last executing test programs: 2m13.473278053s ago: executing program 1 (id=2124): socket$inet_mptcp(0x2, 0x1, 0x106) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1b00"/12], 0x48) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r3, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, &(0x7f00000001c0)=0x7) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r3, 0x84, 0x17, &(0x7f0000000380)=ANY=[@ANYRES32=0x0, @ANYBLOB], 0x9) 2m9.139838703s ago: executing program 1 (id=2132): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, 0x0) 1m57.429804129s ago: executing program 1 (id=2149): sendto$l2tp(0xffffffffffffffff, &(0x7f0000000580)="74e4b542a2ad3177290efb27849ac6b27fc4111dc23317598a874080528f337e141ad1ebe2518aa45b8fe1abf868681643d3d170950d62003518ce16d3362fcfc3b5f4d429fbcba2244d428ec20236070ae801000000e3de0ca54ab0f5762fbdd9617e9c4066e73aa6f52f9705c809084767897a1135eceb8f8959d66acc11aa8d368c757055fdc0159c3cb88bc5af20d5b648f102aa124e27c0efdb9b3af8e1f418bbe98ef18fc60b2abaeea040bc0e1d964c22dbf733a82e21b0435a593ddbfb5028502b875c7fb2b38c6b76c4c12401426af0aabf482b8051fe0c4fdc069446", 0xe1, 0x800, &(0x7f0000000180)={0x2, 0x0, @broadcast, 0x2}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f00000000c0), 0x20302, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) prctl$PR_MCE_KILL(0x21, 0x0, 0x3) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) set_mempolicy(0x8006, &(0x7f0000000340)=0x80000000fff, 0x5) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000000100)={0x0, 0x2800, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000003000000400001802c0004001400010002000000ac14140f00000000000000001400020002000000ffffffff00000000000000000d73797a3200000000cfb35ae42b0694d1c53cd92700a6378e7f5760f3a6e1d62547fd188bade96a06b27dc1189603920d161a535ceaa19caf85ba93b79dd1f53fb55cda2b70ed3a6cd7afb81a1ee51e0aeb0b3707ab9125326a"], 0x54}}, 0x0) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000740)=ANY=[@ANYRES32=0x0, @ANYBLOB="2608e0b670a675bb5b35a3ee172dd3ac49d3b1b4f0e1eaf3247251c62e18304702ed1161b53e26695f7051c740e4037051cd9caa2c22080b4b11da1fcf85f53e5807078c01a5be079e471c869c8ad404c6317e3d0cf872a0df38f8099017401d074f65faad1e008053bd2426ea62ca59c742", @ANYRES32=r1], 0x34}, 0x1, 0x0, 0x0, 0x4c401}, 0x4040140) r4 = socket$kcm(0x25, 0x1, 0x0) recvmsg$kcm(r4, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x160) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000280)='./file1\x00') r5 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) write$qrtrtun(r5, &(0x7f0000000300)="ca", 0x1) creat(&(0x7f0000001380)='./file0\x00', 0x4) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r6 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x40000000000800, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r6, 0xc0145608, &(0x7f0000000040)={0x8, 0x1, 0x1}) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) 1m54.407848306s ago: executing program 1 (id=2156): syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f0000000b80)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fsopen(&(0x7f0000000280)='cifs\x00', 0x0) keyctl$chown(0x4, 0x0, 0xee01, 0xee00) keyctl$KEYCTL_RESTRICT_KEYRING(0xb, 0x0, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x77e}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000380)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) ioctl$VIDIOC_G_STD(r1, 0x80085617, &(0x7f00000003c0)) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0x11) 1m50.701569557s ago: executing program 1 (id=2164): sendmsg$unix(0xffffffffffffffff, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x200000010, &(0x7f0000000000)=0x9, 0x4) recvfrom$unix(0xffffffffffffffff, 0x0, 0x0, 0x10102, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0, r3}, 0x18) newfstatat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300), 0x6000) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_DEV_SETUP(r4, 0x405c5503, &(0x7f0000000180)={{}, 'syz1\x00', 0x40}) ioctl$UI_DEV_CREATE(r4, 0x5501) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r5 = syz_open_dev$radio(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r5, 0xc0205648, &(0x7f00000001c0)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000080)={0xf0f041, 0x2, '\x00', @string=0x0}}) 1m48.68453551s ago: executing program 1 (id=2167): openat$khugepaged_scan(0xffffffffffffff9c, 0x0, 0x1, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000100)=@bridge_getlink={0x20, 0x12, 0x1, 0x20, 0x0, {0x7, 0x0, 0x0, 0x0, 0x8000, 0x8400}}, 0x20}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$IOC_WATCH_QUEUE_SET_FILTER(0xffffffffffffffff, 0x5761, &(0x7f00000009c0)=ANY=[]) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x28000, 0x102) mount(&(0x7f0000000080)=@nullb, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000001640)='debugfs\x00', 0x208000, 0x0) fchdir(0xffffffffffffffff) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, &(0x7f0000000d80)=@e={0xff, 0x9, 0x1, 0x0, @SEQ_CONTROLLER=0xff, 0x51}) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newlink={0x44, 0x10, 0x421, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_PRIMARY={0x8}, @IFLA_BOND_MODE={0x5, 0x1, 0x5}]}}}]}, 0x44}}, 0x0) ioctl$FS_IOC_GETFSLABEL(r0, 0x800452d2, &(0x7f0000000100)) 1m32.902377333s ago: executing program 32 (id=2167): openat$khugepaged_scan(0xffffffffffffff9c, 0x0, 0x1, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000100)=@bridge_getlink={0x20, 0x12, 0x1, 0x20, 0x0, {0x7, 0x0, 0x0, 0x0, 0x8000, 0x8400}}, 0x20}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$IOC_WATCH_QUEUE_SET_FILTER(0xffffffffffffffff, 0x5761, &(0x7f00000009c0)=ANY=[]) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x28000, 0x102) mount(&(0x7f0000000080)=@nullb, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000001640)='debugfs\x00', 0x208000, 0x0) fchdir(0xffffffffffffffff) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, &(0x7f0000000d80)=@e={0xff, 0x9, 0x1, 0x0, @SEQ_CONTROLLER=0xff, 0x51}) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newlink={0x44, 0x10, 0x421, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_PRIMARY={0x8}, @IFLA_BOND_MODE={0x5, 0x1, 0x5}]}}}]}, 0x44}}, 0x0) ioctl$FS_IOC_GETFSLABEL(r0, 0x800452d2, &(0x7f0000000100)) 19.567532236s ago: executing program 2 (id=2334): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000540)={0x10, 0x0, &(0x7f0000000440)=[@request_death={0x400c6313}], 0x0, 0x1000000, 0x0}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) read$FUSE(r2, &(0x7f0000007fc0)={0x2020}, 0x2020) 18.440045811s ago: executing program 4 (id=2335): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r0, 0x6, 0x1, &(0x7f00000000c0)={0x0, 0x747, 0x3, 0x4, 0xfb, 0x8, 0x101}, 0xc) read$char_usb(0xffffffffffffffff, &(0x7f0000000040)=""/236, 0xec) ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, 0x0) connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x484b1e3341a13be1, 0x0) fchdir(r2) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid_for_children\x00') mount(&(0x7f0000000000), &(0x7f0000000040)='./cgroup\x00', 0x0, 0x9001, 0x0) r3 = syz_io_uring_setup(0x81f, &(0x7f0000000480)={0x0, 0xbc02, 0x10, 0x0, 0x30f}, &(0x7f00000000c0)=0x0, &(0x7f0000000540)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) io_uring_enter(r3, 0x47bc, 0x13f8, 0xd, 0x0, 0x0) setsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000000)={0x43, "b80b38"}, 0x6) sendmmsg(r0, &(0x7f0000000640)=[{{0x0, 0x0, &(0x7f00000006c0)=[{0x0}], 0x1}}], 0x1, 0x20004840) 18.424232151s ago: executing program 3 (id=2336): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount(0x0, &(0x7f0000000040)='.\x00', &(0x7f0000000100)='ecryptfs\x00', 0x0, 0x0) setsockopt$XDP_RX_RING(0xffffffffffffffff, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r4, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r4, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a80)={0x6, 0x3, &(0x7f0000000200)=@framed, &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', r5}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) openat$khugepaged_scan(0xffffffffffffff9c, 0x0, 0x1, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000180)={0x6, 0x9, &(0x7f0000000080)=@raw=[@ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}], &(0x7f0000000000)='GPL\x00', 0xff, 0x0, 0x0, 0x41100, 0x0, '\x00', r5, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xf01}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000ff00000000800000308001", @ANYRES32, @ANYBLOB="00000000000000e1513f90000000000000000000", @ANYRES32, @ANYBLOB='\x00'/10, @ANYBLOB], 0x50) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000040000"], 0x48) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="110000000400000004"], 0x48) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000140)={r6, &(0x7f00000000c0), 0x0}, 0x20) 17.353898828s ago: executing program 2 (id=2337): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r4, 0x29, 0x2a, &(0x7f0000000080)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x2}}}, 0x108) setsockopt$inet6_group_source_req(r4, 0x29, 0x2b, 0x0, 0x0) r5 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r5, 0x29, 0x2a, &(0x7f0000000080)={0x20, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x8a}}, {{0xa, 0x0, 0x0, @local}}}, 0x108) setsockopt$inet6_group_source_req(r5, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}}}, 0x108) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@acquire], 0x0, 0x0, 0x0}) r7 = dup3(r6, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000280)={0x10, 0x0, &(0x7f0000000880)=[@request_death], 0x0, 0x200000000000000, 0x0}) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f0000000040)=':%))\\-(-+]\x00', &(0x7f00000001c0)='net/tcp6\x00', 0x0) close_range(r3, 0xffffffffffffffff, 0x0) shutdown(0xffffffffffffffff, 0xfffffffffffffffd) r8 = syz_open_procfs(0xffffffffffffffff, 0x0) pread64(r8, 0x0, 0x0, 0x4fd7) 17.352914625s ago: executing program 3 (id=2338): mount(0x0, 0x0, &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) quotactl_fd$Q_SETQUOTA(0xffffffffffffffff, 0xffffffff80000800, 0x0, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) set_mempolicy(0x4003, &(0x7f0000000200)=0x7, 0x3) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='freezer.self_freezing\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000080)=0x0) waitid(0x0, r1, &(0x7f0000000240), 0x80000000, &(0x7f00000003c0)) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) 16.336474155s ago: executing program 2 (id=2339): socket$inet_mptcp(0x2, 0x1, 0x106) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1b00"/12], 0x48) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r3, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, &(0x7f00000001c0)=0x7) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r3, 0x84, 0x17, &(0x7f0000000380)=ANY=[@ANYRES32=0x0, @ANYBLOB], 0x9) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r3, 0x84, 0x19, &(0x7f0000000340)={0x0, 0x1}, 0x8) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00'}, 0x2d) r4 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r4, &(0x7f00000000c0), 0x10) sendmsg$can_bcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="0400"/16, @ANYRES64=0x0, @ANYRES64=r4, @ANYRES64=0x0, @ANYRES64, @ANYBLOB="0000000001"], 0x48}}, 0x0) r5 = fsopen(&(0x7f0000000240)='romfs\x00', 0x1) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000000)='source', &(0x7f0000000040)='c:::\x00\xfdM\xab\x89\xff\xda\xc7dw2\xa1\xb2\xabuQQ\x14\x97\xc9\xfae\xc7\xa1U\xe2\xbe\"\xb9t\xa0\x0e\xfa\xdb\xf1\xa5.\xd87\xc3p\xa5l\xf8vC\xe2\xe8 \xd5-<#\x186\xe1\xbd\xc0\xc3\xb5N(vj\xa7+<:\xc4\xe00\x01\xdd \x82\x83\xed\x0e\xc4\x1d\xac\xef7\b\xd3Z5\\A\'\x18\xa2\xc3\xab\xc7`\xc3\v\xf3L\x9d[Q\x9e\x11@=\xa1\x9b\xdc\xb1\xef\xc3k<\x97L\xa0\xab\xa6\x1ce\xcd\x99\xb3m\xef\x87\xc5i^N\xbd@\x01\xc0\xb2\x88\xc3\xe2\x96T\xa3\xa5\xeb\x0f\xf2f\xb9$\xd2\x140x0}) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r4}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, 0x0, 0x0) getsockopt$inet6_tcp_buf(r3, 0x6, 0x1a, 0x0, &(0x7f0000000080)) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), r9) syz_genetlink_get_family_id$netlbl_mgmt(0x0, r8) sendmsg$NLBL_MGMT_C_ADDDEF(r8, 0x0, 0xa000000) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x68, 0x10, 0x401, 0xfffffffc, 0x80, {0x0, 0x0, 0x0, 0x0, 0x1503}, [@IFLA_LINKINFO={0x40, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x30, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MACADDR_DATA={0x1c, 0x5, 0x0, 0x1, [{0xa, 0x4, @local}, {0xa, 0x4, @local}]}, @IFLA_MACVLAN_MACADDR_MODE={0x8, 0x3, 0x3}, @IFLA_MACVLAN_MODE={0x8, 0x1, 0x10}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x68}, 0x1, 0x0, 0x0, 0x4001}, 0x0) 16.188263253s ago: executing program 3 (id=2341): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00'}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) socket$kcm(0x2d, 0x2, 0x0) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000080)) ioctl$PPPIOCSMAXCID(r4, 0x40047451, 0x0) r5 = socket$netlink(0x10, 0x3, 0x10) getsockopt$sock_int(r5, 0x1, 0x13, &(0x7f0000000000), 0x0) 15.153102029s ago: executing program 4 (id=2343): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, &(0x7f00000001c0)=0x7) setsockopt$inet_sctp6_SCTP_AUTH_KEY(0xffffffffffffffff, 0x84, 0x17, &(0x7f0000000380)=ANY=[@ANYRES32=0x0, @ANYBLOB], 0x9) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(0xffffffffffffffff, 0x84, 0x19, &(0x7f0000000340)={0x0, 0x1}, 0x8) r3 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r3, &(0x7f00000000c0), 0x10) fsopen(&(0x7f0000000240)='romfs\x00', 0x1) 14.056627344s ago: executing program 4 (id=2344): r0 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) syz_open_dev$sndpcmc(0x0, 0x8, 0x14100) shutdown(0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) sendfile(r2, 0xffffffffffffffff, 0x0, 0x40008) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000200)={'netdevsim0\x00', &(0x7f0000000280)=@ethtool_pauseparam={0x12, 0x0, 0xfffffffe}}) ioctl$sock_SIOCSIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000200)={0x2, 'vlan0\x00', {0x7}, 0x5}) r3 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$IP_VS_SO_SET_FLUSH(0xffffffffffffffff, 0x0, 0x485, 0x0, 0x0) sendmsg$nl_generic(r3, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000280)={0x0, &(0x7f0000000040)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r0, 0xc06864a1, 0x0) socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'pimreg0\x00'}) ioctl$DRM_IOCTL_MODE_GETFB(r0, 0xc01c64ad, &(0x7f00000002c0)) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000003800010325bd7000fadbdb2504"], 0x14}}, 0x0) 12.725018633s ago: executing program 4 (id=2345): sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) ioctl$IOCTL_GET_NUM_DEVICES(0xffffffffffffffff, 0x40046104, &(0x7f0000000100)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x79902000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) epoll_create1(0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='net/sockstat\x00') socket$inet_tcp(0x2, 0x1, 0x0) mount$9p_fd(0x0, &(0x7f0000000380)='.\x00', &(0x7f00000000c0), 0x1800848, &(0x7f0000000480)=ANY=[@ANYBLOB="7472616e733d66642c7266646e6f3dc0e776df92a744de0460c42690f2f2770749d8c7824b149b2ea7af7357f19d85a21309b0b67191b00fd99ba8e60c9aa77f07a8d682ead5a4966f93839c7feefe634d", @ANYRESHEX=r3, @ANYRESHEX, @ANYBLOB=',cache=fscache,msize=0x00000000000007ff,fscache,cache=mmap,fscache,cache=none,cache=mmap,access=user,version=9p2000.u,\x00']) r4 = msgget$private(0x0, 0x790) msgsnd(r4, &(0x7f0000000d00)=ANY=[@ANYRES8], 0x401, 0x0) msgsnd(r4, &(0x7f0000000200)=ANY=[@ANYBLOB="0000ff"], 0x8, 0x0) 11.165671679s ago: executing program 0 (id=2347): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount(0x0, &(0x7f0000000040)='.\x00', &(0x7f0000000100)='ecryptfs\x00', 0x0, 0x0) 11.098233116s ago: executing program 5 (id=2348): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=@newlink={0x3c, 0x10, 0xa01, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macsec={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACSEC_ICV_LEN={0x5, 0x3, 0x10}]}}}]}, 0x3c}}, 0x0) 10.599842725s ago: executing program 5 (id=2349): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0xffff, 0xa000, @dev={0xfe, 0x80, '\x00', 0xe}, 0xf}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r2, 0x0, 0x18, &(0x7f0000000080)=0x5, 0x4) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000140)={&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ff6000/0x9000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff7000/0x2000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000000000)="8eee", 0x2}, 0x68) syz_emit_ethernet(0x9b, &(0x7f0000000680)=ANY=[@ANYBLOB="0180c200000300000000000088a80c0081000000080045040085006400000073907800000302ac1414aa000019fa00719078aff151a55b805ef5580a852f810e8397363e4b42a36395b41d38db50a1bd009e3a17325b47b6f347ab59b7b37de3c3c9c98dadebb34bf58b745ce7a5778a003a6de9c8c0d0f20ebf00eb066aff00b4ada1041004e9ce57f97d8aa1719c7a5d8c42ed8479c3021daa85b836f5ad7b055c8e3a3a6bbc"], 0x0) r3 = bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0x0, 0x0, 0x0, 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) bind$inet(r2, 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x2b0, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x2c8, 0x2e8, 0x2e8, 0x2c8, 0x2e8, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast1}, @mcast1, [], [0x0, 0x0, 0x0, 0xfd], 'erspan0\x00', 'geneve1\x00'}, 0x0, 0xa8, 0xd8, 0x0, {0x0, 0x2000000000000}}, @common=@unspec=@CONNMARK={0x30}}, {{@ipv6={@local, @empty, [0xffffffff, 0x1ff000100, 0x0, 0xffffffff], [0xff, 0xffffff, 0x0, 0xffffff00], 'pimreg0\x00', 'wlan1\x00', {}, {}, 0x21, 0xb, 0x1, 0x16}, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@mcast2, [0xffffff00, 0xff000000, 0x0, 0xffffff], 0x4e23, 0x4e22, 0x4e23, 0x4e20, 0xf81, 0x9, 0x500, 0x7ff, 0x200}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x310) openat$rfkill(0xffffff9c, &(0x7f0000000040), 0x8080, 0x0) poll(0x0, 0x0, 0xc) r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$VIDIOC_ENUM_FMT(r4, 0xc0405602, &(0x7f00000003c0)={0xe, 0xa, 0x1, "020000000000005525052e8bd9e6660201000000000000000000000200", 0x3231564e}) r5 = syz_usb_connect(0x0, 0x0, 0x0, 0x0) syz_usb_control_io$uac1(r5, 0x0, &(0x7f0000000ec0)={0x44, &(0x7f0000000400)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r5, 0x0, 0x0) getsockopt$inet_sctp_SCTP_NODELAY(0xffffffffffffffff, 0x84, 0x3, 0x0, &(0x7f0000000340)) rseq(&(0x7f00000004c0)={0x0, 0x0, 0x0, 0x6}, 0x20, 0x0, 0x0) r6 = msgget(0x0, 0x2c4) msgsnd(r6, 0x0, 0x2000, 0x0) msgctl$IPC_RMID(r6, 0x0) wait4(r0, 0x0, 0x4000000a, 0x0) syz_pidfd_open(r0, 0x0) 10.582406506s ago: executing program 2 (id=2350): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r4, 0x29, 0x2a, &(0x7f0000000080)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x2}}}, 0x108) setsockopt$inet6_group_source_req(r4, 0x29, 0x2b, 0x0, 0x0) r5 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r5, 0x29, 0x2a, &(0x7f0000000080)={0x20, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x8a}}, {{0xa, 0x0, 0x0, @local}}}, 0x108) setsockopt$inet6_group_source_req(r5, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}}}, 0x108) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@acquire], 0x0, 0x0, 0x0}) r7 = dup3(r6, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000280)={0x10, 0x0, &(0x7f0000000880)=[@request_death], 0x0, 0x200000000000000, 0x0}) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f0000000040)=':%))\\-(-+]\x00', &(0x7f00000001c0)='net/tcp6\x00', 0x0) close_range(r3, 0xffffffffffffffff, 0x0) r8 = syz_open_procfs(0xffffffffffffffff, 0x0) pread64(r8, 0x0, 0x0, 0x4fd7) 9.927739791s ago: executing program 0 (id=2351): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) r3 = syz_open_dev$loop(0x0, 0x5, 0x2042) ioctl$BLKSECDISCARD(r3, 0x127d, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = syz_io_uring_setup(0x110, &(0x7f00000000c0)={0x0, 0x10, 0x0, 0x3}, 0x0, &(0x7f0000000280)=0x0) io_uring_register$IORING_REGISTER_FILES(r4, 0x2, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) syz_io_uring_submit(0x0, r5, &(0x7f00000002c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[0xffffffffffffffff], 0x1}) syz_usb_connect(0x0, 0x2d, 0x0, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x3a, 0x0, 0x0) r6 = syz_open_procfs(r0, &(0x7f00000020c0)='cgroup\x00') read$FUSE(r6, &(0x7f0000000000)={0x2020}, 0x2020) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) statx(r6, &(0x7f0000002100)='./file0\x00', 0x6000, 0x100, &(0x7f0000004600)) sendmsg$NFT_BATCH(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000002040)=ANY=[@ANYBLOB], 0x90}}, 0x0) move_mount(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c, 0x0, 0x165) socket$netlink(0x10, 0x3, 0x0) 8.494100361s ago: executing program 2 (id=2352): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount(0x0, &(0x7f0000000040)='.