last executing test programs: 5.299929281s ago: executing program 1 (id=1659): socket$tipc(0x1e, 0x2, 0x0) socket$tipc(0x1e, 0x2, 0x0) socket$tipc(0x1e, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000020)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000030)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000050)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000060)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000070)) socket$tipc(0x1e, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000080)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000090)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000000a0)) r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x1, {0x42}}, 0x10) ioctl$sock_SIOCGIFBR(0xffffffffffffffff, 0x8940, 0x0) socket$tipc(0x1e, 0x5, 0x0) socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000140)={0x42, 0x1}, 0x10) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000280)) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) write(r1, &(0x7f0000000200)="580000001400010300000000000000001e000000ffffffff00"/88, 0x58) 5.126469175s ago: executing program 1 (id=1661): r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ipvs(0x0, r1) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r2, 0x9) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r4 = accept(r2, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYRESHEX], 0xfffffdef}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) recvfrom(r3, &(0x7f0000000180)=""/60, 0xfffffffffffffecb, 0x500, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$rds(0x15, 0x5, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) sendmsg$rds(r5, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) 4.363667893s ago: executing program 3 (id=1664): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010007000000000000000000000a20000000000a03000000000000000100010000000900010073797a300000000048000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f0c00098008000140000100075c0000000e0a01020000000000000000010000000900020073797a320000"], 0xec}, 0x1, 0x0, 0x0, 0x24004005}, 0x20004004) 4.173775458s ago: executing program 3 (id=1667): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x7}, 0x6) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000080)={r0}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000800)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c0000000600000004000000f955000598000000003030612e00743b46120085bae28aa2eb117475a739b5fe7cf98782c21ad0eb7f27f89e58c4ce4d326b4c8774750d961ee0354a1830c5ec"], 0x0, 0x2a, 0x0, 0x8, 0xbf81}, 0x28) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB], 0x50) socket$packet(0x11, 0x3, 0x300) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xf, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000100000000000300000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014006a00b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0xf2a9a9ee94caf607, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x2000033f, &(0x7f0000000240)=ANY=[], 0x0, 0x2003, 0x0, 0x0, 0x0, 0x32, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfff}, 0x94) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000740)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000400)='syzkaller\x00', 0x9, 0x0, 0x0, 0x40f00, 0x50}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000500)=r3, 0x4) socket$inet6_sctp(0xa, 0x5, 0x84) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000240)=[@in6={0xa, 0x4e21, 0x7, @mcast1, 0x10001}]}, &(0x7f00000002c0)=0x10) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r1, 0x84, 0x5, &(0x7f0000000140)={0x0, @in={{0x2, 0x4e23, @broadcast}}}, 0x84) write(r0, &(0x7f0000000100)="060000000300010000", 0x9) 4.132213729s ago: executing program 1 (id=1668): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[], 0x48}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) 3.972102723s ago: executing program 1 (id=1670): r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000000)={0x18, 0x0, {0x1, @empty, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000040)) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f00000000c0)) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl(r2, 0x40047438, &(0x7f0000000040)) ioctl$PPPIOCCONNECT(r2, 0x4004743a, &(0x7f00000000c0)) ioctl$PPPIOCSFLAGS1(r1, 0x40047459, &(0x7f0000000140)=0x4202c78) write$ppp(r1, 0x0, 0x0) 3.966690173s ago: executing program 3 (id=1671): socket$tipc(0x1e, 0x2, 0x0) socket$tipc(0x1e, 0x2, 0x0) socket$tipc(0x1e, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000020)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000030)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000050)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000060)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000070)) socket$tipc(0x1e, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000080)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000090)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000000a0)) r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x1, {0x42}}, 0x10) ioctl$sock_SIOCGIFBR(0xffffffffffffffff, 0x8940, 0x0) socket$tipc(0x1e, 0x5, 0x0) socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000140)={0x42, 0x1}, 0x10) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000280)) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) write(r1, &(0x7f0000000200)="580000001400010300000000000000001e000000ffffffff00"/88, 0x58) 3.785751628s ago: executing program 3 (id=1674): recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0xf0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1e1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000300)={0x1, &(0x7f00000002c0)=[{0x6, 0xc8, 0x6, 0x7}]}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) close(r2) socket(0x10, 0x803, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) 3.67594322s ago: executing program 1 (id=1676): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = creat(0x0, 0x175) mknod(&(0x7f00000001c0)='./bus\x00', 0x8000, 0xd02) acct(&(0x7f0000000000)='./bus\x00') acct(0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a7c000000060a0104000000000000000002000000500004804c0001800c0001007061796c6f6164003c000280080004400000005a0800054000000002080003400000001708000240000000020800064000000002080007400000000808000840000000000900010073797a30000000000900020073797a32"], 0xa4}}, 0x4) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, 0x0, 0x20000014) r5 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x757e, 0x0, 0xfffffffe, 0xffffffff}, &(0x7f0000000580)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r9 = open(&(0x7f0000000140)='./file1\x00', 0x66842, 0x29) syz_ublk_add_dev(r9, r6, r7, r8, &(0x7f00000003c0)={0x2e, 0x71, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000180)=@any_dev={0x4, 0x58e, 0x0, 0x0, 0x1000, 0x9, 0xffffffffffffffff}}}, &(0x7f0000000440)=0x0) syz_ublk_setup_queues(r9, r10, &(0x7f0000000340)={0x0, 0xfb7e, 0x800, 0x200, 0x321, 0x0, r0}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xd3db, 0x8, 0x1, 0x2f2, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9dfe, 0x200, 0x8000001, 0x278, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb606, 0x4, 0x1, 0x321, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8b94, 0x200, 0x0, 0xc0}}], 0x4, &(0x7f00000017c0)={0x2e, 0x40, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xf6}, 0x0, 0x0, '\x00', {0x2, 0xc81, 0x0, 0x0}}, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'wg1\x00', 0x1}) socket$kcm(0xa, 0x5, 0x0) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) mount$9p_fd(0x0, 0x0, 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0, 0x0}, 0x2020) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000080)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xff}}, 0x10, &(0x7f00000001c0)}, 0x3e8) mount$tmpfs(0x0, &(0x7f0000000240)='./cgroup.cpu/cgroup.procs\x00', &(0x7f0000000500), 0x2001000, &(0x7f0000000540)=ANY=[@ANYBLOB='si\x00e=8,uid=', @ANYRESHEX=r11, @ANYBLOB=',fsname=/-&(#,\x00']) 3.540604264s ago: executing program 3 (id=1678): r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b000000000000", 0x10, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000300)=""/99, 0x63}, {&(0x7f0000000fc0)=""/4096, 0x1000}], 0x2, &(0x7f0000000600)=""/191, 0xbf}}], 0x1, 0x2040000, &(0x7f0000003700)={0x77359400}) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x3000004, 0x3032, 0xffffffffffffffff, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d40)=@newqdisc={0x3a8, 0x24, 0x3fe3aa0262d8c783, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0x8, 0xfffb}}, [@qdisc_kind_options=@q_choke={{0xa}, {0x378, 0x2, [@TCA_CHOKE_PARMS={0x14, 0x1, {0xf, 0x0, 0x0, 0x0, 0x1d}}, @TCA_CHOKE_PARMS={0x14, 0x1, {0x65, 0x2, 0x3, 0x17, 0xd, 0x8, 0x2}}, @TCA_CHOKE_MAX_P={0x8, 0x3, 0x2}, @TCA_CHOKE_PARMS={0x14}, @TCA_CHOKE_MAX_P={0x8}, @TCA_CHOKE_STAB={0x104, 0x2, "dc542b4e237011fb38ddb228806571a8633206e26df63a43bbc516382325dedd79c1cf0a26379dfaf72cb5ab9ab7efe16f312ee9ab598d1ac0d7903ac69c51f1b6842ebecf00dec5deff737b59f0c1f0b57cc6c2b7b8c5b2c527aafa57222f4bd2355ccab39fa20d4033b6b687491532080101805feb9c6fa8a56a77186efcb394ce1a1cd7f2130835e3bf9e3ac25d0a102a808be13beb51f37da6d10046f131834545ee5013f43e41e91eb18a12c28540ab4106286e0f7568f6a9cd0c0da51df08e42848096b25d455ebec9adfd6e493d8c9725bc2d49bbbae0a5375b359f91d9dad20ed109ffbc52469cd2cf5df7773f7a4c72ae167485315c326281efc400"}, @TCA_CHOKE_MAX_P={0x8}, @TCA_CHOKE_STAB={0x104, 0x2, "a2a88faa7ec665a571a9ad3d1f9512e3c591df4a4554c6c2e2cc6cb1d9aee4579684743ad4888f1522a47ddaff3d4f9450d288e8559bc4f795aa0d1bc74d926038d88646faa6e9053502000000e8ff927207d17a86b10d604e77a459df67e7f0c842d463ca5977b7e2eb55f9b9881d15633717817c7383e41ec2f119a6a6364d68900c1cce4a3b3225a9009e1e00b444e9e7bcd10e1dec202ce7786aa7cf10d4dd6bbcee586d7903a6239ff90b49cd7fddb0c67ddab326cdb2a783f691be9eba75cc67ae12d3b99c9acb4d9fb7c78081d269b443affd86eededd4867311221004000"}, @TCA_CHOKE_PARMS={0x14, 0x1, {0xfffffffc}}, @TCA_CHOKE_STAB={0x104, 0x2, "554b956aa3fcfbc4a187baf0437163b5d33108db016465f92a93480d2c246d90f03741da6ee916f7c9917dbd81da67d6150151679559af8402b932745d19fbfbd679c133c4714565f91cd05790d990818bac85598b6a844cb2c2d277aaca9a88ee0e6a834ba02b4e549f11fb13e9fe33730c55997f2d3b7e6469210db81587fc522295f49a78f4e08ddfb01172b12a19b303a0c47fa3500cdc3e6725a79dcd3731c37083c3bbe73c43e7e2ea82c72986a1499c677c565ea1cfc874e7e978e4ebe8d338f0b37807d40333ee570133982998623ec809826f1009856a9d9d8e839c65d3ead78c6b3cb8f7beee8e59f19de93d06628a2cdfa4333d96882b96c36cc3"}]}}]}, 0x3a8}, 0x1, 0x0, 0x0, 0x1}, 0x0) 3.115169164s ago: executing program 1 (id=1682): r0 = openat$nci(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000040)=0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000240), r2) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x1c, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}]}, 0x1c}}, 0x0) write$nci(r0, &(0x7f0000000880)=@NCI_OP_NFCEE_DISCOVER_NTF={0x2, 0x1, 0x3, 0x0, 0x5, {0x1, 0x9, "189bcc"}}, 0x8) write$nci(r0, &(0x7f0000000300)=@NCI_OP_RF_DISCOVER_MAP_RSP={0x1, 0x0, 0x2, 0x0, 0x1}, 0x4) sendmsg$NFC_CMD_START_POLL(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010023010000340200000600000008000100", @ANYRES32=r1, @ANYBLOB="080003008346"], 0x24}}, 0x0) write$nci(r0, &(0x7f0000000300)=@NCI_OP_CORE_SET_CONFIG_RSP={0x0, 0x0, 0x2, 0x2, 0x2}, 0x5) 2.984366877s ago: executing program 3 (id=1683): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xa, 0x4, 0x8, 0x8}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b703000000000000850000000600000018110000", @ANYRES32=r1], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=@ipv6_newnexthop={0x1c, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_FDB={0x4}]}, 0x1c}}, 0x0) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000540)={0x114, 0x14, 0x1, 0x70bd2d, 0x25dfdbfc, "", [@nested={0x103, 0x4e, 0x0, 0x1, [@typed={0xc, 0x2, 0x0, 0x0, @u64=0x8}, @typed={0x14, 0x2001, 0x0, 0x0, @ipv6=@empty}, @generic="2a725624d55e18f54ca5798d3fe7955ef9868c011de6a6d4494d7aba163930e7a6d17e0b2db61f06be12a8fe12bf5df24b2807a60c94c81f539deb8a1f987eb7669e1395c2ce8f7c2854902221ce978006451bd593aa73c50e0dfd544fd4fa321cbe1ddd38f2dfb0cec37543dac9e03b4dc38a9d937e23023ab86a8ce5f7a6d9772d2c9b91825cd6f77be8203cbe17d83dbb0590b1ef553211edef00ead1ebbe1b58e5b323435a913a2e5ce557c4ec021c723d2022c694102308a8fb6114ab4d007089b6a2816f689a565d4e70637725b2ff73", @typed={0xc, 0xe9, 0x0, 0x0, @u64=0xd0}]}]}, 0x114}], 0x1, 0x0, 0x0, 0x40004}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@newnexthop={0x28, 0x68, 0x1, 0x2, 0x7ffffffc, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x5}]}, @NHA_FDB={0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x24008000}, 0x4000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_freezer_state(r3, &(0x7f0000000140), 0x2, 0x0) mkdirat$cgroup(r3, &(0x7f00000000c0)='syz1\x00', 0x1ff) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=@newqdisc={0x6c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0x25dfdbfe, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0x0, 0x1}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x5, "41b57012b47bc8e8d8e3484d9c5998b3"}}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xf, 0x8, 0x1a95, 0x88ad, 0x2, 0x7, 0x2752}}, {0x4}}]}]}, 0x6c}}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r9, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000380)="2e00000010008188e6b62aa73772cc9f1ba1f848110000005e140602000000000e000a0010000000", 0x28}, {&(0x7f0000000000)="11c9064268e9", 0x6}], 0x2}, 0x40) sendmsg$nl_route(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@setlink={0x3c, 0x13, 0x1, 0x2000000, 0x25dfdbff, {}, [@IFLA_CARRIER={0x5}, @IFLA_ALT_IFNAME={0x14, 0x35, 'dummy0\x00'}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) write$cgroup_freezer_state(r4, &(0x7f0000000040)='FROZEN\x00', 0x7) r10 = syz_init_net_socket$x25(0x9, 0x5, 0x0) setsockopt$inet_opts(r10, 0x0, 0xd, 0x0, 0x0) r11 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r11, 0x0, 0x2e, &(0x7f0000000340)={0x0, {{0x2, 0xfffe, @multicast1}}, {{0x2, 0x4e21, @broadcast}}}, 0x108) sendfile(r4, r4, 0x0, 0x9) 2.975268627s ago: executing program 2 (id=1684): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)=[{0x0, 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000080), &(0x7f00000000c0)=0xc) ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000100)={0x14, r2, 0x534, 0x70bd2b, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x40050}, 0x4050) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0xe501, 0x3, 0x208, 0xb8, 0xa, 0x1000000, 0xb8, 0x0, 0x170, 0x230, 0x230, 0x170, 0x223, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0xb8}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x3b9, 'syz0\x00'}}}, {{@uncond, 0x0, 0x70, 0xb8}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x3c0, 'syz0\x00', {0xffffffffffffffff}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x268) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01080000000000000000020000000900010073797a30000000002c000000030a01040000000000000000020000000900010073797a30000000000900030073797a300000000090000000060a01240000000000000000020000000900010073797a30000000000900020073797a300000000064000480600001800b0001007461726765740000500002800e00010049444c4554494d455200000008000240000000013400030064000000746573745f6c6162656c0000000000000500dfd74d05892300000000000000000000000100000000000000000000000000004000000011000100000000000000"], 0x104}}, 0x0) 2.685534954s ago: executing program 2 (id=1687): socket$packet(0x11, 0x2, 0x300) unshare(0x22060600) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000600001e95"], &(0x7f0000000bc0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x39, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="10000000040000000800000002"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x1b, 0x3, 0x0, 0x0, 0x4}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r1}, &(0x7f0000000280), &(0x7f0000000440)=r0}, 0x20) 2.46807982s ago: executing program 2 (id=1689): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x2, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xd, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d0}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {}, {0x0, 0xb}, {0xffff, 0xfff2}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_MEMORY_LIMIT={0x8, 0x9, 0x40}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240048e4}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) preadv(r0, &(0x7f0000001840)=[{&(0x7f00000001c0)=""/202, 0xca}], 0x1, 0x5, 0x3) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 1.506450053s ago: executing program 2 (id=1702): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010007000000000000000000000a20000000000a03000000000000000100010000000900010073797a300000000048000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f0c00098008000140000100075c0000000e0a01020000000000000000010000000900020073797a3200000000090001"], 0xec}, 0x1, 0x0, 0x0, 0x24004005}, 0x20004004) 1.377383657s ago: executing program 2 (id=1704): getsockopt$bt_hci(0xffffffffffffffff, 0x11c, 0x1, 0x0, 0x0) openat$6lowpan_enable(0xffffffffffffff9c, 0x0, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0xc, 0xc, &(0x7f0000000880)=ANY=[@ANYRES32, @ANYBLOB="0000000000000000b7080000000000a07b5af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000150000009500000000000000"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000400), 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000), 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="5800000002060102000034e40000000004000008050005000a000000050001000600000005000400000000000900020073797a310000000011000300686173683a69702c706f727400001f000c00078008000640"], 0x58}, 0x1, 0x0, 0x0, 0x400c881}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)={0x54, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @remote}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x6}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) 1.284602849s ago: executing program 2 (id=1706): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000240)=0x5, 0x4) connect$inet6(r0, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305829, &(0x7f0000000180)={0x1100, 0x0, 0x52, 0x11000}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @multicast2}, 0x2, 0x0, 0x4}}, 0x2e) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002cbd7010fddbdf2505000000080009000200000008000c00a80a0000060001000500000008000b"], 0x3c}}, 0x20000034) connect$pppl2tp(0xffffffffffffffff, 0x0, 0x0) close(r2) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, 0x0, 0x0) r5 = socket$l2tp(0x2, 0x2, 0x73) connect$inet(r5, 0x0, 0x0) setsockopt$inet_buf(r5, 0x0, 0x26, 0x0, 0x8d) 1.046464115s ago: executing program 0 (id=1710): r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000000)={0x18, 0x0, {0x1, @empty, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000040)) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f00000000c0)) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl(r2, 0x40047438, &(0x7f0000000040)) ioctl$PPPIOCCONNECT(r2, 0x4004743a, &(0x7f00000000c0)) ioctl$PPPIOCSFLAGS1(r1, 0x40047459, &(0x7f0000000140)=0x4202c78) write$ppp(r1, &(0x7f0000000200), 0x0) 927.257468ms ago: executing program 0 (id=1711): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000300)="060000000300000002", 0x9) 824.19124ms ago: executing program 0 (id=1712): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x2, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xd, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d0}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {}, {0x0, 0xb}, {0xffff, 0xfff2}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_MEMORY_LIMIT={0x8, 0x9, 0x40}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240048e4}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) preadv(r0, &(0x7f0000001840)=[{&(0x7f00000001c0)=""/202, 0xca}], 0x1, 0x5, 0x3) r4 = socket$kcm(0x11, 0x3, 0x0) socket$unix(0x1, 0x5, 0x0) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, 0x0, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 