 114.210915][ T5374] veth1_macvtap: entered promiscuous mode
[ 114.231122][ T5374] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 114.244927][ T5374] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 114.261998][ T74] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 114.274804][ T74] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 114.285788][ T74] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 114.301948][ T74] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 114.613694][ T74] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 114.665710][ T74] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 114.713389][ T74] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
2026/05/21 19:58:48 executed programs: 0
[ 115.470893][ T4653] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 115.476955][ T4653] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 115.484232][ T4653] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 115.487650][ T4653] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 115.491336][ T4653] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 115.760017][ T74] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 116.033316][ T5421] bridge0: port 1(bridge_slave_0) entered blocking state
[ 116.036107][ T5421] bridge0: port 1(bridge_slave_0) entered disabled state
[ 116.040154][ T5421] bridge_slave_0: entered allmulticast mode
[ 116.044098][ T5421] bridge_slave_0: entered promiscuous mode
[ 116.052258][ T5421] bridge0: port 2(bridge_slave_1) entered blocking state
[ 116.055576][ T5421] bridge0: port 2(bridge_slave_1) entered disabled state
[ 116.059810][ T5421] bridge_slave_1: entered allmulticast mode
[ 116.063788][ T5421] bridge_slave_1: entered promiscuous mode
[ 116.088340][ T5421] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 116.095935][ T5421] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 116.147574][ T5421] team0: Port device team_slave_0 added
[ 116.162908][ T5421] team0: Port device team_slave_1 added
[ 116.205608][ T5421] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 116.218910][ T5421] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 116.238953][ T5421] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 116.249520][ T5421] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 116.257711][ T5421] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 116.282185][ T5421] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 116.363777][ T5421] hsr_slave_0: entered promiscuous mode
[ 116.370003][ T5421] hsr_slave_1: entered promiscuous mode
[ 116.379525][ T5421] debugfs: 'hsr0' already exists in 'hsr'
[ 116.382327][ T5421] Cannot create hsr debugfs directory
[ 117.129775][ T74] bridge_slave_1: left allmulticast mode
[ 117.136059][ T74] bridge_slave_1: left promiscuous mode
[ 117.144156][ T74] bridge0: port 2(bridge_slave_1) entered disabled state
[ 117.154522][ T74] bridge_slave_0: left allmulticast mode
[ 117.166269][ T74] bridge_slave_0: left promiscuous mode
[ 117.169318][ T74] bridge0: port 1(bridge_slave_0) entered disabled state
[ 117.506621][ T74] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 117.514668][ T74] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 117.520168][ T74] bond0 (unregistering): Released all slaves
[ 117.531320][ T4998] 8021q: adding VLAN 0 to HW filter on device eth2
[ 117.559813][ T4653] Bluetooth: hci0: command tx timeout
[ 117.578365][ T74] hsr_slave_0: left promiscuous mode
[ 117.588342][ T74] hsr_slave_1: left promiscuous mode
