last executing test programs: 5m31.522631675s ago: executing program 2 (id=3269): openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000000)={0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0100000000000000560000000000000066ba2100b066eeb9e00a00000f"], 0x56}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000380)={0x2, 0x102000, 0x1}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000002340)={0x0, 0x0, @pic={0x7, 0x10, 0x4, 0x81, 0x0, 0xb, 0x7, 0x9, 0x5d, 0x1, 0x8, 0x40, 0x31, 0x0, 0x5, 0x4b}}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f00000000c0)={0x3}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 5m30.931721441s ago: executing program 2 (id=3270): fanotify_init(0x200, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0}) io_uring_enter(0xffffffffffffffff, 0x3516, 0x0, 0x0, 0x0, 0x0) 5m29.735830253s ago: executing program 2 (id=3273): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'xfrm0\x00', 0x0}) sendto$packet(r0, &(0x7f0000000080)="4d01000000000000000100e50414090b0092000000000000005ee4cc040c1e5fcc2eae7fc0dacea9ed192143db2c8381a3e349d8", 0x43, 0x81, &(0x7f0000000340)={0x11, 0x0, r1, 0x1, 0xe, 0x6, @random="645bcc77540e"}, 0x14) sendmsg$ETHTOOL_MSG_WOL_GET(0xffffffffffffffff, 0x0, 0x20008804) 5m29.484033626s ago: executing program 2 (id=3276): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$tmpfs(0x0, &(0x7f0000000280)='./file0/../file0/file0\x00', &(0x7f0000000240), 0x18008, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x104000, 0x0) 5m29.228193465s ago: executing program 2 (id=3279): setsockopt$WPAN_WANTLQI(0xffffffffffffffff, 0x0, 0x3, &(0x7f0000000000)=0x1, 0x4) recvmmsg(0xffffffffffffffff, &(0x7f0000007900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=""/7, 0x7}, 0x9}], 0x1, 0x40000102, 0x0) 5m28.753485344s ago: executing program 2 (id=3281): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) getsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x1, 0x0, &(0x7f0000000300)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0/file0\x00'}, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$IP6T_SO_GET_INFO(r2, 0x29, 0x40, &(0x7f00000000c0)={'security\x00', 0x0, [0x8, 0x5, 0xbbf8, 0xffff, 0x7]}, &(0x7f0000000000)=0x54) 5m28.421075297s ago: executing program 32 (id=3281): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) getsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x1, 0x0, &(0x7f0000000300)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0/file0\x00'}, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$IP6T_SO_GET_INFO(r2, 0x29, 0x40, &(0x7f00000000c0)={'security\x00', 0x0, [0x8, 0x5, 0xbbf8, 0xffff, 0x7]}, &(0x7f0000000000)=0x54) 5m11.196099924s ago: executing program 0 (id=3350): madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) munmap(&(0x7f0000002000/0x2000)=nil, 0x2000) r0 = syz_open_procfs$pagemap(0x0, &(0x7f0000000240)) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f0000000140)={0x60, 0x0, &(0x7f00001cd000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x9, &(0x7f00000021c0)=[{0x2000000000000009, 0xffffffff, 0x1}], 0x1, 0xc2ff, 0x0, 0x0, 0x0, 0x76}) 5m9.624292236s ago: executing program 0 (id=3356): r0 = socket$kcm(0x29, 0x2, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001000)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef42d430f6296b72a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed40000000022278d00031e5388ee5c867ddd58211d6ece3ccb0cd2b6d3cffd962867a3a2f624f992daa94a6a556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff020000000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409e011f1264d43f153b3d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7000026a4e739c60f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf3f704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eedd9068ca1457870eb30d219e23ccc8e06dddeb61799257ab5000013c86ba99523d61a00000000c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f8b2ad1e1f4933545fc3c741374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb8629aeec90e6d1857da822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae200f279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522e8dff8bc570a93fbdb688c3aef810000007a6ea6"], &(0x7f0000000140)='GPL\x00'}, 0x94) r2 = socket$kcm(0x2, 0x1, 0x0) sendmsg$inet(r2, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f0000000040)={r2, r1}) setsockopt$sock_int(r2, 0x1, 0x20, &(0x7f0000000440)=0x80000000, 0x4) 5m9.338181473s ago: executing program 0 (id=3357): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid\x00') unshare(0x6a040000) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000180)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="180000000200"/15], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x2, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x20000000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0x14, 0x0, &(0x7f0000000080)="259a001471a76d2688a24e6588a8fb5e0af66395", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x9}, 0x50) 5m7.484180652s ago: executing program 0 (id=3371): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x101091, 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) pivot_root(&(0x7f0000000340)='./file0\x00', &(0x7f0000000280)='./file0\x00') 5m7.286355465s ago: executing program 0 (id=3373): mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='./file0/../file0\x00', &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x89101a, 0x0) mount$bind(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000440)='./file0/file0\x00', 0x0, 0x12f451, 0x0) mount$bind(&(0x7f00000000c0)='.\x00', &(0x7f0000000080)='./file0/file0/file0\x00', 0x0, 0x80700a, 0x0) umount2(&(0x7f0000000280)='./file0/file0/file0\x00', 0xa) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) 5m6.820192779s ago: executing program 0 (id=3374): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x1, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_GET_CLOCK(r1, 0x8030ae7c, &(0x7f0000000000)) 5m6.166871392s ago: executing program 33 (id=3374): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x1, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_GET_CLOCK(r1, 0x8030ae7c, &(0x7f0000000000)) 2m37.868278092s ago: executing program 4 (id=4251): r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$inet_sctp(r0, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f0000000240)=[{&(0x7f0000000380)='J', 0x1}], 0x1, 0x0, 0x0, 0x2804c041}, 0x4000891) recvmsg(r0, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x40010042) 2m37.731035897s ago: executing program 4 (id=4253): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) r0 = socket(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x44001}, 0x20008850) sendmsg$nl_route_sched(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r4, {0xf000, 0xffff}, {}, {0x7}}, [@filter_kind_options=@f_route={{0xa}, {0xc, 0x2, [@TCA_ROUTE4_CLASSID={0x8, 0x1, {0x10, 0xffff}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) 2m37.27849026s ago: executing program 4 (id=4257): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x1000, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) r4 = syz_io_uring_setup(0x3c63, &(0x7f0000000140)={0x0, 0xfffffffb, 0x10100, 0x2, 0x4000004}, &(0x7f00000002c0)=0x0, 0x0) syz_io_uring_submit(r5, 0x0, &(0x7f0000000200)=@IORING_OP_READ=@use_registered_buffer={0x16, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r4, 0x2df0, 0x40000000, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000780)={0x44, 0x0, &(0x7f0000000900)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000001440)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000001340)="0e9849f1332c3a4f7cd80c990e6bb6b5979749a4fbaef24bc5bcc03ac73ad01da6441277f5ac3b4d0ab075522859b01dff8f24e16cd420439da93470adbb7411843f018e01848aec434d0395f241ae92"}) ioctl$BINDER_THREAD_EXIT(r3, 0x40046208, 0x0) 2m36.290914716s ago: executing program 4 (id=4261): socket$packet(0x11, 0x3, 0x300) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) userfaultfd(0x801) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x6, 0x4, &(0x7f0000000100)=ANY=[@ANYBLOB="180200005a25a0a9000000000300001b850000002c00000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$rxrpc(0x21, 0x2, 0xa) dup(r0) socket$inet6_sctp(0xa, 0x801, 0x84) socket$inet_sctp(0x2, 0x5, 0x84) bpf$MAP_CREATE(0x0, 0x0, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000880), 0x8100) socket$nl_netfilter(0x10, 0x3, 0xc) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0xe, 0x4, 0x8, 0x1}, 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x10, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000002000000850000008600000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x100002, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{r4}, &(0x7f0000000240), &(0x7f00000003c0)=r6}, 0x20) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r5, r2, 0x25, 0x2, @void}, 0x10) syz_emit_ethernet(0x15, &(0x7f0000000480)={@local, @remote, @val={@void, {0x8100, 0x0, 0x1, 0x4}}, {@llc_tr={0x11, {@llc={0x156, 0x6, '\x00'}}}}}, 0x0) 2m35.958140707s ago: executing program 4 (id=4263): syz_open_dev$vim2m(&(0x7f0000000100), 0x7ff, 0x2) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x1, 0x803, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000900)=@newlink={0x48, 0x10, 0x401, 0x0, 0x4, {0x0, 0x0, 0x0, r2, 0x10886}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x10820, 0x343}}}}}}]}, 0x48}}, 0x0) 2m35.816409184s ago: executing program 5 (id=4265): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="4c00000010000104000000000008000008794ee0", @ANYRES32=0x0, @ANYBLOB="03800000000000001c0012800c0001006d6163766c616e000c000280080001000800000008000500", @ANYRES32=r2, @ANYRES8=r2], 0x4c}}, 0x40000) syz_emit_ethernet(0x1fc, &(0x7f0000001600)=ANY=[], 0x0) 2m35.610356238s ago: executing program 4 (id=4268): r0 = socket$pppoe(0x18, 0x1, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000002340), 0x40800) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x80000, 0x0) r1 = syz_open_dev$ttys(0xc, 0x2, 0x0) writev(r1, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket(0x22, 0x2, 0x24) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$FS_IOC_FSGETXATTR(r6, 0x801c581f, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) sync() ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b000000090400"], 0x0) syz_open_dev$midi(0x0, 0x500, 0xc900) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000004080)=ANY=[@ANYBLOB="020000000400000004000000"], 0x48) mmap(&(0x7f0000fa2000/0x4000)=nil, 0x4000, 0x0, 0x82011, r7, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[], 0x50) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(0xffffffffffffffff, 0xc0a85352, &(0x7f00000002c0)={{0x11, 0x8}, 'port0\x00', 0x80, 0x80010, 0x9, 0x1, 0x7, 0x5, 0x4, 0x0, 0x2, 0x10}) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000280)={r8, &(0x7f0000000300), 0x0}, 0x1c) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000100)={0x18, 0x0, {0x3, @random="c0c13c2baeb6", 'hsr0\x00'}}, 0x1e) 2m35.523181201s ago: executing program 5 (id=4270): sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local}) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$CAN_RAW_LOOPBACK(0xffffffffffffffff, 0x65, 0x3, &(0x7f00000000c0), 0x4) setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000000080)=0x1, 0x4) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a}, 0x1c) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="034888a809003200030030"], 0xfdef) 2m34.684973149s ago: executing program 5 (id=4277): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002800)=@delchain={0x55c, 0x65, 0x2, 0x70bd28, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xd, 0x8}, {0x0, 0x9}, {0x6}}, [@TCA_CHAIN={0x8, 0xb, 0x101}, @filter_kind_options=@f_route={{0xa}, {0x4e4, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_IIF={0x8}, @TCA_ROUTE4_IIF={0x8}, @TCA_ROUTE4_ACT={0x84, 0x6, [@m_vlan={0x80, 0x13, 0x0, 0x0, {{0x9}, {0xc, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}]}, {0x49, 0x6, "4536d5ba67cb41f3417191a0b4758169ba997e9dbec50e599419b7f290f4ee70efc0bdcb1d84cd2098b9c95fa81553821d25bbee1244fda18d438c3a5d696ee14197d17ea5"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3}}}}]}, @TCA_ROUTE4_POLICE={0x444, 0x5, [@TCA_POLICE_TBF={0x3c, 0x1, {0x7ff, 0xffffffffffffffff, 0x3, 0xa, 0x6, {0x7, 0x2, 0x4, 0x9, 0x0, 0x4}, {0x10, 0x2, 0x6, 0xfffe, 0x1, 0xeaa1}, 0x6, 0x200, 0x7}}, @TCA_POLICE_RATE={0x404, 0x2, [0x400, 0xc, 0x2, 0x3a, 0x1, 0x2, 0x5, 0xc, 0x73, 0x6, 0x5, 0x7, 0x2, 0xf, 0x4, 0x0, 0x6a, 0x5, 0xb, 0x4e31, 0x8, 0x2, 0x9, 0x419, 0xd, 0x4, 0x1, 0x1, 0x7fffffff, 0x8, 0x1, 0x6, 0x0, 0x4, 0x1, 0x1, 0x1, 0x6772, 0x10000, 0x4a8, 0x4, 0x80000000, 0x2, 0x3ff, 0x2, 0x9, 0x5, 0x4, 0x821, 0x2, 0x7fffffff, 0x3, 0x1, 0x9, 0x7, 0x3ff, 0x6, 0x10002, 0x5eb7, 0x5, 0x2, 0x401, 0xe, 0x4, 0x5, 0x6, 0x2, 0x629, 0x5c0f, 0x2, 0x5f, 0x5, 0x80000000, 0x8, 0x711, 0x8001, 0x0, 0xffffffb3, 0x4f, 0x401, 0xdadd, 0x10, 0xffffff7a, 0x7, 0x9, 0x2, 0x2, 0x3, 0x2, 0x8001, 0x0, 0xc2, 0x2, 0x9, 0x10000, 0xffffffff, 0x2, 0x7, 0x8, 0xfffffff8, 0x7, 0x8, 0xfffff800, 0xff, 0x43, 0x8, 0x10, 0x4, 0x3, 0x0, 0x400, 0x8, 0x80000000, 0x1, 0x3, 0x2, 0x80000000, 0x8, 0xa, 0x4, 0x3, 0x4, 0x4, 0xffffffff, 0x7f, 0x7, 0x8, 0x7, 0x1, 0xcec, 0x6, 0x8, 0x7, 0x4, 0x10001, 0xb9b, 0x8, 0x80000001, 0x9, 0x7, 0x5, 0xb16, 0x8000, 0x2, 0x5, 0x400001, 0xdc44, 0x3ff, 0xfff, 0xabac, 0x6, 0x7, 0x0, 0x800, 0x0, 0x2, 0x9, 0x8, 0x8, 0x9, 0xfff, 0x80000001, 0x5, 0x3, 0x4, 0x3, 0xfffffff0, 0x3, 0xd6, 0xfffffffe, 0x2, 0x5, 0x8, 0xd4, 0x5, 0x2, 0x80000001, 0x3, 0x80, 0x80, 0x0, 0x3, 0x1, 0xfffff8a1, 0xb, 0xce, 0x7fffffff, 0x7, 0x4, 0x3, 0x0, 0x5, 0x9, 0x6, 0x9, 0x8, 0x7fff, 0x4, 0x9, 0x5, 0xe96a, 0x8, 0xc5, 0xc, 0x1ff, 0x8000, 0x5, 0x6, 0xbd, 0x10b, 0x0, 0x0, 0xfffffd6e, 0x800, 0x10000, 0xe, 0x8, 0x401, 0x6d3, 0xd, 0x400, 0x4, 0x3ff, 0xfffffff2, 0x9, 0x1ff, 0x80000000, 0x1, 0x3, 0x0, 0x6e64295d, 0xfffffffb, 0x2, 0x1ff, 0x2, 0x7, 0x0, 0x1, 0x8, 0x5, 0x7fffffff, 0x908e, 0x4, 0x4, 0xb, 0x21, 0x0, 0x9, 0x2, 0x67, 0x6, 0x38e, 0x5, 0x7, 0x2, 0x6]}]}]}}, @filter_kind_options=@f_u32={{0x8}, {0x4}}, @filter_kind_options=@f_flower={{0xb}, {0x28, 0x2, [@TCA_FLOWER_KEY_ARP_THA_MASK={0xa, 0x42, [0xff, 0xff, 0x0, 0xff, 0x0, 0xff]}, @TCA_FLOWER_KEY_PORT_SRC_MIN={0x6, 0x57, 0x4e22}, @TCA_FLOWER_KEY_ENC_IP_TTL_MASK={0x5, 0x53, 0x6b}, @TCA_FLOWER_KEY_IP_TTL={0x5, 0x4b, 0x3}]}}]}, 0x55c}, 0x1, 0x0, 0x0, 0x81}, 0x8000) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000880)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x3a1}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) 2m34.328160707s ago: executing program 5 (id=4279): openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000000)={0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0100000000000000560000000000000066ba2100b066eeb9e00a0000"], 0x56}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000380)={0x2, 0x102000, 0x1}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000002340)={0x0, 0x0, @pic={0x7, 0x10, 0x4, 0x81, 0x0, 0xb, 0x7, 0x9, 0x5d, 0x1, 0x8, 0x40, 0x31, 0x0, 0x5, 0x4b}}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f00000000c0)={0x3}) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000140)={[{0x5, 0xc, 0x6, 0x3, 0x40, 0x2, 0x2, 0x9, 0x1, 0x4, 0x2, 0x9, 0x4}, {0x1, 0x80, 0x7, 0x0, 0x8, 0x6, 0x9, 0xff, 0x2, 0x1, 0x9, 0xf, 0x9}, {0x2, 0x9, 0x5, 0x80, 0x8, 0x7, 0x0, 0x87, 0x5, 0x1, 0x2, 0x3}], 0xf87}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2m33.213244959s ago: executing program 5 (id=4288): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) madvise(&(0x7f00003f3000/0x2000)=nil, 0x2000, 0xa) r2 = msgget$private(0x0, 0x0) msgrcv(r2, 0x0, 0x0, 0x1, 0x3000) msgrcv(r2, 0x0, 0x0, 0x0, 0x3000) msgctl$IPC_RMID(r2, 0x0) connect$unix(r0, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f0000003300), 0x0, 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) mount_setattr(0xffffffffffffffff, 0x0, 0x900, 0x0, 0x0) fanotify_init(0x200, 0x40000) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x6, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x1, 0x0, 0x3}, 0x0) close(0xffffffffffffffff) r3 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$6lowpan_control(r3, &(0x7f0000000500)='connect aa:aa:aa:aa:aa:11 0', 0x1b) write$6lowpan_control(r3, &(0x7f0000000200)='connect aa:aa:aa:aa:aa:10 0', 0x1d) r4 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000680), 0x2, 0x0) write$6lowpan_control(r4, &(0x7f00000006c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f00000018c0), 0x0, 0x0) ioctl$mixer_OSS_GETVERSION(r5, 0x80086303, &(0x7f0000000000)) bind$alg(0xffffffffffffffff, &(0x7f0000000280)={0x26, 'hash\x00', 0x0, 0x0, 'sha384\x00'}, 0x58) r6 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg$unix(r6, 0x0, 0x0, 0x0, 0x0) sendmsg$AUDIT_GET_FEATURE(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0xfffffd8d, &(0x7f00000000c0)={&(0x7f0000000400)={0x10, 0x3fb, 0x8, 0x70bd2b, 0x25dfdbfe}, 0x10}, 0x1, 0x0, 0x0, 0x10044011}, 0x811) 2m31.654034553s ago: executing program 5 (id=4294): r0 = socket$pppoe(0x18, 0x1, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000002340), 0x40800) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x80000, 0x0) r1 = syz_open_dev$ttys(0xc, 0x2, 0x0) writev(r1, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket(0x22, 0x2, 0x24) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$FS_IOC_FSGETXATTR(r6, 0x801c581f, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) sync() ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b000000090400"], 0x0) syz_open_dev$midi(0x0, 0x500, 0xc900) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000004080)=ANY=[@ANYBLOB="02000000040000000400000001"], 0x48) mmap(&(0x7f0000fa2000/0x4000)=nil, 0x4000, 0x0, 0x82011, r7, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[], 0x50) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(0xffffffffffffffff, 0xc0a85352, &(0x7f00000002c0)={{0x11, 0x8}, 'port0\x00', 0x80, 0x80010, 0x9, 0x1, 0x7, 0x5, 0x4, 0x0, 0x2, 0x10}) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000280)={r8, &(0x7f0000000300), 0x0}, 0x1c) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000100)={0x18, 0x0, {0x3, @random="c0c13c2baeb6", 'hsr0\x00'}}, 0x1e) 2m20.439205729s ago: executing program 34 (id=4268): r0 = socket$pppoe(0x18, 0x1, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000002340), 0x40800) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x80000, 0x0) r1 = syz_open_dev$ttys(0xc, 0x2, 0x0) writev(r1, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket(0x22, 0x2, 0x24) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$FS_IOC_FSGETXATTR(r6, 0x801c581f, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) sync() ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b000000090400"], 0x0) syz_open_dev$midi(0x0, 0x500, 0xc900) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000004080)=ANY=[@ANYBLOB="020000000400000004000000"], 0x48) mmap(&(0x7f0000fa2000/0x4000)=nil, 0x4000, 0x0, 0x82011, r7, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[], 0x50) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(0xffffffffffffffff, 0xc0a85352, &(0x7f00000002c0)={{0x11, 0x8}, 'port0\x00', 0x80, 0x80010, 0x9, 0x1, 0x7, 0x5, 0x4, 0x0, 0x2, 0x10}) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000280)={r8, &(0x7f0000000300), 0x0}, 0x1c) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000100)={0x18, 0x0, {0x3, @random="c0c13c2baeb6", 'hsr0\x00'}}, 0x1e) 2m16.053425907s ago: executing program 35 (id=4294): r0 = socket$pppoe(0x18, 0x1, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000002340), 0x40800) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x80000, 0x0) r1 = syz_open_dev$ttys(0xc, 0x2, 0x0) writev(r1, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket(0x22, 0x2, 0x24) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$FS_IOC_FSGETXATTR(r6, 0x801c581f, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) sync() ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b000000090400"], 0x0) syz_open_dev$midi(0x0, 0x500, 0xc900) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000004080)=ANY=[@ANYBLOB="02000000040000000400000001"], 0x48) mmap(&(0x7f0000fa2000/0x4000)=nil, 0x4000, 0x0, 0x82011, r7, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[], 0x50) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(0xffffffffffffffff, 0xc0a85352, &(0x7f00000002c0)={{0x11, 0x8}, 'port0\x00', 0x80, 0x80010, 0x9, 0x1, 0x7, 0x5, 0x4, 0x0, 0x2, 0x10}) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000280)={r8, &(0x7f0000000300), 0x0}, 0x1c) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000100)={0x18, 0x0, {0x3, @random="c0c13c2baeb6", 'hsr0\x00'}}, 0x1e) 11.595078237s ago: executing program 3 (id=5039): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000080)={0x0, 0x8000}, 0x8) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) getsockopt$bt_hci(r2, 0x84, 0x7f, &(0x7f0000000080)=""/4057, &(0x7f0000001180)=0xfd9) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f00000001c0)) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0xea100, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl(r3, 0x8b23, &(0x7f0000000040)) r4 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x8000000000000000, 0x900000001, 0x800000000, 0x45b, 0x0, 0x0, 0x7, 0x5, 0x0, 0xfc, 0xfffffffdfffffffc, 0xfdfffffffffffffc, 0x0, 0x9, 0x4000000000000004, 0x767], 0xeeef0000, 0x80082}) r5 = syz_open_procfs(0x0, &(0x7f0000002380)='net/ip_mr_cache\x00') r6 = socket$igmp(0x2, 0x3, 0x2) getdents64(0xffffffffffffffff, 0x0, 0x0) timer_settime(0x0, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x1e, 0x0, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) io_setup(0x6, 0x0) setsockopt$MRT_INIT(r6, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r6, 0x0, 0xca, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @local}, 0x10) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mreq(r7, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x36, &(0x7f0000000140)={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1e}, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x400, 0x20, 0xfc, 0x2, 0x0, @private=0xa010100, @multicast1=0xe0000300}, @timestamp_reply={0xe, 0x0, 0x0, 0x81, 0x6, 0x7f, 0x7, 0xd}}}}}, 0x0) setsockopt$MRT_ADD_MFC_PROXY(r6, 0x0, 0xd2, &(0x7f00000000c0)={@broadcast, @empty=0xe0000320, 0x0, "8a79348df081496d0420922f45a71c1daa8b610468cd140526c41efcd3a4a422", 0x3, 0x1, 0x85}, 0x3c) pread64(r5, &(0x7f0000000100)=""/253, 0xfd, 0xadc) 8.472872903s ago: executing program 1 (id=5048): openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, 0x0, 0x0) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r1) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) syz_open_procfs$namespace(r0, &(0x7f0000000340)='ns/mnt\x00') sendmsg$TIPC_NL_LINK_SET(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000240)={&(0x7f0000000880)={0x21c, 0x0, 0x100, 0x70bd28, 0x25dfdbfe, {}, [@TIPC_NLA_SOCK={0x38, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x7}]}, @TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0xd}]}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8}]}, @TIPC_NLA_BEARER={0xec, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @l2={'ib', 0x3a, 'xfrm0\x00'}}, @TIPC_NLA_BEARER_NAME={0xf, 0x1, @l2={'ib', 0x3a, 'geneve0\x00'}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x7, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x8}}, {0x14, 0x2, @in={0x2, 0x4e24, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x4}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6f02}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xb}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @loopback}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x7, @remote, 0xe}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7}]}, @TIPC_NLA_NODE={0xe4, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ID={0x95, 0x3, "0913c985745c29af29f943540c44c618ae4e21dc2acb3a3eb29bd217496eaefa269e3fc3b7562b78800bcfff002ae2915cbd23f4c5b581577cfb6ad763fe0ae20b0765ac6c74ac4573d1e4ae85e430487effdeb3a1e2025f5978840687a441f56cad735670c515ed7726f9eaa2450d767978d514d0c7f2ae68e94f0abc1a663b4b777d11ffabb205035d341058bc2172bd"}, @TIPC_NLA_NODE_KEY={0x41, 0x4, {'gcm(aes)\x00', 0x19, "8b5a45d14d8ac9b758154bb4890f3002686bb45e1668c73607"}}]}]}, 0x21c}, 0x1, 0x0, 0x0, 0x20000801}, 0x80) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', r2, 0x0, 0xd}, 0x18) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_io_uring_setup(0x7dca, &(0x7f0000000340)={0x0, 0x4, 0x10100, 0x0, 0x2000000}, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x1fffffffffe, 0xfffffffffffffffd, 0x0, 0x0, 0x1000001000, 0x9}, 0x0, &(0x7f00000002c0)={0x3fb, 0x8000, 0x400000000001, 0x9, 0x40000000000000, 0xf, 0x80000002, 0x2}, 0x0, 0x0) r4 = socket$can_j1939(0x1d, 0x2, 0x7) getsockopt$SO_J1939_SEND_PRIO(r4, 0x6b, 0x3, &(0x7f0000000000), &(0x7f0000000040)=0x4) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) dup(r5) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) 7.351669634s ago: executing program 3 (id=5056): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$kcm(0x2, 0xa, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000640)="f3", 0xf000}], 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) connect$can_j1939(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_RINGS_GET(r7, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={0x0}, 0x1, 0x0, 0x0, 0x44811}, 0x80) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xfffb, 0xf}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=@getchain={0x24, 0x66, 0x903, 0x70bd2d, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0xe, 0x7}, {0xf, 0xfff1}, {0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x40088c8}, 0x20004804) 7.200253104s ago: executing program 8 (id=5057): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x3000004, 0x3032, 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x3b, &(0x7f00000014c0)=""/145, &(0x7f0000000000)=0x91) (fail_nth: 1) 7.19934525s ago: executing program 7 (id=5058): semctl$IPC_STAT(0x0, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x40ead000) mknod$loop(&(0x7f0000000140)='./file0\x00', 0x8fff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(camellia)\x00'}, 0x58) r3 = openat$sysfs(0xffffffffffffff9c, 0x0, 0x149a82, 0x0) write$cgroup_int(r3, &(0x7f0000000040)=0x1c9, 0x12) ioctl$SNDCTL_SEQ_SYNC(r3, 0x5101) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r4 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3", 0x8}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) execve(&(0x7f0000000180)='./file0\x00', 0x0, &(0x7f0000000340)={[&(0x7f0000000940)='\x7f\xb7\xc3\x7f\xa5a\xd6A*c\x9b\xd8R\xf02b\xefA|uiWb\x8f\xee\x1c\xc5\xdb^\x11\x16h\x83\x94y\x89\xf1Y{\x87\xd5\xf3\xccMr\xc5\xbdT\x9e\xc4\x84\x06\xcd\x8b\xcd\t\x01', &(0x7f0000000300)='/#\x00']}) preadv(0xffffffffffffffff, 0x0, 0x0, 0x2b, 0x0) madvise(&(0x7f0000130000/0xd000)=nil, 0xd000, 0x66) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x19) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r5, 0x0, 0x0) getrandom(&(0x7f0000000040)=""/133, 0xfffffffffffffdde, 0x2) 6.218009932s ago: executing program 1 (id=5060): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000026c0), r0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000002800)={0x0, 0x0, &(0x7f00000027c0)={&(0x7f0000000380)={0x3c, r1, 0x1, 0x70bd25, 0x25dfdc02, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8}}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1000100000001}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x6}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24040001}, 0x0) 5.538061182s ago: executing program 1 (id=5062): unshare(0x20000400) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @mcast2, 0x5}, 0x1c) getsockopt$sock_buf(r0, 0x1, 0x19, 0x0, &(0x7f0000003080)) 5.537747393s ago: executing program 8 (id=5063): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYRES16], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg=0x7}, 0x94) close(r0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="2c0000003e00070100000000fcdbdf25047c0000040000001400018008001600", @ANYRES32=0x0, @ANYBLOB="0600060080"], 0x2c}}, 0x0) r2 = socket(0x28, 0x5, 0x0) socket(0x28, 0x5, 0x0) connect$vsock_stream(r2, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) openat$comedi(0xffffffffffffff9c, 0x0, 0x8c482, 0x0) r3 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0x16d7, 0x400, 0x1, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffe, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r6 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r6, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) io_uring_enter(r3, 0x847ba, 0x0, 0xe, 0x0, 0x0) 4.160643246s ago: executing program 8 (id=5066): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000000c0)={'vxcan0\x00', 0x0}) bind$can_j1939(0xffffffffffffffff, &(0x7f0000000100)={0x1d, r1}, 0x18) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmsg$can_j1939(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x1d, 0x0, 0x0, {0x0, 0x0, 0x4}, 0xff}, 0x18, &(0x7f0000000080)={0x0}, 0x4}, 0x4c8c0) 4.129181066s ago: executing program 1 (id=5067): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000040)=[@in={0x2, 0x4e21, @empty}], 0x10) r1 = dup(r0) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r1, &(0x7f0000000180)={0x4, 0x8, 0xfa00, {0xffffffffffffffff, 0x4}}, 0x29fdf) r2 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000040)=ANY=[@ANYBLOB="4c000000140011f225bd7000fddbcf250284", @ANYRES16=r2, @ANYRES64=r2], 0x4c}, 0x1, 0x0, 0x0, 0x48000}, 0xc0) 3.869522592s ago: executing program 1 (id=5068): socket$packet(0x11, 0x2, 0x300) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000079e02200850000006d00000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='kmem_cache_free\x00', r0}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) socket$inet_udp(0x2, 0x2, 0x0) pipe(&(0x7f0000000c00)) epoll_create(0x4) socket$packet(0x11, 0x2, 0x300) socket$packet(0x11, 0x2, 0x300) socket(0x2, 0x80805, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x80001, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000240)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic-generic\x00'}, 0x58) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0b00000005000000020000000400000005"], 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) socket$inet6_sctp(0xa, 0x1, 0x84) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x0, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, [@call={0x85, 0x0, 0x0, 0xb5}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0), 0x48) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r2, &(0x7f0000000000), &(0x7f0000000040)=""/73}, 0x70) 3.715109008s ago: executing program 8 (id=5070): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket(0x28, 0x5, 0x0) r1 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(r1, 0x4) connect$vsock_stream(r0, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) openat$comedi(0xffffffffffffff9c, 0x0, 0x8c482, 0x0) r2 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0x16d7, 0x400, 0x1, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffe, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{0x0}], 0x1}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) io_uring_enter(r2, 0x847ba, 0x0, 0xe, 0x0, 0x0) 3.712004293s ago: executing program 7 (id=5071): r0 = socket(0x2b, 0x80801, 0x1) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e23, 0xab, @empty, 0x1}, 0x1c) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000600)={0x1, 'veth0_to_batadv\x00'}, 0x18) (fail_nth: 1) 3.555522354s ago: executing program 3 (id=5072): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000940), r0) sendmsg$IEEE802154_LLSEC_SETPARAMS(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a00)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x44004094) 3.494327865s ago: executing program 1 (id=5073): r0 = socket(0x2b, 0x80801, 0x1) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/pm_async', 0x102, 0x0) setreuid(0x0, 0xee00) fchown(r1, 0xee01, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r2}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) fgetxattr(0xffffffffffffffff, &(0x7f0000000000)=@known='system.sockprotoname\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_channels={0x3d, 0x0, 0x6, 0x0, 0xfffffffd, 0x1, 0x1, 0xfffffffd, 0x1000000}}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$inet_smc(0x2b, 0x1, 0x0) r7 = syz_io_uring_setup(0x10a, &(0x7f0000000140)={0x0, 0x5883, 0x80, 0x0, 0xfffffdfc}, &(0x7f0000000040)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r8, r9, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x8, 0x0, 0x0, 0x0, {0x8301}, 0x1}) io_uring_enter(r7, 0x3516, 0x0, 0x0, 0x0, 0x0) r10 = socket$inet6_sctp(0xa, 0x5, 0x84) connect$inet6(r10, &(0x7f00000001c0)={0xa, 0x4e23, 0xab, @private1, 0x1}, 0x1c) pselect6(0x40, &(0x7f0000000000)={0x0, 0x180000000000000, 0x2, 0x7, 0x2, 0x7, 0x17, 0x362}, &(0x7f0000000040)={0x7fffffff, 0x7fffffff, 0x8, 0x800, 0x2, 0xd8, 0x1, 0x9}, &(0x7f0000000080)={0x5, 0x7, 0xcf9, 0x6, 0xb6ff, 0x100, 0xcbca, 0x6}, &(0x7f00000000c0), &(0x7f0000000140)={&(0x7f0000000100), 0x8}) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000600)={0x1, 'veth0_to_batadv\x00'}, 0x18) 2.505716154s ago: executing program 7 (id=5075): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050000000000000000002e00000008000300", @ANYRES32, @ANYBLOB="050034008b00f1ff0f004c"], 0x34}}, 0x0) 2.396250807s ago: executing program 3 (id=5076): bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0xfffffffffffffd51, &(0x7f0000000000)='cgroup\x00'}, 0x30) r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000040)='cpu.max\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f00000002c0)=ANY=[], 0x8) 2.334546092s ago: executing program 7 (id=5078): socket$alg(0x26, 0x5, 0x0) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000180)={0x0, 0x0, 0x0, 'queue0\x00'}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000000)={0x0, 0x7a120, 0x43b, {0x0, 0x10000}}) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) r3 = io_uring_setup(0x4d57, &(0x7f0000000400)={0x0, 0x744d, 0x10000, 0x3, 0x143}) io_uring_register$IORING_REGISTER_MEM_REGION(r3, 0x22, &(0x7f00000001c0)={&(0x7f0000000180)={&(0x7f0000000100)="ffa7", 0x2, 0x1, 0x1}}, 0x1) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x10, r2, 0xb7f46000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = syz_io_uring_setup(0x1237, &(0x7f0000000380)={0x0, 0x80fd, 0x8000, 0x3, 0x2b9, 0x0, r3}, &(0x7f0000000040)=0x0, &(0x7f0000000280)=0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x11a, 0x3, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f00000001c0)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r4, 0x80, &(0x7f0000000080)=@l2tp={0x2, 0x0, @local, 0x3}}) io_uring_enter(r5, 0x47bc, 0x0, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r8}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x6) r9 = getpid() sched_setscheduler(r9, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r10, &(0x7f0000000380)=@abs, 0x6e) 2.323679089s ago: executing program 8 (id=5079): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000040)=[@in={0x2, 0x4e21, @empty}], 0x10) r1 = dup(r0) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r1, &(0x7f0000000180)={0x4, 0x8, 0xfa00, {0xffffffffffffffff, 0x4}}, 0x29fdf) r2 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000040)=ANY=[@ANYBLOB="4c000000140011f225bd7000fddbcf250284", @ANYRES16=r2, @ANYRES64=r2], 0x4c}, 0x1, 0x0, 0x0, 0x48000}, 0xc0) 2.112202157s ago: executing program 3 (id=5080): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000000c0)={'vxcan0\x00', 0x0}) bind$can_j1939(0xffffffffffffffff, &(0x7f0000000100)={0x1d, r1}, 0x18) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmsg$can_j1939(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x1d, 0x0, 0x0, {0x0, 0x0, 0x4}, 0xff}, 0x18, &(0x7f0000000080)={0x0}, 0x4}, 0x4c8c0) 1.36865207s ago: executing program 3 (id=5082): syz_usb_connect(0x2, 0x37, &(0x7f0000000100)=ANY=[@ANYBLOB="1201410189e24420f60d56007821010203010902240001000010000904e7070232"], 0x0) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0) ioctl$SNDCTL_DSP_GETOSPACE(r0, 0x8010500c, &(0x7f00000000c0)) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0) r1 = fsopen(&(0x7f0000000400)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000540)='\xd0\x9e^\xa0\xee\xc8\x17T\xb1GI\x90\xe2Q1\xb0\x8f\xe1\xa8\x95\xa0\xcd\fL\xf10x0}) connect$can_bcm(r7, &(0x7f00000000c0)={0x1d, r8}, 0x10) sendmsg$can_bcm(r7, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)={0x1, 0x840, 0x0, {}, {0x77359400}, {}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "ef1d62ee7e923b0ad9cda5b28dd4753620a2f0271768a8284c18a4e2b5e44dc77098b18fd964df81213608ec503db52d42f1a78c97322f4ae4c8dc89cf2b1440"}}, 0x80}}, 0x0) sendmsg$can_bcm(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x1, 0x1, 0x3, {}, {0x0, 0x2710}, {0x3, 0x1, 0x1, 0x1}, 0x1, @can={{0x4, 0x0, 0x0, 0x1}, 0x7, 0x2, 0x0, 0x0, "d467aef0f23fe738"}}, 0x48}, 0x1, 0x0, 0x0, 0x4001}, 0x4000000) sendmsg$can_bcm(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020000006000"/15, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRESDEC=r5, @ANYRES64=r5, @ANYBLOB="00f4"], 0x48}}, 0x40884) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000400)={r6, 0x3, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r9 = socket(0x840000000002, 0x3, 0x100) connect$inet(r9, &(0x7f0000000000)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r9, &(0x7f0000005240), 0x4000095, 0x0) setsockopt$inet_int(r9, 0x0, 0x17, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) 1.200244741s ago: executing program 8 (id=5083): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$kcm(0x2, 0xa, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000640)="f3", 0xf000}], 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) connect$can_j1939(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r6 = socket(0x400000000010, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000380), 0xffffffffffffffff) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xfffb, 0xf}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=@getchain={0x24, 0x66, 0x903, 0x70bd2d, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0xe, 0x7}, {0xf, 0xfff1}, {0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x40088c8}, 0x20004804) 1.069666914s ago: executing program 6 (id=5084): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)={0x100, 0x2b, 0x1, 0x0, 0x25dfdbff, "", [@nested={0xee, 0x0, 0x0, 0x1, [@typed={0xc, 0x2, 0x0, 0x0, @u64}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd3f"]}]}, 0x100}], 0x1}, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB='b *:4\tw'], 0xa) r2 = openat$cgroup_devices(r1, &(0x7f00000000c0)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r2, &(0x7f0000000100)={'b', ' *:* ', 'rwm\x00'}, 0xa) 780.244873ms ago: executing program 6 (id=5085): pipe(&(0x7f0000019480)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000500)=[{&(0x7f00000000c0)="dc52b390", 0x4}, {&(0x7f0000000100)="7681", 0x2}, {&(0x7f0000000480)="eb", 0x1}, {&(0x7f0000000a80)='`', 0x1}, {&(0x7f0000000080)="ca2d", 0x2}, {&(0x7f00000011c0)="b488c5", 0xfffffcfb}, {&(0x7f0000000340)="748080a54714ce974a428103824a223696f0821cda0b0faabd2683bce6e29460f49e7ecca4b1efcaead665a9586108b36c3123d86e7472495513633f1a9b91ba0c6f68df1c7d587f503c24c0ab03730c8e3fd08dade50b3e8cc887e4ceefc44b41a04ab49c20b7a6caed21801820f58ceb0124c7a7f1145a47bdac6a15ecc48e712cce474b342b787013c31dec1e44edfe546ae4ad5fd37f93609de43a8e4a657cb582bbc0d5a6e03f0c8eabb5afd4579b71af1e22c4dd007b5e56c4d2638f382de8621e221ba85e0985abcf3487c8dc41095787d0660bc6695edf4897d391658837e9d0476448584cd49e02c59b6485e49ffb5f4b5861df94caa8adc078ec2774ec19d0ddf49891d9", 0x109}], 0x7, 0x3) close(r1) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0xfff0) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000300)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f0000000900)=0xffffffffffffffff, 0x4) sendmmsg$inet(r2, &(0x7f0000001ec0)=[{{0x0, 0x0, &(0x7f0000001000)=[{&(0x7f0000000780)="92", 0x1}], 0x1}}], 0x1, 0x4008440) splice(r0, 0x0, r1, 0x0, 0x10500, 0x0) 654.790538ms ago: executing program 7 (id=5086): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000940), r0) sendmsg$IEEE802154_LLSEC_SETPARAMS(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000980)={0x20, r1, 0x19, 0x70bd26, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4004000}, 0x44004094) 502.631632ms ago: executing program 6 (id=5087): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) prctl$PR_GET_TIMERSLACK(0x1e) 353.766963ms ago: executing program 7 (id=5088): sysinfo(&(0x7f0000000000)=""/196) r0 = syz_open_dev$usbmon(&(0x7f0000000000), 0x80000001, 0x82002) poll(&(0x7f0000000180)=[{r0}], 0x1, 0x7a0) syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)=0x15) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x551201, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000180)={'\x00', 0xaf, 0xc, 0x200000, 0xd2e, 0x0, 0x0}) fcntl$setownex(r2, 0xf, &(0x7f0000000200)={0x2, r3}) ioctl$TCSETS(r1, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x1, 0x400000, 0x12, "3e00040100"}) 292.784578ms ago: executing program 6 (id=5089): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050000000000000000002e00000008000300", @ANYRES32, @ANYBLOB="050034008b00f1ff0f004c"], 0x34}}, 0x0) 200.567476ms ago: executing program 6 (id=5090): bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0xfffffffffffffd51, &(0x7f0000000000)='cgroup\x00'}, 0x30) r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000040)='cpu.max\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f00000002c0)=ANY=[], 0x8) 0s ago: executing program 6 (id=5091): semctl$IPC_STAT(0x0, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x40ead000) mknod$loop(&(0x7f0000000140)='./file0\x00', 0x8fff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(camellia)\x00'}, 0x58) r3 = openat$sysfs(0xffffffffffffff9c, 0x0, 0x149a82, 0x0) write$cgroup_int(r3, &(0x7f0000000040)=0x1c9, 0x12) ioctl$SNDCTL_SEQ_SYNC(r3, 0x5101) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r4 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be5216344841", 0xe}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) execve(&(0x7f0000000180)='./file0\x00', 0x0, &(0x7f0000000340)={[&(0x7f0000000940)='\x7f\xb7\xc3\x7f\xa5a\xd6A*c\x9b\xd8R\xf02b\xefA|uiWb\x8f\xee\x1c\xc5\xdb^\x11\x16h\x83\x94y\x89\xf1Y{\x87\xd5\xf3\xccMr\xc5\xbdT\x9e\xc4\x84\x06\xcd\x8b\xcd\t\x01', &(0x7f0000000300)='/#\x00']}) preadv(0xffffffffffffffff, 0x0, 0x0, 0x2b, 0x0) madvise(&(0x7f0000130000/0xd000)=nil, 0xd000, 0x66) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x19) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r5, 0x0, 0x0) getrandom(&(0x7f0000000040)=""/133, 