last executing test programs: 10.519885651s ago: executing program 1 (id=972): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6) ftruncate(r0, 0x200000) pwrite64(r0, &(0x7f0000000100)="0000010042", 0x5, 0x1be) pwrite64(r0, &(0x7f0000000100)="55aa", 0x2, 0x1fe) pwrite64(r0, &(0x7f0000000100)='PRIVHEAD', 0x8, 0xc00) pwrite64(r0, &(0x7f0000000100)="0002000b", 0x4, 0xc0c) pwrite64(r0, &(0x7f0000000100)='12345678-1234-1234-1234-123', 0x1b, 0xc30) pwrite64(r0, &(0x7f0000000100)="0000000000000001", 0x8, 0xd1b) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\a', 0x7, 0xd23) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\b', 0x7, 0xd2b) pwrite64(r0, &(0x7f0000000100)='PRIVHEAD', 0x8, 0x1e8000) pwrite64(r0, &(0x7f0000000100)="0002000b", 0x4, 0x1e800c) pwrite64(r0, &(0x7f0000000100)='12345678-1234-1234-1234-123456789612', 0x24, 0x1e8030) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\a', 0x7, 0x1e8123) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\b', 0x7, 0x1e812b) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) 9.576193262s ago: executing program 1 (id=978): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) syz_emit_ethernet(0xab, &(0x7f00000003c0)=ANY=[@ANYBLOB="0180c20000002059249b379086dd601081140075110000000000000000000000000000000000ff02000000000000000000000000000100000e22007590"], 0x0) recvmmsg(r0, &(0x7f00000009c0)=[{{0x0, 0x0, &(0x7f0000000640)}, 0x9}], 0x1, 0x10001, 0x0) syz_emit_ethernet(0x42, &(0x7f0000000040)={@link_local, @broadcast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010700", 0xc, 0x11, 0x0, @private1, @mcast2, {[], {0x0, 0xe22, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x0, 0x0, @void}}}}}}}}, 0x0) 8.820405269s ago: executing program 0 (id=982): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x100002, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_X86_BUS_LOCK_EXIT(r1, 0x4068aea3, &(0x7f00000000c0)={0xc1, 0x0, 0x2}) 8.660215173s ago: executing program 0 (id=983): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f00000000c0)=0x10000000005) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) syz_emit_ethernet(0x56, &(0x7f00000003c0)={@local, @empty, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "fca33f", 0x20, 0x67, 0x0, @dev, @local, {[@hopopts={0x11, 0x2, '\x00', [@enc_lim={0x4, 0x1, 0x8a}, @jumbo={0xc2, 0x4, 0x3}, @calipso={0x7, 0x8, {0x2, 0x0, 0x40, 0x7}}, @enc_lim]}]}}}}}, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000200)=0x40003) r5 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f0000000100)={0x2, &(0x7f0000000000)=[{0x48, 0x2, 0x48, 0x5}, {0x6, 0x27, 0x2, 0x207}]}, 0x10) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xd, &(0x7f0000000380)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffffc}, [@call={0x85, 0x0, 0x0, 0x17}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x3}}]}, &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, 0x0) socket$nl_route(0x10, 0x3, 0x0) 7.746169794s ago: executing program 1 (id=984): r0 = userfaultfd(0x80801) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x3000009, 0x32, 0xffffffffffffffff, 0x261c5000) eventfd2(0x6, 0x80000) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='task\x00') r2 = socket$inet6_tcp(0xa, 0x1, 0x0) close_range(r2, r2, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) getsockopt$bt_hci(r2, 0x0, 0x17, 0x0, &(0x7f0000000040)) setsockopt$inet_mreqsrc(r1, 0x0, 0x0, 0x0, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x100}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000000000/0x400000)=nil, 0x400000}, 0x1}) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000040)={0x4001}, 0xfea3) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, &(0x7f0000002140)="487d5be11f16f3305344affe5555b61d1ace1ab74206000b60e914e16e22ad69b58747915158cf12de875b71172ee3f95689fb03c80e9a832464baf041e8a832a29e000000008000", 0x0, 0x48) r4 = syz_open_dev$ptys(0xc, 0x3, 0x0) syz_open_pts(r4, 0x27901) syz_genetlink_get_family_id$batadv(&(0x7f0000002100), 0xffffffffffffffff) r5 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') read$FUSE(r5, &(0x7f0000000040)={0x2020}, 0x2020) 7.710605864s ago: executing program 0 (id=987): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, 0x0) request_key(0x0, 0x0, &(0x7f0000000340)='\x8e\x00\x9e\xbb\x1e\x1av\xe8M\x00d\xaaI\x00\x00\x00\x00\x00\x00\t<\xe5u\xedA\xa7\aT\xdd\xd1{\xff\xcb\xdb\xb11\xc2s\xcb\xbf\x04\x00\x00\x00<\xfe\xf9\f\xe6E\b\x00\xd7\x85q\xc4\xab\xbd&\x92\x89(\xf3\"\xceJ\x19\x185\xa6- \xe6uK\xe1D\x8f\x9f\x92\xca\x93#\xf5E\xc2\x91Yl\x17\a\x02\t\x17\x7f\xc4\xde\x04\x9b\x89#\xf6&[\xd81\xb3\xdc\x00\x04\x15\x03\x17R\xd24\xeb\xb5\xc2\xff\x1bnF\x8e\xe4\'\x18\xba9.\xd4\xd9\xc6\x98\x8f\xc6D!p\xbeV\xb7x\r@\x1b5\x8br\x11\xdex\x19\x89\xdc\x1el\xcd\x13\xb6\xc2\xdb\x1fr2\x7f?\xfe\x0f\x04\x11\xc3\x8f:uXQ\x0f\v\xfc\xff\x7fL\xfb\xa8]\xd4\xd7\x13?\xe3<#\x1f\x9a\x03C\x8f\xe7\rV1\x99\xaf@Re\x18J\xb6\xee\xeeAnR\n\x8a\xe4\x1a:&\xc7\x15B\x8aG\xa4\a`\xee\xaf\x80T\xddo\xc4D^z\xbf\x1c\x87F?!k\'\xc3\xf9\xa3\xd9\x85\xb1N%\x17\f\xd0#\x05^\xf7\x11\x13\xadKb\x8ck\x10\xd3 >\t\xe0\x16\x80\x82\xb3\xcc\xc7\x05*\x9b\x0eQ\x92\xd7\xbaO\x06\xb2\xdc\xe7/\x1f\x90]IB94(evFMJ\x85\xc4S\xa8\x8b\xbe\xd3\x90\xe9\t\x00\x13\x1e\x9a\x94\x00\x00\x00\x00\x00U\xfbLA\xa6K\xd5\x0eD\xf2Y\xc3,\t4hD\xc4o\xc3\x87$\x9d6\xc8\x93\xa3\x8e:\xfe#\xa0`\xb1k\xacz\xe0\xb3\x95\x17\xdf\xc7\xc2\xedKc\xa3\xbd\xc2\x9f\x86C(/\xe3\xb2\xc6$s^\xd1vU\x9cB)ao\xf1\'', 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x187) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={0x0, 0x58}, 0x1, 0x0, 0x0, 0x44000880}, 0x4080) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f00000001c0)={'ip6tnl0\x00', &(0x7f00000002c0)={'ip6_vti0\x00', 0x0, 0x29, 0x7, 0xf2, 0x4, 0x4, @empty, @empty, 0x8, 0x80, 0x4, 0x6}}) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000000) socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='my_configfs\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='my_configfs/nullb\x00', 0x10000, 0x0) mkdirat(r2, &(0x7f0000000180)='nullb1\x00', 0x1ff) unlinkat(r2, &(0x7f0000000680)='nullb1\x00', 0x200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) 7.000207761s ago: executing program 4 (id=988): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000014000/0x18000)=nil, &(0x7f0000000000)=[@textreal={0x8, &(0x7f0000000240)="360f21d266b9800000c00f326635000400000f300f01cfbaf80c66b8785f488b66efbafc0ced0fc77a8cbaf80c66b87411718066efbafc0c66edbaa10066b80000008066ef0f01ef8ed766b9800000c00f326635002000000f30", 0x5a}], 0x1, 0x10, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 6.784499946s ago: executing program 1 (id=989): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x39) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x404, &(0x7f0000002140)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x4000}}) 6.076877112s ago: executing program 1 (id=991): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TCSETS(r1, 0x545c, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, "43e6323cce19dc42a867c4e745c80552a700"}) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCMSET(r2, 0x5418, &(0x7f0000000000)=0x8001) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x80) sendmsg$NFT_BATCH(r0, 0x0, 0x24000000) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000740)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xb}]}, @NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x101}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x78}, 0x1, 0x0, 0x0, 0x4040854}, 0x40) mkdirat(0xffffffffffffffff, &(0x7f0000000280)='./dev\x00', 0x24) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) r3 = msgget$private(0x0, 0xa4) msgsnd(r3, &(0x7f0000000000)={0x1}, 0x8, 0x800) msgrcv(r3, &(0x7f0000001040)={0x0, ""/100}, 0x6c, 0x0, 0x208be586909acbb4) syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407b0603230001000000010902270001010080320904000003ff0000000705810240000007050202400000070583"], 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newtaction={0x60, 0x30, 0xb, 0x0, 0x400, {}, [{0x4c, 0x1, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x80, 0x8, 0x8, 0x8, 0x3}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}, 0x60}}, 0x44) ioctl$sock_SIOCSPGRP(r4, 0x8902, &(0x7f0000000180)) mkdir(&(0x7f0000000a00)='./debug\x00', 0x1b9) mount(0x0, &(0x7f0000000c00)='./debug\x00', &(0x7f0000000d00)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000e00)='./debug/dynamic_debug/control\x00', 0x1, 0x0) ioctl$TIOCMIWAIT(0xffffffffffffffff, 0x545c, 0x0) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x8000000) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f00000026c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34665c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbccbddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e712a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd13f4cec49669e443dcb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ef8dba2f23b01a9ae44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af40000000000000005f58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef07000000000000006da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405a07feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09c0e5a3bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea10d3cfb41b92ecbb422a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f74562adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b4412331d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd100fcffff007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711c6529ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a22c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29008000000000000005ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc030ea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efd936b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800001f00000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351b9332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d9890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b0783883ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a138d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fce43d8c53a8031e64026e0d36b6401064c49a729f11ab377f7132c5232bb80195dd5d43d29646a9378eea0761b7ed9d2172e33ed87c7413c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828b07f1dc7df9c8e5da22dfb9dacbf5529e4e994128d835f85465173ea7bbcc519a0c9798ce8b1b07567e3e07169c8c3e4da8bf725c050000000000000000000000000000000000000000004775abdf0c62728eb55a9e2849a1ce05bed60dfe4cc9fa43f9684297c02382c0a35829be7a86305792a9d2e80ca9e8fc50f31f6e0fa810303da03d8b74b42c1ebaf16bb343256405a3a07229a54de09a97b269cd29e8b2f0b0d46c51a6a93eec37f4bc6e29a8e19120ae050ab682662e9b2cc3263a4aba62b63ca9123a53c0f4bf3c4463b8144c89bf058a0af0ae9fc2b7cdfc4817703e267cddc193637d7fd97646090da37093657643daae3840c7f5c10f93524f7ae4791ec6e9d9722e5f670ccb358e051a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000300)=ANY=[@ANYRES32=r5, @ANYRES32=r5, @ANYBLOB='/'], 0x20) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000140)=ANY=[@ANYRES32=r5, @ANYRES32=r6, @ANYBLOB='/\x00'/12, @ANYRES32=r5], 0x20) openat(0xffffffffffffff9c, &(0x7f0000000080)='./dev/ttyUSB0\x00', 0x28d00, 0x0) 5.968181784s ago: executing program 4 (id=992): sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x9}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) shmget$private(0x0, 0x3000, 0x54001800, &(0x7f000010d000/0x3000)=nil) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000840), r3) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r3, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000700)={0x70, r4, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast1}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x11}}}, @NLBL_UNLABEL_A_SECCTX={0x2b, 0x7, 'system_u:object_r:user_cron_spool_t:s0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}}]}, 0x70}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) 5.671899001s ago: executing program 0 (id=993): prlimit64(0x0, 0xe, &(0x7f00000005c0)={0x8, 0x20000000000002}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x80, &(0x7f0000002140)=ANY=[]) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, &(0x7f0000000080)) read$FUSE(0xffffffffffffffff, 0x0, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x6000) setresuid(0xee01, r3, r3) add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="1d", 0x1, 0xfffffffffffffffe) add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="1d", 0xfe3a, 0xfffffffffffffffe) 5.064183075s ago: executing program 4 (id=999): pwrite64(0xffffffffffffffff, &(0x7f00000008c0), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0xf32}, 0x0) r0 = syz_open_dev$vivid(&(0x7f0000000080), 0x0, 0x2) ioctl$VIDIOC_QUERYBUF(r0, 0xc0585609, &(0x7f0000000440)=@overlay={0x9, 0x9, 0x4, 0xe000, 0xc4, {0x77359400}, {0x1, 0x2, 0x7, 0x8, 0x7, 0x4, "631d0004"}, 0x8}) ioctl$VIDIOC_QUERYCTRL(r0, 0xc0445624, &(0x7f0000000100)={0x10, 0x240, "f7f6f7eb9aa9a615329221593c62c398a223625e9e86d061ea3d5be9231b89db", 0xa, 0x6, 0x2, 0x9, 0x2888}) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeea, 0x8031, 0xffffffffffffffff, 0xed0e1000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r4, 0x40345410, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x40, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./proc/net/afs/cells\x00', 0x2, 0x0) write(r5, &(0x7f0000000080)='add ', 0x4) syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f00000002c0)) 4.953832338s ago: executing program 3 (id=1000): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) r0 = socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f00000042c0)="86", 0xff0f}], 0x1}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a05000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021880000000c0a01030000000000000000070000010900020073797a31000000000900010073797a30000000005c0003805800008008000340000000024c000b80340001800a0001006c696d6974000000240002800c00024000000000000000000c0001400000000000086fbc080004400000000114000180090001006d6173710000000004000280140000001000010000000000000000000084000a"], 0x10c}}, 0x0) recvmsg(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000340)=""/207, 0xcf}], 0x1, 0x0, 0xffffffffffffff74}, 0x20060) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000037000000000a20000000000a01030000000000000000010000010900010073797a310000000034000000030a01020000000000000000010000000900010073797a310000000008000540fffffffc04"], 0x7c}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB="480000001000390440bd7000fedbdf2500003347", @ANYRES32=0x0, @ANYBLOB="0198000000000000180012800e000100776972656775617264000000040002800800290016150700080028006adc0000"], 0x48}, 0x1, 0x0, 0x0, 0x24000007}, 0x0) syz_init_net_socket$llc(0x1a, 0x802, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/custom0\x00', 0x800, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f00000005c0)=[@acquire], 0x0, 0x0, 0x0}) 4.809367221s ago: executing program 3 (id=1001): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, 0x0, 0x20004000) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="64000000090603000000000000000000070000003c0007800c000180080001407f0000010c001480080001400a010100060004405000000006000540506400000500070000000000080006400000000105000100060000000900020073797a31"], 0x64}, 0x1, 0x0, 0x0, 0x810}, 0x20004000) 4.583754526s ago: executing program 0 (id=1002): r0 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r0, 0xc01864c6, &(0x7f0000000140)={&(0x7f00000000c0)=[r1], 0x1, 0x800}) 4.055939288s ago: executing program 3 (id=1004): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000400), r0) r1 = fsmount(0xffffffffffffffff, 0x0, 0x1) r2 = syz_kvm_add_vcpu$x86(0x0, &(0x7f00000002c0)={0x0, &(0x7f0000000180)=[@nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @host32=0x4c00, 0x400, 0xa, 0xf7}}, @wr_drn={0x68, 0x20, {0x2}}, @in_dx={0x69, 0x20, {0xef9f, 0x2}}, @nested_amd_vmsave={0x183, 0x18, 0x2}, @nested_load_syzos={0x136, 0x48, {0x3, 0x5b1b, [@nested_amd_clgi={0x17f, 0x10}, @rdmsr={0x66, 0x18, {0x299}}]}}, @nested_amd_invlpga={0x17d, 0x20, {0x8080000, 0xb89d}}, @nested_amd_set_intercept={0x181, 0x30, {0x3, 0x6, 0x5, 0x1}}], 0x128}) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000340)=[@textreal={0x8, &(0x7f0000000300)="0f0175090f8ba8b8b800008ed0d13a650f4cb500000f320fc71980e71b660ff394476e66b9800000c00f326635000800000f30", 0x33}], 0x1, 0x68, &(0x7f0000000380)=[@cr4={0x1, 0x400022}, @cr4={0x1, 0x20}], 0x2) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000180), 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[], 0x1c}}, 0x0) remap_file_pages(&(0x7f00006ca000/0x4000)=nil, 0x4000, 0x0, 0x3, 0x20000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37}, 0x20) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000004440)=ANY=[@ANYBLOB="0900000004000000040000000700000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r5, @ANYBLOB="0200000001"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000240), 0xfff, r6, 0x0, 0x300}, 0x38) syz_emit_vhci(0x0, 0x14) r7 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r7, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x15, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) sendmsg$IEEE802154_SCAN_REQ(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x40}, 0x44080) 4.039470648s ago: executing program 4 (id=1005): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, 0x0) request_key(0x0, 0x0, &(0x7f0000000340)='\x8e\x00\x9e\xbb\x1e\x1av\xe8M\x00d\xaaI\x00\x00\x00\x00\x00\x00\t<\xe5u\xedA\xa7\aT\xdd\xd1{\xff\xcb\xdb\xb11\xc2s\xcb\xbf\x04\x00\x00\x00<\xfe\xf9\f\xe6E\b\x00\xd7\x85q\xc4\xab\xbd&\x92\x89(\xf3\"\xceJ\x19\x185\xa6- \xe6uK\xe1D\x8f\x9f\x92\xca\x93#\xf5E\xc2\x91Yl\x17\a\x02\t\x17\x7f\xc4\xde\x04\x9b\x89#\xf6&[\xd81\xb3\xdc\x00\x04\x15\x03\x17R\xd24\xeb\xb5\xc2\xff\x1bnF\x8e\xe4\'\x18\xba9.\xd4\xd9\xc6\x98\x8f\xc6D!p\xbeV\xb7x\r@\x1b5\x8br\x11\xdex\x19\x89\xdc\x1el\xcd\x13\xb6\xc2\xdb\x1fr2\x7f?\xfe\x0f\x04\x11\xc3\x8f:uXQ\x0f\v\xfc\xff\x7fL\xfb\xa8]\xd4\xd7\x13?