[ 117.591953][ T74] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 117.595100][ T74] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 117.606488][ T74] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 117.609767][ T74] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 117.622797][ T74] veth1_macvtap: left promiscuous mode
[ 117.626027][ T74] veth0_macvtap: left promiscuous mode
[ 117.628478][ T74] veth1_vlan: left promiscuous mode
[ 117.631979][ T74] veth0_vlan: left promiscuous mode
[ 117.872827][ T74] team0 (unregistering): Port device team_slave_1 removed
[ 117.885809][ T74] team0 (unregistering): Port device team_slave_0 removed
[ 118.768713][ T5421] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 118.801848][ T5421] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 118.807375][ T5421] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 118.824966][ T5421] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 118.834886][ T5421] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 118.855436][ T5421] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 118.869386][ T5421] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 118.881466][ T5421] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 119.056375][ T5421] 8021q: adding VLAN 0 to HW filter on device bond0
[ 119.104547][ T5421] 8021q: adding VLAN 0 to HW filter on device team0
[ 119.135531][ T74] bridge0: port 1(bridge_slave_0) entered blocking state
[ 119.138681][ T74] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 119.157110][ T74] bridge0: port 2(bridge_slave_1) entered blocking state
[ 119.160233][ T74] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 119.639360][ T4653] Bluetooth: hci0: command tx timeout
[ 119.684350][ T5421] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 119.732980][ T5421] veth0_vlan: entered promiscuous mode
[ 119.741937][ T5421] veth1_vlan: entered promiscuous mode
[ 119.773560][ T5421] veth0_macvtap: entered promiscuous mode
[ 119.781247][ T5421] veth1_macvtap: entered promiscuous mode
[ 119.796690][ T5421] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 119.806261][ T5421] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 119.823624][ T177] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 119.831086][ T177] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 119.840841][ T177] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 119.846714][ T177] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 119.935898][ T69] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 119.947114][ T69] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 119.980012][ T177] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 119.984361][ T177] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 120.310129][ T48] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 120.459098][ T48] usb 5-1: Using ep0 maxpacket: 16
[ 120.465955][ T48] usb 5-1: config 0 has an invalid interface number: 8 but max is 0
[ 120.470099][ T48] usb 5-1: config 0 has no interface number 0
[ 120.472733][ T48] usb 5-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7
[ 120.480561][ T48] usb 5-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f
[ 120.484420][ T48] usb 5-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3
[ 120.487922][ T48] usb 5-1: Product: syz
[ 120.490165][ T48] usb 5-1: SerialNumber: syz
[ 120.498909][ T48] usb 5-1: config 0 descriptor??
[ 120.514738][ T48] cm109 5-1:0.8: invalid payload size 105, expected 4
[ 120.531490][ T48] input: CM109 USB driver as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.8/input/input5
[ 120.914325][ C0] cm109 5-1:0.8: cm109_urb_irq_callback: urb status -71