\x00', &(0x7f0000000100)='ecryptfs\x00', 0x0, 0x0) setsockopt$XDP_RX_RING(0xffffffffffffffff, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x18}, 0x10) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r3, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) 7.819830304s ago: executing program 5 (id=2353): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RELDISP(r0, 0x5605) syz_usb_connect(0x3, 0x0, 0x0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = syz_io_uring_setup(0x110, &(0x7f00000000c0)={0x0, 0x10, 0x0, 0x3}, &(0x7f0000000180)=0x0, &(0x7f0000000280)) io_uring_register$IORING_REGISTER_FILES(r4, 0x2, &(0x7f0000000300)=[0xffffffffffffffff], 0x1) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_usb_connect(0x0, 0x2d, 0x0, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x3a, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000002140)='maps\x00') read$FUSE(r6, &(0x7f0000000000)={0x2020}, 0xfffffc7a) ioctl$TUNSETCARRIER(r6, 0x400454e2, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) statx(0xffffffffffffffff, &(0x7f00000045c0)='./file0\x00', 0x6000, 0x0, &(0x7f0000004600)) sendmsg$NFT_BATCH(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x90}}, 0x0) io_uring_enter(r4, 0x47f6, 0x0, 0x0, 0x0, 0x0) move_mount(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c, 0x0, 0x165) r8 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'bridge_slave_1\x00'}) 7.819478765s ago: executing program 3 (id=2354): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x4, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ptrace$ARCH_SHSTK_ENABLE(0x1e, r1, 0x0, 0x5001) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000180)={'bond0\x00', &(0x7f0000000040)=@ethtool_pauseparam={0x26}}) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000180), 0x4) mincore(&(0x7f0000184000/0x2000)=nil, 0x2000, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x400455c8, 0x2) lseek(0xffffffffffffffff, 0x10000000005, 0x0) r4 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r4, 0x0, 0x0) sendto$inet6(r4, &(0x7f00000001c0)='O', 0x1, 0x80, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r4, 0x84, 0x1a, 0x0, &(0x7f0000000140)) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="02c920"], 0x17) 6.423152539s ago: executing program 3 (id=2355): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sendto$l2tp(0xffffffffffffffff, &(0x7f0000000580)="74e4b542a2ad3177290efb27849ac6b27fc4111dc23317598a874080528f337e141ad1ebe2518aa45b8fe1abf868681643d3d170950d62003518ce16d3362fcfc3b5f4d429fbcba2244d428ec20236070ae801000000e3de0ca54ab0f5762fbdd9617e9c4066e73aa6f52f9705c809084767897a1135eceb8f8959d66acc11aa8d368c757055fdc0159c3cb88bc5af20d5b648f102aa124e27c0efdb9b3af8e1f418bbe98ef18fc60b2abaeea040bc0e1d964c22dbf733a82e21b0435a593ddbfb5028502b875c7fb2b38c6b76c4c12401426a", 0xd3, 0x800, &(0x7f0000000180)={0x2, 0x0, @broadcast, 0x2}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f00000000c0), 0x20302, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) prctl$PR_MCE_KILL(0x21, 0x0, 0x3) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) set_mempolicy(0x8006, &(0x7f0000000340)=0x80000000fff, 0x5) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000000100)={0x0, 0x2800, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000003000000400001802c0004001400010002000000ac14140f00000000000000001400020002000000ffffffff00000000000000000d73797a3200000000cfb35ae42b0694d1c53cd92700a6378e7f5760f3a6e1d62547fd188bade96a06b27dc1189603920d161a535ceaa19caf85ba93b79dd1f53fb55cda2b70ed3a6cd7afb81a1ee51e0aeb0b3707ab9125326a"], 0x54}}, 0x0) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000740)=ANY=[@ANYRES32=0x0, @ANYBLOB="2608e0b670a675bb5b35a3ee172dd3ac49d3b1b4f0e1eaf3247251c62e18304702ed1161b53e26695f7051c740e4037051cd9caa2c22080b4b11da1fcf85f53e5807078c01a5be079e471c869c8ad404c6317e3d0cf872a0df38f8099017401d074f65faad1e008053bd2426ea62ca59c742", @ANYRES32=r1], 0x34}, 0x1, 0x0, 0x0, 0x4c401}, 0x4040140) r4 = socket$kcm(0x25, 0x1, 0x0) recvmsg$kcm(r4, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x160) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000280)='./file1\x00') r5 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) write$qrtrtun(r5, &(0x7f0000000300)="ca", 0x1) creat(&(0x7f0000001380)='./file0\x00', 0x4) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r6 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x40000000000800, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r6, 0xc0145608, &(0x7f0000000040)={0x8, 0x1, 0x1}) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) 6.396141583s ago: executing program 0 (id=2356): sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(r4, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xc}) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000100)=ANY=[@ANYRES32], 0x20) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) ioctl$USBDEVFS_CONTROL(0xffffffffffffffff, 0xc0105500, &(0x7f0000000040)={0x0, 0x1, 0x1, 0x8000, 0x0, 0x0, 0x0}) ioctl$KVM_SET_LAPIC(r5, 0x4400ae8f, &(0x7f0000000140)={"1fb18f59ea850d0f97ecef9f3ac650b2fa293778535d45aebccf0d26cbd6a7e1d89defe6796caf18308722be06e3cafa38f8dbdf7a5bd024db56c672fce92f9138dca0a49f02bdb6a04f052e00d98b82c0bb82f9c4eed019fb6ed8525717a27be3a588a6c85dfbcfee42198a906a3064735a856d318ef9cad710ba86f159db841a78ac645ed3d89462e7cbe5f85dd06854d44aa199f21d77c33d0c0657b8c7bd4dfa488d793fc1d4a63e00722911ab4af6544abdfc5a24cf0dbe7dba76afc12df6df2d250b34629fb724621125c87318bb4e828cc353952a4042adf7b995e2e055067fea7d730e6d4df31ee809a6bfb88259e80e94870a0621f61404494186743608cf9e1406cc49abf91622f6b7ac601e7a15385a41da145d290a4840f9b95463ff865b7d777c22325a09ec8653247a58242f13afd2b63fcf8af362ac264df858fcc5724848255338a2725b53ef9eeda152d7784320729094768bb9e4c7878e8da8e515f68376ca2a6fc55586d1c0e6076f0cce745ba3db43cb4e57768d24953805865dc705e1d0193f5e5fc83e1ed82742ca9e2925e5de2ae582032cbdc662733863bf9e3ef018d48dfae43c9a243f14c2e77725b838bafd25ec3e0436a2553839a158b1627d8165c216483a4897a73d9fc102b669db8fb1abe78ba9ce63bd314e332f988c16c22ec96469615217194cedce0b0323f99bfff76da2b36e92a51c44bdbd761eec611df14e3eb83d5062135069707565f454293e5b0a9c29bc4f42d1425b3fd825a2aaba360050cef7cb68132fb9929a49162baa8aeb5418a44450ff2795bce24e7306ca75c10fff57f47f44a33ee6af0bce9f6ccf5e8e0a10be9e30abc2fd51300a7c8416c57f357a82b8c42139723c32339a3795902c2eb29984f756863a2474d4636689553b40875c8e14e401b89729bd27e0b25a49f7cf56b4c7e66aa1e7dc862d301482dcb73f871ef53127ae6e57ec87addf51fcde1507e59d69b0d5218826fc17af7ca9349b16afbea7d2e7ab2c5592204808a216ccb11fea0320d68ffe3d777d91e0e97937b8927befcc21b604d9ff3ad0bc22280f6414957a474bc5f7a0d9ff6a97b35eb988fa6602ba179aeefa1f9bacc5ed7a6b4641407574a4d704ab788c4f80d20f41779ec55d06aed50366e457b2f09632ae4cd2e8feac2ca107960a4992949114d1269e390ebc1dc7e970691bcebf0296738dfc4fe3b744b3f9b6c8b58ec5163b6b2f39b4680503d8668d3486cc57be388ade823f209eb0ef5f648da3241ce450a90bbdb30a0559f163435e57c8367b8938e05853872d49deeb625f993b054ae7e570a98c3f2a8a137771fdb9e9f94a6446cd2f030a28ab2439825c4d036623bcc51d77f26bde0c79fcccf14b6f2609cec9d31b361b6ed8c87b4695f07f1146c0eef3f4ea882d45bc6d2823f981bd9db0dcaa"}) ioctl$KVM_SIGNAL_MSI(r4, 0x4020aea5, &(0x7f0000000100)={0x33338000, 0xf000, 0x3, 0x1, 0xff}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0}, 0x18) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e24, 0x10000, @private0, 0x5}, 0x1c) r6 = syz_open_dev$usbfs(&(0x7f0000000080), 0x70, 0x101301) ioctl$USBDEVFS_IOCTL(r6, 0xc0105512, &(0x7f0000000200)) bpf$PROG_LOAD(0x5, 0x0, 0x0) 4.644000676s ago: executing program 5 (id=2357): bpf$MAP_CREATE(0x0, 0x0, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[], 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'lo\x00'}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='kfree\x00'}, 0x10) r4 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f00000001c0)='cdg\x00', 0x4) setsockopt$inet_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet(r4, &(0x7f0000000280)={0x2, 0x10, @remote}, 0x10) 4.067778597s ago: executing program 0 (id=2358): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0, 0x0, 0xffffffffffffffff}, 0x18) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='sys_exit\x00'}, 0x10) socket$inet6(0xa, 0x2, 0x3a) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) write$vga_arbiter(0xffffffffffffffff, &(0x7f0000000040)=@other={'lock', ' ', 'mem'}, 0x9) close(0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r4 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) readv(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000340)=""/196, 0xc4}], 0x1) shutdown(r4, 0x0) 3.968262213s ago: executing program 4 (id=2359): syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f0000000b80)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fsopen(&(0x7f0000000280)='cifs\x00', 0x0) keyctl$chown(0x4, 0x0, 0xee01, 0xee00) keyctl$KEYCTL_RESTRICT_KEYRING(0xb, 0x0, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x77e}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, 0x0) ioctl$VIDIOC_G_STD(0xffffffffffffffff, 0x80085617, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x60081, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0x11) 3.590016424s ago: executing program 3 (id=2360): socket$inet_mptcp(0x2, 0x1, 0x106) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1b00"/12], 0x48) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r3, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, &(0x7f00000001c0)=0x7) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r3, 0x84, 0x17, &(0x7f0000000380)=ANY=[@ANYRES32=0x0, @ANYBLOB], 0x9) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r3, 0x84, 0x19, &(0x7f0000000340)={0x0, 0x1}, 0x8) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00'}, 0x2d) r4 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r4, &(0x7f00000000c0), 0x10) sendmsg$can_bcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="0400"/16, @ANYRES64=0x0, @ANYRES64=r4, @ANYRES64=0x0, @ANYRES64, @ANYBLOB="0000000001"], 0x48}}, 0x0) r5 = fsopen(&(0x7f0000000240)='romfs\x00', 0x1) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000000)='source', &(0x7f0000000040)='c:::\x00\xfdM\xab\x89\xff\xda\xc7dw2\xa1\xb2\xabuQQ\x14\x97\xc9\xfae\xc7\xa1U\xe2\xbe\"\xb9t\xa0\x0e\xfa\xdb\xf1\xa5.\xd87\xc3p\xa5l\xf8vC\xe2\xe8 \xd5-<#\x186\xe1\xbd\xc0\xc3\xb5N(vj\xa7+<:\xc4\xe00\x01\xdd \x82\x83\xed\x0e\xc4\x1d\xac\xef7\b\xd3Z5\\A\'\x18\xa2\xc3\xab\xc7`\xc3\v\xf3L\x9d[Q\x9e\x11@=\xa1\x9b\xdc\xb1\xef\xc3k<\x97L\xa0\xab\xa6\x1ce\xcd\x99\xb3m\xef\x87\xc5i^N\xbd@\x01\xc0\xb2\x88\xc3\xe2\x96T\xa3\xa5\xeb\x0f\xf2f\xb9$\xd2\x140xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) rt_sigaction(0x19, &(0x7f0000000000)={0xfffffffffffffffc, 0x44000006, 0x0}, 0x0, 0x8, &(0x7f0000000440)) r3 = memfd_create(&(0x7f00000006c0)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\xf2\xed\x04\x00\x00\x00\xd4N\x12\x9b\x1f\t\xd1Z+\x86T\x16\xf8\x01\x00\x00\x00\x9f+\x8d!\x0fG\xab\xc2\xdc\xa3\xb3\xae8\x9f9?\xefo\xa4k\x01\xb2>\xa1\x9c\x86xm\xe6\x9bZ4\x91\x1a\xdb\xdd\x89\xb9\xc0LF;\xd6\x84\x195\x06\x00\x00\x00~\xf3S\x12\"p^\xc1jP\x8a\xc6[\xbd\xe7q]\xdd\r\x1aZS\x01*\x1b\xfd\xbcMA\xdcq\xa1\x00\xb3\xf9\x91r\x7f\xdc\xf1\xc3G,\xdb\xccS\x15\x95b\x17\xab\xe4?\x96\x95\xa4kP\x99YO\xb8V\xd5p\x90X\xaaf', 0x0) fallocate(r3, 0x0, 0x400000002000000, 0x2) 1.614286649s ago: executing program 5 (id=2362): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000003c0)={'wlan0\x00'}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000009c0)={0x1bdc, 0x0, 0x1, 0x7d, 0x0, {{}, {@void, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}], @chandef_params, @NL80211_ATTR_CH_SWITCH_BLOCK_TX={0x4}, @NL80211_ATTR_CSA_IES={0x1bbc, 0xb9, 0x0, 0x1, [@beacon_params, @beacon_params=[@NL80211_ATTR_BEACON_HEAD={0x299, 0xe, {{{0x0, 0x0, 0x8, 0x0, 0x0, 0x1, 0x1}, {0x7ff0}, @broadcast, @device_a, @random="d9c7a6da523b", {0x7, 0x9}}, 0x3, @random=0x1, 0x2000, @val={0x0, 0x6, @default_ap_ssid}, @void, @val={0x3, 0x1, 0x7c}, @val={0x4, 0x6, {0x2, 0x8, 0xfffd, 0x4}}, @void, @val={0x5, 0x6, {0x4, 0x64, 0x40, "0042cd"}}, @void, @val={0x2a, 0x1, {0x0, 0x0, 0x1}}, @void, @val={0x2d, 0x1a, {0x2, 0x0, 0x4, 0x0, {0x7, 0xb, 0x0, 0x2, 0x0, 0x0, 0x1}, 0x1, 0x3, 0x6}}, @val={0x72, 0x6}, @val={0x71, 0x7, {0x1, 0xffffffffffffffff, 0x1, 0x1, 0x1, 0x7}}, @void, [{0xdd, 0x81, "329cdf1f677c5292d6120061f9022754f493bbd5a6407e862b6f9ccb5ee5abd436a06021de9b896a5888d96ba3255599153a98fcb2e4f530f292c2daa81e3463920082758e546d48d58d4870ec4cec2c2d6e898ee2e989d3e5aa6587e42dc2c0fc44f0ceb105aaa2ba37774d585cfd18a4bf30b532d05049769eccb177a8167644"}, {0xdd, 0x6, "3d49adcd200d"}, {0xdd, 0x12, "e9dc134c1340c276d5f0e94555cca1366074"}, {0xdd, 0x28, "b5c2f3e647161d8bcc8e0633ab2dd51fe6618447a349d98f50c9070c90175d07f29a1bc9900678b6"}, {0xdd, 0x65, "dcd02d4b97cc9904e26bc416c48bac6e9368d8a6c02bc0bcfc851f5342187075e3780656be6b1a40749c1acf0d38a5a256fc400f77a08d42362bcd0190e978b7f8079d0403993686f4457a37f42cfcbadb26876625f0741ce4c5b37391080b6f56432ce2fc"}, {0xdd, 0xdc, "3c79b939fdff4265af2d97cb6e9a1fef8e6fbee34e832fce524f8149381ce950b18bef2281c9cfe939a6485d3927ac2b455c29764f97fa19247b7ffd1272f1f6e32e275273721527eb3fd576aa1dab37c512b97868ad5317e4afbb3daffd2c941350372b9e464ef27b7797efa11713f674f50bdefa275ddd9c876b09d5bd811e7dec6a9c6ec8ab7948f6956138e8c84fb8e6683191bdb2237c1498c8c517bfbea8161acaf0fa3be3bb24a02c89361d377fecae624d97f0bbf298fab59157cee8420f54a74c429d50572d28384aea41f98b0d1f0a21605a07f3ff6af3"}, {0xdd, 0x16, "6487ef44901439ff7557527e71da0c18bd28207b107e"}]}}, @NL80211_ATTR_IE={0x58, 0x2a, [@sec_chan_ofs={0x3e, 0x1, 0x1}, @challenge={0x10, 0x1, 0x1b}, @chsw_timing={0x68, 0x4, {0xe5a1, 0x57}}, @peer_mgmt={0x75, 0x16, {0x1, 0x2, @void, @val=0x15, @val="9acf2831ebcd243011e6a8f1024ea4b6"}}, @prep={0x83, 0x25, {{0x0, 0x1}, 0x6f, 0x0, @device_b, 0x4e11, @value=@device_b, 0x3, 0xb5, @device_b, 0xfffffffc}}, @mesh_config={0x71, 0x7, {0xffffffffffffffff, 0x0, 0x0, 0x1, 0xffffffffffffffff, 0x2, 0x1}}]}, @NL80211_ATTR_IE={0x63, 0x2a, [@supported_rates={0x1, 0x3, [{0x1b, 0x1}, {0xc}, {0x5}]}, @ssid={0x0, 0x6, @default_ap_ssid}, @mesh_config={0x71, 0x7, {0x1, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x2, 0x4}}, @ext_channel_switch={0x3c, 0x4, {0x0, 0x8, 0x3c, 0x8}}, @prep={0x83, 0x25, {{0x0, 0x1}, 0x1, 0x36, @device_b, 0xfffffffc, @value=@device_b, 0x3, 0x5, @device_b, 0x9}}, @ht={0x2d, 0x1a, {0x10, 0x3, 0x3, 0x0, {0x3, 0x9, 0x0, 0x3fe, 0x0, 0x0, 0x1}, 0x6, 0x4, 0xb4}}]}, @NL80211_ATTR_BEACON_TAIL={0x4}, @NL80211_ATTR_IE_PROBE_RESP={0x56, 0x7f, [@random_vendor={0xdd, 0x26, "f1784e05e96abebe1de18145a531010fd76d6dc9f2bbdde9da6a4313e864e83d96bc8ddddfa3"}, @dsss={0x3, 0x1, 0x8c}, @prep={0x83, 0x25, {{0x0, 0x1}, 0x5, 0xff, @device_a, 0x400, @value, 0x2, 0x1, @device_a, 0x10000}}]}, @NL80211_ATTR_PROBE_RESP={0x3e1, 0x91, "52e68926e438d905eb45a3c62122c5e7160e9a50a73162c65702644b293a70ce2c2068425fda32e38d7cf779df426299d4d1ea10e5b4e4352787d80218c5ad67f54f47f96334e58dc9253543bf0dd92975e61e1914e7c483e797f191e9dd6f1431dd3719cb91d8c41a17abd1eb628ea2e213245a243af006a0aae148a99292b9cae2549cf6973c91025a912ffebfa02b4fa190a095f79f22704112818f0bfedc1893ecb1a14758e07b6d675b0398b287a932d4da1bd30ad3228935aedb6d0d62d36c0351da6434ea51103540645da4b5b29f58517ed81f3dd3848b8ea9a66934d7edcf24cc6b49d4ec66a2a23a9d7b6673c62e4698b91f52ba679f1f28531be19e807b905727f9d53b3958023b4861c66e03855faa038bb890b3058ae465ded4b6c5e2ce388a097416ebb6093ca8a0e42149ea6ad3307764639813bbe0203ed3d625f6fd81cfb4a4edd623830cbddfaa28cc7c9a6b378e6d7e6dcb4470df5ed00507e53960104fcbab4e0506618b7f595f3dbd259d4dd1bccbd8045439d0a607bd0ab6cae9b2153441526b7acdd83ef6bfcab97a617840016c3e269e9f341614ecbf51f175d44e21da02b5989e25cb010619a25669ea50f1754e4d2d30b514df03fae988c9003268ff5e0a739afa52580547fac1d6c9d065c30e19ade46ecbd91ca9c2fbfed32fa5c0401bdc8df4f275ad17bf44d843129253993e264c3668136c25b0168347ab98a1c0510adee670fd63e326ac9267fe6643042b14df2422cb0a81ecea48e89a48456e93a820bce548e1b209ca5258987fcdb471e527c316a870875c28616edf0ebc3f824708b36b1002959498fd5b56222d51ff0724abc33291b2f360d3443d79b32133ed6635c774dea0578c6ac3d7a6ce109a2f41d25aac7ac7801c00d0315e39c251e3969c6a7ad8a71b9c7fcde73dbc1a55843f7a40334507c31dae46060a27a282e6ab785e8bfb0bd865d8395735b8cb949f760e39fdde3d336ee741af6b09201f3890be57f6f328550dc3b907d213e0a7b4052cb31d3a59e3f159135ad2c0543e186d84991b7bad4a58f39df6a0e7d3c1aae88cd00a089ac8618b31238dffbbf541befebe12464000cce98d1acd21d66e2d77eb49446966350011c6514f777945907284dad56b62d26bc268256dccd1fc3c4e89f1bc35b1d6d5369c2d85e57056ab82a22a896f9ecdf5e181c19a765c5eaa9a23950a917e26ecbff631915b86533a508572313516129e645ffdcd2db8ab1752450a7d3ac16e90177337ed92841ad6d7e2b67cf56431534d783494f74d7e3204d57041a0cfa49c6b3372d514df9d61421f256900c1a12f543cb38477f3e6f2c509496393e044397628050384bed2f52af668983a9b63d1bbb8fe7a430d755909"}, @NL80211_ATTR_FTM_RESPONDER={0x1074, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_CIVICLOC={0xfc4, 0x3, "d9ee49257f5a758d432373e7f4d345699915c710e6f3dd4c839986dacc9ebf2c42bfd0a39d6c60cfb38dd724abf0314cdb2399dc4ce825f7d2dec20c2fc9c9cc1bf61a2c2c490927ca434e8c64270bc9e12c155e91272afe3d5ef67f2d5ed13ef10ee6ade7ad893041fe9ed3f5f5af19482e801f2496a2e2ebb696af1fb5513d8d19625ac7663d900b20f8eeb72bb853be5d7596879a335f73517cb322005a86fea7433cc060cbd4378deb30438bc1e8aff305a1036a419aed8b2703518c93c22c87f0d3799486e66fe572d63467a1f8c1569f2613e7c10d0551b61bf322757492b666a5abe04d288c7e2704eb6daffc4dced3131eed14c785a2e260bbb864a1ec17373d95f10bf573b19ebc1d47720da716aa637a049af0cd77697aab11828b6fa33d6992cc9f56aa0f9491b23177f98477789c373ce26f09b16c155819d873fb472cb9fb8578e34fc9d1eb613d8c83d4ee09fad3e04f35dae77ea77055801e24b3ed6a9ca995ae9758d9a4c986526f3492f5b96f929516014c07399c5780e13dd62d3b146655a0a0fdfcd7b0eb9ede585a3b39c9f5dd28d9508a5f23b83c7fa40dd4eedb170cb73948bcdf858dc2c3ac6c731538fcaf55c6f4c39c0718c25d1535d976f7aeece4c477fac6d1476e1483c7fd4d32242faa7b7a77f1fc2027982a53b1257a4e38477f3787cd2d9286d47160e31e51c23292320ab8e8737b8423343a61582ef5c5f67e019846910e05ddd5800e85bcc7f5e066b4516e61bab3a67f7d2b8a01dc46ba1537772b1cda66bf3ff41b304f8592a99f0ea375d6eca79ffe87fc366e2c67d9d7a1ec08792ad59071768a3a2e558eafa964cb7cdea1fd66721d148955496d93594ecf727bb5bf1a34ebc4d35d7af518481d33a64389b2942e05359225d06149a4d871b329cea35b04d6b27924395d277e630a2ba079b8bad472866782d21ca76c27dcee872f821dacb96c651605154a1530c7ea3e57ccb4d192195bc2c22df05465c8b992b6320a8b9654fe0c9991d89a5b26197b2284fb2ee622c5b36fb43aca74692e1cb474e5f59fe939c0aeaeab98fceaaace8818857bb59ca37f1d976a201e3afb743464341639db64c26f8fb281a505ead224d03264c653871943ae65c6d88b86d503b275fc1fa43f72c3e94c0bcc536b4e914ef875a69ac6109cad1e27c6128ee386e8f56ed29b1b2382f4ec7cb902a7c0deccc1a8a8b3202b3a4a02604820e8c451aea57d1d818e8df0393b0ac2c87b83fe402fbe715456a0fcd0a028dcafe6d7ba82370ca6a16cce083f6afa10eecacd01419ea23190aefe9d1dacf1504e6c692dfd8ca9de6d5a47d208f78feacf4c44084ea6d19924080fabb4ada3efd5917091c60147c64c89ed57d82e3c5c9e641012976fe1b8d26864613a31d69732d7051a01dc55691febba90988e8a55d48ce7583419f3ca8ec450cd66e8f454dc7038914cc4f1efcad4a02e735e5fe4bb421436917969f0afd213af53542a7b6bd631413954fa621386ac49ed2adf3dca87a7fd9bdcc8ae451e8daa0a6984939981fdd565c05959c5eb89432fe029e0af850a67a91c2fcf2ac911e97972ee140093b5c6bba242b62e70e8201bb1b6b2b682a277f72d22a8a7836bd4aa4e7382eee556e9bd8023d9a1a4dc32a66fafcb5286d27f5a81be09dd0f9935e2160ce71867f4a292b2142d6bbf038d4cc610bccd2c0d66946faabd68c2a3b56561455e5d4a0104228292956d818205c4fccbd695181a2326f5067c5972594fa17c07ad0fc833b36d9c459332f6a2c189b994e0c3d350bed4d54fdcd0a1bdd73804b667445bbc6976e0d35f2fa5ca66187c19bc3f1ac804451e570b4b8d96cd1ec7c4279d4df847411c0fbeeebc6ca487eeaf5195e7f8b63c673a1c27c7f56083b89f486ce63c1be2917cb1e705cd3c55a3666f3d670a165ae176f5fc440921ad4ffe64dc23ba6e9cc0560a34ec39a19bfa18f4fed3b886f91f68963e48b39685e28941388c8555ecf44cc6e71a465520b61ac6ee3c77a5e23326bd9fb1418951cd36c159350cbb75c9535a2501928d225ed00e8fd945c0633a5bc84d96f94d8fad0e31a5917ebb0c118c2b4cf5b2dcf16f240ed9e0484233e0f4e7ec0d7e52a5ecd97bbd6dd39d5a339ca8e9287b98b99c8df578dcc9745210cdd6413094bf6e7a09e34c2c004e4a7eb4bc371873c6cec7ef85b388640a104879f7683e507f13bb6bee4dafac8f068ce4a39438e56ffc5b23628cae5f90b622d5e227531ea6d65d86e2289b01f99292d05908e2588def0e0d73d5543f7035d65b0b7638d333244af842e076f856db4bd041ca9d737c7f0d33baa6f15a4be806b106dd479b8cf5c57684ca2f14f1daf3817c1cea91a0c0641f53c9e0892032b4a391e575c451bfa449b447eb11dd653c8ceba928f570697aaee547649db6d8a4997e2336ea0b001172d0a2459f0063a6f1893936b614fe455fc5b3470875e92eba34aeb7c95c2b64f213f330ca06c257b9958bc84024c254b72b0190ed2d1e193c79b8825e5dafc683a55d6c7e5c27673e389544bee1867f36d7105a9394bdf53c1c7edacdd92714264cd0b58d868da3dee779ea43157bdf92000768d3d2850c093e15ed8886ec0409332bc062cd2cfcb607d8c914a75f6b3e49b57959d6cfe26fa1fbc6b99092a67652cf92beb65108358ab0409eebaf3d06375da87a3e7432571bce616a91444334d1079e389b67f8c49fc249ec237ba5170b6bc3e65159140fa944114b14595fad8c3a06fc6cb1ae658a97b2b11af42513871c51026cbedc318930b249a3c068de8a0901d239762eafcd6a5cd78506190671a35acb9820cc3c2fd1eccc3bf688879751389df56a36f5a24ef50cea13462ae04f6ad5ad3ae9155947cd5292f2f91611610e4b62f77273617b4a1080bb7fd4127ea22de29782308cce8e924d8e95b0dc698e159fa64a20881231b7bf494c22002d19f8c067818acaf5f73de901555a506eda052d0521b4f2669086412279fa810ff534b4defad2f7386d898322694e8b76b6c7a454849ea6b96f8c8858812b2ada339ccefecbff9dc901bfb2a71a2c54e7093780cb59d5eb54b3d067ed67a6c17f672feebe3ddaebf3e1f0c28101883fa66dbd79e32a6e178c9c9e3b2367d383e1797631420cb9dcc36ae6d664ec68f3fd14a7ddb88f1efc26a32fc9b0f322857b644cbb3f27348c1506e9cd4b7c9ed0a1b84ca58ba249581a628d8da016dc5178db59cfa90dc7db171246cb8e5dfa71cc61473be9c7d5be813c3ebb0da0de5d75fec4230690f09798655611922e4f76571ea39088880c69c285a39193ed5a64237204fece607ecf40dc8ee3233b5f1630f81fbb1821161693351c003eb9815be05b082447429b6c75c4ee3507a61e57ee8e515b1c1d32673cf64e0f0259415ee5094b859991a11d818748b49c7ecefbdf68ba2972dcb278880d163b913a1b33bcbadbbc8dd597ebd9dc3abc6cf79bd181e2355ceb7444b3b50789502dbf4b3db8ff438d5b53cb69de452d30e199b9a2159f2fc8397897691c625695146b23c59c78531c0f0fabec5d9135730ce5c52a23b300b4b304c7f7d60129657263870a948709a6ba9b4c8d696677e7ed4ea3175774480b7d0f985f8ec92d3af1a2e416c2cfce06171b500571cbdffe23ec2be85f48373a52b55d5bf36feb5c2b98a0f3d123b6c35cc5b8de568fc09a1a1a85ac9dc1676e34c302cdc44dc6a1294d1caf8105a559a42d7a5de4e6c80ff954cae26a2bbdff97baa416b78545aab4dcb89df91b71e8de4caa01f6ce43dca5b335aaedfaa8f1cfba19b34e39469101be7ffc15d72822abfca7a770c6f61791eb8a890ec2e8e1de42c7fe7c5f1e5c356678abc7b6971356bd6c7c203f8babb97c4ac1f480a39811f9f985d96acd85b20cc394d6b26e2e933816606bdc14fdb040bf0acfd3f91f75e5fa00a02ef922dbb3a6449153a2bef28defbad8c6c4ab67fba22e775100edd028b3d82a07a19b4ec0d18491cea58a1737eb5bc9749f91275996e22b6aac8695351777a8a0948ff24671a74dac03776286427361dd3c37d8c96941ab1ec84266a51dd241e41c61b1f76cfd88f790117bfc9e1adf0b1855fe24bfe911c9408e2079ebfc9a22a1d5b0d8b240e02e4fc39087513c7b0d96d8d8045310bc9cacfa71ebb66c869960d6caff17591cf1f976524e895a90dd1c69cd60d5aff434924043c1133bdd8dc735d012476ae417e72f2379af3cc36b94260254bd67391812b3308825a8736e4f8d05fbdb2fcb3f053d29b2167b0d211e6a048108a3fc91dce00a46b09e6e8118a637cb747cc5ab8f86f40dd1d4dddbea651a76852826c6af8d333640a5c26117f26ab2385b2ebbdf5b409c92911d573882350763e724c196de02afa108bd2009b4fd4b1f325b7f87bc9641227509dd13a075b770945a4d61b67b297e18748b42af9a60d3fec8b5c483deb2338639b9cb09af550ec371d0020e20135c2ce30d460af8e33b82b8dfcf58a9717e5cc77920c5c1dbc112881869a179ede245ab6769c17178f82433736009bf29c90dfc47347af14facb51a845f2e3a551b4ea7567e46b7e91056b4998e376dbe1ff721a59cc08a9bf4b196a2177eeac79066c208154903bbf2b683aa01f100db8a1b76b74bf4403aa5c82a7431d4f7436665b454b31f29847d1d7b25b387ddb1ee21656598a992c155833fad8c6ec8bc0b4d33fb3720cb93214cdfbdda054b9fb361e44d0dd16fb5742ddbd253f0553a226bfcebddea8ff99b399a92ef2a1718100ce5d21dbaf4bd56ef05549efca19041c3a30300ee541bfc01e8fd0b53446be456df3936aaaa3c8e4b50c9a395ac928a5d8eda5419ca81da9f91175a19460c6e25a1839f6d648ec666ed6466658dc0e927fd5b09120b32820ebe8c8fcb28bb604422e89e428bdbbaa443fcb5c6afdcfc0af119a8e6725d4d34acab95da2bd96ffb59c0ac7d6a77d3221ff527afb059bab91ac37b4d993cdbd5e0e566a7053b040c7459e1ee4d56ccae5330a472dcb74710b5d78d15f35894c2ba24eb8423809df642d1be8180fe3371520e65f649f0ecccae2c9a69bbd92c399a27dcb0e878f8ceb8c8223a7588fa5a65f1710b8e704726cf33da12cc4ae5406ce00f7da36bb5308d1a55e26b989d97ca7672f971c7b77e8dfd785486693a1b9b95db930a72641e9e8e681a65d94422c8978a3e898510a6b7f62ba15ce397bc072f25e3323e24a8b4c75d8a202d69fe6128f55dc9e7142c46ab379cb984c021e57420fca6b036f20510fc7eca7cc7dd5b1f430bf5a6d4d5cf659738a25fd98359087f9478e36335c4bc23583b8020bf04aeb9b6ee87065308a0caa461a6f98b02ee4dd1202fb682333a883c295a4e64ed4a87df95e881af73de1b5267457bff21b339639ca6c44458e9527f65a00daf46195225d93ecf444dc018756b9154e80be045d3b568e80e724aec2404b08bc2dcb1a5c77878dfbad7ce1125f6683f7d0566e271e6188bbedd1a271b4d72130fb49eb506c009d06a84413a7e66e9b618bc7efe4fab5fe81ce326a70a16dbec79c82803a34f15c0981ad6af34ad862523e0a29dd5de3de6f5f4c4c79a57d110728e5b207a1e55a9209492b1ed83bc67039050530c76d9f4fafe63652c590f73c6768470c28de774d9f505ff519ac67dafdb67728776d9"}, @NL80211_FTM_RESP_ATTR_CIVICLOC={0xaa, 