\xe3<#\x1f\x9a\x03C\x8f\xe7\rV1\x99\xaf@Re\x18J\xb6\xee\xeeAnR\n\x8a\xe4\x1a:&\xc7\x15B\x8aG\xa4\a`\xee\xaf\x80T\xddo\xc4D^z\xbf\x1c\x87F?!k\'\xc3\xf9\xa3\xd9\x85\xb1N%\x17\f\xd0#\x05^\xf7\x11\x13\xadKb\x8ck\x10\xd3 >\t\xe0\x16\x80\x82\xb3\xcc\xc7\x05*\x9b\x0eQ\x92\xd7\xbaO\x06\xb2\xdc\xe7/\x1f\x90]IB94(evFMJ\x85\xc4S\xa8\x8b\xbe\xd3\x90\xe9\t\x00\x13\x1e\x9a\x94\x00\x00\x00\x00\x00U\xfbLA\xa6K\xd5\x0eD\xf2Y\xc3,\t4hD\xc4o\xc3\x87$\x9d6\xc8\x93\xa3\x8e:\xfe#\xa0`\xb1k\xacz\xe0\xb3\x95\x17\xdf\xc7\xc2\xedKc\xa3\xbd\xc2\x9f\x86C(/\xe3\xb2\xc6$s^\xd1vU\x9cB)ao\xf1\'', 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x187) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={0x0, 0x58}, 0x1, 0x0, 0x0, 0x44000880}, 0x4080) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f00000001c0)={'ip6tnl0\x00', &(0x7f00000002c0)={'ip6_vti0\x00', 0x0, 0x29, 0x7, 0xf2, 0x4, 0x4, @empty, @empty, 0x8, 0x80, 0x4, 0x6}}) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000000) socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='my_configfs\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='my_configfs/nullb\x00', 0x10000, 0x0) mkdirat(r2, &(0x7f0000000180)='nullb1\x00', 0x1ff) unlinkat(r2, &(0x7f0000000680)='nullb1\x00', 0x200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) 4.017542509s ago: executing program 0 (id=1006): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = socket$inet6(0xa, 0x3, 0x1) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x560, 0x0, 0xffffffff, 0xffffffff, 0xf0, 0xffffffff, 0x490, 0xffffffff, 0xffffffff, 0x490, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'vxcan1\x00', {0x8}}}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xfd}}, [], [0x0, 0xffffffff], 'pim6reg\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x3a0, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_virt_wifi\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x5}}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'bridge_slave_0\x00', {0x53}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x5c0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, 0x0, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) getsockopt$PNPIPE_IFINDEX(r1, 0x113, 0x2, 0x0, 0x0) 3.924079581s ago: executing program 2 (id=1007): socket$nl_route(0x10, 0x3, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x1000, 0x0, 0x0, 0x0, 0x0, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/diskstats\x00', 0x0, 0x0) 3.07657729s ago: executing program 3 (id=1008): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="380000005400e50100000000fdffffff07000000", @ANYRES32=r2, @ANYBLOB="20000100", @ANYRES32, @ANYBLOB="000104000000000000000000000000000000000186dd0000"], 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) 2.994036623s ago: executing program 4 (id=1009): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000400), r0) r1 = fsmount(0xffffffffffffffff, 0x0, 0x1) r2 = syz_kvm_add_vcpu$x86(0x0, &(0x7f00000002c0)={0x0, &(0x7f0000000180)=[@nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @host32=0x4c00, 0x400, 0xa, 0xf7}}, @wr_drn={0x68, 0x20, {0x2}}, @in_dx={0x69, 0x20, {0xef9f, 0x2}}, @nested_amd_vmsave={0x183, 0x18, 0x2}, @nested_load_syzos={0x136, 0x48, {0x3, 0x5b1b, [@nested_amd_clgi={0x17f, 0x10}, @rdmsr={0x66, 0x18, {0x299}}]}}, @nested_amd_invlpga={0x17d, 0x20, {0x8080000, 0xb89d}}, @nested_amd_set_intercept={0x181, 0x30, {0x3, 0x6, 0x5, 0x1}}], 0x128}) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000340)=[@textreal={0x8, 0x0}], 0x1, 0x68, &(0x7f0000000380)=[@cr4={0x1, 0x400022}, @cr4={0x1, 0x20}], 0x2) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000180), 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="1b0000001d00010000000000ffdbdf25"], 0x1c}}, 0x0) remap_file_pages(&(0x7f00006ca000/0x4000)=nil, 0x4000, 0x0, 0x3, 0x20000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37}, 0x20) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000004440)=ANY=[@ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r5, @ANYBLOB], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0), 0x0, 0xfff, r6, 0x0, 0x300}, 0x38) syz_emit_vhci(0x0, 0x14) r7 = socket$kcm(0xa, 0x2, 0x0) r8 = socket(0x2, 0x80002, 0x0) setsockopt$IP_VS_SO_SET_ADD(r8, 0x0, 0x482, &(0x7f0000000040)={0x84, @private=0xa010100, 0x4e22, 0x3, 'sh\x00', 0x8, 0x3, 0x6f}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r8, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010103, 0x4e21, 0x3, 'lblcr\x00', 0x5, 0x8, 0x77}, {@remote, 0x4e20, 0x0, 0x6, 0x1}}, 0x44) sendmsg$sock(r7, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x15, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) sendmsg$IEEE802154_SCAN_REQ(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x40}, 0x44080) 2.959815453s ago: executing program 2 (id=1010): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f00000000c0)=0x10000000005) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) syz_emit_ethernet(0x56, &(0x7f00000003c0)={@local, @empty, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "fca33f", 0x20, 0x67, 0x0, @dev, @local, {[@hopopts={0x11, 0x2, '\x00', [@enc_lim={0x4, 0x1, 0x8a}, @jumbo={0xc2, 0x4, 0x3}, @calipso={0x7, 0x8, {0x2, 0x0, 0x40, 0x7}}, @enc_lim]}]}}}}}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x40003) r4 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000100)={0x2, &(0x7f0000000000)=[{0x48, 0x2, 0x48, 0x5}, {0x6, 0x27, 0x2, 0x207}]}, 0x10) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xd, &(0x7f0000000380)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffffc}, [@call={0x85, 0x0, 0x0, 0x17}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x3}}]}, &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, 0x0) socket$nl_route(0x10, 0x3, 0x0) 2.256658109s ago: executing program 2 (id=1011): timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000003940)=ANY=[@ANYBLOB="210000000000000000000000000010000004"], 0x48) keyctl$KEYCTL_MOVE(0x1c, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3000001, 0x11, r0, 0x0) mount$fuse(0x0, 0x0, &(0x7f00000020c0), 0x2000413, &(0x7f00000003c0)={{}, 0x2c, {'rootmode', 0x3d, 0x8000}}) 2.068238803s ago: executing program 2 (id=1012): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6) ftruncate(r0, 0x200000) pwrite64(r0, &(0x7f0000000100)="0000010042", 0x5, 0x1be) pwrite64(r0, &(0x7f0000000100)="55aa", 0x2, 0x1fe) pwrite64(r0, &(0x7f0000000100)='PRIVHEAD', 0x8, 0xc00) pwrite64(r0, 0x0, 0x0, 0xc0c) pwrite64(r0, &(0x7f0000000100)='12345678-1234-1234-1234-123456789612', 0x24, 0xc30) pwrite64(r0, &(0x7f0000000080)="4902f1", 0x3, 0xd33) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\a', 0x7, 0xd23) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\b', 0x7, 0xd2b) pwrite64(r0, &(0x7f0000000100)='PRIVHEAD', 0x8, 0x1e8000) pwrite64(r0, &(0x7f0000000100)="0002000b", 0x4, 0x1e800c) pwrite64(r0, &(0x7f0000000100)='12345678-1234-1234-1234-123456789612', 0x24, 0x1e8030) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\a', 0x7, 0x1e8123) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\b', 0x7, 0x1e812b) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) 1.242464092s ago: executing program 1 (id=1013): syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$sierra_net(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$rtl8150(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f00000004c0)={0x84, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.234042953s ago: executing program 3 (id=1014): syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r0 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) ioctl$HIDIOCGFIELDINFO(r0, 0x4004480d, 0x0) 1.199762463s ago: executing program 2 (id=1015): pwrite64(0xffffffffffffffff, &(0x7f00000008c0), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0xf32}, 0x0) r0 = syz_open_dev$vivid(&(0x7f0000000080), 0x0, 0x2) ioctl$VIDIOC_QUERYBUF(r0, 0xc0585609, &(0x7f0000000440)=@overlay={0x9, 0x9, 0x4, 0xe000, 0xc4, {0x77359400}, {0x1, 0x2, 0x7, 0x8, 0x7, 0x4, "631d0004"}, 0x8}) ioctl$VIDIOC_QUERYCTRL(r0, 0xc0445624, &(0x7f0000000100)={0x10, 0x240, "f7f6f7eb9aa9a615329221593c62c398a223625e9e86d061ea3d5be9231b89db", 0xa, 0x6, 0x2, 0x9, 0x2888}) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeea, 0x8031, 0xffffffffffffffff, 0xed0e1000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r4, 0x40345410, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x40, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./proc/net/afs/cells\x00', 0x2, 0x0) write(r5, &(0x7f0000000080)='add ', 0x4) syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f00000002c0)) 45.471149ms ago: executing program 3 (id=1016): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeea, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$igmp(0x2, 0x3, 0x2) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r1, 0x0, 0xc8, &(0x7f0000000100), 0x4) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, 0x0, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f00000000c0)={0x8, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) setsockopt$inet_mreq(r2, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x36, &(0x7f0000000240)={@local, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x80, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @timestamp={0xd, 0x0, 0x0, 0x40, 0xf, 0x3, 0xd7df, 0xbd}}}}}, 0x0) 44.737639ms ago: executing program 2 (id=1017): openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043ef50d"], 0xf8) bind$bt_hci(0xffffffffffffffff, &(0x7f00000000c0), 0x6) 0s ago: executing program 4 (id=1018): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000400), r0) r1 = fsmount(0xffffffffffffffff, 0x0, 0x1) r2 = syz_kvm_add_vcpu$x86(0x0, &(0x7f00000002c0)={0x0, &(0x7f0000000180)=[@nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @host32=0x4c00, 0x400, 0xa, 0xf7}}, @wr_drn={0x68, 0x20, {0x2}}, @in_dx={0x69, 0x20, {0xef9f, 0x2}}, @nested_amd_vmsave={0x183, 0x18, 0x2}, @nested_load_syzos={0x136, 0x48, {0x3, 0x5b1b, [@nested_amd_clgi={0x17f, 0x10}, @rdmsr={0x66, 0x18, {0x299}}]}}, @nested_amd_invlpga={0x17d, 0x20, {0x8080000, 0xb89d}}, @nested_amd_set_intercept={0x181, 0x30, {0x3, 0x6, 0x5, 0x1}}], 0x128}) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000340)=[@textreal={0x8, &(0x7f0000000300)="0f0175090f8ba8b8b800008ed0d13a650f4cb500000f320fc71980e71b660ff394476e66b9800000c00f326635000800000f30", 0x33}], 0x1, 0x68, &(0x7f0000000380)=[@cr4={0x1, 0x400022}, @cr4={0x1, 0x20}], 0x2) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000180), 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[], 0x1c}}, 0x0) remap_file_pages(&(0x7f00006ca000/0x4000)=nil, 0x4000, 0x0, 0x3, 0x20000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37}, 0x20) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000004440)=ANY=[@ANYBLOB="0900000004000000040000000700000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r5, @ANYBLOB="0200000001"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000240), 0xfff, r6, 0x0, 0x300}, 0x38) syz_emit_vhci(0x0, 0x14) r7 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r7, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x15, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) sendmsg$IEEE802154_SCAN_REQ(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x40}, 0x44080) kernel console output (not intermixed with test programs): pwc: recv_control_msg error -32 req 02 val 2c00 [ 87.624553][ T2238] pwc: recv_control_msg error -32 req 04 val 1000 [ 87.743722][ T2238] pwc: recv_control_msg error -32 req 04 val 1300 [ 87.830830][ T2238] pwc: recv_control_msg error -32 req 04 val 1400 [ 87.831548][ T4561] pl2303 ttyUSB0: pl2303_set_line_request - failed: -32 [ 87.906302][ T2238] pwc: recv_control_msg error -32 req 02 val 2000 [ 87.940327][ T4561] pl2303 1-1:1.0: pl2303_vendor_read - failed to read [000a]: -32 [ 87.950160][ T2238] pwc: recv_control_msg error -32 req 02 val 2100 [ 87.989970][ T4561] pl2303 ttyUSB0: failed to submit interrupt urb: -90 [ 88.071814][ T4231] usb 1-1: USB disconnect, device number 4 [ 88.094990][ T4231] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0 [ 88.119004][ T4231] pl2303 1-1:1.0: device disconnected [ 88.210252][ T2238] pwc: recv_control_msg error -71 req 02 val 2500 [ 88.215432][ T4604] loop0: detected capacity change from 0 to 4096 [ 88.251347][ T2238] pwc: recv_control_msg error -71 req 02 val 2400 [ 88.272780][ T4177] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 5261032297024454656 bytes. [ 88.285889][ T2238] pwc: recv_control_msg error -71 req 02 val 2600 [ 88.291349][ T4177] ldm_parse_privhead(): PRIVHEAD disk size doesn't match real disk size [ 88.307679][ T4177] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 88.319943][ T4177] loop0: [ 88.325701][ T4604] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 5261032297024454656 bytes. [ 88.326908][ T2238] pwc: recv_control_msg error -71 req 02 val 2900 [ 88.356237][ T4604] ldm_parse_privhead(): PRIVHEAD disk size doesn't match real disk size [ 88.364904][ T4604] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 88.373617][ T4604] loop0: [ 88.376991][ T2238] pwc: recv_control_msg error -71 req 02 val 2800 [ 88.410146][ T2238] pwc: recv_control_msg error -71 req 04 val 1100 [ 88.430184][ T2238] pwc: recv_control_msg error -71 req 04 val 1200 [ 88.470164][ T2238] pwc: Registered as video103. [ 88.487079][ T2238] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input6 [ 88.552922][ T2238] usb 4-1: USB disconnect, device number 3 [ 89.029710][ T4616] capability: warning: `syz.1.107' uses 32-bit capabilities (legacy support in use) [ 89.340471][ T4379] usb 2-1: new full-speed USB device number 5 using dummy_hcd [ 89.740613][ T4379] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 89.806630][ T4379] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 23 [ 89.878344][ T4620] netlink: 4 bytes leftover after parsing attributes in process `syz.3.109'. [ 90.645787][ T4626] IPVS: sh: FWM 3 0x00000003 - no destination available [ 90.990392][ T4379] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 91.030480][ T4379] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 91.160187][ T4379] usb 2-1: SerialNumber: syz [ 91.452494][ T4379] hub 2-1:1.0: bad descriptor, ignoring hub [ 91.571268][ T4379] hub: probe of 2-1:1.0 failed with error -5 [ 91.675609][ T4379] cdc_acm 2-1:1.0: Control and data interfaces are not separated! [ 92.212195][ T4379] cdc_acm 2-1:1.0: This needs exactly 3 endpoints [ 92.302599][ T4379] cdc_acm: probe of 2-1:1.0 failed with error -22 [ 92.463402][ T4641] netlink: 8 bytes leftover after parsing attributes in process `syz.3.112'. [ 92.780965][ T2238] usb 2-1: USB disconnect, device number 5 [ 92.860227][ T7] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 93.850216][ T7] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 94.496884][ T7] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 94.560153][ T7] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 94.661445][ T7] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 94.711042][ T7] usb 5-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 95.582278][ T7] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.661875][ T7] usb 5-1: can't set config #1, error -71 [ 95.698383][ T7] usb 5-1: USB disconnect, device number 7 [ 95.719062][ T4673] netlink: 4 bytes leftover after parsing attributes in process `syz.4.122'. [ 95.837250][ T4677] loop0: detected capacity change from 0 to 4096 [ 95.902127][ T4677] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 5261032297024454656 bytes. [ 95.977951][ T4677] ldm_parse_privhead(): PRIVHEAD disk size doesn't match real disk size [ 96.070345][ T4677] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 96.080358][ T4677] loop0: [ 97.044769][ T4697] IPVS: sh: FWM 3 0x00000003 - no destination available [ 99.700262][ T21] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 99.700299][ T23] usb 1-1: new full-speed USB device number 5 using dummy_hcd [ 100.190319][ T21] usb 4-1: device descriptor read/all, error -71 [ 100.198851][ T4716] netlink: 4 bytes leftover after parsing attributes in process `syz.1.135'. [ 100.580082][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #8a!!! [ 100.590069][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #8a!!! [ 100.600057][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #8a!!! [ 100.610065][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #8a!!! [ 101.060071][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 101.070055][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 101.080055][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 101.090053][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 101.100054][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 102.094744][ T4731] netlink: 8 bytes leftover after parsing attributes in process `syz.1.138'. [ 102.103780][ T23] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 102.131965][ T23] usb 1-1: can't read configurations, error -71 [ 102.161889][ T4736] loop0: detected capacity change from 0 to 4096 [ 102.253519][ T4736] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 5261032297024454656 bytes. [ 102.391141][ T4742] IPVS: sh: FWM 3 0x00000003 - no destination available [ 102.920153][ T4238] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 103.190267][ T4736] ldm_parse_privhead(): PRIVHEAD disk size doesn't match real disk size [ 103.223756][ T4736] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 103.261810][ T4736] loop0: [ 103.680199][ T4238] usb 5-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 105.724163][ T4238] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 105.732319][ T4238] usb 5-1: Product: syz [ 105.736507][ T4238] usb 5-1: Manufacturer: syz [ 105.741227][ T4238] usb 5-1: SerialNumber: syz [ 105.754093][ T4238] usb 5-1: config 0 descriptor?? [ 105.960271][ T4238] usb 5-1: can't set config #0, error -71 [ 105.980914][ T4238] usb 5-1: USB disconnect, device number 8 [ 106.143089][ T4761] netlink: 4 bytes leftover after parsing attributes in process `syz.4.148'. [ 107.600463][ T4238] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 107.996422][ T4781] binder_alloc: 4778: pid 4778 spamming oneway? 2 buffers allocated for a total size of 5120 [ 108.020418][ T4238] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 108.105564][ T4238] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 23 [ 109.013135][ T4784] binder_alloc: 4778: pid 4778 spamming oneway? 