0xfffffffffffffdde, 0x2) kernel console output (not intermixed with test programs): [ 511.721147][ T10] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 511.747258][ T10] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 511.770595][ T10] usb 7-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 511.799473][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 511.817927][ T10] usb 7-1: SerialNumber: syz [ 512.051804][ T10] usb 7-1: 0:2 : does not exist [ 512.113187][ T10] usb 7-1: USB disconnect, device number 5 [ 512.188883][T15997] udevd[15997]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 512.199142][ T24] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 512.328823][T16440] binder: 16438:16440 ioctl c0306201 200000001440 returned -11 [ 512.399564][ T24] usb 2-1: Using ep0 maxpacket: 16 [ 512.412223][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 512.427074][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 512.437391][ T24] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 512.450716][ T24] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 512.464235][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 512.476801][ T24] usb 2-1: config 0 descriptor?? [ 512.549197][T14464] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 512.722399][T14464] usb 5-1: Using ep0 maxpacket: 16 [ 512.741444][T14464] usb 5-1: config 0 has an invalid interface number: 41 but max is 0 [ 512.759343][T14464] usb 5-1: config 0 has no interface number 0 [ 512.765956][T14464] usb 5-1: config 0 interface 41 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 512.785308][T14464] usb 5-1: config 0 interface 41 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 512.823521][T14464] usb 5-1: config 0 interface 41 has no altsetting 0 [ 512.859705][T14464] usb 5-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 512.868886][T14464] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 512.899857][T14464] usb 5-1: Product: syz [ 512.920518][T14464] usb 5-1: Manufacturer: syz [ 512.925275][T14464] usb 5-1: SerialNumber: syz [ 512.937040][ T24] input: HID 045e:07da as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:045E:07DA.000F/input/input18 [ 512.964383][T14464] usb 5-1: config 0 descriptor?? [ 512.987922][T16439] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 513.037501][ T24] microsoft 0003:045E:07DA.000F: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.1-1/input0 [ 513.058495][T16439] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 513.168905][ T24] usb 2-1: USB disconnect, device number 7 [ 513.273995][T16439] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 513.326134][T16439] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 513.372946][T16458] fido_id[16458]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 513.879398][T16479] tipc: Enabled bearer , priority 0 [ 513.906752][T16479] syzkaller0: entered promiscuous mode [ 513.932997][T16479] syzkaller0: entered allmulticast mode [ 513.997429][T16477] tipc: Resetting bearer [ 514.033474][T14464] CoreChips 5-1:0.41 (unnamed net_device) (uninitialized): sr_get_phy_addr : Error reading PHYID register:ffffffe0 [ 514.100021][T16477] tipc: Disabling bearer [ 514.929191][ T10] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 515.101965][T14464] CoreChips 5-1:0.41 (unnamed net_device) (uninitialized): Failed to send software reset:ffffffb9 [ 515.119182][T14464] CoreChips 5-1:0.41 (unnamed net_device) (uninitialized): Failed to power up PHY: -71 [ 515.141105][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 515.167517][T14464] CoreChips 5-1:0.41: probe with driver CoreChips failed with error -71 [ 515.176300][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 515.206633][ T10] usb 2-1: New USB device found, idVendor=0fc5, idProduct=b080, bcdDevice= 0.00 [ 515.230350][T14464] usb 5-1: USB disconnect, device number 13 [ 515.244137][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 515.284791][ T10] usb 2-1: config 0 descriptor?? [ 515.725710][ T10] hid-led 0003:0FC5:B080.0010: unknown main item tag 0x0 [ 516.158339][T16517] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 516.174997][T16517] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 516.200375][T16517] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 516.206713][T16517] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 516.234067][T16517] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 516.372000][T14464] usb 2-1: USB disconnect, device number 8 [ 516.395557][ T94] block nbd2: Possible stuck request ffff88802551e000: control (read@0,1024B). Runtime 210 seconds [ 516.408535][ T94] block nbd2: Possible stuck request ffff88802551e1c0: control (read@1024,1024B). Runtime 210 seconds [ 516.420217][ T94] block nbd2: Possible stuck request ffff88802551e380: control (read@2048,1024B). Runtime 210 seconds [ 516.432040][ T94] block nbd2: Possible stuck request ffff88802551e540: control (read@3072,1024B). Runtime 210 seconds [ 516.911407][ T5913] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 517.109138][ T5913] usb 6-1: Using ep0 maxpacket: 32 [ 517.130942][ T5913] usb 6-1: config 0 has an invalid interface number: 184 but max is 0 [ 517.148680][ T13] bridge_slave_1: left allmulticast mode [ 517.169089][ T5913] usb 6-1: config 0 has no interface number 0 [ 517.175558][ T13] bridge_slave_1: left promiscuous mode [ 517.202182][ T5913] usb 6-1: config 0 interface 184 has no altsetting 0 [ 517.209275][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 517.225918][T16566] input: syz1 as /devices/virtual/input/input20 [ 517.256429][ T13] bridge_slave_0: left allmulticast mode [ 517.264607][ T5913] usb 6-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 517.269440][ T13] bridge_slave_0: left promiscuous mode [ 517.304856][ T5913] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 517.333544][ T5913] usb 6-1: Product: syz [ 517.342786][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 517.359057][ T5913] usb 6-1: Manufacturer: syz [ 517.363718][ T5913] usb 6-1: SerialNumber: syz [ 517.444224][ T5913] usb 6-1: config 0 descriptor?? [ 517.459431][ T51] Bluetooth: hci7: command 0x0406 tx timeout [ 517.481796][ T5913] smsc75xx v1.0.0 [ 518.184000][ T51] Bluetooth: hci0: command 0x0c1a tx timeout [ 518.259390][ T51] Bluetooth: hci2: command 0x0c1a tx timeout [ 518.265713][ T51] Bluetooth: hci3: command 0x0c1a tx timeout [ 518.349378][ T5854] Bluetooth: hci1: command 0x0c1a tx timeout [ 518.457287][ T5913] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 518.489491][ T5913] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 519.238744][ T13] team0: Port device geneve0 removed [ 519.952444][T16556] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 519.964951][T16556] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 520.079896][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 520.096186][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 520.107838][ T13] bond0 (unregistering): Released all slaves [ 520.179975][T16556] binder: 16554:16556 ioctl 40046205 0 returned -22 [ 520.217491][ T5913] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000300: -71 [ 520.238785][ T5913] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to write ADDR_FILTX: -71 [ 520.260526][ T5913] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to set mac address [ 520.303463][ T5913] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 520.360474][ T5913] smsc75xx 6-1:0.184: probe with driver smsc75xx failed with error -71 [ 520.399741][ T5913] usb 6-1: USB disconnect, device number 4 [ 520.999112][ T5913] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 521.112740][T16655] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3671'. [ 521.140899][T16653] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 521.173987][ T5913] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 521.191429][ T5913] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 521.234311][ T5913] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 521.305111][ T5913] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 521.321112][ T5913] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 521.358043][ T5913] usb 2-1: Product: syz [ 521.391039][ T5913] usb 2-1: Manufacturer: syz [ 521.425493][ T5913] usb 2-1: SerialNumber: syz [ 521.504308][ T5913] hub 2-1:1.0: bad descriptor, ignoring hub [ 521.522569][ T5913] hub 2-1:1.0: probe with driver hub failed with error -5 [ 521.533039][T16662] kvm: emulating exchange as write [ 521.699276][ T5913] usblp 2-1:1.0: usblp0: USB Unidirectional printer dev 9 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 521.781419][ T13] tipc: Left network mode [ 522.081378][T15346] usb 2-1: USB disconnect, device number 9 [ 522.148256][T15346] usblp0: removed [ 522.390015][ T10] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 522.574931][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 522.639068][ T10] usb 5-1: config 0 has an invalid interface number: 67 but max is 0 [ 522.657488][ T10] usb 5-1: config 0 has no interface number 0 [ 522.707576][ T10] usb 5-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 522.748753][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 522.779284][ T10] usb 5-1: Product: syz [ 522.800034][ T10] usb 5-1: Manufacturer: syz [ 522.815054][ T10] usb 5-1: SerialNumber: syz [ 522.857457][ T10] usb 5-1: config 0 descriptor?? [ 522.955412][ T10] smsc95xx v2.0.0 [ 523.057784][ T13] hsr_slave_0: left promiscuous mode [ 523.107442][ T13] hsr_slave_1: left promiscuous mode [ 523.132583][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 523.145590][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 523.187706][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 523.220555][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 523.292086][T16710] binder: 16709:16710 ioctl c0306201 200000001440 returned -11 [ 523.318597][ T13] veth1_macvtap: left promiscuous mode [ 523.325829][ T10] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 523.347974][ T13] veth0_macvtap: left promiscuous mode [ 523.358048][ T10] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 523.374581][ T13] veth1_vlan: left promiscuous mode [ 523.379479][ T5913] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 523.390596][ T13] veth0_vlan: left promiscuous mode [ 523.553872][ T5913] usb 7-1: Using ep0 maxpacket: 8 [ 523.582631][ T5913] usb 7-1: config 179 has an invalid interface number: 65 but max is 0 [ 523.607283][ T5913] usb 7-1: config 179 has no interface number 0 [ 523.643297][ T5913] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 523.696859][ T5913] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 523.746847][ T5913] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 523.806742][ T5913] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 523.873719][ T5913] usb 7-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 523.904943][ T13] pimreg3 (unregistering): left allmulticast mode [ 523.919119][ T5913] usb 7-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 523.928404][ T5913] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 523.995407][T16707] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 524.236581][T16707] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 524.289348][T16707] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 524.546261][ T5913] usb 7-1: USB disconnect, device number 6 [ 524.552270][ C1] xpad 7-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 524.552329][ C1] xpad 7-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 525.189737][T15346] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 525.481183][ T13] team0 (unregistering): Port device team_slave_1 removed [ 525.508864][T15346] usb 2-1: Using ep0 maxpacket: 32 [ 525.537271][T15346] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 525.550071][T15346] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 525.564953][T15346] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 525.594165][T15346] usb 2-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 525.617225][T15346] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 525.638734][ T13] team0 (unregistering): Port device team_slave_0 removed [ 525.648557][T15346] usb 2-1: config 0 descriptor?? [ 525.790535][T16757] binder: 16756:16757 ioctl c0306201 200000001440 returned -11 [ 526.169333][T15346] input: HID 0458:5011 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0458:5011.0011/input/input23 [ 526.324102][T15346] input: HID 0458:5011 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0458:5011.0011/input/input24 [ 526.381342][T15511] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 526.474960][T15346] kye 0003:0458:5011.0011: input,hiddev0,hidraw0: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.1-1/input0 [ 526.539713][T15346] usb 2-1: USB disconnect, device number 10 [ 526.549265][T15511] usb 6-1: Using ep0 maxpacket: 16 [ 526.567276][T15511] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 526.617043][T15511] usb 6-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 526.644426][ T10] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000024: -71 [ 526.660492][ T10] smsc95xx 5-1:0.67: probe with driver smsc95xx failed with error -71 [ 526.679419][T15511] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 526.684902][T16762] fido_id[16762]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/2-1/report_descriptor': No such file or directory [ 526.696215][T15511] usb 6-1: Product: syz [ 526.717921][T15511] usb 6-1: Manufacturer: syz [ 526.730973][ T10] usb 5-1: USB disconnect, device number 14 [ 526.756079][T15511] usb 6-1: SerialNumber: syz [ 526.802699][T15511] usb 6-1: config 0 descriptor?? [ 526.816104][T15511] asix 6-1:0.0: probe with driver asix failed with error -22 [ 527.078216][T15511] usb 6-1: USB disconnect, device number 5 [ 527.459278][T16773] overlayfs: failed to create directory ./bus/work (errno: 13); mounting read-only [ 527.469615][T16773] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 527.797632][T16741] bridge0: port 3(bond0) entered blocking state [ 527.804848][T16741] bridge0: port 3(bond0) entered disabled state [ 527.818898][T16741] bond0: entered allmulticast mode [ 527.832998][T16741] bond_slave_0: entered allmulticast mode [ 527.846988][T16741] bond_slave_1: entered allmulticast mode [ 527.867274][T16741] bond0: entered promiscuous mode [ 527.874769][T16741] bond_slave_0: entered promiscuous mode [ 527.882252][T16741] bond_slave_1: entered promiscuous mode [ 527.899011][T16741] bridge0: port 3(bond0) entered blocking state [ 527.905478][T16741] bridge0: port 3(bond0) entered forwarding state [ 527.983342][T16767] wg1 speed is unknown, defaulting to 1000 [ 528.205262][T16791] binder: 16789:16791 ioctl c0306201 200000001440 returned -11 [ 528.239148][T16793] veth1_macvtap: mtu less than device minimum [ 528.450367][T16800] wg1 speed is unknown, defaulting to 1000 [ 528.949100][ T5913] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 529.119251][ T5913] usb 7-1: Using ep0 maxpacket: 32 [ 529.130678][ T5913] usb 7-1: config 0 has an invalid interface number: 67 but max is 0 [ 529.179079][ T5913] usb 7-1: config 0 has no interface number 0 [ 529.190256][ T5913] usb 7-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 529.203296][ T5913] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 529.211649][ T5913] usb 7-1: Product: syz [ 529.216110][ T5913] usb 7-1: Manufacturer: syz [ 529.221046][ T5913] usb 7-1: SerialNumber: syz [ 529.239679][ T5913] usb 7-1: config 0 descriptor?? [ 529.248572][ T5913] smsc95xx v2.0.0 [ 529.679852][T15511] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 529.803548][ T5913] smsc95xx 7-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 529.814584][ T5913] smsc95xx 7-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 529.919096][T15511] usb 5-1: Using ep0 maxpacket: 16 [ 529.927533][T15511] usb 5-1: config 0 has an invalid interface number: 251 but max is 0 [ 529.938548][T15511] usb 5-1: config 0 has no interface number 0 [ 529.945221][T15511] usb 5-1: config 0 interface 251 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 16 [ 529.955826][T15511] usb 5-1: config 0 interface 251 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 529.968644][T15511] usb 5-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 529.998320][T15511] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 530.027299][T15511] usb 5-1: Product: syz [ 530.037941][T15511] usb 5-1: Manufacturer: syz [ 530.049085][T15511] usb 5-1: SerialNumber: syz [ 530.057283][T15511] usb 5-1: config 0 descriptor?? [ 530.083129][T16823] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 530.119280][T16823] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 530.228277][ T5913] smsc95xx 7-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000108: -71 [ 530.258387][ T5913] smsc95xx 7-1:0.67: probe with driver smsc95xx failed with error -71 [ 530.307062][ T5913] usb 7-1: USB disconnect, device number 7 [ 530.352399][T16823] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 530.379199][T16823] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 530.651065][T15511] asix 5-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 530.669050][T15511] asix 5-1:0.251 (unnamed net_device) (uninitialized): Failed to read MAC address: -71 [ 530.702540][T15511] asix 5-1:0.251: probe with driver asix failed with error -5 [ 530.750620][T15511] usb 5-1: USB disconnect, device number 15 [ 531.522232][T16859] binder: 16858:16859 ioctl c0306201 200000001440 returned -11 [ 533.178763][T16904] wg1 speed is unknown, defaulting to 1000 [ 533.470270][T16918] binder: 16916:16918 ioctl c0306201 200000001440 returned -11 [ 534.549201][ T30] audit: type=1800 audit(1753958213.861:310): pid=16944 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.3.3747" name="/" dev="9p" ino=2 res=0 errno=0 [ 534.589813][T16944] netfs: Couldn't get user pages (rc=-14) [ 535.513875][T16959] binder: 16958:16959 ioctl c0306201 200000001440 returned -11 [ 535.639177][ T5847] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 535.849297][ T5847] usb 6-1: Using ep0 maxpacket: 32 [ 535.873652][ T5847] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 535.921247][ T5847] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 535.959971][ T5847] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 535.994481][ T5847] usb 6-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 536.036642][ T5847] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 536.083248][ T5847] usb 6-1: config 0 descriptor?? [ 536.092861][T16982] wg1 speed is unknown, defaulting to 1000 [ 536.359108][ T5913] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 536.526048][ C0] raw-gadget.0 gadget.5: ignoring, device is not running [ 536.530099][ T5913] usb 5-1: Using ep0 maxpacket: 32 [ 536.549672][ T5847] usbhid 6-1:0.0: can't add hid device: -71 [ 536.558790][ T5913] usb 5-1: config 0 has an invalid interface number: 67 but max is 0 [ 536.575197][ T5913] usb 5-1: config 0 has no interface number 0 [ 536.577855][ T5847] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 536.621099][ T5913] usb 5-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 536.627480][ T5847] usb 6-1: USB disconnect, device number 6 [ 536.646113][ T5913] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 536.690964][ T5913] usb 5-1: Product: syz [ 536.713184][ T5913] usb 5-1: Manufacturer: syz [ 536.727662][ T5913] usb 5-1: SerialNumber: syz [ 536.835143][ T5913] usb 5-1: config 0 descriptor?? [ 536.854261][ T5913] smsc95xx v2.0.0 [ 537.423029][ T5913] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 537.434081][ T5913] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 538.298289][T17033] cgroup: Need name or subsystem set [ 538.419423][T17035] binder: 17034:17035 ioctl 4018620d 0 returned -22 [ 538.480844][T17035] binder: 17034:17035 ioctl c0306201 200000001440 returned -11 [ 539.049190][ T24] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 539.229472][ T24] usb 7-1: config 0 interface 0 altsetting 128 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 539.268676][ T24] usb 7-1: config 0 interface 0 altsetting 128 endpoint 0x81 has invalid wMaxPacketSize 0 [ 539.288561][ T24] usb 7-1: config 0 interface 0 has no altsetting 0 [ 539.295931][ T24] usb 7-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 539.305608][ T24] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 539.330552][ T24] usb 7-1: config 0 descriptor?? [ 539.967966][ T24] usb 7-1: string descriptor 0 read error: -71 [ 539.982662][ T24] uclogic 0003:256C:006D.0012: failed retrieving string descriptor #200: -71 [ 540.003569][ T24] uclogic 0003:256C:006D.0012: failed retrieving pen parameters: -71 [ 540.021845][ T24] uclogic 0003:256C:006D.0012: failed probing pen v2 parameters: -71 [ 540.039183][ T5913] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 540.099333][ T5913] smsc95xx 5-1:0.67: probe with driver smsc95xx failed with error -71 [ 540.147381][ T24] uclogic 0003:256C:006D.0012: failed probing parameters: -71 [ 540.188678][ T5913] usb 5-1: USB disconnect, device number 16 [ 540.211948][ T24] uclogic 0003:256C:006D.0012: probe with driver uclogic failed with error -71 [ 540.264913][ T24] usb 7-1: USB disconnect, device number 8 [ 540.612614][T17078] wg1 speed is unknown, defaulting to 1000 [ 