0x3, "2d21eabefcd779e94099b1b55d00d0c4dcb2d4ba5adbf47efe49392904f93e83ec3eb374dd328ff62d6f2202d1ed988661e0866ca84259ab027c855314b8bc5f7cc21792adaad9bf282e2940956b301b73e134cd339f22d8875e00123c42c2bb7d995a08262274473f982c97497e9063e4421587a0a5d8eb1c48e479603c1124bda8e18a1452ad2b452564b528cfd794e53c117d539ed8c3e5d485373bea741d852054327a02"}]}, @NL80211_ATTR_BEACON_HEAD={0x34a, 0xe, {{{0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1}, {0xff}, @broadcast, @device_a, @random="b25972e0d06a", {0x5, 0x8}}, 0x7, @random=0x2, 0x8000, @void, @val={0x1, 0x4, [{0x60, 0x1}, {0xc}, {0x60, 0x1}, {0x16, 0x1}]}, @void, @void, @val={0x6, 0x2, 0x45}, @val={0x5, 0x88, {0x9, 0x99, 0x2, "c1e0b04574b62f21ee93832cf8322f0b23a5f7c13945e70e7665ed72822ae7eb95bc81907ae786c5fc1657a24dd354b72d4cd28265e96cf629b028a69ee236a295147004f138466c5064fb03bc477262078dfc26e7f1f7c49344d1e341d050ea2406f84cc51c08a499ccb63f09787569db063b3911b07851f624bd4b3ba99f82cec6820df3"}}, @val={0x25, 0x3, {0x1, 0xb4, 0xfd}}, @val={0x2a, 0x1, {0x1, 0x0, 0x1}}, @void, @void, @val={0x72, 0x6}, @void, @void, [{0xdd, 0x1c, "9ed626babf77cbd2f3e100a1f262c42b55de8ee5652c9fbbffe45323"}, {0xdd, 0x3b, "0d95df8e466e332165b0483831135440b3ac74ead7fed0c735cdb91eb70696b97d97cf928aee986d49bd36f2ccdfbde4c027c40a52d538448fb6bd"}, {0xdd, 0x81, "4e0f16a2d083faabc847903bea56dc05c3455080a74711d7a46b00465f9879622399d32a778b7abc04769adcad3391f16fcde94f177503d1dfc9a48ed391cbb6edc16e1279ad006c5e053ac680653ee02cf7cdc87b4b3a31e6746144603325c0918e505494ba39036610dc09ae990f4b11af756eeb5cfb3b4f76ccdb171c951081"}, {0xdd, 0xa8, "a5425006ba3c4fb3d21ae53cd1d3ab4ba72afc88e04706b5c1a61cf2ad62c35ec9ff0fa2d232013516118f4607e5e713095082285634c8d42ccbd29cc8876407cd15ac8697cce0638a63203512dea1024e4d313c897634e78b14f6c2fb2cc9a7fe832e9eb1c4112828c984b1915eb6da5caa4da2ffcef80de96b7bd7362cb0bd31f35515db40e9d37d397db09df1de8b1350dc06f0c5b96aa4fee8bf0bc9e2934976e5b1008b35b6"}, {0xdd, 0xf4, "2a89078b2967d1b43b9cb4bb0e92dd558085f3f9e28146802676d68bddd4bb9f411bda33f03c60989528e096b5ae072a3af7839a1a9ccf03677db8f7c72ecc2a4f71ba35ee36ca5cce17d615cd42f50660b00cb331b55dbf02c84b9cb3cc0ee02854538ddf78f52d740cb38815cfdbbf7f098812b4c31d93d78f1c8017653af812166aadfe076981dd695440f56c7606f6d7fc7007fd20e35114a63692bd110757d6ba03d8813feaabc4cd4c5c70044f1f5b264ae18ab9a858ee0cbdd8b9b8ec2a2dd7fe51feb5bfcd75d87ed09ff49c77939200a83c20d6a3818eb45d3a89267bbc894f8bc14b6514098c71da13e2e110a6aa86"}]}}], @NL80211_ATTR_CSA_C_OFF_PRESP={0xa, 0xbb, [0x0, 0x7, 0x6]}, @NL80211_ATTR_CSA_C_OFF_PRESP={0xe, 0xbb, [0x2, 0x1, 0x7ff, 0x0, 0x1]}, @NL80211_ATTR_CSA_C_OFF_PRESP={0x6, 0xbb, [0x7]}, @NL80211_ATTR_CSA_C_OFF_PRESP={0x10, 0xbb, [0x4, 0x2, 0x5, 0x6, 0x7fff, 0x100]}, @NL80211_ATTR_CSA_C_OFF_BEACON={0x8, 0xba, [0x5, 0xcc]}, @NL80211_ATTR_CSA_C_OFF_PRESP={0x18, 0xbb, [0xfff, 0x7, 0xa, 0x9, 0x5, 0x4, 0x1000, 0x6, 0x6, 0x1]}, @NL80211_ATTR_CSA_C_OFF_PRESP={0x4}, @NL80211_ATTR_CSA_C_OFF_BEACON={0x8, 0xba, [0x9, 0x9]}]}, @chandef_params]}, 0x1bdc}, 0x1, 0x0, 0x0, 0x4000010}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'wlan1\x00'}) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000900)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f00000000c0)='syzkaller\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000280)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_emit_ethernet(0x42, 0x0, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000100)={0x0, 'erspan0\x00', {0x1}, 0x26}) r2 = memfd_create(&(0x7f0000000440)='+\x8b\x8a\xa9\x16\x11\x91J\xbc+ \x18\x17\xc2:}\xa3\x9bO\xdd\xdf\xdf\x92\xd5\xed\xb4\x17\xe5\xd6\x9a\xb2\xd8\x9ba\xde\xb2.F\xc0\x99}|\xaf\xd3\x1d\x84[*_\x9f\x9d\xb0rYP\x1b\x9f \xe0\x9cgq\x103\x89\x11\x87Rv\x169\xdf\xe3>B\x04\x00\x00\x00W\xd3\xec\xfb\xdf?\xa2\x90+\xa4!\xb2\xf2\xff\x90\a\xc3\x12\xc4;\xffh\xf1x=\xb9c\xce\x03h\xdap\x88U\x1788\x82\xd7\xfd\x83\x00Sx\x91%\x99_\xfe\xd4c\x83\x86\x0f\xa4a-\xaf\x9e\xd9\xef\xe0)]\x00F\xfa\x03\xbc4\xc4\x9a\v\x03\x8b\xa4\xf3\x8f\xf4\"\'\xd3\a9\x14H}j&~\xe9\x16\x83o\xbd\xab\xcd[\xbd\xcb\x04\xfc\xe7\xe3\x9e?\x12\xf0\xf4\x83M3\xd88\x92?@\v\xe6\xd1\xd2\xe4\xde\xdaUeJ\x9fR\xd1`\xfa\xc8\v\xed\xfd\x0e\xa6l\a\xb0\xf5\xa9^a\xf0h\x16\xc8\x89W\x847\x88\x82\x94\x14\xe33\xb7H\xc8b\xd6@3F#\xb7\x04C\x8dm\t\x16a\x0fI\xf4\xfe\xf8\x06j\x19Pz&\xb8\x0f\x98`W\xdb\xc6\"81A\xa4\x8bT\xf1\xcb\xab\xa3\t\xef\xdf&\x0e\xad\x03\x123.\xc2V\xaa\xd5\xf8\xde\x8aV\xa4p{\xcez\xa2\x92\xdb8*wLO\f\x97X\x05\x9a\xc2\xe8\x85\x9d\xcb\xc8\xf0\xc4\x01\x03\xe3?\x9f1\xb4\xfb\xa5y`KB\xdf\xae#\x94C\a\x04\xea\xccG\xf2\b\x8f\xf7\xb1\xe96\x90\xf5P\xa4\'\xce\xe3\xa24\x196\xc5Q\xa1K\x95\xd6\xfal\xe9\xd1\\\r&\xb2c\xb3\x8d\xa7\xb7\xa8\x03S\xbd\xdd\b{\xae\f\x10\xc2\xbb\xd0\xdd*\xa3\xb4\fJ\x00X\xab`N; LF\xa5D\xee\xdf\x7f\x80p\xf6o\x1c\xbdXR\xf2\xa0\x81a\xa1\xe1B\x93Xn\x00\xfc\x05?\xab\xac\x91x\xa8#\xe1\xbeQ\xd1^\x9b\xb9)\xd3\n\xf7(3!\x18\b\xc0\xaampRl\xfdQ\x03\x8c\xd5\xe4\\\xed\x9a\xd1?\xd21\xc8\x90\x1dl|\xd1\x14\xbc3\xe0\x1e\x0e\xe6\x88Y\x99K\x93\x1c@_P\x8c\xc7\x9eZ\xb74KT:\x8a\xdbJ#w\x18\x14\x00\x93\x86\xa5wo\xf6M\xe7D\xf4*\xe3X\x1d\x19\x83\xa7w\xc7+7\x89s\xed\x8a\xd7O\xdd\rhh`\xc0\xa8$\x06pu\xa0\xd0L\x0ez@I\xb8\x83\xb2f\x93j\a0I\xc8l\xe5\x9b\x06\xb5\xac`d\xa3\xcf/\x14\x10\xab\xab\t\xec\xc1UAA\xaf\x14\xef\xbap@*7\x86\xdf\',\x03Y\xb1$\xf0\xb5}\xf0\x82%)9`\x8f\x04\x85m\x80\xd2\xcf@\x06}\xea\xe7w`\xa5\x11\x9f\x9b\x9e\x8f\xb7cb\x1a\xe1\xcf\x87\x1c\\\xf5\xc21\xf7\x82C*\xd5;\x00\x00\x00\x00\x03\xba\xe3\xdc\x92\'\x8e\xd5\x7fG\xfd.\x91\x89T\x99t\xd4d,\xd5\x92O\xf1\xafT!Y\x8e\\\xac\xf7\x11R\x05p\x1a\"\r\xe9\xe5\x8b&\x0f\x8c\xfb\xef\xf8\xd5\x18\xde\xeb\xe5\x19\xdd\xebQ8\xc5iS+\x06D\x16\xfe\xf5.\xe5\v\x89\xb0\"\xa3M\xe9\x81\x11P\xdb\xc4\xc2y\x14\x04\x06\xf6\f\xb0\xecz\x8d`\xb5\x9b\xb43\xcc1\xa7\x9e\xa8\xb5\'\xc6MAe\x0f\xd1\xfcG\xc2/\xe8\xe9t\xcaQ\xf1\fI\x1chM\xc1\x92\xe3\xc3\x01M\xc8/\xefJ\xcb\xd0]\f\xff\xf5\x92\xce\x97Z\xea\xe8\x99\xfa\x96\xce\xa7\x02\xad\xa2\xce\x955\xeaNg\x02\xcd\xfd\x1a}.\xd3\"x\x89/8H\xc2\x93B\na)\x86\xa9U\xa0\xb7\x18\xfb\xe9\xd1\x97cy\xef\xbc\x1a\xbf\xc4\xdd\xe2\x9eBk\x1d\x8eg>\x87\x0e:\x9f\x88\xc0\x9ay\xffQ\xd6\xaf\xf5\xc1\xf3{\x91\xfc\x02t\'H \x97', 0x2) fcntl$addseals(r2, 0x409, 0x8) r3 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10) setsockopt$SO_BINDTODEVICE_wg(r3, 0x1, 0x19, &(0x7f0000000080)='wg1\x00', 0x4) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) sendto$inet(r3, &(0x7f0000000040)="e5", 0xffffffe4, 0x0, 0x0, 0x0) 274.035613ms ago: executing program 0 (id=2363): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$comedi(0xffffffffffffff9c, &(0x7f000000b200)='/dev/comedi1\x00', 0x8040, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000300)={0xb0000000, 0x6, 0x6, 0x8}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0x60, 0x30, 0x1, 0xfffffffe, 0x0, {}, [{0x4c, 0x1, [@m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x4}}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x800}, 0x40040) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x3000) r2 = syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f0000000180)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r2, 0xc06864a1, &(0x7f00000001c0)={0x0, 0x0, r3, 0x0}) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r2, 0xc01864b0, &(0x7f0000000240)={r3, r4, 0x0, 0x0, 0x4}) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r2, 0xc01864b0, &(0x7f0000000000)={r3, r4, 0x0, 0x0, 0x3}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000a00)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@nfs_export_on}]}) rmdir(&(0x7f0000000380)='./file0/../file0\x00') r7 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r7, 0xb) 272.993673ms ago: executing program 5 (id=2364): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00'}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) socket$kcm(0x2d, 0x2, 0x0) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000080)) ioctl$PPPIOCSMAXCID(r4, 0x40047451, 0x0) r5 = socket$netlink(0x10, 0x3, 0x10) getsockopt$sock_int(r5, 0x1, 0x13, &(0x7f0000000000), 0x0) 0s ago: executing program 2 (id=2365): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x4, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ptrace$ARCH_SHSTK_ENABLE(0x1e, r1, 0x0, 0x5001) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000180)={'bond0\x00', &(0x7f0000000040)=@ethtool_pauseparam={0x26}}) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000180), 0x4) mincore(&(0x7f0000184000/0x2000)=nil, 0x2000, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x400455c8, 0x2) lseek(0xffffffffffffffff, 0x10000000005, 0x0) r4 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r4, 0x0, 0x0) sendto$inet6(r4, &(0x7f00000001c0)='O', 0x1, 0x80, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r4, 0x84, 0x1a, 0x0, &(0x7f0000000140)) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="02c920"], 0x17) kernel console output (not intermixed with test programs): 09.677257][ T12] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 509.822493][ T12] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 509.981956][ T12] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 511.476413][ T5849] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 511.493279][ T5849] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 511.507781][ T5849] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 511.544405][ T5849] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 511.566099][ T5849] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 512.101064][ T12] bridge_slave_1: left allmulticast mode [ 512.132807][ T12] bridge_slave_1: left promiscuous mode [ 512.172014][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 512.269597][ T12] bridge_slave_0: left allmulticast mode [ 512.284013][ T12] bridge_slave_0: left promiscuous mode [ 512.300767][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 512.457765][ T9535] kvm: kvm [9534]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0x40000006) = 0x0 [ 513.683914][ T5849] Bluetooth: hci0: command tx timeout [ 513.751338][ T9549] netlink: 32 bytes leftover after parsing attributes in process `syz.0.806'. [ 514.378262][ T9551] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 514.612764][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 514.625176][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 514.635928][ T12] bond0 (unregistering): Released all slaves [ 515.765582][ T5849] Bluetooth: hci0: command tx timeout [ 516.270695][ T9570] program syz.0.811 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 516.353966][ T9570] program syz.0.811 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 516.381566][ T9570] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 516.421611][ T12] hsr_slave_0: left promiscuous mode [ 516.434968][ T12] hsr_slave_1: left promiscuous mode [ 516.461867][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 516.473492][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 516.502272][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 516.513983][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 516.590072][ T12] veth1_macvtap: left promiscuous mode [ 516.617091][ T12] veth0_macvtap: left promiscuous mode [ 516.637366][ T12] veth1_vlan: left promiscuous mode [ 516.658776][ T12] veth0_vlan: left promiscuous mode [ 517.844100][ T5849] Bluetooth: hci0: command tx timeout [ 518.171044][ T51] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 518.192919][ T51] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 518.205980][ T51] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 518.222068][ T51] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 518.237020][ T51] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 518.473892][ T12] team0 (unregistering): Port device team_slave_1 removed [ 518.517529][ T12] team0 (unregistering): Port device team_slave_0 removed [ 519.119897][ T9595] netlink: 32 bytes leftover after parsing attributes in process `syz.3.818'. [ 519.810908][ T9526] chnl_net:caif_netlink_parms(): no params data found [ 519.924689][ T51] Bluetooth: hci0: command tx timeout [ 520.274963][ T9610] netlink: 28 bytes leftover after parsing attributes in process `syz.3.820'. [ 520.324239][ T51] Bluetooth: hci1: command tx timeout [ 521.400965][ T9526] bridge0: port 1(bridge_slave_0) entered blocking state [ 521.410679][ T9526] bridge0: port 1(bridge_slave_0) entered disabled state [ 521.439244][ T9526] bridge_slave_0: entered allmulticast mode [ 521.558488][ T9526] bridge_slave_0: entered promiscuous mode [ 521.580493][ T9526] bridge0: port 2(bridge_slave_1) entered blocking state [ 521.620173][ T9526] bridge0: port 2(bridge_slave_1) entered disabled state [ 521.632747][ T5849] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 521.651418][ T9526] bridge_slave_1: entered allmulticast mode [ 521.657542][ T5849] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 521.666215][ T5849] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 521.675559][ T5849] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 521.683847][ T5849] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 521.693880][ T9526] bridge_slave_1: entered promiscuous mode [ 521.801954][ T9627] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 521.841819][ T13] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 521.882330][ T9589] chnl_net:caif_netlink_parms(): no params data found [ 521.946422][ T9526] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 521.979259][ T13] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 522.011462][ T9526] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 522.067953][ T13] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 522.404803][ T5849] Bluetooth: hci1: command tx timeout [ 522.739670][ T13] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 522.793449][ T9526] team0: Port device team_slave_0 added [ 522.828281][ T9526] team0: Port device team_slave_1 added [ 522.898362][ T9589] bridge0: port 1(bridge_slave_0) entered blocking state [ 522.934294][ T9589] bridge0: port 1(bridge_slave_0) entered disabled state [ 522.941590][ T9589] bridge_slave_0: entered allmulticast mode [ 522.986921][ T9589] bridge_slave_0: entered promiscuous mode [ 523.087658][ T9589] bridge0: port 2(bridge_slave_1) entered blocking state [ 523.110144][ T9589] bridge0: port 2(bridge_slave_1) entered disabled state [ 523.120822][ T9589] bridge_slave_1: entered allmulticast mode [ 523.140339][ T9589] bridge_slave_1: entered promiscuous mode [ 523.262415][ T9589] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 523.273293][ T9526] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 523.280804][ T9526] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 523.311109][ T9526] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 523.484624][ T9526] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 523.491624][ T9526] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 523.538479][ T9526] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 523.775930][ T5849] Bluetooth: hci3: command tx timeout [ 523.847997][ T9589] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 523.986293][ T9589] team0: Port device team_slave_0 added [ 524.000140][ T9589] team0: Port device team_slave_1 added [ 524.138249][ T9526] hsr_slave_0: entered promiscuous mode [ 524.149741][ T9526] hsr_slave_1: entered promiscuous mode [ 524.158619][ T9526] debugfs: 'hsr0' already exists in 'hsr' [ 524.183990][ T9526] Cannot create hsr debugfs directory [ 524.203161][ T9589] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 524.210338][ T9589] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 524.245546][ T9589] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 524.262322][ T9589] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 524.271174][ T9589] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 524.323660][ T9589] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 524.487989][ T5849] Bluetooth: hci1: command tx timeout [ 524.530268][ T9661] process 'syz.3.831' launched './file2' with NULL argv: empty string added [ 524.751848][ T9589] hsr_slave_0: entered promiscuous mode [ 524.769085][ T9589] hsr_slave_1: entered promiscuous mode [ 524.806212][ T9589] debugfs: 'hsr0' already exists in 'hsr' [ 524.840898][ T9589] Cannot create hsr debugfs directory [ 524.900733][ T51] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 524.911365][ T51] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 524.920419][ T51] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 524.930633][ T51] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 524.941642][ T51] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 524.972234][ T13] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 525.167043][ T13] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 525.372268][ T9624] chnl_net:caif_netlink_parms(): no params data found [ 525.505806][ T13] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 525.772181][ T9667] netlink: 28 bytes leftover after parsing attributes in process `syz.3.832'. [ 525.815043][ T13] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 525.853835][ T51] Bluetooth: hci3: command tx timeout [ 526.132565][ T9624] bridge0: port 1(bridge_slave_0) entered blocking state [ 526.140962][ T9624] bridge0: port 1(bridge_slave_0) entered disabled state [ 526.155691][ T9624] bridge_slave_0: entered allmulticast mode [ 526.171604][ T9624] bridge_slave_0: entered promiscuous mode [ 526.199233][ T9624] bridge0: port 2(bridge_slave_1) entered blocking state [ 526.211148][ T9624] bridge0: port 2(bridge_slave_1) entered disabled state [ 526.218618][ T9624] bridge_slave_1: entered allmulticast mode [ 526.228679][ T9624] bridge_slave_1: entered promiscuous mode [ 526.595641][ T51] Bluetooth: hci1: command tx timeout [ 527.043881][ T51] Bluetooth: hci4: command tx timeout [ 527.061589][ T9624] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 527.083053][ T9624] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 527.253924][ T9683] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 527.688476][ T9624] team0: Port device team_slave_0 added [ 527.697893][ T9624] team0: Port device team_slave_1 added [ 527.707339][ T13] bridge_slave_1: left allmulticast mode [ 527.713014][ T13] bridge_slave_1: left promiscuous mode [ 527.720634][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 527.732696][ T13] bridge_slave_0: left allmulticast mode [ 527.738737][ T13] bridge_slave_0: left promiscuous mode [ 527.744681][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 527.759734][ T13] bridge_slave_1: left allmulticast mode [ 527.765925][ T13] bridge_slave_1: left promiscuous mode [ 527.771646][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 527.781614][ T13] bridge_slave_0: left allmulticast mode [ 527.787461][ T13] bridge_slave_0: left promiscuous mode [ 527.793267][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 527.918161][ T13] bond1 (unregistering): (slave ip6gretap1): Removing an active aggregator [ 527.927577][ T13] bond1 (unregistering): (slave ip6gretap1): Releasing backup interface [ 527.936545][ T51] Bluetooth: hci3: command tx timeout [ 528.312769][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 528.328885][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 528.347661][ T13] bond0 (unregistering): Released all slaves [ 528.499329][ T13] bond1 (unregistering): Released all slaves [ 528.801169][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 528.816322][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 528.832210][ T13] bond0 (unregistering): Released all slaves [ 528.975844][ T9624] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 528.989940][ T9624] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 529.030033][ T9624] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 529.056469][ T9624] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 529.063466][ T9624] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 529.089422][ C1] vkms_vblank_simulate: vblank timer overrun [ 529.098176][ T9624] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 529.114793][ T13] tipc: Disabling bearer [ 529.124246][ T51] Bluetooth: hci4: command tx timeout [ 529.130676][ T13] tipc: Left network mode [ 529.151314][ T9690] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 529.308239][ T9624] hsr_slave_0: entered promiscuous mode [ 529.315526][ T9624] hsr_slave_1: entered promiscuous mode [ 529.321746][ T9624] debugfs: 'hsr0' already exists in 'hsr' [ 529.328104][ T9624] Cannot create hsr debugfs directory [ 529.342293][ T9663] chnl_net:caif_netlink_parms(): no params data found [ 529.583398][ T9663] bridge0: port 1(bridge_slave_0) entered blocking state [ 529.591804][ T9663] bridge0: port 1(bridge_slave_0) entered disabled state [ 529.599183][ T9663] bridge_slave_0: entered allmulticast mode [ 529.613092][ T9663] bridge_slave_0: entered promiscuous mode [ 529.625371][ T9663] bridge0: port 2(bridge_slave_1) entered blocking state [ 529.632528][ T9663] bridge0: port 2(bridge_slave_1) entered disabled state [ 529.641269][ T9663] bridge_slave_1: entered allmulticast mode [ 529.659475][ T9663] bridge_slave_1: entered promiscuous mode [ 530.004276][ T51] Bluetooth: hci3: command tx timeout [ 530.043121][ T9663] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 530.087020][ T13] hsr_slave_0: left promiscuous mode [ 530.093009][ T13] hsr_slave_1: left promiscuous mode [ 530.099284][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 530.106794][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 530.117017][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 