752.531362ms ago: executing program 0 (id=1713): recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0xf0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1e1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000300)={0x1, &(0x7f00000002c0)=[{0x6, 0xc8, 0x6, 0x7}]}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) socket(0x10, 0x803, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) 704.278563ms ago: executing program 4 (id=1714): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010007000000000000000000000a20000000000a03000000000000000100010000000900010073797a300000000048000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f0c00098008000140000100075c0000000e0a01020000000000000000010000000900020073797a3200000000090001"], 0xec}, 0x1, 0x0, 0x0, 0x24004005}, 0x20004004) 675.865434ms ago: executing program 0 (id=1715): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r4, {0xffff}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x5, 0xd, 0x8b, 0xd, 0x2, 0x4, 0x2, 0xf, 0xe, 0x3, 0x7, 0x8, 0x4, 0x10, 0x4], 0x3, [0xb, 0x3, 0xad1e, 0xf870, 0x1, 0x4, 0x2, 0xd06, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x9, 0xe, 0x100], [0xfff1, 0x5, 0xffff, 0xfff5, 0x4, 0x8, 0x1, 0x7fff, 0x5, 0x2, 0xc, 0x4, 0xfffc, 0x3, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffe00, {0x0, 0x0, 0x0, r6, {0x8}, {0xffff}, {0xfff2, 0xffe1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0xe, [0xc, 0x5, 0x0, 0xf, 0x10, 0x2, 0x4, 0x2, 0xf, 0x6, 0x6, 0x1, 0x8, 0x4, 0x10, 0x4], 0x3, [0xb, 0x5, 0x7fff, 0x2002, 0x1, 0x4, 0x2, 0xd06, 0xff05, 0x8000, 0xb, 0x3, 0x5, 0x6, 0xd, 0x100], [0x2, 0x5, 0x0, 0xfff5, 0x4, 0x8, 0x7, 0x9, 0x5, 0x2, 0xc, 0x40, 0xfffc, 0x3, 0x1, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x4005c}, 0x0) 550.752787ms ago: executing program 0 (id=1716): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x800) sendmsg$NFT_BATCH(r0, 0x0, 0x40) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x15, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b7000000f8000000bca300000000000024030000b0feffff620af0fff8ffffff71a4f2ff000000001f03000000000000e5000500000000002604fdffff02000015010000033800001d13fcff000000007a0bf8ff0000001f0f14000000000000b503f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e5181554a090f300020000fe275daf51efd601b6bf01c8e8b1b526375ee4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff61623604000000000000006a89adaf17b0a6041bdeebdfd1f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564163427afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4155617572652d950ad31928b0b036dc2869f478341d02d0f5ad94b081fcd507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101a3062cd54f9ff51d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566d674e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48153baae244e7bf573eac34b781337ad5905c6bbf1137548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a90144022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab540b8d7b4ead35a385e0b4a26b702396df7e0c1e02b88c114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb11883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcd857ab15e355713767c536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ced301efeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef0981000000000000ff0f40b1888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fc08001011e32f80fb60e14b9eee094277bbc170882c8890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e3f753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30ca99e969d6fd09dc28ebc15edb4d91675767999d146aef7799738b292fd64bb25b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a794963342aece449a0d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b6ef9d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec035d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9900ca2532b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba7ac1f2b51c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a881192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f9f3322405d1efd78e578dc6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf79a43746979f99f6a1527f004f1e37a3926937e84fb478199dc1020f4beb98b8074bf7df8b5e783637da740800000000000000c55a4385e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc282928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a6a2740000000000000000000000000000000000000000000a0009dd14b38f2f4426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4100260ffcd8f1d04166d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06e64f0698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb0000000000000005375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10baa804a707f0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d34d3757b1450fdb0a9a69f432e277f3a0386eb2bd3305c821c64757f786b79fef54dbe64c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cff5d6b6898335792749df7b1f51e91f8c1c3b1b93b33aaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d94362200000000000000000000f296b0c1484e5f781ad26bff696b05ff0a5e2270e07618b04273bd4075ea38ab463bfa6a38e7c537498ba3e4df8dfc9e040000003c3ffad44d2a376def42e41e9fc31678257e040fa7cf32c221aaac08000000000000001a00000000000000000000173570f0c11ae694b0f7a4f9c2f6790044a357e785af6e153d5f1ea460af92c7cbbd6295afe740f5e154346d483e0d641ef02e4d5295d756e110522a7a945b93fb705b95b6aae27a8fb33732ce1da1c0b1af8eb9222a06e984ab1e6984c8bdc12360627137ab67b6b68ab08acb29a74dc36b51209cfbc87f61182bbeb2772e9d5a1ffc477179be481efe46a4ce86be0b1d8eee42a611a3d44ca450b14586ed63dd92005c79e4a8ab8a94f0c6cb4bed8594a39bd76d3ef8a7ab014e787596db796bd93a36c2880423291e3bccc86f66ba792ff4d87b3f80e5908779e51c5e9055fc5b23605cd000c723187ef09dcf4b07b06a9342f3f62ee7acddff292082c1f4d8eb9561f80873a09a1ae0c9af1121175e5600f43a1179484502009759264a5729f07c2b218fa36ba2316a99aaad0130df83d0bda1e711290f78c143ea143967b00adcd77e6ad5e48d839ea61aadb83e4d071c54691924a3830d3e7b5c198bb0ed623153590000000000000000004b985ea1702f34f2f85b168c083e810ed567e3f1979b9ed1a4bf6a10dac825c96a0828b335de445a4880bb6474157efd1a72ca46ae4cbe3ab648c9bc4867a5a4cb87d7d6d55475b34b3cb6aa9e2337d4e04a37e35109752522ac9b186ddd80c47da6a2f4ef7bb909c975520000000000000000000000219cf5c1376ab33786f6b856d354e90a2733f78f2d188057cead3480eade49d55b770fad7fa000d23da6275768810b6b2df91d3a991ea98d929d271696c258d5b735d5db11df434e7dd1b7c1ca05cea3977df564115f4ec6ffab1d2ff8a642ca50934b3fbe44b0abeba9df209566984a29dfc0466e439a94e177b3c4d5f6e92b8176b9d6ddeeeb196fa964217f88e1acc180aaa4"], &(0x7f00000001c0)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000040)={0x2}, 0x8, 0x10, &(0x7f00000000c0)={0x2, 0x0, 0x0, 0x7714}, 0x10}, 0x4f) write$tun(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="000086dd03000a000000140000006c07010033d43afffe800000000000000000000000000010ff02000000000000000000000000000189"], 0x340a) 549.970837ms ago: executing program 4 (id=1717): getsockopt$bt_hci(0xffffffffffffffff, 0x11c, 0x1, 0x0, 0x0) openat$6lowpan_enable(0xffffffffffffff9c, 0x0, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0xc, 0xc, &(0x7f0000000880)=ANY=[@ANYRES32, @ANYBLOB="0000000000000000b7080000000000a07b5af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000150000009500000000000000"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000400), 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000), 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="5800000002060102000034e40000000004000008050005000a000000050001000600000005000400000000000900020073797a310000000011000300686173683a69702c706f727400001f000c00078008000640"], 0x58}, 0x1, 0x0, 0x0, 0x400c881}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)={0x54, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @remote}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x6}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) 466.385189ms ago: executing program 4 (id=1718): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x7}, 0x6) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000080)={r0}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000800)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c0000000600000004000000f955000598000000003030612e00743b46120085bae28aa2eb117475a739b5fe7cf98782c21ad0eb7f27f89e58c4ce4d326b4c8774750d961ee0354a1830c5ec"], 0x0, 0x2a, 0x0, 0x8, 0xbf81}, 0x28) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="1b00"/11], 0x50) socket$packet(0x11, 0x3, 0x300) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xf, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000100000000000300000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014006a00b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0xf2a9a9ee94caf607, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x2000033f, &(0x7f0000000240)=ANY=[], 0x0, 0x2003, 0x0, 0x0, 0x0, 0x32, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfff}, 0x94) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000740)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000400)='syzkaller\x00', 0x9, 0x0, 0x0, 0x40f00, 0x50}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000500)=r3, 0x4) socket$inet6_sctp(0xa, 0x5, 0x84) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000240)=[@in6={0xa, 0x4e21, 0x7, @mcast1, 0x10001}]}, &(0x7f00000002c0)=0x10) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r1, 0x84, 0x5, &(0x7f0000000140)={0x0, @in={{0x2, 0x4e23, @broadcast}}}, 0x84) write(r0, &(0x7f0000000100)="060000000300010000", 0x9) 407.80359ms ago: executing program 4 (id=1719): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r4, {0xffff}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x5, 0xd, 0x8b, 0xd, 0x2, 0x4, 0x2, 0xf, 0xe, 0x3, 0x7, 0x8, 0x4, 0x10, 0x4], 0x3, [0xb, 0x3, 0xad1e, 0xf870, 0x1, 0x4, 0x2, 0xd06, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x9, 0xe, 0x100], [0xfff1, 0x5, 0xffff, 0xfff5, 0x4, 0x8, 0x1, 0x7fff, 0x5, 0x2, 0xc, 0x4, 0xfffc, 0x3, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffe00, {0x0, 0x0, 0x0, r6, {0x8}, {0xffff}, {0xfff2, 0xffe1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0xe, [0xc, 0x5, 0x0, 0xf, 0x10, 0x2, 0x4, 0x2, 0xf, 0x6, 0x6, 0x1, 0x8, 0x4, 0x10, 0x4], 0x3, [0xb, 0x5, 0x7fff, 0x2002, 0x1, 0x4, 0x2, 0xd06, 0xff05, 0x8000, 0xb, 0x3, 0x5, 0x6, 0xd, 0x100], [0x2, 0x5, 0x0, 0xfff5, 0x4, 0x8, 0x7, 0x9, 0x5, 0x2, 0xc, 0x40, 0xfffc, 0x3, 0x1, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x4005c}, 0x0) r7 = socket(0x10, 0x3, 0x0) sendmmsg(r7, &(0x7f0000000000), 0x4000000000001f2, 0x0) 299.911333ms ago: executing program 4 (id=1720): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$kcm(0x11, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x400001, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_NAT={0x8, 0xb, 0x1}]}}]}, 0x3c}}, 0x4049004) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) sendmsg$kcm(r1, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x8, 0x0, 0x3e}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000180)="27030200590214000600006fb96dbcf706e10500", 0x14}], 0x1}, 0x0) 0s ago: executing program 4 (id=1721): r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000000)={0x18, 0x0, {0x1, @empty, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000040)) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f00000000c0)) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl(r2, 0x40047438, &(0x7f0000000040)) ioctl$PPPIOCCONNECT(r2, 0x4004743a, &(0x7f00000000c0)) ioctl$PPPIOCSFLAGS1(r1, 0x40047459, &(0x7f0000000140)=0x4202c78) write$ppp(r1, &(0x7f0000000200), 0x0) kernel console output (not intermixed with test programs): 0 [ 91.548784][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 91.652237][ T4399] MPTCP: kernel_bind error, err=-98 [ 91.825834][ T14] cfg80211: failed to load regulatory.db [ 91.978472][ T4407] FAULT_INJECTION: forcing a failure. [ 91.978472][ T4407] name failslab, interval 1, probability 0, space 0, times 0 [ 92.038922][ T4407] CPU: 0 PID: 4407 Comm: syz.0.18 Not tainted syzkaller #0 [ 92.046217][ T4407] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 92.056340][ T4407] Call Trace: [ 92.059662][ T4407] [ 92.062639][ T4407] dump_stack_lvl+0x188/0x24e [ 92.067395][ T4407] ? show_regs_print_info+0x12/0x12 [ 92.072664][ T4407] ? load_image+0x410/0x410 [ 92.077241][ T4407] ? __might_sleep+0xd0/0xd0 [ 92.081884][ T4407] ? __lock_acquire+0x7c40/0x7c40 [ 92.086970][ T4407] ? mark_lock+0x94/0x320 [ 92.091399][ T4407] should_fail_ex+0x390/0x4c0 [ 92.096156][ T4407] should_failslab+0x5/0x20 [ 92.100726][ T4407] slab_pre_alloc_hook+0x59/0x300 [ 92.105816][ T4407] ? snd_seq_port_connect+0x67/0x420 [ 92.111154][ T4407] __kmem_cache_alloc_node+0x4f/0x270 [ 92.116590][ T4407] ? snd_seq_port_connect+0x67/0x420 [ 92.121929][ T4407] kmalloc_trace+0x26/0xe0 [ 92.126411][ T4407] snd_seq_port_connect+0x67/0x420 [ 92.131581][ T4407] ? do_raw_read_unlock+0x39/0x70 [ 92.136655][ T4407] ? _raw_read_unlock+0x24/0x40 [ 92.141560][ T4407] snd_seq_ioctl_subscribe_port+0x30a/0x6d0 [ 92.147513][ T4407] ? snd_seq_oss_midi_open+0x196/0x7f0 [ 92.153038][ T4407] ? snd_seq_ioctl_set_port_info+0x130/0x130 [ 92.159083][ T4407] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 92.165118][ T4407] ? _raw_spin_unlock+0x40/0x40 [ 92.170036][ T4407] snd_seq_oss_midi_open+0x4f3/0x7f0 [ 92.175380][ T4407] ? snd_seq_oss_midi_open_all+0xc0/0xc0 [ 92.181062][ T4407] snd_seq_oss_midi_open_all+0x55/0xc0 [ 92.186589][ T4407] snd_seq_oss_open+0x993/0xf00 [ 92.191487][ T4407] ? snd_seq_oss_delete_client+0x50/0x50 [ 92.197178][ T4407] ? trace_raw_output_contention_end+0xd0/0xd0 [ 92.203386][ T4407] ? odev_open+0x58/0x90 [ 92.207657][ T4407] ? __lock_acquire+0x7c40/0x7c40 [ 92.212735][ T4407] ? snd_seq_oss_process_event+0x2910/0x2910 [ 92.218760][ T4407] ? async_call_lookup_ports+0x10/0x10 [ 92.224255][ T4407] ? do_raw_spin_unlock+0x11d/0x230 [ 92.229566][ T4407] ? soundcore_open+0x309/0x4b0 [ 92.234454][ T4407] odev_open+0x63/0x90 [ 92.238552][ T4407] chrdev_open+0x585/0x5f0 [ 92.243004][ T4407] ? cd_forget+0x160/0x160 [ 92.247448][ T4407] ? fsnotify_perm+0x39b/0x550 [ 92.252241][ T4407] ? cd_forget+0x160/0x160 [ 92.256694][ T4407] do_dentry_open+0x7dd/0x10b0 [ 92.261500][ T4407] path_openat+0x2674/0x2f10 [ 92.266129][ T4407] ? verify_lock_unused+0x140/0x140 [ 92.271367][ T4407] ? do_sys_openat2+0xdd/0x4f0 [ 92.276164][ T4407] ? do_filp_open+0x420/0x420 [ 92.280881][ T4407] do_filp_open+0x1ee/0x420 [ 92.285419][ T4407] ? vfs_tmpfile+0x470/0x470 [ 92.290053][ T4407] ? _raw_spin_unlock+0x24/0x40 [ 92.294931][ T4407] ? alloc_fd+0x590/0x640 [ 92.299300][ T4407] do_sys_openat2+0x14b/0x4f0 [ 92.304043][ T4407] ? do_sys_open+0xe0/0xe0 [ 92.308492][ T4407] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 92.314507][ T4407] ? lock_chain_count+0x20/0x20 [ 92.319413][ T4407] __x64_sys_openat+0x135/0x160 [ 92.324309][ T4407] do_syscall_64+0x4c/0xa0 [ 92.328766][ T4407] ? clear_bhb_loop+0x60/0xb0 [ 92.333473][ T4407] ? clear_bhb_loop+0x60/0xb0 [ 92.338187][ T4407] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 92.344111][ T4407] RIP: 0033:0x7f9ac159e159 [ 92.348552][ T4407] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 92.368268][ T4407] RSP: 002b:00007f9ac243f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 92.376719][ T4407] RAX: ffffffffffffffda RBX: 00007f9ac1825fa0 RCX: 00007f9ac159e159 [ 92.384722][ T4407] RDX: 0000000000008002 RSI: 0000200000000040 RDI: ffffffffffffff9c [ 92.392744][ T4407] RBP: 00007f9ac163503b R08: 0000000000000000 R09: 0000000000000000 [ 92.400750][ T4407] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 92.408743][ T4407] R13: 00007f9ac1826038 R14: 00007f9ac1825fa0 R15: 00007fff734df538 [ 92.416753][ T4407] [ 92.483071][ T4409] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 92.559748][ T4412] Zero length message leads to an empty skb [ 92.933380][ T4419] xt_CT: You must specify a L4 protocol and not use inversions on it [ 93.030727][ T4424] comedi comedi2: aio_iiro_16: I/O port conflict (0x7,8) [ 93.051786][ T4420] syz.1.23 uses obsolete (PF_INET,SOCK_PACKET) [ 93.878460][ T4447] netlink: 4 bytes leftover after parsing attributes in process `syz.4.33'. [ 94.193965][ T4457] FAULT_INJECTION: forcing a failure. [ 94.193965][ T4457] name failslab, interval 1, probability 0, space 0, times 0 [ 94.241807][ T4457] CPU: 0 PID: 4457 Comm: syz.1.37 Not tainted syzkaller #0 [ 94.249101][ T4457] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 94.259200][ T4457] Call Trace: [ 94.262512][ T4457] [ 94.265467][ T4457] dump_stack_lvl+0x188/0x24e [ 94.270189][ T4457] ? show_regs_print_info+0x12/0x12 [ 94.275426][ T4457] ? load_image+0x410/0x410 [ 94.279958][ T4457] ? __might_sleep+0xd0/0xd0 [ 94.284569][ T4457] ? __lock_acquire+0x7c40/0x7c40 [ 94.289623][ T4457] ? odev_open+0x63/0x90 [ 94.293900][ T4457] ? do_dentry_open+0x7dd/0x10b0 [ 94.298872][ T4457] ? path_openat+0x2674/0x2f10 [ 94.303674][ T4457] should_fail_ex+0x390/0x4c0 [ 94.308402][ T4457] should_failslab+0x5/0x20 [ 94.312937][ T4457] slab_pre_alloc_hook+0x59/0x300 [ 94.317993][ T4457] ? snd_seq_oss_writeq_new+0xd4/0x340 [ 94.323485][ T4457] __kmem_cache_alloc_node+0x4f/0x270 [ 94.328974][ T4457] ? snd_seq_oss_writeq_new+0xd4/0x340 [ 94.334512][ T4457] kmalloc_trace+0x26/0xe0 [ 94.339000][ T4457] snd_seq_oss_writeq_new+0xd4/0x340 [ 94.344511][ T4457] ? lockdep_softirqs_off+0x430/0x430 [ 94.349927][ T4457] ? snd_seq_oss_readq_info_read+0xd0/0xd0 [ 94.355779][ T4457] ? __raw_spin_lock_init+0x41/0x100 [ 94.361124][ T4457] snd_seq_oss_open+0x865/0xf00 [ 94.366014][ T4457] ? snd_seq_oss_delete_client+0x50/0x50 [ 94.371716][ T4457] ? trace_raw_output_contention_end+0xd0/0xd0 [ 94.377922][ T4457] ? odev_open+0x58/0x90 [ 94.382193][ T4457] ? __lock_acquire+0x7c40/0x7c40 [ 94.387249][ T4457] ? snd_seq_oss_process_event+0x2910/0x2910 [ 94.393257][ T4457] ? async_call_lookup_ports+0x10/0x10 [ 94.398761][ T4457] ? do_raw_spin_unlock+0x11d/0x230 [ 94.403991][ T4457] ? soundcore_open+0x309/0x4b0 [ 94.408877][ T4457] odev_open+0x63/0x90 [ 94.412977][ T4457] chrdev_open+0x585/0x5f0 [ 94.417466][ T4457] ? cd_forget+0x160/0x160 [ 94.421917][ T4457] ? fsnotify_perm+0x39b/0x550 [ 94.426712][ T4457] ? cd_forget+0x160/0x160 [ 94.431161][ T4457] do_dentry_open+0x7dd/0x10b0 [ 94.435982][ T4457] path_openat+0x2674/0x2f10 [ 94.440616][ T4457] ? verify_lock_unused+0x140/0x140 [ 94.445852][ T4457] ? do_sys_openat2+0xdd/0x4f0 [ 94.450653][ T4457] ? do_filp_open+0x420/0x420 [ 94.455373][ T4457] do_filp_open+0x1ee/0x420 [ 94.459910][ T4457] ? vfs_tmpfile+0x470/0x470 [ 94.464545][ T4457] ? _raw_spin_unlock+0x24/0x40 [ 94.469460][ T4457] ? alloc_fd+0x590/0x640 [ 94.473847][ T4457] do_sys_openat2+0x14b/0x4f0 [ 94.478569][ T4457] ? do_sys_open+0xe0/0xe0 [ 94.483031][ T4457] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 94.489046][ T4457] ? lock_chain_count+0x20/0x20 [ 94.493933][ T4457] __x64_sys_openat+0x135/0x160 [ 94.498842][ T4457] do_syscall_64+0x4c/0xa0 [ 94.503319][ T4457] ? clear_bhb_loop+0x60/0xb0 [ 94.508086][ T4457] ? clear_bhb_loop+0x60/0xb0 [ 94.512805][ T4457] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 94.518741][ T4457] RIP: 0033:0x7f6c5d59e159 [ 94.523185][ T4457] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.543275][ T4457] RSP: 002b:00007f6c5e492028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 94.551734][ T4457] RAX: ffffffffffffffda RBX: 00007f6c5d825fa0 RCX: 00007f6c5d59e159 [ 94.559731][ T4457] RDX: 0000000000008002 RSI: 0000200000000040 RDI: ffffffffffffff9c [ 94.567724][ T4457] RBP: 00007f6c5d63503b R08: 0000000000000000 R09: 0000000000000000 [ 94.575716][ T4457] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.583712][ T4457] R13: 00007f6c5d826038 R14: 00007f6c5d825fa0 R15: 00007ffcf16c8d78 [ 94.591725][ T4457] [ 94.711565][ T37] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 94.883185][ T4462] device syzkaller0 entered promiscuous mode [ 94.917100][ T37] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 95.012203][ T37] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 95.051718][ T37] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 95.061836][ T37] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 95.072243][ T37] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 