540.660920][T14464] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 540.849940][T14464] usb 2-1: Using ep0 maxpacket: 32 [ 540.881084][T14464] usb 2-1: config index 0 descriptor too short (expected 29220, got 36) [ 540.894768][T14464] usb 2-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 540.919267][T14464] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 540.939159][T14464] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 540.977554][T14464] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 541.014209][T14464] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 541.069411][T14464] usb 2-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 541.078554][T14464] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 541.169075][T14464] usb 2-1: config 0 descriptor?? [ 541.417196][T14464] usblp 2-1:0.0: usblp0: USB Bidirectional printer dev 11 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 541.478904][T14464] usb 2-1: USB disconnect, device number 11 [ 541.526818][T14464] usblp0: removed [ 541.929610][T14464] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 542.159346][T14464] usb 2-1: Using ep0 maxpacket: 32 [ 542.175820][T14464] usb 2-1: config index 0 descriptor too short (expected 29220, got 36) [ 542.215192][T14464] usb 2-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 542.239022][T14464] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 542.260955][T14464] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 542.309109][T14464] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 542.318905][T14464] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 542.351678][T14464] usb 2-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 542.365456][T14464] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 542.389812][T14464] usb 2-1: config 0 descriptor?? [ 542.562209][T17105] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 542.568502][T17105] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 542.586408][T17105] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 542.597951][T17105] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 542.606311][T17105] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 542.618277][T14464] usblp 2-1:0.0: usblp0: USB Bidirectional printer dev 12 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 542.820933][T15511] usb 2-1: USB disconnect, device number 12 [ 542.865219][T15511] usblp0: removed [ 542.870622][ T10] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 543.049216][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 543.064990][ T10] usb 5-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 543.079746][ T10] usb 5-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 543.091218][ T10] usb 5-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 543.119047][ T10] usb 5-1: config 0 interface 0 has no altsetting 0 [ 543.136055][ T10] usb 5-1: New USB device found, idVendor=050d, idProduct=3201, bcdDevice= 0.00 [ 543.146506][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 543.167578][ T10] usb 5-1: config 0 descriptor?? [ 543.172829][ T5847] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 543.349297][ T5847] usb 6-1: Using ep0 maxpacket: 32 [ 543.381587][ T5847] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 543.398083][T17111] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 543.412668][ T5847] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 543.426352][T17111] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 543.437912][ T5847] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 543.452648][ T5847] usb 6-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 543.462731][ T5847] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 543.483752][ T5847] usb 6-1: config 0 descriptor?? [ 543.798486][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 543.828141][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 543.840133][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 543.847273][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 543.854457][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 543.914930][T17118] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 543.965490][T17118] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 544.099174][ T5854] Bluetooth: hci7: command 0x0406 tx timeout [ 544.185311][ T5847] hid (null): usage index exceeded [ 544.194668][ T5847] hid (null): report_id 1629957346 is invalid [ 544.200985][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 544.208171][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 544.215353][ T5847] hid (null): unknown global tag 0xc [ 544.221264][ T5847] hid (null): unknown global tag 0xd [ 544.226615][ T5847] hid (null): unknown global tag 0xd [ 544.232275][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 544.243222][ T5847] hid (null): unknown global tag 0xe [ 544.249071][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 544.256165][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 544.277055][ T5847] input: HID 0458:5011 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:0458:5011.0014/input/input25 [ 544.295118][T17140] wg1 speed is unknown, defaulting to 1000 [ 544.303023][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 544.310732][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 544.349410][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 544.356617][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 544.373246][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 544.404291][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 544.530354][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 544.537397][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 544.551062][ T5847] input: HID 0458:5011 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:0458:5011.0014/input/input26 [ 544.563330][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 544.579254][ T5854] Bluetooth: hci0: command 0x0c1a tx timeout [ 544.592629][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 544.623848][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 544.660812][ T5854] Bluetooth: hci1: command 0x0c1a tx timeout [ 544.660830][ T51] Bluetooth: hci2: command 0x0c1a tx timeout [ 544.666955][ T5854] Bluetooth: hci3: command 0x0c1a tx timeout [ 544.692491][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 544.700793][ T5847] kye 0003:0458:5011.0014: input,hiddev0,hidraw0: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.5-1/input0 [ 544.724072][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 544.741475][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 544.760720][ T5847] usb 6-1: USB disconnect, device number 7 [ 544.769889][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 544.778382][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 544.791371][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 544.799769][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 544.806924][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 544.833563][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 544.861106][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 544.868235][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 544.918607][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 544.949052][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 544.970446][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 545.019183][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 545.026323][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 545.046295][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 545.071730][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 545.084941][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 545.107386][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 545.126361][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 545.152453][T17151] fido_id[17151]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/6-1/report_descriptor': No such file or directory [ 545.169327][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 545.176439][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 545.216172][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 545.241838][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 545.278766][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 545.327993][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 545.355691][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 545.382923][T17157] binder: 17156:17157 ioctl 4018620d 0 returned -22 [ 545.410230][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 545.418362][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 545.438442][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 545.449244][T17157] binder: 17156:17157 ioctl c0306201 200000001440 returned -11 [ 545.457081][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 545.485858][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 545.504536][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 545.524545][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 545.573456][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 545.609207][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 545.626762][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x1 [ 545.645899][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 545.662097][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 545.705861][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 545.722482][T17162] kvm: user requested TSC rate below hardware speed [ 545.909332][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 545.919523][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x2 [ 545.926554][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 545.940918][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 545.948128][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 545.982039][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 545.996383][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 546.028487][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 546.046609][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 546.059556][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 546.091430][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 546.149778][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 546.189235][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 546.196369][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 546.289146][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x1 [ 546.296556][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 546.369675][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 546.398022][ T10] belkin 0003:050D:3201.0013: unknown main item tag 0x0 [ 546.416359][ T10] belkin 0003:050D:3201.0013: unexpected long global item [ 546.426489][ T94] block nbd2: Possible stuck request ffff88802551e000: control (read@0,1024B). Runtime 240 seconds [ 546.437817][ T94] block nbd2: Possible stuck request ffff88802551e1c0: control (read@1024,1024B). Runtime 240 seconds [ 546.459218][ T94] block nbd2: Possible stuck request ffff88802551e380: control (read@2048,1024B). Runtime 240 seconds [ 546.470773][ T94] block nbd2: Possible stuck request ffff88802551e540: control (read@3072,1024B). Runtime 240 seconds [ 546.483997][ T10] belkin 0003:050D:3201.0013: parse failed [ 546.494373][ T10] belkin 0003:050D:3201.0013: probe with driver belkin failed with error -22 [ 546.510029][ T10] usb 5-1: USB disconnect, device number 17 [ 547.979171][T17198] binder: 17196:17198 ioctl 4018620d 0 returned -22 [ 548.045086][T17198] binder: 17196:17198 ioctl c0306201 200000001440 returned -11 [ 548.117320][T17203] kvm: user requested TSC rate below hardware speed [ 548.283160][T17210] wg1 speed is unknown, defaulting to 1000 [ 550.019690][ T5847] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 550.249141][ T5847] usb 2-1: Using ep0 maxpacket: 32 [ 550.304011][ T5847] usb 2-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 550.354520][ T5847] usb 2-1: config 0 interface 0 has no altsetting 0 [ 550.383503][ T5847] usb 2-1: New USB device found, idVendor=046d, idProduct=c29a, bcdDevice= 0.00 [ 550.417666][ T5847] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 550.480441][ T5847] usb 2-1: config 0 descriptor?? [ 550.733956][T17242] binder: BINDER_SET_CONTEXT_MGR already set [ 550.778059][T17242] binder: 17241:17242 ioctl 4018620d 200000000040 returned -16 [ 550.826320][T17242] binder: 17241:17242 ioctl c0306201 200000001440 returned -11 [ 550.941645][ T5847] logitech 0003:046D:C29A.0015: unknown main item tag 0x0 [ 550.960910][ T5847] logitech 0003:046D:C29A.0015: unknown main item tag 0x0 [ 550.968534][ T5847] logitech 0003:046D:C29A.0015: unknown main item tag 0x0 [ 551.015478][ T5847] logitech 0003:046D:C29A.0015: unknown main item tag 0x0 [ 551.049790][ T5847] logitech 0003:046D:C29A.0015: unknown main item tag 0x0 [ 551.079578][ T5847] logitech 0003:046D:C29A.0015: hidraw0: USB HID v0.01 Device [HID 046d:c29a] on usb-dummy_hcd.1-1/input0 [ 551.109062][ T5847] logitech 0003:046D:C29A.0015: no inputs found [ 551.154240][ T24] usb 2-1: USB disconnect, device number 13 [ 551.285343][T17248] fido_id[17248]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 551.342640][T17254] kvm: user requested TSC rate below hardware speed [ 552.873318][T17284] binder: BINDER_SET_CONTEXT_MGR already set [ 552.879874][T17284] binder: 17283:17284 ioctl 4018620d 200000000040 returned -16 [ 552.905793][T17284] binder: 17283:17284 ioctl c0306201 200000001440 returned -11 [ 552.964786][T15511] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 553.146908][T15511] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 553.173246][T15511] usb 4-1: config 0 has no interfaces? [ 553.188917][T15511] usb 4-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 553.221034][T15511] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 553.254348][T15511] usb 4-1: config 0 descriptor?? [ 553.837659][T17295] wg1 speed is unknown, defaulting to 1000 [ 553.989682][T17299] kvm: user requested TSC rate below hardware speed [ 555.269156][ T5913] usb 5-1: new full-speed USB device number 18 using dummy_hcd [ 555.471215][ T5913] usb 5-1: config 0 has no interfaces? [ 555.482316][ T5913] usb 5-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 555.528242][ T5913] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 555.590157][ T5913] usb 5-1: config 0 descriptor?? [ 555.669298][T15511] usb 4-1: USB disconnect, device number 17 [ 555.843867][T15347] usb 5-1: USB disconnect, device number 18 [ 555.999421][T17334] binder: BINDER_SET_CONTEXT_MGR already set [ 556.014933][T17334] binder: 17329:17334 ioctl 4018620d 200000000040 returned -16 [ 556.074102][T17334] binder: 17329:17334 ioctl c0306201 200000001440 returned -11 [ 556.506700][T17344] kvm: user requested TSC rate below hardware speed [ 557.831210][T17359] wg1 speed is unknown, defaulting to 1000 [ 558.755971][T17379] binder: 17378:17379 ioctl c0306201 0 returned -14 [ 558.850019][T17379] binder: 17378:17379 ioctl c0306201 200000001440 returned -11 [ 559.206080][T17388] kvm: user requested TSC rate below hardware speed [ 561.424175][T17420] binder: BINDER_SET_CONTEXT_MGR already set [ 561.448883][T17420] binder: 17418:17420 ioctl 4018620d 200000000040 returned -16 [ 561.494549][T17420] binder: 17418:17420 ioctl c0306201 200000001440 returned -11 [ 562.450181][T17433] kvm: user requested TSC rate below hardware speed [ 563.063852][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.070521][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.241607][T17459] binder: 17458:17459 ioctl c0306201 0 returned -14 [ 563.289327][T17459] binder: 17458:17459 ioctl c0306201 200000001440 returned -11 [ 564.912661][T17483] kvm: user requested TSC rate below hardware speed [ 565.680658][T17502] binder: 17501:17502 ioctl c0306201 200000001440 returned -11 [ 567.227740][ T2931] Bluetooth: hci4: Frame reassembly failed (-84) [ 567.244906][ T2931] Bluetooth: hci4: Frame reassembly failed (-84) [ 568.269914][T17537] loop8: detected capacity change from 0 to 79 [ 568.296817][T17538] kvm: user requested TSC rate below hardware speed [ 568.320134][T17537] loop8: detected capacity change from 79 to 78 [ 568.538843][T17542] binder: 17541:17542 ioctl c0306201 200000001440 returned -11 [ 569.299411][ T51] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 569.299999][ T5854] Bluetooth: hci0: command 0x0c1a tx timeout [ 569.306006][ T5840] Bluetooth: hci4: command 0x1003 tx timeout [ 569.312138][T17526] Bluetooth: hci0: Opcode 0x0401 failed: -110 [ 570.133629][T17580] kvm: user requested TSC rate below hardware speed [ 570.475562][T17587] binder: 17586:17587 ioctl c0306201 200000001440 returned -11 [ 572.097565][T17615] kvm: user requested TSC rate below hardware speed [ 572.184679][T17619] random: crng reseeded on system resumption [ 572.417703][T17626] input: syz0 as /devices/virtual/input/input27 [ 574.131328][T17658] binder: BINDER_SET_CONTEXT_MGR already set [ 574.154866][T17658] binder: 17655:17658 ioctl 4018620d 200000000140 returned -16 [ 574.287390][T17659] kvm: user requested TSC rate below hardware speed [ 575.439123][T15346] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 575.599193][T15346] usb 4-1: Using ep0 maxpacket: 32 [ 575.630440][T15346] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 575.649113][T15346] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 575.679083][T15346] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 575.712431][T15346] usb 4-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 575.741944][T15346] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 575.777485][T15346] usb 4-1: config 0 descriptor?? [ 575.829601][T15511] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 575.993736][T15511] usb 2-1: Using ep0 maxpacket: 32 [ 576.014458][T15511] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 576.033592][T15511] usb 2-1: config 0 has no interface number 0 [ 576.103369][T15511] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 576.152889][T15511] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 576.197231][T15511] usb 2-1: Product: syz [ 576.222975][T15511] usb 2-1: Manufacturer: syz [ 576.268348][T15511] usb 2-1: SerialNumber: syz [ 576.346965][T15511] usb 2-1: config 0 descriptor?? [ 576.385189][T15511] smsc95xx v2.0.0 [ 576.505554][ T94] block nbd2: Possible stuck request ffff88802551e000: control (read@0,1024B). Runtime 270 seconds [ 576.509309][T15346] input: HID 0458:5011 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0458:5011.0016/input/input28 [ 576.516727][ T94] block nbd2: Possible stuck request ffff88802551e1c0: control (read@1024,1024B). Runtime 270 seconds [ 576.539281][ T94] block nbd2: Possible stuck request ffff88802551e380: control (read@2048,1024B). Runtime 270 seconds [ 576.550465][ T94] block nbd2: Possible stuck request ffff88802551e540: control (read@3072,1024B). Runtime 270 seconds [ 576.665747][T15346] input: HID 0458:5011 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0458:5011.0016/input/input29 [ 576.796222][T15511] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 576.809058][T15346] kye 0003:0458:5011.0016: input,hiddev0,hidraw0: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.3-1/input0 [ 576.819506][T15346] usb 4-1: USB disconnect, device number 18 [ 576.836655][T15511] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 576.899368][ T5847] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 576.909874][T14464] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 576.966451][T17696] fido_id[17696]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/4-1/report_descriptor': No such file or directory [ 577.164519][T17700] kvm: user requested TSC rate below hardware speed [ 577.290835][T14464] usb 5-1: Using ep0 maxpacket: 32 [ 577.297098][ T5847] usb 6-1: Using ep0 maxpacket: 32 [ 577.308632][T14464] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 577.322440][ T5847] usb 6-1: config 0 has an invalid interface number: 184 but max is 0 [ 577.334714][ T5847] usb 6-1: config 0 has no interface number 0 [ 577.340976][T14464] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 577.351300][ T5847] usb 6-1: config 0 interface 184 has no altsetting 0 [ 578.007082][T14464] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 578.021149][T14464] usb 5-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 578.037175][T14464] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 578.047312][ T5847] usb 6-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 578.058477][ T5847] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 578.067908][T14464] usb 5-1: config 0 descriptor?? [ 578.073280][ T5847] usb 6-1: Product: syz [ 578.077665][ T5847] usb 6-1: Manufacturer: syz [ 578.089550][ T5847] usb 6-1: SerialNumber: syz [ 578.098094][ T5847] usb 6-1: config 0 descriptor?? [ 578.110564][ T5847] smsc75xx v1.0.0 [ 578.564403][T14464] input: HID 0458:5011 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:0458:5011.0017/input/input30 [ 578.683488][T14464] input: HID 0458:5011 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:0458:5011.0017/input/input31 [ 578.726968][ T5847] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 578.741810][ T5847] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 578.764463][ T5847] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 578.798056][T14464] kye 