3 buffers allocated for a total size of 5128 [ 109.133703][ T4238] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 109.200988][ T4238] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 109.372691][ T4238] usb 4-1: SerialNumber: syz [ 109.583381][ T4238] hub 4-1:1.0: bad descriptor, ignoring hub [ 110.056408][ T4238] hub: probe of 4-1:1.0 failed with error -5 [ 110.305873][ T4238] cdc_acm 4-1:1.0: Control and data interfaces are not separated! [ 110.344016][ T4238] cdc_acm 4-1:1.0: This needs exactly 3 endpoints [ 110.372374][ T4238] cdc_acm: probe of 4-1:1.0 failed with error -22 [ 110.491195][ T4238] usb 4-1: USB disconnect, device number 6 [ 110.937143][ T4812] IPVS: sh: FWM 3 0x00000003 - no destination available [ 111.010104][ T13] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 111.821959][ T4814] loop0: detected capacity change from 0 to 4096 [ 111.877078][ T4816] netlink: 4 bytes leftover after parsing attributes in process `syz.0.163'. [ 112.400822][ T4814] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 112.420419][ T4814] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 112.450682][ T4814] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 112.470615][ T4814] ldm_validate_privheads(): Cannot find PRIVHEAD 3. [ 112.486003][ T4814] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 112.512598][ T4814] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 112.527442][ T4814] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 112.537752][ T4814] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 112.546685][ T4814] ldm_validate_tocblocks(): Failed to find a valid TOCBLOCK. [ 112.555344][ T4814] loop0: [ 112.692209][ T13] usb 2-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 112.701927][ T13] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 112.722584][ T13] usb 2-1: config 0 descriptor?? [ 112.740265][ T13] usb 2-1: can't set config #0, error -71 [ 113.506372][ T13] usb 2-1: USB disconnect, device number 6 [ 115.140349][ T1350] usb 4-1: new full-speed USB device number 7 using dummy_hcd [ 115.520272][ T1350] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 115.596230][ T1350] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 23 [ 117.579291][ T4858] netlink: 4 bytes leftover after parsing attributes in process `syz.2.175'. [ 118.210186][ T1350] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 118.219325][ T1350] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 118.430280][ T1350] usb 4-1: can't set config #1, error -71 [ 118.449924][ T1350] usb 4-1: USB disconnect, device number 7 [ 119.030242][ T4379] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 119.640238][ T4379] usb 5-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 119.906301][ T4379] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 119.915288][ T4379] usb 5-1: Product: syz [ 119.925294][ T4379] usb 5-1: Manufacturer: syz [ 119.929925][ T4379] usb 5-1: SerialNumber: syz [ 119.936905][ T4379] usb 5-1: config 0 descriptor?? [ 119.982611][ T4379] gspca_main: sunplus-2.14.0 probing 04fc:504a [ 120.423832][ T4903] IPVS: sh: FWM 3 0x00000003 - no destination available [ 120.431882][ T4379] gspca_sunplus: reg_w_riv err -71 [ 120.438409][ T4379] sunplus: probe of 5-1:0.0 failed with error -71 [ 121.199681][ T4877] bridge0: port 2(bridge_slave_1) entered disabled state [ 121.207728][ T4877] bridge0: port 1(bridge_slave_0) entered disabled state [ 121.480344][ T4379] usb 5-1: USB disconnect, device number 9 [ 124.896125][ T4877] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 124.945509][ T4877] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 125.210331][ T4231] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 125.227051][ T4877] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 125.237024][ T4877] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 125.246273][ T4877] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 125.255564][ T4877] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 125.395876][ T4877] syz.1.181 (4877) used greatest stack depth: 19632 bytes left [ 126.678694][ T4944] loop0: detected capacity change from 0 to 4096 [ 126.750423][ T4231] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 126.753287][ T4944] loop0: [ 126.765504][ T4231] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 126.808833][ T4231] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 126.840100][ T4231] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 126.849889][ T4231] usb 3-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 126.890251][ T4231] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 126.920504][ T4929] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 126.927677][ T4929] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 126.991344][ T4935] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 127.029814][ T4957] serio: Serial port ttyS3 [ 127.393699][ T4231] pl2303 3-1:1.0: pl2303 converter detected [ 127.402077][ T4231] usb 3-1: pl2303 converter now attached to ttyUSB0 [ 127.421883][ T4231] usb 3-1: USB disconnect, device number 6 [ 127.431854][ T4231] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0 [ 127.442334][ T4231] pl2303 3-1:1.0: device disconnected [ 127.862304][ T4967] netlink: 'syz.4.202': attribute type 4 has an invalid length. [ 127.870104][ T4967] netlink: 4 bytes leftover after parsing attributes in process `syz.4.202'. [ 128.455221][ T4968] IPVS: sh: FWM 3 0x00000003 - no destination available [ 128.678437][ T4935] usb 4-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 128.712804][ T4935] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 128.721474][ T4935] usb 4-1: Product: syz [ 128.726030][ T4935] usb 4-1: Manufacturer: syz [ 128.730704][ T4935] usb 4-1: SerialNumber: syz [ 128.741200][ T4935] usb 4-1: config 0 descriptor?? [ 128.984276][ T4935] gspca_main: sunplus-2.14.0 probing 04fc:504a [ 129.620553][ T4935] gspca_sunplus: reg_w_riv err -71 [ 129.626267][ T4935] sunplus: probe of 4-1:0.0 failed with error -71 [ 130.033761][ T4935] usb 4-1: USB disconnect, device number 8 [ 130.626158][ T4999] loop0: detected capacity change from 0 to 4096 [ 130.733529][ T4999] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 5261032297024454656 bytes. [ 130.778614][ T4999] ldm_parse_privhead(): PRIVHEAD contains an invalid GUID. [ 130.816873][ T5004] comedi comedi1: Minor 2 could not be opened [ 130.844600][ T4999] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 130.927164][ T4999] loop0: [ 130.990494][ T1350] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 131.370908][ T1350] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 131.443266][ T1350] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 131.607239][ T1350] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 131.826353][ T5017] netlink: 'syz.4.222': attribute type 4 has an invalid length. [ 131.834269][ T5017] netlink: 4 bytes leftover after parsing attributes in process `syz.4.222'. [ 132.670111][ T1350] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 132.693040][ T1350] usb 2-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 132.707033][ T1350] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 132.732145][ T5000] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 132.739300][ T5000] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 132.782715][ T1430] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.789256][ T1430] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.915734][ T1350] pl2303 2-1:1.0: pl2303 converter detected [ 133.650774][ T1350] usb 2-1: pl2303 converter now attached to ttyUSB0 [ 133.774034][ T7] usb 2-1: USB disconnect, device number 7 [ 133.844869][ T7] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0 [ 133.926047][ T5037] loop0: detected capacity change from 0 to 4096 [ 133.926279][ T7] pl2303 2-1:1.0: device disconnected [ 133.975690][ T3557] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 5261032297024454656 bytes. [ 133.991768][ T3557] ldm_parse_privhead(): PRIVHEAD contains an invalid GUID. [ 133.999185][ T3557] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 134.041571][ T3557] loop0: [ 134.157390][ T5037] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 5261032297024454656 bytes. [ 134.194337][ T5037] ldm_parse_privhead(): PRIVHEAD contains an invalid GUID. [ 134.304491][ T5037] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 134.340661][ T5037] loop0: [ 134.350424][ T4935] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 134.662443][ T3557] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 5261032297024454656 bytes. [ 134.675384][ T3557] ldm_parse_privhead(): PRIVHEAD contains an invalid GUID. [ 134.685815][ T3557] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 134.694484][ T3557] loop0: [ 134.796018][ T5054] IPVS: sh: FWM 3 0x00000003 - no destination available [ 134.980220][ T4935] usb 1-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 135.584148][ T4935] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 135.592389][ T4935] usb 1-1: Product: syz [ 135.596786][ T4935] usb 1-1: Manufacturer: syz [ 135.601562][ T4935] usb 1-1: SerialNumber: syz [ 135.694668][ T4935] usb 1-1: config 0 descriptor?? [ 137.100789][ T4935] usb 1-1: can't set config #0, error -71 [ 137.239011][ T4935] usb 1-1: USB disconnect, device number 7 [ 137.284702][ T3557] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 5261032297024454656 bytes. [ 137.300691][ T3557] ldm_parse_privhead(): PRIVHEAD contains an invalid GUID. [ 137.308051][ T3557] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 137.335964][ T3557] loop0: [ 137.926052][ T5079] IPVS: sh: FWM 3 0x00000003 - no destination available [ 139.640123][ T1350] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 139.908123][ T5092] loop0: detected capacity change from 0 to 4096 [ 139.933251][ T5095] batman_adv: batadv0: Adding interface: ip6gretap1 [ 139.939865][ T5095] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 139.965663][ T5095] batman_adv: batadv0: Interface activated: ip6gretap1 [ 140.024252][ T4177] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 140.052179][ T4177] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 140.101438][ T1350] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 140.116084][ T1350] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 140.127930][ T1350] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 140.153429][ T1350] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 140.207662][ T1350] usb 1-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 140.240102][ T4177] loop0: [ 140.276391][ T1350] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 140.294139][ T5097] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 140.305243][ T5097] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 140.319243][ T5077] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 140.328456][ T5097] loop0: [ 140.333476][ T5077] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 140.364268][ T5104] netlink: 8 bytes leftover after parsing attributes in process `syz.4.249'. [ 140.426694][ T1350] pl2303 1-1:1.0: pl2303 converter detected [ 140.467727][ T1350] usb 1-1: pl2303 converter now attached to ttyUSB0 [ 140.867070][ T1350] usb 1-1: USB disconnect, device number 8 [ 140.959276][ T1350] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0 [ 141.021977][ T1350] pl2303 1-1:1.0: device disconnected [ 141.500111][ T4935] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 142.360424][ T5107] ======================================================= [ 142.360424][ T5107] WARNING: The mand mount option has been deprecated and [ 142.360424][ T5107] and is ignored by this kernel. Remove the mand [ 142.360424][ T5107] option from the mount to silence this warning. [ 142.360424][ T5107] ======================================================= [ 142.640821][ T4935] usb 3-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 142.711615][ T4935] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 143.714816][ T4935] usb 3-1: Product: syz [ 143.719959][ T4935] usb 3-1: Manufacturer: syz [ 143.728786][ T4935] usb 3-1: SerialNumber: syz [ 143.745623][ T4935] usb 3-1: config 0 descriptor?? [ 143.792033][ T4935] gspca_main: sunplus-2.14.0 probing 04fc:504a [ 143.910188][ T4935] gspca_sunplus: reg_r err -71 [ 143.990340][ T4935] usb 3-1: USB disconnect, device number 7 [ 144.090225][ T5155] netlink: 'syz.0.262': attribute type 4 has an invalid length. [ 144.098032][ T5155] netlink: 4 bytes leftover after parsing attributes in process `syz.0.262'. [ 145.190221][ T1350] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 145.460560][ T13] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 145.470312][ T1350] usb 5-1: Using ep0 maxpacket: 16 [ 145.590909][ T1350] usb 5-1: too many endpoints for config 0 interface 0 altsetting 3: 255, using maximum allowed: 30 [ 145.630484][ T1350] usb 5-1: config 0 interface 0 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 145.644807][ T1350] usb 5-1: config 0 interface 0 has no altsetting 0 [ 145.651812][ T1350] usb 5-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.00 [ 145.661239][ T1350] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 145.678558][ T1350] usb 5-1: config 0 descriptor?? [ 147.137110][ T5177] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 147.160229][ T13] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 147.170674][ T13] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 147.181072][ T13] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 147.196244][ T13] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 147.204059][ T4708] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 147.207596][ T13] usb 4-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 147.228649][ T13] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 147.272016][ T26] audit: type=1800 audit(1788223215.723:3): pid=5161 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.267" name="zoned" dev="configfs" ino=37036 res=0 errno=0 [ 147.292270][ T5166] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 147.300642][ T5166] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 147.309491][ T5181] ceph: No mds server is up or the cluster is laggy [ 147.311334][ T13] pl2303 4-1:1.0: pl2303 converter detected [ 147.344396][ T13] usb 4-1: pl2303 converter now attached to ttyUSB0 [ 147.383328][ T5187] udc-core: couldn't find an available UDC or it's busy [ 147.472622][ T5187] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 147.499282][ T26] audit: type=1800 audit(1788223215.763:4): pid=5161 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.267" name="zone_nr_conv" dev="configfs" ino=36857 res=0 errno=0 [ 147.522159][ T26] audit: type=1800 audit(1788223215.783:5): pid=5161 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.267" name="power" dev="configfs" ino=36858 res=0 errno=0 [ 148.683464][ T4708] usb 4-1: USB disconnect, device number 9 [ 148.700161][ T1350] usbhid 5-1:0.0: can't add hid device: -71 [ 148.706209][ T1350] usbhid: probe of 5-1:0.0 failed with error -71 [ 148.726058][ T1350] usb 5-1: USB disconnect, device number 10 [ 149.610462][ T4708] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0 [ 149.618752][ T4708] pl2303 4-1:1.0: device disconnected [ 150.133258][ T5209] netlink: 'syz.2.280': attribute type 4 has an invalid length. [ 150.141154][ T5209] netlink: 4 bytes leftover after parsing attributes in process `syz.2.280'. [ 150.857293][ T5221] tipc: Started in network mode [ 150.879051][ T5221] tipc: Node identity 1000001, cluster identity 4711 [ 151.010029][ T5221] tipc: Node number set to 16777217 [ 151.151176][ T4935] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 151.380421][ T4934] usb 3-1: new full-speed USB device number 8 using dummy_hcd [ 151.600392][ T4934] usb 3-1: device descriptor read/64, error -71 [ 151.750985][ T4935] usb 1-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 151.813883][ T4935] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 151.890298][ T4934] usb 3-1: new full-speed USB device number 9 using dummy_hcd [ 151.919605][ T4935] usb 1-1: Product: syz [ 151.977386][ T4935] usb 1-1: Manufacturer: syz [ 152.022901][ T4935] usb 1-1: SerialNumber: syz [ 152.120286][ T4934] usb 3-1: device descriptor read/64, error -71 [ 152.162323][ T4935] usb 1-1: config 0 descriptor?? [ 152.248614][ T4935] gspca_main: sunplus-2.14.0 probing 04fc:504a [ 152.256218][ T4934] usb usb3-port1: attempt power cycle [ 152.681039][ T4934] usb 3-1: new full-speed USB device number 10 using dummy_hcd [ 152.690507][ T4935] gspca_sunplus: reg_w_riv err -71 [ 152.695831][ T4935] sunplus: probe of 1-1:0.0 failed with error -71 [ 152.840661][ T4934] usb 3-1: device descriptor read/8, error -71 [ 152.891917][ T4935] usb 1-1: USB disconnect, device number 9 [ 153.150143][ T4934] usb 3-1: new full-speed USB device number 11 using dummy_hcd [ 153.280483][ T4934] usb 3-1: device descriptor read/8, error -71 [ 153.440837][ T4934] usb usb3-port1: unable to enumerate USB device [ 153.494725][ T5235] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 153.610199][ T4261] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 153.981239][ T4261] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 154.030361][ T4261] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 154.041994][ T4261] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 154.197306][ T4261] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 154.265607][ T4261] usb 4-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 154.697125][ T4261] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 154.760435][ T5232] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 154.778021][ T5232] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 154.807520][ T4261] pl2303 4-1:1.0: pl2303 converter detected [ 154.962759][ T5247] IPVS: sh: FWM 3 0x00000003 - no destination available [ 155.010111][ T4231] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 155.610510][ T4231] usb 3-1: Using ep0 maxpacket: 16 [ 155.692694][ T4261] usb 4-1: pl2303 converter now attached to ttyUSB0 [ 156.845942][ T4261] usb 4-1: USB disconnect, device number 10 [ 156.939497][ T4261] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0 [ 156.970281][ T4231] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 156.979952][ T4261] pl2303 4-1:1.0: device disconnected [ 156.989463][ T4231] usb 3-1: can't read configurations, error -71 [ 158.568016][ T1350] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 159.810455][ T7] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 159.906308][ T5285] serio: Serial port ttyS3 [ 160.200943][ T1350] usb 2-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 160.222800][ T1350] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 160.240217][ T1350] usb 2-1: Product: syz [ 160.244543][ T1350] usb 2-1: Manufacturer: syz [ 160.249152][ T1350] usb 2-1: SerialNumber: syz [ 160.257145][ T1350] usb 2-1: config 0 descriptor?? [ 160.354826][ T1350] usb 2-1: can't set config #0, error -71 [ 160.365235][ T1350] usb 2-1: USB disconnect, device number 8 [ 160.471352][ T7] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 160.490319][ T7] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 160.534006][ T7] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 161.282753][ T7] usb 1-1: config 0 descriptor?? [ 161.330430][ T7] usb 1-1: can't set config #0, error -71 [ 161.357508][ T5305] loop0: detected capacity change from 0 to 4096 [ 161.370351][ T7] usb 1-1: USB disconnect, device number 10 [ 161.932535][ T5312] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[5313] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[5312] [ 162.555005][ T4196] Bluetooth: hci3: link tx timeout [ 162.560610][ T4196] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 162.640267][ T4933] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 163.800127][ T1350] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 163.880144][ T4231] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 164.145164][ T4231] usb 3-1: Using ep0 maxpacket: 16 [ 164.160286][ T4933] usb 4-1: unable to get BOS descriptor or descriptor too short [ 164.250532][ T4933] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 164.263219][ T4933] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 164.280439][ T4231] usb 3-1: too many endpoints for config 0 interface 0 altsetting 3: 255, using maximum allowed: 30 [ 164.281168][ T4933] usb 4-1: too many endpoints for config 1 interface 1 altsetting 76: 188, using maximum allowed: 30 [ 164.303465][ T4933] usb 4-1: config 1 interface 1 altsetting 76 has 0 endpoint descriptors, different from the interface descriptor's value: 188 [ 164.304286][ T4231] usb 3-1: config 0 interface 0 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 164.327704][ T4933] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 164.341323][ T4933] usb 4-1: config 1 interface 1 has no altsetting 0 [ 164.403892][ T4933] usb 4-1: string