530.124503][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 530.140852][ T13] hsr_slave_0: left promiscuous mode [ 530.146832][ T13] hsr_slave_1: left promiscuous mode [ 530.152704][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 530.161414][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 530.171555][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 530.179046][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 530.214180][ T13] veth1_macvtap: left promiscuous mode [ 530.219772][ T13] veth0_macvtap: left promiscuous mode [ 530.225511][ T13] veth1_vlan: left promiscuous mode [ 530.230828][ T13] veth0_vlan: left promiscuous mode [ 530.237403][ T13] veth1_macvtap: left promiscuous mode [ 530.242946][ T13] veth0_macvtap: left promiscuous mode [ 530.249345][ T13] veth1_vlan: left promiscuous mode [ 530.254721][ T13] veth0_vlan: left promiscuous mode [ 530.746896][ T13] team0 (unregistering): Port device team_slave_1 removed [ 530.789527][ T13] team0 (unregistering): Port device team_slave_0 removed [ 531.204179][ T51] Bluetooth: hci4: command tx timeout [ 531.489829][ T13] team0 (unregistering): Port device team_slave_1 removed [ 531.532042][ T13] team0 (unregistering): Port device team_slave_0 removed [ 531.970391][ T9663] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 532.062806][ T9589] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 532.079527][ T9663] team0: Port device team_slave_0 added [ 532.093522][ T9589] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 532.110089][ T9589] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 532.167379][ T9663] team0: Port device team_slave_1 added [ 532.220224][ T9589] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 532.362148][ T9663] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 532.369843][ T9663] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 532.395757][ C1] vkms_vblank_simulate: vblank timer overrun [ 532.426254][ T9663] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 532.473611][ T9663] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 532.491366][ T9663] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 532.537196][ T9663] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 532.599852][ T9526] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 532.651373][ T9526] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 532.671051][ T9526] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 532.776969][ T9526] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 532.838842][ T9663] hsr_slave_0: entered promiscuous mode [ 532.859894][ T9663] hsr_slave_1: entered promiscuous mode [ 532.867247][ T9663] debugfs: 'hsr0' already exists in 'hsr' [ 532.873069][ T9663] Cannot create hsr debugfs directory [ 532.975836][ T5849] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 532.992213][ T5849] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 533.004335][ T5849] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 533.015465][ T5849] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 533.023268][ T5849] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 533.284036][ T51] Bluetooth: hci4: command tx timeout [ 533.430714][ T9663] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 533.458096][ T9624] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 533.495149][ T9624] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 533.523147][ T9589] 8021q: adding VLAN 0 to HW filter on device bond0 [ 533.548499][ T9663] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 533.562506][ T9624] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 533.618567][ T13] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 533.643242][ T9624] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 533.688827][ T9663] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 533.745256][ T13] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 533.804413][ T9663] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 533.832071][ T9526] 8021q: adding VLAN 0 to HW filter on device bond0 [ 533.862182][ T13] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 533.897244][ T9589] 8021q: adding VLAN 0 to HW filter on device team0 [ 533.916868][ T9715] chnl_net:caif_netlink_parms(): no params data found [ 533.950718][ T9526] 8021q: adding VLAN 0 to HW filter on device team0 [ 533.978171][ T13] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 534.019296][ T6382] bridge0: port 1(bridge_slave_0) entered blocking state [ 534.026469][ T6382] bridge0: port 1(bridge_slave_0) entered forwarding state [ 534.069814][ T3026] bridge0: port 2(bridge_slave_1) entered blocking state [ 534.077023][ T3026] bridge0: port 2(bridge_slave_1) entered forwarding state [ 534.125868][ T3026] bridge0: port 1(bridge_slave_0) entered blocking state [ 534.133038][ T3026] bridge0: port 1(bridge_slave_0) entered forwarding state [ 534.193621][ T6382] bridge0: port 2(bridge_slave_1) entered blocking state [ 534.200835][ T6382] bridge0: port 2(bridge_slave_1) entered forwarding state [ 534.302950][ T9715] bridge0: port 1(bridge_slave_0) entered blocking state [ 534.310748][ T9715] bridge0: port 1(bridge_slave_0) entered disabled state [ 534.318145][ T9715] bridge_slave_0: entered allmulticast mode [ 534.326655][ T9715] bridge_slave_0: entered promiscuous mode [ 534.334968][ T9715] bridge0: port 2(bridge_slave_1) entered blocking state [ 534.342117][ T9715] bridge0: port 2(bridge_slave_1) entered disabled state [ 534.349782][ T9715] bridge_slave_1: entered allmulticast mode [ 534.358319][ T9715] bridge_slave_1: entered promiscuous mode [ 534.369232][ T9663] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 534.404974][ T9663] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 534.464600][ T9663] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 534.480020][ T9663] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 534.519511][ T9715] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 534.552883][ T13] bridge_slave_1: left allmulticast mode [ 534.560093][ T13] bridge_slave_1: left promiscuous mode [ 534.568201][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 534.579889][ T13] bridge_slave_0: left allmulticast mode [ 534.586783][ T13] bridge_slave_0: left promiscuous mode [ 534.592488][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 534.605541][ T13] bridge_slave_1: left allmulticast mode [ 534.611296][ T13] bridge_slave_1: left promiscuous mode [ 534.619038][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 534.630063][ T13] bridge_slave_0: left allmulticast mode [ 534.635939][ T13] bridge_slave_0: left promiscuous mode [ 534.641661][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 535.036064][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 535.044864][ T51] Bluetooth: hci2: command tx timeout [ 535.053321][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 535.065289][ T13] bond0 (unregistering): Released all slaves [ 535.371741][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 535.386487][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 535.397708][ T13] bond0 (unregistering): Released all slaves [ 535.418107][ T9715] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 535.506607][ T9715] team0: Port device team_slave_0 added [ 535.517877][ T9715] team0: Port device team_slave_1 added [ 535.664135][ T9715] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 535.671140][ T9715] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 535.698662][ T9715] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 535.758647][ T9715] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 535.765903][ T9715] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 535.802754][ T9715] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 535.939041][ T9624] 8021q: adding VLAN 0 to HW filter on device bond0 [ 536.029428][ T9715] hsr_slave_0: entered promiscuous mode [ 536.038672][ T9715] hsr_slave_1: entered promiscuous mode [ 536.047536][ T9715] debugfs: 'hsr0' already exists in 'hsr' [ 536.053309][ T9715] Cannot create hsr debugfs directory [ 536.129091][ T9526] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 536.197560][ T9624] 8021q: adding VLAN 0 to HW filter on device team0 [ 536.211999][ T9589] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 536.281012][ T3026] bridge0: port 1(bridge_slave_0) entered blocking state [ 536.288227][ T3026] bridge0: port 1(bridge_slave_0) entered forwarding state [ 536.300484][ T3026] bridge0: port 2(bridge_slave_1) entered blocking state [ 536.307690][ T3026] bridge0: port 2(bridge_slave_1) entered forwarding state [ 536.371221][ T13] hsr_slave_0: left promiscuous mode [ 536.377903][ T13] hsr_slave_1: left promiscuous mode [ 536.384451][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 536.391863][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 536.400601][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 536.409003][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 536.420709][ T13] hsr_slave_0: left promiscuous mode [ 536.428475][ T13] hsr_slave_1: left promiscuous mode [ 536.434703][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 536.442095][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 536.450046][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 536.457560][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 536.493949][ T13] veth1_macvtap: left promiscuous mode [ 536.499901][ T13] veth0_macvtap: left promiscuous mode [ 536.506305][ T13] veth1_vlan: left promiscuous mode [ 536.511624][ T13] veth0_vlan: left promiscuous mode [ 536.518339][ T13] veth1_macvtap: left promiscuous mode [ 536.524152][ T13] veth0_macvtap: left promiscuous mode [ 536.529835][ T13] veth1_vlan: left promiscuous mode [ 536.539197][ T13] veth0_vlan: left promiscuous mode [ 537.022203][ T13] team0 (unregistering): Port device team_slave_1 removed [ 537.060185][ T13] team0 (unregistering): Port device team_slave_0 removed [ 537.131467][ T51] Bluetooth: hci2: command tx timeout [ 537.776913][ T13] team0 (unregistering): Port device team_slave_1 removed [ 537.816806][ T13] team0 (unregistering): Port device team_slave_0 removed [ 538.252911][ T9663] 8021q: adding VLAN 0 to HW filter on device bond0 [ 538.337212][ T9663] 8021q: adding VLAN 0 to HW filter on device team0 [ 538.416397][ T1147] bridge0: port 1(bridge_slave_0) entered blocking state [ 538.423570][ T1147] bridge0: port 1(bridge_slave_0) entered forwarding state [ 538.435006][ T9526] veth0_vlan: entered promiscuous mode [ 538.513146][ T9526] veth1_vlan: entered promiscuous mode [ 538.551356][ T4572] bridge0: port 2(bridge_slave_1) entered blocking state [ 538.558673][ T4572] bridge0: port 2(bridge_slave_1) entered forwarding state [ 538.639316][ T9589] veth0_vlan: entered promiscuous mode [ 538.719220][ T9526] veth0_macvtap: entered promiscuous mode [ 538.732528][ T9589] veth1_vlan: entered promiscuous mode [ 538.758565][ T9526] veth1_macvtap: entered promiscuous mode [ 538.857147][ T9526] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 538.910637][ T9589] veth0_macvtap: entered promiscuous mode [ 538.939356][ T9589] veth1_macvtap: entered promiscuous mode [ 538.959352][ T9526] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 539.059796][ T59] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 539.070012][ T59] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 539.088236][ T9624] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 539.127949][ T59] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 539.142611][ T59] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 539.203872][ T51] Bluetooth: hci2: command tx timeout [ 539.229733][ T9589] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 539.261844][ T9589] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 539.386876][ T4572] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 539.402775][ T4572] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 539.432851][ T9715] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 539.442966][ T4572] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 539.452895][ T4572] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 539.475596][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 539.483468][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 539.510194][ T9715] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 539.522727][ T9715] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 539.565370][ T9715] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 539.610400][ T37] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 539.616333][ T9663] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 539.628991][ T37] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 539.756615][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 539.769019][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 540.055655][ T9624] veth0_vlan: entered promiscuous mode [ 540.421544][ T6383] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 540.423149][ T9663] veth0_vlan: entered promiscuous mode [ 540.445832][ T6383] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 540.478645][ T9624] veth1_vlan: entered promiscuous mode [ 540.662250][ T9663] veth1_vlan: entered promiscuous mode [ 540.857436][ T9775] xt_nat: multiple ranges no longer supported [ 541.297717][ T51] Bluetooth: hci2: command tx timeout [ 541.395190][ T9663] veth0_macvtap: entered promiscuous mode [ 541.426372][ T9663] veth1_macvtap: entered promiscuous mode [ 541.477397][ T9715] 8021q: adding VLAN 0 to HW filter on device bond0 [ 541.521528][ T9624] veth0_macvtap: entered promiscuous mode [ 541.545949][ T9624] veth1_macvtap: entered promiscuous mode [ 541.577562][ T9663] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 541.621238][ T9715] 8021q: adding VLAN 0 to HW filter on device team0 [ 541.654778][ T9624] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 541.804781][ T9624] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 542.034649][ T9784] bridge0: entered promiscuous mode [ 542.042127][ T9784] macvlan2: entered promiscuous mode [ 542.608987][ T9786] netlink: 16 bytes leftover after parsing attributes in process `syz.2.842'. [ 542.931232][ T9785] nvme_fabrics: missing parameter 'transport=%s' [ 542.958655][ T9663] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 543.056056][ T9715] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 543.157048][ T9785] nvme_fabrics: missing parameter 'nqn=%s' [ 543.197776][ T9715] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 543.926348][ T4572] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 543.935311][ T4572] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 543.958766][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 543.965997][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 544.005186][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 544.012391][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 544.059912][ T4572] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 544.227604][ T6096] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 544.229374][ T3026] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 544.242977][ T6096] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 544.262143][ T3026] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 544.287278][ T4572] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 544.857644][ T4572] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 544.952300][ T4572] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 544.995131][ T37] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 545.101147][ T37] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 545.198444][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 545.224289][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 545.802263][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 546.005250][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 546.083404][ T5973] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 546.294969][ T5973] usb 3-1: Using ep0 maxpacket: 8 [ 546.300602][ T9715] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 546.474265][ T5973] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 546.483372][ T5973] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 546.559708][ T9824] netlink: 32 bytes leftover after parsing attributes in process `syz.0.830'. [ 546.561732][ T5973] usb 3-1: Product: syz [ 546.619350][ T5973] usb 3-1: Manufacturer: syz [ 547.213809][ T5973] usb 3-1: SerialNumber: syz [ 547.390000][ T5973] usb 3-1: config 0 descriptor?? [ 547.620993][ T5973] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 547.707862][ T9715] veth0_vlan: entered promiscuous mode [ 547.725233][ T9715] veth1_vlan: entered promiscuous mode [ 548.437279][ T4572] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 549.410732][ T4572] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 549.686540][ T4572] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 549.785026][ T5973] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 550.836284][ T5973] usb 3-1: USB disconnect, device number 4 [ 550.852449][ T9715] veth0_macvtap: entered promiscuous mode [ 550.975076][ T9844] netlink: 16 bytes leftover after parsing attributes in process `syz.0.855'. [ 551.680632][ T9844] nvme_fabrics: missing parameter 'transport=%s' [ 551.897032][ T9844] nvme_fabrics: missing parameter 'nqn=%s' [ 552.558914][ T4572] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 552.836672][ T9715] veth1_macvtap: entered promiscuous mode [ 552.985477][ T9715] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 553.182562][ T9715] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 553.886077][ T5849] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 553.897702][ T5849] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 553.946969][ T5849] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 554.001308][ T5849] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 554.016397][ T5849] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 554.085271][ T9874] netlink: 32 bytes leftover after parsing attributes in process `syz.2.861'. [ 554.395364][ T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 554.606197][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 554.658537][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 554.781217][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 554.830343][ T4572] bridge_slave_1: left allmulticast mode [ 554.846048][ T4572] bridge_slave_1: left promiscuous mode [ 554.851876][ T4572] bridge0: port 2(bridge_slave_1) entered disabled state [ 554.873456][ T4572] bridge_slave_0: left allmulticast mode [ 554.883565][ T4572] bridge_slave_0: left promiscuous mode [ 554.889853][ T4572] bridge0: port 1(bridge_slave_0) entered disabled state [ 556.109887][ T51] Bluetooth: hci3: command tx timeout [ 558.166208][ T51] Bluetooth: hci3: command tx timeout [ 558.237233][ T4572] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 558.287560][ T4572] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 558.314098][ T4572] bond0 (unregistering): Released all slaves [ 558.374312][ T5849] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 558.386919][ T5849] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 558.400755][ T5849] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 558.419740][ T5849] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 558.430431][ T5849] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 558.614656][ T30] audit: type=1326 audit(1752824597.990:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9894 comm="syz.1.868" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f0eac78e929 code=0x0 [ 559.074358][ T6383] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 559.083127][ T6383] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 559.121226][ T4572] hsr_slave_0: left promiscuous mode [ 559.142725][ T4572] hsr_slave_1: left promiscuous mode [ 559.160726][ T4572] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 559.169815][ T4572] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 559.178660][ T4572] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 559.186568][ T4572] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 559.209288][ T4572] veth1_macvtap: left promiscuous mode [ 559.218617][ T4572] veth0_macvtap: left promiscuous mode [ 559.224851][ T4572] veth1_vlan: left promiscuous mode [ 559.230492][ T4572] veth0_vlan: left promiscuous mode [ 559.927680][ T4572] team0 (unregistering): Port device team_slave_1 removed [ 559.981352][ T4572] team0 (unregistering): Port device team_slave_0 removed [ 560.256671][ T51] Bluetooth: hci3: command tx timeout [ 560.495343][ T51] Bluetooth: hci4: command tx timeout [ 561.833285][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 561.851009][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 562.325637][ T51] Bluetooth: hci3: command tx timeout [ 562.361284][ T9931] netlink: 32 bytes leftover after parsing attributes in process `syz.3.875'. [ 562.594005][ T51] Bluetooth: hci4: command tx timeout [ 562.971859][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.980612][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.032605][ T9903] chnl_net:caif_netlink_parms(): no params data found [ 563.081295][ T9864] chnl_net:caif_netlink_parms(): no params data found [ 563.277266][ T1147] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 564.444745][ T1147] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 564.445081][ T5849] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 564.466619][ T5849] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 564.475159][ T5849] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 564.483867][ T5849] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 564.491777][ T5849] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 564.773827][ T5849] Bluetooth: hci4: command tx timeout [ 564.792845][ T1147] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 564.847008][ T9903] bridge0: port 1(bridge_slave_0) entered blocking state [ 564.860964][ T9903] bridge0: port 1(bridge_slave_0) entered disabled state [ 565.347293][ T9903] bridge_slave_0: entered allmulticast mode [ 565.842948][ T9903] bridge_slave_0: entered promiscuous mode [ 566.584276][ T5849] Bluetooth: hci1: command tx timeout [ 566.722426][ T1147] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 566.805316][ T5849] Bluetooth: hci4: command tx timeout [ 567.035525][ T9903] bridge0: port 2(bridge_slave_1) entered blocking state [ 567.044927][ T9903] bridge0: port 2(bridge_slave_1) entered disabled state [ 567.053532][ T9903] bridge_slave_1: entered allmulticast mode [ 567.061437][ T9903] bridge_slave_1: entered promiscuous mode [ 567.069695][ T9864] bridge0: port 1(bridge_slave_0) entered blocking state [ 567.765817][ T9864] bridge0: port 1(bridge_slave_0) entered disabled state [ 567.773226][ T9864] bridge_slave_0: entered allmulticast mode [ 567.782029][ T9864] bridge_slave_0: entered promiscuous mode [ 567.909195][ T9864] bridge0: port 2(bridge_slave_1) entered blocking state [ 567.944386][ T9864] bridge0: port 2(bridge_slave_1) entered disabled state [ 567.954055][ T9864] bridge_slave_1: entered allmulticast mode [ 567.989550][ T9864] bridge_slave_1: entered promiscuous mode [ 568.105569][ T9903] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 568.285487][ T9864] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 568.300389][ T9903] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 568.369797][ T9864] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 568.593113][ T9864] team0: Port device team_slave_0 added [ 568.709562][ T5849] Bluetooth: hci1: command tx timeout [ 568.984055][ T9903] team0: Port device team_slave_0 added [ 569.015850][ T9903] team0: Port device team_slave_1 added [ 569.066943][ T9864] team0: Port device team_slave_1 added [ 569.443080][ T9903] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 569.450327][ T9903] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 569.528556][ T9903] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 569.581011][ T9864] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 569.601078][ T9864] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 569.673771][ T9864] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 569.708307][ T9985] netlink: 32 bytes leftover after parsing attributes in process `syz.1.888'. [ 569.722974][ T9903] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 569.730527][ T9903] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 569.947388][ T9903] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 570.016289][ T9864] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 570.080669][ T9864] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 570.176013][ T9864] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 570.409483][ T1147] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 570.482673][ T51] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 570.493634][ T51] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 570.502633][ T51] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 570.511728][ T51] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 570.520520][ T51] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 570.641465][ T9903] hsr_slave_0: entered promiscuous mode [ 570.650853][ T9903] hsr_slave_1: entered promiscuous mode [ 570.684991][ T1147] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 570.723908][ T51] Bluetooth: hci1: command tx timeout [ 570.754442][ T9864] hsr_slave_0: entered promiscuous mode [ 570.761203][ T9864] hsr_slave_1: entered promiscuous mode [ 570.768436][ T9864] debugfs: 'hsr0' already exists in 'hsr' [ 570.774574][ T9864] Cannot create hsr debugfs directory [ 570.818975][ T1147] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 571.047438][ T1147] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 571.679649][ T9946] chnl_net:caif_netlink_parms(): no params data found [ 572.575606][ T51] Bluetooth: hci2: command tx timeout [ 572.875871][ T51] Bluetooth: hci1: command tx timeout [ 573.037133][ T9946] bridge0: port 1(bridge_slave_0) entered blocking state [ 573.045389][ T9946] bridge0: port 1(bridge_slave_0) entered disabled state [ 573.046648][T10012] netlink: 72 bytes leftover after parsing attributes in process `syz.1.893'. [ 573.052838][ T9946] bridge_slave_0: entered allmulticast mode [ 573.090075][ T9946] bridge_slave_0: entered promiscuous mode [ 573.512275][ T1147] bridge_slave_1: left allmulticast mode [ 573.518975][ T1147] bridge_slave_1: left promiscuous mode [ 573.530449][ T1147] bridge0: port 2(bridge_slave_1) entered disabled state [ 573.554845][ T1147] bridge_slave_0: left allmulticast mode [ 573.560835][ T1147] bridge_slave_0: left promiscuous mode [ 573.571266][ T1147] bridge0: port 1(bridge_slave_0) entered disabled state [ 573.614871][ T1147] bridge_slave_1: left allmulticast mode [ 573.620577][ T1147] bridge_slave_1: left promiscuous mode [ 573.626858][ T1147] bridge0: port 2(bridge_slave_1) entered disabled state [ 573.639314][ T1147] bridge_slave_0: left allmulticast mode [ 573.646433][ T1147] bridge_slave_0: left promiscuous mode [ 573.652256][ T1147] bridge0: port 1(bridge_slave_0) entered disabled state [ 574.645587][ T51] Bluetooth: hci2: command tx timeout [ 574.680212][ T1147] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 574.691067][ T1147] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 574.706391][ T1147] bond0 (unregistering): Released all slaves [ 574.983227][ T1147] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 574.996506][ T1147] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 575.007706][ T1147] bond0 (unregistering): Released all slaves [ 575.023140][ T9946] bridge0: port 2(bridge_slave_1) entered blocking state [ 575.030906][ T9946] bridge0: port 2(bridge_slave_1) entered disabled state [ 575.038665][ T9946] bridge_slave_1: entered allmulticast mode [ 575.046915][ T9946] bridge_slave_1: entered promiscuous mode [ 575.083002][ T9987] chnl_net:caif_netlink_parms(): no params data found [ 575.110002][T10016] macvlan3: entered promiscuous mode [ 575.312102][T10018] netlink: 28 bytes leftover after parsing attributes in process `syz.1.895'. [ 575.347037][ T9946] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 575.377566][ T9946] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 576.280758][ T9946] team0: Port device team_slave_0 added [ 576.379319][ T9946] team0: Port device team_slave_1 added [ 576.520293][ T9987] bridge0: port 1(bridge_slave_0) entered blocking state [ 576.527912][ T9987] bridge0: port 1(bridge_slave_0) entered disabled state [ 576.535793][ T9987] bridge_slave_0: entered allmulticast mode [ 576.543299][ T9987] bridge_slave_0: entered promiscuous mode [ 576.582552][ T9946] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 576.589693][ T9946] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 576.616769][ T9946] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 576.629450][ T9987] bridge0: port 2(bridge_slave_1) entered blocking state [ 576.636958][ T9987] bridge0: port 2(bridge_slave_1) entered disabled state [ 576.644708][ T9987] bridge_slave_1: entered allmulticast mode [ 576.652238][ T9987] bridge_slave_1: entered promiscuous mode [ 576.678020][ T9946] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 576.685313][ T9946] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 576.711368][ T9946] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 576.724736][ T51] Bluetooth: hci2: command tx timeout [ 576.755768][ T1147] hsr_slave_0: left promiscuous mode [ 576.761769][ T1147] hsr_slave_1: left promiscuous mode [ 576.769506][ T1147] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 576.777206][ T1147] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 576.788598][ T1147] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 576.796417][ T1147] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 576.810605][ T1147] hsr_slave_0: left promiscuous mode [ 576.817152][ T1147] hsr_slave_1: left promiscuous mode [ 576.823078][ T1147] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 576.831081][ T1147] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 576.839361][ T1147] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 576.847282][ T1147] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 576.880480][ T1147] veth1_macvtap: left promiscuous mode [ 576.886285][ T1147] veth0_macvtap: left promiscuous mode [ 576.892310][ T1147] veth1_vlan: left promiscuous mode [ 576.897841][ T1147] veth0_vlan: left promiscuous mode [ 576.908430][ T1147] veth1_macvtap: left promiscuous mode [ 576.914343][ T1147] veth0_macvtap: left promiscuous mode [ 576.920046][ T1147] veth1_vlan: left promiscuous mode [ 576.925858][ T1147] veth0_vlan: left promiscuous mode [ 577.739076][ T1147] team0 (unregistering): Port device team_slave_1 removed [ 577.982322][ T1147] team0 (unregistering): Port device team_slave_0 removed [ 578.719280][T10032] netlink: 32 bytes leftover after parsing attributes in process `syz.1.899'. [ 578.819595][ T51] Bluetooth: hci2: command tx timeout [ 580.474274][ T1147] team0 (unregistering): Port device team_slave_1 removed [ 580.513424][ T1147] team0 (unregistering): Port device team_slave_0 removed [ 580.913132][ T9987] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 580.955749][T10038] macvlan4: entered promiscuous mode [ 580.991132][ T9987] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 581.088988][ T9987] team0: Port device team_slave_0 added [ 581.131147][ T9946] hsr_slave_0: entered promiscuous mode [ 581.137651][ T9946] hsr_slave_1: entered promiscuous mode [ 581.143894][ T9946] debugfs: 'hsr0' already exists in 'hsr' [ 581.149652][ T9946] Cannot create hsr debugfs directory [ 581.192719][ T9987] team0: Port device team_slave_1 added [ 581.337265][ T9987] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 581.351164][ T9987] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 581.379130][ T9987] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 581.400670][ T9987] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 581.408399][ T9987] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 581.469486][ T9987] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 582.331246][ T9987] hsr_slave_0: entered promiscuous mode [ 582.343370][ T9987] hsr_slave_1: entered promiscuous mode [ 582.350129][ T9987] debugfs: 'hsr0' already exists in 'hsr' [ 582.361473][ T9987] Cannot create hsr debugfs directory [ 583.434200][ T9864] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 583.514099][ T9864] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 583.602890][ T9864] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 583.769419][ T9864] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 584.185502][ T9903] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 584.205890][ T9903] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 584.229294][ T9903] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 584.307139][ T12] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 584.339371][ T9903] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 584.737599][ T12] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 584.957510][T10065] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 585.002838][ T12] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 585.094460][ T12] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 585.173370][ T9903] 8021q: adding VLAN 0 to HW filter on device bond0 [ 585.196902][ T9864] 8021q: adding VLAN 0 to HW filter on device bond0 [ 585.239045][ T9903] 8021q: adding VLAN 0 to HW filter on device team0 [ 585.277679][ T9864] 8021q: adding VLAN 0 to HW filter on device team0 [ 585.308240][ T6383] bridge0: port 1(bridge_slave_0) entered blocking state [ 585.315444][ T6383] bridge0: port 1(bridge_slave_0) entered forwarding state [ 585.342227][ T6383] bridge0: port 1(bridge_slave_0) entered blocking state [ 585.349548][ T6383] bridge0: port 1(bridge_slave_0) entered forwarding state [ 585.367717][ T12] bridge_slave_1: left allmulticast mode [ 585.375264][ T12] bridge_slave_1: left promiscuous mode [ 585.381256][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 585.393445][ T12] bridge_slave_0: left allmulticast mode [ 585.399497][ T12] bridge_slave_0: left promiscuous mode [ 585.405465][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 585.566764][T10078] netlink: 'syz.1.906': attribute type 1 has an invalid length. [ 585.738783][T10081] netlink: 28 bytes leftover after parsing attributes in process `syz.1.906'. [ 585.819391][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 585.833540][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 585.843872][ T12] bond0 (unregistering): Released all slaves [ 585.876216][ T6383] bridge0: port 2(bridge_slave_1) entered blocking state [ 585.883407][ T6383] bridge0: port 2(bridge_slave_1) entered forwarding state [ 585.977945][T10079] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 586.001345][T10080] veth3: entered promiscuous mode [ 586.012622][T10080] bond1: (slave veth3): Enslaving as a backup interface with a down link [ 586.024594][ T6383] bridge0: port 2(bridge_slave_1) entered blocking state [ 586.031780][ T6383] bridge0: port 2(bridge_slave_1) entered forwarding state [ 586.366888][ T9864] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 587.205596][ T12] hsr_slave_0: left promiscuous mode [ 587.211705][ T12] hsr_slave_1: left promiscuous mode [ 587.218596][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 587.228725][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 587.237571][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 587.245746][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 587.275089][ T12] veth1_macvtap: left promiscuous mode [ 587.280696][ T12] veth0_macvtap: left promiscuous mode [ 587.287092][ T12] veth1_vlan: left promiscuous mode [ 587.293186][ T12] veth0_vlan: left promiscuous mode [ 587.725479][ T12] team0 (unregistering): Port device team_slave_1 removed [ 587.766770][ T12] team0 (unregistering): Port device team_slave_0 removed [ 588.543238][ T9946] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 588.565654][ T9903] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 588.583814][ T9864] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 588.590935][ T9946] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 588.650595][ T9946] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 588.691921][ T9946] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 588.789632][ T9987] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 588.827404][ T9987] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 588.851614][ T9987] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 588.869759][ T9987] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 588.891663][ T9903] veth0_vlan: entered promiscuous mode [ 588.935116][ T9903] veth1_vlan: entered promiscuous mode [ 589.053164][ T9903] veth0_macvtap: entered promiscuous mode [ 589.086187][ T9903] veth1_macvtap: entered promiscuous mode [ 589.109676][ T9946] 8021q: adding VLAN 0 to HW filter on device bond0 [ 589.155879][ T9864] veth0_vlan: entered promiscuous mode [ 589.164294][ T9946] 8021q: adding VLAN 0 to HW filter on device team0 [ 589.172888][ T9903] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 589.196085][ T9903] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 589.211296][ T4572] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 589.229989][ T4572] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 589.239508][ T4572] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 589.251351][ T9864] veth1_vlan: entered promiscuous mode [ 589.261464][ T6383] bridge0: port 1(bridge_slave_0) entered blocking state [ 589.268698][ T6383] bridge0: port 1(bridge_slave_0) entered forwarding state [ 589.278894][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 589.298860][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 589.306091][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 589.356492][ T9987] 8021q: adding VLAN 0 to HW filter on device bond0 [ 589.460204][ T9864] veth0_macvtap: entered promiscuous mode [ 589.474072][ T6383] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 589.483161][ T6383] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 589.493011][ T9864] veth1_macvtap: entered promiscuous mode [ 589.517122][ T9987] 8021q: adding VLAN 0 to HW filter on device team0 [ 589.566528][ T4572] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 589.573240][ T9864] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 589.583156][ T4572] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 589.608053][ T6383] bridge0: port 1(bridge_slave_0) entered blocking state [ 589.615266][ T6383] bridge0: port 1(bridge_slave_0) entered forwarding state [ 589.626750][ T6383] bridge0: port 2(bridge_slave_1) entered blocking state [ 589.633959][ T6383] bridge0: port 2(bridge_slave_1) entered forwarding state [ 589.650210][ T9864] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 589.728088][ T13] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 589.753817][ T13] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 589.997238][ T13] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 590.008754][ T13] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 590.931509][ T6153] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 590.955565][ T6153] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 591.079107][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 591.109913][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 591.360336][T10136] bridge0: entered promiscuous mode [ 591.367455][T10136] macvlan2: entered promiscuous mode [ 591.857222][ T9987] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 591.967363][ T9946] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 592.021199][T10140] netlink: 32 bytes leftover after parsing attributes in process `syz.4.853'. [ 594.360363][ T9987] veth0_vlan: entered promiscuous mode [ 594.474726][T10158] random: crng reseeded on system resumption [ 594.478185][T10157] netlink: 'syz.0.917': attribute type 1 has an invalid length. [ 594.490550][ T9987] veth1_vlan: entered promiscuous mode [ 594.503863][ T9946] veth0_vlan: entered promiscuous mode [ 594.549648][ T9946] veth1_vlan: entered promiscuous mode [ 594.626259][T10159] netlink: 28 bytes leftover after parsing attributes in process `syz.0.917'. [ 594.654791][T10157] veth3: entered promiscuous mode [ 595.690966][T10161] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 595.786403][ T9987] veth0_macvtap: entered promiscuous mode [ 595.827894][ T9987] veth1_macvtap: entered promiscuous mode [ 595.857220][ T9946] veth0_macvtap: entered promiscuous mode [ 595.889827][ T9946] veth1_macvtap: entered promiscuous mode [ 595.910831][ T9987] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 595.955712][ T9987] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 596.017951][ T9946] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 596.036931][ T6383] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.057428][ T6383] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.074828][ T6383] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.087020][ T8882] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 596.098265][ T9946] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 596.131438][ T6383] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.176617][ T6383] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.193399][ T6383] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.216848][T10170] 9pnet_fd: Insufficient options for proto=fd [ 596.233326][ T6383] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.250388][ T6383] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.265456][ T8882] usb 1-1: Using ep0 maxpacket: 32 [ 596.277618][ T8882] usb 1-1: config 0 interface 0 altsetting 7 endpoint 0x81 has invalid wMaxPacketSize 0 [ 596.299240][ T8882] usb 1-1: config 0 interface 0 altsetting 7 has 1 endpoint descriptor, different from the interface descriptor's value: 10 [ 596.350028][ T8882] usb 1-1: config 0 interface 0 has no altsetting 0 [ 596.382580][ T8882] usb 1-1: New USB device found, idVendor=20bc, idProduct=5500, bcdDevice= 0.00 [ 596.396939][ T8882] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 596.436369][ T8882] usb 1-1: config 0 descriptor?? [ 597.124998][ T8882] betop 0003:20BC:5500.000A: unknown main item tag 0x7 [ 597.313273][ T8882] betop 0003:20BC:5500.000A: unknown main item tag 0x0 [ 597.896183][ T8882] betop 0003:20BC:5500.000A: unknown main item tag 0x0 [ 597.903162][ T8882] betop 0003:20BC:5500.000A: unknown main item tag 0x0 [ 597.910412][ T8882] betop 0003:20BC:5500.000A: unknown main item tag 0x0 [ 598.028216][T10178] bridge0: entered promiscuous mode [ 598.033603][T10178] macvlan2: entered promiscuous mode [ 598.156338][ T8882] betop 0003:20BC:5500.000A: hidraw0: USB HID v8.00 Device [HID 20bc:5500] on usb-dummy_hcd.0-1/input0 [ 598.351208][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 598.437143][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 598.535371][T10174] nvme_fabrics: missing parameter 'transport=%s' [ 598.542133][T10174] nvme_fabrics: missing parameter 'nqn=%s' [ 599.332840][ T6023] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 599.441466][ T8882] betop 0003:20BC:5500.000A: no inputs found [ 599.455252][ T6023] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 599.455281][ T8882] usb 1-1: USB disconnect, device number 8 [ 599.514685][ T6023] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 599.522655][ T6023] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 600.196973][ T6383] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 600.215814][ T6383] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 601.552774][T10207] netlink: 'syz.1.930': attribute type 1 has an invalid length. [ 601.834803][T10211] netlink: 28 bytes leftover after parsing attributes in process `syz.1.930'. [ 601.954343][T10207] veth5: entered promiscuous mode [ 601.963379][T10207] bond2: (slave veth5): Enslaving as a backup interface with a down link [ 603.468954][T10233] netlink: 4 bytes leftover after parsing attributes in process `syz.1.938'. [ 604.094089][ T51] Bluetooth: Frame is too long (len 18, expected len 4) [ 604.215482][T10235] netlink: 16 bytes leftover after parsing attributes in process `syz.3.937'. [ 606.820988][T10234] nvme_fabrics: missing parameter 'transport=%s' [ 607.012087][T10234] nvme_fabrics: missing parameter 'nqn=%s' [ 607.433994][T10247] netlink: 132 bytes leftover after parsing attributes in process `syz.0.940'. [ 612.684218][T10264] nvme_fabrics: missing parameter 'transport=%s' [ 612.934058][T10264] nvme_fabrics: missing parameter 'nqn=%s' [ 613.023783][T10263] netlink: 16 bytes leftover after parsing attributes in process `syz.4.943'. [ 613.395635][T10277] netlink: 'syz.2.948': attribute type 1 has an invalid length. [ 613.438891][T10277] team0: Port device ip6gretap1 added [ 613.640580][T10277] veth3: entered promiscuous mode [ 613.646903][T10282] netlink: 28 bytes leftover after parsing attributes in process `syz.2.948'. [ 613.648474][T10277] team0: Port device veth3 added [ 615.285179][T10299] netlink: 16 bytes leftover after parsing attributes in process `syz.2.952'. [ 616.924918][T10298] nvme_fabrics: missing parameter 'transport=%s' [ 616.931310][T10298] nvme_fabrics: missing parameter 'nqn=%s' [ 618.825293][T10322] geneve2: entered promiscuous mode [ 618.830745][T10322] geneve2: entered allmulticast mode [ 622.600137][T10354] netlink: 76 bytes leftover after parsing attributes in process `syz.0.967'. [ 623.039813][T10353] netlink: 72 bytes leftover after parsing attributes in process `syz.1.969'. [ 623.175934][T10358] 9pnet_fd: Insufficient options for proto=fd [ 624.495579][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.501980][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 627.690134][T10386] netlink: 16 bytes leftover after parsing attributes in process `syz.0.979'. [ 629.042154][T10387] nvme_fabrics: missing parameter 'transport=%s' [ 629.302631][T10387] nvme_fabrics: missing parameter 'nqn=%s' [ 629.613016][T10394] netlink: 32 bytes leftover after parsing attributes in process `syz.0.981'. [ 629.744667][T10396] netlink: 72 bytes leftover after parsing attributes in process `syz.4.982'. [ 631.927247][T10424] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 633.478520][T10440] netlink: 72 bytes leftover after parsing attributes in process `syz.3.995'. [ 633.884232][ T8882] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 634.114514][ T8882] usb 5-1: Using ep0 maxpacket: 8 [ 634.122535][ T8882] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 634.151880][ T8882] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 634.157983][T10457] netlink: 17 bytes leftover after parsing attributes in process `syz.2.1000'. [ 634.173760][T10457] net_ratelimit: 72 callbacks suppressed [ 634.173788][T10457] netlink: zone id is out of range [ 634.187762][ T8882] pvrusb2: Hardware description: Terratec Grabster AV400 [ 634.205313][T10457] netlink: zone id is out of range [ 634.215118][T10457] netlink: zone id is out of range [ 634.220450][T10457] netlink: zone id is out of range [ 634.228006][ T8882] pvrusb2: ********** [ 634.238047][T10457] netlink: zone id is out of range [ 634.248426][T10457] netlink: zone id is out of range [ 634.253737][T10457] netlink: zone id is out of range [ 634.258977][ T8882] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 634.274024][T10457] netlink: zone id is out of range [ 634.283941][T10457] netlink: zone id is out of range [ 634.310715][ T8882] pvrusb2: Important functionality might not be entirely working. [ 634.325921][T10457] netlink: zone id is out of range [ 634.328895][ T8882] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 634.350289][ T8882] pvrusb2: ********** [ 634.396282][ T2344] pvrusb2: Invalid write control endpoint [ 634.511612][T10463] ubi: mtd0 is already attached to ubi31 [ 634.610694][ T8882] usb 5-1: USB disconnect, device number 7 [ 635.204363][ T2344] pvrusb2: Invalid write control endpoint [ 635.210313][ T2344] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 635.240313][ T2344] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 635.260914][ T2344] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 635.327108][ T2344] pvrusb2: Device being rendered inoperable [ 635.365897][ T2344] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 635.570663][ T2344] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 635.612366][ T2344] pvrusb2: Attached sub-driver cx25840 [ 635.627500][ T2344] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 635.647223][ T2344] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 636.763394][ T5849] Bluetooth: hci0: command 0x0406 tx timeout [ 637.082806][T10476] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 638.078004][T10487] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1007'. [ 639.032911][T10501] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1010'. [ 640.502206][T10510] macvlan5: entered promiscuous mode [ 641.557323][T10516] Error: Driver 'c6xdigio' is already registered, aborting... [ 642.513610][T10516] net_ratelimit: 72 callbacks suppressed [ 642.519369][T10516] sctp: failed to load transform for md5: -2 [ 643.544358][T10526] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 643.698052][T10532] netlink: 17 bytes leftover after parsing attributes in process `syz.1.1020'. [ 643.708036][T10532] netlink: zone id is out of range [ 643.713348][T10532] netlink: zone id is out of range [ 643.718797][T10532] netlink: zone id is out of range [ 643.729966][T10532] netlink: zone id is out of range [ 643.735311][T10532] netlink: zone id is out of range [ 643.740489][T10532] netlink: zone id is out of range [ 643.745849][T10532] netlink: zone id is out of range [ 643.751083][T10532] netlink: zone id is out of range [ 643.756330][T10532] netlink: zone id is out of range [ 650.145742][T10571] : entered promiscuous mode [ 651.339005][T10578] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 651.398606][T10582] netlink: 17 bytes leftover after parsing attributes in process `syz.4.1031'. [ 651.408638][T10582] net_ratelimit: 73 callbacks suppressed [ 651.408654][T10582] netlink: zone id is out of range [ 651.419843][T10582] netlink: zone id is out of range [ 651.425018][T10582] netlink: zone id is out of range [ 651.430218][T10582] netlink: zone id is out of range [ 651.435350][T10582] netlink: zone id is out of range [ 651.440469][T10582] netlink: zone id is out of range [ 651.445638][T10582] netlink: zone id is out of range [ 651.450743][T10582] netlink: zone id is out of range [ 651.455895][T10582] netlink: zone id is out of range [ 651.461009][T10582] netlink: zone id is out of range [ 652.007390][T10591] can0: slcan on ptm0. [ 652.386320][T10589] can0 (unregistered): slcan off ptm0. [ 655.458387][T10609] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 656.688573][T10627] geneve2: entered promiscuous mode [ 656.694046][T10627] geneve2: entered allmulticast mode [ 657.406425][T10626] netlink: 17 bytes leftover after parsing attributes in process `syz.4.1044'. [ 657.418733][T10626] net_ratelimit: 72 callbacks suppressed [ 657.418753][T10626] netlink: zone id is out of range [ 657.430378][T10626] netlink: zone id is out of range [ 657.435799][T10626] netlink: zone id is out of range [ 657.444183][T10626] netlink: zone id is out of range [ 657.449849][T10626] netlink: zone id is out of range [ 657.535104][T10626] netlink: zone id is out of range [ 657.540303][T10626] netlink: zone id is out of range [ 657.551879][T10626] netlink: zone id is out of range [ 657.557741][T10626] netlink: zone id is out of range [ 657.563142][T10626] netlink: zone id is out of range [ 659.142855][T10633] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 660.382948][T10654] overlayfs: failed to resolve './file0': -2 [ 660.457629][T10652] macvlan6: entered promiscuous mode [ 666.596890][T10694] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 668.549667][ T24] hid-generic 0003:0004:0000.000B: unknown main item tag 0x0 [ 668.582369][ T24] hid-generic 0003:0004:0000.000B: unknown main item tag 0x0 [ 668.599830][ T24] hid-generic 0003:0004:0000.000B: unknown main item tag 0x0 [ 668.665797][ T24] hid-generic 0003:0004:0000.000B: hidraw0: USB HID v0.00 Device [syz0] on syz1 [ 670.477564][T10739] tmpfs: Bad value for 'mpol' [ 673.718615][T10768] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 674.075372][ T24] hid-generic 0003:0004:0000.000C: unknown main item tag 0x0 [ 674.107965][ T24] hid-generic 0003:0004:0000.000C: unknown main item tag 0x0 [ 674.127146][ T24] hid-generic 0003:0004:0000.000C: unknown main item tag 0x0 [ 674.172627][ T24] hid-generic 0003:0004:0000.000C: hidraw0: USB HID v0.00 Device [syz0] on syz1 [ 676.094096][ T9558] usb 3-1: new full-speed USB device number 5 using dummy_hcd [ 676.727099][ T9558] usb 3-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c [ 676.736652][ T9558] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 676.754981][ T9558] usb 3-1: config 0 descriptor?? [ 677.684348][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 678.270338][ T9558] pegasus 3-1:0.0: can't reset MAC [ 678.282433][ T9558] pegasus 3-1:0.0: probe with driver pegasus failed with error -5 [ 679.545379][ T9558] usb 3-1: USB disconnect, device number 5 [ 680.401100][T10820] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 683.278368][T10844] geneve2: entered promiscuous mode [ 683.283928][T10844] geneve2: entered allmulticast mode [ 683.458589][ T51] Bluetooth: hci4: command 0x0406 tx timeout [ 684.814788][T10858] bridge0: entered promiscuous mode [ 684.821499][T10858] macvlan2: entered promiscuous mode [ 686.004203][T10866] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 686.016937][T10866] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 686.426360][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 686.432893][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 688.404790][ T5849] Bluetooth: hci1: command 0x0406 tx timeout [ 688.695880][T10877] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 693.136052][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 693.313164][T10919] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1122'. [ 693.408014][T10924] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1122'. [ 694.026740][T10923] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 696.683071][T10948] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 699.165025][T10967] macvlan7: entered promiscuous mode [ 700.327407][T10969] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 701.216521][T10979] can0: slcan on ptm0. [ 701.667573][T10974] can0 (unregistered): slcan off ptm0. [ 703.013784][ T9807] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 704.045666][ T9807] usb 4-1: Using ep0 maxpacket: 8 [ 704.250537][ T9807] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 704.278082][ T9807] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 704.303696][ T9807] usb 4-1: Product: syz [ 704.308066][ T9807] usb 4-1: Manufacturer: syz [ 704.312694][ T9807] usb 4-1: SerialNumber: syz [ 704.327161][ T9807] usb 4-1: config 0 descriptor?? [ 705.024204][T11012] macvlan3: entered promiscuous mode [ 705.039235][ T51] Bluetooth: Frame is too long (len 18, expected len 4) [ 705.088650][ T9807] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 706.036994][ T9807] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 706.262808][ T9807] usb 4-1: USB disconnect, device number 7 [ 711.114547][T11058] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1160'. [ 712.970037][T11071] geneve2: entered promiscuous mode [ 712.975520][T11071] geneve2: entered allmulticast mode [ 714.583528][T11084] ubi: mtd0 is already attached to ubi31 [ 718.135956][T11105] can0: slcan on ptm0. [ 718.264505][T11105] can0 (unregistered): slcan off ptm0. [ 721.207389][T11128] xt_nat: multiple ranges no longer supported [ 724.323903][T11148] ubi: mtd0 is already attached to ubi31 [ 725.466375][T11157] macvlan3: entered promiscuous mode [ 730.121595][T11191] xt_nat: multiple ranges no longer supported [ 732.150629][T11207] ubi: mtd0 is already attached to ubi31 [ 736.931157][T11232] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1209'. [ 737.358720][T11247] xt_nat: multiple ranges no longer supported [ 739.714195][T11264] netlink: 84 bytes leftover after parsing attributes in process `syz.2.1220'. [ 740.061733][ T5936] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 740.393794][ T5936] usb 5-1: Using ep0 maxpacket: 32 [ 741.055478][ T5936] usb 5-1: config 0 interface 0 has no altsetting 0 [ 741.101297][ T5936] usb 5-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 741.131213][ T5936] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 741.141285][ T5936] usb 5-1: Product: syz [ 741.159323][ T5936] usb 5-1: Manufacturer: syz [ 741.177889][ T5936] usb 5-1: SerialNumber: syz [ 741.195331][ T5936] usb 5-1: config 0 descriptor?? [ 741.897486][ T5936] gs_usb 5-1:0.0: Configuring for 1 interfaces [ 742.306935][T11288] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 742.318665][T11288] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 743.505149][ T9807] usb 5-1: USB disconnect, device number 8 [ 744.050579][T11299] xt_nat: multiple ranges no longer supported [ 745.589936][T11309] bridge0: entered promiscuous mode [ 745.595341][T11309] macvlan2: entered promiscuous mode [ 747.293896][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.301663][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.658949][T11317] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 748.337600][T11324] ubi: mtd0 is already attached to ubi31 [ 749.139973][T11336] netlink: 'syz.4.1239': attribute type 10 has an invalid length. [ 749.211782][T11336] 8021q: adding VLAN 0 to HW filter on device team0 [ 749.246067][T11336] bond0: (slave team0): Enslaving as an active interface with an up link [ 751.629583][T11356] xt_nat: multiple ranges no longer supported [ 755.493410][T11371] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 757.749703][T11382] netlink: 'syz.0.1253': attribute type 6 has an invalid length. [ 759.002475][T11400] xt_nat: multiple ranges no longer supported [ 760.470341][T11415] ubi: mtd0 is already attached to ubi31 [ 765.754573][T11431] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 765.925808][T11449] xt_nat: multiple ranges no longer supported [ 766.044251][T11451] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1274'. [ 766.978250][T11454] nvme_fabrics: missing parameter 'transport=%s' [ 767.081157][T11454] nvme_fabrics: missing parameter 'nqn=%s' [ 767.545914][T11461] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 769.348233][T11472] ubi: mtd0 is already attached to ubi31 [ 772.826116][T11499] xt_nat: multiple ranges no longer supported [ 777.156830][T11532] can0: slcan on ptm0. [ 777.515583][T11529] can0 (unregistered): slcan off ptm0. [ 779.625421][T11554] xt_nat: multiple ranges no longer supported [ 784.143881][ T8882] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 784.823620][ T8882] usb 3-1: Using ep0 maxpacket: 32 [ 784.833438][ T8882] usb 3-1: config 0 interface 0 has no altsetting 0 [ 784.844073][ T8882] usb 3-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 785.468240][ T8882] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 785.483055][ T8882] usb 3-1: Product: syz [ 785.497313][ T8882] usb 3-1: Manufacturer: syz [ 785.501973][ T8882] usb 3-1: SerialNumber: syz [ 785.750608][ T8882] usb 3-1: config 0 descriptor?? [ 786.488669][ T8882] gs_usb 3-1:0.0: Configuring for 1 interfaces [ 787.547141][ T8882] gs_usb 3-1:0.0: Disabling termination support for channel 0 (-EPROTO) [ 787.577861][ T8882] usb 3-1: USB disconnect, device number 6 [ 787.607425][T11621] xt_nat: multiple ranges no longer supported [ 787.627005][T11619] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1321'. [ 790.477534][T11641] net_ratelimit: 72 callbacks suppressed [ 790.477557][T11641] sctp: failed to load transform for md5: -2 [ 790.682265][T11651] geneve2: entered promiscuous mode [ 790.687633][T11651] geneve2: entered allmulticast mode [ 792.423666][ T9558] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 792.743625][ T9558] usb 5-1: Using ep0 maxpacket: 32 [ 792.764346][ T9558] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 792.907657][ T9558] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 792.970071][ T9558] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 792.980073][ T9558] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 792.999340][ T9558] usb 5-1: config 0 descriptor?? [ 793.225304][T11672] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1332'. [ 793.701978][T11677] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1334'. [ 793.784476][ T9558] savu 0003:1E7D:2D5A.000D: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.4-1/input0 [ 793.802748][T11678] xt_nat: multiple ranges no longer supported [ 794.000982][ T9558] usb 5-1: USB disconnect, device number 9 [ 796.509389][T11697] macvlan3: entered promiscuous mode [ 798.764486][T11718] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1346'. [ 800.813801][ T5981] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 801.343746][ T5981] usb 5-1: Using ep0 maxpacket: 32 [ 801.361889][ T5981] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 801.375138][ T5981] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 801.386272][ T5981] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 801.400429][ T5981] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 801.605411][ T5981] usb 5-1: config 0 descriptor?? [ 801.628184][T11742] macvlan4: entered promiscuous mode [ 803.067900][T11746] nvme_fabrics: missing parameter 'transport=%s' [ 803.074479][T11746] nvme_fabrics: missing parameter 'nqn=%s' [ 803.112876][ T5981] savu 0003:1E7D:2D5A.000E: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.4-1/input0 [ 803.370471][ T5981] usb 5-1: USB disconnect, device number 10 [ 804.555207][T11759] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1358'. [ 807.641777][T11785] macvlan8: entered promiscuous mode [ 808.728486][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.734982][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 811.681677][T11800] Bluetooth: MGMT ver 1.23 [ 813.489776][T11825] macvlan3: entered promiscuous mode [ 816.360576][T11842] can0: slcan on ptm0. [ 816.614075][T11841] can0 (unregistered): slcan off ptm0. [ 820.443576][T11876] netlink: 'syz.0.1395': attribute type 10 has an invalid length. [ 820.504359][T11876] 8021q: adding VLAN 0 to HW filter on device team0 [ 820.529530][T11876] bond0: (slave team0): Enslaving as an active interface with an up link [ 821.418281][T11883] macvlan9: entered promiscuous mode [ 822.187690][T11893] netlink: 132 bytes leftover after parsing attributes in process `syz.4.1401'. [ 823.839903][T11897] can0: slcan on ptm0. [ 823.884052][T11896] can0 (unregistered): slcan off ptm0. [ 826.478863][T11921] 9pnet_fd: Insufficient options for proto=fd [ 828.788345][T11948] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1418'. [ 832.701034][T11975] geneve2: entered promiscuous mode [ 832.706453][T11975] geneve2: entered allmulticast mode [ 833.633330][T11982] netlink: 'syz.3.1427': attribute type 10 has an invalid length. [ 833.840945][T11982] 8021q: adding VLAN 0 to HW filter on device team0 [ 833.990500][T11982] bond0: (slave team0): Enslaving as an active interface with an up link [ 836.781861][T11993] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1432'. [ 838.643686][T12018] geneve2: entered promiscuous mode [ 838.649028][T12018] geneve2: entered allmulticast mode [ 841.545222][T12023] nvme_fabrics: missing parameter 'transport=%s' [ 841.596133][T12023] nvme_fabrics: missing parameter 'nqn=%s' [ 846.052785][T12078] geneve2: entered promiscuous mode [ 846.058272][T12078] geneve2: entered allmulticast mode [ 846.635177][ T51] Bluetooth: Frame is too long (len 18, expected len 4) [ 850.620505][T12122] netlink: 'syz.3.1467': attribute type 10 has an invalid length. [ 850.784405][T12130] geneve2: entered promiscuous mode [ 850.789800][T12130] geneve2: entered allmulticast mode [ 851.679419][T12137] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1472'. [ 851.990721][T12140] macvlan4: entered promiscuous mode [ 855.052766][T12172] geneve2: entered promiscuous mode [ 855.052860][T12172] geneve2: entered allmulticast mode [ 859.714766][T12197] xt_nat: multiple ranges no longer supported [ 861.998616][T12217] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1494'. [ 863.464300][T12220] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1495'. [ 863.802449][T12228] overlayfs: failed to get inode (-116) [ 863.829820][T12228] overlayfs: failed to get inode (-116) [ 864.895220][T12240] overlayfs: missing 'lowerdir' [ 865.002636][T12242] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1502'. [ 870.174220][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.180675][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.608408][T12268] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 870.622716][T12268] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 870.975968][T12295] geneve2: entered promiscuous mode [ 870.981342][T12295] geneve2: entered allmulticast mode [ 874.086202][T12268] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 874.180816][T12268] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 874.243644][T12268] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 874.250967][T12268] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 874.264735][T12268] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 874.270836][T12268] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 874.312183][T12268] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 874.329324][T12309] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1518'. [ 874.399921][T12268] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 874.643698][T12309] nvme_fabrics: missing parameter 'transport=%s' [ 874.650101][T12309] nvme_fabrics: missing parameter 'nqn=%s' [ 878.861293][T12355] geneve2: entered promiscuous mode [ 878.866671][T12355] geneve2: entered allmulticast mode [ 883.098025][T12387] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1533'. [ 883.581945][T12388] nvme_fabrics: missing parameter 'transport=%s' [ 883.653704][T12388] nvme_fabrics: missing parameter 'nqn=%s' [ 891.161542][T12457] fuse: Bad value for 'fd' [ 893.607092][T12489] xt_nat: multiple ranges no longer supported [ 897.865529][T12517] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1561'. [ 898.808842][T12525] geneve2: entered promiscuous mode [ 898.814273][T12525] geneve2: entered allmulticast mode [ 900.574139][T12523] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 900.820112][ T5973] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 901.003562][ T5973] usb 4-1: Using ep0 maxpacket: 32 [ 901.015300][ T5973] usb 4-1: config 0 has an invalid interface number: 153 but