95.085482][ T37] usb 3-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 95.094817][ T37] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.180626][ T4412] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 95.186989][ T4351] Process accounting resumed [ 95.197631][ T37] keyspan 3-1:1.0: Keyspan 2 port adapter converter detected [ 95.210570][ T37] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 84 [ 95.219131][ T37] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 2 [ 95.231633][ T37] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 95.251882][ T37] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 88 [ 95.267695][ T37] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 6 [ 95.289284][ T37] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 95.740497][ T14] usb 3-1: USB disconnect, device number 2 [ 95.801200][ T14] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 95.837905][ T14] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 95.874028][ T14] keyspan 3-1:1.0: device disconnected [ 95.961369][ T4485] netlink: 'syz.1.47': attribute type 281 has an invalid length. [ 96.048053][ T4486] Bluetooth: MGMT ver 1.22 [ 96.797669][ T14] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 97.011989][ T14] usb 3-1: Using ep0 maxpacket: 16 [ 97.044447][ T14] usb 3-1: config 0 has no interfaces? [ 97.078125][ T14] usb 3-1: New USB device found, idVendor=15c2, idProduct=0045, bcdDevice=1f.20 [ 97.098208][ T14] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 97.111493][ T14] usb 3-1: Product: syz [ 97.116759][ T14] usb 3-1: Manufacturer: syz [ 97.121662][ T14] usb 3-1: SerialNumber: syz [ 97.129748][ T14] usb 3-1: config 0 descriptor?? [ 97.351137][ T14] usb 3-1: USB disconnect, device number 3 [ 97.501515][ T4471] netlink: 'syz.3.43': attribute type 10 has an invalid length. [ 97.570173][ T4471] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 97.773694][ T4505] FAULT_INJECTION: forcing a failure. [ 97.773694][ T4505] name failslab, interval 1, probability 0, space 0, times 0 [ 97.792541][ T4505] CPU: 1 PID: 4505 Comm: syz.3.53 Not tainted syzkaller #0 [ 97.799821][ T4505] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 97.809923][ T4505] Call Trace: [ 97.813248][ T4505] [ 97.816225][ T4505] dump_stack_lvl+0x188/0x24e [ 97.820970][ T4505] ? show_regs_print_info+0x12/0x12 [ 97.826233][ T4505] ? load_image+0x410/0x410 [ 97.830808][ T4505] ? __might_sleep+0xd0/0xd0 [ 97.835452][ T4505] ? __lock_acquire+0x7c40/0x7c40 [ 97.840550][ T4505] should_fail_ex+0x390/0x4c0 [ 97.845299][ T4505] should_failslab+0x5/0x20 [ 97.849863][ T4505] slab_pre_alloc_hook+0x59/0x300 [ 97.854982][ T4505] ? snd_seq_oss_readq_new+0x7e/0x240 [ 97.860413][ T4505] __kmem_cache_alloc_node+0x4f/0x270 [ 97.865828][ T4505] ? snd_seq_oss_readq_new+0x7e/0x240 [ 97.871243][ T4505] __kmalloc+0xa3/0x240 [ 97.875443][ T4505] snd_seq_oss_readq_new+0x7e/0x240 [ 97.880693][ T4505] snd_seq_oss_open+0x7e3/0xf00 [ 97.885591][ T4505] ? snd_seq_oss_delete_client+0x50/0x50 [ 97.891281][ T4505] ? trace_raw_output_contention_end+0xd0/0xd0 [ 97.897483][ T4505] ? odev_open+0x58/0x90 [ 97.901753][ T4505] ? __lock_acquire+0x7c40/0x7c40 [ 97.906815][ T4505] ? snd_seq_oss_process_event+0x2910/0x2910 [ 97.912823][ T4505] ? async_call_lookup_ports+0x10/0x10 [ 97.918309][ T4505] ? do_raw_spin_unlock+0x11d/0x230 [ 97.923540][ T4505] ? soundcore_open+0x309/0x4b0 [ 97.928425][ T4505] odev_open+0x63/0x90 [ 97.932546][ T4505] chrdev_open+0x585/0x5f0 [ 97.936996][ T4505] ? cd_forget+0x160/0x160 [ 97.941444][ T4505] ? fsnotify_perm+0x39b/0x550 [ 97.946234][ T4505] ? cd_forget+0x160/0x160 [ 97.950678][ T4505] do_dentry_open+0x7dd/0x10b0 [ 97.955487][ T4505] path_openat+0x2674/0x2f10 [ 97.960129][ T4505] ? verify_lock_unused+0x140/0x140 [ 97.965356][ T4505] ? do_sys_openat2+0xdd/0x4f0 [ 97.970158][ T4505] ? do_filp_open+0x420/0x420 [ 97.974873][ T4505] do_filp_open+0x1ee/0x420 [ 97.979413][ T4505] ? vfs_tmpfile+0x470/0x470 [ 97.984047][ T4505] ? _raw_spin_unlock+0x24/0x40 [ 97.989053][ T4505] ? alloc_fd+0x590/0x640 [ 97.993436][ T4505] do_sys_openat2+0x14b/0x4f0 [ 97.998167][ T4505] ? do_sys_open+0xe0/0xe0 [ 98.002626][ T4505] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 98.008666][ T4505] ? lock_chain_count+0x20/0x20 [ 98.013556][ T4505] __x64_sys_openat+0x135/0x160 [ 98.018449][ T4505] do_syscall_64+0x4c/0xa0 [ 98.022926][ T4505] ? clear_bhb_loop+0x60/0xb0 [ 98.027642][ T4505] ? clear_bhb_loop+0x60/0xb0 [ 98.032378][ T4505] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 98.038324][ T4505] RIP: 0033:0x7f1cbe79e159 [ 98.042768][ T4505] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 98.062400][ T4505] RSP: 002b:00007f1cbf6e2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 98.070856][ T4505] RAX: ffffffffffffffda RBX: 00007f1cbea25fa0 RCX: 00007f1cbe79e159 [ 98.078858][ T4505] RDX: 0000000000008002 RSI: 0000200000000040 RDI: ffffffffffffff9c [ 98.086854][ T4505] RBP: 00007f1cbe83503b R08: 0000000000000000 R09: 0000000000000000 [ 98.094850][ T4505] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 98.102845][ T4505] R13: 00007f1cbea26038 R14: 00007f1cbea25fa0 R15: 00007ffc6c7e2db8 [ 98.110857][ T4505] [ 98.188050][ T4503] null_blk: disk nullb1 created [ 98.683552][ T4528] netlink: 'syz.0.62': attribute type 281 has an invalid length. [ 99.587359][ T4546] FAULT_INJECTION: forcing a failure. [ 99.587359][ T4546] name failslab, interval 1, probability 0, space 0, times 0 [ 99.620674][ T4546] CPU: 1 PID: 4546 Comm: syz.2.68 Not tainted syzkaller #0 [ 99.627971][ T4546] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 99.638087][ T4546] Call Trace: [ 99.641417][ T4546] [ 99.644401][ T4546] dump_stack_lvl+0x188/0x24e [ 99.649166][ T4546] ? show_regs_print_info+0x12/0x12 [ 99.654446][ T4546] ? load_image+0x410/0x410 [ 99.659876][ T4546] ? __might_sleep+0xd0/0xd0 [ 99.664557][ T4546] ? __lock_acquire+0x7c40/0x7c40 [ 99.669653][ T4546] should_fail_ex+0x390/0x4c0 [ 99.674401][ T4546] should_failslab+0x5/0x20 [ 99.678944][ T4546] slab_pre_alloc_hook+0x59/0x300 [ 99.684013][ T4546] ? snd_seq_oss_readq_info_read+0xd0/0xd0 [ 99.689856][ T4546] ? snd_seq_oss_timer_new+0x4d/0x220 [ 99.695273][ T4546] __kmem_cache_alloc_node+0x4f/0x270 [ 99.700678][ T4546] ? snd_seq_oss_timer_new+0x4d/0x220 [ 99.706084][ T4546] kmalloc_trace+0x26/0xe0 [ 99.710535][ T4546] snd_seq_oss_timer_new+0x4d/0x220 [ 99.715761][ T4546] snd_seq_oss_open+0x8a8/0xf00 [ 99.720655][ T4546] ? snd_seq_oss_delete_client+0x50/0x50 [ 99.726346][ T4546] ? trace_raw_output_contention_end+0xd0/0xd0 [ 99.732544][ T4546] ? odev_open+0x58/0x90 [ 99.736812][ T4546] ? __lock_acquire+0x7c40/0x7c40 [ 99.741900][ T4546] ? snd_seq_oss_process_event+0x2910/0x2910 [ 99.747910][ T4546] ? async_call_lookup_ports+0x10/0x10 [ 99.753398][ T4546] ? do_raw_spin_unlock+0x11d/0x230 [ 99.758633][ T4546] ? soundcore_open+0x309/0x4b0 [ 99.763512][ T4546] odev_open+0x63/0x90 [ 99.767617][ T4546] chrdev_open+0x585/0x5f0 [ 99.772070][ T4546] ? cd_forget+0x160/0x160 [ 99.776517][ T4546] ? fsnotify_perm+0x39b/0x550 [ 99.781304][ T4546] ? cd_forget+0x160/0x160 [ 99.785763][ T4546] do_dentry_open+0x7dd/0x10b0 [ 99.790569][ T4546] path_openat+0x2674/0x2f10 [ 99.795197][ T4546] ? verify_lock_unused+0x140/0x140 [ 99.800429][ T4546] ? do_sys_openat2+0xdd/0x4f0 [ 99.805227][ T4546] ? do_filp_open+0x420/0x420 [ 99.809954][ T4546] do_filp_open+0x1ee/0x420 [ 99.814491][ T4546] ? vfs_tmpfile+0x470/0x470 [ 99.819130][ T4546] ? _raw_spin_unlock+0x24/0x40 [ 99.824007][ T4546] ? alloc_fd+0x590/0x640 [ 99.828378][ T4546] do_sys_openat2+0x14b/0x4f0 [ 99.833097][ T4546] ? do_sys_open+0xe0/0xe0 [ 99.837541][ T4546] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 99.843561][ T4546] ? lock_chain_count+0x20/0x20 [ 99.848450][ T4546] __x64_sys_openat+0x135/0x160 [ 99.853339][ T4546] do_syscall_64+0x4c/0xa0 [ 99.857803][ T4546] ? clear_bhb_loop+0x60/0xb0 [ 99.862513][ T4546] ? clear_bhb_loop+0x60/0xb0 [ 99.867232][ T4546] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 99.873157][ T4546] RIP: 0033:0x7f473cf9e159 [ 99.877609][ T4546] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 99.897500][ T4546] RSP: 002b:00007f473ddb2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 99.905936][ T4546] RAX: ffffffffffffffda RBX: 00007f473d225fa0 RCX: 00007f473cf9e159 [ 99.913936][ T4546] RDX: 0000000000008002 RSI: 0000200000000040 RDI: ffffffffffffff9c [ 99.921933][ T4546] RBP: 00007f473d03503b R08: 0000000000000000 R09: 0000000000000000 [ 99.929924][ T4546] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 99.937915][ T4546] R13: 00007f473d226038 R14: 00007f473d225fa0 R15: 00007fff4962f778 [ 99.945925][ T4546] [ 99.952451][ T4546] ALSA: seq_oss: can't alloc timer [ 100.111625][ T14] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 100.206865][ T4556] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 100.311506][ T14] usb 4-1: Using ep0 maxpacket: 16 [ 100.319155][ T14] usb 4-1: config 0 has no interfaces? [ 100.350428][ T14] usb 4-1: New USB device found, idVendor=15c2, idProduct=0045, bcdDevice=1f.20 [ 100.379056][ T14] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 100.407240][ T4559] netlink: 'syz.1.75': attribute type 281 has an invalid length. [ 100.429917][ T14] usb 4-1: Product: syz [ 100.454817][ T14] usb 4-1: Manufacturer: syz [ 100.459639][ T14] usb 4-1: SerialNumber: syz [ 100.502488][ T14] usb 4-1: config 0 descriptor?? [ 100.726711][ T14] usb 4-1: USB disconnect, device number 2 [ 100.872209][ T4578] IPVS: set_ctl: invalid protocol: 137 172.30.0.5:20001 [ 101.541900][ T4599] netlink: 88 bytes leftover after parsing attributes in process `syz.1.88'. [ 101.577943][ T4599] device syzkaller1 entered promiscuous mode [ 102.331420][ T4326] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 102.382633][ T4617] netlink: 'syz.1.97': attribute type 10 has an invalid length. [ 102.515708][ T4617] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 102.522046][ T4326] usb 5-1: Using ep0 maxpacket: 8 [ 102.548041][ T4326] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 102.590638][ T4326] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 102.651886][ T4326] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 102.672701][ T4636] fuse: Unknown parameter 'user_i00000000000000000000' [ 102.691951][ T4326] usb 5-1: config 16 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 102.736063][ T4326] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 102.768786][ T4326] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 102.780958][ T4326] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.845713][ T4326] usbtmc 5-1:16.0: bulk endpoints not found [ 103.060719][ T4643] netlink: 'syz.2.106': attribute type 281 has an invalid length. [ 103.561503][ T4351] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 103.583462][ T4664] fuse: Bad value for 'fd' [ 103.690489][ T4326] Process accounting resumed [ 103.751519][ T4351] usb 4-1: Using ep0 maxpacket: 16 [ 104.469503][ T4351] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 104.479895][ T4351] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 104.492598][ T4351] usb 4-1: New USB device found, idVendor=0d8c, idProduct=0014, bcdDevice= 0.40 [ 104.502079][ T4351] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 104.510865][ T4351] usb 4-1: Product: syz [ 104.515588][ T4351] usb 4-1: Manufacturer: syz [ 104.520697][ T4351] usb 4-1: SerialNumber: syz [ 104.736695][ T4672] netlink: 20 bytes leftover after parsing attributes in process `syz.0.117'. [ 104.756752][ T4655] mmap: syz.3.112 (4655) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 104.771864][ T4351] usb 4-1: 0:2 : does not exist [ 104.783585][ T4351] usb 4-1: 0:3 : does not exist [ 104.798224][ T4351] usb 4-1: 0:4 : does not exist [ 104.803825][ T4351] usb 4-1: 0:5 : does not exist [ 104.808984][ T4351] usb 4-1: BAAD SPEAKERPHONE c_chmask mismatch [ 104.847771][ T4351] snd-usb-audio: probe of 4-1:1.0 failed with error -22 [ 104.889657][ T4351] usb 4-1: USB disconnect, device number 3 [ 105.080637][ T37] usb 5-1: USB disconnect, device number 2 [ 105.096019][ T4681] netlink: 'syz.0.121': attribute type 281 has an invalid length. [ 105.173846][ T4376] udevd[4376]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 105.491549][ T4326] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 105.579549][ T4698] fuse: Unknown parameter 'user_i00000000000000000000' [ 105.691428][ T4326] usb 3-1: Using ep0 maxpacket: 32 [ 105.715758][ T4326] usb 3-1: config 0 interface 0 has no altsetting 0 [ 105.772378][ T4351] Process accounting resumed [ 105.795499][ T4326] usb 3-1: New USB device found, idVendor=046d, idProduct=c295, bcdDevice= 0.00 [ 105.805013][ T4326] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 105.813819][ T4696] netlink: 'syz.3.129': attribute type 10 has an invalid length. [ 105.824583][ T4326] usb 3-1: config 0 descriptor?? [ 106.038024][ T4326] usbhid 3-1:0.0: can't add hid device: -71 [ 106.057181][ T4326] usbhid: probe of 3-1:0.0 failed with error -71 [ 106.087542][ T4326] usb 3-1: USB disconnect, device number 4 [ 106.102852][ T4705] netlink: 20 bytes leftover after parsing attributes in process `syz.1.131'. [ 106.497036][ T4713] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(6) [ 106.503976][ T4713] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 106.521389][ T4713] vhci_hcd vhci_hcd.0: Device attached [ 106.534364][ T4717] vhci_hcd: connection closed [ 106.536280][ T76] vhci_hcd: stop threads [ 106.541592][ T4321] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 106.578764][ T76] vhci_hcd: release socket [ 106.580570][ T4716] netlink: 'syz.0.135': attribute type 281 has an invalid length. [ 106.583441][ T76] vhci_hcd: disconnect device [ 106.741449][ T4321] usb 4-1: Using ep0 maxpacket: 8 [ 106.748838][ T4321] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 106.792068][ T4321] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 106.836418][ T4321] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 106.880817][ T4321] usb 4-1: config 16 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 106.930419][ T4321] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 106.943882][ T4321] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 106.961624][ T4321] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 106.998181][ T4321] usbtmc 4-1:16.0: bulk endpoints not found [ 107.141441][ T7] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 107.186434][ T4734] fuse: Unknown parameter 'user_id00000000000000000000' [ 107.265836][ T14] Process accounting resumed [ 107.280350][ T4736] netlink: 'syz.1.144': attribute type 10 has an invalid length. [ 107.308127][ T4326] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 107.351539][ T7] usb 1-1: Using ep0 maxpacket: 16 [ 107.360467][ T7] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 107.377193][ T7] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 107.387419][ T7] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 107.410655][ T7] usb 1-1: New USB device found, idVendor=0d8c, idProduct=0014, bcdDevice= 0.40 [ 107.427054][ T7] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 107.436987][ T7] usb 1-1: Product: syz [ 107.441798][ T7] usb 1-1: Manufacturer: syz [ 107.446546][ T7] usb 1-1: SerialNumber: syz [ 107.500114][ T4326] usb 3-1: unable to get BOS descriptor or descriptor too short [ 107.510739][ T4326] usb 3-1: config 1 has an invalid interface number: 163 but max is 0 [ 107.526121][ T4326] usb 3-1: config 1 has no interface number 0 [ 107.539772][ T4326] usb 3-1: config 1 interface 163 has no altsetting 0 [ 107.549624][ T4740] netlink: 20 bytes leftover after parsing attributes in process `syz.1.146'. [ 107.570902][ T4326] usb 3-1: New USB device found, idVendor=06cd, idProduct=0103, bcdDevice=3c.0e [ 107.589796][ T4326] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 107.598411][ T4326] usb 3-1: Product: syz [ 107.608702][ T4326] usb 3-1: Manufacturer: syz [ 107.613844][ T4326] usb 3-1: SerialNumber: syz [ 107.678531][ T7] usb 1-1: 0:2 : does not exist [ 107.684130][ T7] usb 1-1: 0:3 : does not exist [ 107.699273][ T7] usb 1-1: 0:4 : does not exist [ 107.708048][ T7] usb 1-1: 0:5 : does not exist [ 107.723553][ T7] usb 1-1: incorrect wMaxPacketSize 0x0 for BADD profile [ 107.779187][ T7] snd-usb-audio: probe of 1-1:1.0 failed with error -22 [ 107.845382][ T7] usb 1-1: USB disconnect, device number 2 [ 107.889830][ T4745] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(7) [ 107.896428][ T4745] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 107.904349][ T4745] vhci_hcd vhci_hcd.0: Device attached [ 108.332333][ T4326] keyspan 3-1:1.163: Keyspan - (without firmware) converter detected [ 108.361815][ T4351] usb 41-1: new low-speed USB device number 2 using vhci_hcd [ 108.596598][ T4746] vhci_hcd: connection reset by peer [ 108.613699][ T11] vhci_hcd: stop threads [ 108.619039][ T11] vhci_hcd: release socket [ 108.775122][ T11] vhci_hcd: disconnect device [ 108.908955][ T4376] udevd[4376]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 109.143082][ T4326] usb 3-1: USB disconnect, device number 5 [ 109.151838][ T4326] keyspan 3-1:1.163: device disconnected [ 109.193567][ T4321] usb 4-1: USB disconnect, device number 4 [ 109.211073][ T4754] netlink: 'syz.1.148': attribute type 281 has an invalid length. [ 109.294741][ T4757] device syz_tun entered promiscuous mode [ 109.333103][ T4757] device macsec1 entered promiscuous mode [ 109.358766][ T4757] device syz_tun left promiscuous mode [ 109.761956][ T4768] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 109.768608][ T4768] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 109.790541][ T4768] vhci_hcd vhci_hcd.0: Device attached [ 110.054938][ T37] usb 37-1: new low-speed USB device number 2 using vhci_hcd [ 110.088173][ T4771] vhci_hcd: connection closed [ 110.088564][ T4773] vhci_hcd: sendmsg failed!, ret=-32 for 48 [ 110.113038][ T4321] Process accounting resumed [ 110.132555][ T4669] vhci_hcd: stop threads [ 110.136967][ T4669] vhci_hcd: release socket [ 110.153309][ T4776] netlink: 'syz.1.156': attribute type 10 has an invalid length. [ 110.176385][ T4782] netlink: 20 bytes leftover after parsing attributes in process `syz.0.158'. [ 110.196194][ T4669] vhci_hcd: disconnect device [ 110.513857][ T4325] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 110.724636][ T4325] usb 5-1: unable to get BOS descriptor or descriptor too short [ 110.746366][ T4325] usb 5-1: config 1 has an invalid interface number: 163 but max is 0 [ 110.754827][ T4793] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(7) [ 110.761403][ T4793] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 110.769135][ T4793] vhci_hcd vhci_hcd.0: Device attached [ 110.793054][ T4325] usb 5-1: config 1 has no interface number 0 [ 110.807027][ T4796] vhci_hcd: connection closed [ 110.807662][ T47] vhci_hcd: stop threads [ 110.830785][ T4325] usb 5-1: config 1 interface 163 has no altsetting 0 [ 110.843792][ T47] vhci_hcd: release socket [ 110.848294][ T47] vhci_hcd: disconnect device [ 110.860799][ T4325] usb 5-1: New USB device found, idVendor=06cd, idProduct=0103, bcdDevice=3c.0e [ 110.879353][ T4325] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 110.887513][ T4325] usb 5-1: Product: syz [ 110.898362][ T4325] usb 5-1: Manufacturer: syz [ 110.904058][ T4325] usb 5-1: SerialNumber: syz [ 111.100497][ T4806] netlink: 'syz.2.166': attribute type 281 has an invalid length. [ 111.136259][ T4325] keyspan 5-1:1.163: Keyspan - (without firmware) converter detected [ 111.163041][ T4325] usb 5-1: USB disconnect, device number 3 [ 111.169332][ T4325] keyspan 5-1:1.163: device disconnected [ 111.569159][ T4814] netlink: 20 bytes leftover after parsing attributes in process `syz.0.170'. [ 111.599682][ T4325] Process accounting resumed [ 111.799491][ T4821] netlink: 'syz.1.171': attribute type 10 has an invalid length. [ 112.845515][ T4837] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(6) [ 112.852115][ T4837] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 