descriptor 0 read error: -71 [ 164.421424][ T4933] usb 4-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 164.476366][ T4933] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 164.486062][ T4231] usb 3-1: config 0 interface 0 has no altsetting 0 [ 164.493212][ T4231] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.00 [ 164.503493][ T4231] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 164.513440][ T4231] usb 3-1: config 0 descriptor?? [ 164.544549][ T4231] usb 3-1: can't set config #0, error -71 [ 164.550498][ T1350] usb 2-1: device descriptor read/64, error -71 [ 164.900550][ T4231] usb 3-1: USB disconnect, device number 14 [ 164.908815][ T4379] Bluetooth: hci3: command 0x0406 tx timeout [ 164.930210][ T4933] usb 4-1: can't set config #1, error -71 [ 164.971869][ T4933] usb 4-1: USB disconnect, device number 11 [ 165.189856][ T5351] netlink: 12 bytes leftover after parsing attributes in process `syz.0.326'. [ 165.430350][ T4933] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 165.820443][ T4933] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 165.895973][ T4933] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 165.942458][ T1350] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 165.950207][ T4933] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 166.006092][ T5360] loop0: detected capacity change from 0 to 4096 [ 166.064542][ T4933] usb 4-1: config 0 descriptor?? [ 166.085522][ T5360] loop0: [ 166.122132][ T4933] pwc: Askey VC010 type 2 USB webcam detected. [ 166.550121][ T4933] pwc: recv_control_msg error -32 req 02 val 2b00 [ 166.590151][ T4933] pwc: recv_control_msg error -32 req 02 val 2700 [ 166.590351][ T4231] usb 1-1: new low-speed USB device number 11 using dummy_hcd [ 166.630473][ T1350] usb 2-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 166.630723][ T4933] pwc: recv_control_msg error -32 req 02 val 2c00 [ 166.641647][ T1350] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 166.654656][ T1350] usb 2-1: Product: syz [ 166.658868][ T1350] usb 2-1: Manufacturer: syz [ 166.663541][ T1350] usb 2-1: SerialNumber: syz [ 166.670060][ T1350] usb 2-1: config 0 descriptor?? [ 166.680604][ T4933] pwc: recv_control_msg error -32 req 04 val 1000 [ 166.712394][ T1350] gspca_main: sunplus-2.14.0 probing 04fc:504a [ 166.720193][ T4933] pwc: recv_control_msg error -32 req 04 val 1300 [ 166.760186][ T4933] pwc: recv_control_msg error -32 req 04 val 1400 [ 166.801232][ T4933] pwc: recv_control_msg error -32 req 02 val 2000 [ 166.887838][ T4933] pwc: recv_control_msg error -32 req 02 val 2100 [ 166.930387][ T4933] pwc: recv_control_msg error -32 req 04 val 1500 [ 166.970310][ T4933] pwc: recv_control_msg error -32 req 02 val 2500 [ 167.000343][ T4231] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 167.007828][ T4231] usb 1-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 167.010180][ T4933] pwc: recv_control_msg error -32 req 02 val 2400 [ 167.019893][ T4231] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 167.037643][ T4231] usb 1-1: config 168 interface 0 altsetting 188 has an invalid endpoint with address 0xFF, skipping [ 167.048671][ T4231] usb 1-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 167.062178][ T4231] usb 1-1: config 168 interface 0 has no altsetting 0 [ 167.070566][ T4933] pwc: recv_control_msg error -32 req 02 val 2600 [ 167.130315][ T1350] gspca_sunplus: reg_w_riv err -71 [ 167.135502][ T1350] sunplus: probe of 2-1:0.0 failed with error -71 [ 167.145144][ T1350] usb 2-1: USB disconnect, device number 10 [ 167.155974][ T4231] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 167.165206][ T4231] usb 1-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 167.181417][ T4231] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 167.192475][ T4231] usb 1-1: config 168 interface 0 altsetting 188 has an invalid endpoint with address 0xFF, skipping [ 167.203384][ T4231] usb 1-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 167.216819][ T4231] usb 1-1: config 168 interface 0 has no altsetting 0 [ 167.310224][ T4231] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 167.317791][ T4231] usb 1-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 167.329438][ T4231] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 167.330204][ T4933] pwc: recv_control_msg error -71 req 02 val 2800 [ 167.340825][ T4231] usb 1-1: config 168 interface 0 altsetting 188 has an invalid endpoint with address 0xFF, skipping [ 167.357869][ T4231] usb 1-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 167.370216][ T4933] pwc: recv_control_msg error -71 req 04 val 1100 [ 167.371434][ T4231] usb 1-1: config 168 interface 0 has no altsetting 0 [ 167.400241][ T4933] pwc: recv_control_msg error -71 req 04 val 1200 [ 167.407814][ T4933] pwc: Registered as video103. [ 167.414384][ T4933] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input7 [ 167.445115][ T4933] usb 4-1: USB disconnect, device number 12 [ 167.660127][ T4231] usb 1-1: string descriptor 0 read error: -22 [ 167.673562][ T4231] usb 1-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 167.683228][ T4231] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 168.841424][ T4231] adutux 1-1:168.0: interrupt endpoints not found [ 169.122728][ T4935] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 169.140881][ T5362] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 169.644406][ T4934] usb 1-1: USB disconnect, device number 11 [ 169.948084][ T5387] serio: Serial port ttyS3 [ 170.090543][ T4935] usb 3-1: unable to get BOS descriptor or descriptor too short [ 170.185525][ T4935] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 170.216393][ T4935] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 170.259409][ T4935] usb 3-1: too many endpoints for config 1 interface 1 altsetting 76: 188, using maximum allowed: 30 [ 170.301305][ T4935] usb 3-1: config 1 interface 1 altsetting 76 has 0 endpoint descriptors, different from the interface descriptor's value: 188 [ 170.355531][ T4935] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 170.404862][ T4935] usb 3-1: config 1 interface 1 has no altsetting 0 [ 171.600215][ T4231] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 171.660288][ T4935] usb 3-1: string descriptor 0 read error: -22 [ 171.667877][ T4935] usb 3-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 171.693395][ T4935] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 171.840166][ T4231] usb 2-1: Using ep0 maxpacket: 16 [ 171.960300][ T4231] usb 2-1: too many endpoints for config 0 interface 0 altsetting 3: 255, using maximum allowed: 30 [ 171.988146][ T4231] usb 2-1: config 0 interface 0 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 172.031010][ T4935] usb 3-1: cannot get ctl value: req = 0x83, wValue = 0x201, wIndex = 0x200, type = 4 [ 172.041278][ T4231] usb 2-1: config 0 interface 0 has no altsetting 0 [ 172.050044][ T4935] usb 3-1: 2:0: cannot get min/max values for control 2 (id 2) [ 172.059933][ T4231] usb 2-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.00 [ 172.128392][ T5399] netlink: 36 bytes leftover after parsing attributes in process `syz.3.338'. [ 172.224504][ T4231] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 172.377336][ T4231] usb 2-1: config 0 descriptor?? [ 172.700373][ T4935] usb 3-1: cannot get ctl value: req = 0x83, wValue = 0x201, wIndex = 0x200, type = 4 [ 172.790590][ T4935] usb 3-1: 2:0: cannot get min/max values for control 2 (id 2) [ 172.819475][ T5405] loop0: detected capacity change from 0 to 4096 [ 172.843439][ T4935] usb 3-1: cannot get ctl value: req = 0x83, wValue = 0x201, wIndex = 0x200, type = 4 [ 172.863625][ T26] audit: type=1800 audit(1788223241.323:6): pid=5391 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.332" name="zoned" dev="configfs" ino=37385 res=0 errno=0 [ 172.869800][ T4935] usb 3-1: 2:0: cannot get min/max values for control 2 (id 2) [ 172.891590][ T5391] udc-core: couldn't find an available UDC or it's busy [ 172.893407][ T5407] netlink: 8 bytes leftover after parsing attributes in process `syz.3.342'. [ 172.898638][ T5391] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 172.914692][ T26] audit: type=1800 audit(1788223241.353:7): pid=5391 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.332" name="zone_nr_conv" dev="configfs" ino=37386 res=0 errno=0 [ 172.921243][ T4175] loop0: [ 174.106665][ T4231] usbhid 2-1:0.0: can't add hid device: -71 [ 174.123519][ T4231] usbhid: probe of 2-1:0.0 failed with error -71 [ 174.140074][ T26] audit: type=1800 audit(1788223241.353:8): pid=5391 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.332" name="power" dev="configfs" ino=37387 res=0 errno=0 [ 174.169455][ T4935] usb 3-1: USB disconnect, device number 15 [ 174.180212][ T4231] usb 2-1: USB disconnect, device number 11 [ 174.218164][ T5405] loop0: [ 174.592678][ T4934] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 174.724739][ T4935] usb 3-1: new low-speed USB device number 16 using dummy_hcd [ 175.000748][ T4933] usb 2-1: new low-speed USB device number 12 using dummy_hcd [ 175.161747][ T4934] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 175.186314][ T4934] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 175.197007][ T4935] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 175.216924][ T4935] usb 3-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 175.231139][ T4934] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 175.240728][ T4935] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 175.257032][ T4935] usb 3-1: config 168 interface 0 altsetting 188 has an invalid endpoint with address 0xFF, skipping [ 175.326560][ T4934] usb 5-1: config 0 descriptor?? [ 175.345505][ T4935] usb 3-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 175.369925][ T4935] usb 3-1: config 168 interface 0 has no altsetting 0 [ 175.379051][ T4934] pwc: Askey VC010 type 2 USB webcam detected. [ 175.440313][ T4933] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 175.470161][ T4935] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 175.477637][ T4933] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 175.496447][ T4935] usb 3-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 175.516646][ T4933] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 175.527852][ T4935] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 175.550114][ T4933] usb 2-1: config 168 interface 0 altsetting 188 has an invalid endpoint with address 0xFF, skipping [ 175.561401][ T4935] usb 3-1: config 168 interface 0 altsetting 188 has an invalid endpoint with address 0xFF, skipping [ 175.580160][ T4933] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 175.600069][ T4935] usb 3-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 175.620184][ T4933] usb 2-1: config 168 interface 0 has no altsetting 0 [ 175.637475][ T4935] usb 3-1: config 168 interface 0 has no altsetting 0 [ 176.710196][ T13] Bluetooth: hci0: command 0x0c20 tx timeout [ 176.710234][ T4934] pwc: recv_control_msg error -32 req 02 val 2b00 [ 176.740234][ T4933] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 176.747975][ T4935] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 176.758242][ T4935] usb 3-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 176.770573][ T4933] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 176.782410][ T4933] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 176.793532][ T4934] pwc: recv_control_msg error -32 req 02 val 2700 [ 176.803708][ T4935] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 176.814935][ T4933] usb 2-1: config 168 interface 0 altsetting 188 has an invalid endpoint with address 0xFF, skipping [ 176.825973][ T4935] usb 3-1: config 168 interface 0 altsetting 188 has an invalid endpoint with address 0xFF, skipping [ 176.840095][ T4933] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 176.853957][ T4934] pwc: recv_control_msg error -32 req 02 val 2c00 [ 176.860582][ T4935] usb 3-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 176.874274][ T4933] usb 2-1: config 168 interface 0 has no altsetting 0 [ 176.881174][ T4935] usb 3-1: config 168 interface 0 has no altsetting 0 [ 176.910112][ T4934] pwc: recv_control_msg error -32 req 04 val 1000 [ 176.960288][ T4933] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 176.970139][ T4934] pwc: recv_control_msg error -32 req 04 val 1300 [ 176.980441][ T4933] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 177.010217][ T4934] pwc: recv_control_msg error -32 req 04 val 1400 [ 177.037029][ T4933] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 177.070122][ T4934] pwc: recv_control_msg error -32 req 02 val 2000 [ 177.096310][ T4933] usb 2-1: config 168 interface 0 altsetting 188 has an invalid endpoint with address 0xFF, skipping [ 177.110109][ T4934] pwc: recv_control_msg error -32 req 02 val 2100 [ 177.120163][ T4935] usb 3-1: string descriptor 0 read error: -22 [ 177.140280][ T4935] usb 3-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 177.150071][ T4933] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 177.164758][ T4935] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 177.176839][ T4933] usb 2-1: config 168 interface 0 has no altsetting 0 [ 177.184071][ T4934] pwc: recv_control_msg error -32 req 04 val 1500 [ 177.215457][ T4935] usb 3-1: can't set config #168, error -71 [ 177.230288][ T4934] pwc: recv_control_msg error -32 req 02 val 2500 [ 177.237048][ T4935] usb 3-1: USB disconnect, device number 16 [ 177.280103][ T4934] pwc: recv_control_msg error -32 req 02 val 2400 [ 177.320247][ T4934] pwc: recv_control_msg error -32 req 02 val 2600 [ 177.431310][ T4933] usb 2-1: string descriptor 0 read error: -22 [ 177.442462][ T4933] usb 2-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 177.546328][ T4933] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 177.580704][ T4934] pwc: recv_control_msg error -71 req 02 val 2800 [ 177.600146][ T4934] pwc: recv_control_msg error -71 req 04 val 1100 [ 177.611673][ T4933] adutux 2-1:168.0: interrupt endpoints not found [ 177.626154][ T4934] pwc: recv_control_msg error -71 req 04 val 1200 [ 177.659818][ T5425] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 177.675705][ T4934] pwc: Registered as video103. [ 177.707632][ T4934] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input8 [ 177.794317][ T5453] netlink: 'syz.2.356': attribute type 4 has an invalid length. [ 177.802175][ T5453] netlink: 4 bytes leftover after parsing attributes in process `syz.2.356'. [ 177.846573][ T4934] usb 5-1: USB disconnect, device number 11 [ 178.055537][ T4933] usb 2-1: USB disconnect, device number 12 [ 178.454229][ T5460] netlink: 'syz.2.358': attribute type 1 has an invalid length. [ 178.472257][ T5460] netlink: 'syz.2.358': attribute type 2 has an invalid length. [ 179.664343][ T26] audit: type=1800 audit(1788223248.123:9): pid=5477 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.364" name="(" dev="sda1" ino=2047 res=0 errno=0 [ 179.685385][ T13] usb 5-1: new full-speed USB device number 12 using dummy_hcd [ 180.790861][ T13] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid maxpacket 33437, setting to 64 [ 180.823203][ T13] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 180.914158][ T5496] netlink: 'syz.0.369': attribute type 4 has an invalid length. [ 180.922117][ T5496] netlink: 4 bytes leftover after parsing attributes in process `syz.0.369'. [ 181.494485][ T13] usb 5-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice=c2.87 [ 181.523167][ T26] audit: type=1326 audit(1788223249.983:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5497 comm="syz.2.372" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f6b25cb8159 code=0x0 [ 181.558487][ T13] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 181.565232][ T4933] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 181.580267][ T13] usb 5-1: Product: syz [ 181.600285][ T13] usb 5-1: Manufacturer: syz [ 181.625621][ T13] usb 5-1: SerialNumber: syz [ 181.701522][ T13] usb 5-1: config 0 descriptor?? [ 182.020179][ T13] usb 5-1: can't set config #0, error -71 [ 182.048429][ T13] usb 5-1: USB disconnect, device number 12 [ 182.062213][ T5508] loop0: detected capacity change from 0 to 4096 [ 182.080207][ T4933] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 182.105217][ T4933] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 182.130160][ T4933] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 182.142116][ T4933] usb 2-1: config 0 descriptor?? [ 182.263414][ T5510] loop0: [ 182.279645][ T4933] pwc: Askey VC010 type 2 USB webcam detected. [ 183.001153][ T4933] pwc: recv_control_msg error -32 req 02 val 2b00 [ 183.060659][ T4933] pwc: recv_control_msg error -32 req 02 val 2700 [ 183.097362][ T5521] netlink: 8 bytes leftover after parsing attributes in process `syz.2.377'. [ 183.127882][ T5522] IPVS: sh: FWM 3 0x00000003 - no destination available [ 183.920184][ T4933] pwc: recv_control_msg error -32 req 02 val 2c00 [ 183.970170][ T4933] pwc: recv_control_msg error -32 req 04 val 1000 [ 184.030169][ T4933] pwc: recv_control_msg error -32 req 04 val 1300 [ 184.054318][ T26] audit: type=1800 audit(1788223252.513:11): pid=5531 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.378" name="(" dev="sda1" ino=2047 res=0 errno=0 [ 184.078450][ T4933] pwc: recv_control_msg error -32 req 04 val 1400 [ 184.140412][ T4933] pwc: recv_control_msg error -32 req 02 val 2000 [ 184.206278][ T4933] pwc: recv_control_msg error -32 req 02 val 2100 [ 184.260482][ T4933] pwc: recv_control_msg error -32 req 04 val 1500 [ 184.715915][ T4933] pwc: recv_control_msg error -32 req 02 val 2500 [ 184.774135][ T4933] pwc: recv_control_msg error -32 req 02 val 2400 [ 184.830303][ T4933] pwc: recv_control_msg error -32 req 02 val 2600 [ 185.248887][ T4936] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 185.258276][ T4933] pwc: recv_control_msg error -71 req 02 val 2800 [ 185.290380][ T4933] pwc: recv_control_msg error -71 req 04 val 1100 [ 185.606334][ T4933] pwc: recv_control_msg error -71 req 04 val 1200 [ 185.625820][ T4933] pwc: Registered as video103. [ 185.636601][ T4933] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input9 [ 185.672203][ T4933] usb 2-1: USB disconnect, device number 13 [ 185.940163][ T4936] usb 1-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 186.906970][ T13] Bluetooth: hci2: command 0x0406 tx timeout [ 187.022477][ T4936] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 187.034179][ T4936] usb 1-1: config 0 descriptor?? [ 187.048749][ T13] Bluetooth: hci1: command 0x0406 tx timeout [ 187.331031][ T5571] netlink: 36 bytes leftover after parsing attributes in process `syz.4.391'. [ 187.990146][ T13] Bluetooth: hci4: command 0x0406 tx timeout [ 188.510162][ T13] Bluetooth: hci0: command 0x0406 tx timeout [ 188.600252][ T4936] [drm] vendor descriptor length:b9 data:00 00 00 00 00 00 00 00 00 00 00 [ 188.611874][ T4936] [drm:udl_init] *ERROR* Unrecognized vendor firmware descriptor [ 188.756915][ T4936] [drm:udl_init] *ERROR* Selecting channel failed [ 188.809277][ T5586] netlink: 8 bytes leftover after parsing attributes in process `syz.4.396'. [ 