[ 120.917565][ C0] ------------[ cut here ]------------
[ 120.920149][ C0] URB ffff888042746500 submitted while active
[ 120.922794][ C0] WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x7b/0x18b0, CPU#0: syz.0.17/5477
[ 120.927177][ C0] Modules linked in:
[ 120.928987][ C0] CPU: 0 UID: 0 PID: 5477 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
[ 120.932930][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 120.937418][ C0] RIP: 0010:usb_submit_urb+0x7e/0x18b0
[ 120.939873][ C0] Code: 89 f0 48 c1 e8 03 42 80 3c 38 00 74 08 4c 89 f7 e8 e7 37 f4 fa 49 83 3e 00 74 40 e8 dc 6b 87 fa 48 8d 3d c5 f3 ff 08 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 c1 6b 87 fa eb 05 e8 ba 6b
[ 120.948748][ C0] RSP: 0018:ffffc90000007a00 EFLAGS: 00010046
[ 120.951759][ C0] RAX: ffffffff873e6854 RBX: ffff888042746500 RCX: ffff88801f8d4a00
[ 120.955267][ C0] RDX: 0000000000000100 RSI: ffff888042746500 RDI: ffffffff903e5c20
[ 120.958668][ C0] RBP: 000000000000000f R08: 0000000000000003 R09: 0000000000000004
[ 120.962143][ C0] R10: dffffc0000000000 R11: fffff52000000f40 R12: 0000000000000820
[ 120.965561][ C0] R13: ffff888012819030 R14: ffff888042746508 R15: dffffc0000000000
[ 120.968830][ C0] FS: 00005555954d0500(0000) GS:ffff88808c87e000(0000) knlGS:0000000000000000
[ 120.972607][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 120.975346][ C0] CR2: 00007f0d744fe440 CR3: 0000000045586000 CR4: 0000000000352ef0
[ 120.978639][ C0] Call Trace:
[ 120.980102][ C0]
[ 120.981351][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 120.983856][ C0] ? ___ratelimit+0x58c/0x8d0
[ 120.985867][ C0] cm109_urb_irq_callback+0x6e2/0xc90
[ 120.988136][ C0] __usb_hcd_giveback_urb+0x376/0x540
[ 120.990340][ C0] dummy_timer+0xbc0/0x4650
[ 120.992420][ C0] ? __lock_acquire+0x6b5/0x2cf0
[ 120.994628][ C0] ? __lock_acquire+0x6b5/0x2cf0
[ 120.996803][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 120.999096][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 121.001082][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 121.003622][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 121.005610][ C0] __hrtimer_run_queues+0x3c0/0xa20
[ 121.007724][ C0] hrtimer_run_softirq+0x17a/0x240
[ 121.009935][ C0] handle_softirqs+0x22a/0x840
[ 121.012080][ C0] ? __irq_exit_rcu+0xca/0x220
[ 121.013995][ C0] __irq_exit_rcu+0xca/0x220
[ 121.015866][ C0] irq_exit_rcu+0x9/0x30
[ 121.017683][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0
[ 121.020089][ C0]
[ 121.021435][ C0]
[ 121.022866][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 121.025483][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80
[ 121.028137][ C0] Code: f7 e8 2d 8b f4 f5 f7 c3 00 02 00 00 74 05 e8 90 2f 20 f6 9c 58 a9 00 02 00 00 75 27 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 e4 09 e6 f5 65 8b 05 0d 50 8c 07 85 c0 74 18 5b 41 5e c3 cc cc
[ 121.035974][ C0] RSP: 0018:ffffc90003857b40 EFLAGS: 00000206
[ 121.038661][ C0] RAX: 0000000000000006 RBX: 0000000000000246 RCX: 0000000080000001
[ 121.042173][ C0] RDX: 0000000000000006 RSI: ffffffff8dfabee1 RDI: 0000000000000001
[ 121.045554][ C0] RBP: 0000000000000000 R08: ffffffff9030f0f7 R09: 1ffffffff2061e1e
[ 121.048881][ C0] R10: dffffc0000000000 R11: fffffbfff2061e1f R12: 0000000000000246
[ 121.052101][ C0] R13: dffffc0000000000 R14: ffff888037500000 R15: ffff88801f51d400
[ 121.055292][ C0] dummy_pullup+0xcf/0x120
[ 121.057282][ C0] ? __pfx_dummy_pullup+0x10/0x10
[ 121.059511][ C0] usb_gadget_disconnect_locked+0x143/0x4a0
[ 121.062033][ C0] gadget_unbind_driver+0xc7/0x450