112.870263][ T4837] vhci_hcd vhci_hcd.0: Device attached [ 112.908846][ T4842] netlink: 88 bytes leftover after parsing attributes in process `syz.1.178'. [ 112.925017][ T4839] vhci_hcd: connection closed [ 112.931243][ T76] vhci_hcd: stop threads [ 112.968065][ T4842] device syzkaller1 entered promiscuous mode [ 112.981410][ T76] vhci_hcd: release socket [ 113.001829][ T76] vhci_hcd: disconnect device [ 113.027709][ T4845] netlink: 'syz.3.179': attribute type 281 has an invalid length. [ 113.226253][ T4851] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(7) [ 113.232893][ T4851] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 113.249565][ T4851] vhci_hcd vhci_hcd.0: Device attached [ 113.594561][ T4351] vhci_hcd: vhci_device speed not set [ 113.974001][ T4852] vhci_hcd: connection closed [ 113.982614][ T4669] vhci_hcd: stop threads [ 114.551987][ T4669] vhci_hcd: release socket [ 114.556774][ T4669] vhci_hcd: disconnect device [ 114.794994][ T4863] netlink: 20 bytes leftover after parsing attributes in process `syz.0.186'. [ 114.942281][ T14] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 115.181529][ T37] vhci_hcd: vhci_device speed not set [ 115.363961][ T14] usb 2-1: unable to get BOS descriptor or descriptor too short [ 115.417170][ T14] usb 2-1: config 1 has an invalid interface number: 163 but max is 0 [ 115.438325][ T14] usb 2-1: config 1 has no interface number 0 [ 115.539101][ T14] usb 2-1: config 1 interface 163 has no altsetting 0 [ 115.742395][ T14] usb 2-1: New USB device found, idVendor=06cd, idProduct=0103, bcdDevice=3c.0e [ 116.003768][ T14] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 116.029778][ T14] usb 2-1: Product: syz [ 116.034799][ T14] usb 2-1: Manufacturer: syz [ 116.039981][ T14] usb 2-1: SerialNumber: syz [ 116.311352][ T0] NOHZ tick-stop error: local softirq work is pending, handler #10a!!! [ 117.533462][ T4894] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(6) [ 117.540070][ T4894] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 117.548007][ T4894] vhci_hcd vhci_hcd.0: Device attached [ 117.561760][ T4895] vhci_hcd: connection closed [ 117.565820][ T4883] vhci_hcd: stop threads [ 119.477797][ T4883] vhci_hcd: release socket [ 119.482566][ T4883] vhci_hcd: disconnect device [ 119.542296][ T4888] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 119.548902][ T4888] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 119.563351][ T4888] vhci_hcd vhci_hcd.0: Device attached [ 119.585838][ T4904] netlink: 88 bytes leftover after parsing attributes in process `syz.2.195'. [ 119.596191][ T4904] device syzkaller1 entered promiscuous mode [ 119.604469][ T4890] vhci_hcd: connection closed [ 119.605687][ T4885] vhci_hcd: stop threads [ 119.635550][ T4885] vhci_hcd: release socket [ 119.642382][ T4885] vhci_hcd: disconnect device [ 119.695053][ T14] keyspan 2-1:1.163: Keyspan - (without firmware) converter detected [ 119.734738][ T14] usb 2-1: USB disconnect, device number 2 [ 119.756347][ T14] keyspan 2-1:1.163: device disconnected [ 119.948186][ T4913] netlink: 20 bytes leftover after parsing attributes in process `syz.2.198'. [ 120.870576][ T4940] fuse: Unknown parameter '0x0000000000000003' [ 120.929894][ T4942] netlink: 20 bytes leftover after parsing attributes in process `syz.0.210'. [ 121.001578][ T37] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 121.157367][ T4950] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(6) [ 121.164002][ T4950] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 121.177692][ T4950] vhci_hcd vhci_hcd.0: Device attached [ 121.218513][ T37] usb 3-1: unable to get BOS descriptor or descriptor too short [ 121.502313][ T4351] usb 41-1: new low-speed USB device number 3 using vhci_hcd [ 121.887342][ T4951] vhci_hcd: connection reset by peer [ 121.928743][ T4832] vhci_hcd: stop threads [ 121.935958][ T4832] vhci_hcd: release socket [ 122.016388][ T4832] vhci_hcd: disconnect device [ 122.476734][ T37] usb 3-1: config 1 has an invalid interface number: 163 but max is 0 [ 122.486359][ T37] usb 3-1: config 1 has no interface number 0 [ 122.492631][ T37] usb 3-1: config 1 interface 163 has no altsetting 0 [ 122.513939][ T37] usb 3-1: New USB device found, idVendor=06cd, idProduct=0103, bcdDevice=3c.0e [ 122.529342][ T37] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 122.537518][ T37] usb 3-1: Product: syz [ 122.541993][ T37] usb 3-1: Manufacturer: syz [ 122.546664][ T37] usb 3-1: SerialNumber: syz [ 122.807360][ T37] keyspan 3-1:1.163: Keyspan - (without firmware) converter detected [ 124.603477][ T37] usb 3-1: USB disconnect, device number 6 [ 124.609866][ T37] keyspan 3-1:1.163: device disconnected [ 124.850173][ T4964] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 124.856751][ T4964] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 124.866930][ T4964] vhci_hcd vhci_hcd.0: Device attached [ 124.997656][ T4323] Process accounting resumed [ 125.029135][ T4973] netlink: 'syz.3.217': attribute type 10 has an invalid length. [ 125.047630][ T4966] vhci_hcd: connection closed [ 125.047780][ T11] vhci_hcd: stop threads [ 125.064381][ T11] vhci_hcd: release socket [ 125.077199][ T11] vhci_hcd: disconnect device [ 125.136082][ T4834] usb 33-1: new low-speed USB device number 2 using vhci_hcd [ 125.152227][ T4834] usb 33-1: enqueue for inactive port 0 [ 125.231517][ T4834] vhci_hcd: vhci_device speed not set [ 126.070294][ T4990] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(5) [ 126.076891][ T4990] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 126.084670][ T4990] vhci_hcd vhci_hcd.0: Device attached [ 126.101148][ T4993] vhci_hcd: connection closed [ 126.115870][ T11] vhci_hcd: stop threads [ 126.125354][ T11] vhci_hcd: release socket [ 126.129992][ T11] vhci_hcd: disconnect device [ 126.621521][ T4351] vhci_hcd: vhci_device speed not set [ 126.651442][ T37] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 126.843857][ T37] usb 5-1: unable to get BOS descriptor or descriptor too short [ 126.861670][ T37] usb 5-1: config 1 has an invalid interface number: 163 but max is 0 [ 126.888253][ T37] usb 5-1: config 1 has no interface number 0 [ 126.920123][ T37] usb 5-1: config 1 interface 163 has no altsetting 0 [ 126.933457][ T4998] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 126.964605][ T37] usb 5-1: New USB device found, idVendor=06cd, idProduct=0103, bcdDevice=3c.0e [ 126.988599][ T37] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 127.030251][ T37] usb 5-1: Product: syz [ 127.034659][ T37] usb 5-1: Manufacturer: syz [ 127.039487][ T37] usb 5-1: SerialNumber: syz [ 127.280262][ T37] keyspan 5-1:1.163: Keyspan - (without firmware) converter detected [ 127.326667][ T37] usb 5-1: USB disconnect, device number 4 [ 127.340707][ T4320] Process accounting resumed [ 127.355407][ T37] keyspan 5-1:1.163: device disconnected [ 127.367964][ T5012] netlink: 'syz.0.232': attribute type 10 has an invalid length. [ 127.503204][ T5012] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 127.571550][ T4320] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 127.831465][ T4320] usb 3-1: Using ep0 maxpacket: 16 [ 127.839806][ T4320] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 127.851178][ T4320] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 127.860647][ T4320] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 127.873120][ T5023] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 127.879697][ T5023] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 127.889531][ T4320] usb 3-1: New USB device found, idVendor=0d8c, idProduct=0014, bcdDevice= 0.40 [ 127.899926][ T5023] vhci_hcd vhci_hcd.0: Device attached [ 127.905642][ T4320] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 127.914772][ T4320] usb 3-1: Product: syz [ 127.918999][ T4320] usb 3-1: Manufacturer: syz [ 127.924359][ T4320] usb 3-1: SerialNumber: syz [ 127.948823][ T5026] vhci_hcd: connection closed [ 127.949144][ T4749] vhci_hcd: stop threads [ 127.998674][ T4749] vhci_hcd: release socket [ 128.010923][ T4749] vhci_hcd: disconnect device [ 128.067860][ T5033] lo speed is unknown, defaulting to 1000 [ 128.087926][ T5033] lo speed is unknown, defaulting to 1000 [ 128.111012][ T5033] lo speed is unknown, defaulting to 1000 [ 128.162684][ T4320] usb 3-1: 0:2 : does not exist [ 128.184813][ T4320] usb 3-1: 0:3 : does not exist [ 128.190748][ T5033] infiniband syz_device_name_32_chars_1234567: RDMA CMA: cma_listen_on_dev, error -22 [ 128.204469][ T4320] usb 3-1: 0:4 : does not exist [ 128.209442][ T4320] usb 3-1: 0:5 : does not exist [ 128.235380][ T4320] usb 3-1: BAAD SPEAKERPHONE c_chmask mismatch [ 128.289059][ T4320] snd-usb-audio: probe of 3-1:1.0 failed with error -22 [ 128.375749][ T5041] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 128.396801][ T5041] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 128.432202][ T5041] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 128.458048][ T5041] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 128.474598][ T5041] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 128.487943][ T5041] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 128.503265][ T5041] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 128.936109][ T4320] usb 3-1: USB disconnect, device number 7 [ 129.153978][ T5033] lo speed is unknown, defaulting to 1000 [ 129.161010][ T5033] lo speed is unknown, defaulting to 1000 [ 129.168459][ T5033] lo speed is unknown, defaulting to 1000 [ 129.175694][ T5033] lo speed is unknown, defaulting to 1000 [ 129.182609][ T5033] lo speed is unknown, defaulting to 1000 [ 129.302232][ T5046] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(5) [ 129.308819][ T5046] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 129.316442][ T5046] vhci_hcd vhci_hcd.0: Device attached [ 129.340003][ T5047] vhci_hcd: connection closed [ 129.340432][ T4352] vhci_hcd: stop threads [ 129.350569][ T4352] vhci_hcd: release socket [ 129.363961][ T4352] vhci_hcd: disconnect device [ 129.532828][ T4376] udevd[4376]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 130.241361][ T0] NOHZ tick-stop error: local softirq work is pending, handler #38a!!! [ 130.281346][ T0] NOHZ tick-stop error: local softirq work is pending, handler #208!!! [ 130.451349][ T0] NOHZ tick-stop error: local softirq work is pending, handler #20a!!! [ 131.677213][ T5085] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 131.683820][ T5085] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 132.701066][ T5085] vhci_hcd vhci_hcd.0: Device attached [ 132.785011][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.792009][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.981531][ T4348] usb 39-1: new low-speed USB device number 2 using vhci_hcd [ 133.142608][ T5086] vhci_hcd: connection reset by peer [ 133.149205][ T4751] vhci_hcd: stop threads [ 133.155968][ T4751] vhci_hcd: release socket [ 133.181690][ T4751] vhci_hcd: disconnect device [ 133.515601][ T5098] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 133.533602][ T5098] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 133.553451][ T5098] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 133.582833][ T5098] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 133.599313][ T5098] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 133.613531][ T5098] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 133.627755][ T5098] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 134.842146][ T5111] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(5) [ 134.848752][ T5111] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 134.856777][ T5111] vhci_hcd vhci_hcd.0: Device attached [ 135.002974][ T5113] vhci_hcd: connection closed [ 135.012244][ T4883] vhci_hcd: stop threads [ 135.038013][ T4883] vhci_hcd: release socket [ 135.077722][ T4883] vhci_hcd: disconnect device [ 135.131644][ T129] usb 37-1: new low-speed USB device number 3 using vhci_hcd [ 135.145516][ T129] usb 37-1: enqueue for inactive port 0 [ 135.161521][ T5066] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 135.263726][ T129] vhci_hcd: vhci_device speed not set [ 135.371584][ T5066] usb 1-1: Using ep0 maxpacket: 16 [ 135.379589][ T5066] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 135.924267][ T5117] sctp: failed to load transform for md5: -2 [ 135.932600][ T5121] sctp: failed to load transform for md5: -2 [ 135.939897][ T5066] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 135.951348][ T0] NOHZ tick-stop error: local softirq work is pending, handler #38a!!! [ 136.031344][ T0] NOHZ tick-stop error: local softirq work is pending, handler #38a!!! [ 136.051337][ T0] NOHZ tick-stop error: local softirq work is pending, handler #38a!!! [ 136.094566][ T5066] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 136.121358][ T0] NOHZ tick-stop error: local softirq work is pending, handler #20a!!! [ 136.191360][ T0] NOHZ tick-stop error: local softirq work is pending, handler #20a!!! [ 136.241348][ T0] NOHZ tick-stop error: local softirq work is pending, handler #38a!!! [ 136.358807][ T5066] usb 1-1: New USB device found, idVendor=0d8c, idProduct=0014, bcdDevice= 0.40 [ 136.383606][ T5066] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 136.431347][ T5066] usb 1-1: Product: syz [ 136.435688][ T5066] usb 1-1: Manufacturer: syz [ 136.472448][ T5066] usb 1-1: SerialNumber: syz [ 136.717677][ T5066] usb 1-1: 0:2 : does not exist [ 136.751571][ T5066] usb 1-1: 0:3 : does not exist [ 136.788238][ T5066] usb 1-1: 0:4 : does not exist [ 136.801609][ T5066] usb 1-1: 0:5 : does not exist [ 136.806588][ T5066] usb 1-1: BAAD SPEAKERPHONE c_chmask mismatch [ 136.871592][ T5151] syz.2.264: attempt to access beyond end of device [ 136.871592][ T5151] loop0: rw=0, sector=0, nr_sectors = 8 limit=0 [ 136.904458][ T5066] snd-usb-audio: probe of 1-1:1.0 failed with error -22 [ 136.968851][ T5066] usb 1-1: USB disconnect, device number 3 [ 136.989223][ T4376] udevd[4376]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 137.127889][ T5156] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 137.134488][ T5156] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 137.201764][ T5156] vhci_hcd vhci_hcd.0: Device attached [ 137.315478][ T5151] device-mapper: table: 248:0: thin-pool: Error creating metadata object (-EIO) [ 137.421549][ T5151] device-mapper: ioctl: error adding target to table [ 137.481563][ T126] usb 35-1: new low-speed USB device number 2 using vhci_hcd [ 137.593342][ T5165] IPVS: set_ctl: invalid protocol: 137 172.30.0.5:20001 [ 138.241421][ T4348] vhci_hcd: vhci_device speed not set [ 139.226433][ T5157] vhci_hcd: connection reset by peer [ 139.232262][ T4669] vhci_hcd: stop threads [ 139.236643][ T4669] vhci_hcd: release socket [ 139.252778][ T5170] process 'syz.4.268' launched '/dev/fd/3' with NULL argv: empty string added [ 139.301404][ T4669] vhci_hcd: disconnect device [ 139.886249][ T5187] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 139.892860][ T5187] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 139.925624][ T5187] vhci_hcd vhci_hcd.0: Device attached [ 140.160220][ T5189] vhci_hcd: connection closed [ 140.165905][ T4330] vhci_hcd: stop threads [ 140.186806][ T4330] vhci_hcd: release socket [ 140.191709][ T5066] usb 37-1: new low-speed USB device number 4 using vhci_hcd [ 140.206168][ T4330] vhci_hcd: disconnect device [ 140.234334][ T5186] team0: Device wg1 is of different type [ 140.260866][ T5186] A link change request failed with some changes committed already. Interface wg1 may have been left with an inconsistent configuration, please check. [ 140.287798][ T5194] netlink: 'syz.4.273': attribute type 1 has an invalid length. [ 140.322129][ T5198] (unnamed net_device) (uninitialized): option arp_validate: invalid value (1048579) [ 140.336758][ T5203] (unnamed net_device) (uninitialized): option arp_validate: invalid value (1048579) [ 140.366211][ T5204] netlink: 4 bytes leftover after parsing attributes in process `syz.4.273'. [ 140.424940][ T5204] device bridge1 entered promiscuous mode [ 141.285872][ T5233] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 141.292476][ T5233] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 141.367756][ T5233] vhci_hcd vhci_hcd.0: Device attached [ 143.206378][ T5234] vhci_hcd: connection reset by peer [ 143.245388][ T4751] vhci_hcd: stop threads [ 143.271456][ T4751] vhci_hcd: release socket [ 143.303082][ T4751] vhci_hcd: disconnect device [ 143.361836][ T126] vhci_hcd: vhci_device speed not set [ 143.907799][ T5249] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 143.914379][ T5249] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 143.928589][ T5249] vhci_hcd vhci_hcd.0: Device attached [ 143.973521][ T5255] vhci_hcd: connection closed [ 143.991046][ T4883] vhci_hcd: stop threads [ 144.000390][ T4883] vhci_hcd: release socket [ 144.061726][ T4883] vhci_hcd: disconnect device [ 144.150894][ T14] vhci_hcd: vhci_device speed not set [ 144.715346][ T5279] netlink: 'syz.2.300': attribute type 2 has an invalid length. [ 144.728276][ T5279] netlink: 224 bytes leftover after parsing attributes in process `syz.2.300'. [ 144.752870][ T5279] netlink: 'syz.2.300': attribute type 10 has an invalid length. [ 144.797947][ T5279] team0: Port device dummy0 added [ 145.341669][ T5066] vhci_hcd: vhci_device speed not set [ 145.474553][ T5287] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(5) [ 145.481139][ T5287] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 145.488856][ T5287] vhci_hcd vhci_hcd.0: Device attached [ 145.508908][ T5291] vhci_hcd: connection closed [ 145.509302][ T4885] vhci_hcd: stop threads [ 145.541990][ T4885] vhci_hcd: release socket [ 145.562541][ T4885] vhci_hcd: disconnect device [ 145.604610][ T5294] netlink: 64 bytes leftover after parsing attributes in process `syz.2.305'. [ 145.619102][ T5294] device syzkaller1 entered promiscuous mode [ 146.859848][ T5318] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(6) [ 146.866423][ T5318] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 146.914796][ T5318] vhci_hcd vhci_hcd.0: Device attached [ 147.063304][ T5319] vhci_hcd: connection closed [ 147.063643][ T4885] vhci_hcd: stop threads [ 147.088480][ T4885] vhci_hcd: release socket [ 147.102063][ T4885] vhci_hcd: disconnect device [ 147.121499][ T5066] vhci_hcd: vhci_device speed not set [ 147.874310][ T5333] netlink: 64 bytes leftover after parsing attributes in process `syz.2.317'. [ 147.961138][ T5333] device syzkaller1 entered promiscuous mode [ 148.268261][ T5345] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 148.285133][ T5345] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 148.304641][ T5345] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 148.329630][ T5345] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 148.343754][ T5345] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 148.356804][ T5345] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 148.372143][ T5345] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 151.064955][ T5388] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(6) [ 151.071576][ T5388] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 151.086290][ T5388] vhci_hcd vhci_hcd.0: Device attached [ 151.096407][ T5389] vhci_hcd: connection closed [ 151.096698][ T76] vhci_hcd: stop threads [ 151.111105][ T76] vhci_hcd: release socket [ 151.115852][ T76] vhci_hcd: disconnect device [ 151.383550][ T5397] netlink: 'syz.0.331': attribute type 2 has an invalid length. [ 151.400562][ T5397] netlink: 224 bytes leftover after parsing attributes in process `syz.0.331'. [ 151.549134][ T5400] netlink: 'syz.0.331': attribute type 10 has an invalid length. [ 151.730353][ T5400] bond0: (slave dummy0): Releasing backup interface [ 152.148486][ T5400] team0: Port device dummy0 added [ 152.212307][ T5409] netlink: 64 bytes leftover after parsing attributes in process `syz.3.332'. [ 152.322050][ T5415] netlink: 'syz.4.335': attribute type 2 has an invalid length. [ 152.329792][ T5415] netlink: 224 bytes leftover after