188.901243][ T4936] [drm] Initialized udl 0.0.1 20120220 for 1-1:0.0 on minor 2 [ 188.953574][ T4936] [drm] Initialized udl on minor 2 [ 189.009132][ T4936] [drm:udl_get_edid_block] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 189.126167][ T4936] udl 1-1:0.0: [drm] Cannot find any crtc or sizes [ 189.188487][ T4936] usb 1-1: USB disconnect, device number 12 [ 189.240872][ T4933] [drm:udl_get_edid_block] *ERROR* Read EDID byte 0 failed err ffffffed [ 189.266559][ T4933] [drm:udl_get_edid_block] *ERROR* Read EDID byte 0 failed err ffffffed [ 189.297082][ T4933] udl 1-1:0.0: [drm] Cannot find any crtc or sizes [ 189.390051][ T4934] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 190.170371][ T4934] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 190.225345][ T4934] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 190.272659][ T4934] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 190.296200][ T4934] usb 4-1: config 0 descriptor?? [ 191.412361][ T4934] pwc: Askey VC010 type 2 USB webcam detected. [ 192.030143][ T4934] pwc: send_video_command error -71 [ 192.035400][ T4934] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 192.108737][ T4934] Philips webcam: probe of 4-1:0.0 failed with error -71 [ 192.189324][ T4934] usb 4-1: USB disconnect, device number 13 [ 192.848960][ T5630] netlink: 'syz.1.398': attribute type 4 has an invalid length. [ 192.856732][ T5630] netlink: 4 bytes leftover after parsing attributes in process `syz.1.398'. [ 194.237115][ T1430] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.248377][ T1430] ieee802154 phy1 wpan1: encryption failed: -22 [ 195.237773][ T5650] fuse: Bad value for 'fd' [ 199.393831][ T26] audit: type=1326 audit(1788223267.853:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5666 comm="syz.1.420" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f3e1a2e6159 code=0x0 [ 199.395539][ T5669] binder: 5667:5669 ioctl 4018620d 0 returned -22 [ 199.510191][ T1350] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 200.045171][ T1350] usb 1-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 200.115385][ T1350] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 200.126629][ T1350] usb 1-1: config 0 descriptor?? [ 200.358570][ T5689] netlink: 'syz.2.422': attribute type 4 has an invalid length. [ 200.366395][ T5689] netlink: 4 bytes leftover after parsing attributes in process `syz.2.422'. [ 200.919133][ T4231] usb 5-1: new full-speed USB device number 13 using dummy_hcd [ 200.937465][ T5662] IPVS: length: 31 != 24 [ 200.956260][ T5662] loop5: detected capacity change from 0 to 7 [ 201.110473][ T1350] [drm] vendor descriptor length:b9 data:00 00 00 00 00 00 00 00 00 00 00 [ 201.145759][ T1350] [drm:udl_init] *ERROR* Unrecognized vendor firmware descriptor [ 201.527947][ T1350] [drm:udl_init] *ERROR* Selecting channel failed [ 201.781060][ T4231] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 202.101299][ T4231] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 202.113310][ T1350] [drm] Initialized udl 0.0.1 20120220 for 1-1:0.0 on minor 2 [ 202.120974][ T1350] [drm] Initialized udl on minor 2 [ 202.126380][ T4231] usb 5-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 202.140005][ T4231] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 202.224257][ T1350] [drm:udl_get_edid_block] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 202.233885][ T4231] usb 5-1: config 0 descriptor?? [ 202.239534][ T1350] udl 1-1:0.0: [drm] Cannot find any crtc or sizes [ 202.252606][ T1350] usb 1-1: USB disconnect, device number 13 [ 202.259217][ T4379] [drm:udl_get_edid_block] *ERROR* Read EDID byte 0 failed err ffffffed [ 202.268531][ T4379] [drm:udl_get_edid_block] *ERROR* Read EDID byte 0 failed err ffffffed [ 202.277049][ T4379] udl 1-1:0.0: [drm] Cannot find any crtc or sizes [ 202.286483][ T4231] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 202.334902][ T4231] dvb-usb: bulk message failed: -22 (3/0) [ 202.414674][ T4231] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 203.510372][ T4231] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 203.852671][ T4231] usb 5-1: media controller created [ 203.858891][ T4231] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 203.890677][ T4231] dvb-usb: bulk message failed: -22 (6/0) [ 203.900258][ T4231] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 203.958417][ T4231] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input10 [ 203.959649][ T4231] dvb-usb: schedule remote query interval to 150 msecs. [ 203.959671][ T4231] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 203.994277][ T4231] usb 5-1: USB disconnect, device number 13 [ 204.016380][ T4231] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 204.699805][ T5734] fuse: Bad value for 'fd' [ 206.850829][ T13] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 207.092457][ T5753] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input11 [ 207.290240][ T13] usb 3-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 207.299700][ T13] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 207.387260][ T13] usb 3-1: config 0 descriptor?? [ 207.632695][ T5737] IPVS: length: 31 != 24 [ 207.648831][ T5737] loop5: detected capacity change from 0 to 7 [ 208.370148][ T13] [drm] vendor descriptor length:b9 data:00 00 00 00 00 00 00 00 00 00 00 [ 208.379987][ T13] [drm:udl_init] *ERROR* Unrecognized vendor firmware descriptor [ 208.412274][ T13] [drm:udl_init] *ERROR* Selecting channel failed [ 208.473880][ T13] [drm] Initialized udl 0.0.1 20120220 for 3-1:0.0 on minor 2 [ 208.489406][ T13] [drm] Initialized udl on minor 2 [ 208.510726][ T13] [drm:udl_get_edid_block] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 208.532001][ T13] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 208.658727][ T13] usb 3-1: USB disconnect, device number 17 [ 208.680062][ T7] [drm:udl_get_edid_block] *ERROR* Read EDID byte 0 failed err ffffffed [ 208.693038][ T7] [drm:udl_get_edid_block] *ERROR* Read EDID byte 0 failed err ffffffed [ 208.732219][ T7] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 208.740602][ T5793] fuse: Bad value for 'fd' [ 209.042443][ T4933] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 209.410237][ T4933] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 209.426324][ T4933] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 209.430824][ T13] usb 3-1: new low-speed USB device number 18 using dummy_hcd [ 209.444767][ T4933] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 209.570563][ T5807] serio: Serial port ttyS3 [ 209.850518][ T13] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 209.894575][ T13] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 210.000256][ T13] usb 3-1: New USB device found, idVendor=0c70, idProduct=f0b6, bcdDevice= 0.00 [ 210.063186][ T13] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 210.160576][ T13] usb 3-1: config 0 descriptor?? [ 210.288356][ T4933] usb 2-1: config 0 descriptor?? [ 210.331978][ T4933] pwc: Askey VC010 type 2 USB webcam detected. [ 210.629172][ T5826] fuse: Bad value for 'fd' [ 211.330229][ T4933] pwc: recv_control_msg error -32 req 02 val 2b00 [ 211.385892][ T4933] pwc: recv_control_msg error -32 req 02 val 2700 [ 212.540402][ T4933] pwc: recv_control_msg error -71 req 02 val 2c00 [ 212.567936][ T4933] pwc: recv_control_msg error -71 req 04 val 1000 [ 212.660123][ T4933] pwc: recv_control_msg error -71 req 04 val 1300 [ 212.690141][ T4933] pwc: recv_control_msg error -71 req 04 val 1400 [ 212.720141][ T4933] pwc: recv_control_msg error -71 req 02 val 2000 [ 212.741230][ T4933] pwc: recv_control_msg error -71 req 02 val 2100 [ 212.790198][ T4933] pwc: recv_control_msg error -71 req 04 val 1500 [ 212.790283][ T13] usbhid 3-1:0.0: can't add hid device: -71 [ 212.820393][ T4933] pwc: recv_control_msg error -71 req 02 val 2500 [ 212.840423][ T4933] pwc: recv_control_msg error -71 req 02 val 2400 [ 212.860481][ T4933] pwc: recv_control_msg error -71 req 02 val 2600 [ 212.880484][ T4933] pwc: recv_control_msg error -71 req 02 val 2900 [ 212.900337][ T4933] pwc: recv_control_msg error -71 req 02 val 2800 [ 212.942955][ T4933] pwc: recv_control_msg error -71 req 04 val 1100 [ 213.002717][ T4933] pwc: recv_control_msg error -71 req 04 val 1200 [ 213.140190][ T4933] pwc: Registered as video103. [ 213.224850][ T4933] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input12 [ 213.389310][ T13] usbhid: probe of 3-1:0.0 failed with error -71 [ 213.414513][ T4933] usb 2-1: USB disconnect, device number 14 [ 213.520431][ T13] usb 3-1: USB disconnect, device number 18 [ 215.942239][ T5891] netlink: 8 bytes leftover after parsing attributes in process `syz.1.490'. [ 216.430286][ T5909] serio: Serial port ttyS3 [ 216.750082][ T4933] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 217.066393][ T5913] loop0: detected capacity change from 0 to 4096 [ 217.980139][ T4933] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 218.004694][ T4933] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 218.050169][ T4933] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 218.082131][ T4933] usb 5-1: config 0 descriptor?? [ 218.222377][ T4933] pwc: Askey VC010 type 2 USB webcam detected. [ 218.295937][ T5940] netlink: 8 bytes leftover after parsing attributes in process `syz.3.504'. [ 218.633122][ T4933] pwc: recv_control_msg error -32 req 02 val 2b00 [ 218.670542][ T4933] pwc: recv_control_msg error -32 req 02 val 2700 [ 218.745776][ T5953] netlink: 8 bytes leftover after parsing attributes in process `syz.1.507'. [ 219.408340][ T4933] pwc: recv_control_msg error -32 req 02 val 2c00 [ 219.450117][ T4933] pwc: recv_control_msg error -32 req 04 val 1000 [ 219.490242][ T4933] pwc: recv_control_msg error -32 req 04 val 1300 [ 219.530101][ T4933] pwc: recv_control_msg error -32 req 04 val 1400 [ 219.577364][ T5965] serio: Serial port ttyS3 [ 219.582738][ T4933] pwc: recv_control_msg error -32 req 02 val 2000 [ 219.620101][ T4933] pwc: recv_control_msg error -32 req 02 val 2100 [ 219.640107][ T13] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 219.660110][ T4933] pwc: recv_control_msg error -32 req 04 val 1500 [ 219.710158][ T4933] pwc: recv_control_msg error -32 req 02 val 2500 [ 219.795218][ T4933] pwc: recv_control_msg error -32 req 02 val 2400 [ 219.840135][ T4933] pwc: recv_control_msg error -32 req 02 val 2600 [ 220.100168][ T4933] pwc: recv_control_msg error -71 req 02 val 2800 [ 220.120301][ T4933] pwc: recv_control_msg error -71 req 04 val 1100 [ 220.140147][ T4933] pwc: recv_control_msg error -71 req 04 val 1200 [ 220.151438][ T4933] pwc: Registered as video103. [ 220.164827][ T4933] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input13 [ 220.207313][ T4933] usb 5-1: USB disconnect, device number 14 [ 221.121028][ T13] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 221.132171][ T13] usb 4-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xBA, skipping [ 221.370236][ T13] usb 4-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 222.043040][ T13] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 222.052198][ T13] usb 4-1: Product: syz [ 222.056389][ T13] usb 4-1: Manufacturer: syz [ 222.061330][ T13] usb 4-1: SerialNumber: syz [ 222.068321][ T13] usb 4-1: config 0 descriptor?? [ 222.090334][ T5957] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 222.097648][ T5957] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 222.200782][ T13] usb 4-1: ucan: probing device on interface #0 [ 222.207510][ T13] usb 4-1: ucan: invalid EP count (1) [ 222.240109][ T13] usb 4-1: ucan: probe failed; try to update the device firmware [ 222.355890][ T13] usb 4-1: USB disconnect, device number 14 [ 222.910151][ T13] usb 5-1: new full-speed USB device number 15 using dummy_hcd [ 223.360281][ T13] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 223.424449][ T13] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 23 [ 223.714380][ T13] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 223.801725][ T13] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 224.373531][ T13] usb 5-1: SerialNumber: syz [ 224.756367][ T13] hub 5-1:1.0: bad descriptor, ignoring hub [ 225.526574][ T13] hub: probe of 5-1:1.0 failed with error -5 [ 225.631380][ T13] cdc_acm 5-1:1.0: skipping garbage [ 225.706301][ T13] cdc_acm 5-1:1.0: Control and data interfaces are not separated! [ 225.820533][ T13] cdc_acm 5-1:1.0: This needs exactly 3 endpoints [ 225.851089][ T13] cdc_acm: probe of 5-1:1.0 failed with error -22 [ 225.919772][ T6034] binder: 6033:6034 ioctl 4018620d 0 returned -22 [ 225.961582][ T13] usb 5-1: USB disconnect, device number 15 [ 226.148996][ T6048] serio: Serial port ttyS3 [ 228.185789][ T26] audit: type=1326 audit(1788223296.643:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6074 comm="syz.1.549" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f3e1a2e6159 code=0x0 [ 228.228629][ T6080] binder: 6079:6080 ioctl 4018620d 0 returned -22 [ 229.108909][ T6104] serio: Serial port ttyS3 [ 232.625879][ T6150] dlm: no local IP address has been set [ 232.632021][ T6150] dlm: cannot start dlm midcomms -107 [ 233.342279][ T4934] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 233.425098][ T6158] serio: Serial port ttyS3 [ 233.546376][ T6162] netlink: 4 bytes leftover after parsing attributes in process `syz.1.568'. [ 233.610168][ T4934] usb 1-1: device descriptor read/64, error -71 [ 233.940240][ T4934] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 235.100710][ T4934] usb 1-1: device descriptor read/64, error -71 [ 235.220506][ T4934] usb usb1-port1: attempt power cycle [ 235.650154][ T4934] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 235.980136][ T4934] usb 1-1: device descriptor read/8, error -71 [ 237.218919][ T6185] bridge0: adding interface bridge0 with same address as a received packet (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 237.272424][ T6185] bridge0: port 2(bridge_slave_1) entered disabled state [ 237.280443][ T6185] bridge0: port 1(bridge_slave_0) entered disabled state [ 237.366957][ T6189] IPVS: sh: FWM 3 0x00000003 - no destination available [ 238.375404][ T6205] netlink: 4 bytes leftover after parsing attributes in process `syz.3.591'. [ 240.108188][ T6224] netlink: 28 bytes leftover after parsing attributes in process `syz.1.596'. [ 240.176350][ T6229] dlm: no local IP address has been set [ 240.182098][ T6229] dlm: cannot start dlm midcomms -107 [ 240.470289][ T4174] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 240.690239][ T4174] usb 5-1: device descriptor read/64, error -71 [ 240.970482][ T4174] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 241.210228][ T4174] usb 5-1: device descriptor read/64, error -71 [ 241.340734][ T4174] usb usb5-port1: attempt power cycle [ 241.750361][ T4174] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 241.870217][ T4174] usb 5-1: device descriptor read/8, error -71 [ 241.887311][ T6238] IPVS: sh: FWM 3 0x00000003 - no destination available [ 243.697000][ T4174] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 243.807402][ T6256] netlink: 4 bytes leftover after parsing attributes in process `syz.1.607'. [ 244.158864][ T4174] usb 5-1: device not accepting address 19, error -71 [ 244.281564][ T4174] usb usb5-port1: unable to enumerate USB device [ 245.721156][ T6273] IPVS: sh: FWM 3 0x00000003 - no destination available [ 246.047495][ T6286] netlink: 8 bytes leftover after parsing attributes in process `syz.3.615'. [ 249.076586][ T6312] netlink: 4 bytes leftover after parsing attributes in process `syz.1.623'. [ 249.660730][ T6330] IPVS: sh: FWM 3 0x00000003 - no destination available [ 252.038860][ T6363] loop0: detected capacity change from 0 to 4096 [ 252.093728][ T4371] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 252.112963][ T4371] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 252.121259][ T6368] netlink: 4 bytes leftover after parsing attributes in process `syz.4.639'. [ 252.357578][ T4371] loop0: [ 252.570172][ T6363] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 252.583481][ T6363] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 252.590403][ T6363] loop0: [ 252.740154][ T4936] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 254.309431][ T4936] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 254.321233][ T4936] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 254.330765][ T4936] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 254.340994][ T4936] usb 4-1: config 0 descriptor?? [ 255.393747][ T4936] usbhid 4-1:0.0: can't add hid device: -71 [ 255.400217][ T4936] usbhid: probe of 4-1:0.0 failed with error -71 [ 255.408267][ T4936] usb 4-1: USB disconnect, device number 15 [ 255.483648][ T6415] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 256.238697][ T1430] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.245114][ T1430] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.465958][ T6423] netlink: 4 bytes leftover after parsing attributes in process `syz.0.653'. [ 256.800286][ T4936] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 257.070101][ T4936] usb 4-1: Using ep0 maxpacket: 32 [ 257.190240][ T4936] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 257.219400][ T4936] usb 4-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 0.40 [ 257.362681][ T4936] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 257.382075][ T4936] usb 4-1: config 0 descriptor?? [ 258.096162][ T4936] usb 4-1: can't set config #0, error -71 [ 258.112387][ T4936] usb 4-1: USB disconnect, device number 16 [ 258.230078][ T4174] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 258.490081][ T4174] usb 5-1: Using ep0 maxpacket: 16 [ 258.634041][ T6458] binder: 6457:6458 ioctl 4018620d 0 returned -22 [ 258.650330][ T4174] usb 5-1: too many endpoints for config 0 interface 0 altsetting 3: 255, using maximum allowed: 30 [ 258.734247][ T6459] kAFS: Invalid Command on /proc/fs/afs/cells file [ 258.756606][ T4174] usb 5-1: config 0 interface 0 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 258.772730][ T4174] usb 5-1: config 0 interface 0 has no altsetting 0 [ 258.779683][ T4174] usb 5-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.00 [ 258.792364][ T4174] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 259.393418][ T4174] usb 5-1: config 0 descriptor?? [ 259.518570][ T6463] netlink: 4 bytes leftover after parsing attributes in process `syz.3.667'. [ 259.855956][ T26] audit: type=1800 audit(1788223328.313:14): pid=6438 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.658" name="zoned" dev="configfs" ino=42134 res=0 errno=0 [ 259.900586][ T26] audit: type=1800 audit(1788223328.333:15): pid=6438 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.658" name="zone_nr_conv" dev="configfs" ino=42135 res=0 errno=0 [ 260.019051][ T26] audit: type=1800 audit(1788223328.393:16): pid=6438 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.658" name="power" dev="configfs" ino=41838 res=0 errno=0 [ 261.412031][ T4174] usbhid 5-1:0.0: can't add hid device: -71 [ 262.246293][ T4174] usbhid: probe of 5-1:0.0 failed with error -71 [ 262.259083][ T4174] usb 5-1: USB disconnect, device number 