[ 121.064078][ C0] ? __pfx_gadget_unbind_driver+0x10/0x10
[ 121.066300][ C0] device_release_driver_internal+0x46f/0x870
[ 121.068844][ C0] driver_detach+0x1f3/0x2d0
[ 121.070788][ C0] bus_remove_driver+0x226/0x320
[ 121.072992][ C0] usb_gadget_unregister_driver+0x4e/0x70
[ 121.075449][ C0] raw_release+0xd7/0x260
[ 121.077346][ C0] ? __pfx_raw_release+0x10/0x10
[ 121.079493][ C0] __fput+0x44f/0xa60
[ 121.081291][ C0] task_work_run+0x1d9/0x270
[ 121.083478][ C0] ? __pfx_task_work_run+0x10/0x10
[ 121.085683][ C0] exit_to_user_mode_loop+0xf3/0x4d0
[ 121.088044][ C0] ? rcu_is_watching+0x15/0xb0
[ 121.090153][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 121.092937][ C0] do_syscall_64+0x33e/0xf80
[ 121.095016][ C0] ? clear_bhb_loop+0x40/0x90
[ 121.097069][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 121.099575][ C0] RIP: 0033:0x7f0d7439ce59
[ 121.101268][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 121.109420][ C0] RSP: 002b:00007ffed3421518 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
[ 121.113042][ C0] RAX: 0000000000000000 RBX: 00007ffed3421600 RCX: 00007f0d7439ce59
[ 121.116351][ C0] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
[ 121.119739][ C0] RBP: 000000000001d458 R08: 0000000000000001 R09: 0000000000000000
[ 121.122773][ C0] R10: 0000001b2ec20000 R11: 0000000000000246 R12: 0000000000000000
[ 121.125763][ C0] R13: 00007f0d74615fac R14: 00007f0d74615fa8 R15: 00007f0d74615fa0
[ 121.128657][ C0]
[ 121.129900][ C0] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 121.132791][ C0] CPU: 0 UID: 0 PID: 5477 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
[ 121.136537][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 121.140832][ C0] Call Trace:
[ 121.142363][ C0]
[ 121.143655][ C0] vpanic+0x56c/0xa60
[ 121.145444][ C0] ? __pfx__printk+0x10/0x10
[ 121.147431][ C0] ? __pfx_vpanic+0x10/0x10
[ 121.149440][ C0] ? is_bpf_text_address+0x292/0x2b0
[ 121.151588][ C0] ? is_bpf_text_address+0x26/0x2b0
[ 121.153839][ C0] panic+0xc5/0xd0
[ 121.155496][ C0] ? __pfx_panic+0x10/0x10
[ 121.157332][ C0] __warn+0x315/0x4c0
[ 121.159060][ C0] ? usb_submit_urb+0x7b/0x18b0
[ 121.161142][ C0] ? usb_submit_urb+0x7b/0x18b0
[ 121.163201][ C0] __report_bug+0x29a/0x540
[ 121.165151][ C0] ? __pfx_dev_vprintk_emit+0x10/0x10
[ 121.167467][ C0] ? usb_submit_urb+0x7b/0x18b0
[ 121.169518][ C0] ? __pfx___report_bug+0x10/0x10
[ 121.171665][ C0] ? mark_lock+0x180/0x190
[ 121.173543][ C0] ? dev_printk_emit+0xee/0x140
[ 121.175673][ C0] ? __lock_acquire+0x6b5/0x2cf0
[ 121.177765][ C0] report_bug_entry+0x19a/0x290
[ 121.179822][ C0] ? usb_submit_urb+0x7e/0x18b0
[ 121.182046][ C0] ? usb_submit_urb+0x83/0x18b0
[ 121.184179][ C0] handle_bug+0xce/0x200
[ 121.186002][ C0] exc_invalid_op+0x1a/0x50
[ 121.188012][ C0] asm_exc_invalid_op+0x1a/0x20
[ 121.190145][ C0] RIP: 0010:usb_submit_urb+0x7e/0x18b0
[ 121.192438][ C0] Code: 89 f0 48 c1 e8 03 42 80 3c 38 00 74 08 4c 89 f7 e8 e7 37 f4 fa 49 83 3e 00 74 40 e8 dc 6b 87 fa 48 8d 3d c5 f3 ff 08 48 89 de <67> 48 0f b9 3a b8 f0 ff ff ff eb 11 e8 c1 6b 87 fa eb 05 e8 ba 6b
[ 121.200448][ C0] RSP: 0018:ffffc90000007a00 EFLAGS: 00010046
[ 121.203165][ C0] RAX: ffffffff873e6854 RBX: ffff888042746500 RCX: ffff88801f8d4a00
[ 121.206417][ C0] RDX: 0000000000000100 RSI: ffff888042746500 RDI: ffffffff903e5c20
[ 121.209724][ C0] RBP: 000000000000000f R08: 0000000000000003 R09: 0000000000000004
[ 121.213068][ C0] R10: dffffc0000000000 R11: fffff52000000f40 R12: 0000000000000820
[ 121.216655][ C0] R13: ffff888012819030 R14: ffff888042746508 R15: dffffc0000000000
[ 121.220051][ C0] ? usb_submit_urb+0x74/0x18b0