parsing attributes in process `syz.4.335'. [ 152.498484][ T5419] random: crng reseeded on system resumption [ 153.062340][ T5440] netlink: 'syz.3.341': attribute type 13 has an invalid length. [ 153.098261][ T5440] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 153.252146][ T5440] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 153.328585][ T5440] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 153.379598][ T5440] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 153.454046][ T5440] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 153.532008][ T5440] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 153.590865][ T5440] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 153.698536][ T5440] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 153.798043][ T5440] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 153.835902][ T5440] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 154.214312][ T5465] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 154.220877][ T5465] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 154.247286][ T5465] vhci_hcd vhci_hcd.0: Device attached [ 154.389209][ T5467] vhci_hcd: connection closed [ 154.389492][ T5061] vhci_hcd: stop threads [ 154.409008][ T5061] vhci_hcd: release socket [ 154.419787][ T5061] vhci_hcd: disconnect device [ 154.441681][ T126] vhci_hcd: vhci_device speed not set [ 154.673269][ T5480] netlink: 'syz.2.348': attribute type 2 has an invalid length. [ 154.691775][ T5480] netlink: 224 bytes leftover after parsing attributes in process `syz.2.348'. [ 154.806390][ T5480] netlink: 'syz.2.348': attribute type 10 has an invalid length. [ 155.685253][ T5491] netlink: 64 bytes leftover after parsing attributes in process `syz.4.351'. [ 155.737765][ T5500] device syzkaller1 entered promiscuous mode [ 156.078159][ T5509] random: crng reseeded on system resumption [ 156.376877][ T5523] team0: Device wg1 is of different type [ 156.446214][ T5523] A link change request failed with some changes committed already. Interface wg1 may have been left with an inconsistent configuration, please check. [ 156.935258][ T5534] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(6) [ 156.941858][ T5534] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 156.977593][ T5534] vhci_hcd vhci_hcd.0: Device attached [ 157.006790][ T5540] vhci_hcd: connection closed [ 157.008240][ T4751] vhci_hcd: stop threads [ 157.031090][ T4751] vhci_hcd: release socket [ 157.040544][ T4751] vhci_hcd: disconnect device [ 158.796204][ T5573] device syzkaller0 entered promiscuous mode [ 159.000145][ T5585] fuse: Unknown parameter 'user_id00000000000000000000' [ 159.475595][ T5597] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(5) [ 159.482199][ T5597] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 159.490262][ T5597] vhci_hcd vhci_hcd.0: Device attached [ 159.520564][ T5599] vhci_hcd: connection closed [ 159.520806][ T76] vhci_hcd: stop threads [ 159.548902][ T76] vhci_hcd: release socket [ 159.586397][ T76] vhci_hcd: disconnect device [ 160.258720][ T5620] fuse: Unknown parameter 'user_id00000000000000000000' [ 161.489194][ T5644] IPVS: set_ctl: invalid protocol: 137 172.30.0.1:20001 [ 161.687111][ T5650] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(5) [ 161.693704][ T5650] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 161.701674][ T5650] vhci_hcd vhci_hcd.0: Device attached [ 161.719347][ T5654] vhci_hcd: connection closed [ 161.719984][ T76] vhci_hcd: stop threads [ 161.733600][ T76] vhci_hcd: release socket [ 161.738252][ T76] vhci_hcd: disconnect device [ 161.836309][ T5657] fuse: Bad value for 'fd' [ 162.703557][ T5683] fuse: Bad value for 'fd' [ 163.098444][ T5697] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(5) [ 163.105021][ T5697] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 163.113436][ T5697] vhci_hcd vhci_hcd.0: Device attached [ 163.153605][ T5698] vhci_hcd: connection closed [ 163.154047][ T4897] vhci_hcd: stop threads [ 163.181114][ T4897] vhci_hcd: release socket [ 163.191563][ T4897] vhci_hcd: disconnect device [ 163.303419][ T5705] IPVS: set_ctl: invalid protocol: 137 172.30.0.3:20001 [ 163.368703][ T5707] device gretap0 entered promiscuous mode [ 163.688543][ T5717] fuse: Bad value for 'fd' [ 164.937403][ T5747] fuse: Unknown parameter '0x0000000000000003' [ 165.184144][ T5750] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(6) [ 165.190724][ T5750] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 165.198378][ T5750] vhci_hcd vhci_hcd.0: Device attached [ 165.211313][ T5752] vhci_hcd: connection closed [ 165.216063][ T4897] vhci_hcd: stop threads [ 165.251409][ T4897] vhci_hcd: release socket [ 165.269426][ T4897] vhci_hcd: disconnect device [ 165.333466][ T5760] IPVS: set_ctl: invalid protocol: 137 172.30.0.1:20001 [ 166.264653][ T5781] fuse: Unknown parameter '0x0000000000000003' [ 166.450333][ T5784] netlink: 'syz.0.453': attribute type 2 has an invalid length. [ 166.497475][ T5784] netlink: 'syz.0.453': attribute type 11 has an invalid length. [ 166.521416][ T5784] netlink: 132 bytes leftover after parsing attributes in process `syz.0.453'. [ 166.702336][ T5793] netlink: 8 bytes leftover after parsing attributes in process `syz.3.455'. [ 167.581811][ T5803] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 167.588419][ T5803] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 167.596388][ T5803] vhci_hcd vhci_hcd.0: Device attached [ 167.612722][ T5807] vhci_hcd: connection closed [ 167.626457][ T5061] vhci_hcd: stop threads [ 167.697080][ T5061] vhci_hcd: release socket [ 167.708834][ T5061] vhci_hcd: disconnect device [ 167.734420][ T14] Process accounting resumed [ 167.755401][ T5812] netlink: 'syz.0.461': attribute type 10 has an invalid length. [ 167.852623][ T5812] team0: Port device dummy0 removed [ 168.719489][ T5812] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 168.809568][ T5819] IPVS: set_ctl: invalid protocol: 137 172.30.0.5:20001 [ 168.850617][ T5821] fuse: Unknown parameter '0x0000000000000003' [ 169.039332][ T5829] netlink: 8 bytes leftover after parsing attributes in process `syz.1.466'. [ 169.056290][ T5830] netlink: 'syz.0.467': attribute type 13 has an invalid length. [ 169.085846][ T5830] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 169.135674][ T5830] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 169.169374][ T5830] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 169.214041][ T5830] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 169.250808][ T5830] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 169.279378][ T5830] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 169.288958][ T5830] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 169.316653][ T5830] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 169.367826][ T5830] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 169.376312][ T5830] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 169.843174][ T5854] device syzkaller0 entered promiscuous mode [ 170.017761][ T4897] IPv6: ADDRCONF(NETDEV_CHANGE): syzkaller0: link becomes ready [ 170.361588][ T5864] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 170.368226][ T5864] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 170.375894][ T5864] vhci_hcd vhci_hcd.0: Device attached [ 170.393589][ T5865] vhci_hcd: connection closed [ 170.393822][ T4352] vhci_hcd: stop threads [ 170.413515][ T4352] vhci_hcd: release socket [ 170.421209][ T4352] vhci_hcd: disconnect device [ 170.443042][ T5867] IPVS: fo: FWM 3 0x00000003 - no destination available [ 170.589073][ T14] Process accounting resumed [ 171.324790][ T5874] netlink: 8 bytes leftover after parsing attributes in process `syz.4.479'. [ 172.650077][ T5869] netlink: 'syz.3.477': attribute type 10 has an invalid length. [ 172.792508][ T5884] device syzkaller0 entered promiscuous mode [ 173.191489][ T14] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 173.381580][ T14] usb 2-1: Using ep0 maxpacket: 32 [ 173.389540][ T14] usb 2-1: config 0 interface 0 has no altsetting 0 [ 173.401999][ T14] usb 2-1: New USB device found, idVendor=046d, idProduct=c295, bcdDevice= 0.00 [ 173.417114][ T14] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 173.439637][ T14] usb 2-1: config 0 descriptor?? [ 173.656633][ T14] usbhid 2-1:0.0: can't add hid device: -71 [ 173.673306][ T14] usbhid: probe of 2-1:0.0 failed with error -71 [ 173.687525][ T14] usb 2-1: USB disconnect, device number 3 [ 175.168259][ T5916] netlink: 64 bytes leftover after parsing attributes in process `syz.1.487'. [ 175.195089][ T5917] device syzkaller1 entered promiscuous mode [ 175.446392][ T5930] netlink: 8 bytes leftover after parsing attributes in process `syz.2.490'. [ 175.607571][ T5937] netlink: 'syz.4.492': attribute type 2 has an invalid length. [ 175.621555][ T5937] netlink: 224 bytes leftover after parsing attributes in process `syz.4.492'. [ 175.732998][ T5937] netlink: 'syz.4.492': attribute type 10 has an invalid length. [ 175.793677][ T5941] random: crng reseeded on system resumption [ 175.841729][ T5937] team0: Port device dummy0 added [ 177.191595][ T126] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 177.278206][ T4292] Bluetooth: hci4: link tx timeout [ 177.284106][ T4292] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 177.293261][ T4292] Bluetooth: hci4: link tx timeout [ 177.299299][ T4292] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 177.312459][ T4292] Bluetooth: hci4: link tx timeout [ 177.317629][ T4292] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 177.328518][ T4292] Bluetooth: hci4: link tx timeout [ 177.333812][ T4292] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 177.401608][ T126] usb 5-1: Using ep0 maxpacket: 32 [ 177.409738][ T126] usb 5-1: config 0 interface 0 has no altsetting 0 [ 177.419994][ T126] usb 5-1: New USB device found, idVendor=046d, idProduct=c295, bcdDevice= 0.00 [ 177.429766][ T126] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 177.448346][ T126] usb 5-1: config 0 descriptor?? [ 177.529015][ T4292] Bluetooth: hci4: link tx timeout [ 177.534656][ T4292] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 177.543814][ T4292] Bluetooth: hci4: link tx timeout [ 177.549053][ T4292] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 177.563248][ T4292] Bluetooth: hci4: link tx timeout [ 177.568491][ T4292] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 177.576909][ T4292] Bluetooth: hci4: link tx timeout [ 177.582538][ T4292] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 177.670845][ T126] usbhid 5-1:0.0: can't add hid device: -71 [ 177.677316][ T126] usbhid: probe of 5-1:0.0 failed with error -71 [ 177.692432][ T126] usb 5-1: USB disconnect, device number 5 [ 177.707263][ T6005] IPVS: set_ctl: invalid protocol: 137 172.30.0.3:20001 [ 177.941906][ T4292] Bluetooth: hci4: link tx timeout [ 177.947182][ T4292] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 177.955581][ T4292] Bluetooth: hci4: link tx timeout [ 177.960798][ T4292] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 178.398391][ T4292] Bluetooth: hci4: link tx timeout [ 178.404115][ T4292] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 178.412265][ T4292] Bluetooth: hci4: link tx timeout [ 178.417459][ T4292] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 179.341749][ T4292] Bluetooth: hci4: command 0x0406 tx timeout [ 179.472860][ T4292] Bluetooth: hci4: link tx timeout [ 179.478281][ T4292] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 179.489964][ T4292] Bluetooth: hci4: link tx timeout [ 179.495303][ T4292] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 179.607090][ T6063] IPVS: set_ctl: invalid protocol: 137 172.30.0.1:20001 [ 179.661878][ T4348] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 179.682681][ T4292] Bluetooth: hci4: link tx timeout [ 179.687880][ T4292] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 179.697271][ T4292] Bluetooth: hci4: link tx timeout [ 179.702475][ T4292] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 179.825816][ T4292] Bluetooth: hci4: link tx timeout [ 179.831065][ T4292] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 179.839186][ T4292] Bluetooth: hci4: link tx timeout [ 179.844603][ T4292] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 179.852463][ T4348] usb 2-1: Using ep0 maxpacket: 32 [ 179.860872][ T4348] usb 2-1: config 0 interface 0 has no altsetting 0 [ 179.867953][ T4348] usb 2-1: New USB device found, idVendor=046d, idProduct=c295, bcdDevice= 0.00 [ 179.877928][ T4348] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 179.895466][ T4348] usb 2-1: config 0 descriptor?? [ 180.022187][ T4292] Bluetooth: hci4: link tx timeout [ 180.027469][ T4292] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 180.035428][ T4292] Bluetooth: hci4: link tx timeout [ 180.040622][ T4292] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 180.106008][ T4348] usbhid 2-1:0.0: can't add hid device: -71 [ 180.114896][ T4348] usbhid: probe of 2-1:0.0 failed with error -71 [ 180.130388][ T4348] usb 2-1: USB disconnect, device number 4 [ 180.440020][ T6082] random: crng reseeded on system resumption [ 180.697944][ T6092] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 180.711729][ T6092] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 180.720005][ T6092] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 180.728213][ T6092] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 180.736779][ T6092] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 180.745030][ T6092] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 180.764183][ T6092] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 181.421546][ T4292] Bluetooth: hci4: command 0x0406 tx timeout [ 182.224774][ T6112] netlink: 'syz.1.541': attribute type 10 has an invalid length. [ 182.838461][ T22] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 183.031365][ T22] usb 2-1: Using ep0 maxpacket: 32 [ 183.038997][ T22] usb 2-1: config 0 interface 0 has no altsetting 0 [ 183.067264][ T22] usb 2-1: New USB device found, idVendor=046d, idProduct=c295, bcdDevice= 0.00 [ 183.086909][ T22] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 183.122354][ T22] usb 2-1: config 0 descriptor?? [ 183.176465][ T4292] Bluetooth: hci4: link tx timeout [ 183.181778][ T4292] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 183.189515][ T4292] Bluetooth: hci4: link tx timeout [ 183.194883][ T4292] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 183.353436][ T22] usbhid 2-1:0.0: can't add hid device: -71 [ 183.364545][ T22] usbhid: probe of 2-1:0.0 failed with error -71 [ 183.412446][ T22] usb 2-1: USB disconnect, device number 5 [ 183.872373][ T6155] netlink: 'syz.4.558': attribute type 10 has an invalid length. [ 183.953068][ T6164] netlink: 'syz.0.561': attribute type 2 has an invalid length. [ 183.960817][ T6164] netlink: 224 bytes leftover after parsing attributes in process `syz.0.561'. [ 184.022101][ T4292] Bluetooth: hci4: link tx timeout [ 184.027333][ T4292] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 184.035291][ T4292] Bluetooth: hci4: link tx timeout [ 184.040483][ T4292] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 184.093920][ T6155] team0: Port device dummy0 removed [ 184.132405][ T6155] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 184.318406][ T6164] netlink: 'syz.0.561': attribute type 10 has an invalid length. [ 184.380968][ T6164] bond0: (slave dummy0): Releasing backup interface [ 184.407624][ T6164] team0: Port device dummy0 added [ 184.719273][ T4292] Bluetooth: hci4: link tx timeout [ 184.725362][ T4292] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 184.733391][ T4292] Bluetooth: hci4: link tx timeout [ 184.738945][ T4292] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 184.906570][ T6189] device syzkaller0 entered promiscuous mode [ 185.220916][ T6202] netlink: 20 bytes leftover after parsing attributes in process `syz.4.577'. [ 185.391648][ T5132] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 185.478691][ T6208] netlink: 'syz.4.579': attribute type 2 has an invalid length. [ 185.521234][ T6208] netlink: 224 bytes leftover after parsing attributes in process `syz.4.579'. [ 185.583955][ T6208] netlink: 'syz.4.579': attribute type 10 has an invalid length. [ 185.601627][ T5132] usb 1-1: Using ep0 maxpacket: 32 [ 185.615004][ T5132] usb 1-1: config 0 interface 0 has no altsetting 0 [ 185.640255][ T6208] bond0: (slave dummy0): Releasing backup interface [ 185.647426][ T5132] usb 1-1: New USB device found, idVendor=046d, idProduct=c295, bcdDevice= 0.00 [ 185.666022][ T6208] team0: Port device dummy0 added [ 185.675479][ T5132] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 185.708375][ T5132] usb 1-1: config 0 descriptor?? [ 185.931593][ T5132] usbhid 1-1:0.0: can't add hid device: -71 [ 185.938384][ T5132] usbhid: probe of 1-1:0.0 failed with error -71 [ 185.976724][ T5132] usb 1-1: USB disconnect, device number 4 [ 186.115361][ T4292] Bluetooth: hci4: link tx timeout [ 186.120614][ T4292] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 186.129830][ T4292] Bluetooth: hci4: link tx timeout [ 186.135403][ T4292] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 186.209618][ T6227] netlink: 20 bytes leftover after parsing attributes in process `syz.1.588'. [ 186.497580][ T6237] device syzkaller0 entered promiscuous mode [ 187.450446][ T6248] netlink: 'syz.3.596': attribute type 2 has an invalid length. [ 187.485549][ T6248] netlink: 224 bytes leftover after parsing attributes in process `syz.3.596'. [ 187.561547][ T6248] netlink: 'syz.3.596': attribute type 10 has an invalid length. [ 187.591758][ T6248] bond0: (slave dummy0): Releasing backup interface [ 187.659935][ T6248] team0: Port device dummy0 added [ 187.816231][ T4292] Bluetooth: hci4: link tx timeout [ 187.822428][ T4292] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 187.830182][ T4292] Bluetooth: hci4: link tx timeout [ 187.851438][ T4292] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 188.022600][ T4292] Bluetooth: hci4: link tx timeout [ 188.027844][ T4292] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 188.035975][ T4292] Bluetooth: hci4: link tx timeout [ 188.041140][ T4292] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 188.171778][ T5132] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 188.287500][ T6279] device syzkaller0 entered promiscuous mode [ 188.423241][ T5132] usb 5-1: Using ep0 maxpacket: 32 [ 188.435268][ T5132] usb 5-1: config 0 interface 0 has no altsetting 0 [ 188.452909][ T5132] usb 5-1: New USB device found, idVendor=046d, idProduct=c295, bcdDevice= 0.00 [ 188.472503][ T5132] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 188.522390][ T5132] usb 5-1: config 0 descriptor?? [ 188.733878][ T5132] usbhid 5-1:0.0: can't add hid device: -71 [ 188.744704][ T5132] usbhid: probe of 5-1:0.0 failed with error -71 [ 188.797873][ T5132] usb 5-1: USB disconnect, device number 6 [ 189.094407][ T6304] netlink: 'syz.0.616': attribute type 2 has an invalid length. [ 189.111215][ T6304] netlink: 224 bytes leftover after parsing attributes in process `syz.0.616'. [ 189.125527][ T6304] netlink: 'syz.0.616': attribute type 10 has an invalid length. [ 189.845370][ T4292] Bluetooth: hci4: link tx timeout [ 189.850939][ T4292] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 189.858805][ T4292] Bluetooth: hci4: link tx timeout [ 189.864115][ T4292] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 190.133444][ T6340] netlink: 'syz.3.631': attribute type 2 has an invalid length. [ 190.164685][ T6340] netlink: 224 bytes leftover after parsing attributes in process `syz.3.631'. [ 190.215053][ T6340] netlink: 'syz.3.631': attribute type 10 has an invalid length. [ 190.407657][ T6350] syz.0.634 (6350) used greatest stack depth: 20240 bytes left [ 190.512273][ T4321] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 190.716830][ T4321] usb 3-1: Using ep0 maxpacket: 32 [ 190.749322][ T4321] usb 3-1: config 0 interface 0 has no altsetting 0 [ 