0003:0458:5011.0017: input,hiddev0,hidraw0: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.4-1/input0 [ 578.814590][ T5847] smsc75xx 6-1:0.184: probe with driver smsc75xx failed with error -71 [ 578.885581][T14464] usb 5-1: USB disconnect, device number 19 [ 578.962927][ T5847] usb 6-1: USB disconnect, device number 8 [ 580.641274][T15511] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000024: -71 [ 580.695744][T15511] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -71 [ 580.732877][T15511] usb 2-1: USB disconnect, device number 14 [ 580.941749][T17742] kvm: user requested TSC rate below hardware speed [ 581.769160][T15511] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 581.936295][T15511] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 581.956588][T15511] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 581.976075][T15511] usb 4-1: Product: syz [ 581.994824][T15511] usb 4-1: Manufacturer: syz [ 582.007967][T15511] usb 4-1: SerialNumber: syz [ 582.209180][ T24] usb 2-1: new full-speed USB device number 15 using dummy_hcd [ 582.381915][ T24] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 582.412270][ T24] usb 2-1: config 179 has no interface number 0 [ 582.435094][ T24] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 10 [ 582.470926][ T24] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 64 [ 582.487163][ T24] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 582.513319][ T24] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 45824, setting to 64 [ 582.531069][ T24] usb 2-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 582.553257][ T24] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 582.565721][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 582.608147][T17773] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 582.628153][T17773] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 582.871627][T14464] usb 2-1: USB disconnect, device number 15 [ 582.871627][ C1] xpad 2-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 582.871675][ C1] xpad 2-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 582.946546][T17779] kvm: user requested TSC rate below hardware speed [ 583.186961][T17785] ./file0: Can't lookup blockdev [ 583.357521][T15511] cdc_ncm 4-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 583.370756][T15511] cdc_ncm 4-1:1.0: setting tx_max = 184 [ 583.699206][T15347] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 583.707451][T15511] cdc_ncm 4-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.3-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 583.752396][T15511] usb 4-1: USB disconnect, device number 19 [ 583.768915][T15511] cdc_ncm 4-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.3-1, CDC NCM (NO ZLP) [ 583.849240][T15347] usb 5-1: Using ep0 maxpacket: 32 [ 583.856436][T15347] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 583.888322][T15347] usb 5-1: config 0 has no interface number 0 [ 583.912266][T15347] usb 5-1: config 0 interface 184 has no altsetting 0 [ 583.946960][T15347] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 583.966791][T15347] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 583.984300][T15347] usb 5-1: Product: syz [ 583.998753][T15347] usb 5-1: Manufacturer: syz [ 584.008640][T15347] usb 5-1: SerialNumber: syz [ 584.022532][T15347] usb 5-1: config 0 descriptor?? [ 584.051431][T15347] smsc75xx v1.0.0 [ 584.383790][T17801] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4003'. [ 584.602266][T17807] kvm: user requested TSC rate below hardware speed [ 584.655023][ T30] audit: type=1326 audit(1753958263.971:311): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=17809 comm="syz.1.4007" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f656f58e9a9 code=0x0 [ 584.678919][T15347] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 584.698093][T15347] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 584.914263][T15347] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -32 [ 584.958085][T15347] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -32 [ 584.983066][T15347] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 585.036892][T15347] smsc75xx 5-1:0.184: probe with driver smsc75xx failed with error -32 [ 587.049585][T14464] usb 5-1: USB disconnect, device number 20 [ 587.992284][T17860] kvm: user requested TSC rate below hardware speed [ 588.563156][T17881] syz_tun: entered allmulticast mode [ 589.247699][T17871] syz_tun: left allmulticast mode [ 589.705412][T17907] kvm: user requested TSC rate below hardware speed [ 590.591335][T17925] netlink: 44 bytes leftover after parsing attributes in process `syz.4.4040'. [ 590.601376][T17925] netlink: 'syz.4.4040': attribute type 6 has an invalid length. [ 590.609550][T17925] netlink: 'syz.4.4040': attribute type 5 has an invalid length. [ 590.628806][T17925] netlink: 'syz.4.4040': attribute type 4 has an invalid length. [ 590.840006][T17925] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4040'. [ 591.519181][T15511] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 591.557092][T15346] hid-generic 0000:0000:0000.0018: unknown main item tag 0x0 [ 591.601632][T15346] hid-generic 0000:0000:0000.0018: hidraw0: HID v0.00 Device [syz1] on syz0 [ 591.686119][T17945] binder: 17944:17945 ioctl 4018620d 0 returned -22 [ 591.720186][T15511] usb 6-1: config 160 has an invalid interface number: 200 but max is 0 [ 591.728766][T15511] usb 6-1: config 160 has no interface number 0 [ 591.767478][T17945] binder: 17944:17945 ioctl c0306201 200000001440 returned -11 [ 591.826228][T15511] usb 6-1: config 160 interface 200 has no altsetting 0 [ 591.871836][T15511] usb 6-1: New USB device found, idVendor=21bb, idProduct=2070, bcdDevice=87.0b [ 591.902619][T15511] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 591.939069][T15511] usb 6-1: Product: syz [ 591.943477][T15511] usb 6-1: Manufacturer: syz [ 591.948147][T15511] usb 6-1: SerialNumber: syz [ 592.214795][T15511] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 592.242540][T15511] usb 6-1: MIDIStreaming interface descriptor not found [ 592.354058][T15511] usb 6-1: USB disconnect, device number 9 [ 593.129319][T17965] netlink: 56 bytes leftover after parsing attributes in process `syz.5.4051'. [ 593.195212][T17965] netlink: 56 bytes leftover after parsing attributes in process `syz.5.4051'. [ 593.552601][T17974] binder: 17973:17974 ioctl 4018620d 0 returned -22 [ 593.565328][T17974] binder: 17973:17974 ioctl c0306201 200000001440 returned -11 [ 593.599277][T17976] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 593.757832][T17982] syz_tun: entered promiscuous mode [ 593.766947][T17982] vlan2: entered promiscuous mode [ 594.169578][ T10] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 594.209951][ T30] audit: type=1326 audit(1753958273.501:312): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=18000 comm="syz.6.4067" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff989d8e9a9 code=0x7ffc0000 [ 594.272004][ T30] audit: type=1326 audit(1753958273.501:313): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=18000 comm="syz.6.4067" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff989d8e9a9 code=0x7ffc0000 [ 594.298447][T18003] binder: BINDER_SET_CONTEXT_MGR already set [ 594.321173][ T30] audit: type=1326 audit(1753958273.511:314): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=18000 comm="syz.6.4067" exe="/root/syz-executor" sig=0 arch=c000003e syscall=67 compat=0 ip=0x7ff989d8e9a9 code=0x7ffc0000 [ 594.329670][T18003] binder: 18002:18003 ioctl 4018620d 200000000040 returned -16 [ 594.350685][ T30] audit: type=1326 audit(1753958273.511:315): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=18000 comm="syz.6.4067" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff989d8e9a9 code=0x7ffc0000 [ 594.350733][ T30] audit: type=1326 audit(1753958273.511:316): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=18000 comm="syz.6.4067" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff989d8e9a9 code=0x7ffc0000 [ 594.412215][T18004] binder: 18002:18004 ioctl c0306201 0 returned -14 [ 594.419267][ T10] usb 4-1: Using ep0 maxpacket: 8 [ 594.429454][ T10] usb 4-1: config 162 has an invalid interface number: 63 but max is 0 [ 594.465839][ T10] usb 4-1: config 162 has no interface number 0 [ 594.478124][ T10] usb 4-1: config 162 interface 63 has no altsetting 0 [ 594.493211][T18003] binder: 18002:18003 ioctl c0306201 200000001440 returned -11 [ 594.521021][ T10] usb 4-1: New USB device found, idVendor=0644, idProduct=800f, bcdDevice=ed.a9 [ 594.583529][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 594.596466][ T10] usb 4-1: Product: syz [ 594.603938][ T10] usb 4-1: Manufacturer: syz [ 594.608586][ T10] usb 4-1: SerialNumber: syz [ 595.908602][T18029] netlink: 'syz.1.4074': attribute type 1 has an invalid length. [ 596.551002][T18044] binder: 18041:18044 ioctl c0306201 0 returned -14 [ 596.582848][T18044] binder: 18041:18044 ioctl c0306201 200000001440 returned -11 [ 597.008180][ T10] usb 4-1: disable ehci-hcd to run US-144 [ 597.041718][ T10] usb 4-1: USB disconnect, device number 20 [ 597.445362][T18072] loop2: detected capacity change from 0 to 7 [ 597.465081][T18072] loop2: [ 597.468345][T18072] loop2: partition table partially beyond EOD, truncated [ 597.565530][T18077] netlink: 104 bytes leftover after parsing attributes in process `syz.5.4095'. [ 597.727654][T18080] binder: 18079:18080 ioctl c0306201 0 returned -14 [ 597.739512][T18080] binder: 18079:18080 ioctl c0306201 200000001440 returned -11 [ 598.125621][T18091] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4101'. [ 598.419261][ T5854] Bluetooth: hci7: command 0x0406 tx timeout [ 598.425913][T18038] Bluetooth: hci7: Opcode 0x0c1a failed: -110 [ 599.186797][T18093] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4102'. [ 599.197681][T18038] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 599.206382][T18038] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 599.218001][T18038] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 599.231108][T18038] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 599.489093][T15347] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 599.562818][T18108] capability: warning: `syz.3.4110' uses 32-bit capabilities (legacy support in use) [ 599.739223][T15347] usb 7-1: Using ep0 maxpacket: 8 [ 600.019198][T15347] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 600.048604][T15347] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 600.068634][T15347] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 600.121703][T15347] usb 7-1: New USB device found, idVendor=112a, idProduct=0005, bcdDevice=14.a8 [ 600.133186][T15347] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 600.141545][T15347] usb 7-1: Product: syz [ 600.146795][T15347] usb 7-1: Manufacturer: syz [ 600.152789][T15347] usb 7-1: SerialNumber: syz [ 600.213135][T15347] usb 7-1: config 0 descriptor?? [ 600.234497][T15347] redrat3 7-1:0.0: Couldn't find all endpoints [ 600.442732][ T10] usb 7-1: USB disconnect, device number 9 [ 600.499168][ T5854] Bluetooth: hci0: command 0x0c1a tx timeout [ 601.006865][T18133] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4119'. [ 601.229260][ T5854] Bluetooth: hci2: command 0x0c1a tx timeout [ 601.235682][ T5854] Bluetooth: hci3: command 0x0c1a tx timeout [ 601.299291][ T51] Bluetooth: hci1: command 0x0c1a tx timeout [ 603.684454][T18196] binder: 18195:18196 ioctl c0306201 200000001440 returned -11 [ 605.500460][T18232] binder: 18231:18232 ioctl c0306201 200000001440 returned -11 [ 605.611102][T18238] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4152'. [ 606.584810][ T94] block nbd2: Possible stuck request ffff88802551e000: control (read@0,1024B). Runtime 300 seconds [ 606.595650][ T94] block nbd2: Possible stuck request ffff88802551e1c0: control (read@1024,1024B). Runtime 300 seconds [ 606.608740][ T94] block nbd2: Possible stuck request ffff88802551e380: control (read@2048,1024B). Runtime 300 seconds [ 606.619894][ T94] block nbd2: Possible stuck request ffff88802551e540: control (read@3072,1024B). Runtime 300 seconds [ 608.925333][ T30] audit: type=1326 audit(1753958288.241:317): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=18299 comm="syz.1.4176" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f656f58e9a9 code=0x7ffc0000 [ 609.075633][ T30] audit: type=1326 audit(1753958288.241:318): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=18299 comm="syz.1.4176" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f656f58e9a9 code=0x7ffc0000 [ 609.180247][ T30] audit: type=1326 audit(1753958288.241:319): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=18299 comm="syz.1.4176" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f656f52ab89 code=0x7ffc0000 [ 609.202401][ T30] audit: type=1326 audit(1753958288.241:320): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=18299 comm="syz.1.4176" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f656f58e9a9 code=0x7ffc0000 [ 609.225138][ T30] audit: type=1326 audit(1753958288.241:321): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=18299 comm="syz.1.4176" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f656f52ab89 code=0x7ffc0000 [ 609.248125][ T30] audit: type=1326 audit(1753958288.241:322): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=18299 comm="syz.1.4176" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f656f58e9a9 code=0x7ffc0000 [ 609.271711][T18315] wJ: entered promiscuous mode [ 609.318272][T18315] wJ (unregistering): Released all slaves [ 609.339899][ T30] audit: type=1326 audit(1753958288.241:323): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=18299 comm="syz.1.4176" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f656f52ab89 code=0x7ffc0000 [ 609.462168][ T30] audit: type=1326 audit(1753958288.241:324): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=18299 comm="syz.1.4176" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f656f58e9a9 code=0x7ffc0000 [ 609.591368][ T30] audit: type=1326 audit(1753958288.241:325): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=18299 comm="syz.1.4176" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f656f58e9a9 code=0x7ffc0000 [ 609.642392][ T30] audit: type=1326 audit(1753958288.241:326): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=18299 comm="syz.1.4176" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f656f52ab89 code=0x7ffc0000 [ 610.949120][T15346] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 610.949182][T15511] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 611.112356][T15346] usb 7-1: Using ep0 maxpacket: 8 [ 611.124570][T15346] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 611.146601][T15346] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 611.161932][T15346] usb 7-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 611.163048][T15511] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 611.174642][T15346] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 611.201104][T15346] usb 7-1: config 0 descriptor?? [ 611.211948][T15511] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 611.240035][T15511] usb 6-1: Product: syz [ 611.246619][T15511] usb 6-1: Manufacturer: syz [ 611.249595][T15347] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 611.264652][T15511] usb 6-1: SerialNumber: syz [ 611.283046][T15511] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 611.389213][T15347] usb 5-1: device descriptor read/64, error -71 [ 611.401729][ T5847] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 611.425996][ T5913] usb 7-1: USB disconnect, device number 10 [ 611.628645][ T24] usb 6-1: USB disconnect, device number 10 [ 611.636091][T15347] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 611.793501][T15347] usb 5-1: device descriptor read/64, error -71 [ 611.913375][T15347] usb usb5-port1: attempt power cycle [ 612.059213][T18377] syzkaller0: entered promiscuous mode [ 612.065122][T18377] syzkaller0: entered allmulticast mode [ 612.273649][T15347] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 612.309803][T15347] usb 5-1: device descriptor read/8, error -71 [ 612.435699][T18391] netlink: 16178 bytes leftover after parsing attributes in process `syz.1.4210'. [ 612.503906][ T5847] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 612.539283][ T5847] ath9k_htc: Failed to initialize the device [ 612.553791][ T24] usb 6-1: ath9k_htc: USB layer deinitialized [ 612.562043][T15347] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 612.616996][T15347] usb 5-1: device descriptor read/8, error -71 [ 612.650202][T18396] usb usb1: usbfs: process 18396 (syz.1.4213) did not claim interface 0 before use [ 612.742260][T15347] usb usb5-port1: unable to enumerate USB device [ 613.553869][T18421] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4223'. [ 613.999623][T15511] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 614.039121][T15347] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 614.122169][T18442] input: syz0 as /devices/virtual/input/input33 [ 614.159765][T15511] usb 7-1: Using ep0 maxpacket: 16 [ 614.173573][T15511] usb 7-1: unable to get BOS descriptor or descriptor too short [ 614.193745][T15511] usb 7-1: config 1 has an invalid interface number: 26 but max is 1 [ 614.211045][T15511] usb 7-1: config 1 has an invalid interface number: 89 but max is 1 [ 614.231964][T15511] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 614.232889][T15347] usb 6-1: Using ep0 maxpacket: 8 [ 614.244269][T15511] usb 7-1: config 1 has no interface number 0 [ 614.278742][T15511] usb 7-1: config 1 has no interface number 1 [ 614.287749][T15347] usb 6-1: config 0 has an invalid interface number: 55 but max is 0 [ 614.292435][T15511] usb 7-1: config 1 interface 26 altsetting 213 has 0 endpoint descriptors, different from the interface descriptor's value: 6 [ 614.317529][T15511] usb 7-1: config 1 interface 89 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 614.323173][T15347] usb 6-1: config 0 has no interface number 0 [ 614.332293][T15511] usb 7-1: config 1 interface 26 has no altsetting 0 [ 614.358346][T15347] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 614.379676][T15347] usb 6-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 614.399868][T15511] usb 7-1: config 1 interface 89 has no altsetting 0 [ 614.405026][T15347] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 614.430619][T15347] usb 6-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 614.432857][T15511] usb 7-1: New USB device found, idVendor=1f38, idProduct=0001, bcdDevice=29.ec [ 614.455168][T15347] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 614.459339][T15511] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 614.468788][T15347] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 614.478577][T15511] usb 7-1: Product: syz [ 614.489385][T15511] usb 7-1: Manufacturer: syz [ 614.494963][T15347] usb 6-1: config 0 descriptor?? [ 614.504433][T15511] usb 7-1: SerialNumber: syz [ 614.602767][T18454] wg1 speed is unknown, defaulting to 1000 [ 614.616899][T15347] ldusb 6-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 615.550215][T15511] usb 7-1: unknown interface protocol 0x7d, assuming v1 [ 615.559145][T15511] usb 7-1: 26:2 : does not exist [ 615.601191][ T5847] usb 6-1: USB disconnect, device number 11 [ 615.618444][ T5847] ldusb 6-1:0.55: LD USB Device #0 now disconnected [ 615.642381][T15511] usb 7-1: unknown interface protocol 0x13, assuming v1 [ 615.665589][T15511] usb 7-1: 89:0 : does not exist [ 615.751582][T15511] usb 7-1: USB disconnect, device number 11 [ 615.852195][T15997] udevd[15997]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.26/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 615.909111][T15347] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 616.110756][T18472] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4240'. [ 616.150876][T15347] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 616.178925][T15347] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 616.199413][T15347] usb 2-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 616.243199][T15347] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 616.299194][T15347] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 616.307335][T15347] usb 2-1: Product: syz [ 616.369299][T15347] usb 2-1: Manufacturer: syz [ 616.394406][T15347] usb 2-1: SerialNumber: syz [ 616.477553][T15347] cdc_mbim 2-1:1.0: skipping garbage [ 617.501083][T15347] cdc_mbim 2-1:1.0: bind() failure [ 617.515175][T15347] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 617.530038][T15347] cdc_ncm 2-1:1.1: bind() failure [ 617.712018][T15346] usb 2-1: USB disconnect, device number 16 [ 617.753329][T18498] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4248'. [ 618.815546][T18525] binder: BINDER_SET_CONTEXT_MGR already set [ 618.824535][T18525] binder: 18521:18525 ioctl 4018620d 200000000040 returned -16 [ 619.479669][T18525] binder: 18521:18525 ioctl c0306201 200000001440 returned -11 [ 620.229409][T18550] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4265'. [ 620.306497][T18550] syz_tun: entered promiscuous mode [ 621.341464][ T10] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 621.388709][T18582] futex_wake_op: syz.6.4275 tries to shift op by 32; fix this program [ 621.631355][ T10] usb 5-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 621.661178][ T10] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 621.694418][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 621.721493][ T10] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 621.881846][ T10] snd-usb-audio 5-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 623.467605][T18624] input: syz0 as /devices/virtual/input/input34 [ 624.518047][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.526583][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 625.241624][ T5854] Bluetooth: hci1: command 0x0c1a tx timeout [ 625.709098][ T10] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 626.034423][ T10] usb 6-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 626.161355][ T10] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 626.327897][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 626.444389][ T10] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 626.671043][ T10] snd-usb-audio 6-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 626.707258][T15997] udevd[15997]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 627.309149][ T5854] Bluetooth: hci1: command 0x0c1a tx timeout [ 627.497044][T18674] netlink: 16 bytes leftover after parsing attributes in process `syz.6.4307'. [ 627.567143][T18676] netlink: 'syz.1.4308': attribute type 29 has an invalid length. [ 627.577144][T18676] netlink: 'syz.1.4308': attribute type 29 has an invalid length. [ 627.665965][T18678] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4309'. [ 627.902025][T18689] netlink: 104 bytes leftover after parsing attributes in process `syz.3.4313'. [ 627.999842][ T10] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 628.200995][ T10] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 628.225320][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 628.279253][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 628.293977][ T10] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 628.348715][ T10] usb 2-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 628.358204][ T10] usb 2-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 628.372284][ T10] usb 2-1: Manufacturer: syz [ 628.388657][ T10] usb 2-1: config 0 descriptor?? [ 628.816277][ T10] appleir 0003:05AC:8243.0019: unknown main item tag 0x0 [ 628.854578][ T10] appleir 0003:05AC:8243.0019: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.1-1/input0 [ 629.449792][T15347] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 629.599080][T15347] usb 4-1: Using ep0 maxpacket: 32 [ 629.635420][T15347] usb 4-1: New USB device found, idVendor=0ac8, idProduct=c301, bcdDevice=82.d5 [ 629.652889][T15347] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 629.663321][T15347] usb 4-1: Product: syz [ 629.668047][T15347] usb 4-1: Manufacturer: syz [ 629.677054][T15347] usb 4-1: SerialNumber: syz [ 629.701751][T15347] usb 4-1: config 0 descriptor?? [ 629.716903][T15347] hub 4-1:0.0: bad descriptor, ignoring hub [ 629.725051][T15347] hub 4-1:0.0: probe with driver hub failed with error -5 [ 629.745902][T15347] gspca_main: vc032x-2.14.0 probing 0ac8:c301 [ 630.262200][T15347] gspca_vc032x: reg_w err -110 [ 630.272472][T15347] gspca_vc032x: I2c Bus Busy Wait 00 [ 630.284058][T15347] gspca_vc032x: I2c Bus Busy Wait 00 [ 630.296487][T15347] gspca_vc032x: I2c Bus Busy Wait 00 [ 630.302222][T15347] gspca_vc032x: I2c Bus Busy Wait 00 [ 630.307654][T15347] gspca_vc032x: I2c Bus Busy Wait 00 [ 630.313565][T15347] gspca_vc032x: I2c Bus Busy Wait 00 [ 630.318890][T15347] gspca_vc032x: I2c Bus Busy Wait 00 [ 630.324844][T15347] gspca_vc032x: I2c Bus Busy Wait 00 [ 630.330584][T15347] gspca_vc032x: I2c Bus Busy Wait 00 [ 630.336375][T15347] gspca_vc032x: I2c Bus Busy Wait 00 [ 630.342559][T15347] gspca_vc032x: I2c Bus Busy Wait 00 [ 630.355393][T15347] gspca_vc032x: I2c Bus Busy Wait 00 [ 630.365463][T15347] gspca_vc032x: I2c Bus Busy Wait 00 [ 630.382198][T15347] gspca_vc032x: I2c Bus Busy Wait 00 [ 630.393256][T15347] gspca_vc032x: I2c Bus Busy Wait 00 [ 630.403816][T15347] gspca_vc032x: I2c Bus Busy Wait 00 [ 630.409882][T15347] gspca_vc032x: I2c Bus Busy Wait 00 [ 630.415334][T15347] gspca_vc032x: I2c Bus Busy Wait 00 [ 630.425996][T15347] gspca_vc032x: I2c Bus Busy Wait 00 [ 630.431811][T15347] gspca_vc032x: Unknown sensor... [ 630.437798][T15347] vc032x 4-1:0.0: probe with driver vc032x failed with error -22 [ 630.472286][T18727] loop2: detected capacity change from 0 to 7 [ 630.494083][T15997] loop2: [ 630.497109][T15997] loop2: partition table partially beyond EOD, truncated [ 630.515755][T18727] loop2: [ 630.518900][T18727] loop2: partition table partially beyond EOD, truncated [ 630.536926][T18727] netlink: 104 bytes leftover after parsing attributes in process `syz.6.4325'. [ 630.706707][T18733] netlink: 'syz.6.4327': attribute type 1 has an invalid length. [ 630.755508][T18733] bond1: (slave veth3): Enslaving as an active interface with a down link [ 630.786683][T18733] bond1: (slave veth5): Enslaving as an active interface with a down link [ 630.797765][T18733] netlink: 28 bytes leftover after parsing attributes in process `syz.6.4327'. [ 630.813807][T18733] 8021q: adding VLAN 0 to HW filter on device bond1 [ 631.482946][ T10] usb 2-1: reset high-speed USB device number 17 using dummy_hcd [ 631.495554][ T10] usb 2-1: device reset changed ep0 maxpacket size! [ 631.511947][T14464] usb 2-1: USB disconnect, device number 17 [ 631.693800][T14464] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 631.699369][T15346] usb 4-1: USB disconnect, device number 21 [ 631.864095][T14464] usb 2-1: Using ep0 maxpacket: 8 [ 631.884103][T14464] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 631.904920][T14464] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 631.913484][T14464] usb 2-1: Product: syz [ 631.925871][T14464] usb 2-1: Manufacturer: syz [ 631.931162][T14464] usb 2-1: SerialNumber: syz [ 632.126827][ T5847] IPVS: starting estimator thread 0... [ 632.133719][T18755] @: renamed from vlan0 (while UP) [ 632.147425][T14464] usblp 2-1:1.0: usblp0: USB Unidirectional printer dev 18 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 632.229269][T18756] IPVS: using max 49 ests per chain, 117600 per kthread [ 632.707524][T15346] usb 2-1: USB disconnect, device number 18 [ 632.727378][T15346] usblp0: removed [ 634.289529][T18793] loop6: detected capacity change from 0 to 524287999 [ 636.077299][ T51] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 636.101863][ T51] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 636.111705][ T51] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 636.127492][ T51] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 636.139304][ T51] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 636.204969][T18839] wg1 speed is unknown, defaulting to 1000 [ 636.669092][ T94] block nbd2: Possible stuck request ffff88802551e000: control (read@0,1024B). Runtime 330 seconds [ 636.683847][ T94] block nbd2: Possible stuck request ffff88802551e1c0: control (read@1024,1024B). Runtime 330 seconds [ 636.694984][ T94] block nbd2: Possible stuck request ffff88802551e380: control (read@2048,1024B). Runtime 330 seconds [ 636.707791][ T94] block nbd2: Possible stuck request ffff88802551e540: control (read@3072,1024B). Runtime 330 seconds [ 637.075403][T18839] chnl_net:caif_netlink_parms(): no params data found [ 637.397988][T18858] netlink: 83 bytes leftover after parsing attributes in process `syz.1.4371'. [ 637.591141][T18839] bridge0: port 1(bridge_slave_0) entered blocking state [ 637.604971][T18839] bridge0: port 1(bridge_slave_0) entered disabled state [ 637.615593][T18839] bridge_slave_0: entered allmulticast mode [ 637.630754][T18839] bridge_slave_0: entered promiscuous mode [ 637.644504][T18839] bridge0: port 2(bridge_slave_1) entered blocking state [ 637.652156][T18839] bridge0: port 2(bridge_slave_1) entered disabled state [ 637.660974][T18839] bridge_slave_1: entered allmulticast mode [ 637.674073][T18839] bridge_slave_1: entered promiscuous mode [ 637.760379][T18864] blk_print_req_error: 138 callbacks suppressed [ 637.760402][T18864] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 637.832180][T18864] buffer_io_error: 138 callbacks suppressed [ 637.832198][T18864] Buffer I/O error on dev nbd0, logical block 0, async page read [ 637.846885][T18864] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 637.858268][T18864] Buffer I/O error on dev nbd0, logical block 1, async page read [ 637.866766][T18864] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 637.876254][T18864] Buffer I/O error on dev nbd0, logical block 2, async page read [ 637.884962][T18864] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 637.894358][T18864] Buffer I/O error on dev nbd0, logical block 3, async page read [ 637.902831][T18864] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 637.912080][T18864] Buffer I/O error on dev nbd0, logical block 0, async page read [ 637.922460][T18864] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 637.932306][T18864] Buffer I/O error on dev nbd0, logical block 1, async page read [ 637.940869][T18864] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 637.950098][T18864] Buffer I/O error on dev nbd0, logical block 2, async page read [ 637.958527][T18864] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 637.968481][T18864] Buffer I/O error on dev nbd0, logical block 3, async page read [ 637.977639][T18864] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 637.987387][T18864] Buffer I/O error on dev nbd0, logical block 0, async page read [ 637.999663][T18864] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 638.016536][T18864] Buffer I/O error on dev nbd0, logical block 1, async page read [ 638.037163][T18864] ldm_validate_partition_table(): Disk read failed. [ 638.046682][T18864] Dev nbd0: unable to read RDB block 0 [ 638.055371][T18864] nbd0: unable to read partition table [ 638.180611][ T51] Bluetooth: hci4: command tx timeout [ 638.258578][T18839] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 638.290680][T18839] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 638.481569][T18839] team0: Port device team_slave_0 added [ 638.553575][T18839] team0: Port device team_slave_1 added [ 638.691759][T18839] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 638.722992][T18839] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 638.764128][T18839] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 638.777999][T18839] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 638.785145][T18839] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 638.830091][T18839] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 639.019638][T18839] hsr_slave_0: entered promiscuous mode [ 639.041712][T18839] hsr_slave_1: entered promiscuous mode [ 639.048241][T18839] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 639.091057][T18839] Cannot create hsr debugfs directory [ 639.394302][T18900] syz_tun: entered allmulticast mode [ 640.007702][T18891] syz_tun: left allmulticast mode [ 640.035909][T18839] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 640.105874][T18839] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 640.197642][T18839] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 640.252328][T18839] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 640.269077][ T51] Bluetooth: hci4: command tx timeout [ 640.637946][T14464] hid-generic 0000:0000:0000.001A: unknown main item tag 0x0 [ 640.723626][T14464] hid-generic 0000:0000:0000.001A: hidraw0: HID v0.00 Device [syz1] on syz0 [ 640.925576][T18839] 8021q: adding VLAN 0 to HW filter on device bond0 [ 641.083506][T18839] 8021q: adding VLAN 0 to HW filter on device team0 [ 641.152355][ T6146] bridge0: port 1(bridge_slave_0) entered blocking state [ 641.159644][ T6146] bridge0: port 1(bridge_slave_0) entered forwarding state [ 641.241254][ T6146] bridge0: port 2(bridge_slave_1) entered blocking state [ 641.248632][ T6146] bridge0: port 2(bridge_slave_1) entered forwarding state [ 641.498072][T18839] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 641.619356][T18932] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4392'. [ 641.628508][T18932] bond0: left allmulticast mode [ 641.644821][T18932] bond_slave_0: left allmulticast mode [ 641.667028][T18932] bond_slave_1: left allmulticast mode [ 641.689110][T18932] bond0: left promiscuous mode [ 641.709065][T18932] bond_slave_0: left promiscuous mode [ 641.714741][T18932] bond_slave_1: left promiscuous mode [ 641.724349][T18932] bridge0: port 3(bond0) entered disabled state [ 641.742264][T18932] bridge_slave_1: left allmulticast mode [ 641.748454][T18932] bridge_slave_1: left promiscuous mode [ 641.762193][T18932] bridge0: port 2(bridge_slave_1) entered disabled state [ 641.774960][T18932] bridge_slave_0: left allmulticast mode [ 641.781853][T18932] bridge_slave_0: left promiscuous mode [ 641.788127][T18932] bridge0: port 1(bridge_slave_0) entered disabled state [ 641.918188][ T5854] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 641.936520][ T5854] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 641.948347][ T5854] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 641.958139][ T5854] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 641.967119][ T5854] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 642.025391][T18936] wg1 speed is unknown, defaulting to 1000 [ 642.304422][T18839] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 642.359937][ T5854] Bluetooth: hci4: command tx timeout [ 643.149255][T18960] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4396'. [ 643.736043][T18971] syz_tun: entered allmulticast mode [ 644.035189][ T5854] Bluetooth: hci5: command tx timeout [ 644.190779][T18961] syz_tun: left allmulticast mode [ 644.201813][T18936] chnl_net:caif_netlink_parms(): no params data found [ 644.259489][T18839] veth0_vlan: entered promiscuous mode [ 644.422567][ T5854] Bluetooth: hci4: command tx timeout [ 644.447559][T18839] veth1_vlan: entered promiscuous mode [ 644.671507][T18839] veth0_macvtap: entered promiscuous mode [ 644.726411][T18839] veth1_macvtap: entered promiscuous mode [ 644.917838][T18936] bridge0: port 1(bridge_slave_0) entered blocking state [ 644.925483][T18936] bridge0: port 1(bridge_slave_0) entered disabled state [ 644.941860][T18936] bridge_slave_0: entered allmulticast mode [ 644.955937][T18936] bridge_slave_0: entered promiscuous mode [ 644.967079][T18936] bridge0: port 2(bridge_slave_1) entered blocking state [ 644.976452][T18936] bridge0: port 2(bridge_slave_1) entered disabled state [ 644.991567][T18936] bridge_slave_1: entered allmulticast mode [ 645.007262][T18936] bridge_slave_1: entered promiscuous mode [ 645.080410][T18839] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 645.123747][T18998] netlink: 1 bytes leftover after parsing attributes in process `syz.6.4405'. [ 645.138857][T18999] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=none:owns=io+mem [ 645.974995][T19006] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4407'. [ 646.105698][ T5854] Bluetooth: hci5: command tx timeout [ 647.195853][ T6230] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 647.207003][ T6230] bond0 (unregistering): Released all slaves [ 647.235500][T15347] wg1 speed is unknown, defaulting to 1000 [ 647.237676][T18839] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 647.259247][T15347] syz0: Port: 1 Link DOWN [ 647.314281][ T6230] tipc: Left network mode [ 647.552437][T18839] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 647.579777][T18839] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 647.604801][T18839] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 647.629478][T18839] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 647.825037][T18936] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 647.858139][T18936] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 648.009187][T18936] team0: Port device team_slave_0 added [ 648.075915][T19035] loop2: detected capacity change from 0 to 7 [ 648.102655][T19035] Dev loop2: unable to read RDB block 7 [ 648.108400][T19035] loop2: unable to read partition table [ 648.120078][T19035] loop2: partition table beyond EOD, truncated [ 648.130099][T19035] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 648.180307][ T5854] Bluetooth: hci5: command tx timeout [ 648.190133][T18936] team0: Port device team_slave_1 added [ 648.564657][T18936] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 648.667789][T18936] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 648.728840][T18936] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 648.851337][T18936] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 648.871193][T18936] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 648.959992][T18936] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 649.171695][ T6230] hsr_slave_0: left promiscuous mode [ 649.198103][ T6230] hsr_slave_1: left promiscuous mode [ 649.209917][ T6230] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 649.217512][ T6230] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 649.258298][ T6230] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 649.276369][ T6230] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 649.434943][ T6230] team0: left promiscuous mode [ 649.460887][ T6230] team_slave_0: left promiscuous mode [ 649.466669][ T6230] team_slave_1: left promiscuous mode [ 649.487338][ T6230] veth1_macvtap: left promiscuous mode [ 649.499037][ T6230] veth0_macvtap: left promiscuous mode [ 649.525532][ T6230] veth1_vlan: left promiscuous mode [ 649.550022][ T6230] veth0_vlan: left promiscuous mode [ 650.259430][ T5854] Bluetooth: hci5: command tx timeout [ 650.273131][ T6230] team0 (unregistering): Port device team_slave_1 removed [ 650.343412][ T6230] team0 (unregistering): Port device team_slave_0 removed [ 651.158727][T18936] hsr_slave_0: entered promiscuous mode [ 651.178374][T18936] hsr_slave_1: entered promiscuous mode [ 651.221758][T18936] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 651.240927][T18936] Cannot create hsr debugfs directory [ 651.283202][ T3480] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 651.326781][ T3480] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 651.488232][ T6146] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 651.579375][ T6146] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 651.609103][ T5847] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 651.784492][ T5847] usb 4-1: Using ep0 maxpacket: 8 [ 651.813006][ T5847] usb 4-1: config 0 has an invalid descriptor of length 48, skipping remainder of the config [ 651.839110][ T5847] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 651.875785][T19083] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 651.887051][T19083] Bluetooth: hci7: Error when powering off device on rfkill (-4) [ 651.910300][T19083] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 651.916971][T19083] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 651.990321][ T5847] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 651.992304][T19083] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 652.010025][ T5847] usb 4-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 652.021101][ T5847] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 652.029818][ T5847] usb 4-1: Product: syz [ 652.040342][ T5847] usb 4-1: Manufacturer: syz [ 652.045158][ T5847] usb 4-1: SerialNumber: syz [ 652.077823][T19083] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 652.098218][ T5847] usb 4-1: config 0 descriptor?? [ 652.129526][ T9] usb 2-1: new full-speed USB device number 19 using dummy_hcd [ 652.171979][T19083] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 652.177940][T19083] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 652.194513][T19083] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 652.203868][T19083] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 652.453605][ T9] usb 2-1: config 1 has an invalid interface number: 128 but max is 1 [ 652.472697][T19083] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 652.484600][T19083] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 652.518125][T19083] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 652.524562][T19083] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 652.528097][ T9] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 652.552019][T18936] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 652.564885][T19076] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4426'. [ 652.591193][ T9] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 652.620847][ T5847] streamzap 4-1:0.0: streamzap_probe: Unexpected desc.bNumEndpoints (0) [ 652.645486][T18936] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 652.654584][ T9] usb 2-1: config 1 has no interface number 0 [ 652.685980][ T5847] usb 4-1: USB disconnect, device number 22 [ 652.699449][ T9] usb 2-1: config 1 interface 128 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 652.731714][T18936] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 652.768879][T18936] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 652.845296][ T9] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 652.858724][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 652.919455][ T9] usb 2-1: Product: syz [ 652.948485][ T9] usb 2-1: Manufacturer: syz [ 652.997863][ T9] usb 2-1: SerialNumber: syz [ 653.026731][T18936] 8021q: adding VLAN 0 to HW