[ 121.222286][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 121.224786][ C0] ? ___ratelimit+0x58c/0x8d0
[ 121.226839][ C0] cm109_urb_irq_callback+0x6e2/0xc90
[ 121.229124][ C0] __usb_hcd_giveback_urb+0x376/0x540
[ 121.231417][ C0] dummy_timer+0xbc0/0x4650
[ 121.233245][ C0] ? __lock_acquire+0x6b5/0x2cf0
[ 121.235361][ C0] ? __lock_acquire+0x6b5/0x2cf0
[ 121.237431][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 121.239760][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 121.241960][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 121.244449][ C0] ? __pfx_dummy_timer+0x10/0x10
[ 121.246521][ C0] __hrtimer_run_queues+0x3c0/0xa20
[ 121.248746][ C0] hrtimer_run_softirq+0x17a/0x240
[ 121.250947][ C0] handle_softirqs+0x22a/0x840
[ 121.252981][ C0] ? __irq_exit_rcu+0xca/0x220
[ 121.254968][ C0] __irq_exit_rcu+0xca/0x220
[ 121.256926][ C0] irq_exit_rcu+0x9/0x30
[ 121.258846][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0
[ 121.261124][ C0]
[ 121.262406][ C0]
[ 121.263676][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 121.266307][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80
[ 121.269087][ C0] Code: f7 e8 2d 8b f4 f5 f7 c3 00 02 00 00 74 05 e8 90 2f 20 f6 9c 58 a9 00 02 00 00 75 27 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 e4 09 e6 f5 65 8b 05 0d 50 8c 07 85 c0 74 18 5b 41 5e c3 cc cc
[ 121.277183][ C0] RSP: 0018:ffffc90003857b40 EFLAGS: 00000206
[ 121.279720][ C0] RAX: 0000000000000006 RBX: 0000000000000246 RCX: 0000000080000001
[ 121.283071][ C0] RDX: 0000000000000006 RSI: ffffffff8dfabee1 RDI: 0000000000000001
[ 121.286500][ C0] RBP: 0000000000000000 R08: ffffffff9030f0f7 R09: 1ffffffff2061e1e
[ 121.289930][ C0] R10: dffffc0000000000 R11: fffffbfff2061e1f R12: 0000000000000246
[ 121.293262][ C0] R13: dffffc0000000000 R14: ffff888037500000 R15: ffff88801f51d400
[ 121.296605][ C0] dummy_pullup+0xcf/0x120
[ 121.298636][ C0] ? __pfx_dummy_pullup+0x10/0x10
[ 121.300799][ C0] usb_gadget_disconnect_locked+0x143/0x4a0
[ 121.303451][ C0] gadget_unbind_driver+0xc7/0x450
[ 121.305688][ C0] ? __pfx_gadget_unbind_driver+0x10/0x10
[ 121.308130][ C0] device_release_driver_internal+0x46f/0x870
[ 121.311060][ C0] driver_detach+0x1f3/0x2d0
[ 121.313473][ C0] bus_remove_driver+0x226/0x320
[ 121.315564][ C0] usb_gadget_unregister_driver+0x4e/0x70
[ 121.317825][ C0] raw_release+0xd7/0x260
[ 121.319676][ C0] ? __pfx_raw_release+0x10/0x10
[ 121.321804][ C0] __fput+0x44f/0xa60
[ 121.323483][ C0] task_work_run+0x1d9/0x270
[ 121.325550][ C0] ? __pfx_task_work_run+0x10/0x10
[ 121.327736][ C0] exit_to_user_mode_loop+0xf3/0x4d0
[ 121.329786][ C0] ? rcu_is_watching+0x15/0xb0
[ 121.331858][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 121.334403][ C0] do_syscall_64+0x33e/0xf80
[ 121.336364][ C0] ? clear_bhb_loop+0x40/0x90
[ 121.338371][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 121.340831][ C0] RIP: 0033:0x7f0d7439ce59
[ 121.342776][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 121.350823][ C0] RSP: 002b:00007ffed3421518 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
[ 121.354398][ C0] RAX: 0000000000000000 RBX: 00007ffed3421600 RCX: 00007f0d7439ce59
[ 121.357659][ C0] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
[ 121.360888][ C0] RBP: 000000000001d458 R08: 0000000000000001 R09: 0000000000000000
[ 121.364212][ C0] R10: 0000001b2ec20000 R11: 0000000000000246 R12: 0000000000000000
[ 121.367555][ C0] R13: 00007f0d74615fac R14: 00007f0d74615fa8 R15: 00007f0d74615fa0
[ 121.370798][ C0]
[ 121.372458][ C0] Kernel Offset: disabled
[ 121.374324][ C0] Rebooting in 86400 seconds..