190.756462][ T4321] usb 3-1: New USB device found, idVendor=046d, idProduct=c295, bcdDevice= 0.00 [ 190.788420][ T4321] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 190.817664][ T4321] usb 3-1: config 0 descriptor?? [ 191.052482][ T4321] usbhid 3-1:0.0: can't add hid device: -71 [ 191.061565][ T4321] usbhid: probe of 3-1:0.0 failed with error -71 [ 191.095872][ T4321] usb 3-1: USB disconnect, device number 8 [ 191.511932][ T6384] netlink: 'syz.4.646': attribute type 2 has an invalid length. [ 191.525534][ T6384] netlink: 224 bytes leftover after parsing attributes in process `syz.4.646'. [ 191.558173][ T4292] Bluetooth: hci4: link tx timeout [ 191.563629][ T4292] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 191.571440][ T4292] Bluetooth: hci4: link tx timeout [ 191.576612][ T4292] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 191.616706][ T6384] netlink: 'syz.4.646': attribute type 10 has an invalid length. [ 191.844941][ T4292] Bluetooth: hci4: link tx timeout [ 191.850201][ T4292] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 191.858648][ T4292] Bluetooth: hci4: link tx timeout [ 191.863945][ T4292] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 192.026925][ T4292] Bluetooth: hci4: link tx timeout [ 192.032190][ T4292] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 192.039883][ T4292] Bluetooth: hci4: link tx timeout [ 192.045872][ T4292] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 192.462854][ T6420] netlink: 'syz.2.660': attribute type 2 has an invalid length. [ 192.470584][ T6420] netlink: 224 bytes leftover after parsing attributes in process `syz.2.660'. [ 192.542397][ T6420] netlink: 'syz.2.660': attribute type 10 has an invalid length. [ 192.617171][ T6424] random: crng reseeded on system resumption [ 193.207067][ T6455] device dummy0 entered promiscuous mode [ 193.228398][ T6455] device dummy0 left promiscuous mode [ 194.043077][ T6483] netlink: 'syz.0.678': attribute type 2 has an invalid length. [ 194.050803][ T6483] netlink: 224 bytes leftover after parsing attributes in process `syz.0.678'. [ 194.225040][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.231668][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 195.035829][ T6519] IPVS: set_ctl: invalid protocol: 137 172.30.0.1:20001 [ 195.226788][ T6526] netlink: 'syz.4.692': attribute type 2 has an invalid length. [ 195.235415][ T6526] netlink: 224 bytes leftover after parsing attributes in process `syz.4.692'. [ 195.727255][ T22] Process accounting resumed [ 195.741621][ T6532] netlink: 'syz.2.695': attribute type 10 has an invalid length. [ 195.754903][ T6532] team0: Port device dummy0 removed [ 195.764077][ T6532] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 196.273867][ T6554] netlink: 'syz.1.704': attribute type 2 has an invalid length. [ 196.282004][ T6554] netlink: 224 bytes leftover after parsing attributes in process `syz.1.704'. [ 196.806349][ T6570] IPVS: set_ctl: invalid protocol: 137 172.30.0.3:20001 [ 197.022266][ T22] Process accounting resumed [ 197.038592][ T6568] netlink: 'syz.1.710': attribute type 10 has an invalid length. [ 198.057269][ T4321] Process accounting resumed [ 198.075243][ T6598] netlink: 'syz.1.724': attribute type 10 has an invalid length. [ 198.721838][ T6625] IPVS: set_ctl: invalid protocol: 137 172.30.0.3:20001 [ 199.971900][ T126] Process accounting resumed [ 199.985583][ T6646] netlink: 'syz.0.738': attribute type 10 has an invalid length. [ 200.051074][ T6646] team0: Port device dummy0 removed [ 200.094567][ T6646] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 201.167700][ T6683] netlink: 'syz.4.749': attribute type 2 has an invalid length. [ 201.180543][ T6683] netlink: 224 bytes leftover after parsing attributes in process `syz.4.749'. [ 201.193182][ T6684] netlink: 20 bytes leftover after parsing attributes in process `syz.1.748'. [ 201.566663][ T4321] Process accounting resumed [ 201.632896][ T6690] netlink: 'syz.4.752': attribute type 10 has an invalid length. [ 201.680058][ T6690] team0: Port device dummy0 removed [ 201.710347][ T6690] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 202.575991][ T6727] netlink: 'syz.0.763': attribute type 2 has an invalid length. [ 202.591910][ T6727] netlink: 224 bytes leftover after parsing attributes in process `syz.0.763'. [ 203.072348][ T22] Process accounting resumed [ 203.086770][ T6734] netlink: 'syz.4.767': attribute type 10 has an invalid length. [ 203.188649][ T6744] netlink: 'syz.0.770': attribute type 2 has an invalid length. [ 203.197890][ T6744] netlink: 224 bytes leftover after parsing attributes in process `syz.0.770'. [ 203.347183][ T6746] netlink: 'syz.0.770': attribute type 10 has an invalid length. [ 203.382997][ T6746] bond0: (slave dummy0): Releasing backup interface [ 203.405829][ T6746] team0: Port device dummy0 added [ 203.977361][ T6773] netlink: 'syz.4.778': attribute type 2 has an invalid length. [ 204.015620][ T6773] netlink: 224 bytes leftover after parsing attributes in process `syz.4.778'. [ 204.096403][ T6773] netlink: 'syz.4.778': attribute type 10 has an invalid length. [ 204.117279][ T6773] bond0: (slave dummy0): Releasing backup interface [ 204.137716][ T6773] team0: Port device dummy0 added [ 204.228826][ T6781] random: crng reseeded on system resumption [ 204.763269][ T6805] fuse: Bad value for 'fd' [ 205.719608][ T6824] netlink: 20 bytes leftover after parsing attributes in process `syz.2.792'. [ 206.186063][ T6838] netlink: 'syz.4.794': attribute type 2 has an invalid length. [ 206.232641][ T6838] netlink: 224 bytes leftover after parsing attributes in process `syz.4.794'. [ 206.291766][ T6838] netlink: 'syz.4.794': attribute type 10 has an invalid length. [ 206.551419][ T4292] Bluetooth: hci2: command 0x0406 tx timeout [ 206.557533][ T4292] Bluetooth: hci1: command 0x0406 tx timeout [ 206.561890][ T4291] Bluetooth: hci3: command 0x0406 tx timeout [ 206.750417][ T5066] Process accounting resumed [ 206.873019][ T6853] netlink: 'syz.4.800': attribute type 10 has an invalid length. [ 206.916446][ T4285] Bluetooth: hci4: link tx timeout [ 206.921716][ T4285] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 206.929421][ T4285] Bluetooth: hci4: link tx timeout [ 206.935164][ T4285] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 206.946435][ T6853] team0: Port device dummy0 removed [ 207.001089][ T6853] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 207.144837][ T6865] netlink: 20 bytes leftover after parsing attributes in process `syz.4.803'. [ 207.915858][ T6886] netlink: 'syz.0.810': attribute type 2 has an invalid length. [ 207.949620][ T6886] netlink: 224 bytes leftover after parsing attributes in process `syz.0.810'. [ 208.017944][ T6886] netlink: 'syz.0.810': attribute type 10 has an invalid length. [ 208.520451][ T5066] Process accounting resumed [ 208.561837][ T6894] netlink: 'syz.4.813': attribute type 10 has an invalid length. [ 208.589827][ T6897] netlink: 20 bytes leftover after parsing attributes in process `syz.0.814'. [ 209.522081][ T6925] netlink: 'syz.0.823': attribute type 13 has an invalid length. [ 209.529973][ T6925] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 209.560610][ T6925] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 209.568362][ T6925] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 209.577903][ T6925] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 209.621650][ T6925] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 209.629540][ T6932] netlink: 'syz.2.824': attribute type 2 has an invalid length. [ 209.638103][ T6925] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 209.647024][ T6932] netlink: 224 bytes leftover after parsing attributes in process `syz.2.824'. [ 209.657933][ T6925] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 209.681036][ T6925] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 209.691410][ T6925] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 209.706094][ T6925] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 209.838573][ T6932] netlink: 'syz.2.824': attribute type 10 has an invalid length. [ 209.871024][ T6932] bond0: (slave dummy0): Releasing backup interface [ 209.884512][ T6932] team0: Port device dummy0 added [ 210.150228][ T6943] netlink: 20 bytes leftover after parsing attributes in process `syz.2.826'. [ 210.792466][ T5066] Process accounting resumed [ 210.894558][ T6951] netlink: 'syz.2.829': attribute type 10 has an invalid length. [ 210.959585][ T6951] team0: Port device dummy0 removed [ 211.001051][ T6951] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 211.398109][ T6974] netlink: 'syz.2.838': attribute type 13 has an invalid length. [ 211.439720][ T6974] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 211.453862][ T6978] netlink: 20 bytes leftover after parsing attributes in process `syz.1.839'. [ 211.509535][ T6974] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 211.572111][ T6974] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 211.602977][ T6974] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 211.643935][ T6974] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 211.660511][ T6974] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 211.675868][ T6974] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 211.693582][ T6974] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 211.708562][ T6974] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 211.728103][ T6974] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 212.589206][ T4834] Process accounting resumed [ 212.595479][ T7008] netlink: 'syz.1.848': attribute type 10 has an invalid length. [ 212.890867][ T7024] netlink: 20 bytes leftover after parsing attributes in process `syz.3.853'. [ 213.246304][ T7032] netlink: 'syz.3.856': attribute type 2 has an invalid length. [ 213.268821][ T7032] netlink: 224 bytes leftover after parsing attributes in process `syz.3.856'. [ 213.280886][ T7032] netlink: 'syz.3.856': attribute type 10 has an invalid length. [ 214.049868][ T4348] Process accounting resumed [ 214.069302][ T7045] netlink: 'syz.3.862': attribute type 10 has an invalid length. [ 214.118400][ T7045] team0: Port device dummy0 removed [ 214.140630][ T7045] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 214.193030][ T7058] netlink: 20 bytes leftover after parsing attributes in process `syz.2.864'. [ 214.362794][ T7065] netlink: 'syz.3.868': attribute type 2 has an invalid length. [ 214.371142][ T7065] netlink: 224 bytes leftover after parsing attributes in process `syz.3.868'. [ 214.387586][ T7065] netlink: 'syz.3.868': attribute type 10 has an invalid length. [ 214.423144][ T7065] bond0: (slave dummy0): Releasing backup interface [ 214.447988][ T7065] team0: Port device dummy0 added [ 215.281006][ T4348] Process accounting resumed [ 215.292744][ T7086] netlink: 'syz.3.878': attribute type 10 has an invalid length. [ 215.313307][ T7086] team0: Port device dummy0 removed [ 215.322895][ T7086] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 215.368282][ T7092] random: crng reseeded on system resumption [ 215.690382][ T7105] fuse: Bad value for 'fd' [ 215.695278][ T7104] netlink: 'syz.3.882': attribute type 13 has an invalid length. [ 215.713501][ T7104] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 215.746307][ T7104] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 215.763879][ T7104] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 215.792960][ T7104] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 215.829225][ T7104] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 215.853224][ T7104] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 215.879862][ T7104] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 215.911844][ T7104] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 215.933408][ T7104] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 215.955729][ T7104] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 216.314365][ T7119] netlink: 'syz.4.884': attribute type 2 has an invalid length. [ 216.349620][ T7122] IPVS: set_ctl: invalid protocol: 137 172.30.0.3:20001 [ 216.370032][ T7119] netlink: 224 bytes leftover after parsing attributes in process `syz.4.884'. [ 216.457144][ T7119] netlink: 'syz.4.884': attribute type 10 has an invalid length. [ 216.471002][ T7119] bond0: (slave dummy0): Releasing backup interface [ 216.590754][ T7130] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 216.597399][ T7130] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 216.611639][ T7130] vhci_hcd vhci_hcd.0: Device attached [ 216.646205][ T7119] team0: Port device dummy0 added [ 216.912237][ T4348] usb 33-1: new low-speed USB device number 4 using vhci_hcd [ 217.317513][ T7131] vhci_hcd: connection reset by peer [ 217.332091][ T5043] vhci_hcd: stop threads [ 217.340208][ T5043] vhci_hcd: release socket [ 217.418148][ T5043] vhci_hcd: disconnect device [ 218.456746][ T7150] netlink: 'syz.1.892': attribute type 10 has an invalid length. [ 218.481667][ T7159] netlink: 12 bytes leftover after parsing attributes in process `syz.2.895'. [ 218.906534][ T7172] IPVS: set_ctl: invalid protocol: 137 172.30.0.2:20001 [ 219.349788][ T7183] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 219.356393][ T7183] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 219.364475][ T7183] vhci_hcd vhci_hcd.0: Device attached [ 220.031551][ T4834] usb 39-1: new low-speed USB device number 4 using vhci_hcd [ 220.075739][ T7184] vhci_hcd: connection reset by peer [ 220.097151][ T4897] vhci_hcd: stop threads [ 220.106531][ T4897] vhci_hcd: release socket [ 220.151245][ T4897] vhci_hcd: disconnect device [ 221.066769][ T7194] device syzkaller0 entered promiscuous mode [ 221.072115][ T129] Process accounting resumed [ 221.119510][ T7196] netlink: 'syz.4.908': attribute type 10 has an invalid length. [ 221.206263][ T7196] team0: Port device dummy0 removed [ 221.238968][ T7196] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 221.807997][ T7226] IPVS: set_ctl: invalid protocol: 137 172.30.0.2:20001 [ 222.075881][ T4348] vhci_hcd: vhci_device speed not set [ 223.850194][ T7244] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 223.856812][ T7244] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 223.864969][ T7244] vhci_hcd vhci_hcd.0: Device attached [ 224.588091][ T7245] vhci_hcd: connection closed [ 224.589201][ T76] vhci_hcd: stop threads [ 224.664345][ T76] vhci_hcd: release socket [ 224.744991][ T76] vhci_hcd: disconnect device [ 225.181509][ T4834] vhci_hcd: vhci_device speed not set [ 225.706566][ T4348] Process accounting resumed [ 225.725713][ T7268] netlink: 12 bytes leftover after parsing attributes in process `syz.3.924'. [ 225.819998][ T7268] netlink: 'syz.3.924': attribute type 10 has an invalid length. [ 226.434849][ T7290] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 226.441464][ T7290] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 226.450154][ T7290] vhci_hcd vhci_hcd.0: Device attached [ 226.751879][ T4348] usb 33-1: new low-speed USB device number 5 using vhci_hcd [ 227.157385][ T7291] vhci_hcd: connection reset by peer [ 227.177084][ T4752] vhci_hcd: stop threads [ 227.197764][ T4752] vhci_hcd: release socket [ 227.297234][ T4752] vhci_hcd: disconnect device [ 227.644920][ T7285] device syzkaller0 entered promiscuous mode [ 231.058913][ T4326] Process accounting resumed [ 231.067269][ T7327] netlink: 12 bytes leftover after parsing attributes in process `syz.2.940'. [ 231.103586][ T7327] netlink: 'syz.2.940': attribute type 10 has an invalid length. [ 231.921698][ T4348] vhci_hcd: vhci_device speed not set [ 232.961918][ T126] Process accounting resumed [ 232.967423][ T7373] netlink: 12 bytes leftover after parsing attributes in process `syz.0.957'. [ 232.999733][ T7379] netlink: 8 bytes leftover after parsing attributes in process `syz.1.959'. [ 233.029520][ T7373] netlink: 'syz.0.957': attribute type 10 has an invalid length. [ 233.050647][ T7373] team0: Port device dummy0 removed [ 233.083029][ T7373] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 233.420823][ T7388] device vlan2 entered promiscuous mode [ 233.497552][ T7388] netlink: 4 bytes leftover after parsing attributes in process `syz.0.962'. [ 233.518454][ T7388] device hsr_slave_0 left promiscuous mode [ 234.773997][ T7412] netlink: 'syz.2.970': attribute type 1 has an invalid length. [ 234.859159][ T7412] 8021q: adding VLAN 0 to HW filter on device bond1 [ 235.096152][ T7417] bond1 (unregistering): Released all slaves [ 235.517222][ T7426] device syzkaller0 entered promiscuous mode [ 238.504975][ T7469] netlink: 'syz.1.987': attribute type 2 has an invalid length. [ 238.551446][ T7469] netlink: 224 bytes leftover after parsing attributes in process `syz.1.987'. [ 238.606606][ T7475] netlink: 'syz.1.987': attribute type 10 has an invalid length. [ 238.642310][ T7475] bond0: (slave dummy0): Releasing backup interface [ 238.656155][ T7475] team0: Port device dummy0 added [ 239.408579][ T4285] Bluetooth: hci4: link tx timeout [ 239.413926][ T4285] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 239.422141][ T4285] Bluetooth: hci4: link tx timeout [ 239.427310][ T4285] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 240.413570][ T7523] netlink: 'syz.2.1004': attribute type 2 has an invalid length. [ 240.500397][ T7523] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1004'. [ 240.562068][ T7525] netlink: 'syz.2.1004': attribute type 10 has an invalid length. [ 240.614142][ T7529] netlink: 'syz.3.1006': attribute type 1 has an invalid length. [ 240.632966][ T7525] bond0: (slave dummy0): Releasing backup interface [ 240.671942][ T7525] team0: Port device dummy0 added [ 240.689829][ T7529] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1006'. [ 242.012897][ T7562] netlink: 'syz.1.1019': attribute type 2 has an invalid length. [ 242.020752][ T7562] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1019'. [ 242.145744][ T7562] netlink: 'syz.1.1019': attribute type 10 has an invalid length. [ 242.208846][ T7571] random: crng reseeded on system resumption [ 242.765577][ T7555] device syzkaller0 entered promiscuous mode [ 244.017375][ T7610] netlink: 'syz.3.1032': attribute type 2 has an invalid length. [ 244.065318][ T7610] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1032'. [ 245.531622][ T7616] netlink: 'syz.3.1032': attribute type 10 has an invalid length. [ 245.557899][ T7616] bond0: (slave dummy0): Releasing backup interface [ 245.598007][ T7616] team0: Port device dummy0 added [ 245.738511][ T7625] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1034'. [ 246.182988][ T4348] Process accounting resumed [ 246.200863][ T7634] netlink: 'syz.3.1037': attribute type 10 has an invalid length. [ 246.258452][ T7634] team0: Port device dummy0 removed [ 246.354813][ T7634] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 247.417575][ T7660] netlink: 'syz.4.1044': attribute type 10 has an invalid length. [ 247.512058][ T7660] bond0: (slave dummy0): Releasing backup interface [ 247.559392][ T7660] team0: Port device dummy0 added [ 247.940507][ T7669] netlink: 'syz.2.1046': attribute type 13 has an invalid length. [ 248.022041][ T7669] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 248.046823][ T7678] netlink: 'syz.4.1047': attribute type 2 has an invalid length. [ 248.063758][ T7669] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 248.072099][ T7678] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1047'. [ 248.111483][ T7669] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 248.122688][ T7669] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 248.152182][ T7669] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 248.187656][ T7669] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 248.231460][ T7669] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 248.243747][ T7669] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 248.263876][ T7669] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 248.297633][ T7669] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 248.484753][ T7685] netlink: 'syz.4.1047': attribute type 10 has an invalid length. [ 249.074051][ T126] Process accounting resumed [ 249.125156][ T7704] device ipvlan2 entered promiscuous mode [ 249.131156][ T7700] netlink: 'syz.0.1051': attribute type 10 has an invalid length. [ 249.526546][ T7724] random: crng reseeded on system resumption [ 249.880159][ T7731] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1061'. [ 249.962850][ T7731] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1061'. [ 250.366042][ T7740] netlink: 'syz.2.1065': attribute type 2 has an invalid length. [ 250.402202][ T7740] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1065'. [ 250.443130][ T7741] netlink: 'syz.1.1063': attribute type 2 has an invalid length. [ 250.458809][ T7740] netlink: 'syz.2.1065': attribute type 10 has an invalid length. [ 250.468274][ T7741] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1063'. [ 250.534459][ T7741] netlink: 'syz.1.1063': attribute type 10 has an invalid length. [ 250.740409][ T7753] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1068'. [ 251.001567][ T129] Process accounting resumed [ 251.008392][ T7755] netlink: 'syz.2.1069': attribute type 10 has an invalid length. [ 251.032598][ T7755] team0: Port device dummy0 removed [ 251.048705][ T7755] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 251.276414][ T7767] device syzkaller0 entered promiscuous mode [ 251.961548][ T7786] netlink: 'syz.4.1077': attribute type 1 has an invalid length. [ 251.976789][ T7786] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1077'. [ 252.383882][ T7792] netlink: 'syz.1.1079': attribute type 2 has an invalid length. [ 252.438305][ T7792] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1079'. [ 252.518137][ T7792] netlink: 'syz.1.1079': attribute type 10 has an invalid length. [ 252.837306][ T7812] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1084'. [ 253.156810][ T4326] Process accounting resumed [ 253.270609][ T7813] netlink: 'syz.2.1085': attribute type 10 has an invalid length. [ 253.447795][ T7824] random: crng reseeded on system resumption [ 254.092094][ T7852] netlink: 224 bytes leftover after parsing attributes in process `syz.0.1094'. [ 254.119912][ T7852] bond0: (slave dummy0): Releasing backup interface [ 254.147250][ T7852] team0: Port device dummy0 added [ 255.157653][ T4348] Process accounting resumed [ 255.167441][ T7876] validate_nla: 2 callbacks suppressed [ 255.167455][ T7876] netlink: 'syz.3.1099': attribute type 10 has an invalid length. [ 255.447391][ T7866] device syzkaller0 entered promiscuous mode [ 255.508692][ T7886] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1102'. [ 255.663491][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.669911][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.813694][ T7901] netlink: 'syz.2.1106': attribute type 2 has an invalid length. [ 255.859549][ T7901] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1106'. [ 258.292489][ T7909] netlink: 'syz.2.1106': attribute type 10 has an invalid length. [ 258.309314][ T7909] bond0: (slave dummy0): Releasing backup interface [ 258.330139][ T7909] team0: Port device dummy0 added [ 258.901850][ T4326] Process accounting resumed [ 258.938335][ T7927] netlink: 'syz.2.1114': attribute type 10 has an invalid length. [ 258.989938][ T7927] team0: Port device dummy0 removed [ 259.064324][ T7927] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 259.091673][ T7939] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1118'. [ 259.101036][ T7939] netlink: 'syz.1.1118': attribute type 10 has an invalid length. [ 259.159069][ T7939] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1118'. [ 259.225841][ T7939] device geneve2 entered promiscuous mode [ 260.691620][ T4326] Process accounting resumed [ 260.722608][ T7985] netlink: 'syz.2.1132': attribute type 10 has an invalid length. [ 261.238455][ T7993] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 262.164250][ T8021] netlink: 'syz.2.1144': attribute type 2 has an invalid length. [ 262.202699][ T8021] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1144'. [ 262.305624][ T8021] netlink: 'syz.2.1144': attribute type 10 has an invalid length. [ 262.334006][ T8021] bond0: (slave dummy0): Releasing backup interface [ 262.363522][ T8021] team0: Port device dummy0 added [ 262.679314][ T8032] netlink: 'syz.0.1148': attribute type 10 has an invalid length. [ 262.837887][ T8032] team0: Port device dummy0 removed [ 262.888049][ T8032] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 263.020504][ T8033] Process accounting resumed [ 263.509358][ T8061] netlink: 'syz.0.1159': attribute type 2 has an invalid length. [ 263.556629][ T8061] netlink: 224 bytes leftover after parsing attributes in process `syz.0.1159'. [ 263.701752][ T8070] netlink: 'syz.0.1159': attribute type 10 has an invalid length. [ 263.873175][ T8070] bond0: (slave dummy0): Releasing backup interface [ 263.930915][ T8070] team0: Port device dummy0 added [ 266.599583][ T8105] random: crng reseeded on system resumption [ 267.102618][ T8116] netlink: 'syz.0.1173': attribute type 2 has an invalid length. [ 267.143554][ T8116] netlink: 224 bytes leftover after parsing attributes in process `syz.0.1173'. [ 267.203644][ T8116] netlink: 'syz.0.1173': attribute type 10 has an invalid length. [ 267.689501][ T8128] netlink: 'syz.2.1176': attribute type 13 has an invalid length. [ 267.700006][ T8128] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 267.720505][ T8128] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 267.736975][ T8128] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 267.752397][ T8128] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 267.785933][ T8128] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 267.797682][ T8128] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 267.829087][ T8128] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 267.855384][ T8128] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 267.870961][ T8128] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 267.880611][ T8128] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 267.980865][ T8129] netlink: 'syz.3.1175': attribute type 6 has an invalid length. [ 268.023373][ T8129] netlink: 'syz.3.1175': attribute type 7 has an invalid length. [ 268.035357][ T8129] netlink: 'syz.3.1175': attribute type 8 has an invalid length. [ 268.595873][ T8155] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 268.602495][ T8155] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 268.610553][ T8155] vhci_hcd vhci_hcd.0: Device attached [ 268.891718][ T129] usb 37-1: new low-speed USB device number 5 using vhci_hcd [ 269.242764][ T8156] vhci_hcd: connection reset by peer [ 269.257528][ T4669] vhci_hcd: stop threads [ 269.263584][ T4669] vhci_hcd: release socket [ 269.363275][ T4669] vhci_hcd: disconnect device [ 269.987333][ T8169] netlink: 'syz.2.1186': attribute type 1 has an invalid length. [ 270.001893][ T8168] netlink: 'syz.4.1185': attribute type 2 has an invalid length. [ 270.013906][ T8169] netlink: 'syz.2.1186': attribute type 2 has an invalid length. [ 270.041637][ T8168] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1185'. [ 270.051216][ T8172] netlink: 'syz.2.1186': attribute type 1 has an invalid length. [ 270.289319][ T8181] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 270.346069][ T8184] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1191'. [ 270.348304][ T8181] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 270.369278][ T8181] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 270.377167][ T8181] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 270.385445][ T8181] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 270.396643][ T8181] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 270.407203][ T8181] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 270.435336][ T8181] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 270.446260][ T8181] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 270.454596][ T8181] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 271.156691][ T8207] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 271.163299][ T8207] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 271.171326][ T8207] vhci_hcd vhci_hcd.0: Device attached [ 271.788082][ T8208] vhci_hcd: connection closed [ 271.789044][ T5043] vhci_hcd: stop threads [ 271.913024][ T5043] vhci_hcd: release socket [ 272.021753][ T5043] vhci_hcd: disconnect device [ 273.178749][ T8227] syzkaller0: renamed from gre1 [ 273.199535][ T8228] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1204'. [ 274.065220][ T129] vhci_hcd: vhci_device speed not set [ 274.300294][ T8274] device syzkaller0 entered promiscuous mode [ 274.826995][ T8292] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1226'. [ 275.601714][ T8318] device syzkaller0 entered promiscuous mode [ 276.906273][ T8356] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 277.133490][ T8356] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 277.346367][ T8356] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 277.777422][ T8356] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 277.814617][ T8356] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 277.877802][ T8356] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 277.914578][ T8356] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 277.942727][ T8384] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1262'. [ 278.284806][ T8401] validate_nla: 4 callbacks suppressed [ 278.284826][ T8401] netlink: 'syz.0.1267': attribute type 1 has an invalid length. [ 278.309418][ T8401] netlink: 224 bytes leftover after parsing attributes in process `syz.0.1267'. [ 278.564417][ T8407] device syzkaller0 left promiscuous mode [ 279.475140][ T8437] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1276'. [ 279.868158][ T8450] netlink: 'syz.2.1280': attribute type 1 has an invalid length. [ 279.886423][ T8450] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1280'. [ 280.347180][ T8458] IPv6: NLM_F_CREATE should be specified when creating new route [ 280.371500][ T8458] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1283'. [ 281.203719][ T8478] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1290'. [ 281.536457][ T8482] netlink: 'syz.0.1292': attribute type 10 has an invalid length. [ 281.570479][ T8482] team0: Port device dummy0 removed [ 281.596799][ T8482] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 283.120908][ T8512] Cannot find set identified by id 65534 to match [ 283.622668][ T4834] Process accounting resumed [ 283.628622][ T8520] netlink: 'syz.4.1306': attribute type 10 has an invalid length. [ 283.638858][ T8520] team0: Port device dummy0 removed [ 283.704260][ T8520] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 284.786215][ T8557] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 284.792849][ T8557] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 284.800771][ T8557] vhci_hcd vhci_hcd.0: Device attached [ 285.091388][ T129] usb 33-1: new low-speed USB device number 6 using vhci_hcd [ 285.468648][ T8558] vhci_hcd: connection reset by peer [ 285.487968][ T11] vhci_hcd: stop threads [ 285.498018][ T11] vhci_hcd: release socket [ 285.568993][ T11] vhci_hcd: disconnect device [ 285.887988][ T8547] device syzkaller0 entered promiscuous mode [ 286.174234][ T8564] netlink: 'syz.4.1318': attribute type 1 has an invalid length. [ 286.211412][ T8564] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1318'. [ 288.291403][ T8581] netlink: 128 bytes leftover after parsing attributes in process `syz.2.1325'. [ 288.689002][ T8600] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 288.695601][ T8600] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 288.710413][ T8600] vhci_hcd vhci_hcd.0: Device attached [ 289.406348][ T8601] vhci_hcd: connection closed [ 289.407386][ T4897] vhci_hcd: stop threads [ 289.501132][ T4897] vhci_hcd: release socket [ 289.611118][ T4897] vhci_hcd: disconnect device [ 290.231454][ T129] vhci_hcd: vhci_device speed not set [ 291.200078][ T8628] netlink: 128 bytes leftover after parsing attributes in process `syz.1.1339'. [ 291.494971][ T8644] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1343'. [ 292.154724][ T8656] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 292.161329][ T8656] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 292.169376][ T8656] vhci_hcd vhci_hcd.0: Device attached [ 292.541480][ T14] usb 33-1: new low-speed USB device number 7 using vhci_hcd [ 292.864959][ T8657] vhci_hcd: connection reset by peer [ 292.879445][ T76] vhci_hcd: stop threads [ 292.885732][ T76] vhci_hcd: release socket [ 292.939451][ T76] vhci_hcd: disconnect device [ 294.425837][ T8674] netlink: 128 bytes leftover after parsing attributes in process `syz.1.1353'. [ 294.749477][ T8681] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1356'. [ 294.827739][ T8683] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1358'. [ 295.100644][ T8690] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(6) [ 295.107333][ T8690] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 295.121483][ T8690] vhci_hcd vhci_hcd.0: Device attached [ 295.411687][ T126] usb 41-1: new low-speed USB device number 5 using vhci_hcd [ 295.804517][ T8691] vhci_hcd: connection reset by peer [ 295.818735][ T4897] vhci_hcd: stop threads [ 295.827730][ T4897] vhci_hcd: release socket [ 295.899781][ T4897] vhci_hcd: disconnect device [ 296.440171][ T8700] netlink: 'syz.3.1362': attribute type 8 has an invalid length. [ 296.486001][ T8706] netlink: 128 bytes leftover after parsing attributes in process `syz.1.1365'. [ 296.557177][ T8709] netlink: 'syz.0.1366': attribute type 1 has an invalid length. [ 296.602864][ T8709] netlink: 224 bytes leftover after parsing attributes in process `syz.0.1366'. [ 296.707791][ T8718] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1368'. [ 297.228162][ T8738] random: crng reseeded on system resumption [ 297.271392][ T8736] device syzkaller1 entered promiscuous mode [ 297.427393][ T8745] netlink: 128 bytes leftover after parsing attributes in process `syz.0.1378'. [ 297.485251][ T8746] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 297.491852][ T8746] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 297.499800][ T8746] vhci_hcd vhci_hcd.0: Device attached [ 297.741337][ T14] vhci_hcd: vhci_device speed not set [ 297.781552][ T129] usb 39-1: new low-speed USB device number 5 using vhci_hcd [ 298.190579][ T8747] vhci_hcd: connection reset by peer [ 298.207959][ T4669] vhci_hcd: stop threads [ 298.216236][ T4669] vhci_hcd: release socket [ 298.272385][ T4669] vhci_hcd: disconnect device [ 298.886208][ T8756] IPv6: ADDRCONF(NETDEV_CHANGE): gre1: link becomes ready [ 299.291141][ T8774] netlink: 'syz.3.1385': attribute type 1 has an invalid length. [ 299.336028][ T8774] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1385'. [ 299.571631][ T8787] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1388'. [ 300.082268][ T8798] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 300.088874][ T8798] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 300.097335][ T8798] vhci_hcd vhci_hcd.0: Device attached [ 300.401550][ T14] usb 35-1: new low-speed USB device number 3 using vhci_hcd [ 300.641724][ T126] vhci_hcd: vhci_device speed not set [ 300.729759][ T8799] vhci_hcd: connection reset by peer [ 300.745142][ T5061] vhci_hcd: stop threads [ 300.778839][ T5061] vhci_hcd: release socket [ 300.888310][ T5061] vhci_hcd: disconnect device [ 301.440179][ T8808] random: crng reseeded on system resumption [ 301.685333][ T8825] netlink: 'syz.0.1402': attribute type 1 has an invalid length. [ 301.773257][ T8825] netlink: 224 bytes leftover after parsing attributes in process `syz.0.1402'. [ 301.854705][ T8822] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1401'. [ 301.897296][ T4834] Process accounting resumed [ 301.917992][ T8823] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1400'. [ 301.930827][ T8832] netlink: 108 bytes leftover after parsing attributes in process `syz.3.1403'. [ 301.968384][ T8823] netlink: 'syz.2.1400': attribute type 10 has an invalid length. [ 302.033703][ T8823] team0: Port device dummy0 removed [ 302.100617][ T8823] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 302.429280][ T8839] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 302.435883][ T8839] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 302.443870][ T8839] vhci_hcd vhci_hcd.0: Device attached [ 302.756147][ T4285] Bluetooth: hci4: link tx timeout [ 302.761731][ T4285] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 302.769541][ T4285] Bluetooth: hci4: link tx timeout [ 302.775702][ T4285] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 303.091771][ T8840] vhci_hcd: connection reset by peer [ 303.106406][ T9] vhci_hcd: stop threads [ 303.114841][ T9] vhci_hcd: release socket [ 303.175362][ T9] vhci_hcd: disconnect device [ 303.251997][ T129] vhci_hcd: vhci_device speed not set [ 304.057959][ T8860] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1414'. [ 304.114181][ T8863] netlink: 108 bytes leftover after parsing attributes in process `syz.2.1415'. [ 304.393178][ T129] Process accounting resumed [ 304.431820][ T8865] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1416'. [ 305.586987][ T14] vhci_hcd: vhci_device speed not set [ 306.440173][ T8900] netlink: 108 bytes leftover after parsing attributes in process `syz.1.1430'. [ 306.498871][ T8899] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1429'. [ 307.041398][ T14] Process accounting resumed [ 307.072243][ T8913] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1436'. [ 307.181138][ T8913] netlink: 'syz.1.1436': attribute type 10 has an invalid length. [ 307.215444][ T8913] team0: Port device dummy0 removed [ 307.326554][ T8913] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 307.646804][ T8935] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1445'. [ 308.139143][ T8951] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 308.145751][ T8951] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 308.153669][ T8951] vhci_hcd vhci_hcd.0: Device attached [ 308.441682][ T126] usb 37-1: new low-speed USB device number 6 using vhci_hcd [ 308.483925][ T8956] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1453'. [ 308.804572][ T8953] vhci_hcd: connection reset by peer [ 308.818541][ T4897] vhci_hcd: stop threads [ 308.828507][ T4897] vhci_hcd: release socket [ 308.873236][ T4897] vhci_hcd: disconnect device [ 309.741868][ T8973] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1459'. [ 310.116756][ T8990] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1466'. [ 310.175407][ T8990] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(6) [ 310.181998][ T8990] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 310.219729][ T8990] vhci_hcd vhci_hcd.0: Device attached [ 310.491867][ T129] usb 41-1: new low-speed USB device number 6 using vhci_hcd [ 310.855339][ T8991] vhci_hcd: connection reset by peer [ 310.871473][ T76] vhci_hcd: stop threads [ 310.876625][ T76] vhci_hcd: release socket [ 310.995845][ T76] vhci_hcd: disconnect device [ 311.380981][ T9001] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1469'. [ 311.889584][ T9018] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1477'. [ 312.055507][ T9030] sch_tbf: burst 65537 is lower than device syzkaller0 mtu (65589) ! [ 312.163978][ T9036] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1482'. [ 312.262295][ T9036] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 312.268893][ T9036] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 312.276828][ T9036] vhci_hcd vhci_hcd.0: Device attached [ 312.661876][ T4332] usb 33-1: new low-speed USB device number 8 using vhci_hcd [ 312.923152][ T9037] vhci_hcd: connection reset by peer [ 312.937006][ T4897] vhci_hcd: stop threads [ 312.947130][ T4897] vhci_hcd: release socket [ 312.999447][ T4897] vhci_hcd: disconnect device [ 313.580081][ T9042] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1485'. [ 313.601574][ T126] vhci_hcd: vhci_device speed not set [ 313.990326][ T9059] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1492'. [ 314.469918][ T9084] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1500'. [ 314.558101][ T9084] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 314.564699][ T9084] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 314.572667][ T9084] vhci_hcd vhci_hcd.0: Device attached [ 314.951737][ T126] usb 35-1: new low-speed USB device number 4 using vhci_hcd [ 315.251636][ T9085] vhci_hcd: connection reset by peer [ 315.281095][ T9] vhci_hcd: stop threads [ 315.327661][ T9] vhci_hcd: release socket [ 315.411514][ T9] vhci_hcd: disconnect device [ 315.661541][ T129] vhci_hcd: vhci_device speed not set [ 315.975138][ T9096] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1503'. [ 316.779478][ T9128] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 316.786087][ T9128] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 316.794682][ T9128] vhci_hcd vhci_hcd.0: Device attached [ 317.113695][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.120096][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.232123][ T4325] usb 39-1: new low-speed USB device number 6 using vhci_hcd [ 317.455706][ T9129] vhci_hcd: connection reset by peer [ 317.469454][ T5043] vhci_hcd: stop threads [ 317.475865][ T5043] vhci_hcd: release socket [ 317.542014][ T5043] vhci_hcd: disconnect device [ 317.821861][ T4332] vhci_hcd: vhci_device speed not set [ 318.804608][ T9165] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 318.811211][ T9165] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 318.819136][ T9165] vhci_hcd vhci_hcd.0: Device attached [ 319.536401][ T9166] vhci_hcd: connection closed [ 319.537421][ T4897] vhci_hcd: stop threads [ 319.629053][ T4897] vhci_hcd: release socket [ 319.739773][ T4897] vhci_hcd: disconnect device [ 320.161614][ T126] vhci_hcd: vhci_device speed not set [ 321.138652][ T9204] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 321.145265][ T9204] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 321.153133][ T9204] vhci_hcd vhci_hcd.0: Device attached [ 321.442293][ T126] usb 33-1: new low-speed USB device number 9 using vhci_hcd [ 321.564702][ T9209] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 321.829269][ T9205] vhci_hcd: connection reset by peer [ 321.843762][ T76] vhci_hcd: stop threads [ 321.848535][ T76] vhci_hcd: release socket [ 321.910461][ T76] vhci_hcd: disconnect device [ 322.391736][ T4325] vhci_hcd: vhci_device speed not set [ 322.427857][ T9213] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1551'. [ 322.772859][ T9226] IPv6: ADDRCONF(NETDEV_CHANGE): gre1: link becomes ready [ 323.285845][ T9245] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(6) [ 323.292456][ T9245] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 323.300404][ T9245] vhci_hcd vhci_hcd.0: Device attached [ 323.567015][ T9248] netlink: 100 bytes leftover after parsing attributes in process `syz.1.1562'. [ 323.592282][ T4332] usb 41-1: new low-speed USB device number 7 using vhci_hcd [ 323.956728][ T9235] lo speed is unknown, defaulting to 1000 [ 324.004546][ T9246] vhci_hcd: connection reset by peer [ 324.018903][ T76] vhci_hcd: stop threads [ 324.025803][ T76] vhci_hcd: release socket [ 324.084626][ T76] vhci_hcd: disconnect device [ 325.063708][ T9265] IPVS: set_ctl: invalid protocol: 137 172.30.0.5:20001 [ 325.086571][ T9260] device syzkaller0 entered promiscuous mode [ 325.447154][ T9281] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1572'. [ 326.635040][ T126] vhci_hcd: vhci_device speed not set [ 327.170698][ T9284] Bluetooth: ISO socket layer initialized [ 327.395778][ T9292] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 327.402393][ T9292] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 327.410267][ T9292] vhci_hcd vhci_hcd.0: Device attached [ 327.691492][ T129] usb 35-1: new low-speed USB device number 5 using vhci_hcd [ 328.114475][ T9293] vhci_hcd: connection reset by peer [ 328.128682][ T4897] vhci_hcd: stop threads [ 328.133564][ T4897] vhci_hcd: release socket [ 328.186900][ T4897] vhci_hcd: disconnect device [ 328.791637][ T4332] vhci_hcd: vhci_device speed not set [ 329.052465][ T9313] IPVS: set_ctl: invalid protocol: 137 172.30.0.1:20001 [ 329.316365][ T9322] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1585'. [ 329.673387][ T9336] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 329.680007][ T9336] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 329.693765][ T9336] vhci_hcd vhci_hcd.0: Device attached [ 330.397651][ T9337] vhci_hcd: connection closed [ 330.398542][ T5061] vhci_hcd: stop threads [ 330.459217][ T5061] vhci_hcd: release socket [ 330.501001][ T5061] vhci_hcd: disconnect device [ 331.303068][ T9344] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 331.309676][ T9344] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 331.317751][ T9344] vhci_hcd vhci_hcd.0: Device attached [ 331.621933][ T4332] usb 37-1: new low-speed USB device number 7 using vhci_hcd [ 331.998834][ T9345] vhci_hcd: connection reset by peer [ 332.013268][ T4752] vhci_hcd: stop threads [ 332.017672][ T4752] vhci_hcd: release socket [ 332.059710][ T4752] vhci_hcd: disconnect device [ 332.861562][ T129] vhci_hcd: vhci_device speed not set [ 333.121851][ T9365] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1599'. [ 333.152128][ T9369] random: crng reseeded on system resumption [ 333.221622][ T9352] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1594'. [ 333.632193][ T9387] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 333.638797][ T9387] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 333.646963][ T9387] vhci_hcd vhci_hcd.0: Device attached [ 334.001502][ T129] usb 35-1: new low-speed USB device number 6 using vhci_hcd [ 334.328804][ T9388] vhci_hcd: connection reset by peer [ 334.342825][ T5043] vhci_hcd: stop threads [ 334.347749][ T5043] vhci_hcd: release socket [ 334.420302][ T5043] vhci_hcd: disconnect device [ 335.153036][ T9400] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 335.159638][ T9400] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 335.167832][ T9400] vhci_hcd vhci_hcd.0: Device attached [ 335.850038][ T9402] vhci_hcd: connection closed [ 335.850912][ T4897] vhci_hcd: stop threads [ 335.911797][ T4897] vhci_hcd: release socket [ 335.979234][ T4897] vhci_hcd: disconnect device [ 336.702574][ T9408] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 336.781591][ T4332] vhci_hcd: vhci_device speed not set [ 336.886445][ T9408] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 337.028822][ T9408] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 337.139827][ T9408] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 337.158715][ T9426] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1615'. [ 337.168260][ T9429] device syzkaller0 entered promiscuous mode [ 337.344252][ T9435] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1617'. [ 337.366017][ T9408] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 337.462868][ T9439] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 337.469473][ T9439] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 337.477542][ T9439] vhci_hcd vhci_hcd.0: Device attached [ 337.761723][ T4834] usb 33-1: new low-speed USB device number 10 using vhci_hcd [ 338.063010][ T9408] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 338.175549][ T9440] vhci_hcd: connection reset by peer [ 338.194954][ T11] vhci_hcd: stop threads [ 338.199607][ T11] vhci_hcd: release socket [ 338.262853][ T11] vhci_hcd: disconnect device [ 338.505965][ T9408] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 338.710561][ T9408] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 339.187212][ T129] vhci_hcd: vhci_device speed not set [ 339.647573][ T9473] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 339.654215][ T9473] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 339.662572][ T9473] vhci_hcd vhci_hcd.0: Device attached [ 339.951464][ T22] usb 39-1: new low-speed USB device number 7 using vhci_hcd [ 340.353636][ T9474] vhci_hcd: connection reset by peer [ 340.374359][ T4897] vhci_hcd: stop threads [ 340.378975][ T4897] vhci_hcd: release socket [ 340.425997][ T4897] vhci_hcd: disconnect device [ 341.187932][ T9491] sch_tbf: burst 65537 is lower than device syzkaller0 mtu (65589) ! [ 341.276286][ T9498] netlink: 'syz.1.1641': attribute type 2 has an invalid length. [ 341.290818][ T9498] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1641'. [ 341.338138][ T9498] netlink: 'syz.1.1641': attribute type 10 has an invalid length. [ 341.390626][ T9498] bond0: (slave dummy0): Releasing backup interface [ 341.428871][ T9498] team0: Port device dummy0 added [ 341.615725][ T9501] device syzkaller0 entered promiscuous mode [ 341.715923][ T9513] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 341.722561][ T9513] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 341.730480][ T9513] vhci_hcd vhci_hcd.0: Device attached [ 342.011506][ T5132] usb 35-1: new low-speed USB device number 7 using vhci_hcd [ 342.460228][ T9514] vhci_hcd: connection reset by peer [ 342.477317][ T4897] vhci_hcd: stop threads [ 342.484407][ T4897] vhci_hcd: release socket [ 342.546596][ T4897] vhci_hcd: disconnect device [ 342.941753][ T4834] vhci_hcd: vhci_device speed not set [ 343.443755][ T9535] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1653'. [ 345.054510][ T9508] device syzkaller0 entered promiscuous mode [ 345.090994][ T9542] sch_tbf: burst 65537 is lower than device syzkaller0 mtu (65589) ! [ 345.101575][ T22] vhci_hcd: vhci_device speed not set [ 345.409832][ T9559] IPVS: set_ctl: invalid protocol: 137 172.30.0.5:20001 [ 346.326868][ T9576] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1664'. [ 346.528109][ T9585] device syzkaller0 entered promiscuous mode [ 346.910150][ T9598] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1673'. [ 347.181572][ T5132] vhci_hcd: vhci_device speed not set [ 347.195456][ T4332] Process accounting resumed [ 347.316073][ T9606] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1677'. [ 347.530473][ T9612] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 347.660082][ T9612] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 347.748197][ T9612] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 347.855186][ T9612] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 347.877648][ T9631] netlink: 'syz.3.1683': attribute type 10 has an invalid length. [ 347.903237][ T9631] bond0: (slave dummy0): Releasing backup interface [ 347.929261][ T9631] team0: Port device dummy0 added [ 347.980428][ T9612] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 348.024396][ T9612] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 348.073071][ T9612] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 348.123655][ T9612] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 348.157245][ T9640] device syzkaller0 entered promiscuous mode [ 348.262121][ T9643] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1690'. [ 348.546925][ T4326] Process accounting resumed [ 349.125566][ T9670] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1702'. [ 349.781824][ T9691] sch_tbf: burst 65537 is lower than device syzkaller0 mtu (65589) ! [ 349.948685][ T9695] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1714'. [ 350.325035][ T9707] device syzkaller0 entered promiscuous mode [ 350.523622][ T9623] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 350.539937][ T9629] netlink: 'syz.3.1683': attribute type 2 has an invalid length. [ 350.555356][ T9629] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1683'. [ 350.561412][ T9615] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 350.615967][ T9615] [ 350.618366][ T9615] ====================================================== [ 350.625430][ T9615] WARNING: possible circular locking dependency detected [ 350.632533][ T9615] syzkaller #0 Not tainted [ 350.636987][ T9615] ------------------------------------------------------ [ 350.644057][ T9615] syz.1.1682/9615 is trying to acquire lock: [ 350.650073][ T9615] ffffffff8d41a368 (nci_mutex){+.+.}-{3:3}, at: virtual_nci_close+0x13/0x40 [ 350.658842][ T9615] [ 350.658842][ T9615] but task is already holding lock: [ 350.666248][ T9615] ffff8880579d1350 (&ndev->req_lock){+.+.}-{3:3}, at: nci_close_device+0x102/0x600 [ 350.675727][ T9615] [ 350.675727][ T9615] which lock already depends on the new lock. [ 350.675727][ T9615] [ 350.686165][ T9615] [ 350.686165][ T9615] the existing dependency chain (in reverse order) is: [ 350.695215][ T9615] [ 350.695215][ T9615] -> #3 (&ndev->req_lock){+.+.}-{3:3}: [ 350.702930][ T9615] __mutex_lock+0x12d/0xae0 [ 350.707986][ T9615] nci_start_poll+0x8c8/0xcc0 [ 350.713207][ T9615] nfc_start_poll+0x141/0x2c0 [ 350.718435][ T9615] nfc_genl_start_poll+0x1d7/0x340 [ 350.724103][ T9615] genl_family_rcv_msg_doit+0x22f/0x350 [ 350.730195][ T9615] genl_rcv_msg+0x601/0x790 [ 350.735252][ T9615] netlink_rcv_skb+0x1ef/0x440 [ 350.740569][ T9615] genl_rcv+0x24/0x40 [ 350.745093][ T9615] netlink_unicast+0x7ad/0x920 [ 350.750407][ T9615] netlink_sendmsg+0x8ad/0xbd0 [ 350.755715][ T9615] ____sys_sendmsg+0x5ed/0x9a0 [ 350.761035][ T9615] ___sys_sendmsg+0x2a2/0x360 [ 350.766269][ T9615] __se_sys_sendmsg+0x1c3/0x2b0 [ 350.771678][ T9615] do_syscall_64+0x4c/0xa0 [ 350.776647][ T9615] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 350.783089][ T9615] [ 350.783089][ T9615] -> #2 (&genl_data->genl_data_mutex){+.+.}-{3:3}: [ 350.791800][ T9615] __mutex_lock+0x12d/0xae0 [ 350.796845][ T9615] nfc_urelease_event_work+0x120/0x310 [ 350.802851][ T9615] process_one_work+0x8ab/0x1160 [ 350.808329][ T9615] worker_thread+0xaf5/0x12a0 [ 350.813547][ T9615] kthread+0x29d/0x330 [ 350.818154][ T9615] ret_from_fork+0x1f/0x30 [ 350.823119][ T9615] [ 350.823119][ T9615] -> #1 (nfc_devlist_mutex){+.+.}-{3:3}: [ 350.830981][ T9615] __mutex_lock+0x12d/0xae0 [ 350.836026][ T9615] nfc_register_device+0x38/0x300 [ 350.841595][ T9615] nci_register_device+0x89f/0x9f0 [ 350.847253][ T9615] virtual_ncidev_open+0x55/0xc0 [ 350.852740][ T9615] misc_open+0x31f/0x390 [ 350.857533][ T9615] chrdev_open+0x585/0x5f0 [ 350.862494][ T9615] do_dentry_open+0x7dd/0x10b0 [ 350.867805][ T9615] path_openat+0x2674/0x2f10 [ 350.872967][ T9615] do_filp_open+0x1ee/0x420 [ 350.878013][ T9615] do_sys_openat2+0x14b/0x4f0 [ 350.883243][ T9615] __x64_sys_openat+0x135/0x160 [ 350.888645][ T9615] do_syscall_64+0x4c/0xa0 [ 350.893619][ T9615] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 350.900063][ T9615] [ 350.900063][ T9615] -> #0 (nci_mutex){+.+.}-{3:3}: [ 350.907215][ T9615] __lock_acquire+0x2d18/0x7c40 [ 350.912622][ T9615] lock_acquire+0x1bb/0x4a0 [ 350.917673][ T9615] __mutex_lock+0x12d/0xae0 [ 350.922716][ T9615] virtual_nci_close+0x13/0x40 [ 350.928045][ T9615] nci_close_device+0x383/0x600 [ 350.933439][ T9615] nci_unregister_device+0x5e/0x250 [ 350.939176][ T9615] virtual_ncidev_close+0x55/0x90 [ 350.944759][ T9615] __fput+0x20a/0x8b0 [ 350.949284][ T9615] task_work_run+0x1d0/0x260 [ 350.954426][ T9615] exit_to_user_mode_loop+0xe6/0x110 [ 350.960264][ T9615] exit_to_user_mode_prepare+0xee/0x180 [ 350.966361][ T9615] syscall_exit_to_user_mode+0x16/0x40 [ 350.972361][ T9615] do_syscall_64+0x58/0xa0 [ 350.977330][ T9615] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 350.983777][ T9615] [ 350.983777][ T9615] other info that might help us debug this: [ 350.983777][ T9615] [ 350.994018][ T9615] Chain exists of: [ 350.994018][ T9615] nci_mutex --> &genl_data->genl_data_mutex --> &ndev->req_lock [ 350.994018][ T9615] [ 351.007596][ T9615] Possible unsafe locking scenario: [ 351.007596][ T9615] [ 351.015062][ T9615] CPU0 CPU1 [ 351.020442][ T9615] ---- ---- [ 351.025821][ T9615] lock(&ndev->req_lock); [ 351.030254][ T9615] lock(&genl_data->genl_data_mutex); [ 351.038254][ T9615] lock(&ndev->req_lock); [ 351.045216][ T9615] lock(nci_mutex); [ 351.049140][ T9615] [ 351.049140][ T9615] *** DEADLOCK *** [ 351.049140][ T9615] [ 351.057299][ T9615] 1 lock held by syz.1.1682/9615: [ 351.062334][ T9615] #0: ffff8880579d1350 (&ndev->req_lock){+.+.}-{3:3}, at: nci_close_device+0x102/0x600 [ 351.072111][ T9615] [ 351.072111][ T9615] stack backtrace: [ 351.078022][ T9615] CPU: 0 PID: 9615 Comm: syz.1.1682 Not tainted syzkaller #0 [ 351.085414][ T9615] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 351.095498][ T9615] Call Trace: [ 351.098882][ T9615] [ 351.101928][ T9615] dump_stack_lvl+0x188/0x24e [ 351.106701][ T9615] ? load_image+0x410/0x410 [ 351.111236][ T9615] ? show_regs_print_info+0x12/0x12 [ 351.116469][ T9615] ? print_circular_bug+0x12b/0x1a0 [ 351.121700][ T9615] check_noncircular+0x296/0x330 [ 351.126734][ T9615] ? add_chain_block+0x9b0/0x9b0 [ 351.131716][ T9615] ? lockdep_lock+0xf1/0x1f0 [ 351.136544][ T9615] ? _find_first_zero_bit+0xd2/0x100 [ 351.141874][ T9615] __lock_acquire+0x2d18/0x7c40 [ 351.146904][ T9615] ? verify_lock_unused+0x140/0x140 [ 351.152156][ T9615] ? release_firmware_map_entry+0x187/0x187 [ 351.158096][ T9615] ? prb_read_valid+0x60/0x60 [ 351.162792][ T9615] ? llist_add_batch+0x12b/0x180 [ 351.167763][ T9615] ? preempt_schedule+0xbc/0xd0 [ 351.172658][ T9615] ? find_next_clump8+0x1a0/0x1a0 [ 351.177712][ T9615] lock_acquire+0x1bb/0x4a0 [ 351.182241][ T9615] ? virtual_nci_close+0x13/0x40 [ 351.187228][ T9615] ? __irq_work_queue_local+0x12c/0x190 [ 351.192825][ T9615] ? __might_sleep+0xd0/0xd0 [ 351.197434][ T9615] ? read_lock_is_recursive+0x10/0x10 [ 351.202836][ T9615] ? vprintk_emit+0x59f/0x6a0 [ 351.207537][ T9615] ? vprintk_emit+0x315/0x6a0 [ 351.212241][ T9615] ? printk_sprint+0x460/0x460 [ 351.217032][ T9615] ? preempt_schedule_thunk+0x16/0x18 [ 351.222458][ T9615] __mutex_lock+0x12d/0xae0 [ 351.227002][ T9615] ? virtual_nci_close+0x13/0x40 [ 351.231957][ T9615] ? _raw_spin_unlock_irq+0x3c/0x40 [ 351.237173][ T9615] ? _printk+0xda/0x130 [ 351.241355][ T9615] ? virtual_nci_close+0x13/0x40 [ 351.246319][ T9615] ? mutex_lock_nested+0x10/0x10 [ 351.251278][ T9615] ? load_image+0x410/0x410 [ 351.255820][ T9615] ? nci_send_cmd+0x1db/0x320 [ 351.260512][ T9615] virtual_nci_close+0x13/0x40 [ 351.265377][ T9615] nci_close_device+0x383/0x600 [ 351.270259][ T9615] ? __kmem_cache_free+0xb6/0x200 [ 351.275305][ T9615] ? nci_unregister_device+0x250/0x250 [ 351.280790][ T9615] nci_unregister_device+0x5e/0x250 [ 351.286008][ T9615] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 351.292017][ T9615] ? __lock_acquire+0x7c40/0x7c40 [ 351.297064][ T9615] ? virtual_ncidev_open+0xc0/0xc0 [ 351.302223][ T9615] virtual_ncidev_close+0x55/0x90 [ 351.307273][ T9615] __fput+0x20a/0x8b0 [ 351.311336][ T9615] task_work_run+0x1d0/0x260 [ 351.315987][ T9615] ? task_work_cancel+0x220/0x220 [ 351.321033][ T9615] ? __close_range+0x20c/0x770 [ 351.325827][ T9615] ? exit_to_user_mode_loop+0x3b/0x110 [ 351.331317][ T9615] exit_to_user_mode_loop+0xe6/0x110 [ 351.336681][ T9615] exit_to_user_mode_prepare+0xee/0x180 [ 351.342253][ T9615] syscall_exit_to_user_mode+0x16/0x40 [ 351.347761][ T9615] do_syscall_64+0x58/0xa0 [ 351.352228][ T9615] ? clear_bhb_loop+0x60/0xb0 [ 351.356940][ T9615] ? clear_bhb_loop+0x60/0xb0 [ 351.361680][ T9615] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 351.367624][ T9615] RIP: 0033:0x7f6c5d59e159 [ 351.372108][ T9615] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 351.391803][ T9615] RSP: 002b:00007ffcf16c8ed8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 351.400243][ T9615] RAX: 0000000000000000 RBX: 00007f6c5d827da0 RCX: 00007f6c5d59e159 [ 351.408233][ T9615] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 351.416226][ T9615] RBP: 00007f6c5d827da0 R08: 0000000000000006 R09: 0000000000000000 [ 351.424217][ T9615] R10: 00007f6c5d827cb0 R11: 0000000000000246 R12: 00000000000550ae [ 351.432235][ T9615] R13: 00007f6c5d82618c R14: 0000000000054e47 R15: 00007f6c5d826180 [ 351.440231][ T9615] [ 351.549436][ T9713] device syzkaller0 entered promiscuous mode