20 [ 263.282509][ T6489] netlink: 4 bytes leftover after parsing attributes in process `syz.3.674'. [ 263.484908][ T6489] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 264.405155][ T6489] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 264.466067][ T6494] netlink: 'syz.1.676': attribute type 4 has an invalid length. [ 264.584814][ T6500] binder: 6499:6500 ioctl 4018620d 0 returned -22 [ 264.779061][ T6511] netlink: 4 bytes leftover after parsing attributes in process `syz.0.681'. [ 265.017333][ T6512] netlink: 44 bytes leftover after parsing attributes in process `syz.0.681'. [ 267.792387][ T6530] page:ffffea0001200000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x48000 [ 267.833776][ T6530] head:ffffea0001200000 order:9 compound_mapcount:0 compound_pincount:0 [ 267.865160][ T6530] flags: 0xfff00000010000(head|node=0|zone=1|lastcpupid=0x7ff) [ 267.897061][ T6530] raw: 00fff00000010000 0000000000000000 dead000000000122 0000000000000000 [ 268.015654][ T6530] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 268.085565][ T6530] page dumped because: unmovable page [ 268.101487][ T6530] page_owner tracks the page as allocated [ 268.145168][ T6530] page last allocated via order 9, migratetype Unmovable, gfp_mask 0x11c25c2(__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_COMP|__GFP_ZERO|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_DIRECT_RECLAIM|__GFP_SKIP_KASAN_POISON), pid 5713, ts 203507262993, free_ts 197142634923 [ 268.530621][ T6542] dlm: no local IP address has been set [ 268.536416][ T6542] dlm: cannot start dlm midcomms -107 [ 269.138643][ T6530] get_page_from_freelist+0x24f6/0x2670 [ 269.162650][ T6530] __alloc_pages+0x1ee/0x480 [ 269.167305][ T6530] mm_get_huge_zero_page+0x157/0x240 [ 269.210091][ T6530] do_huge_pmd_anonymous_page+0xc8e/0x1ca0 [ 269.221298][ T6530] handle_mm_fault+0x2126/0x4440 [ 269.360023][ T6530] do_user_addr_fault+0x494/0xc90 [ 269.420269][ T4231] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 270.018552][ T6530] exc_page_fault+0x60/0x100 [ 270.035978][ T6530] asm_exc_page_fault+0x22/0x30 [ 270.130861][ T6530] copy_user_generic_unrolled+0x9e/0xc0 [ 270.136470][ T6530] _copy_from_user+0xfa/0x170 [ 270.200896][ T6530] snd_rawmidi_kernel_write1+0x38d/0x610 [ 270.233182][ T6530] snd_rawmidi_write+0x5b0/0xb90 [ 270.238565][ T6530] do_iter_write+0x3c3/0x7a0 [ 270.258637][ T6530] do_writev+0x281/0x480 [ 270.268767][ T6530] do_syscall_64+0x4c/0xa0 [ 270.288021][ T6530] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 270.328601][ T6530] page last free stack trace: [ 270.350095][ T4231] usb 5-1: Using ep0 maxpacket: 32 [ 270.376716][ T6530] free_unref_page_prepare+0x637/0x6c0 [ 270.395352][ T6530] free_unref_page_list+0x119/0x830 [ 270.435608][ T6530] release_pages+0x185f/0x1bd0 [ 270.448546][ T6553] netlink: 4 bytes leftover after parsing attributes in process `syz.2.693'. [ 270.476872][ T6530] __pagevec_release+0x6d/0xe0 [ 270.490493][ T4231] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 270.552065][ T6530] shmem_undo_range+0x5cd/0x19a0 [ 270.580048][ T6530] shmem_evict_inode+0x1e2/0x9a0 [ 270.585131][ T6530] evict+0x4b6/0x8b0 [ 270.640080][ T6530] do_unlinkat+0x3e7/0x710 [ 270.646069][ T6530] __x64_sys_unlink+0x45/0x50 [ 270.825224][ T6530] do_syscall_64+0x4c/0xa0 [ 270.839514][ T6530] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 270.858617][ T6554] netlink: 44 bytes leftover after parsing attributes in process `syz.2.693'. [ 271.131790][ T6557] loop0: detected capacity change from 0 to 4096 [ 271.260298][ T4231] usb 5-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 271.304164][ T4231] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 271.354571][ T4231] usb 5-1: Product: syz [ 271.379012][ T4231] usb 5-1: Manufacturer: syz [ 272.211224][ T4231] usb 5-1: config 0 descriptor?? [ 272.356487][ T4231] usb 5-1: can't set config #0, error -71 [ 272.380210][ T1350] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 272.447093][ T6576] netlink: 'syz.3.699': attribute type 4 has an invalid length. [ 272.454847][ T6576] netlink: 4 bytes leftover after parsing attributes in process `syz.3.699'. [ 273.173648][ T4231] usb 5-1: USB disconnect, device number 21 [ 273.361374][ T6583] rnbd_client L599: Mapping device /dev/ram0 on session s1, (access_mode: rw, nr_poll_queues: 0) [ 273.396317][ T6583] rtrs_client L2062: : Failed to resolve address, err: -19 [ 273.408214][ T6583] rtrs_client L2614: : init_conns() failed: err=-19 path=@ip:127.0.0.1 [:0] [ 274.165731][ T1350] usb 2-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 274.205055][ T1350] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 274.223119][ T6594] netlink: 4 bytes leftover after parsing attributes in process `syz.4.706'. [ 274.288943][ T1350] usb 2-1: config 0 descriptor?? [ 274.730959][ T6594] netlink: 44 bytes leftover after parsing attributes in process `syz.4.706'. [ 274.760685][ T1350] usb 2-1: can't set config #0, error -71 [ 274.780160][ T7] usb 4-1: new low-speed USB device number 17 using dummy_hcd [ 274.825328][ T1350] usb 2-1: USB disconnect, device number 15 [ 275.051457][ T6601] dlm: no local IP address has been set [ 275.057148][ T6601] dlm: cannot start dlm midcomms -107 [ 275.340666][ T7] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 275.420245][ T1350] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 275.644908][ T7] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 275.700171][ T7] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 276.822656][ T7] usb 4-1: config 168 interface 0 altsetting 188 has an invalid endpoint with address 0xFF, skipping [ 276.890058][ T1350] usb 2-1: Using ep0 maxpacket: 32 [ 276.895379][ T7] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 276.932504][ T7] usb 4-1: config 168 interface 0 has no altsetting 0 [ 277.010227][ T1350] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 277.022510][ T7] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 277.032506][ T7] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 277.060531][ T6590] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 277.070369][ T7] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 277.070401][ T7] usb 4-1: config 168 interface 0 altsetting 188 has an invalid endpoint with address 0xFF, skipping [ 277.070420][ T7] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 277.070445][ T7] usb 4-1: config 168 interface 0 has no altsetting 0 [ 277.113766][ T6617] netlink: 'syz.0.713': attribute type 4 has an invalid length. [ 277.121461][ T6617] netlink: 4 bytes leftover after parsing attributes in process `syz.0.713'. [ 277.130329][ T7] usb 4-1: unable to read config index 2 descriptor/start: -71 [ 277.187848][ T6619] loop0: detected capacity change from 0 to 4096 [ 277.276515][ T7] usb 4-1: can't read configurations, error -71 [ 277.310250][ T1350] usb 2-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 277.319335][ T1350] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 277.327434][ T1350] usb 2-1: Product: syz [ 277.331851][ T1350] usb 2-1: Manufacturer: syz [ 277.336466][ T1350] usb 2-1: SerialNumber: syz [ 278.022195][ T1350] usb 2-1: config 0 descriptor?? [ 278.044610][ T6619] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 278.060413][ T1350] usb 2-1: can't set config #0, error -71 [ 278.066343][ T6619] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 278.090937][ T1350] usb 2-1: USB disconnect, device number 16 [ 278.099372][ T6619] loop0: [ 278.189369][ T6629] netlink: 4 bytes leftover after parsing attributes in process `syz.1.719'. [ 278.262545][ T6633] netlink: 16 bytes leftover after parsing attributes in process `syz.1.719'. [ 278.296543][ T6634] loop0: detected capacity change from 0 to 4096 [ 278.470477][ T4935] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 280.450303][ T4935] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 280.461142][ T4935] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 280.512642][ T4935] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 280.550275][ T4935] usb 1-1: config 0 descriptor?? [ 280.580972][ T6641] rdma_op ffff8880786699f0 conn xmit_rdma 0000000000000000 [ 280.602079][ T4935] pwc: Askey VC010 type 2 USB webcam detected. [ 280.889184][ T6659] dlm: no local IP address has been set [ 280.897222][ T6660] netlink: 'syz.4.728': attribute type 4 has an invalid length. [ 280.905032][ T6660] netlink: 4 bytes leftover after parsing attributes in process `syz.4.728'. [ 280.929461][ T6659] dlm: cannot start dlm midcomms -107 [ 281.220419][ T1350] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 281.469262][ T4935] pwc: recv_control_msg error -32 req 02 val 2b00 [ 281.610026][ T1350] usb 4-1: Using ep0 maxpacket: 32 [ 281.620153][ T4935] pwc: recv_control_msg error -32 req 02 val 2700 [ 281.790341][ T1350] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 281.980415][ T1350] usb 4-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 282.050207][ T4935] pwc: recv_control_msg error -32 req 02 val 2c00 [ 282.152560][ T4935] pwc: recv_control_msg error -32 req 04 val 1000 [ 282.459266][ T4935] pwc: recv_control_msg error -32 req 04 val 1300 [ 283.091531][ T4935] pwc: recv_control_msg error -32 req 04 val 1400 [ 283.172767][ T4935] pwc: recv_control_msg error -71 req 02 val 2000 [ 283.206656][ T4935] pwc: recv_control_msg error -71 req 02 val 2100 [ 283.214711][ T1350] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 283.223174][ T1350] usb 4-1: Product: syz [ 283.227368][ T1350] usb 4-1: Manufacturer: syz [ 283.235486][ T1350] usb 4-1: SerialNumber: syz [ 283.242614][ T1350] usb 4-1: config 0 descriptor?? [ 283.290373][ T4935] pwc: recv_control_msg error -71 req 04 val 1500 [ 283.316950][ T4935] pwc: recv_control_msg error -71 req 02 val 2500 [ 283.348018][ T6689] loop0: detected capacity change from 0 to 4096 [ 283.395725][ T4935] pwc: recv_control_msg error -71 req 02 val 2400 [ 283.440048][ T4935] pwc: recv_control_msg error -71 req 02 val 2600 [ 283.500917][ T6655] udc-core: couldn't find an available UDC or it's busy [ 283.507903][ T6655] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 283.523209][ T4935] pwc: recv_control_msg error -71 req 02 val 2900 [ 283.536292][ T4177] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 283.556905][ T4177] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 283.575661][ T4177] loop0: [ 283.580983][ T4935] pwc: recv_control_msg error -71 req 02 val 2800 [ 283.606583][ T6694] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 283.621831][ T4935] pwc: recv_control_msg error -71 req 04 val 1100 [ 283.635636][ T6694] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 283.657831][ T6694] loop0: [ 283.662542][ T4935] pwc: recv_control_msg error -71 req 04 val 1200 [ 283.734824][ T4935] pwc: Registered as video103. [ 283.767819][ T4935] input: PWC snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/input/input14 [ 283.842587][ T4935] usb 1-1: USB disconnect, device number 18 [ 283.901905][ T6704] rdma_op ffff8880611579f0 conn xmit_rdma 0000000000000000 [ 284.847682][ T4174] usb 4-1: USB disconnect, device number 19 [ 284.887448][ T6714] loop0: detected capacity change from 0 to 4096 [ 285.013852][ T6714] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 285.053285][ T6714] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 285.063863][ T6714] loop0: [ 285.440372][ T4174] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 285.870162][ T4174] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 285.900534][ T4174] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 285.934310][ T4174] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 286.007460][ T4174] usb 5-1: config 0 descriptor?? [ 286.093880][ T4174] pwc: Askey VC010 type 2 USB webcam detected. [ 286.140123][ T4229] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 286.390148][ T4229] usb 4-1: Using ep0 maxpacket: 16 [ 286.510254][ T4229] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xD has an invalid bInterval 0, changing to 7 [ 286.530095][ T4174] pwc: recv_control_msg error -32 req 02 val 2b00 [ 286.640178][ T4174] pwc: recv_control_msg error -32 req 02 val 2700 [ 286.725649][ T4174] pwc: recv_control_msg error -32 req 02 val 2c00 [ 286.760756][ T4229] usb 4-1: New USB device found, idVendor=4752, idProduct=0011, bcdDevice=32.4f [ 287.000045][ T4229] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 287.013411][ T4229] usb 4-1: Product: syz [ 287.017623][ T4229] usb 4-1: Manufacturer: syz [ 287.025933][ T4229] usb 4-1: SerialNumber: syz [ 287.050111][ T4174] pwc: recv_control_msg error -32 req 04 val 1000 [ 287.059287][ T4229] usb 4-1: config 0 descriptor?? [ 287.064788][ T4193] Bluetooth: hci3: link tx timeout [ 287.070021][ T4193] Bluetooth: hci3: killing stalled connection 10:aa:aa:aa:aa:aa [ 287.079326][ T4193] Bluetooth: hci3: link tx timeout [ 287.084524][ T4193] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 287.092232][ T4193] Bluetooth: hci3: link tx timeout [ 287.097353][ T4193] Bluetooth: hci3: killing stalled connection 10:aa:aa:aa:aa:aa [ 287.105239][ T4193] Bluetooth: hci3: link tx timeout [ 287.106045][ T4174] pwc: recv_control_msg error -32 req 04 val 1300 [ 287.110525][ T4193] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 287.125960][ T4193] Bluetooth: hci3: link tx timeout [ 287.131523][ T4193] Bluetooth: hci3: killing stalled connection 10:aa:aa:aa:aa:aa [ 287.139197][ T4193] Bluetooth: hci3: link tx timeout [ 287.144403][ T4193] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 287.172044][ T4193] Bluetooth: hci3: link tx timeout [ 287.177239][ T4193] Bluetooth: hci3: killing stalled connection 10:aa:aa:aa:aa:aa [ 287.185006][ T4193] Bluetooth: hci3: link tx timeout [ 287.190153][ T4193] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 287.197819][ T4193] Bluetooth: hci3: link tx timeout [ 287.200855][ T4229] hub 4-1:0.0: bad descriptor, ignoring hub [ 287.204163][ T4193] Bluetooth: hci3: killing stalled connection 10:aa:aa:aa:aa:aa [ 287.216534][ T4193] Bluetooth: hci3: link tx timeout [ 287.221719][ T4193] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 287.258254][ T4193] Bluetooth: hci3: link tx timeout [ 287.261718][ T4229] hub: probe of 4-1:0.0 failed with error -5 [ 287.263751][ T4193] Bluetooth: hci3: killing stalled connection 10:aa:aa:aa:aa:aa [ 287.277186][ T4193] Bluetooth: hci3: link tx timeout [ 287.282425][ T4193] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 287.290762][ T4193] Bluetooth: hci3: link tx timeout [ 287.295904][ T4193] Bluetooth: hci3: killing stalled connection 10:aa:aa:aa:aa:aa [ 287.300318][ T4174] pwc: recv_control_msg error -32 req 04 val 1400 [ 287.303647][ T4193] Bluetooth: hci3: link tx timeout [ 287.315199][ T4193] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 287.380232][ T4174] pwc: recv_control_msg error -32 req 02 val 2000 [ 287.452666][ T4174] pwc: recv_control_msg error -32 req 02 val 2100 [ 287.500357][ T4174] pwc: recv_control_msg error -32 req 04 val 1500 [ 287.540103][ T4174] pwc: recv_control_msg error -32 req 02 val 2500 [ 287.580173][ T4174] pwc: recv_control_msg error -32 req 02 val 2400 [ 287.630232][ T4174] pwc: recv_control_msg error -32 req 02 val 2600 [ 287.900102][ T4174] pwc: recv_control_msg error -71 req 02 val 2800 [ 287.933618][ T4174] pwc: recv_control_msg error -71 req 04 val 1100 [ 288.033155][ T4174] pwc: recv_control_msg error -71 req 04 val 1200 [ 288.075262][ T4174] pwc: Registered as video103. [ 288.095376][ T4174] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input15 [ 288.175245][ T4174] usb 5-1: USB disconnect, device number 22 [ 288.381858][ T6744] loop0: detected capacity change from 0 to 512 [ 288.510079][ T6744] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 288.549571][ T6746] netlink: 4 bytes leftover after parsing attributes in process `syz.3.754'. [ 289.071479][ T6748] netlink: 16 bytes leftover after parsing attributes in process `syz.3.754'. [ 289.185732][ T4379] Bluetooth: hci3: command 0x0406 tx timeout [ 289.316130][ T6754] dlm: no local IP address has been set [ 289.321858][ T6754] dlm: cannot start dlm midcomms -107 [ 289.635723][ T4379] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 289.980065][ T4379] usb 5-1: Using ep0 maxpacket: 32 [ 290.110767][ T4379] usb 5-1: config 0 has an invalid interface number: 85 but max is 0 [ 290.129304][ T4379] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 290.148478][ T6756] loop0: detected capacity change from 0 to 3904 [ 290.153224][ T4379] usb 5-1: config 0 has no interface number 0 [ 290.161608][ T4379] usb 5-1: config 0 interface 85 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 290.175337][ T4379] usb 5-1: config 0 interface 85 has no altsetting 0 [ 290.254860][ T6759] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 290.279137][ T6759] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 290.319649][ T6759] loop0: [ 290.390270][ T4379] usb 5-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 290.409032][ T4379] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 290.427923][ T6763] netlink: 8 bytes leftover after parsing attributes in process `syz.0.758'. [ 290.486913][ T4379] usb 5-1: Product: syz [ 290.499264][ T4379] usb 5-1: Manufacturer: syz [ 290.522327][ T4379] usb 5-1: SerialNumber: syz [ 290.550091][ T4379] usb 5-1: config 0 descriptor?? [ 290.621903][ T4379] usbhid 5-1:0.85: couldn't find an input interrupt endpoint [ 290.828944][ T6753] udc-core: couldn't find an available UDC or it's busy [ 290.836002][ T6753] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 291.907779][ T1107] usb 5-1: USB disconnect, device number 23 [ 292.566355][ T6795] loop1: detected capacity change from 0 to 1024 [ 292.616226][ T4229] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 294.360090][ T4229] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 294.473076][ T4229] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 294.482552][ T4229] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 294.492615][ T4229] usb 1-1: config 0 descriptor?? [ 294.508215][ T6794] hfsplus: invalid length 1280 has been corrected to 255 [ 294.531857][ T4229] pwc: Askey VC010 type 2 USB webcam detected. [ 294.688980][ T6808] loop0: detected capacity change from 0 to 4096 [ 294.735505][ T4177] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 294.769058][ T4177] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 294.801867][ T4177] loop0: [ 294.888907][ T1323] block nbd1: Attempted send on invalid socket [ 294.897764][ T1323] blk_update_request: I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 294.960153][ T4229] pwc: recv_control_msg error -32 req 02 val 2b00 [ 295.821062][ T6808] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 295.835844][ T4229] pwc: recv_control_msg error -32 req 02 val 2700 [ 295.856612][ T6808] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 295.891390][ T6808] loop0: [ 295.904210][ T4229] pwc: recv_control_msg error -32 req 02 val 2c00 [ 295.980168][ T4229] pwc: recv_control_msg error -32 req 04 val 1000 [ 296.020231][ T4229] pwc: recv_control_msg error -32 req 04 val 1300 [ 296.061522][ T4229] pwc: recv_control_msg error -32 req 04 val 1400 [ 296.253974][ T4229] pwc: recv_control_msg error -32 req 02 val 2000 [ 296.305170][ T6823] kAFS: Invalid Command on /proc/fs/afs/cells file [ 296.320214][ T4229] pwc: recv_control_msg error -32 req 02 val 2100 [ 296.350425][ T4628] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 296.370659][ T4229] pwc: recv_control_msg error -32 req 04 val 1500 [ 296.473878][ T4229] pwc: recv_control_msg error -32 req 02 val 2500 [ 296.720097][ T4229] pwc: recv_control_msg error -32 req 02 val 2400 [ 296.731641][ T4934] usb 4-1: USB disconnect, device number 20 [ 296.760448][ T4628] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 296.780420][ T4229] pwc: recv_control_msg error -32 req 02 val 2600 [ 296.798431][ T4628] usb 2-1: config 0 has no interface number 0 [ 297.140172][ T4229] pwc: recv_control_msg error -71 req 02 val 2800 [ 297.150399][ T4628] usb 2-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 297.180183][ T4628] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 297.189137][ T4628] usb 2-1: Product: syz [ 297.250409][ T4628] usb 2-1: Manufacturer: syz [ 297.255351][ T4628] usb 2-1: SerialNumber: syz [ 297.384217][ T4628] usb 2-1: config 0 descriptor?? [ 297.800208][ T4229] pwc: recv_control_msg error -71 req 04 val 1100 [ 297.878677][ T4628] usb 2-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 297.897232][ T4628] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 297.907993][ T4628] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 297.929179][ T4628] usb 2-1: media controller created [ 297.951642][ T4229] pwc: recv_control_msg error -71 req 04 val 1200 [ 298.893858][ T4628] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 298.961208][ T4229] pwc: Registered as video103. [ 298.966643][ T4229] input: PWC snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/input/input16 [ 298.970405][ T4628] i2c i2c-1: ec100: i2c rd failed=-71 reg=33 [ 299.009051][ T26] audit: type=1326 audit(1788223367.463:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6841 comm="syz.2.780" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b25cb8159 code=0x7ffc0000 [ 299.026745][ T4628] usb 2-1: USB disconnect, device number 17 [ 299.085636][ T6849] loop0: detected capacity change from 0 to 4096 [ 299.191143][ T4229] usb 1-1: USB disconnect, device number 19 [ 299.331534][ T4177] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 299.363732][ T4177] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 299.395173][ T4177] loop0: [ 299.413657][ T6852] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 299.459353][ T6852] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 299.898892][ T6852] loop0: [ 299.963072][ T6862] netlink: 4 bytes leftover after parsing attributes in process `syz.1.787'. [ 300.152925][ T6867] netlink: 4 bytes leftover after parsing attributes in process `syz.0.789'. [ 300.276570][ T6870] kAFS: Invalid Command on /proc/fs/afs/cells file [ 303.442297][ T6906] loop0: detected capacity change from 0 to 4096 [ 303.533135][ T6913] netlink: 4 bytes leftover after parsing attributes in process `syz.4.802'. [ 303.624165][ T4177] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 303.650031][ T4177] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 303.671511][ T4177] loop0: [ 303.690298][ T6906] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 303.699631][ T6906] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 303.727657][ T6906] loop0: [ 308.567574][ T6963] netlink: 4 bytes leftover after parsing attributes in process `syz.0.816'. [ 310.946580][ T6988] kAFS: Invalid Command on /proc/fs/afs/cells file [ 310.990146][ T4708] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 311.390498][ T4708] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 311.520335][ T4708] usb 1-1: config 0 has no interface number 0 [ 311.740346][ T4708] usb 1-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 311.756457][ T6996] 9pnet_virtio: no channels available for device syz [ 311.764971][ T4708] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 311.800064][ T4708] usb 1-1: Product: syz [ 311.819119][ T4708] usb 1-1: Manufacturer: syz [ 311.834885][ T4708] usb 1-1: SerialNumber: syz [ 311.965151][ T4708] usb 1-1: config 0 descriptor?? [ 313.410178][ T4708] dvb_usb_ec168: probe of 1-1:0.1 failed with error -110 [ 313.555720][ T7016] netlink: 4 bytes leftover after parsing attributes in process `syz.3.833'. [ 314.878052][ T4708] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 314.960060][ T4174] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 315.729066][ T4231] usb 1-1: USB disconnect, device number 20 [ 316.319649][ T4708] usb 2-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 316.389691][ T4708] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 316.410280][ T4174] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 316.438610][ T4708] usb 2-1: config 0 descriptor?? [ 316.443965][ T4174] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 316.454598][ T4174] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 316.465374][ T4174] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 316.486466][ T4174] usb 3-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 316.516207][ T4174] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 316.570279][ T7028] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 316.583770][ T7028] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 316.611690][ T4174] pl2303 3-1:1.0: required interrupt-in endpoint missing [ 316.714342][ T7025] IPVS: length: 31 != 24 [ 316.743392][ T7025] loop5: detected capacity change from 0 to 7 [ 316.787008][ T7054] Failed to get privilege flags for destination (handle=0x2:0x1) [ 316.831123][ T4174] usb 3-1: USB disconnect, device number 19 [ 316.910480][ T4708] [drm] vendor descriptor length:b9 data:00 00 00 00 00 00 00 00 00 00 00 [ 316.950029][ T4708] [drm:udl_init] *ERROR* Unrecognized vendor firmware descriptor [ 316.970238][ T4708] [drm:udl_init] *ERROR* Selecting channel failed [ 317.007745][ T7058] netlink: 'syz.0.846': attribute type 1 has an invalid length. [ 317.069178][ T7061] netlink: 8 bytes leftover after parsing attributes in process `syz.3.847'. [ 317.240326][ T1430] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.246668][ T1430] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.289654][ T4708] [drm] Initialized udl 0.0.1 20120220 for 2-1:0.0 on minor 2 [ 317.301862][ T4708] [drm] Initialized udl on minor 2 [ 317.303140][ T7058] netlink: 72 bytes leftover after parsing attributes in process `syz.0.846'. [ 317.330106][ T4708] [drm:udl_get_edid_block] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 317.380161][ T4708] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 317.386241][ T7066] netlink: 8 bytes leftover after parsing attributes in process `syz.3.848'. [ 317.425498][ T4708] usb 2-1: USB disconnect, device number 18 [ 317.452446][ T4174] [drm:udl_get_edid_block] *ERROR* Read EDID byte 0 failed err ffffffed [ 317.464650][ T4174] [drm:udl_get_edid_block] *ERROR* Read EDID byte 0 failed err ffffffed [ 317.473681][ T4174] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 318.341301][ T7089] netlink: 'syz.0.851': attribute type 4 has an invalid length. [ 318.348995][ T7089] netlink: 4 bytes leftover after parsing attributes in process `syz.0.851'. [ 320.270209][ T4708] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 320.330033][ T4231] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 320.691322][ T4231] usb 4-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 320.710383][ T4708] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 320.732058][ T4708] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 320.732459][ T4231] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 320.755819][ T4708] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 320.783216][ T4708] usb 5-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 320.801026][ T4231] usb 4-1: config 0 descriptor?? [ 320.838526][ T4708] usb 5-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 320.850174][ T4708] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 320.897254][ T7103] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 320.919616][ T7103] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 321.015859][ T4708] pl2303 5-1:1.0: required interrupt-in endpoint missing [ 321.042893][ T7107] IPVS: length: 31 != 24 [ 321.061178][ T7107] loop5: detected capacity change from 0 to 7 [ 321.160529][ T4231] [drm] vendor descriptor length:b9 data:00 00 00 00 00 00 00 00 00 00 00 [ 321.181898][ T4231] [drm:udl_init] *ERROR* Unrecognized vendor firmware descriptor [ 321.200042][ T4935] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 321.207899][ T4933] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 321.220155][ T4231] [drm:udl_init] *ERROR* Selecting channel failed [ 321.239123][ T4231] [drm] Initialized udl 0.0.1 20120220 for 4-1:0.0 on minor 2 [ 321.256037][ T4708] usb 5-1: USB disconnect, device number 24 [ 321.257068][ T4231] [drm] Initialized udl on minor 2 [ 321.290168][ T4231] [drm:udl_get_edid_block] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 321.306558][ T4231] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 321.333934][ T4231] usb 4-1: USB disconnect, device number 21 [ 321.364131][ T1107] [drm:udl_get_edid_block] *ERROR* Read EDID byte 0 failed err ffffffed [ 321.377066][ T1107] [drm:udl_get_edid_block] *ERROR* Read EDID byte 0 failed err ffffffed [ 321.390966][ T1107] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 321.470105][ T4935] usb 3-1: Using ep0 maxpacket: 16 [ 321.591823][ T4935] usb 3-1: too many endpoints for config 0 interface 0 altsetting 3: 255, using maximum allowed: 30 [ 321.591921][ T4933] usb 1-1: config 0 interface 0 altsetting 255 has an invalid endpoint with address 0xFF, skipping [ 321.614394][ T4933] usb 1-1: config 0 interface 0 has no altsetting 0 [ 321.621606][ T4935] usb 3-1: config 0 interface 0 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 321.650279][ T4935] usb 3-1: config 0 interface 0 has no altsetting 0 [ 321.657136][ T4935] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.00 [ 321.677238][ T4935] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 321.707951][ T4935] usb 3-1: config 0 descriptor?? [ 321.820309][ T4933] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 321.835678][ T4933] usb 1-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 321.849533][ T4933] usb 1-1: Product: syz [ 321.854801][ T4933] usb 1-1: Manufacturer: syz [ 321.859453][ T4933] usb 1-1: SerialNumber: syz [ 321.885602][ T4933] usb 1-1: config 0 descriptor?? [ 321.899454][ T7126] netlink: 8 bytes leftover after parsing attributes in process `syz.3.865'. [ 321.967426][ T4933] snd-usb-audio: probe of 1-1:0.0 failed with error -22 [ 322.047274][ T4371] udevd[4371]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 322.158831][ T4231] usb 1-1: USB disconnect, device number 21 [ 322.177605][ T26] audit: type=1800 audit(1788223390.633:18): pid=7111 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.857" name="zoned" dev="configfs" ino=63345 res=0 errno=0 [ 322.218585][ T7111] udc-core: couldn't find an available UDC or it's busy [ 322.229843][ T7111] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 322.279315][ T26] audit: type=1800 audit(1788223390.663:19): pid=7111 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.857" name="zone_nr_conv" dev="configfs" ino=63346 res=0 errno=0 [ 322.332974][ T26] audit: type=1800 audit(1788223390.663:20): pid=7111 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.857" name="power" dev="configfs" ino=63347 res=0 errno=0 [ 323.050018][ T4935] usbhid 3-1:0.0: can't add hid device: -71 [ 323.056607][ T4935] usbhid: probe of 3-1:0.0 failed with error -71 [ 323.082729][ T4935] usb 3-1: USB disconnect, device number 20 [ 323.131989][ T7152] FAULT_INJECTION: forcing a failure. [ 323.131989][ T7152] name failslab, interval 1, probability 0, space 0, times 0 [ 323.295728][ T7152] CPU: 0 PID: 7152 Comm: syz.4.874 Not tainted syzkaller #0 [ 323.303071][ T7152] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 323.313154][ T7152] Call Trace: [ 323.316458][ T7152] [ 323.319403][ T7152] dump_stack_lvl+0x188/0x250 [ 323.324108][ T7152] ? show_regs_print_info+0x20/0x20 [ 323.329334][ T7152] ? load_image+0x410/0x410 [ 323.333857][ T7152] ? __might_sleep+0xf0/0xf0 [ 323.338463][ T7152] ? __lock_acquire+0x7b50/0x7b50 [ 323.343509][ T7152] should_fail+0x383/0x4b0 [ 323.347953][ T7152] should_failslab+0x5/0x20 [ 323.352475][ T7152] slab_pre_alloc_hook+0x51/0xc0 [ 323.357431][ T7152] ? vm_area_dup+0x1e/0xb0 [ 323.361868][ T7152] kmem_cache_alloc+0x3d/0x280 [ 323.366650][ T7152] vm_area_dup+0x1e/0xb0 [ 323.370907][ T7152] __split_vma+0xb1/0x410 [ 323.375250][ T7152] ? find_vma+0x1df/0x230 [ 323.379601][ T7152] __do_munmap+0x40b/0xe10 [ 323.384052][ T7152] __vm_munmap+0x13f/0x240 [ 323.388489][ T7152] ? vm_munmap+0x20/0x20 [ 323.392747][ T7152] ? blocking_notifier_call_chain+0x16a/0x1b0 [ 323.398838][ T7152] __x64_sys_munmap+0x67/0x70 [ 323.403535][ T7152] do_syscall_64+0x4c/0xa0 [ 323.407979][ T7152] ? clear_bhb_loop+0x30/0x80 [ 323.412685][ T7152] ? clear_bhb_loop+0x30/0x80 [ 323.417386][ T7152] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 323.423320][ T7152] RIP: 0033:0x7f10c9059f87 [ 323.427751][ T7152] Code: 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 0b 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 323.447457][ T7152] RSP: 002b:00007f10c72b0d18 EFLAGS: 00000206 ORIG_RAX: 000000000000000b [ 323.455906][ T7152] RAX: ffffffffffffffda RBX: 00007f10c0000000 RCX: 00007f10c9059f87 [ 323.463979][ T7152] RDX: 0000000000000000 RSI: 0000000003292000 RDI: 00007f10c4000000 [ 323.471951][ T7152] RBP: 0000000000021000 R08: 00000000ffffffff R09: 0000000000000000 [ 323.479922][ T7152] R10: 0000000000000022 R11: 0000000000000206 R12: 0000000004000000 [ 323.487919][ T7152] R13: 0000000000001000 R14: 00007f10c4000000 R15: 0000000000d6e000 [ 323.495901][ T7152] [ 323.595808][ T7165] binder: 7164:7165 unknown command 0 [ 323.615211][ T7165] binder: 7164:7165 ioctl c0306201 2000000001c0 returned -22 [ 323.653249][ T7166] netlink: 'syz.1.873': attribute type 4 has an invalid length. [ 323.661493][ T7166] netlink: 4 bytes leftover after parsing attributes in process `syz.1.873'. [ 323.940849][ T4933] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 324.090504][ T4935] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 324.350485][ T4935] usb 3-1: Using ep0 maxpacket: 16 [ 324.350641][ T4933] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 324.366711][ T4933] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 324.404983][ T4933] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 324.480075][ T4933] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 324.580558][ T4935] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 324.594264][ T4933] usb 4-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 324.633504][ T4935] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 324.684989][ T4933] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 324.735023][ T4935] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 324.851520][ T7156] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 324.889564][ T7156] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 324.901747][ T4935] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 324.986648][ T4935] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 325.018723][ T4933] pl2303 4-1:1.0: required interrupt-in endpoint missing [ 325.113522][ T4935] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 325.143004][ T4935] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 325.168599][ T4935] usb 3-1: config 0 descriptor?? [ 325.266537][ T4933] usb 4-1: USB disconnect, device number 22 [ 325.350273][ T4935] rc_core: IR keymap rc-hauppauge not found [ 325.356279][ T4935] Registered IR keymap rc-empty [ 325.376768][ T4935] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 325.430155][ T4935] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 325.496216][ T4935] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 325.618109][ T4935] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input17 [ 325.714423][ T4935] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 325.780079][ T4935] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 325.822410][ T4935] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 325.874930][ T4935] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 325.930056][ T4935] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 325.970224][ T4935] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 326.020843][ T4935] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 326.650064][ T4935] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 326.680143][ T4935] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 326.743606][ T4935] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 326.801533][ T4935] mceusb 3-1:0.0: Registered with mce emulator interface version 1 [ 326.809573][ T4935] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 327.339081][ T4935] usb 3-1: USB disconnect, device number 21 [ 328.480284][ T4933] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 329.194179][ T7224] netlink: 'syz.3.890': attribute type 4 has an invalid length. [ 329.201976][ T7224] netlink: 4 bytes leftover after parsing attributes in process `syz.3.890'. [ 329.220078][ T4935] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 329.430186][ T4933] usb 1-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 329.469885][ T4933] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 329.505683][ T4933] usb 1-1: config 0 descriptor?? [ 329.767273][ T7214] IPVS: length: 31 != 24 [ 329.775717][ T4935] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 329.854179][ T7214] loop5: detected capacity change from 0 to 7 [ 329.876376][ T4935] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 329.914927][ T4935] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 329.970463][ T4935] usb 3-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 330.375731][ T4935] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 330.515057][ T7216] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 330.565763][ T7216] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 330.676272][ T4935] pl2303 3-1:1.0: required interrupt-in endpoint missing [ 330.701145][ T4933] [drm] vendor descriptor length:b9 data:00 00 00 00 00 00 00 00 00 00 00 [ 330.709702][ T4933] [drm:udl_init] *ERROR* Unrecognized vendor firmware descriptor [ 330.780179][ T4933] [drm:udl_init] *ERROR* Selecting channel failed [ 330.795591][ T4933] [drm] Initialized udl 0.0.1 20120220 for 1-1:0.0 on minor 2 [ 330.844485][ T4231] usb 3-1: USB disconnect, device number 22 [ 330.870316][ T4933] [drm] Initialized udl on minor 2 [ 330.900114][ T4933] [drm:udl_get_edid_block] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 330.926583][ T4933] udl 1-1:0.0: [drm] Cannot find any crtc or sizes [ 330.977024][ T4933] usb 1-1: USB