max is 0 [ 901.036019][ T5973] usb 4-1: config 0 has no interface number 0 [ 901.042194][ T5973] usb 4-1: config 0 interface 153 has no altsetting 0 [ 901.085952][ T5973] usb 4-1: New USB device found, idVendor=1a61, idProduct=3410, bcdDevice= f.f0 [ 901.113514][ T5973] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 901.121662][ T5973] usb 4-1: Product: syz [ 901.143531][ T5973] usb 4-1: Manufacturer: syz [ 901.148200][ T5973] usb 4-1: SerialNumber: syz [ 901.175835][ T5973] usb 4-1: config 0 descriptor?? [ 901.186889][ T5973] ti_usb_3410_5052 4-1:0.153: TI USB 3410 1 port adapter converter detected [ 901.233671][ T5973] usb 4-1: TI USB 3410 1 port adapter converter now attached to ttyUSB0 [ 902.050926][T12539] wireguard0: entered promiscuous mode [ 902.403895][T12539] wireguard0: entered allmulticast mode [ 902.714055][ T5973] usb 4-1: USB disconnect, device number 8 [ 902.773093][ T5973] ti_usb_3410_5052_1 ttyUSB0: TI USB 3410 1 port adapter converter now disconnected from ttyUSB0 [ 902.862489][ T5973] ti_usb_3410_5052 4-1:0.153: device disconnected [ 906.581466][T12622] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 910.133803][T12654] ubi: mtd0 is already attached to ubi31 [ 912.206123][T12664] netlink: 'syz.0.1588': attribute type 4 has an invalid length. [ 912.214006][T12664] netlink: 17 bytes leftover after parsing attributes in process `syz.0.1588'. [ 916.022205][T12687] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 919.526345][T12724] ubi: mtd0 is already attached to ubi31 [ 920.743942][ T24] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 920.840603][T12734] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1605'. [ 920.996898][ T24] usb 5-1: unable to get BOS descriptor or descriptor too short [ 921.037486][ T24] usb 5-1: config 1 has an invalid interface number: 193 but max is 1 [ 921.063576][ T24] usb 5-1: config 1 has no interface number 1 [ 921.078576][T12734] nvme_fabrics: missing parameter 'transport=%s' [ 921.085028][T12734] nvme_fabrics: missing parameter 'nqn=%s' [ 921.106781][ T24] usb 5-1: config 1 interface 0 altsetting 247 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 921.342886][ T24] usb 5-1: config 1 interface 0 has no altsetting 0 [ 921.357294][ T24] usb 5-1: config 1 interface 193 has no altsetting 0 [ 921.381520][ T24] usb 5-1: New USB device found, idVendor=2040, idProduct=b990, bcdDevice=f6.75 [ 921.401744][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 921.411109][ T24] usb 5-1: Product: syz [ 921.416346][ T24] usb 5-1: Manufacturer: syz [ 921.421042][ T24] usb 5-1: SerialNumber: syz [ 921.732264][ T24] smsusb:smsusb_probe: board id=8, interface number 0 [ 921.748651][ T24] smsusb:smsusb_probe: board id=8, interface number 193 [ 922.484032][ T24] usb 5-1: USB disconnect, device number 11 [ 925.337436][T12763] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 927.770672][T12796] ubi: mtd0 is already attached to ubi31 [ 928.567162][T12803] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1619'. [ 928.855533][T12803] nvme_fabrics: missing parameter 'transport=%s' [ 928.861951][T12803] nvme_fabrics: missing parameter 'nqn=%s' [ 931.633405][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.639994][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 932.182977][T12822] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 932.260946][T12833] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1628'. [ 934.176550][T12849] can0: slcan on ptm0. [ 934.504414][T12847] can0 (unregistered): slcan off ptm0. [ 935.962342][T12866] ubi: mtd0 is already attached to ubi31 [ 937.463782][ T9558] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 937.513197][T12876] macvlan4: entered promiscuous mode [ 937.665141][ T9558] usb 4-1: Using ep0 maxpacket: 16 [ 937.686185][ T9558] usb 4-1: config index 0 descriptor too short (expected 65, got 36) [ 937.705217][ T9558] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 937.722690][ T9558] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 937.733205][ T9558] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 938.465825][ T9558] usb 4-1: New USB device found, idVendor=1781, idProduct=0898, bcdDevice= 0.00 [ 938.561738][T12880] netlink: 'syz.2.1641': attribute type 4 has an invalid length. [ 938.616572][ T9558] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 938.734425][ T9558] usb 4-1: config 0 descriptor?? [ 938.919726][ T9558] input: PXRC Flight Controller Adapter as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input8 [ 939.868788][ T5981] usb 4-1: USB disconnect, device number 9 [ 940.620463][T12900] netlink: 'syz.0.1648': attribute type 11 has an invalid length. [ 940.649040][T12900] netlink: 144 bytes leftover after parsing attributes in process `syz.0.1648'. [ 942.340199][T12901] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 943.025490][T12924] ubi: mtd0 is already attached to ubi31 [ 946.205528][T12947] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1661'. [ 947.073910][T12946] nvme_fabrics: missing parameter 'transport=%s' [ 947.080533][T12946] nvme_fabrics: missing parameter 'nqn=%s' [ 952.367186][T12995] ubi: mtd0 is already attached to ubi31 [ 953.730498][T13007] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1679'. [ 954.811374][T13004] nvme_fabrics: missing parameter 'transport=%s' [ 954.818110][T13004] nvme_fabrics: missing parameter 'nqn=%s' [ 955.177836][T13013] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1681'. [ 956.815767][T13026] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1684'. [ 960.460725][T13057] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1693'. [ 962.753728][T13058] nvme_fabrics: missing parameter 'transport=%s' [ 962.903467][T13058] nvme_fabrics: missing parameter 'nqn=%s' [ 963.264699][T13068] macvlan5: entered promiscuous mode [ 963.727821][T13070] netlink: 132 bytes leftover after parsing attributes in process `syz.4.1697'. [ 966.681018][T13102] ubi: mtd0 is already attached to ubi31 [ 967.758310][T13116] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1709'. [ 968.319081][T13120] netlink: 132 bytes leftover after parsing attributes in process `syz.4.1710'. [ 971.490901][T13145] input: syz1 as /devices/virtual/input/input9 [ 971.597750][T13146] vivid-002: disconnect [ 972.362992][T13141] vivid-002: reconnect [ 973.506465][ T5973] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 973.526928][T13155] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1720'. [ 973.913616][ T5973] usb 5-1: Using ep0 maxpacket: 8 [ 973.925289][ T5973] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 973.943626][ T5973] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 973.963806][ T5973] usb 5-1: Product: syz [ 973.973743][ T5973] usb 5-1: Manufacturer: syz [ 973.979239][ T5973] usb 5-1: SerialNumber: syz [ 974.144494][ T5973] usb 5-1: config 0 descriptor?? [ 974.846826][ T5973] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 974.853740][ T24] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 974.874034][ T5973] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 975.003581][ T24] usb 3-1: device descriptor read/64, error -71 [ 975.263798][ T24] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 975.423908][ T24] usb 3-1: device descriptor read/64, error -71 [ 975.590358][ T24] usb usb3-port1: attempt power cycle [ 975.916189][ T5936] usb 5-1: USB disconnect, device number 12 [ 976.078787][T13188] program syz.3.1728 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 976.128836][T13188] program syz.3.1728 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 976.173663][T13188] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 976.243539][ T24] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 976.274386][ T24] usb 3-1: device descriptor read/8, error -71 [ 976.533737][ T24] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 976.573639][ T24] usb 3-1: device descriptor read/8, error -71 [ 976.684123][ T24] usb usb3-port1: unable to enumerate USB device [ 976.797373][T13199] ubi: mtd0 is already attached to ubi31 [ 978.686333][T13206] sctp: failed to load transform for md5: -2 [ 984.142533][T13249] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1745'. [ 985.868737][T13258] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1749'. [ 987.016497][T13270] ubi: mtd0 is already attached to ubi31 [ 989.968511][T13297] netlink: 'syz.4.1758': attribute type 10 has an invalid length. [ 992.409853][ T9] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 992.753469][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 992.769706][ T9] usb 4-1: config 0 interface 0 has no altsetting 0 [ 993.041883][T13318] macvlan6: entered promiscuous mode [ 993.097569][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 993.259901][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 993.262724][ T9] usb 4-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 993.293893][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 993.302474][ T9] usb 4-1: Product: syz [ 993.306781][ T9] usb 4-1: Manufacturer: syz [ 993.311455][ T9] usb 4-1: SerialNumber: syz [ 993.321760][ T9] usb 4-1: config 0 descriptor?? [ 994.109879][ T9] gs_usb 4-1:0.0: Configuring for 175 interfaces [ 994.116478][ T9] gs_usb 4-1:0.0: Driver cannot handle more that 3 CAN interfaces [ 994.177324][ T9] gs_usb 4-1:0.0: probe with driver gs_usb failed with error -22 [ 995.477077][ T9] usb 4-1: USB disconnect, device number 10 [ 995.802864][T13342] ubi: mtd0 is already attached to ubi31 [ 998.828133][T13370] autofs: Unknown parameter 'fd0x0000000000000000' [ 999.571009][T13382] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1784'. [ 1002.382242][T13410] macvlan10: entered promiscuous mode [ 1003.191211][T13421] ubi: mtd0 is already attached to ubi31 [ 1003.328238][T13422] geneve2: entered promiscuous mode [ 1003.333721][T13422] geneve2: entered allmulticast mode [ 1008.995509][T13484] vivid-004: disconnect [ 1009.000175][T13483] vivid-004: reconnect [ 1011.047942][T13504] autofs: Unknown parameter 'fd0x0000000000000000' [ 1012.353464][ T9807] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 1012.633611][ T9807] usb 3-1: Using ep0 maxpacket: 32 [ 1012.650839][ T9807] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1013.386132][ T9807] usb 3-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 1013.408052][T13527] vivid-000: disconnect [ 1013.437687][ T9807] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1013.446143][T13525] vivid-000: reconnect [ 1013.894095][ T9807] usb 3-1: Product: syz [ 1013.898335][ T9807] usb 3-1: Manufacturer: syz [ 1013.902952][ T9807] usb 3-1: SerialNumber: syz [ 1013.948744][ T9807] usb 3-1: config 0 descriptor?? [ 1014.422266][ T9807] gs_usb 3-1:0.0: Configuring for 175 interfaces [ 1014.433660][ T9807] gs_usb 3-1:0.0: Driver cannot handle more that 3 CAN interfaces [ 1014.449003][ T9807] gs_usb 3-1:0.0: probe with driver gs_usb failed with error -22 [ 1014.653038][T13539] netlink: 'syz.4.1831': attribute type 10 has an invalid length. [ 1015.775496][T13550] netlink: 'syz.1.1835': attribute type 4 has an invalid length. [ 1016.454736][ T9558] usb 3-1: USB disconnect, device number 11 [ 1020.292101][T13592] netlink: 'syz.3.1847': attribute type 10 has an invalid length. [ 1021.961860][T13607] geneve2: entered promiscuous mode [ 1021.967222][T13607] geneve2: entered allmulticast mode [ 1022.811216][T13616] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1852'. [ 1023.309044][T13622] autofs: Unknown parameter 'fd0x0000000000000000' [ 1025.245945][T13637] xt_nat: multiple ranges no longer supported [ 1026.284826][T13648] macvlan5: entered promiscuous mode [ 1027.478802][T13655] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1865'. [ 1027.579774][T13658] geneve2: entered promiscuous mode [ 1027.585102][T13658] geneve2: entered allmulticast mode [ 1032.870936][T13691] netlink: 'syz.4.1874': attribute type 10 has an invalid length. [ 1034.075638][T13701] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1877'. [ 1037.066605][T13723] Device name cannot be null; rc = [-22] [ 1039.774290][T13743] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1889'. [ 1044.562840][T13778] Device name cannot be null; rc = [-22] [ 1051.908851][T13834] Device name cannot be null; rc = [-22] [ 1055.064290][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 1055.070766][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 1056.270198][T13867] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1920'. [ 1059.621759][T13888] Device name cannot be null; rc = [-22] [ 1061.508237][T13911] geneve2: entered promiscuous mode [ 1061.513772][T13911] geneve2: entered allmulticast mode [ 1062.424665][T13919] autofs: Unknown parameter 'fd0x0000000000000000' [ 1065.388864][T13936] Device name cannot be null; rc = [-22] [ 1068.795878][T13953] input: syz1 as /devices/virtual/input/input10 [ 1068.831816][T13953] vivid-001: disconnect [ 1069.372930][T13950] vivid-001: reconnect [ 1076.406886][T13998] input: syz1 as /devices/virtual/input/input11 [ 1076.444370][T13998] vivid-004: disconnect [ 1076.960501][T13993] vivid-004: reconnect [ 1078.369866][T14002] Device name cannot be null; rc = [-22] [ 1080.320065][T14016] geneve2: entered promiscuous mode [ 1080.325770][T14016] geneve2: entered allmulticast mode [ 1088.047902][T14070] geneve2: entered promiscuous mode [ 1088.090440][T14070] geneve2: entered allmulticast mode [ 1090.427753][T14100] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1981'. [ 1093.417432][T14124] autofs: Unknown parameter 'fd0x0000000000000000' [ 1098.667217][T14158] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1995'. [ 1102.090856][T14184] Device name cannot be null; rc = [-22] [ 1103.256753][T14195] netlink: 'syz.4.2004': attribute type 4 has an invalid length. [ 1104.778589][T14192] geneve2: entered promiscuous mode [ 1105.742941][T14192] geneve2: entered allmulticast mode [ 1107.016869][T14204] geneve2: entered promiscuous mode [ 1107.022106][T14204] geneve2: entered allmulticast mode [ 1109.274284][T14226] can0: slcan on ptm0. [ 1111.713590][T14223] can0 (unregistered): slcan off ptm0. [ 1112.057368][T14244] autofs: Unknown parameter 'fd0x0000000000000000' [ 1112.200265][T14249] geneve2: entered promiscuous mode [ 1112.205861][T14249] geneve2: entered allmulticast mode [ 1113.143839][T14248] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 1113.619633][T14261] netlink: 'syz.2.2019': attribute type 4 has an invalid length. [ 1114.281011][T14266] Device name cannot be null; rc = [-22] [ 1115.927894][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 1116.020573][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 1116.321993][T14287] ubi: mtd0 is already attached to ubi31 [ 1120.802277][T14321] geneve2: entered promiscuous mode [ 1120.846550][T14321] geneve2: entered allmulticast mode [ 1122.850654][ T9] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 1123.673557][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 1123.852666][ T9] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1124.633590][ T9] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 1124.756737][T14346] netlink: 17 bytes leftover after parsing attributes in process `syz.3.2040'. [ 1124.773340][T14346] netlink: zone id is out of range [ 1124.778910][T14346] netlink: zone id is out of range [ 1124.784928][T14346] netlink: zone id is out of range [ 1124.790322][T14346] netlink: zone id is out of range [ 1124.795905][T14346] netlink: zone id is out of range [ 1124.801270][T14346] netlink: zone id is out of range [ 1124.806796][T14346] netlink: zone id is out of range [ 1124.812172][T14346] netlink: zone id is out of range [ 1124.818092][T14346] netlink: zone id is out of range [ 1124.823709][T14346] netlink: zone id is out of range [ 1124.906726][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1124.934386][ T9] usb 3-1: config 0 descriptor?? [ 1124.946866][ T9] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 1125.185913][T14352] netlink: 'syz.1.2041': attribute type 4 has an invalid length. [ 1127.645323][ T9] usb 3-1: USB disconnect, device number 12 [ 1130.037544][T14401] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2053'. [ 1130.362952][T14407] Device name cannot be null; rc = [-22] [ 1132.673927][ T5855] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 1132.704981][T14424] netlink: 'syz.2.2060': attribute type 4 has an invalid length. [ 1133.044972][ T5855] usb 4-1: Using ep0 maxpacket: 32 [ 1133.057009][ T5855] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1134.103731][ T5855] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 1134.112835][ T5855] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1134.190649][ T5855] usb 4-1: config 0 descriptor?? [ 1134.271452][ T5855] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 1135.455636][T14455] Device name cannot be null; rc = [-22] [ 1136.183642][ T5936] usb 4-1: USB disconnect, device number 11 [ 1142.336566][T14493] netlink: 'syz.1.2077': attribute type 4 has an invalid length. [ 1143.523545][ T9] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 1143.734246][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 1144.471831][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1144.483523][ T9] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 1144.492605][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1144.515123][ T9] usb 4-1: config 0 descriptor?? [ 1144.540395][ T9] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 1146.435297][ T9807] usb 4-1: USB disconnect, device number 12 [ 1150.002397][T14549] net_ratelimit: 76 callbacks suppressed [ 1150.002422][T14549] sctp: failed to load transform for md5: -2 [ 1150.426079][T14558] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2093'. [ 1150.783561][T14560] nvme_fabrics: missing parameter 'transport=%s' [ 1151.091098][T14560] nvme_fabrics: missing parameter 'nqn=%s' [ 1152.047190][T14571] ubi: mtd0 is already attached to ubi31 [ 1152.088587][T14572] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2095'. [ 1153.279692][T14578] geneve2: entered promiscuous mode [ 1153.286125][T14578] geneve2: entered allmulticast mode [ 1154.819221][T14596] macvlan4: entered promiscuous mode [ 1159.457660][T14627] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2110'. [ 1160.050606][T14631] geneve2: entered promiscuous mode [ 1160.056061][T14631] geneve2: entered allmulticast mode [ 1160.994820][T14638] ubi: mtd0 is already attached to ubi31 [ 1162.150085][T14637] nvme_fabrics: missing parameter 'transport=%s' [ 1162.156943][T14637] nvme_fabrics: missing parameter 'nqn=%s' [ 1164.693585][ T5855] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 1164.913408][ T5855] usb 4-1: Using ep0 maxpacket: 32 [ 1164.928335][ T5855] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1164.946472][ T5855] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 1164.989891][ T5855] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1165.026944][ T5855] usb 4-1: config 0 descriptor?? [ 1165.044670][ T5855] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 1167.203980][T13232] usb 4-1: USB disconnect, device number 13 [ 1168.714814][T14697] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2125'. [ 1170.231410][T14696] nvme_fabrics: missing parameter 'transport=%s' [ 1170.274843][T14696] nvme_fabrics: missing parameter 'nqn=%s' [ 1170.361179][T14703] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2126'. [ 1171.603321][ T5973] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 1171.807264][ T5973] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 1171.834654][ T5973] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1171.860103][ T5973] usb 4-1: config 0 descriptor?? [ 1173.397581][ T5973] ath6kl: Failed to submit usb control message: -110 [ 1174.123417][ T5973] ath6kl: unable to send the bmi data to the device: -110 [ 1174.130596][ T5973] ath6kl: Unable to send get target info: -110 [ 1174.154369][ T5973] ath6kl: Failed to init ath6kl core: -110 [ 1174.170201][ T5973] ath6kl_usb 4-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 1174.183573][ T5973] usb 4-1: USB disconnect, device number 14 [ 1174.422399][T14734] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2134'. [ 1176.131839][T14748] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2138'. [ 1178.664366][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 1178.670855][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 1178.816181][T14749] nvme_fabrics: missing parameter 'transport=%s' [ 1178.822852][T14749] nvme_fabrics: missing parameter 'nqn=%s' [ 1179.210546][T14757] can0: slcan on ptm0. [ 1180.599891][T14756] can0 (unregistered): slcan off ptm0. [ 1181.063874][T14771] Device name cannot be null; rc = [-22] [ 1181.935173][T14775] Device name cannot be null; rc = [-22] [ 1184.161809][T14807] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2149'. [ 1185.539132][T14807] nvme_fabrics: missing parameter 'transport=%s' [ 1185.595495][T14807] nvme_fabrics: missing parameter 'nqn=%s' [ 1187.613416][T14829] can0: slcan on ptm0. [ 1187.838353][T14828] can0 (unregistered): slcan off ptm0. [ 1187.896900][T14837] Device name cannot be null; rc = [-22] [ 1190.827980][T14857] input: syz1 as /devices/virtual/input/input12 [ 1191.047496][T14858] vivid-002: disconnect [ 1191.597293][T14852] vivid-002: reconnect [ 1192.549378][T14859] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2165'. [ 1194.989819][T14860] nvme_fabrics: missing parameter 'transport=%s' [ 1195.116131][T14860] nvme_fabrics: missing parameter 'nqn=%s' [ 1195.406495][T14864] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2166'. [ 1196.492169][T14864] nvme_fabrics: missing parameter 'transport=%s' [ 1196.516125][T14864] nvme_fabrics: missing parameter 'nqn=%s' [ 1196.904569][T14879] Device name cannot be null; rc = [-22] [ 1200.685703][T14904] netlink: 'syz.3.2177': attribute type 11 has an invalid length. [ 1200.693704][T14904] netlink: 144 bytes leftover after parsing attributes in process `syz.3.2177'. [ 1203.486479][T14922] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2180'. [ 1206.192146][T14921] nvme_fabrics: missing parameter 'transport=%s' [ 1206.198902][T14921] nvme_fabrics: missing parameter 'nqn=%s' [ 1206.327483][T14933] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2182'. [ 1207.710706][T14931] nvme_fabrics: missing parameter 'transport=%s' [ 