filter on device bond0 [ 653.061446][ T9] cdc_wdm 2-1:1.128: probe with driver cdc_wdm failed with error -22 [ 653.084705][T18936] 8021q: adding VLAN 0 to HW filter on device team0 [ 653.200150][ T6230] bridge0: port 1(bridge_slave_0) entered blocking state [ 653.207294][ T6230] bridge0: port 1(bridge_slave_0) entered forwarding state [ 653.356929][ T6230] bridge0: port 2(bridge_slave_1) entered blocking state [ 653.364142][ T6230] bridge0: port 2(bridge_slave_1) entered forwarding state [ 654.338215][T18936] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 654.898406][T15346] usb 2-1: USB disconnect, device number 19 [ 655.157270][T19127] bridge0: port 2(bridge_slave_1) entered disabled state [ 655.165267][T19127] bridge0: port 1(bridge_slave_0) entered disabled state [ 655.618601][T19127] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 655.692037][T19127] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 655.974802][T19128] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 656.085290][T19127] netdevsim netdevsim6 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 656.097656][T19127] netdevsim netdevsim6 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 656.119275][T19127] netdevsim netdevsim6 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 656.142797][T19127] netdevsim netdevsim6 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 656.858658][T18936] veth0_vlan: entered promiscuous mode [ 656.900620][T18936] veth1_vlan: entered promiscuous mode [ 657.013872][T18936] veth0_macvtap: entered promiscuous mode [ 657.054467][T18936] veth1_macvtap: entered promiscuous mode [ 657.130588][T18936] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 657.192200][T18936] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 657.218727][T18936] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 657.244465][T18936] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 657.293444][T18936] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 657.321186][T18936] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 657.823074][ T6230] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 657.865991][ T6230] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 658.377081][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 658.386848][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 658.729281][T19154] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 658.843336][T19203] binder: 19202:19203 ioctl c0306201 0 returned -14 [ 658.902541][T19154] usb 7-1: Using ep0 maxpacket: 32 [ 658.918238][T19154] usb 7-1: New USB device found, idVendor=0ac8, idProduct=c301, bcdDevice=82.d5 [ 658.928594][T19154] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 658.943033][T19154] usb 7-1: Product: syz [ 658.953475][T19154] usb 7-1: Manufacturer: syz [ 658.958280][T19154] usb 7-1: SerialNumber: syz [ 658.982506][T19154] usb 7-1: config 0 descriptor?? [ 659.022792][T19154] hub 7-1:0.0: bad descriptor, ignoring hub [ 659.099442][T19154] hub 7-1:0.0: probe with driver hub failed with error -5 [ 659.402621][T19154] gspca_main: vc032x-2.14.0 probing 0ac8:c301 [ 659.686699][T19220] batadv_slave_1: entered allmulticast mode [ 659.878423][T19207] batadv_slave_1: left allmulticast mode [ 659.929436][T19154] gspca_vc032x: reg_w err -110 [ 659.934298][T19154] gspca_vc032x: I2c Bus Busy Wait 00 [ 659.971972][T19154] gspca_vc032x: I2c Bus Busy Wait 00 [ 660.013021][T19154] gspca_vc032x: I2c Bus Busy Wait 00 [ 660.045168][T19154] gspca_vc032x: I2c Bus Busy Wait 00 [ 660.092793][T19154] gspca_vc032x: I2c Bus Busy Wait 00 [ 660.131998][T19154] gspca_vc032x: I2c Bus Busy Wait 00 [ 660.158153][T19154] gspca_vc032x: I2c Bus Busy Wait 00 [ 660.164016][T19227] input: syz0 as /devices/virtual/input/input35 [ 660.199152][T19154] gspca_vc032x: I2c Bus Busy Wait 00 [ 660.233850][T19154] gspca_vc032x: I2c Bus Busy Wait 00 [ 660.252440][T19154] gspca_vc032x: I2c Bus Busy Wait 00 [ 660.458154][T19154] gspca_vc032x: I2c Bus Busy Wait 00 [ 660.508562][T19154] gspca_vc032x: I2c Bus Busy Wait 00 [ 660.559102][T19154] gspca_vc032x: I2c Bus Busy Wait 00 [ 660.600858][T19154] gspca_vc032x: I2c Bus Busy Wait 00 [ 660.633890][T19154] gspca_vc032x: I2c Bus Busy Wait 00 [ 660.668581][T19154] gspca_vc032x: I2c Bus Busy Wait 00 [ 660.704371][T19154] gspca_vc032x: I2c Bus Busy Wait 00 [ 660.723484][T19154] gspca_vc032x: I2c Bus Busy Wait 00 [ 660.760760][T19154] gspca_vc032x: I2c Bus Busy Wait 00 [ 660.793816][T19154] gspca_vc032x: Unknown sensor... [ 660.826050][T19154] vc032x 7-1:0.0: probe with driver vc032x failed with error -22 [ 661.089688][T19154] usb 7-1: USB disconnect, device number 12 [ 661.627017][T19253] fuse: Unknown parameter 'fd0x0000000000000004' [ 661.665622][T19255] input: syz0 as /devices/virtual/input/input36 [ 661.896900][T19154] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 662.069165][T19154] usb 4-1: Using ep0 maxpacket: 8 [ 662.086609][T19154] usb 4-1: unable to get BOS descriptor or descriptor too short [ 662.138506][T19154] usb 4-1: config 4 has an invalid interface number: 147 but max is 0 [ 662.157890][T19154] usb 4-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 662.169916][T19154] usb 4-1: config 4 has no interface number 0 [ 662.197044][T19154] usb 4-1: New USB device found, idVendor=04f2, idProduct=b746, bcdDevice=8e.6e [ 662.220997][T19154] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 662.231128][T19154] usb 4-1: Product: syz [ 662.246688][T19154] usb 4-1: Manufacturer: syz [ 662.259714][T19154] usb 4-1: SerialNumber: syz [ 662.345663][T19277] af_packet: tpacket_rcv: packet too big, clamped from 42 to 4294967286. macoff=82 [ 662.387453][T19280] syz_tun: entered allmulticast mode [ 662.558148][T19154] usb 4-1: Found UVC 0.02 device syz (04f2:b746) [ 662.597971][T19154] usb 4-1: No valid video chain found. [ 662.631177][T19154] usb 4-1: USB disconnect, device number 23 [ 662.884969][T19289] loop2: detected capacity change from 0 to 7 [ 662.899945][T19289] loop2: [ 662.909252][T19289] loop2: partition table partially beyond EOD, truncated [ 662.945176][T19289] netlink: 104 bytes leftover after parsing attributes in process `syz.7.4484'. [ 663.022752][T19271] syz_tun: left allmulticast mode [ 664.933502][T19332] netlink: 16 bytes leftover after parsing attributes in process `syz.6.4503'. [ 665.353306][T19343] syz_tun: entered allmulticast mode [ 665.914690][T19355] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4508'. [ 665.987813][T19335] syz_tun: left allmulticast mode [ 666.741579][ T94] block nbd2: Possible stuck request ffff88802551e000: control (read@0,1024B). Runtime 360 seconds [ 666.752969][ T94] block nbd2: Possible stuck request ffff88802551e1c0: control (read@1024,1024B). Runtime 360 seconds [ 666.764183][ T94] block nbd2: Possible stuck request ffff88802551e380: control (read@2048,1024B). Runtime 360 seconds [ 666.775281][ T94] block nbd2: Possible stuck request ffff88802551e540: control (read@3072,1024B). Runtime 360 seconds [ 667.044813][T19370] syz_tun: entered allmulticast mode [ 667.072608][T19369] syz_tun: left allmulticast mode [ 668.017103][T19397] syz_tun: entered allmulticast mode [ 668.295246][T19404] netlink: 'syz.3.4527': attribute type 1 has an invalid length. [ 668.462086][T19406] macvlan2: entered promiscuous mode [ 668.467688][T19406] macvlan2: entered allmulticast mode [ 668.475497][T19406] bond1: entered promiscuous mode [ 668.481421][T19406] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 668.529978][T19406] bond1: left promiscuous mode [ 668.838663][T19409] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4528'. [ 668.874085][T19409] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4528'. [ 669.000469][T19389] syz_tun: left allmulticast mode [ 669.243956][T19424] tipc: Cannot configure node identity twice [ 669.797761][T19432] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=none,decodes=none:owns=io+mem [ 670.399417][T19444] tipc: Started in network mode [ 670.404390][T19444] tipc: Node identity 1ea70d7f7565, cluster identity 4711 [ 670.427180][T19444] tipc: Enabled bearer , priority 0 [ 670.510983][T19449] syzkaller0: entered promiscuous mode [ 670.516789][T19449] syzkaller0: entered allmulticast mode [ 670.576178][T19444] tipc: Resetting bearer [ 670.723652][T19441] tipc: Resetting bearer [ 670.782570][T19441] tipc: Disabling bearer [ 670.975047][T19457] netlink: 4 bytes leftover after parsing attributes in process `syz.7.4548'. [ 671.869983][T19483] batadv_slave_1: entered allmulticast mode [ 672.042031][T19462] batadv_slave_1: left allmulticast mode [ 672.564402][ T30] kauditd_printk_skb: 57 callbacks suppressed [ 672.564416][ T30] audit: type=1326 audit(1753958351.871:384): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19497 comm="syz.3.4561" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7feebeb8e9a9 code=0x0 [ 673.227681][ T30] audit: type=1326 audit(1753958352.541:385): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19509 comm="syz.1.4563" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f656f58e9a9 code=0x0 [ 674.032542][T19526] binder: BINDER_SET_CONTEXT_MGR already set [ 674.059701][T19526] binder: 19524:19526 ioctl 4018620d 200000000040 returned -16 [ 674.802463][ T30] audit: type=1326 audit(1753958354.121:386): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19543 comm="syz.6.4579" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7ff989d8e9a9 code=0x0 [ 675.464939][T19570] binder: BINDER_SET_CONTEXT_MGR already set [ 675.501692][T19570] binder: 19565:19570 ioctl 4018620d 200000000040 returned -16 [ 675.649252][T19570] binder: 19565:19570 ioctl c0306201 200000001440 returned -11 [ 677.866278][T19617] binder: 19615:19617 ioctl c0306201 200000001440 returned -11 [ 680.442223][T19667] netlink: 224 bytes leftover after parsing attributes in process `syz.3.4629'. [ 680.454216][T19662] netlink: 28 bytes leftover after parsing attributes in process `syz.7.4628'. [ 680.498457][T19662] openvswitch: netlink: Flow key attr not present in new flow. [ 680.942531][T19676] Bluetooth: MGMT ver 1.23 [ 682.614161][T19708] netlink: 'syz.6.4646': attribute type 10 has an invalid length. [ 682.640378][T19708] batman_adv: batadv0: Adding interface: team0 [ 682.646604][T19708] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 682.683054][T19708] batman_adv: batadv0: Not using interface team0 (retrying later): interface not active [ 682.794081][T19707] tipc: Enabled bearer , priority 0 [ 682.857780][T19707] syzkaller0: entered promiscuous mode [ 682.886292][T19707] syzkaller0: entered allmulticast mode [ 682.945404][T19707] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 683.202147][T19720] tipc: Resetting bearer [ 683.359520][T19706] tipc: Resetting bearer [ 683.715912][T19706] tipc: Disabling bearer [ 684.730193][T19763] nbd3: detected capacity change from 0 to 549764202496 [ 684.788819][ T5854] block nbd3: Receive control failed (result -32) [ 684.805329][T15997] block nbd3: Dead connection, failed to find a fallback [ 684.812639][T15997] block nbd3: shutting down sockets [ 684.817975][T15997] blk_print_req_error: 55 callbacks suppressed [ 684.817990][T15997] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 684.837295][T15997] buffer_io_error: 54 callbacks suppressed [ 684.837314][T15997] Buffer I/O error on dev nbd3, logical block 0, async page read [ 684.851934][T15997] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 684.861641][T15997] Buffer I/O error on dev nbd3, logical block 0, async page read [ 684.870132][T15997] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 684.879499][T15997] Buffer I/O error on dev nbd3, logical block 0, async page read [ 684.887616][T15997] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 684.897406][T15997] Buffer I/O error on dev nbd3, logical block 0, async page read [ 684.913201][T15997] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 684.955836][T15997] Buffer I/O error on dev nbd3, logical block 0, async page read [ 684.988521][T15997] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 685.039704][T15997] Buffer I/O error on dev nbd3, logical block 0, async page read [ 685.057562][T15997] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 685.077766][T15997] Buffer I/O error on dev nbd3, logical block 0, async page read [ 685.100624][T15997] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 685.153864][T15997] Buffer I/O error on dev nbd3, logical block 0, async page read [ 685.173869][T15997] ldm_validate_partition_table(): Disk read failed. [ 685.219399][T15997] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 685.228604][T15997] Buffer I/O error on dev nbd3, logical block 0, async page read [ 685.270514][T15997] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 685.295731][T15997] Buffer I/O error on dev nbd3, logical block 0, async page read [ 685.326346][T15997] Dev nbd3: unable to read RDB block 0 [ 685.333800][T15997] nbd3: unable to read partition table [ 685.377788][T15997] ldm_validate_partition_table(): Disk read failed. [ 685.400017][T15997] Dev nbd3: unable to read RDB block 0 [ 685.406309][T15997] nbd3: unable to read partition table [ 685.949884][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.957282][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.130409][T19800] input: syz0 as /devices/virtual/input/input41 [ 686.429277][T19810] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 687.404391][T19840] input: syz0 as /devices/virtual/input/input42 [ 689.263155][T19896] input: syz0 as /devices/virtual/input/input43 [ 691.033905][T19944] openvswitch: netlink: IP tunnel dst address not specified [ 691.071091][T19945] input: syz0 as /devices/virtual/input/input44 [ 692.151803][T19984] input: syz0 as /devices/virtual/input/input45 [ 692.711624][T20004] x_tables: ip_tables: MARK.2 target: invalid size 8 (kernel) != (user) 16 [ 692.917276][T20010] team0: No ports can be present during mode change [ 693.162379][T20020] input: syz0 as /devices/virtual/input/input46 [ 693.195447][T20026] vxcan1: entered allmulticast mode [ 693.405971][T20029] lo speed is unknown, defaulting to 1000 [ 693.428472][T20029] lo speed is unknown, defaulting to 1000 [ 693.438755][T20029] lo speed is unknown, defaulting to 1000 [ 694.166158][T20029] infiniband syz0: set active [ 694.171291][T19146] lo speed is unknown, defaulting to 1000 [ 694.204300][T20029] infiniband syz0: added lo [ 694.315032][T20029] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 694.348216][T20029] infiniband syz0: Couldn't open port 1 [ 694.601210][T20029] RDS/IB: syz0: added [ 694.630604][T20029] smc: adding ib device syz0 with port count 1 [ 694.676536][T20029] smc: ib device syz0 port 1 has pnetid [ 694.709522][T19146] lo speed is unknown, defaulting to 1000 [ 694.716986][T20029] lo speed is unknown, defaulting to 1000 [ 695.951609][T20029] lo speed is unknown, defaulting to 1000 [ 696.362636][T20075] netlink: 104 bytes leftover after parsing attributes in process `syz.8.4781'. [ 696.802618][T20029] lo speed is unknown, defaulting to 1000 [ 696.821067][ T94] block nbd2: Possible stuck request ffff88802551e000: control (read@0,1024B). Runtime 390 seconds [ 696.832400][ T94] block nbd2: Possible stuck request ffff88802551e1c0: control (read@1024,1024B). Runtime 390 seconds [ 696.843483][ T94] block nbd2: Possible stuck request ffff88802551e380: control (read@2048,1024B). Runtime 390 seconds [ 696.854613][ T94] block nbd2: Possible stuck request ffff88802551e540: control (read@3072,1024B). Runtime 390 seconds [ 696.936796][ C1] vcan0: j1939_tp_rxtimer: 0xffff88803476a000: rx timeout, send abort [ 696.945321][ C1] vcan0: j1939_tp_rxtimer: 0xffff888034769000: rx timeout, send abort [ 696.954141][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88803476a000: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 696.968605][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff888034769000: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 697.763604][T20103] netlink: 12 bytes leftover after parsing attributes in process `syz.7.4793'. [ 698.214540][T20029] lo speed is unknown, defaulting to 1000 [ 698.649797][ C1] vcan0: j1939_tp_rxtimer: 0xffff888052659000: rx timeout, send abort [ 698.955508][T20029] lo speed is unknown, defaulting to 1000 [ 699.149903][ C1] vcan0: j1939_tp_rxtimer: 0xffff888058a65000: rx timeout, send abort [ 699.158365][ C1] vcan0: j1939_tp_rxtimer: 0xffff888052659000: abort rx timeout. Force session deactivation [ 699.582803][T20029] lo speed is unknown, defaulting to 1000 [ 699.658334][ C1] vcan0: j1939_tp_rxtimer: 0xffff888058a65000: abort rx timeout. Force session deactivation [ 700.890325][T20154] QAT: Device 244 not found [ 701.767894][T19153] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 702.185687][T20161] usb usb1: check_ctrlrecip: process 20161 (syz.7.4811) requesting ep 01 but needs 81 [ 702.196179][T20161] usb usb1: usbfs: process 20161 (syz.7.4811) did not claim interface 0 before use [ 702.245917][T19153] usb 9-1: Using ep0 maxpacket: 32 [ 702.258820][T19153] usb 9-1: config 0 has an invalid interface number: 67 but max is 0 [ 702.278864][T19153] usb 9-1: config 0 has no interface number 0 [ 702.316841][T19153] usb 9-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 702.375104][T19153] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 702.398505][T20029] lo speed is unknown, defaulting to 1000 [ 702.416104][T19153] usb 9-1: Product: syz [ 702.457624][T19153] usb 9-1: Manufacturer: syz [ 702.479157][T19153] usb 9-1: SerialNumber: syz [ 702.521237][T19153] usb 9-1: config 0 descriptor?? [ 702.583235][T19153] smsc95xx v2.0.0 [ 704.309166][T19153] smsc95xx 9-1:0.67 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -71 [ 704.402035][T19153] smsc95xx 9-1:0.67: probe with driver smsc95xx failed with error -71 [ 704.483189][T19153] usb 9-1: USB disconnect, device number 2 [ 704.613950][T20029] lo speed is unknown, defaulting to 1000 [ 706.095335][T20199] netlink: 1 bytes leftover after parsing attributes in process `syz.7.4819'. [ 706.328746][T20029] lo speed is unknown, defaulting to 1000 [ 708.364945][T20231] usb usb1: check_ctrlrecip: process 20231 (syz.6.4823) requesting ep 01 but needs 81 [ 708.619205][T20231] usb usb1: usbfs: process 20231 (syz.6.4823) did not claim interface 0 before use [ 711.174478][T20248] QAT: Device 244 not found [ 711.419525][T15511] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 711.592231][T15511] usb 7-1: Using ep0 maxpacket: 32 [ 711.603548][T15511] usb 7-1: config 0 has an invalid interface number: 67 but max is 0 [ 711.617454][T15511] usb 7-1: config 0 has no interface number 0 [ 711.652664][T15511] usb 7-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 711.675231][T15511] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 711.690083][T15511] usb 7-1: Product: syz [ 711.694312][T15511] usb 7-1: Manufacturer: syz [ 711.698940][T15511] usb 7-1: SerialNumber: syz [ 711.717650][T15511] usb 7-1: config 0 descriptor?? [ 711.867320][T15511] smsc95xx v2.0.0 [ 714.389675][T15511] smsc95xx 7-1:0.67 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -71 [ 714.533647][T15511] smsc95xx 7-1:0.67: probe with driver smsc95xx failed with error -71 [ 715.533615][T15511] usb 7-1: USB disconnect, device number 13 [ 716.240908][T20287] usb usb1: check_ctrlrecip: process 20287 (syz.6.4837) requesting ep 01 but needs 81 [ 716.250855][T20287] usb usb1: usbfs: process 20287 (syz.6.4837) did not claim interface 0 before use [ 721.437098][ T5208] udevd[5208]: worker [5859] /devices/virtual/block/nbd2 timeout; kill it [ 722.559090][ T5208] udevd[5208]: seq 15633 '/devices/virtual/block/nbd2' killed [ 723.102242][T20339] nbd4: detected capacity change from 0 to 127 [ 723.130512][ T5854] block nbd4: Receive control failed (result -104) [ 723.298188][T20345] usb usb1: check_ctrlrecip: process 20345 (syz.3.4855) requesting ep 01 but needs 81 [ 723.719260][T20345] usb usb1: usbfs: process 20345 (syz.3.4855) did not claim interface 0 before use [ 723.799634][T20347] syzkaller0: entered promiscuous mode [ 723.829561][T20347] syzkaller0: entered allmulticast mode [ 724.007594][T20360] netlink: 12 bytes leftover after parsing attributes in process `syz.8.4860'. [ 726.905327][T20173] block nbd2: Possible stuck request ffff88802551e000: control (read@0,1024B). Runtime 420 seconds [ 726.918595][T20173] block nbd2: Possible stuck request ffff88802551e1c0: control (read@1024,1024B). Runtime 420 seconds [ 726.937153][T20173] block nbd2: Possible stuck request ffff88802551e380: control (read@2048,1024B). Runtime 420 seconds [ 726.976651][T20173] block nbd2: Possible stuck request ffff88802551e540: control (read@3072,1024B). Runtime 420 seconds [ 728.515409][T20388] tipc: Enabled bearer , priority 0 [ 728.551140][T20388] syzkaller0: entered promiscuous mode [ 728.573408][T20388] syzkaller0: entered allmulticast mode [ 728.786274][T20387] tipc: Resetting bearer [ 729.309196][T20401] usb usb1: check_ctrlrecip: process 20401 (syz.1.4873) requesting ep 01 but needs 81 [ 729.319112][T20401] usb usb1: usbfs: process 20401 (syz.1.4873) did not claim interface 0 before use [ 729.339428][T20387] tipc: Disabling bearer [ 729.408294][T20403] tipc: Started in network mode [ 729.413676][T20403] tipc: Node identity b24ab2c9bdd1, cluster identity 4711 [ 729.423526][T20403] tipc: Enabled bearer , priority 0 [ 729.430970][T20405] syzkaller0: entered promiscuous mode [ 729.436522][T20405] syzkaller0: entered allmulticast mode [ 729.507578][T20397] tipc: Resetting bearer [ 729.522333][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 729.531234][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 729.586792][T20395] tipc: Resetting bearer [ 729.686247][T20395] tipc: Disabling bearer [ 732.929444][T20446] usb usb1: check_ctrlrecip: process 20446 (syz.7.4889) requesting ep 01 but needs 81 [ 732.939145][T20446] usb usb1: usbfs: process 20446 (syz.7.4889) did not claim interface 0 before use [ 741.966178][T20544] netlink: 1 bytes leftover after parsing attributes in process `syz.8.4920'. [ 742.117420][T20544] fuse: root generation should be zero [ 742.279360][T20554] kvm: user requested TSC rate below hardware speed [ 747.386059][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.392689][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 748.088227][T20643] tipc: Enabled bearer , priority 0 [ 748.167513][T20643] tipc: Resetting bearer [ 748.191616][T20647] tipc: Enabled bearer , priority 0 [ 748.247304][T20642] tipc: Disabling bearer [ 748.275408][T20647] syzkaller0: entered promiscuous mode [ 748.281660][T20647] syzkaller0: entered allmulticast mode [ 748.353283][T20647] tipc: Resetting bearer [ 748.381082][T20645] tipc: Resetting bearer [ 748.456839][T20645] tipc: Disabling bearer [ 750.338497][T20710] netlink: 1 bytes leftover after parsing attributes in process `syz.3.4980'. [ 750.464908][T20717] batadv_slave_1: entered allmulticast mode [ 750.508875][T20718] syz_tun: entered allmulticast mode [ 751.179574][T20703] batadv_slave_1: left allmulticast mode [ 751.356776][T20705] syz_tun: left allmulticast mode [ 753.147652][T20173] block nbd4: Possible stuck request ffff8880255f7000: control (read@0,1024B). Runtime 30 seconds [ 753.159186][T20173] block nbd4: Possible stuck request ffff8880255f71c0: control (read@1024,1024B). Runtime 30 seconds [ 753.189151][T20173] block nbd4: Possible stuck request ffff8880255f7380: control (read@2048,1024B). Runtime 30 seconds [ 753.206977][T20173] block nbd4: Possible stuck request ffff8880255f7540: control (read@3072,1024B). Runtime 30 seconds [ 756.979460][ T94] block nbd2: Possible stuck request ffff88802551e000: control (read@0,1024B). Runtime 450 seconds [ 756.990850][ T94] block nbd2: Possible stuck request ffff88802551e1c0: control (read@1024,1024B). Runtime 450 seconds [ 757.005429][ T94] block nbd2: Possible stuck request ffff88802551e380: control (read@2048,1024B). Runtime 450 seconds [ 757.073604][ T94] block nbd2: Possible stuck request ffff88802551e540: control (read@3072,1024B). Runtime 450 seconds [ 760.436894][T20845] netlink: 1 bytes leftover after parsing attributes in process `syz.7.5019'. [ 762.208783][T20871] netlink: 1 bytes leftover after parsing attributes in process `syz.6.5028'. [ 762.968714][T20887] netlink: 1 bytes leftover after parsing attributes in process `syz.1.5033'. [ 765.672961][T20921] syz_tun: entered allmulticast mode [ 766.395552][T20903] syz_tun: left allmulticast mode [ 767.420017][T20933] netlink: 1 bytes leftover after parsing attributes in process `syz.8.5046'. [ 770.112761][T20975] FAULT_INJECTION: forcing a failure. [ 770.112761][T20975] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 770.132589][T20975] CPU: 1 UID: 0 PID: 20975 Comm: syz.8.5057 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 770.132606][T20975] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 770.132618][T20975] Call Trace: [ 770.132626][T20975] [ 770.132631][T20975] dump_stack_lvl+0x189/0x250 [ 770.132658][T20975] ? __pfx____ratelimit+0x10/0x10 [ 770.132670][T20975] ? __pfx_dump_stack_lvl+0x10/0x10 [ 770.132682][T20975] ? __pfx__printk+0x10/0x10 [ 770.132696][T20975] ? __might_fault+0xb0/0x130 [ 770.132713][T20975] should_fail_ex+0x414/0x560 [ 770.132728][T20975] _copy_from_user+0x2d/0xb0 [ 770.132743][T20975] do_sock_getsockopt+0x17d/0x450 [ 770.132762][T20975] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 770.132777][T20975] ? do_syscall_64+0x20/0x3b0 [ 770.132788][T20975] ? __fget_files+0x3a0/0x420 [ 770.132800][T20975] ? __fget_files+0x2a/0x420 [ 770.132814][T20975] __x64_sys_getsockopt+0x1a5/0x250 [ 770.132829][T20975] ? do_syscall_64+0x20/0x3b0 [ 770.132841][T20975] ? do_syscall_64+0x20/0x3b0 [ 770.132854][T20975] do_syscall_64+0xfa/0x3b0 [ 770.132865][T20975] ? lockdep_hardirqs_on+0x9c/0x150 [ 770.132876][T20975] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 770.132886][T20975] ? clear_bhb_loop+0x60/0xb0 [ 770.132899][T20975] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 770.132909][T20975] RIP: 0033:0x7fb67198e9a9 [ 770.132922][T20975] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 770.132931][T20975] RSP: 002b:00007fb6727eb038 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 770.132943][T20975] RAX: ffffffffffffffda RBX: 00007fb671bb6080 RCX: 00007fb67198e9a9 [ 770.132951][T20975] RDX: 000000000000003b RSI: 0000000000000001 RDI: 0000000000000004 [ 770.132957][T20975] RBP: 00007fb6727eb090 R08: 0000200000000000 R09: 0000000000000000 [ 770.132964][T20975] R10: 00002000000014c0 R11: 0000000000000246 R12: 0000000000000001 [ 770.132970][T20975] R13: 0000000000000000 R14: 00007fb671bb6080 R15: 00007ffcca468308 [ 770.132986][T20975] [ 772.398232][T21000] FAULT_INJECTION: forcing a failure. [ 772.398232][T21000] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 772.472388][T21000] CPU: 0 UID: 0 PID: 21000 Comm: syz.7.5071 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 772.472417][T21000] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 772.472428][T21000] Call Trace: [ 772.472436][T21000] [ 772.472445][T21000] dump_stack_lvl+0x189/0x250 [ 772.472472][T21000] ? __pfx____ratelimit+0x10/0x10 [ 772.472495][T21000] ? __pfx_dump_stack_lvl+0x10/0x10 [ 772.472517][T21000] ? __pfx__printk+0x10/0x10 [ 772.472542][T21000] ? __might_fault+0xb0/0x130 [ 772.472573][T21000] should_fail_ex+0x414/0x560 [ 772.472599][T21000] _copy_from_user+0x2d/0xb0 [ 772.472627][T21000] do_ip_vs_set_ctl+0x2d3/0xa60 [ 772.472654][T21000] ? __pfx_do_ip_vs_set_ctl+0x10/0x10 [ 772.472672][T21000] ? rcu_is_watching+0x15/0xb0 [ 772.472720][T21000] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 772.472750][T21000] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 772.472770][T21000] ? smc_setsockopt+0x181/0xab0 [ 772.472793][T21000] ? __pfx___mutex_lock+0x10/0x10 [ 772.472821][T21000] ? __lock_acquire+0xab9/0xd20 [ 772.472844][T21000] nf_setsockopt+0x26c/0x290 [ 772.472874][T21000] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 772.472902][T21000] smc_setsockopt+0x232/0xab0 [ 772.472928][T21000] ? __pfx_smc_setsockopt+0x10/0x10 [ 772.472951][T21000] ? __fget_files+0x2a/0x420 [ 772.472971][T21000] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 772.472990][T21000] ? __pfx_smc_setsockopt+0x10/0x10 [ 772.473011][T21000] do_sock_setsockopt+0x179/0x1b0 [ 772.473045][T21000] __x64_sys_setsockopt+0x13f/0x1b0 [ 772.473079][T21000] do_syscall_64+0xfa/0x3b0 [ 772.473099][T21000] ? lockdep_hardirqs_on+0x9c/0x150 [ 772.473120][T21000] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 772.473139][T21000] ? clear_bhb_loop+0x60/0xb0 [ 772.473163][T21000] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 772.473182][T21000] RIP: 0033:0x7f05e218e9a9 [ 772.473198][T21000] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 772.473215][T21000] RSP: 002b:00007f05e2f98038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 772.473235][T21000] RAX: ffffffffffffffda RBX: 00007f05e23b5fa0 RCX: 00007f05e218e9a9 [ 772.473249][T21000] RDX: 000000000000048c RSI: 0000000000000000 RDI: 0000000000000003 [ 772.473261][T21000] RBP: 00007f05e2f98090 R08: 0000000000000018 R09: 0000000000000000 [ 772.473274][T21000] R10: 0000200000000600 R11: 0000000000000246 R12: 0000000000000001 [ 772.473286][T21000] R13: 0000000000000000 R14: 00007f05e23b5fa0 R15: 00007ffe07fe0f68 [ 772.473317][T21000] [ 775.039685][T19153] usb 4-1: new full-speed USB device number 24 using dummy_hcd [ 775.291168][T19153] usb 4-1: config 0 has an invalid interface number: 231 but max is 0 [ 775.341667][T19153] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 775.398369][T19153] usb 4-1: config 0 has no interface number 0 [ 775.426154][T19153] usb 4-1: config 0 interface 231 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 775.502418][T19153] usb 4-1: config 0 interface 231 has no altsetting 0 [ 775.534972][T19153] usb 4-1: New USB device found, idVendor=0df6, idProduct=0056, bcdDevice=21.78 [ 775.560675][T19153] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 775.590092][T19153] usb 4-1: Product: syz [ 775.609465][T19153] usb 4-1: Manufacturer: syz [ 775.655603][T19153] usb 4-1: SerialNumber: syz [ 775.716160][T19153] usb 4-1: config 0 descriptor?? [ 775.975522][T21025] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 775.993831][T21025] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 776.050142][T19153] asix 4-1:0.231 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 776.076642][T19153] asix 4-1:0.231: probe with driver asix failed with error -71 [ 776.219150][ T31] INFO: task syz.4.4268:18564 blocked for more than 143 seconds. SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 776.320437][ T31] Not tainted 6.16.0-syzkaller #0 [ 776.539743][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 776.548853][T19153] usb 4-1: USB disconnect, device number 24 [ 776.599907][ T31] task:syz.4.4268 state:D stack:26368 pid:18564 tgid:18555 ppid:13676 task_flags:0x400040 flags:0x00004006 [ 776.629259][ T31] Call Trace: [ 776.632609][ T31] [ 776.635587][ T31] __schedule+0x16aa/0x4c90 [ 776.657890][ T31] ? schedule+0x165/0x360 [ 776.699553][ T31] ? __pfx___schedule+0x10/0x10 [ 776.720637][ T31] ? schedule+0x91/0x360 [ 776.729122][ T31] schedule+0x165/0x360 [ 776.733344][ T31] schedule_preempt_disabled+0x13/0x30 [ 776.763894][ T31] __mutex_lock+0x724/0xe80 [ 776.768534][ T31] ? __mutex_lock+0x51b/0xe80 [ 776.849139][ T31] ? sync_bdevs+0x1ac/0x340 [ 776.853824][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 776.858888][ T31] ? iput+0x398/0x9d0 [ 776.939536][ T31] ? do_raw_spin_unlock+0x122/0x240 [ 776.944833][ T31] sync_bdevs+0x1ac/0x340 [ 777.009078][ T31] ksys_sync+0xb9/0x150 [ 777.013380][ T31] ? __pfx_ksys_sync+0x10/0x10 [ 777.018261][ T31] ? rcu_is_watching+0x15/0xb0 [ 777.071767][ T31] ? do_syscall_64+0xbe/0x3b0 [ 777.081073][ T31] __ia32_sys_sync+0xe/0x20 [ 777.085718][ T31] do_syscall_64+0xfa/0x3b0 [ 777.145069][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 777.159382][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 777.165957][ T31] ? clear_bhb_loop+0x60/0xb0 [ 777.229215][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 777.235182][ T31] RIP: 0033:0x7fe98cb8e9a9 [ 777.259571][ T31] RSP: 002b:00007fe98d9a9038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2 [ 777.279193][ T31] RAX: ffffffffffffffda RBX: 00007fe98cdb6160 RCX: 00007fe98cb8e9a9 [ 777.309107][ T31] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 777.317150][ T31] RBP: 00007fe98cdb6160 R08: 0000000000000000 R09: 0000000000000000 [ 777.369748][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 777.377892][ T31] R13: 0000000000000000 R14: 00007fe98cdb6160 R15: 00007ffd3aba10c8 [ 777.419121][ T31] [ 777.459542][ T31] INFO: task syz.5.4294:18639 blocked for more than 144 seconds. [ 777.467325][ T31] Not tainted 6.16.0-syzkaller #0 [ 777.510401][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 777.529088][ T31] task:syz.5.4294 state:D stack:27272 pid:18639 tgid:18632 ppid:15070 task_flags:0x400040 flags:0x00004004 [ 777.559044][ T31] Call Trace: [ 777.562474][ T31] [ 777.565422][ T31] __schedule+0x16aa/0x4c90 [ 777.579050][ T31] ? schedule+0x165/0x360 [ 777.583518][ T31] ? __pfx___schedule+0x10/0x10 [ 777.588423][ T31] ? schedule+0x91/0x360 [ 777.594393][ T31] schedule+0x165/0x360 [ 777.598782][ T31] schedule_preempt_disabled+0x13/0x30 [ 777.608909][ T31] __mutex_lock+0x724/0xe80 [ 777.620188][ T31] ? __mutex_lock+0x51b/0xe80 [ 777.624956][ T31] ? sync_bdevs+0x1ac/0x340 [ 777.629962][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 777.635365][ T31] ? iput+0x398/0x9d0 [ 777.649065][ T31] ? do_raw_spin_unlock+0x122/0x240 [ 777.654378][ T31] sync_bdevs+0x1ac/0x340 [ 777.658934][ T31] ksys_sync+0xb9/0x150 [ 777.670703][ T31] ? __pfx_ksys_sync+0x10/0x10 [ 777.675505][ T31] ? do_syscall_64+0xbe/0x3b0 [ 777.688238][ T31] __ia32_sys_sync+0xe/0x20 [ 777.693191][ T31] do_syscall_64+0xfa/0x3b0 [ 777.697743][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 777.713686][ T31] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 777.719612][ T31] ? clear_bhb_loop+0x60/0xb0 [ 777.724421][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 777.730421][ T31] RIP: 0033:0x7f0f59b8e9a9 [ 777.734859][ T31] RSP: 002b:00007f0f5a95c038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2 [ 777.743377][ T31] RAX: ffffffffffffffda RBX: 00007f0f59db6160 RCX: 00007f0f59b8e9a9 [ 777.751397][ T31] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 777.762127][ T31] RBP: 00007f0f59db6160 R08: 0000000000000000 R09: 0000000000000000 [ 777.771297][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 777.780232][ T31] R13: 0000000000000000 R14: 00007f0f59db6160 R15: 00007ffc18a65408 [ 777.788251][ T31] [ 777.794799][ T31] [ 777.794799][ T31] Showing all locks held in the system: [ 777.803805][ T31] 4 locks held by kworker/u8:1/13: [ 777.810060][ T31] 1 lock held by khungtaskd/31: [ 777.815388][ T31] #0: ffffffff8e13f0e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 777.829742][ T31] 1 lock held by klogd/5197: [ 777.834443][ T31] #0: ffff8880b8639e18 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xad/0x140 [ 777.880068][ T31] 2 locks held by getty/5603: [ 777.884915][ T31] #0: ffff88814c7230a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 777.897263][ T31] #1: ffffc9000333b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 777.907984][ T31] 1 lock held by udevd/5859: [ 777.914283][ T31] #0: ffff88802543b358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xd30 [ 777.923974][ T31] 1 lock held by syz-executor/15019: [ 777.929526][ T31] #0: ffffffff8f509f08 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 777.938722][ T31] 1 lock held by udevd/15997: [ 777.949074][ T31] #0: ffff888025583358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xd30 [ 777.992601][ T31] 1 lock held by syz.3.4121/18142: [ 777.997742][ T31] 1 lock held by syz.4.4268/18564: [ 778.003765][ T31] #0: ffff88802543b358 (&disk->open_mutex){+.+.}-{4:4}, at: sync_bdevs+0x1ac/0x340 [ 778.015581][ T31] 1 lock held by syz.5.4294/18639: [ 778.029715][ T31] #0: ffff88802543b358 (&disk->open_mutex){+.+.}-{4:4}, at: sync_bdevs+0x1ac/0x340 [ 778.059087][ T31] 1 lock held by syz-executor/18839: [ 778.064515][ T31] #0: ffffffff8f509f08 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 778.077022][ T31] 3 locks held by kworker/1:10/19154: [ 778.083156][ T31] #0: ffff88801a480d48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 778.097537][ T31] #1: ffffc9000b877bc0 (free_ipc_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 778.149084][ T31] #2: ffffffff8e144bf8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3b9/0x730 [ 778.189386][ T31] 1 lock held by syz.8.5083/21032: [ 778.205043][ T31] 1 lock held by syz.6.5091/21051: [ 778.269223][ T31] 1 lock held by dhcpcd/21054: [ 778.274129][ T31] #0: ffff88802705e258 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xcd0 [ 778.349107][ T31] [ 778.355284][ T31] ============================================= [ 778.355284][ T31] [ 778.410217][ T31] NMI backtrace for cpu 0 [ 778.410239][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 778.410260][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 778.410272][ T31] Call Trace: [ 778.410280][ T31] [ 778.410288][ T31] dump_stack_lvl+0x189/0x250 [ 778.410313][ T31] ? __wake_up_klogd+0xd9/0x110 [ 778.410376][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 778.410397][ T31] ? __pfx__printk+0x10/0x10 [ 778.410433][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 778.410464][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 778.410489][ T31] ? _printk+0xcf/0x120 [ 778.410517][ T31] ? __pfx__printk+0x10/0x10 [ 778.410543][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 778.410574][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 778.410604][ T31] watchdog+0xfee/0x1030 [ 778.410634][ T31] ? watchdog+0x1de/0x1030 [ 778.410668][ T31] kthread+0x70e/0x8a0 [ 778.410697][ T31] ? __pfx_watchdog+0x10/0x10 [ 778.410722][ T31] ? __pfx_kthread+0x10/0x10 [ 778.410748][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 778.410766][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 778.410783][ T31] ? __pfx_kthread+0x10/0x10 [ 778.410808][ T31] ret_from_fork+0x3fc/0x770 [ 778.410830][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 778.410854][ T31] ? __switch_to_asm+0x39/0x70 [ 778.410876][ T31] ? __switch_to_asm+0x33/0x70 [ 778.410896][ T31] ? __pfx_kthread+0x10/0x10 [ 778.410922][ T31] ret_from_fork_asm+0x1a/0x30 [ 778.410961][ T31] [ 778.410968][ T31] Sending NMI from CPU 0 to CPUs 1: [ 778.576965][ C1] NMI backtrace for cpu 1 [ 778.576981][ C1] CPU: 1 UID: 0 PID: 2948 Comm: kworker/u8:8 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 778.577001][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 778.577012][ C1] Workqueue: bat_events batadv_nc_worker [ 778.577041][ C1] RIP: 0010:trace_irq_enable+0x30/0x110 [ 778.577067][ C1] Code: 8b 05 68 df d4 10 83 f8 08 73 3c 89 c3 c1 e8 06 48 8d 3c c5 f0 b3 a0 8f be 08 00 00 00 e8 88 5e 58 00 48 0f a3 1d 00 03 d9 0d <73> 12 e8 99 79 df ff 84 c0 75 09 80 3d ff ed c2 0d 00 74 0f 5b 41 [ 778.577082][ C1] RSP: 0018:ffffc9000bd078c0 EFLAGS: 00000057 [ 778.577095][ C1] RAX: 0000000000000001 RBX: 0000000000000001 RCX: ffffffff81c7b0e8 [ 778.577106][ C1] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8fa0b3f0 [ 778.577116][ C1] RBP: ffffc9000bd07978 R08: ffffffff8fa0b3f7 R09: 1ffffffff1f4167e [ 778.577129][ C1] R10: dffffc0000000000 R11: fffffbfff1f4167f R12: ffffffff8b34c1f8 [ 778.577141][ C1] R13: dffffc0000000000 R14: dffffc0000000000 R15: 1ffff920017a0f1c [ 778.577154][ C1] FS: 0000000000000000(0000) GS:ffff888125d57000(0000) knlGS:0000000000000000 [ 778.577168][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 778.577179][ C1] CR2: 00007ffdfd290fdc CR3: 000000000df38000 CR4: 00000000003526f0 [ 778.577194][ C1] Call Trace: [ 778.577203][ C1] [ 778.577212][ C1] trace_hardirqs_on+0x18/0x40 [ 778.577233][ C1] __local_bh_enable_ip+0x12d/0x1c0 [ 778.577253][ C1] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 778.577279][ C1] ? do_raw_spin_unlock+0x122/0x240 [ 778.577300][ C1] ? batadv_nc_purge_paths+0x318/0x3b0 [ 778.577316][ C1] ? __pfx_batadv_nc_to_purge_nc_path_coding+0x10/0x10 [ 778.577334][ C1] batadv_nc_purge_paths+0x318/0x3b0 [ 778.577357][ C1] batadv_nc_worker+0x328/0x610 [ 778.577382][ C1] ? process_scheduled_works+0x9ef/0x17b0 [ 778.577400][ C1] process_scheduled_works+0xade/0x17b0 [ 778.577432][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 778.577458][ C1] worker_thread+0x8a0/0xda0 [ 778.577478][ C1] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 778.577508][ C1] ? __kthread_parkme+0x7b/0x200 [ 778.577531][ C1] kthread+0x70e/0x8a0 [ 778.577553][ C1] ? __pfx_worker_thread+0x10/0x10 [ 778.577570][ C1] ? __pfx_kthread+0x10/0x10 [ 778.577591][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 778.577605][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 778.577621][ C1] ? __pfx_kthread+0x10/0x10 [ 778.577641][ C1] ret_from_fork+0x3fc/0x770 [ 778.577658][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 778.577676][ C1] ? __switch_to_asm+0x39/0x70 [ 778.577695][ C1] ? __switch_to_asm+0x33/0x70 [ 778.577713][ C1] ? __pfx_kthread+0x10/0x10 [ 778.577734][ C1] ret_from_fork_asm+0x1a/0x30 [ 778.577761][ C1] [ 778.851993][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 778.859155][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 778.869331][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 778.879415][ T31] Call Trace: [ 778.882691][ T31] [ 778.885706][ T31] dump_stack_lvl+0x99/0x250 [ 778.890330][ T31] ? __asan_memcpy+0x40/0x70 [ 778.895066][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 778.900351][ T31] ? __pfx__printk+0x10/0x10 [ 778.904953][ T31] panic+0x2db/0x790 [ 778.908857][ T31] ? __pfx_panic+0x10/0x10 [ 778.913411][ T31] ? nmi_backtrace_stall_check+0x433/0x440 [ 778.919223][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 778.924601][ T31] ? nmi_trigger_cpumask_backtrace+0x2b6/0x300 [ 778.930771][ T31] watchdog+0x102d/0x1030 [ 778.935108][ T31] ? watchdog+0x1de/0x1030 [ 778.939538][ T31] kthread+0x70e/0x8a0 [ 778.943615][ T31] ? __pfx_watchdog+0x10/0x10 [ 778.948399][ T31] ? __pfx_kthread+0x10/0x10 [ 778.953027][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 778.958315][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 778.963786][ T31] ? __pfx_kthread+0x10/0x10 [ 778.968466][ T31] ret_from_fork+0x3fc/0x770 [ 778.973319][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 778.978435][ T31] ? __switch_to_asm+0x39/0x70 [ 778.983289][ T31] ? __switch_to_asm+0x33/0x70 [ 778.988058][ T31] ? __pfx_kthread+0x10/0x10 [ 778.992926][ T31] ret_from_fork_asm+0x1a/0x30 [ 778.997855][ T31] [ 779.001233][ T31] Kernel Offset: disabled [ 779.005647][ T31] Rebooting in 86400 seconds..