disconnect, device number 22 [ 331.000310][ T4935] [drm:udl_get_edid_block] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 331.018361][ T4935] [drm:udl_get_edid_block] *ERROR* Read EDID byte 0 failed err ffffffed [ 331.048477][ T4935] udl 1-1:0.0: [drm] Cannot find any crtc or sizes [ 332.403912][ T7258] IPv6: ADDRCONF(NETDEV_CHANGE): eql: link becomes ready [ 333.019731][ T7258] IPv6: ADDRCONF(NETDEV_CHANGE): wpan0: link becomes ready [ 333.050274][ T7258] IPv6: ADDRCONF(NETDEV_CHANGE): wpan1: link becomes ready [ 333.063418][ T7258] A link change request failed with some changes committed already. Interface teql0 may have been left with an inconsistent configuration, please check. [ 334.117408][ T7276] tipc: Started in network mode [ 334.130089][ T7276] tipc: Node identity 1000001, cluster identity 4369 [ 334.145046][ T7276] tipc: Node number set to 16777217 [ 334.155396][ T7276] tipc: Cannot configure node identity twice [ 334.168507][ T7276] tipc: New replicast peer: 127.0.0.1 [ 334.213653][ T7276] tipc: Enabled bearer , priority 10 [ 334.352115][ T1107] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 334.810145][ T4933] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 335.181043][ T4933] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 335.228065][ T4933] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 335.255067][ T4933] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 335.320163][ T4933] usb 3-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 335.337064][ T4933] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 335.366231][ T7287] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 335.373797][ T7287] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 335.401507][ T4933] pl2303 3-1:1.0: required interrupt-in endpoint missing [ 335.480136][ T1107] usb 4-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 335.489236][ T1107] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 335.631408][ T26] audit: type=1800 audit(1788223404.083:21): pid=7292 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.921" name="memory_backed" dev="configfs" ino=70746 res=0 errno=0 [ 336.178268][ T1107] usb 4-1: config 0 descriptor?? [ 336.190840][ T4379] usb 3-1: USB disconnect, device number 23 [ 337.012953][ T7273] IPVS: length: 31 != 24 [ 337.029196][ T7273] loop5: detected capacity change from 0 to 7 [ 337.200169][ T1107] [drm] vendor descriptor length:b9 data:00 00 00 00 00 00 00 00 00 00 00 [ 337.209409][ T1107] [drm:udl_init] *ERROR* Unrecognized vendor firmware descriptor [ 337.250049][ T1107] [drm:udl_init] *ERROR* Selecting channel failed [ 337.261299][ T1107] [drm] Initialized udl 0.0.1 20120220 for 4-1:0.0 on minor 2 [ 337.297564][ T1107] [drm] Initialized udl on minor 2 [ 337.353706][ T1107] [drm:udl_get_edid_block] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 337.404381][ T1107] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 337.434818][ T1107] usb 4-1: USB disconnect, device number 23 [ 337.475707][ T4379] [drm:udl_get_edid_block] *ERROR* Read EDID byte 0 failed err ffffffed [ 337.518471][ T4379] [drm:udl_get_edid_block] *ERROR* Read EDID byte 0 failed err ffffffed [ 337.540626][ T4379] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 337.555057][ T7311] loop0: detected capacity change from 0 to 4096 [ 337.711290][ T7315] netlink: 'syz.0.911': attribute type 4 has an invalid length. [ 337.719465][ T7315] netlink: 4 bytes leftover after parsing attributes in process `syz.0.911'. [ 338.937224][ T7323] binder: 7322:7323 ioctl 4018620d 0 returned -22 [ 338.944945][ T7313] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 338.965876][ T7313] ldm_parse_privhead(): PRIVHEAD contains an invalid GUID. [ 338.974617][ T7313] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 338.985759][ T7313] loop0: [ 339.439383][ T7331] device syzkaller0 entered promiscuous mode [ 339.780011][ T4933] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 340.080071][ T4229] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 340.155414][ T4933] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 340.176516][ T4933] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 340.200552][ T4933] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 340.219852][ T4933] usb 3-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 340.229386][ T4933] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 340.270296][ T7346] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 340.286595][ T7346] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 340.311219][ T4933] pl2303 3-1:1.0: required interrupt-in endpoint missing [ 340.420178][ T7377] loop0: detected capacity change from 0 to 4096 [ 340.450384][ T4229] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 340.461329][ T4229] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 340.499207][ T4229] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 340.520549][ T4379] usb 3-1: USB disconnect, device number 24 [ 340.523495][ T7377] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 340.526801][ T7379] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 340.543724][ T4229] usb 2-1: config 0 descriptor?? [ 340.564748][ T7377] ldm_parse_privhead(): PRIVHEAD contains an invalid GUID. [ 340.575324][ T7377] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 340.582679][ T7377] loop0: [ 340.640556][ T7382] binder: 7380:7382 ioctl 4018620d 0 returned -22 [ 340.646564][ T4229] pwc: Askey VC010 type 2 USB webcam detected. [ 341.270335][ T4229] pwc: recv_control_msg error -32 req 02 val 2b00 [ 341.331561][ T4229] pwc: recv_control_msg error -32 req 02 val 2700 [ 341.520963][ T4229] pwc: recv_control_msg error -32 req 02 val 2c00 [ 341.570155][ T4229] pwc: recv_control_msg error -32 req 04 val 1000 [ 341.723102][ T4229] pwc: recv_control_msg error -32 req 04 val 1300 [ 341.775562][ T4229] pwc: recv_control_msg error -32 req 04 val 1400 [ 342.502407][ T4229] pwc: recv_control_msg error -32 req 02 val 2000 [ 342.521579][ T7421] loop0: detected capacity change from 0 to 4096 [ 342.540612][ T4229] pwc: recv_control_msg error -32 req 02 val 2100 [ 342.580198][ T4229] pwc: recv_control_msg error -32 req 04 val 1500 [ 342.594450][ T7421] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 342.620059][ T4229] pwc: recv_control_msg error -32 req 02 val 2500 [ 342.670114][ T4229] pwc: recv_control_msg error -32 req 02 val 2400 [ 342.677319][ T7421] ldm_parse_privhead(): PRIVHEAD contains an invalid GUID. [ 342.685521][ T7426] binder: 7425:7426 ioctl 4018620d 0 returned -22 [ 342.704014][ T7421] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 342.727251][ T7421] loop0: [ 342.740193][ T4229] pwc: recv_control_msg error -32 req 02 val 2600 [ 343.209362][ T4229] pwc: recv_control_msg error -71 req 02 val 2800 [ 343.230403][ T4229] pwc: recv_control_msg error -71 req 04 val 1100 [ 343.250188][ T4229] pwc: recv_control_msg error -71 req 04 val 1200 [ 343.260004][ T4379] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 343.261799][ T4229] pwc: Registered as video103. [ 343.275390][ T4229] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input18 [ 343.313466][ T4229] usb 2-1: USB disconnect, device number 19 [ 343.458557][ T7452] device syzkaller0 entered promiscuous mode [ 343.691393][ T4379] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 343.850668][ T4379] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 344.060629][ T4379] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 344.231583][ T4379] usb 5-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 344.247103][ T7461] loop0: detected capacity change from 0 to 4096 [ 344.300768][ T7463] binder: 7462:7463 ioctl 4018620d 0 returned -22 [ 344.315474][ T4379] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 344.416564][ T7461] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 344.443206][ T7433] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 344.450110][ T7461] ldm_parse_privhead(): PRIVHEAD contains an invalid GUID. [ 344.459341][ T7461] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 344.469746][ T7461] loop0: [ 344.489949][ T7433] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 344.531585][ T4379] pl2303 5-1:1.0: required interrupt-in endpoint missing [ 344.617136][ T7479] loop0: detected capacity change from 0 to 4096 [ 344.630340][ C0] tipc: RX(1000001): key[1] is activated [ 344.673149][ T4177] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 344.694163][ T4177] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 344.702178][ T4177] loop0: [ 344.709519][ T7479] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 344.737159][ T4628] usb 5-1: USB disconnect, device number 25 [ 344.746211][ T7479] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 344.755230][ T7479] loop0: [ 348.391879][ T7522] binder: 7521:7522 ioctl 4018620d 0 returned -22 [ 349.033133][ T7544] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 349.270653][ T4231] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 349.398173][ T7556] kAFS: Invalid Command on /proc/fs/afs/cells file [ 350.124315][ T7564] xt_hashlimit: size too large, truncated to 1048576 [ 350.147435][ T7567] binder: 7563:7567 ioctl 4018620d 0 returned -22 [ 350.286591][ T7571] IPVS: sh: FWM 3 0x00000003 - no destination available [ 350.350133][ T4231] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 350.975538][ T4231] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 350.986595][ T4231] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 350.997436][ T4231] usb 2-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 351.008105][ T4231] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 351.030583][ T7535] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 351.068353][ T7570] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1006'. [ 351.114976][ T7535] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 351.151595][ T4231] pl2303 2-1:1.0: required interrupt-in endpoint missing [ 352.039652][ T7586] loop0: detected capacity change from 0 to 4096 [ 352.820174][ T7586] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 352.832688][ T7586] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 352.840403][ T7586] loop0: [ 352.855771][ T4379] usb 2-1: USB disconnect, device number 20 [ 352.990422][ T7592] IPVS: sh: FWM 3 0x00000003 - no destination available [ 353.434537][ T7597] kAFS: Invalid Command on /proc/fs/afs/cells file [ 354.169851][ T4193] ================================================================== [ 354.179238][ T4193] BUG: KASAN: slab-out-of-bounds in hci_le_meta_evt+0x12cf/0x3ca0 [ 354.187982][ T4193] Read of size 1 at addr ffff888078923c0a by task kworker/u5:2/4193 [ 354.196761][ T4193] [ 354.199326][ T4193] CPU: 0 PID: 4193 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 354.207629][ T4193] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 354.218696][ T4193] Workqueue: hci4 hci_rx_work [ 354.223868][ T4193] Call Trace: [ 354.227481][ T4193] [ 354.230706][ T4193] dump_stack_lvl+0x188/0x250 [ 354.235908][ T4193] ? show_regs_print_info+0x20/0x20 [ 354.241651][ T4193] ? load_image+0x410/0x410 [ 354.246599][ T4193] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 354.252668][ T4193] print_address_description+0x60/0x2d0 [ 354.258753][ T4193] ? hci_le_meta_evt+0x12cf/0x3ca0 [ 354.264359][ T4193] kasan_report+0xdf/0x130 [ 354.269276][ T4193] ? hci_le_meta_evt+0x12cf/0x3ca0 [ 354.274888][ T4193] hci_le_meta_evt+0x12cf/0x3ca0 [ 354.280305][ T4193] ? hci_event_packet+0x363/0x1310 [ 354.285915][ T4193] ? __lock_acquire+0x7b50/0x7b50 [ 354.291459][ T4193] ? hci_remote_host_features_evt+0x240/0x240 [ 354.298113][ T4193] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 354.304371][ T4193] ? mark_lock+0x94/0x320 [ 354.309116][ T4193] ? mutex_unlock+0x10/0x10 [ 354.314061][ T4193] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 354.320638][ T4193] ? lock_chain_count+0x20/0x20 [ 354.325957][ T4193] ? __rwlock_init+0x140/0x140 [ 354.331268][ T4193] hci_event_packet+0xe0b/0x1310 [ 354.336705][ T4193] ? _raw_spin_unlock+0x40/0x40 [ 354.342036][ T4193] ? rcu_lock_release+0x20/0x20 [ 354.347373][ T4193] ? hci_send_to_monitor+0x9c/0x4a0 [ 354.353135][ T4193] hci_rx_work+0x255/0xa10 [ 354.357984][ T4193] process_one_work+0x867/0xff0 [ 354.363419][ T4193] ? worker_detach_from_pool+0x240/0x240 [ 354.369601][ T4193] ? lockdep_hardirqs_off+0x70/0x100 [ 354.375432][ T4193] ? _raw_spin_lock_irq+0xb7/0xf0 [ 354.380953][ T4193] ? _raw_spin_lock_irqsave+0x100/0x100 [ 354.387045][ T4193] ? wq_worker_running+0x97/0x170 [ 354.392563][ T4193] worker_thread+0xad7/0x12a0 [ 354.397725][ T4193] kthread+0x42e/0x520 [ 354.402179][ T4193] ? rcu_lock_release+0x20/0x20 [ 354.407506][ T4193] ? kthread_blkcg+0xd0/0xd0 [ 354.412553][ T4193] ret_from_fork+0x1f/0x30 [ 354.417425][ T4193] [ 354.420726][ T4193] [ 354.423259][ T4193] Allocated by task 7601: [ 354.427989][ T4193] __kasan_kmalloc+0xaf/0xe0 [ 354.433034][ T4193] __alloc_skb+0x22c/0x750 [ 354.437949][ T4193] vhci_write+0xbd/0x440 [ 354.442670][ T4193] vfs_write+0x748/0xd70 [ 354.447383][ T4193] ksys_write+0x153/0x260 [ 354.452118][ T4193] do_syscall_64+0x4c/0xa0 [ 354.456972][ T4193] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 354.463427][ T4193] [ 354.465957][ T4193] The buggy address belongs to the object at ffff888078923800 [ 354.465957][ T4193] which belongs to the cache kmalloc-1k of size 1024 [ 354.481388][ T4193] The buggy address is located 10 bytes to the right of [ 354.481388][ T4193] 1024-byte region [ffff888078923800, ffff888078923c00) [ 354.496538][ T4193] The buggy address belongs to the page: [ 354.502712][ T4193] page:ffffea0001e24800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78920 [ 354.513856][ T4193] head:ffffea0001e24800 order:3 compound_mapcount:0 compound_pincount:0 [ 354.522992][ T4193] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 354.531755][ T4193] raw: 00fff00000010200 0000000000000000 0000000f00000001 ffff888016c41dc0 [ 354.541189][ T4193] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 354.550614][ T4193] page dumped because: kasan: bad access detected [ 354.557636][ T4193] page_owner tracks the page as allocated [ 354.563896][ T4193] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 4238, ts 66771644516, free_ts 66698417579 [ 354.585749][ T4193] get_page_from_freelist+0x24f6/0x2670 [ 354.591919][ T4193] __alloc_pages+0x1ee/0x480 [ 354.596984][ T4193] new_slab+0xc0/0x4b0 [ 354.601433][ T4193] ___slab_alloc+0x807/0xdd0 [ 354.606458][ T4193] __kmalloc_node_track_caller+0x13d/0x3a0 [ 354.612821][ T4193] __alloc_skb+0x22c/0x750 [ 354.617687][ T4193] inet6_rt_notify+0xe0/0x290 [ 354.622925][ T4193] fib6_add+0x1e9a/0x3ee0 [ 354.627662][ T4193] ip6_ins_rt+0xd3/0x130 [ 354.632305][ T4193] __ipv6_ifa_notify+0x4e4/0xe60 [ 354.637705][ T4193] addrconf_dad_completed+0x186/0xc80 [ 354.643585][ T4193] addrconf_dad_work+0xc83/0x1530 [ 354.649085][ T4193] process_one_work+0x867/0xff0 [ 354.654393][ T4193] worker_thread+0xad7/0x12a0 [ 354.659508][ T4193] kthread+0x42e/0x520 [ 354.663952][ T4193] ret_from_fork+0x1f/0x30 [ 354.668786][ T4193] page last free stack trace: [ 354.673893][ T4193] free_unref_page_prepare+0x637/0x6c0 [ 354.679888][ T4193] free_unref_page+0x8f/0x2a0 [ 354.685015][ T4193] __unfreeze_partials+0x188/0x1e0 [ 354.690610][ T4193] put_cpu_partial+0x12d/0x190 [ 354.695835][ T4193] qlist_free_all+0x35/0x90 [ 354.700826][ T4193] kasan_quarantine_reduce+0x150/0x160 [ 354.706800][ T4193] __kasan_slab_alloc+0x2f/0xc0 [ 354.712110][ T4193] slab_post_alloc_hook+0x4c/0x380 [ 354.717721][ T4193] kmem_cache_alloc_node+0x184/0x2c0 [ 354.723515][ T4193] __alloc_skb+0xf4/0x750 [ 354.728250][ T4193] alloc_skb_with_frags+0xa7/0x720 [ 354.733839][ T4193] sock_alloc_send_pskb+0x87f/0x9a0 [ 354.739528][ T4193] unix_dgram_sendmsg+0x6f8/0x19c0 [ 354.745198][ T4193] __sys_sendto+0x46d/0x620 [ 354.750122][ T4193] __x64_sys_sendto+0xda/0xf0 [ 354.755247][ T4193] do_syscall_64+0x4c/0xa0 [ 354.760106][ T4193] [ 354.762642][ T4193] Memory state around the buggy address: [ 354.768832][ T4193] ffff888078923b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 354.777677][ T4193] ffff888078923b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 354.786525][ T4193] >ffff888078923c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 354.795361][ T4193] ^ [ 354.800092][ T4193] ffff888078923c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 354.808927][ T4193] ffff888078923d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 354.817769][ T4193] ================================================================== [ 354.826611][ T4193] Disabling lock debugging due to kernel taint [ 354.834072][ T4193] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 354.841983][ T4193] CPU: 0 PID: 4193 Comm: kworker/u5:2 Tainted: G B syzkaller #0 [ 354.851778][ T4193] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 354.862814][ T4193] Workqueue: hci4 hci_rx_work [ 354.867943][ T4193] Call Trace: [ 354.871526][ T4193] [ 354.874726][ T4193] dump_stack_lvl+0x188/0x250 [ 354.879844][ T4193] ? show_regs_print_info+0x20/0x20 [ 354.885532][ T4193] ? load_image+0x410/0x410 [ 354.890459][ T4193] panic+0x2f8/0x850 [ 354.894714][ T4193] ? bpf_jit_dump+0xd0/0xd0 [ 354.899636][ T4193] ? _raw_spin_unlock_irqrestore+0x10d/0x120 [ 354.906198][ T4193] ? _raw_spin_unlock+0x40/0x40 [ 354.911504][ T4193] ? hci_le_meta_evt+0x12cf/0x3ca0 [ 354.917103][ T4193] check_panic_on_warn+0x80/0xa0 [ 354.922594][ T4193] ? hci_le_meta_evt+0x12cf/0x3ca0 [ 354.928189][ T4193] end_report+0x6d/0xf0 [ 354.932731][ T4193] kasan_report+0x102/0x130 [ 354.937659][ T4193] ? hci_le_meta_evt+0x12cf/0x3ca0 [ 354.943350][ T4193] hci_le_meta_evt+0x12cf/0x3ca0 [ 354.948759][ T4193] ? hci_event_packet+0x363/0x1310 [ 354.954353][ T4193] ? __lock_acquire+0x7b50/0x7b50 [ 354.959875][ T4193] ? hci_remote_host_features_evt+0x240/0x240 [ 354.966531][ T4193] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 354.972714][ T4193] ? mark_lock+0x94/0x320 [ 354.977448][ T4193] ? mutex_unlock+0x10/0x10 [ 354.982377][ T4193] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 354.989021][ T4193] ? lock_chain_count+0x20/0x20 [ 354.994356][ T4193] ? __rwlock_init+0x140/0x140 [ 354.999578][ T4193] hci_event_packet+0xe0b/0x1310 [ 355.005018][ T4193] ? _raw_spin_unlock+0x40/0x40 [ 355.010330][ T4193] ? rcu_lock_release+0x20/0x20 [ 355.015664][ T4193] ? hci_send_to_monitor+0x9c/0x4a0 [ 355.021369][ T4193] hci_rx_work+0x255/0xa10 [ 355.026225][ T4193] process_one_work+0x867/0xff0 [ 355.031568][ T4193] ? worker_detach_from_pool+0x240/0x240 [ 355.037746][ T4193] ? lockdep_hardirqs_off+0x70/0x100 [ 355.043562][ T4193] ? _raw_spin_lock_irq+0xb7/0xf0 [ 355.049071][ T4193] ? _raw_spin_lock_irqsave+0x100/0x100 [ 355.055147][ T4193] ? wq_worker_running+0x97/0x170 [ 355.060648][ T4193] worker_thread+0xad7/0x12a0 [ 355.065969][ T4193] kthread+0x42e/0x520 [ 355.070435][ T4193] ? rcu_lock_release+0x20/0x20 [ 355.075767][ T4193] ? kthread_blkcg+0xd0/0xd0 [ 355.080791][ T4193] ret_from_fork+0x1f/0x30 [ 355.085622][ T4193] [ 355.089214][ T4193] Kernel Offset: disabled [ 355.093966][ T4193] Rebooting in 86400 seconds..