1207.735911][T14931] nvme_fabrics: missing parameter 'nqn=%s' [ 1210.870187][T14963] netlink: 'syz.4.2192': attribute type 4 has an invalid length. [ 1213.327826][T14981] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1213.337787][T14981] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1213.346378][T14981] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1213.355544][T14981] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1213.364523][T14981] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1213.416707][T14980] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2197'. [ 1213.433391][ T51] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1213.443668][ T51] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1213.452434][ T51] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1213.461521][ T51] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1213.503651][ T51] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1215.698628][T15006] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1215.754979][ T51] Bluetooth: hci5: command tx timeout [ 1216.409389][ T13] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1217.023984][T15025] Device name cannot be null; rc = [-22] [ 1217.506323][ T13] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1218.411294][ T51] Bluetooth: hci5: command tx timeout [ 1218.850256][T15036] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2210'. [ 1219.011837][ T13] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1219.042359][T15044] binder: 15043:15044 ioctl c018620c 0 returned -14 [ 1219.105624][T14979] chnl_net:caif_netlink_parms(): no params data found [ 1220.184873][ T13] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1220.553615][ T51] Bluetooth: hci5: command tx timeout [ 1222.365121][T14979] bridge0: port 1(bridge_slave_0) entered blocking state [ 1222.372761][T14979] bridge0: port 1(bridge_slave_0) entered disabled state [ 1222.392974][T14979] bridge_slave_0: entered allmulticast mode [ 1222.508255][T14979] bridge_slave_0: entered promiscuous mode [ 1222.564376][ T51] Bluetooth: hci5: command tx timeout [ 1222.581827][T14979] bridge0: port 2(bridge_slave_1) entered blocking state [ 1222.604448][T14979] bridge0: port 2(bridge_slave_1) entered disabled state [ 1222.611937][T14979] bridge_slave_1: entered allmulticast mode [ 1222.638855][T14979] bridge_slave_1: entered promiscuous mode [ 1222.921439][T15074] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2218'. [ 1223.020880][T14979] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1223.033672][ T13] bridge_slave_1: left allmulticast mode [ 1223.039564][ T13] bridge_slave_1: left promiscuous mode [ 1223.047545][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 1223.084523][ T13] bridge_slave_0: left allmulticast mode [ 1223.098738][ T13] bridge_slave_0: left promiscuous mode [ 1223.112344][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 1225.089033][T15090] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2222'. [ 1225.207880][ T13] bond1 (unregistering): (slave ip6gretap1): Releasing backup interface [ 1225.217831][ T13] bond1 (unregistering): (slave ip6gretap1): the permanent HWaddr of slave - 36:9e:94:c8:84:2a - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 1227.729499][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1227.742513][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1227.753019][ T13] bond0 (unregistering): Released all slaves [ 1227.769053][ T13] bond1 (unregistering): (slave veth3): Releasing backup interface [ 1227.779222][ T13] bond1 (unregistering): Released all slaves [ 1227.798852][ T13] bond2 (unregistering): (slave veth5): Releasing backup interface [ 1227.808474][ T13] bond2 (unregistering): Released all slaves [ 1227.826741][ T13] bond3 (unregistering): Released all slaves [ 1227.841049][ T13] bond4 (unregistering): Released all slaves [ 1227.857820][ T13] bond5 (unregistering): Released all slaves [ 1227.877806][ T13] bond6 (unregistering): Released all slaves [ 1227.893854][ T13] bond7 (unregistering): Released all slaves [ 1227.911688][T14979] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1227.984602][T15117] geneve2: entered promiscuous mode [ 1228.020274][T15117] geneve2: entered allmulticast mode [ 1228.185680][T14979] team0: Port device team_slave_0 added [ 1228.672520][T14979] team0: Port device team_slave_1 added [ 1228.890611][T14979] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1228.935340][T14979] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1229.152487][T14979] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1229.243665][T14979] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1229.250743][T14979] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1229.333885][T14979] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1229.333920][T15132] netlink: 'syz.4.2230': attribute type 11 has an invalid length. [ 1229.664706][T15132] netlink: 144 bytes leftover after parsing attributes in process `syz.4.2230'. [ 1231.026034][ T13] hsr_slave_0: left promiscuous mode [ 1231.107255][ T13] hsr_slave_1: left promiscuous mode [ 1231.146471][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1231.176800][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1231.209557][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1231.236961][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1231.447923][ T13] veth1_macvtap: left promiscuous mode [ 1231.458893][ T13] veth0_macvtap: left promiscuous mode [ 1231.465897][ T13] veth1_vlan: left promiscuous mode [ 1231.471665][ T13] veth0_vlan: left promiscuous mode [ 1234.224133][ T13] team0 (unregistering): Port device team_slave_1 removed [ 1234.288205][ T13] team0 (unregistering): Port device team_slave_0 removed [ 1234.332033][T15161] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2237'. [ 1234.880653][T15166] [U]  [ 1234.904076][T14979] hsr_slave_0: entered promiscuous mode [ 1234.910834][T14979] hsr_slave_1: entered promiscuous mode [ 1234.922428][T14979] debugfs: 'hsr0' already exists in 'hsr' [ 1234.929037][T14979] Cannot create hsr debugfs directory [ 1237.655707][T14979] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1237.799558][T14979] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1237.812083][T14979] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1238.512273][T14979] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1238.809335][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 1238.815850][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 1238.956123][T15193] geneve2: entered promiscuous mode [ 1238.974672][T15193] geneve2: entered allmulticast mode [ 1240.390245][T14979] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1240.437592][T14979] 8021q: adding VLAN 0 to HW filter on device team0 [ 1240.460289][T15106] bridge0: port 1(bridge_slave_0) entered blocking state [ 1240.467505][T15106] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1240.508589][T15106] bridge0: port 2(bridge_slave_1) entered blocking state [ 1240.515791][T15106] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1240.792651][T15214] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2247'. [ 1241.699302][T15229] macvlan5: entered promiscuous mode [ 1242.718114][T14979] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1242.841289][T15238] netlink: 'syz.3.2251': attribute type 11 has an invalid length. [ 1243.361311][T15238] netlink: 144 bytes leftover after parsing attributes in process `syz.3.2251'. [ 1244.050580][T15256] Device name cannot be null; rc = [-22] [ 1245.648600][T15270] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2259'. [ 1245.846080][T14979] veth0_vlan: entered promiscuous mode [ 1245.887290][T14979] veth1_vlan: entered promiscuous mode [ 1246.533050][T14979] veth0_macvtap: entered promiscuous mode [ 1246.546610][T14979] veth1_macvtap: entered promiscuous mode [ 1246.585084][T14979] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1246.610584][T14979] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1246.632146][ T6383] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1246.732500][ T59] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1246.742631][ T59] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1246.756545][ T59] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1248.341773][T15105] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1248.517092][T15105] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1249.093389][T15069] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1249.101357][T15069] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1251.383279][T15320] Device name cannot be null; rc = [-22] [ 1252.020060][T15323] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2271'. [ 1254.153363][ T5922] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 1254.573340][ T5922] usb 6-1: Using ep0 maxpacket: 32 [ 1255.353719][ T5922] usb 6-1: config 0 has an invalid interface number: 225 but max is 0 [ 1255.363334][ T5922] usb 6-1: config 0 has no interface number 0 [ 1255.380591][ T5922] usb 6-1: New USB device found, idVendor=0856, idProduct=ac30, bcdDevice=7e.79 [ 1255.389949][ T5922] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1255.410268][ T5922] usb 6-1: Product: syz [ 1255.431313][ T5922] usb 6-1: Manufacturer: syz [ 1255.463268][ T5922] usb 6-1: SerialNumber: syz [ 1255.484499][ T5922] usb 6-1: config 0 descriptor?? [ 1256.976302][T15362] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2282'. [ 1257.003399][ T5922] mos7840 6-1:0.225: required endpoints missing [ 1257.222893][ T5922] usb 6-1: USB disconnect, device number 2 [ 1257.249479][T15366] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1260.361587][T15396] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2290'. [ 1261.238479][T15400] Device name cannot be null; rc = [-22] [ 1262.514389][T15408] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2295'. [ 1264.421031][T15416] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1268.871558][T15449] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2303'. [ 1272.733742][T15478] Device name cannot be null; rc = [-22] [ 1274.764086][T15469] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1278.057723][T15528] Device name cannot be null; rc = [-22] [ 1281.590367][T15557] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2332'. [ 1282.234101][T15561] binder: 15558:15561 ioctl c0306201 200000000540 returned -22 [ 1282.935552][T15570] Device name cannot be null; rc = [-22] [ 1285.474956][T15588] macvlan6: entered promiscuous mode [ 1290.426835][T15624] Device name cannot be null; rc = [-22] [ 1292.945555][T15644] Device name cannot be null; rc = [-22] [ 1295.007140][T15655] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2355'. [ 1297.345354][T15656] nvme_fabrics: missing parameter 'transport=%s' [ 1297.351794][T15656] nvme_fabrics: missing parameter 'nqn=%s' [ 1300.324686][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 1300.748227][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 1301.243593][T15688] ================================================================== [ 1301.251716][T15688] BUG: KASAN: slab-use-after-free in sysfs_remove_file_ns+0x3d/0x70 [ 1301.259736][T15688] Read of size 8 at addr ffff8880674f5630 by task syz.0.2363/15688 [ 1301.267637][T15688] [ 1301.270012][T15688] CPU: 0 UID: 0 PID: 15688 Comm: syz.0.2363 Not tainted 6.16.0-rc6-next-20250717-syzkaller #0 PREEMPT(full) [ 1301.270037][T15688] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1301.270053][T15688] Call Trace: [ 1301.270061][T15688] [ 1301.270071][T15688] dump_stack_lvl+0x189/0x250 [ 1301.270098][T15688] ? __virt_addr_valid+0x1c8/0x5c0 [ 1301.270120][T15688] ? rcu_is_watching+0x15/0xb0 [ 1301.270139][T15688] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1301.270159][T15688] ? rcu_is_watching+0x15/0xb0 [ 1301.270177][T15688] ? lock_release+0x4b/0x3e0 [ 1301.270203][T15688] ? _raw_spin_lock_irqsave+0xb3/0xf0 [ 1301.270228][T15688] ? __virt_addr_valid+0x1c8/0x5c0 [ 1301.270249][T15688] ? __virt_addr_valid+0x4a5/0x5c0 [ 1301.270271][T15688] print_report+0xca/0x230 [ 1301.270287][T15688] ? sysfs_remove_file_ns+0x3d/0x70 [ 1301.270305][T15688] kasan_report+0x118/0x150 [ 1301.270332][T15688] ? sysfs_remove_file_ns+0x3d/0x70 [ 1301.270361][T15688] sysfs_remove_file_ns+0x3d/0x70 [ 1301.270379][T15688] bus_remove_driver+0x198/0x2f0 [ 1301.270399][T15688] comedi_device_detach+0x134/0x720 [ 1301.270427][T15688] comedi_unlocked_ioctl+0xbd2/0xfc0 [ 1301.270451][T15688] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 1301.270483][T15688] ? __lock_acquire+0xab9/0xd20 [ 1301.270518][T15688] ? __fget_files+0x2a/0x420 [ 1301.270537][T15688] ? __fget_files+0x2a/0x420 [ 1301.270555][T15688] ? __fget_files+0x3a0/0x420 [ 1301.270571][T15688] ? __fget_files+0x2a/0x420 [ 1301.270589][T15688] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1301.270613][T15688] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 1301.270632][T15688] __se_sys_ioctl+0xf9/0x170 [ 1301.270657][T15688] do_syscall_64+0xfa/0x3b0 [ 1301.270683][T15688] ? lockdep_hardirqs_on+0x9c/0x150 [ 1301.270708][T15688] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1301.270726][T15688] ? clear_bhb_loop+0x60/0xb0 [ 1301.270746][T15688] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1301.270768][T15688] RIP: 0033:0x7fd788b8e929 [ 1301.270788][T15688] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1301.270806][T15688] RSP: 002b:00007fd789a7b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1301.270826][T15688] RAX: ffffffffffffffda RBX: 00007fd788db5fa0 RCX: 00007fd788b8e929 [ 1301.270840][T15688] RDX: 0000000000000000 RSI: 0000000040946400 RDI: 0000000000000003 [ 1301.270851][T15688] RBP: 00007fd788c10ca1 R08: 0000000000000000 R09: 0000000000000000 [ 1301.270863][T15688] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1301.270874][T15688] R13: 0000000000000000 R14: 00007fd788db5fa0 R15: 00007ffcae1ced98 [ 1301.270895][T15688] [ 1301.270901][T15688] [ 1301.531231][T15688] Allocated by task 15610: [ 1301.535657][T15688] kasan_save_track+0x3e/0x80 [ 1301.540356][T15688] __kasan_kmalloc+0x93/0xb0 [ 1301.544959][T15688] __kmalloc_noprof+0x27a/0x4f0 [ 1301.549829][T15688] snd_midi_event_new+0x95/0x1e0 [ 1301.554770][T15688] snd_virmidi_output_open+0xf3/0x5d0 [ 1301.560147][T15688] open_substream+0x3f2/0x7b0 [ 1301.564837][T15688] rawmidi_open_priv+0xc4/0x660 [ 1301.569716][T15688] snd_rawmidi_open+0x44f/0xae0 [ 1301.574584][T15688] chrdev_open+0x4cc/0x5e0 [ 1301.579008][T15688] do_dentry_open+0x950/0x13f0 [ 1301.583774][T15688] vfs_open+0x3b/0x340 [ 1301.587850][T15688] path_openat+0x2ee5/0x3830 [ 1301.592450][T15688] do_filp_open+0x1fa/0x410 [ 1301.596969][T15688] do_sys_openat2+0x121/0x1c0 [ 1301.601662][T15688] __x64_sys_openat+0x138/0x170 [ 1301.606519][T15688] do_syscall_64+0xfa/0x3b0 [ 1301.611036][T15688] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1301.616934][T15688] [ 1301.619262][T15688] Freed by task 15581: [ 1301.623326][T15688] kasan_save_track+0x3e/0x80 [ 1301.628013][T15688] kasan_save_free_info+0x46/0x50 [ 1301.633039][T15688] __kasan_slab_free+0x62/0x70 [ 1301.637813][T15688] kfree+0x18e/0x440 [ 1301.641715][T15688] snd_midi_event_free+0x40/0x60 [ 1301.646656][T15688] snd_virmidi_output_close+0xa3/0x110 [ 1301.652120][T15688] close_substream+0x460/0x7a0 [ 1301.656896][T15688] rawmidi_release_priv+0xef/0x1c0 [ 1301.662026][T15688] snd_rawmidi_release+0x5b/0xc0 [ 1301.666981][T15688] __fput+0x449/0xa70 [ 1301.670971][T15688] task_work_run+0x1d1/0x260 [ 1301.675580][T15688] exit_to_user_mode_loop+0xec/0x110 [ 1301.680886][T15688] do_syscall_64+0x2bd/0x3b0 [ 1301.685489][T15688] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1301.691388][T15688] [ 1301.693718][T15688] The buggy address belongs to the object at ffff8880674f5600 [ 1301.693718][T15688] which belongs to the cache kmalloc-256 of size 256 [ 1301.707776][T15688] The buggy address is located 48 bytes inside of [ 1301.707776][T15688] freed 256-byte region [ffff8880674f5600, ffff8880674f5700) [ 1301.721492][T15688] [ 1301.723820][T15688] The buggy address belongs to the physical page: [ 1301.730244][T15688] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x674f4 [ 1301.739031][T15688] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1301.747624][T15688] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 1301.755181][T15688] page_type: f5(slab) [ 1301.759171][T15688] raw: 00fff00000000040 ffff88801a441b40 dead000000000100 dead000000000122 [ 1301.767754][T15688] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 1301.776341][T15688] head: 00fff00000000040 ffff88801a441b40 dead000000000100 dead000000000122 [ 1301.785016][T15688] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 1301.793691][T15688] head: 00fff00000000001 ffffea00019d3d01 00000000ffffffff 00000000ffffffff [ 1301.802366][T15688] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 1301.811034][T15688] page dumped because: kasan: bad access detected [ 1301.817456][T15688] page_owner tracks the page as allocated [ 1301.823172][T15688] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 8352, tgid 8348 (syz.3.490), ts 367102840731, free_ts 351734799490 [ 1301.844463][T15688] post_alloc_hook+0x240/0x2a0 [ 1301.849252][T15688] get_page_from_freelist+0x21e4/0x22c0 [ 1301.854807][T15688] __alloc_frozen_pages_noprof+0x181/0x370 [ 1301.860622][T15688] alloc_pages_mpol+0x232/0x4a0 [ 1301.865486][T15688] allocate_slab+0x8a/0x370 [ 1301.869995][T15688] ___slab_alloc+0xbeb/0x1410 [ 1301.874674][T15688] __kmalloc_noprof+0x305/0x4f0 [ 1301.879539][T15688] io_cache_alloc_new+0x40/0x100 [ 1301.884485][T15688] __io_prep_rw+0x23f/0xd80 [ 1301.889002][T15688] io_prep_rwv+0x8c/0x3d0 [ 1301.893348][T15688] io_submit_sqes+0x8f3/0x1d10 [ 1301.898214][T15688] __se_sys_io_uring_enter+0x2df/0x2b20 [ 1301.903777][T15688] do_syscall_64+0xfa/0x3b0 [ 1301.908294][T15688] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1301.914191][T15688] page last free pid 7800 tgid 7800 stack trace: [ 1301.920518][T15688] __free_frozen_pages+0xbc4/0xd30 [ 1301.925643][T15688] __tlb_remove_table+0x2d2/0x3b0 [ 1301.930672][T15688] tlb_remove_table_rcu+0x85/0x100 [ 1301.935786][T15688] rcu_core+0xca8/0x1710 [ 1301.940044][T15688] handle_softirqs+0x283/0x870 [ 1301.944808][T15688] __irq_exit_rcu+0xca/0x1f0 [ 1301.949403][T15688] irq_exit_rcu+0x9/0x30 [ 1301.953647][T15688] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 1301.959291][T15688] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1301.965278][T15688] [ 1301.967605][T15688] Memory state around the buggy address: [ 1301.973240][T15688] ffff8880674f5500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1301.981307][T15688] ffff8880674f5580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1301.989370][T15688] >ffff8880674f5600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1301.997432][T15688] ^ [ 1302.003063][T15688] ffff8880674f5680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1302.011125][T15688] ffff8880674f5700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1302.019193][T15688] ================================================================== SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1302.456069][T15688] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1302.463406][T15688] CPU: 0 UID: 0 PID: 15688 Comm: syz.0.2363 Not tainted 6.16.0-rc6-next-20250717-syzkaller #0 PREEMPT(full) [ 1302.474973][T15688] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1302.485066][T15688] Call Trace: [ 1302.488371][T15688] [ 1302.491334][T15688] dump_stack_lvl+0x99/0x250 [ 1302.495972][T15688] ? __asan_memcpy+0x40/0x70 [ 1302.500603][T15688] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1302.505839][T15688] ? __pfx__printk+0x10/0x10 [ 1302.510476][T15688] vpanic+0x281/0x750 [ 1302.514491][T15688] ? preempt_schedule+0xae/0xc0 [ 1302.519376][T15688] ? __pfx_vpanic+0x10/0x10 [ 1302.523901][T15688] ? preempt_schedule_common+0x83/0xd0 [ 1302.529401][T15688] ? preempt_schedule+0xae/0xc0 [ 1302.534286][T15688] ? __pfx_preempt_schedule+0x10/0x10 [ 1302.539696][T15688] panic+0xb9/0xc0 [ 1302.543444][T15688] ? __pfx_panic+0x10/0x10 [ 1302.547915][T15688] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 1302.553849][T15688] ? is_module_address+0x17/0xf0 [ 1302.558806][T15688] ? sysfs_remove_file_ns+0x3d/0x70 [ 1302.564012][T15688] check_panic_on_warn+0x89/0xb0 [ 1302.568975][T15688] ? sysfs_remove_file_ns+0x3d/0x70 [ 1302.574184][T15688] end_report+0x78/0x160 [ 1302.578443][T15688] kasan_report+0x129/0x150 [ 1302.582967][T15688] ? sysfs_remove_file_ns+0x3d/0x70 [ 1302.588217][T15688] sysfs_remove_file_ns+0x3d/0x70 [ 1302.593257][T15688] bus_remove_driver+0x198/0x2f0 [ 1302.598207][T15688] comedi_device_detach+0x134/0x720 [ 1302.603422][T15688] comedi_unlocked_ioctl+0xbd2/0xfc0 [ 1302.608724][T15688] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 1302.614550][T15688] ? __lock_acquire+0xab9/0xd20 [ 1302.619424][T15688] ? __fget_files+0x2a/0x420 [ 1302.624026][T15688] ? __fget_files+0x2a/0x420 [ 1302.628627][T15688] ? __fget_files+0x3a0/0x420 [ 1302.633362][T15688] ? __fget_files+0x2a/0x420 [ 1302.637980][T15688] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1302.642936][T15688] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 1302.648755][T15688] __se_sys_ioctl+0xf9/0x170 [ 1302.653362][T15688] do_syscall_64+0xfa/0x3b0 [ 1302.657883][T15688] ? lockdep_hardirqs_on+0x9c/0x150 [ 1302.663096][T15688] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1302.669171][T15688] ? clear_bhb_loop+0x60/0xb0 [ 1302.673875][T15688] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1302.679777][T15688] RIP: 0033:0x7fd788b8e929 [ 1302.684199][T15688] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1302.703816][T15688] RSP: 002b:00007fd789a7b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1302.712246][T15688] RAX: ffffffffffffffda RBX: 00007fd788db5fa0 RCX: 00007fd788b8e929 [ 1302.720224][T15688] RDX: 0000000000000000 RSI: 0000000040946400 RDI: 0000000000000003 [ 1302.728199][T15688] RBP: 00007fd788c10ca1 R08: 0000000000000000 R09: 0000000000000000 [ 1302.736181][T15688] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1302.744166][T15688] R13: 0000000000000000 R14: 00007fd788db5fa0 R15: 00007ffcae1ced98 [ 1302.752155][T15688] [ 1302.755614][T15688] Kernel Offset: disabled [ 1302.759983][T15688] Rebooting in 86400 seconds..